From 4566c6d22b49081c6690e8667f4ee99a4e6fc44f Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 25 Aug 2026 14:57:46 +0530
Subject: [PATCH 01/53] fix(clerk): retry sign-in init on a network failure
 instead of a dead-end error

The tray auto-launches at OS login/restart, often before the network is
up. initClerk() then rejects (no live-API fetch to fall back from), and
ClerkErrorBoundary showed a permanent "check CLERK_PUBLISHABLE_KEY and
restart" message - wrong, since the key was fine and the app is fully
blocked behind sign-in until the user force-quits and relaunches by hand.

isLikelyClerkNetworkError classifies the rejection (navigator.onLine +
known connection-failure text from both the Rust/reqwest stack and the
JS fetch stack). A network-looking failure now shows a clearer message
and retries automatically on the browser's `online` event or a capped
backoff timer; a genuine misconfiguration keeps the original message.
---
 ui/__tests__/clerkNetworkError.test.ts     | 62 ++++++++++++++++++++++
 ui/app/setup/signin/ClerkErrorBoundary.tsx | 45 +++++++++++++---
 ui/app/setup/signin/ClerkGate.tsx          | 59 +++++++++++++++++---
 ui/lib/clerkNetworkError.ts                | 61 +++++++++++++++++++++
 4 files changed, 214 insertions(+), 13 deletions(-)
 create mode 100644 ui/__tests__/clerkNetworkError.test.ts
 create mode 100644 ui/lib/clerkNetworkError.ts

diff --git a/ui/__tests__/clerkNetworkError.test.ts b/ui/__tests__/clerkNetworkError.test.ts
new file mode 100644
index 000000000..cd3f9416d
--- /dev/null
+++ b/ui/__tests__/clerkNetworkError.test.ts
@@ -0,0 +1,62 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { describe, it, expect, afterEach } from 'bun:test'
+import { isLikelyClerkNetworkError } from '../lib/clerkNetworkError'
+
+// Regression coverage for a real report: a staging build showed "Sign-in
+// couldn't start - check CLERK_PUBLISHABLE_KEY and restart" on a Mac right
+// after a machine restart, with a correctly-configured key. Root cause: the
+// tray auto-launches at login before the OS has network up, so `clerk.load()`
+// rejects on a connection failure - `ClerkErrorBoundary` showed the
+// misconfiguration message for what was actually a transient offline window.
+// This classifier is what lets the boundary tell the two apart.
+
+describe('isLikelyClerkNetworkError', () => {
+  afterEach(() => {
+    // @ts-expect-error -- test-only override of a read-only DOM property
+    delete global.navigator
+  })
+
+  it('is true for a reqwest/clerk-fapi-rs connection failure (Rust side)', () => {
+    expect(isLikelyClerkNetworkError(new Error(
+      'error trying to connect: dns error: failed to lookup address information: nodename nor servname provided, or not known',
+    ))).toBe(true)
+  })
+
+  it('is true for a plain "error sending request" reqwest wrapper', () => {
+    expect(isLikelyClerkNetworkError(new Error('error sending request for url (https://clerk.meridiona.com/v1/client)'))).toBe(true)
+  })
+
+  it('is true for the browser fetch failure wording (JS-side Clerk load)', () => {
+    expect(isLikelyClerkNetworkError(new Error('Failed to fetch'))).toBe(true)
+    expect(isLikelyClerkNetworkError(new Error('NetworkError when attempting to fetch resource.'))).toBe(true)
+  })
+
+  it('is true for a Safari-style offline message', () => {
+    expect(isLikelyClerkNetworkError('The Internet connection appears to be offline.')).toBe(true)
+  })
+
+  it('is true for a Chromium net-error code', () => {
+    expect(isLikelyClerkNetworkError(new Error('net::ERR_INTERNET_DISCONNECTED'))).toBe(true)
+  })
+
+  it('is true whenever the browser itself reports offline, regardless of message', () => {
+    // @ts-expect-error -- test-only global override
+    global.navigator = { onLine: false }
+    expect(isLikelyClerkNetworkError(new Error('some completely unrelated error text'))).toBe(true)
+  })
+
+  it('is false for a malformed/wrong-instance publishable key error', () => {
+    expect(isLikelyClerkNetworkError(new Error('Missing publishableKey'))).toBe(false)
+    expect(isLikelyClerkNetworkError(new Error('Clerk: Missing publishable_key'))).toBe(false)
+  })
+
+  it('is false for an unrelated JS error', () => {
+    expect(isLikelyClerkNetworkError(new TypeError('Cannot read properties of undefined'))).toBe(false)
+  })
+
+  it('handles non-Error rejection shapes without throwing', () => {
+    expect(isLikelyClerkNetworkError(undefined)).toBe(false)
+    expect(isLikelyClerkNetworkError(null)).toBe(false)
+    expect(isLikelyClerkNetworkError({ code: 'native_api_disabled' })).toBe(false)
+  })
+})
diff --git a/ui/app/setup/signin/ClerkErrorBoundary.tsx b/ui/app/setup/signin/ClerkErrorBoundary.tsx
index d21a17b78..6d6e81834 100644
--- a/ui/app/setup/signin/ClerkErrorBoundary.tsx
+++ b/ui/app/setup/signin/ClerkErrorBoundary.tsx
@@ -3,6 +3,21 @@
 
 import { Component } from 'react'
 import type { ReactNode } from 'react'
+import { isLikelyClerkNetworkError } from '@/lib/clerkNetworkError'
+import { Btn } from '../atoms'
+
+type Props = {
+  children: ReactNode
+  /** Re-mounts the gated subtree with a fresh `initClerk()` call - see
+   *  `ClerkGate`, which passes a `key`-bumping callback so this boundary's own
+   *  `failed` state resets along with it. */
+  onRetry: () => void
+  /** Reported so `ClerkGate` can schedule an automatic retry (backoff timer +
+   *  an `online` listener) when the failure looks like "no network yet"
+   *  rather than a real misconfiguration - that orchestration needs to
+   *  survive across remounts of this boundary, so it lives one level up. */
+  onError: (error: unknown) => void
+}
 
 /** Catches `initClerk()` rejecting inside `ClerkGate`'s `use()` call and shows a
  *  message instead of leaving Suspense's child throw uncaught, which would
@@ -12,23 +27,39 @@ import type { ReactNode } from 'react'
  *  NOTE the "no key at all" case does NOT reach here: `sign_in_required`
  *  (`commands::account`) reports false for a debug build with no key, and the
  *  gates skip Clerk entirely rather than mounting a `ClerkGate` that is certain
- *  to fail. So what lands here is a key that IS configured and still didn't
- *  init — malformed, or the wrong instance — which is why the copy points at
- *  the value being bad rather than missing. */
-export class ClerkErrorBoundary extends Component<{ children: ReactNode }, { failed: boolean }> {
-  state: { failed: boolean } = { failed: false }
+ *  to fail. So what lands here is either a key that IS configured and still
+ *  didn't init, or a transient network failure - see `isLikelyClerkNetworkError`
+ *  for how those two are told apart, and why they need different copy: a real
+ *  misconfiguration needs a rebuild, but a login-item launch that raced the
+ *  OS's own network bring-up just needs a moment (v1.90.0 staging report:
+ *  `docs/vision.md`-adjacent - this is the exact "worked after I reconnected"
+ *  case, not a bad key). */
+export class ClerkErrorBoundary extends Component<Props, { failed: boolean; networkIssue: boolean }> {
+  state: { failed: boolean; networkIssue: boolean } = { failed: false, networkIssue: false }
 
-  static getDerivedStateFromError() {
-    return { failed: true }
+  static getDerivedStateFromError(error: unknown) {
+    return { failed: true, networkIssue: isLikelyClerkNetworkError(error) }
   }
 
   componentDidCatch(error: unknown) {
     // eslint-disable-next-line no-console -- surfaced nowhere else; this is a dev/misconfiguration signal
     console.error('setup: Clerk sign-in unavailable', error)
+    this.props.onError(error)
   }
 
   render() {
     if (this.state.failed) {
+      if (this.state.networkIssue) {
+        return (
+          <div style={{ display: 'flex', flexDirection: 'column', gap: 8, alignItems: 'flex-start' }}>
+            <p style={{ fontSize: 12.5, color: 'var(--t-muted)' }}>
+              Sign-in couldn&apos;t reach the network. Meridian will retry automatically once
+              you&apos;re back online.
+            </p>
+            <Btn variant="secondary" size="sm" onClick={this.props.onRetry}>Retry now</Btn>
+          </div>
+        )
+      }
       return (
         <p style={{ fontSize: 12.5, color: 'var(--t-muted)' }}>
           Sign-in couldn&apos;t start - check CLERK_PUBLISHABLE_KEY and restart.
diff --git a/ui/app/setup/signin/ClerkGate.tsx b/ui/app/setup/signin/ClerkGate.tsx
index 58c9b3391..cedcf2c0d 100644
--- a/ui/app/setup/signin/ClerkGate.tsx
+++ b/ui/app/setup/signin/ClerkGate.tsx
@@ -9,12 +9,13 @@
 // about the bootstrap is identical, so it lives here once instead of being
 // duplicated across both widgets.
 
-import { Suspense, use, useState } from 'react'
+import { Suspense, use, useCallback, useEffect, useRef, useState } from 'react'
 import type { ReactNode } from 'react'
 import { ClerkProvider } from '@clerk/react'
 // eslint-disable-next-line @typescript-eslint/no-var-requires -- no type defs shipped for this community plugin
 import { initClerk } from 'tauri-plugin-clerk'
 import { isTauri } from '@/lib/bridge'
+import { isLikelyClerkNetworkError } from '@/lib/clerkNetworkError'
 import { ClerkErrorBoundary } from './ClerkErrorBoundary'
 
 // The initialised clerk instance's type isn't exported by this community
@@ -32,22 +33,68 @@ function ClerkResolve({ clerkPromise, children }: {
   )
 }
 
+const INITIAL_RETRY_MS = 5_000
+const MAX_RETRY_MS = 60_000
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- see ClerkResolve
+type Attempt = { key: number; clerkPromise: Promise<any> | null }
+
+function freshAttempt(key: number): Attempt {
+  return { key, clerkPromise: isTauri() ? initClerk() : null }
+}
+
 export function ClerkGate({ notInTauriMessage, fallback, children }: {
   notInTauriMessage: string
   fallback: ReactNode
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- see ClerkResolve
   children: (clerk: any) => ReactNode
 }) {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- see ClerkResolve
-  const [clerkPromise] = useState<Promise<any> | null>(() => (isTauri() ? initClerk() : null))
+  // `retry()` replaces BOTH the promise `use()` resolves and the boundary's
+  // `key` in one update, so a retry always means a genuinely new
+  // `initClerk()` call feeding a freshly-mounted (failed: false) boundary -
+  // not the same already-rejected promise re-thrown forever.
+  const [attempt, setAttempt] = useState<Attempt>(() => freshAttempt(0))
+  const retry = useCallback(() => setAttempt((prev) => freshAttempt(prev.key + 1)), [])
+
+  const backoffMs = useRef(INITIAL_RETRY_MS)
+  const pending = useRef<{ timer: ReturnType<typeof setTimeout> | null; onlineListener: (() => void) | null }>({
+    timer: null,
+    onlineListener: null,
+  })
+
+  const clearPending = useCallback(() => {
+    if (pending.current.timer) clearTimeout(pending.current.timer)
+    if (pending.current.onlineListener) window.removeEventListener('online', pending.current.onlineListener)
+    pending.current = { timer: null, onlineListener: null }
+  }, [])
+
+  // Only a NETWORK-looking failure gets auto-retried - a bad key won't fix
+  // itself on a timer, so that case is left to the boundary's static message
+  // (see ClerkErrorBoundary's doc). Two independent triggers race to whichever
+  // fires first: the browser's `online` event (instant once connectivity is
+  // back) and a backoff timer (a floor for browsers/WKWebViews that don't fire
+  // `online` reliably in a login-item's background window).
+  const handleError = useCallback((error: unknown) => {
+    if (!isLikelyClerkNetworkError(error)) return
+    clearPending()
+    const onlineListener = () => { clearPending(); retry() }
+    pending.current.onlineListener = onlineListener
+    window.addEventListener('online', onlineListener)
+    pending.current.timer = setTimeout(() => { clearPending(); retry() }, backoffMs.current)
+    backoffMs.current = Math.min(backoffMs.current * 2, MAX_RETRY_MS)
+  }, [clearPending, retry])
+
+  const manualRetry = useCallback(() => { clearPending(); retry() }, [clearPending, retry])
+
+  useEffect(() => clearPending, [clearPending])
 
-  if (!clerkPromise) {
+  if (!attempt.clerkPromise) {
     return <p style={{ fontSize: 12.5, color: 'var(--t-muted)' }}>{notInTauriMessage}</p>
   }
   return (
-    <ClerkErrorBoundary>
+    <ClerkErrorBoundary key={attempt.key} onRetry={manualRetry} onError={handleError}>
       <Suspense fallback={fallback}>
-        <ClerkResolve clerkPromise={clerkPromise}>{children}</ClerkResolve>
+        <ClerkResolve clerkPromise={attempt.clerkPromise}>{children}</ClerkResolve>
       </Suspense>
     </ClerkErrorBoundary>
   )
diff --git a/ui/lib/clerkNetworkError.ts b/ui/lib/clerkNetworkError.ts
new file mode 100644
index 000000000..e5538ef75
--- /dev/null
+++ b/ui/lib/clerkNetworkError.ts
@@ -0,0 +1,61 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+
+// Classifies why `tauri-plugin-clerk`'s `initClerk()` rejected: a machine with
+// no network yet (the login-item auto-launch races the OS's own network
+// bring-up, so `clerk.load()`'s live-API fetch has nothing to reach) versus an
+// actual misconfiguration (a malformed/wrong-instance publishable key).
+// `ClerkErrorBoundary` uses this to pick copy that matches the real cause -
+// "check CLERK_PUBLISHABLE_KEY" is true for the second case and actively wrong
+// for the first, since the key is fine and the fix is just waiting for a
+// connection.
+//
+// The Rust side (`clerk.load()` via clerk-fapi-rs -> reqwest) and the JS side
+// (`@clerk/clerk-js`'s own fetch, and the CDN fetch for prebuilt UI) can each
+// be the one that rejects, on either OS, so this matches substrings from both
+// stacks rather than one platform's wording. False negatives (a network error
+// misread as "other") just fall back to the pre-existing generic message, so
+// the list is kept broad on purpose.
+const NETWORK_ERROR_PATTERNS = [
+  'error trying to connect',
+  'error sending request',
+  'dns error',
+  'failed to lookup address',
+  'connection refused',
+  'network is unreachable',
+  'network is down',
+  'could not connect',
+  'timed out',
+  'operation timed out',
+  'failed to fetch',
+  'load failed',
+  'networkerror',
+  'internet connection appears to be offline',
+  'err_internet_disconnected',
+  'err_network_changed',
+  'err_name_not_resolved',
+]
+
+function errorText(error: unknown): string {
+  if (error instanceof Error) return error.message
+  if (typeof error === 'string') return error
+  if (error === null || error === undefined) return ''
+  try {
+    // JSON.stringify returns `undefined` (not a string) for values like a bare
+    // function, which would otherwise crash the caller's .toLowerCase().
+    return JSON.stringify(error) ?? String(error)
+  } catch {
+    return String(error)
+  }
+}
+
+/** True when `initClerk()`'s rejection looks like "no network yet", not a bad
+ *  key. Combines two independent signals: the browser's own connectivity flag
+ *  (unavailable outside a browser-like runtime, hence the `typeof` guard) and
+ *  substring-matching the error text against known network-failure wording
+ *  from reqwest, `@clerk/clerk-js`'s fetch, and Chromium's net-error codes. */
+export function isLikelyClerkNetworkError(error: unknown): boolean {
+  const offline = typeof navigator !== 'undefined' && navigator.onLine === false
+  if (offline) return true
+  const text = errorText(error).toLowerCase()
+  return NETWORK_ERROR_PATTERNS.some((pattern) => text.includes(pattern))
+}

From 23b4a6604e9335c693f6dd975fb022695cf207f9 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 25 Aug 2026 20:42:04 +0530
Subject: [PATCH 02/53] fix(ui): cut What's New down to a title and one
 sentence per entry

Release notes had grown to paragraph-long bullets split across
highlights and fixes - 1.90.0 alone ran to twelve entries, several of
them sixty words. Notes nobody finishes reading are notes nobody reads.

Replace both lists with a single `items` array of {title, body}, capped
at three per release, and rewrite all 29 releases (and the roadmap
descriptions) to that shape. Which bucket a change came from is our
concern, not the reader's, so the highlights/fixes split and its
bullet/FIXES chrome are gone.

`release_notes_stay_short` enforces the limits (<=3 items, title <=44
chars, body <=160) rather than trusting curation - without it the file
drifts back to pasted commit messages within a few releases.
---
 CLAUDE.md                                |   2 +-
 tray/src-tauri/resources/whats-new.json  | 612 ++++++++++++-----------
 tray/src-tauri/src/commands/whats_new.rs |  48 +-
 ui/components/timeline/WhatsNewModal.tsx |  37 +-
 ui/lib/api-types.ts                      |   9 +-
 5 files changed, 386 insertions(+), 322 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index a608e4e53..787751cbc 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -602,7 +602,7 @@ the packaged-build test recipe). In short:
 The dashboard's "What's New" modal (`ui/components/timeline/WhatsNewModal.tsx`, opened via the toolbar nav pill or auto-opened once per app version by the tray's `poll::whats_new_auto_open`) is **hand-curated**, deliberately separate from the auto-generated `CHANGELOG.md` — that file is commit-level and too internal to show end users (e.g. `hf-proxy: bake MERIDIAN_HF_ENDPOINT into the staging channel`).
 
 1. Edit `tray/src-tauri/resources/whats-new.json` (compiled into the tray binary via `include_str!`, not Tauri resource-bundling — a rebuild always picks up the change).
-2. Add a new object to the front of `releases` (newest-first): `version`, `date`, `highlights` (features, user-facing language), `fixes`. Rewrite each bullet in plain user terms — never paste a commit message verbatim.
+2. Add a new object to the front of `releases` (newest-first): `version`, `date`, and `items` — **at most three**, each a short `title` (≤44 chars) plus a `body` of **one short sentence** (≤160 chars). There is deliberately no highlights/fixes split: which bucket a change came from is our concern, not the reader's, and the split doubled the length of every entry. `release_notes_stay_short` in `whats_new.rs` fails the build if these limits are exceeded — they are the feature, not a style preference, because notes nobody finishes reading are notes nobody reads. Pick the two or three changes a user would actually notice and drop the rest; never paste a commit message verbatim.
 3. Update `roadmap` if upcoming plans changed — `status` is `in-progress` | `planned` | `considering`.
 4. Every string in this file is user-facing app text — plain hyphen `-` only, no em-dash, per the Hard Rules at the top of this file.
 5. `cargo test -p meridian-tray` (from `tray/src-tauri/`) covers `whats_new_json_parses`, which fails the build if the JSON doesn't match the expected shape.
diff --git a/tray/src-tauri/resources/whats-new.json b/tray/src-tauri/resources/whats-new.json
index c9287e9dc..75e7375ab 100644
--- a/tray/src-tauri/resources/whats-new.json
+++ b/tray/src-tauri/resources/whats-new.json
@@ -3,433 +3,463 @@
     {
       "version": "1.90.0",
       "date": "2026-08-24",
-      "highlights": [
-        "Meridian now starts itself reliably, and comes back when you actually start work rather than at a time we picked. It used to register once and never check again, so moving the app to Applications, reinstalling, or restoring it from the Bin could leave it unable to start at login with nothing to tell you - and because Meridian records your day from the app itself, a launch that never happened meant a day with nothing in it. It now checks and repairs that registration every single launch, and the next-day restart triggers on your Mac or PC waking, unlocking or signing in, instead of a fixed hour that missed you if your laptop was shut at the time.",
-        "On macOS, Meridian now appears by name under System Settings - General - Login Items & Extensions, so you can see it and turn it off there like any other app. It used to install itself as an unnamed background job, and uninstalling left that job behind pointing at an app that no longer existed.",
-        "If your project tool is not one we support yet, you can now tell us which one you use instead of being stuck on that step."
-      ],
-      "fixes": [
-        "Creating a task on GitHub from your daily plan works properly now. It used to fail outright if your project board had no GitHub task on it yet, and even when it worked the new issue never came back into Meridian - it was created but never added to your board or assigned to you, which is what Meridian looks for. New tasks are now filed, assigned to you and placed on your board. You will need to reconnect GitHub in Settings - Integrations once, because adding an issue to a board needs a permission the old connection did not ask for.",
-        "The end-of-day time you pick during the guided tour is actually saved. The tour would move on as though you had answered, and Settings still showed the old default afterwards.",
-        "The guided tour no longer gets stuck on that same question. Dismissing the dialog could leave the tour waiting on a button that was no longer on screen, and it pointed at the Turn on button before choosing a time had switched it on.",
-        "The end-of-day time dialog no longer appears twice if you skip the tour while it is opening, and it now asks you to pick a time before it will save.",
-        "Meridian no longer reports your project tool as failing to sync just because your laptop was asleep. A gap in time was being treated the same as a run of failures, so the first attempt after waking raised a warning about a tracker that was working fine.",
-        "Signing in sticks across a relaunch. A session that was still loading reported an empty status, which Meridian read as a failed sign-in and quietly dropped, so you were shown the sign-in screen again.",
-        "Several fixes that protect your database around a restart: the write-ahead log is now flushed cleanly when the daemon stops, damage is spotted from Meridian's own reads rather than waiting for a scan, an automatic repair that fails now falls back to a fresh start instead of leaving you stuck, and Meridian no longer holds a connection open across a daemon restart.",
-        "On Windows, an automatic repair no longer gives up when a file is briefly locked by another process, and updating your start-at-login setting no longer closes Meridian while it does so.",
-        "The tray popover has a cleaner edge - the window is clipped to its own rounded corners and no longer draws a second shadow behind it."
+      "items": [
+        {
+          "title": "Starts reliably, every time",
+          "body": "Meridian repairs its own start-at-login registration on every launch, and comes back when your machine wakes instead of at a fixed hour."
+        },
+        {
+          "title": "GitHub tasks from your plan",
+          "body": "New issues are filed, assigned to you and placed on your board - reconnect GitHub in Settings once to grant the permission this needs."
+        },
+        {
+          "title": "Steadier around restarts",
+          "body": "Several fixes protect your database when Meridian stops, restarts or repairs itself."
+        }
       ]
     },
     {
       "version": "1.89.0",
       "date": "2026-08-20",
-      "highlights": [
-        "Ollama Cloud joins the setup wizard as a free, no-subscription way to draft with AI, and is now the one we recommend if you don't already have a subscription. Groq is being retired from active use - if you're currently on it, Settings will show a notice pointing you to Ollama, and your configuration stays exactly as you left it until you switch.",
-        "Settings now shows exactly what daily usage reporting sends - a health snapshot alongside the counts, never your screen activity or anything you wrote - and a new switch lets you turn it off separately from error reporting, without losing crash reports."
-      ],
-      "fixes": [
-        "Signing in sticks even on a cold start with no network. A session that was still loading could report its status as empty, which Meridian was reading as a failed sign-in and quietly dropping - so a user who had genuinely signed in before would see the sign-in screen anyway.",
-        "Codex and Cursor sign-in are detected more reliably. A browser sign-in that visibly succeeded could still get reported back to Meridian as failed; it no longer does.",
-        "Draft with AI on Cursor no longer takes up to a minute when it usually takes seconds.",
-        "A brief network or provider hiccup no longer flips your AI provider to unavailable and stops your day from being written - Meridian retries once before giving up.",
-        "Several worklog drafts falling behind in the same hour now arrive as one notification instead of landing all at once.",
-        "Drafting stopped failing with a hidden schema error on some custom AI endpoints.",
-        "Coding-agent session summaries no longer silently fail to generate on some setups.",
-        "A database repair that fails on launch now retries automatically within the same session instead of leaving Meridian stuck until you relaunch.",
-        "Testing a specific AI provider's connection is more reliable when you have more than one free-tier key configured - it could fail outright, or show one endpoint's result on another's card."
+      "items": [
+        {
+          "title": "Ollama Cloud, free to use",
+          "body": "A no-subscription way to draft with AI, and the one we now recommend if you don't already have a subscription."
+        },
+        {
+          "title": "Usage reporting you can switch off",
+          "body": "Settings shows exactly what daily usage reporting sends, with its own switch separate from error reports."
+        },
+        {
+          "title": "Sign-in and drafting fixes",
+          "body": "Signing in sticks on a cold start, and a brief provider hiccup no longer stops your day being written."
+        }
       ]
     },
     {
       "version": "1.88.0",
       "date": "2026-08-17",
-      "highlights": [
-        "The guided tour no longer blocks the very buttons it asks you to press. Choosing your project tool, answering the AI question, even typing a task title - the tour was covering all of it, so you could read the instruction but not follow it, and the step only moved on when it timed out minutes later.",
-        "The daily summary now updates a work log the moment you post it. A row you had just filed still said DRAFT READY TO POST, in the colour reserved for things that need you, until you closed the summary and opened it again.",
-        "The installer now says to open Meridian after dragging it. A disk image cannot start an app itself, so the app sat in Applications doing nothing while the window that put it there gave no hint a second step was left."
-      ],
-      "fixes": [
-        "Permission warnings no longer fire on launch when nothing is wrong. Rebuilding or updating the app made macOS report Screen Recording and Accessibility as off for a moment; the toast fired on that first read and then cleared itself. A permission now has to read off for five minutes before you hear about it.",
-        "The tour no longer leaves the app clickable while it narrates over a window it opened. A stray click could close the modal it was describing, after which it carried on explaining a screen that was no longer there.",
-        "The planner no longer reports Sync failed for a sync that worked.",
-        "The setup wizard's permission cards line up. The Screen Recording title wraps to two lines where Accessibility does not, which pushed everything below it a line lower in that one card, and the notifications card drew a different header from the two beside it.",
-        "The setup window no longer resizes itself when macOS or Windows cannot say whether it is maximized. On Windows a resize clears the maximized state, so the window would snap back to its old size mid-wizard when you pressed Continue.",
-        "The dashboard builds no longer depend on a font downloaded at build time, which had started failing and taking the build with it.",
-        "The open-source card fits its buttons at every width, and leads with starring the repo."
+      "items": [
+        {
+          "title": "The tour stays out of your way",
+          "body": "It no longer covers the very buttons it asks you to press."
+        },
+        {
+          "title": "Work logs update as you post",
+          "body": "A row you just filed no longer keeps saying it is a draft waiting for you."
+        },
+        {
+          "title": "Fewer false permission warnings",
+          "body": "A permission has to read as off for five minutes before Meridian mentions it."
+        }
       ]
     },
     {
       "version": "1.87.0",
       "date": "2026-08-16",
-      "highlights": [
-        "Notifications on Windows can now be answered. Buttons and the reply box did nothing there - the only way a question ever closed itself was by expiring - and a notification Meridian tried to take back stayed in the Action Center with buttons that still looked live. Both now work the way they already did on Mac.",
-        "The guided tour can be replayed. Settings - Account - Show me around brings it back. Until now that control existed only in development builds, so once you finished or skipped the tour there was no way to see it again.",
-        "The tour writes your first task for you instead of waiting at an empty box. It used to ask you to invent one before you had watched Meridian draft anything, which is the wrong moment to ask - the step straight after is the one where a scruffy one-liner becomes a titled, described task."
-      ],
-      "fixes": [
-        "On Windows the dashboard no longer opens with no title bar and no taskbar. It covered the whole screen with nothing to click - no minimize, no close - and the only ways out were Alt+F4 and Alt+Tab. It now fills the usable screen with its window controls intact.",
-        "On Windows, pressing Continue in the setup wizard no longer shrinks a maximized window back down to its smaller size.",
-        "The setup wizard no longer stops on the Alerts step when there is nothing to ask. Windows switches notifications on for most apps already, so that step usually opened with its one setting done.",
-        "The setup wizard's Continue button is easier to read - the old fill was pale enough that the button looked half-disabled.",
-        "Installing an update no longer races Meridian's own health check, which could put the background service back while the file it runs from was still being replaced.",
-        "Windows no longer logs a notification error every time Meridian starts.",
-        "Pressing Generate on a work log with no AI connected now takes you somewhere. The Choose a provider button opened Settings behind the card you were still looking at, so the one route the app offers for connecting a model appeared to do nothing.",
-        "The tour no longer demonstrates generating a work log on a machine with no AI set up at all.",
-        "The tour's spotlight no longer shows square corners around a rounded card, and its narration bar no longer covers the first line of what it is talking about.",
-        "Writing a task, being sent off to connect an AI provider, and coming back now returns you to what you were typing rather than to the task list.",
-        "Finishing the tour no longer asks a second time when you want your work log written."
+      "items": [
+        {
+          "title": "Notifications work on Windows",
+          "body": "Buttons and the reply box now do what they already did on Mac."
+        },
+        {
+          "title": "Replay the guided tour",
+          "body": "Settings - Account - Show me around brings it back any time."
+        },
+        {
+          "title": "The Windows dashboard behaves",
+          "body": "It opens with its title bar and window controls intact instead of covering the whole screen."
+        }
       ]
     },
     {
       "version": "1.86.0",
       "date": "2026-08-16",
-      "highlights": [
-        "Setup now picks up where you left off. Closing the wizard part-way through used to mean starting again from the first card.",
-        "Meridian tells you when your daily summary is ready, instead of leaving you to go and look.",
-        "The dashboard opens filling the screen rather than in a small window you have to resize every time."
-      ],
-      "fixes": [
-        "Signing in sticks. Your session was being quietly dropped every time Meridian restarted, so you had to sign in again each launch.",
-        "Settings no longer crashes on builds where sign-in is switched off.",
-        "The vendored sign-in component was writing your session token into Meridian's own logs. It no longer does, and that logging is now switched off by default regardless.",
-        "The wizard's privacy wording now matches what the app actually does. It said Meridian never collects anything - true of a build you compile yourself, but not of the installed app, which sends redacted error reports and product analytics you can switch off. The download page, the privacy document and the wizard all say the same thing now.",
-        "The Notifications permission card in setup now shows the real Notifications pane rather than a stand-in, and the permission cards are highlighted one at a time instead of all at once.",
-        "The setup wizard no longer renders black when the window is in full screen.",
-        "What's New no longer opens on top of you the moment first-run setup finishes.",
-        "The walkthrough survives a stray click, and the tray's own pop-ups no longer interrupt it half way through.",
-        "Connecting GitHub no longer blames your token when GitHub simply cut the response short. Meridian retries instead."
+      "items": [
+        {
+          "title": "Setup picks up where you left off",
+          "body": "Closing the wizard part-way no longer means starting again from the first card."
+        },
+        {
+          "title": "Signing in sticks",
+          "body": "Your session is no longer quietly dropped every time Meridian restarts."
+        },
+        {
+          "title": "Told when your summary is ready",
+          "body": "Meridian tells you, instead of leaving you to go and look."
+        }
       ]
     },
     {
       "version": "1.85.0",
       "date": "2026-08-13",
-      "highlights": [
-        "Meridian shows you around the first time you open it. A guided walkthrough covers planning a day, watching your work get picked up, and having a work log written for you - starting on your own day, then on an example day so you can see a full one end to end.",
-        "Yesterday's unfinished work now moves into today on its own, so you no longer start the morning rebuilding a list you already made.",
-        "Meridian now says when a draft work log has fallen behind the work it describes, rather than letting you post something that stopped being true an hour ago."
-      ],
-      "fixes": [
-        "Uninstalling now removes your data. Some of it survived every uninstall route the app offered, which is not what uninstall means.",
-        "An update already being installed is no longer reported as 'Update failed', and an install that genuinely fails now tells every screen, so nothing is left sitting on a spinner.",
-        "Restarting the background service no longer runs into the limit macOS puts on how often a service may restart, which used to leave it stopped for minutes at a time.",
-        "A work-log draft that the AI failed to produce now points you at the reason rather than ending the flow with nothing.",
-        "Every notification now opens the thing it is about. Some of them went nowhere. The board-hygiene digest, which fired at midnight and which nobody ever acted on, is gone.",
-        "A fresh install opens setup rather than dropping you on an empty dashboard.",
-        "The work-log draft is laid out as a document you can read, and the live hour on your timeline now says which hour it means."
+      "items": [
+        {
+          "title": "A guided walkthrough",
+          "body": "Meridian shows you around the first time you open it, first on your own day and then on an example day."
+        },
+        {
+          "title": "Unfinished work rolls over",
+          "body": "Yesterday's open tasks move into today on their own."
+        },
+        {
+          "title": "Uninstall removes your data",
+          "body": "Data that used to survive an uninstall is now properly cleared."
+        }
       ]
     },
     {
       "version": "1.84.0",
       "date": "2026-08-07",
-      "highlights": [
-        "Meridian now checks its database when it starts and repairs a damaged one on its own. Until now the offer to repair lived inside the database itself, so the worst damage took the offer down with it - the app simply sat there doing nothing, with no warning and no button to press, and the only way back was a support ticket. That case now heals itself before the app finishes opening.",
-        "Quit now really does stop Meridian. The background service used to keep running after you closed the app: still watching, still holding your data file open, still making network calls. Quitting stops it, and opening Meridian starts it again.",
-        "Pause now actually pauses. The menu switched to 'Disconnected' but the background service was put straight back a few seconds later, so it kept working while the menu said it had stopped."
-      ],
-      "fixes": [
-        "The 'Repair Database' button in the damaged-database banner works again. It had been doing nothing at all since it shipped - the confirmation box it asked for never appeared, and a box nobody answered counted as 'no', so the repair was silently cancelled every time.",
-        "Repairing by hand used to be impossible for the same reason Quit was: the instructions said to close Meridian first, and closing it did not stop the part that had to stop.",
-        "Meridian can no longer get stuck refusing to quit. If something went wrong while shutting down, every later attempt to close the app was ignored and the only way out was to force it.",
-        "If a damaged database cannot be opened at all, Meridian now leaves it alone unless it can confirm the file is genuinely damaged rather than locked. A file it cannot unlock looks identical to a broken one, and the safe assumption is that your data is fine and something else is wrong.",
-        "On Windows, the instructions shown when a database needs repairing now cover installs that start Meridian from the Startup folder, not only those using a scheduled task.",
-        "Pausing while Meridian was still setting itself up no longer leaves it running behind a paused label."
+      "items": [
+        {
+          "title": "A self-repairing database",
+          "body": "Meridian checks its database at startup and rebuilds a damaged one on its own."
+        },
+        {
+          "title": "Quit really quits",
+          "body": "Closing the app now stops the background service with it."
+        },
+        {
+          "title": "Pause really pauses",
+          "body": "Pausing no longer puts the background service straight back a few seconds later."
+        }
       ]
     },
     {
       "version": "1.83.2",
       "date": "2026-08-05",
-      "highlights": [
-        "Meridian no longer reports its own background service as stopped when it is merely busy. The popover said 'Daemon: Not running' and offered a Restart button while recording carried on normally - and restarting at that moment is one of the ways the database gets damaged.",
-        "The 'database is damaged' banner now clears itself once a repair succeeds. It used to survive the very repair that fixed it, so people saw a warning about a problem that no longer existed - in one case twelve hours and two repairs later."
-      ],
-      "fixes": [
-        "Every notice banner now shows when it was raised, so a warning left over from this morning is obvious at a glance.",
-        "Fixed the background service's health check shutting down for good after one momentary error. Every screen then reported the service as stopped, next to a Restart button, while it was in fact still recording, and only restarting it cleared that.",
-        "Versions older than this one now install this update on their own rather than waiting for you to click, so a machine left on an affected build does not stay there."
+      "items": [
+        {
+          "title": "Honest service status",
+          "body": "Meridian no longer reports its background service as stopped when it is merely busy."
+        },
+        {
+          "title": "The damaged-database banner clears",
+          "body": "It now disappears once a repair succeeds, instead of outliving the fix."
+        }
       ]
     },
     {
       "version": "1.83.1",
       "date": "2026-08-04",
-      "highlights": [
-        "The Repair Database button now actually works. In the last version, clicking through it did nothing at all - the confirmation box it relied on is invisible in the app, so repairing a damaged database meant using a terminal.",
-        "Three causes of database damage on Mac are fixed. One could strike while Meridian upgraded your data to encrypted storage, one on any busy day once Meridian ran out of the file handles macOS allows it, and one when Meridian restarted its own background service in the middle of a write because a health check mistook 'busy' for 'stopped'.",
-        "When a work log action fails, Meridian now tells you why. Approving, rejecting, posting and editing used to fail silently - the row simply snapped back to its old value with no explanation."
-      ],
-      "fixes": [
-        "Fixed the one-time encryption upgrade running while the background service was still writing to your data, which could leave the database damaged. Meridian now stops the service first, checks nothing else is still using the file, and leaves your data alone entirely if it cannot.",
-        "Fixed Meridian running out of file handles on Mac, which could damage the database in the middle of a write. It now asks the system for enough at startup.",
-        "Fixed Meridian restarting its own background service roughly every 45 seconds on a busy machine. The service was healthy every time; the check that judged it simply gave up waiting too early.",
-        "On Windows machines where company policy blocks scheduled tasks, restarting no longer reports a failure every single time. The backup method was already working - only the false alarm is gone.",
-        "Error reports now say which health check failed, rather than only that one did.",
-        "Fixed the Windows build of the app, which had been broken by the database fixes above."
+      "items": [
+        {
+          "title": "Repair Database works",
+          "body": "Clicking through the repair no longer silently does nothing."
+        },
+        {
+          "title": "Three causes of database damage fixed",
+          "body": "The one-time encryption step, running out of file handles, and needless restarts of the background service."
+        },
+        {
+          "title": "Work log errors explain themselves",
+          "body": "Approving, rejecting, posting and editing now say why they failed."
+        }
       ]
     },
     {
       "version": "1.83.0",
       "date": "2026-08-03",
-      "highlights": [
-        "Meridian now notices when its own database has been damaged and can rebuild it from inside the app, with no terminal needed. Your data is salvaged into a fresh file, the damaged copy is kept as a backup and never deleted, and the background service stands down while the work happens.",
-        "A banner tells you when the database is damaged, and offers the repair right there rather than leaving you to find it."
-      ],
-      "fixes": [
-        "The Install button for Claude and Codex now works on Windows. It used to report that the installer had finished and the tool was still missing, when in fact nothing had been installed at all.",
-        "The 'provider unavailable' banner now catches an assistant that is installed, tested fine an hour ago, and has been failing every request since. Before, your day could quietly stay empty while the banner insisted everything was fine."
+      "items": [
+        {
+          "title": "Repair a damaged database in the app",
+          "body": "Your data is salvaged into a fresh file and the damaged copy is kept as a backup."
+        },
+        {
+          "title": "The Install button works on Windows",
+          "body": "Claude and Codex now genuinely install rather than just reporting success."
+        }
       ]
     },
     {
       "version": "1.82.3",
       "date": "2026-08-01",
-      "highlights": [],
-      "fixes": [
-        "A failure while Meridian was starting up no longer takes the whole app down with it. It now reports the problem and carries on.",
-        "Solo users can see their confirmed daily plan again."
+      "items": [
+        {
+          "title": "Startup failures are survivable",
+          "body": "A problem while Meridian is starting no longer takes the whole app down."
+        },
+        {
+          "title": "Solo plans are visible again",
+          "body": "Solo users can see their confirmed daily plan."
+        }
       ]
     },
     {
       "version": "1.82.2",
       "date": "2026-07-31",
-      "highlights": [
-        "A brand-new install now works on its very first launch. Meridian used to look for its database moments before the background service had created it, then never look again - so the dashboard stayed empty and nothing was recorded until you quit and reopened the app."
-      ],
-      "fixes": [
-        "Meridian no longer claims your data is encrypted under a lost key when the file is actually empty or cut short. That warning told people to contact support before removing anything, when deleting the leftover stub was all that was needed.",
-        "Meridian now refuses to create a new encryption key while your existing data is still encrypted under an older one - which would have made that data permanently unreadable. It stops and explains instead of quietly locking you out.",
-        "The tray tooltip no longer gets stranded on screen after a right-click.",
-        "Windows: notifications are no longer reported as blocked when the system simply has no record of them yet.",
-        "Windows: the background service can now open an encrypted database, instead of failing to find the settings it needed.",
-        "Dropped a health check that kept reporting a problem which no longer exists."
+      "items": [
+        {
+          "title": "First launch just works",
+          "body": "A brand-new install records from its very first launch, with no quit and reopen."
+        },
+        {
+          "title": "Clearer encryption warnings",
+          "body": "Meridian no longer claims your data is locked under a lost key when the file is simply empty."
+        }
       ]
     },
     {
       "version": "1.82.1",
       "date": "2026-07-29",
-      "highlights": [],
-      "fixes": [
-        "A behind-the-scenes release - build and packaging fixes only, with no change to how Meridian works day to day."
+      "items": [
+        {
+          "title": "A behind-the-scenes release",
+          "body": "Build and packaging fixes only, with no change to how Meridian works day to day."
+        }
       ]
     },
     {
       "version": "1.82.0",
       "date": "2026-07-29",
-      "highlights": [
-        "If you open Meridian straight from the disk image without dragging it to Applications first, it now offers to move itself there and reopen. Before, it worked for that session but could never start itself again after a restart.",
-        "Windows setup now includes a notification permission step, so reminders work from the start rather than silently doing nothing.",
-        "Meridian pauses capture when your disk is nearly full instead of writing into it. Doing so is a known way for the database to end up damaged."
-      ],
-      "fixes": [
-        "Signing in to Claude and Codex no longer fails with 'env: node: No such file or directory'.",
-        "Windows: the one-time encryption of your existing data now runs to completion, instead of being blocked by the background service still holding the file open.",
-        "If the background service cannot start at all, that now reaches the team as an error report. It used to be completely invisible from our side."
+      "items": [
+        {
+          "title": "Move to Applications on first run",
+          "body": "Opened straight from the disk image, Meridian offers to move itself there and reopen."
+        },
+        {
+          "title": "Notification permission on Windows",
+          "body": "Setup now asks for it, so reminders work from the start."
+        },
+        {
+          "title": "Pauses when your disk is nearly full",
+          "body": "Writing into a full disk is a known way for the database to end up damaged."
+        }
       ]
     },
     {
       "version": "1.81.0",
       "date": "2026-07-28",
-      "highlights": [
-        "If Meridian cannot finish encrypting your data because a copy of it is still running, it now says so plainly and tells you how to finish the job - rather than quietly leaving your database unencrypted.",
-        "While you are signed in, your Support ID now stays the same across all of your devices, so support can piece together what happened if you are testing an early build."
-      ],
-      "fixes": [
-        "Fixed Meridian being unable to open its own database after an interrupted encryption step. On Windows this could stop tracking altogether, and it did not recover on its own.",
-        "Tracker sync no longer tells you to check your credentials when the real problem is a passing network glitch. It stays quiet, retries on its own, and only raises it if the connection stays broken.",
-        "When a sync problem does need you, the message now says what actually went wrong and points you to Settings - instead of naming a file most people have never opened.",
-        "Tracker sync can no longer hang forever waiting on a server that has stopped responding."
+      "items": [
+        {
+          "title": "Clearer encryption messages",
+          "body": "If Meridian cannot finish encrypting your data, it says so plainly and tells you how to finish the job."
+        },
+        {
+          "title": "Calmer tracker sync",
+          "body": "A passing network glitch no longer looks like a credentials problem."
+        }
       ]
     },
     {
       "version": "1.80.0",
       "date": "2026-07-28",
-      "highlights": [
-        "Everything Meridian has captured is now encrypted on disk. The key is kept in your system keychain, and your existing data is upgraded automatically the first time you open this version - there is nothing to set up.",
-        "Meridian can now send error reports to the team automatically, so crashes and failures get fixed without you having to report them. It is on by default and you can turn it off any time in Settings - Capture.",
-        "Everything identifying is stripped on your device before a report is sent - file paths, web addresses, email addresses, and your computer's name. Your screen activity, OCR text, and window titles are never included.",
-        "A new Support ID in Settings - Account. Quote it when you contact us and we can find the errors from your device, without it being linked to your account."
-      ],
-      "fixes": [
-        "Error reports now work on Windows. They were silently never being sent.",
-        "Problems in screen capture and accessibility - the parts that read what is on screen - are now reported, so a device that quietly stops capturing can be spotted instead of just looking like an idle day.",
-        "Error reports now carry the actual reason something failed, instead of only naming the step that failed."
+      "items": [
+        {
+          "title": "Your data is encrypted on disk",
+          "body": "The key lives in your system keychain and your existing data is upgraded automatically."
+        },
+        {
+          "title": "Automatic error reports",
+          "body": "Crashes reach us without you reporting them, and you can turn this off in Settings - Capture."
+        },
+        {
+          "title": "Nothing identifying leaves your device",
+          "body": "Paths, web addresses, email addresses and your computer's name are stripped before anything is sent."
+        }
       ]
     },
     {
       "version": "1.79.0",
       "date": "2026-07-24",
-      "highlights": [
-        "Claude, Codex, and Cursor now sign in and run on Windows the same way they do on a Mac.",
-        "Meridian restores its own launch-at-login setting if it ever gets cleared, so tracking does not quietly stop after a restart.",
-        "Notification settings are now a single switch plus quiet hours, instead of a list of per-type toggles."
-      ],
-      "fixes": [
-        "Fixed sign-in for Claude, Codex, and Cursor on Windows, including prompts that were being dropped.",
-        "A brief network problem no longer leaves Jira showing a stuck sync error.",
-        "Export Diagnostics is reachable again, now under Settings - Account."
+      "items": [
+        {
+          "title": "AI providers on Windows",
+          "body": "Claude, Codex and Cursor sign in and run the same way they do on a Mac."
+        },
+        {
+          "title": "Launch at login repairs itself",
+          "body": "Tracking no longer quietly stops after a restart."
+        },
+        {
+          "title": "Simpler notification settings",
+          "body": "One switch plus quiet hours, instead of a list of per-type toggles."
+        }
       ]
     },
     {
       "version": "1.78.0",
       "date": "2026-07-23",
-      "highlights": [
-        "Meridian notices within about ten seconds if its background service stops, and restarts it for you.",
-        "You can delete personal tasks you created, and dismiss or merge the tasks Meridian infers from your day.",
-        "The daily plan now holds up to 20 tasks, up from 10."
-      ],
-      "fixes": [
-        "Fixed the background service failing to restart on Windows, and a console window that flashed on screen.",
-        "The Tasks board refreshes immediately after you delete a personal task.",
-        "Uninstalling now also clears cached app data and permission grants."
+      "items": [
+        {
+          "title": "The background service restarts itself",
+          "body": "Meridian notices within about ten seconds if it stops."
+        },
+        {
+          "title": "Tidy up your tasks",
+          "body": "Delete personal tasks, and dismiss or merge the ones Meridian infers from your day."
+        },
+        {
+          "title": "Room for 20 tasks a day",
+          "body": "The daily plan now holds twice as many as before."
+        }
       ]
     },
     {
       "version": "1.77.0",
       "date": "2026-07-22",
-      "highlights": [
-        "A rebuilt daily summary, organised around what you planned versus what you actually did, with a progress ring and a single checklist.",
-        "Composing the summary has its own screen now, and it composes itself at the end of the day.",
-        "Worklogs can turn a personal task into a real ticket, and write a tailored update for each ticket you moved forward.",
-        "The date picker is now a proper interactive calendar."
-      ],
-      "fixes": [
-        "Fixed a crash in accessibility capture when the recorder restarted."
+      "items": [
+        {
+          "title": "A rebuilt daily summary",
+          "body": "Organised around what you planned versus what you actually did, with a progress ring and a single checklist."
+        },
+        {
+          "title": "Summaries compose themselves",
+          "body": "Your summary is written at the end of the day, on a screen of its own."
+        },
+        {
+          "title": "A work log per ticket",
+          "body": "A tailored update for every ticket you moved forward."
+        }
       ]
     },
     {
       "version": "1.76.0",
       "date": "2026-07-22",
-      "highlights": [
-        "Meridian captures context from secondary monitors, not only the screen you are focused on.",
-        "Connected tracker cards have View tasks and Sync now buttons.",
-        "Jira gets a multi-select project picker, matching the one GitHub already had."
-      ],
-      "fixes": [
-        "Fixed connecting an account not opening a browser on Windows.",
-        "Fixed the task list briefly showing stale results while loading."
+      "items": [
+        {
+          "title": "Secondary monitors are captured",
+          "body": "Meridian reads context from every screen, not only the one you are focused on."
+        },
+        {
+          "title": "Act on a tracker from its card",
+          "body": "View tasks and Sync now sit right where the tracker is connected."
+        }
       ]
     },
     {
       "version": "1.75.1",
       "date": "2026-07-22",
-      "highlights": [],
-      "fixes": [
-        "Fixed Meridian finding and launching your AI provider CLIs on Windows.",
-        "Fixed the popover position, tooltips, onboarding, and setup wizard on Windows.",
-        "Meridian now reads your real Windows notification and permission settings instead of assuming they are off."
+      "items": [
+        {
+          "title": "Windows polish",
+          "body": "Your AI provider tools are found, and the popover, tooltips and setup wizard all behave."
+        }
       ]
     },
     {
       "version": "1.75.0",
       "date": "2026-07-21",
-      "highlights": [
-        "Signing in is now required across the dashboard and the tray popover.",
-        "The plan's task detail can change a task's status, including for personal tasks.",
-        "You can choose which tracker a proposed ticket gets created on.",
-        "A Refresh button on the daily plan once a tracker is connected."
-      ],
-      "fixes": [
-        "Streamlined the GitHub connect flow, including the device-code step and picking projects."
+      "items": [
+        {
+          "title": "Sign-in across the app",
+          "body": "The dashboard and the tray popover now both require signing in."
+        },
+        {
+          "title": "Change a task's status from its detail",
+          "body": "Personal tasks included."
+        },
+        {
+          "title": "Choose where a ticket is created",
+          "body": "Pick the tracker a proposed ticket gets filed on."
+        }
       ]
     },
     {
       "version": "1.74.0",
       "date": "2026-07-20",
-      "highlights": [
-        "Worklogs can draft themselves once a day, at a time you choose."
-      ],
-      "fixes": [
-        "Fixed the GitHub project picker not saving after connecting an account.",
-        "Fixed Dock and menu-bar icon rendering."
+      "items": [
+        {
+          "title": "Work logs draft themselves",
+          "body": "Once a day, at a time you choose."
+        },
+        {
+          "title": "The GitHub project picker saves",
+          "body": "Your board selection now sticks after connecting."
+        }
       ]
     },
     {
       "version": "1.73.0",
       "date": "2026-07-20",
-      "highlights": [
-        "Windows support. The full app - background service, tray, notifications, and installer - now runs on Windows.",
-        "Choosing a model is now a picker with a curated list, instead of typing the model name yourself."
-      ],
-      "fixes": [
-        "Fixed screen capture on macOS 26.",
-        "Hardened worklog and activity processing so a failure surfaces instead of passing silently.",
-        "Bounded the memory and time the on-device text model can use."
+      "items": [
+        {
+          "title": "Windows support",
+          "body": "The background service, tray, notifications and installer all run on Windows."
+        },
+        {
+          "title": "Pick a model from a list",
+          "body": "A curated picker, instead of typing the model name yourself."
+        }
       ]
     },
     {
       "version": "1.72.0",
       "date": "2026-07-18",
-      "highlights": [
-        "Choose apps and websites for Meridian to ignore, so nothing from them is ever captured. Set them up in Settings.",
-        "Bring your own cloud AI provider: add any OpenAI-compatible endpoint from the provider picker and Meridian will use it for worklogs and summaries.",
-        "Test your AI provider connection from Settings or during setup, so you can confirm it works before relying on it.",
-        "A new AI-composed daily summary that reads like a summary of your day, with the charts chosen to fit what actually happened.",
-        "The day timeline shows the current hour as a live strip again, so you can watch the hour fill in as you work.",
-        "Worklogs now follow the day's plan and post to every ticket you actually moved forward.",
-        "Added a \"suggest a feature\" link to the roadmap in What's New."
-      ],
-      "fixes": [
-        "Fixed a memory leak that made Meridian's memory use climb while screen capture was running.",
-        "Fixed duplicate and missing worklogs when the same hour was processed more than once.",
-        "Fixed worklog drafting failing on the Codex provider, and it now reports the real reason when it does fail.",
-        "Fixed a failed update showing a stale download percentage when you retried it.",
-        "Fixed modals scrolling instead of fitting, clipped task titles, and changing a task's status from Cleanup.",
-        "Fixed a task card's summary clipping mid-line instead of leaving room for the \"+N more\" label.",
-        "Made the AI provider picker easier to read."
+      "items": [
+        {
+          "title": "Ignore apps and websites",
+          "body": "Choose what Meridian never captures, in Settings."
+        },
+        {
+          "title": "Bring your own AI provider",
+          "body": "Add any OpenAI-compatible endpoint from the provider picker."
+        },
+        {
+          "title": "An AI-composed daily summary",
+          "body": "It reads like a summary of your day, with the charts chosen to fit what happened."
+        }
       ]
     },
     {
       "version": "1.71.0",
       "date": "2026-07-15",
-      "highlights": [
-        "Redesigned dashboard look: refined typography, a single violet accent, and real per-app brand colors.",
-        "Sign in with just your email and a one-time code, then manage your account from Settings.",
-        "Meridian is now signed and notarized by Apple, so macOS won't flag it as an unidentified app.",
-        "Added an in-app uninstall wizard.",
-        "The \"Plan your day\" view now opens automatically once a day to help you start with a plan.",
-        "Onboarding now shows an expected-memory gauge and a notifications permission step."
-      ],
-      "fixes": [
-        "Fixed navigating to a specific view sometimes not working if the dashboard was already open.",
-        "Fixed worklog creation failing for Jira projects that don't have a Bug issue type.",
-        "Fixed worklogs repeatedly failing to post once a Jira issue hit its daily worklog limit.",
-        "Fixed a bug that could trigger duplicate Jira worklog backfills.",
-        "Fixed the notifications permission link opening the wrong settings pane."
+      "items": [
+        {
+          "title": "A redesigned dashboard",
+          "body": "Refined typography, a single violet accent and real per-app brand colors."
+        },
+        {
+          "title": "Sign in with a one-time code",
+          "body": "Just your email, then manage your account from Settings."
+        },
+        {
+          "title": "Signed and notarized by Apple",
+          "body": "macOS no longer flags Meridian as an unidentified app."
+        }
       ]
     },
     {
       "version": "1.70.0",
       "date": "2026-07-09",
-      "highlights": [
-        "Track work automatically across GitHub, Linear, Azure DevOps, Jira, Trello, and Asana.",
-        "Pick which GitHub Projects (v2) board to sync right from the connect flow.",
-        "Sign in to GitHub natively - no more copy-pasting a command-line login.",
-        "Popover: tap the \"Capturing\" status to see a live health panel.",
-        "Onboarding shows expected memory usage and downloads models faster.",
-        "Redesigned Overview and Hour-detail views."
-      ],
-      "fixes": [
-        "Fixed OAuth connect flows that could get stuck if you canceled partway through.",
-        "Fixed \"Open in tracker\" links that weren't opening your browser.",
-        "Daily plan reminders no longer stack up past midnight."
+      "items": [
+        {
+          "title": "Six trackers supported",
+          "body": "GitHub, Linear, Azure DevOps, Jira, Trello and Asana."
+        },
+        {
+          "title": "Native GitHub sign-in",
+          "body": "No more copy-pasting a command-line login."
+        },
+        {
+          "title": "A live health panel",
+          "body": "Tap the Capturing status in the popover to see it."
+        }
       ]
     },
     {
       "version": "1.69.1",
       "date": "2026-07-05",
-      "highlights": [],
-      "fixes": [
-        "Fixed external links not opening from inside the app."
+      "items": [
+        {
+          "title": "External links open again",
+          "body": "Links from inside the app now reach your browser."
+        }
       ]
     },
     {
       "version": "1.69.0",
       "date": "2026-07-03",
-      "highlights": [
-        "Brand-new one-pager Timeline dashboard design.",
-        "Added the Meridian nav pill to the toolbar for quicker navigation.",
-        "Broader ticket write-back support across Jira, Linear, and Azure DevOps.",
-        "Rebuilt the popover to match the latest design."
-      ],
-      "fixes": [
-        "Fixed a leak that could grow the local AI server's memory use by several GB an hour.",
-        "Fixed a bug that could post the same work log to Jira twice."
+      "items": [
+        {
+          "title": "A one-pager Timeline dashboard",
+          "body": "A brand-new design that puts the whole day on one screen."
+        },
+        {
+          "title": "Ticket write-back everywhere",
+          "body": "Broader support across Jira, Linear and Azure DevOps."
+        }
       ]
     }
   ],
@@ -437,17 +467,17 @@
     {
       "title": "Track down the last cause of database damage on Mac",
       "status": "in-progress",
-      "description": "Four causes are now fixed: a risky one-time encryption step, running out of file handles, Meridian restarting its own background service when it was only busy, and this release closing the gaps where the app and the background service could both write to your data at the same time. Damage has still been seen after the first three, so we are not calling this solved until the machines we are watching stay clean. What has changed is the recovery: Meridian now repairs a damaged database by itself at startup, so a bad one no longer means a dead app."
+      "description": "Four causes are fixed and Meridian now repairs a damaged database by itself at startup, but we won't call this solved until the machines we're watching stay clean."
     },
     {
-      "title": "More trackers - Linear, Trello, and Azure DevOps",
+      "title": "More trackers - Linear, Trello and Azure DevOps",
       "status": "planned",
-      "description": "Meridian already speaks to all three. They are listed as coming soon while we finish testing each one end to end, so the trackers you can connect today are ones we know work."
+      "description": "Meridian already speaks to all three; they stay listed as coming soon until each one is tested end to end."
     },
     {
       "title": "Report crashes in the background service",
       "status": "planned",
-      "description": "Error reporting currently covers the app itself. Extending it to the background service means a hard crash there gets reported too, rather than only being visible in local logs."
+      "description": "Error reporting covers the app today, so a hard crash in the background service is only visible in local logs."
     }
   ]
 }
diff --git a/tray/src-tauri/src/commands/whats_new.rs b/tray/src-tauri/src/commands/whats_new.rs
index 104d58ee2..4414e6307 100644
--- a/tray/src-tauri/src/commands/whats_new.rs
+++ b/tray/src-tauri/src/commands/whats_new.rs
@@ -21,13 +21,24 @@ use serde::{Deserialize, Serialize};
 use std::path::Path;
 use std::sync::OnceLock;
 
-/// One release's user-facing notes.
+/// One entry in a release: a short headline plus a single sentence. The
+/// deliberate shape of the whole feature — a release is at most two or three
+/// of these, so the modal can be read at a glance rather than skimmed and
+/// abandoned. Anything that needs a paragraph belongs in the docs, not here.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct ReleaseItem {
+    pub title: String,
+    pub body: String,
+}
+
+/// One release's user-facing notes. No highlights/fixes split — a user reading
+/// this doesn't care which bucket a change came from, and the split doubled
+/// the length of every entry.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct ReleaseNote {
     pub version: String,
     pub date: String,
-    pub highlights: Vec<String>,
-    pub fixes: Vec<String>,
+    pub items: Vec<ReleaseItem>,
 }
 
 /// A roadmap item's status. A serde enum (vs. a bare `String`) so a typo'd
@@ -136,6 +147,37 @@ mod tests {
         assert!(!data.releases.is_empty(), "seed at least one release");
     }
 
+    /// The brevity rule, enforced rather than trusted: What's New is read at a
+    /// glance or not at all, so a release gets at most three entries and each
+    /// body stays one short sentence. Without this the file drifts back into
+    /// pasted commit messages within a few releases.
+    #[test]
+    fn release_notes_stay_short() {
+        let data: WhatsNewData = serde_json::from_str(WHATS_NEW_JSON).unwrap();
+        for r in &data.releases {
+            assert!(
+                !r.items.is_empty() && r.items.len() <= 3,
+                "v{}: 1-3 items, got {}",
+                r.version,
+                r.items.len()
+            );
+            for it in &r.items {
+                assert!(
+                    it.title.len() <= 44,
+                    "v{}: title too long: {:?}",
+                    r.version,
+                    it.title
+                );
+                assert!(
+                    it.body.len() <= 160,
+                    "v{}: body must be one short sentence: {:?}",
+                    r.version,
+                    it.body
+                );
+            }
+        }
+    }
+
     #[test]
     fn unseen_when_marker_absent() {
         let dir =
diff --git a/ui/components/timeline/WhatsNewModal.tsx b/ui/components/timeline/WhatsNewModal.tsx
index 6a56df042..493b30fed 100644
--- a/ui/components/timeline/WhatsNewModal.tsx
+++ b/ui/components/timeline/WhatsNewModal.tsx
@@ -6,6 +6,11 @@
 // (releases newest-first, from `get_whats_new`) and Roadmap. `scrollInside`
 // gives the tab bar a fixed home while the content below scrolls on its own,
 // same layout technique SettingsModal uses for its sidebar + content split.
+//
+// A release renders as at most three title + one-sentence entries, with no
+// highlights/fixes split: the previous bulleted paragraphs were too long to
+// actually get read, and the bucket a change came from is our concern, not
+// the reader's. The brevity is enforced in `whats_new.rs`, not just curated.
 
 'use client'
 
@@ -106,18 +111,14 @@ function ReleaseList({ releases }: { releases: ReleaseNote[] }) {
               {latest && <LatestBadge />}
               <p className="mt-body-sm ml-auto" style={{ color: 'var(--t-faint)' }}>{r.date}</p>
             </div>
-            {r.highlights.length > 0 && (
-              <BulletList items={r.highlights} dotColor="var(--color-state-approved)" />
-            )}
-            {r.fixes.length > 0 && (
-              <>
-                <div className="flex items-center gap-1.5 mt-4 mb-1.5">
-                  <span aria-hidden="true" style={{ fontSize: 11 }}>🔧</span>
-                  <p className="mt-label" style={{ color: 'var(--color-state-pending)' }}>FIXES</p>
+            <div className="flex flex-col gap-3">
+              {r.items.map(item => (
+                <div key={item.title}>
+                  <p className="mt-body-sm" style={{ color: 'var(--t-title)', fontWeight: 600 }}>{item.title}</p>
+                  <p className="mt-body-sm" style={{ color: 'var(--t-muted)', marginTop: 2 }}>{item.body}</p>
                 </div>
-                <BulletList items={r.fixes} dotColor="var(--color-state-pending)" />
-              </>
-            )}
+              ))}
+            </div>
           </div>
         )
       })}
@@ -140,20 +141,6 @@ function LatestBadge() {
   )
 }
 
-function BulletList({ items, dotColor }: { items: string[]; dotColor: string }) {
-  return (
-    <ul className="flex flex-col gap-1.5">
-      {items.map((item, i) => (
-        <li key={i} className="mt-body-sm flex gap-2.5" style={{ color: 'var(--t-muted)' }}>
-          <span aria-hidden="true" className="shrink-0 rounded-full"
-            style={{ width: 5, height: 5, marginTop: 6, background: dotColor }} />
-          <span>{item}</span>
-        </li>
-      ))}
-    </ul>
-  )
-}
-
 function RoadmapList({ items }: { items: RoadmapItem[] }) {
   return (
     <div className="flex flex-col gap-3">
diff --git a/ui/lib/api-types.ts b/ui/lib/api-types.ts
index 77c1ad13a..26f14647e 100644
--- a/ui/lib/api-types.ts
+++ b/ui/lib/api-types.ts
@@ -798,11 +798,16 @@ export interface UpdateError {
 
 // ── What's New (`get_whats_new`) ───────────────────────────────────────────────
 
+/** A headline plus one sentence — see `whats_new.rs`'s `ReleaseItem`. */
+export interface ReleaseItem {
+  title: string
+  body: string
+}
+
 export interface ReleaseNote {
   version: string
   date: string
-  highlights: string[]
-  fixes: string[]
+  items: ReleaseItem[]
 }
 
 export interface RoadmapItem {

From 790954a6f837eb7f33424e6a41f869ee1fb20b29 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 25 Aug 2026 21:03:38 +0530
Subject: [PATCH 03/53] fix(tray): repaint the offline banner as soon as the
 daemon+DB are ready

The poll loop's health tick only runs every 60s (ticks 0, 2, 4...), and
tick 0 fires at launch - before the daemon has necessarily finished
starting or the DB pool has opened. A cold start correctly reports
Unhealthy at that instant, then the popover's "Meridian is offline"
banner sat there stale for up to 60s even once the daemon and DB were
both actually ready, because nothing repainted the displayed status in
between. Observed live: the health panel's on-demand rows already
showed Daemon Running / Database Ready while the banner above them
still said offline.

Adds a separate one-shot fast-poll (3s interval, 60s ceiling) that
repaints AppState.health/ui_reachable and re-emits status-update the
moment the daemon+DB are ready, then stops permanently. It shares the
same is_healthy() predicate as the poll loop's own health tick (now
factored out) so the two can never disagree about what "healthy"
means, and it deliberately never touches the went-quiet notice or
auto-restart decision state - those stay solely owned by the slower,
debounced refresh_health tick.
---
 tray/src-tauri/src/commands/health.rs     | 65 ++++++++++++++++++
 tray/src-tauri/src/lib.rs                 | 14 ++++
 tray/src-tauri/src/poll/mod.rs            |  6 ++
 tray/src-tauri/src/poll/refresh.rs        |  6 +-
 tray/src-tauri/src/poll/startup_health.rs | 82 +++++++++++++++++++++++
 5 files changed, 171 insertions(+), 2 deletions(-)
 create mode 100644 tray/src-tauri/src/poll/startup_health.rs

diff --git a/tray/src-tauri/src/commands/health.rs b/tray/src-tauri/src/commands/health.rs
index fedb4043d..62d3c58a2 100644
--- a/tray/src-tauri/src/commands/health.rs
+++ b/tray/src-tauri/src/commands/health.rs
@@ -50,6 +50,22 @@ pub struct HealthResponse {
     pub llm_provider_detail: Option<String>,
 }
 
+/// Whether a [`HealthResponse`] counts as a healthy tray: the DB is open and
+/// the daemon process is running (the two signals the popover's
+/// online/offline banner is actually gated on — LLM-provider availability is
+/// a separate, softer banner and does not factor in here).
+///
+/// Shared between the poll loop's notice-owning
+/// [`crate::poll::refresh_health`] and the startup fast-poll
+/// ([`crate::poll::startup_health`]) so the two can never disagree about what
+/// "healthy" means — this is the one place that decides it.
+///
+/// `database_ready` defaults to unhealthy when unknown; `daemon_running`
+/// defaults to healthy (older schema compat).
+pub fn is_healthy(hr: &HealthResponse) -> bool {
+    hr.database_ready.unwrap_or(false) && hr.daemon_running.unwrap_or(true)
+}
+
 /// Run all three health checks in parallel and return the combined result.
 /// Called by both `get_health` (Tauri command) and `poll::refresh_health` (internal).
 pub async fn check_health() -> HealthResponse {
@@ -248,3 +264,52 @@ pub async fn get_health() -> Result<HealthResponse, String> {
     );
     Ok(result)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn hr(database_ready: Option<bool>, daemon_running: Option<bool>) -> HealthResponse {
+        HealthResponse {
+            database_ready,
+            daemon_running,
+            a11y_helper_trusted: None,
+            error: None,
+            llm_provider_ok: None,
+            llm_provider_rate_limited: None,
+            llm_provider_name: None,
+            llm_provider_detail: None,
+        }
+    }
+
+    #[test]
+    fn healthy_when_both_signals_are_true() {
+        assert!(is_healthy(&hr(Some(true), Some(true))));
+    }
+
+    #[test]
+    fn unhealthy_when_the_db_is_not_ready() {
+        assert!(!is_healthy(&hr(Some(false), Some(true))));
+    }
+
+    #[test]
+    fn unhealthy_when_the_daemon_is_not_running() {
+        assert!(!is_healthy(&hr(Some(true), Some(false))));
+    }
+
+    /// `database_ready: None` must read as unhealthy - an unknown DB state is
+    /// never treated as "fine". Older-schema compat only applies to
+    /// `daemon_running` (below), not this field.
+    #[test]
+    fn an_unknown_db_state_is_treated_as_unhealthy() {
+        assert!(!is_healthy(&hr(None, Some(true))));
+    }
+
+    /// `daemon_running: None` defaults to healthy (older schema compat) - the
+    /// mirror image of the DB default, and the one place the two signals
+    /// disagree on how to treat "unknown".
+    #[test]
+    fn an_unknown_daemon_state_defaults_to_healthy() {
+        assert!(is_healthy(&hr(Some(true), None)));
+    }
+}
diff --git a/tray/src-tauri/src/lib.rs b/tray/src-tauri/src/lib.rs
index dc134f10d..d2a83eb38 100644
--- a/tray/src-tauri/src/lib.rs
+++ b/tray/src-tauri/src/lib.rs
@@ -1188,6 +1188,20 @@ pub fn run() {
                 poll::run_daemon_watchdog().await;
             });
 
+            // One-shot: repaint the popover's online/offline banner the moment
+            // the daemon+DB are actually ready, instead of leaving it stuck on
+            // "Meridian is offline" until the poll loop's own next 30/60 s
+            // health tick. Separate from both loops above on purpose — see
+            // `poll::startup_health` for why it must not touch either one's
+            // state.
+            {
+                let app_handle = app.handle().clone();
+                let state_clone = app_state.clone();
+                tauri::async_runtime::spawn(async move {
+                    poll::fast_poll_until_healthy(app_handle, state_clone).await;
+                });
+            }
+
             // Launch-at-login AND morning relaunch: VERIFY-AND-REPAIR on every
             // launch (see autostart.rs), so the tray comes back after a reboot
             // and again the next morning if it was quit. Deliberately not
diff --git a/tray/src-tauri/src/poll/mod.rs b/tray/src-tauri/src/poll/mod.rs
index 938218519..832a1fc09 100644
--- a/tray/src-tauri/src/poll/mod.rs
+++ b/tray/src-tauri/src/poll/mod.rs
@@ -12,6 +12,10 @@
 //!   server-side per row).
 //! - [`live`] — the live data → Tauri events that replace the dashboard's SSE
 //!   streams: `notices-update`, `notifications-update`.
+//! - [`startup_health`] — a separate, faster one-shot loop (spawned
+//!   alongside this one, not called from inside it) that repaints the
+//!   displayed health status the moment the daemon+DB are ready, instead of
+//!   waiting for this loop's next 30/60 s-cadenced health tick.
 //!
 //! The tray-sync helpers (emit / tooltip / menu) stay here, coupled to the loop.
 
@@ -20,6 +24,7 @@ mod notifications;
 mod permissions;
 mod plan_auto_open;
 mod refresh;
+mod startup_health;
 mod watchdog;
 mod whats_new_auto_open;
 
@@ -29,6 +34,7 @@ use notifications::drain_notifications;
 use refresh::{
     refresh_active, refresh_current_task, refresh_health, refresh_today, refresh_worklogs,
 };
+pub use startup_health::fast_poll_until_healthy;
 use std::sync::atomic::Ordering;
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
diff --git a/tray/src-tauri/src/poll/refresh.rs b/tray/src-tauri/src/poll/refresh.rs
index 50ddccee4..eaaebcead 100644
--- a/tray/src-tauri/src/poll/refresh.rs
+++ b/tray/src-tauri/src/poll/refresh.rs
@@ -52,11 +52,13 @@ pub(super) async fn refresh_health(
     // (it also carries `daemon_running`, which the banner ignores).
     let _ = app.emit("health-update", &hr);
 
-    // db_ready and daemon_running both default true when absent (older schema compat).
+    // db_ready defaults unhealthy when unknown; daemon_running defaults healthy
+    // (older schema compat) — kept as locals for the log fields below, but the
+    // classification itself goes through `is_healthy` (see there for why).
     let db_ready = hr.database_ready.unwrap_or(false);
     let daemon_running = hr.daemon_running.unwrap_or(true);
 
-    let new_health = if db_ready && daemon_running {
+    let new_health = if crate::commands::health::is_healthy(&hr) {
         HealthStatus::Healthy
     } else {
         HealthStatus::Unhealthy
diff --git a/tray/src-tauri/src/poll/startup_health.rs b/tray/src-tauri/src/poll/startup_health.rs
new file mode 100644
index 000000000..fcd166831
--- /dev/null
+++ b/tray/src-tauri/src/poll/startup_health.rs
@@ -0,0 +1,82 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! A one-shot fast health repaint for the first seconds after tray launch.
+//!
+//! # The problem this closes
+//! The poll loop's [`super::refresh::refresh_health`] only runs on ticks
+//! 0, 2, 4, … — every 60 s — because that cadence also drives the went-quiet
+//! / back-online *notice* and the auto-restart decision
+//! (`decide_health_notice`), both deliberately debounced so a genuine outage
+//! doesn't flap. Tick 0 fires within moments of launch, before the daemon has
+//! necessarily finished starting or the DB pool has opened, so a cold start
+//! correctly reports Unhealthy at that instant — and then the popover's
+//! "Meridian is offline" banner just sits there, stale, for up to 60 s even
+//! once the daemon and DB are both actually ready, because nothing repaints
+//! the DISPLAYED status in between. Observed live: the health panel's
+//! on-demand rows ("Daemon: Running", "Database: Ready") already show the
+//! true state the moment it opens, while the banner above it still says
+//! offline — two reads of the same underlying signal, one fresh, one stale.
+//!
+//! # What this does and does not touch
+//! This loop only repaints [`AppState::health`] / `ui_reachable` and re-emits
+//! `status-update` — it never touches `consecutive_health_failures`,
+//! `daemon_was_healthy` or `startup_health_reconciled`, so it cannot affect
+//! the went-quiet notice or trigger an auto-restart; those stay solely owned
+//! by `refresh_health`. It runs at most once per process, stops the instant
+//! it observes a healthy check, and gives up silently after [`CEILING`],
+//! letting the normal cadence take over — it must never spin forever on a
+//! machine that is genuinely down.
+//!
+//! It also does not change what "healthy" MEANS — it shares
+//! [`crate::commands::health::is_healthy`] with `refresh_health`, so the two
+//! can never disagree, and this fix is scoped to the display lag only, not a
+//! new readiness signal.
+//!
+//! # Related
+//! - [`super::refresh::refresh_health`] — the slower, notice-owning check
+//!   this repaints ahead of.
+//! - [`super::watchdog`] — the same "separate fast loop, narrow job" shape,
+//!   for starting a stopped daemon rather than painting the UI.
+
+use crate::commands::health::{check_health, is_healthy};
+use crate::state::{AppState, HealthStatus};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+use tauri::Emitter;
+
+/// How often to recheck while not yet healthy.
+const TICK: Duration = Duration::from_secs(3);
+
+/// Give up after this long. Matches the worst-case wait this loop replaces
+/// (the normal cadence's 60 s), so a genuinely broken install is never worse
+/// off than before this loop existed — just never better, past this point.
+const CEILING: Duration = Duration::from_secs(60);
+
+/// Poll [`check_health`] every [`TICK`] until the tray is healthy (or
+/// [`CEILING`] elapses), repainting the displayed status the moment it is.
+/// Intended to be spawned once, at tray startup, alongside the main poll
+/// loop — see `lib.rs`.
+pub async fn fast_poll_until_healthy(app: tauri::AppHandle, state: Arc<Mutex<AppState>>) {
+    let deadline = tokio::time::Instant::now() + CEILING;
+    loop {
+        let hr = check_health().await;
+        if is_healthy(&hr) {
+            let payload = {
+                let Ok(mut s) = state.lock() else {
+                    return;
+                };
+                // A concurrent `refresh_health` tick may already have painted
+                // this by the time we get here — overwriting it with the same
+                // (now also fresh) verdict is harmless.
+                s.health = HealthStatus::Healthy;
+                s.ui_reachable = true;
+                s.to_payload()
+            };
+            let _ = app.emit("status-update", payload);
+            return;
+        }
+        if tokio::time::Instant::now() >= deadline {
+            return;
+        }
+        tokio::time::sleep(TICK).await;
+    }
+}

From 94f79825428acabb4ac941fa83f64052060213a6 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 25 Aug 2026 21:24:07 +0530
Subject: [PATCH 04/53] fix(llm): show an actionable message when a sign-in CLI
 crashes at Node startup

codex/claude/cursor-agent are all #!/usr/bin/env node scripts, and when Node
crashes while loading the entrypoint itself (not the CLI's own logic - the
stack trace names internal/modules/esm and ends in a bare "Node.js vX.Y.Z"
line) interactive_login dumped that raw multi-line internal trace verbatim
into the Settings UI as the failure message, e.g. "codex exited Some(1):
///opt/homebrew/lib/node_modules/@openai/codex/bin/codex.js:105:9)...at
ModuleJob.run (node:internal/modules/esm/module_job:437:25)...Node.js
v25.9.0" - unreadable and not actionable for a user.

node_crash_message() recognizes this exact signature and swaps it for plain
copy pointing at the real, actionable fix (update the CLI or switch Node
versions). Anything not matching the signature falls through to the existing
raw-tail message unchanged, so no other failure reason is masked.

This is a pure message-formatting change - it does not touch how the CLI is
resolved or spawned (command_for_resolved_cli's PATH construction is
unrelated and untouched), so it carries no risk to the sign-in flow itself
regardless of what is actually causing the underlying Node crash on the
reporting machine.
---
 src/llm/detect.rs | 82 +++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 73 insertions(+), 9 deletions(-)

diff --git a/src/llm/detect.rs b/src/llm/detect.rs
index 946ac14a6..dbf3df0cb 100644
--- a/src/llm/detect.rs
+++ b/src/llm/detect.rs
@@ -1154,6 +1154,33 @@ fn buffered_tail(buf: &std::sync::Mutex<String>, n: usize) -> String {
     tail(&s, n)
 }
 
+/// Recognize a Node.js uncaught-exception crash during the CLI's own module
+/// load (as opposed to an auth failure the CLI reported cleanly) and swap the
+/// raw, multi-line internal stack trace for plain-language copy.
+///
+/// `codex`/`claude`/`cursor-agent` are all `#!/usr/bin/env node` scripts,
+/// and a crash while Node is still loading the entrypoint - not running its
+/// own logic - always ends its report with a bare `Node.js vX.Y.Z` line and
+/// names `internal/modules/esm`/`ModuleJob.run` in the stack. That signature
+/// is what was dumped verbatim into Settings: `codex exited Some(1):
+/// .../codex.js:105:9) ... at ModuleJob.run (node:internal/modules/esm/
+/// module_job:437:25) ... Node.js v25.9.0`. Anything not matching this exact
+/// shape returns `None` and the caller falls back to the raw tail unchanged -
+/// this only replaces a message we can say something more specific about, it
+/// never hides one.
+fn node_crash_message(bin: &str, stderr_tail: &str) -> Option<String> {
+    if stderr_tail.contains("Node.js v")
+        && (stderr_tail.contains("internal/modules/esm") || stderr_tail.contains("ModuleJob.run"))
+    {
+        return Some(format!(
+            "{bin} crashed on startup instead of signing in - this usually means the installed \
+             {bin} isn't compatible with your current Node.js version. Try updating {bin} to its \
+             latest version, or switching to a different Node.js version, then sign in again."
+        ));
+    }
+    None
+}
+
 /// [`interactive_login`]'s three durations, bundled so a real sign-in and a test can each
 /// supply their own without growing the function's argument count. Production always uses
 /// [`Self::PRODUCTION`]; tests use tiny values so the same race logic exercises in
@@ -1324,15 +1351,20 @@ where
             } else {
                 stderr_tail
             };
-            let process_message = format!(
-                "{bin} exited {:?}: {}",
-                status.code(),
-                if reason.is_empty() {
-                    "no output".to_string()
-                } else {
-                    reason
-                }
-            );
+            let process_message = if let Some(friendly) = node_crash_message(bin, &reason) {
+                tracing::debug!(bin, raw_tail = %reason, "sign-in CLI crashed at Node module load, showing a friendlier message");
+                friendly
+            } else {
+                format!(
+                    "{bin} exited {:?}: {}",
+                    status.code(),
+                    if reason.is_empty() {
+                        "no output".to_string()
+                    } else {
+                        reason
+                    }
+                )
+            };
             confirm_or_report(label, bin, &path, success_message, &verify, process_message).await
         }
         Ended::WaitError(e) => {
@@ -1802,6 +1834,38 @@ fn path_candidate_names(bin: &str) -> Vec<String> {
 mod tests {
     use super::*;
 
+    const NODE_ESM_CRASH_TAIL: &str = "///opt/homebrew/lib/node_modules/@openai/codex/bin/codex.js:105:9)\n    at ModuleJob.run (node:internal/modules/esm/module_job:437:25)\n    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:639:26)\n    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:101:5)\n\nNode.js v25.9.0";
+
+    /// The exact signature from the reported crash: a friendlier message replaces the raw
+    /// Node internal stack trace.
+    #[test]
+    fn recognizes_a_node_esm_loader_crash() {
+        let msg = node_crash_message("codex", NODE_ESM_CRASH_TAIL).expect("should recognize crash");
+        assert!(msg.contains("codex"));
+        assert!(msg.contains("Node.js version"));
+        assert!(
+            !msg.contains("ModuleJob.run"),
+            "raw stack trace must not leak into the friendly message"
+        );
+    }
+
+    /// An ordinary auth failure (no Node crash signature) must fall through unchanged - this
+    /// must never mask a real, different failure reason.
+    #[test]
+    fn leaves_an_unrelated_failure_untouched() {
+        assert!(
+            node_crash_message("codex", "Error: invalid device code, please try again").is_none()
+        );
+        assert!(node_crash_message("codex", "").is_none());
+    }
+
+    /// "Node.js v" alone (e.g. a version banner some CLIs print on success) is not enough by
+    /// itself - only the module-loader signature counts as a crash.
+    #[test]
+    fn requires_the_module_loader_signature_not_just_a_node_version_string() {
+        assert!(node_crash_message("codex", "codex 1.2.3 (Node.js v22.1.0)").is_none());
+    }
+
     fn groq_custom_provider() -> meridian_core::settings::CustomLlmProvider {
         meridian_core::settings::CustomLlmProvider {
             id: "groq1".to_string(),

From d92131eecac588c51b08e58274cd30591be17d61 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 25 Aug 2026 21:31:17 +0530
Subject: [PATCH 05/53] fix(llm): shell-quote resolved paths in the installer
 command builder

Surfaced by this branch's pre-push security audit: resolve_installer_binary
interpolated a locally-resolved CLI path (and its parent directory) directly
into POSIX shell text without quoting. install_command()'s own literals are
fixed per-provider strings and already documented as safe to run unquoted,
but the resolved path comes from a filesystem PATH lookup (resolve_cli) - an
attacker able to plant a maliciously-named file in a writable PATH directory
could otherwise inject shell syntax into the command this builds.

shell_quote() POSIX single-quotes both interpolated values (escaping any
embedded single quote), so the substituted text can never break out of its
own quoting regardless of what characters the resolved path contains.
---
 src/llm/detect.rs | 43 ++++++++++++++++++++++++++++++++++++-------
 1 file changed, 36 insertions(+), 7 deletions(-)

diff --git a/src/llm/detect.rs b/src/llm/detect.rs
index dbf3df0cb..3444a9a89 100644
--- a/src/llm/detect.rs
+++ b/src/llm/detect.rs
@@ -785,6 +785,17 @@ pub struct InstallOutcome {
 /// This was a live bug: it made the Install button fail for every npm-based provider on
 /// Windows, and - because the leading token is what triggers the rewrite - Cursor was
 /// unaffected purely by accident, its command starting with `$s`.
+/// POSIX single-quote a string for safe interpolation into the shell text
+/// [`resolve_installer_binary`] builds. `dir`/`resolved` come from a local
+/// filesystem path resolution (`resolve_cli`), not a fixed literal like
+/// `rest` - an attacker able to plant a maliciously-named file in a PATH
+/// directory could otherwise inject shell syntax into the installer command
+/// this builds.
+#[cfg(not(windows))]
+fn shell_quote(s: &str) -> String {
+    format!("'{}'", s.replace('\'', r"'\''"))
+}
+
 #[cfg(windows)]
 async fn resolve_installer_binary(cmd: &str) -> String {
     cmd.to_string()
@@ -806,11 +817,11 @@ async fn resolve_installer_binary(cmd: &str) -> String {
             // npm itself fixed the first one.
             Some(resolved) => match resolved.parent() {
                 Some(dir) => format!(
-                    "export PATH=\"{}:$PATH\"; {} {rest}",
-                    dir.display(),
-                    resolved.display()
+                    "export PATH={}:$PATH; {} {rest}",
+                    shell_quote(&dir.display().to_string()),
+                    shell_quote(&resolved.display().to_string())
                 ),
-                None => format!("{} {rest}", resolved.display()),
+                None => format!("{} {rest}", shell_quote(&resolved.display().to_string())),
             },
             None => cmd.to_string(),
         },
@@ -1866,6 +1877,24 @@ mod tests {
         assert!(node_crash_message("codex", "codex 1.2.3 (Node.js v22.1.0)").is_none());
     }
 
+    #[cfg(not(windows))]
+    #[test]
+    fn shell_quote_wraps_an_ordinary_path_unchanged() {
+        assert_eq!(shell_quote("/opt/homebrew/bin"), "'/opt/homebrew/bin'");
+    }
+
+    /// The finding this exists to close: an embedded single quote must not let the string
+    /// escape its own quoting and inject shell syntax.
+    #[cfg(not(windows))]
+    #[test]
+    fn shell_quote_escapes_an_embedded_single_quote() {
+        let malicious = "/tmp/evil'; rm -rf ~; echo '";
+        let quoted = shell_quote(malicious);
+        // Every character of the input must appear only inside a quoted segment -
+        // reassembling the escape sequence proves it round-trips back to the original.
+        assert_eq!(quoted, r"'/tmp/evil'\''; rm -rf ~; echo '\'''");
+    }
+
     fn groq_custom_provider() -> meridian_core::settings::CustomLlmProvider {
         meridian_core::settings::CustomLlmProvider {
             id: "groq1".to_string(),
@@ -2909,9 +2938,9 @@ mod tests {
         assert_eq!(
             resolved,
             format!(
-                "export PATH=\"{}:$PATH\"; {} i -g some-package",
-                bin_dir.display(),
-                fake_bin.display()
+                "export PATH={}:$PATH; {} i -g some-package",
+                shell_quote(&bin_dir.display().to_string()),
+                shell_quote(&fake_bin.display().to_string())
             ),
             "expected the leading binary swapped for its resolved absolute path, with its \
              directory prepended onto PATH"

From 31730fba1e46f76e8b5815e2f9e5a3acc363cffe Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 25 Aug 2026 22:06:47 +0530
Subject: [PATCH 06/53] fix(coding-agent): move the summariser's codex/claude
 prompt off argv onto stdin

Root-caused via a diagnostics bundle attached to
github.com/Meridiona/meridian/issues/805: the coding-agent session summariser
(src/coding_agent_session_ingest/summariser/{codex,claude}.rs) was passing its
full instructions prompt - always multi-line, sourced from
assets/skills/coding-agent/session-summary/SKILL.md - as a positional argv
argument to `codex exec`/`claude -p`. On Windows both resolve to npm-generated
.cmd batch files, and Rust's std library refuses to spawn a .bat/.cmd target
when an argument contains a character it cannot safely escape - notably an
embedded newline (the CVE-2024-24576 "BatBadBut" fix) - so every real call
through this path failed to even spawn, with `io::Error { InvalidInput,
"batch file arguments are invalid" }`. The attached bundle shows this firing
165 times across dozens of session rows on one Windows machine, each one
retried once and then dead-lettered ("summarise failed repeatedly").

This is the exact bug `src/llm/{codex,claude}.rs` (the hourly worklog
pipeline / connectivity-test backends) already found and fixed in a2a31c19
(2026-07-24) by moving the prompt to stdin - but that fix never reached its
sibling in the coding-agent summariser, which has carried the identical bug
since it was written. This applies the same fix here: no positional prompt on
argv, the instructions + transcript combined into one stdin payload instead
(matching each engine's already-fixed stdin shape exactly - codex's `<stdin>`
wrapping, claude's bare join). Codex's schema is also now run through
`crate::llm::schema::strictify` before being written, matching
`CodexBackend`'s already-fixed path, since unblocking the spawn means codex's
own strict-schema validation is now reachable too.

`summariser/copilot.rs` has the same npm-.cmd exposure on Windows but can't
take the same fix (`copilot -p` ignores stdin, confirmed live) - left as a
documented known gap, not fixed here.

This closes the "batch file arguments are invalid" class of failure
(github.com/Meridiona/meridian/issues/805, #841's "failed to write any
tasks/summaries" symptom) but NOT #805's separate `test_llm_provider`
20s-timeout symptom (a different code path, `src/llm/codex.rs::signed_out`'s
slow-fail case - not touched here) or #841's Claude-session-drops-out
symptom (macOS, so this Windows-only argv bug cannot be the cause - needs
separate investigation).

New tests in both files pin: the instructions prompt is genuinely multi-line
(the premise the fix rests on), argv never carries a newline, no positional
prompt is passed, the model flag is threaded correctly, and the stdin payload
carries both the instructions and the transcript.
---
 .../summariser/claude.rs                      | 114 ++++++++++--
 .../summariser/codex.rs                       | 166 +++++++++++++++---
 .../summariser/copilot.rs                     |  10 ++
 .../summariser/prompts.rs                     |  18 +-
 4 files changed, 261 insertions(+), 47 deletions(-)

diff --git a/src/coding_agent_session_ingest/summariser/claude.rs b/src/coding_agent_session_ingest/summariser/claude.rs
index 10f964856..f76c0e3cd 100644
--- a/src/coding_agent_session_ingest/summariser/claude.rs
+++ b/src/coding_agent_session_ingest/summariser/claude.rs
@@ -14,6 +14,21 @@
 // spawns. `--no-session-persistence` means no JSONL is written for it either.
 // NOTE: the inherited env must carry HOME/PATH/USER/LOGNAME for the login
 // keychain to unlock (see the auth spike) — the daemon's launchd plist owns that.
+//
+// # The whole prompt goes over stdin, not argv (Windows)
+//
+// `claude` resolves to `claude.cmd` on Windows for an npm install (`npm i -g
+// @anthropic-ai/claude-code`, the exact command `install_command()` runs for this
+// provider) - an npm-generated batch file, not a native exe - and Rust's std library
+// refuses to spawn a `.bat`/`.cmd` target when an argument contains characters it
+// cannot safely escape (the CVE-2024-24576 "BatBadBut" fix), notably embedded
+// newlines. SUMMARY_RULES is sourced from a Markdown rules file, so it is always
+// multi-line - meaning every real call through this function failed to even spawn
+// on Windows with `io::Error { InvalidInput, "batch file arguments are invalid" }`.
+// `crate::llm::claude::ClaudeBackend` (the hourly worklog pipeline / connectivity
+// test) already moved off argv for exactly this reason - this applies the same fix
+// here, which had the identical bug all along. `-p` as a bare flag (no positional
+// value) reads the whole prompt from stdin instead.
 
 use serde_json::Value;
 
@@ -21,6 +36,32 @@ use super::config::SummariserConfig;
 use super::prompts;
 use super::{run_capture, EngineOutput, SummariserError};
 
+/// The instructions + the session transcript, combined into the one blob `claude -p`
+/// reads from stdin now that no positional prompt is passed - see the module doc.
+fn claude_stdin_payload(stdin_text: &str) -> String {
+    let instructions = format!(
+        "{} Summarise the coding-session transcript provided on stdin.",
+        prompts::SUMMARY_RULES
+    );
+    format!("{instructions}\n\n{stdin_text}")
+}
+
+/// The `claude -p` argv - no prompt in here, see the module doc. Split out so the
+/// no-newline invariant this function exists to guarantee is directly testable.
+fn claude_args(model: &str) -> Vec<String> {
+    vec![
+        "-p".into(),
+        "--output-format".into(),
+        "json".into(),
+        "--json-schema".into(),
+        prompts::summary_schema_json(),
+        "--model".into(),
+        model.to_string(),
+        "--no-session-persistence".into(),
+        "--strict-mcp-config".into(), // drop MCP overhead; keeps skills working
+    ]
+}
+
 pub async fn run_claude(
     stdin_text: &str,
     cfg: &SummariserConfig,
@@ -35,27 +76,12 @@ pub async fn run_claude(
              the env var has no effect and can be removed"
         );
     }
-    let prompt = format!(
-        "{} Summarise the coding-session transcript provided on stdin.",
-        prompts::SUMMARY_RULES
-    );
-    let args: Vec<String> = vec![
-        "-p".into(),
-        prompt,
-        "--output-format".into(),
-        "json".into(),
-        "--json-schema".into(),
-        prompts::summary_schema_json(),
-        "--model".into(),
-        cfg.claude_model.clone(),
-        "--no-session-persistence".into(),
-        "--strict-mcp-config".into(), // drop MCP overhead; keeps skills working
-    ];
+    let args = claude_args(&cfg.claude_model);
 
     let cap = run_capture(
         "claude",
         &args,
-        stdin_text,
+        &claude_stdin_payload(stdin_text),
         &cfg.meridian_home,
         cfg.claude_timeout_s,
         &[("MERIDIAN_SUMMARISER", "1")],
@@ -130,3 +156,57 @@ pub async fn run_claude(
     }
     Ok(EngineOutput { summary })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The premise the whole fix rests on: SUMMARY_RULES is sourced from a Markdown
+    /// rules file and is always multi-line. If `SKILL.md` ever became single-line, this
+    /// fix would no longer be guarding against anything real - this pins that it still is.
+    #[test]
+    fn summary_rules_is_multi_line() {
+        assert!(prompts::SUMMARY_RULES.contains('\n'));
+    }
+
+    /// The regression this fix exists to close: `claude -p` argv must never carry the
+    /// instructions prompt (or anything else newline-bearing) - that is exactly what
+    /// makes Rust's std refuse to spawn `claude.cmd` on Windows. A future edit that
+    /// reintroduces the prompt into `args` fails this test.
+    #[test]
+    fn claude_args_never_contains_a_newline() {
+        let args = claude_args("claude-opus-5");
+        for arg in &args {
+            assert!(!arg.contains('\n'), "argv entry carries a newline: {arg:?}");
+        }
+    }
+
+    /// `claude -p` must be a bare flag - a positional value right after it would force
+    /// the prompt back through argv.
+    #[test]
+    fn claude_args_has_no_positional_prompt() {
+        let args = claude_args("claude-opus-5");
+        assert_eq!(args[0], "-p");
+        assert_eq!(
+            args[1], "--output-format",
+            "the second argv entry must be a flag, not a prompt"
+        );
+    }
+
+    #[test]
+    fn claude_args_carries_the_model() {
+        let args = claude_args("claude-opus-5");
+        let i = args
+            .iter()
+            .position(|a| a == "--model")
+            .expect("--model flag present");
+        assert_eq!(args[i + 1], "claude-opus-5");
+    }
+
+    #[test]
+    fn claude_stdin_payload_carries_both_the_instructions_and_the_transcript() {
+        let payload = claude_stdin_payload("the transcript");
+        assert!(payload.contains("the transcript"));
+        assert!(payload.starts_with(&prompts::SUMMARY_RULES[..40]));
+    }
+}
diff --git a/src/coding_agent_session_ingest/summariser/codex.rs b/src/coding_agent_session_ingest/summariser/codex.rs
index 6a101005b..ac35b00e8 100644
--- a/src/coding_agent_session_ingest/summariser/codex.rs
+++ b/src/coding_agent_session_ingest/summariser/codex.rs
@@ -5,6 +5,20 @@
 // `--ephemeral` (no session file → indexer won't re-pick it), `--output-schema`
 // + `-o FILE` to capture the structured final message. Port of
 // the former Python summariser/codex_runner.py.
+//
+// # The whole prompt goes over stdin, not argv (Windows)
+//
+// `codex` resolves to `codex.cmd` on Windows - an npm-generated batch file, not a
+// native exe - and Rust's std library refuses to spawn a `.bat`/`.cmd` target when an
+// argument contains characters it cannot safely escape (the CVE-2024-24576 "BatBadBut"
+// fix), notably embedded newlines. The instructions prompt is sourced from a Markdown
+// rules file (`SUMMARY_RULES`), so it is always multi-line - meaning every real call
+// through this function failed to even spawn on Windows with `io::Error { InvalidInput,
+// "batch file arguments are invalid" }` (confirmed live:
+// github.com/Meridiona/meridian/issues/805). `crate::llm::codex::CodexBackend` (the
+// hourly worklog pipeline / connectivity test) already moved off argv for exactly this
+// reason - this applies the same fix here, which had the identical bug all along.
+// `codex exec` with no positional prompt reads the whole prompt from stdin instead.
 
 use std::path::PathBuf;
 use std::sync::atomic::{AtomicU64, Ordering};
@@ -13,15 +27,48 @@ use super::config::SummariserConfig;
 use super::prompts;
 use super::{run_capture, EngineOutput, SummariserError};
 
-pub async fn run_codex(
-    stdin_text: &str,
-    cfg: &SummariserConfig,
-) -> Result<EngineOutput, SummariserError> {
-    let prompt = format!(
+/// The instructions + the session transcript, combined into the one blob `codex exec`
+/// reads from stdin now that no positional prompt is passed - see the module doc.
+fn codex_stdin_payload(stdin_text: &str) -> String {
+    let instructions = format!(
         "{} Summarise the coding-session transcript provided on stdin.",
         prompts::summary_instruction()
     );
+    format!("{instructions}\n\n<stdin>\n{stdin_text}\n</stdin>\n")
+}
 
+/// The `codex exec` argv - no prompt in here, see the module doc. Split out so the
+/// no-newline invariant this function exists to guarantee is directly testable.
+fn codex_args(
+    schema_path: &std::path::Path,
+    out_path: &std::path::Path,
+    home: String,
+    model: &str,
+) -> Vec<String> {
+    let mut args: Vec<String> = vec![
+        "exec".into(),
+        "-s".into(),
+        "read-only".into(),
+        "--skip-git-repo-check".into(),
+        "--ephemeral".into(),
+        "--output-schema".into(),
+        schema_path.display().to_string(),
+        "-o".into(),
+        out_path.display().to_string(),
+        "-C".into(),
+        home,
+    ];
+    if !model.is_empty() {
+        args.push("-m".into());
+        args.push(model.to_string());
+    }
+    args
+}
+
+pub async fn run_codex(
+    stdin_text: &str,
+    cfg: &SummariserConfig,
+) -> Result<EngineOutput, SummariserError> {
     // Unique scratch dir for the schema + captured final message. Avoids the
     // time/random APIs (banned in some contexts) via pid + a static counter.
     static SEQ: AtomicU64 = AtomicU64::new(0);
@@ -36,34 +83,22 @@ pub async fn run_codex(
     let _guard = TempDirGuard(td.clone());
     let schema_path = td.join("schema.json");
     let out_path = td.join("last_message.txt");
-    if let Err(e) = std::fs::write(&schema_path, prompts::summary_schema_json()) {
+    // `strictify`: matches `crate::llm::codex::CodexBackend`, which applies the same
+    // transform before handing a schema to codex - without it, codex's own strict
+    // dialect check can reject the schema with `invalid_json_schema` (see that
+    // module's test fixture, a live 400 from exactly this).
+    let schema = crate::llm::schema::strictify(&prompts::summary_schema_value());
+    if let Err(e) = std::fs::write(&schema_path, schema.to_string()) {
         return Err(SummariserError::Failed(format!("codex: write schema: {e}")));
     }
 
     let home = cfg.meridian_home.display().to_string();
-    let mut args: Vec<String> = vec![
-        "exec".into(),
-        prompt,
-        "-s".into(),
-        "read-only".into(),
-        "--skip-git-repo-check".into(),
-        "--ephemeral".into(),
-        "--output-schema".into(),
-        schema_path.display().to_string(),
-        "-o".into(),
-        out_path.display().to_string(),
-        "-C".into(),
-        home,
-    ];
-    if !cfg.codex_model.is_empty() {
-        args.push("-m".into());
-        args.push(cfg.codex_model.clone());
-    }
+    let args = codex_args(&schema_path, &out_path, home, &cfg.codex_model);
 
     let cap = run_capture(
         "codex",
         &args,
-        stdin_text,
+        &codex_stdin_payload(stdin_text),
         &cfg.meridian_home,
         cfg.codex_timeout_s,
         &[("MERIDIAN_SUMMARISER", "1")],
@@ -111,3 +146,84 @@ impl Drop for TempDirGuard {
         let _ = std::fs::remove_dir_all(&self.0);
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::Path;
+
+    /// The premise the whole fix rests on: the instructions are sourced from a Markdown
+    /// rules file and are always multi-line. If `SKILL.md` ever became single-line, this
+    /// fix would no longer be guarding against anything real - this pins that it still is.
+    #[test]
+    fn the_instructions_prompt_is_multi_line() {
+        assert!(prompts::summary_instruction().contains('\n'));
+    }
+
+    /// The regression this fix exists to close: `codex exec` argv must never carry the
+    /// instructions prompt (or anything else newline-bearing) - that is exactly what makes
+    /// Rust's std refuse to spawn `codex.cmd` on Windows. A future edit that reintroduces
+    /// the prompt into `args` fails this test.
+    #[test]
+    fn codex_args_never_contains_a_newline() {
+        let args = codex_args(
+            Path::new("/tmp/schema.json"),
+            Path::new("/tmp/out.txt"),
+            "/tmp/home".into(),
+            "gpt-5.5",
+        );
+        for arg in &args {
+            assert!(!arg.contains('\n'), "argv entry carries a newline: {arg:?}");
+        }
+    }
+
+    #[test]
+    fn codex_args_omits_the_model_flag_when_unset() {
+        let args = codex_args(
+            Path::new("/tmp/schema.json"),
+            Path::new("/tmp/out.txt"),
+            "/tmp/home".into(),
+            "",
+        );
+        assert!(!args.contains(&"-m".to_string()));
+    }
+
+    #[test]
+    fn codex_args_carries_the_model_flag_when_set() {
+        let args = codex_args(
+            Path::new("/tmp/schema.json"),
+            Path::new("/tmp/out.txt"),
+            "/tmp/home".into(),
+            "gpt-5.5",
+        );
+        let i = args
+            .iter()
+            .position(|a| a == "-m")
+            .expect("-m flag present");
+        assert_eq!(args[i + 1], "gpt-5.5");
+    }
+
+    /// `codex exec`'s argv must carry NO positional prompt - the instructions now live
+    /// entirely in the stdin payload built by `codex_stdin_payload`.
+    #[test]
+    fn codex_args_has_no_positional_prompt() {
+        let args = codex_args(
+            Path::new("/tmp/schema.json"),
+            Path::new("/tmp/out.txt"),
+            "/tmp/home".into(),
+            "",
+        );
+        assert_eq!(args[0], "exec");
+        assert_eq!(
+            args[1], "-s",
+            "the second argv entry must be a flag, not a prompt"
+        );
+    }
+
+    #[test]
+    fn codex_stdin_payload_carries_both_the_instructions_and_the_transcript() {
+        let payload = codex_stdin_payload("the transcript");
+        assert!(payload.contains("the transcript"));
+        assert!(payload.starts_with(&prompts::summary_instruction()[..40]));
+    }
+}
diff --git a/src/coding_agent_session_ingest/summariser/copilot.rs b/src/coding_agent_session_ingest/summariser/copilot.rs
index dc00303e8..cf79e12e1 100644
--- a/src/coding_agent_session_ingest/summariser/copilot.rs
+++ b/src/coding_agent_session_ingest/summariser/copilot.rs
@@ -14,6 +14,16 @@
 //   analysis.
 // * No `--json-schema`, so the JSON contract rides in the prompt and
 //   `extract` tolerates fenced/prose-wrapped objects (codex pattern).
+//
+// KNOWN WINDOWS GAP: `copilot` is also npm-installed (`npm i -g @github/copilot`),
+// so it resolves to `copilot.cmd` on Windows the same as `codex`/`claude` - and this
+// prompt is always multi-line (it embeds `prompts::summary_instruction()` plus the
+// transcript), which is exactly what makes Rust's std refuse to spawn a `.bat`/`.cmd`
+// target (the CVE-2024-24576 "BatBadBut" fix; see `codex.rs`'s/`claude.rs`'s module
+// docs for the confirmed-live error). Unlike codex/claude, this one can't simply move
+// to stdin - `-p` ignores it, per the first divergence above. Left unfixed here; a
+// real fix needs a different mechanism (e.g. a temp-file prompt, if copilot supports
+// reading one) - not yet designed.
 
 use super::config::SummariserConfig;
 use super::prompts;
diff --git a/src/coding_agent_session_ingest/summariser/prompts.rs b/src/coding_agent_session_ingest/summariser/prompts.rs
index 4dd15df61..33e0ee03d 100644
--- a/src/coding_agent_session_ingest/summariser/prompts.rs
+++ b/src/coding_agent_session_ingest/summariser/prompts.rs
@@ -5,7 +5,7 @@
 // `session-summary` skill (same rules, in SKILL.md); Codex/Copilot/cursor-agent
 // get SUMMARY_INSTRUCTION as their prompt. All target SUMMARY_SCHEMA.
 
-use serde_json::json;
+use serde_json::{json, Value};
 
 /// Fingerprint of the summariser's own prompt. The source sweep refuses to
 /// ingest any conversation whose first user message carries this marker, so a
@@ -30,9 +30,10 @@ pub fn summary_instruction() -> String {
     )
 }
 
-/// Structured-output contract, serialized for `claude --json-schema` /
-/// `codex --output-schema`. `summary` is the prose we store.
-pub fn summary_schema_json() -> String {
+/// Structured-output contract, as a value - `codex --output-schema` needs the raw
+/// `Value` so `crate::llm::schema::strictify` can be applied to it before writing.
+/// `summary` is the prose we store.
+pub fn summary_schema_value() -> Value {
     json!({
         "type": "object",
         "properties": {
@@ -40,7 +41,14 @@ pub fn summary_schema_json() -> String {
         },
         "required": ["summary"],
     })
-    .to_string()
+}
+
+/// Structured-output contract, serialized for `claude --json-schema`. Claude's schema
+/// validation doesn't need OpenAI's strict dialect (unlike codex - see
+/// `crate::llm::claude::ClaudeBackend`, which also passes its schema through raw), so
+/// this stays the plain, un-strictified form.
+pub fn summary_schema_json() -> String {
+    summary_schema_value().to_string()
 }
 
 /// Substrings that mark a subscription usage/rate limit in CLI stderr/output —

From a212ccf28e1353d562752ce7a4d4f2d7830f5f5f Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 25 Aug 2026 23:01:43 +0530
Subject: [PATCH 07/53] chore: revert copilot.rs comment, leave file untouched

The Windows batch-file spawn gap in copilot.rs is real (same class as the
codex/claude fix in the previous commit - copilot is also npm-.cmd-shimmed
on Windows) but copilot's `-p` flag ignores stdin, so it can't take the same
fix without a separately-designed mechanism. Documenting it inline made the
pre-push security audit flag it as a new HIGH finding on every push touching
this crate, which isn't right for a pre-existing, unrelated condition this
change doesn't regress. Reverting to keep the file exactly as it was.
---
 src/coding_agent_session_ingest/summariser/copilot.rs | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/src/coding_agent_session_ingest/summariser/copilot.rs b/src/coding_agent_session_ingest/summariser/copilot.rs
index cf79e12e1..dc00303e8 100644
--- a/src/coding_agent_session_ingest/summariser/copilot.rs
+++ b/src/coding_agent_session_ingest/summariser/copilot.rs
@@ -14,16 +14,6 @@
 //   analysis.
 // * No `--json-schema`, so the JSON contract rides in the prompt and
 //   `extract` tolerates fenced/prose-wrapped objects (codex pattern).
-//
-// KNOWN WINDOWS GAP: `copilot` is also npm-installed (`npm i -g @github/copilot`),
-// so it resolves to `copilot.cmd` on Windows the same as `codex`/`claude` - and this
-// prompt is always multi-line (it embeds `prompts::summary_instruction()` plus the
-// transcript), which is exactly what makes Rust's std refuse to spawn a `.bat`/`.cmd`
-// target (the CVE-2024-24576 "BatBadBut" fix; see `codex.rs`'s/`claude.rs`'s module
-// docs for the confirmed-live error). Unlike codex/claude, this one can't simply move
-// to stdin - `-p` ignores it, per the first divergence above. Left unfixed here; a
-// real fix needs a different mechanism (e.g. a temp-file prompt, if copilot supports
-// reading one) - not yet designed.
 
 use super::config::SummariserConfig;
 use super::prompts;

From 6230666c1452a51993aeba05d932903ff9ed0dad Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Wed, 26 Aug 2026 09:58:56 +0530
Subject: [PATCH 08/53] fix(infra): assert the gateway's 401 instead of
 printing a reminder about it

`scripts/deploy-gateway.sh` ended with an `echo` telling a human that
`telemetry.meridiona.com` "should 401 without a Bearer token". It sent no
request and failed on nothing, so a gateway that started answering 200
unauthenticated would deploy green - the one automated gate on the rule
CLAUDE.md added after `infra/hf-proxy` reached 173,088 requests in a day
and took meridiona.com down with Error 1027.

The deploy now probes both public hostnames after `up -d` and exits
non-zero unless all four answer 401:

  ingest  no credentials      POST /v1/logs
  ingest  wrong bearer token  POST /v1/logs with a junk Bearer
  oo-ui   no credentials      GET /
  oo-ui   wrong basic auth    GET / with junk basic creds

The wrong-credential probes are not redundant. An unauthenticated 401
still passes if `bearertokenauth` were swapped for something that merely
checks the header is PRESENT; only a bad token proves the value is
validated. Same reasoning for the UI's basic auth.

Two properties are load-bearing:

- A 200 fails IMMEDIATELY rather than being retried. It is the
  catastrophe the check exists to catch, and retrying only delays it.
- An exhausted retry budget FAILS. `000` covers both "collector still
  binding :4318" and "DNS gone / TLS broken / egress blocked", which are
  indistinguishable from the status alone, so it is retried and then
  fails. A retry loop that fell through to success would reproduce
  exactly the bug being fixed here.

Testing. `classify_probe` is pure, and `--self-test` exercises all 15
status cases offline. Mutation-tested three ways to prove it is not
vacuous: 200->pass goes red on the 200 case, dropping 000 from the retry
set goes red on the 000 case, and a catch-all `pass` goes red on 9 cases.

`--verify-only` runs the four probes with no deploy - added because the
alternative way to exercise this code was to run a production deploy.
Dry-run against the live gateway: all four return 401 in 2.1s. Both
failure paths exercised too - a host answering 200 fails immediately,
and an unresolvable host retries to the budget and then fails rather
than passing silently.

CLAUDE.md's hard rule said verification "is currently a MANUAL step".
Updated to describe what the script now does, including the two
properties above, since those are what a future edit would regress.

Closes #864
---
 CLAUDE.md                 |   2 +-
 scripts/deploy-gateway.sh | 188 +++++++++++++++++++++++++++++++++++++-
 2 files changed, 185 insertions(+), 5 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 7f42cc669..3411b9528 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -19,7 +19,7 @@ Meridian is a single-process Rust daemon that normalises raw screen-capture fram
 - NEVER push directly to `main` or `pre-main` — always create a separate feature branch, commit there, and raise a PR to `pre-main`. **All features, fixes, and other changes target `pre-main`** (the staging branch), not `main` — only a maintainer opens the `pre-main → main` release PR, and only after everything on `pre-main` has been tested end-to-end on staging
 - ALWAYS use a separate branch per feature/fix — branch name format: `type/short-description` (e.g. `feat/trello-oauth`, `fix/ui-disconnect`)
 - In all **user-facing app text** — window titles, wizard/UI copy, button and menu labels, notification bodies, tray tooltips, any string the user reads — use a plain hyphen `-` only. NEVER an em-dash (`—`), en-dash (`–`), or double hyphen (`--`). Use it spaced (` - `) where a dash separates clauses. (This rule is about displayed strings; code comments and docs are exempt.)
-- **Any publicly reachable service we deploy must authenticate every request, validate its origin, allowlist the paths it serves, and rate-limit — and it gets deleted the day its last caller does.** "Authenticate" is separate from "validate the origin" on purpose: an origin check alone is a header a caller controls, and reading the two as one requirement is what permits an unauthenticated public service. An unauthenticated request must be rejected outright with a 401, and **verifying that is currently a MANUAL step** — `scripts/deploy-gateway.sh` only prints "should 401 without a Bearer token" as a reminder at the end of a deploy; it sends no request and fails on nothing, so a gateway that started answering 200 unauthenticated would deploy green. `infra/hf-proxy` (`hf.meridiona.com`) was an unauthenticated reverse proxy to huggingface.co. Its header carried a thoughtful `SECURITY:` block about cache-key poisoning and auth headers leaking into a shared cache; it never asked *who may call this*. When the MLX stack that used it was deleted it kept running with no callers and a public DNS record — and Cloudflare publishes every hostname to the Certificate Transparency logs the moment it issues the cert, so scanners find it whether or not you advertise it. It reached **173,088 requests in a day** against a 100k/day account-wide cap and took meridiona.com down with Error 1027 for traffic the site did not generate. Assume every hostname you provision is public knowledge immediately.
+- **Any publicly reachable service we deploy must authenticate every request, validate its origin, allowlist the paths it serves, and rate-limit — and it gets deleted the day its last caller does.** "Authenticate" is separate from "validate the origin" on purpose: an origin check alone is a header a caller controls, and reading the two as one requirement is what permits an unauthenticated public service. An unauthenticated request must be rejected outright with a 401, and **`scripts/deploy-gateway.sh` now asserts that rather than printing a reminder about it** — after `up -d` it probes both public hostnames four ways (ingest and OO UI × no credentials and wrong credentials) and exits non-zero unless every one answers 401, so a gateway that started answering 200 unauthenticated fails the deploy instead of going green. The wrong-credential probes are not redundant: an unauthenticated 401 still passes if an authenticator were swapped for one that merely checks a header is *present*. Two properties are load-bearing and easy to regress — a `200` fails immediately rather than being retried, and an exhausted retry budget (`000`/5xx, i.e. the stack never came up) **fails** rather than falling through to success, which is exactly the shape of the bug it replaced. `bash scripts/deploy-gateway.sh --self-test` exercises the status classifier offline; `--verify-only` runs the four probes against the live gateway without deploying. `infra/hf-proxy` (`hf.meridiona.com`) was an unauthenticated reverse proxy to huggingface.co. Its header carried a thoughtful `SECURITY:` block about cache-key poisoning and auth headers leaking into a shared cache; it never asked *who may call this*. When the MLX stack that used it was deleted it kept running with no callers and a public DNS record — and Cloudflare publishes every hostname to the Certificate Transparency logs the moment it issues the cert, so scanners find it whether or not you advertise it. It reached **173,088 requests in a day** against a 100k/day account-wide cap and took meridiona.com down with Error 1027 for traffic the site did not generate. Assume every hostname you provision is public knowledge immediately.
 
 ---
 
diff --git a/scripts/deploy-gateway.sh b/scripts/deploy-gateway.sh
index b006e25c9..409698088 100644
--- a/scripts/deploy-gateway.sh
+++ b/scripts/deploy-gateway.sh
@@ -30,15 +30,170 @@ ZONE="${GATEWAY_ZONE:-asia-south1-a}"
 PROJECT="${GATEWAY_PROJECT:-meridiona-observability}"
 REMOTE_DIR="central-observability"
 
+# The two public hostnames Caddy serves (see ops/central-observability/Caddyfile).
+# Deliberately NOT read from the VM's .env: this check's whole value is that it
+# always runs, and an ssh round-trip to discover the domain adds a failure mode
+# where a flake means we can't determine what to probe. If a domain ever drifts,
+# probing the old name fails loudly — which is the correct outcome, not a skip.
+GATEWAY_DOMAIN="${GATEWAY_DOMAIN:-telemetry.meridiona.com}"
+OO_UI_DOMAIN="${OO_UI_DOMAIN:-observe.meridiona.com}"
+
+# How long to keep retrying a transient probe result before giving up. `up -d`
+# returns as soon as the containers are created, so the collector can still be
+# binding :4318 when the first probe lands.
+PROBE_TIMEOUT_S="${PROBE_TIMEOUT_S:-90}"
+PROBE_INTERVAL_S="${PROBE_INTERVAL_S:-3}"
+
 # Everything git owns. `.env` is intentionally not here — see the header.
 FILES=(docker-compose.yml otel-collector-config.yaml Caddyfile .env.example)
 
-SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")/../ops/central-observability" && pwd)"
-
 ssh_vm() {
 	gcloud compute ssh "${VM}" --zone="${ZONE}" --project="${PROJECT}" --command "$1"
 }
 
+# ── Post-deploy auth assertion ───────────────────────────────────────────────
+#
+# CLAUDE.md's hard rule requires that an unauthenticated request to anything we
+# expose publicly is rejected outright with a 401.
+#
+# This used to be an `echo` at the end of the deploy telling a human to go and
+# check. It sent no request and failed on nothing, so a gateway that started
+# answering 200 unauthenticated would deploy green and stay that way until
+# somebody noticed — which is the shape of the `infra/hf-proxy` incident
+# (173,088 requests in a day against a service that had no callers at all). See
+# the Hard Rules section of CLAUDE.md for the full story.
+
+# Map an observed HTTP status onto one of three verdicts. Pure — no network, no
+# globals — so `--self-test` can exercise every branch offline.
+#
+#   pass   the required 401
+#   retry  the stack is plausibly still coming up (Caddy up, collector not yet)
+#   reject anything else, INCLUDING 2xx/3xx/4xx that are not 401
+#
+# 200 must never be retried: a success on an unauthenticated request is the
+# catastrophe this check exists to catch, and retrying it only delays the
+# failure. A 400 likewise rejects immediately — it means the body reached the
+# collector, i.e. the request got PAST auth.
+classify_probe() {
+	case "$1" in
+	401) echo pass ;;
+	000 | 429 | 502 | 503 | 504) echo retry ;;
+	*) echo reject ;;
+	esac
+}
+
+# Probe one URL until it returns 401 or the budget runs out.
+#
+# `000` is curl's code for "no HTTP response at all" and covers both a collector
+# that has not finished starting AND a dead DNS record / broken TLS / blocked
+# egress. Those are indistinguishable from the status alone, so it is retried
+# and then FAILS — an exhausted retry loop must never fall through to success,
+# which would reproduce the very bug this replaces.
+probe_rejects_unauthenticated() {
+	local label="$1" url="$2"
+	shift 2
+	local deadline=$((SECONDS + PROBE_TIMEOUT_S)) code verdict
+	while :; do
+		code="$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 "$@" "${url}" || true)"
+		verdict="$(classify_probe "${code}")"
+		case "${verdict}" in
+		pass)
+			echo "  ok   ${label} -> 401"
+			return 0
+			;;
+		reject)
+			echo "  FAIL ${label} -> ${code} (expected 401)" >&2
+			return 1
+			;;
+		retry)
+			if [ "${SECONDS}" -ge "${deadline}" ]; then
+				echo "  FAIL ${label} -> ${code} after ${PROBE_TIMEOUT_S}s (expected 401)" >&2
+				return 1
+			fi
+			sleep "${PROBE_INTERVAL_S}"
+			;;
+		esac
+	done
+}
+
+# Assert both public hostnames reject callers who have no credentials AND
+# callers whose credentials are wrong.
+#
+# The wrong-credential probes are the ones that earn their keep. An
+# unauthenticated 401 still passes if the auth extension were swapped for
+# something that merely checks a header is PRESENT; only a bad token proves the
+# value is actually validated.
+verify_public_endpoints_authenticate() {
+	local failed=0
+	probe_rejects_unauthenticated \
+		"ingest  no credentials     " "https://${GATEWAY_DOMAIN}/v1/logs" \
+		-X POST -H 'Content-Type: application/json' --data '{}' || failed=1
+	probe_rejects_unauthenticated \
+		"ingest  wrong bearer token " "https://${GATEWAY_DOMAIN}/v1/logs" \
+		-X POST -H 'Content-Type: application/json' \
+		-H 'Authorization: Bearer deploy-gateway-probe-not-a-real-token' --data '{}' || failed=1
+	probe_rejects_unauthenticated \
+		"oo-ui   no credentials     " "https://${OO_UI_DOMAIN}/" || failed=1
+	probe_rejects_unauthenticated \
+		"oo-ui   wrong basic auth   " "https://${OO_UI_DOMAIN}/" \
+		-u 'deploy-gateway-probe:not-a-real-password' || failed=1
+	return "${failed}"
+}
+
+# Run the auth assertion on its own, without deploying anything. Two uses: an
+# operator re-checking a gateway they did not just deploy, and testing a change
+# to the probes themselves — the alternative is running a production deploy to
+# exercise four read-only curls.
+if [ "${1:-}" = "--verify-only" ]; then
+	echo "==> verifying ${GATEWAY_DOMAIN} and ${OO_UI_DOMAIN} reject unauthenticated callers"
+	if verify_public_endpoints_authenticate; then
+		echo "==> ok. Both hostnames require credentials."
+		exit 0
+	fi
+	echo "==> FAILED. See above." >&2
+	exit 1
+fi
+
+# Offline check that `classify_probe` still discriminates. Run it after touching
+# the table above:  bash scripts/deploy-gateway.sh --self-test
+if [ "${1:-}" = "--self-test" ]; then
+	self_test_failures=0
+	while read -r code want; do
+		[ -z "${code}" ] && continue
+		got="$(classify_probe "${code}")"
+		if [ "${got}" != "${want}" ]; then
+			echo "FAIL classify_probe ${code}: want ${want}, got ${got}" >&2
+			self_test_failures=$((self_test_failures + 1))
+		fi
+	done <<-'CASES'
+		401 pass
+		200 reject
+		201 reject
+		204 reject
+		301 reject
+		302 reject
+		400 reject
+		403 reject
+		404 reject
+		500 reject
+		000 retry
+		429 retry
+		502 retry
+		503 retry
+		504 retry
+	CASES
+	if [ "${self_test_failures}" -ne 0 ]; then
+		echo "self-test: ${self_test_failures} case(s) failed" >&2
+		exit 1
+	fi
+	echo "self-test: classify_probe ok"
+	exit 0
+fi
+
+# Resolved here rather than at the top so `--self-test` above stays purely
+# offline — it must not depend on being run from inside a checkout.
+SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")/../ops/central-observability" && pwd)"
+
 echo "==> deploying ${SRC} -> ${VM} (${ZONE}, ${PROJECT})"
 
 for f in "${FILES[@]}"; do
@@ -70,5 +225,30 @@ ssh_vm "cd ${REMOTE_DIR} && docker compose config -q && echo '  ok'"
 echo "==> applying"
 ssh_vm "cd ${REMOTE_DIR} && docker compose up -d && docker compose ps"
 
-echo "==> done. Verify ingest still works before walking away:"
-echo "    https://telemetry.meridiona.com  should 401 without a Bearer token"
+echo "==> verifying both public hostnames reject unauthenticated callers"
+if ! verify_public_endpoints_authenticate; then
+	cat >&2 <<-EOF
+
+		DEPLOY FAILED ITS AUTH CHECK.
+
+		A hostname we expose publicly did not answer 401. Treat this as live:
+		Cloudflare publishes every hostname to the Certificate Transparency logs
+		the moment it issues the cert, so scanners find it whether or not it is
+		advertised.
+
+		  - 2xx/4xx-not-401 on ingest: the collector's bearertokenauth/ingest
+		    authenticator is not gating the OTLP receiver. Check
+		    otel-collector-config.yaml's receivers.otlp.protocols.http.auth and
+		    that INGEST_TOKEN is set in the VM's .env.
+		  - 2xx on the OO UI: Caddy's basic_auth block is not applying. Check
+		    OO_UI_USER / OO_UI_PASSWORD_HASH in the VM's .env.
+		  - persistent 000/5xx: the stack never came up. \`docker compose ps\`
+		    and \`docker compose logs\` on the VM.
+
+		The new config IS already applied — this check runs after \`up -d\`. Roll
+		back or fix forward, but do not walk away from it.
+	EOF
+	exit 1
+fi
+
+echo "==> done."

From a4715fa8a0b21c6c0dceef7c89e7e0428001714b Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Wed, 26 Aug 2026 10:19:54 +0530
Subject: [PATCH 09/53] fix(daemon): make single-instance acquisition atomic
 with an OS lock

`main()` guarded against a second daemon with a PROBE - "is anyone
listening on the endpoint?" - and then ran `setup_db` (pool + migrations,
including live `ALTER TABLE`s) before binding the listener at 5b.

That bind is deliberately late, so a daemon about to `exit(1)` on a
locked/corrupt database never advertises `{"running":true}` to the tray's
watchdog. The reasoning is sound and is kept. But it means the winner of
a two-daemon race has NOT bound anything at the moment the loser probes,
so both get `false`, both fall through, and both run migrations on one
`meridian.db`. Check-then-act, not acquire.

A test named `single_instance_check_precedes_setup_db_and_bind_follows_it`
asserted, in its own message, that "a daemon that will lose that race must
never touch meridian.db". It could only pin the ORDER of three call
sites, and the order was already correct - the ordering was never the
gap. So it recorded confidence in a guarantee that did not hold.

## The lock

`platform::acquire_single_instance_lock` takes an exclusive, non-blocking
lock on `~/.meridian/daemon.lock` BEFORE `setup_db`, held for the
process's life:

- Unix: `flock(LOCK_EX | LOCK_NB)`
- Windows: `LockFileEx(LOCKFILE_EXCLUSIVE_LOCK | LOCKFILE_FAIL_IMMEDIATELY)`

Both attach to the open file description, so the OS releases them when
the process dies however it dies - no stale-lock state to misjudge. The
file is never unlinked: deleting it would let a later start create a new
inode and lock THAT, so two processes could each hold "the" lock.

Windows deliberately does not use a `share_mode(0)` exclusive open. That
fails with ERROR_SHARING_VIOLATION when anything else merely has the file
open - an antivirus scanner, a backup agent - which is indistinguishable
from a real second daemon. `LockFileEx` on a shared handle gives
ERROR_LOCK_VIOLATION for genuine contention only.

## Three outcomes, not two - the part that keeps this from being an outage

  Acquired      -> proceed
  HeldByAnother -> stand down cleanly, as the probe already does
  Unavailable   -> WARN and proceed UNLOCKED

`Unavailable` covers a home dir that can't be created, a read-only fs,
permissions, and any errno that isn't EWOULDBLOCK/EAGAIN. Before this
lock there was no lock at all, so running on is exactly the previous
behaviour and forfeits nothing that was ever guaranteed. Standing down
would instead be a brand-new way for the daemon to be permanently dead on
a machine where nothing was wrong. A guard against a rare race must not
be able to cause a common outage.

## The probe stays

It is the cheap, informative check, it produces the better log line, and
it is the only thing that sees a daemon from a build predating this lock -
i.e. every daemon during the rollout window. Neither is redundant; both
comments say so, so a future reader doesn't delete one.

## Testing

Behavioural, not source-scanning: the lock conflicts across two `open`s in
one process (it binds to the file description), so the real guarantee is
testable without spawning daemons.

- `a_second_acquire_of_the_same_path_loses`
- `dropping_the_guard_releases_the_lock` (+ the file must survive)
- `an_unusable_path_is_unavailable_not_held`, covering BOTH pre-syscall
  failure branches - an early version covered only one and passed
  unchanged when the other was broken

Mutation-proved: flock forced to always succeed -> the first test fails;
each `Unavailable` branch rewritten to `HeldByAnother` -> the third fails
on the matching assertion; the acquire removed from `main` -> the
ordering test fails.

End-to-end, two real daemons under an isolated HOME. With the winner's
socket removed so the probe is blind - exactly the real race - the second
daemon stood down on the LOCK and ran zero migrations.

Windows code compiled for x86_64-pc-windows-msvc in isolation (the full
cross-build dies in `ring`'s C step on macOS, so it never reaches this
module).

Both deps were already in the tree: +2 lockfile lines, no new crates.

`spawn_health_listener`'s own unlink-then-bind is still check-then-act.
The lock makes it unreachable for two daemons; leaving it otherwise
untouched is deliberate - #862 owns that boundary.

Closes #861
---
 Cargo.lock              |   2 +
 Cargo.toml              |  19 +++
 src/main.rs             |  97 ++++++++++++--
 src/platform/mod.rs     | 271 ++++++++++++++++++++++++++++++++++++++--
 src/platform/unix.rs    |  42 +++++++
 src/platform/windows.rs |  58 +++++++++
 6 files changed, 471 insertions(+), 18 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2872bc2b6..208b610e2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5150,6 +5150,7 @@ dependencies = [
  "http",
  "jsonschema",
  "keyring",
+ "libc",
  "libsqlite3-sys",
  "meridian-core",
  "meridian-oauth",
@@ -5180,6 +5181,7 @@ dependencies = [
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 994cc97ac..ce21fde30 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -204,6 +204,25 @@ candle-core = "0.10"
 candle-nn = "0.10"
 candle-transformers = "0.10"
 
+# `flock` for the daemon's single-instance lock (src/platform/unix.rs). Three
+# lines of FFI; `libc` is already in the tree transitively, so this adds no
+# build cost. Deliberately not `fs2`/`fd-lock`: both wrap this same call, and
+# neither surfaces the errno, which is the ONE thing this code needs — telling
+# "another daemon holds it" apart from "the lock could not be attempted" is
+# what keeps a failed lock from bricking an install.
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
+
+# `LockFileEx` for the same lock on Windows (src/platform/windows.rs). Version
+# pinned to 0.61 to match what the tray already resolves, rather than adding a
+# seventh windows-sys in the tree.
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = [
+    "Win32_Foundation",
+    "Win32_Storage_FileSystem",
+    "Win32_System_IO",
+] }
+
 [dev-dependencies]
 tokio       = { version = "1.15", features = ["full", "test-util"] }
 tempfile    = "3"
diff --git a/src/main.rs b/src/main.rs
index cada9f44d..e596a0e4a 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1053,8 +1053,10 @@ async fn main() -> Result<()> {
         return Ok(());
     }
 
-    // 4a-ter. Single-instance guard — CHECKED here, before `setup_db`, even
-    //     though the listener isn't bound until 5b below.
+    // 4a-ter. Single-instance guard, part 1 of 2: the endpoint PROBE. Cheap,
+    //     informative, and not authoritative — 4a-quater below is the acquire.
+    //     Checked here, before `setup_db`, even though the listener isn't
+    //     bound until 5b.
     //
     //     ~/.meridian/daemon.sock: a successful connect that gets a greeting
     //     means ANOTHER daemon already owns this data dir. That happens
@@ -1070,7 +1072,8 @@ async fn main() -> Result<()> {
     //     and ran migrations — including a live `ALTER TABLE` — against a
     //     file the winning daemon could simultaneously be writing to or
     //     checkpointing. Checking before `setup_db` means a losing daemon
-    //     never touches meridian.db at all.
+    //     never touches meridian.db at all — but only for a race this probe
+    //     can SEE, which is why the lock at 4a-quater exists.
     //
     //     Only a stale socket (no listener) is removed, and only right before
     //     THIS process binds its own — see the bind site below. Whoever starts
@@ -1092,6 +1095,57 @@ async fn main() -> Result<()> {
         return Ok(());
     }
 
+    // 4a-quater. ACQUIRE the single-instance lock. The check above is a probe;
+    //     this is the acquire, and the difference is the whole point.
+    //
+    //     `daemon_already_running` asks "is anyone listening?" — and the winner
+    //     of a two-daemon race has NOT bound its listener at that moment,
+    //     because the bind is deliberately deferred to 5b so a daemon about to
+    //     `exit(1)` on a corrupt database never advertises `{"running":true}`.
+    //     So two daemons starting together both see nothing, both fall through,
+    //     and both run `setup_db` — migrations included, `ALTER TABLE`
+    //     included — against one file. That is check-then-act, and this repo
+    //     has a documented history of `database disk image is malformed`
+    //     attributed to exactly two writers.
+    //
+    //     `flock`/`LockFileEx` is atomic: exactly one caller wins however the
+    //     two interleave. The guard is held for the rest of the process's life
+    //     and released by the OS when the process dies, however it dies — so
+    //     there is no stale lock to reason about and nothing to clean up.
+    //
+    //     The probe stays. It is the cheap, informative check, it produces the
+    //     better log line, and it is the ONLY thing that sees a daemon from a
+    //     build predating this lock — which is every daemon during the rollout
+    //     window. Neither is redundant.
+    //
+    //     `None` below is "running unlocked", not "no lock needed" — see the
+    //     Unavailable arm.
+    let _single_instance_lock = match meridian::platform::acquire_single_instance_lock() {
+        meridian::platform::LockOutcome::Acquired(guard) => Some(guard),
+        meridian::platform::LockOutcome::HeldByAnother => {
+            tracing::warn!(
+                "another meridian daemon holds the single-instance lock for this data dir — exiting (lock)"
+            );
+            return Ok(());
+        }
+        // Could not find out. Proceed UNLOCKED rather than refuse to start:
+        // before this lock existed there was no lock at all, so running on is
+        // exactly the previous behaviour and gives up nothing that was ever
+        // guaranteed. Standing down here would instead be a brand-new way for
+        // the daemon to be permanently dead on a machine where nothing is
+        // wrong (a read-only home, an odd errno, an antivirus holding the
+        // file). A guard against a rare race must not be able to cause a
+        // common outage.
+        meridian::platform::LockOutcome::Unavailable(e) => {
+            tracing::warn!(
+                error = %e, // not-anyhow: a String the acquire already formatted with its full cause; there is no chain to walk
+                "could not take the single-instance lock — continuing without it; \
+                 the endpoint probe above remains the only guard this start has"
+            );
+            None
+        }
+    };
+
     // 4b. Open / create meridian pool and run migrations FIRST — before any
     //     preflight that can block or fail. The UI and MCP server read this DB
     //     directly, so it must exist even when an optional component (capture,
@@ -1138,9 +1192,17 @@ async fn main() -> Result<()> {
     //     would let a daemon that's about to `exit(1)` on a locked or corrupt
     //     database falsely tell the tray's watchdog it's healthy for the
     //     brief window before that failure surfaces. Safe to bind
-    //     unconditionally here: the check above already established nothing
-    //     else is listening, and nothing between there and here binds it out
-    //     from under us (both single-threaded up to the poll loop).
+    //     unconditionally here: we hold the single-instance lock taken at
+    //     4a-quater, so no other daemon process reached this line at all. (The
+    //     older justification — "the check above established nothing else is
+    //     listening, and we're single-threaded up to the poll loop" — was only
+    //     ever about THIS process's threads and said nothing about a second
+    //     process. The lock is what actually makes this claim true.)
+    //
+    //     NOTE: `spawn_health_listener` itself unlinks a stale socket and then
+    //     binds, which is its own check-then-act across processes. The lock
+    //     makes that unreachable for two daemons, but the sequence is left
+    //     untouched here on purpose — #862 owns that boundary.
     meridian::platform::spawn_health_listener()?;
     tracing::info!(endpoint = %meridian::platform::endpoint_display(), "daemon health endpoint ready");
 
@@ -1643,7 +1705,7 @@ mod startup_order_tests {
     /// `every_early_return_still_restores_the_daemon`) — this scans the
     /// source for the three call sites and asserts their relative order.
     #[test]
-    fn single_instance_check_precedes_setup_db_and_bind_follows_it() {
+    fn single_instance_lock_precedes_setup_db_and_bind_follows_it() {
         const SRC: &str = include_str!("main.rs");
         // Truncate at THIS test module first — the file scans itself, and the
         // needles below (`daemon_already_running`, `setup_db(&initial_cfg`)
@@ -1657,6 +1719,9 @@ mod startup_order_tests {
         let check_pos = prod
             .find("meridian::platform::daemon_already_running().await")
             .expect("the single-instance guard's check call must exist in main()");
+        let lock_pos = prod
+            .find("meridian::platform::acquire_single_instance_lock()")
+            .expect("the single-instance LOCK acquire must exist in main()");
         let setup_db_pos = prod
             .find("setup_db(&initial_cfg.meridian_db_uri()).await")
             .expect("the setup_db() call must exist in main()");
@@ -1665,11 +1730,21 @@ mod startup_order_tests {
             .expect("the health-listener bind call must exist in main()");
 
         assert!(
-            check_pos < setup_db_pos,
-            "the single-instance guard must be CHECKED before setup_db() opens \
+            check_pos < lock_pos,
+            "the cheap endpoint probe should run before the lock acquire, so \
+             the common case (a daemon that is plainly already up) produces \
+             the informative log line. Found check at byte {check_pos}, lock \
+             at byte {lock_pos}."
+        );
+        assert!(
+            lock_pos < setup_db_pos,
+            "the single-instance lock must be ACQUIRED before setup_db() opens \
              the pool and runs migrations — a daemon that will lose that race \
-             must never touch meridian.db. Found check at byte {check_pos}, \
-             setup_db at byte {setup_db_pos}."
+             must never touch meridian.db. This assertion used to name the \
+             PROBE instead, which is why it passed for two releases while the \
+             hazard was wide open: the probe is check-then-act, so both racers \
+             pass it. Only the lock is an acquire. Found lock at byte \
+             {lock_pos}, setup_db at byte {setup_db_pos}."
         );
         assert!(
             setup_db_pos < bind_pos,
diff --git a/src/platform/mod.rs b/src/platform/mod.rs
index 906b8c69d..bb8fca26c 100644
--- a/src/platform/mod.rs
+++ b/src/platform/mod.rs
@@ -1,15 +1,22 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
 //! OS-specific daemon plumbing, behind one interface.
 //!
-//! Two concerns live here because both are genuinely unavailable in portable
-//! form and both are load-bearing at startup:
+//! Three concerns live here because each is genuinely unavailable in portable
+//! form and each is load-bearing at startup:
 //!
-//! - **The IPC endpoint** — simultaneously the tray/UI health probe and the
-//!   single-instance guard. A Unix domain socket on Unix, a named pipe on
-//!   Windows.
+//! - **The IPC endpoint** — the tray/UI health probe, and a first, cheap look
+//!   at whether another daemon is up. A Unix domain socket on Unix, a named
+//!   pipe on Windows.
+//! - **The single-instance lock** — the *authoritative* guard, and the one
+//!   thing here that is atomic. [`acquire_single_instance_lock`], `flock` on
+//!   Unix and `LockFileEx` on Windows.
 //! - **The shutdown signal set** — `SIGINT`/`SIGTERM`/`SIGHUP` on Unix,
 //!   Ctrl-C / console-close / system-shutdown events on Windows.
 //!
+//! The first two are easy to mistake for one thing. They are not: see
+//! [`acquire_single_instance_lock`] for why the probe cannot replace the lock,
+//! and why the lock does not make the probe redundant.
+//!
 //! # Why a module rather than inline `cfg`
 //!
 //! The repo's convention is that leaf-level differences (a field, a single
@@ -33,9 +40,13 @@
 //! a false `false` means two daemons write one `meridian.db`, double every ETL
 //! pass, and fire the worklog trigger twice.
 //!
+//! What it does NOT promise, and what the lock is for: it is a **probe**, so
+//! two daemons starting together can both get `false` and both proceed. The
+//! answer is only true of the instant it was asked.
+//!
 //! # Who calls this
-//! `src/main.rs`, at startup (single-instance check, then listener) and around
-//! the main loop's shutdown select.
+//! `src/main.rs`, at startup (probe, then lock, then pool, then listener) and
+//! around the main loop's shutdown select.
 
 #[cfg(unix)]
 mod unix;
@@ -53,6 +64,252 @@ pub use windows::{
     service_manifest, service_status, spawn_health_listener, wait_for_shutdown,
 };
 
+// ── Single-instance lock ────────────────────────────────────────────────────
+
+/// Why a lock attempt did not succeed.
+///
+/// The distinction is the whole point of this type, and collapsing it is how
+/// this change would turn from a fix into an outage — see [`LockOutcome`].
+pub(crate) enum LockError {
+    /// Another live process holds the lock. Authoritative: the OS says so.
+    Held,
+    /// The lock could not be attempted or answered at all — the directory
+    /// could not be created, the filesystem is read-only, permissions deny it,
+    /// or the syscall failed for a reason that is not contention.
+    Other(String),
+}
+
+/// What [`acquire_single_instance_lock`] concluded.
+///
+/// Three states, not two, deliberately:
+///
+/// - [`Acquired`](Self::Acquired) — this process owns the data dir. Proceed.
+/// - [`HeldByAnother`](Self::HeldByAnother) — a live daemon owns it. Stand
+///   down cleanly, exactly as the endpoint probe already does.
+/// - [`Unavailable`](Self::Unavailable) — we could not find out. **Proceed
+///   unlocked**, with a warning.
+///
+/// That last one is not defensive padding, it is the safety property. Before
+/// this lock existed there was no lock at all, so running unlocked is precisely
+/// the status quo and costs nothing that was previously guaranteed. Refusing to
+/// start, by contrast, would be a BRAND NEW way for the daemon to be
+/// permanently dead on a machine where nothing was actually wrong — a
+/// read-only home directory or an odd `errno` would brick an install that
+/// worked fine yesterday. A guard against a rare race must never be able to
+/// cause a common outage.
+pub enum LockOutcome {
+    /// The lock is held by this process for as long as the guard lives.
+    Acquired(DaemonLock),
+    /// Another process holds it. Do not touch `meridian.db`.
+    HeldByAnother,
+    /// Indeterminate; the string is the underlying error for the log.
+    Unavailable(String),
+}
+
+/// Ownership of the single-instance lock, released when this is dropped.
+///
+/// Holds the open file and nothing else: on both platforms the lock is tied to
+/// the open file description, so the OS drops it when the handle closes —
+/// including on `SIGKILL`, a panic, or a power loss. That is what makes this
+/// safe where a marker FILE would not be: there is no stale state to clean up
+/// and therefore no "is this leftover lock real?" question to get wrong.
+///
+/// The file itself is never deleted. Unlinking on shutdown would reintroduce
+/// exactly the race being closed (process A unlinks while B holds a lock on the
+/// same inode; C then creates a fresh file and locks that instead, and A and C
+/// both believe they are alone).
+pub struct DaemonLock {
+    _file: std::fs::File,
+}
+
+/// `~/.meridian/daemon.lock` — the file whose lock means "this process owns
+/// this data directory".
+///
+/// Sits beside `daemon.sock` and scopes to the same data dir the endpoint does,
+/// so the two guards answer about the same thing.
+fn lock_path() -> std::path::PathBuf {
+    meridian_core::paths::home_dir_or_cwd()
+        .join(".meridian")
+        .join("daemon.lock")
+}
+
+/// Take the single-instance lock for this data directory.
+///
+/// # Why this exists alongside [`daemon_already_running`]
+///
+/// They are not redundant, and deleting either one reopens a real hazard:
+///
+/// - The **endpoint probe** is the cheap, informative check. It produces the
+///   good log line, and it is the only thing that sees a daemon from a build
+///   that predates this lock — which matters for the whole rollout window
+///   during which an old daemon takes no lock at all.
+/// - **This lock** is the authoritative one. The probe is check-then-act: two
+///   daemons starting together both find nothing listening (the winner has not
+///   bound its listener yet — the bind is deliberately deferred until after
+///   the database is open) and both proceed into `setup_db`, running
+///   migrations on one file. `flock`/`LockFileEx` is an atomic acquire, so
+///   exactly one caller wins no matter how the two are interleaved.
+///
+/// # Related
+/// - `src/main.rs` — the sole caller, immediately before `setup_db`.
+/// - [`LockOutcome`] — why a failure to lock does not stop the daemon.
+pub fn acquire_single_instance_lock() -> LockOutcome {
+    acquire_lock_at(&lock_path())
+}
+
+/// [`acquire_single_instance_lock`] against an explicit path, so the behaviour
+/// can be tested without touching the real `~/.meridian`.
+fn acquire_lock_at(path: &std::path::Path) -> LockOutcome {
+    if let Some(parent) = path.parent() {
+        if let Err(e) = std::fs::create_dir_all(parent) {
+            return LockOutcome::Unavailable(format!("could not create {}: {e}", parent.display()));
+        }
+    }
+    // Opened read+write and SHARED (no exclusive share mode on Windows): the
+    // lock is taken as a separate, explicit step below. Opening exclusively
+    // would conflict with anything else that merely has the file open — an
+    // antivirus scanner, a backup agent — and that is indistinguishable from a
+    // real second daemon, which is the one mistake that must not be made here.
+    let file = match std::fs::OpenOptions::new()
+        .read(true)
+        .write(true)
+        .create(true)
+        .truncate(false)
+        .open(path)
+    {
+        Ok(f) => f,
+        Err(e) => {
+            return LockOutcome::Unavailable(format!("could not open {}: {e}", path.display()))
+        }
+    };
+    match lock_file_exclusive(&file) {
+        Ok(()) => LockOutcome::Acquired(DaemonLock { _file: file }),
+        Err(LockError::Held) => LockOutcome::HeldByAnother,
+        Err(LockError::Other(e)) => LockOutcome::Unavailable(e),
+    }
+}
+
+#[cfg(unix)]
+use unix::lock_file_exclusive;
+#[cfg(windows)]
+use windows::lock_file_exclusive;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn describe(outcome: &LockOutcome) -> String {
+        match outcome {
+            LockOutcome::Acquired(_) => "Acquired".into(),
+            LockOutcome::HeldByAnother => "HeldByAnother".into(),
+            LockOutcome::Unavailable(e) => format!("Unavailable({e})"),
+        }
+    }
+
+    /// The property the whole change rests on: once one caller holds the lock,
+    /// a second acquire of the same path loses — atomically, with no window in
+    /// which both believe they won.
+    ///
+    /// This works in-process because both `flock` and `LockFileEx` attach the
+    /// lock to the OPEN FILE DESCRIPTION, and `acquire_lock_at` opens the file
+    /// fresh each call. Two `open`s therefore contend exactly as two processes
+    /// would — which is what makes the guarantee testable at all without
+    /// spawning real daemons.
+    #[test]
+    fn a_second_acquire_of_the_same_path_loses() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("sub").join("daemon.lock");
+
+        let first = acquire_lock_at(&path);
+        assert!(
+            matches!(first, LockOutcome::Acquired(_)),
+            "the first acquire must win on a fresh path, got {}",
+            describe(&first)
+        );
+
+        let second = acquire_lock_at(&path);
+        assert!(
+            matches!(second, LockOutcome::HeldByAnother),
+            "a second acquire while the first guard is alive must report \
+             HeldByAnother - if this is Acquired, two daemons can run \
+             migrations on one meridian.db, got {}",
+            describe(&second)
+        );
+        drop(first);
+    }
+
+    /// The lock must be released by dropping the guard alone. Nothing unlinks
+    /// the file, so if release depended on deletion this would fail — and the
+    /// next daemon start would stand down forever against a lock nobody holds.
+    #[test]
+    fn dropping_the_guard_releases_the_lock() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("daemon.lock");
+
+        let first = acquire_lock_at(&path);
+        assert!(matches!(first, LockOutcome::Acquired(_)));
+        drop(first);
+
+        let again = acquire_lock_at(&path);
+        assert!(
+            matches!(again, LockOutcome::Acquired(_)),
+            "after the holder drops, the next acquire must win - the lock file \
+             is deliberately never deleted, so release comes from closing the \
+             handle and nothing else, got {}",
+            describe(&again)
+        );
+        assert!(
+            path.exists(),
+            "the lock file must survive release: unlinking it would let a \
+             later start create a NEW inode and lock that instead, so two \
+             processes could each hold 'the' lock"
+        );
+    }
+
+    /// The asymmetry that keeps this guard from becoming an outage: a lock we
+    /// could not even attempt is [`LockOutcome::Unavailable`], never
+    /// [`LockOutcome::HeldByAnother`].
+    ///
+    /// `main` stands down on `HeldByAnother` and proceeds on `Unavailable`, so
+    /// misclassifying here means a daemon that refuses to start on a machine
+    /// where nothing is wrong.
+    ///
+    /// Both ways `acquire_lock_at` can fail before it ever reaches the lock
+    /// syscall are covered, because they are separate branches and an early
+    /// version of this test exercised only the first — it passed unchanged
+    /// when the second was deliberately broken.
+    #[test]
+    fn an_unusable_path_is_unavailable_not_held() {
+        let dir = tempfile::tempdir().expect("tempdir");
+
+        // 1. The parent directory cannot be created: a regular file already
+        //    occupies that name, so `create_dir_all` fails for real.
+        let blocker = dir.path().join("not-a-directory");
+        std::fs::write(&blocker, b"").expect("write blocker file");
+        let parent_fails = acquire_lock_at(&blocker.join("daemon.lock"));
+        assert!(
+            matches!(parent_fails, LockOutcome::Unavailable(_)),
+            "a lock path whose parent cannot be created must be Unavailable so \
+             the daemon proceeds unlocked (the pre-existing behaviour); \
+             reporting it as HeldByAnother would make it stand down forever, \
+             got {}",
+            describe(&parent_fails)
+        );
+
+        // 2. The parent is fine but the lock path itself cannot be opened as a
+        //    file - here because it is a directory (EISDIR).
+        let as_dir = dir.path().join("daemon.lock");
+        std::fs::create_dir(&as_dir).expect("create dir at the lock path");
+        let open_fails = acquire_lock_at(&as_dir);
+        assert!(
+            matches!(open_fails, LockOutcome::Unavailable(_)),
+            "a lock path that cannot be opened must be Unavailable for the same \
+             reason, got {}",
+            describe(&open_fails)
+        );
+    }
+}
+
 /// What the health report can say about the service's on-disk definition.
 ///
 /// Same reasoning as [`ServiceStatus`]: `Missing` is a finding, `Unknown` is
diff --git a/src/platform/unix.rs b/src/platform/unix.rs
index 90e8bd0dd..d614f94ec 100644
--- a/src/platform/unix.rs
+++ b/src/platform/unix.rs
@@ -97,6 +97,48 @@ pub fn spawn_health_listener() -> anyhow::Result<()> {
     Ok(())
 }
 
+/// Take an exclusive, non-blocking advisory lock on an already-open file.
+///
+/// `flock` associates the lock with the **open file description**, not with the
+/// process and not with the path. Three consequences this design leans on:
+///
+/// - The kernel releases it when the descriptor closes, including on `SIGKILL`,
+///   a panic, or a power loss. No stale-lock problem, so nothing has to decide
+///   whether a leftover lock is real.
+/// - Two `open()` calls produce two descriptions, so a second acquire conflicts
+///   even inside the same process. That is what makes this testable in-process
+///   rather than needing two real daemons.
+/// - It is *advisory*: it constrains other `flock` callers only, and never
+///   blocks an unrelated tool from reading or writing the file. The lock file
+///   holds no content, so that costs nothing.
+///
+/// `EWOULDBLOCK`/`EAGAIN` is the ONLY errno that means contention. Everything
+/// else — `EBADF`, `EINVAL`, `ENOLCK`, or anything a network filesystem
+/// invents — is reported as [`super::LockError::Other`] so the caller proceeds
+/// unlocked instead of standing down. Treating a blanket "flock failed" as
+/// "another daemon owns this" is the version of this that bricks installs.
+pub(crate) fn lock_file_exclusive(file: &std::fs::File) -> Result<(), super::LockError> {
+    use std::os::unix::io::AsRawFd as _;
+
+    // SAFETY: `file` is a live `File` borrowed for the whole call, so its
+    // descriptor is open and valid. `flock` has no other precondition, and
+    // LOCK_NB guarantees it does not block.
+    let rc = unsafe { libc::flock(file.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) };
+    if rc == 0 {
+        return Ok(());
+    }
+    let err = std::io::Error::last_os_error();
+    let code = err.raw_os_error().unwrap_or(0);
+    // Compared with `if` rather than matched: EAGAIN and EWOULDBLOCK are the
+    // same value on Linux and macOS, and two match arms with equal values is an
+    // unreachable-pattern error. They are separate constants on some targets.
+    if code == libc::EWOULDBLOCK || code == libc::EAGAIN {
+        Err(super::LockError::Held)
+    } else {
+        Err(super::LockError::Other(format!("flock failed: {err}")))
+    }
+}
+
 /// Unlink the socket file on clean shutdown.
 ///
 /// Best-effort: a leftover file is harmless — the next start's probe finds no
diff --git a/src/platform/windows.rs b/src/platform/windows.rs
index 8ee2d9b0c..01078b400 100644
--- a/src/platform/windows.rs
+++ b/src/platform/windows.rs
@@ -109,6 +109,64 @@ pub fn spawn_health_listener() -> anyhow::Result<()> {
     Ok(())
 }
 
+/// Take an exclusive, immediately-failing byte-range lock on an already-open
+/// file — the Windows counterpart of `super::unix`'s `flock`.
+///
+/// # Why `LockFileEx` and not an exclusive `share_mode(0)` open
+///
+/// Opening the file with no sharing is the shorter way to get mutual exclusion
+/// on Windows, and it is the wrong one here. A `share_mode(0)` open fails with
+/// `ERROR_SHARING_VIOLATION` when **anything** else has the file open — an
+/// antivirus scanner mid-scan, a backup agent, a search indexer — and that is
+/// byte-for-byte the same error a real second daemon produces. The one mistake
+/// this whole module must not make is concluding "another daemon owns this data
+/// dir" when nothing of the sort is true.
+///
+/// `LockFileEx` on a normally-shared handle separates the two: a genuine lock
+/// conflict is `ERROR_LOCK_VIOLATION` (33), which no passive file-opener can
+/// cause. So contention is reported as [`super::LockError::Held`] and every
+/// other failure — including a sharing violation — becomes
+/// [`super::LockError::Other`], which makes the caller proceed unlocked rather
+/// than refuse to start.
+///
+/// The lock is released by the kernel when the handle closes, on process exit
+/// or kill, matching the `flock` guarantee the Unix side relies on. One byte at
+/// offset 0 is locked: the file has no content, so the range is a token, not a
+/// region anyone reads.
+pub(crate) fn lock_file_exclusive(file: &std::fs::File) -> Result<(), super::LockError> {
+    use std::os::windows::io::AsRawHandle as _;
+    use windows_sys::Win32::Foundation::{ERROR_LOCK_VIOLATION, HANDLE};
+    use windows_sys::Win32::Storage::FileSystem::{
+        LockFileEx, LOCKFILE_EXCLUSIVE_LOCK, LOCKFILE_FAIL_IMMEDIATELY,
+    };
+
+    let mut overlapped =
+        unsafe { std::mem::zeroed::<windows_sys::Win32::System::IO::OVERLAPPED>() };
+    // SAFETY: `file` is a live `File` borrowed for the whole call, so its
+    // handle is valid. `overlapped` is a correctly zeroed, stack-owned struct
+    // that outlives the call — LOCKFILE_FAIL_IMMEDIATELY means the call cannot
+    // complete asynchronously, so nothing retains the pointer past return.
+    let ok = unsafe {
+        LockFileEx(
+            file.as_raw_handle() as HANDLE,
+            LOCKFILE_EXCLUSIVE_LOCK | LOCKFILE_FAIL_IMMEDIATELY,
+            0,
+            1,
+            0,
+            &mut overlapped,
+        )
+    };
+    if ok != 0 {
+        return Ok(());
+    }
+    let err = std::io::Error::last_os_error();
+    if err.raw_os_error() == Some(ERROR_LOCK_VIOLATION as i32) {
+        Err(super::LockError::Held)
+    } else {
+        Err(super::LockError::Other(format!("LockFileEx failed: {err}")))
+    }
+}
+
 /// No-op: a named pipe disappears with the process that holds it, so unlike a
 /// socket file there is nothing to unlink.
 pub fn release_endpoint() {}

From 02657c32bd47d7d977774e4dca1a13ee0bce2ee0 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Wed, 26 Aug 2026 13:12:16 +0530
Subject: [PATCH 10/53] fix(llm): make the health-gate exemption's outcome
 visible in shipped telemetry

Investigating github.com/Meridiona/meridian/issues/805 against live central
OpenObserve data showed a stale "codex timed out after 20s" verdict sitting
unrefreshed for over a week on an affected Windows host, while genuine
`llm.infer` spans for that host had stopped entirely days earlier. The
obvious question - is the 15-minute health-probe exemption
(resolver.rs::HEALTH_PROBE_INTERVAL) ever actually firing for this user, and
if so, what happens - turned out to be unanswerable from telemetry alone:
the log line marking "the exemption just fired" was `tracing::info!`, and
the redacted ship leg only forwards WARN+ logs (see CLAUDE.md's Observability
section), so it never reached central OO regardless of whether it ran.

Bumped that line to `tracing::warn!`, and added a matching WARN on the
success side (previously silent - a cleared outage looked identical to "the
exemption never got another chance" from telemetry). Together the two make
both outcomes of an exempted probe - "granted, then failed again" vs
"granted, then cleared" - directly queryable the next time this recurs,
instead of requiring the multi-query archaeology this investigation needed.

Log-only change: no behavior, timing, or gating logic touched.
---
 src/llm/resolver.rs | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/llm/resolver.rs b/src/llm/resolver.rs
index 94fac2170..898c6d7bf 100644
--- a/src/llm/resolver.rs
+++ b/src/llm/resolver.rs
@@ -554,7 +554,13 @@ async fn complete_inner(req: &PromptRequest) -> Result<(LlmOutput, LlmProvider),
             return Err(refusal);
         }
         probing = true;
-        tracing::info!(
+        // WARN, not INFO: this is the ONLY record that the 15-minute exemption
+        // (`HEALTH_PROBE_INTERVAL`) ever fired at all. Redaction ships WARN+ logs
+        // only (see CLAUDE.md's Observability section), so at INFO this line never
+        // reaches central OO - which is exactly what made a live-in-the-field
+        // "is the exemption even running?" question undiagnosable from telemetry
+        // alone (github.com/Meridiona/meridian/issues/805).
+        tracing::warn!(
             provider = chosen.as_str(),
             label = %req.label,
             error = %refusal,
@@ -663,6 +669,16 @@ async fn complete_inner(req: &PromptRequest) -> Result<(LlmOutput, LlmProvider),
             // which that check cannot see - so it would write nothing and the next call
             // would be refused again by the verdict this one just disproved.
             if probing {
+                // The other half of the exemption's story - see the WARN above where
+                // `probing` was set. Without this, a successful re-check is invisible:
+                // the outage just silently stops appearing in the next refusal log,
+                // which reads identically to "the exemption never got another chance to
+                // fire" from telemetry alone.
+                tracing::warn!(
+                    provider = chosen.as_str(),
+                    label = %req.label,
+                    "llm: provider re-check succeeded - clearing the unavailable verdict"
+                );
                 super::runtime_health::record_probe_success(&key);
             } else {
                 super::runtime_health::record_success(&key);

From 1f46407f8bc37d0f5bc0e2e5f6947e085c9fa194 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Wed, 26 Aug 2026 13:32:36 +0530
Subject: [PATCH 11/53] feat(observability): make a daemon generation
 identifiable and its quit survivable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three corruption mechanisms were fixed this month (#886, #894, #861) and
NONE of them was confirmed from field data - each was reasoned from code,
because the telemetry cannot currently answer the questions an incident
raises. This fixes the three gaps that made that true.

## 1. No process could be told apart from the next one

A quit-then-relaunch during an update starts three daemons inside 35
seconds. All three logged an identical "meridian daemon starting", and
the SIGTERMs between them named nobody, so no signal could be attributed
to any generation. An investigation on 2026-08-25 ran aground on exactly
this and had to withdraw its conclusion.

`pid` now rides on `meridian daemon starting`, on every arm of
`wait_for_shutdown` (both platforms), and on `shutting down`.

Logged as `i64`, not the `u32` `std::process::id()` returns, and that is
load-bearing: `tracing-opentelemetry` 0.28 has no `record_u64`, so a
`u32` falls through to `record_debug` and is emitted as a STRING that
then has to survive the attribute allowlist as a string key. An `i64`
becomes a real `IntValue`, which `redact::keep_attribute`'s first arm
keeps unconditionally. Same trap as CLAUDE.md's third coupling.

## 2. A successful WAL checkpoint logged nothing

A FAILED checkpoint warned; a successful one was silent. So "no line
after `shutting down`" meant either "it completed" or "the process was
killed part-way through" - indistinguishable, and that distinction is the
entire question when a meridian.db is later found malformed. Both
outcomes are logged now. Silence after `shutting down` means killed.

## 3. The quit verdict was systematically discarded

`handle.exit(0)` is `std::process::exit`: no destructors, and whatever
the OTel batch processors are still holding dies with the process. What
they hold at that instant is the line describing how stopping the daemon
went - `daemon stopped for quit`, `could not stop the daemon on quit`,
`exceeded its budget`.

Quit is when the tray and the daemon are most likely to overlap on
meridian.db, so that was the most useful record that exists for a
corruption report, and it was the one guaranteed never to survive.

`observability::force_flush()` is the "flush and keep going" half of
`ObservabilityGuard::shutdown` - callable from anywhere, idempotent, a
no-op before init or with capture disabled. The exit handler calls it
between `stop_for_quit` and `handle.exit`.

## 4. `meridian logs` was discarding every structured field

Found while verifying the above: `RenderedRecord` decoded attributes and
threw them away, so the one supported local read path showed the message
of every record and none of its data. `SIGTERM received` with no pid,
`ETL run failed` with no error - the exact opposite of the structured-
field discipline CLAUDE.md mandates, and the reason the 25th's
investigation was reading messages only.

Fields now render after the message. Call-site metadata
(`code.*`/`log.target`/`thread.*`, stamped on every record by
`experimental_metadata_attributes`) and unset fields are skipped, so the
line gains signal rather than width. Display only - the spool and export
bundles were always full-fidelity.

## Verified end to end

Real daemon, isolated HOME, SIGTERM, read back through `meridian logs`:

  meridian daemon starting pid=11174 meridian_db=… poll_interval_secs=60
  SIGTERM received pid=11174
  shutting down pid=11174
  WAL checkpoint on shutdown complete pid=11174

pid matches the shell-reported pid; the whole lifecycle is attributable
to one process. This is precisely what was missing on the 25th.

Tests: the flush's ORDER is asserted, not its presence - a flush placed
before `stop_for_quit` compiles, runs, and preserves only the records
that were never at risk. Mutation-proved both ways (moved before the
stop -> red; deleted -> red). Attribute rendering has three tests
covering an i64 field, metadata suppression, and unset-field omission.

Refs #861
---
 src/main.rs                            |  40 +++++-
 src/observability/mod.rs               |  73 +++++++++++
 src/platform/unix.rs                   |  16 ++-
 src/platform/windows.rs                |   9 +-
 src/telemetry_spool/render.rs          | 173 +++++++++++++++++++++++++
 tray/src-tauri/src/daemon_lifecycle.rs |  36 +++++
 tray/src-tauri/src/lib.rs              |  12 ++
 7 files changed, 349 insertions(+), 10 deletions(-)

diff --git a/src/main.rs b/src/main.rs
index cada9f44d..279af94ed 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1023,8 +1023,26 @@ async fn main() -> Result<()> {
     let initial_cfg = Config::from_env();
     tracing::info!(stage = "config_loaded", "configuration ready");
 
-    // 4. Log startup parameters
+    // 4. Log startup parameters.
+    //
+    //    `pid` is here so a generation can be TOLD APART from the next one.
+    //    Without it, a machine that started three daemons in 35 seconds — which
+    //    is what a quit-then-relaunch during an update looks like — produces
+    //    three identical "meridian daemon starting" lines and a set of signal
+    //    lines that cannot be attributed to any of them. Every corruption
+    //    investigation so far has run aground on exactly that: the events are
+    //    all in the spool, and nothing says which process each belongs to.
+    //
+    //    Logged as `i64`, not the `u32` `std::process::id` returns, and this is
+    //    load-bearing rather than cosmetic. `tracing-opentelemetry` 0.28 has no
+    //    `record_u64`, so a `u32`/`u64` field falls through to `record_debug`
+    //    and is emitted as a STRING — which then has to survive the attribute
+    //    allowlist as a string key to egress at all. An `i64` becomes a real
+    //    `IntValue`, and `redact::keep_attribute`'s first arm keeps every
+    //    `IntValue` unconditionally. See CLAUDE.md's third "coupling that
+    //    silently deletes error coverage".
     tracing::info!(
+        pid = std::process::id() as i64,
         meridian_db = %initial_cfg.meridian_db,
         poll_interval_secs = initial_cfg.poll_interval_secs,
         "meridian daemon starting"
@@ -1526,13 +1544,27 @@ async fn main() -> Result<()> {
     let _ = shutdown_tx.send(true);
 
     // 9. Shutdown
-    tracing::info!("shutting down");
+    tracing::info!(pid = std::process::id() as i64, "shutting down");
     meridian::platform::release_endpoint();
     // See `db::meridian::checkpoint_wal`'s doc for why this runs before every
     // close, not just a plain shutdown. Best-effort: a failed checkpoint must
     // not block shutdown.
-    if let Err(e) = meridian::db::meridian::checkpoint_wal(&meridian).await {
-        tracing::warn!(error = %meridian::errors::chain(&e), "WAL checkpoint on shutdown failed - continuing anyway");
+    //
+    // BOTH outcomes are logged, and the success line is the point. Previously a
+    // failed checkpoint logged a WARN and a successful one logged nothing, so
+    // "no line after `shutting down`" meant either "it worked" or "the process
+    // was killed part-way through" — indistinguishable, and the difference is
+    // the entire question when a `meridian.db` is later found malformed. A
+    // corruption investigation on 2026-08-25 stalled on exactly this ambiguity
+    // and had to withdraw its conclusion. Now silence here means killed.
+    match meridian::db::meridian::checkpoint_wal(&meridian).await {
+        Ok(()) => tracing::info!(
+            pid = std::process::id() as i64,
+            "WAL checkpoint on shutdown complete"
+        ),
+        Err(e) => {
+            tracing::warn!(error = %meridian::errors::chain(&e), "WAL checkpoint on shutdown failed - continuing anyway")
+        }
     }
     meridian.close().await;
 
diff --git a/src/observability/mod.rs b/src/observability/mod.rs
index 7e98cf7ce..30f593392 100644
--- a/src/observability/mod.rs
+++ b/src/observability/mod.rs
@@ -142,6 +142,71 @@ impl ObservabilityGuard {
     }
 }
 
+/// Provider handles kept for [`force_flush`]. Set once by [`init`].
+///
+/// Separate from [`ObservabilityGuard`] because the guard is owned by whoever
+/// called `init` — in the tray that is a local in `run()` — while the code that
+/// needs to flush is somewhere else entirely (an exit handler in a spawned
+/// task). Both providers are `Arc`-backed, so this holds clones rather than
+/// taking anything away from the guard.
+static FLUSH_HANDLES: std::sync::OnceLock<FlushHandles> = std::sync::OnceLock::new();
+
+struct FlushHandles {
+    tracer_provider: Option<TracerProvider>,
+    logger_provider: Option<LoggerProvider>,
+}
+
+/// Push everything currently batched in memory out to the telemetry spool,
+/// WITHOUT shutting the providers down.
+///
+/// # Why this is needed at all
+///
+/// Spans and logs do not reach `~/.meridian/telemetry/pending/` the moment they
+/// are emitted: the batch processors hold them and drain on a timer. A process
+/// that calls `std::process::exit` — which is what `tauri::AppHandle::exit`
+/// does — takes that batch with it. Destructors do not run, so holding an RAII
+/// guard is no protection either.
+///
+/// The practical cost was that the LAST thing a process does is the thing least
+/// likely to be recorded, and for the tray the last thing it does is stop the
+/// daemon on quit. Every `daemon stopped for quit` / `could not stop the daemon
+/// on quit` / `exceeded its budget` line was emitted and then discarded
+/// microseconds later, so the outcome of the operation that most needs
+/// explaining after a corruption report was systematically the one missing from
+/// the spool.
+///
+/// [`ObservabilityGuard::shutdown`] already does this and more, but it consumes
+/// the guard and shuts the providers down; this is the "flush and keep going"
+/// half, callable from anywhere and safe to call more than once.
+///
+/// A no-op when capture is disabled (`MERIDIAN_TELEMETRY_DISABLED`) or before
+/// [`init`] has run, so callers never need to check.
+///
+/// # Who calls this
+/// - `meridian_tray_lib::run`'s `RunEvent::ExitRequested` handler, immediately
+///   before `handle.exit(0)`.
+pub async fn force_flush() {
+    let Some(handles) = FLUSH_HANDLES.get() else {
+        return;
+    };
+    if let Some(tp) = handles.tracer_provider.clone() {
+        let _ = tokio::task::spawn_blocking(move || {
+            for r in tp.force_flush() {
+                if let Err(e) = r {
+                    eprintln!("observability: span force_flush error: {e:?}");
+                }
+            }
+        })
+        .await;
+    }
+    if let Some(lp) = handles.logger_provider.clone() {
+        let _ = tokio::task::spawn_blocking(move || {
+            let _ = lp.force_flush();
+        })
+        .await;
+    }
+}
+
 /// Initialise the layered tracing subscriber.
 ///
 /// `service_name` becomes the OTel `service.name` resource attribute. The
@@ -254,6 +319,14 @@ pub fn init(service_name: &str) -> Result<ObservabilityGuard> {
         );
     }
 
+    // Clones for `force_flush`, which runs far from whoever owns the guard.
+    // `set` rather than `get_or_init`: a second `init` in one process is a bug,
+    // and silently keeping the first set of handles is the safer failure.
+    let _ = FLUSH_HANDLES.set(FlushHandles {
+        tracer_provider: tracer_provider.clone(),
+        logger_provider: logger_provider.clone(),
+    });
+
     Ok(ObservabilityGuard {
         tracer_provider,
         logger_provider,
diff --git a/src/platform/unix.rs b/src/platform/unix.rs
index 90e8bd0dd..95e4cb574 100644
--- a/src/platform/unix.rs
+++ b/src/platform/unix.rs
@@ -210,10 +210,20 @@ pub async fn wait_for_shutdown() {
     let mut sigterm = signal(SignalKind::terminate()).expect("register SIGTERM handler");
     let mut sighup = signal(SignalKind::hangup()).expect("register SIGHUP handler");
 
+    // `pid` on every arm: these lines are the record of WHICH daemon generation
+    // was asked to stop, and during an update or a quit-then-relaunch there are
+    // several within seconds of each other. Without it the signal cannot be
+    // matched to the "meridian daemon starting" line it belongs to, and the
+    // shutdown sequence — the window where the tray and the daemon can overlap
+    // on meridian.db — is unreconstructable after the fact.
+    //
+    // `as i64` deliberately; see the same cast at the startup log in `main.rs`
+    // for why a `u32` would ship as a string, or not at all.
+    let pid = std::process::id() as i64;
     tokio::select! {
-        _ = sigint.recv()  => tracing::info!("SIGINT received"),
-        _ = sigterm.recv() => tracing::info!("SIGTERM received"),
-        _ = sighup.recv()  => tracing::info!("SIGHUP received — reloading (graceful restart)"),
+        _ = sigint.recv()  => tracing::info!(pid, "SIGINT received"),
+        _ = sigterm.recv() => tracing::info!(pid, "SIGTERM received"),
+        _ = sighup.recv()  => tracing::info!(pid, "SIGHUP received — reloading (graceful restart)"),
     }
 }
 
diff --git a/src/platform/windows.rs b/src/platform/windows.rs
index 8ee2d9b0c..ada384903 100644
--- a/src/platform/windows.rs
+++ b/src/platform/windows.rs
@@ -209,9 +209,12 @@ pub async fn wait_for_shutdown() {
     let mut close = ctrl_close().expect("register console-close handler");
     let mut shutdown = ctrl_shutdown().expect("register system-shutdown handler");
 
+    // `pid` on every arm, for the same reason as the Unix arm — see
+    // `super::unix::wait_for_shutdown`.
+    let pid = std::process::id() as i64;
     tokio::select! {
-        _ = ctrl_c.recv()   => tracing::info!("Ctrl-C received"),
-        _ = close.recv()    => tracing::info!("console close received"),
-        _ = shutdown.recv() => tracing::info!("system shutdown received"),
+        _ = ctrl_c.recv()   => tracing::info!(pid, "Ctrl-C received"),
+        _ = close.recv()    => tracing::info!(pid, "console close received"),
+        _ = shutdown.recv() => tracing::info!(pid, "system shutdown received"),
     }
 }
diff --git a/src/telemetry_spool/render.rs b/src/telemetry_spool/render.rs
index 16df2f03e..636bc8a04 100644
--- a/src/telemetry_spool/render.rs
+++ b/src/telemetry_spool/render.rs
@@ -41,6 +41,34 @@ pub struct RenderedRecord {
     pub body: String,
     pub trace_id: String,
     pub span_id: String,
+    /// The record's structured fields, already stringified, in emission order.
+    ///
+    /// These were previously decoded and thrown away, so `meridian logs` showed
+    /// the message of every record and none of its data. That is the opposite
+    /// of how this codebase is instrumented — CLAUDE.md requires values to be
+    /// structured fields and never formatted into the message — so the one
+    /// supported way to read logs locally was systematically hiding the half
+    /// that was written to be machine-readable. A `SIGTERM received` with no
+    /// `pid`, an `ETL run failed` with no `error`.
+    pub attributes: Vec<(String, String)>,
+}
+
+/// Attribute keys `meridian logs` does not print.
+///
+/// Not a privacy filter — this is the local, full-fidelity read path and
+/// nothing here is withheld from the spool or from an export bundle. It is
+/// purely about signal: `opentelemetry-appender-tracing`'s
+/// `experimental_metadata_attributes` feature stamps call-site metadata on
+/// EVERY record, which would triple the width of every line with the one thing
+/// a reader already knows (they can see the message).
+///
+/// Prefix-matched, so `code.filepath`/`code.lineno`/`code.namespace` are all
+/// covered by one entry.
+const UNPRINTED_ATTR_PREFIXES: &[&str] = &["code.", "log.target", "thread.", "busy_ns", "idle_ns"];
+
+/// Is this a call-site metadata key rather than a value the emitter chose?
+fn is_unprinted_attr(key: &str) -> bool {
+    UNPRINTED_ATTR_PREFIXES.iter().any(|p| key.starts_with(p))
 }
 
 /// Decode one spooled file into [`RenderedRecord`]s. The signal (logs vs
@@ -86,6 +114,9 @@ fn decode_logs(bytes: &[u8]) -> Result<Vec<RenderedRecord>> {
                     body: any_value_to_string(lr.body.as_ref()),
                     trace_id: hex::encode(&lr.trace_id),
                     span_id: hex::encode(&lr.span_id),
+                    attributes: collect_attributes(
+                        lr.attributes.iter().map(|kv| (&kv.key, kv.value.as_ref())),
+                    ),
                 });
             }
         }
@@ -109,6 +140,11 @@ fn decode_traces(bytes: &[u8]) -> Result<Vec<RenderedRecord>> {
                     body: span.name,
                     trace_id: hex::encode(&span.trace_id),
                     span_id: hex::encode(&span.span_id),
+                    attributes: collect_attributes(
+                        span.attributes
+                            .iter()
+                            .map(|kv| (&kv.key, kv.value.as_ref())),
+                    ),
                 });
             }
         }
@@ -124,6 +160,18 @@ fn resource_service_name(resource: Option<&Resource>) -> String {
         .unwrap_or_else(|| "unknown".to_string())
 }
 
+/// Stringify a record's attributes for display, dropping call-site metadata
+/// and anything with an empty value (a field that was recorded but never set —
+/// printing `outcome=` adds width and no information).
+fn collect_attributes<'a>(
+    kvs: impl Iterator<Item = (&'a String, Option<&'a AnyValue>)>,
+) -> Vec<(String, String)> {
+    kvs.filter(|(k, _)| !is_unprinted_attr(k))
+        .map(|(k, v)| (k.clone(), any_value_to_string(v)))
+        .filter(|(_, v)| !v.is_empty())
+        .collect()
+}
+
 fn any_value_to_string(v: Option<&AnyValue>) -> String {
     match v.and_then(|v| v.value.as_ref()) {
         Some(Value::StringValue(s)) => s.clone(),
@@ -177,6 +225,11 @@ pub fn format_line(r: &RenderedRecord) -> String {
     .unwrap_or_else(|| "?".to_string());
 
     let mut line = format!("{ts} {:>7} [{}] {}", r.severity, r.service_name, r.body);
+    // After the message, before `trace_id`: the fields are what the message is
+    // about, and the trace id is a join key nobody reads inline.
+    for (k, v) in &r.attributes {
+        line.push_str(&format!(" {k}={v}"));
+    }
     if !r.trace_id.is_empty() {
         line.push_str(&format!(" trace_id={}", r.trace_id));
     }
@@ -423,6 +476,126 @@ mod tests {
         req.encode_to_vec()
     }
 
+    /// Build one log record carrying the given attributes, so the rendering of
+    /// structured fields can be exercised without a live subscriber.
+    fn make_log_bytes_with_attrs(body: &str, attrs: &[(&str, any_value::Value)]) -> Vec<u8> {
+        let req = ExportLogsServiceRequest {
+            resource_logs: vec![ResourceLogs {
+                resource: Some(Resource {
+                    attributes: vec![KeyValue {
+                        key: "service.name".to_string(),
+                        value: Some(AnyValue {
+                            value: Some(any_value::Value::StringValue("test-svc".to_string())),
+                        }),
+                    }],
+                    dropped_attributes_count: 0,
+                }),
+                scope_logs: vec![ScopeLogs {
+                    scope: Some(InstrumentationScope::default()),
+                    log_records: vec![LogRecord {
+                        time_unix_nano: 1_700_000_000_000_000_000,
+                        severity_text: "INFO".to_string(),
+                        body: Some(AnyValue {
+                            value: Some(any_value::Value::StringValue(body.to_string())),
+                        }),
+                        attributes: attrs
+                            .iter()
+                            .map(|(k, v)| KeyValue {
+                                key: (*k).to_string(),
+                                value: Some(AnyValue {
+                                    value: Some(v.clone()),
+                                }),
+                            })
+                            .collect(),
+                        ..Default::default()
+                    }],
+                    schema_url: String::new(),
+                }],
+                schema_url: String::new(),
+            }],
+        };
+        req.encode_to_vec()
+    }
+
+    /// A record's structured fields must reach the rendered line.
+    ///
+    /// They were decoded and discarded before, which made `meridian logs` show
+    /// the message of every record and none of its data — so `SIGTERM received`
+    /// could not be attributed to a process and `ETL run failed` did not carry
+    /// its error. `pid` is the concrete case this was added for: an `i64`, which
+    /// must render as a plain number rather than a debug-formatted string.
+    #[test]
+    fn structured_fields_are_rendered_not_discarded() {
+        let bytes = make_log_bytes_with_attrs(
+            "SIGTERM received",
+            &[("pid", any_value::Value::IntValue(4321))],
+        );
+        let records = decode_logs(&bytes).unwrap();
+        let r = &records[0];
+        assert_eq!(
+            r.attributes,
+            vec![("pid".to_string(), "4321".to_string())],
+            "the log's structured fields must survive decoding"
+        );
+        let line = format_line(r);
+        assert!(
+            line.contains("SIGTERM received pid=4321"),
+            "the fields must appear on the rendered line, right after the \
+             message; got {line:?}"
+        );
+    }
+
+    /// Call-site metadata is stamped on EVERY record by
+    /// `experimental_metadata_attributes`. Printing it would bury the fields
+    /// that were chosen deliberately under three that never vary in usefulness.
+    #[test]
+    fn call_site_metadata_is_not_printed() {
+        let bytes = make_log_bytes_with_attrs(
+            "shutting down",
+            &[
+                (
+                    "code.filepath",
+                    any_value::Value::StringValue("src/main.rs".into()),
+                ),
+                ("code.lineno", any_value::Value::IntValue(1547)),
+                (
+                    "code.namespace",
+                    any_value::Value::StringValue("meridian".into()),
+                ),
+                (
+                    "log.target",
+                    any_value::Value::StringValue("meridian".into()),
+                ),
+                ("pid", any_value::Value::IntValue(99)),
+            ],
+        );
+        let r = &decode_logs(&bytes).unwrap()[0];
+        assert_eq!(
+            r.attributes,
+            vec![("pid".to_string(), "99".to_string())],
+            "only the emitter's own fields should survive; got {:?}",
+            r.attributes
+        );
+    }
+
+    /// A field declared on a span but never recorded arrives as an empty value.
+    /// Rendering `outcome=` costs width and carries nothing.
+    #[test]
+    fn unset_fields_are_omitted() {
+        let bytes = make_log_bytes_with_attrs(
+            "daemon_lifecycle.stop",
+            &[
+                ("outcome", any_value::Value::StringValue(String::new())),
+                ("reason", any_value::Value::StringValue("quit".to_string())),
+            ],
+        );
+        let r = &decode_logs(&bytes).unwrap()[0];
+        assert_eq!(
+            r.attributes,
+            vec![("reason".to_string(), "quit".to_string())]
+        );
+    }
+
     #[test]
     fn decode_logs_round_trips_service_severity_and_body() {
         let bytes = make_log_bytes("test-svc", "WARN", "hello from the spool");
diff --git a/tray/src-tauri/src/daemon_lifecycle.rs b/tray/src-tauri/src/daemon_lifecycle.rs
index 8a2323459..9ca58b572 100644
--- a/tray/src-tauri/src/daemon_lifecycle.rs
+++ b/tray/src-tauri/src/daemon_lifecycle.rs
@@ -922,5 +922,41 @@ mod tests {
              INSIDE the task, or a panic mid-stop leaves the exit held forever \
              and the app cannot be quit at all; found: {spawn_body:?}"
         );
+
+        // `stop_for_quit`'s verdict must be FLUSHED before the process exits.
+        //
+        // `handle.exit` is `std::process::exit`: no destructors, and whatever
+        // the OTel batch processors are still holding dies with the process.
+        // What they are holding at that moment is the line describing how
+        // stopping the daemon went - `daemon stopped for quit`, `could not stop
+        // the daemon on quit`, or `exceeded its budget`. Those are the most
+        // useful records that exist for a corruption report, because quit is
+        // when the tray and the daemon are most likely to overlap on
+        // meridian.db, and every one of them was being discarded microseconds
+        // after being emitted.
+        //
+        // Ordering is asserted, not mere presence: a flush placed BEFORE
+        // `stop_for_quit` compiles, runs, logs nothing unusual, and preserves
+        // exactly the records that were never in danger while still losing the
+        // one that was.
+        let stop_pos = spawn_body
+            .find("stop_for_quit().await")
+            .expect("the spawned task must call stop_for_quit");
+        let flush_pos = spawn_body
+            .find("observability::force_flush().await")
+            .expect(
+                "the spawned stop task must flush telemetry before exiting, or \
+                 stop_for_quit's outcome never reaches the spool",
+            );
+        let exit_pos = spawn_body
+            .find("handle.exit(")
+            .expect("the spawned task must exit the app");
+        assert!(
+            stop_pos < flush_pos && flush_pos < exit_pos,
+            "the telemetry flush must sit BETWEEN stop_for_quit and \
+             handle.exit: before the stop it flushes a verdict that has not \
+             been reached yet, and after the exit it does not run at all. \
+             Found stop at {stop_pos}, flush at {flush_pos}, exit at {exit_pos}."
+        );
     }
 }
diff --git a/tray/src-tauri/src/lib.rs b/tray/src-tauri/src/lib.rs
index dc134f10d..5a16ce644 100644
--- a/tray/src-tauri/src/lib.rs
+++ b/tray/src-tauri/src/lib.rs
@@ -1458,6 +1458,18 @@ pub fn run() {
                             // phase. See [`daemon_lifecycle::HeldExitGuard`].
                             let _released = daemon_lifecycle::HeldExitGuard;
                             daemon_lifecycle::stop_for_quit().await;
+                            // Push `stop_for_quit`'s verdict to the spool BEFORE
+                            // exiting. `handle.exit` is `std::process::exit`, so
+                            // it runs no destructors and takes whatever the OTel
+                            // batch processors are still holding with it — and
+                            // what they are holding at this instant is the line
+                            // that just described how stopping the daemon went.
+                            //
+                            // That line is the single most useful record for a
+                            // corruption report (quit is when the tray and the
+                            // daemon are most likely to overlap on meridian.db),
+                            // and it was the one guaranteed never to survive.
+                            meridian::observability::force_flush().await;
                             // Immediately before the exit, so the re-entrant
                             // `ExitRequested` this triggers is the one and only
                             // one allowed through.

From 215f99ab30f24d5939b6e6036875ce2449f10fae Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Wed, 26 Aug 2026 13:33:40 +0530
Subject: [PATCH 12/53] fix(coding-agent): move the summariser's cursor-agent
 prompt off argv onto stdin

Same bug as the codex/claude fix already merged (#901): the coding-agent
session summariser's cursor_agent.rs was still passing its full,
always-multi-line prompt as a positional `cursor-agent -p <prompt>` argv
argument. On Windows `cursor-agent` resolves to `cursor-agent.cmd` - a batch
file, not a native exe - and Rust's std library refuses to spawn a
`.bat`/`.cmd` target when an argument contains a newline (the CVE-2024-24576
"BatBadBut" fix), so every real call through this function failed to even
spawn on Windows.

The sibling hourly-pipeline backend (src/llm/cursor.rs::CursorBackend) was
already fixed for exactly this in commit 4a83d98f (2026-07-24) - "confirmed
live" per its own module doc - but the summariser's copy was never touched,
identical to the codex/claude miss. This was found via the connectivity
audit that followed #901 (github.com/Meridiona/meridian/issues/805, #841),
which flagged it as the highest-confidence remaining gap: same fix, same
file shape, already proven twice this session.

No positional prompt on argv now; the prompt goes over stdin instead,
matching CursorBackend's already-fixed shape exactly (`-p` as a bare flag).
The stale "stdin support unprobed" comment is corrected - CursorBackend's
own module doc already confirms it live.

New tests pin: the prompt is genuinely multi-line (the premise the fix rests
on), argv never carries a newline, no positional prompt is passed, and the
safety-ladder flags still thread through correctly.
---
 .../summariser/cursor_agent.rs                | 73 +++++++++++++++++--
 1 file changed, 68 insertions(+), 5 deletions(-)

diff --git a/src/coding_agent_session_ingest/summariser/cursor_agent.rs b/src/coding_agent_session_ingest/summariser/cursor_agent.rs
index 667504b07..dc6cc0938 100644
--- a/src/coding_agent_session_ingest/summariser/cursor_agent.rs
+++ b/src/coding_agent_session_ingest/summariser/cursor_agent.rs
@@ -2,7 +2,7 @@
 //
 // Run `cursor-agent` to summarise a Cursor session (symmetry with claude.rs /
 // codex.rs / copilot.rs — each agent's transcripts go to its own CLI, with no
-// cross-engine fallback). The transcript rides in the prompt argument, and any
+// cross-engine fallback). The transcript goes over stdin (see below), and any
 // failure leaves the row pending for a later drain (Failed → retried up to
 // primary_attempts, then left pending).
 //
@@ -13,6 +13,19 @@
 // Persistence probed: `-p` runs write to ~/.cursor/chats/, NOT the vscdb we
 // ingest from — so a summariser run cannot re-enter the indexer (the
 // SUMMARY_PROMPT_MARKER guard in sources/mod.rs backstops this anyway).
+//
+// # The whole prompt goes over stdin, not argv (Windows)
+//
+// It used to be `cursor-agent -p <prompt>` (positional argv). `cursor-agent` resolves to
+// `cursor-agent.cmd` on Windows - a batch file, not a native exe - and Rust's std library
+// refuses to spawn a `.bat`/`.cmd` target when an argument contains characters it cannot
+// safely escape (the CVE-2024-24576 "BatBadBut" fix), notably embedded newlines. The prompt
+// (instructions + transcript) is always multi-line, so every real call through this function
+// failed to even spawn on Windows with `io::Error { InvalidInput, "batch file arguments are
+// invalid" }`. `crate::llm::cursor::CursorBackend` (the hourly worklog pipeline / connectivity
+// test) already moved off argv for exactly this reason, "confirmed live" per its own module
+// doc - this applies the identical fix here, which had the identical bug all along.
+// `cursor-agent -p` as a bare flag (no positional value) reads the whole prompt from stdin.
 
 use super::config::SummariserConfig;
 use super::prompts;
@@ -74,6 +87,15 @@ pub async fn run_cursor_agent(
         .await
 }
 
+/// The `cursor-agent -p` argv - no prompt in here, see the module doc. Split out so the
+/// no-newline invariant this function exists to guarantee is directly testable.
+fn cursor_agent_args(safety: Vec<String>) -> Vec<String> {
+    let mut args: Vec<String> = vec!["-p".into()];
+    args.extend(["--output-format".into(), "text".into()]);
+    args.extend(safety);
+    args
+}
+
 /// One `cursor-agent` attempt with the safety argv/environment chosen by the ladder.
 async fn run_once(
     prompt: &str,
@@ -81,16 +103,14 @@ async fn run_once(
     env: Vec<(&'static str, String)>,
     cfg: &SummariserConfig,
 ) -> Result<EngineOutput, SummariserError> {
-    let mut args: Vec<String> = vec!["-p".into(), prompt.to_string()];
-    args.extend(["--output-format".into(), "text".into()]);
-    args.extend(safety);
+    let args = cursor_agent_args(safety);
 
     let env_refs: Vec<(&str, &str)> = env.iter().map(|(k, v)| (*k, v.as_str())).collect();
 
     let cap = run_capture(
         "cursor-agent",
         &args,
-        "", // transcript is embedded in the prompt (stdin support unprobed)
+        prompt, // payload goes over stdin - see the module doc
         // See the note in llm/cursor.rs: a cwd outside $HOME so rule discovery cannot regress.
         &crate::llm::cursor_cli::neutral_workspace(),
         cfg.cursor_timeout_s,
@@ -132,3 +152,46 @@ async fn run_once(
     }
     Ok(EngineOutput { summary })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The premise the whole fix rests on: the instructions are sourced from a Markdown
+    /// rules file and are always multi-line. If `SKILL.md` ever became single-line, this
+    /// fix would no longer be guarding against anything real - this pins that it still is.
+    #[test]
+    fn the_instructions_prompt_is_multi_line() {
+        assert!(prompts::summary_instruction().contains('\n'));
+    }
+
+    /// The regression this fix exists to close: `cursor-agent -p` argv must never carry the
+    /// prompt (or anything else newline-bearing) - that is exactly what makes Rust's std
+    /// refuse to spawn `cursor-agent.cmd` on Windows. A future edit that reintroduces the
+    /// prompt into `args` fails this test.
+    #[test]
+    fn cursor_agent_args_never_contains_a_newline() {
+        let args = cursor_agent_args(vec!["--allowed-tools".into(), String::new()]);
+        for arg in &args {
+            assert!(!arg.contains('\n'), "argv entry carries a newline: {arg:?}");
+        }
+    }
+
+    /// `-p` must be a bare flag - a positional value right after it would force the prompt
+    /// back through argv.
+    #[test]
+    fn cursor_agent_args_has_no_positional_prompt() {
+        let args = cursor_agent_args(vec![]);
+        assert_eq!(args[0], "-p");
+        assert_eq!(
+            args[1], "--output-format",
+            "the second argv entry must be a flag, not a prompt"
+        );
+    }
+
+    #[test]
+    fn cursor_agent_args_carries_the_safety_flags() {
+        let args = cursor_agent_args(vec!["--force".into()]);
+        assert!(args.contains(&"--force".to_string()));
+    }
+}

From bd048b5269d8f97af0bfd19d2f645b6a5efafd1f Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Wed, 26 Aug 2026 13:46:18 +0530
Subject: [PATCH 13/53] fix(daemon): put a pid on the three stand-down WARNs

These are the ONLY record of a stand-down that reaches central
telemetry. The ship leg is WARN+ only, and `meridian daemon starting` -
the line that carries the pid - is INFO, so it never egresses. A
stand-down therefore arrived in central OO as an anonymous event that
could not be tied to a process or correlated with anything around it:
the same gap that made the 2026-08-25 investigation unresolvable.

The `HeldByAnother` WARN in particular is a MEASUREMENT, not just a
guard. It fires exactly when two daemons raced and the endpoint probe
did not see it - the case that was previously both invisible and
unguarded - so its rate across the fleet is the first direct evidence of
how often this happens in the field rather than how often it could
happen in principle.

`as i64` for the same reason as everywhere else: a u32 ships as a string
via record_debug and has to survive the string allowlist; an i64 is an
IntValue and is kept unconditionally.
---
 src/main.rs | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/src/main.rs b/src/main.rs
index e596a0e4a..fb9e51c91 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1087,8 +1087,18 @@ async fn main() -> Result<()> {
     //
     //     The endpoint itself is OS-specific (a socket file on Unix, a named
     //     pipe on Windows) — see `meridian::platform`.
+    //
+    //     `pid` on this and the two stand-down logs below is not decoration.
+    //     These WARNs are the ONLY record of a stand-down that reaches central
+    //     telemetry: the redaction ship leg is WARN+ only, and `meridian daemon
+    //     starting` — the line that would otherwise carry the pid — is INFO and
+    //     never egresses. Without it a stand-down arrives as an anonymous event
+    //     that cannot be tied to a process or correlated with anything around
+    //     it, which is the same gap that made the 2026-08-25 investigation
+    //     unresolvable.
     if meridian::platform::daemon_already_running().await {
         tracing::warn!(
+            pid = std::process::id() as i64,
             endpoint = %meridian::platform::endpoint_display(),
             "another meridian daemon already owns this data dir — exiting (single-instance guard)"
         );
@@ -1122,8 +1132,16 @@ async fn main() -> Result<()> {
     //     Unavailable arm.
     let _single_instance_lock = match meridian::platform::acquire_single_instance_lock() {
         meridian::platform::LockOutcome::Acquired(guard) => Some(guard),
+        // This WARN is a MEASUREMENT as much as a stand-down. It fires exactly
+        // when two daemons raced and the probe above did not see it — the case
+        // that was previously invisible AND unguarded. Because it egresses to
+        // central telemetry, its rate across the fleet is the first direct
+        // evidence of how often this actually happens, rather than how often it
+        // could happen in principle. Rewording it is fine; dropping it or
+        // demoting it below WARN removes the only signal we have.
         meridian::platform::LockOutcome::HeldByAnother => {
             tracing::warn!(
+                pid = std::process::id() as i64,
                 "another meridian daemon holds the single-instance lock for this data dir — exiting (lock)"
             );
             return Ok(());
@@ -1138,6 +1156,7 @@ async fn main() -> Result<()> {
         // common outage.
         meridian::platform::LockOutcome::Unavailable(e) => {
             tracing::warn!(
+                pid = std::process::id() as i64,
                 error = %e, // not-anyhow: a String the acquire already formatted with its full cause; there is no chain to walk
                 "could not take the single-instance lock — continuing without it; \
                  the endpoint probe above remains the only guard this start has"

From cd296a9dfc02bcbfb5fdca5483ddb5101440d3f6 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Wed, 26 Aug 2026 14:21:36 +0530
Subject: [PATCH 14/53] fix(infra): stop an unknown argument from triggering a
 production deploy

Self-found while re-reading #902 after merge, not from review.

The flag handling I added there was two bare `if [ "$1" = "--flag" ]`
blocks with no else, so ANY other argument fell straight through to the
deploy. `--help`, `--dry-run`, `-n`, and a typo like `--selftest` all
pushed config to the production gateway and restarted the stack. The two
safest-sounding things a person types when unsure what a script does
were the two most dangerous.

Replaced with an explicit `case`: a deploy now requires exactly zero
arguments, `--help` prints usage, and anything unrecognised exits 2
without touching the VM.

Verified: --dry-run / --selftest / -n / --deploy all exit 2 with no
gcloud call; --help exits 0; --self-test and --verify-only unchanged
(verify-only still returns 401 on all four probes against the live
gateway).
---
 scripts/deploy-gateway.sh | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/scripts/deploy-gateway.sh b/scripts/deploy-gateway.sh
index 409698088..248b664aa 100644
--- a/scripts/deploy-gateway.sh
+++ b/scripts/deploy-gateway.sh
@@ -140,6 +140,42 @@ verify_public_endpoints_authenticate() {
 	return "${failed}"
 }
 
+# ── Argument dispatch ────────────────────────────────────────────────────────
+#
+# Every argument is either recognised or an ERROR. This used to be two
+# `if [ "$1" = "--flag" ]` blocks with no else, so ANY other argument fell
+# straight through to the deploy: `--help`, `--dry-run`, `-n`, or a typo like
+# `--selftest` all pushed config to the production gateway and restarted it.
+# The two safest-sounding things a person types when they are unsure what a
+# script does were the two most dangerous.
+#
+# A deploy now requires exactly zero arguments. Anything unrecognised prints
+# usage and exits 2 without touching the VM.
+case "${1:-}" in
+--verify-only | --self-test | "") ;;
+-h | --help)
+	cat <<-USAGE
+		usage: deploy-gateway.sh [--verify-only | --self-test]
+
+		  (no arguments)   deploy ops/central-observability/ to the gateway VM,
+		                   then assert both public hostnames reject
+		                   unauthenticated callers
+		  --verify-only    run only that assertion, against the live gateway,
+		                   deploying nothing
+		  --self-test      offline check of the status classifier
+
+		env: GATEWAY_VM GATEWAY_ZONE GATEWAY_PROJECT GATEWAY_DOMAIN
+		     OO_UI_DOMAIN PROBE_TIMEOUT_S PROBE_INTERVAL_S
+	USAGE
+	exit 0
+	;;
+*)
+	echo "deploy-gateway.sh: unknown argument '${1}'" >&2
+	echo "run with --help for usage; a deploy takes NO arguments" >&2
+	exit 2
+	;;
+esac
+
 # Run the auth assertion on its own, without deploying anything. Two uses: an
 # operator re-checking a gateway they did not just deploy, and testing a change
 # to the probes themselves — the alternative is running a production deploy to

From e4e8e59954df73941721737779fea6a1bcfd947e Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Wed, 26 Aug 2026 15:21:36 +0530
Subject: [PATCH 15/53] fix(sync): make the daemon the sole owner of the
 rotating Jira OAuth token

An Atlassian OAuth refresh token is single-use and rotating: the old token dies
the instant the new one is issued, so a lost response leaves the grant
recoverable only inside a 10-minute window and permanently dead after it. That
makes it a resource with exactly ONE safe writer. It had several - the daemon's
poll loop, the tray in-process, and a fresh `meridian` CLI process per trigger.
The advisory file lock meant to serialise them could not: its 10s timeout is
shorter than the ~26s a refresh can take, and on timeout the code proceeded
WITHOUT the lock. Only Atlassian's grace window prevented corruption.

This is not hypothetical. A production install lost its Jira grant permanently
when a timer-driven refresh POST at 18:26:55 straddled a 28-minute suspend; the
retry was instant on wake at 18:55:29, but 18 minutes outside the window.

Two changes make single-ownership structural rather than a matter of lock
discipline:

1. An outbox (`pm_sync_requests`, migration 082). Producers write a coalescing
   request row; the daemon's watcher is the only consumer. The tray, and the
   `tasks-sync`/`pm-sync`/`plan-task-*`/`ticket-update`/`ticket-set-status`/
   `worklog-generate` CLIs all ask instead of doing. The only remaining
   in-process sync is the fallback taken when no daemon is running at all,
   where there is no second writer to race.

2. An attended/unattended split (`Trigger`). Unattended code may USE a valid
   access token but must never MINT one: the clock-driven worklog sweep goes
   through `current_if_valid`, so an expired token defers instead of refreshing
   and a laptop shut overnight no longer raises a sync error every morning.
   Every refresh now sits immediately behind a human action.

The standing timer is gone with it. The daemon's poll loop no longer syncs, so
installs stop hitting their tracker every ~5 minutes forever. Syncing is now
triggered only where it is needed: connecting a tracker, "Sync now", any board
write, and the two screens that decide something from the whole task list - the
daily plan (a ticket assigned an hour ago was absent from the list users pick
from, not merely stale) and the retarget ticket picker (which had no refresh at
all). Dashboard-open is deliberately NOT a trigger: a window opening is not
evidence anyone is about to read the board. Worklog drafting needs no board
refresh either, since matching reads the day's plan as its candidate pool.

Also fixed while here:
- `sync_freshness` is outcome-driven (`pm_sync_state.last_error`) instead of
  elapsed-time-driven, which was a guaranteed false positive once quiet periods
  became normal.
- "Sync now" with the daemon stopped fell through to a request nobody would
  service; it now shells out to the CLI's own no-daemon fallback.
- `meridian tasks-sync` exited 0 on a failed sync, so the tray's fallback
  reported success for a sync that did not happen.
- Split `auto_generate.rs`, `pm_sync_requests.rs` and `meridian-oauth/jira.rs`
  to stay under the 500-line cap.

NOT YET MANUALLY VERIFIED - see the PR description. Every automated gate is
green (fmt, clippy -D warnings, cargo test --workspace, tsc, 915 UI tests,
static export build), but the tray-to-daemon round trip has no automated
coverage and migration 082 has only ever run against in-memory SQLite, never a
real SQLCipher WAL database with two processes attached.
---
 meridian-core/src/lib.rs                      |   4 +
 meridian-core/src/pm_sync_requests/mod.rs     | 279 ++++++++++++++
 meridian-core/src/pm_sync_requests/tests.rs   | 266 ++++++++++++++
 meridian-oauth/src/{jira.rs => jira/mod.rs}   | 102 +++---
 meridian-oauth/src/jira/tests.rs              | 121 ++++++
 src/health/jira.rs                            | 113 +++++-
 src/intelligence/mod.rs                       | 113 +++++-
 src/intelligence/oauth/jira.rs                |  89 ++++-
 src/intelligence/providers/jira/refresh.rs    | 150 +++++---
 src/intelligence/sync_delegate.rs             | 320 ++++++++++++++++
 src/intelligence/sync_requests.rs             | 227 ++++++++++++
 src/main.rs                                   | 200 ++++++++--
 src/migrations/082_pm_sync_requests.sql       |  68 ++++
 src/plan_tasks/create.rs                      |  36 +-
 src/plan_tasks/done.rs                        |  17 +-
 src/plan_tasks/edit.rs                        |  17 +-
 src/pm_worklog/auto_generate/mod.rs           | 216 +++++++++++
 .../sweep.rs}                                 | 237 ++----------
 tray/src-tauri/src/commands/integrations.rs   |  28 +-
 tray/src-tauri/src/commands/tasks.rs          | 345 +++++++++++++-----
 tray/src-tauri/src/lib.rs                     |   1 +
 ui/components/plan/PlanView.tsx               |  31 +-
 .../timeline/WorklogTicketPicker.tsx          |  16 +-
 .../timeline/settings/IntegrationsSection.tsx |   2 +-
 ui/lib/taskSync.ts                            |  56 +++
 25 files changed, 2575 insertions(+), 479 deletions(-)
 create mode 100644 meridian-core/src/pm_sync_requests/mod.rs
 create mode 100644 meridian-core/src/pm_sync_requests/tests.rs
 rename meridian-oauth/src/{jira.rs => jira/mod.rs} (85%)
 create mode 100644 meridian-oauth/src/jira/tests.rs
 create mode 100644 src/intelligence/sync_delegate.rs
 create mode 100644 src/intelligence/sync_requests.rs
 create mode 100644 src/migrations/082_pm_sync_requests.sql
 create mode 100644 src/pm_worklog/auto_generate/mod.rs
 rename src/pm_worklog/{auto_generate.rs => auto_generate/sweep.rs} (53%)

diff --git a/meridian-core/src/lib.rs b/meridian-core/src/lib.rs
index 9653d4712..fa07d5253 100644
--- a/meridian-core/src/lib.rs
+++ b/meridian-core/src/lib.rs
@@ -44,6 +44,10 @@ pub mod settings;
 /// Notification delivery policy + native pending queue (ported from lib/notifications.ts).
 pub mod notifications;
 
+/// Single-owner PM sync request outbox (migration 082) - producers ask, the daemon
+/// alone services them, so the rotating Jira OAuth token has exactly one writer.
+pub mod pm_sync_requests;
+
 /// The `~/.meridian/plan_auto_opened` marker format — written by the tray's
 /// daily planner auto-open, read by the daemon's plan-nudge hold-back.
 pub mod plan_marker;
diff --git a/meridian-core/src/pm_sync_requests/mod.rs b/meridian-core/src/pm_sync_requests/mod.rs
new file mode 100644
index 000000000..ed070c6b5
--- /dev/null
+++ b/meridian-core/src/pm_sync_requests/mod.rs
@@ -0,0 +1,279 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Single-owner PM sync: the request side of the outbox (`pm_sync_requests`,
+//! migration 082).
+//!
+//! # Why sync is a request instead of an action
+//!
+//! An Atlassian OAuth refresh token is single-use and rotating. The old token dies
+//! the instant the new one is issued, so a lost response leaves the grant
+//! recoverable only inside a 10-minute window and permanently dead after it. That
+//! makes the token a resource with exactly ONE safe writer.
+//!
+//! It had several: the tray refreshed in-process, the daemon refreshed on its poll
+//! loop, and the tray spawned fresh `meridian pm-sync` / `tasks-sync` processes that
+//! each refreshed too. The advisory file lock meant to serialise them could not
+//! actually do it - its 10 s timeout is shorter than the ~26 s a refresh can take
+//! (3 attempts x 8 s plus backoff), and on timeout the code proceeded WITHOUT the
+//! lock rather than backing off. So two processes could spend the same token, and
+//! the only thing preventing corruption was Atlassian's grace window handing the
+//! loser the current pair.
+//!
+//! Producers now write a row here and the **daemon is the sole consumer**, so the
+//! credential is held by one process by construction rather than by lock discipline.
+//!
+//! # Who calls this
+//! - Producers: `tray/src-tauri/src/commands/tasks.rs` (window opens, tracker
+//!   connect, "Sync now"), and the `meridian tasks-sync` / `pm-sync` CLIs when a
+//!   daemon is running.
+//! - Consumer: the daemon's sync-request watcher (`src/intelligence/sync_requests.rs`).
+//!
+//! # Related
+//! - [`crate::notifications`] - the outbox pattern this mirrors.
+
+use anyhow::{Context, Result};
+use sqlx::SqlitePool;
+
+/// The all-providers request every current producer writes. A specific provider
+/// name scopes a request to one board, reserved for a future caller that needs it.
+pub const ALL_PROVIDERS: &str = "*";
+
+/// Whether the daemon should honour the per-provider staleness window or bypass it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SyncMode {
+    /// Honour the staleness window - the cheap common case (a window opening).
+    Gated,
+    /// Bypass it: the user explicitly asked (connected a tracker, pressed "Sync
+    /// now", ran a CLI).
+    Force,
+}
+
+impl SyncMode {
+    /// The stored discriminant. Kept as text so the row is readable in `sqlite3`
+    /// during support work.
+    pub fn as_str(self) -> &'static str {
+        match self {
+            SyncMode::Gated => "gated",
+            SyncMode::Force => "force",
+        }
+    }
+
+    /// Parse a stored discriminant, defaulting to the SAFER option. An unknown or
+    /// corrupt value must never silently become a `Force` that bypasses the
+    /// staleness gate and hammers the provider's API.
+    pub fn from_str_or_gated(s: &str) -> Self {
+        match s {
+            "force" => SyncMode::Force,
+            _ => SyncMode::Gated,
+        }
+    }
+}
+
+/// One pending request, as claimed by the daemon.
+#[derive(Debug, Clone)]
+pub struct SyncRequest {
+    pub provider: String,
+    pub mode: SyncMode,
+    pub reason: String,
+}
+
+/// Ask the daemon to sync PM tasks. Idempotent and coalescing: repeated calls
+/// collapse into the single pending row rather than queueing, so opening the
+/// dashboard ten times means "a sync is wanted", not ten syncs.
+///
+/// `mode` **escalates only**. A `Force` landing on a pending `Gated` upgrades it,
+/// because a user who just connected a tracker must not have that downgraded by a
+/// passing window focus; a `Gated` landing on a pending `Force` leaves the `Force`
+/// intact. Writing a new request also clears any previous completion stamps, so the
+/// row unambiguously represents work still to do.
+///
+/// `reason` is a producer tag for tracing only (`"dashboard_open"`,
+/// `"token_connected"`). Never pass user content - it is read back into logs.
+#[tracing::instrument(skip(pool))]
+pub async fn request(
+    pool: &SqlitePool,
+    provider: &str,
+    mode: SyncMode,
+    reason: &str,
+) -> Result<()> {
+    sqlx::query(
+        "INSERT INTO pm_sync_requests
+             (provider, mode, reason, requested_at, claimed_at, completed_at, error, synced_count)
+         VALUES (?, ?, ?, strftime('%Y-%m-%dT%H:%M:%SZ', 'now'), NULL, NULL, NULL, NULL)
+         ON CONFLICT(provider) DO UPDATE SET
+             -- Escalate to 'force', never back down from it while still pending.
+             --
+             -- The `completed_at IS NULL` half is load-bearing: the row is kept after a
+             -- sync finishes (so \"Sync now\" can read its result), so without it a
+             -- SPENT 'force' would be inherited forever and every later gated request
+             -- would silently escalate. One tracker connect would then make every
+             -- planner open bypass the staleness gate and hit the provider for real -
+             -- reinstating the constant polling this whole design removes, and
+             -- multiplying exactly the token refreshes it exists to reduce.
+             mode = CASE
+                 WHEN excluded.mode = 'force'
+                   OR (pm_sync_requests.mode = 'force'
+                       AND pm_sync_requests.completed_at IS NULL)
+                      THEN 'force'
+                 ELSE excluded.mode
+             END,
+             reason       = excluded.reason,
+             requested_at = excluded.requested_at,
+             -- A fresh request re-opens the row: drop the in-flight and completion
+             -- marks so the watcher sees pending work again.
+             claimed_at   = NULL,
+             completed_at = NULL,
+             error        = NULL,
+             synced_count = NULL",
+    )
+    .bind(provider)
+    .bind(mode.as_str())
+    .bind(reason)
+    .execute(pool)
+    .await
+    .context("writing a PM sync request")?;
+    tracing::debug!(provider, mode = mode.as_str(), reason, "PM sync requested");
+    Ok(())
+}
+
+/// Claim the pending request for `provider`, if there is one, marking it in-flight
+/// so a second watcher tick can't pick up the same work.
+///
+/// The claim is a conditional UPDATE (`WHERE claimed_at IS NULL AND completed_at IS
+/// NULL`) rather than a read-then-write, so two daemons racing on the same file -
+/// which the single-instance guard makes unlikely but not impossible during a
+/// restart overlap - cannot both claim it. SQLite serialises the statement, so
+/// exactly one sees a non-zero `rows_affected`.
+#[tracing::instrument(skip(pool))]
+pub async fn claim(pool: &SqlitePool, provider: &str) -> Result<Option<SyncRequest>> {
+    let claimed = sqlx::query(
+        "UPDATE pm_sync_requests
+            SET claimed_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
+          WHERE provider = ?
+            AND claimed_at IS NULL
+            AND completed_at IS NULL",
+    )
+    .bind(provider)
+    .execute(pool)
+    .await
+    .context("claiming a PM sync request")?;
+
+    if claimed.rows_affected() == 0 {
+        return Ok(None);
+    }
+
+    let row: Option<(String, String)> =
+        sqlx::query_as("SELECT mode, reason FROM pm_sync_requests WHERE provider = ?")
+            .bind(provider)
+            .fetch_optional(pool)
+            .await
+            .context("reading the claimed PM sync request")?;
+
+    Ok(row.map(|(mode, reason)| SyncRequest {
+        provider: provider.to_string(),
+        mode: SyncMode::from_str_or_gated(&mode),
+        reason,
+    }))
+}
+
+/// Record the outcome of a serviced request in place. The row is deliberately kept
+/// rather than deleted so `"Sync now"` can read a real result without holding the
+/// credential, and so support has a content-free view of the last attempt.
+///
+/// Writes only if the row is still the one that was claimed. The guard is
+/// **`claimed_at IS NOT NULL`**, and that specific predicate is the whole point:
+/// [`request`] resets `claimed_at` to `NULL`, so a request that arrived mid-sync
+/// makes this UPDATE match nothing. Guarding on `completed_at IS NULL` alone would
+/// NOT work - the fresh request leaves that NULL too, so the older sync's outcome
+/// would stamp the new request as done without it ever being serviced, and the
+/// user's "Sync now" would report success for a sync that never ran.
+#[tracing::instrument(skip(pool))]
+pub async fn complete(
+    pool: &SqlitePool,
+    provider: &str,
+    synced_count: Option<i64>,
+    error: Option<&str>,
+) -> Result<()> {
+    sqlx::query(
+        "UPDATE pm_sync_requests
+            SET completed_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now'),
+                error        = ?,
+                synced_count = ?
+          WHERE provider = ?
+            AND claimed_at IS NOT NULL
+            AND completed_at IS NULL",
+    )
+    .bind(error)
+    .bind(synced_count)
+    .bind(provider)
+    .execute(pool)
+    .await
+    .context("completing a PM sync request")?;
+    Ok(())
+}
+
+/// Release claims left in flight by a daemon that died mid-sync, so the request
+/// becomes claimable again. Call once at watcher startup.
+///
+/// Without this a crash, a `meridian restart`, or a SIGKILL between [`claim`] and
+/// [`complete`] strands the row **claimed but never completed** - and since [`claim`]
+/// requires `claimed_at IS NULL`, no future tick would ever pick it up. PM sync
+/// would then be silently dead until the next new request happened to reset the row.
+/// Same reasoning as the daemon's `cleanup_incomplete_runs` for partial ETL runs.
+///
+/// Only ever widens what is claimable, so it is safe to run unconditionally on every
+/// boot: a genuinely in-flight sync cannot exist yet, because the only consumer is
+/// the watcher this runs before.
+#[tracing::instrument(skip(pool))]
+pub async fn reset_stale_claims(pool: &SqlitePool) -> Result<u64> {
+    let res = sqlx::query(
+        "UPDATE pm_sync_requests
+            SET claimed_at = NULL
+          WHERE claimed_at IS NOT NULL
+            AND completed_at IS NULL",
+    )
+    .execute(pool)
+    .await
+    .context("resetting stale PM sync request claims")?;
+    let n = res.rows_affected();
+    if n > 0 {
+        tracing::info!(
+            reset = n,
+            "released PM sync claims stranded by a previous daemon exit"
+        );
+    }
+    Ok(n)
+}
+
+/// The outcome of the last request for `provider`, for a producer that wants to
+/// show one ("Sync now"). `None` while the request is still pending or in flight,
+/// so a caller can poll this until it turns `Some`.
+pub async fn outcome(pool: &SqlitePool, provider: &str) -> Result<Option<SyncOutcome>> {
+    let row: Option<(Option<String>, Option<String>, Option<i64>)> = sqlx::query_as(
+        "SELECT completed_at, error, synced_count FROM pm_sync_requests WHERE provider = ?",
+    )
+    .bind(provider)
+    .fetch_optional(pool)
+    .await
+    .context("reading the PM sync outcome")?;
+
+    Ok(match row {
+        Some((Some(_completed), error, synced_count)) => Some(SyncOutcome {
+            error,
+            synced_count,
+        }),
+        // No row, or a row still pending / in flight.
+        _ => None,
+    })
+}
+
+/// A completed request's result.
+#[derive(Debug, Clone)]
+pub struct SyncOutcome {
+    /// `None` on success, the failure detail otherwise.
+    pub error: Option<String>,
+    /// Tasks refreshed, when the daemon reported a count.
+    pub synced_count: Option<i64>,
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/meridian-core/src/pm_sync_requests/tests.rs b/meridian-core/src/pm_sync_requests/tests.rs
new file mode 100644
index 000000000..2bf861c66
--- /dev/null
+++ b/meridian-core/src/pm_sync_requests/tests.rs
@@ -0,0 +1,266 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Tests for the PM sync request outbox.
+//!
+//! Split out of `mod.rs` purely for the 500-line file cap; they are the module's own
+//! unit tests and belong to it. Each one pins a race or a policy that is invisible
+//! from the SQL alone - read them alongside the doc comment on the function they
+//! exercise.
+
+use super::*;
+use sqlx::sqlite::SqliteConnectOptions;
+use std::str::FromStr;
+
+async fn db() -> SqlitePool {
+    let opts = SqliteConnectOptions::from_str("sqlite::memory:")
+        .unwrap()
+        .create_if_missing(true);
+    let pool = SqlitePool::connect_with(opts).await.unwrap();
+    sqlx::query(
+        "CREATE TABLE pm_sync_requests (
+             provider TEXT NOT NULL PRIMARY KEY,
+             mode TEXT NOT NULL DEFAULT 'gated',
+             reason TEXT NOT NULL DEFAULT '',
+             requested_at TEXT NOT NULL,
+             claimed_at TEXT,
+             completed_at TEXT,
+             error TEXT,
+             synced_count INTEGER
+         )",
+    )
+    .execute(&pool)
+    .await
+    .unwrap();
+    pool
+}
+
+/// Repeated requests must COALESCE into one pending row. Ten planner opens
+/// mean "a sync is wanted", not ten syncs.
+#[tokio::test]
+async fn repeated_requests_coalesce_into_one_row() {
+    let pool = db().await;
+    for _ in 0..10 {
+        request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
+            .await
+            .unwrap();
+    }
+    let n: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM pm_sync_requests")
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+    assert_eq!(n, 1);
+}
+
+/// A user action must not be downgraded by a passing window focus.
+#[tokio::test]
+async fn force_survives_a_later_gated_request() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "token_connected")
+        .await
+        .unwrap();
+    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
+        .await
+        .unwrap();
+
+    let req = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
+    assert_eq!(req.mode, SyncMode::Force);
+}
+
+/// ...and a user action must be able to escalate a pending gated request.
+#[tokio::test]
+async fn gated_escalates_to_force() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
+        .await
+        .unwrap();
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+        .await
+        .unwrap();
+
+    let req = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
+    assert_eq!(req.mode, SyncMode::Force);
+}
+
+/// A *spent* force must NOT be inherited. The row survives completion so "Sync
+/// now" can read its result, so escalation has to be scoped to a still-pending
+/// row - otherwise one tracker connect leaves `mode = 'force'` set forever and
+/// every later planner open bypasses the staleness gate and hits the provider
+/// for real, multiplying the token refreshes this design exists to reduce.
+#[tokio::test]
+async fn a_completed_force_does_not_escalate_the_next_gated_request() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "token_connected")
+        .await
+        .unwrap();
+    claim(&pool, ALL_PROVIDERS).await.unwrap();
+    complete(&pool, ALL_PROVIDERS, Some(4), None).await.unwrap();
+
+    // A later window open wants the cheap, gated behaviour.
+    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
+        .await
+        .unwrap();
+
+    let req = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
+    assert_eq!(
+        req.mode,
+        SyncMode::Gated,
+        "a spent force must not escalate later gated requests"
+    );
+}
+
+/// The in-flight case still escalates: a force that is claimed but not completed
+/// will have its outcome discarded by `complete`'s guard and be re-serviced, so
+/// the force intent must survive into that re-run.
+#[tokio::test]
+async fn an_in_flight_force_still_survives_a_gated_request() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+        .await
+        .unwrap();
+    claim(&pool, ALL_PROVIDERS).await.unwrap();
+
+    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
+        .await
+        .unwrap();
+
+    let req = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
+    assert_eq!(req.mode, SyncMode::Force);
+}
+
+/// A claim is exclusive: the second attempt sees nothing, so two watcher ticks
+/// can never run the same sync twice.
+#[tokio::test]
+async fn claim_is_exclusive() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
+        .await
+        .unwrap();
+    assert!(claim(&pool, ALL_PROVIDERS).await.unwrap().is_some());
+    assert!(
+        claim(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
+        "a claimed request must not be claimable again"
+    );
+}
+
+/// Nothing pending is a quiet `None`, not an error - the watcher ticks on this
+/// constantly.
+#[tokio::test]
+async fn claim_with_no_request_is_none() {
+    let pool = db().await;
+    assert!(claim(&pool, ALL_PROVIDERS).await.unwrap().is_none());
+}
+
+/// A daemon killed between claim and complete must not strand PM sync forever.
+/// Without the reset the row stays claimed, `claim` requires `claimed_at IS
+/// NULL`, and no future tick could ever service it.
+#[tokio::test]
+async fn stale_claims_are_released_on_startup() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+        .await
+        .unwrap();
+    claim(&pool, ALL_PROVIDERS).await.unwrap();
+    // ... daemon dies here, no `complete` ever runs.
+
+    assert!(
+        claim(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
+        "precondition: a stranded claim blocks re-claiming"
+    );
+
+    assert_eq!(reset_stale_claims(&pool).await.unwrap(), 1);
+
+    let req = claim(&pool, ALL_PROVIDERS)
+        .await
+        .unwrap()
+        .expect("the request must be serviceable again after the reset");
+    assert_eq!(req.mode, SyncMode::Force);
+}
+
+/// The reset must not disturb a request that already completed - that would
+/// re-run finished work on every daemon boot.
+#[tokio::test]
+async fn reset_leaves_completed_requests_alone() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
+        .await
+        .unwrap();
+    claim(&pool, ALL_PROVIDERS).await.unwrap();
+    complete(&pool, ALL_PROVIDERS, Some(2), None).await.unwrap();
+
+    assert_eq!(reset_stale_claims(&pool).await.unwrap(), 0);
+    assert!(
+        claim(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
+        "a completed request must stay completed"
+    );
+}
+
+/// The outcome is invisible until the daemon finishes, so a producer polling it
+/// can tell "still working" from "done".
+#[tokio::test]
+async fn outcome_is_none_until_completed() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+        .await
+        .unwrap();
+    assert!(outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none());
+
+    claim(&pool, ALL_PROVIDERS).await.unwrap();
+    assert!(
+        outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
+        "in-flight must still read as pending"
+    );
+
+    complete(&pool, ALL_PROVIDERS, Some(7), None).await.unwrap();
+    let out = outcome(&pool, ALL_PROVIDERS).await.unwrap().expect("done");
+    assert_eq!(out.synced_count, Some(7));
+    assert!(out.error.is_none());
+}
+
+/// A failure is reported, not swallowed.
+#[tokio::test]
+async fn outcome_carries_the_error() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+        .await
+        .unwrap();
+    claim(&pool, ALL_PROVIDERS).await.unwrap();
+    complete(&pool, ALL_PROVIDERS, None, Some("401 unauthorized"))
+        .await
+        .unwrap();
+
+    let out = outcome(&pool, ALL_PROVIDERS).await.unwrap().expect("done");
+    assert_eq!(out.error.as_deref(), Some("401 unauthorized"));
+}
+
+/// THE RACE THIS GUARDS: a request arriving mid-sync resets the row, and the
+/// older sync's outcome must NOT stamp it complete - that would mark the new
+/// request done without ever servicing it.
+#[tokio::test]
+async fn completion_does_not_clobber_a_request_that_arrived_mid_sync() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
+        .await
+        .unwrap();
+    claim(&pool, ALL_PROVIDERS).await.unwrap();
+
+    // A new request lands while the first sync is still running.
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+        .await
+        .unwrap();
+
+    // The in-flight sync finishes and tries to report. This must be a NO-OP:
+    // the new request cleared `claimed_at`, so the guard rejects it.
+    complete(&pool, ALL_PROVIDERS, Some(3), None).await.unwrap();
+
+    assert!(
+        outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
+        "the older sync's outcome must NOT mark the new request complete - \
+         that would report success for a sync that never ran"
+    );
+
+    let req = claim(&pool, ALL_PROVIDERS)
+        .await
+        .unwrap()
+        .expect("the mid-sync request must still be pending");
+    assert_eq!(req.mode, SyncMode::Force);
+    assert_eq!(req.reason, "sync_now");
+}
diff --git a/meridian-oauth/src/jira.rs b/meridian-oauth/src/jira/mod.rs
similarity index 85%
rename from meridian-oauth/src/jira.rs
rename to meridian-oauth/src/jira/mod.rs
index 198901125..37ff9086c 100644
--- a/meridian-oauth/src/jira.rs
+++ b/meridian-oauth/src/jira/mod.rs
@@ -236,9 +236,59 @@ pub async fn login(client_id: &str, client_secret: &str, port: u16) -> Result<St
     Ok(site_url)
 }
 
+/// Seconds of margin before `expires_at` at which the access token is treated as
+/// expired. Stops a request being issued with a token that expires while it is
+/// still in flight.
+pub const EXPIRY_SKEW_SECS: i64 = 120;
+
+/// The stored tokens IF the access token is still usable — never a network call,
+/// never a refresh. `None` means "no store, unreadable store, or the access token
+/// has expired", and the caller must NOT interpret that as an error.
+///
+/// # Why this exists
+///
+/// Spending the rotating refresh token is only safe when a human is present. The
+/// POST is a single-use exchange: Atlassian retires the old token the moment it
+/// issues the replacement, so if the reply is lost the grant is dead, recoverable
+/// only inside Atlassian's 10-minute reuse-leeway window. A refresh fired from a
+/// background timer can therefore be destroyed by a laptop lid closing, with
+/// nobody watching and nothing to retry against — which is exactly how a
+/// production install lost its Jira grant permanently (a refresh POST at 18:26:55
+/// straddled a 28-minute suspend; the retry, instant on wake at 18:55:29, was 18
+/// minutes outside the window).
+///
+/// So the rule this function enforces: **unattended code may USE a valid access
+/// token but must never MINT one.** Anything on a clock — the worklog drafting
+/// sweep, retention passes, any future scheduled job — calls this. Anything on
+/// the path of a real user action calls [`ensure_fresh`] instead, where the
+/// machine is provably awake and in use because someone just clicked something.
+///
+/// Deferring costs nothing in practice: an unattended sweep that finds an expired
+/// token is, by definition, running while nobody is at the machine, and the next
+/// attended request refreshes properly.
+///
+/// # Related
+/// - [`ensure_fresh`] — the attended counterpart, which may refresh.
+/// - [`crate::store::OAuthTokens::is_expired`] — the expiry predicate used here.
+pub fn current_if_valid() -> Option<OAuthTokens> {
+    let t = store::load("jira").ok()?;
+    if t.is_expired(now_unix(), EXPIRY_SKEW_SECS) {
+        tracing::debug!(
+            "jira access token expired - unattended caller deferring rather than refreshing"
+        );
+        return None;
+    }
+    Some(t)
+}
+
 /// Load the stored tokens, refreshing the access token if it's within 120 s of
 /// expiry. Persists the rotated refresh token. Returns ready-to-use tokens.
 ///
+/// **Only call this on the path of a real user action.** Spending the rotating
+/// refresh token from a background timer is what permanently kills a grant when
+/// the machine suspends mid-request; see [`current_if_valid`] for the full
+/// reasoning and the unattended alternative.
+///
 /// Refreshes are serialised on TWO levels so the rotating refresh token is never
 /// double-spent: a static mutex within this process, and an advisory FILE lock
 /// ([`store::lock_provider`]) across every Meridian process. After taking the file
@@ -250,7 +300,7 @@ pub async fn ensure_fresh() -> Result<OAuthTokens> {
 
     // Fast path: a still-fresh token needs neither a refresh nor the file lock.
     let t = store::load("jira")?;
-    if !t.is_expired(now_unix(), 120) {
+    if !t.is_expired(now_unix(), EXPIRY_SKEW_SECS) {
         return Ok(t);
     }
 
@@ -273,7 +323,7 @@ pub async fn ensure_fresh() -> Result<OAuthTokens> {
     // adopt their token instead of refreshing again with the dead one. This
     // double-check is what actually breaks the race.
     let mut t = store::load("jira")?;
-    if !t.is_expired(now_unix(), 120) {
+    if !t.is_expired(now_unix(), EXPIRY_SKEW_SECS) {
         tracing::debug!("jira token already refreshed by another process — adopting it");
         return Ok(t);
     }
@@ -370,50 +420,4 @@ impl JiraReqCtx {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn oauth_ctx() -> JiraReqCtx {
-        JiraReqCtx::OAuth {
-            token: "tok".into(),
-            cloud_id: "cloud-xyz".into(),
-            site_url: "https://acme.atlassian.net".into(),
-        }
-    }
-
-    fn basic_ctx() -> JiraReqCtx {
-        JiraReqCtx::Basic {
-            base_url: "https://acme.atlassian.net/".into(),
-            email: "a@b.com".into(),
-            api_token: "tok".into(),
-        }
-    }
-
-    #[test]
-    fn oauth_api_url_uses_gateway() {
-        assert_eq!(
-            oauth_ctx().api_url("/rest/api/3/search/jql"),
-            "https://api.atlassian.com/ex/jira/cloud-xyz/rest/api/3/search/jql"
-        );
-    }
-
-    #[test]
-    fn basic_api_url_uses_site_and_trims_slash() {
-        assert_eq!(
-            basic_ctx().api_url("/rest/api/3/search/jql"),
-            "https://acme.atlassian.net/rest/api/3/search/jql"
-        );
-    }
-
-    #[test]
-    fn browse_url_uses_site_in_both_modes() {
-        assert_eq!(
-            oauth_ctx().browse_url("KAN-1"),
-            "https://acme.atlassian.net/browse/KAN-1"
-        );
-        assert_eq!(
-            basic_ctx().browse_url("KAN-1"),
-            "https://acme.atlassian.net/browse/KAN-1"
-        );
-    }
-}
+mod tests;
diff --git a/meridian-oauth/src/jira/tests.rs b/meridian-oauth/src/jira/tests.rs
new file mode 100644
index 000000000..7293dcd30
--- /dev/null
+++ b/meridian-oauth/src/jira/tests.rs
@@ -0,0 +1,121 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Tests for the Jira OAuth flow and token handling.
+//!
+//! Split out of `mod.rs` for the 500-line file cap; they are this module's own unit
+//! tests. The `current_if_valid` cases pin the attended/unattended split - the rule
+//! that unattended code may USE a valid access token but must never MINT one, which
+//! is what stops a background refresh being destroyed by a laptop suspend.
+
+use super::*;
+
+fn oauth_ctx() -> JiraReqCtx {
+    JiraReqCtx::OAuth {
+        token: "tok".into(),
+        cloud_id: "cloud-xyz".into(),
+        site_url: "https://acme.atlassian.net".into(),
+    }
+}
+
+fn basic_ctx() -> JiraReqCtx {
+    JiraReqCtx::Basic {
+        base_url: "https://acme.atlassian.net/".into(),
+        email: "a@b.com".into(),
+        api_token: "tok".into(),
+    }
+}
+
+#[test]
+fn oauth_api_url_uses_gateway() {
+    assert_eq!(
+        oauth_ctx().api_url("/rest/api/3/search/jql"),
+        "https://api.atlassian.com/ex/jira/cloud-xyz/rest/api/3/search/jql"
+    );
+}
+
+#[test]
+fn basic_api_url_uses_site_and_trims_slash() {
+    assert_eq!(
+        basic_ctx().api_url("/rest/api/3/search/jql"),
+        "https://acme.atlassian.net/rest/api/3/search/jql"
+    );
+}
+
+#[test]
+fn browse_url_uses_site_in_both_modes() {
+    assert_eq!(
+        oauth_ctx().browse_url("KAN-1"),
+        "https://acme.atlassian.net/browse/KAN-1"
+    );
+    assert_eq!(
+        basic_ctx().browse_url("KAN-1"),
+        "https://acme.atlassian.net/browse/KAN-1"
+    );
+}
+
+/// Seed a jira token store under a private `$HOME` with `expires_at` at
+/// `now + offset_secs`. Returns the guard that keeps `$HOME` stable for the
+/// duration of the test.
+fn seed_store(tag: &str, offset_secs: i64) -> std::sync::MutexGuard<'static, ()> {
+    let guard = crate::env_test_guard();
+    let dir = std::env::temp_dir().join(format!("meridian_oauth_civ_{tag}_{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::env::set_var("HOME", &dir);
+    store::save(&OAuthTokens {
+        provider: "jira".into(),
+        client_id: "cid".into(),
+        access_token: "access".into(),
+        refresh_token: "refresh".into(),
+        expires_at: now_unix() + offset_secs,
+        scopes: String::new(),
+        cloud_id: "cloud-xyz".into(),
+        site_url: "https://acme.atlassian.net".into(),
+    })
+    .expect("seeding the token store should succeed");
+    guard
+}
+
+/// A comfortably-valid access token is handed straight back, so an unattended
+/// sweep can still refresh the ticket cache without touching the network.
+#[test]
+fn current_if_valid_returns_a_live_token() {
+    let _g = seed_store("live", 3600);
+    let t = current_if_valid().expect("a token an hour from expiry must be usable");
+    assert_eq!(t.access_token, "access");
+    assert_eq!(t.cloud_id, "cloud-xyz");
+}
+
+/// THE POINT OF THE FUNCTION: an expired token yields `None` rather than
+/// triggering a refresh. Spending the rotating refresh token unattended is what
+/// permanently kills a grant when the machine suspends mid-POST, so a
+/// clock-driven caller must defer instead.
+#[test]
+fn current_if_valid_refuses_to_mint_when_expired() {
+    let _g = seed_store("expired", -10);
+    assert!(
+        current_if_valid().is_none(),
+        "an expired token must NOT be returned - the caller would use it and 401, \
+         and the whole point is to defer to the next attended request"
+    );
+}
+
+/// The skew is applied, not just raw expiry: a token inside the margin counts as
+/// expired so a request can't be issued with one that dies mid-flight.
+#[test]
+fn current_if_valid_applies_the_expiry_skew() {
+    let _g = seed_store("skew", EXPIRY_SKEW_SECS - 10);
+    assert!(
+        current_if_valid().is_none(),
+        "a token inside the {EXPIRY_SKEW_SECS}s skew must be treated as expired"
+    );
+}
+
+/// No store at all is a `None`, never a panic or an error — an install that has
+/// never connected Jira must sweep quietly.
+#[test]
+fn current_if_valid_handles_a_missing_store() {
+    let _g = crate::env_test_guard();
+    let dir = std::env::temp_dir().join(format!("meridian_oauth_civ_none_{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::env::set_var("HOME", &dir);
+    assert!(current_if_valid().is_none());
+}
diff --git a/src/health/jira.rs b/src/health/jira.rs
index ac4ec38a6..23624db4e 100644
--- a/src/health/jira.rs
+++ b/src/health/jira.rs
@@ -5,6 +5,16 @@
 // collapses both into a silent warn. Sync freshness + candidate count come from
 // meridian.db (content-free). Creds are read from the env (loaded via dotenv at
 // startup), so this works without reaching into Config internals.
+//
+// `sync_freshness` is outcome-driven (`pm_sync_state.last_error`), not
+// elapsed-time-driven. Syncing is on-demand now (the daily plan, the match-to-ticket
+// picker, connecting a tracker, a board write, manual "Sync now") rather than a
+// background poller ticking every ~5 minutes forever — so a quiet period with no sync
+// attempt is normal, not a symptom. A laptop shut overnight is the everyday case: it
+// wakes with a cache many hours old and nothing wrong. `last_error` reflects the actual outcome of the last attempted fetch
+// (set by `intelligence::providers::record_sync_failure`, cleared by
+// `clear_sync_error` on the next success), which stays correct however long that
+// was ago.
 
 use crate::config::Config;
 use crate::health::Check;
@@ -12,9 +22,6 @@ use crate::intelligence::oauth::{jira as oauth_jira, store as oauth_store};
 use sqlx::SqlitePool;
 use std::time::Duration;
 
-/// Cache older than this (2× the 30-min sync interval) ⇒ fetch likely failing.
-const SYNC_STALE_SECS: f64 = 3600.0;
-
 pub async fn checks(_cfg: &Config, pool: Option<&SqlitePool>) -> Vec<Check> {
     let mut out = Vec::new();
 
@@ -133,28 +140,29 @@ async fn classify_auth(send: reqwest::Result<reqwest::Response>) -> Check {
 }
 
 async fn sync_freshness(pool: &SqlitePool) -> Check {
-    match sqlx::query_scalar::<_, Option<f64>>(
-        "SELECT (julianday('now') - julianday(MAX(last_synced_at))) * 86400.0
+    match sqlx::query_as::<_, (Option<String>, Option<f64>)>(
+        "SELECT last_error, (julianday('now') - julianday(last_synced_at)) * 86400.0
          FROM pm_sync_state WHERE provider = 'jira'",
     )
-    .fetch_one(pool)
+    .fetch_optional(pool)
     .await
     {
-        Ok(Some(age)) if age > SYNC_STALE_SECS => Check::warn(
-            "ticket sync",
-            "L3",
-            format!(
-                "cache {:.0}m stale — fetch may be failing silently",
-                age / 60.0
-            ),
-        )
-        .with_remedy("check the auth row above; the daemon refreshes every 30m"),
-        Ok(Some(age)) => Check::ok(
+        // A recorded failure is the real signal — the last attempted fetch didn't
+        // work, regardless of how long ago that was. Never a warn from elapsed time
+        // alone: a long quiet period between on-demand syncs is expected now.
+        Ok(Some((Some(err), _))) => {
+            Check::warn("ticket sync", "L3", format!("sync failing: {err}")).with_remedy(
+                "check the auth row above, or Reconnect Jira in Settings - Integrations",
+            )
+        }
+        Ok(Some((None, Some(age)))) => Check::ok(
             "ticket sync",
             "L3",
-            format!("fresh ({:.0}m ago)", age / 60.0),
+            format!("last synced {:.0}m ago, no errors", age / 60.0),
         ),
-        Ok(None) => Check::info("ticket sync", "L3", "no Jira sync recorded yet"),
+        Ok(Some((None, None))) | Ok(None) => {
+            Check::info("ticket sync", "L3", "no Jira sync recorded yet")
+        }
         Err(e) => Check::warn(
             "ticket sync",
             "L3",
@@ -188,3 +196,72 @@ async fn candidate_count(pool: &SqlitePool) -> Check {
         ),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::health::Severity;
+    use sqlx::sqlite::SqliteConnectOptions;
+    use std::str::FromStr;
+
+    async fn make_db() -> SqlitePool {
+        let opts = SqliteConnectOptions::from_str("sqlite::memory:")
+            .unwrap()
+            .create_if_missing(true);
+        let pool = SqlitePool::connect_with(opts).await.unwrap();
+        sqlx::migrate!("src/migrations").run(&pool).await.unwrap();
+        pool
+    }
+
+    async fn seed(pool: &SqlitePool, synced_modifier: &str, last_error: Option<&str>) {
+        sqlx::query(
+            "INSERT INTO pm_sync_state (provider, last_synced_at, last_error)
+             VALUES ('jira', strftime('%Y-%m-%dT%H:%M:%SZ', 'now', ?), ?)",
+        )
+        .bind(synced_modifier)
+        .bind(last_error)
+        .execute(pool)
+        .await
+        .unwrap();
+    }
+
+    /// The false positive this rewrite exists to fix: a sync that hasn't run in
+    /// hours, with no recorded error, must NOT warn — on-demand syncing means a
+    /// long quiet period is expected, not a symptom.
+    #[tokio::test]
+    async fn sync_freshness_ok_when_stale_but_no_error() {
+        let pool = make_db().await;
+        seed(&pool, "-6 hours", None).await;
+
+        let check = sync_freshness(&pool).await;
+
+        assert_eq!(check.severity, Severity::Ok, "detail was: {}", check.detail);
+    }
+
+    /// A recorded fetch failure is the real signal, regardless of how recent it is.
+    #[tokio::test]
+    async fn sync_freshness_warns_on_recorded_error() {
+        let pool = make_db().await;
+        seed(&pool, "-2 minutes", Some("401 unauthorized")).await;
+
+        let check = sync_freshness(&pool).await;
+
+        assert_eq!(check.severity, Severity::Warn);
+        assert!(
+            check.detail.contains("401 unauthorized"),
+            "detail was: {}",
+            check.detail
+        );
+    }
+
+    /// A tracker that has never synced (fresh connect, or one that's never
+    /// fetched successfully) reports as informational, not a warning.
+    #[tokio::test]
+    async fn sync_freshness_info_when_never_synced() {
+        let pool = make_db().await;
+
+        let check = sync_freshness(&pool).await;
+
+        assert_eq!(check.severity, Severity::Info);
+    }
+}
diff --git a/src/intelligence/mod.rs b/src/intelligence/mod.rs
index 269728fd4..491d0415c 100644
--- a/src/intelligence/mod.rs
+++ b/src/intelligence/mod.rs
@@ -3,14 +3,37 @@
 pub mod oauth;
 pub mod providers;
 pub mod session_categorizer;
+/// Producer side of the `pm_sync_requests` outbox for short-lived CLI processes — how
+/// `plan-task-*`, `ticket-update` and `worklog-generate` refresh the board without
+/// becoming a second writer of the rotating Jira OAuth token.
+pub mod sync_delegate;
+/// Daemon-side consumer of the `pm_sync_requests` outbox — the reason the daemon is
+/// the only process that ever holds the rotating Jira OAuth token.
+pub mod sync_requests;
 pub mod task_triage;
 pub mod ticket_update;
 
 use anyhow::Result;
 use sqlx::SqlitePool;
+use std::sync::OnceLock;
+use tokio::sync::Mutex;
 
 use crate::config::{Config, PmProviderConfig};
 
+/// In-process serialisation for [`run_pm_sync`]. Now that syncing is triggered from
+/// several independent on-demand call sites (the daily plan, worklog drafting sweep,
+/// `meridian pm-sync`) instead of one single poll-loop tick, two of them can land in
+/// the same instant — e.g. opening the planner while a drafting sweep is mid-flight.
+/// Both would otherwise read `pm_sync_state` as stale and fire a real fetch
+/// concurrently, wasting a call for every redundant racer. This only dedups within
+/// ONE process; the Jira OAuth refresh-token race across processes is a separate,
+/// already-solved problem (`meridian-oauth/src/store.rs::lock_provider`, a
+/// cross-process file lock inside the refresh path itself).
+fn sync_lock() -> &'static Mutex<()> {
+    static LOCK: OnceLock<Mutex<()>> = OnceLock::new();
+    LOCK.get_or_init(|| Mutex::new(()))
+}
+
 /// True once at least one PM task is cached. Rows only land in `pm_tasks` after a
 /// provider authenticated and fetched successfully, so a non-zero count is proof
 /// a tracker actually WORKS (not merely that keys are present — bad creds 401 and
@@ -73,20 +96,74 @@ pub async fn run_pm_force_sync(meridian: &SqlitePool, config: &Config) -> Result
     Ok(())
 }
 
-/// Refreshes PM task caches from all configured providers.
+/// Whether a sync is happening behind a real user action or on a clock. Only Jira
+/// OAuth cares, and the difference is not cosmetic: see [`Trigger::Unattended`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Trigger {
+    /// A human just did something — opened the planner, connected a tracker,
+    /// pressed Sync now, edited a ticket, ran a CLI. The machine is provably awake
+    /// and in use, so spending the rotating refresh token is safe.
+    Attended,
+    /// A clock fired and nobody is necessarily there (the hourly worklog drafting
+    /// sweep). Jira OAuth must NOT refresh here: the refresh is a single-use
+    /// exchange whose lost response kills the grant permanently outside a
+    /// 10-minute window, and a laptop suspending mid-POST is exactly how that
+    /// happens with no one watching. An expired token means skip this pass; the
+    /// next attended request refreshes properly. Providers with static
+    /// credentials (GitHub/Linear/Trello/Azure) are unaffected — they have no
+    /// rotating credential to lose.
+    Unattended,
+}
+
+/// Refreshes PM task caches from all configured providers whose cache has gone
+/// stale, behind a real user action. See [`run_pm_sync_with`] for the shared body
+/// and [`Trigger`] for why the distinction exists.
 #[tracing::instrument(skip_all)]
 pub async fn run_pm_sync(meridian: &SqlitePool, config: &Config) -> Result<()> {
+    run_pm_sync_with(meridian, config, Trigger::Attended).await
+}
+
+/// [`run_pm_sync`] for clock-driven callers: refreshes the ticket cache only if it
+/// can be done without minting a new Jira OAuth token, and quietly keeps the stale
+/// cache otherwise. Used by the hourly worklog drafting sweep.
+#[tracing::instrument(skip_all)]
+pub async fn run_pm_sync_unattended(meridian: &SqlitePool, config: &Config) -> Result<()> {
+    run_pm_sync_with(meridian, config, Trigger::Unattended).await
+}
+
+/// Refreshes PM task caches from all configured providers whose cache has gone stale
+/// (per-provider `refresh_if_stale`) — a cheap no-op when nothing is stale. Called
+/// from every on-demand trigger (the daily plan, worklog drafting, `meridian
+/// pm-sync`), not a timer, so [`sync_lock`] serialises same-process callers that land
+/// in the same instant rather than each racing the staleness check independently.
+#[tracing::instrument(skip(meridian, config))]
+pub async fn run_pm_sync_with(
+    meridian: &SqlitePool,
+    config: &Config,
+    trigger: Trigger,
+) -> Result<()> {
     if config.pm_providers.is_empty() {
         tracing::warn!("no PM providers configured — pm_tasks will stay empty (set JIRA_BASE_URL/GITHUB_TOKEN/LINEAR_API_KEY/AZURE_DEVOPS_PAT)");
         return Ok(());
     }
+
+    let _guard = match sync_lock().try_lock() {
+        Ok(g) => g,
+        Err(_) => {
+            tracing::debug!("run_pm_sync: another sync is already in flight — waiting for it");
+            sync_lock().lock().await
+        }
+    };
+
     let provider_count = config.pm_providers.len();
     tracing::debug!(provider_count, "syncing PM providers");
 
     for provider in &config.pm_providers {
         let name = provider.provider_name();
         let result = match provider {
-            PmProviderConfig::Jira(cfg) => providers::jira::refresh_if_stale(meridian, cfg).await,
+            PmProviderConfig::Jira(cfg) => {
+                providers::jira::refresh_if_stale(meridian, cfg, trigger).await
+            }
             PmProviderConfig::GitHub(cfg) => {
                 providers::github::refresh_if_stale(meridian, cfg).await
             }
@@ -220,4 +297,36 @@ mod tests {
         .unwrap();
         assert_eq!(queued, 0, "the board hygiene digest producer was removed");
     }
+
+    /// `run_pm_sync` now fires from several independent on-demand callers instead of
+    /// one poll-loop tick, so two of them can land in the same instant. This proves
+    /// [`sync_lock`] actually serialises concurrent holders rather than being a no-op
+    /// — tested directly against the lock primitive since exercising the full
+    /// `run_pm_sync` path needs a live (or mocked) provider HTTP call this crate has
+    /// no test seam for.
+    #[tokio::test]
+    async fn sync_lock_serialises_concurrent_holders() {
+        let order = std::sync::Arc::new(tokio::sync::Mutex::new(Vec::<&str>::new()));
+
+        let first_guard = sync_lock().lock().await;
+        let order_clone = order.clone();
+        let second = tokio::spawn(async move {
+            let _g = sync_lock().lock().await; // must wait for `first_guard` to drop
+            order_clone.lock().await.push("second");
+        });
+
+        // Give the spawned task a chance to actually block on the lock before we
+        // release it — otherwise a fast scheduler could run it after the drop below
+        // and the ordering assertion would prove nothing.
+        tokio::task::yield_now().await;
+        order.lock().await.push("first");
+        drop(first_guard);
+
+        second.await.unwrap();
+        assert_eq!(
+            *order.lock().await,
+            vec!["first", "second"],
+            "the second acquirer must not proceed until the first guard drops"
+        );
+    }
 }
diff --git a/src/intelligence/oauth/jira.rs b/src/intelligence/oauth/jira.rs
index 7af628c62..2aea4ede5 100644
--- a/src/intelligence/oauth/jira.rs
+++ b/src/intelligence/oauth/jira.rs
@@ -31,29 +31,47 @@ pub(crate) fn has_basic_auth(jira: &JiraConfig) -> bool {
         && !jira.api_token.trim().is_empty()
 }
 
+/// The Basic-auth context from config. Shared by both resolvers so the two cannot
+/// disagree about which config fields make up a request context — a field added to
+/// [`JiraReqCtx::Basic`] has exactly one place to be filled in.
+fn basic_ctx(jira: &JiraConfig) -> JiraReqCtx {
+    JiraReqCtx::Basic {
+        base_url: jira.base_url.clone(),
+        email: jira.email.clone(),
+        api_token: jira.api_token.clone(),
+    }
+}
+
+/// The OAuth context from a token the caller has already obtained. Deliberately takes
+/// the tokens rather than fetching them: that is the whole difference between the two
+/// resolvers ([`resolve`] may mint a new pair, `resolve_unattended` must not), and
+/// keeping the fetch out of here means neither can acquire one by accident.
+fn oauth_ctx(t: meridian_oauth::store::OAuthTokens) -> JiraReqCtx {
+    JiraReqCtx::OAuth {
+        token: t.access_token,
+        cloud_id: t.cloud_id,
+        site_url: t.site_url,
+    }
+}
+
 /// Decide how to authenticate Jira requests: prefer the static API token when
 /// fully configured, otherwise fall back to a stored OAuth session. API token
 /// beats stored OAuth — a set JIRA_API_TOKEN always wins.
 /// This mirrors the industry standard (gh, Vercel CLI, Stripe CLI all follow
 /// env-var-first) and lets developers use a stable PAT in .env without being
 /// blocked by a stale OAuth session stored in ~/.meridian/oauth/jira.json.
+///
+/// **May MINT a new refresh token, so only call this behind a real user action.**
+/// See [`resolve_unattended`] for the clock-driven counterpart and why the
+/// distinction is load-bearing.
 pub async fn resolve(jira: &JiraConfig) -> Result<JiraReqCtx> {
     if has_basic_auth(jira) {
         tracing::debug!(auth_method = "api_token", "resolving Jira auth");
-        return Ok(JiraReqCtx::Basic {
-            base_url: jira.base_url.clone(),
-            email: jira.email.clone(),
-            api_token: jira.api_token.clone(),
-        });
+        return Ok(basic_ctx(jira));
     }
     if store::exists("jira") {
         tracing::debug!(auth_method = "oauth", "resolving Jira auth");
-        let t = ensure_fresh().await?;
-        return Ok(JiraReqCtx::OAuth {
-            token: t.access_token,
-            cloud_id: t.cloud_id,
-            site_url: t.site_url,
-        });
+        return Ok(oauth_ctx(ensure_fresh().await?));
     }
     bail!(
         "no Jira auth available — run `meridian oauth-login jira`, \
@@ -61,6 +79,55 @@ pub async fn resolve(jira: &JiraConfig) -> Result<JiraReqCtx> {
     )
 }
 
+/// [`resolve`] for callers running on a CLOCK rather than behind a user action:
+/// returns auth only if it can be had without spending the rotating refresh token.
+/// `None` means "skip this pass", never an error.
+///
+/// # Why a separate resolver
+///
+/// Refreshing an Atlassian OAuth token is a single-use exchange: the old refresh
+/// token dies the instant the new one is issued, so a lost response leaves the
+/// grant recoverable only inside a 10-minute window. When that POST is fired by a
+/// timer with nobody at the machine, a closing laptop lid destroys the grant
+/// permanently — which is precisely how a production install lost Jira for five
+/// days (refresh at 18:26:55, 28-minute suspend, retry instant on wake at
+/// 18:55:29 but 18 minutes too late).
+///
+/// So unattended code may USE a valid access token but must never MINT one. This
+/// is the same discipline that makes Claude Code's MCP connections durable against
+/// the identical protocol: it only ever refreshes on the tail of something a human
+/// just asked for.
+///
+/// API-token (basic) auth is returned unconditionally — a static token has no
+/// expiry to race and no rotating credential to lose, so there is nothing to
+/// protect it from.
+///
+/// Deferring is close to free: a sweep that finds an expired token is by
+/// definition running while nobody is using the machine, so there is little new
+/// activity to match, and the next attended request refreshes properly.
+///
+/// # Related
+/// - [`resolve`] — the attended counterpart, which may refresh.
+/// - [`meridian_oauth::jira::current_if_valid`] — the non-minting token read.
+pub fn resolve_unattended(jira: &JiraConfig) -> Option<JiraReqCtx> {
+    if has_basic_auth(jira) {
+        tracing::debug!(
+            auth_method = "api_token",
+            "resolving Jira auth (unattended)"
+        );
+        return Some(basic_ctx(jira));
+    }
+    if !store::exists("jira") {
+        return None;
+    }
+    // `current_if_valid`, never `ensure_fresh` — this is the line that makes the
+    // function unattended-safe, and swapping it would silently reintroduce the
+    // timer-driven refresh that killed a production grant.
+    let t = meridian_oauth::jira::current_if_valid()?;
+    tracing::debug!(auth_method = "oauth", "resolving Jira auth (unattended)");
+    Some(oauth_ctx(t))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/src/intelligence/providers/jira/refresh.rs b/src/intelligence/providers/jira/refresh.rs
index dab541b0b..bcc4256e9 100644
--- a/src/intelligence/providers/jira/refresh.rs
+++ b/src/intelligence/providers/jira/refresh.rs
@@ -25,6 +25,7 @@ use sqlx::SqlitePool;
 
 use crate::config::JiraConfig;
 use crate::intelligence::providers::http::SyncFault;
+use crate::intelligence::Trigger;
 
 use super::{
     backfill_worklogged, discover_start_date_field, fetch, native_terminal, prune, upsert,
@@ -36,7 +37,11 @@ use super::{
 // ---------------------------------------------------------------------------
 
 #[tracing::instrument(skip(pool, jira))]
-pub async fn refresh_if_stale(pool: &SqlitePool, jira: &JiraConfig) -> Result<Option<Vec<String>>> {
+pub async fn refresh_if_stale(
+    pool: &SqlitePool,
+    jira: &JiraConfig,
+    trigger: Trigger,
+) -> Result<Option<Vec<String>>> {
     let threshold = format!("-{SYNC_INTERVAL_MINS} minutes");
     let (is_fresh,): (i64,) = sqlx::query_as(
         "SELECT EXISTS(
@@ -70,66 +75,85 @@ pub async fn refresh_if_stale(pool: &SqlitePool, jira: &JiraConfig) -> Result<Op
     // Resolve auth once per refresh: OAuth (with refresh-before-use) if a token
     // store exists, else static basic auth. A resolve failure means no usable
     // creds — keep the stale cache rather than erroring the whole tick.
-    let ctx = match crate::intelligence::oauth::jira::resolve(jira).await {
-        Ok(ctx) => ctx,
-        Err(e) => {
-            // A refresh that failed only because Atlassian was briefly
-            // unreachable (network blip, timeout, 429, 5xx) does NOT mean the
-            // token is dead — the stored refresh token is still valid and the
-            // next tick will almost certainly succeed. Raising a "Reconnect
-            // Jira / re-run oauth-login" sync error for that transient case is
-            // exactly what made this fault flap on and off at random. Keep the
-            // stale cache and stay quiet; the notice is reserved for a terminal
-            // auth failure the user actually has to act on.
-            // Deliberately NOT `record_sync_failure` like the fetch arm below:
-            // this path needs the auth-method-specific remedy override that the
-            // shared helper has no way to express (basic auth really does want
-            // the `.env` wording). The classification policy is otherwise
-            // identical, so a change to one should be mirrored here.
-            //
-            // `meridian_oauth::is_transient` only recognises a `TokenError` from
-            // the token endpoint and answers `false` for anything else, so a raw
-            // transport failure escaping the refresh would still land here as
-            // terminal. Falling back to `http::classify` closes that hole
-            // without ever making a genuinely dead grant look retryable.
-            let fault = if meridian_oauth::is_transient(&e) {
-                SyncFault::retry(&e)
-            } else {
-                crate::intelligence::providers::http::classify(&e)
-            };
-            match fault {
-                SyncFault::Retry { detail } => {
-                    tracing::warn!(
-                        error = %detail,
-                        "jira auth temporarily unavailable - keeping stale cache, will retry next sync"
-                    );
-                    let _ = crate::intelligence::providers::note_transient_sync_failure(
-                        pool, "jira", &detail,
-                    )
-                    .await;
-                }
-                SyncFault::Report { detail } => {
-                    tracing::warn!(error = %detail, "jira auth unavailable - keeping stale cache");
-                    let msg = format!("Jira auth failed: {detail}");
-                    // Basic-auth (JIRA_API_TOKEN/JIRA_BASE_URL) and OAuth are
-                    // mutually exclusive here - has_basic_auth() mirrors
-                    // resolve()'s own choice - so the remedy must match whichever
-                    // path this failure came from, not always point at .env.
-                    let remedy = if crate::intelligence::oauth::jira::has_basic_auth(jira) {
-                        "Set JIRA_API_TOKEN and JIRA_BASE_URL in .env"
-                    } else {
-                        "Reconnect Jira in Settings - Integrations"
-                    };
-                    let _ = crate::intelligence::providers::stamp_sync_error_with_remedy(
-                        pool,
-                        "jira",
-                        &msg,
-                        Some(remedy),
-                    )
-                    .await;
+    //
+    // A clock-driven pass must never MINT a Jira OAuth token — spending the
+    // rotating refresh token unattended is what permanently kills a grant when the
+    // machine suspends mid-POST (see `Trigger::Unattended`). An expired token here
+    // means keep the stale cache and let the next attended request refresh; that
+    // is not a failure and must not be recorded as one, or a laptop that was shut
+    // for the night would raise a sync error every morning.
+    let ctx = if trigger == Trigger::Unattended {
+        match crate::intelligence::oauth::jira::resolve_unattended(jira) {
+            Some(ctx) => ctx,
+            None => {
+                tracing::debug!(
+                    "jira token not usable without a refresh - deferring unattended sync"
+                );
+                return Ok(None);
+            }
+        }
+    } else {
+        match crate::intelligence::oauth::jira::resolve(jira).await {
+            Ok(ctx) => ctx,
+            Err(e) => {
+                // A refresh that failed only because Atlassian was briefly
+                // unreachable (network blip, timeout, 429, 5xx) does NOT mean the
+                // token is dead — the stored refresh token is still valid and the
+                // next tick will almost certainly succeed. Raising a "Reconnect
+                // Jira / re-run oauth-login" sync error for that transient case is
+                // exactly what made this fault flap on and off at random. Keep the
+                // stale cache and stay quiet; the notice is reserved for a terminal
+                // auth failure the user actually has to act on.
+                // Deliberately NOT `record_sync_failure` like the fetch arm below:
+                // this path needs the auth-method-specific remedy override that the
+                // shared helper has no way to express (basic auth really does want
+                // the `.env` wording). The classification policy is otherwise
+                // identical, so a change to one should be mirrored here.
+                //
+                // `meridian_oauth::is_transient` only recognises a `TokenError` from
+                // the token endpoint and answers `false` for anything else, so a raw
+                // transport failure escaping the refresh would still land here as
+                // terminal. Falling back to `http::classify` closes that hole
+                // without ever making a genuinely dead grant look retryable.
+                let fault = if meridian_oauth::is_transient(&e) {
+                    SyncFault::retry(&e)
+                } else {
+                    crate::intelligence::providers::http::classify(&e)
+                };
+                match fault {
+                    SyncFault::Retry { detail } => {
+                        tracing::warn!(
+                            error = %detail,
+                            "jira auth temporarily unavailable - keeping stale cache, will retry next sync"
+                        );
+                        let _ = crate::intelligence::providers::note_transient_sync_failure(
+                            pool, "jira", &detail,
+                        )
+                        .await;
+                    }
+                    SyncFault::Report { detail } => {
+                        tracing::warn!(error = %detail, "jira auth unavailable - keeping stale cache");
+                        let msg = format!("Jira auth failed: {detail}");
+                        // Basic-auth (JIRA_API_TOKEN/JIRA_BASE_URL) and OAuth are
+                        // mutually exclusive here - has_basic_auth() mirrors
+                        // resolve()'s own choice - so the remedy must match whichever
+                        // path this failure came from, not always point at .env.
+                        let remedy = if crate::intelligence::oauth::jira::has_basic_auth(jira) {
+                            "Set JIRA_API_TOKEN and JIRA_BASE_URL in .env"
+                        } else {
+                            "Reconnect Jira in Settings - Integrations"
+                        };
+                        let _ = crate::intelligence::providers::stamp_sync_error_with_remedy(
+                            pool,
+                            "jira",
+                            &msg,
+                            Some(remedy),
+                        )
+                        .await;
+                    }
                 }
+                return Ok(None);
             }
-            return Ok(None);
         }
     };
     let auth_method = if jira.api_token.is_empty() {
@@ -225,10 +249,16 @@ pub async fn refresh_if_stale(pool: &SqlitePool, jira: &JiraConfig) -> Result<Op
 /// Clears `pm_sync_state` for this provider so `refresh_if_stale` sees it as
 /// stale, then delegates. The `last_synced_at` is updated inside the delegate,
 /// so subsequent ticks won't double-fetch.
+///
+/// Always [`Trigger::Attended`]: every caller is a direct user action — connecting
+/// a tracker, pressing Sync now, or a `meridian tasks-sync` / `ticket-update` CLI
+/// invocation — so refreshing the OAuth token here is safe and expected. There is
+/// deliberately no unattended force-sync: forcing a fetch while nobody is present
+/// is the combination this whole distinction exists to prevent.
 pub async fn force_refresh(pool: &SqlitePool, jira: &JiraConfig) -> Result<Option<Vec<String>>> {
     sqlx::query("DELETE FROM pm_sync_state WHERE provider = 'jira'")
         .execute(pool)
         .await
         .context("clearing jira sync state for force refresh")?;
-    refresh_if_stale(pool, jira).await
+    refresh_if_stale(pool, jira, Trigger::Attended).await
 }
diff --git a/src/intelligence/sync_delegate.rs b/src/intelligence/sync_delegate.rs
new file mode 100644
index 000000000..8475390f9
--- /dev/null
+++ b/src/intelligence/sync_delegate.rs
@@ -0,0 +1,320 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Producer side of the `pm_sync_requests` outbox for **short-lived CLI processes**:
+//! ask the daemon to sync, rather than syncing here.
+//!
+//! # Why this exists
+//!
+//! An Atlassian OAuth refresh token is single-use and rotating: the old token dies the
+//! instant the new one is issued, so a lost response leaves the grant recoverable only
+//! inside a 10-minute window and permanently dead after it. A credential like that has
+//! exactly one safe writer, and [`crate::intelligence::sync_requests`] makes the daemon
+//! that writer.
+//!
+//! The tray was converted to request-instead-of-sync at the same time, but six CLI
+//! subcommands the tray *spawns* were missed and kept refreshing in their own process:
+//! `plan-task-create` / `plan-task-edit` / `plan-task-done`, `ticket-update`,
+//! `ticket-set-status`, and `worklog-generate`. Every one is user-triggered, so none of
+//! them can recreate the timer-driven "refresh POST in flight when the lid closes"
+//! failure - but each is a second process able to spend the token while the daemon's
+//! watcher is servicing a request. The only thing serialising them was
+//! `meridian-oauth`'s advisory file lock, whose 10 s timeout is shorter than the ~26 s
+//! a refresh can take and which proceeds WITHOUT the lock on timeout. This closes that.
+//!
+//! # Why the in-process fallback stays
+//!
+//! A dev checkout, CI, or a support session with the daemon stopped still needs these
+//! commands to refresh the board. With no daemon running there is no second writer, so
+//! syncing here is safe by the same argument. [`crate::platform::daemon_already_running`]
+//! is the same probe the single-instance guard uses, so the two cannot disagree about
+//! who owns the data dir.
+//!
+//! # Who calls this
+//! - `src/main.rs`'s `tasks-sync` / `pm-sync` / `ticket-update` / `ticket-set-status` /
+//!   `worklog-generate` arms.
+//! - [`crate::plan_tasks`]'s `create` / `edit` / `done` post-write refresh.
+//!
+//! # Related
+//! - [`meridian_core::pm_sync_requests`] - the request/claim/complete API.
+//! - [`crate::intelligence::sync_requests`] - the daemon-side consumer that does the work.
+//! - [`crate::intelligence::Trigger`] - why attendedness is tracked at all.
+
+use std::time::Duration;
+
+use meridian_core::pm_sync_requests::{self, SyncMode, ALL_PROVIDERS};
+use sqlx::SqlitePool;
+
+use crate::config::Config;
+
+/// How often to re-read the request row while waiting. Matched to the daemon watcher's
+/// own 2 s tick rather than being tighter - a faster poll cannot see a result sooner.
+const POLL_INTERVAL: Duration = Duration::from_millis(500);
+
+/// What happened to a delegated sync.
+///
+/// `Pending` deliberately merges "queued, not waited for" and "waited, budget elapsed":
+/// both mean the daemon owns the work and will finish it, which is the only thing a
+/// caller can act on. Neither is a failure.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Delegation {
+    /// The sync finished successfully. `count` is the resulting `pm_tasks` total, and is
+    /// present only when the daemon reported it (the in-process path does not tally).
+    Synced { count: Option<i64> },
+    /// The sync was attempted and failed, or the request could not be queued. The string
+    /// is already a flattened error chain, ready to print or log.
+    Failed { error: String },
+    /// Queued for the daemon; no outcome is known yet.
+    Pending,
+}
+
+/// Ask for a sync and wait up to `budget` for the outcome.
+///
+/// Use this when the caller's next step *reads* `pm_tasks` and would behave differently
+/// against a stale board - `plan-task-create` checking whether its new ticket has
+/// mirrored, or `worklog-generate` matching sessions to tickets. Pick a budget that
+/// fits inside the caller's own timeout: a `Pending` return means "carry on with what
+/// is cached", never "fail".
+pub async fn sync_and_wait(
+    pool: &SqlitePool,
+    config: &Config,
+    mode: SyncMode,
+    label: &str,
+    budget: Duration,
+) -> Delegation {
+    delegate(pool, config, mode, label, Some(budget)).await
+}
+
+/// The budget for a post-write refresh (`plan-task-done`, `plan-task-edit`,
+/// `ticket-update`, `ticket-set-status`).
+///
+/// These deliberately WAIT rather than firing and forgetting, because they were
+/// synchronous before delegation and the frontend re-reads the board as soon as the CLI
+/// exits - returning early would show the pre-write value for a second or two and read
+/// as "my change didn't save". The old inline path already paid this latency (its own
+/// HTTP call, up to ~26 s with a token refresh), so waiting is not a new cost.
+pub const POST_WRITE_SYNC_BUDGET: Duration = Duration::from_secs(30);
+
+/// Ask for a post-write refresh and wait for it, using [`POST_WRITE_SYNC_BUDGET`].
+///
+/// A `Pending` return is not a failure: the tracker write already landed and the daemon
+/// will still finish the mirror refresh. Callers log it and carry on.
+pub async fn sync_after_write(pool: &SqlitePool, config: &Config, label: &str) -> Delegation {
+    delegate(
+        pool,
+        config,
+        SyncMode::Force,
+        label,
+        Some(POST_WRITE_SYNC_BUDGET),
+    )
+    .await
+}
+
+/// Shared body: pick the owner, then act.
+///
+/// Only the branch lives here - both halves are separately testable, which the probe
+/// makes necessary: [`crate::platform::daemon_already_running`] talks to the real
+/// single-instance endpoint, so a test that called this function would pass or fail
+/// depending on whether the developer happens to have a daemon running.
+#[tracing::instrument(skip(pool, config), fields(mode = mode.as_str()))]
+async fn delegate(
+    pool: &SqlitePool,
+    config: &Config,
+    mode: SyncMode,
+    label: &str,
+    wait: Option<Duration>,
+) -> Delegation {
+    if crate::platform::daemon_already_running().await {
+        request_and_wait(pool, mode, label, wait).await
+    } else {
+        sync_here(pool, config, mode, label).await
+    }
+}
+
+/// The no-daemon fallback: do the sync in this process.
+async fn sync_here(pool: &SqlitePool, config: &Config, mode: SyncMode, label: &str) -> Delegation {
+    tracing::debug!(label, "no daemon running - syncing in-process");
+    let result = match mode {
+        SyncMode::Force => super::run_pm_force_sync(pool, config).await,
+        SyncMode::Gated => super::run_pm_sync(pool, config).await,
+    };
+    match result {
+        Ok(()) => Delegation::Synced { count: None },
+        Err(e) => Delegation::Failed {
+            error: crate::errors::chain(&e),
+        },
+    }
+}
+
+/// The delegated path: hand the work to the daemon, optionally waiting for its outcome.
+/// `wait: None` returns [`Delegation::Pending`] the moment the request is written.
+async fn request_and_wait(
+    pool: &SqlitePool,
+    mode: SyncMode,
+    label: &str,
+    wait: Option<Duration>,
+) -> Delegation {
+    if let Err(e) = pm_sync_requests::request(pool, ALL_PROVIDERS, mode, label).await {
+        return Delegation::Failed {
+            error: format!(
+                "could not queue the sync request: {}",
+                crate::errors::chain(&e)
+            ),
+        };
+    }
+    tracing::debug!(label, "pm sync requested - the daemon owns tracker auth");
+
+    match wait {
+        Some(budget) => wait_for_outcome(pool, label, budget).await,
+        None => Delegation::Pending,
+    }
+}
+
+/// Poll the request row until the daemon records an outcome, or `budget` elapses.
+///
+/// The row is keyed on the provider (`'*'`), so a concurrent CLI's request can reset it
+/// and this can end up reading a sibling's outcome. That is fine: both asked for the same
+/// thing, and "some sync just completed" is exactly what the caller needs to know. It
+/// cannot read a *stale* outcome, because `request` clears `completed_at`.
+async fn wait_for_outcome(pool: &SqlitePool, label: &str, budget: Duration) -> Delegation {
+    let deadline = std::time::Instant::now() + budget;
+    loop {
+        if std::time::Instant::now() >= deadline {
+            tracing::debug!(
+                label,
+                budget_s = budget.as_secs(),
+                "daemon did not report a sync outcome in time - continuing"
+            );
+            return Delegation::Pending;
+        }
+        tokio::time::sleep(POLL_INTERVAL).await;
+        match pm_sync_requests::outcome(pool, ALL_PROVIDERS).await {
+            Ok(Some(out)) => {
+                return match out.error {
+                    Some(error) => Delegation::Failed { error },
+                    None => Delegation::Synced {
+                        count: out.synced_count,
+                    },
+                };
+            }
+            Ok(None) => continue,
+            Err(e) => {
+                return Delegation::Failed {
+                    error: format!(
+                        "could not read the sync outcome: {}",
+                        crate::errors::chain(&e)
+                    ),
+                };
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use sqlx::sqlite::SqliteConnectOptions;
+    use std::str::FromStr;
+
+    async fn db() -> SqlitePool {
+        let opts = SqliteConnectOptions::from_str("sqlite::memory:")
+            .unwrap()
+            .create_if_missing(true);
+        let pool = SqlitePool::connect_with(opts).await.unwrap();
+        sqlx::migrate!("src/migrations").run(&pool).await.unwrap();
+        pool
+    }
+
+    /// With no providers configured, `run_pm_*_sync` returns early - so the fallback
+    /// path must report success rather than queueing anything. If it ever starts writing
+    /// a request row, a dev checkout would silently stop refreshing: with no daemon
+    /// there is nothing to service it.
+    #[tokio::test]
+    async fn the_fallback_syncs_here_and_queues_nothing() {
+        let pool = db().await;
+        let cfg = Config::from_env();
+
+        let got = sync_here(&pool, &cfg, SyncMode::Force, "test").await;
+
+        assert_eq!(got, Delegation::Synced { count: None });
+        assert!(
+            pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
+                .await
+                .unwrap()
+                .is_none(),
+            "the in-process path must not queue a request"
+        );
+    }
+
+    /// A queued request must be *claimable* by the daemon, carrying the mode and reason
+    /// the producer asked for. If the row were written in a shape `claim` cannot match,
+    /// every delegated sync would silently never happen.
+    #[tokio::test]
+    async fn a_queued_request_is_claimable_by_the_daemon() {
+        let pool = db().await;
+
+        let got = request_and_wait(&pool, SyncMode::Force, "plan-task-done", None).await;
+
+        assert_eq!(got, Delegation::Pending);
+        let claimed = pm_sync_requests::claim(&pool, ALL_PROVIDERS)
+            .await
+            .unwrap()
+            .expect("the daemon must be able to claim the queued request");
+        assert_eq!(claimed.mode, SyncMode::Force);
+        assert_eq!(claimed.reason, "plan-task-done");
+    }
+
+    /// A budget that elapses with no daemon to service the row must read as `Pending`,
+    /// not `Failed`. `plan-task-create` and `worklog-generate` both continue on
+    /// `Pending` and would otherwise log a phantom failure on every slow sync.
+    #[tokio::test]
+    async fn an_elapsed_budget_is_pending_not_failed() {
+        let pool = db().await;
+
+        let got = request_and_wait(
+            &pool,
+            SyncMode::Gated,
+            "worklog-generate",
+            Some(Duration::from_millis(600)),
+        )
+        .await;
+
+        assert_eq!(got, Delegation::Pending);
+    }
+
+    /// A failure the daemon recorded must reach the caller verbatim, so `tasks-sync`
+    /// exits non-zero with the real reason rather than a generic timeout.
+    #[tokio::test]
+    async fn a_recorded_failure_is_reported_to_the_caller() {
+        let pool = db().await;
+        pm_sync_requests::request(&pool, ALL_PROVIDERS, SyncMode::Force, "tasks-sync")
+            .await
+            .unwrap();
+        pm_sync_requests::claim(&pool, ALL_PROVIDERS).await.unwrap();
+        pm_sync_requests::complete(&pool, ALL_PROVIDERS, None, Some("refresh_token is invalid"))
+            .await
+            .unwrap();
+
+        // Re-requesting clears the outcome, so the waiter must be the one to observe it:
+        // drive the wait directly against the already-completed row.
+        let got = wait_for_outcome(&pool, "tasks-sync", Duration::from_secs(5)).await;
+
+        assert_eq!(
+            got,
+            Delegation::Failed {
+                error: "refresh_token is invalid".to_string()
+            }
+        );
+    }
+
+    /// `Pending` is not a failure, and callers branch on that. Pinned because the
+    /// obvious refactor - folding a timeout into `Failed` - would turn "the daemon is
+    /// still working" into a user-visible error on every slow sync.
+    #[test]
+    fn pending_is_distinct_from_failed() {
+        assert_ne!(
+            Delegation::Pending,
+            Delegation::Failed {
+                error: "x".to_string()
+            }
+        );
+    }
+}
diff --git a/src/intelligence/sync_requests.rs b/src/intelligence/sync_requests.rs
new file mode 100644
index 000000000..8e1838909
--- /dev/null
+++ b/src/intelligence/sync_requests.rs
@@ -0,0 +1,227 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Single-owner PM sync: the daemon-side consumer of the `pm_sync_requests` outbox.
+//!
+//! # Why this task exists
+//!
+//! An Atlassian OAuth refresh token is single-use and rotating: the old token dies
+//! the instant the new one is issued, so a lost response leaves the grant
+//! recoverable only inside a 10-minute window and permanently dead after it. A
+//! credential like that has exactly one safe writer.
+//!
+//! It used to have many. The tray refreshed in-process, the daemon refreshed on its
+//! poll loop, and the tray spawned fresh `meridian pm-sync` / `tasks-sync` processes
+//! that each refreshed too. The advisory file lock meant to serialise them could not:
+//! its 10 s timeout is shorter than the ~26 s a refresh can take, and on timeout the
+//! code proceeded WITHOUT the lock. Two processes could spend the same token, and
+//! only Atlassian's grace window kept that from corrupting state.
+//!
+//! This watcher makes the daemon the sole consumer, so single-ownership is a property
+//! of the architecture rather than of lock discipline. Every other would-be writer -
+//! the tray, and the `tasks-sync` / `pm-sync` / `plan-task-*` / `ticket-update` /
+//! `ticket-set-status` / `worklog-generate` CLIs - now writes a request row instead
+//! (see [`crate::intelligence::sync_delegate`]). The only remaining in-process sync is
+//! the fallback taken when no daemon is running at all, where there is no second
+//! writer to race.
+//!
+//! # Why a separate task instead of the main poll loop
+//!
+//! The poll loop ticks on `POLL_INTERVAL_SECS` (60 s by default). Making a user who
+//! pressed "Sync now" wait up to a minute for the sync to even *begin* would be a
+//! visible regression against the old shell-out, which started immediately. So this
+//! runs its own short cadence ([`WATCH_INTERVAL`]) - a single indexed read against a
+//! local SQLite file, negligible next to the ETL work sharing the process.
+//!
+//! It is deliberately NOT a timer that syncs on its own: it only ever acts on a row
+//! a producer wrote, so every refresh still traces back to a human action. That is
+//! the property that stops a refresh POST being in flight when a laptop lid closes.
+//!
+//! # Who calls this
+//! - [`run_watcher`] is spawned once by `src/main.rs` at daemon startup.
+//! - Producers write rows via [`meridian_core::pm_sync_requests::request`].
+//!
+//! # Related
+//! - [`meridian_core::pm_sync_requests`] - the request/claim/complete API.
+//! - [`crate::intelligence::run_pm_sync`] / [`crate::intelligence::run_pm_force_sync`]
+//!   - the work this dispatches to.
+//! - [`crate::intelligence::Trigger`] - why attendedness is tracked at all.
+
+use std::time::Duration;
+
+use meridian_core::pm_sync_requests::{self, SyncMode, ALL_PROVIDERS};
+use sqlx::SqlitePool;
+use tokio::sync::watch;
+
+use crate::config::Config;
+
+/// How often to look for a pending request. Short enough that "Sync now" feels
+/// immediate, and cheap enough to be irrelevant: one indexed read of a single-row
+/// table on a local file.
+const WATCH_INTERVAL: Duration = Duration::from_secs(2);
+
+/// Drain PM sync requests for the life of the process.
+///
+/// Releases claims stranded by a previous daemon exit once at startup (see
+/// [`pm_sync_requests::reset_stale_claims`]), then loops.
+///
+/// Never propagates an error: a failure to read the table, or a failing sync, must
+/// not take down the daemon or stop future requests being serviced. Outcomes are
+/// recorded on the row so a producer can surface them.
+///
+/// Returns when `shutdown_rx` goes true. The shutdown check is on the SLEEP, not
+/// mid-sync, so a sync already in flight is allowed to finish and record its
+/// outcome rather than being cut off with the row left claimed. A hard kill during a
+/// sync is still possible, and [`pm_sync_requests::reset_stale_claims`] cleans that
+/// up on the next boot.
+#[tracing::instrument(skip(pool, shutdown_rx))]
+pub async fn run_watcher(pool: SqlitePool, mut shutdown_rx: watch::Receiver<bool>) {
+    if let Err(e) = pm_sync_requests::reset_stale_claims(&pool).await {
+        // Non-fatal: the table may not exist yet on a very old DB mid-migration.
+        // A stranded claim self-heals as soon as any producer writes a new request
+        // (which resets `claimed_at`), so this is a latency issue, not a dead end.
+        tracing::warn!(
+            error = %crate::errors::chain(&e),
+            "could not release stale PM sync claims - a pending request may wait for the next producer"
+        );
+    }
+
+    loop {
+        tokio::select! {
+            _ = tokio::time::sleep(WATCH_INTERVAL) => service_once(&pool).await,
+            _ = shutdown_rx.changed() => {
+                if *shutdown_rx.borrow() {
+                    tracing::debug!("PM sync request watcher stopping");
+                    return;
+                }
+            }
+        }
+    }
+}
+
+/// Claim and service at most one pending request. Split from the loop so the
+/// decision logic is reachable without spawning a task.
+async fn service_once(pool: &SqlitePool) {
+    let req = match pm_sync_requests::claim(pool, ALL_PROVIDERS).await {
+        Ok(Some(req)) => req,
+        Ok(None) => return,
+        Err(e) => {
+            // Logged at debug, not warn: on a fresh install this fires every 2 s
+            // until migration 082 has run, and a warn-level line every 2 s would
+            // bury real problems (and, being WARN+, would egress to central
+            // observability on every packaged install).
+            tracing::debug!(
+                error = %crate::errors::chain(&e),
+                "could not read PM sync requests"
+            );
+            return;
+        }
+    };
+
+    // Config is read here rather than captured at spawn time so a settings change
+    // (a newly connected tracker, an edited JQL) is picked up without a restart.
+    // Cheap because this only runs when there is actually work.
+    let cfg = Config::from_env();
+
+    tracing::info!(
+        mode = req.mode.as_str(),
+        reason = %req.reason,
+        "servicing PM sync request"
+    );
+
+    // Both arms are ATTENDED: a row exists only because a producer wrote it in
+    // response to a user action, which is precisely the condition that makes
+    // spending the rotating refresh token safe. There is deliberately no unattended
+    // path through this watcher - the clock-driven worklog sweep calls
+    // `run_pm_sync_unattended` directly instead of requesting.
+    let result = match req.mode {
+        SyncMode::Force => crate::intelligence::run_pm_force_sync(pool, &cfg).await,
+        SyncMode::Gated => crate::intelligence::run_pm_sync(pool, &cfg).await,
+    };
+
+    let (count, error) = match result {
+        Ok(()) => {
+            // The count is read back from `pm_tasks` rather than threaded out of the
+            // sync: `run_pm_sync` fans out over every provider and a per-provider
+            // tally would have to pick one to report. The board total is what "Sync
+            // now" actually wants to show.
+            let n = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM pm_tasks")
+                .fetch_one(pool)
+                .await
+                .ok();
+            tracing::info!(task_count = ?n, "PM sync request completed");
+            (n, None)
+        }
+        Err(e) => {
+            let detail = crate::errors::chain(&e);
+            tracing::warn!(error = %detail, "PM sync request failed");
+            (None, Some(detail))
+        }
+    };
+
+    if let Err(e) = pm_sync_requests::complete(pool, &req.provider, count, error.as_deref()).await {
+        tracing::warn!(
+            error = %crate::errors::chain(&e),
+            "could not record the PM sync outcome - the producer will keep waiting"
+        );
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use sqlx::sqlite::SqliteConnectOptions;
+    use std::str::FromStr;
+
+    async fn db() -> SqlitePool {
+        let opts = SqliteConnectOptions::from_str("sqlite::memory:")
+            .unwrap()
+            .create_if_missing(true);
+        let pool = SqlitePool::connect_with(opts).await.unwrap();
+        sqlx::migrate!("src/migrations").run(&pool).await.unwrap();
+        pool
+    }
+
+    /// An empty table must be a silent no-op. This runs every 2 s forever, so any
+    /// noise or error here would be a permanent log flood.
+    #[tokio::test]
+    async fn service_once_is_quiet_with_no_requests() {
+        let pool = db().await;
+        service_once(&pool).await;
+        assert!(pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
+            .await
+            .unwrap()
+            .is_none());
+    }
+
+    /// With no PM providers configured, `run_pm_sync` returns `Ok(())` early, so the
+    /// request must still be marked complete rather than left pending forever - a
+    /// producer polling for the outcome would otherwise hang.
+    #[tokio::test]
+    async fn a_request_is_completed_even_with_no_providers_configured() {
+        let pool = db().await;
+        pm_sync_requests::request(&pool, ALL_PROVIDERS, SyncMode::Gated, "test")
+            .await
+            .unwrap();
+
+        service_once(&pool).await;
+
+        let out = pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
+            .await
+            .unwrap()
+            .expect("the request must be completed, not left pending");
+        assert!(out.error.is_none(), "unexpected error: {:?}", out.error);
+    }
+
+    /// The migration must actually create the table the watcher depends on.
+    #[tokio::test]
+    async fn migration_creates_the_requests_table() {
+        let pool = db().await;
+        let exists: i64 = sqlx::query_scalar(
+            "SELECT EXISTS(SELECT 1 FROM sqlite_master
+                            WHERE type = 'table' AND name = 'pm_sync_requests')",
+        )
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(exists, 1);
+    }
+}
diff --git a/src/main.rs b/src/main.rs
index cada9f44d..5867f0542 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -8,8 +8,9 @@ use anyhow::{Context, Result};
 use meridian::config::Config;
 use meridian::db::meridian::{cleanup_incomplete_runs, setup_db};
 use meridian::etl::run_etl;
-use meridian::intelligence::{run_pm_force_sync, run_pm_sync};
+use meridian::intelligence::sync_delegate::Delegation;
 use meridian::observability;
+use meridian_core::pm_sync_requests::SyncMode;
 use tokio::sync::Notify;
 use tracing::Instrument;
 
@@ -350,23 +351,45 @@ async fn main() -> Result<()> {
         return Ok(());
     }
 
-    // `meridian tasks-sync` — force an immediate sync of all configured PM
-    // providers (Jira, Linear, GitHub), bypassing the 5-minute staleness gate.
-    // Exits 0 on success, non-zero if the DB cannot be opened.
-    if std::env::args().nth(1).as_deref() == Some("tasks-sync") {
+    // `meridian tasks-sync` (force) / `meridian pm-sync` (gated) — the two on-demand
+    // CLI sync entry points. There is no background poller anymore; see
+    // `src/intelligence/mod.rs`'s doc comments for the full trigger list.
+    //
+    // `tasks-sync` bypasses the per-provider staleness gate (the user asked for fresh
+    // data now); `pm-sync` honours it, so it is a cheap no-op on an already-fresh
+    // board. Both DELEGATE to a running daemon rather than syncing here — see
+    // `cli_sync` for why the rotating credential has exactly one safe writer.
+    //
+    // One arm, because the two differ only in mode and label. They were separate
+    // copies of the same fourteen lines, which is how `pm-sync` ended up documented as
+    // the command the tray used "on opening the dashboard" — a trigger that no longer
+    // exists.
+    //
+    // Exit 1 if the DB cannot be opened, or if the sync itself failed. Reporting the
+    // sync failure in the exit code matters: with no daemon running the tray's "Sync
+    // now" shells out to `tasks-sync` and reads a non-zero exit as the failure, so
+    // exiting 0 here would show the user a successful sync that did not happen. A
+    // timeout is NOT a failure (`cli_sync` returns true) — the daemon is still working.
+    let cli_sync_mode = match std::env::args().nth(1).as_deref() {
+        Some("tasks-sync") => Some((SyncMode::Force, "tasks-sync")),
+        Some("pm-sync") => Some((SyncMode::Gated, "pm-sync")),
+        _ => None,
+    };
+    if let Some((mode, label)) = cli_sync_mode {
         let cfg = Config::from_env();
         match setup_db(&cfg.meridian_db_uri()).await {
             Ok(pool) => {
-                if let Err(e) = run_pm_force_sync(&pool, &cfg).await {
-                    eprintln!("tasks-sync: {e}");
-                }
+                let ok = cli_sync(&pool, &cfg, mode, label).await;
                 pool.close().await;
+                if !ok {
+                    std::process::exit(1);
+                }
             }
             Err(e) => {
                 // `{e:#}` prints the full anyhow source chain (e.g. the sqlx
                 // "migration N was previously applied / missing" cause) instead
                 // of just the top-level "failed to run migrations" context.
-                eprintln!("tasks-sync: open db: {e:#}");
+                eprintln!("{label}: open db: {e:#}");
                 std::process::exit(1);
             }
         }
@@ -404,7 +427,7 @@ async fn main() -> Result<()> {
                     meridian::intelligence::ticket_update::ApplyStatus::Applied
                 ) {
                     if let Ok(pool) = setup_db(&cfg.meridian_db_uri()).await {
-                        let _ = run_pm_force_sync(&pool, &cfg).await;
+                        cli_sync_after_write(&pool, &cfg, "ticket-update").await;
                         pool.close().await;
                     }
                 }
@@ -510,7 +533,7 @@ async fn main() -> Result<()> {
                     meridian::intelligence::ticket_update::ApplyStatus::Applied
                 ) {
                     if let Ok(pool) = setup_db(&cfg.meridian_db_uri()).await {
-                        let _ = run_pm_force_sync(&pool, &cfg).await;
+                        cli_sync_after_write(&pool, &cfg, "ticket-set-status").await;
                         pool.close().await;
                     }
                 }
@@ -694,6 +717,32 @@ async fn main() -> Result<()> {
         let obs_guard = observability::init("meridian-rust").ok();
         match setup_db(&cfg.meridian_db_uri()).await {
             Ok(pool) => {
+                // Matching needs current ticket state — a stale board could silently
+                // bind this draft to a closed/renamed ticket. Best-effort: a sync
+                // failure must not block drafting against whatever's cached.
+                //
+                // Delegated to the daemon, the sole owner of the rotating Jira OAuth
+                // token (see `intelligence::sync_delegate`). The wait budget is short
+                // because an LLM call follows inside the tray's 150 s timeout for this
+                // command: better to draft against a slightly stale board than to blow
+                // the timeout and show the user nothing at all.
+                match meridian::intelligence::sync_delegate::sync_and_wait(
+                    &pool,
+                    &cfg,
+                    SyncMode::Gated,
+                    "worklog-generate",
+                    std::time::Duration::from_secs(30),
+                )
+                .await
+                {
+                    Delegation::Synced { .. } => {}
+                    Delegation::Failed { error } => {
+                        tracing::warn!(%error, "worklog-generate: pm sync failed — matching against cached tasks");
+                    }
+                    Delegation::Pending => {
+                        tracing::warn!("worklog-generate: pm sync still running — matching against cached tasks");
+                    }
+                }
                 match meridian::pm_worklog::generate(&pool, &cfg, &day, &task_id).await {
                     Ok(mut draft) => {
                         // A matched draft carries a target_key we can link even
@@ -1256,9 +1305,7 @@ async fn main() -> Result<()> {
     }
 
     // 7c. Run ETL once immediately before entering the loop.
-    //     Re-read config so that any settings.json present at startup takes effect.
     {
-        let cfg = Config::from_env();
         let startup_tick = tracing::info_span!("startup_tick");
         *etl_tick_span.lock().unwrap_or_else(|e| e.into_inner()) = Some(startup_tick.clone());
         let _guard = startup_tick.enter();
@@ -1282,12 +1329,10 @@ async fn main() -> Result<()> {
                 tracing::warn!(error = %meridian::errors::chain(&e), "capture retention sweep failed");
             }
         }
-        if let Err(e) = run_pm_sync(&meridian, &cfg).await {
-            tracing::error!(
-                error = %meridian::errors::chain(&e),
-                "intelligence run failed"
-            );
-        }
+        // No PM sync here anymore — there's no background poller. Syncing is
+        // on-demand now (the daily plan, the match-to-ticket picker, connecting a
+        // tracker, a board write, worklog drafting, `meridian tasks-sync`/`pm-sync`);
+        // see `src/intelligence/mod.rs`'s doc comments for the full set of triggers.
     }
 
     let (shutdown_tx, shutdown_rx) = tokio::sync::watch::channel(false);
@@ -1372,6 +1417,32 @@ async fn main() -> Result<()> {
         });
     }
 
+    // 7h. PM sync request watcher — the daemon is the SOLE holder of the rotating
+    //     Jira OAuth refresh token, so every other process (the tray, the CLIs) asks
+    //     for a sync by writing a `pm_sync_requests` row instead of refreshing
+    //     itself. This drains those requests.
+    //
+    //     Why single-ownership matters: the refresh is a single-use exchange whose
+    //     lost response kills the grant outside a 10-minute window. Serialising N
+    //     processes with an advisory file lock did not work — a 10 s lock timeout
+    //     guarding a ~26 s operation, and on timeout the code proceeded WITHOUT the
+    //     lock — so two processes could spend the same token and only Atlassian's
+    //     grace window prevented corruption.
+    //
+    //     Deliberately its own task on a short cadence rather than folded into the
+    //     60 s poll loop below: a user pressing "Sync now" must not wait up to a
+    //     minute for the sync to begin. It never syncs on its own initiative — only
+    //     ever on a row a producer wrote, so every refresh still traces to a human
+    //     action, which is what keeps a refresh POST from being in flight when a
+    //     laptop lid closes.
+    {
+        let pool_sync = meridian.clone();
+        let rx_sync = shutdown_rx.clone();
+        tokio::spawn(async move {
+            meridian::intelligence::sync_requests::run_watcher(pool_sync, rx_sync).await;
+        });
+    }
+
     // 8b. Poll loop — ETL, PM sync, and FM categorization on the configured interval.
     // Track the last-applied log level so we can detect changes and hot-reload
     // the EnvFilter without restarting the daemon.
@@ -1506,17 +1577,16 @@ async fn main() -> Result<()> {
                     tracing::debug!(error = %meridian::errors::chain(&e), "notification response consume skipped");
                 }
 
-                // Refresh the PM task cache (pm_tasks) every tick — interval-gated
-                // per provider (~5 min), so this is a cheap no-op most ticks. The
-                // legacy drafting driver that used to trigger this before every
-                // pass was retired when the worklog pipeline moved to the
-                // clock-aligned Python trigger, which never calls this itself —
-                // leaving pm_tasks (and hence a ticket's title on the timeline)
-                // stuck at whatever it was at the last daemon restart. This is
-                // the only thing that keeps it live during normal operation.
-                if let Err(e) = run_pm_sync(&meridian, &cfg).await {
-                    tracing::warn!(error = %meridian::errors::chain(&e), "pm_tasks refresh failed — using cached tasks");
-                }
+                // No PM sync on this tick anymore — there's no background poller.
+                // `pm_tasks` is refreshed on-demand instead: the daily plan and the
+                // match-to-ticket picker (the two screens that decide something from
+                // the whole board), connecting a tracker, any board write, the worklog
+                // drafting sweep (`pm_worklog::auto_generate`), and the manual
+                // `meridian tasks-sync`/`pm-sync` CLI paths. See
+                // `src/intelligence/mod.rs`'s doc comments for the full trigger list
+                // and the reasoning (fewer standing background refreshes also shrinks
+                // how often a Jira OAuth token refresh can straddle a laptop
+                // sleep/wake).
             }
         }
     }
@@ -1549,6 +1619,76 @@ async fn main() -> Result<()> {
     Ok(())
 }
 
+/// Body of the `tasks-sync` / `pm-sync` CLIs: ask the daemon and report what it did.
+///
+/// The delegation itself (and why a CLI must not spend the rotating Jira OAuth token
+/// itself) lives in [`meridian::intelligence::sync_delegate`]; this only maps the
+/// outcome onto stdout/stderr and an exit code, so the user-facing wording stays in
+/// one place next to the other CLI output.
+async fn cli_sync(
+    pool: &meridian::db::SqlitePool,
+    cfg: &Config,
+    mode: SyncMode,
+    label: &str,
+) -> bool {
+    // A generous budget: a cold sync across five providers with a token refresh can
+    // legitimately take a while, and a CLI that gives up early looks like a failure
+    // when the sync is still going. Syncing IS the point of this command, so unlike
+    // the post-write callers it waits.
+    match meridian::intelligence::sync_delegate::sync_and_wait(
+        pool,
+        cfg,
+        mode,
+        label,
+        std::time::Duration::from_secs(120),
+    )
+    .await
+    {
+        Delegation::Synced { count: Some(n) } => {
+            println!("{label}: synced {n} task(s)");
+            true
+        }
+        Delegation::Synced { count: None } => {
+            println!("{label}: synced");
+            true
+        }
+        Delegation::Failed { error } => {
+            eprintln!("{label}: {error}");
+            false
+        }
+        // NOT an error exit: the request is queued and the daemon will service it.
+        // Exiting non-zero here would fail scripts over a slow sync that ultimately
+        // succeeds.
+        Delegation::Pending => {
+            println!("{label}: still running - it will finish in the background");
+            true
+        }
+    }
+}
+
+/// Refresh the board after a CLI write applied to the tracker (`ticket-update`,
+/// `ticket-set-status`).
+///
+/// Waits for the outcome (see `sync_delegate::POST_WRITE_SYNC_BUDGET`): the frontend
+/// re-reads the board as soon as this process exits, so returning before the mirror
+/// caught up would briefly show the pre-write value and read as a lost edit. Failures
+/// and timeouts are logged, never printed - the tracker write already succeeded, so a
+/// sync hiccup must not make the command look like it failed.
+async fn cli_sync_after_write(pool: &meridian::db::SqlitePool, cfg: &Config, label: &str) {
+    match meridian::intelligence::sync_delegate::sync_after_write(pool, cfg, label).await {
+        Delegation::Synced { .. } => {}
+        Delegation::Failed { error } => {
+            tracing::warn!(label, %error, "post-write pm sync failed - the tracker write still landed");
+        }
+        Delegation::Pending => {
+            tracing::warn!(
+                label,
+                "post-write pm sync still running - the tracker write still landed"
+            );
+        }
+    }
+}
+
 /// Runs one ETL pass and maps the outcome onto the notice bus.
 ///
 /// Returns `true` when the failure was database corruption, which the caller
diff --git a/src/migrations/082_pm_sync_requests.sql b/src/migrations/082_pm_sync_requests.sql
new file mode 100644
index 000000000..9a49eaaeb
--- /dev/null
+++ b/src/migrations/082_pm_sync_requests.sql
@@ -0,0 +1,68 @@
+-- ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+--
+-- Single-owner PM sync: the request side of the outbox.
+--
+-- WHY THIS EXISTS
+-- An Atlassian OAuth refresh token is single-use and rotating: the old token dies
+-- the instant the new one is issued, so a lost response leaves the grant
+-- recoverable only inside a 10-minute window and unrecoverable after it. That
+-- makes the token a resource with exactly one safe writer.
+--
+-- It had several. The tray refreshed in-process, the daemon refreshed on its poll
+-- loop, and the tray spawned `meridian pm-sync` / `tasks-sync` as fresh processes
+-- that each refreshed too. Mutual exclusion was left to an advisory file lock that
+-- could not actually deliver it: its 10 s timeout is shorter than the ~26 s a
+-- refresh can take (3 attempts x 8 s + backoff), and on failure the code proceeded
+-- WITHOUT the lock rather than backing off. Two processes could therefore spend the
+-- same token, and the only thing preventing corruption was Atlassian's grace window
+-- handing the loser the current pair. Correctness by vendor accident.
+--
+-- So sync becomes a REQUEST rather than an action. Producers (tray window opens,
+-- tracker connect, "Sync now", the CLI) write a row here; the daemon is the sole
+-- consumer and the sole holder of the credential.
+--
+-- COALESCING, NOT A QUEUE
+-- `provider` is the PRIMARY KEY so repeated requests collapse into one pending row
+-- (`ON CONFLICT DO UPDATE`). Opening the dashboard ten times must not queue ten
+-- syncs - it must mean "a sync is wanted", once. `'*'` is the all-providers request
+-- that every current producer writes; per-provider rows are reserved for a future
+-- caller that needs to refresh just one board.
+--
+-- `mode` escalates and never de-escalates while a row is pending: a 'force' request
+-- landing on a pending 'gated' one upgrades it, because a user who just connected a
+-- tracker or pressed "Sync now" must not have their explicit request downgraded by a
+-- passing window focus. The reverse is silently ignored by the producer's UPSERT.
+--
+-- COMPLETION IS REPORTED IN PLACE, NOT DELETED
+-- The daemon stamps `completed_at` plus `error` / `synced_count` rather than removing
+-- the row, so "Sync now" can show a real outcome without the tray needing to hold the
+-- credential or shell out. A serviced row is retained until the next request replaces
+-- it, which also gives `meridian health` a cheap, content-free view of the last sync
+-- attempt.
+
+CREATE TABLE IF NOT EXISTS pm_sync_requests (
+    -- '*' = all configured providers. A specific provider name scopes the request.
+    provider      TEXT    NOT NULL PRIMARY KEY,
+    -- 'gated'  - honour the per-provider staleness window (the cheap common case).
+    -- 'force'  - bypass it; the user explicitly asked (connect, "Sync now", CLI).
+    mode          TEXT    NOT NULL DEFAULT 'gated',
+    -- Free-text producer tag for tracing only (e.g. 'dashboard_open', 'token_connected').
+    -- Never a user-content value: this is read back into logs.
+    reason        TEXT    NOT NULL DEFAULT '',
+    requested_at  TEXT    NOT NULL,
+    -- Set when the daemon starts servicing, so a request in flight is distinguishable
+    -- from one still waiting. Cleared on the next request.
+    claimed_at    TEXT,
+    -- Set when the daemon finishes, success or failure. NULL while pending/in-flight.
+    completed_at  TEXT,
+    -- NULL on success. The failure detail otherwise, for the tray to surface.
+    error         TEXT,
+    -- Tasks refreshed on the last completed pass, for "Sync now" feedback.
+    synced_count  INTEGER
+);
+
+-- No secondary index on purpose. Every hot query (`claim`, `complete`, `outcome`,
+-- `request`) filters on `provider`, which is the PRIMARY KEY, so an index on
+-- (completed_at, claimed_at) would never be chosen. The only query that does not
+-- name a provider is `reset_stale_claims`, which runs once per daemon boot over a
+-- table holding one row per provider - a scan there is free.
diff --git a/src/plan_tasks/create.rs b/src/plan_tasks/create.rs
index 16a62e1b7..2b8867e27 100644
--- a/src/plan_tasks/create.rs
+++ b/src/plan_tasks/create.rs
@@ -30,13 +30,22 @@
 //! - [`meridian_core::plan`] — `apply_plan_action("add")`, which puts the key in today.
 
 use anyhow::{Context, Result};
+use meridian_core::pm_sync_requests::SyncMode;
 use meridian_core::task_create::{self, NewTask};
 use serde::Serialize;
 use sqlx::SqlitePool;
+use std::time::Duration;
 use tracing::field::Empty;
 use tracing::Instrument;
 
 use crate::config::Config;
+use crate::intelligence::sync_delegate::Delegation;
+
+/// How long to wait for the post-create sync before falling through to the shadow row.
+/// Must stay comfortably inside the tray's 90 s `WRITE_TIMEOUT` for `plan-task-create`,
+/// since a blown tray timeout looks to the user like a failed create even though the
+/// ticket was filed.
+const POST_CREATE_SYNC_BUDGET: Duration = Duration::from_secs(60);
 
 /// Where a new task should live.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -177,9 +186,30 @@ async fn create_on_tracker(
     tracing::Span::current().record("synced", true);
 
     // Pull the authoritative row in immediately rather than waiting out the 5-minute
-    // sync gate. Best-effort: a failed sync is not a failed create.
-    if let Err(e) = crate::intelligence::run_pm_force_sync(pool, config).await {
-        tracing::warn!(error = %e, "plan_task: post-create sync failed - will shadow the row");
+    // sync gate. Best-effort: a failed sync is not a failed create - it just means the
+    // `task_exists` check below falls through to the shadow row.
+    //
+    // Delegated to the daemon (see `intelligence::sync_delegate`) because this is a
+    // short-lived CLI process and the rotating Jira OAuth token has exactly one safe
+    // writer. Unlike the edit/done paths this WAITS for the outcome: the very next line
+    // reads `pm_tasks`, so returning before the sync landed would shadow every created
+    // ticket. The budget sits inside the tray's 90 s `WRITE_TIMEOUT` for this command.
+    match crate::intelligence::sync_delegate::sync_and_wait(
+        pool,
+        config,
+        SyncMode::Force,
+        "plan-task-create",
+        POST_CREATE_SYNC_BUDGET,
+    )
+    .await
+    {
+        Delegation::Synced { .. } => {}
+        Delegation::Failed { error } => {
+            tracing::warn!(%error, "plan_task: post-create sync failed - will shadow the row");
+        }
+        Delegation::Pending => {
+            tracing::warn!("plan_task: post-create sync still running - will shadow the row");
+        }
     }
 
     if task_create::task_exists(pool, &key).await? {
diff --git a/src/plan_tasks/done.rs b/src/plan_tasks/done.rs
index 53dc4496a..e0a5643d4 100644
--- a/src/plan_tasks/done.rs
+++ b/src/plan_tasks/done.rs
@@ -29,6 +29,7 @@ use tracing::field::Empty;
 use tracing::Instrument;
 
 use crate::config::Config;
+use crate::intelligence::sync_delegate::Delegation;
 use crate::intelligence::ticket_update::{self, ApplyStatus};
 use crate::plan_tasks::edit::EditResult;
 
@@ -117,8 +118,20 @@ async fn set_done_on_tracker(
 
     // Best-effort — the tracker has already accepted the transition, so a sync hiccup
     // must not read as a failed toggle.
-    if let Err(e) = crate::intelligence::run_pm_force_sync(pool, config).await {
-        tracing::warn!(error = %e, "plan_task: post-toggle sync failed - the change still landed");
+    //
+    // Delegated to the daemon (`intelligence::sync_delegate`), which is the only process
+    // that may spend the rotating Jira OAuth token. Nothing below reads `pm_tasks`, so
+    // this does not wait for the outcome - the request row is written and the daemon
+    // picks it up within ~2 s, well before the user's next board read.
+    match crate::intelligence::sync_delegate::sync_after_write(pool, config, "plan-task-done").await
+    {
+        Delegation::Synced { .. } => {}
+        Delegation::Failed { error } => {
+            tracing::warn!(%error, "plan_task: post-toggle sync failed - the change still landed");
+        }
+        Delegation::Pending => {
+            tracing::warn!("plan_task: post-toggle sync still running - the change still landed");
+        }
     }
     tracing::Span::current().record("status", "applied");
     tracing::info!(field, "plan_task: tracker task status set");
diff --git a/src/plan_tasks/edit.rs b/src/plan_tasks/edit.rs
index 7b244755e..df4523497 100644
--- a/src/plan_tasks/edit.rs
+++ b/src/plan_tasks/edit.rs
@@ -32,6 +32,7 @@ use tracing::field::Empty;
 use tracing::Instrument;
 
 use crate::config::Config;
+use crate::intelligence::sync_delegate::Delegation;
 use crate::intelligence::ticket_update::{self, ApplyStatus};
 
 /// The outcome of an edit, serialized to the CLI's one JSON line.
@@ -157,8 +158,20 @@ async fn edit_on_tracker(
         // Reflect the applied write back into our mirror (the `ticket-update` CLI
         // does exactly this after an Applied write). Best-effort — the tracker has
         // already accepted it, so a sync hiccup must not read as a failed edit.
-        if let Err(e) = crate::intelligence::run_pm_force_sync(pool, config).await {
-            tracing::warn!(error = %e, "plan_task: post-edit sync failed - the edit still landed");
+        //
+        // Delegated to the daemon (`intelligence::sync_delegate`), the only process that
+        // may spend the rotating Jira OAuth token. Nothing below reads `pm_tasks`, so the
+        // outcome is not awaited.
+        match crate::intelligence::sync_delegate::sync_after_write(pool, config, "plan-task-edit")
+            .await
+        {
+            Delegation::Synced { .. } => {}
+            Delegation::Failed { error } => {
+                tracing::warn!(%error, "plan_task: post-edit sync failed - the edit still landed");
+            }
+            Delegation::Pending => {
+                tracing::warn!("plan_task: post-edit sync still running - the edit still landed");
+            }
         }
     }
     tracing::Span::current().record("status", "applied");
diff --git a/src/pm_worklog/auto_generate/mod.rs b/src/pm_worklog/auto_generate/mod.rs
new file mode 100644
index 000000000..a72ebe467
--- /dev/null
+++ b/src/pm_worklog/auto_generate/mod.rs
@@ -0,0 +1,216 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Auto-generate worklog DRAFTS, once a day, at a user-chosen local clock time —
+//! the opt-in behind `settings.worklog_auto_generate_time`.
+//!
+//! This runs the exact same action as the day-task detail panel's "Generate
+//! worklog" button (`pm_worklog::generate`), automatically, for any task past the
+//! fixed [`sweep::QUALIFYING_MINUTES`] threshold that doesn't have a draft yet. It
+//! NEVER approves or posts — approving is always a deliberate human click
+//! (`pm_worklog::approve`, the panel's "Approve & post"). Auto-generate only saves
+//! the user the click that starts the draft; the tracker is never touched without
+//! them.
+//!
+//! Off by default: the field is `None` until the user picks a time from the
+//! Timeline nudge or Settings → Worklogs, so nothing here ever runs unattended for
+//! someone who hasn't said yes.
+//!
+//! # A TRACKER IS NOT REQUIRED — and used to be, wrongly
+//! Both entry points opened with `if config.pm_providers.is_empty() { return }`,
+//! on the premise that "there is nothing to match against, so the sweep would only
+//! fail every call". That premise is false, and stopped being true the moment
+//! personal tasks became first-class: [`crate::pm_worklog::generate`] matches a
+//! PERSONAL (`local`) day-task exactly like a real ticket and, on approve, posts to
+//! that task's own row (`post_to_local_task`) — no tracker anywhere in the path.
+//! Only the PROPOSE branch needs a configured provider, and that branch failing is
+//! already a per-task `warn!` the loop walks past.
+//!
+//! So the gate silently disabled the whole feature for every tracker-less user —
+//! the cohort Meridian now leads with — and Settings mirrored it with a dead-end
+//! card offering nothing. Removed at both ends. Keep it that way: the correct floor
+//! is "does this task have qualifying minutes and no draft yet", which is what the
+//! sweep already checks, not "does this user have Jira".
+//!
+//! # Once a day, from the chosen time onward — not continuously, and self-healing
+//! [`maybe_auto_generate`] is called every clock-aligned wake (HH:03, same as the
+//! rest of the worklog pipeline), but only actually scans once the current local
+//! hour has REACHED the chosen time's hour — so a task crossing the threshold at
+//! 2pm with a 6pm setting waits for 6pm, not the next tick after 2pm.
+//!
+//! Deliberately `>=`, not `==`: if the Mac is asleep, off, or the app isn't
+//! running at exactly 9pm, there is no tick at 9pm to miss — the daemon simply
+//! catches up on its next wake that same day (10pm, or whenever the machine comes
+//! back), because every tick from the chosen hour through local midnight re-runs
+//! the same scan. This is safe to repeat because already-drafted tasks are
+//! skipped (see below) — a caught-up run only ever drafts what genuinely wasn't
+//! drafted yet, it never redoes work. The one thing this does NOT do is reach
+//! back across local midnight: if the whole rest of the day was slept through,
+//! that day's catch-up is skipped, matching this pipeline's standing "no
+//! backfill past today" policy — the manual "Generate worklog" button in the
+//! panel always still works for any past day.
+//!
+//! # Fires once per task, not on every qualifying tick
+//! Once a task has ANY draft (auto- or manually generated), this leaves it alone
+//! for good — it does not keep re-drafting an already-drafted task on a later
+//! tick, whether that's later the same evening (the catch-up case above) or a
+//! future day. If the user keeps working the task past the auto-draft, getting
+//! an up-to-date version is a manual "Regenerate" click in the panel (which
+//! shows when the draft was last generated, via `DayTaskWorklogDraft::
+//! updated_at`) — auto-generate hands off to that rather than looping forever.
+//!
+//! # One task at a time
+//! Tasks are processed in a plain sequential loop, not fanned out — each `generate`
+//! call is a real LLM request, and running them one after another (rather than
+//! concurrently) keeps this predictable and easy to reason about from the trace.
+//!
+//! # Board freshness
+//! [`sweep::draft_qualifying_tasks`] syncs the PM board (gated, ~5 min per provider)
+//! before matching — there is no background poller keeping `pm_tasks` fresh
+//! anymore, so this sweep is one of the few places that has to ask for it itself.
+//!
+//! # Observability
+//! The whole run is one `worklog.auto_generate.run` span (see
+//! [`maybe_auto_generate`]) carrying the gate outcome and per-run counts as
+//! attributes — `gate` names exactly why a run did or didn't scan (`disabled`,
+//! `before_chosen_hour`, `malformed_time`, or `ran`), so "why didn't this fire
+//! tonight" is answerable from the trace alone, not by reading code. Each task
+//! that actually gets drafted (or fails to) gets its own `info!`/`warn!` — real,
+//! individually actionable events — but a task skipped for already having a
+//! draft or not yet qualifying is silent (folded into the summary counts only),
+//! so a quiet evening with nothing to do doesn't spam the log with one line per
+//! task.
+//!
+//! # Who calls this
+//! [`crate::worklog_pipeline::run_loop`], every clock-aligned wake (HH:03), right
+//! after the hourly activity-report pass.
+//!
+//! # Related
+//! - [`crate::pm_worklog::generate`] — the exact function the manual button calls;
+//!   this module never calls [`crate::pm_worklog::approve`].
+//! - [`meridian_core::day_tasks::get_day_tasks`] — the read model this scans;
+//!   `DayTask::minutes` is the deterministic measured total.
+//! - [`meridian_core::day_task_worklogs::get_day_task_worklog`] — the "has this
+//!   task already been drafted" check that makes auto-generate fire exactly once
+//!   per task.
+//! - [`sweep`] — the mechanical per-task loop, split out when this file passed the
+//!   500-line cap.
+
+mod sweep;
+
+use chrono::{Local, Timelike};
+use sqlx::SqlitePool;
+use tracing::field::Empty;
+use tracing::Instrument;
+
+use crate::config::Config;
+use sweep::draft_qualifying_tasks;
+
+/// Parse "HH:MM" into `(hour, minute)`. `None` for anything malformed — the
+/// settings write path (`update_settings`) already rejects a bad value, so this
+/// only has to be defensive against a hand-edited file.
+fn parse_hh_mm(s: &str) -> Option<(u32, u32)> {
+    let (h, m) = s.split_once(':')?;
+    let (h, m) = (h.parse::<u32>().ok()?, m.parse::<u32>().ok()?);
+    (h < 24 && m < 60).then_some((h, m))
+}
+
+/// Once the current local hour has reached the user's chosen hour (today), scan
+/// `day_local`'s day-tasks and auto-generate a worklog DRAFT (never approve,
+/// never post) for any past [`sweep::QUALIFYING_MINUTES`] that doesn't have a draft
+/// yet. A no-op when `worklog_auto_generate_time` is unset, or before that hour.
+/// Safe to call again later the same day (e.g. the machine was asleep at the
+/// chosen time) — see the module docs. Tasks are processed one at a time, in
+/// order — never concurrently.
+#[tracing::instrument(skip(pool, config))]
+pub async fn maybe_auto_generate(pool: &SqlitePool, config: &Config, day_local: &str) {
+    let span = tracing::info_span!(
+        "worklog.auto_generate.run",
+        day = day_local,
+        chosen_time = Empty,
+        gate = Empty,
+        tasks_total = Empty,
+        tasks_qualifying = Empty,
+        tasks_already_drafted = Empty,
+        tasks_drafted = Empty,
+        tasks_failed = Empty,
+    );
+    run(pool, config, day_local).instrument(span).await
+}
+
+async fn run(pool: &SqlitePool, config: &Config, day_local: &str) {
+    let current_span = tracing::Span::current();
+
+    let settings = meridian_core::settings::load_runtime_settings();
+    let Some(chosen_time) = settings.worklog_auto_generate_time else {
+        current_span.record("gate", "disabled");
+        return;
+    };
+    current_span.record("chosen_time", chosen_time.as_str());
+
+    let Some((chosen_hour, _)) = parse_hh_mm(&chosen_time) else {
+        current_span.record("gate", "malformed_time");
+        tracing::warn!(
+            chosen_time,
+            "worklog: auto-generate time is malformed — skipping"
+        );
+        return;
+    };
+    if Local::now().hour() < chosen_hour {
+        current_span.record("gate", "before_chosen_hour");
+        return;
+    }
+    current_span.record("gate", "ran");
+
+    draft_qualifying_tasks(pool, config, day_local, &current_span).await;
+}
+
+/// The "Generate now" path — the same day-task draft sweep as [`maybe_auto_generate`],
+/// but WITHOUT the time-of-day gate, run because the user asked for it on the spot
+/// (the daily-summary screen's "Generate now" button) rather than because the clock
+/// reached their chosen time. Everything else is identical: drafts only, never
+/// approves/posts, and skips any task that already has a draft, so it is safe to run
+/// alongside or before the scheduled pass. Independent of `worklog_auto_generate_time`:
+/// a user who never set a time can still generate on demand.
+#[tracing::instrument(skip(pool, config))]
+pub async fn generate_now(pool: &SqlitePool, config: &Config, day_local: &str) {
+    let span = tracing::info_span!(
+        "worklog.generate_now.run",
+        day = day_local,
+        gate = Empty,
+        tasks_total = Empty,
+        tasks_qualifying = Empty,
+        tasks_already_drafted = Empty,
+        tasks_drafted = Empty,
+        tasks_failed = Empty,
+    );
+    async {
+        let current_span = tracing::Span::current();
+        current_span.record("gate", "ran");
+        draft_qualifying_tasks(pool, config, day_local, &current_span).await;
+    }
+    .instrument(span)
+    .await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::parse_hh_mm;
+
+    #[test]
+    fn parses_valid_times() {
+        assert_eq!(parse_hh_mm("00:00"), Some((0, 0)));
+        assert_eq!(parse_hh_mm("18:00"), Some((18, 0)));
+        assert_eq!(parse_hh_mm("23:59"), Some((23, 59)));
+        assert_eq!(parse_hh_mm("09:05"), Some((9, 5)));
+    }
+
+    #[test]
+    fn rejects_out_of_range_or_malformed_values() {
+        assert_eq!(parse_hh_mm("24:00"), None);
+        assert_eq!(parse_hh_mm("18:60"), None);
+        assert_eq!(parse_hh_mm("18"), None);
+        assert_eq!(parse_hh_mm("18:00:00"), None);
+        assert_eq!(parse_hh_mm(""), None);
+        assert_eq!(parse_hh_mm("not-a-time"), None);
+        assert_eq!(parse_hh_mm("ab:cd"), None);
+    }
+}
diff --git a/src/pm_worklog/auto_generate.rs b/src/pm_worklog/auto_generate/sweep.rs
similarity index 53%
rename from src/pm_worklog/auto_generate.rs
rename to src/pm_worklog/auto_generate/sweep.rs
index 8e693e819..9586e0431 100644
--- a/src/pm_worklog/auto_generate.rs
+++ b/src/pm_worklog/auto_generate/sweep.rs
@@ -1,96 +1,11 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Auto-generate worklog DRAFTS, once a day, at a user-chosen local clock time —
-//! the opt-in behind `settings.worklog_auto_generate_time`.
-//!
-//! This runs the exact same action as the day-task detail panel's "Generate
-//! worklog" button (`pm_worklog::generate`), automatically, for any task past the
-//! fixed [`QUALIFYING_MINUTES`] threshold that doesn't have a draft yet. It NEVER
-//! approves or posts — approving is always a deliberate human click
-//! (`pm_worklog::approve`, the panel's "Approve & post"). Auto-generate only saves
-//! the user the click that starts the draft; the tracker is never touched without
-//! them.
-//!
-//! Off by default: the field is `None` until the user picks a time from the
-//! Timeline nudge or Settings → Worklogs, so nothing here ever runs unattended for
-//! someone who hasn't said yes.
-//!
-//! # A TRACKER IS NOT REQUIRED — and used to be, wrongly
-//! Both entry points opened with `if config.pm_providers.is_empty() { return }`,
-//! on the premise that "there is nothing to match against, so the sweep would only
-//! fail every call". That premise is false, and stopped being true the moment
-//! personal tasks became first-class: [`crate::pm_worklog::generate`] matches a
-//! PERSONAL (`local`) day-task exactly like a real ticket and, on approve, posts to
-//! that task's own row (`post_to_local_task`) — no tracker anywhere in the path.
-//! Only the PROPOSE branch needs a configured provider, and that branch failing is
-//! already a per-task `warn!` the loop walks past.
-//!
-//! So the gate silently disabled the whole feature for every tracker-less user —
-//! the cohort Meridian now leads with — and Settings mirrored it with a dead-end
-//! card offering nothing. Removed at both ends. Keep it that way: the correct floor
-//! is "does this task have qualifying minutes and no draft yet", which is what the
-//! sweep already checks, not "does this user have Jira".
-//!
-//! # Once a day, from the chosen time onward — not continuously, and self-healing
-//! [`maybe_auto_generate`] is called every clock-aligned wake (HH:03, same as the
-//! rest of the worklog pipeline), but only actually scans once the current local
-//! hour has REACHED the chosen time's hour — so a task crossing the threshold at
-//! 2pm with a 6pm setting waits for 6pm, not the next tick after 2pm.
-//!
-//! Deliberately `>=`, not `==`: if the Mac is asleep, off, or the app isn't
-//! running at exactly 9pm, there is no tick at 9pm to miss — the daemon simply
-//! catches up on its next wake that same day (10pm, or whenever the machine comes
-//! back), because every tick from the chosen hour through local midnight re-runs
-//! the same scan. This is safe to repeat because already-drafted tasks are
-//! skipped (see below) — a caught-up run only ever drafts what genuinely wasn't
-//! drafted yet, it never redoes work. The one thing this does NOT do is reach
-//! back across local midnight: if the whole rest of the day was slept through,
-//! that day's catch-up is skipped, matching this pipeline's standing "no
-//! backfill past today" policy — the manual "Generate worklog" button in the
-//! panel always still works for any past day.
-//!
-//! # Fires once per task, not on every qualifying tick
-//! Once a task has ANY draft (auto- or manually generated), this leaves it alone
-//! for good — it does not keep re-drafting an already-drafted task on a later
-//! tick, whether that's later the same evening (the catch-up case above) or a
-//! future day. If the user keeps working the task past the auto-draft, getting
-//! an up-to-date version is a manual "Regenerate" click in the panel (which
-//! shows when the draft was last generated, via `DayTaskWorklogDraft::
-//! updated_at`) — auto-generate hands off to that rather than looping forever.
-//!
-//! # One task at a time
-//! Tasks are processed in a plain sequential loop, not fanned out — each `generate`
-//! call is a real LLM request, and running them one after another (rather than
-//! concurrently) keeps this predictable and easy to reason about from the trace.
-//!
-//! # Observability
-//! The whole run is one `worklog.auto_generate.run` span (see
-//! [`maybe_auto_generate`]) carrying the gate outcome and per-run counts as
-//! attributes — `gate` names exactly why a run did or didn't scan (`disabled`,
-//! `before_chosen_hour`, `malformed_time`, or `ran`), so "why didn't this fire
-//! tonight" is answerable from the trace alone, not by reading code. Each task
-//! that actually gets drafted (or fails to) gets its own `info!`/`warn!` — real,
-//! individually actionable events — but a task skipped for already having a
-//! draft or not yet qualifying is silent (folded into the summary counts only),
-//! so a quiet evening with nothing to do doesn't spam the log with one line per
-//! task.
-//!
-//! # Who calls this
-//! [`crate::worklog_pipeline::run_loop`], every clock-aligned wake (HH:03), right
-//! after the hourly activity-report pass.
-//!
-//! # Related
-//! - [`crate::pm_worklog::generate`] — the exact function the manual button calls;
-//!   this module never calls [`crate::pm_worklog::approve`].
-//! - [`meridian_core::day_tasks::get_day_tasks`] — the read model this scans;
-//!   `DayTask::minutes` is the deterministic measured total.
-//! - [`meridian_core::day_task_worklogs::get_day_task_worklog`] — the "has this
-//!   task already been drafted" check that makes auto-generate fire exactly once
-//!   per task.
+//! The shared sweep body [`super::maybe_auto_generate`] (clock-gated) and
+//! [`super::generate_now`] (on demand) both call: draft a worklog for every
+//! qualifying, not-yet-drafted day-task. Split out of `auto_generate.rs` when that
+//! file passed the repo's 500-line cap — see `auto_generate/mod.rs`'s module doc
+//! for the full feature description; this file is the mechanical loop only.
 
-use chrono::{Local, Timelike};
 use sqlx::SqlitePool;
-use tracing::field::Empty;
-use tracing::Instrument;
 
 use crate::config::Config;
 use crate::pm_worklog;
@@ -98,101 +13,14 @@ use crate::pm_worklog;
 /// Fixed qualifying threshold — a day-task needs more than this many tracked
 /// minutes to be auto-drafted. Not user-configurable: only WHEN Meridian checks
 /// (`worklog_auto_generate_time`) is a choice; WHICH tasks qualify is not.
-const QUALIFYING_MINUTES: i64 = 30;
-
-/// Parse "HH:MM" into `(hour, minute)`. `None` for anything malformed — the
-/// settings write path (`update_settings`) already rejects a bad value, so this
-/// only has to be defensive against a hand-edited file.
-fn parse_hh_mm(s: &str) -> Option<(u32, u32)> {
-    let (h, m) = s.split_once(':')?;
-    let (h, m) = (h.parse::<u32>().ok()?, m.parse::<u32>().ok()?);
-    (h < 24 && m < 60).then_some((h, m))
-}
-
-/// Once the current local hour has reached the user's chosen hour (today), scan
-/// `day_local`'s day-tasks and auto-generate a worklog DRAFT (never approve,
-/// never post) for any past [`QUALIFYING_MINUTES`] that doesn't have a draft yet.
-/// A no-op when `worklog_auto_generate_time` is unset, or before that hour. Safe
-/// to call again later the same day (e.g. the machine was asleep at the chosen
-/// time) — see the module docs. Tasks are processed one at a time, in order —
-/// never concurrently.
-#[tracing::instrument(skip(pool, config))]
-pub async fn maybe_auto_generate(pool: &SqlitePool, config: &Config, day_local: &str) {
-    let span = tracing::info_span!(
-        "worklog.auto_generate.run",
-        day = day_local,
-        chosen_time = Empty,
-        gate = Empty,
-        tasks_total = Empty,
-        tasks_qualifying = Empty,
-        tasks_already_drafted = Empty,
-        tasks_drafted = Empty,
-        tasks_failed = Empty,
-    );
-    run(pool, config, day_local).instrument(span).await
-}
-
-async fn run(pool: &SqlitePool, config: &Config, day_local: &str) {
-    let current_span = tracing::Span::current();
-
-    let settings = meridian_core::settings::load_runtime_settings();
-    let Some(chosen_time) = settings.worklog_auto_generate_time else {
-        current_span.record("gate", "disabled");
-        return;
-    };
-    current_span.record("chosen_time", chosen_time.as_str());
-
-    let Some((chosen_hour, _)) = parse_hh_mm(&chosen_time) else {
-        current_span.record("gate", "malformed_time");
-        tracing::warn!(
-            chosen_time,
-            "worklog: auto-generate time is malformed — skipping"
-        );
-        return;
-    };
-    if Local::now().hour() < chosen_hour {
-        current_span.record("gate", "before_chosen_hour");
-        return;
-    }
-    current_span.record("gate", "ran");
-
-    draft_qualifying_tasks(pool, config, day_local, &current_span).await;
-}
-
-/// The "Generate now" path — the same day-task draft sweep as [`maybe_auto_generate`],
-/// but WITHOUT the time-of-day gate, run because the user asked for it on the spot
-/// (the daily-summary screen's "Generate now" button) rather than because the clock
-/// reached their chosen time. Everything else is identical: drafts only, never
-/// approves/posts, and skips any task that already has a draft, so it is safe to run
-/// alongside or before the scheduled pass. Independent of `worklog_auto_generate_time`:
-/// a user who never set a time can still generate on demand.
-#[tracing::instrument(skip(pool, config))]
-pub async fn generate_now(pool: &SqlitePool, config: &Config, day_local: &str) {
-    let span = tracing::info_span!(
-        "worklog.generate_now.run",
-        day = day_local,
-        gate = Empty,
-        tasks_total = Empty,
-        tasks_qualifying = Empty,
-        tasks_already_drafted = Empty,
-        tasks_drafted = Empty,
-        tasks_failed = Empty,
-    );
-    async {
-        let current_span = tracing::Span::current();
-        current_span.record("gate", "ran");
-        draft_qualifying_tasks(pool, config, day_local, &current_span).await;
-    }
-    .instrument(span)
-    .await
-}
+pub(super) const QUALIFYING_MINUTES: i64 = 30;
 
 /// What one sweep did. Returned rather than only recorded onto the span so the
 /// behaviour is assertable: "did this run at all" and "did it early-return" are
 /// otherwise indistinguishable from outside, which is exactly how a tracker gate
 /// silently disabled the whole feature for solo users once already.
 #[derive(Debug, Default, PartialEq, Eq)]
-struct SweepCounts {
+pub(super) struct SweepCounts {
     total: usize,
     qualifying: u32,
     already_drafted: u32,
@@ -201,19 +29,36 @@ struct SweepCounts {
 }
 
 /// Draft a worklog for every qualifying, not-yet-drafted day-task of `day_local`,
-/// recording per-run counts onto `span` and returning them. The shared body of
-/// [`maybe_auto_generate`] (gated on the clock) and [`generate_now`] (on demand); it
-/// assumes its caller has already decided a run is warranted.
+/// recording per-run counts onto `span`. The shared body of
+/// [`super::maybe_auto_generate`] (gated on the clock) and [`super::generate_now`]
+/// (on demand); it assumes its caller has already decided a run is warranted.
 ///
 /// Deliberately NOT gated on a connected tracker - a personal day-task is matched and
 /// drafted like any ticket, and only the propose branch needs one (it already fails
 /// per-task). See [`neither_sweep_is_gated_on_a_connected_tracker`].
-async fn draft_qualifying_tasks(
+pub(super) async fn draft_qualifying_tasks(
     pool: &SqlitePool,
     config: &Config,
     day_local: &str,
     span: &tracing::Span,
 ) -> SweepCounts {
+    // Matching a day-task against `pm_tasks` wants current ticket state, and there is
+    // no background poller keeping it fresh anymore — so this sweep asks for it.
+    //
+    // UNATTENDED on purpose. This runs on a clock (HH:03), which makes it the one
+    // remaining path that could fire a Jira OAuth refresh with nobody at the machine
+    // — the exact shape that permanently killed a production user's grant when a
+    // refresh POST straddled a 28-minute suspend. `run_pm_sync_unattended` will use a
+    // valid access token but never mint one, so an expired token simply defers to the
+    // next attended request instead of betting the grant. Best-effort either way: a
+    // sync failure must not block drafting against whatever is cached.
+    if let Err(e) = crate::intelligence::run_pm_sync_unattended(pool, config).await {
+        tracing::warn!(
+            day = day_local, error = %e,
+            "worklog: auto-generate pm sync failed — matching against cached tasks"
+        );
+    }
+
     let tasks = match meridian_core::day_tasks::get_day_tasks(pool, day_local).await {
         Ok(resp) => resp.tasks,
         Err(e) => {
@@ -305,7 +150,7 @@ async fn draft_qualifying_tasks(
 
 #[cfg(test)]
 mod tests {
-    use super::{draft_qualifying_tasks, parse_hh_mm, SweepCounts, QUALIFYING_MINUTES};
+    use super::{draft_qualifying_tasks, SweepCounts, QUALIFYING_MINUTES};
     use crate::config::Config;
     use sqlx::sqlite::SqlitePoolOptions;
     use sqlx::SqlitePool;
@@ -449,25 +294,6 @@ mod tests {
         assert_eq!(counts, SweepCounts::default());
     }
 
-    #[test]
-    fn parses_valid_times() {
-        assert_eq!(parse_hh_mm("00:00"), Some((0, 0)));
-        assert_eq!(parse_hh_mm("18:00"), Some((18, 0)));
-        assert_eq!(parse_hh_mm("23:59"), Some((23, 59)));
-        assert_eq!(parse_hh_mm("09:05"), Some((9, 5)));
-    }
-
-    #[test]
-    fn rejects_out_of_range_or_malformed_values() {
-        assert_eq!(parse_hh_mm("24:00"), None);
-        assert_eq!(parse_hh_mm("18:60"), None);
-        assert_eq!(parse_hh_mm("18"), None);
-        assert_eq!(parse_hh_mm("18:00:00"), None);
-        assert_eq!(parse_hh_mm(""), None);
-        assert_eq!(parse_hh_mm("not-a-time"), None);
-        assert_eq!(parse_hh_mm("ab:cd"), None);
-    }
-
     /// Neither entry point may re-acquire a "do they have a tracker" precondition.
     ///
     /// Source-level because the gate was a bare early return with no observable
@@ -477,7 +303,10 @@ mod tests {
     /// ticket); only the propose branch needs one, and it already fails per-task.
     #[test]
     fn neither_sweep_is_gated_on_a_connected_tracker() {
-        let src = include_str!("auto_generate.rs");
+        // Both files: `maybe_auto_generate`/`generate_now` (the entry points) live in
+        // `mod.rs`, the actual per-task loop lives here — a gate could reappear in
+        // either.
+        let src = concat!(include_str!("mod.rs"), "\n", include_str!("sweep.rs"));
         // Comment lines dropped, not just their markers - the module doc above
         // quotes the removed gate verbatim to explain why it went.
         let code: String = src
diff --git a/tray/src-tauri/src/commands/integrations.rs b/tray/src-tauri/src/commands/integrations.rs
index 5dbe8b53a..2e6e1d502 100644
--- a/tray/src-tauri/src/commands/integrations.rs
+++ b/tray/src-tauri/src/commands/integrations.rs
@@ -681,6 +681,11 @@ pub async fn save_integration_token(
         tracing::debug!("daemon reload after token save (non-fatal — will pick up on next start)");
     }
 
+    // First-time (or credential-change) connect — force a sync so the board
+    // populates immediately rather than waiting for the next on-demand trigger.
+    // There's no stale cache to protect here, so gating buys nothing.
+    crate::commands::tasks::trigger_background_pm_force_sync(db_pool.get(), "token_connected");
+
     Ok(serde_json::json!({ "ok": true, "reloaded": reloaded }))
 }
 
@@ -1198,7 +1203,7 @@ pub async fn start_oauth(
     db_pool: State<'_, crate::db_pool::DbPool>,
 ) -> Result<StartOAuthResponse, String> {
     match body.provider.as_str() {
-        "jira" | "trello" => start_oauth_in_process(body.provider),
+        "jira" | "trello" => start_oauth_in_process(body.provider, db_pool.get()),
         "github" => start_oauth_github_device(body.provider, db_pool.inner().clone()).await,
         other => Err(format!("Unknown provider: {other}")),
     }
@@ -1251,7 +1256,10 @@ pub async fn cancel_oauth(body: CancelOAuthBody) -> Result<(), String> {
 /// functions — avoiding `std::env::set_var` on a Tokio worker thread (POSIX
 /// setenv is not thread-safe under concurrent env reads). A per-provider
 /// [`AtomicBool`] prevents two flows from racing to bind the same loopback port.
-fn start_oauth_in_process(provider: String) -> Result<StartOAuthResponse, String> {
+fn start_oauth_in_process(
+    provider: String,
+    db: Option<meridian_core::SqlitePool>,
+) -> Result<StartOAuthResponse, String> {
     // Resolve credentials from .env WITHOUT mutating process env.
     let mode = crate::install::detect_install_mode();
     let dot_env = mode.env_path().map(parse_env).unwrap_or_default();
@@ -1343,7 +1351,12 @@ fn start_oauth_in_process(provider: String) -> Result<StartOAuthResponse, String
         // Always clear the in-flight flag before returning, regardless of outcome.
         in_flight.store(false, Ordering::SeqCst);
         match result {
-            Ok(()) => tracing::info!(provider = %task_provider, "in-process OAuth login succeeded"),
+            Ok(()) => {
+                tracing::info!(provider = %task_provider, "in-process OAuth login succeeded");
+                // First-time connect — force a sync so the board populates
+                // immediately rather than waiting for the next on-demand trigger.
+                crate::commands::tasks::trigger_background_pm_force_sync(db, "oauth_connected");
+            }
             Err(e) => {
                 let msg = format!("{e:#}");
                 tracing::warn!(provider = %task_provider, error = %msg, "in-process OAuth login failed");
@@ -1457,10 +1470,19 @@ async fn start_oauth_github_device(
                     return;
                 }
                 tracing::info!("GitHub device-flow login succeeded");
+                // Grab the DB handle BEFORE `db_pool` is moved into the reload below,
+                // so the sync request can still be written afterwards.
+                let sync_db = db_pool.get();
                 // Best-effort reload so the token takes effect now, not next restart.
                 if let Err(e) = crate::commands::daemon::reload_daemon_with(db_pool).await {
                     tracing::debug!(error = %e, "daemon reload after GitHub connect (non-fatal)");
                 }
+                // First-time connect — force a sync so the board populates
+                // immediately rather than waiting for the next on-demand trigger.
+                crate::commands::tasks::trigger_background_pm_force_sync(
+                    sync_db,
+                    "oauth_connected",
+                );
             }
             Err(e) => {
                 let msg = format!("{e:#}");
diff --git a/tray/src-tauri/src/commands/tasks.rs b/tray/src-tauri/src/commands/tasks.rs
index 882eb515e..90e8d6091 100644
--- a/tray/src-tauri/src/commands/tasks.rs
+++ b/tray/src-tauri/src/commands/tasks.rs
@@ -1,29 +1,72 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Task-board action commands — the ported `/api/tasks/sync` POST.
+//! Task-board action commands — the ported `/api/tasks/sync` POST, plus the
+//! on-demand sync triggers every other tray command fires into.
 //!
-//! Re-syncs the PM board: spawns `meridian tasks-sync`, which pulls the latest
-//! tickets from the connected tracker into `pm_tasks`. Tracker auth lives in the
-//! daemon, so — like every tracker write — this shells out to the CLI rather than
-//! talking to the provider directly; it's a process spawn, so it lives tray-side,
-//! not in meridian-core. (The per-task *read*, `get_tasks`, stays in
-//! [`crate::commands::dashboard`].)
+//! There is no background poller anymore: syncing `pm_tasks` from the connected
+//! tracker happens only at genuine on-demand moments — the manual "Sync now"
+//! button ([`sync_tasks`], force), connecting a tracker
+//! ([`trigger_background_pm_force_sync`], force, fire-and-forget), plan mount and
+//! the match-to-ticket picker ([`request_gated_sync_tasks`], gated, waits for
+//! result).
+//!
+//! # The tray does not sync, it ASKS
+//!
+//! Every function here writes a row to `pm_sync_requests` and the **daemon** does the
+//! work. The tray never holds a tracker credential, and it no longer spawns a
+//! `meridian` process to borrow one either.
+//!
+//! That is not tidiness, it is the fix for a production incident. An Atlassian OAuth
+//! refresh token is single-use and rotating: the old token dies the instant the new
+//! one is issued, so a lost response leaves the grant recoverable only inside a
+//! 10-minute window and permanently dead after it. The credential therefore has
+//! exactly one safe writer — and it used to have several (daemon, tray in-process,
+//! plus a fresh CLI process per trigger). The advisory file lock meant to serialise
+//! them could not: its 10 s timeout is shorter than the ~26 s a refresh can take, and
+//! on timeout the code proceeded WITHOUT the lock. Only Atlassian's grace window kept
+//! that from corrupting state.
+//!
+//! Requesting instead of doing also removed a per-trigger process spawn: opening the
+//! dashboard used to start a whole `meridian pm-sync` process — process init, DB
+//! open, config load — which then usually discovered the staleness gate and did
+//! nothing. It is now one coalescing UPSERT.
+//!
+//! (The per-task *read*, `get_tasks`, stays in [`crate::commands::dashboard`], and
+//! deliberately never triggers a sync itself — it's polled every 30-60s while a panel
+//! is mounted, and wiring a sync to that would silently rebuild the background-timer
+//! problem this replaces.)
 //!
 //! # Who calls this
-//! Registered in `lib.rs`'s `invoke_handler!`; consumed by `TasksView.tsx`'s Sync
-//! button via `ui/lib/bridge.ts::mutate` (success → re-fetch; error → inline msg).
+//! [`sync_tasks`] and [`request_gated_sync_tasks`] are registered in `lib.rs`'s
+//! `invoke_handler!`. `sync_tasks` (force) backs every "Sync now" — the Tasks panel,
+//! the planner's Refresh chip, and the per-provider button in Settings — via
+//! `ui/lib/taskSync.ts::syncTasks`. `request_gated_sync_tasks` backs
+//! `taskSync.ts::requestGatedTaskSync`, called by `PlanView` on mount and
+//! `WorklogTicketPicker` on open.
+//!
+//! [`trigger_background_pm_force_sync`] is a plain Rust fn (not a Tauri command),
+//! called from `commands::integrations`'s connect-success paths.
+//!
+//! Nothing calls a gated sync from a window opener any more: `open_dashboard` and
+//! `tray::open_native_dashboard` used to, and no longer do.
 //!
 //! # Related
-//! - [`crate::install::meridian_bin`] — the shared native-first binary resolver.
-//! - [`crate::commands::parents`] — the other read-side `meridian` CLI shell-out.
+//! - [`meridian_core::pm_sync_requests`] — the request/claim/complete API.
+//! - `src/intelligence/sync_requests.rs` — the daemon-side consumer.
+//! - `src/intelligence/sync_delegate.rs` — the producer side for the `meridian` CLI
+//!   subcommands the tray spawns (`tasks-sync`, `pm-sync`, `plan-task-*`,
+//!   `ticket-update`, `ticket-set-status`, `worklog-generate`), which delegate to the
+//!   same outbox when a daemon is running, for the same reason.
 
-use meridian_core::proc_ext::NoWindow;
+use meridian_core::pm_sync_requests::{self, SyncMode, ALL_PROVIDERS};
+use meridian_core::SqlitePool;
 use serde::Serialize;
 use std::time::Duration;
 
-/// How long `meridian tasks-sync` gets before the command gives up and reports
-/// a timeout. Named so the log field, the user-facing message and the timer can
-/// never disagree — they were three independent literals, and a `30` that drifts
-/// in one place turns a support report into a wrong-duration red herring.
+/// How long [`ask_daemon_to_sync`] waits for the daemon to report an outcome, and the
+/// budget for the no-daemon CLI fallback. Named so the log field, the user-facing
+/// message and the timer can never disagree — they were three independent literals,
+/// and a `30` that drifts in one place turns a support report into a wrong-duration
+/// red herring.
 const SYNC_TIMEOUT: Duration = Duration::from_secs(30);
 
 /// Success payload — mirrors the route's `{ ok, detail }` (the CLI's stdout).
@@ -33,83 +76,209 @@ pub struct SyncResult {
     pub detail: String,
 }
 
-/// Re-sync the board from the tracker (the ported /api/tasks/sync POST). Spawns
-/// `meridian tasks-sync` with a `SYNC_TIMEOUT` budget; returns its trimmed stdout as
-/// `detail` on success, or an `Err` carrying stderr (the route's 500 body.error)
-/// on timeout / spawn failure / non-zero exit.
+/// How often [`ask_daemon_to_sync`] re-reads the request row while waiting. The
+/// daemon's watcher ticks every 2 s, so this is matched to that rather than being
+/// tighter — a faster poll would just burn reads without seeing a result any sooner.
+const OUTCOME_POLL_INTERVAL: Duration = Duration::from_millis(500);
+
+/// Resolve the tray's DB handle, or an error string suitable for returning straight
+/// to the frontend. `None` means the pool is closed (a repair or a corrupt DB), which
+/// is a real condition rather than a bug — say so plainly instead of unwrapping.
+fn require_pool(
+    pool: &tauri::State<'_, crate::db_pool::DbPool>,
+) -> Result<meridian_core::SqlitePool, String> {
+    pool.get()
+        .ok_or_else(|| "the database is not open - Meridian may be repairing it".to_string())
+}
+
+/// Re-sync the board from the tracker (the ported /api/tasks/sync POST) — always
+/// forces a fetch, bypassing the per-provider staleness gate, because the user
+/// explicitly asked for fresh data right now.
+///
+/// Asks the daemon rather than syncing here. The tray must never hold the tracker
+/// credential: the Jira refresh token is single-use and rotating, so two processes
+/// spending it can permanently kill the grant, and the daemon is the designated sole
+/// owner (see [`meridian_core::pm_sync_requests`]). This writes a `force` request,
+/// then polls the row for the outcome so the button can still report a real result.
 #[tauri::command]
-#[tracing::instrument]
-pub async fn sync_tasks() -> Result<SyncResult, String> {
-    let bin = crate::install::meridian_bin();
-    // The cwd picks the credentials, because dotenvy walks up from it: a release
-    // build lands on the canonical ~/.meridian/.env (AZURE_DEVOPS_PAT, JIRA_URL, …),
-    // a dev build on the checkout's own. Never inherit the tray's cwd — under a
-    // packaged .app that is inside the bundle, and dotenvy finds no .env at all.
-    let cwd = crate::install::cli_cwd()?;
-    // WHICH binary ran, and from where, are the two facts that make a failure here
-    // legible: a stale installed CLI against a DB the dev daemon migrated ahead
-    // exits non-zero with nothing but `status=Some(1)` in the log otherwise.
-    tracing::debug!(bin = %bin, cwd = %cwd.display(), "tasks-sync: spawning");
-    let child = tokio::process::Command::new(&bin)
-        .arg("tasks-sync")
-        .current_dir(&cwd)
-        .stdin(std::process::Stdio::null())
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        // On timeout below, `tokio::time::timeout` drops the output future; without
-        // this the orphaned `meridian tasks-sync` keeps running (and can still mutate
-        // the board) after the UI reports a failure. The deleted /api/tasks/sync route
-        // called child.kill() on its 30s timer — kill_on_drop preserves that contract.
-        .kill_on_drop(true)
-        .no_window()
-        .output();
+#[tracing::instrument(skip(pool))]
+pub async fn sync_tasks(
+    pool: tauri::State<'_, crate::db_pool::DbPool>,
+) -> Result<SyncResult, String> {
+    let db = require_pool(&pool)?;
+    match ask_daemon_to_sync(&db, SyncMode::Force, "sync_now", "tasks-sync").await? {
+        Some(result) => Ok(result),
+        // The user pressed a button and is watching a spinner, so a timeout has to
+        // SAY something — but not "failed": the request is queued and the daemon will
+        // service it. This is the one caller that reports the wait as an error.
+        None => Err(format!(
+            "the sync is still running after {}s - it will finish in the background",
+            SYNC_TIMEOUT.as_secs()
+        )),
+    }
+}
+
+/// Frontend-facing: request a **gated** sync and wait for the outcome.
+///
+/// # Only two screens should call this
+///
+/// The board is rendered in many places, but only two of them make a *decision from
+/// the whole task list*, and a stale board there is not a cosmetic lag:
+///
+/// - **The daily plan**, where the user picks the day's tickets. A ticket assigned an
+///   hour ago is simply ABSENT from the list they can pick from, so it cannot enter
+///   the plan at all. (`PlanView`, on mount.)
+/// - **The retarget / match-to-existing-ticket picker**, which lists every open
+///   ticket by definition. (`WorklogTicketPicker`, on open.)
+///
+/// Everything else showing the board is display and self-corrects on the next real
+/// trigger. In particular **worklog drafting does NOT need this**: matching reads the
+/// day's *plan* as its candidate pool, not the board (see
+/// `src/pm_worklog/generate.rs::fetch_plan_candidates` — "Not the board"), so a
+/// fresher board cannot widen the candidate set by even one ticket.
+///
+/// # Gated, and never on a poll
+///
+/// `Gated` rather than `Force` because these fire on mount/open, which recurs: the
+/// daemon applies the per-provider staleness window, so a re-open inside it costs one
+/// coalescing UPSERT instead of a tracker call. `sync_tasks` is the forced variant and
+/// belongs to buttons the user pressed.
+///
+/// **Never wire this to a polled read.** `PlanView` re-loads every 30 s and
+/// `TasksPanel` every 60 s; attaching a sync to those would rebuild the
+/// background-timer problem this whole design removed, relocated into the read path.
+/// Mount and click are one-shot; a poll is not.
+#[tauri::command]
+#[tracing::instrument(skip(pool))]
+pub async fn request_gated_sync_tasks(
+    pool: tauri::State<'_, crate::db_pool::DbPool>,
+) -> Result<SyncResult, String> {
+    let db = require_pool(&pool)?;
+    // A timeout here is NOT an error, unlike [`sync_tasks`]. Nothing is watching a
+    // spinner: the screen already rendered from cache and only wanted fresher rows.
+    // Returning `Err` would make the frontend log a failure for a sync that is simply
+    // still going, which is noise in the telemetry spool rather than information.
+    Ok(
+        ask_daemon_to_sync(&db, SyncMode::Gated, "plan_or_picker", "pm-sync")
+            .await?
+            .unwrap_or(SyncResult {
+                ok: false,
+                detail: "still running in the background".to_string(),
+            }),
+    )
+}
 
-    let output = match tokio::time::timeout(SYNC_TIMEOUT, child).await {
-        Err(_) => {
-            // `kill_on_drop` reaps the child here, taking its stderr with it, so
-            // this log is the ONLY record a timeout ever leaves. Emitting a bare
-            // "tasks-sync timed out" (as it did) makes the two cases that matter
-            // indistinguishable in a support bundle: a genuinely slow tracker
-            // sync vs. a `meridian` binary that never got past opening a corrupt
-            // meridian.db. WHICH binary and WHICH cwd is what separates them —
-            // the same two facts the spawn/non-zero arms below already log.
+/// Ask the daemon to sync and wait up to [`SYNC_TIMEOUT`] for its outcome.
+///
+/// `Ok(Some(_))` the daemon reported a result; `Ok(None)` the budget elapsed with the
+/// request still queued (not a failure - the daemon will service it); `Err` the sync
+/// itself failed, or the outbox could not be read.
+///
+/// Shared by [`sync_tasks`] and [`request_gated_sync_tasks`], which differ only in
+/// their mode, their tag, their no-daemon fallback subcommand, and what they make of a
+/// timeout. Those four params are the entire difference; everything else - the daemon
+/// probe, the fallback, the request write, the poll loop - was duplicated line for line
+/// between them, which is how the two drifted into having different log messages and
+/// only one of them being `#[instrument]`ed.
+///
+/// `fallback_cli` is the `meridian` subcommand that performs this same sync in its own
+/// process. It is used only when no daemon owns the data dir, where there is no second
+/// writer to race for the rotating credential - the tray still never holds a token
+/// itself. Without it, a queued row would sit unserviced and the user would watch a
+/// spinner time out with the daemon stopped.
+#[tracing::instrument(skip(db), fields(mode = mode.as_str()))]
+async fn ask_daemon_to_sync(
+    db: &SqlitePool,
+    mode: SyncMode,
+    reason: &'static str,
+    fallback_cli: &'static str,
+) -> Result<Option<SyncResult>, String> {
+    if !crate::commands::daemon_control::status().await.running {
+        tracing::debug!(
+            fallback_cli,
+            "no daemon - delegating to the CLI's own fallback"
+        );
+        let out =
+            crate::commands::cli_exec::run_meridian(&[fallback_cli], SYNC_TIMEOUT, fallback_cli)
+                .await?;
+        return Ok(Some(SyncResult {
+            ok: true,
+            detail: out.trim().to_string(),
+        }));
+    }
+
+    pm_sync_requests::request(db, ALL_PROVIDERS, mode, reason)
+        .await
+        .map_err(|e| format!("could not queue the sync: {e}"))?;
+
+    let deadline = tokio::time::Instant::now() + SYNC_TIMEOUT;
+    loop {
+        if tokio::time::Instant::now() >= deadline {
             tracing::warn!(
-                bin = %bin,
-                cwd = %cwd.display(),
-                timeout_s = SYNC_TIMEOUT.as_secs(),
-                "tasks-sync timed out"
+                timeout_s = SYNC_TIMEOUT.as_secs() as i64,
+                "daemon did not report a sync outcome in time"
             );
-            return Err(format!(
-                "tasks-sync timed out after {}s",
-                SYNC_TIMEOUT.as_secs()
-            ));
+            return Ok(None);
         }
-        Ok(Err(e)) => {
-            tracing::warn!(bin = %bin, error = %e, "tasks-sync spawn failed");
-            return Err(format!("spawn error: {e}"));
-        }
-        Ok(Ok(o)) => o,
-    };
+        tokio::time::sleep(OUTCOME_POLL_INTERVAL).await;
 
-    if output.status.success() {
-        let detail = String::from_utf8_lossy(&output.stdout).trim().to_string();
-        tracing::info!("tasks-sync ok");
-        Ok(SyncResult { ok: true, detail })
-    } else {
-        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-        // Log the CLI's own reason, not just the exit code. `status=Some(1)` alone
-        // says nothing — the failure is always explained in stderr, and dropping it
-        // turned a one-line diagnosis into a manual re-run of the subcommand.
-        tracing::warn!(
-            status = ?output.status.code(),
-            bin = %bin,
-            stderr = %stderr,
-            "tasks-sync non-zero"
-        );
-        Err(if stderr.is_empty() {
-            "tasks-sync failed".to_string()
-        } else {
-            stderr
-        })
+        match pm_sync_requests::outcome(db, ALL_PROVIDERS).await {
+            Ok(Some(out)) => {
+                if let Some(err) = out.error {
+                    tracing::warn!(error = %err, "daemon reported a sync failure");
+                    return Err(err);
+                }
+                let detail = match out.synced_count {
+                    Some(n) => format!("synced {n} task(s)"),
+                    None => "synced".to_string(),
+                };
+                tracing::debug!(detail = %detail, "sync ok");
+                return Ok(Some(SyncResult { ok: true, detail }));
+            }
+            Ok(None) => continue,
+            Err(e) => return Err(format!("could not read the sync outcome: {e}")),
+        }
     }
 }
+
+/// Fire-and-forget: ask the daemon to **force** a fetch (bypassing the staleness
+/// gate) — for a moment where there is no stale cache to protect, e.g. a tracker was
+/// just connected and the board should populate immediately rather than wait for the
+/// next on-demand trigger.
+///
+/// There is deliberately no `trigger_background_pm_sync` (gated) sibling any more. It
+/// existed for the dashboard window openers, and those were removed: a window opening
+/// is not evidence anyone is about to make a decision from the whole board. The two
+/// screens that genuinely are — the daily plan and the retarget ticket picker — ask
+/// for themselves through [`request_gated_sync_tasks`]. See that command's doc.
+pub(crate) fn trigger_background_pm_force_sync(db: Option<SqlitePool>, reason: &'static str) {
+    request_sync(db, SyncMode::Force, reason);
+}
+
+/// Write a sync request, fire-and-forget.
+///
+/// Unlike [`sync_tasks`] this does NOT fall back to the CLI when no daemon is running.
+/// These fire from window-open and connect-success paths where nothing is waiting on a
+/// result, so a queued row that the next daemon start services is the right outcome -
+/// spawning a process per window open is exactly the cost this replaced.
+///
+/// Takes `Option<SqlitePool>` (i.e. `DbPool::get()`) rather than a pool or an
+/// `AppHandle`, because `None` is a real state and not an error: the pool is closed
+/// while a corrupt DB is being repaired. Callers pass what they already hold, which
+/// is a `DbPool` in the integration paths and app state in the window paths.
+///
+/// Best-effort by design: these fire from window-open and connect-success paths
+/// where a failure must never block the thing the user asked for, and the next
+/// trigger (or their explicit "Sync now") retries anyway.
+fn request_sync(db: Option<SqlitePool>, mode: SyncMode, reason: &'static str) {
+    let Some(db) = db else {
+        tracing::debug!(reason, "pm sync request skipped - database not open");
+        return;
+    };
+    tauri::async_runtime::spawn(async move {
+        match pm_sync_requests::request(&db, ALL_PROVIDERS, mode, reason).await {
+            Ok(()) => tracing::debug!(reason, mode = mode.as_str(), "pm sync requested"),
+            Err(e) => tracing::debug!(reason, error = %e, "pm sync request failed"),
+        }
+    });
+}
diff --git a/tray/src-tauri/src/lib.rs b/tray/src-tauri/src/lib.rs
index dc134f10d..a7a621472 100644
--- a/tray/src-tauri/src/lib.rs
+++ b/tray/src-tauri/src/lib.rs
@@ -1358,6 +1358,7 @@ pub fn run() {
             // process / service control (ported /api process routes)
             commands::reload_daemon,
             commands::sync_tasks,
+            commands::request_gated_sync_tasks,
             commands::run_update,
             // tracker connect/disconnect (ported /api/integrations + /api/auth/oauth)
             commands::disconnect_integration,
diff --git a/ui/components/plan/PlanView.tsx b/ui/components/plan/PlanView.tsx
index 3c2bb9fb6..56645f625 100644
--- a/ui/components/plan/PlanView.tsx
+++ b/ui/components/plan/PlanView.tsx
@@ -25,7 +25,7 @@ import { dayString } from '@/components/timeline/types'
 import type { PlanResponse, IntegrationsResponse } from '@/lib/api-types'
 import { MAX_PLAN_TASKS } from '@/lib/api-types'
 import { load as bridgeLoad } from '@/lib/bridge'
-import { lastSyncFailure, syncTasks } from '@/lib/taskSync'
+import { lastSyncFailure, requestGatedTaskSync, syncTasks } from '@/lib/taskSync'
 import { availableTrackerNames, connectedTrackers } from '@/lib/integrations'
 import { usePlan, refreshPlan, planAction, pausePlanRefresh } from '@/components/plan/planStore'
 import { isTutorialRunning } from '@/components/tutorial/engine'
@@ -219,14 +219,35 @@ export default function PlanView() {
   useEffect(() => {
     if (autoSyncedRef.current || !trackersLoaded || !data) return
     autoSyncedRef.current = true
-    // Nothing to pull, or something already there to show: the wait is over
-    // before it started.
-    if (trackers.length === 0 || (data.available?.length ?? 0) > 0) { setFirstSyncDone(true); return }
+    // Nothing to pull: the wait is over before it started.
+    if (trackers.length === 0) { setFirstSyncDone(true); return }
+    // A POPULATED board still needs a refresh, just not a blocking one.
+    //
+    // This branch used to return immediately, on the reasoning that there was
+    // "something already there to show". True for the empty-board spinner this
+    // backstop exists for, but it left the planner as the one screen that picks
+    // from the whole task list while never asking for a current copy of it - so a
+    // ticket assigned an hour ago was absent from the list, and the only way to
+    // see it was noticing the Refresh chip. Absent, not stale: it cannot be put in
+    // today's plan at all.
+    //
+    // GATED, unlike the empty branch's forced `handleSync`: this fires on every
+    // planner open, so the per-provider staleness window is what keeps it from
+    // becoming a tracker call each time. Not awaited before `setFirstSyncDone` -
+    // the cached board renders now and the 30 s poll picks the fresher rows up.
+    if ((data.available?.length ?? 0) > 0) {
+      void requestGatedTaskSync().then((ok) => { if (ok) void load(false) })
+      setFirstSyncDone(true)
+      return
+    }
     // Usually this JOINS the sync the connect flow already started - see `handleSync`.
     // It stays as a backstop because plenty of empty-board arrivals never went near a
     // connect: a reopened app, a board that emptied, a sync that failed an hour ago.
     handleSync().finally(() => setFirstSyncDone(true))
-  }, [data, trackers, trackersLoaded, handleSync])
+    // `load` is in the deps because the populated branch above calls it directly.
+    // Re-running is harmless either way: `autoSyncedRef` makes the whole effect
+    // one-shot per mount.
+  }, [data, trackers, trackersLoaded, handleSync, load])
 
   // The drag hold-off is module-global, so a planner closed mid-drag (onDragEnd
   // never fires) would strand every reader's refresh paused for the rest of the
diff --git a/ui/components/timeline/WorklogTicketPicker.tsx b/ui/components/timeline/WorklogTicketPicker.tsx
index 394963338..94d122d6c 100644
--- a/ui/components/timeline/WorklogTicketPicker.tsx
+++ b/ui/components/timeline/WorklogTicketPicker.tsx
@@ -23,6 +23,7 @@
 
 import { useEffect, useMemo, useState } from 'react'
 import { load } from '@/lib/bridge'
+import { requestGatedTaskSync } from '@/lib/taskSync'
 import type { BoardTicket } from '@/lib/api-types'
 
 /** Rank the board against a query: key first (people type "KAN-3"), then title,
@@ -64,9 +65,22 @@ export function WorklogTicketPicker({ current, busy, onPick, onCancel, title, ex
   useEffect(() => {
     if (tickets) return
     let alive = true
-    load<BoardTicket[]>('/api/board-tickets', 'get_board_tickets')
+    const read = () => load<BoardTicket[]>('/api/board-tickets', 'get_board_tickets')
       .then(r => { if (alive) setFetched(excludeLocal ? r.filter(t => t.provider !== 'local') : r) })
       .catch(() => { if (alive) setError('Could not load your board - try again in a moment.') })
+
+    // Show the cached board immediately, then ask for a refresh and re-read.
+    //
+    // This picker is the ONE surface whose entire purpose is choosing from the whole
+    // board, so a ticket missing from it is not a cosmetic lag - the user cannot
+    // retarget onto a ticket that is not listed, and nothing on screen suggests the
+    // list is incomplete. It had no refresh of its own and relied on whatever some
+    // other screen had happened to fetch.
+    //
+    // Ordered read-then-refresh-then-read on purpose: opening a picker must never
+    // wait on a network round trip. GATED, so opening it repeatedly stays inside the
+    // per-provider staleness window rather than hitting the tracker each time.
+    void read().then(() => requestGatedTaskSync()).then(ok => { if (ok && alive) void read() })
     return () => { alive = false }
   }, [excludeLocal, tickets])
 
diff --git a/ui/components/timeline/settings/IntegrationsSection.tsx b/ui/components/timeline/settings/IntegrationsSection.tsx
index 76fe3acb5..11e2ac66e 100644
--- a/ui/components/timeline/settings/IntegrationsSection.tsx
+++ b/ui/components/timeline/settings/IntegrationsSection.tsx
@@ -64,7 +64,7 @@ export function IntegrationsSection({ integrations, onChanged, gate = false, onD
               Connected to {connected.map(t => t.name).join(', ')}
             </p>
             <p className="text-[11.5px] font-semibold mt-0.5" style={{ color: 'color-mix(in srgb, var(--color-state-approved) 75%, var(--t-muted))' }}>
-              Syncing every hour
+              Kept in sync automatically
             </p>
           </div>
         </div>
diff --git a/ui/lib/taskSync.ts b/ui/lib/taskSync.ts
index 86fd88dc9..1e593fb1a 100644
--- a/ui/lib/taskSync.ts
+++ b/ui/lib/taskSync.ts
@@ -137,3 +137,59 @@ export function syncTasks(): Promise<boolean> {
 export function pendingTaskSync(): Promise<boolean> | null {
   return inFlight
 }
+
+/**
+ * Refresh the board for a screen that is about to make a decision from the WHOLE
+ * task list, and would behave differently against a stale one.
+ *
+ * # Only two screens should call this
+ *
+ * - **The daily plan**, where the user picks the day's tickets. A stale board here
+ *   is not a cosmetic lag: a ticket assigned an hour ago is simply absent from the
+ *   list they can pick from, so it cannot enter the plan at all. That is the
+ *   candidate-starvation failure, and it is why this exists.
+ * - **The retarget / match-to-existing-ticket picker**, which lists every open
+ *   ticket by definition.
+ *
+ * Worklog drafting deliberately does NOT call this: matching reads the day's *plan*
+ * as its candidate pool, not the board (`fetch_plan_candidates` - "Not the board"),
+ * so a fresher board cannot widen the candidate set by even one ticket.
+ *
+ * # Gated, unlike `syncTasks`
+ *
+ * `syncTasks` FORCES a fetch, which is right for a button the user pressed and wrong
+ * for a mount: a screen the user opens repeatedly would hit the tracker every time.
+ * This goes through `request_gated_sync_tasks`, so the daemon applies the
+ * per-provider staleness window and a re-open inside it costs one local UPSERT.
+ *
+ * **Never call this from a poll.** `PlanView` re-loads every 30 s and `TasksPanel`
+ * every 60 s; wiring it there would rebuild the background-timer problem this whole
+ * design removed, relocated into the read path. Mount and click are one-shot.
+ *
+ * NEVER REJECTS, for the same reason as `syncTasks`: resolves `true` on a completed
+ * sync and `false` on a failure. Callers that only want fresher rows can ignore the
+ * value; nothing on these screens should break because a refresh failed, since the
+ * cached board still renders.
+ *
+ * Deliberately NOT joined to `inFlight`: that promise tracks the *forced* sync, and
+ * a gated request is a different ask. It is cheap enough (one UPSERT when the window
+ * is closed) that sharing state would cost more in surprise than in requests.
+ */
+export function requestGatedTaskSync(): Promise<boolean> {
+  return mutate<{ ok: boolean }>('/api/tasks/sync', 'request_gated_sync_tasks', {})
+    // `ok: false` means the daemon had not reported back inside its budget - the sync
+    // is still running, so there is nothing fresher to re-read YET. Reported as
+    // `false` so callers skip a pointless re-read; it is not a failure and nothing is
+    // logged for it (unlike the `.catch` below).
+    .then((r) => r?.ok !== false)
+    .catch((e) => {
+      // Reported, not surfaced: unlike the Refresh chip there is no UI element
+      // waiting to explain this, and the screen renders fine from cache. It still
+      // has to reach the telemetry spool, or a board that is quietly never
+      // refreshing looks identical to one that is up to date.
+      const reason = syncFailureReason(e)
+      console.error('[meridian] gated tracker sync failed', e)
+      reportUiError(`gated tracker sync failed: ${reason}`)
+      return false
+    })
+}

From 9b5057f89eab3980e13d947a70c8abbc185c411c Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Wed, 26 Aug 2026 15:32:23 +0530
Subject: [PATCH 16/53] fix(sync): explain the update window instead of leaking
 a SQL error

`pm_sync_requests` arrives in migration 082, and only the daemon runs migrations
(the tray opens meridian.db with `create_if_missing(false)`, assuming the daemon
made it). So during an app update there is a window - new tray already running,
daemon not yet restarted onto the new binary - where the table does not exist.

It lasts seconds and self-heals when the daemon restarts, but a user who pressed
"Sync now" inside it was shown `could not queue the sync: no such table:
pm_sync_requests`. That reads like database damage for what is a normal
transient update state, and it is the kind of message that generates a support
ticket about a non-problem.

Maps that one case to "Meridian is still finishing an update - try again in a
moment". Every other write failure keeps its detail: collapsing them all into
the friendly message would hide a real fault (a locked or corrupt DB) behind
"try again in a moment", which would never resolve. Three tests pin all three
branches, including that a DIFFERENT missing table is not misreported as an
update in progress.
---
 tray/src-tauri/src/commands/tasks.rs | 86 +++++++++++++++++++++++++++-
 1 file changed, 83 insertions(+), 3 deletions(-)

diff --git a/tray/src-tauri/src/commands/tasks.rs b/tray/src-tauri/src/commands/tasks.rs
index 90e8d6091..f626c7bae 100644
--- a/tray/src-tauri/src/commands/tasks.rs
+++ b/tray/src-tauri/src/commands/tasks.rs
@@ -81,6 +81,35 @@ pub struct SyncResult {
 /// tighter — a faster poll would just burn reads without seeing a result any sooner.
 const OUTCOME_POLL_INTERVAL: Duration = Duration::from_millis(500);
 
+/// Turn a failed request-write into something a user can act on.
+///
+/// # Why the missing-table case is special-cased
+///
+/// `pm_sync_requests` arrives in migration 082, and **only the daemon runs migrations**
+/// (the tray opens the file with `create_if_missing(false)` and assumes the daemon made
+/// it). So during an app update there is a window — new tray already running, daemon not
+/// yet restarted onto the new binary — where the table genuinely does not exist yet.
+///
+/// It is seconds long and self-heals the moment the daemon restarts, but a user who
+/// presses "Sync now" inside it would otherwise be shown a raw SQL string:
+/// `could not queue the sync: no such table: pm_sync_requests`. That reads like
+/// database damage for what is in fact a normal, transient update state, and it is the
+/// kind of message that produces a support ticket about a non-problem.
+///
+/// Matched on the message rather than a typed error because sqlx surfaces this as a
+/// `Database` error whose only distinguishing feature IS its text; the match is
+/// deliberately loose (table name plus "no such table") so a reworded sqlite message
+/// degrades to the generic branch rather than mis-reporting something else.
+fn queue_failure_message(e: &anyhow::Error) -> String {
+    let detail = format!("{e:#}");
+    if detail.contains("no such table") && detail.contains("pm_sync_requests") {
+        tracing::warn!("pm_sync_requests missing - the daemon has not applied migration 082 yet");
+        return "Meridian is still finishing an update - try again in a moment".to_string();
+    }
+    tracing::warn!(error = %detail, "could not queue a PM sync request");
+    format!("could not queue the sync: {detail}")
+}
+
 /// Resolve the tray's DB handle, or an error string suitable for returning straight
 /// to the frontend. `None` means the pool is closed (a repair or a corrupt DB), which
 /// is a real condition rather than a bug — say so plainly instead of unwrapping.
@@ -207,9 +236,9 @@ async fn ask_daemon_to_sync(
         }));
     }
 
-    pm_sync_requests::request(db, ALL_PROVIDERS, mode, reason)
-        .await
-        .map_err(|e| format!("could not queue the sync: {e}"))?;
+    if let Err(e) = pm_sync_requests::request(db, ALL_PROVIDERS, mode, reason).await {
+        return Err(queue_failure_message(&e));
+    }
 
     let deadline = tokio::time::Instant::now() + SYNC_TIMEOUT;
     loop {
@@ -282,3 +311,54 @@ fn request_sync(db: Option<SqlitePool>, mode: SyncMode, reason: &'static str) {
         }
     });
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The update window: `pm_sync_requests` does not exist yet because the daemon
+    /// has not applied migration 082. The user must see a transient-update message,
+    /// never a raw SQL string that reads like database damage.
+    #[test]
+    fn a_missing_requests_table_reads_as_a_pending_update() {
+        let e = anyhow::anyhow!(
+            "error returned from database: (code: 1) no such table: pm_sync_requests"
+        );
+
+        let msg = queue_failure_message(&e);
+
+        assert_eq!(
+            msg,
+            "Meridian is still finishing an update - try again in a moment"
+        );
+        assert!(!msg.contains("no such table"), "must not leak SQL: {msg}");
+    }
+
+    /// Any OTHER write failure keeps its detail. Collapsing every error into the
+    /// friendly update message would hide a real fault (a locked or corrupt DB) behind
+    /// "try again in a moment", which never resolves.
+    #[test]
+    fn other_failures_keep_their_detail() {
+        let e = anyhow::anyhow!("database is locked");
+
+        let msg = queue_failure_message(&e);
+
+        assert!(
+            msg.contains("database is locked"),
+            "detail was dropped: {msg}"
+        );
+    }
+
+    /// A missing table that is NOT ours is somebody else's problem and must not be
+    /// reported as a pending update - that would send the user to wait out an update
+    /// that is already finished while the real fault goes unnamed.
+    #[test]
+    fn a_different_missing_table_is_not_reported_as_an_update() {
+        let e = anyhow::anyhow!("no such table: pm_tasks");
+
+        let msg = queue_failure_message(&e);
+
+        assert!(msg.contains("pm_tasks"), "detail was dropped: {msg}");
+        assert!(!msg.contains("finishing an update"), "misattributed: {msg}");
+    }
+}

From d6eec94c4ef85e0cfcc3dfef021730dbbb90eb5f Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Wed, 26 Aug 2026 19:21:03 +0530
Subject: [PATCH 17/53] fix(sync): report sync outcomes by sequence and stop
 caching db pools

Three defects found by reproducing a staging report of "Sync now" failing
and `(code: 11) database disk image is malformed` on a database that
`meridian db check` reported healthy.

1. Sync reported failure for syncs that had SUCCEEDED.

`pm_sync_requests` modelled completion as a flag that `request()` cleared,
and `complete()` guarded on `claimed_at IS NOT NULL`, which `request()` had
just nulled. A request arriving mid-sync therefore made the running sync's
completion match nothing: the outcome was discarded, the work was redone,
and every waiter polled its full 30s budget and reported failure. Connecting
a tracker fires `oauth_connected`, `token_connected` and the user's own
"Sync now" within seconds, so this was the normal case, not an edge one.

Migration 083 adds `seq`/`completed_seq`. Completion is now a watermark that
is never cleared: a producer holding seq N is satisfied by any
`completed_seq >= N`, so overlapping requests coalesce instead of
cannibalising each other, one sync can satisfy several waiters, and a
request made mid-sync still cannot be marked done by work that predates it.

2. Capture wrote to a closed pool after every daemon reload.

The consumers cached an `Option<SqlitePool>` for the tray process's whole
lifetime and wrote through it every ~2.5s. `DbPool::close()` (run by
`reload_daemon` around every daemon restart, precisely so the tray holds no
connection across one) cannot reach a clone that escaped the handle. They
now take the handle and resolve `get()` per write; the same fix applies to
two escaped clones in `integrations.rs`. This predates the outbox work.

3. The daemon checkpointed the WAL underneath its own live writes.

The sync watcher's `JoinHandle` was dropped, and `service_once` ignores the
shutdown flag once it has claimed a row so it can finish - so it could still
be writing for tens of seconds while `checkpoint_wal` and `close()` ran.
`release_endpoint()` also ran before the checkpoint, opening the
single-instance guard while this process was still writing. The watcher is
now awaited first and the endpoint released last. The watcher also reads
before claiming, so an idle daemon issues no write transactions at all
(`claim` is an UPDATE, and SQLite opens one even for a no-op match - roughly
43,000 a day on this 2s tick).

Recovery, because a cause may remain unfound: `DbPool::recover_if_corrupt`
recycles the pool on a corrupt-view write failure, with a cooldown, so the
app heals itself instead of needing a relaunch no user would think to try.
It shares one lock with the reload cycle - without that, a recycle could
reopen the pool inside the reload's close/signal window and leave a
connection spanning two daemon generations, which is the corruption profile
the dance exists to prevent.

Also: four `error = %e` sites lost their cause chain and now use `cmd_err!`;
the schema-pending message covers a missing COLUMN as well as a missing
table, since 083 reopens that update window; capture write failures raise
the `db.corrupt` banner; and the outbox tests now run the real migrator
instead of a hand-written CREATE TABLE that had already drifted.

Not covered: every test here runs against in-memory SQLite. The WAL-index
desync needs two real processes on a real encrypted file with launchd
relaunching the daemon, and was never reproduced in a test.
---
 meridian-core/src/pm_sync_requests/mod.rs     | 267 +++++++++++---
 meridian-core/src/pm_sync_requests/tests.rs   | 244 +++++++++++--
 src/intelligence/sync_delegate.rs             |  64 ++--
 src/intelligence/sync_requests.rs             |  37 +-
 src/main.rs                                   | 118 +++++-
 src/migrations/083_pm_sync_request_seq.sql    |  35 ++
 tray/src-tauri/src/commands/daemon.rs         |  48 +++
 tray/src-tauri/src/commands/integrations.rs   |  18 +-
 tray/src-tauri/src/commands/pause.rs          |   8 +-
 .../src/commands/{tasks.rs => tasks/mod.rs}   | 289 ++++++++++-----
 tray/src-tauri/src/commands/tasks/tests.rs    | 162 +++++++++
 tray/src-tauri/src/db_pool.rs                 | 209 -----------
 tray/src-tauri/src/db_pool/mod.rs             | 342 ++++++++++++++++++
 tray/src-tauri/src/db_pool/tests.rs           | 276 ++++++++++++++
 tray/src-tauri/src/lib.rs                     | 127 ++++++-
 tray/src-tauri/src/poll/mod.rs                |  20 +-
 tray/src-tauri/src/poll/refresh.rs            |  99 +----
 17 files changed, 1820 insertions(+), 543 deletions(-)
 create mode 100644 src/migrations/083_pm_sync_request_seq.sql
 rename tray/src-tauri/src/commands/{tasks.rs => tasks/mod.rs} (54%)
 create mode 100644 tray/src-tauri/src/commands/tasks/tests.rs
 delete mode 100644 tray/src-tauri/src/db_pool.rs
 create mode 100644 tray/src-tauri/src/db_pool/mod.rs
 create mode 100644 tray/src-tauri/src/db_pool/tests.rs

diff --git a/meridian-core/src/pm_sync_requests/mod.rs b/meridian-core/src/pm_sync_requests/mod.rs
index ed070c6b5..8bc72cbb0 100644
--- a/meridian-core/src/pm_sync_requests/mod.rs
+++ b/meridian-core/src/pm_sync_requests/mod.rs
@@ -74,8 +74,20 @@ pub struct SyncRequest {
     pub provider: String,
     pub mode: SyncMode,
     pub reason: String,
+    /// The sequence number this claim covers - pass it back to [`complete`].
+    ///
+    /// Captured at claim time on purpose: a request arriving DURING the sync bumps
+    /// `seq` past this value, so it stays pending and gets its own sync rather than
+    /// being silently marked done by work that started before it was asked for.
+    pub seq: i64,
 }
 
+// Every query below spells "nothing has completed yet" as
+// `COALESCE(completed_seq, 0)` and "pending" as `seq > COALESCE(completed_seq, 0)`.
+// `seq` starts at 1, so 0 is unreachable as a real watermark. It lives inline in the
+// SQL rather than as a Rust constant because it cannot be interpolated into a query
+// string without giving up the compile-time-checked literal.
+
 /// Ask the daemon to sync PM tasks. Idempotent and coalescing: repeated calls
 /// collapse into the single pending row rather than queueing, so opening the
 /// dashboard ten times means "a sync is wanted", not ten syncs.
@@ -83,10 +95,25 @@ pub struct SyncRequest {
 /// `mode` **escalates only**. A `Force` landing on a pending `Gated` upgrades it,
 /// because a user who just connected a tracker must not have that downgraded by a
 /// passing window focus; a `Gated` landing on a pending `Force` leaves the `Force`
-/// intact. Writing a new request also clears any previous completion stamps, so the
-/// row unambiguously represents work still to do.
+/// intact.
+///
+/// # Returns the sequence number to wait on
+///
+/// Pass the returned `seq` to [`outcome`]. It is what makes concurrent producers
+/// safe, and it replaces the previous design where a new request cleared the
+/// completion stamps outright.
 ///
-/// `reason` is a producer tag for tracing only (`"dashboard_open"`,
+/// Clearing them looked right - the row should represent work still to do - but it
+/// destroyed the *answer* to a request already in flight, and the tracker-connect
+/// flow always has several in flight at once (`oauth_connected`,
+/// `token_connected`, and the user's own "Sync now", within a few seconds). The
+/// completion of an earlier sync then matched nothing, the work was redone, and
+/// every waiter timed out reporting failure for a sync that had in fact succeeded.
+///
+/// So completion is now a **watermark**, never cleared: this only bumps `seq` and
+/// re-opens the claim. A holder of seq N is satisfied by any `completed_seq >= N`.
+///
+/// `reason` is a producer tag for tracing only (`"plan_or_picker"`,
 /// `"token_connected"`). Never pass user content - it is read back into logs.
 #[tracing::instrument(skip(pool))]
 pub async fn request(
@@ -94,84 +121,165 @@ pub async fn request(
     provider: &str,
     mode: SyncMode,
     reason: &str,
-) -> Result<()> {
+) -> Result<i64> {
+    // A transaction, not `RETURNING`: the upsert and the read-back of `seq` must be
+    // atomic (a concurrent producer bumping `seq` in between would hand this caller
+    // a number it never wrote, making it wait on somebody else's sync), and
+    // `RETURNING` on an upsert needs SQLite 3.35+, which is not worth depending on
+    // when the SQLCipher build is the thing supplying the library.
+    let mut tx = pool
+        .begin()
+        .await
+        .context("opening a PM sync request transaction")?;
+
     sqlx::query(
         "INSERT INTO pm_sync_requests
-             (provider, mode, reason, requested_at, claimed_at, completed_at, error, synced_count)
-         VALUES (?, ?, ?, strftime('%Y-%m-%dT%H:%M:%SZ', 'now'), NULL, NULL, NULL, NULL)
+             (provider, mode, reason, requested_at,
+              claimed_at, completed_at, error, synced_count, seq, completed_seq)
+         VALUES (?, ?, ?, strftime('%Y-%m-%dT%H:%M:%SZ', 'now'),
+              NULL, NULL, NULL, NULL, 1, NULL)
          ON CONFLICT(provider) DO UPDATE SET
+             -- The whole point: a new request is a new sequence number, so the
+             -- outcome of whatever is already running stays attributable to it.
+             seq = pm_sync_requests.seq + 1,
              -- Escalate to 'force', never back down from it while still pending.
              --
-             -- The `completed_at IS NULL` half is load-bearing: the row is kept after a
-             -- sync finishes (so \"Sync now\" can read its result), so without it a
-             -- SPENT 'force' would be inherited forever and every later gated request
-             -- would silently escalate. One tracker connect would then make every
-             -- planner open bypass the staleness gate and hit the provider for real -
+             -- The pendingness half is load-bearing: the row is kept after a sync
+             -- finishes (so \"Sync now\" can read its result), so without it a SPENT
+             -- 'force' would be inherited forever and every later gated request would
+             -- silently escalate. One tracker connect would then make every planner
+             -- open bypass the staleness gate and hit the provider for real -
              -- reinstating the constant polling this whole design removes, and
              -- multiplying exactly the token refreshes it exists to reduce.
              mode = CASE
                  WHEN excluded.mode = 'force'
                    OR (pm_sync_requests.mode = 'force'
-                       AND pm_sync_requests.completed_at IS NULL)
+                       AND pm_sync_requests.seq > COALESCE(pm_sync_requests.completed_seq, 0))
                       THEN 'force'
                  ELSE excluded.mode
              END,
              reason       = excluded.reason,
              requested_at = excluded.requested_at,
-             -- A fresh request re-opens the row: drop the in-flight and completion
-             -- marks so the watcher sees pending work again.
-             claimed_at   = NULL,
-             completed_at = NULL,
-             error        = NULL,
-             synced_count = NULL",
+             -- Re-open the claim so the watcher sees pending work, but do NOT touch
+             -- completed_at / completed_seq / error / synced_count: those describe
+             -- the last sync that actually ran, and erasing them is what lost
+             -- outcomes. `seq` above is what marks this as new work.
+             claimed_at   = NULL",
     )
     .bind(provider)
     .bind(mode.as_str())
     .bind(reason)
-    .execute(pool)
+    .execute(&mut *tx)
     .await
     .context("writing a PM sync request")?;
-    tracing::debug!(provider, mode = mode.as_str(), reason, "PM sync requested");
-    Ok(())
+
+    let seq: i64 = sqlx::query_scalar("SELECT seq FROM pm_sync_requests WHERE provider = ?")
+        .bind(provider)
+        .fetch_one(&mut *tx)
+        .await
+        .context("reading back the PM sync request sequence")?;
+
+    tx.commit().await.context("committing a PM sync request")?;
+
+    tracing::debug!(
+        provider,
+        mode = mode.as_str(),
+        reason,
+        seq,
+        "PM sync requested"
+    );
+    Ok(seq)
+}
+
+/// Is there work to claim? A pure READ, so an idle consumer touches no locks.
+///
+/// # Why this exists rather than just calling [`claim`]
+///
+/// [`claim`] is an `UPDATE`, and SQLite opens a write transaction and takes a
+/// RESERVED lock to evaluate one even when it matches no rows. The daemon's watcher
+/// ticks every 2 s forever, so calling `claim` unconditionally meant **~43,000 write
+/// transactions a day on an idle machine** - work that did not exist before this
+/// outbox, on a file a second process also writes. Worse than the cost: it made
+/// every daemon kill far more likely to land while a write transaction was open,
+/// which is the profile behind the `-shm` desync that wedged writes on
+/// 1.91.0-staging.2 with `(code: 11) database disk image is malformed` on a database
+/// that was provably healthy.
+///
+/// Gating on this read takes an idle daemon's write load to zero. WAL readers do not
+/// take the write lock, so a tick that finds nothing is genuinely free.
+///
+/// **Advisory only.** A `true` here can go stale before [`claim`] runs, and that is
+/// fine: `claim` is still the conditional `UPDATE` that decides, so exclusivity is
+/// unchanged and a lost race just yields `None`. A `false` that was wrong costs one
+/// tick of latency.
+pub async fn has_pending(pool: &SqlitePool, provider: &str) -> Result<bool> {
+    let found: Option<i64> = sqlx::query_scalar(
+        "SELECT 1 FROM pm_sync_requests
+          WHERE provider = ?
+            AND claimed_at IS NULL
+            AND seq > COALESCE(completed_seq, 0)",
+    )
+    .bind(provider)
+    .fetch_optional(pool)
+    .await
+    .context("checking for a pending PM sync request")?;
+    Ok(found.is_some())
 }
 
 /// Claim the pending request for `provider`, if there is one, marking it in-flight
 /// so a second watcher tick can't pick up the same work.
 ///
-/// The claim is a conditional UPDATE (`WHERE claimed_at IS NULL AND completed_at IS
-/// NULL`) rather than a read-then-write, so two daemons racing on the same file -
-/// which the single-instance guard makes unlikely but not impossible during a
-/// restart overlap - cannot both claim it. SQLite serialises the statement, so
-/// exactly one sees a non-zero `rows_affected`.
+/// The claim is a conditional UPDATE (`WHERE claimed_at IS NULL AND <pending>`)
+/// rather than a read-then-write, so two daemons racing on the same file - which the
+/// single-instance guard makes unlikely but not impossible during a restart overlap -
+/// cannot both claim it. SQLite serialises the statement, so exactly one sees a
+/// non-zero `rows_affected`.
+///
+/// Pending is `seq > COALESCE(completed_seq, 0)`, not `completed_at IS NULL`: the
+/// completion stamps are a watermark now and are never cleared, so the only thing
+/// that makes a row claimable again is [`request`] bumping `seq` past it.
+///
+/// Reads `seq` back inside the same transaction as the claim, so the value handed to
+/// [`complete`] is exactly the one this claim covers even if a producer bumps it a
+/// microsecond later.
 #[tracing::instrument(skip(pool))]
 pub async fn claim(pool: &SqlitePool, provider: &str) -> Result<Option<SyncRequest>> {
+    let mut tx = pool
+        .begin()
+        .await
+        .context("opening a PM sync claim transaction")?;
+
     let claimed = sqlx::query(
         "UPDATE pm_sync_requests
             SET claimed_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
           WHERE provider = ?
             AND claimed_at IS NULL
-            AND completed_at IS NULL",
+            AND seq > COALESCE(completed_seq, 0)",
     )
     .bind(provider)
-    .execute(pool)
+    .execute(&mut *tx)
     .await
     .context("claiming a PM sync request")?;
 
     if claimed.rows_affected() == 0 {
+        // Nothing to do - roll back rather than commit an empty transaction.
         return Ok(None);
     }
 
-    let row: Option<(String, String)> =
-        sqlx::query_as("SELECT mode, reason FROM pm_sync_requests WHERE provider = ?")
+    let row: Option<(String, String, i64)> =
+        sqlx::query_as("SELECT mode, reason, seq FROM pm_sync_requests WHERE provider = ?")
             .bind(provider)
-            .fetch_optional(pool)
+            .fetch_optional(&mut *tx)
             .await
             .context("reading the claimed PM sync request")?;
 
-    Ok(row.map(|(mode, reason)| SyncRequest {
+    tx.commit().await.context("committing a PM sync claim")?;
+
+    Ok(row.map(|(mode, reason, seq)| SyncRequest {
         provider: provider.to_string(),
         mode: SyncMode::from_str_or_gated(&mode),
         reason,
+        seq,
     }))
 }
 
@@ -179,35 +287,65 @@ pub async fn claim(pool: &SqlitePool, provider: &str) -> Result<Option<SyncReque
 /// rather than deleted so `"Sync now"` can read a real result without holding the
 /// credential, and so support has a content-free view of the last attempt.
 ///
-/// Writes only if the row is still the one that was claimed. The guard is
-/// **`claimed_at IS NOT NULL`**, and that specific predicate is the whole point:
-/// [`request`] resets `claimed_at` to `NULL`, so a request that arrived mid-sync
-/// makes this UPDATE match nothing. Guarding on `completed_at IS NULL` alone would
-/// NOT work - the fresh request leaves that NULL too, so the older sync's outcome
-/// would stamp the new request as done without it ever being serviced, and the
-/// user's "Sync now" would report success for a sync that never ran.
+/// `seq` is the value from the [`SyncRequest`] this call is reporting on. It records
+/// the watermark, and it is also the guard.
+///
+/// # Why the guard is the sequence and NOT `claimed_at`
+///
+/// It used to be `claimed_at IS NOT NULL AND completed_at IS NULL`, chosen because
+/// [`request`] nulled `claimed_at` and so a request arriving mid-sync would make this
+/// UPDATE match nothing - deliberately, to stop an older sync's outcome marking a
+/// newer request as done.
+///
+/// The intent was right and the mechanism was a data-loss bug. Discarding the write
+/// also discarded the answer the *original* waiter was polling for, and since
+/// tracker-connect fires several requests seconds apart, that was the normal case
+/// rather than the edge one: the sync succeeded, the outcome was dropped, the work
+/// was repeated, and the user was shown a failure.
+///
+/// Guarding on `seq > COALESCE(completed_seq, 0)` keeps the protection and loses the
+/// bug. The watermark only ever moves forward, so this is idempotent and a late
+/// duplicate cannot roll it back; a newer request has a HIGHER `seq` than the one
+/// being completed, so it stays pending and gets its own sync. `claimed_at` is
+/// cleared here rather than depended on, which is what makes that next sync
+/// claimable immediately.
 #[tracing::instrument(skip(pool))]
 pub async fn complete(
     pool: &SqlitePool,
     provider: &str,
+    seq: i64,
     synced_count: Option<i64>,
     error: Option<&str>,
 ) -> Result<()> {
-    sqlx::query(
+    let res = sqlx::query(
         "UPDATE pm_sync_requests
-            SET completed_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now'),
-                error        = ?,
-                synced_count = ?
+            SET completed_at  = strftime('%Y-%m-%dT%H:%M:%SZ', 'now'),
+                completed_seq = ?,
+                claimed_at    = NULL,
+                error         = ?,
+                synced_count  = ?
           WHERE provider = ?
-            AND claimed_at IS NOT NULL
-            AND completed_at IS NULL",
+            AND ? > COALESCE(completed_seq, 0)",
     )
+    .bind(seq)
     .bind(error)
     .bind(synced_count)
     .bind(provider)
+    .bind(seq)
     .execute(pool)
     .await
     .context("completing a PM sync request")?;
+
+    if res.rows_affected() == 0 {
+        // Not an error: a duplicate or out-of-order completion for a watermark that
+        // has already moved past `seq`. Worth a line, because it should be rare and
+        // a steady stream of them would mean two consumers are running.
+        tracing::debug!(
+            provider,
+            seq,
+            "PM sync completion ignored - the watermark is already at or past it"
+        );
+    }
     Ok(())
 }
 
@@ -229,7 +367,7 @@ pub async fn reset_stale_claims(pool: &SqlitePool) -> Result<u64> {
         "UPDATE pm_sync_requests
             SET claimed_at = NULL
           WHERE claimed_at IS NOT NULL
-            AND completed_at IS NULL",
+            AND seq > COALESCE(completed_seq, 0)",
     )
     .execute(pool)
     .await
@@ -244,12 +382,24 @@ pub async fn reset_stale_claims(pool: &SqlitePool) -> Result<u64> {
     Ok(n)
 }
 
-/// The outcome of the last request for `provider`, for a producer that wants to
-/// show one ("Sync now"). `None` while the request is still pending or in flight,
-/// so a caller can poll this until it turns `Some`.
-pub async fn outcome(pool: &SqlitePool, provider: &str) -> Result<Option<SyncOutcome>> {
-    let row: Option<(Option<String>, Option<String>, Option<i64>)> = sqlx::query_as(
-        "SELECT completed_at, error, synced_count FROM pm_sync_requests WHERE provider = ?",
+/// The outcome for the request the caller wrote, for a producer that wants to show
+/// one ("Sync now"). `None` while that request is still pending or in flight, so a
+/// caller can poll this until it turns `Some`.
+///
+/// `want_seq` is the value [`request`] returned. `Some` means `completed_seq >=
+/// want_seq` - i.e. a sync that finished at or after the caller's request, which is
+/// what makes overlapping producers safe: two waiters can be satisfied by one sync,
+/// and neither can be handed the result of a sync that finished BEFORE it asked.
+///
+/// Passing a stale `want_seq` (from a previous request) therefore returns a result
+/// immediately, by design - it has genuinely been satisfied.
+pub async fn outcome(
+    pool: &SqlitePool,
+    provider: &str,
+    want_seq: i64,
+) -> Result<Option<SyncOutcome>> {
+    let row: Option<(Option<i64>, Option<String>, Option<i64>)> = sqlx::query_as(
+        "SELECT completed_seq, error, synced_count FROM pm_sync_requests WHERE provider = ?",
     )
     .bind(provider)
     .fetch_optional(pool)
@@ -257,11 +407,14 @@ pub async fn outcome(pool: &SqlitePool, provider: &str) -> Result<Option<SyncOut
     .context("reading the PM sync outcome")?;
 
     Ok(match row {
-        Some((Some(_completed), error, synced_count)) => Some(SyncOutcome {
-            error,
-            synced_count,
-        }),
-        // No row, or a row still pending / in flight.
+        Some((Some(completed_seq), error, synced_count)) if completed_seq >= want_seq => {
+            Some(SyncOutcome {
+                error,
+                synced_count,
+            })
+        }
+        // No row, nothing completed yet, or the watermark has not reached this
+        // caller's request.
         _ => None,
     })
 }
diff --git a/meridian-core/src/pm_sync_requests/tests.rs b/meridian-core/src/pm_sync_requests/tests.rs
index 2bf861c66..1877f34a7 100644
--- a/meridian-core/src/pm_sync_requests/tests.rs
+++ b/meridian-core/src/pm_sync_requests/tests.rs
@@ -10,26 +10,23 @@ use super::*;
 use sqlx::sqlite::SqliteConnectOptions;
 use std::str::FromStr;
 
+/// The table as the REAL migrations build it, not a hand-written copy.
+///
+/// It used to be a hand-written `CREATE TABLE` mirroring migration 082. That is a
+/// schema the tests can silently diverge from: adding `seq`/`completed_seq` in
+/// migration 083 left every one of these tests passing against a table that did not
+/// have the columns the queries now use, so the suite proved nothing about the code
+/// that shipped. Running the migrator instead means these tests also assert that
+/// 082 + 083 actually apply in order, which is the property real installs depend on.
 async fn db() -> SqlitePool {
     let opts = SqliteConnectOptions::from_str("sqlite::memory:")
         .unwrap()
         .create_if_missing(true);
     let pool = SqlitePool::connect_with(opts).await.unwrap();
-    sqlx::query(
-        "CREATE TABLE pm_sync_requests (
-             provider TEXT NOT NULL PRIMARY KEY,
-             mode TEXT NOT NULL DEFAULT 'gated',
-             reason TEXT NOT NULL DEFAULT '',
-             requested_at TEXT NOT NULL,
-             claimed_at TEXT,
-             completed_at TEXT,
-             error TEXT,
-             synced_count INTEGER
-         )",
-    )
-    .execute(&pool)
-    .await
-    .unwrap();
+    sqlx::migrate!("../src/migrations")
+        .run(&pool)
+        .await
+        .unwrap();
     pool
 }
 
@@ -92,7 +89,9 @@ async fn a_completed_force_does_not_escalate_the_next_gated_request() {
         .await
         .unwrap();
     claim(&pool, ALL_PROVIDERS).await.unwrap();
-    complete(&pool, ALL_PROVIDERS, Some(4), None).await.unwrap();
+    complete(&pool, ALL_PROVIDERS, 1, Some(4), None)
+        .await
+        .unwrap();
 
     // A later window open wants the cheap, gated behaviour.
     request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
@@ -108,8 +107,9 @@ async fn a_completed_force_does_not_escalate_the_next_gated_request() {
 }
 
 /// The in-flight case still escalates: a force that is claimed but not completed
-/// will have its outcome discarded by `complete`'s guard and be re-serviced, so
-/// the force intent must survive into that re-run.
+/// gets a NEW sequence number from the arriving request, so it stays pending past
+/// the running sync's completion and is serviced again - and the force intent must
+/// survive into that re-run rather than being downgraded to the arriving gated mode.
 #[tokio::test]
 async fn an_in_flight_force_still_survives_a_gated_request() {
     let pool = db().await;
@@ -184,7 +184,9 @@ async fn reset_leaves_completed_requests_alone() {
         .await
         .unwrap();
     claim(&pool, ALL_PROVIDERS).await.unwrap();
-    complete(&pool, ALL_PROVIDERS, Some(2), None).await.unwrap();
+    complete(&pool, ALL_PROVIDERS, 1, Some(2), None)
+        .await
+        .unwrap();
 
     assert_eq!(reset_stale_claims(&pool).await.unwrap(), 0);
     assert!(
@@ -201,16 +203,21 @@ async fn outcome_is_none_until_completed() {
     request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
         .await
         .unwrap();
-    assert!(outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none());
+    assert!(outcome(&pool, ALL_PROVIDERS, 1).await.unwrap().is_none());
 
     claim(&pool, ALL_PROVIDERS).await.unwrap();
     assert!(
-        outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
+        outcome(&pool, ALL_PROVIDERS, 1).await.unwrap().is_none(),
         "in-flight must still read as pending"
     );
 
-    complete(&pool, ALL_PROVIDERS, Some(7), None).await.unwrap();
-    let out = outcome(&pool, ALL_PROVIDERS).await.unwrap().expect("done");
+    complete(&pool, ALL_PROVIDERS, 1, Some(7), None)
+        .await
+        .unwrap();
+    let out = outcome(&pool, ALL_PROVIDERS, 1)
+        .await
+        .unwrap()
+        .expect("done");
     assert_eq!(out.synced_count, Some(7));
     assert!(out.error.is_none());
 }
@@ -223,44 +230,205 @@ async fn outcome_carries_the_error() {
         .await
         .unwrap();
     claim(&pool, ALL_PROVIDERS).await.unwrap();
-    complete(&pool, ALL_PROVIDERS, None, Some("401 unauthorized"))
+    complete(&pool, ALL_PROVIDERS, 1, None, Some("401 unauthorized"))
         .await
         .unwrap();
 
-    let out = outcome(&pool, ALL_PROVIDERS).await.unwrap().expect("done");
+    let out = outcome(&pool, ALL_PROVIDERS, 1)
+        .await
+        .unwrap()
+        .expect("done");
     assert_eq!(out.error.as_deref(), Some("401 unauthorized"));
 }
 
-/// THE RACE THIS GUARDS: a request arriving mid-sync resets the row, and the
-/// older sync's outcome must NOT stamp it complete - that would mark the new
-/// request done without ever servicing it.
+/// **THE BUG THIS FILE EXISTS FOR, and both halves of it at once.**
+///
+/// A request arriving mid-sync must not be marked done by the sync that was already
+/// running (or "Sync now" reports success for work that never ran), AND the sync that
+/// was already running must still be able to report its result to whoever asked for
+/// it (or every waiter times out and reports failure for a sync that succeeded).
+///
+/// The 082 design could only get one of those. It guarded `complete` on `claimed_at
+/// IS NOT NULL`, which the new request had just nulled, so the completion was
+/// discarded entirely - protecting the new request by throwing away the old
+/// request's answer. On 1.91.0-staging.2 that was the normal case rather than an
+/// edge one, because connecting a tracker fires `oauth_connected`,
+/// `token_connected` and the user's "Sync now" within a few seconds: the sync
+/// worked, the answer was dropped, the work was repeated, and the user saw a
+/// failure.
+///
+/// The sequence watermark gets both. Asserting only the first half is what let the
+/// bug ship, so this test asserts them together.
 #[tokio::test]
-async fn completion_does_not_clobber_a_request_that_arrived_mid_sync() {
+async fn a_mid_sync_request_neither_steals_nor_destroys_the_running_sync_s_outcome() {
     let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
+    let first = request(&pool, ALL_PROVIDERS, SyncMode::Gated, "plan_or_picker")
         .await
         .unwrap();
-    claim(&pool, ALL_PROVIDERS).await.unwrap();
+    let claimed = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
+    assert_eq!(
+        claimed.seq, first,
+        "the claim must cover the request it read"
+    );
 
-    // A new request lands while the first sync is still running.
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+    // A second producer asks while the first sync is still running - the connect
+    // flow does exactly this.
+    let second = request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
         .await
         .unwrap();
+    assert!(second > first, "a new request must advance the sequence");
 
-    // The in-flight sync finishes and tries to report. This must be a NO-OP:
-    // the new request cleared `claimed_at`, so the guard rejects it.
-    complete(&pool, ALL_PROVIDERS, Some(3), None).await.unwrap();
+    // The in-flight sync finishes and reports against the seq it claimed.
+    complete(&pool, ALL_PROVIDERS, claimed.seq, Some(3), None)
+        .await
+        .unwrap();
+
+    // Half one - the FIX. The first waiter gets its answer instead of timing out.
+    let out = outcome(&pool, ALL_PROVIDERS, first)
+        .await
+        .unwrap()
+        .expect("the waiter that asked for this sync must receive its outcome");
+    assert_eq!(out.synced_count, Some(3));
 
+    // Half two - the ORIGINAL PROTECTION, preserved. The later request was not
+    // serviced by work that started before it existed.
     assert!(
-        outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
-        "the older sync's outcome must NOT mark the new request complete - \
+        outcome(&pool, ALL_PROVIDERS, second)
+            .await
+            .unwrap()
+            .is_none(),
+        "a request made mid-sync must NOT be satisfied by the sync already running - \
          that would report success for a sync that never ran"
     );
 
+    // ...and it is still serviceable, with its escalation intact.
     let req = claim(&pool, ALL_PROVIDERS)
         .await
         .unwrap()
         .expect("the mid-sync request must still be pending");
     assert_eq!(req.mode, SyncMode::Force);
     assert_eq!(req.reason, "sync_now");
+    assert_eq!(req.seq, second);
+}
+
+/// Two waiters, one sync: the whole point of a watermark. Both producers asked
+/// before anything was serviced, so one sync must satisfy both rather than each
+/// needing its own provider round trip.
+#[tokio::test]
+async fn one_sync_satisfies_every_waiter_that_asked_before_it_ran() {
+    let pool = db().await;
+    let a = request(&pool, ALL_PROVIDERS, SyncMode::Force, "oauth_connected")
+        .await
+        .unwrap();
+    let b = request(&pool, ALL_PROVIDERS, SyncMode::Force, "token_connected")
+        .await
+        .unwrap();
+
+    let claimed = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
+    complete(&pool, ALL_PROVIDERS, claimed.seq, Some(11), None)
+        .await
+        .unwrap();
+
+    for (label, seq) in [("first", a), ("second", b)] {
+        assert!(
+            outcome(&pool, ALL_PROVIDERS, seq).await.unwrap().is_some(),
+            "the {label} waiter must be satisfied by the single sync that covered it"
+        );
+    }
+    assert!(
+        claim(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
+        "coalesced requests must not leave extra work behind - that is a second \
+         provider round trip for one user action"
+    );
+}
+
+/// `has_pending` is the gate that keeps an IDLE daemon from writing at all.
+///
+/// The watcher ticks every 2 s forever and used to call `claim` unconditionally - an
+/// `UPDATE`, so SQLite opened a write transaction and took a lock even when it
+/// matched nothing. That was ~43,000 write transactions a day on an idle machine,
+/// against a file a second process also writes, and it made every daemon kill far
+/// likelier to land mid-write.
+///
+/// So the states where the answer must be `false` matter more than the one where it
+/// is `true`: each is a tick that now touches no lock at all.
+#[tokio::test]
+async fn has_pending_is_false_in_every_idle_state() {
+    let pool = db().await;
+
+    assert!(
+        !has_pending(&pool, ALL_PROVIDERS).await.unwrap(),
+        "a fresh install with no row must not provoke a claim - this is the state \
+         almost every tick runs in"
+    );
+
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+        .await
+        .unwrap();
+    assert!(
+        has_pending(&pool, ALL_PROVIDERS).await.unwrap(),
+        "real work must still be seen"
+    );
+
+    let claimed = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
+    assert!(
+        !has_pending(&pool, ALL_PROVIDERS).await.unwrap(),
+        "an in-flight request is not claimable, so ticks during a long sync must be \
+         free too"
+    );
+
+    complete(&pool, ALL_PROVIDERS, claimed.seq, Some(2), None)
+        .await
+        .unwrap();
+    assert!(
+        !has_pending(&pool, ALL_PROVIDERS).await.unwrap(),
+        "a completed row is the steady state after any sync - it must never read as \
+         work, or the daemon would re-sync forever"
+    );
+
+    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "plan_or_picker")
+        .await
+        .unwrap();
+    assert!(
+        has_pending(&pool, ALL_PROVIDERS).await.unwrap(),
+        "a new request after a completion must be visible again"
+    );
+}
+
+/// A duplicate or out-of-order completion must never move the watermark backwards,
+/// so a retrying consumer cannot un-answer a waiter that was already satisfied.
+#[tokio::test]
+async fn the_completion_watermark_only_moves_forward() {
+    let pool = db().await;
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+        .await
+        .unwrap();
+    let first = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
+    complete(&pool, ALL_PROVIDERS, first.seq, Some(5), None)
+        .await
+        .unwrap();
+
+    let second = request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+        .await
+        .unwrap();
+    let claimed = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
+    complete(&pool, ALL_PROVIDERS, claimed.seq, Some(9), None)
+        .await
+        .unwrap();
+
+    // A late duplicate for the OLD seq arrives (a retry, a doubled tick).
+    complete(&pool, ALL_PROVIDERS, first.seq, Some(1), Some("stale"))
+        .await
+        .unwrap();
+
+    let out = outcome(&pool, ALL_PROVIDERS, second)
+        .await
+        .unwrap()
+        .expect("the newer waiter must stay satisfied");
+    assert_eq!(
+        out.synced_count,
+        Some(9),
+        "the stale retry overwrote the result"
+    );
+    assert_eq!(out.error, None, "the stale retry resurrected an old error");
 }
diff --git a/src/intelligence/sync_delegate.rs b/src/intelligence/sync_delegate.rs
index 8475390f9..f2ddc7cce 100644
--- a/src/intelligence/sync_delegate.rs
+++ b/src/intelligence/sync_delegate.rs
@@ -152,29 +152,45 @@ async fn request_and_wait(
     label: &str,
     wait: Option<Duration>,
 ) -> Delegation {
-    if let Err(e) = pm_sync_requests::request(pool, ALL_PROVIDERS, mode, label).await {
-        return Delegation::Failed {
-            error: format!(
-                "could not queue the sync request: {}",
-                crate::errors::chain(&e)
-            ),
-        };
-    }
-    tracing::debug!(label, "pm sync requested - the daemon owns tracker auth");
+    let seq = match pm_sync_requests::request(pool, ALL_PROVIDERS, mode, label).await {
+        Ok(seq) => seq,
+        Err(e) => {
+            return Delegation::Failed {
+                error: format!(
+                    "could not queue the sync request: {}",
+                    crate::errors::chain(&e)
+                ),
+            };
+        }
+    };
+    tracing::debug!(
+        label,
+        seq,
+        "pm sync requested - the daemon owns tracker auth"
+    );
 
     match wait {
-        Some(budget) => wait_for_outcome(pool, label, budget).await,
+        Some(budget) => wait_for_outcome(pool, label, seq, budget).await,
         None => Delegation::Pending,
     }
 }
 
 /// Poll the request row until the daemon records an outcome, or `budget` elapses.
 ///
-/// The row is keyed on the provider (`'*'`), so a concurrent CLI's request can reset it
-/// and this can end up reading a sibling's outcome. That is fine: both asked for the same
-/// thing, and "some sync just completed" is exactly what the caller needs to know. It
-/// cannot read a *stale* outcome, because `request` clears `completed_at`.
-async fn wait_for_outcome(pool: &SqlitePool, label: &str, budget: Duration) -> Delegation {
+/// The row is keyed on the provider (`'*'`), so a concurrent producer's request shares
+/// it. `seq` is what keeps that safe: it is the sequence number THIS caller's request
+/// was given, and `outcome` only answers once the completion watermark reaches it. So a
+/// sibling's sync can satisfy this caller (both asked for the same thing, and "a sync
+/// finished after you asked" is exactly what the caller needs to know), while a sync that
+/// finished BEFORE this request cannot - which is the stale read the previous
+/// `completed_at`-clearing design tried to prevent by destroying the other waiter's
+/// answer.
+async fn wait_for_outcome(
+    pool: &SqlitePool,
+    label: &str,
+    seq: i64,
+    budget: Duration,
+) -> Delegation {
     let deadline = std::time::Instant::now() + budget;
     loop {
         if std::time::Instant::now() >= deadline {
@@ -186,7 +202,7 @@ async fn wait_for_outcome(pool: &SqlitePool, label: &str, budget: Duration) -> D
             return Delegation::Pending;
         }
         tokio::time::sleep(POLL_INTERVAL).await;
-        match pm_sync_requests::outcome(pool, ALL_PROVIDERS).await {
+        match pm_sync_requests::outcome(pool, ALL_PROVIDERS, seq).await {
             Ok(Some(out)) => {
                 return match out.error {
                     Some(error) => Delegation::Failed { error },
@@ -236,7 +252,7 @@ mod tests {
 
         assert_eq!(got, Delegation::Synced { count: None });
         assert!(
-            pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
+            pm_sync_requests::outcome(&pool, ALL_PROVIDERS, 1)
                 .await
                 .unwrap()
                 .is_none(),
@@ -289,13 +305,19 @@ mod tests {
             .await
             .unwrap();
         pm_sync_requests::claim(&pool, ALL_PROVIDERS).await.unwrap();
-        pm_sync_requests::complete(&pool, ALL_PROVIDERS, None, Some("refresh_token is invalid"))
-            .await
-            .unwrap();
+        pm_sync_requests::complete(
+            &pool,
+            ALL_PROVIDERS,
+            1,
+            None,
+            Some("refresh_token is invalid"),
+        )
+        .await
+        .unwrap();
 
         // Re-requesting clears the outcome, so the waiter must be the one to observe it:
         // drive the wait directly against the already-completed row.
-        let got = wait_for_outcome(&pool, "tasks-sync", Duration::from_secs(5)).await;
+        let got = wait_for_outcome(&pool, "tasks-sync", 1, Duration::from_secs(5)).await;
 
         assert_eq!(
             got,
diff --git a/src/intelligence/sync_requests.rs b/src/intelligence/sync_requests.rs
index 8e1838909..a60ea29c5 100644
--- a/src/intelligence/sync_requests.rs
+++ b/src/intelligence/sync_requests.rs
@@ -100,9 +100,17 @@ pub async fn run_watcher(pool: SqlitePool, mut shutdown_rx: watch::Receiver<bool
 /// Claim and service at most one pending request. Split from the loop so the
 /// decision logic is reachable without spawning a task.
 async fn service_once(pool: &SqlitePool) {
-    let req = match pm_sync_requests::claim(pool, ALL_PROVIDERS).await {
-        Ok(Some(req)) => req,
-        Ok(None) => return,
+    // READ first, and claim only if there is something to claim.
+    //
+    // `claim` is an UPDATE, and SQLite opens a write transaction to evaluate one even
+    // when it matches nothing - so calling it unconditionally on this 2 s tick put
+    // ~43,000 write transactions a day on an idle machine's database, and made every
+    // daemon kill far likelier to land mid-write. See
+    // `pm_sync_requests::has_pending` for the full reasoning. The read is advisory;
+    // `claim` below is still what decides, so exclusivity is unchanged.
+    match pm_sync_requests::has_pending(pool, ALL_PROVIDERS).await {
+        Ok(false) => return,
+        Ok(true) => {}
         Err(e) => {
             // Logged at debug, not warn: on a fresh install this fires every 2 s
             // until migration 082 has run, and a warn-level line every 2 s would
@@ -114,6 +122,20 @@ async fn service_once(pool: &SqlitePool) {
             );
             return;
         }
+    }
+
+    let req = match pm_sync_requests::claim(pool, ALL_PROVIDERS).await {
+        Ok(Some(req)) => req,
+        // Lost the race to another claimant between the read and here - fine, and
+        // the reason `has_pending` is documented as advisory.
+        Ok(None) => return,
+        Err(e) => {
+            tracing::debug!(
+                error = %crate::errors::chain(&e),
+                "could not claim a PM sync request"
+            );
+            return;
+        }
     };
 
     // Config is read here rather than captured at spawn time so a settings change
@@ -124,6 +146,7 @@ async fn service_once(pool: &SqlitePool) {
     tracing::info!(
         mode = req.mode.as_str(),
         reason = %req.reason,
+        seq = req.seq,
         "servicing PM sync request"
     );
 
@@ -157,7 +180,9 @@ async fn service_once(pool: &SqlitePool) {
         }
     };
 
-    if let Err(e) = pm_sync_requests::complete(pool, &req.provider, count, error.as_deref()).await {
+    if let Err(e) =
+        pm_sync_requests::complete(pool, &req.provider, req.seq, count, error.as_deref()).await
+    {
         tracing::warn!(
             error = %crate::errors::chain(&e),
             "could not record the PM sync outcome - the producer will keep waiting"
@@ -186,7 +211,7 @@ mod tests {
     async fn service_once_is_quiet_with_no_requests() {
         let pool = db().await;
         service_once(&pool).await;
-        assert!(pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
+        assert!(pm_sync_requests::outcome(&pool, ALL_PROVIDERS, 1)
             .await
             .unwrap()
             .is_none());
@@ -204,7 +229,7 @@ mod tests {
 
         service_once(&pool).await;
 
-        let out = pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
+        let out = pm_sync_requests::outcome(&pool, ALL_PROVIDERS, 1)
             .await
             .unwrap()
             .expect("the request must be completed, not left pending");
diff --git a/src/main.rs b/src/main.rs
index 5867f0542..3615d1f1b 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1435,13 +1435,21 @@ async fn main() -> Result<()> {
     //     ever on a row a producer wrote, so every refresh still traces to a human
     //     action, which is what keeps a refresh POST from being in flight when a
     //     laptop lid closes.
-    {
+    //
+    //     Its `JoinHandle` is KEPT, unlike the loops above, and awaited in the
+    //     shutdown sequence before the WAL checkpoint. This task is the daemon's
+    //     only writer outside the poll loop, and `service_once` deliberately runs a
+    //     whole sync (network + `pm_tasks` writes, tens of seconds) without
+    //     re-checking the shutdown flag, so dropping the handle meant checkpointing
+    //     and closing the pool underneath live writes on every restart. See the
+    //     shutdown site for the full reasoning.
+    let sync_watcher = {
         let pool_sync = meridian.clone();
         let rx_sync = shutdown_rx.clone();
         tokio::spawn(async move {
             meridian::intelligence::sync_requests::run_watcher(pool_sync, rx_sync).await;
-        });
-    }
+        })
+    };
 
     // 8b. Poll loop — ETL, PM sync, and FM categorization on the configured interval.
     // Track the last-applied log level so we can detect changes and hot-reload
@@ -1597,7 +1605,42 @@ async fn main() -> Result<()> {
 
     // 9. Shutdown
     tracing::info!("shutting down");
-    meridian::platform::release_endpoint();
+
+    // 9a. Wait for the PM sync watcher to actually STOP before touching the WAL.
+    //
+    //     `shutdown_tx.send(true)` above only sets a flag, and the watcher checks it
+    //     on its sleep - not around `service_once`, which is deliberate (a claimed
+    //     request finishes and records an outcome rather than being cut off with the
+    //     row left claimed). The consequence is that after the signal this task can
+    //     still be inside a full provider sync for tens of seconds, writing to
+    //     `pm_tasks`. Without this await, `checkpoint_wal` and `close` below ran
+    //     underneath those writes on EVERY restart - and a reconnect flow restarts
+    //     the daemon, which is exactly when a burst of sync requests exists to
+    //     service. A TRUNCATE checkpoint racing live writes is the one thing that
+    //     function exists to prevent (see its doc: it hands the next generation a
+    //     half-written WAL while the tray keeps a stale view of the file).
+    //
+    //     Bounded, because the whole point of the no-interrupt design is that
+    //     `service_once` may be mid-network-call: on timeout we proceed anyway and
+    //     say so, which is strictly better than the old unconditional race, and no
+    //     worse than a hard kill.
+    {
+        const WATCHER_DRAIN_TIMEOUT: Duration = Duration::from_secs(45);
+        match tokio::time::timeout(WATCHER_DRAIN_TIMEOUT, sync_watcher).await {
+            Ok(Ok(())) => tracing::debug!("PM sync watcher stopped cleanly before checkpoint"),
+            // `JoinError`'s Display ignores `f.alternate()`, so `chain()` would
+            // render byte-identically - it carries a panic payload or a
+            // cancellation, never a `.context()` chain.
+            Ok(Err(e)) => {
+                tracing::warn!(error = %e, "sync watcher ended abnormally"); // not-anyhow: JoinError
+            }
+            Err(_elapsed) => tracing::warn!(
+                timeout_s = WATCHER_DRAIN_TIMEOUT.as_secs() as i64,
+                "PM sync watcher did not stop in time - checkpointing anyway, which may leave a non-empty WAL"
+            ),
+        }
+    }
+
     // See `db::meridian::checkpoint_wal`'s doc for why this runs before every
     // close, not just a plain shutdown. Best-effort: a failed checkpoint must
     // not block shutdown.
@@ -1606,6 +1649,19 @@ async fn main() -> Result<()> {
     }
     meridian.close().await;
 
+    // 9b. Release the single-instance endpoint LAST, after the pool is closed.
+    //
+    //     This used to run first, before the checkpoint. `daemon_already_running` is
+    //     how a starting daemon decides whether to bow out (4a-ter), so releasing it
+    //     early opens the guard while THIS process is still checkpointing and closing
+    //     - the window `single_instance_check_precedes_setup_db_and_bind_follows_it`
+    //     exists to close, reopened from the exiting side. It only pinned the
+    //     STARTING daemon's ordering. Under launchd the relaunch is immediate, and a
+    //     new generation running migrations against a file the old one is mid-
+    //     checkpoint on is the double-writer profile the fleet-correlated corruption
+    //     was traced to.
+    meridian::platform::release_endpoint();
+
     // Flush OTel exporters FIRST, while the runtime is alive — this writes the
     // daemon's final shutdown spans/logs into the spool's pending/ dir...
     obs_guard.shutdown().await;
@@ -1820,4 +1876,58 @@ mod startup_order_tests {
              bind at byte {bind_pos}."
         );
     }
+
+    /// The EXIT-side ordering, which the test above does not cover and which was
+    /// wrong until 1.91.0-staging.2's write wedge was traced.
+    ///
+    /// Three things must happen in this order on shutdown:
+    /// 1. await the PM sync watcher — it is the daemon's only writer outside the
+    ///    poll loop, and `service_once` deliberately ignores the shutdown flag
+    ///    once it has claimed a row (so it can finish and record an outcome), so
+    ///    it can still be writing for tens of seconds after the signal;
+    /// 2. `checkpoint_wal` — a TRUNCATE checkpoint racing those live writes is
+    ///    the exact thing that function exists to prevent, and it is what hands
+    ///    the next daemon generation a half-written WAL while the tray keeps a
+    ///    stale view of the file;
+    /// 3. `release_endpoint` LAST — it is what `daemon_already_running` answers,
+    ///    so releasing it before the checkpoint and close lets a relaunching
+    ///    daemon pass the single-instance guard and start migrating against a
+    ///    file this process is still checkpointing. Under launchd the relaunch
+    ///    is immediate, so that window is real, not theoretical.
+    ///
+    /// Same self-scanning idiom (and the same truncate-at-the-test-module trap)
+    /// as the test above.
+    #[test]
+    fn shutdown_awaits_the_sync_watcher_then_checkpoints_then_releases_the_endpoint() {
+        const SRC: &str = include_str!("main.rs");
+        let prod = SRC
+            .split_once("\n#[cfg(test)]")
+            .map_or(SRC, |(before, _)| before);
+
+        let await_pos = prod
+            .find("WATCHER_DRAIN_TIMEOUT, sync_watcher)")
+            .expect("shutdown must await the PM sync watcher's JoinHandle");
+        let checkpoint_pos = prod
+            .find("meridian::db::meridian::checkpoint_wal(&meridian).await")
+            .expect("shutdown must checkpoint the WAL");
+        let release_pos = prod
+            .find("meridian::platform::release_endpoint();")
+            .expect("shutdown must release the single-instance endpoint");
+
+        assert!(
+            await_pos < checkpoint_pos,
+            "the PM sync watcher must be awaited BEFORE the WAL checkpoint — \
+             checkpointing underneath its live writes is what corrupted the \
+             shared WAL index. Found await at byte {await_pos}, checkpoint at \
+             byte {checkpoint_pos}."
+        );
+        assert!(
+            checkpoint_pos < release_pos,
+            "release_endpoint() must run AFTER the checkpoint and pool close — \
+             releasing it earlier opens the single-instance guard while this \
+             process is still writing, letting a relaunching daemon migrate \
+             against the same file. Found checkpoint at byte {checkpoint_pos}, \
+             release at byte {release_pos}."
+        );
+    }
 }
diff --git a/src/migrations/083_pm_sync_request_seq.sql b/src/migrations/083_pm_sync_request_seq.sql
new file mode 100644
index 000000000..5c3cc7e76
--- /dev/null
+++ b/src/migrations/083_pm_sync_request_seq.sql
@@ -0,0 +1,35 @@
+-- ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+
+-- Give each PM sync request a monotonic sequence number, so a producer can tell
+-- WHICH request an outcome belongs to.
+--
+-- Migration 082 modelled the outbox as one row per provider whose completion was
+-- signalled by `completed_at` going non-NULL, and `request()` cleared it so the row
+-- "unambiguously represents work still to do". With one waiter that is fine. With
+-- two it loses answers, and the tracker-connect flow always produces at least two:
+-- `oauth_connected`, `token_connected` and the user's own "Sync now" all fire inside
+-- a few seconds.
+--
+-- Measured on 1.91.0-staging.2: request A is claimed and a real Jira sync starts;
+-- request B lands mid-flight and nulls `claimed_at`/`completed_at`; the daemon
+-- finishes and calls `complete()`, whose guard was `claimed_at IS NOT NULL` - now
+-- NULL - so the outcome was DISCARDED and the sync re-run from scratch. Every waiter
+-- then polled for its full 30 s budget and reported failure for a sync that had
+-- actually succeeded, repeatedly.
+--
+-- With a sequence, "done" is a watermark rather than a flag: a producer holding seq
+-- N is satisfied by any `completed_seq >= N`, so overlapping requests coalesce
+-- instead of cannibalising each other, and no completion can be misattributed to a
+-- request that was never serviced.
+--
+-- `seq` starts at 1 and `completed_seq` is NULL-means-nothing-completed, so
+-- "pending" is `seq > COALESCE(completed_seq, 0)` everywhere.
+ALTER TABLE pm_sync_requests ADD COLUMN seq INTEGER NOT NULL DEFAULT 1;
+ALTER TABLE pm_sync_requests ADD COLUMN completed_seq INTEGER;
+
+-- Carry the existing row's state across rather than resetting it. A row already
+-- completed under 082 must NOT read as pending after this migration (that would fire
+-- a spurious provider sync on the first daemon start after an update, for every
+-- installed user at once); a row mid-flight must stay pending so it is still
+-- serviced.
+UPDATE pm_sync_requests SET completed_seq = seq WHERE completed_at IS NOT NULL;
diff --git a/tray/src-tauri/src/commands/daemon.rs b/tray/src-tauri/src/commands/daemon.rs
index 83afe313b..fef8680f5 100644
--- a/tray/src-tauri/src/commands/daemon.rs
+++ b/tray/src-tauri/src/commands/daemon.rs
@@ -248,6 +248,14 @@ pub(crate) async fn reload_daemon_with(
 /// point in time this function does not need to reason about.
 async fn reload_with_pool_cycle(pool: &crate::db_pool::DbPool) -> Result<u32, String> {
     with_reload_lock(|| async {
+        // Also excludes a concurrent `DbPool::recover_if_corrupt`, which closes and
+        // reopens this same handle. `with_reload_lock` alone only serialises reloads
+        // against each other, so without this a recycle could REOPEN the pool in the
+        // window between the close below and the restart signal - leaving a live
+        // connection spanning two daemon generations, which is the 2026-08-24
+        // corruption profile this whole close/reopen dance exists to prevent. See
+        // `DbPool::lock_cycle`.
+        let _cycle = pool.lock_cycle().await;
         pool.close().await;
         let result = super::daemon_control::reload().await;
         pool.reopen().await;
@@ -901,4 +909,44 @@ mod tests {
             "a later reload still reaches the daemon"
         );
     }
+
+    /// Every close/reopen of the tray's pool must hold `DbPool::lock_cycle`, and
+    /// `reload_with_pool_cycle` must take it BEFORE it closes.
+    ///
+    /// `with_reload_lock` only serialises reloads against each other.
+    /// `DbPool::recover_if_corrupt` is a second close/reopen site, so without a
+    /// shared lock the two interleave:
+    ///
+    /// 1. reload closes - the handle is `None`;
+    /// 2. a recycle sees `None`, treats it as nothing to close, and REOPENS;
+    /// 3. reload signals the daemon restart, with that fresh pool open across it.
+    ///
+    /// Step 3 is the 2026-08-24 corruption profile - a tray connection spanning two
+    /// daemon generations - i.e. the self-heal would have reintroduced the very bug
+    /// this close/reopen dance exists to prevent. Source-scanned because reproducing
+    /// it needs a real launchd daemon restart racing a real corrupt write.
+    #[test]
+    fn the_reload_cycle_holds_the_shared_pool_lock_before_closing() {
+        const SRC: &str = include_str!("daemon.rs");
+        let prod = SRC
+            .split_once("\n#[cfg(test)]")
+            .map_or(SRC, |(before, _)| before);
+        let body = prod
+            .split_once("async fn reload_with_pool_cycle")
+            .expect("reload_with_pool_cycle must exist")
+            .1;
+
+        let lock_pos = body
+            .find("lock_cycle().await")
+            .expect("reload_with_pool_cycle must acquire DbPool::lock_cycle");
+        let close_pos = body
+            .find("pool.close().await")
+            .expect("reload_with_pool_cycle must close the pool");
+        assert!(
+            lock_pos < close_pos,
+            "the shared cycle lock must be held BEFORE the close - taking it after \
+             leaves the window where a concurrent recycle can reopen the pool into \
+             the daemon restart. lock at {lock_pos}, close at {close_pos}."
+        );
+    }
 }
diff --git a/tray/src-tauri/src/commands/integrations.rs b/tray/src-tauri/src/commands/integrations.rs
index 2e6e1d502..0d10f792c 100644
--- a/tray/src-tauri/src/commands/integrations.rs
+++ b/tray/src-tauri/src/commands/integrations.rs
@@ -684,7 +684,10 @@ pub async fn save_integration_token(
     // First-time (or credential-change) connect — force a sync so the board
     // populates immediately rather than waiting for the next on-demand trigger.
     // There's no stale cache to protect here, so gating buys nothing.
-    crate::commands::tasks::trigger_background_pm_force_sync(db_pool.get(), "token_connected");
+    crate::commands::tasks::trigger_background_pm_force_sync(
+        db_pool.inner().clone(),
+        "token_connected",
+    );
 
     Ok(serde_json::json!({ "ok": true, "reloaded": reloaded }))
 }
@@ -1203,7 +1206,7 @@ pub async fn start_oauth(
     db_pool: State<'_, crate::db_pool::DbPool>,
 ) -> Result<StartOAuthResponse, String> {
     match body.provider.as_str() {
-        "jira" | "trello" => start_oauth_in_process(body.provider, db_pool.get()),
+        "jira" | "trello" => start_oauth_in_process(body.provider, db_pool.inner().clone()),
         "github" => start_oauth_github_device(body.provider, db_pool.inner().clone()).await,
         other => Err(format!("Unknown provider: {other}")),
     }
@@ -1258,7 +1261,7 @@ pub async fn cancel_oauth(body: CancelOAuthBody) -> Result<(), String> {
 /// [`AtomicBool`] prevents two flows from racing to bind the same loopback port.
 fn start_oauth_in_process(
     provider: String,
-    db: Option<meridian_core::SqlitePool>,
+    db: crate::db_pool::DbPool,
 ) -> Result<StartOAuthResponse, String> {
     // Resolve credentials from .env WITHOUT mutating process env.
     let mode = crate::install::detect_install_mode();
@@ -1470,9 +1473,12 @@ async fn start_oauth_github_device(
                     return;
                 }
                 tracing::info!("GitHub device-flow login succeeded");
-                // Grab the DB handle BEFORE `db_pool` is moved into the reload below,
-                // so the sync request can still be written afterwards.
-                let sync_db = db_pool.get();
+                // Clone the HANDLE (not `db_pool.get()`) before `db_pool` is moved
+                // into the reload below. The old code took a pool here, which the
+                // reload's `DbPool::close` then killed - so the sync request it was
+                // saved for could never be written. The handle survives, and
+                // `request_sync` resolves it after the reopen.
+                let sync_db = db_pool.clone();
                 // Best-effort reload so the token takes effect now, not next restart.
                 if let Err(e) = crate::commands::daemon::reload_daemon_with(db_pool).await {
                     tracing::debug!(error = %e, "daemon reload after GitHub connect (non-fatal)");
diff --git a/tray/src-tauri/src/commands/pause.rs b/tray/src-tauri/src/commands/pause.rs
index 7d81ccc17..7a01d12e4 100644
--- a/tray/src-tauri/src/commands/pause.rs
+++ b/tray/src-tauri/src/commands/pause.rs
@@ -338,9 +338,13 @@ pub(crate) async fn resume_capture(
         }
     }
 
-    // Restart the capture engine so screen recording resumes.
+    // Restart the capture engine so screen recording resumes. Resolve the managed
+    // HANDLE rather than passing `pool` (a snapshot this fn was handed): the capture
+    // consumers outlive any single pool generation - see `start_capture`'s doc.
     #[cfg(feature = "capture")]
-    crate::start_capture(state.clone(), pool.cloned());
+    if let Some(db) = crate::db_pool::from_app(app) {
+        crate::start_capture(state.clone(), db);
+    }
 
     // Emit immediately so the popover reverts to the picker without waiting for the next tick.
     if let Ok(s) = state.lock() {
diff --git a/tray/src-tauri/src/commands/tasks.rs b/tray/src-tauri/src/commands/tasks/mod.rs
similarity index 54%
rename from tray/src-tauri/src/commands/tasks.rs
rename to tray/src-tauri/src/commands/tasks/mod.rs
index f626c7bae..76a429d71 100644
--- a/tray/src-tauri/src/commands/tasks.rs
+++ b/tray/src-tauri/src/commands/tasks/mod.rs
@@ -81,14 +81,44 @@ pub struct SyncResult {
 /// tighter — a faster poll would just burn reads without seeing a result any sooner.
 const OUTCOME_POLL_INTERVAL: Duration = Duration::from_millis(500);
 
-/// Turn a failed request-write into something a user can act on.
+/// Shown when an outbox query fails because `meridian.db` itself is damaged. Points
+/// at the banner rather than repeating the SQLite text, because
+/// [`explain_outbox_failure`] has just raised that banner and it carries both the
+/// full cause and a Repair button - a settings panel has neither.
+const DB_DAMAGED_MESSAGE: &str =
+    "Meridian's database is damaged - use the Repair Database banner on the dashboard";
+
+/// Shown during the update window described on [`explain_outbox_failure`].
+const UPDATE_IN_PROGRESS_MESSAGE: &str =
+    "Meridian is still finishing an update - try again in a moment";
+
+/// What a failed `pm_sync_requests` query means for the user, plus the side effect it
+/// must trigger first.
+///
+/// Both halves of the handoff - the request write and the outcome read - fail for the
+/// same three reasons, so they classify here instead of each growing its own ladder.
+/// Callers render and log the chain themselves via [`crate::cmd_err!`] and pass the
+/// result in as `rendered`, which keeps each site's log message a constant (better
+/// grouping in OpenObserve than one message with the operation interpolated into it).
+///
+/// # Corruption must reach the banner, not a settings panel
+///
+/// This is the branch the whole function exists for. A staging machine's
+/// `meridian.db` had real b-tree damage and these two queries were the ONLY code on
+/// it to find out: `repair_boot`'s startup probe is skipped while a daemon answers,
+/// the daemon latches only when its own queries reach a damaged page, and
+/// `poll::refresh` covers only its four dashboard reads. So the user was shown
+/// `could not queue the sync: ... database disk image is malformed` inside Settings,
+/// with no banner and no Repair button - a recoverable fault presented as a failed
+/// button press. [`crate::db_pool::raise_if_corrupt`] fixes that at the source; this
+/// function just has to call it and then say something better than the SQL.
 ///
 /// # Why the missing-table case is special-cased
 ///
 /// `pm_sync_requests` arrives in migration 082, and **only the daemon runs migrations**
 /// (the tray opens the file with `create_if_missing(false)` and assumes the daemon made
-/// it). So during an app update there is a window — new tray already running, daemon not
-/// yet restarted onto the new binary — where the table genuinely does not exist yet.
+/// it). So during an app update there is a window - new tray already running, daemon not
+/// yet restarted onto the new binary - where the table genuinely does not exist yet.
 ///
 /// It is seconds long and self-heals the moment the daemon restarts, but a user who
 /// presses "Sync now" inside it would otherwise be shown a raw SQL string:
@@ -100,24 +130,67 @@ const OUTCOME_POLL_INTERVAL: Duration = Duration::from_millis(500);
 /// `Database` error whose only distinguishing feature IS its text; the match is
 /// deliberately loose (table name plus "no such table") so a reworded sqlite message
 /// degrades to the generic branch rather than mis-reporting something else.
-fn queue_failure_message(e: &anyhow::Error) -> String {
-    let detail = format!("{e:#}");
-    if detail.contains("no such table") && detail.contains("pm_sync_requests") {
-        tracing::warn!("pm_sync_requests missing - the daemon has not applied migration 082 yet");
-        return "Meridian is still finishing an update - try again in a moment".to_string();
+/// Corruption, by contrast, is classified by `is_corrupt_error` on the real error -
+/// never by string matching - so it stays correct across sqlite wordings.
+async fn explain_outbox_failure(
+    db: &SqlitePool,
+    e: &anyhow::Error,
+    rendered: &str,
+    fallback: &str,
+) -> String {
+    crate::db_pool::raise_if_corrupt(db, e).await;
+
+    if meridian::db::integrity::is_corrupt_error(e) {
+        return DB_DAMAGED_MESSAGE.to_string();
+    }
+    // "no such table" (082 not applied) OR "no such column" (083 not applied). The
+    // column case is not hypothetical: migration 083 added `seq`/`completed_seq`, and
+    // during an update the new tray queries them before the daemon has migrated. The
+    // first version of this branch only matched the table and would have shown every
+    // updating user `no such column: seq` - the exact raw-SQL-in-a-settings-panel
+    // failure it was written to prevent, one migration later. Any future migration
+    // touching this table inherits the same window, which is why this matches the
+    // schema-mismatch FAMILY rather than one message.
+    // SQLite names the TABLE for a missing table (`no such table:
+    // pm_sync_requests`) but only the COLUMN for a missing column (`no such column:
+    // seq`) - and none of this module's `.context(...)` strings contain the literal
+    // table name, so the two cases need separate needles rather than one
+    // table-plus-kind check.
+    //
+    // Matched on the full `no such column: <name>` prefix, not on the bare column
+    // name: `rendered.contains("seq")` would fire on any message containing
+    // "sequence" or "consequently" and mis-report an unrelated fault as a pending
+    // update, which sends the user to wait out an update that already finished.
+    const SCHEMA_PENDING: [&str; 3] = [
+        "no such table: pm_sync_requests",
+        "no such column: seq",
+        "no such column: completed_seq",
+    ];
+    if SCHEMA_PENDING
+        .iter()
+        .any(|needle| rendered.contains(needle))
+    {
+        return UPDATE_IN_PROGRESS_MESSAGE.to_string();
     }
-    tracing::warn!(error = %detail, "could not queue a PM sync request");
-    format!("could not queue the sync: {detail}")
+    format!("{fallback}: {rendered}")
 }
 
-/// Resolve the tray's DB handle, or an error string suitable for returning straight
-/// to the frontend. `None` means the pool is closed (a repair or a corrupt DB), which
-/// is a real condition rather than a bug — say so plainly instead of unwrapping.
+/// Confirm a pool is currently open, without keeping the one we looked at.
+///
+/// Returns the HANDLE, not a `SqlitePool`. It used to return the pool, which every
+/// caller then held for the length of a 30 s poll loop - so a recycle or a daemon
+/// reload part-way through left the rest of that loop querying a dead pool. Callers
+/// resolve `get()` per use instead; this only answers "is there any point starting".
+///
+/// `None` means the pool is closed (a repair, or a recycle in progress), which is a
+/// real condition rather than a bug - say so plainly instead of unwrapping.
 fn require_pool(
     pool: &tauri::State<'_, crate::db_pool::DbPool>,
-) -> Result<meridian_core::SqlitePool, String> {
-    pool.get()
-        .ok_or_else(|| "the database is not open - Meridian may be repairing it".to_string())
+) -> Result<crate::db_pool::DbPool, String> {
+    if pool.get().is_none() {
+        return Err("the database is not open - Meridian may be repairing it".to_string());
+    }
+    Ok(pool.inner().clone())
 }
 
 /// Re-sync the board from the tracker (the ported /api/tasks/sync POST) — always
@@ -215,9 +288,14 @@ pub async fn request_gated_sync_tasks(
 /// writer to race for the rotating credential - the tray still never holds a token
 /// itself. Without it, a queued row would sit unserviced and the user would watch a
 /// spinner time out with the daemon stopped.
+/// Takes the `DbPool` HANDLE and resolves it per query, rather than holding one
+/// `SqlitePool` for the whole 30 s wait. That matters here specifically: a daemon
+/// reload or a `recover_if_corrupt` recycle part-way through the poll loop replaces
+/// the pool, and a cached one would spend the rest of the budget querying a closed
+/// handle and then report a timeout for a sync that had finished.
 #[tracing::instrument(skip(db), fields(mode = mode.as_str()))]
 async fn ask_daemon_to_sync(
-    db: &SqlitePool,
+    db: &crate::db_pool::DbPool,
     mode: SyncMode,
     reason: &'static str,
     fallback_cli: &'static str,
@@ -236,22 +314,65 @@ async fn ask_daemon_to_sync(
         }));
     }
 
-    if let Err(e) = pm_sync_requests::request(db, ALL_PROVIDERS, mode, reason).await {
-        return Err(queue_failure_message(&e));
-    }
+    // The sequence number this request was given. Polling the outcome WITHOUT it is
+    // what made "Sync now" report failure for syncs that had succeeded: the connect
+    // flow writes several requests seconds apart, and the old row-level
+    // `completed_at` flag could not say which one an outcome belonged to.
+    //
+    // Attempted twice: a first failure whose cause is a broken pool VIEW (not damaged
+    // data) is recovered by `recover_if_corrupt` recycling the connections, and the
+    // retry then succeeds - so the user's button works instead of them having to
+    // discover that quitting and relaunching the app is the cure. Exactly two
+    // attempts: the recycle either fixed it or the fault is real, and a loop here
+    // would hold a user-facing command open against a database that cannot serve it.
+    let mut attempt = 0;
+    let seq = loop {
+        attempt += 1;
+        let pool = db
+            .get()
+            .ok_or_else(|| "the database is not open - Meridian may be repairing it".to_string())?;
+        match pm_sync_requests::request(&pool, ALL_PROVIDERS, mode, reason).await {
+            Ok(seq) => break seq,
+            Err(e) => {
+                let rendered = crate::cmd_err!(e, "could not queue a PM sync request");
+                // Raises the banner and recycles the pool when the fault is a broken
+                // view; returns whether a retry is worth making.
+                let recovered = db.recover_if_corrupt(&e).await;
+                crate::db_pool::raise_if_corrupt(&pool, &e).await;
+                if recovered && attempt == 1 {
+                    tracing::info!("retrying the PM sync request on the recycled pool");
+                    continue;
+                }
+                return Err(explain_outbox_failure(
+                    &pool,
+                    &e,
+                    &rendered,
+                    "could not queue the sync",
+                )
+                .await);
+            }
+        }
+    };
 
     let deadline = tokio::time::Instant::now() + SYNC_TIMEOUT;
     loop {
         if tokio::time::Instant::now() >= deadline {
             tracing::warn!(
                 timeout_s = SYNC_TIMEOUT.as_secs() as i64,
+                seq,
                 "daemon did not report a sync outcome in time"
             );
             return Ok(None);
         }
         tokio::time::sleep(OUTCOME_POLL_INTERVAL).await;
 
-        match pm_sync_requests::outcome(db, ALL_PROVIDERS).await {
+        let Some(pool) = db.get() else {
+            // A recycle or a daemon reload has the pool closed right now. Keep
+            // waiting rather than failing - the request row is already written and
+            // the daemon will service it.
+            continue;
+        };
+        match pm_sync_requests::outcome(&pool, ALL_PROVIDERS, seq).await {
             Ok(Some(out)) => {
                 if let Some(err) = out.error {
                     tracing::warn!(error = %err, "daemon reported a sync failure");
@@ -265,7 +386,30 @@ async fn ask_daemon_to_sync(
                 return Ok(Some(SyncResult { ok: true, detail }));
             }
             Ok(None) => continue,
-            Err(e) => return Err(format!("could not read the sync outcome: {e}")),
+            // `cmd_err!`, never a bare `{e}`: every `pm_sync_requests` query adds its
+            // own `.context(...)`, and `anyhow`'s `Display` renders ONLY the outermost
+            // one. This site shipped as `could not read the sync outcome: reading the
+            // PM sync outcome` on a machine whose database was corrupt - the context
+            // twice over and the actual `(code: 11) database disk image is malformed`
+            // nowhere, which is precisely the 1.83.2 field incident `cmd_err!` was
+            // written for.
+            Err(e) => {
+                let rendered = crate::cmd_err!(e, "could not read the PM sync outcome");
+                // Recycle on a broken view here too, then keep waiting rather than
+                // failing: the request row is written and the daemon is servicing it,
+                // so a healed pool on the next poll turn still reports a real result.
+                if db.recover_if_corrupt(&e).await {
+                    tracing::info!("recycled the pool mid-wait - continuing to poll");
+                    continue;
+                }
+                return Err(explain_outbox_failure(
+                    &pool,
+                    &e,
+                    &rendered,
+                    "could not read the sync outcome",
+                )
+                .await);
+            }
         }
     }
 }
@@ -280,7 +424,7 @@ async fn ask_daemon_to_sync(
 /// is not evidence anyone is about to make a decision from the whole board. The two
 /// screens that genuinely are — the daily plan and the retarget ticket picker — ask
 /// for themselves through [`request_gated_sync_tasks`]. See that command's doc.
-pub(crate) fn trigger_background_pm_force_sync(db: Option<SqlitePool>, reason: &'static str) {
+pub(crate) fn trigger_background_pm_force_sync(db: crate::db_pool::DbPool, reason: &'static str) {
     request_sync(db, SyncMode::Force, reason);
 }
 
@@ -291,74 +435,45 @@ pub(crate) fn trigger_background_pm_force_sync(db: Option<SqlitePool>, reason: &
 /// result, so a queued row that the next daemon start services is the right outcome -
 /// spawning a process per window open is exactly the cost this replaced.
 ///
-/// Takes `Option<SqlitePool>` (i.e. `DbPool::get()`) rather than a pool or an
-/// `AppHandle`, because `None` is a real state and not an error: the pool is closed
-/// while a corrupt DB is being repaired. Callers pass what they already hold, which
-/// is a `DbPool` in the integration paths and app state in the window paths.
+/// Takes the [`crate::db_pool::DbPool`] HANDLE and resolves it **inside** the spawned
+/// task, not at the call site.
 ///
-/// Best-effort by design: these fire from window-open and connect-success paths
-/// where a failure must never block the thing the user asked for, and the next
-/// trigger (or their explicit "Sync now") retries anyway.
-fn request_sync(db: Option<SqlitePool>, mode: SyncMode, reason: &'static str) {
-    let Some(db) = db else {
-        tracing::debug!(reason, "pm sync request skipped - database not open");
-        return;
-    };
+/// This parameter used to be `Option<SqlitePool>`, and the reasoning was that `None`
+/// is a real state (the pool is closed while a corrupt DB is repaired) so callers
+/// should pass what they already hold. The state check was right; taking a pool to do
+/// it was not. Every caller is a connect-success path, and those paths **restart the
+/// daemon**, which calls `DbPool::close`. A pool resolved before that point is dead by
+/// the time this task runs - `integrations.rs` even had a comment explaining that it
+/// grabbed the pool early "so the sync request can still be written afterwards",
+/// which is precisely backwards. Resolving after the spawn means the task sees
+/// whichever generation is live when it actually writes.
+///
+/// Best-effort by design: these fire from connect-success paths where a failure must
+/// never block the thing the user asked for, and the next trigger (or their explicit
+/// "Sync now") retries anyway. A corrupt database is the one exception worth
+/// surfacing, so it still raises the banner.
+fn request_sync(db: crate::db_pool::DbPool, mode: SyncMode, reason: &'static str) {
     tauri::async_runtime::spawn(async move {
-        match pm_sync_requests::request(&db, ALL_PROVIDERS, mode, reason).await {
-            Ok(()) => tracing::debug!(reason, mode = mode.as_str(), "pm sync requested"),
-            Err(e) => tracing::debug!(reason, error = %e, "pm sync request failed"),
+        let Some(pool) = db.get() else {
+            tracing::debug!(reason, "pm sync request skipped - database not open");
+            return;
+        };
+        match pm_sync_requests::request(&pool, ALL_PROVIDERS, mode, reason).await {
+            // Nothing waits on this one, so the sequence number is discarded.
+            Ok(_seq) => tracing::debug!(reason, mode = mode.as_str(), "pm sync requested"),
+            Err(e) => {
+                // Full chain: `anyhow`'s `Display` would render only
+                // `"writing a PM sync request"` and drop the SQLite code under it.
+                tracing::debug!(
+                    reason,
+                    error = %meridian::errors::chain(&e),
+                    "pm sync request failed"
+                );
+                crate::db_pool::raise_if_corrupt(&pool, &e).await;
+            }
         }
     });
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The update window: `pm_sync_requests` does not exist yet because the daemon
-    /// has not applied migration 082. The user must see a transient-update message,
-    /// never a raw SQL string that reads like database damage.
-    #[test]
-    fn a_missing_requests_table_reads_as_a_pending_update() {
-        let e = anyhow::anyhow!(
-            "error returned from database: (code: 1) no such table: pm_sync_requests"
-        );
-
-        let msg = queue_failure_message(&e);
-
-        assert_eq!(
-            msg,
-            "Meridian is still finishing an update - try again in a moment"
-        );
-        assert!(!msg.contains("no such table"), "must not leak SQL: {msg}");
-    }
-
-    /// Any OTHER write failure keeps its detail. Collapsing every error into the
-    /// friendly update message would hide a real fault (a locked or corrupt DB) behind
-    /// "try again in a moment", which never resolves.
-    #[test]
-    fn other_failures_keep_their_detail() {
-        let e = anyhow::anyhow!("database is locked");
-
-        let msg = queue_failure_message(&e);
-
-        assert!(
-            msg.contains("database is locked"),
-            "detail was dropped: {msg}"
-        );
-    }
-
-    /// A missing table that is NOT ours is somebody else's problem and must not be
-    /// reported as a pending update - that would send the user to wait out an update
-    /// that is already finished while the real fault goes unnamed.
-    #[test]
-    fn a_different_missing_table_is_not_reported_as_an_update() {
-        let e = anyhow::anyhow!("no such table: pm_tasks");
-
-        let msg = queue_failure_message(&e);
-
-        assert!(msg.contains("pm_tasks"), "detail was dropped: {msg}");
-        assert!(!msg.contains("finishing an update"), "misattributed: {msg}");
-    }
-}
+mod tests;
diff --git a/tray/src-tauri/src/commands/tasks/tests.rs b/tray/src-tauri/src/commands/tasks/tests.rs
new file mode 100644
index 000000000..ba3000ace
--- /dev/null
+++ b/tray/src-tauri/src/commands/tasks/tests.rs
@@ -0,0 +1,162 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Unit tests for [`super`] — split out only to keep both files under the
+//! repo's 500-line cap, following the same `{mod,tests}.rs` shape as
+//! `meridian-core/src/pm_sync_requests/` and
+//! `src/intelligence/providers/jira/`.
+
+use super::*;
+async fn fresh_db() -> SqlitePool {
+    use sqlx::sqlite::SqliteConnectOptions;
+    use std::str::FromStr;
+    let opts = SqliteConnectOptions::from_str("sqlite::memory:")
+        .unwrap()
+        .create_if_missing(true);
+    let pool = SqlitePool::connect_with(opts).await.unwrap();
+    sqlx::migrate!("../../src/migrations")
+        .run(&pool)
+        .await
+        .unwrap();
+    pool
+}
+
+/// Render an error the way the real call sites do, so the tests exercise the same
+/// `rendered` string production sees rather than a hand-written one.
+fn rendered(e: &anyhow::Error) -> String {
+    format!("{e:#}")
+}
+
+async fn corrupt_notices(pool: &SqlitePool) -> i64 {
+    sqlx::query_scalar("SELECT COUNT(*) FROM system_notices WHERE notice_id = ?")
+        .bind(meridian::notices::DB_CORRUPT)
+        .fetch_one(pool)
+        .await
+        .unwrap()
+}
+
+/// The update window: `pm_sync_requests` does not exist yet because the daemon
+/// has not applied migration 082. The user must see a transient-update message,
+/// never a raw SQL string that reads like database damage.
+#[tokio::test]
+async fn a_missing_requests_table_reads_as_a_pending_update() {
+    let pool = fresh_db().await;
+    let e =
+        anyhow::anyhow!("error returned from database: (code: 1) no such table: pm_sync_requests");
+
+    let msg = explain_outbox_failure(&pool, &e, &rendered(&e), "could not queue the sync").await;
+
+    assert_eq!(msg, UPDATE_IN_PROGRESS_MESSAGE);
+    assert!(!msg.contains("no such table"), "must not leak SQL: {msg}");
+    assert_eq!(
+        corrupt_notices(&pool).await,
+        0,
+        "a pending migration is not corruption"
+    );
+}
+
+/// The regression this function was rewritten for. A corrupt database must (a) get
+/// the `db.corrupt` banner raised, which is the only surface carrying a Repair
+/// button, and (b) send the user there rather than printing SQLite's wording into
+/// a settings panel that can do nothing about it.
+#[tokio::test]
+async fn corruption_raises_the_banner_and_points_at_it() {
+    let pool = fresh_db().await;
+    let e = anyhow::anyhow!(
+        "error returned from database: (code: 11) database disk image is malformed"
+    )
+    .context("reading the PM sync outcome");
+
+    let msg =
+        explain_outbox_failure(&pool, &e, &rendered(&e), "could not read the sync outcome").await;
+
+    assert_eq!(msg, DB_DAMAGED_MESSAGE);
+    assert_eq!(
+        corrupt_notices(&pool).await,
+        1,
+        "corruption found by an outbox query must raise the same banner the daemon raises"
+    );
+    assert!(
+        !msg.contains("malformed"),
+        "the banner carries the cause; the panel should not repeat it: {msg}"
+    );
+}
+
+/// The banner's detail must carry the real cause even though the panel message
+/// does not - otherwise the diagnosis is lost exactly like the bare-`{e}` bug that
+/// hid this incident in the first place.
+#[tokio::test]
+async fn the_banner_keeps_the_full_cause_chain() {
+    let pool = fresh_db().await;
+    let e = anyhow::anyhow!(
+        "error returned from database: (code: 11) database disk image is malformed"
+    )
+    .context("reading the PM sync outcome");
+
+    explain_outbox_failure(&pool, &e, &rendered(&e), "could not read the sync outcome").await;
+
+    let detail: String =
+        sqlx::query_scalar("SELECT detail FROM system_notices WHERE notice_id = ?")
+            .bind(meridian::notices::DB_CORRUPT)
+            .fetch_one(&pool)
+            .await
+            .unwrap();
+    assert!(
+        detail.contains("database disk image is malformed"),
+        "banner dropped the cause: {detail}"
+    );
+    assert!(
+        detail.contains("reading the PM sync outcome"),
+        "banner dropped the context: {detail}"
+    );
+}
+
+/// Any OTHER failure keeps its detail. Collapsing every error into a friendly
+/// message would hide a real fault behind "try again in a moment", which never
+/// resolves. It must also NOT raise the corruption banner - that would train the
+/// user to run `db repair` for faults it cannot fix.
+#[tokio::test]
+async fn other_failures_keep_their_detail() {
+    let pool = fresh_db().await;
+    let e = anyhow::anyhow!("database is locked");
+
+    let msg = explain_outbox_failure(&pool, &e, &rendered(&e), "could not queue the sync").await;
+
+    assert!(
+        msg.contains("database is locked"),
+        "detail was dropped: {msg}"
+    );
+    assert!(msg.starts_with("could not queue the sync"), "{msg}");
+    assert_eq!(corrupt_notices(&pool).await, 0, "a lock is not corruption");
+}
+
+/// A missing table that is NOT ours is somebody else's problem and must not be
+/// reported as a pending update - that would send the user to wait out an update
+/// that is already finished while the real fault goes unnamed.
+#[tokio::test]
+async fn a_different_missing_table_is_not_reported_as_an_update() {
+    let pool = fresh_db().await;
+    let e = anyhow::anyhow!("no such table: pm_tasks");
+
+    let msg = explain_outbox_failure(&pool, &e, &rendered(&e), "could not queue the sync").await;
+
+    assert!(msg.contains("pm_tasks"), "detail was dropped: {msg}");
+    assert!(!msg.contains("finishing an update"), "misattributed: {msg}");
+}
+
+/// The two call sites differ only in their fallback phrasing, and that phrasing is
+/// what the user reads when nothing more specific applies. Pinned so a refactor
+/// cannot silently make the outcome-read failure claim the write failed.
+#[tokio::test]
+async fn the_fallback_names_the_operation_that_actually_failed() {
+    let pool = fresh_db().await;
+    let e = anyhow::anyhow!("disk I/O error");
+
+    let read =
+        explain_outbox_failure(&pool, &e, &rendered(&e), "could not read the sync outcome").await;
+    let write = explain_outbox_failure(&pool, &e, &rendered(&e), "could not queue the sync").await;
+
+    assert!(
+        read.starts_with("could not read the sync outcome"),
+        "{read}"
+    );
+    assert!(write.starts_with("could not queue the sync"), "{write}");
+}
diff --git a/tray/src-tauri/src/db_pool.rs b/tray/src-tauri/src/db_pool.rs
deleted file mode 100644
index 3a2aef329..000000000
--- a/tray/src-tauri/src/db_pool.rs
+++ /dev/null
@@ -1,209 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! The tray's swappable `meridian.db` pool handle.
-//!
-//! Before this module, `meridian.db`'s pool was opened once at tray startup
-//! (`lib.rs`'s `open_existing_lazy` call) and handed to Tauri as bare
-//! `Option<meridian_core::SqlitePool>>` managed state - held for the tray
-//! process's ENTIRE lifetime, including across a daemon restart.
-//! `commands::daemon::reload_daemon` SIGHUPs the daemon (macOS: exits and
-//! relies on launchd, or in a dev session a human, to relaunch it) without the
-//! tray's own connection ever knowing a restart happened - so the tray's pool
-//! spans two different daemon process generations on the same file. That is
-//! the confirmed trigger of a real `meridian.db` corruption incident
-//! (2026-08-24): see PR #856, which fixed the daemon's shutdown to checkpoint
-//! the WAL and made the tray's own reads detect corruption immediately - both
-//! good independent hardening, but neither closes the actual gap.
-//!
-//! [`DbPool`] closes it: `reload_daemon` calls [`DbPool::close`] before
-//! signaling and [`DbPool::reopen`] once the new daemon process is confirmed
-//! up, so the tray never holds a connection spanning the boundary. Every
-//! other call site is unaffected - [`DbPool::get`] returns the exact same
-//! `Option<SqlitePool>` shape `State<Option<SqlitePool>>>::inner()` used to,
-//! just renamed, since "the pool might legitimately be absent right now" was
-//! already part of every caller's contract (a `None` during a first launch,
-//! before the daemon has created the file).
-//!
-//! # Who calls this
-//! - `lib.rs`'s setup hook constructs it and calls `app.manage`.
-//! - `commands::daemon::reload_daemon` calls `close`/`reopen` around the
-//!   signal - the one thing that could not be done through the old bare
-//!   `Option<SqlitePool>>` state.
-//! - Every dashboard/poll read that used to do
-//!   `let Some(pool) = pool.inner() else { ... }` now does the same against
-//!   `pool.get()`.
-
-use meridian_core::SqlitePool;
-use std::sync::{Arc, RwLock};
-
-/// Swappable handle to the tray's `meridian.db` pool, managed as Tauri state
-/// in place of a bare `Option<SqlitePool>>`.
-///
-/// `uri`/`key_hex` are remembered at construction so [`reopen`](Self::reopen)
-/// needs no arguments at its call site - `reload_daemon` has neither the DB
-/// path nor the encryption key on hand, only this handle.
-#[derive(Clone)]
-pub struct DbPool {
-    inner: Arc<RwLock<Option<SqlitePool>>>,
-    uri: String,
-    key_hex: Option<String>,
-}
-
-/// Manual, not derived: several call sites take `DbPool` as a `#[tauri::command]`
-/// parameter without `#[tracing::instrument(skip(...))]`, so a derived `Debug`
-/// would print `key_hex` — the raw SQLCipher key — into a span every time one
-/// of those commands runs. `key_hex.is_some()` is all any log ever needs.
-impl std::fmt::Debug for DbPool {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("DbPool")
-            .field("uri", &self.uri)
-            .field("key_set", &self.key_hex.is_some())
-            .finish()
-    }
-}
-
-impl DbPool {
-    pub fn new(pool: Option<SqlitePool>, uri: String, key_hex: Option<String>) -> Self {
-        Self {
-            inner: Arc::new(RwLock::new(pool)),
-            uri,
-            key_hex,
-        }
-    }
-
-    /// The pool, if one is currently open - `None` before the daemon has
-    /// created `meridian.db` yet, or during the brief window between
-    /// [`close`](Self::close) and [`reopen`](Self::reopen) around a daemon
-    /// restart. Cheap: `sqlx::SqlitePool` is itself `Arc`-backed, so this is
-    /// a shallow clone, not a new connection.
-    pub fn get(&self) -> Option<SqlitePool> {
-        self.inner.read().unwrap_or_else(|e| e.into_inner()).clone()
-    }
-
-    /// Close the pool and clear the handle. Called before signaling the
-    /// daemon to restart, so nothing on this side keeps a connection alive
-    /// spanning the old process's shutdown and the new one's startup - see
-    /// this module's header for the corruption this closes off. Every reader
-    /// sees `get() == None` for the duration and behaves exactly as it
-    /// already does on a cold start (empty defaults, no panic).
-    pub async fn close(&self) {
-        let taken = self.inner.write().unwrap_or_else(|e| e.into_inner()).take();
-        if let Some(pool) = taken {
-            pool.close().await;
-        }
-    }
-
-    /// Reopen against the same uri/key this handle was built with. Lazy,
-    /// matching the original startup open - see that call site's doc
-    /// (`lib.rs`) for why eager fails when `meridian.db` briefly does not
-    /// exist. Best-effort: a failure here is logged and leaves `get()`
-    /// returning `None`, same as any other reason the pool isn't open yet;
-    /// the daemon's own re-creation of the file on its next write heals it
-    /// exactly as a lazy pool always has.
-    pub async fn reopen(&self) {
-        match meridian_core::open_existing_lazy(&self.uri, self.key_hex.as_deref()).await {
-            Ok(pool) => {
-                *self.inner.write().unwrap_or_else(|e| e.into_inner()) = Some(pool);
-            }
-            Err(e) => {
-                tracing::error!(
-                    error = %e,
-                    "DbPool::reopen failed - meridian.db stays unavailable until the next reload or tray restart"
-                );
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    async fn migrated_db(dir: &std::path::Path) -> (String, meridian_core::SqlitePool) {
-        use sqlx::sqlite::{SqliteConnectOptions, SqlitePoolOptions};
-        use std::str::FromStr;
-
-        let path = dir.join("db_pool_test.db");
-        let uri = format!("sqlite://{}", path.display());
-        // `open_existing`/`open_existing_lazy` both set `create_if_missing(false)`
-        // (they assume the daemon already created the file) - a test fixture
-        // needs its own connect path to create one from scratch.
-        let opts = SqliteConnectOptions::from_str(&uri)
-            .unwrap()
-            .create_if_missing(true);
-        let pool = SqlitePoolOptions::new()
-            .connect_with(opts)
-            .await
-            .expect("create db");
-        sqlx::migrate!("../../src/migrations")
-            .run(&pool)
-            .await
-            .expect("migrate");
-        pool.close().await;
-        // Reopen through the same lazy path `DbPool` itself uses, so the
-        // handle under test behaves exactly like production.
-        let pool = meridian_core::open_existing_lazy(&uri, None)
-            .await
-            .expect("reopen lazily");
-        (uri, pool)
-    }
-
-    /// `get()` must return exactly what was passed to `new()`.
-    #[tokio::test]
-    async fn get_returns_the_pool_it_was_built_with() {
-        let dir = tempfile::tempdir().unwrap();
-        let (uri, pool) = migrated_db(dir.path()).await;
-        let handle = DbPool::new(Some(pool), uri, None);
-        assert!(handle.get().is_some());
-    }
-
-    /// A handle built with no pool (e.g. the DB isn't open yet) must behave
-    /// exactly like the old `None` state every caller already handles.
-    #[tokio::test]
-    async fn get_is_none_when_built_empty() {
-        let handle = DbPool::new(None, "sqlite://does-not-matter".to_string(), None);
-        assert!(handle.get().is_none());
-    }
-
-    /// The exact sequence `reload_daemon` runs: close, then a read in
-    /// between must see `None` (nothing races the daemon's restart), then
-    /// reopen brings a working pool back without needing to be told the URI
-    /// again.
-    #[tokio::test]
-    async fn close_then_reopen_restores_a_working_pool() {
-        let dir = tempfile::tempdir().unwrap();
-        let (uri, pool) = migrated_db(dir.path()).await;
-        let handle = DbPool::new(Some(pool), uri, None);
-
-        handle.close().await;
-        assert!(
-            handle.get().is_none(),
-            "a reader between close() and reopen() must see no pool, not a stale one"
-        );
-
-        handle.reopen().await;
-        let reopened = handle.get().expect("reopen must restore a pool");
-        // Prove it's a genuinely live connection, not just a non-None marker.
-        meridian_core::ping(&reopened)
-            .await
-            .expect("reopened pool must actually work");
-    }
-
-    /// `reopen` must not panic on failure, and must leave `get()` at `None`
-    /// rather than propagating the error - `reopen` is deliberately
-    /// best-effort (see its doc), the same shape as any other reason a lazy
-    /// pool isn't open yet. A missing/wrong-shaped file is NOT enough to
-    /// prove this (`open_existing_lazy` defers that check to first use, so
-    /// it would return `Ok` here regardless) - an invalid key is what
-    /// actually fails synchronously, at `validate_key_hex` inside
-    /// `open_existing_lazy` itself, before any connection is attempted.
-    #[tokio::test]
-    async fn reopen_failure_leaves_the_handle_empty_not_panicked() {
-        let handle = DbPool::new(
-            None,
-            "sqlite://does-not-matter".to_string(),
-            Some("not-valid-hex".to_string()),
-        );
-        handle.reopen().await;
-        assert!(handle.get().is_none());
-    }
-}
diff --git a/tray/src-tauri/src/db_pool/mod.rs b/tray/src-tauri/src/db_pool/mod.rs
new file mode 100644
index 000000000..2b5f8a0c4
--- /dev/null
+++ b/tray/src-tauri/src/db_pool/mod.rs
@@ -0,0 +1,342 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! The tray's swappable `meridian.db` pool handle.
+//!
+//! Before this module, `meridian.db`'s pool was opened once at tray startup
+//! (`lib.rs`'s `open_existing_lazy` call) and handed to Tauri as bare
+//! `Option<meridian_core::SqlitePool>>` managed state - held for the tray
+//! process's ENTIRE lifetime, including across a daemon restart.
+//! `commands::daemon::reload_daemon` SIGHUPs the daemon (macOS: exits and
+//! relies on launchd, or in a dev session a human, to relaunch it) without the
+//! tray's own connection ever knowing a restart happened - so the tray's pool
+//! spans two different daemon process generations on the same file. That is
+//! the confirmed trigger of a real `meridian.db` corruption incident
+//! (2026-08-24): see PR #856, which fixed the daemon's shutdown to checkpoint
+//! the WAL and made the tray's own reads detect corruption immediately - both
+//! good independent hardening, but neither closes the actual gap.
+//!
+//! [`DbPool`] closes it: `reload_daemon` calls [`DbPool::close`] before
+//! signaling and [`DbPool::reopen`] once the new daemon process is confirmed
+//! up, so the tray never holds a connection spanning the boundary. Every
+//! other call site is unaffected - [`DbPool::get`] returns the exact same
+//! `Option<SqlitePool>` shape `State<Option<SqlitePool>>>::inner()` used to,
+//! just renamed, since "the pool might legitimately be absent right now" was
+//! already part of every caller's contract (a `None` during a first launch,
+//! before the daemon has created the file).
+//!
+//! # Who calls this
+//! - `lib.rs`'s setup hook constructs it and calls `app.manage`.
+//! - `commands::daemon::reload_daemon` calls `close`/`reopen` around the
+//!   signal - the one thing that could not be done through the old bare
+//!   `Option<SqlitePool>>` state.
+//! - Every dashboard/poll read that used to do
+//!   `let Some(pool) = pool.inner() else { ... }` now does the same against
+//!   `pool.get()`.
+//! - Anything that touches this pool and can fail calls
+//!   [`raise_if_corrupt`] on the error - see that function's doc.
+
+use meridian_core::SqlitePool;
+use std::sync::{Arc, RwLock};
+use std::time::Instant;
+
+/// The managed [`DbPool`] handle, from an app handle.
+///
+/// For code that must reach the pool but is not a `#[tauri::command]` (so it
+/// cannot take `State<'_, DbPool>`): the capture consumers, the poll loop's
+/// guards, `resume_capture`.
+///
+/// # Take the HANDLE, never a pool snapshot
+///
+/// The point of returning `DbPool` rather than `Option<SqlitePool>` is that
+/// callers must resolve [`DbPool::get`] **at each use**. A long-lived task that
+/// clones the `SqlitePool` once and keeps it is the exact bug this exists to
+/// prevent: [`close`](DbPool::close) can only reach the pool inside this
+/// handle, so an escaped clone keeps its connections - and its WAL-index
+/// (`-shm`) mapping - alive across the daemon restart the close/reopen dance
+/// exists to fence off. Measured on 1.91.0-staging.2: the capture consumers
+/// held such a clone for the whole process lifetime and wrote through it every
+/// ~2.5 s, and after a reconnect-triggered daemon restart every write failed
+/// with `(code: 11) database disk image is malformed` **while the file itself
+/// was healthy** (`db check`: 40 tables clean) and reads kept succeeding. Only
+/// writes break, because reads can still be served from the main file while the
+/// WAL write path cannot.
+pub(crate) fn from_app(app: &tauri::AppHandle) -> Option<DbPool> {
+    use tauri::Manager;
+    app.try_state::<DbPool>().map(|s| s.inner().clone())
+}
+
+/// If `err` indicates `meridian.db` is corrupt, raise the SAME `db.corrupt`
+/// notice `main.rs`'s `etl_tick` raises on the daemon side - immediately,
+/// from whichever side of the app noticed first.
+///
+/// The daemon already had this covered for its own queries, but the tray holds
+/// its own independent, long-lived pool on the same file (opened once at
+/// startup, `lib.rs`'s `app.manage(db_pool)`) and touches different tables on
+/// its own cadence. In the incident this was written for, the tray's poll-loop
+/// reads hit `(code: 11) database disk image is malformed` a full 5+ minutes
+/// before any daemon-side query happened to touch the same damage - and until
+/// this function existed, that whole window was silent `tracing::warn!` noise
+/// with no banner, because nothing on this side of the process ever called
+/// `raise_typed`. Idempotent (`raise_typed` upserts), so calling it on every
+/// failing tick is safe and cheap - it does not need its own latch the way the
+/// daemon's ETL loop does, because a tick that keeps failing just keeps
+/// refreshing the same notice row rather than retrying a query with side
+/// effects.
+///
+/// # Why this lives here and not in `poll::refresh`
+///
+/// It started as a private helper wrapping that loop's four dashboard READS,
+/// which quietly made "the tray noticed corruption" mean "one of four specific
+/// reads noticed corruption". `commands::tasks`' PM-sync outbox writes are on
+/// this same pool and outside all of it, so on a staging machine whose
+/// `meridian.db` was damaged they were the only code to find the damage - and
+/// reported it as a raw SQL string in a settings panel, with no banner and no
+/// Repair button, because the three detectors that DO know what corruption
+/// means each had a scope that excluded them:
+///
+/// - `repair_boot`'s startup probe is skipped entirely while a daemon answers
+///   (its own comment defers to "the notice banner instead");
+/// - the daemon latches only when ITS queries reach a damaged page;
+/// - this helper only covered `poll::refresh`.
+///
+/// Living on the pool module is what lets any of them call it - both `poll` and
+/// `commands` already depend on this module for `DbPool` itself.
+///
+/// # Coverage is still partial - do not read this as an invariant
+///
+/// The rule this SHOULD enforce is "a failure on the tray's pool goes through
+/// here". It does not yet. Wired today: `poll::refresh`'s four reads and
+/// `commands::tasks`' two outbox queries. **Not** wired: `commands::dashboard`,
+/// which has ~24 `cmd_err!` sites reading `pm_tasks`, triage, week and
+/// coding-agent tables - so damage confined to those pages is still found
+/// without raising the banner.
+///
+/// That gap is narrower than it looks, because `poll::refresh` re-reads the
+/// active-session/today/worklogs tables every ~30 s and the daemon latches on
+/// its own ETL path, so most real damage is reached by something that does
+/// raise. It is not zero, though, and the honest statement is that this is a
+/// convention being adopted rather than one already held everywhere. Anything
+/// added here should also be added to those sites rather than assuming they are
+/// already covered.
+pub(crate) async fn raise_if_corrupt(pool: &SqlitePool, err: &anyhow::Error) {
+    if !meridian::db::integrity::is_corrupt_error(err) {
+        return;
+    }
+    let _ = meridian::notices::raise_typed(
+        pool,
+        meridian::notices::Notice {
+            id: meridian::notices::DB_CORRUPT,
+            severity: "error",
+            title: "Meridian's database is damaged",
+            // Full chain, not `err.to_string()` - same reasoning as
+            // `crate::cmd_err!`'s doc comment: `anyhow::Error`'s `Display`
+            // renders only the outermost `.context()` and would otherwise
+            // drop the SQLite code a reader needs.
+            detail: &format!("{err:#}"),
+            remedy: Some("Quit Meridian, then run 'meridian db repair' in a terminal"),
+            event_key: meridian::notices::DB_CORRUPT,
+            deep_link: Some(meridian_core::notifications::deep_links::LOGS),
+        },
+    )
+    .await;
+}
+
+/// Swappable handle to the tray's `meridian.db` pool, managed as Tauri state
+/// in place of a bare `Option<SqlitePool>>`.
+///
+/// `uri`/`key_hex` are remembered at construction so [`reopen`](Self::reopen)
+/// needs no arguments at its call site - `reload_daemon` has neither the DB
+/// path nor the encryption key on hand, only this handle.
+#[derive(Clone)]
+pub struct DbPool {
+    inner: Arc<RwLock<Option<SqlitePool>>>,
+    uri: String,
+    key_hex: Option<String>,
+    /// Serialises [`recover_if_corrupt`](Self::recover_if_corrupt) and remembers
+    /// when it last ran, so concurrent failing writers recycle the pool once
+    /// between them instead of each racing their own close/reopen.
+    recycle: Arc<tokio::sync::Mutex<Option<Instant>>>,
+}
+
+/// Minimum gap between two pool recycles.
+///
+/// Without it, a wedged pool would recycle on EVERY failing write - the capture
+/// consumers alone write every ~2.5 s - so a fault the recycle cannot fix (real
+/// file damage, a revoked key) would turn into a close/reopen storm on the file
+/// the daemon is also using. One attempt per window, then the banner and the
+/// error stand.
+const RECYCLE_COOLDOWN: std::time::Duration = std::time::Duration::from_secs(30);
+
+/// Ceiling on the close half of a recycle.
+///
+/// `SqlitePool::close` waits for checked-out connections to come back, and the
+/// whole reason we are here is that something is wrong with this pool. Bounded so
+/// a connection that never returns cannot hold the recycle lock - and therefore
+/// every future recovery attempt - forever. `close` clears the handle
+/// synchronously before it awaits, so a timeout still leaves `get()` at `None`
+/// and the reopen below still installs a fresh pool.
+const RECYCLE_CLOSE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(5);
+
+/// Manual, not derived: several call sites take `DbPool` as a `#[tauri::command]`
+/// parameter without `#[tracing::instrument(skip(...))]`, so a derived `Debug`
+/// would print `key_hex` — the raw SQLCipher key — into a span every time one
+/// of those commands runs. `key_hex.is_some()` is all any log ever needs.
+impl std::fmt::Debug for DbPool {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DbPool")
+            .field("uri", &self.uri)
+            .field("key_set", &self.key_hex.is_some())
+            .finish()
+    }
+}
+
+impl DbPool {
+    pub fn new(pool: Option<SqlitePool>, uri: String, key_hex: Option<String>) -> Self {
+        Self {
+            inner: Arc::new(RwLock::new(pool)),
+            uri,
+            key_hex,
+            recycle: Arc::new(tokio::sync::Mutex::new(None)),
+        }
+    }
+
+    /// Recover from a write that failed because this pool's view of the database is
+    /// broken: drop every connection and open a fresh pool. Returns whether the
+    /// caller now has a working pool and may retry.
+    ///
+    /// # Why the app must heal itself here
+    ///
+    /// On 1.91.0-staging.2 a reconnect-triggered daemon restart left the tray's
+    /// connections with a desynced WAL index (`-shm`). Reads kept working, every
+    /// write failed with `(code: 11) database disk image is malformed`, and `db
+    /// check` reported all 40 tables healthy - the data was never damaged, only this
+    /// process's bookkeeping. The only cure was quitting and relaunching the app,
+    /// which **no user has any way of knowing**. They just saw sync stop working.
+    ///
+    /// Closing and reopening the pool is what that relaunch did for the database
+    /// handle, so doing it here removes the need for the user to be told anything.
+    /// It is deliberately independent of *why* the view broke: the ordering fixes
+    /// that shipped alongside this close the mechanism we identified, but this is
+    /// what makes a mechanism we did NOT identify survivable rather than permanent.
+    ///
+    /// Non-corrupt errors return `false` immediately - a locked database or a
+    /// missing table must not trigger a reconnect.
+    ///
+    /// # Caller contract
+    ///
+    /// **Call this only after your query has returned**, never while holding a
+    /// connection from this pool. The close half waits for checked-out connections
+    /// to be returned, so a caller still holding one would wait on itself. Every
+    /// current caller is on an error path, where the connection is already back.
+    /// Exclusive access to this handle's close/reopen lifecycle.
+    ///
+    /// **Every close+reopen pair must hold this**, not just the recycle path.
+    /// `commands::daemon::reload_with_pool_cycle` had its own private lock, which
+    /// serialised reloads against each other but not against
+    /// [`recover_if_corrupt`](Self::recover_if_corrupt) - and interleaving those two
+    /// reintroduces the exact hazard the close/reopen dance exists to remove:
+    ///
+    /// 1. reload closes, handle is `None`;
+    /// 2. a recycle sees `None`, treats it as nothing to close, and REOPENS;
+    /// 3. reload then signals the daemon restart - with that fresh pool open
+    ///    across it.
+    ///
+    /// Step 3 is the 2026-08-24 corruption profile (a tray connection spanning two
+    /// daemon generations with no WAL checkpoint between them). The lock lives on the
+    /// handle rather than in either caller so a third close/reopen site cannot be
+    /// added without one.
+    ///
+    /// The guard's value is the last recycle instant, which is also what makes the
+    /// cooldown check-and-set atomic.
+    pub(crate) async fn lock_cycle(&self) -> tokio::sync::MutexGuard<'_, Option<Instant>> {
+        self.recycle.lock().await
+    }
+
+    pub(crate) async fn recover_if_corrupt(&self, err: &anyhow::Error) -> bool {
+        if !meridian::db::integrity::is_corrupt_error(err) {
+            return false;
+        }
+
+        // Held across the close/reopen on purpose: it serialises concurrent
+        // recyclers, excludes a `reload_daemon` cycle (see `lock_cycle`), and makes
+        // the cooldown check-and-set atomic.
+        let mut last = self.lock_cycle().await;
+        if let Some(at) = *last {
+            if at.elapsed() < RECYCLE_COOLDOWN {
+                tracing::debug!(
+                    "skipping meridian.db pool recycle - one ran less than {}s ago",
+                    RECYCLE_COOLDOWN.as_secs()
+                );
+                return false;
+            }
+        }
+        *last = Some(Instant::now());
+
+        tracing::warn!("recycling the meridian.db pool after a corrupt-view write failure");
+        if tokio::time::timeout(RECYCLE_CLOSE_TIMEOUT, self.close())
+            .await
+            .is_err()
+        {
+            // `close` already took the handle before awaiting, so this is safe to
+            // proceed through - the old pool is unreachable either way.
+            tracing::warn!(
+                timeout_s = RECYCLE_CLOSE_TIMEOUT.as_secs() as i64,
+                "pool close did not finish during recycle - reopening anyway"
+            );
+        }
+        self.reopen().await;
+
+        let recovered = self.get().is_some();
+        if recovered {
+            tracing::info!("meridian.db pool recycled - writes should work again");
+        } else {
+            tracing::warn!("meridian.db pool recycle did not yield a usable pool");
+        }
+        recovered
+    }
+
+    /// The pool, if one is currently open - `None` before the daemon has
+    /// created `meridian.db` yet, or during the brief window between
+    /// [`close`](Self::close) and [`reopen`](Self::reopen) around a daemon
+    /// restart. Cheap: `sqlx::SqlitePool` is itself `Arc`-backed, so this is
+    /// a shallow clone, not a new connection.
+    pub fn get(&self) -> Option<SqlitePool> {
+        self.inner.read().unwrap_or_else(|e| e.into_inner()).clone()
+    }
+
+    /// Close the pool and clear the handle. Called before signaling the
+    /// daemon to restart, so nothing on this side keeps a connection alive
+    /// spanning the old process's shutdown and the new one's startup - see
+    /// this module's header for the corruption this closes off. Every reader
+    /// sees `get() == None` for the duration and behaves exactly as it
+    /// already does on a cold start (empty defaults, no panic).
+    pub async fn close(&self) {
+        let taken = self.inner.write().unwrap_or_else(|e| e.into_inner()).take();
+        if let Some(pool) = taken {
+            pool.close().await;
+        }
+    }
+
+    /// Reopen against the same uri/key this handle was built with. Lazy,
+    /// matching the original startup open - see that call site's doc
+    /// (`lib.rs`) for why eager fails when `meridian.db` briefly does not
+    /// exist. Best-effort: a failure here is logged and leaves `get()`
+    /// returning `None`, same as any other reason the pool isn't open yet;
+    /// the daemon's own re-creation of the file on its next write heals it
+    /// exactly as a lazy pool always has.
+    pub async fn reopen(&self) {
+        match meridian_core::open_existing_lazy(&self.uri, self.key_hex.as_deref()).await {
+            Ok(pool) => {
+                *self.inner.write().unwrap_or_else(|e| e.into_inner()) = Some(pool);
+            }
+            Err(e) => {
+                tracing::error!(
+                    error = %e,
+                    "DbPool::reopen failed - meridian.db stays unavailable until the next reload or tray restart"
+                );
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/tray/src-tauri/src/db_pool/tests.rs b/tray/src-tauri/src/db_pool/tests.rs
new file mode 100644
index 000000000..d1b983f87
--- /dev/null
+++ b/tray/src-tauri/src/db_pool/tests.rs
@@ -0,0 +1,276 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Tests for the tray's swappable `meridian.db` pool handle.
+//!
+//! Split out of `mod.rs` for the 500-line file cap, following the same
+//! `{mod,tests}.rs` shape as `meridian-core/src/pm_sync_requests/` and
+//! `src/intelligence/providers/jira/`.
+
+use super::*;
+
+async fn migrated_db(dir: &std::path::Path) -> (String, meridian_core::SqlitePool) {
+    use sqlx::sqlite::{SqliteConnectOptions, SqlitePoolOptions};
+    use std::str::FromStr;
+
+    let path = dir.join("db_pool_test.db");
+    let uri = format!("sqlite://{}", path.display());
+    // `open_existing`/`open_existing_lazy` both set `create_if_missing(false)`
+    // (they assume the daemon already created the file) - a test fixture
+    // needs its own connect path to create one from scratch.
+    let opts = SqliteConnectOptions::from_str(&uri)
+        .unwrap()
+        .create_if_missing(true);
+    let pool = SqlitePoolOptions::new()
+        .connect_with(opts)
+        .await
+        .expect("create db");
+    sqlx::migrate!("../../src/migrations")
+        .run(&pool)
+        .await
+        .expect("migrate");
+    pool.close().await;
+    // Reopen through the same lazy path `DbPool` itself uses, so the
+    // handle under test behaves exactly like production.
+    let pool = meridian_core::open_existing_lazy(&uri, None)
+        .await
+        .expect("reopen lazily");
+    (uri, pool)
+}
+
+/// `get()` must return exactly what was passed to `new()`.
+#[tokio::test]
+async fn get_returns_the_pool_it_was_built_with() {
+    let dir = tempfile::tempdir().unwrap();
+    let (uri, pool) = migrated_db(dir.path()).await;
+    let handle = DbPool::new(Some(pool), uri, None);
+    assert!(handle.get().is_some());
+}
+
+/// A handle built with no pool (e.g. the DB isn't open yet) must behave
+/// exactly like the old `None` state every caller already handles.
+#[tokio::test]
+async fn get_is_none_when_built_empty() {
+    let handle = DbPool::new(None, "sqlite://does-not-matter".to_string(), None);
+    assert!(handle.get().is_none());
+}
+
+/// The exact sequence `reload_daemon` runs: close, then a read in
+/// between must see `None` (nothing races the daemon's restart), then
+/// reopen brings a working pool back without needing to be told the URI
+/// again.
+#[tokio::test]
+async fn close_then_reopen_restores_a_working_pool() {
+    let dir = tempfile::tempdir().unwrap();
+    let (uri, pool) = migrated_db(dir.path()).await;
+    let handle = DbPool::new(Some(pool), uri, None);
+
+    handle.close().await;
+    assert!(
+        handle.get().is_none(),
+        "a reader between close() and reopen() must see no pool, not a stale one"
+    );
+
+    handle.reopen().await;
+    let reopened = handle.get().expect("reopen must restore a pool");
+    // Prove it's a genuinely live connection, not just a non-None marker.
+    meridian_core::ping(&reopened)
+        .await
+        .expect("reopened pool must actually work");
+}
+
+/// **The regression test for the 1.91.0-staging.2 write wedge.**
+///
+/// A pool CLONE taken before `close()` is dead afterwards, while the handle
+/// keeps working across the same close/reopen. That is the entire difference
+/// between the old capture consumers (which cached
+/// `Option<SqlitePool>` for the process lifetime and wrote through it every
+/// ~2.5 s) and the current ones (which call `get()` per write).
+///
+/// Asserting on the clone is what makes this a real guard rather than a
+/// tautology: it proves the snapshot pattern is *observably* broken by a
+/// daemon reload, so re-introducing it anywhere cannot look harmless.
+#[tokio::test]
+async fn a_pool_snapshot_dies_across_a_reload_but_the_handle_survives() {
+    let dir = tempfile::tempdir().unwrap();
+    let (uri, pool) = migrated_db(dir.path()).await;
+    let handle = DbPool::new(Some(pool), uri, None);
+
+    // What a long-lived consumer used to cache at startup.
+    let snapshot = handle.get().expect("a pool to snapshot");
+    meridian_core::ping(&snapshot)
+        .await
+        .expect("the snapshot works before the reload");
+
+    // Exactly what `reload_daemon` does around every daemon restart.
+    handle.close().await;
+    handle.reopen().await;
+
+    assert!(
+        meridian_core::ping(&snapshot).await.is_err(),
+        "a cached SqlitePool must be observably dead after close/reopen - if this \
+         ever passes, the snapshot pattern looks safe and the capture wedge returns"
+    );
+
+    let fresh = handle.get().expect("the handle must still yield a pool");
+    meridian_core::ping(&fresh)
+        .await
+        .expect("resolving the handle per use must survive the reload");
+}
+
+fn corrupt_err() -> anyhow::Error {
+    anyhow::anyhow!("error returned from database: (code: 11) database disk image is malformed")
+        .context("writing a PM sync request")
+}
+
+/// The self-heal: a corrupt-VIEW write failure must give the caller a working
+/// pool back, with no user action.
+///
+/// This is what removes the relaunch. On 1.91.0-staging.2 a wedged pool stayed
+/// wedged for the life of the tray process, and quitting the app was the only
+/// cure - which no user could be expected to discover.
+#[tokio::test]
+async fn a_corrupt_write_recycles_the_pool_and_recovers() {
+    let dir = tempfile::tempdir().unwrap();
+    let (uri, pool) = migrated_db(dir.path()).await;
+    let handle = DbPool::new(Some(pool), uri, None);
+    let before = handle.get().expect("a pool");
+
+    assert!(
+        handle.recover_if_corrupt(&corrupt_err()).await,
+        "a corrupt write must report that recovery succeeded"
+    );
+
+    // The connections that held the broken view are gone...
+    assert!(
+        meridian_core::ping(&before).await.is_err(),
+        "the recycled pool's old connections must be dropped, not reused"
+    );
+    // ...and the caller can retry against a working one.
+    let after = handle.get().expect("a fresh pool after recycle");
+    meridian_core::ping(&after)
+        .await
+        .expect("the recycled pool must actually work");
+}
+
+/// Only corruption may recycle. A locked database, a missing table or a pending
+/// migration must leave the pool alone - dropping every connection on an ordinary
+/// transient error would turn a blip into an outage.
+#[tokio::test]
+async fn an_unrelated_error_does_not_recycle_the_pool() {
+    let dir = tempfile::tempdir().unwrap();
+    let (uri, pool) = migrated_db(dir.path()).await;
+    let handle = DbPool::new(Some(pool), uri, None);
+    let before = handle.get().expect("a pool");
+
+    let err = anyhow::anyhow!("database is locked").context("writing a PM sync request");
+    assert!(!handle.recover_if_corrupt(&err).await);
+
+    meridian_core::ping(&before)
+        .await
+        .expect("an unrelated error must leave the existing pool usable");
+}
+
+/// The cooldown. Capture writes every ~2.5 s, so a fault the recycle CANNOT fix
+/// (real file damage, a revoked key) would otherwise become a close/reopen storm
+/// on the file the daemon is also using.
+#[tokio::test]
+async fn a_second_corrupt_write_inside_the_cooldown_does_not_recycle_again() {
+    let dir = tempfile::tempdir().unwrap();
+    let (uri, pool) = migrated_db(dir.path()).await;
+    let handle = DbPool::new(Some(pool), uri, None);
+
+    assert!(handle.recover_if_corrupt(&corrupt_err()).await);
+    let after_first = handle.get().expect("a pool");
+
+    assert!(
+        !handle.recover_if_corrupt(&corrupt_err()).await,
+        "a second failure moments later must be refused, not recycled again"
+    );
+    meridian_core::ping(&after_first)
+        .await
+        .expect("the refused attempt must not have torn down the working pool");
+}
+
+/// In-memory, schema-migrated. Enough for [`raise_if_corrupt`], which only
+/// inspects the error it is handed and needs a `system_notices` table to
+/// write into - real corrupted bytes on disk are not required, and
+/// `sqlite::memory:` cannot be corrupted anyway (see
+/// `src/db/test_corrupt.rs` for fixtures that can).
+async fn fresh_db() -> SqlitePool {
+    use sqlx::sqlite::SqliteConnectOptions;
+    use std::str::FromStr;
+    let opts = SqliteConnectOptions::from_str("sqlite::memory:")
+        .unwrap()
+        .create_if_missing(true);
+    let pool = SqlitePool::connect_with(opts).await.unwrap();
+    sqlx::migrate!("../../src/migrations")
+        .run(&pool)
+        .await
+        .unwrap();
+    pool
+}
+
+/// Whichever side of the app touches this pool must raise `db.corrupt` the
+/// moment IT hits corruption, not wait for a daemon-side query to stumble
+/// onto the same damage minutes later. `db::integrity::is_corrupt_error`
+/// (the classifier this delegates to) is already pinned against the real
+/// field-incident shape elsewhere.
+#[tokio::test]
+async fn raise_if_corrupt_writes_the_notice_on_a_corrupt_error() {
+    let pool = fresh_db().await;
+    let err = anyhow::anyhow!(
+        "error returned from database: (code: 11) database disk image is malformed"
+    )
+    .context("current_task: fetch most recent task session");
+
+    raise_if_corrupt(&pool, &err).await;
+
+    let row: (String, String) =
+        sqlx::query_as("SELECT severity, detail FROM system_notices WHERE notice_id = ?")
+            .bind(meridian::notices::DB_CORRUPT)
+            .fetch_one(&pool)
+            .await
+            .expect("db.corrupt notice must be written");
+    assert_eq!(row.0, "error");
+    assert!(
+        row.1.contains("database disk image is malformed"),
+        "notice detail dropped the actual cause: {}",
+        row.1
+    );
+}
+
+/// Every other failure (a lock, a missing table, a network blip on an
+/// unrelated call) must NOT raise the corruption banner — that would train
+/// the user to run `db repair` for faults it can't fix.
+#[tokio::test]
+async fn raise_if_corrupt_is_silent_on_unrelated_errors() {
+    let pool = fresh_db().await;
+    let err = anyhow::anyhow!("database is locked").context("today: fetch sessions");
+
+    raise_if_corrupt(&pool, &err).await;
+
+    let count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM system_notices WHERE notice_id = ?")
+        .bind(meridian::notices::DB_CORRUPT)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+    assert_eq!(count, 0, "an unrelated error must not raise db.corrupt");
+}
+
+/// `reopen` must not panic on failure, and must leave `get()` at `None`
+/// rather than propagating the error - `reopen` is deliberately
+/// best-effort (see its doc), the same shape as any other reason a lazy
+/// pool isn't open yet. A missing/wrong-shaped file is NOT enough to
+/// prove this (`open_existing_lazy` defers that check to first use, so
+/// it would return `Ok` here regardless) - an invalid key is what
+/// actually fails synchronously, at `validate_key_hex` inside
+/// `open_existing_lazy` itself, before any connection is attempted.
+#[tokio::test]
+async fn reopen_failure_leaves_the_handle_empty_not_panicked() {
+    let handle = DbPool::new(
+        None,
+        "sqlite://does-not-matter".to_string(),
+        Some("not-valid-hex".to_string()),
+    );
+    handle.reopen().await;
+    assert!(handle.get().is_none());
+}
diff --git a/tray/src-tauri/src/lib.rs b/tray/src-tauri/src/lib.rs
index a7a621472..c0ab8446b 100644
--- a/tray/src-tauri/src/lib.rs
+++ b/tray/src-tauri/src/lib.rs
@@ -936,8 +936,10 @@ pub fn run() {
                     None,
                 ));
             }
-            #[cfg(feature = "capture")]
-            let capture_pool = db_setup_result;
+            // (No `capture_pool` binding here any more: `start_capture` takes the
+            // managed `DbPool` handle and resolves it per write, so the raw
+            // `Option<SqlitePool>` this used to carry across to it is exactly the
+            // snapshot that wedged capture writes after a daemon restart.)
 
             // Single source of truth for the tray menu lives in `tray.rs`, so the
             // poll loop's health-driven rebuild can't drift out of sync. Initial
@@ -1225,8 +1227,19 @@ pub fn run() {
             // that task, never the tray (we gave up the screenpipe daemon's process
             // isolation, so this matters). Frames → capture_frames (slice 4a),
             // input events → capture_ui_events (slice 3c).
+            // Pass the managed HANDLE, never `capture_pool` (the raw
+            // `Option<SqlitePool>` snapshot from setup) - see `start_capture`'s doc.
+            // Always `Some` by here: the fallback above registers an empty handle on
+            // the panic path, so this only skips capture if managed state is somehow
+            // absent entirely, which nothing else could work through either.
             #[cfg(feature = "capture")]
-            start_capture(app_state.clone(), capture_pool);
+            if let Some(db) = db_pool::from_app(app.handle()) {
+                start_capture(app_state.clone(), db);
+            } else {
+                tracing::error!(
+                    "capture not started - the DbPool handle is not managed, so nothing could persist frames"
+                );
+            }
 
             // Auto-open the setup wizard on first launch (no ~/.meridian/onboarded).
             // The 800 ms delay lets the tray menu settle before the window appears.
@@ -1653,9 +1666,23 @@ fn tray_debug(window: tauri::Window, msg: String) {
 /// Once from `lib.rs`'s `setup()` on launch, and again from
 /// `commands::pause_for_duration` on resume.
 #[cfg(feature = "capture")]
+/// Start (or restart) the in-process capture engine and its persisting consumers.
+///
+/// # `db` is the HANDLE, deliberately not a pool
+///
+/// The consumers below live for the whole tray process and write every ~2.5 s, so
+/// they must resolve [`db_pool::DbPool::get`] **per write** rather than caching a
+/// `SqlitePool`. This parameter used to be `Option<SqlitePool>` - a snapshot taken
+/// once at start - and that was the 1.91.0-staging.2 write-wedge: `DbPool::close`
+/// (run by `reload_daemon` around every daemon restart, precisely so the tray never
+/// holds a connection across one) cannot reach a clone that escaped the handle, so
+/// the capture connections spanned the daemon's shutdown WAL TRUNCATE checkpoint,
+/// desynced their `-shm` view, and every subsequent write failed with `(code: 11)
+/// database disk image is malformed` - permanently, on a database that was
+/// provably healthy. See [`db_pool::from_app`] for the measured detail.
 pub(crate) fn start_capture(
     app_state: std::sync::Arc<std::sync::Mutex<AppState>>,
-    pool: Option<meridian_core::SqlitePool>,
+    db: db_pool::DbPool,
 ) {
     use capture::{screenpipe::ScreenpipeEngine, CaptureEngine};
 
@@ -1729,7 +1756,10 @@ pub(crate) fn start_capture(
     // Handles both item shapes the engine can send — the primary per-tick frame
     // and secondary-monitor context samples (multi-screen capture) — through the
     // same ignore-list gate, routed to their own tables.
-    let consumer_pool = pool.clone();
+    // The HANDLE, cloned (cheap - `Arc`-backed). Every write below resolves
+    // `.get()` afresh, so a daemon-restart close/reopen is followed rather than
+    // outlived. Never hoist this into a `SqlitePool` outside the loop.
+    let consumer_pool = db.clone();
     let frame_ignore = capture_ignore.clone();
     tauri::async_runtime::spawn(async move {
         while let Some(item) = rx.recv().await {
@@ -1755,7 +1785,7 @@ pub(crate) fn start_capture(
                         );
                         continue;
                     }
-                    let Some(p) = consumer_pool.as_ref() else {
+                    let Some(p) = consumer_pool.get() else {
                         continue;
                     };
                     let row = meridian_core::CaptureFrameInsert {
@@ -1766,8 +1796,20 @@ pub(crate) fn start_capture(
                         text: frame.text,
                         text_source: frame.text_source.as_str().to_string(),
                     };
-                    if let Err(e) = meridian_core::insert_capture_frame(p, &row).await {
-                        tracing::warn!(error = %e, "capture: failed to persist frame");
+                    if let Err(e) = meridian_core::insert_capture_frame(&p, &row).await {
+                        // `cmd_err!`, not `%e`: this site logged only the outermost
+                        // context (`insert capture_frame`) and threw the cause away,
+                        // so a fleet-wide write wedge was undiagnosable from logs -
+                        // the same swallowed-cause bug `cmd_err!` was written for.
+                        let _ = crate::cmd_err!(e, "capture: failed to persist frame");
+                        // These writes land every ~2.5 s, which makes them both the
+                        // first thing on the machine to notice a broken pool view and
+                        // the natural place to heal it - so the app recovers within
+                        // seconds instead of waiting for a relaunch the user has no
+                        // reason to know about. No retry: the next frame is 2.5 s away
+                        // and will use the fresh pool.
+                        db_pool::raise_if_corrupt(&p, &e).await;
+                        consumer_pool.recover_if_corrupt(&e).await;
                     }
                 }
                 capture::CaptureItem::Secondary(sample) => {
@@ -1789,7 +1831,7 @@ pub(crate) fn start_capture(
                         );
                         continue;
                     }
-                    let Some(p) = consumer_pool.as_ref() else {
+                    let Some(p) = consumer_pool.get() else {
                         continue;
                     };
                     let row = meridian_core::CaptureSecondaryScreenInsert {
@@ -1799,8 +1841,13 @@ pub(crate) fn start_capture(
                         window_name: sample.window_name,
                         text: sample.text,
                     };
-                    if let Err(e) = meridian_core::insert_capture_secondary_screen(p, &row).await {
-                        tracing::warn!(error = %e, "capture: failed to persist secondary-screen sample");
+                    if let Err(e) = meridian_core::insert_capture_secondary_screen(&p, &row).await {
+                        let _ = crate::cmd_err!(
+                            e,
+                            "capture: failed to persist secondary-screen sample"
+                        );
+                        db_pool::raise_if_corrupt(&p, &e).await;
+                        consumer_pool.recover_if_corrupt(&e).await;
                     }
                 }
             }
@@ -1831,7 +1878,8 @@ pub(crate) fn start_capture(
     // UI event consumer: exits on cancel signal, which drops ui_rx, causing
     // the OS recorder thread to see tx.is_closed() within 500ms and exit.
     let (ui_tx, mut ui_rx) = tokio::sync::mpsc::channel::<meridian_core::CaptureUiEventInsert>(256);
-    let ui_pool = pool;
+    // The handle, not a pool - same reason as `consumer_pool` above.
+    let ui_pool = db;
     let ui_ignore = capture_ignore;
     tauri::async_runtime::spawn(async move {
         loop {
@@ -1845,9 +1893,11 @@ pub(crate) fn start_capture(
                     if ui_ignore.lock().unwrap().should_drop_app(ev.app_name.as_deref()) {
                         continue;
                     }
-                    let Some(p) = ui_pool.as_ref() else { continue };
-                    if let Err(e) = meridian_core::insert_capture_ui_event(p, &ev).await {
-                        tracing::warn!(error = %e, "capture: failed to persist ui event");
+                    let Some(p) = ui_pool.get() else { continue };
+                    if let Err(e) = meridian_core::insert_capture_ui_event(&p, &ev).await {
+                        let _ = crate::cmd_err!(e, "capture: failed to persist ui event");
+                        db_pool::raise_if_corrupt(&p, &e).await;
+                        ui_pool.recover_if_corrupt(&e).await;
                     }
                 }
             }
@@ -1882,3 +1932,50 @@ pub(crate) fn start_capture(
     s.ui_recorder_thread = Some(ui_recorder_thread);
     tracing::info!("capture: engine and ui recorder started");
 }
+
+#[cfg(test)]
+mod capture_pool_lifetime_tests {
+    /// The capture consumers must resolve the pool PER WRITE, never cache one.
+    ///
+    /// `start_capture` spawns three consumers that live for the whole tray
+    /// process and write every ~2.5 s. Until 1.91.0-staging.2 they captured
+    /// `Option<SqlitePool>` once at start, which `DbPool::close` (run by
+    /// `reload_daemon` around every daemon restart) cannot reach — so those
+    /// connections spanned the daemon's shutdown WAL TRUNCATE checkpoint,
+    /// desynced their `-shm` view, and every write from then on failed with
+    /// `(code: 11) database disk image is malformed` on a database that `db
+    /// check` reported healthy. Reads kept working, which is why it read as
+    /// corruption rather than as a connection bug.
+    ///
+    /// `a_pool_snapshot_dies_across_a_reload_but_the_handle_survives` in
+    /// `db_pool` proves the snapshot is dead after a reload; this proves these
+    /// particular call sites don't take one. It scans the source because the
+    /// consumers need a live tray app, an OS capture engine and a real daemon
+    /// restart to exercise — the same reason `main.rs`'s startup/shutdown
+    /// ordering tests scan rather than execute.
+    #[test]
+    fn capture_consumers_resolve_the_pool_per_write() {
+        const SRC: &str = include_str!("lib.rs");
+        let prod = SRC
+            .split_once("\n#[cfg(test)]\nmod capture_pool_lifetime_tests")
+            .map_or(SRC, |(before, _)| before);
+
+        for cached in ["let consumer_pool = pool.clone();", "let ui_pool = pool;"] {
+            assert!(
+                !prod.contains(cached),
+                "`{cached}` caches a SqlitePool for the capture consumers' whole \
+                 lifetime. Pass the `DbPool` handle and call `.get()` inside the \
+                 write loop instead - see `start_capture`'s doc for the wedge this \
+                 caused."
+            );
+        }
+
+        let handle_sites =
+            prod.matches("consumer_pool.get()").count() + prod.matches("ui_pool.get()").count();
+        assert_eq!(
+            handle_sites, 3,
+            "expected all 3 capture write sites (frame, secondary-screen, ui event) \
+             to resolve the handle per write, found {handle_sites}"
+        );
+    }
+}
diff --git a/tray/src-tauri/src/poll/mod.rs b/tray/src-tauri/src/poll/mod.rs
index 938218519..922842a77 100644
--- a/tray/src-tauri/src/poll/mod.rs
+++ b/tray/src-tauri/src/poll/mod.rs
@@ -116,7 +116,7 @@ pub async fn run_poll_loop(app: tauri::AppHandle, state: Arc<Mutex<AppState>>) {
         // check_disk_space's doc comment for why writing into a nearly-full
         // disk must stop rather than degrade silently.
         if let Some(pool) = &pool {
-            check_disk_space(&state, pool).await;
+            check_disk_space(&app, &state, pool).await;
         }
         // Work-hours schedule enforcement: auto-pause capture outside the
         // configured window, auto-resume when entering it. Only fires when the
@@ -217,7 +217,11 @@ fn update_tray_icon(app: &tauri::AppHandle, state: &Arc<Mutex<AppState>>) {
 /// timer) is separately gated in [`crate::commands::pause::resume_capture`],
 /// so a still-low disk can't be resumed into from any direction — this
 /// function only owns the disk-low pause's own start/end transition.
-async fn check_disk_space(state: &Arc<Mutex<AppState>>, pool: &meridian_core::SqlitePool) {
+async fn check_disk_space(
+    app: &tauri::AppHandle,
+    state: &Arc<Mutex<AppState>>,
+    pool: &meridian_core::SqlitePool,
+) {
     let low = meridian::health::platform::meridian_data_low_gb().is_some();
 
     let (pause_source, started_at, capture_paused_flag) = {
@@ -341,8 +345,11 @@ async fn check_disk_space(state: &Arc<Mutex<AppState>>, pool: &meridian_core::Sq
             // rare blip (engine starts and stops within the same tick,
             // capturing nothing) rather than a bug worth cross-checking
             // schedule state here too.
+            // The managed handle, not `pool` - see `start_capture`'s doc.
             #[cfg(feature = "capture")]
-            crate::start_capture(state.clone(), Some(pool.clone()));
+            if let Some(db) = crate::db_pool::from_app(app) {
+                crate::start_capture(state.clone(), db);
+            }
             tracing::info!(duration_s, "disk-space guard: capture resumed");
         }
         _ => {
@@ -438,9 +445,12 @@ async fn check_work_hours(
                 s.schedule_resume_at = None;
                 s.pause_until = None;
             }
-            // Restart engine so screen recording resumes.
+            // Restart engine so screen recording resumes. The managed handle, not
+            // `pool` - see `start_capture`'s doc.
             #[cfg(feature = "capture")]
-            crate::start_capture(state.clone(), Some(pool.clone()));
+            if let Some(db) = crate::db_pool::from_app(app) {
+                crate::start_capture(state.clone(), db);
+            }
             tracing::info!(
                 duration_s,
                 "work-hours: schedule pause ended — capture resumed"
diff --git a/tray/src-tauri/src/poll/refresh.rs b/tray/src-tauri/src/poll/refresh.rs
index 50ddccee4..cc0e6f424 100644
--- a/tray/src-tauri/src/poll/refresh.rs
+++ b/tray/src-tauri/src/poll/refresh.rs
@@ -392,47 +392,6 @@ fn decide_health_notice(
     }
 }
 
-/// If `err` indicates `meridian.db` is corrupt, raise the SAME `db.corrupt`
-/// notice `main.rs`'s `etl_tick` raises on the daemon side - immediately,
-/// from whichever side of the app noticed first.
-///
-/// The daemon already had this covered for its own queries, but the tray
-/// holds its own independent, long-lived pool on the same file (opened once
-/// at startup, `lib.rs`'s `app.manage(db_pool)`) and reads different tables
-/// on this loop's faster (~30 s) cadence than the daemon's ETL/summariser
-/// ticks. In the incident this fixes, the tray's own reads here hit
-/// `(code: 11) database disk image is malformed` a full 5+ minutes before any
-/// daemon-side query happened to touch the same damage - and until this
-/// function existed, that whole window was silent `tracing::warn!` noise with
-/// no banner, because nothing on this side of the process ever called
-/// `raise_typed`. Idempotent (`raise_typed` upserts), so calling this on
-/// every failing tick is safe and cheap - it does not need its own latch the
-/// way the daemon's ETL loop does, because a poll tick that keeps failing
-/// just keeps refreshing the same notice row rather than retrying a query
-/// with side effects.
-async fn raise_if_corrupt(pool: &SqlitePool, err: &anyhow::Error) {
-    if !meridian::db::integrity::is_corrupt_error(err) {
-        return;
-    }
-    let _ = meridian::notices::raise_typed(
-        pool,
-        meridian::notices::Notice {
-            id: meridian::notices::DB_CORRUPT,
-            severity: "error",
-            title: "Meridian's database is damaged",
-            // Full chain, not `err.to_string()` - same reasoning as
-            // `crate::cmd_err!`'s doc comment: `anyhow::Error`'s `Display`
-            // renders only the outermost `.context()` and would otherwise
-            // drop the SQLite code a reader needs.
-            detail: &format!("{err:#}"),
-            remedy: Some("Quit Meridian, then run 'meridian db repair' in a terminal"),
-            event_key: meridian::notices::DB_CORRUPT,
-            deep_link: Some(meridian_core::notifications::deep_links::LOGS),
-        },
-    )
-    .await;
-}
-
 /// Read the active session (direct DB) and store the app name + elapsed seconds.
 /// On a read error we keep the previous value rather than clearing the pill on a
 /// transient blip.
@@ -453,7 +412,7 @@ pub(super) async fn refresh_active(pool: &SqlitePool, state: &Arc<Mutex<AppState
             // drop exactly the cause (e.g. a corrupt DB's SQLite code) that a
             // reader needs.
             tracing::warn!(error = %meridian::errors::chain(&e), "refresh_active failed");
-            raise_if_corrupt(pool, &e).await;
+            crate::db_pool::raise_if_corrupt(pool, &e).await;
             return;
         }
     };
@@ -493,7 +452,7 @@ pub(super) async fn refresh_current_task(pool: &SqlitePool, state: &Arc<Mutex<Ap
         }
         Err(e) => {
             tracing::warn!(error = %meridian::errors::chain(&e), "refresh_current_task failed");
-            raise_if_corrupt(pool, &e).await;
+            crate::db_pool::raise_if_corrupt(pool, &e).await;
         }
     }
 }
@@ -548,7 +507,7 @@ pub(super) async fn refresh_today(pool: &SqlitePool, state: &Arc<Mutex<AppState>
         }
         Err(e) => {
             tracing::warn!(error = %meridian::errors::chain(&e), "refresh_today failed");
-            raise_if_corrupt(pool, &e).await;
+            crate::db_pool::raise_if_corrupt(pool, &e).await;
         }
     }
 }
@@ -583,7 +542,7 @@ pub(super) async fn refresh_worklogs(pool: &SqlitePool, state: &Arc<Mutex<AppSta
         }
         Err(e) => {
             tracing::warn!(error = %meridian::errors::chain(&e), "refresh_worklogs failed");
-            raise_if_corrupt(pool, &e).await;
+            crate::db_pool::raise_if_corrupt(pool, &e).await;
         }
     }
 }
@@ -995,54 +954,8 @@ mod tests {
         assert!(!recovered.reconcile_stale);
     }
 
-    /// The tray's own reads must raise `db.corrupt` the moment THEY hit
-    /// corruption, not wait for a daemon-side query to stumble onto the same
-    /// damage minutes later — the gap this fix closes. Real corrupted bytes on
-    /// disk aren't needed: `raise_if_corrupt` only inspects the error, and
-    /// `db::integrity::is_corrupt_error` (the classifier it delegates to) is
-    /// already pinned against the real field-incident shape elsewhere.
-    #[tokio::test]
-    async fn raise_if_corrupt_writes_the_notice_on_a_corrupt_error() {
-        let pool = fresh_db().await;
-        let err = anyhow::anyhow!(
-            "error returned from database: (code: 11) database disk image is malformed"
-        )
-        .context("current_task: fetch most recent task session");
-
-        raise_if_corrupt(&pool, &err).await;
-
-        let row: (String, String) =
-            sqlx::query_as("SELECT severity, detail FROM system_notices WHERE notice_id = ?")
-                .bind(meridian::notices::DB_CORRUPT)
-                .fetch_one(&pool)
-                .await
-                .expect("db.corrupt notice must be written");
-        assert_eq!(row.0, "error");
-        assert!(
-            row.1.contains("database disk image is malformed"),
-            "notice detail dropped the actual cause: {}",
-            row.1
-        );
-    }
-
-    /// Every other read failure (a lock, a missing table, a network blip on an
-    /// unrelated call) must NOT raise the corruption banner — that would train
-    /// the user to run `db repair` for faults it can't fix.
-    #[tokio::test]
-    async fn raise_if_corrupt_is_silent_on_unrelated_errors() {
-        let pool = fresh_db().await;
-        let err = anyhow::anyhow!("database is locked").context("today: fetch sessions");
-
-        raise_if_corrupt(&pool, &err).await;
-
-        let count: i64 =
-            sqlx::query_scalar("SELECT COUNT(*) FROM system_notices WHERE notice_id = ?")
-                .bind(meridian::notices::DB_CORRUPT)
-                .fetch_one(&pool)
-                .await
-                .unwrap();
-        assert_eq!(count, 0, "an unrelated error must not raise db.corrupt");
-    }
+    // `raise_if_corrupt`'s own tests moved with it to `crate::db_pool`, which
+    // is where the four call sites above now point.
 
     async fn fresh_db() -> meridian_core::SqlitePool {
         use sqlx::sqlite::SqliteConnectOptions;

From 7b13f6df098d6e8a911fb3dc08ac1f0452fcfd87 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Thu, 27 Aug 2026 00:06:31 +0530
Subject: [PATCH 18/53] Revert "Merge pull request #910 from
 Meridiona/fix/pm-sync-outcome-and-pool-lifetime"

This reverts commit d6befe402ba93daed346e6481cd3ebafc6c22825, reversing
changes made to a6ee29697cac5d63b0ca1c2aa0c710b386a4ff86.
---
 meridian-core/src/pm_sync_requests/mod.rs     | 267 +++-----------
 meridian-core/src/pm_sync_requests/tests.rs   | 244 ++-----------
 src/intelligence/sync_delegate.rs             |  64 ++--
 src/intelligence/sync_requests.rs             |  37 +-
 src/main.rs                                   | 121 +------
 src/migrations/083_pm_sync_request_seq.sql    |  35 --
 tray/src-tauri/src/commands/daemon.rs         |  48 ---
 tray/src-tauri/src/commands/integrations.rs   |  18 +-
 tray/src-tauri/src/commands/pause.rs          |   8 +-
 .../src/commands/{tasks/mod.rs => tasks.rs}   | 289 +++++----------
 tray/src-tauri/src/commands/tasks/tests.rs    | 162 ---------
 tray/src-tauri/src/db_pool.rs                 | 209 +++++++++++
 tray/src-tauri/src/db_pool/mod.rs             | 342 ------------------
 tray/src-tauri/src/db_pool/tests.rs           | 276 --------------
 tray/src-tauri/src/lib.rs                     | 127 +------
 tray/src-tauri/src/poll/mod.rs                |  20 +-
 tray/src-tauri/src/poll/refresh.rs            |  99 ++++-
 17 files changed, 543 insertions(+), 1823 deletions(-)
 delete mode 100644 src/migrations/083_pm_sync_request_seq.sql
 rename tray/src-tauri/src/commands/{tasks/mod.rs => tasks.rs} (54%)
 delete mode 100644 tray/src-tauri/src/commands/tasks/tests.rs
 create mode 100644 tray/src-tauri/src/db_pool.rs
 delete mode 100644 tray/src-tauri/src/db_pool/mod.rs
 delete mode 100644 tray/src-tauri/src/db_pool/tests.rs

diff --git a/meridian-core/src/pm_sync_requests/mod.rs b/meridian-core/src/pm_sync_requests/mod.rs
index 8bc72cbb0..ed070c6b5 100644
--- a/meridian-core/src/pm_sync_requests/mod.rs
+++ b/meridian-core/src/pm_sync_requests/mod.rs
@@ -74,20 +74,8 @@ pub struct SyncRequest {
     pub provider: String,
     pub mode: SyncMode,
     pub reason: String,
-    /// The sequence number this claim covers - pass it back to [`complete`].
-    ///
-    /// Captured at claim time on purpose: a request arriving DURING the sync bumps
-    /// `seq` past this value, so it stays pending and gets its own sync rather than
-    /// being silently marked done by work that started before it was asked for.
-    pub seq: i64,
 }
 
-// Every query below spells "nothing has completed yet" as
-// `COALESCE(completed_seq, 0)` and "pending" as `seq > COALESCE(completed_seq, 0)`.
-// `seq` starts at 1, so 0 is unreachable as a real watermark. It lives inline in the
-// SQL rather than as a Rust constant because it cannot be interpolated into a query
-// string without giving up the compile-time-checked literal.
-
 /// Ask the daemon to sync PM tasks. Idempotent and coalescing: repeated calls
 /// collapse into the single pending row rather than queueing, so opening the
 /// dashboard ten times means "a sync is wanted", not ten syncs.
@@ -95,25 +83,10 @@ pub struct SyncRequest {
 /// `mode` **escalates only**. A `Force` landing on a pending `Gated` upgrades it,
 /// because a user who just connected a tracker must not have that downgraded by a
 /// passing window focus; a `Gated` landing on a pending `Force` leaves the `Force`
-/// intact.
-///
-/// # Returns the sequence number to wait on
-///
-/// Pass the returned `seq` to [`outcome`]. It is what makes concurrent producers
-/// safe, and it replaces the previous design where a new request cleared the
-/// completion stamps outright.
+/// intact. Writing a new request also clears any previous completion stamps, so the
+/// row unambiguously represents work still to do.
 ///
-/// Clearing them looked right - the row should represent work still to do - but it
-/// destroyed the *answer* to a request already in flight, and the tracker-connect
-/// flow always has several in flight at once (`oauth_connected`,
-/// `token_connected`, and the user's own "Sync now", within a few seconds). The
-/// completion of an earlier sync then matched nothing, the work was redone, and
-/// every waiter timed out reporting failure for a sync that had in fact succeeded.
-///
-/// So completion is now a **watermark**, never cleared: this only bumps `seq` and
-/// re-opens the claim. A holder of seq N is satisfied by any `completed_seq >= N`.
-///
-/// `reason` is a producer tag for tracing only (`"plan_or_picker"`,
+/// `reason` is a producer tag for tracing only (`"dashboard_open"`,
 /// `"token_connected"`). Never pass user content - it is read back into logs.
 #[tracing::instrument(skip(pool))]
 pub async fn request(
@@ -121,165 +94,84 @@ pub async fn request(
     provider: &str,
     mode: SyncMode,
     reason: &str,
-) -> Result<i64> {
-    // A transaction, not `RETURNING`: the upsert and the read-back of `seq` must be
-    // atomic (a concurrent producer bumping `seq` in between would hand this caller
-    // a number it never wrote, making it wait on somebody else's sync), and
-    // `RETURNING` on an upsert needs SQLite 3.35+, which is not worth depending on
-    // when the SQLCipher build is the thing supplying the library.
-    let mut tx = pool
-        .begin()
-        .await
-        .context("opening a PM sync request transaction")?;
-
+) -> Result<()> {
     sqlx::query(
         "INSERT INTO pm_sync_requests
-             (provider, mode, reason, requested_at,
-              claimed_at, completed_at, error, synced_count, seq, completed_seq)
-         VALUES (?, ?, ?, strftime('%Y-%m-%dT%H:%M:%SZ', 'now'),
-              NULL, NULL, NULL, NULL, 1, NULL)
+             (provider, mode, reason, requested_at, claimed_at, completed_at, error, synced_count)
+         VALUES (?, ?, ?, strftime('%Y-%m-%dT%H:%M:%SZ', 'now'), NULL, NULL, NULL, NULL)
          ON CONFLICT(provider) DO UPDATE SET
-             -- The whole point: a new request is a new sequence number, so the
-             -- outcome of whatever is already running stays attributable to it.
-             seq = pm_sync_requests.seq + 1,
              -- Escalate to 'force', never back down from it while still pending.
              --
-             -- The pendingness half is load-bearing: the row is kept after a sync
-             -- finishes (so \"Sync now\" can read its result), so without it a SPENT
-             -- 'force' would be inherited forever and every later gated request would
-             -- silently escalate. One tracker connect would then make every planner
-             -- open bypass the staleness gate and hit the provider for real -
+             -- The `completed_at IS NULL` half is load-bearing: the row is kept after a
+             -- sync finishes (so \"Sync now\" can read its result), so without it a
+             -- SPENT 'force' would be inherited forever and every later gated request
+             -- would silently escalate. One tracker connect would then make every
+             -- planner open bypass the staleness gate and hit the provider for real -
              -- reinstating the constant polling this whole design removes, and
              -- multiplying exactly the token refreshes it exists to reduce.
              mode = CASE
                  WHEN excluded.mode = 'force'
                    OR (pm_sync_requests.mode = 'force'
-                       AND pm_sync_requests.seq > COALESCE(pm_sync_requests.completed_seq, 0))
+                       AND pm_sync_requests.completed_at IS NULL)
                       THEN 'force'
                  ELSE excluded.mode
              END,
              reason       = excluded.reason,
              requested_at = excluded.requested_at,
-             -- Re-open the claim so the watcher sees pending work, but do NOT touch
-             -- completed_at / completed_seq / error / synced_count: those describe
-             -- the last sync that actually ran, and erasing them is what lost
-             -- outcomes. `seq` above is what marks this as new work.
-             claimed_at   = NULL",
+             -- A fresh request re-opens the row: drop the in-flight and completion
+             -- marks so the watcher sees pending work again.
+             claimed_at   = NULL,
+             completed_at = NULL,
+             error        = NULL,
+             synced_count = NULL",
     )
     .bind(provider)
     .bind(mode.as_str())
     .bind(reason)
-    .execute(&mut *tx)
+    .execute(pool)
     .await
     .context("writing a PM sync request")?;
-
-    let seq: i64 = sqlx::query_scalar("SELECT seq FROM pm_sync_requests WHERE provider = ?")
-        .bind(provider)
-        .fetch_one(&mut *tx)
-        .await
-        .context("reading back the PM sync request sequence")?;
-
-    tx.commit().await.context("committing a PM sync request")?;
-
-    tracing::debug!(
-        provider,
-        mode = mode.as_str(),
-        reason,
-        seq,
-        "PM sync requested"
-    );
-    Ok(seq)
-}
-
-/// Is there work to claim? A pure READ, so an idle consumer touches no locks.
-///
-/// # Why this exists rather than just calling [`claim`]
-///
-/// [`claim`] is an `UPDATE`, and SQLite opens a write transaction and takes a
-/// RESERVED lock to evaluate one even when it matches no rows. The daemon's watcher
-/// ticks every 2 s forever, so calling `claim` unconditionally meant **~43,000 write
-/// transactions a day on an idle machine** - work that did not exist before this
-/// outbox, on a file a second process also writes. Worse than the cost: it made
-/// every daemon kill far more likely to land while a write transaction was open,
-/// which is the profile behind the `-shm` desync that wedged writes on
-/// 1.91.0-staging.2 with `(code: 11) database disk image is malformed` on a database
-/// that was provably healthy.
-///
-/// Gating on this read takes an idle daemon's write load to zero. WAL readers do not
-/// take the write lock, so a tick that finds nothing is genuinely free.
-///
-/// **Advisory only.** A `true` here can go stale before [`claim`] runs, and that is
-/// fine: `claim` is still the conditional `UPDATE` that decides, so exclusivity is
-/// unchanged and a lost race just yields `None`. A `false` that was wrong costs one
-/// tick of latency.
-pub async fn has_pending(pool: &SqlitePool, provider: &str) -> Result<bool> {
-    let found: Option<i64> = sqlx::query_scalar(
-        "SELECT 1 FROM pm_sync_requests
-          WHERE provider = ?
-            AND claimed_at IS NULL
-            AND seq > COALESCE(completed_seq, 0)",
-    )
-    .bind(provider)
-    .fetch_optional(pool)
-    .await
-    .context("checking for a pending PM sync request")?;
-    Ok(found.is_some())
+    tracing::debug!(provider, mode = mode.as_str(), reason, "PM sync requested");
+    Ok(())
 }
 
 /// Claim the pending request for `provider`, if there is one, marking it in-flight
 /// so a second watcher tick can't pick up the same work.
 ///
-/// The claim is a conditional UPDATE (`WHERE claimed_at IS NULL AND <pending>`)
-/// rather than a read-then-write, so two daemons racing on the same file - which the
-/// single-instance guard makes unlikely but not impossible during a restart overlap -
-/// cannot both claim it. SQLite serialises the statement, so exactly one sees a
-/// non-zero `rows_affected`.
-///
-/// Pending is `seq > COALESCE(completed_seq, 0)`, not `completed_at IS NULL`: the
-/// completion stamps are a watermark now and are never cleared, so the only thing
-/// that makes a row claimable again is [`request`] bumping `seq` past it.
-///
-/// Reads `seq` back inside the same transaction as the claim, so the value handed to
-/// [`complete`] is exactly the one this claim covers even if a producer bumps it a
-/// microsecond later.
+/// The claim is a conditional UPDATE (`WHERE claimed_at IS NULL AND completed_at IS
+/// NULL`) rather than a read-then-write, so two daemons racing on the same file -
+/// which the single-instance guard makes unlikely but not impossible during a
+/// restart overlap - cannot both claim it. SQLite serialises the statement, so
+/// exactly one sees a non-zero `rows_affected`.
 #[tracing::instrument(skip(pool))]
 pub async fn claim(pool: &SqlitePool, provider: &str) -> Result<Option<SyncRequest>> {
-    let mut tx = pool
-        .begin()
-        .await
-        .context("opening a PM sync claim transaction")?;
-
     let claimed = sqlx::query(
         "UPDATE pm_sync_requests
             SET claimed_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
           WHERE provider = ?
             AND claimed_at IS NULL
-            AND seq > COALESCE(completed_seq, 0)",
+            AND completed_at IS NULL",
     )
     .bind(provider)
-    .execute(&mut *tx)
+    .execute(pool)
     .await
     .context("claiming a PM sync request")?;
 
     if claimed.rows_affected() == 0 {
-        // Nothing to do - roll back rather than commit an empty transaction.
         return Ok(None);
     }
 
-    let row: Option<(String, String, i64)> =
-        sqlx::query_as("SELECT mode, reason, seq FROM pm_sync_requests WHERE provider = ?")
+    let row: Option<(String, String)> =
+        sqlx::query_as("SELECT mode, reason FROM pm_sync_requests WHERE provider = ?")
             .bind(provider)
-            .fetch_optional(&mut *tx)
+            .fetch_optional(pool)
             .await
             .context("reading the claimed PM sync request")?;
 
-    tx.commit().await.context("committing a PM sync claim")?;
-
-    Ok(row.map(|(mode, reason, seq)| SyncRequest {
+    Ok(row.map(|(mode, reason)| SyncRequest {
         provider: provider.to_string(),
         mode: SyncMode::from_str_or_gated(&mode),
         reason,
-        seq,
     }))
 }
 
@@ -287,65 +179,35 @@ pub async fn claim(pool: &SqlitePool, provider: &str) -> Result<Option<SyncReque
 /// rather than deleted so `"Sync now"` can read a real result without holding the
 /// credential, and so support has a content-free view of the last attempt.
 ///
-/// `seq` is the value from the [`SyncRequest`] this call is reporting on. It records
-/// the watermark, and it is also the guard.
-///
-/// # Why the guard is the sequence and NOT `claimed_at`
-///
-/// It used to be `claimed_at IS NOT NULL AND completed_at IS NULL`, chosen because
-/// [`request`] nulled `claimed_at` and so a request arriving mid-sync would make this
-/// UPDATE match nothing - deliberately, to stop an older sync's outcome marking a
-/// newer request as done.
-///
-/// The intent was right and the mechanism was a data-loss bug. Discarding the write
-/// also discarded the answer the *original* waiter was polling for, and since
-/// tracker-connect fires several requests seconds apart, that was the normal case
-/// rather than the edge one: the sync succeeded, the outcome was dropped, the work
-/// was repeated, and the user was shown a failure.
-///
-/// Guarding on `seq > COALESCE(completed_seq, 0)` keeps the protection and loses the
-/// bug. The watermark only ever moves forward, so this is idempotent and a late
-/// duplicate cannot roll it back; a newer request has a HIGHER `seq` than the one
-/// being completed, so it stays pending and gets its own sync. `claimed_at` is
-/// cleared here rather than depended on, which is what makes that next sync
-/// claimable immediately.
+/// Writes only if the row is still the one that was claimed. The guard is
+/// **`claimed_at IS NOT NULL`**, and that specific predicate is the whole point:
+/// [`request`] resets `claimed_at` to `NULL`, so a request that arrived mid-sync
+/// makes this UPDATE match nothing. Guarding on `completed_at IS NULL` alone would
+/// NOT work - the fresh request leaves that NULL too, so the older sync's outcome
+/// would stamp the new request as done without it ever being serviced, and the
+/// user's "Sync now" would report success for a sync that never ran.
 #[tracing::instrument(skip(pool))]
 pub async fn complete(
     pool: &SqlitePool,
     provider: &str,
-    seq: i64,
     synced_count: Option<i64>,
     error: Option<&str>,
 ) -> Result<()> {
-    let res = sqlx::query(
+    sqlx::query(
         "UPDATE pm_sync_requests
-            SET completed_at  = strftime('%Y-%m-%dT%H:%M:%SZ', 'now'),
-                completed_seq = ?,
-                claimed_at    = NULL,
-                error         = ?,
-                synced_count  = ?
+            SET completed_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now'),
+                error        = ?,
+                synced_count = ?
           WHERE provider = ?
-            AND ? > COALESCE(completed_seq, 0)",
+            AND claimed_at IS NOT NULL
+            AND completed_at IS NULL",
     )
-    .bind(seq)
     .bind(error)
     .bind(synced_count)
     .bind(provider)
-    .bind(seq)
     .execute(pool)
     .await
     .context("completing a PM sync request")?;
-
-    if res.rows_affected() == 0 {
-        // Not an error: a duplicate or out-of-order completion for a watermark that
-        // has already moved past `seq`. Worth a line, because it should be rare and
-        // a steady stream of them would mean two consumers are running.
-        tracing::debug!(
-            provider,
-            seq,
-            "PM sync completion ignored - the watermark is already at or past it"
-        );
-    }
     Ok(())
 }
 
@@ -367,7 +229,7 @@ pub async fn reset_stale_claims(pool: &SqlitePool) -> Result<u64> {
         "UPDATE pm_sync_requests
             SET claimed_at = NULL
           WHERE claimed_at IS NOT NULL
-            AND seq > COALESCE(completed_seq, 0)",
+            AND completed_at IS NULL",
     )
     .execute(pool)
     .await
@@ -382,24 +244,12 @@ pub async fn reset_stale_claims(pool: &SqlitePool) -> Result<u64> {
     Ok(n)
 }
 
-/// The outcome for the request the caller wrote, for a producer that wants to show
-/// one ("Sync now"). `None` while that request is still pending or in flight, so a
-/// caller can poll this until it turns `Some`.
-///
-/// `want_seq` is the value [`request`] returned. `Some` means `completed_seq >=
-/// want_seq` - i.e. a sync that finished at or after the caller's request, which is
-/// what makes overlapping producers safe: two waiters can be satisfied by one sync,
-/// and neither can be handed the result of a sync that finished BEFORE it asked.
-///
-/// Passing a stale `want_seq` (from a previous request) therefore returns a result
-/// immediately, by design - it has genuinely been satisfied.
-pub async fn outcome(
-    pool: &SqlitePool,
-    provider: &str,
-    want_seq: i64,
-) -> Result<Option<SyncOutcome>> {
-    let row: Option<(Option<i64>, Option<String>, Option<i64>)> = sqlx::query_as(
-        "SELECT completed_seq, error, synced_count FROM pm_sync_requests WHERE provider = ?",
+/// The outcome of the last request for `provider`, for a producer that wants to
+/// show one ("Sync now"). `None` while the request is still pending or in flight,
+/// so a caller can poll this until it turns `Some`.
+pub async fn outcome(pool: &SqlitePool, provider: &str) -> Result<Option<SyncOutcome>> {
+    let row: Option<(Option<String>, Option<String>, Option<i64>)> = sqlx::query_as(
+        "SELECT completed_at, error, synced_count FROM pm_sync_requests WHERE provider = ?",
     )
     .bind(provider)
     .fetch_optional(pool)
@@ -407,14 +257,11 @@ pub async fn outcome(
     .context("reading the PM sync outcome")?;
 
     Ok(match row {
-        Some((Some(completed_seq), error, synced_count)) if completed_seq >= want_seq => {
-            Some(SyncOutcome {
-                error,
-                synced_count,
-            })
-        }
-        // No row, nothing completed yet, or the watermark has not reached this
-        // caller's request.
+        Some((Some(_completed), error, synced_count)) => Some(SyncOutcome {
+            error,
+            synced_count,
+        }),
+        // No row, or a row still pending / in flight.
         _ => None,
     })
 }
diff --git a/meridian-core/src/pm_sync_requests/tests.rs b/meridian-core/src/pm_sync_requests/tests.rs
index 1877f34a7..2bf861c66 100644
--- a/meridian-core/src/pm_sync_requests/tests.rs
+++ b/meridian-core/src/pm_sync_requests/tests.rs
@@ -10,23 +10,26 @@ use super::*;
 use sqlx::sqlite::SqliteConnectOptions;
 use std::str::FromStr;
 
-/// The table as the REAL migrations build it, not a hand-written copy.
-///
-/// It used to be a hand-written `CREATE TABLE` mirroring migration 082. That is a
-/// schema the tests can silently diverge from: adding `seq`/`completed_seq` in
-/// migration 083 left every one of these tests passing against a table that did not
-/// have the columns the queries now use, so the suite proved nothing about the code
-/// that shipped. Running the migrator instead means these tests also assert that
-/// 082 + 083 actually apply in order, which is the property real installs depend on.
 async fn db() -> SqlitePool {
     let opts = SqliteConnectOptions::from_str("sqlite::memory:")
         .unwrap()
         .create_if_missing(true);
     let pool = SqlitePool::connect_with(opts).await.unwrap();
-    sqlx::migrate!("../src/migrations")
-        .run(&pool)
-        .await
-        .unwrap();
+    sqlx::query(
+        "CREATE TABLE pm_sync_requests (
+             provider TEXT NOT NULL PRIMARY KEY,
+             mode TEXT NOT NULL DEFAULT 'gated',
+             reason TEXT NOT NULL DEFAULT '',
+             requested_at TEXT NOT NULL,
+             claimed_at TEXT,
+             completed_at TEXT,
+             error TEXT,
+             synced_count INTEGER
+         )",
+    )
+    .execute(&pool)
+    .await
+    .unwrap();
     pool
 }
 
@@ -89,9 +92,7 @@ async fn a_completed_force_does_not_escalate_the_next_gated_request() {
         .await
         .unwrap();
     claim(&pool, ALL_PROVIDERS).await.unwrap();
-    complete(&pool, ALL_PROVIDERS, 1, Some(4), None)
-        .await
-        .unwrap();
+    complete(&pool, ALL_PROVIDERS, Some(4), None).await.unwrap();
 
     // A later window open wants the cheap, gated behaviour.
     request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
@@ -107,9 +108,8 @@ async fn a_completed_force_does_not_escalate_the_next_gated_request() {
 }
 
 /// The in-flight case still escalates: a force that is claimed but not completed
-/// gets a NEW sequence number from the arriving request, so it stays pending past
-/// the running sync's completion and is serviced again - and the force intent must
-/// survive into that re-run rather than being downgraded to the arriving gated mode.
+/// will have its outcome discarded by `complete`'s guard and be re-serviced, so
+/// the force intent must survive into that re-run.
 #[tokio::test]
 async fn an_in_flight_force_still_survives_a_gated_request() {
     let pool = db().await;
@@ -184,9 +184,7 @@ async fn reset_leaves_completed_requests_alone() {
         .await
         .unwrap();
     claim(&pool, ALL_PROVIDERS).await.unwrap();
-    complete(&pool, ALL_PROVIDERS, 1, Some(2), None)
-        .await
-        .unwrap();
+    complete(&pool, ALL_PROVIDERS, Some(2), None).await.unwrap();
 
     assert_eq!(reset_stale_claims(&pool).await.unwrap(), 0);
     assert!(
@@ -203,21 +201,16 @@ async fn outcome_is_none_until_completed() {
     request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
         .await
         .unwrap();
-    assert!(outcome(&pool, ALL_PROVIDERS, 1).await.unwrap().is_none());
+    assert!(outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none());
 
     claim(&pool, ALL_PROVIDERS).await.unwrap();
     assert!(
-        outcome(&pool, ALL_PROVIDERS, 1).await.unwrap().is_none(),
+        outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
         "in-flight must still read as pending"
     );
 
-    complete(&pool, ALL_PROVIDERS, 1, Some(7), None)
-        .await
-        .unwrap();
-    let out = outcome(&pool, ALL_PROVIDERS, 1)
-        .await
-        .unwrap()
-        .expect("done");
+    complete(&pool, ALL_PROVIDERS, Some(7), None).await.unwrap();
+    let out = outcome(&pool, ALL_PROVIDERS).await.unwrap().expect("done");
     assert_eq!(out.synced_count, Some(7));
     assert!(out.error.is_none());
 }
@@ -230,205 +223,44 @@ async fn outcome_carries_the_error() {
         .await
         .unwrap();
     claim(&pool, ALL_PROVIDERS).await.unwrap();
-    complete(&pool, ALL_PROVIDERS, 1, None, Some("401 unauthorized"))
+    complete(&pool, ALL_PROVIDERS, None, Some("401 unauthorized"))
         .await
         .unwrap();
 
-    let out = outcome(&pool, ALL_PROVIDERS, 1)
-        .await
-        .unwrap()
-        .expect("done");
+    let out = outcome(&pool, ALL_PROVIDERS).await.unwrap().expect("done");
     assert_eq!(out.error.as_deref(), Some("401 unauthorized"));
 }
 
-/// **THE BUG THIS FILE EXISTS FOR, and both halves of it at once.**
-///
-/// A request arriving mid-sync must not be marked done by the sync that was already
-/// running (or "Sync now" reports success for work that never ran), AND the sync that
-/// was already running must still be able to report its result to whoever asked for
-/// it (or every waiter times out and reports failure for a sync that succeeded).
-///
-/// The 082 design could only get one of those. It guarded `complete` on `claimed_at
-/// IS NOT NULL`, which the new request had just nulled, so the completion was
-/// discarded entirely - protecting the new request by throwing away the old
-/// request's answer. On 1.91.0-staging.2 that was the normal case rather than an
-/// edge one, because connecting a tracker fires `oauth_connected`,
-/// `token_connected` and the user's "Sync now" within a few seconds: the sync
-/// worked, the answer was dropped, the work was repeated, and the user saw a
-/// failure.
-///
-/// The sequence watermark gets both. Asserting only the first half is what let the
-/// bug ship, so this test asserts them together.
+/// THE RACE THIS GUARDS: a request arriving mid-sync resets the row, and the
+/// older sync's outcome must NOT stamp it complete - that would mark the new
+/// request done without ever servicing it.
 #[tokio::test]
-async fn a_mid_sync_request_neither_steals_nor_destroys_the_running_sync_s_outcome() {
+async fn completion_does_not_clobber_a_request_that_arrived_mid_sync() {
     let pool = db().await;
-    let first = request(&pool, ALL_PROVIDERS, SyncMode::Gated, "plan_or_picker")
-        .await
-        .unwrap();
-    let claimed = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
-    assert_eq!(
-        claimed.seq, first,
-        "the claim must cover the request it read"
-    );
-
-    // A second producer asks while the first sync is still running - the connect
-    // flow does exactly this.
-    let second = request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
+    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
         .await
         .unwrap();
-    assert!(second > first, "a new request must advance the sequence");
+    claim(&pool, ALL_PROVIDERS).await.unwrap();
 
-    // The in-flight sync finishes and reports against the seq it claimed.
-    complete(&pool, ALL_PROVIDERS, claimed.seq, Some(3), None)
+    // A new request lands while the first sync is still running.
+    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
         .await
         .unwrap();
 
-    // Half one - the FIX. The first waiter gets its answer instead of timing out.
-    let out = outcome(&pool, ALL_PROVIDERS, first)
-        .await
-        .unwrap()
-        .expect("the waiter that asked for this sync must receive its outcome");
-    assert_eq!(out.synced_count, Some(3));
+    // The in-flight sync finishes and tries to report. This must be a NO-OP:
+    // the new request cleared `claimed_at`, so the guard rejects it.
+    complete(&pool, ALL_PROVIDERS, Some(3), None).await.unwrap();
 
-    // Half two - the ORIGINAL PROTECTION, preserved. The later request was not
-    // serviced by work that started before it existed.
     assert!(
-        outcome(&pool, ALL_PROVIDERS, second)
-            .await
-            .unwrap()
-            .is_none(),
-        "a request made mid-sync must NOT be satisfied by the sync already running - \
+        outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
+        "the older sync's outcome must NOT mark the new request complete - \
          that would report success for a sync that never ran"
     );
 
-    // ...and it is still serviceable, with its escalation intact.
     let req = claim(&pool, ALL_PROVIDERS)
         .await
         .unwrap()
         .expect("the mid-sync request must still be pending");
     assert_eq!(req.mode, SyncMode::Force);
     assert_eq!(req.reason, "sync_now");
-    assert_eq!(req.seq, second);
-}
-
-/// Two waiters, one sync: the whole point of a watermark. Both producers asked
-/// before anything was serviced, so one sync must satisfy both rather than each
-/// needing its own provider round trip.
-#[tokio::test]
-async fn one_sync_satisfies_every_waiter_that_asked_before_it_ran() {
-    let pool = db().await;
-    let a = request(&pool, ALL_PROVIDERS, SyncMode::Force, "oauth_connected")
-        .await
-        .unwrap();
-    let b = request(&pool, ALL_PROVIDERS, SyncMode::Force, "token_connected")
-        .await
-        .unwrap();
-
-    let claimed = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
-    complete(&pool, ALL_PROVIDERS, claimed.seq, Some(11), None)
-        .await
-        .unwrap();
-
-    for (label, seq) in [("first", a), ("second", b)] {
-        assert!(
-            outcome(&pool, ALL_PROVIDERS, seq).await.unwrap().is_some(),
-            "the {label} waiter must be satisfied by the single sync that covered it"
-        );
-    }
-    assert!(
-        claim(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
-        "coalesced requests must not leave extra work behind - that is a second \
-         provider round trip for one user action"
-    );
-}
-
-/// `has_pending` is the gate that keeps an IDLE daemon from writing at all.
-///
-/// The watcher ticks every 2 s forever and used to call `claim` unconditionally - an
-/// `UPDATE`, so SQLite opened a write transaction and took a lock even when it
-/// matched nothing. That was ~43,000 write transactions a day on an idle machine,
-/// against a file a second process also writes, and it made every daemon kill far
-/// likelier to land mid-write.
-///
-/// So the states where the answer must be `false` matter more than the one where it
-/// is `true`: each is a tick that now touches no lock at all.
-#[tokio::test]
-async fn has_pending_is_false_in_every_idle_state() {
-    let pool = db().await;
-
-    assert!(
-        !has_pending(&pool, ALL_PROVIDERS).await.unwrap(),
-        "a fresh install with no row must not provoke a claim - this is the state \
-         almost every tick runs in"
-    );
-
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
-        .await
-        .unwrap();
-    assert!(
-        has_pending(&pool, ALL_PROVIDERS).await.unwrap(),
-        "real work must still be seen"
-    );
-
-    let claimed = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
-    assert!(
-        !has_pending(&pool, ALL_PROVIDERS).await.unwrap(),
-        "an in-flight request is not claimable, so ticks during a long sync must be \
-         free too"
-    );
-
-    complete(&pool, ALL_PROVIDERS, claimed.seq, Some(2), None)
-        .await
-        .unwrap();
-    assert!(
-        !has_pending(&pool, ALL_PROVIDERS).await.unwrap(),
-        "a completed row is the steady state after any sync - it must never read as \
-         work, or the daemon would re-sync forever"
-    );
-
-    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "plan_or_picker")
-        .await
-        .unwrap();
-    assert!(
-        has_pending(&pool, ALL_PROVIDERS).await.unwrap(),
-        "a new request after a completion must be visible again"
-    );
-}
-
-/// A duplicate or out-of-order completion must never move the watermark backwards,
-/// so a retrying consumer cannot un-answer a waiter that was already satisfied.
-#[tokio::test]
-async fn the_completion_watermark_only_moves_forward() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
-        .await
-        .unwrap();
-    let first = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
-    complete(&pool, ALL_PROVIDERS, first.seq, Some(5), None)
-        .await
-        .unwrap();
-
-    let second = request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
-        .await
-        .unwrap();
-    let claimed = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
-    complete(&pool, ALL_PROVIDERS, claimed.seq, Some(9), None)
-        .await
-        .unwrap();
-
-    // A late duplicate for the OLD seq arrives (a retry, a doubled tick).
-    complete(&pool, ALL_PROVIDERS, first.seq, Some(1), Some("stale"))
-        .await
-        .unwrap();
-
-    let out = outcome(&pool, ALL_PROVIDERS, second)
-        .await
-        .unwrap()
-        .expect("the newer waiter must stay satisfied");
-    assert_eq!(
-        out.synced_count,
-        Some(9),
-        "the stale retry overwrote the result"
-    );
-    assert_eq!(out.error, None, "the stale retry resurrected an old error");
 }
diff --git a/src/intelligence/sync_delegate.rs b/src/intelligence/sync_delegate.rs
index f2ddc7cce..8475390f9 100644
--- a/src/intelligence/sync_delegate.rs
+++ b/src/intelligence/sync_delegate.rs
@@ -152,45 +152,29 @@ async fn request_and_wait(
     label: &str,
     wait: Option<Duration>,
 ) -> Delegation {
-    let seq = match pm_sync_requests::request(pool, ALL_PROVIDERS, mode, label).await {
-        Ok(seq) => seq,
-        Err(e) => {
-            return Delegation::Failed {
-                error: format!(
-                    "could not queue the sync request: {}",
-                    crate::errors::chain(&e)
-                ),
-            };
-        }
-    };
-    tracing::debug!(
-        label,
-        seq,
-        "pm sync requested - the daemon owns tracker auth"
-    );
+    if let Err(e) = pm_sync_requests::request(pool, ALL_PROVIDERS, mode, label).await {
+        return Delegation::Failed {
+            error: format!(
+                "could not queue the sync request: {}",
+                crate::errors::chain(&e)
+            ),
+        };
+    }
+    tracing::debug!(label, "pm sync requested - the daemon owns tracker auth");
 
     match wait {
-        Some(budget) => wait_for_outcome(pool, label, seq, budget).await,
+        Some(budget) => wait_for_outcome(pool, label, budget).await,
         None => Delegation::Pending,
     }
 }
 
 /// Poll the request row until the daemon records an outcome, or `budget` elapses.
 ///
-/// The row is keyed on the provider (`'*'`), so a concurrent producer's request shares
-/// it. `seq` is what keeps that safe: it is the sequence number THIS caller's request
-/// was given, and `outcome` only answers once the completion watermark reaches it. So a
-/// sibling's sync can satisfy this caller (both asked for the same thing, and "a sync
-/// finished after you asked" is exactly what the caller needs to know), while a sync that
-/// finished BEFORE this request cannot - which is the stale read the previous
-/// `completed_at`-clearing design tried to prevent by destroying the other waiter's
-/// answer.
-async fn wait_for_outcome(
-    pool: &SqlitePool,
-    label: &str,
-    seq: i64,
-    budget: Duration,
-) -> Delegation {
+/// The row is keyed on the provider (`'*'`), so a concurrent CLI's request can reset it
+/// and this can end up reading a sibling's outcome. That is fine: both asked for the same
+/// thing, and "some sync just completed" is exactly what the caller needs to know. It
+/// cannot read a *stale* outcome, because `request` clears `completed_at`.
+async fn wait_for_outcome(pool: &SqlitePool, label: &str, budget: Duration) -> Delegation {
     let deadline = std::time::Instant::now() + budget;
     loop {
         if std::time::Instant::now() >= deadline {
@@ -202,7 +186,7 @@ async fn wait_for_outcome(
             return Delegation::Pending;
         }
         tokio::time::sleep(POLL_INTERVAL).await;
-        match pm_sync_requests::outcome(pool, ALL_PROVIDERS, seq).await {
+        match pm_sync_requests::outcome(pool, ALL_PROVIDERS).await {
             Ok(Some(out)) => {
                 return match out.error {
                     Some(error) => Delegation::Failed { error },
@@ -252,7 +236,7 @@ mod tests {
 
         assert_eq!(got, Delegation::Synced { count: None });
         assert!(
-            pm_sync_requests::outcome(&pool, ALL_PROVIDERS, 1)
+            pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
                 .await
                 .unwrap()
                 .is_none(),
@@ -305,19 +289,13 @@ mod tests {
             .await
             .unwrap();
         pm_sync_requests::claim(&pool, ALL_PROVIDERS).await.unwrap();
-        pm_sync_requests::complete(
-            &pool,
-            ALL_PROVIDERS,
-            1,
-            None,
-            Some("refresh_token is invalid"),
-        )
-        .await
-        .unwrap();
+        pm_sync_requests::complete(&pool, ALL_PROVIDERS, None, Some("refresh_token is invalid"))
+            .await
+            .unwrap();
 
         // Re-requesting clears the outcome, so the waiter must be the one to observe it:
         // drive the wait directly against the already-completed row.
-        let got = wait_for_outcome(&pool, "tasks-sync", 1, Duration::from_secs(5)).await;
+        let got = wait_for_outcome(&pool, "tasks-sync", Duration::from_secs(5)).await;
 
         assert_eq!(
             got,
diff --git a/src/intelligence/sync_requests.rs b/src/intelligence/sync_requests.rs
index a60ea29c5..8e1838909 100644
--- a/src/intelligence/sync_requests.rs
+++ b/src/intelligence/sync_requests.rs
@@ -100,17 +100,9 @@ pub async fn run_watcher(pool: SqlitePool, mut shutdown_rx: watch::Receiver<bool
 /// Claim and service at most one pending request. Split from the loop so the
 /// decision logic is reachable without spawning a task.
 async fn service_once(pool: &SqlitePool) {
-    // READ first, and claim only if there is something to claim.
-    //
-    // `claim` is an UPDATE, and SQLite opens a write transaction to evaluate one even
-    // when it matches nothing - so calling it unconditionally on this 2 s tick put
-    // ~43,000 write transactions a day on an idle machine's database, and made every
-    // daemon kill far likelier to land mid-write. See
-    // `pm_sync_requests::has_pending` for the full reasoning. The read is advisory;
-    // `claim` below is still what decides, so exclusivity is unchanged.
-    match pm_sync_requests::has_pending(pool, ALL_PROVIDERS).await {
-        Ok(false) => return,
-        Ok(true) => {}
+    let req = match pm_sync_requests::claim(pool, ALL_PROVIDERS).await {
+        Ok(Some(req)) => req,
+        Ok(None) => return,
         Err(e) => {
             // Logged at debug, not warn: on a fresh install this fires every 2 s
             // until migration 082 has run, and a warn-level line every 2 s would
@@ -122,20 +114,6 @@ async fn service_once(pool: &SqlitePool) {
             );
             return;
         }
-    }
-
-    let req = match pm_sync_requests::claim(pool, ALL_PROVIDERS).await {
-        Ok(Some(req)) => req,
-        // Lost the race to another claimant between the read and here - fine, and
-        // the reason `has_pending` is documented as advisory.
-        Ok(None) => return,
-        Err(e) => {
-            tracing::debug!(
-                error = %crate::errors::chain(&e),
-                "could not claim a PM sync request"
-            );
-            return;
-        }
     };
 
     // Config is read here rather than captured at spawn time so a settings change
@@ -146,7 +124,6 @@ async fn service_once(pool: &SqlitePool) {
     tracing::info!(
         mode = req.mode.as_str(),
         reason = %req.reason,
-        seq = req.seq,
         "servicing PM sync request"
     );
 
@@ -180,9 +157,7 @@ async fn service_once(pool: &SqlitePool) {
         }
     };
 
-    if let Err(e) =
-        pm_sync_requests::complete(pool, &req.provider, req.seq, count, error.as_deref()).await
-    {
+    if let Err(e) = pm_sync_requests::complete(pool, &req.provider, count, error.as_deref()).await {
         tracing::warn!(
             error = %crate::errors::chain(&e),
             "could not record the PM sync outcome - the producer will keep waiting"
@@ -211,7 +186,7 @@ mod tests {
     async fn service_once_is_quiet_with_no_requests() {
         let pool = db().await;
         service_once(&pool).await;
-        assert!(pm_sync_requests::outcome(&pool, ALL_PROVIDERS, 1)
+        assert!(pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
             .await
             .unwrap()
             .is_none());
@@ -229,7 +204,7 @@ mod tests {
 
         service_once(&pool).await;
 
-        let out = pm_sync_requests::outcome(&pool, ALL_PROVIDERS, 1)
+        let out = pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
             .await
             .unwrap()
             .expect("the request must be completed, not left pending");
diff --git a/src/main.rs b/src/main.rs
index f0690dae3..157153b91 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1534,21 +1534,13 @@ async fn main() -> Result<()> {
     //     ever on a row a producer wrote, so every refresh still traces to a human
     //     action, which is what keeps a refresh POST from being in flight when a
     //     laptop lid closes.
-    //
-    //     Its `JoinHandle` is KEPT, unlike the loops above, and awaited in the
-    //     shutdown sequence before the WAL checkpoint. This task is the daemon's
-    //     only writer outside the poll loop, and `service_once` deliberately runs a
-    //     whole sync (network + `pm_tasks` writes, tens of seconds) without
-    //     re-checking the shutdown flag, so dropping the handle meant checkpointing
-    //     and closing the pool underneath live writes on every restart. See the
-    //     shutdown site for the full reasoning.
-    let sync_watcher = {
+    {
         let pool_sync = meridian.clone();
         let rx_sync = shutdown_rx.clone();
         tokio::spawn(async move {
             meridian::intelligence::sync_requests::run_watcher(pool_sync, rx_sync).await;
-        })
-    };
+        });
+    }
 
     // 8b. Poll loop — ETL, PM sync, and FM categorization on the configured interval.
     // Track the last-applied log level so we can detect changes and hot-reload
@@ -1704,45 +1696,7 @@ async fn main() -> Result<()> {
 
     // 9. Shutdown
     tracing::info!(pid = std::process::id() as i64, "shutting down");
-
-    // 9a. Wait for the PM sync watcher to actually STOP before touching the WAL.
-    //
-    //     `shutdown_tx.send(true)` above only sets a flag, and the watcher checks it
-    //     on its sleep - not around `service_once`, which is deliberate (a claimed
-    //     request finishes and records an outcome rather than being cut off with the
-    //     row left claimed). The consequence is that after the signal this task can
-    //     still be inside a full provider sync for tens of seconds, writing to
-    //     `pm_tasks`. Without this await, `checkpoint_wal` and `close` below ran
-    //     underneath those writes on EVERY restart - and a reconnect flow restarts
-    //     the daemon, which is exactly when a burst of sync requests exists to
-    //     service. A TRUNCATE checkpoint racing live writes is the one thing that
-    //     function exists to prevent (see its doc: it hands the next generation a
-    //     half-written WAL while the tray keeps a stale view of the file).
-    //
-    //     Bounded, because the whole point of the no-interrupt design is that
-    //     `service_once` may be mid-network-call: on timeout we proceed anyway and
-    //     say so, which is strictly better than the old unconditional race, and no
-    //     worse than a hard kill.
-    {
-        const WATCHER_DRAIN_TIMEOUT: Duration = Duration::from_secs(45);
-        match tokio::time::timeout(WATCHER_DRAIN_TIMEOUT, sync_watcher).await {
-            Ok(Ok(())) => tracing::debug!("PM sync watcher stopped cleanly before checkpoint"),
-            // `JoinError`'s Display ignores `f.alternate()`, so `chain()` would
-            // render byte-identically - it carries a panic payload or a
-            // cancellation, never a `.context()` chain.
-            Ok(Err(e)) => {
-                tracing::warn!(error = %e, "sync watcher ended abnormally"); // not-anyhow: JoinError
-            }
-            Err(_elapsed) => tracing::warn!(
-                timeout_s = WATCHER_DRAIN_TIMEOUT.as_secs() as i64,
-                "PM sync watcher did not stop in time - checkpointing anyway, which may leave a non-empty WAL"
-            ),
-        }
-    }
-
-    // (`release_endpoint` used to be here. It now runs at 9b, after the pool is
-    // closed - see there for why the exiting side's ordering matters too.)
-
+    meridian::platform::release_endpoint();
     // See `db::meridian::checkpoint_wal`'s doc for why this runs before every
     // close, not just a plain shutdown. Best-effort: a failed checkpoint must
     // not block shutdown.
@@ -1765,19 +1719,6 @@ async fn main() -> Result<()> {
     }
     meridian.close().await;
 
-    // 9b. Release the single-instance endpoint LAST, after the pool is closed.
-    //
-    //     This used to run first, before the checkpoint. `daemon_already_running` is
-    //     how a starting daemon decides whether to bow out (4a-ter), so releasing it
-    //     early opens the guard while THIS process is still checkpointing and closing
-    //     - the window `single_instance_check_precedes_setup_db_and_bind_follows_it`
-    //     exists to close, reopened from the exiting side. It only pinned the
-    //     STARTING daemon's ordering. Under launchd the relaunch is immediate, and a
-    //     new generation running migrations against a file the old one is mid-
-    //     checkpoint on is the double-writer profile the fleet-correlated corruption
-    //     was traced to.
-    meridian::platform::release_endpoint();
-
     // Flush OTel exporters FIRST, while the runtime is alive — this writes the
     // daemon's final shutdown spans/logs into the spool's pending/ dir...
     obs_guard.shutdown().await;
@@ -2005,58 +1946,4 @@ mod startup_order_tests {
              bind at byte {bind_pos}."
         );
     }
-
-    /// The EXIT-side ordering, which the test above does not cover and which was
-    /// wrong until 1.91.0-staging.2's write wedge was traced.
-    ///
-    /// Three things must happen in this order on shutdown:
-    /// 1. await the PM sync watcher — it is the daemon's only writer outside the
-    ///    poll loop, and `service_once` deliberately ignores the shutdown flag
-    ///    once it has claimed a row (so it can finish and record an outcome), so
-    ///    it can still be writing for tens of seconds after the signal;
-    /// 2. `checkpoint_wal` — a TRUNCATE checkpoint racing those live writes is
-    ///    the exact thing that function exists to prevent, and it is what hands
-    ///    the next daemon generation a half-written WAL while the tray keeps a
-    ///    stale view of the file;
-    /// 3. `release_endpoint` LAST — it is what `daemon_already_running` answers,
-    ///    so releasing it before the checkpoint and close lets a relaunching
-    ///    daemon pass the single-instance guard and start migrating against a
-    ///    file this process is still checkpointing. Under launchd the relaunch
-    ///    is immediate, so that window is real, not theoretical.
-    ///
-    /// Same self-scanning idiom (and the same truncate-at-the-test-module trap)
-    /// as the test above.
-    #[test]
-    fn shutdown_awaits_the_sync_watcher_then_checkpoints_then_releases_the_endpoint() {
-        const SRC: &str = include_str!("main.rs");
-        let prod = SRC
-            .split_once("\n#[cfg(test)]")
-            .map_or(SRC, |(before, _)| before);
-
-        let await_pos = prod
-            .find("WATCHER_DRAIN_TIMEOUT, sync_watcher)")
-            .expect("shutdown must await the PM sync watcher's JoinHandle");
-        let checkpoint_pos = prod
-            .find("meridian::db::meridian::checkpoint_wal(&meridian).await")
-            .expect("shutdown must checkpoint the WAL");
-        let release_pos = prod
-            .find("meridian::platform::release_endpoint();")
-            .expect("shutdown must release the single-instance endpoint");
-
-        assert!(
-            await_pos < checkpoint_pos,
-            "the PM sync watcher must be awaited BEFORE the WAL checkpoint — \
-             checkpointing underneath its live writes is what corrupted the \
-             shared WAL index. Found await at byte {await_pos}, checkpoint at \
-             byte {checkpoint_pos}."
-        );
-        assert!(
-            checkpoint_pos < release_pos,
-            "release_endpoint() must run AFTER the checkpoint and pool close — \
-             releasing it earlier opens the single-instance guard while this \
-             process is still writing, letting a relaunching daemon migrate \
-             against the same file. Found checkpoint at byte {checkpoint_pos}, \
-             release at byte {release_pos}."
-        );
-    }
 }
diff --git a/src/migrations/083_pm_sync_request_seq.sql b/src/migrations/083_pm_sync_request_seq.sql
deleted file mode 100644
index 5c3cc7e76..000000000
--- a/src/migrations/083_pm_sync_request_seq.sql
+++ /dev/null
@@ -1,35 +0,0 @@
--- ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-
--- Give each PM sync request a monotonic sequence number, so a producer can tell
--- WHICH request an outcome belongs to.
---
--- Migration 082 modelled the outbox as one row per provider whose completion was
--- signalled by `completed_at` going non-NULL, and `request()` cleared it so the row
--- "unambiguously represents work still to do". With one waiter that is fine. With
--- two it loses answers, and the tracker-connect flow always produces at least two:
--- `oauth_connected`, `token_connected` and the user's own "Sync now" all fire inside
--- a few seconds.
---
--- Measured on 1.91.0-staging.2: request A is claimed and a real Jira sync starts;
--- request B lands mid-flight and nulls `claimed_at`/`completed_at`; the daemon
--- finishes and calls `complete()`, whose guard was `claimed_at IS NOT NULL` - now
--- NULL - so the outcome was DISCARDED and the sync re-run from scratch. Every waiter
--- then polled for its full 30 s budget and reported failure for a sync that had
--- actually succeeded, repeatedly.
---
--- With a sequence, "done" is a watermark rather than a flag: a producer holding seq
--- N is satisfied by any `completed_seq >= N`, so overlapping requests coalesce
--- instead of cannibalising each other, and no completion can be misattributed to a
--- request that was never serviced.
---
--- `seq` starts at 1 and `completed_seq` is NULL-means-nothing-completed, so
--- "pending" is `seq > COALESCE(completed_seq, 0)` everywhere.
-ALTER TABLE pm_sync_requests ADD COLUMN seq INTEGER NOT NULL DEFAULT 1;
-ALTER TABLE pm_sync_requests ADD COLUMN completed_seq INTEGER;
-
--- Carry the existing row's state across rather than resetting it. A row already
--- completed under 082 must NOT read as pending after this migration (that would fire
--- a spurious provider sync on the first daemon start after an update, for every
--- installed user at once); a row mid-flight must stay pending so it is still
--- serviced.
-UPDATE pm_sync_requests SET completed_seq = seq WHERE completed_at IS NOT NULL;
diff --git a/tray/src-tauri/src/commands/daemon.rs b/tray/src-tauri/src/commands/daemon.rs
index fef8680f5..83afe313b 100644
--- a/tray/src-tauri/src/commands/daemon.rs
+++ b/tray/src-tauri/src/commands/daemon.rs
@@ -248,14 +248,6 @@ pub(crate) async fn reload_daemon_with(
 /// point in time this function does not need to reason about.
 async fn reload_with_pool_cycle(pool: &crate::db_pool::DbPool) -> Result<u32, String> {
     with_reload_lock(|| async {
-        // Also excludes a concurrent `DbPool::recover_if_corrupt`, which closes and
-        // reopens this same handle. `with_reload_lock` alone only serialises reloads
-        // against each other, so without this a recycle could REOPEN the pool in the
-        // window between the close below and the restart signal - leaving a live
-        // connection spanning two daemon generations, which is the 2026-08-24
-        // corruption profile this whole close/reopen dance exists to prevent. See
-        // `DbPool::lock_cycle`.
-        let _cycle = pool.lock_cycle().await;
         pool.close().await;
         let result = super::daemon_control::reload().await;
         pool.reopen().await;
@@ -909,44 +901,4 @@ mod tests {
             "a later reload still reaches the daemon"
         );
     }
-
-    /// Every close/reopen of the tray's pool must hold `DbPool::lock_cycle`, and
-    /// `reload_with_pool_cycle` must take it BEFORE it closes.
-    ///
-    /// `with_reload_lock` only serialises reloads against each other.
-    /// `DbPool::recover_if_corrupt` is a second close/reopen site, so without a
-    /// shared lock the two interleave:
-    ///
-    /// 1. reload closes - the handle is `None`;
-    /// 2. a recycle sees `None`, treats it as nothing to close, and REOPENS;
-    /// 3. reload signals the daemon restart, with that fresh pool open across it.
-    ///
-    /// Step 3 is the 2026-08-24 corruption profile - a tray connection spanning two
-    /// daemon generations - i.e. the self-heal would have reintroduced the very bug
-    /// this close/reopen dance exists to prevent. Source-scanned because reproducing
-    /// it needs a real launchd daemon restart racing a real corrupt write.
-    #[test]
-    fn the_reload_cycle_holds_the_shared_pool_lock_before_closing() {
-        const SRC: &str = include_str!("daemon.rs");
-        let prod = SRC
-            .split_once("\n#[cfg(test)]")
-            .map_or(SRC, |(before, _)| before);
-        let body = prod
-            .split_once("async fn reload_with_pool_cycle")
-            .expect("reload_with_pool_cycle must exist")
-            .1;
-
-        let lock_pos = body
-            .find("lock_cycle().await")
-            .expect("reload_with_pool_cycle must acquire DbPool::lock_cycle");
-        let close_pos = body
-            .find("pool.close().await")
-            .expect("reload_with_pool_cycle must close the pool");
-        assert!(
-            lock_pos < close_pos,
-            "the shared cycle lock must be held BEFORE the close - taking it after \
-             leaves the window where a concurrent recycle can reopen the pool into \
-             the daemon restart. lock at {lock_pos}, close at {close_pos}."
-        );
-    }
 }
diff --git a/tray/src-tauri/src/commands/integrations.rs b/tray/src-tauri/src/commands/integrations.rs
index 0d10f792c..2e6e1d502 100644
--- a/tray/src-tauri/src/commands/integrations.rs
+++ b/tray/src-tauri/src/commands/integrations.rs
@@ -684,10 +684,7 @@ pub async fn save_integration_token(
     // First-time (or credential-change) connect — force a sync so the board
     // populates immediately rather than waiting for the next on-demand trigger.
     // There's no stale cache to protect here, so gating buys nothing.
-    crate::commands::tasks::trigger_background_pm_force_sync(
-        db_pool.inner().clone(),
-        "token_connected",
-    );
+    crate::commands::tasks::trigger_background_pm_force_sync(db_pool.get(), "token_connected");
 
     Ok(serde_json::json!({ "ok": true, "reloaded": reloaded }))
 }
@@ -1206,7 +1203,7 @@ pub async fn start_oauth(
     db_pool: State<'_, crate::db_pool::DbPool>,
 ) -> Result<StartOAuthResponse, String> {
     match body.provider.as_str() {
-        "jira" | "trello" => start_oauth_in_process(body.provider, db_pool.inner().clone()),
+        "jira" | "trello" => start_oauth_in_process(body.provider, db_pool.get()),
         "github" => start_oauth_github_device(body.provider, db_pool.inner().clone()).await,
         other => Err(format!("Unknown provider: {other}")),
     }
@@ -1261,7 +1258,7 @@ pub async fn cancel_oauth(body: CancelOAuthBody) -> Result<(), String> {
 /// [`AtomicBool`] prevents two flows from racing to bind the same loopback port.
 fn start_oauth_in_process(
     provider: String,
-    db: crate::db_pool::DbPool,
+    db: Option<meridian_core::SqlitePool>,
 ) -> Result<StartOAuthResponse, String> {
     // Resolve credentials from .env WITHOUT mutating process env.
     let mode = crate::install::detect_install_mode();
@@ -1473,12 +1470,9 @@ async fn start_oauth_github_device(
                     return;
                 }
                 tracing::info!("GitHub device-flow login succeeded");
-                // Clone the HANDLE (not `db_pool.get()`) before `db_pool` is moved
-                // into the reload below. The old code took a pool here, which the
-                // reload's `DbPool::close` then killed - so the sync request it was
-                // saved for could never be written. The handle survives, and
-                // `request_sync` resolves it after the reopen.
-                let sync_db = db_pool.clone();
+                // Grab the DB handle BEFORE `db_pool` is moved into the reload below,
+                // so the sync request can still be written afterwards.
+                let sync_db = db_pool.get();
                 // Best-effort reload so the token takes effect now, not next restart.
                 if let Err(e) = crate::commands::daemon::reload_daemon_with(db_pool).await {
                     tracing::debug!(error = %e, "daemon reload after GitHub connect (non-fatal)");
diff --git a/tray/src-tauri/src/commands/pause.rs b/tray/src-tauri/src/commands/pause.rs
index 7a01d12e4..7d81ccc17 100644
--- a/tray/src-tauri/src/commands/pause.rs
+++ b/tray/src-tauri/src/commands/pause.rs
@@ -338,13 +338,9 @@ pub(crate) async fn resume_capture(
         }
     }
 
-    // Restart the capture engine so screen recording resumes. Resolve the managed
-    // HANDLE rather than passing `pool` (a snapshot this fn was handed): the capture
-    // consumers outlive any single pool generation - see `start_capture`'s doc.
+    // Restart the capture engine so screen recording resumes.
     #[cfg(feature = "capture")]
-    if let Some(db) = crate::db_pool::from_app(app) {
-        crate::start_capture(state.clone(), db);
-    }
+    crate::start_capture(state.clone(), pool.cloned());
 
     // Emit immediately so the popover reverts to the picker without waiting for the next tick.
     if let Ok(s) = state.lock() {
diff --git a/tray/src-tauri/src/commands/tasks/mod.rs b/tray/src-tauri/src/commands/tasks.rs
similarity index 54%
rename from tray/src-tauri/src/commands/tasks/mod.rs
rename to tray/src-tauri/src/commands/tasks.rs
index 76a429d71..f626c7bae 100644
--- a/tray/src-tauri/src/commands/tasks/mod.rs
+++ b/tray/src-tauri/src/commands/tasks.rs
@@ -81,44 +81,14 @@ pub struct SyncResult {
 /// tighter — a faster poll would just burn reads without seeing a result any sooner.
 const OUTCOME_POLL_INTERVAL: Duration = Duration::from_millis(500);
 
-/// Shown when an outbox query fails because `meridian.db` itself is damaged. Points
-/// at the banner rather than repeating the SQLite text, because
-/// [`explain_outbox_failure`] has just raised that banner and it carries both the
-/// full cause and a Repair button - a settings panel has neither.
-const DB_DAMAGED_MESSAGE: &str =
-    "Meridian's database is damaged - use the Repair Database banner on the dashboard";
-
-/// Shown during the update window described on [`explain_outbox_failure`].
-const UPDATE_IN_PROGRESS_MESSAGE: &str =
-    "Meridian is still finishing an update - try again in a moment";
-
-/// What a failed `pm_sync_requests` query means for the user, plus the side effect it
-/// must trigger first.
-///
-/// Both halves of the handoff - the request write and the outcome read - fail for the
-/// same three reasons, so they classify here instead of each growing its own ladder.
-/// Callers render and log the chain themselves via [`crate::cmd_err!`] and pass the
-/// result in as `rendered`, which keeps each site's log message a constant (better
-/// grouping in OpenObserve than one message with the operation interpolated into it).
-///
-/// # Corruption must reach the banner, not a settings panel
-///
-/// This is the branch the whole function exists for. A staging machine's
-/// `meridian.db` had real b-tree damage and these two queries were the ONLY code on
-/// it to find out: `repair_boot`'s startup probe is skipped while a daemon answers,
-/// the daemon latches only when its own queries reach a damaged page, and
-/// `poll::refresh` covers only its four dashboard reads. So the user was shown
-/// `could not queue the sync: ... database disk image is malformed` inside Settings,
-/// with no banner and no Repair button - a recoverable fault presented as a failed
-/// button press. [`crate::db_pool::raise_if_corrupt`] fixes that at the source; this
-/// function just has to call it and then say something better than the SQL.
+/// Turn a failed request-write into something a user can act on.
 ///
 /// # Why the missing-table case is special-cased
 ///
 /// `pm_sync_requests` arrives in migration 082, and **only the daemon runs migrations**
 /// (the tray opens the file with `create_if_missing(false)` and assumes the daemon made
-/// it). So during an app update there is a window - new tray already running, daemon not
-/// yet restarted onto the new binary - where the table genuinely does not exist yet.
+/// it). So during an app update there is a window — new tray already running, daemon not
+/// yet restarted onto the new binary — where the table genuinely does not exist yet.
 ///
 /// It is seconds long and self-heals the moment the daemon restarts, but a user who
 /// presses "Sync now" inside it would otherwise be shown a raw SQL string:
@@ -130,67 +100,24 @@ const UPDATE_IN_PROGRESS_MESSAGE: &str =
 /// `Database` error whose only distinguishing feature IS its text; the match is
 /// deliberately loose (table name plus "no such table") so a reworded sqlite message
 /// degrades to the generic branch rather than mis-reporting something else.
-/// Corruption, by contrast, is classified by `is_corrupt_error` on the real error -
-/// never by string matching - so it stays correct across sqlite wordings.
-async fn explain_outbox_failure(
-    db: &SqlitePool,
-    e: &anyhow::Error,
-    rendered: &str,
-    fallback: &str,
-) -> String {
-    crate::db_pool::raise_if_corrupt(db, e).await;
-
-    if meridian::db::integrity::is_corrupt_error(e) {
-        return DB_DAMAGED_MESSAGE.to_string();
-    }
-    // "no such table" (082 not applied) OR "no such column" (083 not applied). The
-    // column case is not hypothetical: migration 083 added `seq`/`completed_seq`, and
-    // during an update the new tray queries them before the daemon has migrated. The
-    // first version of this branch only matched the table and would have shown every
-    // updating user `no such column: seq` - the exact raw-SQL-in-a-settings-panel
-    // failure it was written to prevent, one migration later. Any future migration
-    // touching this table inherits the same window, which is why this matches the
-    // schema-mismatch FAMILY rather than one message.
-    // SQLite names the TABLE for a missing table (`no such table:
-    // pm_sync_requests`) but only the COLUMN for a missing column (`no such column:
-    // seq`) - and none of this module's `.context(...)` strings contain the literal
-    // table name, so the two cases need separate needles rather than one
-    // table-plus-kind check.
-    //
-    // Matched on the full `no such column: <name>` prefix, not on the bare column
-    // name: `rendered.contains("seq")` would fire on any message containing
-    // "sequence" or "consequently" and mis-report an unrelated fault as a pending
-    // update, which sends the user to wait out an update that already finished.
-    const SCHEMA_PENDING: [&str; 3] = [
-        "no such table: pm_sync_requests",
-        "no such column: seq",
-        "no such column: completed_seq",
-    ];
-    if SCHEMA_PENDING
-        .iter()
-        .any(|needle| rendered.contains(needle))
-    {
-        return UPDATE_IN_PROGRESS_MESSAGE.to_string();
+fn queue_failure_message(e: &anyhow::Error) -> String {
+    let detail = format!("{e:#}");
+    if detail.contains("no such table") && detail.contains("pm_sync_requests") {
+        tracing::warn!("pm_sync_requests missing - the daemon has not applied migration 082 yet");
+        return "Meridian is still finishing an update - try again in a moment".to_string();
     }
-    format!("{fallback}: {rendered}")
+    tracing::warn!(error = %detail, "could not queue a PM sync request");
+    format!("could not queue the sync: {detail}")
 }
 
-/// Confirm a pool is currently open, without keeping the one we looked at.
-///
-/// Returns the HANDLE, not a `SqlitePool`. It used to return the pool, which every
-/// caller then held for the length of a 30 s poll loop - so a recycle or a daemon
-/// reload part-way through left the rest of that loop querying a dead pool. Callers
-/// resolve `get()` per use instead; this only answers "is there any point starting".
-///
-/// `None` means the pool is closed (a repair, or a recycle in progress), which is a
-/// real condition rather than a bug - say so plainly instead of unwrapping.
+/// Resolve the tray's DB handle, or an error string suitable for returning straight
+/// to the frontend. `None` means the pool is closed (a repair or a corrupt DB), which
+/// is a real condition rather than a bug — say so plainly instead of unwrapping.
 fn require_pool(
     pool: &tauri::State<'_, crate::db_pool::DbPool>,
-) -> Result<crate::db_pool::DbPool, String> {
-    if pool.get().is_none() {
-        return Err("the database is not open - Meridian may be repairing it".to_string());
-    }
-    Ok(pool.inner().clone())
+) -> Result<meridian_core::SqlitePool, String> {
+    pool.get()
+        .ok_or_else(|| "the database is not open - Meridian may be repairing it".to_string())
 }
 
 /// Re-sync the board from the tracker (the ported /api/tasks/sync POST) — always
@@ -288,14 +215,9 @@ pub async fn request_gated_sync_tasks(
 /// writer to race for the rotating credential - the tray still never holds a token
 /// itself. Without it, a queued row would sit unserviced and the user would watch a
 /// spinner time out with the daemon stopped.
-/// Takes the `DbPool` HANDLE and resolves it per query, rather than holding one
-/// `SqlitePool` for the whole 30 s wait. That matters here specifically: a daemon
-/// reload or a `recover_if_corrupt` recycle part-way through the poll loop replaces
-/// the pool, and a cached one would spend the rest of the budget querying a closed
-/// handle and then report a timeout for a sync that had finished.
 #[tracing::instrument(skip(db), fields(mode = mode.as_str()))]
 async fn ask_daemon_to_sync(
-    db: &crate::db_pool::DbPool,
+    db: &SqlitePool,
     mode: SyncMode,
     reason: &'static str,
     fallback_cli: &'static str,
@@ -314,65 +236,22 @@ async fn ask_daemon_to_sync(
         }));
     }
 
-    // The sequence number this request was given. Polling the outcome WITHOUT it is
-    // what made "Sync now" report failure for syncs that had succeeded: the connect
-    // flow writes several requests seconds apart, and the old row-level
-    // `completed_at` flag could not say which one an outcome belonged to.
-    //
-    // Attempted twice: a first failure whose cause is a broken pool VIEW (not damaged
-    // data) is recovered by `recover_if_corrupt` recycling the connections, and the
-    // retry then succeeds - so the user's button works instead of them having to
-    // discover that quitting and relaunching the app is the cure. Exactly two
-    // attempts: the recycle either fixed it or the fault is real, and a loop here
-    // would hold a user-facing command open against a database that cannot serve it.
-    let mut attempt = 0;
-    let seq = loop {
-        attempt += 1;
-        let pool = db
-            .get()
-            .ok_or_else(|| "the database is not open - Meridian may be repairing it".to_string())?;
-        match pm_sync_requests::request(&pool, ALL_PROVIDERS, mode, reason).await {
-            Ok(seq) => break seq,
-            Err(e) => {
-                let rendered = crate::cmd_err!(e, "could not queue a PM sync request");
-                // Raises the banner and recycles the pool when the fault is a broken
-                // view; returns whether a retry is worth making.
-                let recovered = db.recover_if_corrupt(&e).await;
-                crate::db_pool::raise_if_corrupt(&pool, &e).await;
-                if recovered && attempt == 1 {
-                    tracing::info!("retrying the PM sync request on the recycled pool");
-                    continue;
-                }
-                return Err(explain_outbox_failure(
-                    &pool,
-                    &e,
-                    &rendered,
-                    "could not queue the sync",
-                )
-                .await);
-            }
-        }
-    };
+    if let Err(e) = pm_sync_requests::request(db, ALL_PROVIDERS, mode, reason).await {
+        return Err(queue_failure_message(&e));
+    }
 
     let deadline = tokio::time::Instant::now() + SYNC_TIMEOUT;
     loop {
         if tokio::time::Instant::now() >= deadline {
             tracing::warn!(
                 timeout_s = SYNC_TIMEOUT.as_secs() as i64,
-                seq,
                 "daemon did not report a sync outcome in time"
             );
             return Ok(None);
         }
         tokio::time::sleep(OUTCOME_POLL_INTERVAL).await;
 
-        let Some(pool) = db.get() else {
-            // A recycle or a daemon reload has the pool closed right now. Keep
-            // waiting rather than failing - the request row is already written and
-            // the daemon will service it.
-            continue;
-        };
-        match pm_sync_requests::outcome(&pool, ALL_PROVIDERS, seq).await {
+        match pm_sync_requests::outcome(db, ALL_PROVIDERS).await {
             Ok(Some(out)) => {
                 if let Some(err) = out.error {
                     tracing::warn!(error = %err, "daemon reported a sync failure");
@@ -386,30 +265,7 @@ async fn ask_daemon_to_sync(
                 return Ok(Some(SyncResult { ok: true, detail }));
             }
             Ok(None) => continue,
-            // `cmd_err!`, never a bare `{e}`: every `pm_sync_requests` query adds its
-            // own `.context(...)`, and `anyhow`'s `Display` renders ONLY the outermost
-            // one. This site shipped as `could not read the sync outcome: reading the
-            // PM sync outcome` on a machine whose database was corrupt - the context
-            // twice over and the actual `(code: 11) database disk image is malformed`
-            // nowhere, which is precisely the 1.83.2 field incident `cmd_err!` was
-            // written for.
-            Err(e) => {
-                let rendered = crate::cmd_err!(e, "could not read the PM sync outcome");
-                // Recycle on a broken view here too, then keep waiting rather than
-                // failing: the request row is written and the daemon is servicing it,
-                // so a healed pool on the next poll turn still reports a real result.
-                if db.recover_if_corrupt(&e).await {
-                    tracing::info!("recycled the pool mid-wait - continuing to poll");
-                    continue;
-                }
-                return Err(explain_outbox_failure(
-                    &pool,
-                    &e,
-                    &rendered,
-                    "could not read the sync outcome",
-                )
-                .await);
-            }
+            Err(e) => return Err(format!("could not read the sync outcome: {e}")),
         }
     }
 }
@@ -424,7 +280,7 @@ async fn ask_daemon_to_sync(
 /// is not evidence anyone is about to make a decision from the whole board. The two
 /// screens that genuinely are — the daily plan and the retarget ticket picker — ask
 /// for themselves through [`request_gated_sync_tasks`]. See that command's doc.
-pub(crate) fn trigger_background_pm_force_sync(db: crate::db_pool::DbPool, reason: &'static str) {
+pub(crate) fn trigger_background_pm_force_sync(db: Option<SqlitePool>, reason: &'static str) {
     request_sync(db, SyncMode::Force, reason);
 }
 
@@ -435,45 +291,74 @@ pub(crate) fn trigger_background_pm_force_sync(db: crate::db_pool::DbPool, reaso
 /// result, so a queued row that the next daemon start services is the right outcome -
 /// spawning a process per window open is exactly the cost this replaced.
 ///
-/// Takes the [`crate::db_pool::DbPool`] HANDLE and resolves it **inside** the spawned
-/// task, not at the call site.
+/// Takes `Option<SqlitePool>` (i.e. `DbPool::get()`) rather than a pool or an
+/// `AppHandle`, because `None` is a real state and not an error: the pool is closed
+/// while a corrupt DB is being repaired. Callers pass what they already hold, which
+/// is a `DbPool` in the integration paths and app state in the window paths.
 ///
-/// This parameter used to be `Option<SqlitePool>`, and the reasoning was that `None`
-/// is a real state (the pool is closed while a corrupt DB is repaired) so callers
-/// should pass what they already hold. The state check was right; taking a pool to do
-/// it was not. Every caller is a connect-success path, and those paths **restart the
-/// daemon**, which calls `DbPool::close`. A pool resolved before that point is dead by
-/// the time this task runs - `integrations.rs` even had a comment explaining that it
-/// grabbed the pool early "so the sync request can still be written afterwards",
-/// which is precisely backwards. Resolving after the spawn means the task sees
-/// whichever generation is live when it actually writes.
-///
-/// Best-effort by design: these fire from connect-success paths where a failure must
-/// never block the thing the user asked for, and the next trigger (or their explicit
-/// "Sync now") retries anyway. A corrupt database is the one exception worth
-/// surfacing, so it still raises the banner.
-fn request_sync(db: crate::db_pool::DbPool, mode: SyncMode, reason: &'static str) {
+/// Best-effort by design: these fire from window-open and connect-success paths
+/// where a failure must never block the thing the user asked for, and the next
+/// trigger (or their explicit "Sync now") retries anyway.
+fn request_sync(db: Option<SqlitePool>, mode: SyncMode, reason: &'static str) {
+    let Some(db) = db else {
+        tracing::debug!(reason, "pm sync request skipped - database not open");
+        return;
+    };
     tauri::async_runtime::spawn(async move {
-        let Some(pool) = db.get() else {
-            tracing::debug!(reason, "pm sync request skipped - database not open");
-            return;
-        };
-        match pm_sync_requests::request(&pool, ALL_PROVIDERS, mode, reason).await {
-            // Nothing waits on this one, so the sequence number is discarded.
-            Ok(_seq) => tracing::debug!(reason, mode = mode.as_str(), "pm sync requested"),
-            Err(e) => {
-                // Full chain: `anyhow`'s `Display` would render only
-                // `"writing a PM sync request"` and drop the SQLite code under it.
-                tracing::debug!(
-                    reason,
-                    error = %meridian::errors::chain(&e),
-                    "pm sync request failed"
-                );
-                crate::db_pool::raise_if_corrupt(&pool, &e).await;
-            }
+        match pm_sync_requests::request(&db, ALL_PROVIDERS, mode, reason).await {
+            Ok(()) => tracing::debug!(reason, mode = mode.as_str(), "pm sync requested"),
+            Err(e) => tracing::debug!(reason, error = %e, "pm sync request failed"),
         }
     });
 }
 
 #[cfg(test)]
-mod tests;
+mod tests {
+    use super::*;
+
+    /// The update window: `pm_sync_requests` does not exist yet because the daemon
+    /// has not applied migration 082. The user must see a transient-update message,
+    /// never a raw SQL string that reads like database damage.
+    #[test]
+    fn a_missing_requests_table_reads_as_a_pending_update() {
+        let e = anyhow::anyhow!(
+            "error returned from database: (code: 1) no such table: pm_sync_requests"
+        );
+
+        let msg = queue_failure_message(&e);
+
+        assert_eq!(
+            msg,
+            "Meridian is still finishing an update - try again in a moment"
+        );
+        assert!(!msg.contains("no such table"), "must not leak SQL: {msg}");
+    }
+
+    /// Any OTHER write failure keeps its detail. Collapsing every error into the
+    /// friendly update message would hide a real fault (a locked or corrupt DB) behind
+    /// "try again in a moment", which never resolves.
+    #[test]
+    fn other_failures_keep_their_detail() {
+        let e = anyhow::anyhow!("database is locked");
+
+        let msg = queue_failure_message(&e);
+
+        assert!(
+            msg.contains("database is locked"),
+            "detail was dropped: {msg}"
+        );
+    }
+
+    /// A missing table that is NOT ours is somebody else's problem and must not be
+    /// reported as a pending update - that would send the user to wait out an update
+    /// that is already finished while the real fault goes unnamed.
+    #[test]
+    fn a_different_missing_table_is_not_reported_as_an_update() {
+        let e = anyhow::anyhow!("no such table: pm_tasks");
+
+        let msg = queue_failure_message(&e);
+
+        assert!(msg.contains("pm_tasks"), "detail was dropped: {msg}");
+        assert!(!msg.contains("finishing an update"), "misattributed: {msg}");
+    }
+}
diff --git a/tray/src-tauri/src/commands/tasks/tests.rs b/tray/src-tauri/src/commands/tasks/tests.rs
deleted file mode 100644
index ba3000ace..000000000
--- a/tray/src-tauri/src/commands/tasks/tests.rs
+++ /dev/null
@@ -1,162 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Unit tests for [`super`] — split out only to keep both files under the
-//! repo's 500-line cap, following the same `{mod,tests}.rs` shape as
-//! `meridian-core/src/pm_sync_requests/` and
-//! `src/intelligence/providers/jira/`.
-
-use super::*;
-async fn fresh_db() -> SqlitePool {
-    use sqlx::sqlite::SqliteConnectOptions;
-    use std::str::FromStr;
-    let opts = SqliteConnectOptions::from_str("sqlite::memory:")
-        .unwrap()
-        .create_if_missing(true);
-    let pool = SqlitePool::connect_with(opts).await.unwrap();
-    sqlx::migrate!("../../src/migrations")
-        .run(&pool)
-        .await
-        .unwrap();
-    pool
-}
-
-/// Render an error the way the real call sites do, so the tests exercise the same
-/// `rendered` string production sees rather than a hand-written one.
-fn rendered(e: &anyhow::Error) -> String {
-    format!("{e:#}")
-}
-
-async fn corrupt_notices(pool: &SqlitePool) -> i64 {
-    sqlx::query_scalar("SELECT COUNT(*) FROM system_notices WHERE notice_id = ?")
-        .bind(meridian::notices::DB_CORRUPT)
-        .fetch_one(pool)
-        .await
-        .unwrap()
-}
-
-/// The update window: `pm_sync_requests` does not exist yet because the daemon
-/// has not applied migration 082. The user must see a transient-update message,
-/// never a raw SQL string that reads like database damage.
-#[tokio::test]
-async fn a_missing_requests_table_reads_as_a_pending_update() {
-    let pool = fresh_db().await;
-    let e =
-        anyhow::anyhow!("error returned from database: (code: 1) no such table: pm_sync_requests");
-
-    let msg = explain_outbox_failure(&pool, &e, &rendered(&e), "could not queue the sync").await;
-
-    assert_eq!(msg, UPDATE_IN_PROGRESS_MESSAGE);
-    assert!(!msg.contains("no such table"), "must not leak SQL: {msg}");
-    assert_eq!(
-        corrupt_notices(&pool).await,
-        0,
-        "a pending migration is not corruption"
-    );
-}
-
-/// The regression this function was rewritten for. A corrupt database must (a) get
-/// the `db.corrupt` banner raised, which is the only surface carrying a Repair
-/// button, and (b) send the user there rather than printing SQLite's wording into
-/// a settings panel that can do nothing about it.
-#[tokio::test]
-async fn corruption_raises_the_banner_and_points_at_it() {
-    let pool = fresh_db().await;
-    let e = anyhow::anyhow!(
-        "error returned from database: (code: 11) database disk image is malformed"
-    )
-    .context("reading the PM sync outcome");
-
-    let msg =
-        explain_outbox_failure(&pool, &e, &rendered(&e), "could not read the sync outcome").await;
-
-    assert_eq!(msg, DB_DAMAGED_MESSAGE);
-    assert_eq!(
-        corrupt_notices(&pool).await,
-        1,
-        "corruption found by an outbox query must raise the same banner the daemon raises"
-    );
-    assert!(
-        !msg.contains("malformed"),
-        "the banner carries the cause; the panel should not repeat it: {msg}"
-    );
-}
-
-/// The banner's detail must carry the real cause even though the panel message
-/// does not - otherwise the diagnosis is lost exactly like the bare-`{e}` bug that
-/// hid this incident in the first place.
-#[tokio::test]
-async fn the_banner_keeps_the_full_cause_chain() {
-    let pool = fresh_db().await;
-    let e = anyhow::anyhow!(
-        "error returned from database: (code: 11) database disk image is malformed"
-    )
-    .context("reading the PM sync outcome");
-
-    explain_outbox_failure(&pool, &e, &rendered(&e), "could not read the sync outcome").await;
-
-    let detail: String =
-        sqlx::query_scalar("SELECT detail FROM system_notices WHERE notice_id = ?")
-            .bind(meridian::notices::DB_CORRUPT)
-            .fetch_one(&pool)
-            .await
-            .unwrap();
-    assert!(
-        detail.contains("database disk image is malformed"),
-        "banner dropped the cause: {detail}"
-    );
-    assert!(
-        detail.contains("reading the PM sync outcome"),
-        "banner dropped the context: {detail}"
-    );
-}
-
-/// Any OTHER failure keeps its detail. Collapsing every error into a friendly
-/// message would hide a real fault behind "try again in a moment", which never
-/// resolves. It must also NOT raise the corruption banner - that would train the
-/// user to run `db repair` for faults it cannot fix.
-#[tokio::test]
-async fn other_failures_keep_their_detail() {
-    let pool = fresh_db().await;
-    let e = anyhow::anyhow!("database is locked");
-
-    let msg = explain_outbox_failure(&pool, &e, &rendered(&e), "could not queue the sync").await;
-
-    assert!(
-        msg.contains("database is locked"),
-        "detail was dropped: {msg}"
-    );
-    assert!(msg.starts_with("could not queue the sync"), "{msg}");
-    assert_eq!(corrupt_notices(&pool).await, 0, "a lock is not corruption");
-}
-
-/// A missing table that is NOT ours is somebody else's problem and must not be
-/// reported as a pending update - that would send the user to wait out an update
-/// that is already finished while the real fault goes unnamed.
-#[tokio::test]
-async fn a_different_missing_table_is_not_reported_as_an_update() {
-    let pool = fresh_db().await;
-    let e = anyhow::anyhow!("no such table: pm_tasks");
-
-    let msg = explain_outbox_failure(&pool, &e, &rendered(&e), "could not queue the sync").await;
-
-    assert!(msg.contains("pm_tasks"), "detail was dropped: {msg}");
-    assert!(!msg.contains("finishing an update"), "misattributed: {msg}");
-}
-
-/// The two call sites differ only in their fallback phrasing, and that phrasing is
-/// what the user reads when nothing more specific applies. Pinned so a refactor
-/// cannot silently make the outcome-read failure claim the write failed.
-#[tokio::test]
-async fn the_fallback_names_the_operation_that_actually_failed() {
-    let pool = fresh_db().await;
-    let e = anyhow::anyhow!("disk I/O error");
-
-    let read =
-        explain_outbox_failure(&pool, &e, &rendered(&e), "could not read the sync outcome").await;
-    let write = explain_outbox_failure(&pool, &e, &rendered(&e), "could not queue the sync").await;
-
-    assert!(
-        read.starts_with("could not read the sync outcome"),
-        "{read}"
-    );
-    assert!(write.starts_with("could not queue the sync"), "{write}");
-}
diff --git a/tray/src-tauri/src/db_pool.rs b/tray/src-tauri/src/db_pool.rs
new file mode 100644
index 000000000..3a2aef329
--- /dev/null
+++ b/tray/src-tauri/src/db_pool.rs
@@ -0,0 +1,209 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! The tray's swappable `meridian.db` pool handle.
+//!
+//! Before this module, `meridian.db`'s pool was opened once at tray startup
+//! (`lib.rs`'s `open_existing_lazy` call) and handed to Tauri as bare
+//! `Option<meridian_core::SqlitePool>>` managed state - held for the tray
+//! process's ENTIRE lifetime, including across a daemon restart.
+//! `commands::daemon::reload_daemon` SIGHUPs the daemon (macOS: exits and
+//! relies on launchd, or in a dev session a human, to relaunch it) without the
+//! tray's own connection ever knowing a restart happened - so the tray's pool
+//! spans two different daemon process generations on the same file. That is
+//! the confirmed trigger of a real `meridian.db` corruption incident
+//! (2026-08-24): see PR #856, which fixed the daemon's shutdown to checkpoint
+//! the WAL and made the tray's own reads detect corruption immediately - both
+//! good independent hardening, but neither closes the actual gap.
+//!
+//! [`DbPool`] closes it: `reload_daemon` calls [`DbPool::close`] before
+//! signaling and [`DbPool::reopen`] once the new daemon process is confirmed
+//! up, so the tray never holds a connection spanning the boundary. Every
+//! other call site is unaffected - [`DbPool::get`] returns the exact same
+//! `Option<SqlitePool>` shape `State<Option<SqlitePool>>>::inner()` used to,
+//! just renamed, since "the pool might legitimately be absent right now" was
+//! already part of every caller's contract (a `None` during a first launch,
+//! before the daemon has created the file).
+//!
+//! # Who calls this
+//! - `lib.rs`'s setup hook constructs it and calls `app.manage`.
+//! - `commands::daemon::reload_daemon` calls `close`/`reopen` around the
+//!   signal - the one thing that could not be done through the old bare
+//!   `Option<SqlitePool>>` state.
+//! - Every dashboard/poll read that used to do
+//!   `let Some(pool) = pool.inner() else { ... }` now does the same against
+//!   `pool.get()`.
+
+use meridian_core::SqlitePool;
+use std::sync::{Arc, RwLock};
+
+/// Swappable handle to the tray's `meridian.db` pool, managed as Tauri state
+/// in place of a bare `Option<SqlitePool>>`.
+///
+/// `uri`/`key_hex` are remembered at construction so [`reopen`](Self::reopen)
+/// needs no arguments at its call site - `reload_daemon` has neither the DB
+/// path nor the encryption key on hand, only this handle.
+#[derive(Clone)]
+pub struct DbPool {
+    inner: Arc<RwLock<Option<SqlitePool>>>,
+    uri: String,
+    key_hex: Option<String>,
+}
+
+/// Manual, not derived: several call sites take `DbPool` as a `#[tauri::command]`
+/// parameter without `#[tracing::instrument(skip(...))]`, so a derived `Debug`
+/// would print `key_hex` — the raw SQLCipher key — into a span every time one
+/// of those commands runs. `key_hex.is_some()` is all any log ever needs.
+impl std::fmt::Debug for DbPool {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DbPool")
+            .field("uri", &self.uri)
+            .field("key_set", &self.key_hex.is_some())
+            .finish()
+    }
+}
+
+impl DbPool {
+    pub fn new(pool: Option<SqlitePool>, uri: String, key_hex: Option<String>) -> Self {
+        Self {
+            inner: Arc::new(RwLock::new(pool)),
+            uri,
+            key_hex,
+        }
+    }
+
+    /// The pool, if one is currently open - `None` before the daemon has
+    /// created `meridian.db` yet, or during the brief window between
+    /// [`close`](Self::close) and [`reopen`](Self::reopen) around a daemon
+    /// restart. Cheap: `sqlx::SqlitePool` is itself `Arc`-backed, so this is
+    /// a shallow clone, not a new connection.
+    pub fn get(&self) -> Option<SqlitePool> {
+        self.inner.read().unwrap_or_else(|e| e.into_inner()).clone()
+    }
+
+    /// Close the pool and clear the handle. Called before signaling the
+    /// daemon to restart, so nothing on this side keeps a connection alive
+    /// spanning the old process's shutdown and the new one's startup - see
+    /// this module's header for the corruption this closes off. Every reader
+    /// sees `get() == None` for the duration and behaves exactly as it
+    /// already does on a cold start (empty defaults, no panic).
+    pub async fn close(&self) {
+        let taken = self.inner.write().unwrap_or_else(|e| e.into_inner()).take();
+        if let Some(pool) = taken {
+            pool.close().await;
+        }
+    }
+
+    /// Reopen against the same uri/key this handle was built with. Lazy,
+    /// matching the original startup open - see that call site's doc
+    /// (`lib.rs`) for why eager fails when `meridian.db` briefly does not
+    /// exist. Best-effort: a failure here is logged and leaves `get()`
+    /// returning `None`, same as any other reason the pool isn't open yet;
+    /// the daemon's own re-creation of the file on its next write heals it
+    /// exactly as a lazy pool always has.
+    pub async fn reopen(&self) {
+        match meridian_core::open_existing_lazy(&self.uri, self.key_hex.as_deref()).await {
+            Ok(pool) => {
+                *self.inner.write().unwrap_or_else(|e| e.into_inner()) = Some(pool);
+            }
+            Err(e) => {
+                tracing::error!(
+                    error = %e,
+                    "DbPool::reopen failed - meridian.db stays unavailable until the next reload or tray restart"
+                );
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    async fn migrated_db(dir: &std::path::Path) -> (String, meridian_core::SqlitePool) {
+        use sqlx::sqlite::{SqliteConnectOptions, SqlitePoolOptions};
+        use std::str::FromStr;
+
+        let path = dir.join("db_pool_test.db");
+        let uri = format!("sqlite://{}", path.display());
+        // `open_existing`/`open_existing_lazy` both set `create_if_missing(false)`
+        // (they assume the daemon already created the file) - a test fixture
+        // needs its own connect path to create one from scratch.
+        let opts = SqliteConnectOptions::from_str(&uri)
+            .unwrap()
+            .create_if_missing(true);
+        let pool = SqlitePoolOptions::new()
+            .connect_with(opts)
+            .await
+            .expect("create db");
+        sqlx::migrate!("../../src/migrations")
+            .run(&pool)
+            .await
+            .expect("migrate");
+        pool.close().await;
+        // Reopen through the same lazy path `DbPool` itself uses, so the
+        // handle under test behaves exactly like production.
+        let pool = meridian_core::open_existing_lazy(&uri, None)
+            .await
+            .expect("reopen lazily");
+        (uri, pool)
+    }
+
+    /// `get()` must return exactly what was passed to `new()`.
+    #[tokio::test]
+    async fn get_returns_the_pool_it_was_built_with() {
+        let dir = tempfile::tempdir().unwrap();
+        let (uri, pool) = migrated_db(dir.path()).await;
+        let handle = DbPool::new(Some(pool), uri, None);
+        assert!(handle.get().is_some());
+    }
+
+    /// A handle built with no pool (e.g. the DB isn't open yet) must behave
+    /// exactly like the old `None` state every caller already handles.
+    #[tokio::test]
+    async fn get_is_none_when_built_empty() {
+        let handle = DbPool::new(None, "sqlite://does-not-matter".to_string(), None);
+        assert!(handle.get().is_none());
+    }
+
+    /// The exact sequence `reload_daemon` runs: close, then a read in
+    /// between must see `None` (nothing races the daemon's restart), then
+    /// reopen brings a working pool back without needing to be told the URI
+    /// again.
+    #[tokio::test]
+    async fn close_then_reopen_restores_a_working_pool() {
+        let dir = tempfile::tempdir().unwrap();
+        let (uri, pool) = migrated_db(dir.path()).await;
+        let handle = DbPool::new(Some(pool), uri, None);
+
+        handle.close().await;
+        assert!(
+            handle.get().is_none(),
+            "a reader between close() and reopen() must see no pool, not a stale one"
+        );
+
+        handle.reopen().await;
+        let reopened = handle.get().expect("reopen must restore a pool");
+        // Prove it's a genuinely live connection, not just a non-None marker.
+        meridian_core::ping(&reopened)
+            .await
+            .expect("reopened pool must actually work");
+    }
+
+    /// `reopen` must not panic on failure, and must leave `get()` at `None`
+    /// rather than propagating the error - `reopen` is deliberately
+    /// best-effort (see its doc), the same shape as any other reason a lazy
+    /// pool isn't open yet. A missing/wrong-shaped file is NOT enough to
+    /// prove this (`open_existing_lazy` defers that check to first use, so
+    /// it would return `Ok` here regardless) - an invalid key is what
+    /// actually fails synchronously, at `validate_key_hex` inside
+    /// `open_existing_lazy` itself, before any connection is attempted.
+    #[tokio::test]
+    async fn reopen_failure_leaves_the_handle_empty_not_panicked() {
+        let handle = DbPool::new(
+            None,
+            "sqlite://does-not-matter".to_string(),
+            Some("not-valid-hex".to_string()),
+        );
+        handle.reopen().await;
+        assert!(handle.get().is_none());
+    }
+}
diff --git a/tray/src-tauri/src/db_pool/mod.rs b/tray/src-tauri/src/db_pool/mod.rs
deleted file mode 100644
index 2b5f8a0c4..000000000
--- a/tray/src-tauri/src/db_pool/mod.rs
+++ /dev/null
@@ -1,342 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! The tray's swappable `meridian.db` pool handle.
-//!
-//! Before this module, `meridian.db`'s pool was opened once at tray startup
-//! (`lib.rs`'s `open_existing_lazy` call) and handed to Tauri as bare
-//! `Option<meridian_core::SqlitePool>>` managed state - held for the tray
-//! process's ENTIRE lifetime, including across a daemon restart.
-//! `commands::daemon::reload_daemon` SIGHUPs the daemon (macOS: exits and
-//! relies on launchd, or in a dev session a human, to relaunch it) without the
-//! tray's own connection ever knowing a restart happened - so the tray's pool
-//! spans two different daemon process generations on the same file. That is
-//! the confirmed trigger of a real `meridian.db` corruption incident
-//! (2026-08-24): see PR #856, which fixed the daemon's shutdown to checkpoint
-//! the WAL and made the tray's own reads detect corruption immediately - both
-//! good independent hardening, but neither closes the actual gap.
-//!
-//! [`DbPool`] closes it: `reload_daemon` calls [`DbPool::close`] before
-//! signaling and [`DbPool::reopen`] once the new daemon process is confirmed
-//! up, so the tray never holds a connection spanning the boundary. Every
-//! other call site is unaffected - [`DbPool::get`] returns the exact same
-//! `Option<SqlitePool>` shape `State<Option<SqlitePool>>>::inner()` used to,
-//! just renamed, since "the pool might legitimately be absent right now" was
-//! already part of every caller's contract (a `None` during a first launch,
-//! before the daemon has created the file).
-//!
-//! # Who calls this
-//! - `lib.rs`'s setup hook constructs it and calls `app.manage`.
-//! - `commands::daemon::reload_daemon` calls `close`/`reopen` around the
-//!   signal - the one thing that could not be done through the old bare
-//!   `Option<SqlitePool>>` state.
-//! - Every dashboard/poll read that used to do
-//!   `let Some(pool) = pool.inner() else { ... }` now does the same against
-//!   `pool.get()`.
-//! - Anything that touches this pool and can fail calls
-//!   [`raise_if_corrupt`] on the error - see that function's doc.
-
-use meridian_core::SqlitePool;
-use std::sync::{Arc, RwLock};
-use std::time::Instant;
-
-/// The managed [`DbPool`] handle, from an app handle.
-///
-/// For code that must reach the pool but is not a `#[tauri::command]` (so it
-/// cannot take `State<'_, DbPool>`): the capture consumers, the poll loop's
-/// guards, `resume_capture`.
-///
-/// # Take the HANDLE, never a pool snapshot
-///
-/// The point of returning `DbPool` rather than `Option<SqlitePool>` is that
-/// callers must resolve [`DbPool::get`] **at each use**. A long-lived task that
-/// clones the `SqlitePool` once and keeps it is the exact bug this exists to
-/// prevent: [`close`](DbPool::close) can only reach the pool inside this
-/// handle, so an escaped clone keeps its connections - and its WAL-index
-/// (`-shm`) mapping - alive across the daemon restart the close/reopen dance
-/// exists to fence off. Measured on 1.91.0-staging.2: the capture consumers
-/// held such a clone for the whole process lifetime and wrote through it every
-/// ~2.5 s, and after a reconnect-triggered daemon restart every write failed
-/// with `(code: 11) database disk image is malformed` **while the file itself
-/// was healthy** (`db check`: 40 tables clean) and reads kept succeeding. Only
-/// writes break, because reads can still be served from the main file while the
-/// WAL write path cannot.
-pub(crate) fn from_app(app: &tauri::AppHandle) -> Option<DbPool> {
-    use tauri::Manager;
-    app.try_state::<DbPool>().map(|s| s.inner().clone())
-}
-
-/// If `err` indicates `meridian.db` is corrupt, raise the SAME `db.corrupt`
-/// notice `main.rs`'s `etl_tick` raises on the daemon side - immediately,
-/// from whichever side of the app noticed first.
-///
-/// The daemon already had this covered for its own queries, but the tray holds
-/// its own independent, long-lived pool on the same file (opened once at
-/// startup, `lib.rs`'s `app.manage(db_pool)`) and touches different tables on
-/// its own cadence. In the incident this was written for, the tray's poll-loop
-/// reads hit `(code: 11) database disk image is malformed` a full 5+ minutes
-/// before any daemon-side query happened to touch the same damage - and until
-/// this function existed, that whole window was silent `tracing::warn!` noise
-/// with no banner, because nothing on this side of the process ever called
-/// `raise_typed`. Idempotent (`raise_typed` upserts), so calling it on every
-/// failing tick is safe and cheap - it does not need its own latch the way the
-/// daemon's ETL loop does, because a tick that keeps failing just keeps
-/// refreshing the same notice row rather than retrying a query with side
-/// effects.
-///
-/// # Why this lives here and not in `poll::refresh`
-///
-/// It started as a private helper wrapping that loop's four dashboard READS,
-/// which quietly made "the tray noticed corruption" mean "one of four specific
-/// reads noticed corruption". `commands::tasks`' PM-sync outbox writes are on
-/// this same pool and outside all of it, so on a staging machine whose
-/// `meridian.db` was damaged they were the only code to find the damage - and
-/// reported it as a raw SQL string in a settings panel, with no banner and no
-/// Repair button, because the three detectors that DO know what corruption
-/// means each had a scope that excluded them:
-///
-/// - `repair_boot`'s startup probe is skipped entirely while a daemon answers
-///   (its own comment defers to "the notice banner instead");
-/// - the daemon latches only when ITS queries reach a damaged page;
-/// - this helper only covered `poll::refresh`.
-///
-/// Living on the pool module is what lets any of them call it - both `poll` and
-/// `commands` already depend on this module for `DbPool` itself.
-///
-/// # Coverage is still partial - do not read this as an invariant
-///
-/// The rule this SHOULD enforce is "a failure on the tray's pool goes through
-/// here". It does not yet. Wired today: `poll::refresh`'s four reads and
-/// `commands::tasks`' two outbox queries. **Not** wired: `commands::dashboard`,
-/// which has ~24 `cmd_err!` sites reading `pm_tasks`, triage, week and
-/// coding-agent tables - so damage confined to those pages is still found
-/// without raising the banner.
-///
-/// That gap is narrower than it looks, because `poll::refresh` re-reads the
-/// active-session/today/worklogs tables every ~30 s and the daemon latches on
-/// its own ETL path, so most real damage is reached by something that does
-/// raise. It is not zero, though, and the honest statement is that this is a
-/// convention being adopted rather than one already held everywhere. Anything
-/// added here should also be added to those sites rather than assuming they are
-/// already covered.
-pub(crate) async fn raise_if_corrupt(pool: &SqlitePool, err: &anyhow::Error) {
-    if !meridian::db::integrity::is_corrupt_error(err) {
-        return;
-    }
-    let _ = meridian::notices::raise_typed(
-        pool,
-        meridian::notices::Notice {
-            id: meridian::notices::DB_CORRUPT,
-            severity: "error",
-            title: "Meridian's database is damaged",
-            // Full chain, not `err.to_string()` - same reasoning as
-            // `crate::cmd_err!`'s doc comment: `anyhow::Error`'s `Display`
-            // renders only the outermost `.context()` and would otherwise
-            // drop the SQLite code a reader needs.
-            detail: &format!("{err:#}"),
-            remedy: Some("Quit Meridian, then run 'meridian db repair' in a terminal"),
-            event_key: meridian::notices::DB_CORRUPT,
-            deep_link: Some(meridian_core::notifications::deep_links::LOGS),
-        },
-    )
-    .await;
-}
-
-/// Swappable handle to the tray's `meridian.db` pool, managed as Tauri state
-/// in place of a bare `Option<SqlitePool>>`.
-///
-/// `uri`/`key_hex` are remembered at construction so [`reopen`](Self::reopen)
-/// needs no arguments at its call site - `reload_daemon` has neither the DB
-/// path nor the encryption key on hand, only this handle.
-#[derive(Clone)]
-pub struct DbPool {
-    inner: Arc<RwLock<Option<SqlitePool>>>,
-    uri: String,
-    key_hex: Option<String>,
-    /// Serialises [`recover_if_corrupt`](Self::recover_if_corrupt) and remembers
-    /// when it last ran, so concurrent failing writers recycle the pool once
-    /// between them instead of each racing their own close/reopen.
-    recycle: Arc<tokio::sync::Mutex<Option<Instant>>>,
-}
-
-/// Minimum gap between two pool recycles.
-///
-/// Without it, a wedged pool would recycle on EVERY failing write - the capture
-/// consumers alone write every ~2.5 s - so a fault the recycle cannot fix (real
-/// file damage, a revoked key) would turn into a close/reopen storm on the file
-/// the daemon is also using. One attempt per window, then the banner and the
-/// error stand.
-const RECYCLE_COOLDOWN: std::time::Duration = std::time::Duration::from_secs(30);
-
-/// Ceiling on the close half of a recycle.
-///
-/// `SqlitePool::close` waits for checked-out connections to come back, and the
-/// whole reason we are here is that something is wrong with this pool. Bounded so
-/// a connection that never returns cannot hold the recycle lock - and therefore
-/// every future recovery attempt - forever. `close` clears the handle
-/// synchronously before it awaits, so a timeout still leaves `get()` at `None`
-/// and the reopen below still installs a fresh pool.
-const RECYCLE_CLOSE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(5);
-
-/// Manual, not derived: several call sites take `DbPool` as a `#[tauri::command]`
-/// parameter without `#[tracing::instrument(skip(...))]`, so a derived `Debug`
-/// would print `key_hex` — the raw SQLCipher key — into a span every time one
-/// of those commands runs. `key_hex.is_some()` is all any log ever needs.
-impl std::fmt::Debug for DbPool {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("DbPool")
-            .field("uri", &self.uri)
-            .field("key_set", &self.key_hex.is_some())
-            .finish()
-    }
-}
-
-impl DbPool {
-    pub fn new(pool: Option<SqlitePool>, uri: String, key_hex: Option<String>) -> Self {
-        Self {
-            inner: Arc::new(RwLock::new(pool)),
-            uri,
-            key_hex,
-            recycle: Arc::new(tokio::sync::Mutex::new(None)),
-        }
-    }
-
-    /// Recover from a write that failed because this pool's view of the database is
-    /// broken: drop every connection and open a fresh pool. Returns whether the
-    /// caller now has a working pool and may retry.
-    ///
-    /// # Why the app must heal itself here
-    ///
-    /// On 1.91.0-staging.2 a reconnect-triggered daemon restart left the tray's
-    /// connections with a desynced WAL index (`-shm`). Reads kept working, every
-    /// write failed with `(code: 11) database disk image is malformed`, and `db
-    /// check` reported all 40 tables healthy - the data was never damaged, only this
-    /// process's bookkeeping. The only cure was quitting and relaunching the app,
-    /// which **no user has any way of knowing**. They just saw sync stop working.
-    ///
-    /// Closing and reopening the pool is what that relaunch did for the database
-    /// handle, so doing it here removes the need for the user to be told anything.
-    /// It is deliberately independent of *why* the view broke: the ordering fixes
-    /// that shipped alongside this close the mechanism we identified, but this is
-    /// what makes a mechanism we did NOT identify survivable rather than permanent.
-    ///
-    /// Non-corrupt errors return `false` immediately - a locked database or a
-    /// missing table must not trigger a reconnect.
-    ///
-    /// # Caller contract
-    ///
-    /// **Call this only after your query has returned**, never while holding a
-    /// connection from this pool. The close half waits for checked-out connections
-    /// to be returned, so a caller still holding one would wait on itself. Every
-    /// current caller is on an error path, where the connection is already back.
-    /// Exclusive access to this handle's close/reopen lifecycle.
-    ///
-    /// **Every close+reopen pair must hold this**, not just the recycle path.
-    /// `commands::daemon::reload_with_pool_cycle` had its own private lock, which
-    /// serialised reloads against each other but not against
-    /// [`recover_if_corrupt`](Self::recover_if_corrupt) - and interleaving those two
-    /// reintroduces the exact hazard the close/reopen dance exists to remove:
-    ///
-    /// 1. reload closes, handle is `None`;
-    /// 2. a recycle sees `None`, treats it as nothing to close, and REOPENS;
-    /// 3. reload then signals the daemon restart - with that fresh pool open
-    ///    across it.
-    ///
-    /// Step 3 is the 2026-08-24 corruption profile (a tray connection spanning two
-    /// daemon generations with no WAL checkpoint between them). The lock lives on the
-    /// handle rather than in either caller so a third close/reopen site cannot be
-    /// added without one.
-    ///
-    /// The guard's value is the last recycle instant, which is also what makes the
-    /// cooldown check-and-set atomic.
-    pub(crate) async fn lock_cycle(&self) -> tokio::sync::MutexGuard<'_, Option<Instant>> {
-        self.recycle.lock().await
-    }
-
-    pub(crate) async fn recover_if_corrupt(&self, err: &anyhow::Error) -> bool {
-        if !meridian::db::integrity::is_corrupt_error(err) {
-            return false;
-        }
-
-        // Held across the close/reopen on purpose: it serialises concurrent
-        // recyclers, excludes a `reload_daemon` cycle (see `lock_cycle`), and makes
-        // the cooldown check-and-set atomic.
-        let mut last = self.lock_cycle().await;
-        if let Some(at) = *last {
-            if at.elapsed() < RECYCLE_COOLDOWN {
-                tracing::debug!(
-                    "skipping meridian.db pool recycle - one ran less than {}s ago",
-                    RECYCLE_COOLDOWN.as_secs()
-                );
-                return false;
-            }
-        }
-        *last = Some(Instant::now());
-
-        tracing::warn!("recycling the meridian.db pool after a corrupt-view write failure");
-        if tokio::time::timeout(RECYCLE_CLOSE_TIMEOUT, self.close())
-            .await
-            .is_err()
-        {
-            // `close` already took the handle before awaiting, so this is safe to
-            // proceed through - the old pool is unreachable either way.
-            tracing::warn!(
-                timeout_s = RECYCLE_CLOSE_TIMEOUT.as_secs() as i64,
-                "pool close did not finish during recycle - reopening anyway"
-            );
-        }
-        self.reopen().await;
-
-        let recovered = self.get().is_some();
-        if recovered {
-            tracing::info!("meridian.db pool recycled - writes should work again");
-        } else {
-            tracing::warn!("meridian.db pool recycle did not yield a usable pool");
-        }
-        recovered
-    }
-
-    /// The pool, if one is currently open - `None` before the daemon has
-    /// created `meridian.db` yet, or during the brief window between
-    /// [`close`](Self::close) and [`reopen`](Self::reopen) around a daemon
-    /// restart. Cheap: `sqlx::SqlitePool` is itself `Arc`-backed, so this is
-    /// a shallow clone, not a new connection.
-    pub fn get(&self) -> Option<SqlitePool> {
-        self.inner.read().unwrap_or_else(|e| e.into_inner()).clone()
-    }
-
-    /// Close the pool and clear the handle. Called before signaling the
-    /// daemon to restart, so nothing on this side keeps a connection alive
-    /// spanning the old process's shutdown and the new one's startup - see
-    /// this module's header for the corruption this closes off. Every reader
-    /// sees `get() == None` for the duration and behaves exactly as it
-    /// already does on a cold start (empty defaults, no panic).
-    pub async fn close(&self) {
-        let taken = self.inner.write().unwrap_or_else(|e| e.into_inner()).take();
-        if let Some(pool) = taken {
-            pool.close().await;
-        }
-    }
-
-    /// Reopen against the same uri/key this handle was built with. Lazy,
-    /// matching the original startup open - see that call site's doc
-    /// (`lib.rs`) for why eager fails when `meridian.db` briefly does not
-    /// exist. Best-effort: a failure here is logged and leaves `get()`
-    /// returning `None`, same as any other reason the pool isn't open yet;
-    /// the daemon's own re-creation of the file on its next write heals it
-    /// exactly as a lazy pool always has.
-    pub async fn reopen(&self) {
-        match meridian_core::open_existing_lazy(&self.uri, self.key_hex.as_deref()).await {
-            Ok(pool) => {
-                *self.inner.write().unwrap_or_else(|e| e.into_inner()) = Some(pool);
-            }
-            Err(e) => {
-                tracing::error!(
-                    error = %e,
-                    "DbPool::reopen failed - meridian.db stays unavailable until the next reload or tray restart"
-                );
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/tray/src-tauri/src/db_pool/tests.rs b/tray/src-tauri/src/db_pool/tests.rs
deleted file mode 100644
index d1b983f87..000000000
--- a/tray/src-tauri/src/db_pool/tests.rs
+++ /dev/null
@@ -1,276 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Tests for the tray's swappable `meridian.db` pool handle.
-//!
-//! Split out of `mod.rs` for the 500-line file cap, following the same
-//! `{mod,tests}.rs` shape as `meridian-core/src/pm_sync_requests/` and
-//! `src/intelligence/providers/jira/`.
-
-use super::*;
-
-async fn migrated_db(dir: &std::path::Path) -> (String, meridian_core::SqlitePool) {
-    use sqlx::sqlite::{SqliteConnectOptions, SqlitePoolOptions};
-    use std::str::FromStr;
-
-    let path = dir.join("db_pool_test.db");
-    let uri = format!("sqlite://{}", path.display());
-    // `open_existing`/`open_existing_lazy` both set `create_if_missing(false)`
-    // (they assume the daemon already created the file) - a test fixture
-    // needs its own connect path to create one from scratch.
-    let opts = SqliteConnectOptions::from_str(&uri)
-        .unwrap()
-        .create_if_missing(true);
-    let pool = SqlitePoolOptions::new()
-        .connect_with(opts)
-        .await
-        .expect("create db");
-    sqlx::migrate!("../../src/migrations")
-        .run(&pool)
-        .await
-        .expect("migrate");
-    pool.close().await;
-    // Reopen through the same lazy path `DbPool` itself uses, so the
-    // handle under test behaves exactly like production.
-    let pool = meridian_core::open_existing_lazy(&uri, None)
-        .await
-        .expect("reopen lazily");
-    (uri, pool)
-}
-
-/// `get()` must return exactly what was passed to `new()`.
-#[tokio::test]
-async fn get_returns_the_pool_it_was_built_with() {
-    let dir = tempfile::tempdir().unwrap();
-    let (uri, pool) = migrated_db(dir.path()).await;
-    let handle = DbPool::new(Some(pool), uri, None);
-    assert!(handle.get().is_some());
-}
-
-/// A handle built with no pool (e.g. the DB isn't open yet) must behave
-/// exactly like the old `None` state every caller already handles.
-#[tokio::test]
-async fn get_is_none_when_built_empty() {
-    let handle = DbPool::new(None, "sqlite://does-not-matter".to_string(), None);
-    assert!(handle.get().is_none());
-}
-
-/// The exact sequence `reload_daemon` runs: close, then a read in
-/// between must see `None` (nothing races the daemon's restart), then
-/// reopen brings a working pool back without needing to be told the URI
-/// again.
-#[tokio::test]
-async fn close_then_reopen_restores_a_working_pool() {
-    let dir = tempfile::tempdir().unwrap();
-    let (uri, pool) = migrated_db(dir.path()).await;
-    let handle = DbPool::new(Some(pool), uri, None);
-
-    handle.close().await;
-    assert!(
-        handle.get().is_none(),
-        "a reader between close() and reopen() must see no pool, not a stale one"
-    );
-
-    handle.reopen().await;
-    let reopened = handle.get().expect("reopen must restore a pool");
-    // Prove it's a genuinely live connection, not just a non-None marker.
-    meridian_core::ping(&reopened)
-        .await
-        .expect("reopened pool must actually work");
-}
-
-/// **The regression test for the 1.91.0-staging.2 write wedge.**
-///
-/// A pool CLONE taken before `close()` is dead afterwards, while the handle
-/// keeps working across the same close/reopen. That is the entire difference
-/// between the old capture consumers (which cached
-/// `Option<SqlitePool>` for the process lifetime and wrote through it every
-/// ~2.5 s) and the current ones (which call `get()` per write).
-///
-/// Asserting on the clone is what makes this a real guard rather than a
-/// tautology: it proves the snapshot pattern is *observably* broken by a
-/// daemon reload, so re-introducing it anywhere cannot look harmless.
-#[tokio::test]
-async fn a_pool_snapshot_dies_across_a_reload_but_the_handle_survives() {
-    let dir = tempfile::tempdir().unwrap();
-    let (uri, pool) = migrated_db(dir.path()).await;
-    let handle = DbPool::new(Some(pool), uri, None);
-
-    // What a long-lived consumer used to cache at startup.
-    let snapshot = handle.get().expect("a pool to snapshot");
-    meridian_core::ping(&snapshot)
-        .await
-        .expect("the snapshot works before the reload");
-
-    // Exactly what `reload_daemon` does around every daemon restart.
-    handle.close().await;
-    handle.reopen().await;
-
-    assert!(
-        meridian_core::ping(&snapshot).await.is_err(),
-        "a cached SqlitePool must be observably dead after close/reopen - if this \
-         ever passes, the snapshot pattern looks safe and the capture wedge returns"
-    );
-
-    let fresh = handle.get().expect("the handle must still yield a pool");
-    meridian_core::ping(&fresh)
-        .await
-        .expect("resolving the handle per use must survive the reload");
-}
-
-fn corrupt_err() -> anyhow::Error {
-    anyhow::anyhow!("error returned from database: (code: 11) database disk image is malformed")
-        .context("writing a PM sync request")
-}
-
-/// The self-heal: a corrupt-VIEW write failure must give the caller a working
-/// pool back, with no user action.
-///
-/// This is what removes the relaunch. On 1.91.0-staging.2 a wedged pool stayed
-/// wedged for the life of the tray process, and quitting the app was the only
-/// cure - which no user could be expected to discover.
-#[tokio::test]
-async fn a_corrupt_write_recycles_the_pool_and_recovers() {
-    let dir = tempfile::tempdir().unwrap();
-    let (uri, pool) = migrated_db(dir.path()).await;
-    let handle = DbPool::new(Some(pool), uri, None);
-    let before = handle.get().expect("a pool");
-
-    assert!(
-        handle.recover_if_corrupt(&corrupt_err()).await,
-        "a corrupt write must report that recovery succeeded"
-    );
-
-    // The connections that held the broken view are gone...
-    assert!(
-        meridian_core::ping(&before).await.is_err(),
-        "the recycled pool's old connections must be dropped, not reused"
-    );
-    // ...and the caller can retry against a working one.
-    let after = handle.get().expect("a fresh pool after recycle");
-    meridian_core::ping(&after)
-        .await
-        .expect("the recycled pool must actually work");
-}
-
-/// Only corruption may recycle. A locked database, a missing table or a pending
-/// migration must leave the pool alone - dropping every connection on an ordinary
-/// transient error would turn a blip into an outage.
-#[tokio::test]
-async fn an_unrelated_error_does_not_recycle_the_pool() {
-    let dir = tempfile::tempdir().unwrap();
-    let (uri, pool) = migrated_db(dir.path()).await;
-    let handle = DbPool::new(Some(pool), uri, None);
-    let before = handle.get().expect("a pool");
-
-    let err = anyhow::anyhow!("database is locked").context("writing a PM sync request");
-    assert!(!handle.recover_if_corrupt(&err).await);
-
-    meridian_core::ping(&before)
-        .await
-        .expect("an unrelated error must leave the existing pool usable");
-}
-
-/// The cooldown. Capture writes every ~2.5 s, so a fault the recycle CANNOT fix
-/// (real file damage, a revoked key) would otherwise become a close/reopen storm
-/// on the file the daemon is also using.
-#[tokio::test]
-async fn a_second_corrupt_write_inside_the_cooldown_does_not_recycle_again() {
-    let dir = tempfile::tempdir().unwrap();
-    let (uri, pool) = migrated_db(dir.path()).await;
-    let handle = DbPool::new(Some(pool), uri, None);
-
-    assert!(handle.recover_if_corrupt(&corrupt_err()).await);
-    let after_first = handle.get().expect("a pool");
-
-    assert!(
-        !handle.recover_if_corrupt(&corrupt_err()).await,
-        "a second failure moments later must be refused, not recycled again"
-    );
-    meridian_core::ping(&after_first)
-        .await
-        .expect("the refused attempt must not have torn down the working pool");
-}
-
-/// In-memory, schema-migrated. Enough for [`raise_if_corrupt`], which only
-/// inspects the error it is handed and needs a `system_notices` table to
-/// write into - real corrupted bytes on disk are not required, and
-/// `sqlite::memory:` cannot be corrupted anyway (see
-/// `src/db/test_corrupt.rs` for fixtures that can).
-async fn fresh_db() -> SqlitePool {
-    use sqlx::sqlite::SqliteConnectOptions;
-    use std::str::FromStr;
-    let opts = SqliteConnectOptions::from_str("sqlite::memory:")
-        .unwrap()
-        .create_if_missing(true);
-    let pool = SqlitePool::connect_with(opts).await.unwrap();
-    sqlx::migrate!("../../src/migrations")
-        .run(&pool)
-        .await
-        .unwrap();
-    pool
-}
-
-/// Whichever side of the app touches this pool must raise `db.corrupt` the
-/// moment IT hits corruption, not wait for a daemon-side query to stumble
-/// onto the same damage minutes later. `db::integrity::is_corrupt_error`
-/// (the classifier this delegates to) is already pinned against the real
-/// field-incident shape elsewhere.
-#[tokio::test]
-async fn raise_if_corrupt_writes_the_notice_on_a_corrupt_error() {
-    let pool = fresh_db().await;
-    let err = anyhow::anyhow!(
-        "error returned from database: (code: 11) database disk image is malformed"
-    )
-    .context("current_task: fetch most recent task session");
-
-    raise_if_corrupt(&pool, &err).await;
-
-    let row: (String, String) =
-        sqlx::query_as("SELECT severity, detail FROM system_notices WHERE notice_id = ?")
-            .bind(meridian::notices::DB_CORRUPT)
-            .fetch_one(&pool)
-            .await
-            .expect("db.corrupt notice must be written");
-    assert_eq!(row.0, "error");
-    assert!(
-        row.1.contains("database disk image is malformed"),
-        "notice detail dropped the actual cause: {}",
-        row.1
-    );
-}
-
-/// Every other failure (a lock, a missing table, a network blip on an
-/// unrelated call) must NOT raise the corruption banner — that would train
-/// the user to run `db repair` for faults it can't fix.
-#[tokio::test]
-async fn raise_if_corrupt_is_silent_on_unrelated_errors() {
-    let pool = fresh_db().await;
-    let err = anyhow::anyhow!("database is locked").context("today: fetch sessions");
-
-    raise_if_corrupt(&pool, &err).await;
-
-    let count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM system_notices WHERE notice_id = ?")
-        .bind(meridian::notices::DB_CORRUPT)
-        .fetch_one(&pool)
-        .await
-        .unwrap();
-    assert_eq!(count, 0, "an unrelated error must not raise db.corrupt");
-}
-
-/// `reopen` must not panic on failure, and must leave `get()` at `None`
-/// rather than propagating the error - `reopen` is deliberately
-/// best-effort (see its doc), the same shape as any other reason a lazy
-/// pool isn't open yet. A missing/wrong-shaped file is NOT enough to
-/// prove this (`open_existing_lazy` defers that check to first use, so
-/// it would return `Ok` here regardless) - an invalid key is what
-/// actually fails synchronously, at `validate_key_hex` inside
-/// `open_existing_lazy` itself, before any connection is attempted.
-#[tokio::test]
-async fn reopen_failure_leaves_the_handle_empty_not_panicked() {
-    let handle = DbPool::new(
-        None,
-        "sqlite://does-not-matter".to_string(),
-        Some("not-valid-hex".to_string()),
-    );
-    handle.reopen().await;
-    assert!(handle.get().is_none());
-}
diff --git a/tray/src-tauri/src/lib.rs b/tray/src-tauri/src/lib.rs
index 7899b0717..670b2e325 100644
--- a/tray/src-tauri/src/lib.rs
+++ b/tray/src-tauri/src/lib.rs
@@ -936,10 +936,8 @@ pub fn run() {
                     None,
                 ));
             }
-            // (No `capture_pool` binding here any more: `start_capture` takes the
-            // managed `DbPool` handle and resolves it per write, so the raw
-            // `Option<SqlitePool>` this used to carry across to it is exactly the
-            // snapshot that wedged capture writes after a daemon restart.)
+            #[cfg(feature = "capture")]
+            let capture_pool = db_setup_result;
 
             // Single source of truth for the tray menu lives in `tray.rs`, so the
             // poll loop's health-driven rebuild can't drift out of sync. Initial
@@ -1241,19 +1239,8 @@ pub fn run() {
             // that task, never the tray (we gave up the screenpipe daemon's process
             // isolation, so this matters). Frames → capture_frames (slice 4a),
             // input events → capture_ui_events (slice 3c).
-            // Pass the managed HANDLE, never `capture_pool` (the raw
-            // `Option<SqlitePool>` snapshot from setup) - see `start_capture`'s doc.
-            // Always `Some` by here: the fallback above registers an empty handle on
-            // the panic path, so this only skips capture if managed state is somehow
-            // absent entirely, which nothing else could work through either.
             #[cfg(feature = "capture")]
-            if let Some(db) = db_pool::from_app(app.handle()) {
-                start_capture(app_state.clone(), db);
-            } else {
-                tracing::error!(
-                    "capture not started - the DbPool handle is not managed, so nothing could persist frames"
-                );
-            }
+            start_capture(app_state.clone(), capture_pool);
 
             // Auto-open the setup wizard on first launch (no ~/.meridian/onboarded).
             // The 800 ms delay lets the tray menu settle before the window appears.
@@ -1692,23 +1679,9 @@ fn tray_debug(window: tauri::Window, msg: String) {
 /// Once from `lib.rs`'s `setup()` on launch, and again from
 /// `commands::pause_for_duration` on resume.
 #[cfg(feature = "capture")]
-/// Start (or restart) the in-process capture engine and its persisting consumers.
-///
-/// # `db` is the HANDLE, deliberately not a pool
-///
-/// The consumers below live for the whole tray process and write every ~2.5 s, so
-/// they must resolve [`db_pool::DbPool::get`] **per write** rather than caching a
-/// `SqlitePool`. This parameter used to be `Option<SqlitePool>` - a snapshot taken
-/// once at start - and that was the 1.91.0-staging.2 write-wedge: `DbPool::close`
-/// (run by `reload_daemon` around every daemon restart, precisely so the tray never
-/// holds a connection across one) cannot reach a clone that escaped the handle, so
-/// the capture connections spanned the daemon's shutdown WAL TRUNCATE checkpoint,
-/// desynced their `-shm` view, and every subsequent write failed with `(code: 11)
-/// database disk image is malformed` - permanently, on a database that was
-/// provably healthy. See [`db_pool::from_app`] for the measured detail.
 pub(crate) fn start_capture(
     app_state: std::sync::Arc<std::sync::Mutex<AppState>>,
-    db: db_pool::DbPool,
+    pool: Option<meridian_core::SqlitePool>,
 ) {
     use capture::{screenpipe::ScreenpipeEngine, CaptureEngine};
 
@@ -1782,10 +1755,7 @@ pub(crate) fn start_capture(
     // Handles both item shapes the engine can send — the primary per-tick frame
     // and secondary-monitor context samples (multi-screen capture) — through the
     // same ignore-list gate, routed to their own tables.
-    // The HANDLE, cloned (cheap - `Arc`-backed). Every write below resolves
-    // `.get()` afresh, so a daemon-restart close/reopen is followed rather than
-    // outlived. Never hoist this into a `SqlitePool` outside the loop.
-    let consumer_pool = db.clone();
+    let consumer_pool = pool.clone();
     let frame_ignore = capture_ignore.clone();
     tauri::async_runtime::spawn(async move {
         while let Some(item) = rx.recv().await {
@@ -1811,7 +1781,7 @@ pub(crate) fn start_capture(
                         );
                         continue;
                     }
-                    let Some(p) = consumer_pool.get() else {
+                    let Some(p) = consumer_pool.as_ref() else {
                         continue;
                     };
                     let row = meridian_core::CaptureFrameInsert {
@@ -1822,20 +1792,8 @@ pub(crate) fn start_capture(
                         text: frame.text,
                         text_source: frame.text_source.as_str().to_string(),
                     };
-                    if let Err(e) = meridian_core::insert_capture_frame(&p, &row).await {
-                        // `cmd_err!`, not `%e`: this site logged only the outermost
-                        // context (`insert capture_frame`) and threw the cause away,
-                        // so a fleet-wide write wedge was undiagnosable from logs -
-                        // the same swallowed-cause bug `cmd_err!` was written for.
-                        let _ = crate::cmd_err!(e, "capture: failed to persist frame");
-                        // These writes land every ~2.5 s, which makes them both the
-                        // first thing on the machine to notice a broken pool view and
-                        // the natural place to heal it - so the app recovers within
-                        // seconds instead of waiting for a relaunch the user has no
-                        // reason to know about. No retry: the next frame is 2.5 s away
-                        // and will use the fresh pool.
-                        db_pool::raise_if_corrupt(&p, &e).await;
-                        consumer_pool.recover_if_corrupt(&e).await;
+                    if let Err(e) = meridian_core::insert_capture_frame(p, &row).await {
+                        tracing::warn!(error = %e, "capture: failed to persist frame");
                     }
                 }
                 capture::CaptureItem::Secondary(sample) => {
@@ -1857,7 +1815,7 @@ pub(crate) fn start_capture(
                         );
                         continue;
                     }
-                    let Some(p) = consumer_pool.get() else {
+                    let Some(p) = consumer_pool.as_ref() else {
                         continue;
                     };
                     let row = meridian_core::CaptureSecondaryScreenInsert {
@@ -1867,13 +1825,8 @@ pub(crate) fn start_capture(
                         window_name: sample.window_name,
                         text: sample.text,
                     };
-                    if let Err(e) = meridian_core::insert_capture_secondary_screen(&p, &row).await {
-                        let _ = crate::cmd_err!(
-                            e,
-                            "capture: failed to persist secondary-screen sample"
-                        );
-                        db_pool::raise_if_corrupt(&p, &e).await;
-                        consumer_pool.recover_if_corrupt(&e).await;
+                    if let Err(e) = meridian_core::insert_capture_secondary_screen(p, &row).await {
+                        tracing::warn!(error = %e, "capture: failed to persist secondary-screen sample");
                     }
                 }
             }
@@ -1904,8 +1857,7 @@ pub(crate) fn start_capture(
     // UI event consumer: exits on cancel signal, which drops ui_rx, causing
     // the OS recorder thread to see tx.is_closed() within 500ms and exit.
     let (ui_tx, mut ui_rx) = tokio::sync::mpsc::channel::<meridian_core::CaptureUiEventInsert>(256);
-    // The handle, not a pool - same reason as `consumer_pool` above.
-    let ui_pool = db;
+    let ui_pool = pool;
     let ui_ignore = capture_ignore;
     tauri::async_runtime::spawn(async move {
         loop {
@@ -1919,11 +1871,9 @@ pub(crate) fn start_capture(
                     if ui_ignore.lock().unwrap().should_drop_app(ev.app_name.as_deref()) {
                         continue;
                     }
-                    let Some(p) = ui_pool.get() else { continue };
-                    if let Err(e) = meridian_core::insert_capture_ui_event(&p, &ev).await {
-                        let _ = crate::cmd_err!(e, "capture: failed to persist ui event");
-                        db_pool::raise_if_corrupt(&p, &e).await;
-                        ui_pool.recover_if_corrupt(&e).await;
+                    let Some(p) = ui_pool.as_ref() else { continue };
+                    if let Err(e) = meridian_core::insert_capture_ui_event(p, &ev).await {
+                        tracing::warn!(error = %e, "capture: failed to persist ui event");
                     }
                 }
             }
@@ -1958,50 +1908,3 @@ pub(crate) fn start_capture(
     s.ui_recorder_thread = Some(ui_recorder_thread);
     tracing::info!("capture: engine and ui recorder started");
 }
-
-#[cfg(test)]
-mod capture_pool_lifetime_tests {
-    /// The capture consumers must resolve the pool PER WRITE, never cache one.
-    ///
-    /// `start_capture` spawns three consumers that live for the whole tray
-    /// process and write every ~2.5 s. Until 1.91.0-staging.2 they captured
-    /// `Option<SqlitePool>` once at start, which `DbPool::close` (run by
-    /// `reload_daemon` around every daemon restart) cannot reach — so those
-    /// connections spanned the daemon's shutdown WAL TRUNCATE checkpoint,
-    /// desynced their `-shm` view, and every write from then on failed with
-    /// `(code: 11) database disk image is malformed` on a database that `db
-    /// check` reported healthy. Reads kept working, which is why it read as
-    /// corruption rather than as a connection bug.
-    ///
-    /// `a_pool_snapshot_dies_across_a_reload_but_the_handle_survives` in
-    /// `db_pool` proves the snapshot is dead after a reload; this proves these
-    /// particular call sites don't take one. It scans the source because the
-    /// consumers need a live tray app, an OS capture engine and a real daemon
-    /// restart to exercise — the same reason `main.rs`'s startup/shutdown
-    /// ordering tests scan rather than execute.
-    #[test]
-    fn capture_consumers_resolve_the_pool_per_write() {
-        const SRC: &str = include_str!("lib.rs");
-        let prod = SRC
-            .split_once("\n#[cfg(test)]\nmod capture_pool_lifetime_tests")
-            .map_or(SRC, |(before, _)| before);
-
-        for cached in ["let consumer_pool = pool.clone();", "let ui_pool = pool;"] {
-            assert!(
-                !prod.contains(cached),
-                "`{cached}` caches a SqlitePool for the capture consumers' whole \
-                 lifetime. Pass the `DbPool` handle and call `.get()` inside the \
-                 write loop instead - see `start_capture`'s doc for the wedge this \
-                 caused."
-            );
-        }
-
-        let handle_sites =
-            prod.matches("consumer_pool.get()").count() + prod.matches("ui_pool.get()").count();
-        assert_eq!(
-            handle_sites, 3,
-            "expected all 3 capture write sites (frame, secondary-screen, ui event) \
-             to resolve the handle per write, found {handle_sites}"
-        );
-    }
-}
diff --git a/tray/src-tauri/src/poll/mod.rs b/tray/src-tauri/src/poll/mod.rs
index 4e59633b2..832a1fc09 100644
--- a/tray/src-tauri/src/poll/mod.rs
+++ b/tray/src-tauri/src/poll/mod.rs
@@ -122,7 +122,7 @@ pub async fn run_poll_loop(app: tauri::AppHandle, state: Arc<Mutex<AppState>>) {
         // check_disk_space's doc comment for why writing into a nearly-full
         // disk must stop rather than degrade silently.
         if let Some(pool) = &pool {
-            check_disk_space(&app, &state, pool).await;
+            check_disk_space(&state, pool).await;
         }
         // Work-hours schedule enforcement: auto-pause capture outside the
         // configured window, auto-resume when entering it. Only fires when the
@@ -223,11 +223,7 @@ fn update_tray_icon(app: &tauri::AppHandle, state: &Arc<Mutex<AppState>>) {
 /// timer) is separately gated in [`crate::commands::pause::resume_capture`],
 /// so a still-low disk can't be resumed into from any direction — this
 /// function only owns the disk-low pause's own start/end transition.
-async fn check_disk_space(
-    app: &tauri::AppHandle,
-    state: &Arc<Mutex<AppState>>,
-    pool: &meridian_core::SqlitePool,
-) {
+async fn check_disk_space(state: &Arc<Mutex<AppState>>, pool: &meridian_core::SqlitePool) {
     let low = meridian::health::platform::meridian_data_low_gb().is_some();
 
     let (pause_source, started_at, capture_paused_flag) = {
@@ -351,11 +347,8 @@ async fn check_disk_space(
             // rare blip (engine starts and stops within the same tick,
             // capturing nothing) rather than a bug worth cross-checking
             // schedule state here too.
-            // The managed handle, not `pool` - see `start_capture`'s doc.
             #[cfg(feature = "capture")]
-            if let Some(db) = crate::db_pool::from_app(app) {
-                crate::start_capture(state.clone(), db);
-            }
+            crate::start_capture(state.clone(), Some(pool.clone()));
             tracing::info!(duration_s, "disk-space guard: capture resumed");
         }
         _ => {
@@ -451,12 +444,9 @@ async fn check_work_hours(
                 s.schedule_resume_at = None;
                 s.pause_until = None;
             }
-            // Restart engine so screen recording resumes. The managed handle, not
-            // `pool` - see `start_capture`'s doc.
+            // Restart engine so screen recording resumes.
             #[cfg(feature = "capture")]
-            if let Some(db) = crate::db_pool::from_app(app) {
-                crate::start_capture(state.clone(), db);
-            }
+            crate::start_capture(state.clone(), Some(pool.clone()));
             tracing::info!(
                 duration_s,
                 "work-hours: schedule pause ended — capture resumed"
diff --git a/tray/src-tauri/src/poll/refresh.rs b/tray/src-tauri/src/poll/refresh.rs
index 39b400499..eaaebcead 100644
--- a/tray/src-tauri/src/poll/refresh.rs
+++ b/tray/src-tauri/src/poll/refresh.rs
@@ -394,6 +394,47 @@ fn decide_health_notice(
     }
 }
 
+/// If `err` indicates `meridian.db` is corrupt, raise the SAME `db.corrupt`
+/// notice `main.rs`'s `etl_tick` raises on the daemon side - immediately,
+/// from whichever side of the app noticed first.
+///
+/// The daemon already had this covered for its own queries, but the tray
+/// holds its own independent, long-lived pool on the same file (opened once
+/// at startup, `lib.rs`'s `app.manage(db_pool)`) and reads different tables
+/// on this loop's faster (~30 s) cadence than the daemon's ETL/summariser
+/// ticks. In the incident this fixes, the tray's own reads here hit
+/// `(code: 11) database disk image is malformed` a full 5+ minutes before any
+/// daemon-side query happened to touch the same damage - and until this
+/// function existed, that whole window was silent `tracing::warn!` noise with
+/// no banner, because nothing on this side of the process ever called
+/// `raise_typed`. Idempotent (`raise_typed` upserts), so calling this on
+/// every failing tick is safe and cheap - it does not need its own latch the
+/// way the daemon's ETL loop does, because a poll tick that keeps failing
+/// just keeps refreshing the same notice row rather than retrying a query
+/// with side effects.
+async fn raise_if_corrupt(pool: &SqlitePool, err: &anyhow::Error) {
+    if !meridian::db::integrity::is_corrupt_error(err) {
+        return;
+    }
+    let _ = meridian::notices::raise_typed(
+        pool,
+        meridian::notices::Notice {
+            id: meridian::notices::DB_CORRUPT,
+            severity: "error",
+            title: "Meridian's database is damaged",
+            // Full chain, not `err.to_string()` - same reasoning as
+            // `crate::cmd_err!`'s doc comment: `anyhow::Error`'s `Display`
+            // renders only the outermost `.context()` and would otherwise
+            // drop the SQLite code a reader needs.
+            detail: &format!("{err:#}"),
+            remedy: Some("Quit Meridian, then run 'meridian db repair' in a terminal"),
+            event_key: meridian::notices::DB_CORRUPT,
+            deep_link: Some(meridian_core::notifications::deep_links::LOGS),
+        },
+    )
+    .await;
+}
+
 /// Read the active session (direct DB) and store the app name + elapsed seconds.
 /// On a read error we keep the previous value rather than clearing the pill on a
 /// transient blip.
@@ -414,7 +455,7 @@ pub(super) async fn refresh_active(pool: &SqlitePool, state: &Arc<Mutex<AppState
             // drop exactly the cause (e.g. a corrupt DB's SQLite code) that a
             // reader needs.
             tracing::warn!(error = %meridian::errors::chain(&e), "refresh_active failed");
-            crate::db_pool::raise_if_corrupt(pool, &e).await;
+            raise_if_corrupt(pool, &e).await;
             return;
         }
     };
@@ -454,7 +495,7 @@ pub(super) async fn refresh_current_task(pool: &SqlitePool, state: &Arc<Mutex<Ap
         }
         Err(e) => {
             tracing::warn!(error = %meridian::errors::chain(&e), "refresh_current_task failed");
-            crate::db_pool::raise_if_corrupt(pool, &e).await;
+            raise_if_corrupt(pool, &e).await;
         }
     }
 }
@@ -509,7 +550,7 @@ pub(super) async fn refresh_today(pool: &SqlitePool, state: &Arc<Mutex<AppState>
         }
         Err(e) => {
             tracing::warn!(error = %meridian::errors::chain(&e), "refresh_today failed");
-            crate::db_pool::raise_if_corrupt(pool, &e).await;
+            raise_if_corrupt(pool, &e).await;
         }
     }
 }
@@ -544,7 +585,7 @@ pub(super) async fn refresh_worklogs(pool: &SqlitePool, state: &Arc<Mutex<AppSta
         }
         Err(e) => {
             tracing::warn!(error = %meridian::errors::chain(&e), "refresh_worklogs failed");
-            crate::db_pool::raise_if_corrupt(pool, &e).await;
+            raise_if_corrupt(pool, &e).await;
         }
     }
 }
@@ -956,8 +997,54 @@ mod tests {
         assert!(!recovered.reconcile_stale);
     }
 
-    // `raise_if_corrupt`'s own tests moved with it to `crate::db_pool`, which
-    // is where the four call sites above now point.
+    /// The tray's own reads must raise `db.corrupt` the moment THEY hit
+    /// corruption, not wait for a daemon-side query to stumble onto the same
+    /// damage minutes later — the gap this fix closes. Real corrupted bytes on
+    /// disk aren't needed: `raise_if_corrupt` only inspects the error, and
+    /// `db::integrity::is_corrupt_error` (the classifier it delegates to) is
+    /// already pinned against the real field-incident shape elsewhere.
+    #[tokio::test]
+    async fn raise_if_corrupt_writes_the_notice_on_a_corrupt_error() {
+        let pool = fresh_db().await;
+        let err = anyhow::anyhow!(
+            "error returned from database: (code: 11) database disk image is malformed"
+        )
+        .context("current_task: fetch most recent task session");
+
+        raise_if_corrupt(&pool, &err).await;
+
+        let row: (String, String) =
+            sqlx::query_as("SELECT severity, detail FROM system_notices WHERE notice_id = ?")
+                .bind(meridian::notices::DB_CORRUPT)
+                .fetch_one(&pool)
+                .await
+                .expect("db.corrupt notice must be written");
+        assert_eq!(row.0, "error");
+        assert!(
+            row.1.contains("database disk image is malformed"),
+            "notice detail dropped the actual cause: {}",
+            row.1
+        );
+    }
+
+    /// Every other read failure (a lock, a missing table, a network blip on an
+    /// unrelated call) must NOT raise the corruption banner — that would train
+    /// the user to run `db repair` for faults it can't fix.
+    #[tokio::test]
+    async fn raise_if_corrupt_is_silent_on_unrelated_errors() {
+        let pool = fresh_db().await;
+        let err = anyhow::anyhow!("database is locked").context("today: fetch sessions");
+
+        raise_if_corrupt(&pool, &err).await;
+
+        let count: i64 =
+            sqlx::query_scalar("SELECT COUNT(*) FROM system_notices WHERE notice_id = ?")
+                .bind(meridian::notices::DB_CORRUPT)
+                .fetch_one(&pool)
+                .await
+                .unwrap();
+        assert_eq!(count, 0, "an unrelated error must not raise db.corrupt");
+    }
 
     async fn fresh_db() -> meridian_core::SqlitePool {
         use sqlx::sqlite::SqliteConnectOptions;

From fd0db1e97521d985f193365b45fc1a30556c7821 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Thu, 27 Aug 2026 00:06:35 +0530
Subject: [PATCH 19/53] Revert "Merge pull request #909 from
 Meridiona/fix/single-owner-pm-sync"

This reverts commit a6ee29697cac5d63b0ca1c2aa0c710b386a4ff86, reversing
changes made to 888de374c5d3678146c685fa927ac054003c8902.
---
 meridian-core/src/lib.rs                      |   4 -
 meridian-core/src/pm_sync_requests/mod.rs     | 279 ------------
 meridian-core/src/pm_sync_requests/tests.rs   | 266 -----------
 meridian-oauth/src/{jira/mod.rs => jira.rs}   | 102 ++---
 meridian-oauth/src/jira/tests.rs              | 121 -----
 src/health/jira.rs                            | 113 +----
 src/intelligence/mod.rs                       | 113 +----
 src/intelligence/oauth/jira.rs                |  89 +---
 src/intelligence/providers/jira/refresh.rs    | 150 +++----
 src/intelligence/sync_delegate.rs             | 320 -------------
 src/intelligence/sync_requests.rs             | 227 ----------
 src/main.rs                                   | 200 ++-------
 src/migrations/082_pm_sync_requests.sql       |  68 ---
 src/plan_tasks/create.rs                      |  36 +-
 src/plan_tasks/done.rs                        |  17 +-
 src/plan_tasks/edit.rs                        |  17 +-
 .../sweep.rs => auto_generate.rs}             | 237 ++++++++--
 src/pm_worklog/auto_generate/mod.rs           | 216 ---------
 tray/src-tauri/src/commands/integrations.rs   |  28 +-
 tray/src-tauri/src/commands/tasks.rs          | 421 ++++--------------
 tray/src-tauri/src/lib.rs                     |   1 -
 ui/components/plan/PlanView.tsx               |  31 +-
 .../timeline/WorklogTicketPicker.tsx          |  16 +-
 .../timeline/settings/IntegrationsSection.tsx |   2 +-
 ui/lib/taskSync.ts                            |  56 ---
 25 files changed, 477 insertions(+), 2653 deletions(-)
 delete mode 100644 meridian-core/src/pm_sync_requests/mod.rs
 delete mode 100644 meridian-core/src/pm_sync_requests/tests.rs
 rename meridian-oauth/src/{jira/mod.rs => jira.rs} (85%)
 delete mode 100644 meridian-oauth/src/jira/tests.rs
 delete mode 100644 src/intelligence/sync_delegate.rs
 delete mode 100644 src/intelligence/sync_requests.rs
 delete mode 100644 src/migrations/082_pm_sync_requests.sql
 rename src/pm_worklog/{auto_generate/sweep.rs => auto_generate.rs} (53%)
 delete mode 100644 src/pm_worklog/auto_generate/mod.rs

diff --git a/meridian-core/src/lib.rs b/meridian-core/src/lib.rs
index fa07d5253..9653d4712 100644
--- a/meridian-core/src/lib.rs
+++ b/meridian-core/src/lib.rs
@@ -44,10 +44,6 @@ pub mod settings;
 /// Notification delivery policy + native pending queue (ported from lib/notifications.ts).
 pub mod notifications;
 
-/// Single-owner PM sync request outbox (migration 082) - producers ask, the daemon
-/// alone services them, so the rotating Jira OAuth token has exactly one writer.
-pub mod pm_sync_requests;
-
 /// The `~/.meridian/plan_auto_opened` marker format — written by the tray's
 /// daily planner auto-open, read by the daemon's plan-nudge hold-back.
 pub mod plan_marker;
diff --git a/meridian-core/src/pm_sync_requests/mod.rs b/meridian-core/src/pm_sync_requests/mod.rs
deleted file mode 100644
index ed070c6b5..000000000
--- a/meridian-core/src/pm_sync_requests/mod.rs
+++ /dev/null
@@ -1,279 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Single-owner PM sync: the request side of the outbox (`pm_sync_requests`,
-//! migration 082).
-//!
-//! # Why sync is a request instead of an action
-//!
-//! An Atlassian OAuth refresh token is single-use and rotating. The old token dies
-//! the instant the new one is issued, so a lost response leaves the grant
-//! recoverable only inside a 10-minute window and permanently dead after it. That
-//! makes the token a resource with exactly ONE safe writer.
-//!
-//! It had several: the tray refreshed in-process, the daemon refreshed on its poll
-//! loop, and the tray spawned fresh `meridian pm-sync` / `tasks-sync` processes that
-//! each refreshed too. The advisory file lock meant to serialise them could not
-//! actually do it - its 10 s timeout is shorter than the ~26 s a refresh can take
-//! (3 attempts x 8 s plus backoff), and on timeout the code proceeded WITHOUT the
-//! lock rather than backing off. So two processes could spend the same token, and
-//! the only thing preventing corruption was Atlassian's grace window handing the
-//! loser the current pair.
-//!
-//! Producers now write a row here and the **daemon is the sole consumer**, so the
-//! credential is held by one process by construction rather than by lock discipline.
-//!
-//! # Who calls this
-//! - Producers: `tray/src-tauri/src/commands/tasks.rs` (window opens, tracker
-//!   connect, "Sync now"), and the `meridian tasks-sync` / `pm-sync` CLIs when a
-//!   daemon is running.
-//! - Consumer: the daemon's sync-request watcher (`src/intelligence/sync_requests.rs`).
-//!
-//! # Related
-//! - [`crate::notifications`] - the outbox pattern this mirrors.
-
-use anyhow::{Context, Result};
-use sqlx::SqlitePool;
-
-/// The all-providers request every current producer writes. A specific provider
-/// name scopes a request to one board, reserved for a future caller that needs it.
-pub const ALL_PROVIDERS: &str = "*";
-
-/// Whether the daemon should honour the per-provider staleness window or bypass it.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum SyncMode {
-    /// Honour the staleness window - the cheap common case (a window opening).
-    Gated,
-    /// Bypass it: the user explicitly asked (connected a tracker, pressed "Sync
-    /// now", ran a CLI).
-    Force,
-}
-
-impl SyncMode {
-    /// The stored discriminant. Kept as text so the row is readable in `sqlite3`
-    /// during support work.
-    pub fn as_str(self) -> &'static str {
-        match self {
-            SyncMode::Gated => "gated",
-            SyncMode::Force => "force",
-        }
-    }
-
-    /// Parse a stored discriminant, defaulting to the SAFER option. An unknown or
-    /// corrupt value must never silently become a `Force` that bypasses the
-    /// staleness gate and hammers the provider's API.
-    pub fn from_str_or_gated(s: &str) -> Self {
-        match s {
-            "force" => SyncMode::Force,
-            _ => SyncMode::Gated,
-        }
-    }
-}
-
-/// One pending request, as claimed by the daemon.
-#[derive(Debug, Clone)]
-pub struct SyncRequest {
-    pub provider: String,
-    pub mode: SyncMode,
-    pub reason: String,
-}
-
-/// Ask the daemon to sync PM tasks. Idempotent and coalescing: repeated calls
-/// collapse into the single pending row rather than queueing, so opening the
-/// dashboard ten times means "a sync is wanted", not ten syncs.
-///
-/// `mode` **escalates only**. A `Force` landing on a pending `Gated` upgrades it,
-/// because a user who just connected a tracker must not have that downgraded by a
-/// passing window focus; a `Gated` landing on a pending `Force` leaves the `Force`
-/// intact. Writing a new request also clears any previous completion stamps, so the
-/// row unambiguously represents work still to do.
-///
-/// `reason` is a producer tag for tracing only (`"dashboard_open"`,
-/// `"token_connected"`). Never pass user content - it is read back into logs.
-#[tracing::instrument(skip(pool))]
-pub async fn request(
-    pool: &SqlitePool,
-    provider: &str,
-    mode: SyncMode,
-    reason: &str,
-) -> Result<()> {
-    sqlx::query(
-        "INSERT INTO pm_sync_requests
-             (provider, mode, reason, requested_at, claimed_at, completed_at, error, synced_count)
-         VALUES (?, ?, ?, strftime('%Y-%m-%dT%H:%M:%SZ', 'now'), NULL, NULL, NULL, NULL)
-         ON CONFLICT(provider) DO UPDATE SET
-             -- Escalate to 'force', never back down from it while still pending.
-             --
-             -- The `completed_at IS NULL` half is load-bearing: the row is kept after a
-             -- sync finishes (so \"Sync now\" can read its result), so without it a
-             -- SPENT 'force' would be inherited forever and every later gated request
-             -- would silently escalate. One tracker connect would then make every
-             -- planner open bypass the staleness gate and hit the provider for real -
-             -- reinstating the constant polling this whole design removes, and
-             -- multiplying exactly the token refreshes it exists to reduce.
-             mode = CASE
-                 WHEN excluded.mode = 'force'
-                   OR (pm_sync_requests.mode = 'force'
-                       AND pm_sync_requests.completed_at IS NULL)
-                      THEN 'force'
-                 ELSE excluded.mode
-             END,
-             reason       = excluded.reason,
-             requested_at = excluded.requested_at,
-             -- A fresh request re-opens the row: drop the in-flight and completion
-             -- marks so the watcher sees pending work again.
-             claimed_at   = NULL,
-             completed_at = NULL,
-             error        = NULL,
-             synced_count = NULL",
-    )
-    .bind(provider)
-    .bind(mode.as_str())
-    .bind(reason)
-    .execute(pool)
-    .await
-    .context("writing a PM sync request")?;
-    tracing::debug!(provider, mode = mode.as_str(), reason, "PM sync requested");
-    Ok(())
-}
-
-/// Claim the pending request for `provider`, if there is one, marking it in-flight
-/// so a second watcher tick can't pick up the same work.
-///
-/// The claim is a conditional UPDATE (`WHERE claimed_at IS NULL AND completed_at IS
-/// NULL`) rather than a read-then-write, so two daemons racing on the same file -
-/// which the single-instance guard makes unlikely but not impossible during a
-/// restart overlap - cannot both claim it. SQLite serialises the statement, so
-/// exactly one sees a non-zero `rows_affected`.
-#[tracing::instrument(skip(pool))]
-pub async fn claim(pool: &SqlitePool, provider: &str) -> Result<Option<SyncRequest>> {
-    let claimed = sqlx::query(
-        "UPDATE pm_sync_requests
-            SET claimed_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
-          WHERE provider = ?
-            AND claimed_at IS NULL
-            AND completed_at IS NULL",
-    )
-    .bind(provider)
-    .execute(pool)
-    .await
-    .context("claiming a PM sync request")?;
-
-    if claimed.rows_affected() == 0 {
-        return Ok(None);
-    }
-
-    let row: Option<(String, String)> =
-        sqlx::query_as("SELECT mode, reason FROM pm_sync_requests WHERE provider = ?")
-            .bind(provider)
-            .fetch_optional(pool)
-            .await
-            .context("reading the claimed PM sync request")?;
-
-    Ok(row.map(|(mode, reason)| SyncRequest {
-        provider: provider.to_string(),
-        mode: SyncMode::from_str_or_gated(&mode),
-        reason,
-    }))
-}
-
-/// Record the outcome of a serviced request in place. The row is deliberately kept
-/// rather than deleted so `"Sync now"` can read a real result without holding the
-/// credential, and so support has a content-free view of the last attempt.
-///
-/// Writes only if the row is still the one that was claimed. The guard is
-/// **`claimed_at IS NOT NULL`**, and that specific predicate is the whole point:
-/// [`request`] resets `claimed_at` to `NULL`, so a request that arrived mid-sync
-/// makes this UPDATE match nothing. Guarding on `completed_at IS NULL` alone would
-/// NOT work - the fresh request leaves that NULL too, so the older sync's outcome
-/// would stamp the new request as done without it ever being serviced, and the
-/// user's "Sync now" would report success for a sync that never ran.
-#[tracing::instrument(skip(pool))]
-pub async fn complete(
-    pool: &SqlitePool,
-    provider: &str,
-    synced_count: Option<i64>,
-    error: Option<&str>,
-) -> Result<()> {
-    sqlx::query(
-        "UPDATE pm_sync_requests
-            SET completed_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now'),
-                error        = ?,
-                synced_count = ?
-          WHERE provider = ?
-            AND claimed_at IS NOT NULL
-            AND completed_at IS NULL",
-    )
-    .bind(error)
-    .bind(synced_count)
-    .bind(provider)
-    .execute(pool)
-    .await
-    .context("completing a PM sync request")?;
-    Ok(())
-}
-
-/// Release claims left in flight by a daemon that died mid-sync, so the request
-/// becomes claimable again. Call once at watcher startup.
-///
-/// Without this a crash, a `meridian restart`, or a SIGKILL between [`claim`] and
-/// [`complete`] strands the row **claimed but never completed** - and since [`claim`]
-/// requires `claimed_at IS NULL`, no future tick would ever pick it up. PM sync
-/// would then be silently dead until the next new request happened to reset the row.
-/// Same reasoning as the daemon's `cleanup_incomplete_runs` for partial ETL runs.
-///
-/// Only ever widens what is claimable, so it is safe to run unconditionally on every
-/// boot: a genuinely in-flight sync cannot exist yet, because the only consumer is
-/// the watcher this runs before.
-#[tracing::instrument(skip(pool))]
-pub async fn reset_stale_claims(pool: &SqlitePool) -> Result<u64> {
-    let res = sqlx::query(
-        "UPDATE pm_sync_requests
-            SET claimed_at = NULL
-          WHERE claimed_at IS NOT NULL
-            AND completed_at IS NULL",
-    )
-    .execute(pool)
-    .await
-    .context("resetting stale PM sync request claims")?;
-    let n = res.rows_affected();
-    if n > 0 {
-        tracing::info!(
-            reset = n,
-            "released PM sync claims stranded by a previous daemon exit"
-        );
-    }
-    Ok(n)
-}
-
-/// The outcome of the last request for `provider`, for a producer that wants to
-/// show one ("Sync now"). `None` while the request is still pending or in flight,
-/// so a caller can poll this until it turns `Some`.
-pub async fn outcome(pool: &SqlitePool, provider: &str) -> Result<Option<SyncOutcome>> {
-    let row: Option<(Option<String>, Option<String>, Option<i64>)> = sqlx::query_as(
-        "SELECT completed_at, error, synced_count FROM pm_sync_requests WHERE provider = ?",
-    )
-    .bind(provider)
-    .fetch_optional(pool)
-    .await
-    .context("reading the PM sync outcome")?;
-
-    Ok(match row {
-        Some((Some(_completed), error, synced_count)) => Some(SyncOutcome {
-            error,
-            synced_count,
-        }),
-        // No row, or a row still pending / in flight.
-        _ => None,
-    })
-}
-
-/// A completed request's result.
-#[derive(Debug, Clone)]
-pub struct SyncOutcome {
-    /// `None` on success, the failure detail otherwise.
-    pub error: Option<String>,
-    /// Tasks refreshed, when the daemon reported a count.
-    pub synced_count: Option<i64>,
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/meridian-core/src/pm_sync_requests/tests.rs b/meridian-core/src/pm_sync_requests/tests.rs
deleted file mode 100644
index 2bf861c66..000000000
--- a/meridian-core/src/pm_sync_requests/tests.rs
+++ /dev/null
@@ -1,266 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Tests for the PM sync request outbox.
-//!
-//! Split out of `mod.rs` purely for the 500-line file cap; they are the module's own
-//! unit tests and belong to it. Each one pins a race or a policy that is invisible
-//! from the SQL alone - read them alongside the doc comment on the function they
-//! exercise.
-
-use super::*;
-use sqlx::sqlite::SqliteConnectOptions;
-use std::str::FromStr;
-
-async fn db() -> SqlitePool {
-    let opts = SqliteConnectOptions::from_str("sqlite::memory:")
-        .unwrap()
-        .create_if_missing(true);
-    let pool = SqlitePool::connect_with(opts).await.unwrap();
-    sqlx::query(
-        "CREATE TABLE pm_sync_requests (
-             provider TEXT NOT NULL PRIMARY KEY,
-             mode TEXT NOT NULL DEFAULT 'gated',
-             reason TEXT NOT NULL DEFAULT '',
-             requested_at TEXT NOT NULL,
-             claimed_at TEXT,
-             completed_at TEXT,
-             error TEXT,
-             synced_count INTEGER
-         )",
-    )
-    .execute(&pool)
-    .await
-    .unwrap();
-    pool
-}
-
-/// Repeated requests must COALESCE into one pending row. Ten planner opens
-/// mean "a sync is wanted", not ten syncs.
-#[tokio::test]
-async fn repeated_requests_coalesce_into_one_row() {
-    let pool = db().await;
-    for _ in 0..10 {
-        request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
-            .await
-            .unwrap();
-    }
-    let n: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM pm_sync_requests")
-        .fetch_one(&pool)
-        .await
-        .unwrap();
-    assert_eq!(n, 1);
-}
-
-/// A user action must not be downgraded by a passing window focus.
-#[tokio::test]
-async fn force_survives_a_later_gated_request() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "token_connected")
-        .await
-        .unwrap();
-    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
-        .await
-        .unwrap();
-
-    let req = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
-    assert_eq!(req.mode, SyncMode::Force);
-}
-
-/// ...and a user action must be able to escalate a pending gated request.
-#[tokio::test]
-async fn gated_escalates_to_force() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
-        .await
-        .unwrap();
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
-        .await
-        .unwrap();
-
-    let req = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
-    assert_eq!(req.mode, SyncMode::Force);
-}
-
-/// A *spent* force must NOT be inherited. The row survives completion so "Sync
-/// now" can read its result, so escalation has to be scoped to a still-pending
-/// row - otherwise one tracker connect leaves `mode = 'force'` set forever and
-/// every later planner open bypasses the staleness gate and hits the provider
-/// for real, multiplying the token refreshes this design exists to reduce.
-#[tokio::test]
-async fn a_completed_force_does_not_escalate_the_next_gated_request() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "token_connected")
-        .await
-        .unwrap();
-    claim(&pool, ALL_PROVIDERS).await.unwrap();
-    complete(&pool, ALL_PROVIDERS, Some(4), None).await.unwrap();
-
-    // A later window open wants the cheap, gated behaviour.
-    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
-        .await
-        .unwrap();
-
-    let req = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
-    assert_eq!(
-        req.mode,
-        SyncMode::Gated,
-        "a spent force must not escalate later gated requests"
-    );
-}
-
-/// The in-flight case still escalates: a force that is claimed but not completed
-/// will have its outcome discarded by `complete`'s guard and be re-serviced, so
-/// the force intent must survive into that re-run.
-#[tokio::test]
-async fn an_in_flight_force_still_survives_a_gated_request() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
-        .await
-        .unwrap();
-    claim(&pool, ALL_PROVIDERS).await.unwrap();
-
-    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
-        .await
-        .unwrap();
-
-    let req = claim(&pool, ALL_PROVIDERS).await.unwrap().expect("pending");
-    assert_eq!(req.mode, SyncMode::Force);
-}
-
-/// A claim is exclusive: the second attempt sees nothing, so two watcher ticks
-/// can never run the same sync twice.
-#[tokio::test]
-async fn claim_is_exclusive() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
-        .await
-        .unwrap();
-    assert!(claim(&pool, ALL_PROVIDERS).await.unwrap().is_some());
-    assert!(
-        claim(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
-        "a claimed request must not be claimable again"
-    );
-}
-
-/// Nothing pending is a quiet `None`, not an error - the watcher ticks on this
-/// constantly.
-#[tokio::test]
-async fn claim_with_no_request_is_none() {
-    let pool = db().await;
-    assert!(claim(&pool, ALL_PROVIDERS).await.unwrap().is_none());
-}
-
-/// A daemon killed between claim and complete must not strand PM sync forever.
-/// Without the reset the row stays claimed, `claim` requires `claimed_at IS
-/// NULL`, and no future tick could ever service it.
-#[tokio::test]
-async fn stale_claims_are_released_on_startup() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
-        .await
-        .unwrap();
-    claim(&pool, ALL_PROVIDERS).await.unwrap();
-    // ... daemon dies here, no `complete` ever runs.
-
-    assert!(
-        claim(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
-        "precondition: a stranded claim blocks re-claiming"
-    );
-
-    assert_eq!(reset_stale_claims(&pool).await.unwrap(), 1);
-
-    let req = claim(&pool, ALL_PROVIDERS)
-        .await
-        .unwrap()
-        .expect("the request must be serviceable again after the reset");
-    assert_eq!(req.mode, SyncMode::Force);
-}
-
-/// The reset must not disturb a request that already completed - that would
-/// re-run finished work on every daemon boot.
-#[tokio::test]
-async fn reset_leaves_completed_requests_alone() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
-        .await
-        .unwrap();
-    claim(&pool, ALL_PROVIDERS).await.unwrap();
-    complete(&pool, ALL_PROVIDERS, Some(2), None).await.unwrap();
-
-    assert_eq!(reset_stale_claims(&pool).await.unwrap(), 0);
-    assert!(
-        claim(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
-        "a completed request must stay completed"
-    );
-}
-
-/// The outcome is invisible until the daemon finishes, so a producer polling it
-/// can tell "still working" from "done".
-#[tokio::test]
-async fn outcome_is_none_until_completed() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
-        .await
-        .unwrap();
-    assert!(outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none());
-
-    claim(&pool, ALL_PROVIDERS).await.unwrap();
-    assert!(
-        outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
-        "in-flight must still read as pending"
-    );
-
-    complete(&pool, ALL_PROVIDERS, Some(7), None).await.unwrap();
-    let out = outcome(&pool, ALL_PROVIDERS).await.unwrap().expect("done");
-    assert_eq!(out.synced_count, Some(7));
-    assert!(out.error.is_none());
-}
-
-/// A failure is reported, not swallowed.
-#[tokio::test]
-async fn outcome_carries_the_error() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
-        .await
-        .unwrap();
-    claim(&pool, ALL_PROVIDERS).await.unwrap();
-    complete(&pool, ALL_PROVIDERS, None, Some("401 unauthorized"))
-        .await
-        .unwrap();
-
-    let out = outcome(&pool, ALL_PROVIDERS).await.unwrap().expect("done");
-    assert_eq!(out.error.as_deref(), Some("401 unauthorized"));
-}
-
-/// THE RACE THIS GUARDS: a request arriving mid-sync resets the row, and the
-/// older sync's outcome must NOT stamp it complete - that would mark the new
-/// request done without ever servicing it.
-#[tokio::test]
-async fn completion_does_not_clobber_a_request_that_arrived_mid_sync() {
-    let pool = db().await;
-    request(&pool, ALL_PROVIDERS, SyncMode::Gated, "dashboard_open")
-        .await
-        .unwrap();
-    claim(&pool, ALL_PROVIDERS).await.unwrap();
-
-    // A new request lands while the first sync is still running.
-    request(&pool, ALL_PROVIDERS, SyncMode::Force, "sync_now")
-        .await
-        .unwrap();
-
-    // The in-flight sync finishes and tries to report. This must be a NO-OP:
-    // the new request cleared `claimed_at`, so the guard rejects it.
-    complete(&pool, ALL_PROVIDERS, Some(3), None).await.unwrap();
-
-    assert!(
-        outcome(&pool, ALL_PROVIDERS).await.unwrap().is_none(),
-        "the older sync's outcome must NOT mark the new request complete - \
-         that would report success for a sync that never ran"
-    );
-
-    let req = claim(&pool, ALL_PROVIDERS)
-        .await
-        .unwrap()
-        .expect("the mid-sync request must still be pending");
-    assert_eq!(req.mode, SyncMode::Force);
-    assert_eq!(req.reason, "sync_now");
-}
diff --git a/meridian-oauth/src/jira/mod.rs b/meridian-oauth/src/jira.rs
similarity index 85%
rename from meridian-oauth/src/jira/mod.rs
rename to meridian-oauth/src/jira.rs
index 37ff9086c..198901125 100644
--- a/meridian-oauth/src/jira/mod.rs
+++ b/meridian-oauth/src/jira.rs
@@ -236,59 +236,9 @@ pub async fn login(client_id: &str, client_secret: &str, port: u16) -> Result<St
     Ok(site_url)
 }
 
-/// Seconds of margin before `expires_at` at which the access token is treated as
-/// expired. Stops a request being issued with a token that expires while it is
-/// still in flight.
-pub const EXPIRY_SKEW_SECS: i64 = 120;
-
-/// The stored tokens IF the access token is still usable — never a network call,
-/// never a refresh. `None` means "no store, unreadable store, or the access token
-/// has expired", and the caller must NOT interpret that as an error.
-///
-/// # Why this exists
-///
-/// Spending the rotating refresh token is only safe when a human is present. The
-/// POST is a single-use exchange: Atlassian retires the old token the moment it
-/// issues the replacement, so if the reply is lost the grant is dead, recoverable
-/// only inside Atlassian's 10-minute reuse-leeway window. A refresh fired from a
-/// background timer can therefore be destroyed by a laptop lid closing, with
-/// nobody watching and nothing to retry against — which is exactly how a
-/// production install lost its Jira grant permanently (a refresh POST at 18:26:55
-/// straddled a 28-minute suspend; the retry, instant on wake at 18:55:29, was 18
-/// minutes outside the window).
-///
-/// So the rule this function enforces: **unattended code may USE a valid access
-/// token but must never MINT one.** Anything on a clock — the worklog drafting
-/// sweep, retention passes, any future scheduled job — calls this. Anything on
-/// the path of a real user action calls [`ensure_fresh`] instead, where the
-/// machine is provably awake and in use because someone just clicked something.
-///
-/// Deferring costs nothing in practice: an unattended sweep that finds an expired
-/// token is, by definition, running while nobody is at the machine, and the next
-/// attended request refreshes properly.
-///
-/// # Related
-/// - [`ensure_fresh`] — the attended counterpart, which may refresh.
-/// - [`crate::store::OAuthTokens::is_expired`] — the expiry predicate used here.
-pub fn current_if_valid() -> Option<OAuthTokens> {
-    let t = store::load("jira").ok()?;
-    if t.is_expired(now_unix(), EXPIRY_SKEW_SECS) {
-        tracing::debug!(
-            "jira access token expired - unattended caller deferring rather than refreshing"
-        );
-        return None;
-    }
-    Some(t)
-}
-
 /// Load the stored tokens, refreshing the access token if it's within 120 s of
 /// expiry. Persists the rotated refresh token. Returns ready-to-use tokens.
 ///
-/// **Only call this on the path of a real user action.** Spending the rotating
-/// refresh token from a background timer is what permanently kills a grant when
-/// the machine suspends mid-request; see [`current_if_valid`] for the full
-/// reasoning and the unattended alternative.
-///
 /// Refreshes are serialised on TWO levels so the rotating refresh token is never
 /// double-spent: a static mutex within this process, and an advisory FILE lock
 /// ([`store::lock_provider`]) across every Meridian process. After taking the file
@@ -300,7 +250,7 @@ pub async fn ensure_fresh() -> Result<OAuthTokens> {
 
     // Fast path: a still-fresh token needs neither a refresh nor the file lock.
     let t = store::load("jira")?;
-    if !t.is_expired(now_unix(), EXPIRY_SKEW_SECS) {
+    if !t.is_expired(now_unix(), 120) {
         return Ok(t);
     }
 
@@ -323,7 +273,7 @@ pub async fn ensure_fresh() -> Result<OAuthTokens> {
     // adopt their token instead of refreshing again with the dead one. This
     // double-check is what actually breaks the race.
     let mut t = store::load("jira")?;
-    if !t.is_expired(now_unix(), EXPIRY_SKEW_SECS) {
+    if !t.is_expired(now_unix(), 120) {
         tracing::debug!("jira token already refreshed by another process — adopting it");
         return Ok(t);
     }
@@ -420,4 +370,50 @@ impl JiraReqCtx {
 }
 
 #[cfg(test)]
-mod tests;
+mod tests {
+    use super::*;
+
+    fn oauth_ctx() -> JiraReqCtx {
+        JiraReqCtx::OAuth {
+            token: "tok".into(),
+            cloud_id: "cloud-xyz".into(),
+            site_url: "https://acme.atlassian.net".into(),
+        }
+    }
+
+    fn basic_ctx() -> JiraReqCtx {
+        JiraReqCtx::Basic {
+            base_url: "https://acme.atlassian.net/".into(),
+            email: "a@b.com".into(),
+            api_token: "tok".into(),
+        }
+    }
+
+    #[test]
+    fn oauth_api_url_uses_gateway() {
+        assert_eq!(
+            oauth_ctx().api_url("/rest/api/3/search/jql"),
+            "https://api.atlassian.com/ex/jira/cloud-xyz/rest/api/3/search/jql"
+        );
+    }
+
+    #[test]
+    fn basic_api_url_uses_site_and_trims_slash() {
+        assert_eq!(
+            basic_ctx().api_url("/rest/api/3/search/jql"),
+            "https://acme.atlassian.net/rest/api/3/search/jql"
+        );
+    }
+
+    #[test]
+    fn browse_url_uses_site_in_both_modes() {
+        assert_eq!(
+            oauth_ctx().browse_url("KAN-1"),
+            "https://acme.atlassian.net/browse/KAN-1"
+        );
+        assert_eq!(
+            basic_ctx().browse_url("KAN-1"),
+            "https://acme.atlassian.net/browse/KAN-1"
+        );
+    }
+}
diff --git a/meridian-oauth/src/jira/tests.rs b/meridian-oauth/src/jira/tests.rs
deleted file mode 100644
index 7293dcd30..000000000
--- a/meridian-oauth/src/jira/tests.rs
+++ /dev/null
@@ -1,121 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Tests for the Jira OAuth flow and token handling.
-//!
-//! Split out of `mod.rs` for the 500-line file cap; they are this module's own unit
-//! tests. The `current_if_valid` cases pin the attended/unattended split - the rule
-//! that unattended code may USE a valid access token but must never MINT one, which
-//! is what stops a background refresh being destroyed by a laptop suspend.
-
-use super::*;
-
-fn oauth_ctx() -> JiraReqCtx {
-    JiraReqCtx::OAuth {
-        token: "tok".into(),
-        cloud_id: "cloud-xyz".into(),
-        site_url: "https://acme.atlassian.net".into(),
-    }
-}
-
-fn basic_ctx() -> JiraReqCtx {
-    JiraReqCtx::Basic {
-        base_url: "https://acme.atlassian.net/".into(),
-        email: "a@b.com".into(),
-        api_token: "tok".into(),
-    }
-}
-
-#[test]
-fn oauth_api_url_uses_gateway() {
-    assert_eq!(
-        oauth_ctx().api_url("/rest/api/3/search/jql"),
-        "https://api.atlassian.com/ex/jira/cloud-xyz/rest/api/3/search/jql"
-    );
-}
-
-#[test]
-fn basic_api_url_uses_site_and_trims_slash() {
-    assert_eq!(
-        basic_ctx().api_url("/rest/api/3/search/jql"),
-        "https://acme.atlassian.net/rest/api/3/search/jql"
-    );
-}
-
-#[test]
-fn browse_url_uses_site_in_both_modes() {
-    assert_eq!(
-        oauth_ctx().browse_url("KAN-1"),
-        "https://acme.atlassian.net/browse/KAN-1"
-    );
-    assert_eq!(
-        basic_ctx().browse_url("KAN-1"),
-        "https://acme.atlassian.net/browse/KAN-1"
-    );
-}
-
-/// Seed a jira token store under a private `$HOME` with `expires_at` at
-/// `now + offset_secs`. Returns the guard that keeps `$HOME` stable for the
-/// duration of the test.
-fn seed_store(tag: &str, offset_secs: i64) -> std::sync::MutexGuard<'static, ()> {
-    let guard = crate::env_test_guard();
-    let dir = std::env::temp_dir().join(format!("meridian_oauth_civ_{tag}_{}", std::process::id()));
-    let _ = std::fs::remove_dir_all(&dir);
-    std::env::set_var("HOME", &dir);
-    store::save(&OAuthTokens {
-        provider: "jira".into(),
-        client_id: "cid".into(),
-        access_token: "access".into(),
-        refresh_token: "refresh".into(),
-        expires_at: now_unix() + offset_secs,
-        scopes: String::new(),
-        cloud_id: "cloud-xyz".into(),
-        site_url: "https://acme.atlassian.net".into(),
-    })
-    .expect("seeding the token store should succeed");
-    guard
-}
-
-/// A comfortably-valid access token is handed straight back, so an unattended
-/// sweep can still refresh the ticket cache without touching the network.
-#[test]
-fn current_if_valid_returns_a_live_token() {
-    let _g = seed_store("live", 3600);
-    let t = current_if_valid().expect("a token an hour from expiry must be usable");
-    assert_eq!(t.access_token, "access");
-    assert_eq!(t.cloud_id, "cloud-xyz");
-}
-
-/// THE POINT OF THE FUNCTION: an expired token yields `None` rather than
-/// triggering a refresh. Spending the rotating refresh token unattended is what
-/// permanently kills a grant when the machine suspends mid-POST, so a
-/// clock-driven caller must defer instead.
-#[test]
-fn current_if_valid_refuses_to_mint_when_expired() {
-    let _g = seed_store("expired", -10);
-    assert!(
-        current_if_valid().is_none(),
-        "an expired token must NOT be returned - the caller would use it and 401, \
-         and the whole point is to defer to the next attended request"
-    );
-}
-
-/// The skew is applied, not just raw expiry: a token inside the margin counts as
-/// expired so a request can't be issued with one that dies mid-flight.
-#[test]
-fn current_if_valid_applies_the_expiry_skew() {
-    let _g = seed_store("skew", EXPIRY_SKEW_SECS - 10);
-    assert!(
-        current_if_valid().is_none(),
-        "a token inside the {EXPIRY_SKEW_SECS}s skew must be treated as expired"
-    );
-}
-
-/// No store at all is a `None`, never a panic or an error — an install that has
-/// never connected Jira must sweep quietly.
-#[test]
-fn current_if_valid_handles_a_missing_store() {
-    let _g = crate::env_test_guard();
-    let dir = std::env::temp_dir().join(format!("meridian_oauth_civ_none_{}", std::process::id()));
-    let _ = std::fs::remove_dir_all(&dir);
-    std::env::set_var("HOME", &dir);
-    assert!(current_if_valid().is_none());
-}
diff --git a/src/health/jira.rs b/src/health/jira.rs
index 23624db4e..ac4ec38a6 100644
--- a/src/health/jira.rs
+++ b/src/health/jira.rs
@@ -5,16 +5,6 @@
 // collapses both into a silent warn. Sync freshness + candidate count come from
 // meridian.db (content-free). Creds are read from the env (loaded via dotenv at
 // startup), so this works without reaching into Config internals.
-//
-// `sync_freshness` is outcome-driven (`pm_sync_state.last_error`), not
-// elapsed-time-driven. Syncing is on-demand now (the daily plan, the match-to-ticket
-// picker, connecting a tracker, a board write, manual "Sync now") rather than a
-// background poller ticking every ~5 minutes forever — so a quiet period with no sync
-// attempt is normal, not a symptom. A laptop shut overnight is the everyday case: it
-// wakes with a cache many hours old and nothing wrong. `last_error` reflects the actual outcome of the last attempted fetch
-// (set by `intelligence::providers::record_sync_failure`, cleared by
-// `clear_sync_error` on the next success), which stays correct however long that
-// was ago.
 
 use crate::config::Config;
 use crate::health::Check;
@@ -22,6 +12,9 @@ use crate::intelligence::oauth::{jira as oauth_jira, store as oauth_store};
 use sqlx::SqlitePool;
 use std::time::Duration;
 
+/// Cache older than this (2× the 30-min sync interval) ⇒ fetch likely failing.
+const SYNC_STALE_SECS: f64 = 3600.0;
+
 pub async fn checks(_cfg: &Config, pool: Option<&SqlitePool>) -> Vec<Check> {
     let mut out = Vec::new();
 
@@ -140,29 +133,28 @@ async fn classify_auth(send: reqwest::Result<reqwest::Response>) -> Check {
 }
 
 async fn sync_freshness(pool: &SqlitePool) -> Check {
-    match sqlx::query_as::<_, (Option<String>, Option<f64>)>(
-        "SELECT last_error, (julianday('now') - julianday(last_synced_at)) * 86400.0
+    match sqlx::query_scalar::<_, Option<f64>>(
+        "SELECT (julianday('now') - julianday(MAX(last_synced_at))) * 86400.0
          FROM pm_sync_state WHERE provider = 'jira'",
     )
-    .fetch_optional(pool)
+    .fetch_one(pool)
     .await
     {
-        // A recorded failure is the real signal — the last attempted fetch didn't
-        // work, regardless of how long ago that was. Never a warn from elapsed time
-        // alone: a long quiet period between on-demand syncs is expected now.
-        Ok(Some((Some(err), _))) => {
-            Check::warn("ticket sync", "L3", format!("sync failing: {err}")).with_remedy(
-                "check the auth row above, or Reconnect Jira in Settings - Integrations",
-            )
-        }
-        Ok(Some((None, Some(age)))) => Check::ok(
+        Ok(Some(age)) if age > SYNC_STALE_SECS => Check::warn(
+            "ticket sync",
+            "L3",
+            format!(
+                "cache {:.0}m stale — fetch may be failing silently",
+                age / 60.0
+            ),
+        )
+        .with_remedy("check the auth row above; the daemon refreshes every 30m"),
+        Ok(Some(age)) => Check::ok(
             "ticket sync",
             "L3",
-            format!("last synced {:.0}m ago, no errors", age / 60.0),
+            format!("fresh ({:.0}m ago)", age / 60.0),
         ),
-        Ok(Some((None, None))) | Ok(None) => {
-            Check::info("ticket sync", "L3", "no Jira sync recorded yet")
-        }
+        Ok(None) => Check::info("ticket sync", "L3", "no Jira sync recorded yet"),
         Err(e) => Check::warn(
             "ticket sync",
             "L3",
@@ -196,72 +188,3 @@ async fn candidate_count(pool: &SqlitePool) -> Check {
         ),
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::health::Severity;
-    use sqlx::sqlite::SqliteConnectOptions;
-    use std::str::FromStr;
-
-    async fn make_db() -> SqlitePool {
-        let opts = SqliteConnectOptions::from_str("sqlite::memory:")
-            .unwrap()
-            .create_if_missing(true);
-        let pool = SqlitePool::connect_with(opts).await.unwrap();
-        sqlx::migrate!("src/migrations").run(&pool).await.unwrap();
-        pool
-    }
-
-    async fn seed(pool: &SqlitePool, synced_modifier: &str, last_error: Option<&str>) {
-        sqlx::query(
-            "INSERT INTO pm_sync_state (provider, last_synced_at, last_error)
-             VALUES ('jira', strftime('%Y-%m-%dT%H:%M:%SZ', 'now', ?), ?)",
-        )
-        .bind(synced_modifier)
-        .bind(last_error)
-        .execute(pool)
-        .await
-        .unwrap();
-    }
-
-    /// The false positive this rewrite exists to fix: a sync that hasn't run in
-    /// hours, with no recorded error, must NOT warn — on-demand syncing means a
-    /// long quiet period is expected, not a symptom.
-    #[tokio::test]
-    async fn sync_freshness_ok_when_stale_but_no_error() {
-        let pool = make_db().await;
-        seed(&pool, "-6 hours", None).await;
-
-        let check = sync_freshness(&pool).await;
-
-        assert_eq!(check.severity, Severity::Ok, "detail was: {}", check.detail);
-    }
-
-    /// A recorded fetch failure is the real signal, regardless of how recent it is.
-    #[tokio::test]
-    async fn sync_freshness_warns_on_recorded_error() {
-        let pool = make_db().await;
-        seed(&pool, "-2 minutes", Some("401 unauthorized")).await;
-
-        let check = sync_freshness(&pool).await;
-
-        assert_eq!(check.severity, Severity::Warn);
-        assert!(
-            check.detail.contains("401 unauthorized"),
-            "detail was: {}",
-            check.detail
-        );
-    }
-
-    /// A tracker that has never synced (fresh connect, or one that's never
-    /// fetched successfully) reports as informational, not a warning.
-    #[tokio::test]
-    async fn sync_freshness_info_when_never_synced() {
-        let pool = make_db().await;
-
-        let check = sync_freshness(&pool).await;
-
-        assert_eq!(check.severity, Severity::Info);
-    }
-}
diff --git a/src/intelligence/mod.rs b/src/intelligence/mod.rs
index 491d0415c..269728fd4 100644
--- a/src/intelligence/mod.rs
+++ b/src/intelligence/mod.rs
@@ -3,37 +3,14 @@
 pub mod oauth;
 pub mod providers;
 pub mod session_categorizer;
-/// Producer side of the `pm_sync_requests` outbox for short-lived CLI processes — how
-/// `plan-task-*`, `ticket-update` and `worklog-generate` refresh the board without
-/// becoming a second writer of the rotating Jira OAuth token.
-pub mod sync_delegate;
-/// Daemon-side consumer of the `pm_sync_requests` outbox — the reason the daemon is
-/// the only process that ever holds the rotating Jira OAuth token.
-pub mod sync_requests;
 pub mod task_triage;
 pub mod ticket_update;
 
 use anyhow::Result;
 use sqlx::SqlitePool;
-use std::sync::OnceLock;
-use tokio::sync::Mutex;
 
 use crate::config::{Config, PmProviderConfig};
 
-/// In-process serialisation for [`run_pm_sync`]. Now that syncing is triggered from
-/// several independent on-demand call sites (the daily plan, worklog drafting sweep,
-/// `meridian pm-sync`) instead of one single poll-loop tick, two of them can land in
-/// the same instant — e.g. opening the planner while a drafting sweep is mid-flight.
-/// Both would otherwise read `pm_sync_state` as stale and fire a real fetch
-/// concurrently, wasting a call for every redundant racer. This only dedups within
-/// ONE process; the Jira OAuth refresh-token race across processes is a separate,
-/// already-solved problem (`meridian-oauth/src/store.rs::lock_provider`, a
-/// cross-process file lock inside the refresh path itself).
-fn sync_lock() -> &'static Mutex<()> {
-    static LOCK: OnceLock<Mutex<()>> = OnceLock::new();
-    LOCK.get_or_init(|| Mutex::new(()))
-}
-
 /// True once at least one PM task is cached. Rows only land in `pm_tasks` after a
 /// provider authenticated and fetched successfully, so a non-zero count is proof
 /// a tracker actually WORKS (not merely that keys are present — bad creds 401 and
@@ -96,74 +73,20 @@ pub async fn run_pm_force_sync(meridian: &SqlitePool, config: &Config) -> Result
     Ok(())
 }
 
-/// Whether a sync is happening behind a real user action or on a clock. Only Jira
-/// OAuth cares, and the difference is not cosmetic: see [`Trigger::Unattended`].
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Trigger {
-    /// A human just did something — opened the planner, connected a tracker,
-    /// pressed Sync now, edited a ticket, ran a CLI. The machine is provably awake
-    /// and in use, so spending the rotating refresh token is safe.
-    Attended,
-    /// A clock fired and nobody is necessarily there (the hourly worklog drafting
-    /// sweep). Jira OAuth must NOT refresh here: the refresh is a single-use
-    /// exchange whose lost response kills the grant permanently outside a
-    /// 10-minute window, and a laptop suspending mid-POST is exactly how that
-    /// happens with no one watching. An expired token means skip this pass; the
-    /// next attended request refreshes properly. Providers with static
-    /// credentials (GitHub/Linear/Trello/Azure) are unaffected — they have no
-    /// rotating credential to lose.
-    Unattended,
-}
-
-/// Refreshes PM task caches from all configured providers whose cache has gone
-/// stale, behind a real user action. See [`run_pm_sync_with`] for the shared body
-/// and [`Trigger`] for why the distinction exists.
+/// Refreshes PM task caches from all configured providers.
 #[tracing::instrument(skip_all)]
 pub async fn run_pm_sync(meridian: &SqlitePool, config: &Config) -> Result<()> {
-    run_pm_sync_with(meridian, config, Trigger::Attended).await
-}
-
-/// [`run_pm_sync`] for clock-driven callers: refreshes the ticket cache only if it
-/// can be done without minting a new Jira OAuth token, and quietly keeps the stale
-/// cache otherwise. Used by the hourly worklog drafting sweep.
-#[tracing::instrument(skip_all)]
-pub async fn run_pm_sync_unattended(meridian: &SqlitePool, config: &Config) -> Result<()> {
-    run_pm_sync_with(meridian, config, Trigger::Unattended).await
-}
-
-/// Refreshes PM task caches from all configured providers whose cache has gone stale
-/// (per-provider `refresh_if_stale`) — a cheap no-op when nothing is stale. Called
-/// from every on-demand trigger (the daily plan, worklog drafting, `meridian
-/// pm-sync`), not a timer, so [`sync_lock`] serialises same-process callers that land
-/// in the same instant rather than each racing the staleness check independently.
-#[tracing::instrument(skip(meridian, config))]
-pub async fn run_pm_sync_with(
-    meridian: &SqlitePool,
-    config: &Config,
-    trigger: Trigger,
-) -> Result<()> {
     if config.pm_providers.is_empty() {
         tracing::warn!("no PM providers configured — pm_tasks will stay empty (set JIRA_BASE_URL/GITHUB_TOKEN/LINEAR_API_KEY/AZURE_DEVOPS_PAT)");
         return Ok(());
     }
-
-    let _guard = match sync_lock().try_lock() {
-        Ok(g) => g,
-        Err(_) => {
-            tracing::debug!("run_pm_sync: another sync is already in flight — waiting for it");
-            sync_lock().lock().await
-        }
-    };
-
     let provider_count = config.pm_providers.len();
     tracing::debug!(provider_count, "syncing PM providers");
 
     for provider in &config.pm_providers {
         let name = provider.provider_name();
         let result = match provider {
-            PmProviderConfig::Jira(cfg) => {
-                providers::jira::refresh_if_stale(meridian, cfg, trigger).await
-            }
+            PmProviderConfig::Jira(cfg) => providers::jira::refresh_if_stale(meridian, cfg).await,
             PmProviderConfig::GitHub(cfg) => {
                 providers::github::refresh_if_stale(meridian, cfg).await
             }
@@ -297,36 +220,4 @@ mod tests {
         .unwrap();
         assert_eq!(queued, 0, "the board hygiene digest producer was removed");
     }
-
-    /// `run_pm_sync` now fires from several independent on-demand callers instead of
-    /// one poll-loop tick, so two of them can land in the same instant. This proves
-    /// [`sync_lock`] actually serialises concurrent holders rather than being a no-op
-    /// — tested directly against the lock primitive since exercising the full
-    /// `run_pm_sync` path needs a live (or mocked) provider HTTP call this crate has
-    /// no test seam for.
-    #[tokio::test]
-    async fn sync_lock_serialises_concurrent_holders() {
-        let order = std::sync::Arc::new(tokio::sync::Mutex::new(Vec::<&str>::new()));
-
-        let first_guard = sync_lock().lock().await;
-        let order_clone = order.clone();
-        let second = tokio::spawn(async move {
-            let _g = sync_lock().lock().await; // must wait for `first_guard` to drop
-            order_clone.lock().await.push("second");
-        });
-
-        // Give the spawned task a chance to actually block on the lock before we
-        // release it — otherwise a fast scheduler could run it after the drop below
-        // and the ordering assertion would prove nothing.
-        tokio::task::yield_now().await;
-        order.lock().await.push("first");
-        drop(first_guard);
-
-        second.await.unwrap();
-        assert_eq!(
-            *order.lock().await,
-            vec!["first", "second"],
-            "the second acquirer must not proceed until the first guard drops"
-        );
-    }
 }
diff --git a/src/intelligence/oauth/jira.rs b/src/intelligence/oauth/jira.rs
index 2aea4ede5..7af628c62 100644
--- a/src/intelligence/oauth/jira.rs
+++ b/src/intelligence/oauth/jira.rs
@@ -31,47 +31,29 @@ pub(crate) fn has_basic_auth(jira: &JiraConfig) -> bool {
         && !jira.api_token.trim().is_empty()
 }
 
-/// The Basic-auth context from config. Shared by both resolvers so the two cannot
-/// disagree about which config fields make up a request context — a field added to
-/// [`JiraReqCtx::Basic`] has exactly one place to be filled in.
-fn basic_ctx(jira: &JiraConfig) -> JiraReqCtx {
-    JiraReqCtx::Basic {
-        base_url: jira.base_url.clone(),
-        email: jira.email.clone(),
-        api_token: jira.api_token.clone(),
-    }
-}
-
-/// The OAuth context from a token the caller has already obtained. Deliberately takes
-/// the tokens rather than fetching them: that is the whole difference between the two
-/// resolvers ([`resolve`] may mint a new pair, `resolve_unattended` must not), and
-/// keeping the fetch out of here means neither can acquire one by accident.
-fn oauth_ctx(t: meridian_oauth::store::OAuthTokens) -> JiraReqCtx {
-    JiraReqCtx::OAuth {
-        token: t.access_token,
-        cloud_id: t.cloud_id,
-        site_url: t.site_url,
-    }
-}
-
 /// Decide how to authenticate Jira requests: prefer the static API token when
 /// fully configured, otherwise fall back to a stored OAuth session. API token
 /// beats stored OAuth — a set JIRA_API_TOKEN always wins.
 /// This mirrors the industry standard (gh, Vercel CLI, Stripe CLI all follow
 /// env-var-first) and lets developers use a stable PAT in .env without being
 /// blocked by a stale OAuth session stored in ~/.meridian/oauth/jira.json.
-///
-/// **May MINT a new refresh token, so only call this behind a real user action.**
-/// See [`resolve_unattended`] for the clock-driven counterpart and why the
-/// distinction is load-bearing.
 pub async fn resolve(jira: &JiraConfig) -> Result<JiraReqCtx> {
     if has_basic_auth(jira) {
         tracing::debug!(auth_method = "api_token", "resolving Jira auth");
-        return Ok(basic_ctx(jira));
+        return Ok(JiraReqCtx::Basic {
+            base_url: jira.base_url.clone(),
+            email: jira.email.clone(),
+            api_token: jira.api_token.clone(),
+        });
     }
     if store::exists("jira") {
         tracing::debug!(auth_method = "oauth", "resolving Jira auth");
-        return Ok(oauth_ctx(ensure_fresh().await?));
+        let t = ensure_fresh().await?;
+        return Ok(JiraReqCtx::OAuth {
+            token: t.access_token,
+            cloud_id: t.cloud_id,
+            site_url: t.site_url,
+        });
     }
     bail!(
         "no Jira auth available — run `meridian oauth-login jira`, \
@@ -79,55 +61,6 @@ pub async fn resolve(jira: &JiraConfig) -> Result<JiraReqCtx> {
     )
 }
 
-/// [`resolve`] for callers running on a CLOCK rather than behind a user action:
-/// returns auth only if it can be had without spending the rotating refresh token.
-/// `None` means "skip this pass", never an error.
-///
-/// # Why a separate resolver
-///
-/// Refreshing an Atlassian OAuth token is a single-use exchange: the old refresh
-/// token dies the instant the new one is issued, so a lost response leaves the
-/// grant recoverable only inside a 10-minute window. When that POST is fired by a
-/// timer with nobody at the machine, a closing laptop lid destroys the grant
-/// permanently — which is precisely how a production install lost Jira for five
-/// days (refresh at 18:26:55, 28-minute suspend, retry instant on wake at
-/// 18:55:29 but 18 minutes too late).
-///
-/// So unattended code may USE a valid access token but must never MINT one. This
-/// is the same discipline that makes Claude Code's MCP connections durable against
-/// the identical protocol: it only ever refreshes on the tail of something a human
-/// just asked for.
-///
-/// API-token (basic) auth is returned unconditionally — a static token has no
-/// expiry to race and no rotating credential to lose, so there is nothing to
-/// protect it from.
-///
-/// Deferring is close to free: a sweep that finds an expired token is by
-/// definition running while nobody is using the machine, so there is little new
-/// activity to match, and the next attended request refreshes properly.
-///
-/// # Related
-/// - [`resolve`] — the attended counterpart, which may refresh.
-/// - [`meridian_oauth::jira::current_if_valid`] — the non-minting token read.
-pub fn resolve_unattended(jira: &JiraConfig) -> Option<JiraReqCtx> {
-    if has_basic_auth(jira) {
-        tracing::debug!(
-            auth_method = "api_token",
-            "resolving Jira auth (unattended)"
-        );
-        return Some(basic_ctx(jira));
-    }
-    if !store::exists("jira") {
-        return None;
-    }
-    // `current_if_valid`, never `ensure_fresh` — this is the line that makes the
-    // function unattended-safe, and swapping it would silently reintroduce the
-    // timer-driven refresh that killed a production grant.
-    let t = meridian_oauth::jira::current_if_valid()?;
-    tracing::debug!(auth_method = "oauth", "resolving Jira auth (unattended)");
-    Some(oauth_ctx(t))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/src/intelligence/providers/jira/refresh.rs b/src/intelligence/providers/jira/refresh.rs
index bcc4256e9..dab541b0b 100644
--- a/src/intelligence/providers/jira/refresh.rs
+++ b/src/intelligence/providers/jira/refresh.rs
@@ -25,7 +25,6 @@ use sqlx::SqlitePool;
 
 use crate::config::JiraConfig;
 use crate::intelligence::providers::http::SyncFault;
-use crate::intelligence::Trigger;
 
 use super::{
     backfill_worklogged, discover_start_date_field, fetch, native_terminal, prune, upsert,
@@ -37,11 +36,7 @@ use super::{
 // ---------------------------------------------------------------------------
 
 #[tracing::instrument(skip(pool, jira))]
-pub async fn refresh_if_stale(
-    pool: &SqlitePool,
-    jira: &JiraConfig,
-    trigger: Trigger,
-) -> Result<Option<Vec<String>>> {
+pub async fn refresh_if_stale(pool: &SqlitePool, jira: &JiraConfig) -> Result<Option<Vec<String>>> {
     let threshold = format!("-{SYNC_INTERVAL_MINS} minutes");
     let (is_fresh,): (i64,) = sqlx::query_as(
         "SELECT EXISTS(
@@ -75,85 +70,66 @@ pub async fn refresh_if_stale(
     // Resolve auth once per refresh: OAuth (with refresh-before-use) if a token
     // store exists, else static basic auth. A resolve failure means no usable
     // creds — keep the stale cache rather than erroring the whole tick.
-    //
-    // A clock-driven pass must never MINT a Jira OAuth token — spending the
-    // rotating refresh token unattended is what permanently kills a grant when the
-    // machine suspends mid-POST (see `Trigger::Unattended`). An expired token here
-    // means keep the stale cache and let the next attended request refresh; that
-    // is not a failure and must not be recorded as one, or a laptop that was shut
-    // for the night would raise a sync error every morning.
-    let ctx = if trigger == Trigger::Unattended {
-        match crate::intelligence::oauth::jira::resolve_unattended(jira) {
-            Some(ctx) => ctx,
-            None => {
-                tracing::debug!(
-                    "jira token not usable without a refresh - deferring unattended sync"
-                );
-                return Ok(None);
-            }
-        }
-    } else {
-        match crate::intelligence::oauth::jira::resolve(jira).await {
-            Ok(ctx) => ctx,
-            Err(e) => {
-                // A refresh that failed only because Atlassian was briefly
-                // unreachable (network blip, timeout, 429, 5xx) does NOT mean the
-                // token is dead — the stored refresh token is still valid and the
-                // next tick will almost certainly succeed. Raising a "Reconnect
-                // Jira / re-run oauth-login" sync error for that transient case is
-                // exactly what made this fault flap on and off at random. Keep the
-                // stale cache and stay quiet; the notice is reserved for a terminal
-                // auth failure the user actually has to act on.
-                // Deliberately NOT `record_sync_failure` like the fetch arm below:
-                // this path needs the auth-method-specific remedy override that the
-                // shared helper has no way to express (basic auth really does want
-                // the `.env` wording). The classification policy is otherwise
-                // identical, so a change to one should be mirrored here.
-                //
-                // `meridian_oauth::is_transient` only recognises a `TokenError` from
-                // the token endpoint and answers `false` for anything else, so a raw
-                // transport failure escaping the refresh would still land here as
-                // terminal. Falling back to `http::classify` closes that hole
-                // without ever making a genuinely dead grant look retryable.
-                let fault = if meridian_oauth::is_transient(&e) {
-                    SyncFault::retry(&e)
-                } else {
-                    crate::intelligence::providers::http::classify(&e)
-                };
-                match fault {
-                    SyncFault::Retry { detail } => {
-                        tracing::warn!(
-                            error = %detail,
-                            "jira auth temporarily unavailable - keeping stale cache, will retry next sync"
-                        );
-                        let _ = crate::intelligence::providers::note_transient_sync_failure(
-                            pool, "jira", &detail,
-                        )
-                        .await;
-                    }
-                    SyncFault::Report { detail } => {
-                        tracing::warn!(error = %detail, "jira auth unavailable - keeping stale cache");
-                        let msg = format!("Jira auth failed: {detail}");
-                        // Basic-auth (JIRA_API_TOKEN/JIRA_BASE_URL) and OAuth are
-                        // mutually exclusive here - has_basic_auth() mirrors
-                        // resolve()'s own choice - so the remedy must match whichever
-                        // path this failure came from, not always point at .env.
-                        let remedy = if crate::intelligence::oauth::jira::has_basic_auth(jira) {
-                            "Set JIRA_API_TOKEN and JIRA_BASE_URL in .env"
-                        } else {
-                            "Reconnect Jira in Settings - Integrations"
-                        };
-                        let _ = crate::intelligence::providers::stamp_sync_error_with_remedy(
-                            pool,
-                            "jira",
-                            &msg,
-                            Some(remedy),
-                        )
-                        .await;
-                    }
+    let ctx = match crate::intelligence::oauth::jira::resolve(jira).await {
+        Ok(ctx) => ctx,
+        Err(e) => {
+            // A refresh that failed only because Atlassian was briefly
+            // unreachable (network blip, timeout, 429, 5xx) does NOT mean the
+            // token is dead — the stored refresh token is still valid and the
+            // next tick will almost certainly succeed. Raising a "Reconnect
+            // Jira / re-run oauth-login" sync error for that transient case is
+            // exactly what made this fault flap on and off at random. Keep the
+            // stale cache and stay quiet; the notice is reserved for a terminal
+            // auth failure the user actually has to act on.
+            // Deliberately NOT `record_sync_failure` like the fetch arm below:
+            // this path needs the auth-method-specific remedy override that the
+            // shared helper has no way to express (basic auth really does want
+            // the `.env` wording). The classification policy is otherwise
+            // identical, so a change to one should be mirrored here.
+            //
+            // `meridian_oauth::is_transient` only recognises a `TokenError` from
+            // the token endpoint and answers `false` for anything else, so a raw
+            // transport failure escaping the refresh would still land here as
+            // terminal. Falling back to `http::classify` closes that hole
+            // without ever making a genuinely dead grant look retryable.
+            let fault = if meridian_oauth::is_transient(&e) {
+                SyncFault::retry(&e)
+            } else {
+                crate::intelligence::providers::http::classify(&e)
+            };
+            match fault {
+                SyncFault::Retry { detail } => {
+                    tracing::warn!(
+                        error = %detail,
+                        "jira auth temporarily unavailable - keeping stale cache, will retry next sync"
+                    );
+                    let _ = crate::intelligence::providers::note_transient_sync_failure(
+                        pool, "jira", &detail,
+                    )
+                    .await;
+                }
+                SyncFault::Report { detail } => {
+                    tracing::warn!(error = %detail, "jira auth unavailable - keeping stale cache");
+                    let msg = format!("Jira auth failed: {detail}");
+                    // Basic-auth (JIRA_API_TOKEN/JIRA_BASE_URL) and OAuth are
+                    // mutually exclusive here - has_basic_auth() mirrors
+                    // resolve()'s own choice - so the remedy must match whichever
+                    // path this failure came from, not always point at .env.
+                    let remedy = if crate::intelligence::oauth::jira::has_basic_auth(jira) {
+                        "Set JIRA_API_TOKEN and JIRA_BASE_URL in .env"
+                    } else {
+                        "Reconnect Jira in Settings - Integrations"
+                    };
+                    let _ = crate::intelligence::providers::stamp_sync_error_with_remedy(
+                        pool,
+                        "jira",
+                        &msg,
+                        Some(remedy),
+                    )
+                    .await;
                 }
-                return Ok(None);
             }
+            return Ok(None);
         }
     };
     let auth_method = if jira.api_token.is_empty() {
@@ -249,16 +225,10 @@ pub async fn refresh_if_stale(
 /// Clears `pm_sync_state` for this provider so `refresh_if_stale` sees it as
 /// stale, then delegates. The `last_synced_at` is updated inside the delegate,
 /// so subsequent ticks won't double-fetch.
-///
-/// Always [`Trigger::Attended`]: every caller is a direct user action — connecting
-/// a tracker, pressing Sync now, or a `meridian tasks-sync` / `ticket-update` CLI
-/// invocation — so refreshing the OAuth token here is safe and expected. There is
-/// deliberately no unattended force-sync: forcing a fetch while nobody is present
-/// is the combination this whole distinction exists to prevent.
 pub async fn force_refresh(pool: &SqlitePool, jira: &JiraConfig) -> Result<Option<Vec<String>>> {
     sqlx::query("DELETE FROM pm_sync_state WHERE provider = 'jira'")
         .execute(pool)
         .await
         .context("clearing jira sync state for force refresh")?;
-    refresh_if_stale(pool, jira, Trigger::Attended).await
+    refresh_if_stale(pool, jira).await
 }
diff --git a/src/intelligence/sync_delegate.rs b/src/intelligence/sync_delegate.rs
deleted file mode 100644
index 8475390f9..000000000
--- a/src/intelligence/sync_delegate.rs
+++ /dev/null
@@ -1,320 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Producer side of the `pm_sync_requests` outbox for **short-lived CLI processes**:
-//! ask the daemon to sync, rather than syncing here.
-//!
-//! # Why this exists
-//!
-//! An Atlassian OAuth refresh token is single-use and rotating: the old token dies the
-//! instant the new one is issued, so a lost response leaves the grant recoverable only
-//! inside a 10-minute window and permanently dead after it. A credential like that has
-//! exactly one safe writer, and [`crate::intelligence::sync_requests`] makes the daemon
-//! that writer.
-//!
-//! The tray was converted to request-instead-of-sync at the same time, but six CLI
-//! subcommands the tray *spawns* were missed and kept refreshing in their own process:
-//! `plan-task-create` / `plan-task-edit` / `plan-task-done`, `ticket-update`,
-//! `ticket-set-status`, and `worklog-generate`. Every one is user-triggered, so none of
-//! them can recreate the timer-driven "refresh POST in flight when the lid closes"
-//! failure - but each is a second process able to spend the token while the daemon's
-//! watcher is servicing a request. The only thing serialising them was
-//! `meridian-oauth`'s advisory file lock, whose 10 s timeout is shorter than the ~26 s
-//! a refresh can take and which proceeds WITHOUT the lock on timeout. This closes that.
-//!
-//! # Why the in-process fallback stays
-//!
-//! A dev checkout, CI, or a support session with the daemon stopped still needs these
-//! commands to refresh the board. With no daemon running there is no second writer, so
-//! syncing here is safe by the same argument. [`crate::platform::daemon_already_running`]
-//! is the same probe the single-instance guard uses, so the two cannot disagree about
-//! who owns the data dir.
-//!
-//! # Who calls this
-//! - `src/main.rs`'s `tasks-sync` / `pm-sync` / `ticket-update` / `ticket-set-status` /
-//!   `worklog-generate` arms.
-//! - [`crate::plan_tasks`]'s `create` / `edit` / `done` post-write refresh.
-//!
-//! # Related
-//! - [`meridian_core::pm_sync_requests`] - the request/claim/complete API.
-//! - [`crate::intelligence::sync_requests`] - the daemon-side consumer that does the work.
-//! - [`crate::intelligence::Trigger`] - why attendedness is tracked at all.
-
-use std::time::Duration;
-
-use meridian_core::pm_sync_requests::{self, SyncMode, ALL_PROVIDERS};
-use sqlx::SqlitePool;
-
-use crate::config::Config;
-
-/// How often to re-read the request row while waiting. Matched to the daemon watcher's
-/// own 2 s tick rather than being tighter - a faster poll cannot see a result sooner.
-const POLL_INTERVAL: Duration = Duration::from_millis(500);
-
-/// What happened to a delegated sync.
-///
-/// `Pending` deliberately merges "queued, not waited for" and "waited, budget elapsed":
-/// both mean the daemon owns the work and will finish it, which is the only thing a
-/// caller can act on. Neither is a failure.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Delegation {
-    /// The sync finished successfully. `count` is the resulting `pm_tasks` total, and is
-    /// present only when the daemon reported it (the in-process path does not tally).
-    Synced { count: Option<i64> },
-    /// The sync was attempted and failed, or the request could not be queued. The string
-    /// is already a flattened error chain, ready to print or log.
-    Failed { error: String },
-    /// Queued for the daemon; no outcome is known yet.
-    Pending,
-}
-
-/// Ask for a sync and wait up to `budget` for the outcome.
-///
-/// Use this when the caller's next step *reads* `pm_tasks` and would behave differently
-/// against a stale board - `plan-task-create` checking whether its new ticket has
-/// mirrored, or `worklog-generate` matching sessions to tickets. Pick a budget that
-/// fits inside the caller's own timeout: a `Pending` return means "carry on with what
-/// is cached", never "fail".
-pub async fn sync_and_wait(
-    pool: &SqlitePool,
-    config: &Config,
-    mode: SyncMode,
-    label: &str,
-    budget: Duration,
-) -> Delegation {
-    delegate(pool, config, mode, label, Some(budget)).await
-}
-
-/// The budget for a post-write refresh (`plan-task-done`, `plan-task-edit`,
-/// `ticket-update`, `ticket-set-status`).
-///
-/// These deliberately WAIT rather than firing and forgetting, because they were
-/// synchronous before delegation and the frontend re-reads the board as soon as the CLI
-/// exits - returning early would show the pre-write value for a second or two and read
-/// as "my change didn't save". The old inline path already paid this latency (its own
-/// HTTP call, up to ~26 s with a token refresh), so waiting is not a new cost.
-pub const POST_WRITE_SYNC_BUDGET: Duration = Duration::from_secs(30);
-
-/// Ask for a post-write refresh and wait for it, using [`POST_WRITE_SYNC_BUDGET`].
-///
-/// A `Pending` return is not a failure: the tracker write already landed and the daemon
-/// will still finish the mirror refresh. Callers log it and carry on.
-pub async fn sync_after_write(pool: &SqlitePool, config: &Config, label: &str) -> Delegation {
-    delegate(
-        pool,
-        config,
-        SyncMode::Force,
-        label,
-        Some(POST_WRITE_SYNC_BUDGET),
-    )
-    .await
-}
-
-/// Shared body: pick the owner, then act.
-///
-/// Only the branch lives here - both halves are separately testable, which the probe
-/// makes necessary: [`crate::platform::daemon_already_running`] talks to the real
-/// single-instance endpoint, so a test that called this function would pass or fail
-/// depending on whether the developer happens to have a daemon running.
-#[tracing::instrument(skip(pool, config), fields(mode = mode.as_str()))]
-async fn delegate(
-    pool: &SqlitePool,
-    config: &Config,
-    mode: SyncMode,
-    label: &str,
-    wait: Option<Duration>,
-) -> Delegation {
-    if crate::platform::daemon_already_running().await {
-        request_and_wait(pool, mode, label, wait).await
-    } else {
-        sync_here(pool, config, mode, label).await
-    }
-}
-
-/// The no-daemon fallback: do the sync in this process.
-async fn sync_here(pool: &SqlitePool, config: &Config, mode: SyncMode, label: &str) -> Delegation {
-    tracing::debug!(label, "no daemon running - syncing in-process");
-    let result = match mode {
-        SyncMode::Force => super::run_pm_force_sync(pool, config).await,
-        SyncMode::Gated => super::run_pm_sync(pool, config).await,
-    };
-    match result {
-        Ok(()) => Delegation::Synced { count: None },
-        Err(e) => Delegation::Failed {
-            error: crate::errors::chain(&e),
-        },
-    }
-}
-
-/// The delegated path: hand the work to the daemon, optionally waiting for its outcome.
-/// `wait: None` returns [`Delegation::Pending`] the moment the request is written.
-async fn request_and_wait(
-    pool: &SqlitePool,
-    mode: SyncMode,
-    label: &str,
-    wait: Option<Duration>,
-) -> Delegation {
-    if let Err(e) = pm_sync_requests::request(pool, ALL_PROVIDERS, mode, label).await {
-        return Delegation::Failed {
-            error: format!(
-                "could not queue the sync request: {}",
-                crate::errors::chain(&e)
-            ),
-        };
-    }
-    tracing::debug!(label, "pm sync requested - the daemon owns tracker auth");
-
-    match wait {
-        Some(budget) => wait_for_outcome(pool, label, budget).await,
-        None => Delegation::Pending,
-    }
-}
-
-/// Poll the request row until the daemon records an outcome, or `budget` elapses.
-///
-/// The row is keyed on the provider (`'*'`), so a concurrent CLI's request can reset it
-/// and this can end up reading a sibling's outcome. That is fine: both asked for the same
-/// thing, and "some sync just completed" is exactly what the caller needs to know. It
-/// cannot read a *stale* outcome, because `request` clears `completed_at`.
-async fn wait_for_outcome(pool: &SqlitePool, label: &str, budget: Duration) -> Delegation {
-    let deadline = std::time::Instant::now() + budget;
-    loop {
-        if std::time::Instant::now() >= deadline {
-            tracing::debug!(
-                label,
-                budget_s = budget.as_secs(),
-                "daemon did not report a sync outcome in time - continuing"
-            );
-            return Delegation::Pending;
-        }
-        tokio::time::sleep(POLL_INTERVAL).await;
-        match pm_sync_requests::outcome(pool, ALL_PROVIDERS).await {
-            Ok(Some(out)) => {
-                return match out.error {
-                    Some(error) => Delegation::Failed { error },
-                    None => Delegation::Synced {
-                        count: out.synced_count,
-                    },
-                };
-            }
-            Ok(None) => continue,
-            Err(e) => {
-                return Delegation::Failed {
-                    error: format!(
-                        "could not read the sync outcome: {}",
-                        crate::errors::chain(&e)
-                    ),
-                };
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use sqlx::sqlite::SqliteConnectOptions;
-    use std::str::FromStr;
-
-    async fn db() -> SqlitePool {
-        let opts = SqliteConnectOptions::from_str("sqlite::memory:")
-            .unwrap()
-            .create_if_missing(true);
-        let pool = SqlitePool::connect_with(opts).await.unwrap();
-        sqlx::migrate!("src/migrations").run(&pool).await.unwrap();
-        pool
-    }
-
-    /// With no providers configured, `run_pm_*_sync` returns early - so the fallback
-    /// path must report success rather than queueing anything. If it ever starts writing
-    /// a request row, a dev checkout would silently stop refreshing: with no daemon
-    /// there is nothing to service it.
-    #[tokio::test]
-    async fn the_fallback_syncs_here_and_queues_nothing() {
-        let pool = db().await;
-        let cfg = Config::from_env();
-
-        let got = sync_here(&pool, &cfg, SyncMode::Force, "test").await;
-
-        assert_eq!(got, Delegation::Synced { count: None });
-        assert!(
-            pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
-                .await
-                .unwrap()
-                .is_none(),
-            "the in-process path must not queue a request"
-        );
-    }
-
-    /// A queued request must be *claimable* by the daemon, carrying the mode and reason
-    /// the producer asked for. If the row were written in a shape `claim` cannot match,
-    /// every delegated sync would silently never happen.
-    #[tokio::test]
-    async fn a_queued_request_is_claimable_by_the_daemon() {
-        let pool = db().await;
-
-        let got = request_and_wait(&pool, SyncMode::Force, "plan-task-done", None).await;
-
-        assert_eq!(got, Delegation::Pending);
-        let claimed = pm_sync_requests::claim(&pool, ALL_PROVIDERS)
-            .await
-            .unwrap()
-            .expect("the daemon must be able to claim the queued request");
-        assert_eq!(claimed.mode, SyncMode::Force);
-        assert_eq!(claimed.reason, "plan-task-done");
-    }
-
-    /// A budget that elapses with no daemon to service the row must read as `Pending`,
-    /// not `Failed`. `plan-task-create` and `worklog-generate` both continue on
-    /// `Pending` and would otherwise log a phantom failure on every slow sync.
-    #[tokio::test]
-    async fn an_elapsed_budget_is_pending_not_failed() {
-        let pool = db().await;
-
-        let got = request_and_wait(
-            &pool,
-            SyncMode::Gated,
-            "worklog-generate",
-            Some(Duration::from_millis(600)),
-        )
-        .await;
-
-        assert_eq!(got, Delegation::Pending);
-    }
-
-    /// A failure the daemon recorded must reach the caller verbatim, so `tasks-sync`
-    /// exits non-zero with the real reason rather than a generic timeout.
-    #[tokio::test]
-    async fn a_recorded_failure_is_reported_to_the_caller() {
-        let pool = db().await;
-        pm_sync_requests::request(&pool, ALL_PROVIDERS, SyncMode::Force, "tasks-sync")
-            .await
-            .unwrap();
-        pm_sync_requests::claim(&pool, ALL_PROVIDERS).await.unwrap();
-        pm_sync_requests::complete(&pool, ALL_PROVIDERS, None, Some("refresh_token is invalid"))
-            .await
-            .unwrap();
-
-        // Re-requesting clears the outcome, so the waiter must be the one to observe it:
-        // drive the wait directly against the already-completed row.
-        let got = wait_for_outcome(&pool, "tasks-sync", Duration::from_secs(5)).await;
-
-        assert_eq!(
-            got,
-            Delegation::Failed {
-                error: "refresh_token is invalid".to_string()
-            }
-        );
-    }
-
-    /// `Pending` is not a failure, and callers branch on that. Pinned because the
-    /// obvious refactor - folding a timeout into `Failed` - would turn "the daemon is
-    /// still working" into a user-visible error on every slow sync.
-    #[test]
-    fn pending_is_distinct_from_failed() {
-        assert_ne!(
-            Delegation::Pending,
-            Delegation::Failed {
-                error: "x".to_string()
-            }
-        );
-    }
-}
diff --git a/src/intelligence/sync_requests.rs b/src/intelligence/sync_requests.rs
deleted file mode 100644
index 8e1838909..000000000
--- a/src/intelligence/sync_requests.rs
+++ /dev/null
@@ -1,227 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Single-owner PM sync: the daemon-side consumer of the `pm_sync_requests` outbox.
-//!
-//! # Why this task exists
-//!
-//! An Atlassian OAuth refresh token is single-use and rotating: the old token dies
-//! the instant the new one is issued, so a lost response leaves the grant
-//! recoverable only inside a 10-minute window and permanently dead after it. A
-//! credential like that has exactly one safe writer.
-//!
-//! It used to have many. The tray refreshed in-process, the daemon refreshed on its
-//! poll loop, and the tray spawned fresh `meridian pm-sync` / `tasks-sync` processes
-//! that each refreshed too. The advisory file lock meant to serialise them could not:
-//! its 10 s timeout is shorter than the ~26 s a refresh can take, and on timeout the
-//! code proceeded WITHOUT the lock. Two processes could spend the same token, and
-//! only Atlassian's grace window kept that from corrupting state.
-//!
-//! This watcher makes the daemon the sole consumer, so single-ownership is a property
-//! of the architecture rather than of lock discipline. Every other would-be writer -
-//! the tray, and the `tasks-sync` / `pm-sync` / `plan-task-*` / `ticket-update` /
-//! `ticket-set-status` / `worklog-generate` CLIs - now writes a request row instead
-//! (see [`crate::intelligence::sync_delegate`]). The only remaining in-process sync is
-//! the fallback taken when no daemon is running at all, where there is no second
-//! writer to race.
-//!
-//! # Why a separate task instead of the main poll loop
-//!
-//! The poll loop ticks on `POLL_INTERVAL_SECS` (60 s by default). Making a user who
-//! pressed "Sync now" wait up to a minute for the sync to even *begin* would be a
-//! visible regression against the old shell-out, which started immediately. So this
-//! runs its own short cadence ([`WATCH_INTERVAL`]) - a single indexed read against a
-//! local SQLite file, negligible next to the ETL work sharing the process.
-//!
-//! It is deliberately NOT a timer that syncs on its own: it only ever acts on a row
-//! a producer wrote, so every refresh still traces back to a human action. That is
-//! the property that stops a refresh POST being in flight when a laptop lid closes.
-//!
-//! # Who calls this
-//! - [`run_watcher`] is spawned once by `src/main.rs` at daemon startup.
-//! - Producers write rows via [`meridian_core::pm_sync_requests::request`].
-//!
-//! # Related
-//! - [`meridian_core::pm_sync_requests`] - the request/claim/complete API.
-//! - [`crate::intelligence::run_pm_sync`] / [`crate::intelligence::run_pm_force_sync`]
-//!   - the work this dispatches to.
-//! - [`crate::intelligence::Trigger`] - why attendedness is tracked at all.
-
-use std::time::Duration;
-
-use meridian_core::pm_sync_requests::{self, SyncMode, ALL_PROVIDERS};
-use sqlx::SqlitePool;
-use tokio::sync::watch;
-
-use crate::config::Config;
-
-/// How often to look for a pending request. Short enough that "Sync now" feels
-/// immediate, and cheap enough to be irrelevant: one indexed read of a single-row
-/// table on a local file.
-const WATCH_INTERVAL: Duration = Duration::from_secs(2);
-
-/// Drain PM sync requests for the life of the process.
-///
-/// Releases claims stranded by a previous daemon exit once at startup (see
-/// [`pm_sync_requests::reset_stale_claims`]), then loops.
-///
-/// Never propagates an error: a failure to read the table, or a failing sync, must
-/// not take down the daemon or stop future requests being serviced. Outcomes are
-/// recorded on the row so a producer can surface them.
-///
-/// Returns when `shutdown_rx` goes true. The shutdown check is on the SLEEP, not
-/// mid-sync, so a sync already in flight is allowed to finish and record its
-/// outcome rather than being cut off with the row left claimed. A hard kill during a
-/// sync is still possible, and [`pm_sync_requests::reset_stale_claims`] cleans that
-/// up on the next boot.
-#[tracing::instrument(skip(pool, shutdown_rx))]
-pub async fn run_watcher(pool: SqlitePool, mut shutdown_rx: watch::Receiver<bool>) {
-    if let Err(e) = pm_sync_requests::reset_stale_claims(&pool).await {
-        // Non-fatal: the table may not exist yet on a very old DB mid-migration.
-        // A stranded claim self-heals as soon as any producer writes a new request
-        // (which resets `claimed_at`), so this is a latency issue, not a dead end.
-        tracing::warn!(
-            error = %crate::errors::chain(&e),
-            "could not release stale PM sync claims - a pending request may wait for the next producer"
-        );
-    }
-
-    loop {
-        tokio::select! {
-            _ = tokio::time::sleep(WATCH_INTERVAL) => service_once(&pool).await,
-            _ = shutdown_rx.changed() => {
-                if *shutdown_rx.borrow() {
-                    tracing::debug!("PM sync request watcher stopping");
-                    return;
-                }
-            }
-        }
-    }
-}
-
-/// Claim and service at most one pending request. Split from the loop so the
-/// decision logic is reachable without spawning a task.
-async fn service_once(pool: &SqlitePool) {
-    let req = match pm_sync_requests::claim(pool, ALL_PROVIDERS).await {
-        Ok(Some(req)) => req,
-        Ok(None) => return,
-        Err(e) => {
-            // Logged at debug, not warn: on a fresh install this fires every 2 s
-            // until migration 082 has run, and a warn-level line every 2 s would
-            // bury real problems (and, being WARN+, would egress to central
-            // observability on every packaged install).
-            tracing::debug!(
-                error = %crate::errors::chain(&e),
-                "could not read PM sync requests"
-            );
-            return;
-        }
-    };
-
-    // Config is read here rather than captured at spawn time so a settings change
-    // (a newly connected tracker, an edited JQL) is picked up without a restart.
-    // Cheap because this only runs when there is actually work.
-    let cfg = Config::from_env();
-
-    tracing::info!(
-        mode = req.mode.as_str(),
-        reason = %req.reason,
-        "servicing PM sync request"
-    );
-
-    // Both arms are ATTENDED: a row exists only because a producer wrote it in
-    // response to a user action, which is precisely the condition that makes
-    // spending the rotating refresh token safe. There is deliberately no unattended
-    // path through this watcher - the clock-driven worklog sweep calls
-    // `run_pm_sync_unattended` directly instead of requesting.
-    let result = match req.mode {
-        SyncMode::Force => crate::intelligence::run_pm_force_sync(pool, &cfg).await,
-        SyncMode::Gated => crate::intelligence::run_pm_sync(pool, &cfg).await,
-    };
-
-    let (count, error) = match result {
-        Ok(()) => {
-            // The count is read back from `pm_tasks` rather than threaded out of the
-            // sync: `run_pm_sync` fans out over every provider and a per-provider
-            // tally would have to pick one to report. The board total is what "Sync
-            // now" actually wants to show.
-            let n = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM pm_tasks")
-                .fetch_one(pool)
-                .await
-                .ok();
-            tracing::info!(task_count = ?n, "PM sync request completed");
-            (n, None)
-        }
-        Err(e) => {
-            let detail = crate::errors::chain(&e);
-            tracing::warn!(error = %detail, "PM sync request failed");
-            (None, Some(detail))
-        }
-    };
-
-    if let Err(e) = pm_sync_requests::complete(pool, &req.provider, count, error.as_deref()).await {
-        tracing::warn!(
-            error = %crate::errors::chain(&e),
-            "could not record the PM sync outcome - the producer will keep waiting"
-        );
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use sqlx::sqlite::SqliteConnectOptions;
-    use std::str::FromStr;
-
-    async fn db() -> SqlitePool {
-        let opts = SqliteConnectOptions::from_str("sqlite::memory:")
-            .unwrap()
-            .create_if_missing(true);
-        let pool = SqlitePool::connect_with(opts).await.unwrap();
-        sqlx::migrate!("src/migrations").run(&pool).await.unwrap();
-        pool
-    }
-
-    /// An empty table must be a silent no-op. This runs every 2 s forever, so any
-    /// noise or error here would be a permanent log flood.
-    #[tokio::test]
-    async fn service_once_is_quiet_with_no_requests() {
-        let pool = db().await;
-        service_once(&pool).await;
-        assert!(pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
-            .await
-            .unwrap()
-            .is_none());
-    }
-
-    /// With no PM providers configured, `run_pm_sync` returns `Ok(())` early, so the
-    /// request must still be marked complete rather than left pending forever - a
-    /// producer polling for the outcome would otherwise hang.
-    #[tokio::test]
-    async fn a_request_is_completed_even_with_no_providers_configured() {
-        let pool = db().await;
-        pm_sync_requests::request(&pool, ALL_PROVIDERS, SyncMode::Gated, "test")
-            .await
-            .unwrap();
-
-        service_once(&pool).await;
-
-        let out = pm_sync_requests::outcome(&pool, ALL_PROVIDERS)
-            .await
-            .unwrap()
-            .expect("the request must be completed, not left pending");
-        assert!(out.error.is_none(), "unexpected error: {:?}", out.error);
-    }
-
-    /// The migration must actually create the table the watcher depends on.
-    #[tokio::test]
-    async fn migration_creates_the_requests_table() {
-        let pool = db().await;
-        let exists: i64 = sqlx::query_scalar(
-            "SELECT EXISTS(SELECT 1 FROM sqlite_master
-                            WHERE type = 'table' AND name = 'pm_sync_requests')",
-        )
-        .fetch_one(&pool)
-        .await
-        .unwrap();
-        assert_eq!(exists, 1);
-    }
-}
diff --git a/src/main.rs b/src/main.rs
index 157153b91..f52889729 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -8,9 +8,8 @@ use anyhow::{Context, Result};
 use meridian::config::Config;
 use meridian::db::meridian::{cleanup_incomplete_runs, setup_db};
 use meridian::etl::run_etl;
-use meridian::intelligence::sync_delegate::Delegation;
+use meridian::intelligence::{run_pm_force_sync, run_pm_sync};
 use meridian::observability;
-use meridian_core::pm_sync_requests::SyncMode;
 use tokio::sync::Notify;
 use tracing::Instrument;
 
@@ -351,45 +350,23 @@ async fn main() -> Result<()> {
         return Ok(());
     }
 
-    // `meridian tasks-sync` (force) / `meridian pm-sync` (gated) — the two on-demand
-    // CLI sync entry points. There is no background poller anymore; see
-    // `src/intelligence/mod.rs`'s doc comments for the full trigger list.
-    //
-    // `tasks-sync` bypasses the per-provider staleness gate (the user asked for fresh
-    // data now); `pm-sync` honours it, so it is a cheap no-op on an already-fresh
-    // board. Both DELEGATE to a running daemon rather than syncing here — see
-    // `cli_sync` for why the rotating credential has exactly one safe writer.
-    //
-    // One arm, because the two differ only in mode and label. They were separate
-    // copies of the same fourteen lines, which is how `pm-sync` ended up documented as
-    // the command the tray used "on opening the dashboard" — a trigger that no longer
-    // exists.
-    //
-    // Exit 1 if the DB cannot be opened, or if the sync itself failed. Reporting the
-    // sync failure in the exit code matters: with no daemon running the tray's "Sync
-    // now" shells out to `tasks-sync` and reads a non-zero exit as the failure, so
-    // exiting 0 here would show the user a successful sync that did not happen. A
-    // timeout is NOT a failure (`cli_sync` returns true) — the daemon is still working.
-    let cli_sync_mode = match std::env::args().nth(1).as_deref() {
-        Some("tasks-sync") => Some((SyncMode::Force, "tasks-sync")),
-        Some("pm-sync") => Some((SyncMode::Gated, "pm-sync")),
-        _ => None,
-    };
-    if let Some((mode, label)) = cli_sync_mode {
+    // `meridian tasks-sync` — force an immediate sync of all configured PM
+    // providers (Jira, Linear, GitHub), bypassing the 5-minute staleness gate.
+    // Exits 0 on success, non-zero if the DB cannot be opened.
+    if std::env::args().nth(1).as_deref() == Some("tasks-sync") {
         let cfg = Config::from_env();
         match setup_db(&cfg.meridian_db_uri()).await {
             Ok(pool) => {
-                let ok = cli_sync(&pool, &cfg, mode, label).await;
-                pool.close().await;
-                if !ok {
-                    std::process::exit(1);
+                if let Err(e) = run_pm_force_sync(&pool, &cfg).await {
+                    eprintln!("tasks-sync: {e}");
                 }
+                pool.close().await;
             }
             Err(e) => {
                 // `{e:#}` prints the full anyhow source chain (e.g. the sqlx
                 // "migration N was previously applied / missing" cause) instead
                 // of just the top-level "failed to run migrations" context.
-                eprintln!("{label}: open db: {e:#}");
+                eprintln!("tasks-sync: open db: {e:#}");
                 std::process::exit(1);
             }
         }
@@ -427,7 +404,7 @@ async fn main() -> Result<()> {
                     meridian::intelligence::ticket_update::ApplyStatus::Applied
                 ) {
                     if let Ok(pool) = setup_db(&cfg.meridian_db_uri()).await {
-                        cli_sync_after_write(&pool, &cfg, "ticket-update").await;
+                        let _ = run_pm_force_sync(&pool, &cfg).await;
                         pool.close().await;
                     }
                 }
@@ -533,7 +510,7 @@ async fn main() -> Result<()> {
                     meridian::intelligence::ticket_update::ApplyStatus::Applied
                 ) {
                     if let Ok(pool) = setup_db(&cfg.meridian_db_uri()).await {
-                        cli_sync_after_write(&pool, &cfg, "ticket-set-status").await;
+                        let _ = run_pm_force_sync(&pool, &cfg).await;
                         pool.close().await;
                     }
                 }
@@ -717,32 +694,6 @@ async fn main() -> Result<()> {
         let obs_guard = observability::init("meridian-rust").ok();
         match setup_db(&cfg.meridian_db_uri()).await {
             Ok(pool) => {
-                // Matching needs current ticket state — a stale board could silently
-                // bind this draft to a closed/renamed ticket. Best-effort: a sync
-                // failure must not block drafting against whatever's cached.
-                //
-                // Delegated to the daemon, the sole owner of the rotating Jira OAuth
-                // token (see `intelligence::sync_delegate`). The wait budget is short
-                // because an LLM call follows inside the tray's 150 s timeout for this
-                // command: better to draft against a slightly stale board than to blow
-                // the timeout and show the user nothing at all.
-                match meridian::intelligence::sync_delegate::sync_and_wait(
-                    &pool,
-                    &cfg,
-                    SyncMode::Gated,
-                    "worklog-generate",
-                    std::time::Duration::from_secs(30),
-                )
-                .await
-                {
-                    Delegation::Synced { .. } => {}
-                    Delegation::Failed { error } => {
-                        tracing::warn!(%error, "worklog-generate: pm sync failed — matching against cached tasks");
-                    }
-                    Delegation::Pending => {
-                        tracing::warn!("worklog-generate: pm sync still running — matching against cached tasks");
-                    }
-                }
                 match meridian::pm_worklog::generate(&pool, &cfg, &day, &task_id).await {
                     Ok(mut draft) => {
                         // A matched draft carries a target_key we can link even
@@ -1404,7 +1355,9 @@ async fn main() -> Result<()> {
     }
 
     // 7c. Run ETL once immediately before entering the loop.
+    //     Re-read config so that any settings.json present at startup takes effect.
     {
+        let cfg = Config::from_env();
         let startup_tick = tracing::info_span!("startup_tick");
         *etl_tick_span.lock().unwrap_or_else(|e| e.into_inner()) = Some(startup_tick.clone());
         let _guard = startup_tick.enter();
@@ -1428,10 +1381,12 @@ async fn main() -> Result<()> {
                 tracing::warn!(error = %meridian::errors::chain(&e), "capture retention sweep failed");
             }
         }
-        // No PM sync here anymore — there's no background poller. Syncing is
-        // on-demand now (the daily plan, the match-to-ticket picker, connecting a
-        // tracker, a board write, worklog drafting, `meridian tasks-sync`/`pm-sync`);
-        // see `src/intelligence/mod.rs`'s doc comments for the full set of triggers.
+        if let Err(e) = run_pm_sync(&meridian, &cfg).await {
+            tracing::error!(
+                error = %meridian::errors::chain(&e),
+                "intelligence run failed"
+            );
+        }
     }
 
     let (shutdown_tx, shutdown_rx) = tokio::sync::watch::channel(false);
@@ -1516,32 +1471,6 @@ async fn main() -> Result<()> {
         });
     }
 
-    // 7h. PM sync request watcher — the daemon is the SOLE holder of the rotating
-    //     Jira OAuth refresh token, so every other process (the tray, the CLIs) asks
-    //     for a sync by writing a `pm_sync_requests` row instead of refreshing
-    //     itself. This drains those requests.
-    //
-    //     Why single-ownership matters: the refresh is a single-use exchange whose
-    //     lost response kills the grant outside a 10-minute window. Serialising N
-    //     processes with an advisory file lock did not work — a 10 s lock timeout
-    //     guarding a ~26 s operation, and on timeout the code proceeded WITHOUT the
-    //     lock — so two processes could spend the same token and only Atlassian's
-    //     grace window prevented corruption.
-    //
-    //     Deliberately its own task on a short cadence rather than folded into the
-    //     60 s poll loop below: a user pressing "Sync now" must not wait up to a
-    //     minute for the sync to begin. It never syncs on its own initiative — only
-    //     ever on a row a producer wrote, so every refresh still traces to a human
-    //     action, which is what keeps a refresh POST from being in flight when a
-    //     laptop lid closes.
-    {
-        let pool_sync = meridian.clone();
-        let rx_sync = shutdown_rx.clone();
-        tokio::spawn(async move {
-            meridian::intelligence::sync_requests::run_watcher(pool_sync, rx_sync).await;
-        });
-    }
-
     // 8b. Poll loop — ETL, PM sync, and FM categorization on the configured interval.
     // Track the last-applied log level so we can detect changes and hot-reload
     // the EnvFilter without restarting the daemon.
@@ -1676,16 +1605,17 @@ async fn main() -> Result<()> {
                     tracing::debug!(error = %meridian::errors::chain(&e), "notification response consume skipped");
                 }
 
-                // No PM sync on this tick anymore — there's no background poller.
-                // `pm_tasks` is refreshed on-demand instead: the daily plan and the
-                // match-to-ticket picker (the two screens that decide something from
-                // the whole board), connecting a tracker, any board write, the worklog
-                // drafting sweep (`pm_worklog::auto_generate`), and the manual
-                // `meridian tasks-sync`/`pm-sync` CLI paths. See
-                // `src/intelligence/mod.rs`'s doc comments for the full trigger list
-                // and the reasoning (fewer standing background refreshes also shrinks
-                // how often a Jira OAuth token refresh can straddle a laptop
-                // sleep/wake).
+                // Refresh the PM task cache (pm_tasks) every tick — interval-gated
+                // per provider (~5 min), so this is a cheap no-op most ticks. The
+                // legacy drafting driver that used to trigger this before every
+                // pass was retired when the worklog pipeline moved to the
+                // clock-aligned Python trigger, which never calls this itself —
+                // leaving pm_tasks (and hence a ticket's title on the timeline)
+                // stuck at whatever it was at the last daemon restart. This is
+                // the only thing that keeps it live during normal operation.
+                if let Err(e) = run_pm_sync(&meridian, &cfg).await {
+                    tracing::warn!(error = %meridian::errors::chain(&e), "pm_tasks refresh failed — using cached tasks");
+                }
             }
         }
     }
@@ -1732,76 +1662,6 @@ async fn main() -> Result<()> {
     Ok(())
 }
 
-/// Body of the `tasks-sync` / `pm-sync` CLIs: ask the daemon and report what it did.
-///
-/// The delegation itself (and why a CLI must not spend the rotating Jira OAuth token
-/// itself) lives in [`meridian::intelligence::sync_delegate`]; this only maps the
-/// outcome onto stdout/stderr and an exit code, so the user-facing wording stays in
-/// one place next to the other CLI output.
-async fn cli_sync(
-    pool: &meridian::db::SqlitePool,
-    cfg: &Config,
-    mode: SyncMode,
-    label: &str,
-) -> bool {
-    // A generous budget: a cold sync across five providers with a token refresh can
-    // legitimately take a while, and a CLI that gives up early looks like a failure
-    // when the sync is still going. Syncing IS the point of this command, so unlike
-    // the post-write callers it waits.
-    match meridian::intelligence::sync_delegate::sync_and_wait(
-        pool,
-        cfg,
-        mode,
-        label,
-        std::time::Duration::from_secs(120),
-    )
-    .await
-    {
-        Delegation::Synced { count: Some(n) } => {
-            println!("{label}: synced {n} task(s)");
-            true
-        }
-        Delegation::Synced { count: None } => {
-            println!("{label}: synced");
-            true
-        }
-        Delegation::Failed { error } => {
-            eprintln!("{label}: {error}");
-            false
-        }
-        // NOT an error exit: the request is queued and the daemon will service it.
-        // Exiting non-zero here would fail scripts over a slow sync that ultimately
-        // succeeds.
-        Delegation::Pending => {
-            println!("{label}: still running - it will finish in the background");
-            true
-        }
-    }
-}
-
-/// Refresh the board after a CLI write applied to the tracker (`ticket-update`,
-/// `ticket-set-status`).
-///
-/// Waits for the outcome (see `sync_delegate::POST_WRITE_SYNC_BUDGET`): the frontend
-/// re-reads the board as soon as this process exits, so returning before the mirror
-/// caught up would briefly show the pre-write value and read as a lost edit. Failures
-/// and timeouts are logged, never printed - the tracker write already succeeded, so a
-/// sync hiccup must not make the command look like it failed.
-async fn cli_sync_after_write(pool: &meridian::db::SqlitePool, cfg: &Config, label: &str) {
-    match meridian::intelligence::sync_delegate::sync_after_write(pool, cfg, label).await {
-        Delegation::Synced { .. } => {}
-        Delegation::Failed { error } => {
-            tracing::warn!(label, %error, "post-write pm sync failed - the tracker write still landed");
-        }
-        Delegation::Pending => {
-            tracing::warn!(
-                label,
-                "post-write pm sync still running - the tracker write still landed"
-            );
-        }
-    }
-}
-
 /// Runs one ETL pass and maps the outcome onto the notice bus.
 ///
 /// Returns `true` when the failure was database corruption, which the caller
diff --git a/src/migrations/082_pm_sync_requests.sql b/src/migrations/082_pm_sync_requests.sql
deleted file mode 100644
index 9a49eaaeb..000000000
--- a/src/migrations/082_pm_sync_requests.sql
+++ /dev/null
@@ -1,68 +0,0 @@
--- ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
---
--- Single-owner PM sync: the request side of the outbox.
---
--- WHY THIS EXISTS
--- An Atlassian OAuth refresh token is single-use and rotating: the old token dies
--- the instant the new one is issued, so a lost response leaves the grant
--- recoverable only inside a 10-minute window and unrecoverable after it. That
--- makes the token a resource with exactly one safe writer.
---
--- It had several. The tray refreshed in-process, the daemon refreshed on its poll
--- loop, and the tray spawned `meridian pm-sync` / `tasks-sync` as fresh processes
--- that each refreshed too. Mutual exclusion was left to an advisory file lock that
--- could not actually deliver it: its 10 s timeout is shorter than the ~26 s a
--- refresh can take (3 attempts x 8 s + backoff), and on failure the code proceeded
--- WITHOUT the lock rather than backing off. Two processes could therefore spend the
--- same token, and the only thing preventing corruption was Atlassian's grace window
--- handing the loser the current pair. Correctness by vendor accident.
---
--- So sync becomes a REQUEST rather than an action. Producers (tray window opens,
--- tracker connect, "Sync now", the CLI) write a row here; the daemon is the sole
--- consumer and the sole holder of the credential.
---
--- COALESCING, NOT A QUEUE
--- `provider` is the PRIMARY KEY so repeated requests collapse into one pending row
--- (`ON CONFLICT DO UPDATE`). Opening the dashboard ten times must not queue ten
--- syncs - it must mean "a sync is wanted", once. `'*'` is the all-providers request
--- that every current producer writes; per-provider rows are reserved for a future
--- caller that needs to refresh just one board.
---
--- `mode` escalates and never de-escalates while a row is pending: a 'force' request
--- landing on a pending 'gated' one upgrades it, because a user who just connected a
--- tracker or pressed "Sync now" must not have their explicit request downgraded by a
--- passing window focus. The reverse is silently ignored by the producer's UPSERT.
---
--- COMPLETION IS REPORTED IN PLACE, NOT DELETED
--- The daemon stamps `completed_at` plus `error` / `synced_count` rather than removing
--- the row, so "Sync now" can show a real outcome without the tray needing to hold the
--- credential or shell out. A serviced row is retained until the next request replaces
--- it, which also gives `meridian health` a cheap, content-free view of the last sync
--- attempt.
-
-CREATE TABLE IF NOT EXISTS pm_sync_requests (
-    -- '*' = all configured providers. A specific provider name scopes the request.
-    provider      TEXT    NOT NULL PRIMARY KEY,
-    -- 'gated'  - honour the per-provider staleness window (the cheap common case).
-    -- 'force'  - bypass it; the user explicitly asked (connect, "Sync now", CLI).
-    mode          TEXT    NOT NULL DEFAULT 'gated',
-    -- Free-text producer tag for tracing only (e.g. 'dashboard_open', 'token_connected').
-    -- Never a user-content value: this is read back into logs.
-    reason        TEXT    NOT NULL DEFAULT '',
-    requested_at  TEXT    NOT NULL,
-    -- Set when the daemon starts servicing, so a request in flight is distinguishable
-    -- from one still waiting. Cleared on the next request.
-    claimed_at    TEXT,
-    -- Set when the daemon finishes, success or failure. NULL while pending/in-flight.
-    completed_at  TEXT,
-    -- NULL on success. The failure detail otherwise, for the tray to surface.
-    error         TEXT,
-    -- Tasks refreshed on the last completed pass, for "Sync now" feedback.
-    synced_count  INTEGER
-);
-
--- No secondary index on purpose. Every hot query (`claim`, `complete`, `outcome`,
--- `request`) filters on `provider`, which is the PRIMARY KEY, so an index on
--- (completed_at, claimed_at) would never be chosen. The only query that does not
--- name a provider is `reset_stale_claims`, which runs once per daemon boot over a
--- table holding one row per provider - a scan there is free.
diff --git a/src/plan_tasks/create.rs b/src/plan_tasks/create.rs
index 2b8867e27..16a62e1b7 100644
--- a/src/plan_tasks/create.rs
+++ b/src/plan_tasks/create.rs
@@ -30,22 +30,13 @@
 //! - [`meridian_core::plan`] — `apply_plan_action("add")`, which puts the key in today.
 
 use anyhow::{Context, Result};
-use meridian_core::pm_sync_requests::SyncMode;
 use meridian_core::task_create::{self, NewTask};
 use serde::Serialize;
 use sqlx::SqlitePool;
-use std::time::Duration;
 use tracing::field::Empty;
 use tracing::Instrument;
 
 use crate::config::Config;
-use crate::intelligence::sync_delegate::Delegation;
-
-/// How long to wait for the post-create sync before falling through to the shadow row.
-/// Must stay comfortably inside the tray's 90 s `WRITE_TIMEOUT` for `plan-task-create`,
-/// since a blown tray timeout looks to the user like a failed create even though the
-/// ticket was filed.
-const POST_CREATE_SYNC_BUDGET: Duration = Duration::from_secs(60);
 
 /// Where a new task should live.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -186,30 +177,9 @@ async fn create_on_tracker(
     tracing::Span::current().record("synced", true);
 
     // Pull the authoritative row in immediately rather than waiting out the 5-minute
-    // sync gate. Best-effort: a failed sync is not a failed create - it just means the
-    // `task_exists` check below falls through to the shadow row.
-    //
-    // Delegated to the daemon (see `intelligence::sync_delegate`) because this is a
-    // short-lived CLI process and the rotating Jira OAuth token has exactly one safe
-    // writer. Unlike the edit/done paths this WAITS for the outcome: the very next line
-    // reads `pm_tasks`, so returning before the sync landed would shadow every created
-    // ticket. The budget sits inside the tray's 90 s `WRITE_TIMEOUT` for this command.
-    match crate::intelligence::sync_delegate::sync_and_wait(
-        pool,
-        config,
-        SyncMode::Force,
-        "plan-task-create",
-        POST_CREATE_SYNC_BUDGET,
-    )
-    .await
-    {
-        Delegation::Synced { .. } => {}
-        Delegation::Failed { error } => {
-            tracing::warn!(%error, "plan_task: post-create sync failed - will shadow the row");
-        }
-        Delegation::Pending => {
-            tracing::warn!("plan_task: post-create sync still running - will shadow the row");
-        }
+    // sync gate. Best-effort: a failed sync is not a failed create.
+    if let Err(e) = crate::intelligence::run_pm_force_sync(pool, config).await {
+        tracing::warn!(error = %e, "plan_task: post-create sync failed - will shadow the row");
     }
 
     if task_create::task_exists(pool, &key).await? {
diff --git a/src/plan_tasks/done.rs b/src/plan_tasks/done.rs
index e0a5643d4..53dc4496a 100644
--- a/src/plan_tasks/done.rs
+++ b/src/plan_tasks/done.rs
@@ -29,7 +29,6 @@ use tracing::field::Empty;
 use tracing::Instrument;
 
 use crate::config::Config;
-use crate::intelligence::sync_delegate::Delegation;
 use crate::intelligence::ticket_update::{self, ApplyStatus};
 use crate::plan_tasks::edit::EditResult;
 
@@ -118,20 +117,8 @@ async fn set_done_on_tracker(
 
     // Best-effort — the tracker has already accepted the transition, so a sync hiccup
     // must not read as a failed toggle.
-    //
-    // Delegated to the daemon (`intelligence::sync_delegate`), which is the only process
-    // that may spend the rotating Jira OAuth token. Nothing below reads `pm_tasks`, so
-    // this does not wait for the outcome - the request row is written and the daemon
-    // picks it up within ~2 s, well before the user's next board read.
-    match crate::intelligence::sync_delegate::sync_after_write(pool, config, "plan-task-done").await
-    {
-        Delegation::Synced { .. } => {}
-        Delegation::Failed { error } => {
-            tracing::warn!(%error, "plan_task: post-toggle sync failed - the change still landed");
-        }
-        Delegation::Pending => {
-            tracing::warn!("plan_task: post-toggle sync still running - the change still landed");
-        }
+    if let Err(e) = crate::intelligence::run_pm_force_sync(pool, config).await {
+        tracing::warn!(error = %e, "plan_task: post-toggle sync failed - the change still landed");
     }
     tracing::Span::current().record("status", "applied");
     tracing::info!(field, "plan_task: tracker task status set");
diff --git a/src/plan_tasks/edit.rs b/src/plan_tasks/edit.rs
index df4523497..7b244755e 100644
--- a/src/plan_tasks/edit.rs
+++ b/src/plan_tasks/edit.rs
@@ -32,7 +32,6 @@ use tracing::field::Empty;
 use tracing::Instrument;
 
 use crate::config::Config;
-use crate::intelligence::sync_delegate::Delegation;
 use crate::intelligence::ticket_update::{self, ApplyStatus};
 
 /// The outcome of an edit, serialized to the CLI's one JSON line.
@@ -158,20 +157,8 @@ async fn edit_on_tracker(
         // Reflect the applied write back into our mirror (the `ticket-update` CLI
         // does exactly this after an Applied write). Best-effort — the tracker has
         // already accepted it, so a sync hiccup must not read as a failed edit.
-        //
-        // Delegated to the daemon (`intelligence::sync_delegate`), the only process that
-        // may spend the rotating Jira OAuth token. Nothing below reads `pm_tasks`, so the
-        // outcome is not awaited.
-        match crate::intelligence::sync_delegate::sync_after_write(pool, config, "plan-task-edit")
-            .await
-        {
-            Delegation::Synced { .. } => {}
-            Delegation::Failed { error } => {
-                tracing::warn!(%error, "plan_task: post-edit sync failed - the edit still landed");
-            }
-            Delegation::Pending => {
-                tracing::warn!("plan_task: post-edit sync still running - the edit still landed");
-            }
+        if let Err(e) = crate::intelligence::run_pm_force_sync(pool, config).await {
+            tracing::warn!(error = %e, "plan_task: post-edit sync failed - the edit still landed");
         }
     }
     tracing::Span::current().record("status", "applied");
diff --git a/src/pm_worklog/auto_generate/sweep.rs b/src/pm_worklog/auto_generate.rs
similarity index 53%
rename from src/pm_worklog/auto_generate/sweep.rs
rename to src/pm_worklog/auto_generate.rs
index 9586e0431..8e693e819 100644
--- a/src/pm_worklog/auto_generate/sweep.rs
+++ b/src/pm_worklog/auto_generate.rs
@@ -1,11 +1,96 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! The shared sweep body [`super::maybe_auto_generate`] (clock-gated) and
-//! [`super::generate_now`] (on demand) both call: draft a worklog for every
-//! qualifying, not-yet-drafted day-task. Split out of `auto_generate.rs` when that
-//! file passed the repo's 500-line cap — see `auto_generate/mod.rs`'s module doc
-//! for the full feature description; this file is the mechanical loop only.
+//! Auto-generate worklog DRAFTS, once a day, at a user-chosen local clock time —
+//! the opt-in behind `settings.worklog_auto_generate_time`.
+//!
+//! This runs the exact same action as the day-task detail panel's "Generate
+//! worklog" button (`pm_worklog::generate`), automatically, for any task past the
+//! fixed [`QUALIFYING_MINUTES`] threshold that doesn't have a draft yet. It NEVER
+//! approves or posts — approving is always a deliberate human click
+//! (`pm_worklog::approve`, the panel's "Approve & post"). Auto-generate only saves
+//! the user the click that starts the draft; the tracker is never touched without
+//! them.
+//!
+//! Off by default: the field is `None` until the user picks a time from the
+//! Timeline nudge or Settings → Worklogs, so nothing here ever runs unattended for
+//! someone who hasn't said yes.
+//!
+//! # A TRACKER IS NOT REQUIRED — and used to be, wrongly
+//! Both entry points opened with `if config.pm_providers.is_empty() { return }`,
+//! on the premise that "there is nothing to match against, so the sweep would only
+//! fail every call". That premise is false, and stopped being true the moment
+//! personal tasks became first-class: [`crate::pm_worklog::generate`] matches a
+//! PERSONAL (`local`) day-task exactly like a real ticket and, on approve, posts to
+//! that task's own row (`post_to_local_task`) — no tracker anywhere in the path.
+//! Only the PROPOSE branch needs a configured provider, and that branch failing is
+//! already a per-task `warn!` the loop walks past.
+//!
+//! So the gate silently disabled the whole feature for every tracker-less user —
+//! the cohort Meridian now leads with — and Settings mirrored it with a dead-end
+//! card offering nothing. Removed at both ends. Keep it that way: the correct floor
+//! is "does this task have qualifying minutes and no draft yet", which is what the
+//! sweep already checks, not "does this user have Jira".
+//!
+//! # Once a day, from the chosen time onward — not continuously, and self-healing
+//! [`maybe_auto_generate`] is called every clock-aligned wake (HH:03, same as the
+//! rest of the worklog pipeline), but only actually scans once the current local
+//! hour has REACHED the chosen time's hour — so a task crossing the threshold at
+//! 2pm with a 6pm setting waits for 6pm, not the next tick after 2pm.
+//!
+//! Deliberately `>=`, not `==`: if the Mac is asleep, off, or the app isn't
+//! running at exactly 9pm, there is no tick at 9pm to miss — the daemon simply
+//! catches up on its next wake that same day (10pm, or whenever the machine comes
+//! back), because every tick from the chosen hour through local midnight re-runs
+//! the same scan. This is safe to repeat because already-drafted tasks are
+//! skipped (see below) — a caught-up run only ever drafts what genuinely wasn't
+//! drafted yet, it never redoes work. The one thing this does NOT do is reach
+//! back across local midnight: if the whole rest of the day was slept through,
+//! that day's catch-up is skipped, matching this pipeline's standing "no
+//! backfill past today" policy — the manual "Generate worklog" button in the
+//! panel always still works for any past day.
+//!
+//! # Fires once per task, not on every qualifying tick
+//! Once a task has ANY draft (auto- or manually generated), this leaves it alone
+//! for good — it does not keep re-drafting an already-drafted task on a later
+//! tick, whether that's later the same evening (the catch-up case above) or a
+//! future day. If the user keeps working the task past the auto-draft, getting
+//! an up-to-date version is a manual "Regenerate" click in the panel (which
+//! shows when the draft was last generated, via `DayTaskWorklogDraft::
+//! updated_at`) — auto-generate hands off to that rather than looping forever.
+//!
+//! # One task at a time
+//! Tasks are processed in a plain sequential loop, not fanned out — each `generate`
+//! call is a real LLM request, and running them one after another (rather than
+//! concurrently) keeps this predictable and easy to reason about from the trace.
+//!
+//! # Observability
+//! The whole run is one `worklog.auto_generate.run` span (see
+//! [`maybe_auto_generate`]) carrying the gate outcome and per-run counts as
+//! attributes — `gate` names exactly why a run did or didn't scan (`disabled`,
+//! `before_chosen_hour`, `malformed_time`, or `ran`), so "why didn't this fire
+//! tonight" is answerable from the trace alone, not by reading code. Each task
+//! that actually gets drafted (or fails to) gets its own `info!`/`warn!` — real,
+//! individually actionable events — but a task skipped for already having a
+//! draft or not yet qualifying is silent (folded into the summary counts only),
+//! so a quiet evening with nothing to do doesn't spam the log with one line per
+//! task.
+//!
+//! # Who calls this
+//! [`crate::worklog_pipeline::run_loop`], every clock-aligned wake (HH:03), right
+//! after the hourly activity-report pass.
+//!
+//! # Related
+//! - [`crate::pm_worklog::generate`] — the exact function the manual button calls;
+//!   this module never calls [`crate::pm_worklog::approve`].
+//! - [`meridian_core::day_tasks::get_day_tasks`] — the read model this scans;
+//!   `DayTask::minutes` is the deterministic measured total.
+//! - [`meridian_core::day_task_worklogs::get_day_task_worklog`] — the "has this
+//!   task already been drafted" check that makes auto-generate fire exactly once
+//!   per task.
 
+use chrono::{Local, Timelike};
 use sqlx::SqlitePool;
+use tracing::field::Empty;
+use tracing::Instrument;
 
 use crate::config::Config;
 use crate::pm_worklog;
@@ -13,14 +98,101 @@ use crate::pm_worklog;
 /// Fixed qualifying threshold — a day-task needs more than this many tracked
 /// minutes to be auto-drafted. Not user-configurable: only WHEN Meridian checks
 /// (`worklog_auto_generate_time`) is a choice; WHICH tasks qualify is not.
-pub(super) const QUALIFYING_MINUTES: i64 = 30;
+const QUALIFYING_MINUTES: i64 = 30;
+
+/// Parse "HH:MM" into `(hour, minute)`. `None` for anything malformed — the
+/// settings write path (`update_settings`) already rejects a bad value, so this
+/// only has to be defensive against a hand-edited file.
+fn parse_hh_mm(s: &str) -> Option<(u32, u32)> {
+    let (h, m) = s.split_once(':')?;
+    let (h, m) = (h.parse::<u32>().ok()?, m.parse::<u32>().ok()?);
+    (h < 24 && m < 60).then_some((h, m))
+}
+
+/// Once the current local hour has reached the user's chosen hour (today), scan
+/// `day_local`'s day-tasks and auto-generate a worklog DRAFT (never approve,
+/// never post) for any past [`QUALIFYING_MINUTES`] that doesn't have a draft yet.
+/// A no-op when `worklog_auto_generate_time` is unset, or before that hour. Safe
+/// to call again later the same day (e.g. the machine was asleep at the chosen
+/// time) — see the module docs. Tasks are processed one at a time, in order —
+/// never concurrently.
+#[tracing::instrument(skip(pool, config))]
+pub async fn maybe_auto_generate(pool: &SqlitePool, config: &Config, day_local: &str) {
+    let span = tracing::info_span!(
+        "worklog.auto_generate.run",
+        day = day_local,
+        chosen_time = Empty,
+        gate = Empty,
+        tasks_total = Empty,
+        tasks_qualifying = Empty,
+        tasks_already_drafted = Empty,
+        tasks_drafted = Empty,
+        tasks_failed = Empty,
+    );
+    run(pool, config, day_local).instrument(span).await
+}
+
+async fn run(pool: &SqlitePool, config: &Config, day_local: &str) {
+    let current_span = tracing::Span::current();
+
+    let settings = meridian_core::settings::load_runtime_settings();
+    let Some(chosen_time) = settings.worklog_auto_generate_time else {
+        current_span.record("gate", "disabled");
+        return;
+    };
+    current_span.record("chosen_time", chosen_time.as_str());
+
+    let Some((chosen_hour, _)) = parse_hh_mm(&chosen_time) else {
+        current_span.record("gate", "malformed_time");
+        tracing::warn!(
+            chosen_time,
+            "worklog: auto-generate time is malformed — skipping"
+        );
+        return;
+    };
+    if Local::now().hour() < chosen_hour {
+        current_span.record("gate", "before_chosen_hour");
+        return;
+    }
+    current_span.record("gate", "ran");
+
+    draft_qualifying_tasks(pool, config, day_local, &current_span).await;
+}
+
+/// The "Generate now" path — the same day-task draft sweep as [`maybe_auto_generate`],
+/// but WITHOUT the time-of-day gate, run because the user asked for it on the spot
+/// (the daily-summary screen's "Generate now" button) rather than because the clock
+/// reached their chosen time. Everything else is identical: drafts only, never
+/// approves/posts, and skips any task that already has a draft, so it is safe to run
+/// alongside or before the scheduled pass. Independent of `worklog_auto_generate_time`:
+/// a user who never set a time can still generate on demand.
+#[tracing::instrument(skip(pool, config))]
+pub async fn generate_now(pool: &SqlitePool, config: &Config, day_local: &str) {
+    let span = tracing::info_span!(
+        "worklog.generate_now.run",
+        day = day_local,
+        gate = Empty,
+        tasks_total = Empty,
+        tasks_qualifying = Empty,
+        tasks_already_drafted = Empty,
+        tasks_drafted = Empty,
+        tasks_failed = Empty,
+    );
+    async {
+        let current_span = tracing::Span::current();
+        current_span.record("gate", "ran");
+        draft_qualifying_tasks(pool, config, day_local, &current_span).await;
+    }
+    .instrument(span)
+    .await
+}
 
 /// What one sweep did. Returned rather than only recorded onto the span so the
 /// behaviour is assertable: "did this run at all" and "did it early-return" are
 /// otherwise indistinguishable from outside, which is exactly how a tracker gate
 /// silently disabled the whole feature for solo users once already.
 #[derive(Debug, Default, PartialEq, Eq)]
-pub(super) struct SweepCounts {
+struct SweepCounts {
     total: usize,
     qualifying: u32,
     already_drafted: u32,
@@ -29,36 +201,19 @@ pub(super) struct SweepCounts {
 }
 
 /// Draft a worklog for every qualifying, not-yet-drafted day-task of `day_local`,
-/// recording per-run counts onto `span`. The shared body of
-/// [`super::maybe_auto_generate`] (gated on the clock) and [`super::generate_now`]
-/// (on demand); it assumes its caller has already decided a run is warranted.
+/// recording per-run counts onto `span` and returning them. The shared body of
+/// [`maybe_auto_generate`] (gated on the clock) and [`generate_now`] (on demand); it
+/// assumes its caller has already decided a run is warranted.
 ///
 /// Deliberately NOT gated on a connected tracker - a personal day-task is matched and
 /// drafted like any ticket, and only the propose branch needs one (it already fails
 /// per-task). See [`neither_sweep_is_gated_on_a_connected_tracker`].
-pub(super) async fn draft_qualifying_tasks(
+async fn draft_qualifying_tasks(
     pool: &SqlitePool,
     config: &Config,
     day_local: &str,
     span: &tracing::Span,
 ) -> SweepCounts {
-    // Matching a day-task against `pm_tasks` wants current ticket state, and there is
-    // no background poller keeping it fresh anymore — so this sweep asks for it.
-    //
-    // UNATTENDED on purpose. This runs on a clock (HH:03), which makes it the one
-    // remaining path that could fire a Jira OAuth refresh with nobody at the machine
-    // — the exact shape that permanently killed a production user's grant when a
-    // refresh POST straddled a 28-minute suspend. `run_pm_sync_unattended` will use a
-    // valid access token but never mint one, so an expired token simply defers to the
-    // next attended request instead of betting the grant. Best-effort either way: a
-    // sync failure must not block drafting against whatever is cached.
-    if let Err(e) = crate::intelligence::run_pm_sync_unattended(pool, config).await {
-        tracing::warn!(
-            day = day_local, error = %e,
-            "worklog: auto-generate pm sync failed — matching against cached tasks"
-        );
-    }
-
     let tasks = match meridian_core::day_tasks::get_day_tasks(pool, day_local).await {
         Ok(resp) => resp.tasks,
         Err(e) => {
@@ -150,7 +305,7 @@ pub(super) async fn draft_qualifying_tasks(
 
 #[cfg(test)]
 mod tests {
-    use super::{draft_qualifying_tasks, SweepCounts, QUALIFYING_MINUTES};
+    use super::{draft_qualifying_tasks, parse_hh_mm, SweepCounts, QUALIFYING_MINUTES};
     use crate::config::Config;
     use sqlx::sqlite::SqlitePoolOptions;
     use sqlx::SqlitePool;
@@ -294,6 +449,25 @@ mod tests {
         assert_eq!(counts, SweepCounts::default());
     }
 
+    #[test]
+    fn parses_valid_times() {
+        assert_eq!(parse_hh_mm("00:00"), Some((0, 0)));
+        assert_eq!(parse_hh_mm("18:00"), Some((18, 0)));
+        assert_eq!(parse_hh_mm("23:59"), Some((23, 59)));
+        assert_eq!(parse_hh_mm("09:05"), Some((9, 5)));
+    }
+
+    #[test]
+    fn rejects_out_of_range_or_malformed_values() {
+        assert_eq!(parse_hh_mm("24:00"), None);
+        assert_eq!(parse_hh_mm("18:60"), None);
+        assert_eq!(parse_hh_mm("18"), None);
+        assert_eq!(parse_hh_mm("18:00:00"), None);
+        assert_eq!(parse_hh_mm(""), None);
+        assert_eq!(parse_hh_mm("not-a-time"), None);
+        assert_eq!(parse_hh_mm("ab:cd"), None);
+    }
+
     /// Neither entry point may re-acquire a "do they have a tracker" precondition.
     ///
     /// Source-level because the gate was a bare early return with no observable
@@ -303,10 +477,7 @@ mod tests {
     /// ticket); only the propose branch needs one, and it already fails per-task.
     #[test]
     fn neither_sweep_is_gated_on_a_connected_tracker() {
-        // Both files: `maybe_auto_generate`/`generate_now` (the entry points) live in
-        // `mod.rs`, the actual per-task loop lives here — a gate could reappear in
-        // either.
-        let src = concat!(include_str!("mod.rs"), "\n", include_str!("sweep.rs"));
+        let src = include_str!("auto_generate.rs");
         // Comment lines dropped, not just their markers - the module doc above
         // quotes the removed gate verbatim to explain why it went.
         let code: String = src
diff --git a/src/pm_worklog/auto_generate/mod.rs b/src/pm_worklog/auto_generate/mod.rs
deleted file mode 100644
index a72ebe467..000000000
--- a/src/pm_worklog/auto_generate/mod.rs
+++ /dev/null
@@ -1,216 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Auto-generate worklog DRAFTS, once a day, at a user-chosen local clock time —
-//! the opt-in behind `settings.worklog_auto_generate_time`.
-//!
-//! This runs the exact same action as the day-task detail panel's "Generate
-//! worklog" button (`pm_worklog::generate`), automatically, for any task past the
-//! fixed [`sweep::QUALIFYING_MINUTES`] threshold that doesn't have a draft yet. It
-//! NEVER approves or posts — approving is always a deliberate human click
-//! (`pm_worklog::approve`, the panel's "Approve & post"). Auto-generate only saves
-//! the user the click that starts the draft; the tracker is never touched without
-//! them.
-//!
-//! Off by default: the field is `None` until the user picks a time from the
-//! Timeline nudge or Settings → Worklogs, so nothing here ever runs unattended for
-//! someone who hasn't said yes.
-//!
-//! # A TRACKER IS NOT REQUIRED — and used to be, wrongly
-//! Both entry points opened with `if config.pm_providers.is_empty() { return }`,
-//! on the premise that "there is nothing to match against, so the sweep would only
-//! fail every call". That premise is false, and stopped being true the moment
-//! personal tasks became first-class: [`crate::pm_worklog::generate`] matches a
-//! PERSONAL (`local`) day-task exactly like a real ticket and, on approve, posts to
-//! that task's own row (`post_to_local_task`) — no tracker anywhere in the path.
-//! Only the PROPOSE branch needs a configured provider, and that branch failing is
-//! already a per-task `warn!` the loop walks past.
-//!
-//! So the gate silently disabled the whole feature for every tracker-less user —
-//! the cohort Meridian now leads with — and Settings mirrored it with a dead-end
-//! card offering nothing. Removed at both ends. Keep it that way: the correct floor
-//! is "does this task have qualifying minutes and no draft yet", which is what the
-//! sweep already checks, not "does this user have Jira".
-//!
-//! # Once a day, from the chosen time onward — not continuously, and self-healing
-//! [`maybe_auto_generate`] is called every clock-aligned wake (HH:03, same as the
-//! rest of the worklog pipeline), but only actually scans once the current local
-//! hour has REACHED the chosen time's hour — so a task crossing the threshold at
-//! 2pm with a 6pm setting waits for 6pm, not the next tick after 2pm.
-//!
-//! Deliberately `>=`, not `==`: if the Mac is asleep, off, or the app isn't
-//! running at exactly 9pm, there is no tick at 9pm to miss — the daemon simply
-//! catches up on its next wake that same day (10pm, or whenever the machine comes
-//! back), because every tick from the chosen hour through local midnight re-runs
-//! the same scan. This is safe to repeat because already-drafted tasks are
-//! skipped (see below) — a caught-up run only ever drafts what genuinely wasn't
-//! drafted yet, it never redoes work. The one thing this does NOT do is reach
-//! back across local midnight: if the whole rest of the day was slept through,
-//! that day's catch-up is skipped, matching this pipeline's standing "no
-//! backfill past today" policy — the manual "Generate worklog" button in the
-//! panel always still works for any past day.
-//!
-//! # Fires once per task, not on every qualifying tick
-//! Once a task has ANY draft (auto- or manually generated), this leaves it alone
-//! for good — it does not keep re-drafting an already-drafted task on a later
-//! tick, whether that's later the same evening (the catch-up case above) or a
-//! future day. If the user keeps working the task past the auto-draft, getting
-//! an up-to-date version is a manual "Regenerate" click in the panel (which
-//! shows when the draft was last generated, via `DayTaskWorklogDraft::
-//! updated_at`) — auto-generate hands off to that rather than looping forever.
-//!
-//! # One task at a time
-//! Tasks are processed in a plain sequential loop, not fanned out — each `generate`
-//! call is a real LLM request, and running them one after another (rather than
-//! concurrently) keeps this predictable and easy to reason about from the trace.
-//!
-//! # Board freshness
-//! [`sweep::draft_qualifying_tasks`] syncs the PM board (gated, ~5 min per provider)
-//! before matching — there is no background poller keeping `pm_tasks` fresh
-//! anymore, so this sweep is one of the few places that has to ask for it itself.
-//!
-//! # Observability
-//! The whole run is one `worklog.auto_generate.run` span (see
-//! [`maybe_auto_generate`]) carrying the gate outcome and per-run counts as
-//! attributes — `gate` names exactly why a run did or didn't scan (`disabled`,
-//! `before_chosen_hour`, `malformed_time`, or `ran`), so "why didn't this fire
-//! tonight" is answerable from the trace alone, not by reading code. Each task
-//! that actually gets drafted (or fails to) gets its own `info!`/`warn!` — real,
-//! individually actionable events — but a task skipped for already having a
-//! draft or not yet qualifying is silent (folded into the summary counts only),
-//! so a quiet evening with nothing to do doesn't spam the log with one line per
-//! task.
-//!
-//! # Who calls this
-//! [`crate::worklog_pipeline::run_loop`], every clock-aligned wake (HH:03), right
-//! after the hourly activity-report pass.
-//!
-//! # Related
-//! - [`crate::pm_worklog::generate`] — the exact function the manual button calls;
-//!   this module never calls [`crate::pm_worklog::approve`].
-//! - [`meridian_core::day_tasks::get_day_tasks`] — the read model this scans;
-//!   `DayTask::minutes` is the deterministic measured total.
-//! - [`meridian_core::day_task_worklogs::get_day_task_worklog`] — the "has this
-//!   task already been drafted" check that makes auto-generate fire exactly once
-//!   per task.
-//! - [`sweep`] — the mechanical per-task loop, split out when this file passed the
-//!   500-line cap.
-
-mod sweep;
-
-use chrono::{Local, Timelike};
-use sqlx::SqlitePool;
-use tracing::field::Empty;
-use tracing::Instrument;
-
-use crate::config::Config;
-use sweep::draft_qualifying_tasks;
-
-/// Parse "HH:MM" into `(hour, minute)`. `None` for anything malformed — the
-/// settings write path (`update_settings`) already rejects a bad value, so this
-/// only has to be defensive against a hand-edited file.
-fn parse_hh_mm(s: &str) -> Option<(u32, u32)> {
-    let (h, m) = s.split_once(':')?;
-    let (h, m) = (h.parse::<u32>().ok()?, m.parse::<u32>().ok()?);
-    (h < 24 && m < 60).then_some((h, m))
-}
-
-/// Once the current local hour has reached the user's chosen hour (today), scan
-/// `day_local`'s day-tasks and auto-generate a worklog DRAFT (never approve,
-/// never post) for any past [`sweep::QUALIFYING_MINUTES`] that doesn't have a draft
-/// yet. A no-op when `worklog_auto_generate_time` is unset, or before that hour.
-/// Safe to call again later the same day (e.g. the machine was asleep at the
-/// chosen time) — see the module docs. Tasks are processed one at a time, in
-/// order — never concurrently.
-#[tracing::instrument(skip(pool, config))]
-pub async fn maybe_auto_generate(pool: &SqlitePool, config: &Config, day_local: &str) {
-    let span = tracing::info_span!(
-        "worklog.auto_generate.run",
-        day = day_local,
-        chosen_time = Empty,
-        gate = Empty,
-        tasks_total = Empty,
-        tasks_qualifying = Empty,
-        tasks_already_drafted = Empty,
-        tasks_drafted = Empty,
-        tasks_failed = Empty,
-    );
-    run(pool, config, day_local).instrument(span).await
-}
-
-async fn run(pool: &SqlitePool, config: &Config, day_local: &str) {
-    let current_span = tracing::Span::current();
-
-    let settings = meridian_core::settings::load_runtime_settings();
-    let Some(chosen_time) = settings.worklog_auto_generate_time else {
-        current_span.record("gate", "disabled");
-        return;
-    };
-    current_span.record("chosen_time", chosen_time.as_str());
-
-    let Some((chosen_hour, _)) = parse_hh_mm(&chosen_time) else {
-        current_span.record("gate", "malformed_time");
-        tracing::warn!(
-            chosen_time,
-            "worklog: auto-generate time is malformed — skipping"
-        );
-        return;
-    };
-    if Local::now().hour() < chosen_hour {
-        current_span.record("gate", "before_chosen_hour");
-        return;
-    }
-    current_span.record("gate", "ran");
-
-    draft_qualifying_tasks(pool, config, day_local, &current_span).await;
-}
-
-/// The "Generate now" path — the same day-task draft sweep as [`maybe_auto_generate`],
-/// but WITHOUT the time-of-day gate, run because the user asked for it on the spot
-/// (the daily-summary screen's "Generate now" button) rather than because the clock
-/// reached their chosen time. Everything else is identical: drafts only, never
-/// approves/posts, and skips any task that already has a draft, so it is safe to run
-/// alongside or before the scheduled pass. Independent of `worklog_auto_generate_time`:
-/// a user who never set a time can still generate on demand.
-#[tracing::instrument(skip(pool, config))]
-pub async fn generate_now(pool: &SqlitePool, config: &Config, day_local: &str) {
-    let span = tracing::info_span!(
-        "worklog.generate_now.run",
-        day = day_local,
-        gate = Empty,
-        tasks_total = Empty,
-        tasks_qualifying = Empty,
-        tasks_already_drafted = Empty,
-        tasks_drafted = Empty,
-        tasks_failed = Empty,
-    );
-    async {
-        let current_span = tracing::Span::current();
-        current_span.record("gate", "ran");
-        draft_qualifying_tasks(pool, config, day_local, &current_span).await;
-    }
-    .instrument(span)
-    .await
-}
-
-#[cfg(test)]
-mod tests {
-    use super::parse_hh_mm;
-
-    #[test]
-    fn parses_valid_times() {
-        assert_eq!(parse_hh_mm("00:00"), Some((0, 0)));
-        assert_eq!(parse_hh_mm("18:00"), Some((18, 0)));
-        assert_eq!(parse_hh_mm("23:59"), Some((23, 59)));
-        assert_eq!(parse_hh_mm("09:05"), Some((9, 5)));
-    }
-
-    #[test]
-    fn rejects_out_of_range_or_malformed_values() {
-        assert_eq!(parse_hh_mm("24:00"), None);
-        assert_eq!(parse_hh_mm("18:60"), None);
-        assert_eq!(parse_hh_mm("18"), None);
-        assert_eq!(parse_hh_mm("18:00:00"), None);
-        assert_eq!(parse_hh_mm(""), None);
-        assert_eq!(parse_hh_mm("not-a-time"), None);
-        assert_eq!(parse_hh_mm("ab:cd"), None);
-    }
-}
diff --git a/tray/src-tauri/src/commands/integrations.rs b/tray/src-tauri/src/commands/integrations.rs
index 2e6e1d502..5dbe8b53a 100644
--- a/tray/src-tauri/src/commands/integrations.rs
+++ b/tray/src-tauri/src/commands/integrations.rs
@@ -681,11 +681,6 @@ pub async fn save_integration_token(
         tracing::debug!("daemon reload after token save (non-fatal — will pick up on next start)");
     }
 
-    // First-time (or credential-change) connect — force a sync so the board
-    // populates immediately rather than waiting for the next on-demand trigger.
-    // There's no stale cache to protect here, so gating buys nothing.
-    crate::commands::tasks::trigger_background_pm_force_sync(db_pool.get(), "token_connected");
-
     Ok(serde_json::json!({ "ok": true, "reloaded": reloaded }))
 }
 
@@ -1203,7 +1198,7 @@ pub async fn start_oauth(
     db_pool: State<'_, crate::db_pool::DbPool>,
 ) -> Result<StartOAuthResponse, String> {
     match body.provider.as_str() {
-        "jira" | "trello" => start_oauth_in_process(body.provider, db_pool.get()),
+        "jira" | "trello" => start_oauth_in_process(body.provider),
         "github" => start_oauth_github_device(body.provider, db_pool.inner().clone()).await,
         other => Err(format!("Unknown provider: {other}")),
     }
@@ -1256,10 +1251,7 @@ pub async fn cancel_oauth(body: CancelOAuthBody) -> Result<(), String> {
 /// functions — avoiding `std::env::set_var` on a Tokio worker thread (POSIX
 /// setenv is not thread-safe under concurrent env reads). A per-provider
 /// [`AtomicBool`] prevents two flows from racing to bind the same loopback port.
-fn start_oauth_in_process(
-    provider: String,
-    db: Option<meridian_core::SqlitePool>,
-) -> Result<StartOAuthResponse, String> {
+fn start_oauth_in_process(provider: String) -> Result<StartOAuthResponse, String> {
     // Resolve credentials from .env WITHOUT mutating process env.
     let mode = crate::install::detect_install_mode();
     let dot_env = mode.env_path().map(parse_env).unwrap_or_default();
@@ -1351,12 +1343,7 @@ fn start_oauth_in_process(
         // Always clear the in-flight flag before returning, regardless of outcome.
         in_flight.store(false, Ordering::SeqCst);
         match result {
-            Ok(()) => {
-                tracing::info!(provider = %task_provider, "in-process OAuth login succeeded");
-                // First-time connect — force a sync so the board populates
-                // immediately rather than waiting for the next on-demand trigger.
-                crate::commands::tasks::trigger_background_pm_force_sync(db, "oauth_connected");
-            }
+            Ok(()) => tracing::info!(provider = %task_provider, "in-process OAuth login succeeded"),
             Err(e) => {
                 let msg = format!("{e:#}");
                 tracing::warn!(provider = %task_provider, error = %msg, "in-process OAuth login failed");
@@ -1470,19 +1457,10 @@ async fn start_oauth_github_device(
                     return;
                 }
                 tracing::info!("GitHub device-flow login succeeded");
-                // Grab the DB handle BEFORE `db_pool` is moved into the reload below,
-                // so the sync request can still be written afterwards.
-                let sync_db = db_pool.get();
                 // Best-effort reload so the token takes effect now, not next restart.
                 if let Err(e) = crate::commands::daemon::reload_daemon_with(db_pool).await {
                     tracing::debug!(error = %e, "daemon reload after GitHub connect (non-fatal)");
                 }
-                // First-time connect — force a sync so the board populates
-                // immediately rather than waiting for the next on-demand trigger.
-                crate::commands::tasks::trigger_background_pm_force_sync(
-                    sync_db,
-                    "oauth_connected",
-                );
             }
             Err(e) => {
                 let msg = format!("{e:#}");
diff --git a/tray/src-tauri/src/commands/tasks.rs b/tray/src-tauri/src/commands/tasks.rs
index f626c7bae..882eb515e 100644
--- a/tray/src-tauri/src/commands/tasks.rs
+++ b/tray/src-tauri/src/commands/tasks.rs
@@ -1,72 +1,29 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Task-board action commands — the ported `/api/tasks/sync` POST, plus the
-//! on-demand sync triggers every other tray command fires into.
+//! Task-board action commands — the ported `/api/tasks/sync` POST.
 //!
-//! There is no background poller anymore: syncing `pm_tasks` from the connected
-//! tracker happens only at genuine on-demand moments — the manual "Sync now"
-//! button ([`sync_tasks`], force), connecting a tracker
-//! ([`trigger_background_pm_force_sync`], force, fire-and-forget), plan mount and
-//! the match-to-ticket picker ([`request_gated_sync_tasks`], gated, waits for
-//! result).
-//!
-//! # The tray does not sync, it ASKS
-//!
-//! Every function here writes a row to `pm_sync_requests` and the **daemon** does the
-//! work. The tray never holds a tracker credential, and it no longer spawns a
-//! `meridian` process to borrow one either.
-//!
-//! That is not tidiness, it is the fix for a production incident. An Atlassian OAuth
-//! refresh token is single-use and rotating: the old token dies the instant the new
-//! one is issued, so a lost response leaves the grant recoverable only inside a
-//! 10-minute window and permanently dead after it. The credential therefore has
-//! exactly one safe writer — and it used to have several (daemon, tray in-process,
-//! plus a fresh CLI process per trigger). The advisory file lock meant to serialise
-//! them could not: its 10 s timeout is shorter than the ~26 s a refresh can take, and
-//! on timeout the code proceeded WITHOUT the lock. Only Atlassian's grace window kept
-//! that from corrupting state.
-//!
-//! Requesting instead of doing also removed a per-trigger process spawn: opening the
-//! dashboard used to start a whole `meridian pm-sync` process — process init, DB
-//! open, config load — which then usually discovered the staleness gate and did
-//! nothing. It is now one coalescing UPSERT.
-//!
-//! (The per-task *read*, `get_tasks`, stays in [`crate::commands::dashboard`], and
-//! deliberately never triggers a sync itself — it's polled every 30-60s while a panel
-//! is mounted, and wiring a sync to that would silently rebuild the background-timer
-//! problem this replaces.)
+//! Re-syncs the PM board: spawns `meridian tasks-sync`, which pulls the latest
+//! tickets from the connected tracker into `pm_tasks`. Tracker auth lives in the
+//! daemon, so — like every tracker write — this shells out to the CLI rather than
+//! talking to the provider directly; it's a process spawn, so it lives tray-side,
+//! not in meridian-core. (The per-task *read*, `get_tasks`, stays in
+//! [`crate::commands::dashboard`].)
 //!
 //! # Who calls this
-//! [`sync_tasks`] and [`request_gated_sync_tasks`] are registered in `lib.rs`'s
-//! `invoke_handler!`. `sync_tasks` (force) backs every "Sync now" — the Tasks panel,
-//! the planner's Refresh chip, and the per-provider button in Settings — via
-//! `ui/lib/taskSync.ts::syncTasks`. `request_gated_sync_tasks` backs
-//! `taskSync.ts::requestGatedTaskSync`, called by `PlanView` on mount and
-//! `WorklogTicketPicker` on open.
-//!
-//! [`trigger_background_pm_force_sync`] is a plain Rust fn (not a Tauri command),
-//! called from `commands::integrations`'s connect-success paths.
-//!
-//! Nothing calls a gated sync from a window opener any more: `open_dashboard` and
-//! `tray::open_native_dashboard` used to, and no longer do.
+//! Registered in `lib.rs`'s `invoke_handler!`; consumed by `TasksView.tsx`'s Sync
+//! button via `ui/lib/bridge.ts::mutate` (success → re-fetch; error → inline msg).
 //!
 //! # Related
-//! - [`meridian_core::pm_sync_requests`] — the request/claim/complete API.
-//! - `src/intelligence/sync_requests.rs` — the daemon-side consumer.
-//! - `src/intelligence/sync_delegate.rs` — the producer side for the `meridian` CLI
-//!   subcommands the tray spawns (`tasks-sync`, `pm-sync`, `plan-task-*`,
-//!   `ticket-update`, `ticket-set-status`, `worklog-generate`), which delegate to the
-//!   same outbox when a daemon is running, for the same reason.
+//! - [`crate::install::meridian_bin`] — the shared native-first binary resolver.
+//! - [`crate::commands::parents`] — the other read-side `meridian` CLI shell-out.
 
-use meridian_core::pm_sync_requests::{self, SyncMode, ALL_PROVIDERS};
-use meridian_core::SqlitePool;
+use meridian_core::proc_ext::NoWindow;
 use serde::Serialize;
 use std::time::Duration;
 
-/// How long [`ask_daemon_to_sync`] waits for the daemon to report an outcome, and the
-/// budget for the no-daemon CLI fallback. Named so the log field, the user-facing
-/// message and the timer can never disagree — they were three independent literals,
-/// and a `30` that drifts in one place turns a support report into a wrong-duration
-/// red herring.
+/// How long `meridian tasks-sync` gets before the command gives up and reports
+/// a timeout. Named so the log field, the user-facing message and the timer can
+/// never disagree — they were three independent literals, and a `30` that drifts
+/// in one place turns a support report into a wrong-duration red herring.
 const SYNC_TIMEOUT: Duration = Duration::from_secs(30);
 
 /// Success payload — mirrors the route's `{ ok, detail }` (the CLI's stdout).
@@ -76,289 +33,83 @@ pub struct SyncResult {
     pub detail: String,
 }
 
-/// How often [`ask_daemon_to_sync`] re-reads the request row while waiting. The
-/// daemon's watcher ticks every 2 s, so this is matched to that rather than being
-/// tighter — a faster poll would just burn reads without seeing a result any sooner.
-const OUTCOME_POLL_INTERVAL: Duration = Duration::from_millis(500);
-
-/// Turn a failed request-write into something a user can act on.
-///
-/// # Why the missing-table case is special-cased
-///
-/// `pm_sync_requests` arrives in migration 082, and **only the daemon runs migrations**
-/// (the tray opens the file with `create_if_missing(false)` and assumes the daemon made
-/// it). So during an app update there is a window — new tray already running, daemon not
-/// yet restarted onto the new binary — where the table genuinely does not exist yet.
-///
-/// It is seconds long and self-heals the moment the daemon restarts, but a user who
-/// presses "Sync now" inside it would otherwise be shown a raw SQL string:
-/// `could not queue the sync: no such table: pm_sync_requests`. That reads like
-/// database damage for what is in fact a normal, transient update state, and it is the
-/// kind of message that produces a support ticket about a non-problem.
-///
-/// Matched on the message rather than a typed error because sqlx surfaces this as a
-/// `Database` error whose only distinguishing feature IS its text; the match is
-/// deliberately loose (table name plus "no such table") so a reworded sqlite message
-/// degrades to the generic branch rather than mis-reporting something else.
-fn queue_failure_message(e: &anyhow::Error) -> String {
-    let detail = format!("{e:#}");
-    if detail.contains("no such table") && detail.contains("pm_sync_requests") {
-        tracing::warn!("pm_sync_requests missing - the daemon has not applied migration 082 yet");
-        return "Meridian is still finishing an update - try again in a moment".to_string();
-    }
-    tracing::warn!(error = %detail, "could not queue a PM sync request");
-    format!("could not queue the sync: {detail}")
-}
-
-/// Resolve the tray's DB handle, or an error string suitable for returning straight
-/// to the frontend. `None` means the pool is closed (a repair or a corrupt DB), which
-/// is a real condition rather than a bug — say so plainly instead of unwrapping.
-fn require_pool(
-    pool: &tauri::State<'_, crate::db_pool::DbPool>,
-) -> Result<meridian_core::SqlitePool, String> {
-    pool.get()
-        .ok_or_else(|| "the database is not open - Meridian may be repairing it".to_string())
-}
-
-/// Re-sync the board from the tracker (the ported /api/tasks/sync POST) — always
-/// forces a fetch, bypassing the per-provider staleness gate, because the user
-/// explicitly asked for fresh data right now.
-///
-/// Asks the daemon rather than syncing here. The tray must never hold the tracker
-/// credential: the Jira refresh token is single-use and rotating, so two processes
-/// spending it can permanently kill the grant, and the daemon is the designated sole
-/// owner (see [`meridian_core::pm_sync_requests`]). This writes a `force` request,
-/// then polls the row for the outcome so the button can still report a real result.
-#[tauri::command]
-#[tracing::instrument(skip(pool))]
-pub async fn sync_tasks(
-    pool: tauri::State<'_, crate::db_pool::DbPool>,
-) -> Result<SyncResult, String> {
-    let db = require_pool(&pool)?;
-    match ask_daemon_to_sync(&db, SyncMode::Force, "sync_now", "tasks-sync").await? {
-        Some(result) => Ok(result),
-        // The user pressed a button and is watching a spinner, so a timeout has to
-        // SAY something — but not "failed": the request is queued and the daemon will
-        // service it. This is the one caller that reports the wait as an error.
-        None => Err(format!(
-            "the sync is still running after {}s - it will finish in the background",
-            SYNC_TIMEOUT.as_secs()
-        )),
-    }
-}
-
-/// Frontend-facing: request a **gated** sync and wait for the outcome.
-///
-/// # Only two screens should call this
-///
-/// The board is rendered in many places, but only two of them make a *decision from
-/// the whole task list*, and a stale board there is not a cosmetic lag:
-///
-/// - **The daily plan**, where the user picks the day's tickets. A ticket assigned an
-///   hour ago is simply ABSENT from the list they can pick from, so it cannot enter
-///   the plan at all. (`PlanView`, on mount.)
-/// - **The retarget / match-to-existing-ticket picker**, which lists every open
-///   ticket by definition. (`WorklogTicketPicker`, on open.)
-///
-/// Everything else showing the board is display and self-corrects on the next real
-/// trigger. In particular **worklog drafting does NOT need this**: matching reads the
-/// day's *plan* as its candidate pool, not the board (see
-/// `src/pm_worklog/generate.rs::fetch_plan_candidates` — "Not the board"), so a
-/// fresher board cannot widen the candidate set by even one ticket.
-///
-/// # Gated, and never on a poll
-///
-/// `Gated` rather than `Force` because these fire on mount/open, which recurs: the
-/// daemon applies the per-provider staleness window, so a re-open inside it costs one
-/// coalescing UPSERT instead of a tracker call. `sync_tasks` is the forced variant and
-/// belongs to buttons the user pressed.
-///
-/// **Never wire this to a polled read.** `PlanView` re-loads every 30 s and
-/// `TasksPanel` every 60 s; attaching a sync to those would rebuild the
-/// background-timer problem this whole design removed, relocated into the read path.
-/// Mount and click are one-shot; a poll is not.
+/// Re-sync the board from the tracker (the ported /api/tasks/sync POST). Spawns
+/// `meridian tasks-sync` with a `SYNC_TIMEOUT` budget; returns its trimmed stdout as
+/// `detail` on success, or an `Err` carrying stderr (the route's 500 body.error)
+/// on timeout / spawn failure / non-zero exit.
 #[tauri::command]
-#[tracing::instrument(skip(pool))]
-pub async fn request_gated_sync_tasks(
-    pool: tauri::State<'_, crate::db_pool::DbPool>,
-) -> Result<SyncResult, String> {
-    let db = require_pool(&pool)?;
-    // A timeout here is NOT an error, unlike [`sync_tasks`]. Nothing is watching a
-    // spinner: the screen already rendered from cache and only wanted fresher rows.
-    // Returning `Err` would make the frontend log a failure for a sync that is simply
-    // still going, which is noise in the telemetry spool rather than information.
-    Ok(
-        ask_daemon_to_sync(&db, SyncMode::Gated, "plan_or_picker", "pm-sync")
-            .await?
-            .unwrap_or(SyncResult {
-                ok: false,
-                detail: "still running in the background".to_string(),
-            }),
-    )
-}
-
-/// Ask the daemon to sync and wait up to [`SYNC_TIMEOUT`] for its outcome.
-///
-/// `Ok(Some(_))` the daemon reported a result; `Ok(None)` the budget elapsed with the
-/// request still queued (not a failure - the daemon will service it); `Err` the sync
-/// itself failed, or the outbox could not be read.
-///
-/// Shared by [`sync_tasks`] and [`request_gated_sync_tasks`], which differ only in
-/// their mode, their tag, their no-daemon fallback subcommand, and what they make of a
-/// timeout. Those four params are the entire difference; everything else - the daemon
-/// probe, the fallback, the request write, the poll loop - was duplicated line for line
-/// between them, which is how the two drifted into having different log messages and
-/// only one of them being `#[instrument]`ed.
-///
-/// `fallback_cli` is the `meridian` subcommand that performs this same sync in its own
-/// process. It is used only when no daemon owns the data dir, where there is no second
-/// writer to race for the rotating credential - the tray still never holds a token
-/// itself. Without it, a queued row would sit unserviced and the user would watch a
-/// spinner time out with the daemon stopped.
-#[tracing::instrument(skip(db), fields(mode = mode.as_str()))]
-async fn ask_daemon_to_sync(
-    db: &SqlitePool,
-    mode: SyncMode,
-    reason: &'static str,
-    fallback_cli: &'static str,
-) -> Result<Option<SyncResult>, String> {
-    if !crate::commands::daemon_control::status().await.running {
-        tracing::debug!(
-            fallback_cli,
-            "no daemon - delegating to the CLI's own fallback"
-        );
-        let out =
-            crate::commands::cli_exec::run_meridian(&[fallback_cli], SYNC_TIMEOUT, fallback_cli)
-                .await?;
-        return Ok(Some(SyncResult {
-            ok: true,
-            detail: out.trim().to_string(),
-        }));
-    }
-
-    if let Err(e) = pm_sync_requests::request(db, ALL_PROVIDERS, mode, reason).await {
-        return Err(queue_failure_message(&e));
-    }
-
-    let deadline = tokio::time::Instant::now() + SYNC_TIMEOUT;
-    loop {
-        if tokio::time::Instant::now() >= deadline {
+#[tracing::instrument]
+pub async fn sync_tasks() -> Result<SyncResult, String> {
+    let bin = crate::install::meridian_bin();
+    // The cwd picks the credentials, because dotenvy walks up from it: a release
+    // build lands on the canonical ~/.meridian/.env (AZURE_DEVOPS_PAT, JIRA_URL, …),
+    // a dev build on the checkout's own. Never inherit the tray's cwd — under a
+    // packaged .app that is inside the bundle, and dotenvy finds no .env at all.
+    let cwd = crate::install::cli_cwd()?;
+    // WHICH binary ran, and from where, are the two facts that make a failure here
+    // legible: a stale installed CLI against a DB the dev daemon migrated ahead
+    // exits non-zero with nothing but `status=Some(1)` in the log otherwise.
+    tracing::debug!(bin = %bin, cwd = %cwd.display(), "tasks-sync: spawning");
+    let child = tokio::process::Command::new(&bin)
+        .arg("tasks-sync")
+        .current_dir(&cwd)
+        .stdin(std::process::Stdio::null())
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        // On timeout below, `tokio::time::timeout` drops the output future; without
+        // this the orphaned `meridian tasks-sync` keeps running (and can still mutate
+        // the board) after the UI reports a failure. The deleted /api/tasks/sync route
+        // called child.kill() on its 30s timer — kill_on_drop preserves that contract.
+        .kill_on_drop(true)
+        .no_window()
+        .output();
+
+    let output = match tokio::time::timeout(SYNC_TIMEOUT, child).await {
+        Err(_) => {
+            // `kill_on_drop` reaps the child here, taking its stderr with it, so
+            // this log is the ONLY record a timeout ever leaves. Emitting a bare
+            // "tasks-sync timed out" (as it did) makes the two cases that matter
+            // indistinguishable in a support bundle: a genuinely slow tracker
+            // sync vs. a `meridian` binary that never got past opening a corrupt
+            // meridian.db. WHICH binary and WHICH cwd is what separates them —
+            // the same two facts the spawn/non-zero arms below already log.
             tracing::warn!(
-                timeout_s = SYNC_TIMEOUT.as_secs() as i64,
-                "daemon did not report a sync outcome in time"
+                bin = %bin,
+                cwd = %cwd.display(),
+                timeout_s = SYNC_TIMEOUT.as_secs(),
+                "tasks-sync timed out"
             );
-            return Ok(None);
+            return Err(format!(
+                "tasks-sync timed out after {}s",
+                SYNC_TIMEOUT.as_secs()
+            ));
         }
-        tokio::time::sleep(OUTCOME_POLL_INTERVAL).await;
-
-        match pm_sync_requests::outcome(db, ALL_PROVIDERS).await {
-            Ok(Some(out)) => {
-                if let Some(err) = out.error {
-                    tracing::warn!(error = %err, "daemon reported a sync failure");
-                    return Err(err);
-                }
-                let detail = match out.synced_count {
-                    Some(n) => format!("synced {n} task(s)"),
-                    None => "synced".to_string(),
-                };
-                tracing::debug!(detail = %detail, "sync ok");
-                return Ok(Some(SyncResult { ok: true, detail }));
-            }
-            Ok(None) => continue,
-            Err(e) => return Err(format!("could not read the sync outcome: {e}")),
+        Ok(Err(e)) => {
+            tracing::warn!(bin = %bin, error = %e, "tasks-sync spawn failed");
+            return Err(format!("spawn error: {e}"));
         }
-    }
-}
-
-/// Fire-and-forget: ask the daemon to **force** a fetch (bypassing the staleness
-/// gate) — for a moment where there is no stale cache to protect, e.g. a tracker was
-/// just connected and the board should populate immediately rather than wait for the
-/// next on-demand trigger.
-///
-/// There is deliberately no `trigger_background_pm_sync` (gated) sibling any more. It
-/// existed for the dashboard window openers, and those were removed: a window opening
-/// is not evidence anyone is about to make a decision from the whole board. The two
-/// screens that genuinely are — the daily plan and the retarget ticket picker — ask
-/// for themselves through [`request_gated_sync_tasks`]. See that command's doc.
-pub(crate) fn trigger_background_pm_force_sync(db: Option<SqlitePool>, reason: &'static str) {
-    request_sync(db, SyncMode::Force, reason);
-}
-
-/// Write a sync request, fire-and-forget.
-///
-/// Unlike [`sync_tasks`] this does NOT fall back to the CLI when no daemon is running.
-/// These fire from window-open and connect-success paths where nothing is waiting on a
-/// result, so a queued row that the next daemon start services is the right outcome -
-/// spawning a process per window open is exactly the cost this replaced.
-///
-/// Takes `Option<SqlitePool>` (i.e. `DbPool::get()`) rather than a pool or an
-/// `AppHandle`, because `None` is a real state and not an error: the pool is closed
-/// while a corrupt DB is being repaired. Callers pass what they already hold, which
-/// is a `DbPool` in the integration paths and app state in the window paths.
-///
-/// Best-effort by design: these fire from window-open and connect-success paths
-/// where a failure must never block the thing the user asked for, and the next
-/// trigger (or their explicit "Sync now") retries anyway.
-fn request_sync(db: Option<SqlitePool>, mode: SyncMode, reason: &'static str) {
-    let Some(db) = db else {
-        tracing::debug!(reason, "pm sync request skipped - database not open");
-        return;
+        Ok(Ok(o)) => o,
     };
-    tauri::async_runtime::spawn(async move {
-        match pm_sync_requests::request(&db, ALL_PROVIDERS, mode, reason).await {
-            Ok(()) => tracing::debug!(reason, mode = mode.as_str(), "pm sync requested"),
-            Err(e) => tracing::debug!(reason, error = %e, "pm sync request failed"),
-        }
-    });
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The update window: `pm_sync_requests` does not exist yet because the daemon
-    /// has not applied migration 082. The user must see a transient-update message,
-    /// never a raw SQL string that reads like database damage.
-    #[test]
-    fn a_missing_requests_table_reads_as_a_pending_update() {
-        let e = anyhow::anyhow!(
-            "error returned from database: (code: 1) no such table: pm_sync_requests"
-        );
-
-        let msg = queue_failure_message(&e);
 
-        assert_eq!(
-            msg,
-            "Meridian is still finishing an update - try again in a moment"
+    if output.status.success() {
+        let detail = String::from_utf8_lossy(&output.stdout).trim().to_string();
+        tracing::info!("tasks-sync ok");
+        Ok(SyncResult { ok: true, detail })
+    } else {
+        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+        // Log the CLI's own reason, not just the exit code. `status=Some(1)` alone
+        // says nothing — the failure is always explained in stderr, and dropping it
+        // turned a one-line diagnosis into a manual re-run of the subcommand.
+        tracing::warn!(
+            status = ?output.status.code(),
+            bin = %bin,
+            stderr = %stderr,
+            "tasks-sync non-zero"
         );
-        assert!(!msg.contains("no such table"), "must not leak SQL: {msg}");
-    }
-
-    /// Any OTHER write failure keeps its detail. Collapsing every error into the
-    /// friendly update message would hide a real fault (a locked or corrupt DB) behind
-    /// "try again in a moment", which never resolves.
-    #[test]
-    fn other_failures_keep_their_detail() {
-        let e = anyhow::anyhow!("database is locked");
-
-        let msg = queue_failure_message(&e);
-
-        assert!(
-            msg.contains("database is locked"),
-            "detail was dropped: {msg}"
-        );
-    }
-
-    /// A missing table that is NOT ours is somebody else's problem and must not be
-    /// reported as a pending update - that would send the user to wait out an update
-    /// that is already finished while the real fault goes unnamed.
-    #[test]
-    fn a_different_missing_table_is_not_reported_as_an_update() {
-        let e = anyhow::anyhow!("no such table: pm_tasks");
-
-        let msg = queue_failure_message(&e);
-
-        assert!(msg.contains("pm_tasks"), "detail was dropped: {msg}");
-        assert!(!msg.contains("finishing an update"), "misattributed: {msg}");
+        Err(if stderr.is_empty() {
+            "tasks-sync failed".to_string()
+        } else {
+            stderr
+        })
     }
 }
diff --git a/tray/src-tauri/src/lib.rs b/tray/src-tauri/src/lib.rs
index 670b2e325..830fdc9a2 100644
--- a/tray/src-tauri/src/lib.rs
+++ b/tray/src-tauri/src/lib.rs
@@ -1372,7 +1372,6 @@ pub fn run() {
             // process / service control (ported /api process routes)
             commands::reload_daemon,
             commands::sync_tasks,
-            commands::request_gated_sync_tasks,
             commands::run_update,
             // tracker connect/disconnect (ported /api/integrations + /api/auth/oauth)
             commands::disconnect_integration,
diff --git a/ui/components/plan/PlanView.tsx b/ui/components/plan/PlanView.tsx
index 56645f625..3c2bb9fb6 100644
--- a/ui/components/plan/PlanView.tsx
+++ b/ui/components/plan/PlanView.tsx
@@ -25,7 +25,7 @@ import { dayString } from '@/components/timeline/types'
 import type { PlanResponse, IntegrationsResponse } from '@/lib/api-types'
 import { MAX_PLAN_TASKS } from '@/lib/api-types'
 import { load as bridgeLoad } from '@/lib/bridge'
-import { lastSyncFailure, requestGatedTaskSync, syncTasks } from '@/lib/taskSync'
+import { lastSyncFailure, syncTasks } from '@/lib/taskSync'
 import { availableTrackerNames, connectedTrackers } from '@/lib/integrations'
 import { usePlan, refreshPlan, planAction, pausePlanRefresh } from '@/components/plan/planStore'
 import { isTutorialRunning } from '@/components/tutorial/engine'
@@ -219,35 +219,14 @@ export default function PlanView() {
   useEffect(() => {
     if (autoSyncedRef.current || !trackersLoaded || !data) return
     autoSyncedRef.current = true
-    // Nothing to pull: the wait is over before it started.
-    if (trackers.length === 0) { setFirstSyncDone(true); return }
-    // A POPULATED board still needs a refresh, just not a blocking one.
-    //
-    // This branch used to return immediately, on the reasoning that there was
-    // "something already there to show". True for the empty-board spinner this
-    // backstop exists for, but it left the planner as the one screen that picks
-    // from the whole task list while never asking for a current copy of it - so a
-    // ticket assigned an hour ago was absent from the list, and the only way to
-    // see it was noticing the Refresh chip. Absent, not stale: it cannot be put in
-    // today's plan at all.
-    //
-    // GATED, unlike the empty branch's forced `handleSync`: this fires on every
-    // planner open, so the per-provider staleness window is what keeps it from
-    // becoming a tracker call each time. Not awaited before `setFirstSyncDone` -
-    // the cached board renders now and the 30 s poll picks the fresher rows up.
-    if ((data.available?.length ?? 0) > 0) {
-      void requestGatedTaskSync().then((ok) => { if (ok) void load(false) })
-      setFirstSyncDone(true)
-      return
-    }
+    // Nothing to pull, or something already there to show: the wait is over
+    // before it started.
+    if (trackers.length === 0 || (data.available?.length ?? 0) > 0) { setFirstSyncDone(true); return }
     // Usually this JOINS the sync the connect flow already started - see `handleSync`.
     // It stays as a backstop because plenty of empty-board arrivals never went near a
     // connect: a reopened app, a board that emptied, a sync that failed an hour ago.
     handleSync().finally(() => setFirstSyncDone(true))
-    // `load` is in the deps because the populated branch above calls it directly.
-    // Re-running is harmless either way: `autoSyncedRef` makes the whole effect
-    // one-shot per mount.
-  }, [data, trackers, trackersLoaded, handleSync, load])
+  }, [data, trackers, trackersLoaded, handleSync])
 
   // The drag hold-off is module-global, so a planner closed mid-drag (onDragEnd
   // never fires) would strand every reader's refresh paused for the rest of the
diff --git a/ui/components/timeline/WorklogTicketPicker.tsx b/ui/components/timeline/WorklogTicketPicker.tsx
index 94d122d6c..394963338 100644
--- a/ui/components/timeline/WorklogTicketPicker.tsx
+++ b/ui/components/timeline/WorklogTicketPicker.tsx
@@ -23,7 +23,6 @@
 
 import { useEffect, useMemo, useState } from 'react'
 import { load } from '@/lib/bridge'
-import { requestGatedTaskSync } from '@/lib/taskSync'
 import type { BoardTicket } from '@/lib/api-types'
 
 /** Rank the board against a query: key first (people type "KAN-3"), then title,
@@ -65,22 +64,9 @@ export function WorklogTicketPicker({ current, busy, onPick, onCancel, title, ex
   useEffect(() => {
     if (tickets) return
     let alive = true
-    const read = () => load<BoardTicket[]>('/api/board-tickets', 'get_board_tickets')
+    load<BoardTicket[]>('/api/board-tickets', 'get_board_tickets')
       .then(r => { if (alive) setFetched(excludeLocal ? r.filter(t => t.provider !== 'local') : r) })
       .catch(() => { if (alive) setError('Could not load your board - try again in a moment.') })
-
-    // Show the cached board immediately, then ask for a refresh and re-read.
-    //
-    // This picker is the ONE surface whose entire purpose is choosing from the whole
-    // board, so a ticket missing from it is not a cosmetic lag - the user cannot
-    // retarget onto a ticket that is not listed, and nothing on screen suggests the
-    // list is incomplete. It had no refresh of its own and relied on whatever some
-    // other screen had happened to fetch.
-    //
-    // Ordered read-then-refresh-then-read on purpose: opening a picker must never
-    // wait on a network round trip. GATED, so opening it repeatedly stays inside the
-    // per-provider staleness window rather than hitting the tracker each time.
-    void read().then(() => requestGatedTaskSync()).then(ok => { if (ok && alive) void read() })
     return () => { alive = false }
   }, [excludeLocal, tickets])
 
diff --git a/ui/components/timeline/settings/IntegrationsSection.tsx b/ui/components/timeline/settings/IntegrationsSection.tsx
index 11e2ac66e..76fe3acb5 100644
--- a/ui/components/timeline/settings/IntegrationsSection.tsx
+++ b/ui/components/timeline/settings/IntegrationsSection.tsx
@@ -64,7 +64,7 @@ export function IntegrationsSection({ integrations, onChanged, gate = false, onD
               Connected to {connected.map(t => t.name).join(', ')}
             </p>
             <p className="text-[11.5px] font-semibold mt-0.5" style={{ color: 'color-mix(in srgb, var(--color-state-approved) 75%, var(--t-muted))' }}>
-              Kept in sync automatically
+              Syncing every hour
             </p>
           </div>
         </div>
diff --git a/ui/lib/taskSync.ts b/ui/lib/taskSync.ts
index 1e593fb1a..86fd88dc9 100644
--- a/ui/lib/taskSync.ts
+++ b/ui/lib/taskSync.ts
@@ -137,59 +137,3 @@ export function syncTasks(): Promise<boolean> {
 export function pendingTaskSync(): Promise<boolean> | null {
   return inFlight
 }
-
-/**
- * Refresh the board for a screen that is about to make a decision from the WHOLE
- * task list, and would behave differently against a stale one.
- *
- * # Only two screens should call this
- *
- * - **The daily plan**, where the user picks the day's tickets. A stale board here
- *   is not a cosmetic lag: a ticket assigned an hour ago is simply absent from the
- *   list they can pick from, so it cannot enter the plan at all. That is the
- *   candidate-starvation failure, and it is why this exists.
- * - **The retarget / match-to-existing-ticket picker**, which lists every open
- *   ticket by definition.
- *
- * Worklog drafting deliberately does NOT call this: matching reads the day's *plan*
- * as its candidate pool, not the board (`fetch_plan_candidates` - "Not the board"),
- * so a fresher board cannot widen the candidate set by even one ticket.
- *
- * # Gated, unlike `syncTasks`
- *
- * `syncTasks` FORCES a fetch, which is right for a button the user pressed and wrong
- * for a mount: a screen the user opens repeatedly would hit the tracker every time.
- * This goes through `request_gated_sync_tasks`, so the daemon applies the
- * per-provider staleness window and a re-open inside it costs one local UPSERT.
- *
- * **Never call this from a poll.** `PlanView` re-loads every 30 s and `TasksPanel`
- * every 60 s; wiring it there would rebuild the background-timer problem this whole
- * design removed, relocated into the read path. Mount and click are one-shot.
- *
- * NEVER REJECTS, for the same reason as `syncTasks`: resolves `true` on a completed
- * sync and `false` on a failure. Callers that only want fresher rows can ignore the
- * value; nothing on these screens should break because a refresh failed, since the
- * cached board still renders.
- *
- * Deliberately NOT joined to `inFlight`: that promise tracks the *forced* sync, and
- * a gated request is a different ask. It is cheap enough (one UPSERT when the window
- * is closed) that sharing state would cost more in surprise than in requests.
- */
-export function requestGatedTaskSync(): Promise<boolean> {
-  return mutate<{ ok: boolean }>('/api/tasks/sync', 'request_gated_sync_tasks', {})
-    // `ok: false` means the daemon had not reported back inside its budget - the sync
-    // is still running, so there is nothing fresher to re-read YET. Reported as
-    // `false` so callers skip a pointless re-read; it is not a failure and nothing is
-    // logged for it (unlike the `.catch` below).
-    .then((r) => r?.ok !== false)
-    .catch((e) => {
-      // Reported, not surfaced: unlike the Refresh chip there is no UI element
-      // waiting to explain this, and the screen renders fine from cache. It still
-      // has to reach the telemetry spool, or a board that is quietly never
-      // refreshing looks identical to one that is up to date.
-      const reason = syncFailureReason(e)
-      console.error('[meridian] gated tracker sync failed', e)
-      reportUiError(`gated tracker sync failed: ${reason}`)
-      return false
-    })
-}

From 99799af6559f5ba6ade2b03ec5ee686225514faa Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Thu, 27 Aug 2026 00:12:03 +0530
Subject: [PATCH 20/53] revert: keep migrations 082 and 083 after backing out
 the outbox

The two reverts deleted these files along with the code that used them.
They must stay.

Both have already run on the staging testers' databases. `sqlx::migrate!`
validates the applied set against the resolved files on every open, so a
migration recorded as applied with no matching file makes the daemon fail
to open the database at all - a hard boot failure for anyone who ran
v1.91.0-staging.2 or .3. Deleting them would also break the repo's
append-only migration rule.

The `pm_sync_requests` table and its seq/completed_seq columns are simply
unused now. An orphaned table costs nothing; a daemon that cannot open its
own database costs everything.
---
 src/migrations/082_pm_sync_requests.sql    | 68 ++++++++++++++++++++++
 src/migrations/083_pm_sync_request_seq.sql | 35 +++++++++++
 2 files changed, 103 insertions(+)
 create mode 100644 src/migrations/082_pm_sync_requests.sql
 create mode 100644 src/migrations/083_pm_sync_request_seq.sql

diff --git a/src/migrations/082_pm_sync_requests.sql b/src/migrations/082_pm_sync_requests.sql
new file mode 100644
index 000000000..9a49eaaeb
--- /dev/null
+++ b/src/migrations/082_pm_sync_requests.sql
@@ -0,0 +1,68 @@
+-- ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+--
+-- Single-owner PM sync: the request side of the outbox.
+--
+-- WHY THIS EXISTS
+-- An Atlassian OAuth refresh token is single-use and rotating: the old token dies
+-- the instant the new one is issued, so a lost response leaves the grant
+-- recoverable only inside a 10-minute window and unrecoverable after it. That
+-- makes the token a resource with exactly one safe writer.
+--
+-- It had several. The tray refreshed in-process, the daemon refreshed on its poll
+-- loop, and the tray spawned `meridian pm-sync` / `tasks-sync` as fresh processes
+-- that each refreshed too. Mutual exclusion was left to an advisory file lock that
+-- could not actually deliver it: its 10 s timeout is shorter than the ~26 s a
+-- refresh can take (3 attempts x 8 s + backoff), and on failure the code proceeded
+-- WITHOUT the lock rather than backing off. Two processes could therefore spend the
+-- same token, and the only thing preventing corruption was Atlassian's grace window
+-- handing the loser the current pair. Correctness by vendor accident.
+--
+-- So sync becomes a REQUEST rather than an action. Producers (tray window opens,
+-- tracker connect, "Sync now", the CLI) write a row here; the daemon is the sole
+-- consumer and the sole holder of the credential.
+--
+-- COALESCING, NOT A QUEUE
+-- `provider` is the PRIMARY KEY so repeated requests collapse into one pending row
+-- (`ON CONFLICT DO UPDATE`). Opening the dashboard ten times must not queue ten
+-- syncs - it must mean "a sync is wanted", once. `'*'` is the all-providers request
+-- that every current producer writes; per-provider rows are reserved for a future
+-- caller that needs to refresh just one board.
+--
+-- `mode` escalates and never de-escalates while a row is pending: a 'force' request
+-- landing on a pending 'gated' one upgrades it, because a user who just connected a
+-- tracker or pressed "Sync now" must not have their explicit request downgraded by a
+-- passing window focus. The reverse is silently ignored by the producer's UPSERT.
+--
+-- COMPLETION IS REPORTED IN PLACE, NOT DELETED
+-- The daemon stamps `completed_at` plus `error` / `synced_count` rather than removing
+-- the row, so "Sync now" can show a real outcome without the tray needing to hold the
+-- credential or shell out. A serviced row is retained until the next request replaces
+-- it, which also gives `meridian health` a cheap, content-free view of the last sync
+-- attempt.
+
+CREATE TABLE IF NOT EXISTS pm_sync_requests (
+    -- '*' = all configured providers. A specific provider name scopes the request.
+    provider      TEXT    NOT NULL PRIMARY KEY,
+    -- 'gated'  - honour the per-provider staleness window (the cheap common case).
+    -- 'force'  - bypass it; the user explicitly asked (connect, "Sync now", CLI).
+    mode          TEXT    NOT NULL DEFAULT 'gated',
+    -- Free-text producer tag for tracing only (e.g. 'dashboard_open', 'token_connected').
+    -- Never a user-content value: this is read back into logs.
+    reason        TEXT    NOT NULL DEFAULT '',
+    requested_at  TEXT    NOT NULL,
+    -- Set when the daemon starts servicing, so a request in flight is distinguishable
+    -- from one still waiting. Cleared on the next request.
+    claimed_at    TEXT,
+    -- Set when the daemon finishes, success or failure. NULL while pending/in-flight.
+    completed_at  TEXT,
+    -- NULL on success. The failure detail otherwise, for the tray to surface.
+    error         TEXT,
+    -- Tasks refreshed on the last completed pass, for "Sync now" feedback.
+    synced_count  INTEGER
+);
+
+-- No secondary index on purpose. Every hot query (`claim`, `complete`, `outcome`,
+-- `request`) filters on `provider`, which is the PRIMARY KEY, so an index on
+-- (completed_at, claimed_at) would never be chosen. The only query that does not
+-- name a provider is `reset_stale_claims`, which runs once per daemon boot over a
+-- table holding one row per provider - a scan there is free.
diff --git a/src/migrations/083_pm_sync_request_seq.sql b/src/migrations/083_pm_sync_request_seq.sql
new file mode 100644
index 000000000..5c3cc7e76
--- /dev/null
+++ b/src/migrations/083_pm_sync_request_seq.sql
@@ -0,0 +1,35 @@
+-- ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+
+-- Give each PM sync request a monotonic sequence number, so a producer can tell
+-- WHICH request an outcome belongs to.
+--
+-- Migration 082 modelled the outbox as one row per provider whose completion was
+-- signalled by `completed_at` going non-NULL, and `request()` cleared it so the row
+-- "unambiguously represents work still to do". With one waiter that is fine. With
+-- two it loses answers, and the tracker-connect flow always produces at least two:
+-- `oauth_connected`, `token_connected` and the user's own "Sync now" all fire inside
+-- a few seconds.
+--
+-- Measured on 1.91.0-staging.2: request A is claimed and a real Jira sync starts;
+-- request B lands mid-flight and nulls `claimed_at`/`completed_at`; the daemon
+-- finishes and calls `complete()`, whose guard was `claimed_at IS NOT NULL` - now
+-- NULL - so the outcome was DISCARDED and the sync re-run from scratch. Every waiter
+-- then polled for its full 30 s budget and reported failure for a sync that had
+-- actually succeeded, repeatedly.
+--
+-- With a sequence, "done" is a watermark rather than a flag: a producer holding seq
+-- N is satisfied by any `completed_seq >= N`, so overlapping requests coalesce
+-- instead of cannibalising each other, and no completion can be misattributed to a
+-- request that was never serviced.
+--
+-- `seq` starts at 1 and `completed_seq` is NULL-means-nothing-completed, so
+-- "pending" is `seq > COALESCE(completed_seq, 0)` everywhere.
+ALTER TABLE pm_sync_requests ADD COLUMN seq INTEGER NOT NULL DEFAULT 1;
+ALTER TABLE pm_sync_requests ADD COLUMN completed_seq INTEGER;
+
+-- Carry the existing row's state across rather than resetting it. A row already
+-- completed under 082 must NOT read as pending after this migration (that would fire
+-- a spurious provider sync on the first daemon start after an update, for every
+-- installed user at once); a row mid-flight must stay pending so it is still
+-- serviced.
+UPDATE pm_sync_requests SET completed_seq = seq WHERE completed_at IS NOT NULL;

From 0e4c505162c6ae406c438372954c492d63a45626 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Thu, 27 Aug 2026 00:49:52 +0530
Subject: [PATCH 21/53] fix(release): a revert must be able to cut a release

Reverting #909 and #910 off pre-main produced three commits and a dry run
that reported "Analysis of 4 commits complete: no release". The revert was
merged and unshippable - the staging testers stayed on the exact build we
had just backed out, with no way to reach them.

Two reasons, both structural rather than a mistake in those commits:

- `git revert` writes `Revert "Merge pull request #910 from ..."`, which is
  not a conventional-commit header at all, so it carries no type.
- The `conventionalcommits` preset has no default release rule for the
  `revert` type, so even a well-formed `revert:` commit is inert.

The release-notes generator in both configs ALREADY declares a "Reverts"
section for the `revert` type, so the notes half of the pipeline expects
reverts to appear in releases. Only the analyzer half disagreed. This is
an oversight, not a decision.

A revert is the case where shipping is most urgent - it is what you reach
for when something in production is actively wrong - so it must not be the
one thing the pipeline treats as unreleasable.

Custom `releaseRules` are additive, not a replacement: commit-analyzer
falls through to DEFAULT_RELEASE_RULES when no custom rule matches
(index.js:63-67, "If no custom releaseRules or none matched the commit,
try with default releaseRules"). Verified in the installed package rather
than assumed, because getting this wrong would silently stop `feat` and
`fix` from releasing.
---
 .releaserc.json         | 8 +++++++-
 .releaserc.staging.json | 8 +++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.releaserc.json b/.releaserc.json
index 4b9f0f40c..42c46c99f 100644
--- a/.releaserc.json
+++ b/.releaserc.json
@@ -7,7 +7,13 @@
     [
       "@semantic-release/commit-analyzer",
       {
-        "preset": "conventionalcommits"
+        "preset": "conventionalcommits",
+        "releaseRules": [
+          {
+            "type": "revert",
+            "release": "patch"
+          }
+        ]
       }
     ],
     [
diff --git a/.releaserc.staging.json b/.releaserc.staging.json
index 9f8d2a7c3..3b923ed58 100644
--- a/.releaserc.staging.json
+++ b/.releaserc.staging.json
@@ -11,7 +11,13 @@
     [
       "@semantic-release/commit-analyzer",
       {
-        "preset": "conventionalcommits"
+        "preset": "conventionalcommits",
+        "releaseRules": [
+          {
+            "type": "revert",
+            "release": "patch"
+          }
+        ]
       }
     ],
     [

From e8c4245fa58c094902907427ff196fb97652c2af Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Thu, 27 Aug 2026 17:13:28 +0530
Subject: [PATCH 22/53] fix: the CodeRabbit findings on #899, all of them in
 code I wrote

Eight findings on the three PRs merged today. Seven fixed, one declined
with a reason. The first two are the ones that mattered.

## The stand-down WARN reached nothing (main.rs)

`daemon_already_running()` and `LockOutcome::HeldByAnother` both
`return Ok(())` before `obs_guard.shutdown()`. `main` returning does not
flush - `ObservabilityGuard` has no `Drop`, by design - so the WARN died
in the batch processor.

MEASURED, not argued: a second daemon was made to lose the lock race and
`meridian logs` found ZERO occurrences of the WARN it had just printed.
On a release build there is no stdout mirror either, so the event was
invisible everywhere.

That WARN is the only evidence two daemons raced PAST the endpoint probe.
I described it as "the first direct evidence of how often this happens
across the fleet"; it would have measured nothing. Both stand-downs now
flush + drain, matching the repair-marker stand-down 50 lines above.
0 -> 1 occurrences after the fix. Pinned by
`every_stand_down_flushes_before_returning`.

## The quit flush could hang the app forever (tray/lib.rs)

`force_flush()` awaits blocking exporter work and the SpoolClient does
synchronous filesystem writes. Unbounded, a wedged spool sits there
while `ExitPhase::Stopping` holds every later `ExitRequested` - the app
becomes permanently unquittable with no way back. That is exactly what
`HeldExitGuard` exists to prevent, reached again through another door,
in a function whose neighbouring `stop_for_quit` is bounded for the
identical reason.

Now bounded by `QUIT_FLUSH_BUDGET` (2s, shorter than the 5s stop budget:
the flush protects a diagnostic, not user data). The ordering test now
also asserts boundedness.

## The rest

- `main.rs`: the bind-site comment claimed the lock makes a second
  process unreachable. True on `Acquired`, FALSE on `Unavailable`, which
  proceeds unlocked deliberately. Corrected - and it now warns against
  deleting the stale-socket handling on the strength of a lock that path
  does not hold.
- `main.rs`: `pid` on the checkpoint FAILURE warn. The success line had
  it; the failure line - the one most worth attributing - did not.
- `render.rs`: `log.target`/`busy_ns`/`idle_ns` were prefix-matched
  alongside the real `code.`/`thread.` namespaces, so `busy_ns_budget`
  or `log.target_override` would have been silently hidden. That is the
  exact bug this rendering was added to fix, reintroduced by the noise
  filter. Split into namespaces vs whole keys, with a near-match test.
- `observability`: the logger arm discarded its flush error while the
  tracer arm printed one. Both report now.

  Deliberately `eprintln!`, NOT `tracing::error!` as suggested: this is
  the code that flushes the telemetry pipeline, so reporting its failure
  through that pipeline is circular - on the quit path the process exits
  microseconds later and the record would land in the batch that just
  failed. Also note `force_flush` returns `Vec<Result<_>>`, one per
  processor, not a `Result`.
- `deploy-gateway.sh`: `--noproxy '*'`. curl honours http_proxy/
  https_proxy, so an intercepting proxy's own 401 would satisfy a
  security assertion without the request reaching the gateway. Verified:
  https_proxy at a dead port gives 000, --noproxy gives the real 401.
- `deploy-gateway.sh`: validate `$#`, not just `$1`. `--verify-only
  extra` ignored the extra word and a single EMPTY argument matched the
  `""` arm and deployed - the same class of bug the dispatch was added
  to fix.

## Declined

Em-dashes in four log message bodies. CLAUDE.md's rule targets
user-facing app text - window titles, wizard copy, button labels,
notification bodies - and exempts comments/docs. Log bodies have used
em-dashes throughout: 171 sites across the tree already. Changing four
of them makes the codebase less consistent, not more, and sets no
precedent. If the rule should extend to log messages that is a
tree-wide sweep plus a lint, not four edits inside a release PR.

## Testing

Every assertion mutation-proved:
- flush removed from the lock stand-down -> the new test fails
- all-prefix matching restored in render.rs -> the near-match test fails
- timeout removed from the quit flush -> boundedness assertion fails

The last one initially failed to COMPILE (dead_code on the now-unused
constant), which reads as "0 failing" - the trap this repo has hit
before. Re-run with `#[allow(dead_code)]` so the mutant built and the
test actually ran and failed for the right reason.

clippy --workspace --all-targets -D warnings clean; 27 test suites green.
---
 scripts/deploy-gateway.sh              | 27 ++++++++-
 src/main.rs                            | 83 +++++++++++++++++++++++---
 src/observability/mod.rs               | 25 +++++++-
 src/telemetry_spool/render.rs          | 48 +++++++++++++--
 tray/src-tauri/src/daemon_lifecycle.rs | 35 +++++++++--
 tray/src-tauri/src/lib.rs              | 26 +++++++-
 6 files changed, 223 insertions(+), 21 deletions(-)

diff --git a/scripts/deploy-gateway.sh b/scripts/deploy-gateway.sh
index 248b664aa..116ff34d9 100644
--- a/scripts/deploy-gateway.sh
+++ b/scripts/deploy-gateway.sh
@@ -94,7 +94,16 @@ probe_rejects_unauthenticated() {
 	shift 2
 	local deadline=$((SECONDS + PROBE_TIMEOUT_S)) code verdict
 	while :; do
-		code="$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 "$@" "${url}" || true)"
+		# --noproxy '*': the point of this probe is that THE GATEWAY rejects
+		# the caller. curl honours http_proxy/https_proxy/ALL_PROXY, so on a
+		# machine with a proxy configured an intercepting proxy's own 401
+		# would satisfy the assertion without the request ever reaching the
+		# gateway - a security check passing on someone else's answer.
+		# Verified: with https_proxy pointed at a dead port the probe returns
+		# 000, and --noproxy '*' returns the gateway's real 401. If direct
+		# egress is genuinely impossible here, 000 retries and then FAILS,
+		# which is the intended "fail rather than falsely pass" behaviour.
+		code="$(curl -s --noproxy '*' -o /dev/null -w '%{http_code}' --max-time 15 "$@" "${url}" || true)"
 		verdict="$(classify_probe "${code}")"
 		case "${verdict}" in
 		pass)
@@ -151,6 +160,22 @@ verify_public_endpoints_authenticate() {
 #
 # A deploy now requires exactly zero arguments. Anything unrecognised prints
 # usage and exits 2 without touching the VM.
+# `$#` first: the `case` below only ever inspects `$1`, so without this
+# `--verify-only somethingelse` would silently ignore the extra word, and a
+# single EMPTY argument (`"$SOME_UNSET_VAR"`) would match the `""` arm and
+# deploy. Both are the same class of bug as the one this dispatch was added to
+# fix - an argument that does not mean what it looks like, ending in a
+# production deploy.
+if [ "$#" -gt 1 ]; then
+	echo "deploy-gateway.sh: unexpected extra argument '${2}'" >&2
+	echo "run with --help for usage" >&2
+	exit 2
+fi
+if [ "$#" -eq 1 ] && [ -z "${1}" ]; then
+	echo "deploy-gateway.sh: empty argument - a deploy takes NO arguments" >&2
+	echo "run with --help for usage" >&2
+	exit 2
+fi
 case "${1:-}" in
 --verify-only | --self-test | "") ;;
 -h | --help)
diff --git a/src/main.rs b/src/main.rs
index f52889729..fcc4b622d 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1120,6 +1120,14 @@ async fn main() -> Result<()> {
             endpoint = %meridian::platform::endpoint_display(),
             "another meridian daemon already owns this data dir — exiting (single-instance guard)"
         );
+        // Flush before returning, matching the repair-marker stand-down above.
+        // Without it this WARN dies in the batch processor: `main` returning
+        // does not flush (`ObservabilityGuard` has no Drop — see its docs), so
+        // the record of a stand-down never reached the spool at all. MEASURED,
+        // not theorised: a second daemon was made to lose the race and
+        // `meridian logs` found zero occurrences of its own WARN.
+        obs_guard.shutdown().await;
+        meridian::telemetry_spool::shipper::drain_once().await;
         return Ok(());
     }
 
@@ -1162,6 +1170,11 @@ async fn main() -> Result<()> {
                 pid = std::process::id() as i64,
                 "another meridian daemon holds the single-instance lock for this data dir — exiting (lock)"
             );
+            // See the probe stand-down above. This one matters most: it is the
+            // ONLY evidence that two daemons raced past the probe, and it was
+            // reaching nothing.
+            obs_guard.shutdown().await;
+            meridian::telemetry_spool::shipper::drain_once().await;
             return Ok(());
         }
         // Could not find out. Proceed UNLOCKED rather than refuse to start:
@@ -1229,17 +1242,28 @@ async fn main() -> Result<()> {
     //     would let a daemon that's about to `exit(1)` on a locked or corrupt
     //     database falsely tell the tray's watchdog it's healthy for the
     //     brief window before that failure surfaces. Safe to bind
-    //     unconditionally here: we hold the single-instance lock taken at
+    //     unconditionally here — but read the next paragraph before relying
+    //     on WHY, because the obvious reason is only true most of the time.
+    //
+    //     ON THE `Acquired` PATH we hold the single-instance lock taken at
     //     4a-quater, so no other daemon process reached this line at all. (The
     //     older justification — "the check above established nothing else is
     //     listening, and we're single-threaded up to the poll loop" — was only
     //     ever about THIS process's threads and said nothing about a second
-    //     process. The lock is what actually makes this claim true.)
+    //     process.)
+    //
+    //     ON THE `Unavailable` PATH WE HOLD NO LOCK. That path exists on
+    //     purpose (a lock we could not attempt must not stop the daemon
+    //     starting), and it reaches this line with exactly the pre-lock
+    //     guarantees: the endpoint probe, which is check-then-act. So the
+    //     lock does NOT make the sequence below unreachable in general — only
+    //     on the path where it was actually acquired.
     //
     //     NOTE: `spawn_health_listener` itself unlinks a stale socket and then
-    //     binds, which is its own check-then-act across processes. The lock
-    //     makes that unreachable for two daemons, but the sequence is left
-    //     untouched here on purpose — #862 owns that boundary.
+    //     binds, which is its own check-then-act across processes. Do not
+    //     delete that stale-socket handling on the strength of the lock: on
+    //     the `Unavailable` path it is still the only thing standing there.
+    //     #862 owns that boundary.
     meridian::platform::spawn_health_listener()?;
     tracing::info!(endpoint = %meridian::platform::endpoint_display(), "daemon health endpoint ready");
 
@@ -1643,9 +1667,14 @@ async fn main() -> Result<()> {
             pid = std::process::id() as i64,
             "WAL checkpoint on shutdown complete"
         ),
-        Err(e) => {
-            tracing::warn!(error = %meridian::errors::chain(&e), "WAL checkpoint on shutdown failed - continuing anyway")
-        }
+        // `pid` here too: the whole reason both outcomes are logged is to
+        // attribute a checkpoint to a generation, and a FAILED checkpoint is
+        // the one most worth attributing.
+        Err(e) => tracing::warn!(
+            pid = std::process::id() as i64,
+            error = %meridian::errors::chain(&e),
+            "WAL checkpoint on shutdown failed - continuing anyway"
+        ),
     }
     meridian.close().await;
 
@@ -1755,6 +1784,44 @@ mod startup_order_tests {
     /// `backend_install.rs` (`a_stuck_bootout_is_reported_at_warn`,
     /// `every_early_return_still_restores_the_daemon`) — this scans the
     /// source for the three call sites and asserts their relative order.
+    /// A stand-down must FLUSH before it returns, or its own WARN is lost.
+    ///
+    /// `main` returning does not flush: `ObservabilityGuard` has no `Drop`
+    /// (its docs say to call `shutdown` explicitly), so a record emitted just
+    /// before `return Ok(())` dies in the batch processor.
+    ///
+    /// This was not theoretical. MEASURED before the fix: a second daemon was
+    /// made to lose the lock race and `meridian logs` found ZERO occurrences of
+    /// the WARN the daemon had just printed. On a release build there is no
+    /// stdout mirror either, so the event was invisible everywhere - and that
+    /// WARN is the only evidence that two daemons raced past the endpoint
+    /// probe, which is the entire reason the lock reports it.
+    #[test]
+    fn every_stand_down_flushes_before_returning() {
+        const SRC: &str = include_str!("main.rs");
+        let prod = SRC
+            .split_once("\n#[cfg(test)]")
+            .map_or(SRC, |(before, _)| before);
+
+        for needle in ["exiting (single-instance guard)", "exiting (lock)"] {
+            let at = prod
+                .find(needle)
+                .unwrap_or_else(|| panic!("the {needle} stand-down must exist in main()"));
+            let after = &prod[at..];
+            let ret = after
+                .find("return Ok(());")
+                .unwrap_or_else(|| panic!("the {needle} stand-down must return"));
+            let between = &after[..ret];
+            assert!(
+                between.contains("obs_guard.shutdown().await;"),
+                "the '{needle}' stand-down must flush telemetry before it \
+                 returns - without it the WARN it just emitted never reaches \
+                 the spool and the stand-down is invisible. Found between the \
+                 log and the return: {between:?}"
+            );
+        }
+    }
+
     #[test]
     fn single_instance_lock_precedes_setup_db_and_bind_follows_it() {
         const SRC: &str = include_str!("main.rs");
diff --git a/src/observability/mod.rs b/src/observability/mod.rs
index 30f593392..fdd75954d 100644
--- a/src/observability/mod.rs
+++ b/src/observability/mod.rs
@@ -134,7 +134,13 @@ impl ObservabilityGuard {
         }
         if let Some(lp) = self.logger_provider {
             let _ = tokio::task::spawn_blocking(move || {
-                let _ = lp.force_flush();
+                // See `force_flush` for why this reports to stderr rather than
+                // through `tracing`.
+                for r in lp.force_flush() {
+                    if let Err(e) = r {
+                        eprintln!("observability: log force_flush error: {e:?}");
+                    }
+                }
                 let _ = lp.shutdown();
             })
             .await;
@@ -201,7 +207,22 @@ pub async fn force_flush() {
     }
     if let Some(lp) = handles.logger_provider.clone() {
         let _ = tokio::task::spawn_blocking(move || {
-            let _ = lp.force_flush();
+            // Reported, not discarded - the tracer arm above already prints its
+            // error and the logger arm silently swallowed one.
+            //
+            // `eprintln!` rather than `tracing::error!` DELIBERATELY: this is
+            // the code that flushes the telemetry pipeline, so routing its own
+            // failure back into that pipeline is circular. On the quit path the
+            // process exits microseconds later, so a `tracing::error!` here
+            // would land in the very batch that just failed to flush and be
+            // lost - reporting the failure by the one mechanism the failure
+            // proves is broken. stderr is the only sink that does not depend on
+            // what is failing.
+            for r in lp.force_flush() {
+                if let Err(e) = r {
+                    eprintln!("observability: log force_flush error: {e:?}");
+                }
+            }
         })
         .await;
     }
diff --git a/src/telemetry_spool/render.rs b/src/telemetry_spool/render.rs
index 636bc8a04..1f1983f77 100644
--- a/src/telemetry_spool/render.rs
+++ b/src/telemetry_spool/render.rs
@@ -62,13 +62,23 @@ pub struct RenderedRecord {
 /// EVERY record, which would triple the width of every line with the one thing
 /// a reader already knows (they can see the message).
 ///
-/// Prefix-matched, so `code.filepath`/`code.lineno`/`code.namespace` are all
-/// covered by one entry.
-const UNPRINTED_ATTR_PREFIXES: &[&str] = &["code.", "log.target", "thread.", "busy_ns", "idle_ns"];
+/// Namespaces: every key under them is call-site metadata, so a prefix match
+/// is correct and `code.filepath`/`code.lineno`/`code.namespace` are covered by
+/// one entry.
+const UNPRINTED_ATTR_NAMESPACES: &[&str] = &["code.", "thread."];
+
+/// Whole keys. Deliberately NOT prefixes: these are single field names, and
+/// matching them by prefix would silently swallow an emitter's own field that
+/// merely starts the same way - `log.target_override`, `busy_ns_budget`,
+/// `idle_ns_extra`. Hiding a field the author chose to record is precisely the
+/// bug this rendering exists to fix, so it must not be reintroduced by the
+/// filter meant to reduce noise.
+const UNPRINTED_ATTR_KEYS: &[&str] = &["log.target", "busy_ns", "idle_ns"];
 
 /// Is this a call-site metadata key rather than a value the emitter chose?
 fn is_unprinted_attr(key: &str) -> bool {
-    UNPRINTED_ATTR_PREFIXES.iter().any(|p| key.starts_with(p))
+    UNPRINTED_ATTR_NAMESPACES.iter().any(|p| key.starts_with(p))
+        || UNPRINTED_ATTR_KEYS.contains(&key)
 }
 
 /// Decode one spooled file into [`RenderedRecord`]s. The signal (logs vs
@@ -578,6 +588,36 @@ mod tests {
         );
     }
 
+    /// A near-miss on an exact-match key must NOT be suppressed.
+    ///
+    /// `log.target`, `busy_ns` and `idle_ns` are whole field names, not
+    /// namespaces. When they were prefix-matched alongside `code.`/`thread.`,
+    /// any emitter field that merely started the same way was silently hidden -
+    /// which is the exact failure this rendering was added to fix, reintroduced
+    /// by the filter meant to reduce noise.
+    #[test]
+    fn a_field_that_merely_starts_like_a_metadata_key_still_prints() {
+        for key in ["log.target_override", "busy_ns_budget", "idle_ns_extra"] {
+            assert!(
+                !is_unprinted_attr(key),
+                "{key} is an emitter field, not call-site metadata, and must be \
+                 displayed"
+            );
+        }
+        // ...while the exact keys and the real namespaces stay suppressed.
+        for key in [
+            "log.target",
+            "busy_ns",
+            "idle_ns",
+            "code.filepath",
+            "code.lineno",
+            "thread.id",
+            "thread.name",
+        ] {
+            assert!(is_unprinted_attr(key), "{key} is call-site metadata");
+        }
+    }
+
     /// A field declared on a span but never recorded arrives as an empty value.
     /// Rendering `outcome=` costs width and carries nothing.
     #[test]
diff --git a/tray/src-tauri/src/daemon_lifecycle.rs b/tray/src-tauri/src/daemon_lifecycle.rs
index 9ca58b572..764255017 100644
--- a/tray/src-tauri/src/daemon_lifecycle.rs
+++ b/tray/src-tauri/src/daemon_lifecycle.rs
@@ -86,6 +86,16 @@ use tracing::Instrument;
 /// the next launch reconciles the daemon regardless.
 const QUIT_STOP_BUDGET: Duration = Duration::from_secs(5);
 
+/// How long a quit waits for the telemetry flush before exiting anyway.
+///
+/// Shorter than [`QUIT_STOP_BUDGET`] on purpose: the flush is a local disk
+/// write that normally completes in milliseconds, and the thing it protects is
+/// a diagnostic record, not the user's data. Losing that record is a bad
+/// outcome; a Quit that never completes is a worse one, and `ExitPhase::Stopping`
+/// holds every subsequent `ExitRequested` - so an unbounded wait here leaves
+/// the app with no path out at all.
+pub(crate) const QUIT_FLUSH_BUDGET: Duration = Duration::from_secs(2);
+
 /// Where the app is in its exit sequence.
 ///
 /// The quit path is not atomic - the daemon stop is async and the exit is not -
@@ -942,12 +952,15 @@ mod tests {
         let stop_pos = spawn_body
             .find("stop_for_quit().await")
             .expect("the spawned task must call stop_for_quit");
-        let flush_pos = spawn_body
-            .find("observability::force_flush().await")
-            .expect(
-                "the spawned stop task must flush telemetry before exiting, or \
+        // Matched WITHOUT `.await` attached: the call is wrapped in a
+        // `tokio::time::timeout`, so the await belongs to the timeout rather
+        // than to `force_flush` itself. The over-specific needle failed the
+        // moment that bound was added - the test doing its job, but it was the
+        // needle that needed correcting, not the code.
+        let flush_pos = spawn_body.find("observability::force_flush(").expect(
+            "the spawned stop task must flush telemetry before exiting, or \
                  stop_for_quit's outcome never reaches the spool",
-            );
+        );
         let exit_pos = spawn_body
             .find("handle.exit(")
             .expect("the spawned task must exit the app");
@@ -958,5 +971,17 @@ mod tests {
              been reached yet, and after the exit it does not run at all. \
              Found stop at {stop_pos}, flush at {flush_pos}, exit at {exit_pos}."
         );
+
+        // And it must be BOUNDED. `force_flush` awaits blocking exporter work
+        // and the spool does synchronous filesystem writes, so an unbounded
+        // await here can hang the quit indefinitely - and `ExitPhase::Stopping`
+        // holds every later `ExitRequested`, leaving the app unquittable with
+        // no way back. That is the failure mode `HeldExitGuard` exists to
+        // prevent, reached again through a different door.
+        assert!(
+            spawn_body[..exit_pos].contains("QUIT_FLUSH_BUDGET"),
+            "the telemetry flush on quit must be bounded by QUIT_FLUSH_BUDGET; \
+             an unbounded await leaves no path out of ExitPhase::Stopping"
+        );
     }
 }
diff --git a/tray/src-tauri/src/lib.rs b/tray/src-tauri/src/lib.rs
index 830fdc9a2..f366137a4 100644
--- a/tray/src-tauri/src/lib.rs
+++ b/tray/src-tauri/src/lib.rs
@@ -1483,7 +1483,31 @@ pub fn run() {
                             // corruption report (quit is when the tray and the
                             // daemon are most likely to overlap on meridian.db),
                             // and it was the one guaranteed never to survive.
-                            meridian::observability::force_flush().await;
+                            //
+                            // BOUNDED, for the same reason `stop_for_quit` is:
+                            // a quit that hangs is worse than a record that is
+                            // lost. `force_flush` awaits blocking exporter work
+                            // and the SpoolClient does synchronous filesystem
+                            // writes, so a wedged spool (full disk, a stalled
+                            // network home dir) would otherwise sit here
+                            // forever - and `ExitPhase::Stopping` holds every
+                            // later `ExitRequested`, so the app would be
+                            // permanently unquittable with no way back. That is
+                            // the exact failure mode `HeldExitGuard` exists to
+                            // prevent; an unbounded await here reintroduced it
+                            // by another door.
+                            if tokio::time::timeout(
+                                daemon_lifecycle::QUIT_FLUSH_BUDGET,
+                                meridian::observability::force_flush(),
+                            )
+                            .await
+                            .is_err()
+                            {
+                                tracing::warn!(
+                                    budget_s = daemon_lifecycle::QUIT_FLUSH_BUDGET.as_secs(),
+                                    "flushing telemetry on quit exceeded its budget - exiting anyway"
+                                );
+                            }
                             // Immediately before the exit, so the re-entrant
                             // `ExitRequested` this triggers is the one and only
                             // one allowed through.

From 41f8a60353cef9821f9f87804c5f1ea5d2da904a Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Thu, 27 Aug 2026 19:24:55 +0530
Subject: [PATCH 23/53] ci(release): pin the Windows runner and make a cold
 build loud

v1.91.0-staging.4's Windows job compiled for 36 minutes against a cache
that was sitting on `main` the whole time. It asked for

    v0-rust-windows-release-...-Windows_NT-x64-cd9df261-fb0b6063

and the 1305 MiB entry on `main` was

    v0-rust-windows-release-...-Windows_NT-x64-581b1cd0-fb0b6063

Same day, ci.yml's Windows jobs asked for `581b1cd0` and missed a
`cd9df261` entry - the two workflows had swapped hashes overnight.
Cargo.lock, rust-toolchain.toml, this workflow file and the job's `env:`
block were all unchanged, so the drift is environmental: the Windows
fleet was serving more than one image (`windows-2025-vs2026` observed in
CI), and rust-cache hashes the CARGO_*/CC*/CFLAGS/CXX/CMAKE*/RUST*
variables into that key component. Which runner you land on decides
whether you start warm.

Three changes:

* Pin `windows-latest` -> `windows-2025`. macOS was already pinned to
  `macos-26`; Windows was the only unpinned runner. This removes the
  major image roll as a variable but does not freeze the weekly refresh,
  and cannot fix a fleet that is heterogeneous within one label - so it
  is a mitigation, not the fix.

* Report the rust-cache outcome on both jobs. A miss emits an
  `::error::` annotation plus a `$GITHUB_STEP_SUMMARY` section carrying
  the hashed environment. This is the actual fix: the miss itself has
  always been invisible, written as `No cache found.` inside a collapsed
  log group while every check went green - the same silence that let
  cache-warm.yml write an unreadable key for this pipeline's entire
  history. Deliberately non-fatal: a cache miss must never block
  shipping a release, but it must be impossible to overlook. Credential-
  shaped values are filtered out of the dump.

* `cache-on-failure: true` on both jobs. A run that compiles for 30
  minutes and then dies in bundling, signing or upload currently throws
  the compile away, so the retry pays for it a second time.

Also corrects a now-stale `windows-latest` reference in update.rs's
docs.

Not included, deliberately: ci.yml's `windows-latest` has the same
exposure and is worth pinning too, but it is a separate concern from the
release pipeline and belongs in its own change.
---
 .github/workflows/release-build.yml | 150 +++++++++++++++++++++++++++-
 tray/src-tauri/src/update.rs        |   2 +-
 2 files changed, 150 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
index 8e56dd450..20b6aefe8 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -519,6 +519,7 @@ jobs:
       # for v0-rust-macos-release-aarch64-apple-darwin" — so stale entries
       # stopped being reaped too, feeding the same eviction.
       - uses: Swatinem/rust-cache@v2
+        id: rust-cache
         with:
           # shared-key REPLACES rust-cache's automatic job-based key. That
           # matters: by default `add-job-id-key` is true, so ci.yml's
@@ -561,6 +562,70 @@ jobs:
           # nothing can restore from — which is exactly how the repo's 10 GiB
           # quota filled up and began evicting caches other jobs needed.
           save-if: ${{ github.ref == 'refs/heads/main' }}
+          # SAVE THE CACHE EVEN WHEN THE JOB FAILS.
+          #
+          # Defaults to false, so a run that compiles for 30 minutes and then
+          # dies in bundling, signing, notarization or upload throws that whole
+          # compile away, and the retry starts cold again - paying twice for one
+          # release. The compile is the expensive half and it SUCCEEDED; a later
+          # step failing says nothing about the artifacts it produced. A partial
+          # `target/` is not a hazard either: cargo fingerprints it correctly,
+          # which is the same property every incremental build already relies on.
+          cache-on-failure: true
+
+      # A COLD BUILD MUST NOT BE SILENT. This is the release pipeline's oldest
+      # and most expensive failure mode, and it has never once announced itself.
+      #
+      # The shape every time: the cache key drifts or the entry is evicted,
+      # `No cache found.` is written into a COLLAPSED log group, the build takes
+      # 20-30 extra minutes, and every check goes green with correct binaries at
+      # the end. It has only ever been caught by someone happening to watch the
+      # clock - most recently 2026-08-27, when the Windows job compiled for 36
+      # minutes while the cache it wanted sat unread on `main` (see the
+      # `runs-on` note in the windows job). The same silence let cache-warm.yml
+      # write an unreadable key for this pipeline's entire history.
+      #
+      # Deliberately an `::error::` ANNOTATION that does NOT fail the step. The
+      # asymmetry matters: a cache miss must never block shipping a release -
+      # the build is slow, not wrong, and failing here would turn a GitHub image
+      # roll into a release outage. But it must be impossible to overlook, so it
+      # lands as a red annotation on the run page and as a section in
+      # `$GITHUB_STEP_SUMMARY`, both of which sit ABOVE the logs rather than
+      # inside a collapsed group.
+      #
+      # The env dump is the other half, and it is what makes the NEXT occurrence
+      # cheap. rust-cache hashes the NAMES AND VALUES of every
+      # CARGO_*/CC*/CFLAGS/CXX/CMAKE*/RUST* variable into the key component that
+      # drifts, and nothing has ever recorded what those were on a run that
+      # missed - so each time the cause has to be re-derived from the cache API
+      # and guesswork. Printing them on a miss turns that into a diff between
+      # two runs. Values that look like credentials are dropped rather than
+      # printed; none of the hashed prefixes should carry one, and a build log
+      # is not the place to find out otherwise.
+      - name: Report the rust-cache outcome
+        run: |
+          if [ "${{ steps.rust-cache.outputs.cache-hit }}" = "true" ]; then
+            echo "rust-cache: HIT - this build starts warm."
+            exit 0
+          fi
+          msg="rust-cache MISSED on ${{ runner.os }}: this build compiles from scratch (~35 min on Windows, ~20 min on macOS). The key drifted or the entry was evicted - compare the environment below against a run that hit."
+          echo "::error title=Cold Rust build (${{ runner.os }})::${msg}"
+          {
+            echo "### rust-cache miss - ${{ runner.os }}"
+            echo
+            echo "${msg}"
+            echo
+            echo "<details><summary>Cache-key environment (rust-cache hashes these names and values)</summary>"
+            echo
+            echo '```'
+            env \
+              | grep -E '^(CARGO|CC|CFLAGS|CXX|CMAKE|RUST)' \
+              | grep -viE '(TOKEN|SECRET|PASSWORD|CREDENTIAL|_KEY)' \
+              | sort || true
+            echo '```'
+            echo
+            echo "</details>"
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - uses: actions/setup-node@v7
         with:
@@ -836,7 +901,25 @@ jobs:
   windows:
     name: Windows x86_64
     needs: prepare
-    runs-on: windows-latest
+    # PINNED, not `windows-latest`. The macOS job is pinned to `macos-26` and
+    # this one was not, and that asymmetry is not cosmetic: on 2026-08-27 the
+    # release's Windows job asked for
+    # `...-Windows_NT-x64-cd9df261-fb0b6063` while a 1305 MiB entry sat on
+    # `main` under `...-Windows_NT-x64-581b1cd0-fb0b6063`, so it compiled for
+    # 36 minutes with the cache it needed one API call away. The same day's
+    # ci.yml Windows jobs asked for `581b1cd0` and missed a `cd9df261` entry -
+    # the two workflows had SWAPPED hashes overnight. Nothing in the repo
+    # changed (identical Cargo.lock, rust-toolchain, workflow file and env
+    # block), so the drift came from the runner image: the fleet was serving
+    # more than one Windows environment (`windows-2025-vs2026` observed), and
+    # rust-cache hashes the CARGO_*/CC*/CFLAGS/CXX/CMAKE*/RUST* vars, so which
+    # runner you land on decides whether you start warm.
+    #
+    # Pinning the label removes the 2022 -> 2025 major roll as a variable. It
+    # does NOT freeze the weekly image refresh, and it cannot fix a fleet that
+    # is heterogeneous within one label - which is exactly why this line is not
+    # treated as the fix. The cache-outcome report below is.
+    runs-on: windows-2025
     timeout-minutes: 60 # same cap as macos — bound a hung build instead of falling back to GitHub's 360-minute default
     permissions:
       contents: write # uploads assets into the draft
@@ -929,6 +1012,7 @@ jobs:
       # equivalent step for the measurement (5288 cache entries evicting the
       # tarball that actually matters, for a 0.00% Rust hit rate).
       - uses: Swatinem/rust-cache@v2
+        id: rust-cache
         with:
           # Keyed by triple only, same reasoning as the macOS job — one warm
           # cache shared across every workflow that compiles this target.
@@ -941,6 +1025,70 @@ jobs:
           # compiled OpenSSL-from-source + SQLCipher + the daemon and tray from
           # a stone-cold cache, 35.7 min of a 37 min job, every single time.
           save-if: ${{ github.ref == 'refs/heads/main' }}
+          # SAVE THE CACHE EVEN WHEN THE JOB FAILS.
+          #
+          # Defaults to false, so a run that compiles for 30 minutes and then
+          # dies in bundling, signing, notarization or upload throws that whole
+          # compile away, and the retry starts cold again - paying twice for one
+          # release. The compile is the expensive half and it SUCCEEDED; a later
+          # step failing says nothing about the artifacts it produced. A partial
+          # `target/` is not a hazard either: cargo fingerprints it correctly,
+          # which is the same property every incremental build already relies on.
+          cache-on-failure: true
+
+      # A COLD BUILD MUST NOT BE SILENT. This is the release pipeline's oldest
+      # and most expensive failure mode, and it has never once announced itself.
+      #
+      # The shape every time: the cache key drifts or the entry is evicted,
+      # `No cache found.` is written into a COLLAPSED log group, the build takes
+      # 20-30 extra minutes, and every check goes green with correct binaries at
+      # the end. It has only ever been caught by someone happening to watch the
+      # clock - most recently 2026-08-27, when the Windows job compiled for 36
+      # minutes while the cache it wanted sat unread on `main` (see the
+      # `runs-on` note in the windows job). The same silence let cache-warm.yml
+      # write an unreadable key for this pipeline's entire history.
+      #
+      # Deliberately an `::error::` ANNOTATION that does NOT fail the step. The
+      # asymmetry matters: a cache miss must never block shipping a release -
+      # the build is slow, not wrong, and failing here would turn a GitHub image
+      # roll into a release outage. But it must be impossible to overlook, so it
+      # lands as a red annotation on the run page and as a section in
+      # `$GITHUB_STEP_SUMMARY`, both of which sit ABOVE the logs rather than
+      # inside a collapsed group.
+      #
+      # The env dump is the other half, and it is what makes the NEXT occurrence
+      # cheap. rust-cache hashes the NAMES AND VALUES of every
+      # CARGO_*/CC*/CFLAGS/CXX/CMAKE*/RUST* variable into the key component that
+      # drifts, and nothing has ever recorded what those were on a run that
+      # missed - so each time the cause has to be re-derived from the cache API
+      # and guesswork. Printing them on a miss turns that into a diff between
+      # two runs. Values that look like credentials are dropped rather than
+      # printed; none of the hashed prefixes should carry one, and a build log
+      # is not the place to find out otherwise.
+      - name: Report the rust-cache outcome
+        run: |
+          if [ "${{ steps.rust-cache.outputs.cache-hit }}" = "true" ]; then
+            echo "rust-cache: HIT - this build starts warm."
+            exit 0
+          fi
+          msg="rust-cache MISSED on ${{ runner.os }}: this build compiles from scratch (~35 min on Windows, ~20 min on macOS). The key drifted or the entry was evicted - compare the environment below against a run that hit."
+          echo "::error title=Cold Rust build (${{ runner.os }})::${msg}"
+          {
+            echo "### rust-cache miss - ${{ runner.os }}"
+            echo
+            echo "${msg}"
+            echo
+            echo "<details><summary>Cache-key environment (rust-cache hashes these names and values)</summary>"
+            echo
+            echo '```'
+            env \
+              | grep -E '^(CARGO|CC|CFLAGS|CXX|CMAKE|RUST)' \
+              | grep -viE '(TOKEN|SECRET|PASSWORD|CREDENTIAL|_KEY)' \
+              | sort || true
+            echo '```'
+            echo
+            echo "</details>"
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - uses: actions/setup-node@v7
         with:
diff --git a/tray/src-tauri/src/update.rs b/tray/src-tauri/src/update.rs
index 9ea4b38b1..af1082d87 100644
--- a/tray/src-tauri/src/update.rs
+++ b/tray/src-tauri/src/update.rs
@@ -284,7 +284,7 @@ const NO_PLATFORM_ASSET: &str = "no-platform-asset";
 /// published update artifact in `latest.json`" rather than a real check
 /// failure. Concretely this is Windows ARM64 today: `scripts/package-updater-windows.sh`
 /// only ever writes the `windows-x86_64` / `windows-x86_64-nsis` keys (the
-/// `.github/workflows/release-build.yml` `windows` job builds on `windows-latest`,
+/// `.github/workflows/release-build.yml` `windows` job builds on `windows-2025`,
 /// i.e. x86_64, only — there is no ARM64 Windows release job), so an ARM64
 /// install's updater lookup can never match anything the manifest carries.
 ///

From b4f33de7f9c1e59ba9110f28cdaceb5b3c27ee81 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Thu, 27 Aug 2026 20:31:49 +0530
Subject: [PATCH 24/53] fix(telemetry): stop subprocess stderr reaching central
 OO through the log body

Closes #872.

The redaction allowlist governs attribute KEYS. The message body is not an
attribute - it IS the record, so it always ships, having passed only
scrub_text's URL/email/blob patterns, which know nothing about ticket keys or
a tracker's error payload. Three tray call sites spliced a `meridian`
subprocess's stderr straight into a WARN body, and #872 measured the result in
central OpenObserve: a real user's ticket key (ENG-7041), from a value the
allowlist explicitly denies as an attribute.

The stderr moves to `stderr_tail`, deliberately NOT allowlisted. That is the
two-tier design working rather than a diagnostic being thrown away: unallowlisted
attributes are captured at full fidelity locally (`meridian logs` renders them,
export bundles carry the raw spool) and dropped on the ship leg. The engineer
debugging their own machine loses nothing.

The shipped record also gains what it was silently missing: `code` was
`code = ?Option<i32>`, which debug-formats to the string "Some(1)" - not a bare
number, so `is_bare_number` could not rescue it and the exit code was dropped
from every shipped record. Passed as i64 it is kept unconditionally.

Rejected: an identifier regex over the body ([A-Z]{2,10}-\d+). It is the most
common shape in technical prose - UTF-8, SHA-256, RFC-7396, CVE-2024-1234,
x86-64 - so the exclusion list is unbounded and every miss is a silent
diagnostic loss, i.e. #867 re-created in the body. It would also make
scrub_text look like it handles identifiers, so the next splice goes unexamined.

Enforced, not just fixed: src/log_hygiene.rs walks every workspace source tree
and fails the build on a new interpolated WARN+/ERROR body, with INTERPOLABLE as
the justified exemption list. It matches BARE `warn!(` too - 14 sites in etl/
and capture/ import the macro, and a scan anchored on `tracing::warn!` would
have read as full coverage while skipping all of them.

Both new assertions are mutation-proved: restoring the pre-fix body fails the
cli_exec test with the measured leak verbatim, and fails the repo-wide scan from
a different crate; adding stderr_tail to SAFE_STRING_KEYS fails both guards.

privacy.md said error reports never contain ticket keys while describing only
the attribute filter, never mentioning that the message itself is sent. Both
corrected to the fixed state.

cli_exec.rs and the new lint would have pushed two files past the 500-line rule,
so the tests are split into cli_exec_tests.rs and the lint lives in its own
module rather than growing errors.rs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CLAUDE.md                                     |  22 +-
 docs/privacy.md                               |   3 +-
 src/lib.rs                                    |   4 +
 src/log_hygiene.rs                            | 361 ++++++++++++++++++
 src/telemetry_spool/redact.rs                 |  83 ++++
 tray/src-tauri/src/commands/cli_exec.rs       | 220 ++++-------
 tray/src-tauri/src/commands/cli_exec_tests.rs | 274 +++++++++++++
 tray/src-tauri/src/commands/parents.rs        |  14 +-
 tray/src-tauri/src/commands/triage.rs         |  12 +-
 tray/src-tauri/src/lib.rs                     |   8 +-
 10 files changed, 854 insertions(+), 147 deletions(-)
 create mode 100644 src/log_hygiene.rs
 create mode 100644 tray/src-tauri/src/commands/cli_exec_tests.rs

diff --git a/CLAUDE.md b/CLAUDE.md
index bceecf006..144b98011 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -385,7 +385,7 @@ supported way to read logs locally, replacing the old JSONL-tailing UI and the
 old bash `meridian logs` (which used to tail launchd-redirected stdout/stderr
 text).
 
-**Three couplings that silently delete error coverage.** Each has bitten at
+**Four couplings that silently delete error coverage - or cause an egress.** Each has bitten at
 least once; none fails loudly, and none is visible from the call site.
 
 1. **The `EnvFilter` decides what is captured at all — before the spool, before
@@ -420,7 +420,25 @@ least once; none fails loudly, and none is visible from the call site.
    the field was the cheaper half. Likewise a full binary path (`bin`) stays
    denied while `bin_source` — a closed set of literals from
    `install::bin_source` — ships in its place.
-3. **A `u64` field is not shipped as a number.** `tracing-opentelemetry` 0.28's
+3. **The log BODY is not an attribute, and nothing filters it.** The allowlist
+   governs attribute KEYS; the body *is* the record, so it always ships, having
+   passed only `scrub_text`'s URL/email/blob patterns — which know nothing about
+   ticket keys, window titles, or a tracker's error payload. CLAUDE.md has said
+   "structured fields — never format data values into the message string" from
+   the start, and nothing enforced it, so it drifted at three tray call sites
+   that spliced a `meridian` subprocess's stderr into a WARN body. Issue #872
+   measured the result: a real user's ticket key (`ENG-7041`) in central
+   OpenObserve, from a value the allowlist denies as an attribute. It is now
+   enforced — `errors.rs::no_user_data_interpolated_into_a_log_body` walks every
+   workspace source tree and fails the build on a new interpolated WARN+/ERROR
+   body, with `INTERPOLABLE` as the deliberate, justified exemption list. **The
+   corollary when you fix one: move the value to an UNALLOWLISTED attribute
+   rather than deleting it.** Unallowlisted attributes are captured at full
+   fidelity locally (`meridian logs` renders them; export bundles carry the raw
+   spool) and dropped on the ship leg — that is the two-tier design working, and
+   it is why `stderr_tail` costs the engineer debugging their own machine
+   nothing. Deleting the value instead is #867's mistake wearing #872's clothes.
+4. **A `u64` field is not shipped as a number.** `tracing-opentelemetry` 0.28's
    `Visit` impl has no `record_u64`, so `tracing::field::Visit`'s default applies
    and forwards to `record_debug` — which emits a **StringValue**. The field then
    misses the allowlist (nobody lists `timeout_s` as a *string* key) and is
diff --git a/docs/privacy.md b/docs/privacy.md
index 4e16df438..8d9bdc6c2 100644
--- a/docs/privacy.md
+++ b/docs/privacy.md
@@ -78,12 +78,13 @@ For the records that do qualify, every attribute is filtered on your device befo
 - **Text values are dropped unless the attribute name is on an explicit allowlist.** Anything path-like is scrubbed of your home directory; the small free-text subset (error messages, stack traces) is additionally scrubbed of URLs, email addresses, and token-shaped strings, then length-clamped.
 - **Structured values** (byte blobs, arrays, nested maps) are dropped outright.
 - **Span events and links are cleared entirely.**
+- **The message itself is sent** - it is the error, so there is nothing to filter it against. Meridian's own rule is therefore that a message must be a fixed sentence and every runtime value must travel as a named field, where the allowlist above applies to it. That rule is enforced automatically: a build fails if any warning or error message formats a value into its text.
 
 The filter fails closed: a newly added attribute anywhere in the codebase is dropped by default until someone deliberately allowlists it.
 
 ### What is therefore never sent
 
-OCR text, accessibility-tree content, window titles, browser URLs, coding-agent conversation bodies, LLM prompts and completions, ticket contents, file paths, and your local database. These stay on your machine even when error reporting is on. Local logs remain full-fidelity for your own debugging — the stripping applies only to the copy that would be transmitted.
+OCR text, accessibility-tree content, window titles, browser URLs, coding-agent conversation bodies, LLM prompts and completions, ticket keys, ticket contents, file paths, and your local database. These stay on your machine even when error reporting is on. Local logs remain full-fidelity for your own debugging — the stripping applies only to the copy that would be transmitted.
 
 ### How reports are identified
 
diff --git a/src/lib.rs b/src/lib.rs
index 2c9b1c477..a78af526c 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -22,6 +22,10 @@ pub mod health;
 pub mod intelligence;
 pub mod llm;
 pub mod llm_experiment;
+// Test-only lints on log content; see the module header. `#[cfg(test)]` because it
+// has no runtime surface - it exists purely to fail the build.
+#[cfg(test)]
+mod log_hygiene;
 pub mod notices;
 pub mod notification_responses;
 pub mod notifications;
diff --git a/src/log_hygiene.rs b/src/log_hygiene.rs
new file mode 100644
index 000000000..bbf9ec8b9
--- /dev/null
+++ b/src/log_hygiene.rs
@@ -0,0 +1,361 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+
+//! Build-time lints on what a log record is allowed to CONTAIN.
+//!
+//! # Why this is a module and not a comment in a style guide
+//! `telemetry_spool::redact` filters attributes by key: anything not on
+//! `SAFE_STRING_KEYS` is dropped before the ship leg. The **message body** has
+//! no such gate - it *is* the record, so it always ships, having passed only
+//! `scrub_text`'s URL/email/blob patterns, which know nothing about ticket keys,
+//! window titles, or a tracker's error payload.
+//!
+//! CLAUDE.md has said "structured fields - never format data values into the
+//! message string" since the beginning, and nothing checked it. It drifted at
+//! three tray call sites that spliced a `meridian` subprocess's stderr into a
+//! WARN body, and issue #872 measured the result in central OpenObserve: a real
+//! user's ticket key (`ENG-7041`), from a value the allowlist denies as an
+//! attribute. A rule nothing enforces is a rule that decays, which is the whole
+//! argument for putting it here instead.
+//!
+//! The lint is source-scanning because the defect is invisible at runtime - the
+//! record is emitted, well-formed, and carries exactly what it was told to.
+//! Nothing observes the difference until it is already on someone else's server.
+//!
+//! # Who calls this
+//! Nothing at runtime. `cargo test` runs [`tests::no_user_data_interpolated_into_a_log_body`]
+//! over every workspace source tree, and it fails the build for the whole
+//! workspace, not just this crate.
+//!
+//! # Related
+//! - [`crate::errors`] - the sibling log-hygiene lint, on the opposite failure:
+//!   `no_bare_error_display_in_db_paths` catches a cause being DROPPED, this
+//!   catches user data being ADDED. Both exist because a well-formed log line
+//!   is not a correct one.
+//! - `crate::telemetry_spool::redact` - the attribute-side boundary this one
+//!   complements, and the reason a body needs its own rule at all.
+
+#[cfg(test)]
+mod tests {
+
+    /// The identifiers a WARN+/ERROR **message body** may interpolate.
+    ///
+    /// # Why this is an allowlist and not "don't do that"
+    /// A log body is the one field `telemetry_spool::redact` structurally cannot
+    /// filter. Attributes are dropped unless their key is on
+    /// `SAFE_STRING_KEYS`; the body IS the record, so it always ships. Anything
+    /// interpolated into it egresses verbatim, having passed only `scrub_text`'s
+    /// URL/email/blob patterns - which know nothing about ticket keys, window
+    /// titles, or a tracker's error payload.
+    ///
+    /// Issue #872 measured the consequence: a real user's ticket key
+    /// (`ENG-7041`) in central OpenObserve, spliced in from a `meridian`
+    /// subprocess's stderr by three tray call sites, from a value the allowlist
+    /// denies as an attribute. CLAUDE.md has forbidden this since the beginning
+    /// - "structured fields - never format data values into the message string"
+    /// - and nothing enforced it, so it drifted three times.
+    ///
+    /// # Adding an identifier
+    /// It must be provably a compile-time constant or a closed set of our own
+    /// literals at EVERY call site, and it must earn a justification here. If
+    /// the value is runtime data, it belongs in a structured field instead,
+    /// where the allowlist can make a deliberate decision about it - which is
+    /// the entire point of having one.
+    const INTERPOLABLE: &[&str] = &[
+        // A subcommand/operation label. `&'static str` at every call site
+        // (`"ticket-statuses"`, `"plan-task-draft"`, …) - it names OUR
+        // subcommand, never the user's data.
+        "label",
+        // `catch_setup_panic`'s stage name - a `&str` literal at both call
+        // sites, naming a tray setup step.
+        "what",
+        // A panic payload, from `catch_setup_panic`. Deliberately still in the
+        // body: it is our own `expect`/`panic!` text and it is THE diagnostic
+        // for a startup panic, so moving it to an unallowlisted attribute would
+        // delete it from the fleet's telemetry entirely - #867's mistake, not
+        // #872's. It already ships today and this change does not widen that;
+        // the rename to `panic_msg` exists so the exemption is visible at the
+        // call site rather than riding on the generic name `msg`, which is what
+        // all three #872 sites used.
+        "panic_msg",
+    ];
+
+    /// The source trees this scans. A directory WALK, not an `include_str!`
+    /// list: the defect is a new call site, so a "remember to add your file"
+    /// list would be exactly the shape of hole issue #878 was about. Every
+    /// crate in the workspace that emits telemetry is covered.
+    const SCANNED_TREES: &[&str] = &[
+        "src",
+        "meridian-core/src",
+        "meridian-oauth/src",
+        "tray/src-tauri/src",
+    ];
+
+    /// Collect `(path, production source)` for every `.rs` under `SCANNED_TREES`,
+    /// truncated at the file's test module - a file's own tests legitimately
+    /// contain example log lines, and this scan reads the file it lives in.
+    fn production_sources() -> Vec<(String, String)> {
+        fn walk(dir: &std::path::Path, out: &mut Vec<(String, String)>) {
+            let Ok(entries) = std::fs::read_dir(dir) else {
+                return;
+            };
+            for e in entries.flatten() {
+                let p = e.path();
+                if p.is_dir() {
+                    walk(&p, out);
+                } else if p.extension().is_some_and(|x| x == "rs")
+                    // A dedicated test file (`tests.rs`, `cli_exec_tests.rs`)
+                    // has no in-file `#[cfg(test)]` to truncate at, so the
+                    // marker heuristic below would read all of it as
+                    // production and flag its example log lines.
+                    && !p.file_name().is_some_and(|n| {
+                        let n = n.to_string_lossy();
+                        n == "tests.rs" || n.ends_with("_tests.rs")
+                    })
+                {
+                    if let Ok(src) = std::fs::read_to_string(&p) {
+                        let prod = src
+                            .split_once("\n#[cfg(test)]")
+                            .map_or(src.as_str(), |(a, _)| a)
+                            .to_string();
+                        out.push((p.display().to_string(), prod));
+                    }
+                }
+            }
+        }
+        // Set at COMPILE time to this crate's directory, which is the workspace
+        // root (`members = [".", …]`), so the walk is rooted correctly no matter
+        // where the test binary is invoked from.
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
+        let mut out = Vec::new();
+        for tree in SCANNED_TREES {
+            walk(&root.join(tree), &mut out);
+        }
+        assert!(
+            out.len() > 100,
+            "the source walk found only {} files - SCANNED_TREES is stale or the \
+             layout moved, and a scan that reads nothing passes silently",
+            out.len()
+        );
+        out
+    }
+
+    /// Every `{ident}` interpolated into the message body of a `tracing::warn!`
+    /// or `tracing::error!` in `src`, with its line number.
+    fn interpolated_body_idents(src: &str) -> Vec<(usize, String, String)> {
+        let mut found = Vec::new();
+        // Matched WITHOUT the `tracing::` prefix on purpose: 14 sites in
+        // `etl/` and `capture/` import the macro (`use tracing::warn`) and call
+        // it bare, and a scan anchored on the qualified spelling would have read
+        // as full coverage while silently skipping every one of them.
+        for macro_name in ["warn!", "error!"] {
+            let mut from = 0;
+            while let Some(rel) = src[from..].find(macro_name) {
+                let start = from + rel;
+                from = start + macro_name.len();
+                // Not part of a longer identifier (`some_error!`, `debug_warn!`).
+                if src[..start]
+                    .chars()
+                    .next_back()
+                    .is_some_and(|c| c.is_alphanumeric() || c == '_')
+                {
+                    continue;
+                }
+                // Skip a commented-out example.
+                let line_start = src[..start].rfind('\n').map_or(0, |i| i + 1);
+                if src[line_start..start].trim_start().starts_with("//") {
+                    continue;
+                }
+                let Some(open) = src[start..].find('(').map(|i| start + i) else {
+                    continue;
+                };
+                // Balance parens, ignoring anything inside a string literal.
+                let (mut depth, mut i) = (0usize, open);
+                let (mut in_str, mut esc) = (false, false);
+                let bytes: Vec<char> = src[open..].chars().collect();
+                let mut k = 0usize;
+                while k < bytes.len() {
+                    let c = bytes[k];
+                    if in_str {
+                        if esc {
+                            esc = false;
+                        } else if c == '\\' {
+                            esc = true;
+                        } else if c == '"' {
+                            in_str = false;
+                        }
+                    } else if c == '"' {
+                        in_str = true;
+                    } else if c == '(' {
+                        depth += 1;
+                    } else if c == ')' {
+                        depth -= 1;
+                        if depth == 0 {
+                            break;
+                        }
+                    }
+                    k += 1;
+                }
+                i += k;
+                let args = &src[open + 1..i.min(src.len())];
+                // The message is the LAST top-level string literal in the arg
+                // list - `tracing`'s own rule.
+                let Some(msg) = last_string_literal(args) else {
+                    continue;
+                };
+                let line = src[..start].matches('\n').count() + 1;
+                for ident in placeholders(&msg) {
+                    found.push((line, ident, msg.clone()));
+                }
+            }
+        }
+        found
+    }
+
+    /// The last `"…"` literal in a macro argument list, unescaped enough to read
+    /// its `{}` placeholders.
+    fn last_string_literal(args: &str) -> Option<String> {
+        let chars: Vec<char> = args.chars().collect();
+        let (mut i, mut last) = (0usize, None);
+        while i < chars.len() {
+            if chars[i] == '"' {
+                let mut j = i + 1;
+                let mut buf = String::new();
+                while j < chars.len() {
+                    if chars[j] == '\\' {
+                        j += 2;
+                        continue;
+                    }
+                    if chars[j] == '"' {
+                        break;
+                    }
+                    buf.push(chars[j]);
+                    j += 1;
+                }
+                last = Some(buf);
+                i = j + 1;
+            } else {
+                i += 1;
+            }
+        }
+        last
+    }
+
+    /// Named `{ident}` captures in a format string. Positional `{}` / `{:?}` are
+    /// out of scope: they take their value from a trailing argument, and
+    /// `no_bare_error_display_in_db_paths` already covers the `%e` case that
+    /// produces in practice.
+    fn placeholders(msg: &str) -> Vec<String> {
+        let mut out = Vec::new();
+        let chars: Vec<char> = msg.chars().collect();
+        let mut i = 0usize;
+        while i < chars.len() {
+            if chars[i] == '{' {
+                if chars.get(i + 1) == Some(&'{') {
+                    i += 2;
+                    continue;
+                }
+                let mut j = i + 1;
+                let mut name = String::new();
+                while j < chars.len() && (chars[j].is_alphanumeric() || chars[j] == '_') {
+                    name.push(chars[j]);
+                    j += 1;
+                }
+                // Only a NAMED capture: `{x}` or `{x:?}`, not `{}` or `{:?}`.
+                if !name.is_empty()
+                    && !name.starts_with(|c: char| c.is_ascii_digit())
+                    && matches!(chars.get(j), Some('}') | Some(':'))
+                {
+                    out.push(name);
+                }
+                i = j;
+            } else {
+                i += 1;
+            }
+        }
+        out
+    }
+
+    /// A WARN+ log BODY always ships - it is the one field the redaction
+    /// allowlist cannot reach - so nothing runtime-valued may be formatted into
+    /// it. See [`INTERPOLABLE`] for the full reasoning and issue #872 for the
+    /// leak that prompted this.
+    #[test]
+    fn no_user_data_interpolated_into_a_log_body() {
+        let mut offenders = Vec::new();
+        for (path, src) in production_sources() {
+            for (line, ident, msg) in interpolated_body_idents(&src) {
+                if !INTERPOLABLE.contains(&ident.as_str()) {
+                    offenders.push(format!("{path}:{line} - `{{{ident}}}` in \"{msg}\""));
+                }
+            }
+        }
+        assert!(
+            offenders.is_empty(),
+            "a WARN+/ERROR message body interpolates a value that is not on \
+             `INTERPOLABLE`. The body is the ONE field `telemetry_spool::redact` \
+             cannot filter - attributes are dropped unless allowlisted, but the \
+             body always ships - so whatever this formats in egresses verbatim \
+             to central OpenObserve. Issue #872 measured a real user's ticket key \
+             arriving this way. Put the value in a structured field instead \
+             (`tracing::warn!(some_key = %v, \"static message\")`), where the \
+             allowlist can make a deliberate decision about it; if it is genuinely \
+             a compile-time literal at every call site, add it to `INTERPOLABLE` \
+             with a justification. Offenders: {offenders:#?}"
+        );
+    }
+
+    /// The scan above is only worth having if it actually catches the #872
+    /// shape. Feeds it the pre-fix source verbatim - a scan nobody has seen fail
+    /// is a scan nobody knows works.
+    #[test]
+    fn the_body_scan_catches_the_splice_it_was_written_for() {
+        let pre_fix = r#"
+            tracing::warn!(
+                bin = %bin,
+                code = ?output.status.code(),
+                "{label} non-zero: {msg}"
+            );
+        "#;
+        let hits = interpolated_body_idents(pre_fix);
+        let idents: Vec<&str> = hits.iter().map(|(_, i, _)| i.as_str()).collect();
+        assert!(
+            idents.contains(&"msg"),
+            "the scan missed `{{msg}}`, the exact splice #872 measured: {idents:?}"
+        );
+        assert!(
+            idents.contains(&"label"),
+            "the scan missed `{{label}}` - it must SEE allowlisted idents too, or \
+             the allowlist is doing nothing and a rename would slip through: {idents:?}"
+        );
+
+        assert!(
+            interpolated_body_idents(r#"warn!(error = %e, "gap {kind} misclassified");"#)
+                .iter()
+                .any(|(_, i, _)| i == "kind"),
+            "the scan missed a BARE `warn!(` - 14 sites in etl/ and capture/ \
+             import the macro and call it unqualified"
+        );
+
+        // Things that must NOT trip it.
+        assert!(
+            interpolated_body_idents(r#"tracing::warn!(error = %e, "fetch failed");"#).is_empty(),
+            "a body with no interpolation was flagged"
+        );
+        assert!(
+            interpolated_body_idents(r#"// tracing::warn!("{msg}");"#).is_empty(),
+            "a commented-out example was flagged"
+        );
+        assert!(
+            interpolated_body_idents(r#"fn my_error!(x) { "{msg}" }"#).is_empty(),
+            "`my_error!` is a different macro and must not be scanned"
+        );
+        assert!(
+            interpolated_body_idents(r#"tracing::warn!(n = 1, "dropped {} rows", n);"#).is_empty(),
+            "a positional `{{}}` placeholder is out of scope - see `placeholders`"
+        );
+        assert!(
+            interpolated_body_idents(r#"tracing::warn!("100{{msg}} percent");"#).is_empty(),
+            "an escaped `{{{{`/`}}}}` literal was read as a placeholder"
+        );
+    }
+}
diff --git a/src/telemetry_spool/redact.rs b/src/telemetry_spool/redact.rs
index 48e5b622d..d3b81b92e 100644
--- a/src/telemetry_spool/redact.rs
+++ b/src/telemetry_spool/redact.rs
@@ -1820,6 +1820,89 @@ mod tests {
         }
     }
 
+    /// End-to-end proof of the #872 fix, at the boundary itself rather than at
+    /// the call site: a WARN shaped exactly like the one
+    /// `commands::cli_exec::log_non_zero_exit` now emits must ship its static
+    /// message and exit code, and must NOT ship the subprocess stderr the
+    /// pre-fix version spliced into that message.
+    ///
+    /// The pre-fix half is asserted too, and is the more important one - it is
+    /// what makes this a regression test rather than a restatement. Reverting
+    /// `log_non_zero_exit`'s body to `"{label} non-zero: {stderr}"` puts the
+    /// ticket key back in `body`, where nothing here can filter it, and this
+    /// test then fails on the very next line.
+    #[test]
+    fn a_subprocess_stderr_ships_only_when_it_is_spliced_into_the_body() {
+        const STDERR: &str = "Jira GET transitions for ENG-7041 returned 404 Not Found";
+
+        // The FIXED shape: static body, stderr on an unallowlisted attribute.
+        let mut fixed = log_record(
+            SEVERITY_WARN,
+            vec![
+                str_attr("stderr_tail", STDERR),
+                str_attr("key", "ENG-7041"),
+                str_attr("bin_source", "staged"),
+                int_attr("code", 1),
+                int_attr("stderr_len", STDERR.len() as i64),
+            ],
+        );
+        fixed.body = Some(AnyValue {
+            value: Some(Value::StringValue("ticket-statuses non-zero".into())),
+        });
+        let out = match redact_and_filter("logs", &encode_logs(vec![fixed])) {
+            Redacted::Payload { bytes, .. } => decode_logs(&bytes),
+            Redacted::Empty => panic!("the WARN was filtered out before redaction"),
+            Redacted::Undecodable => panic!("the re-encoded payload did not decode"),
+        };
+        let rec = out.first().expect("the WARN was dropped entirely");
+        let body = match rec.body.as_ref().and_then(|b| b.value.as_ref()) {
+            Some(Value::StringValue(s)) => s.clone(),
+            other => panic!("expected a string body, got {other:?}"),
+        };
+        assert!(
+            !body.contains("ENG-7041"),
+            "the ticket key reached the wire through the body: {body}"
+        );
+        let keys: Vec<&str> = rec.attributes.iter().map(|kv| kv.key.as_str()).collect();
+        assert!(
+            !keys.contains(&"stderr_tail") && !keys.contains(&"key"),
+            "stderr_tail / key are not allowlisted and must not ship: {keys:?}"
+        );
+        // …but the record is still worth having: which subcommand, which
+        // binary, and - restored by this change, having previously been
+        // debug-formatted into `\"Some(1)\"` and dropped - the exit code.
+        assert!(body.contains("ticket-statuses"), "{body}");
+        assert!(keys.contains(&"bin_source"), "{keys:?}");
+        assert!(
+            keys.contains(&"code") && keys.contains(&"stderr_len"),
+            "the numeric diagnostics were dropped: {keys:?}"
+        );
+
+        // The PRE-FIX shape, for contrast: same stderr, spliced into the body.
+        // Nothing in this module can stop it, which is precisely why the guard
+        // had to go at the call site (`errors.rs`).
+        let mut pre_fix = log_record(SEVERITY_WARN, vec![]);
+        pre_fix.body = Some(AnyValue {
+            value: Some(Value::StringValue(format!(
+                "ticket-statuses non-zero: {STDERR}"
+            ))),
+        });
+        let out = match redact_and_filter("logs", &encode_logs(vec![pre_fix])) {
+            Redacted::Payload { bytes, .. } => decode_logs(&bytes),
+            _ => panic!("expected a payload"),
+        };
+        let body = match out[0].body.as_ref().and_then(|b| b.value.as_ref()) {
+            Some(Value::StringValue(s)) => s.clone(),
+            other => panic!("expected a string body, got {other:?}"),
+        };
+        assert!(
+            body.contains("ENG-7041"),
+            "if redaction has started catching ticket keys in the body, this test \
+             and `errors.rs`'s INTERPOLABLE doc are both out of date - the fix \
+             would no longer need to live at the call site. Body was: {body}"
+        );
+    }
+
     /// `health check failed` is a static message carrying no diagnostic payload
     /// of its own — everything that identifies the fault rides on its fields. So
     /// six machines reported a CRITICAL health failure to the backend with no
diff --git a/tray/src-tauri/src/commands/cli_exec.rs b/tray/src-tauri/src/commands/cli_exec.rs
index 665bf881b..6b47eb560 100644
--- a/tray/src-tauri/src/commands/cli_exec.rs
+++ b/tray/src-tauri/src/commands/cli_exec.rs
@@ -107,19 +107,91 @@ pub(crate) async fn run_meridian(
         let msg = if stderr.is_empty() {
             format!("{label} exited {:?}", output.status.code())
         } else {
-            stderr
+            stderr.clone()
         };
-        tracing::warn!(
-            bin = %bin,
-            bin_source = crate::install::bin_source(&bin),
-            code = ?output.status.code(),
-            "{label} non-zero: {msg}"
-        );
+        log_non_zero_exit(NonZeroExit {
+            label,
+            bin: Some(bin.as_str()),
+            provider: None,
+            key: None,
+            code: output.status.code(),
+            stderr: &stderr,
+        });
         return Err(msg);
     }
     Ok(stdout)
 }
 
+/// Everything the [`log_non_zero_exit`] WARN reports. A struct rather than six
+/// parameters because clippy caps argument counts at seven and the three call
+/// sites each carry a different subset (see `BlockBounds` in the daemon's ETL
+/// runner for the same convention).
+pub(crate) struct NonZeroExit<'a> {
+    /// The subcommand label, e.g. `ticket-statuses`. A `&'static str` literal at
+    /// every call site - it names OUR subcommand, never the user's data, which
+    /// is why it is the one value interpolated into the message body.
+    pub(crate) label: &'a str,
+    /// The resolved `meridian` binary path, when the caller has one.
+    pub(crate) bin: Option<&'a str>,
+    /// The tracker this call was for (`jira`, `linear`, …), when applicable.
+    pub(crate) provider: Option<&'a str>,
+    /// The ticket key the call was about, when applicable. Local-only - see the
+    /// note on `stderr_tail` in [`log_non_zero_exit`].
+    pub(crate) key: Option<&'a str>,
+    /// The child's exit code, if it exited rather than being signalled.
+    pub(crate) code: Option<i32>,
+    /// The child's full stderr, already trimmed.
+    pub(crate) stderr: &'a str,
+}
+
+/// The ONE place a non-zero `meridian` subprocess exit is logged.
+///
+/// # Why this is not three inline `warn!`s
+/// It used to be: this module, [`crate::commands::parents`] and
+/// [`crate::commands::triage`] each spliced the child's stderr straight into the
+/// message body (`"{label} non-zero: {msg}"`). A log **body** always ships - it
+/// is the record - so it is the one field `telemetry_spool::redact`'s attribute
+/// allowlist cannot reach, and subprocess stderr is unbounded third-party text:
+/// a Jira 404 body, a provider API error, a DB error. Issue #872 measured a real
+/// user's ticket key (`ENG-7041`) in central OpenObserve, arriving through
+/// exactly this splice, from a key the allowlist denies as an attribute.
+///
+/// So the body is now static and the stderr rides on `stderr_tail`, which is
+/// deliberately **not** on `redact::SAFE_STRING_KEYS`. That is the two-tier
+/// design working as intended rather than a diagnostic being thrown away:
+/// unallowlisted attributes are captured at full fidelity locally (`meridian
+/// logs` renders attributes, and export bundles carry the raw spool) and dropped
+/// on the ship leg. The engineer debugging their own machine loses nothing; the
+/// central backend stops receiving the user's content.
+///
+/// `code` is passed as `i64` on purpose. It used to be `code = ?…`, which
+/// debug-formats an `Option` into the string `"Some(1)"` - not a bare number, so
+/// `redact::is_bare_number` could not rescue it and the exit code was dropped
+/// from every shipped record. An `IntValue` is kept unconditionally for any key
+/// ([`meridian::telemetry_spool::redact`]'s first `keep_attribute` arm), so this
+/// change also *restores* a diagnostic the previous form silently lost.
+pub(crate) fn log_non_zero_exit(ctx: NonZeroExit<'_>) {
+    let NonZeroExit {
+        label,
+        bin,
+        provider,
+        key,
+        code,
+        stderr,
+    } = ctx;
+    tracing::warn!(
+        bin = bin.unwrap_or(""),
+        bin_source = bin.map(crate::install::bin_source).unwrap_or(""),
+        provider = provider.unwrap_or(""),
+        key = key.unwrap_or(""),
+        // `-1` for "signalled, no exit code" - `Option` would stringify.
+        code = code.unwrap_or(-1) as i64,
+        stderr_len = stderr.len() as i64,
+        stderr_tail = %tail(stderr, 400),
+        "{label} non-zero"
+    );
+}
+
 /// Spawn `meridian <args…>` detached — no timeout, not awaited. For work that can
 /// far outlive a reasonable invoke budget (an N-variant LLM experiment); the UI
 /// polls the DB for progress instead of holding the call. A background task waits
@@ -215,135 +287,5 @@ pub(crate) async fn run_meridian_json<T: for<'de> Deserialize<'de>>(
 }
 
 #[cfg(test)]
-mod tests {
-    use std::process::Stdio;
-    use std::time::Duration;
-
-    /// Regression guard: on a timeout, `tokio::time::timeout` drops the
-    /// `.output()` future, and without `kill_on_drop(true)` the spawned
-    /// `meridian <args>` keeps running in the background after the caller has
-    /// already reported failure to the user. For an LLM-backed call like
-    /// `plan-task-draft`, that orphan then competes with the next "Try again"
-    /// click's fresh process for the same provider/DB — a plausible reason a
-    /// draft that missed its 150s budget once keeps missing it on retry.
-    ///
-    /// This can't drive `run_meridian` itself as a real spawn-and-verify test:
-    /// it resolves its binary via `crate::install::meridian_bin()`, and
-    /// overriding that via `MERIDIAN_BIN` would mean `std::env::set_var` on a
-    /// shared test binary — exactly what `integrations.rs`'s "avoiding
-    /// `std::env::set_var` on a Tokio worker thread" note warns off. So this
-    /// is source-scanned, mirroring `tasks.rs::sync_tasks`, the sibling call
-    /// site that already carries this fix. The MECHANISM itself — that
-    /// `kill_on_drop(true)` actually terminates an orphaned child, on this
-    /// platform, with tokio's real process reaping — is verified separately
-    /// below, against a plain `tokio::process::Command` that needs no
-    /// `MERIDIAN_BIN` override at all.
-    #[test]
-    fn run_meridian_kills_the_child_on_timeout() {
-        let src = include_str!("cli_exec.rs");
-        let prod = src.split_once("\n#[cfg(test)]").map_or(src, |(a, _)| a);
-        let spawn = prod
-            .find("tokio::process::Command::new(&bin)")
-            .expect("run_meridian's Command builder moved or was renamed");
-        let output_call = prod[spawn..]
-            .find(".output();")
-            .expect("run_meridian's Command builder no longer ends in .output()");
-        let builder = &prod[spawn..spawn + output_call];
-        assert!(
-            builder.contains(".kill_on_drop(true)"),
-            "run_meridian's spawned child is missing .kill_on_drop(true) — a \
-             timeout will orphan it instead of killing it. Builder was: {builder}"
-        );
-    }
-
-    /// A process that runs far longer than the timeout below, so the timeout
-    /// always wins the race — the exact shape `run_meridian` puts its child
-    /// in. No dependency on `meridian`/`MERIDIAN_BIN`: `sleep`/`ping` are
-    /// present on every macOS and Windows runner this crate's tests run on
-    /// (see `.github/workflows/ci.yml`'s `windows-latest` + `macos-latest`
-    /// `cargo test --workspace` jobs).
-    #[cfg(unix)]
-    fn long_running_command() -> (&'static str, &'static [&'static str]) {
-        ("sleep", &["30"])
-    }
-    #[cfg(windows)]
-    fn long_running_command() -> (&'static str, &'static [&'static str]) {
-        // `timeout.exe` refuses to run with stdin redirected (no console
-        // handle) — `ping` to loopback is the standard "sleep N seconds"
-        // substitute on Windows and needs no real network.
-        ("ping", &["-n", "30", "127.0.0.1"])
-    }
-
-    #[cfg(unix)]
-    fn process_is_alive(pid: u32) -> bool {
-        std::process::Command::new("ps")
-            .args(["-p", &pid.to_string()])
-            .output()
-            .map(|o| o.status.success())
-            .unwrap_or(false)
-    }
-    #[cfg(windows)]
-    fn process_is_alive(pid: u32) -> bool {
-        // `tasklist` exits 0 either way, printing "No tasks are running..."
-        // when nothing matches — the pid has to actually appear in the
-        // output, not just a success status.
-        std::process::Command::new("tasklist")
-            .args(["/FI", &format!("PID eq {pid}"), "/NH"])
-            .output()
-            .map(|o| String::from_utf8_lossy(&o.stdout).contains(&pid.to_string()))
-            .unwrap_or(false)
-    }
-
-    /// Proves the MECHANISM `run_meridian_kills_the_child_on_timeout` pins the
-    /// wiring for: that `kill_on_drop(true)` on a `tokio::process::Command`
-    /// actually terminates the child once the future racing it is dropped —
-    /// i.e. that this fix does what its own reasoning claims, not just that
-    /// the flag is textually present.
-    #[tokio::test]
-    async fn kill_on_drop_actually_terminates_the_orphaned_child() {
-        let (bin, args) = long_running_command();
-        let child = tokio::process::Command::new(bin)
-            .args(args)
-            .stdin(Stdio::null())
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped())
-            .kill_on_drop(true)
-            .spawn()
-            .expect("failed to spawn the long-running test process");
-        let pid = child.id().expect("a just-spawned child must have a pid");
-        assert!(
-            process_is_alive(pid),
-            "test bug: process not observed alive right after spawn"
-        );
-
-        {
-            // Mirrors `run_meridian` exactly: race the child's `.output()`
-            // against a timeout far shorter than the process's own runtime.
-            let output_fut = child.wait_with_output();
-            let result = tokio::time::timeout(Duration::from_millis(50), output_fut).await;
-            assert!(
-                result.is_err(),
-                "test bug: the process exited before the timeout could fire"
-            );
-            // `output_fut` (and the `Child` it consumed) drops here — exactly
-            // what happens when `tokio::time::timeout` drops `run_meridian`'s
-            // `.output()` future on a real timeout.
-        }
-
-        // `kill_on_drop`'s kill is fired from `Drop`, not awaited to
-        // completion — poll briefly rather than asserting instantaneously.
-        let mut still_alive = process_is_alive(pid);
-        for _ in 0..20 {
-            if !still_alive {
-                break;
-            }
-            tokio::time::sleep(Duration::from_millis(100)).await;
-            still_alive = process_is_alive(pid);
-        }
-        assert!(
-            !still_alive,
-            "child (pid {pid}) is still running ~2s after being dropped — \
-             kill_on_drop did not terminate it"
-        );
-    }
-}
+#[path = "cli_exec_tests.rs"]
+mod tests;
diff --git a/tray/src-tauri/src/commands/cli_exec_tests.rs b/tray/src-tauri/src/commands/cli_exec_tests.rs
new file mode 100644
index 000000000..ff2f85a16
--- /dev/null
+++ b/tray/src-tauri/src/commands/cli_exec_tests.rs
@@ -0,0 +1,274 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Tests for [`super`] - split out to keep `cli_exec.rs` under the 500-line
+//! rule. Attached with `#[path]` rather than a `cli_exec/` directory so the
+//! `include_str!("cli_exec.rs")` source scan below keeps resolving against the
+//! same directory.
+use super::{log_non_zero_exit, NonZeroExit};
+use std::process::Stdio;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+use tracing_subscriber::{layer::SubscriberExt, registry, Layer};
+
+/// One captured tracing event: level, message body, and `(field, value)`
+/// pairs. Mirrors `commands::setup`'s recorder, which exists for the same
+/// reason - `telemetry_spool::redact` filters on the EXACT field name, so a
+/// test that only asserted "the stderr is logged somewhere" would pass
+/// whether it landed in the body (always ships) or an unallowlisted
+/// attribute (never ships), which is the entire distinction under test.
+#[derive(Debug)]
+struct CapturedEvent {
+    message: String,
+    fields: Vec<(String, String)>,
+}
+
+struct Recorder(Arc<Mutex<Vec<CapturedEvent>>>);
+
+impl<S: tracing::Subscriber> Layer<S> for Recorder {
+    fn on_event(&self, event: &tracing::Event<'_>, _c: tracing_subscriber::layer::Context<'_, S>) {
+        struct V(Vec<(String, String)>);
+        impl tracing::field::Visit for V {
+            fn record_debug(&mut self, f: &tracing::field::Field, v: &dyn std::fmt::Debug) {
+                self.0.push((f.name().to_string(), format!("{v:?}")));
+            }
+        }
+        let mut v = V(Vec::new());
+        event.record(&mut v);
+        // `tracing` records the formatted message body under the reserved
+        // field name `message`; everything else is a structured attribute.
+        let message =
+            v.0.iter()
+                .find(|(k, _)| k == "message")
+                .map(|(_, val)| val.clone())
+                .unwrap_or_default();
+        let fields = v.0.into_iter().filter(|(k, _)| k != "message").collect();
+        self.0
+            .lock()
+            .unwrap()
+            .push(CapturedEvent { message, fields });
+    }
+}
+
+/// Run `f` under a bare recording subscriber (no `EnvFilter`, so level is
+/// irrelevant) and return what it emitted. Drains through the `Mutex`
+/// rather than `Arc::try_unwrap` - see `commands::setup::capture`'s note on
+/// the Windows CI flake that caused.
+fn capture(f: impl FnOnce()) -> Vec<CapturedEvent> {
+    let seen = Arc::new(Mutex::new(Vec::new()));
+    let subscriber = registry().with(Recorder(Arc::clone(&seen)));
+    tracing::subscriber::with_default(subscriber, f);
+    let events = std::mem::take(&mut *seen.lock().unwrap());
+    events
+}
+
+/// The measured leak from issue #872, verbatim: a real user's ticket key
+/// reached central OpenObserve inside a WARN body, because the tray spliced
+/// the `meridian` subprocess's stderr into the message. `task_key` is denied
+/// as an attribute and pinned so by
+/// `redact::user_scoped_diagnostic_keys_stay_off_the_allowlist` - but the
+/// body is not an attribute, so the allowlist never saw it.
+const MEASURED_STDERR: &str = "Jira GET transitions for ENG-7041 returned 404 Not Found:         {\"errorMessages\":[\"Issue does not exist or you do not have permission to see it.\"]}";
+
+/// The regression this whole change exists for.
+///
+/// Asserts BOTH halves, because either one alone is satisfiable by a bad
+/// fix: the ticket key must not be in the body (or it ships), AND the
+/// stderr must still be captured under `stderr_tail` (or we have repeated
+/// #867 in the opposite direction and deleted the only record the failure
+/// leaves on the engineer's own machine).
+#[test]
+fn a_non_zero_exit_keeps_subprocess_stderr_out_of_the_message_body() {
+    let events = capture(|| {
+        log_non_zero_exit(NonZeroExit {
+            label: "ticket-statuses",
+            bin: Some("/Users/someone/.meridian/bin/meridian"),
+            provider: Some("jira"),
+            key: Some("ENG-7041"),
+            code: Some(1),
+            stderr: MEASURED_STDERR,
+        })
+    });
+    let e = events.first().expect("log_non_zero_exit emitted no event");
+
+    assert!(
+        !e.message.contains("ENG-7041"),
+        "the user's ticket key is in the log BODY, which always ships - \
+             redact's attribute allowlist cannot reach it. Body was: {}",
+        e.message
+    );
+    assert!(
+        !e.message.contains("Issue does not exist"),
+        "the provider's error payload is in the log BODY. Body was: {}",
+        e.message
+    );
+    assert!(
+        e.message.contains("ticket-statuses"),
+        "the body must still name WHICH subcommand failed. Body was: {}",
+        e.message
+    );
+
+    let tail = e
+        .fields
+        .iter()
+        .find(|(k, _)| k == "stderr_tail")
+        .map(|(_, v)| v.as_str())
+        .expect(
+            "stderr is no longer captured at all - it must move to an \
+                 unallowlisted ATTRIBUTE, not disappear",
+        );
+    assert!(
+        tail.contains("ENG-7041"),
+        "stderr_tail lost the diagnostic it exists to carry: {tail}"
+    );
+}
+
+/// `stderr_tail` must stay OFF `redact::SAFE_STRING_KEYS`, or moving the
+/// stderr out of the body accomplishes nothing - it would ship under its new
+/// name instead. Pinning it here rather than trusting the reader to
+/// remember: the fix above is only a fix while this holds.
+#[test]
+fn the_key_the_stderr_moved_to_is_not_allowlisted_for_egress() {
+    let redact = include_str!("../../../../src/telemetry_spool/redact.rs");
+    let allowlist = redact
+        .split_once("const SAFE_STRING_KEYS")
+        .expect("SAFE_STRING_KEYS was renamed - this guard no longer reads it")
+        .1
+        .split_once("\n];")
+        .expect("SAFE_STRING_KEYS list terminator moved")
+        .0;
+    for key in ["stderr_tail", "key", "bin"] {
+        assert!(
+            !allowlist.contains(&format!("\"{key}\"")),
+            "`{key}` was added to redact::SAFE_STRING_KEYS, so the stderr / \
+                 ticket key / home-directory path this module deliberately keeps \
+                 local now egresses. See log_non_zero_exit's doc (#872)."
+        );
+    }
+}
+
+/// Regression guard: on a timeout, `tokio::time::timeout` drops the
+/// `.output()` future, and without `kill_on_drop(true)` the spawned
+/// `meridian <args>` keeps running in the background after the caller has
+/// already reported failure to the user. For an LLM-backed call like
+/// `plan-task-draft`, that orphan then competes with the next "Try again"
+/// click's fresh process for the same provider/DB — a plausible reason a
+/// draft that missed its 150s budget once keeps missing it on retry.
+///
+/// This can't drive `run_meridian` itself as a real spawn-and-verify test:
+/// it resolves its binary via `crate::install::meridian_bin()`, and
+/// overriding that via `MERIDIAN_BIN` would mean `std::env::set_var` on a
+/// shared test binary — exactly what `integrations.rs`'s "avoiding
+/// `std::env::set_var` on a Tokio worker thread" note warns off. So this
+/// is source-scanned, mirroring `tasks.rs::sync_tasks`, the sibling call
+/// site that already carries this fix. The MECHANISM itself — that
+/// `kill_on_drop(true)` actually terminates an orphaned child, on this
+/// platform, with tokio's real process reaping — is verified separately
+/// below, against a plain `tokio::process::Command` that needs no
+/// `MERIDIAN_BIN` override at all.
+#[test]
+fn run_meridian_kills_the_child_on_timeout() {
+    let src = include_str!("cli_exec.rs");
+    let prod = src.split_once("\n#[cfg(test)]").map_or(src, |(a, _)| a);
+    let spawn = prod
+        .find("tokio::process::Command::new(&bin)")
+        .expect("run_meridian's Command builder moved or was renamed");
+    let output_call = prod[spawn..]
+        .find(".output();")
+        .expect("run_meridian's Command builder no longer ends in .output()");
+    let builder = &prod[spawn..spawn + output_call];
+    assert!(
+        builder.contains(".kill_on_drop(true)"),
+        "run_meridian's spawned child is missing .kill_on_drop(true) — a \
+             timeout will orphan it instead of killing it. Builder was: {builder}"
+    );
+}
+
+/// A process that runs far longer than the timeout below, so the timeout
+/// always wins the race — the exact shape `run_meridian` puts its child
+/// in. No dependency on `meridian`/`MERIDIAN_BIN`: `sleep`/`ping` are
+/// present on every macOS and Windows runner this crate's tests run on
+/// (see `.github/workflows/ci.yml`'s `windows-latest` + `macos-latest`
+/// `cargo test --workspace` jobs).
+#[cfg(unix)]
+fn long_running_command() -> (&'static str, &'static [&'static str]) {
+    ("sleep", &["30"])
+}
+#[cfg(windows)]
+fn long_running_command() -> (&'static str, &'static [&'static str]) {
+    // `timeout.exe` refuses to run with stdin redirected (no console
+    // handle) — `ping` to loopback is the standard "sleep N seconds"
+    // substitute on Windows and needs no real network.
+    ("ping", &["-n", "30", "127.0.0.1"])
+}
+
+#[cfg(unix)]
+fn process_is_alive(pid: u32) -> bool {
+    std::process::Command::new("ps")
+        .args(["-p", &pid.to_string()])
+        .output()
+        .map(|o| o.status.success())
+        .unwrap_or(false)
+}
+#[cfg(windows)]
+fn process_is_alive(pid: u32) -> bool {
+    // `tasklist` exits 0 either way, printing "No tasks are running..."
+    // when nothing matches — the pid has to actually appear in the
+    // output, not just a success status.
+    std::process::Command::new("tasklist")
+        .args(["/FI", &format!("PID eq {pid}"), "/NH"])
+        .output()
+        .map(|o| String::from_utf8_lossy(&o.stdout).contains(&pid.to_string()))
+        .unwrap_or(false)
+}
+
+/// Proves the MECHANISM `run_meridian_kills_the_child_on_timeout` pins the
+/// wiring for: that `kill_on_drop(true)` on a `tokio::process::Command`
+/// actually terminates the child once the future racing it is dropped —
+/// i.e. that this fix does what its own reasoning claims, not just that
+/// the flag is textually present.
+#[tokio::test]
+async fn kill_on_drop_actually_terminates_the_orphaned_child() {
+    let (bin, args) = long_running_command();
+    let child = tokio::process::Command::new(bin)
+        .args(args)
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .kill_on_drop(true)
+        .spawn()
+        .expect("failed to spawn the long-running test process");
+    let pid = child.id().expect("a just-spawned child must have a pid");
+    assert!(
+        process_is_alive(pid),
+        "test bug: process not observed alive right after spawn"
+    );
+
+    {
+        // Mirrors `run_meridian` exactly: race the child's `.output()`
+        // against a timeout far shorter than the process's own runtime.
+        let output_fut = child.wait_with_output();
+        let result = tokio::time::timeout(Duration::from_millis(50), output_fut).await;
+        assert!(
+            result.is_err(),
+            "test bug: the process exited before the timeout could fire"
+        );
+        // `output_fut` (and the `Child` it consumed) drops here — exactly
+        // what happens when `tokio::time::timeout` drops `run_meridian`'s
+        // `.output()` future on a real timeout.
+    }
+
+    // `kill_on_drop`'s kill is fired from `Drop`, not awaited to
+    // completion — poll briefly rather than asserting instantaneously.
+    let mut still_alive = process_is_alive(pid);
+    for _ in 0..20 {
+        if !still_alive {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        still_alive = process_is_alive(pid);
+    }
+    assert!(
+        !still_alive,
+        "child (pid {pid}) is still running ~2s after being dropped — \
+             kill_on_drop did not terminate it"
+    );
+}
diff --git a/tray/src-tauri/src/commands/parents.rs b/tray/src-tauri/src/commands/parents.rs
index cc5073781..a6f2a59b9 100644
--- a/tray/src-tauri/src/commands/parents.rs
+++ b/tray/src-tauri/src/commands/parents.rs
@@ -102,9 +102,19 @@ pub async fn get_ticket_parents(provider: String, key: String) -> ParentsRespons
         let msg = if stderr.is_empty() {
             format!("exited {:?}", output.status.code())
         } else {
-            stderr
+            stderr.clone()
         };
-        tracing::warn!(%provider, %key, "ticket-parents non-zero: {msg}");
+        // Static body + `stderr_tail`, NOT `"…non-zero: {msg}"`. The stderr here
+        // is a tracker's error payload and routinely contains the ticket key -
+        // see `cli_exec::log_non_zero_exit` and issue #872.
+        crate::commands::cli_exec::log_non_zero_exit(crate::commands::cli_exec::NonZeroExit {
+            label: "ticket-parents",
+            bin: Some(bin.as_str()),
+            provider: Some(&provider),
+            key: Some(&key),
+            code: output.status.code(),
+            stderr: &stderr,
+        });
         return ParentsResponse::failure(msg);
     }
 
diff --git a/tray/src-tauri/src/commands/triage.rs b/tray/src-tauri/src/commands/triage.rs
index 21941d880..c9a0aa145 100644
--- a/tray/src-tauri/src/commands/triage.rs
+++ b/tray/src-tauri/src/commands/triage.rs
@@ -260,9 +260,17 @@ pub async fn apply_ticket_fix(body: ApplyBody) -> Result<ApplyResponse, String>
         let msg = if stderr.is_empty() {
             format!("ticket-update exited {:?}", output.status.code())
         } else {
-            stderr
+            stderr.clone()
         };
-        tracing::warn!("ticket-update non-zero: {msg}");
+        // Static body + `stderr_tail` - see `cli_exec::log_non_zero_exit` (#872).
+        crate::commands::cli_exec::log_non_zero_exit(crate::commands::cli_exec::NonZeroExit {
+            label: "ticket-update",
+            bin: Some(bin.as_str()),
+            provider: Some(&body.provider),
+            key: Some(&body.key),
+            code: output.status.code(),
+            stderr: &stderr,
+        });
         return Err(msg);
     }
 
diff --git a/tray/src-tauri/src/lib.rs b/tray/src-tauri/src/lib.rs
index 830fdc9a2..eb5105227 100644
--- a/tray/src-tauri/src/lib.rs
+++ b/tray/src-tauri/src/lib.rs
@@ -133,8 +133,14 @@ fn catch_setup_panic<T>(what: &str, f: impl FnOnce() -> T + std::panic::UnwindSa
                 .map(|s| s.to_string())
                 .or_else(|| payload.downcast_ref::<String>().cloned())
                 .unwrap_or_else(|| "non-string panic payload".to_string());
+            // `panic_msg`, not `msg`: `errors.rs::no_user_data_interpolated_into_a_log_body`
+            // allows exactly three identifiers into a WARN+ body and this is one of
+            // them, named so the exemption is legible at the call site. A panic
+            // payload is our own `expect`/`panic!` text, not a subprocess's or a
+            // provider's output - the distinction that guard exists to force.
+            let panic_msg = msg;
             tracing::error!(
-                "tray setup panicked during {what}: {msg} — degrading to a disabled state instead of crashing the tray"
+                "tray setup panicked during {what}: {panic_msg} — degrading to a disabled state instead of crashing the tray"
             );
             None
         }

From e5dc92fa272f0330b363f58ede0e2d8e32578036 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Thu, 27 Aug 2026 20:44:40 +0530
Subject: [PATCH 25/53] fix(telemetry): close three coverage holes in the
 log-body lint

Found by reviewing the guard against the claim privacy.md now makes for it.

1. The scan truncated each file at its first `#[cfg(test)]`, the idiom inherited
   from `no_bare_error_display_in_db_paths`. On a whole-tree scan that is
   silently catastrophic: everything after the first test module is discarded,
   including the real code below it. Measured - tray/src-tauri/src/lib.rs was
   scanned at 6.6% of its bytes, and jira/mod.rs at 2%, because a bare
   `#[cfg(test)] mod tests;` DECLARATION on line 15 truncated the file. Replaced
   with brace-balanced `strip_test_modules`; reachable macro sites 493 -> 526.

2. `offenders.is_empty()` passes when the scan finds NOTHING, so a parse
   regression would switch the guard off without failing it - exactly how hole 1
   stayed invisible. MIN_MACRO_SITES pins the parse the way the file-count
   assert already pinned the walk, counted in the same loop so the two cannot
   drift.

3. privacy.md said "a build fails if any warning or error message formats a
   value into its text", but positional `{}` was out of scope, so
   `warn!("failed for {}", ticket_key)` passed. Deferring it to
   `no_bare_error_display_in_db_paths` would not have worked - that scan's own
   doc scopes it to five DB files. There are zero positional WARN+ bodies in the
   tree, so it is enforced instead and the sentence is now true.

Also: `provider` is allowlisted and ships, but arrives at the tray as an
unvalidated String from the frontend, so the allowlist's "fixed internal set"
premise rested on the frontend behaving. `provider_label` narrows it to the six
tracker literals or "other", the same shape as `install::bin_source`. The
SAFE_STRING_KEYS comment described only the LLM-engine domain while parents.rs
was already emitting tracker names - now names both.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 src/log_hygiene.rs                            | 195 ++++++++++++++++--
 src/telemetry_spool/redact.rs                 |  16 +-
 tray/src-tauri/src/commands/cli_exec.rs       |  29 ++-
 tray/src-tauri/src/commands/cli_exec_tests.rs |  49 +++++
 4 files changed, 266 insertions(+), 23 deletions(-)

diff --git a/src/log_hygiene.rs b/src/log_hygiene.rs
index bbf9ec8b9..cb8636ca1 100644
--- a/src/log_hygiene.rs
+++ b/src/log_hygiene.rs
@@ -113,11 +113,7 @@ mod tests {
                     })
                 {
                     if let Ok(src) = std::fs::read_to_string(&p) {
-                        let prod = src
-                            .split_once("\n#[cfg(test)]")
-                            .map_or(src.as_str(), |(a, _)| a)
-                            .to_string();
-                        out.push((p.display().to_string(), prod));
+                        out.push((p.display().to_string(), strip_test_modules(&src)));
                     }
                 }
             }
@@ -139,10 +135,97 @@ mod tests {
         out
     }
 
+    /// Remove `#[cfg(test)] mod … { … }` BLOCKS, brace-balanced, and nothing
+    /// else.
+    ///
+    /// # Why not truncate at the first `#[cfg(test)]`
+    /// That is the older idiom (`errors.rs::no_bare_error_display_in_db_paths`
+    /// still uses it) and it is silently catastrophic for a whole-tree scan:
+    /// everything after the FIRST test module is discarded, including the real
+    /// code below it. Measured on this tree before the change -
+    /// `tray/src-tauri/src/lib.rs` was scanned at 6.6% of its bytes (a test
+    /// module sits at line 150 of 1915), and `intelligence/providers/jira/mod.rs`
+    /// at 2%, because a bare `#[cfg(test)] mod tests;` DECLARATION on line 15
+    /// truncated the file. A declaration points at a separate file, which the
+    /// walk already skips by name, so it must not truncate anything at all.
+    ///
+    /// The scan would still have passed - just over a fraction of the codebase.
+    /// That is the failure mode `SCANNED_TREES`'s file-count assert and
+    /// `MIN_MACRO_SITES` below both exist to make loud.
+    fn strip_test_modules(src: &str) -> String {
+        const MARKER: &str = "#[cfg(test)]";
+        let mut out = String::with_capacity(src.len());
+        let mut rest = src;
+        while let Some(i) = rest.find(MARKER) {
+            let after = &rest[i + MARKER.len()..];
+            // `#[cfg(test)] mod name { … }` - only a BLOCK is stripped. A `;`
+            // declaration, or the attribute on a fn/const/use, is kept.
+            let Some(brace) = after.find('{') else {
+                out.push_str(&rest[..i + MARKER.len()]);
+                rest = after;
+                continue;
+            };
+            let head = &after[..brace];
+            if !head.trim_start().starts_with("mod ") || head.contains(';') {
+                out.push_str(&rest[..i + MARKER.len()]);
+                rest = after;
+                continue;
+            }
+            out.push_str(&rest[..i]);
+            // Balance braces from the module's opening one, ignoring string
+            // literals and line comments (both can contain a stray brace).
+            let body: Vec<char> = after[brace..].chars().collect();
+            let (mut depth, mut k) = (0usize, 0usize);
+            let (mut in_str, mut esc, mut in_comment) = (false, false, false);
+            while k < body.len() {
+                let c = body[k];
+                if in_comment {
+                    if c == '\n' {
+                        in_comment = false;
+                    }
+                } else if in_str {
+                    if esc {
+                        esc = false;
+                    } else if c == '\\' {
+                        esc = true;
+                    } else if c == '"' {
+                        in_str = false;
+                    }
+                } else if c == '"' {
+                    in_str = true;
+                } else if c == '/' && body.get(k + 1) == Some(&'/') {
+                    in_comment = true;
+                } else if c == '{' {
+                    depth += 1;
+                } else if c == '}' {
+                    depth -= 1;
+                    if depth == 0 {
+                        k += 1;
+                        break;
+                    }
+                }
+                k += 1;
+            }
+            let consumed: usize = body[..k].iter().map(|c| c.len_utf8()).sum();
+            rest = &after[brace + consumed..];
+        }
+        out.push_str(rest);
+        out
+    }
+
     /// Every `{ident}` interpolated into the message body of a `tracing::warn!`
     /// or `tracing::error!` in `src`, with its line number.
     fn interpolated_body_idents(src: &str) -> Vec<(usize, String, String)> {
+        scan_bodies(src).1
+    }
+
+    /// [`interpolated_body_idents`] plus the number of WARN+/ERROR macro sites
+    /// the parser REACHED. The count comes out of the same loop on purpose - a
+    /// separate counting fn could drift from the real scan, and then
+    /// `MIN_MACRO_SITES` would be measuring something the guard does not use.
+    fn scan_bodies(src: &str) -> (usize, Vec<(usize, String, String)>) {
         let mut found = Vec::new();
+        let mut reached = 0usize;
         // Matched WITHOUT the `tracing::` prefix on purpose: 14 sites in
         // `etl/` and `capture/` import the macro (`use tracing::warn`) and call
         // it bare, and a scan anchored on the qualified spelling would have read
@@ -168,6 +251,7 @@ mod tests {
                 let Some(open) = src[start..].find('(').map(|i| start + i) else {
                     continue;
                 };
+                reached += 1;
                 // Balance parens, ignoring anything inside a string literal.
                 let (mut depth, mut i) = (0usize, open);
                 let (mut in_str, mut esc) = (false, false);
@@ -208,11 +292,21 @@ mod tests {
                 }
             }
         }
-        found
+        (reached, found)
     }
 
     /// The last `"…"` literal in a macro argument list, unescaped enough to read
-    /// its `{}` placeholders.
+    /// its `{}` placeholders - `tracing`'s own rule for which literal is the
+    /// message.
+    ///
+    /// # Residual, stated
+    /// A message followed by a string-literal ARGUMENT
+    /// (`warn!("dropped {n} for {}", "unknown")`) resolves to the argument, so
+    /// that site's real message goes unscanned. No such site exists in the tree
+    /// today (473 of 493 macro sites parse a message; the other 20 carry no
+    /// literal at all). Scanning every literal instead would false-positive on
+    /// a non-message field value, which is the worse trade for a shape that
+    /// does not occur.
     fn last_string_literal(args: &str) -> Option<String> {
         let chars: Vec<char> = args.chars().collect();
         let (mut i, mut last) = (0usize, None);
@@ -240,10 +334,20 @@ mod tests {
         last
     }
 
-    /// Named `{ident}` captures in a format string. Positional `{}` / `{:?}` are
-    /// out of scope: they take their value from a trailing argument, and
-    /// `no_bare_error_display_in_db_paths` already covers the `%e` case that
-    /// produces in practice.
+    /// What a positional `{}` / `{:?}` is reported as. It has no name to print,
+    /// but it is exactly as dangerous - `warn!("failed for {}", ticket_key)`
+    /// ships the key just as surely as `"failed for {ticket_key}"` does.
+    ///
+    /// It is enforced rather than deferred because there are currently ZERO of
+    /// them in a WARN+/ERROR body across all four trees, so the rule costs
+    /// nothing to hold and `docs/privacy.md` can state it to users without
+    /// qualification. Deferring it to `no_bare_error_display_in_db_paths` (the
+    /// earlier plan) would not have worked: that scan's own doc scopes it to
+    /// five DB files and explicitly leaves ~120 sites elsewhere uncovered.
+    const POSITIONAL: &str = "<positional argument>";
+
+    /// Every placeholder in a format string: named `{ident}` captures by name,
+    /// and positional `{}` / `{:?}` as [`POSITIONAL`].
     fn placeholders(msg: &str) -> Vec<String> {
         let mut out = Vec::new();
         let chars: Vec<char> = msg.chars().collect();
@@ -260,12 +364,15 @@ mod tests {
                     name.push(chars[j]);
                     j += 1;
                 }
-                // Only a NAMED capture: `{x}` or `{x:?}`, not `{}` or `{:?}`.
-                if !name.is_empty()
-                    && !name.starts_with(|c: char| c.is_ascii_digit())
-                    && matches!(chars.get(j), Some('}') | Some(':'))
-                {
+                let closes = matches!(chars.get(j), Some('}') | Some(':'));
+                if !name.is_empty() && !name.starts_with(|c: char| c.is_ascii_digit()) && closes {
+                    // A NAMED capture: `{x}` or `{x:?}`.
                     out.push(name);
+                } else if closes {
+                    // `{}`, `{:?}`, `{0}` - the value comes from a trailing
+                    // argument, which the scan cannot see. Reported all the
+                    // same; see `POSITIONAL`.
+                    out.push(POSITIONAL.to_string());
                 }
                 i = j;
             } else {
@@ -279,11 +386,28 @@ mod tests {
     /// allowlist cannot reach - so nothing runtime-valued may be formatted into
     /// it. See [`INTERPOLABLE`] for the full reasoning and issue #872 for the
     /// leak that prompted this.
+    /// A floor on how many WARN+/ERROR macro sites the parser actually REACHES.
+    ///
+    /// `offenders.is_empty()` passes when the scan finds nothing, so a
+    /// regression in the paren balancing, the literal extraction, or
+    /// [`strip_test_modules`] would turn this guard off without failing it -
+    /// which is precisely how the truncation bug documented on
+    /// `strip_test_modules` hid a 94% coverage loss on one file. The file-count
+    /// assert in [`production_sources`] guards the walk; this guards the parse.
+    ///
+    /// Set well below the real count - 526 today, up from 493 before
+    /// [`strip_test_modules`] replaced the truncation - so ordinary deletions
+    /// don't trip it. Raise it if it ever does; do not lower it.
+    const MIN_MACRO_SITES: usize = 400;
+
     #[test]
     fn no_user_data_interpolated_into_a_log_body() {
         let mut offenders = Vec::new();
+        let mut reached = 0usize;
         for (path, src) in production_sources() {
-            for (line, ident, msg) in interpolated_body_idents(&src) {
+            let (sites, hits) = scan_bodies(&src);
+            reached += sites;
+            for (line, ident, msg) in hits {
                 if !INTERPOLABLE.contains(&ident.as_str()) {
                     offenders.push(format!("{path}:{line} - `{{{ident}}}` in \"{msg}\""));
                 }
@@ -302,6 +426,13 @@ mod tests {
              a compile-time literal at every call site, add it to `INTERPOLABLE` \
              with a justification. Offenders: {offenders:#?}"
         );
+        assert!(
+            reached >= MIN_MACRO_SITES,
+            "the scan reached only {reached} WARN+/ERROR macro sites, below the \
+             {MIN_MACRO_SITES} floor - the parse or the test-module stripping has \
+             regressed and this guard is now passing over a fraction of the \
+             codebase. See MIN_MACRO_SITES."
+        );
     }
 
     /// The scan above is only worth having if it actually catches the #872
@@ -345,13 +476,39 @@ mod tests {
             interpolated_body_idents(r#"// tracing::warn!("{msg}");"#).is_empty(),
             "a commented-out example was flagged"
         );
+
+        // `strip_test_modules` must remove a test module's BODY and nothing
+        // else. The `mod tests;` case is the one that silently truncated 98% of
+        // `jira/mod.rs` under the old `split_once` idiom.
+        let with_decl = "#[cfg(test)]\nmod tests;\nfn f() { warn!(\"x {y}\"); }";
+        assert!(
+            !interpolated_body_idents(&strip_test_modules(with_decl)).is_empty(),
+            "a `#[cfg(test)] mod tests;` DECLARATION truncated the rest of the file"
+        );
+        let with_block = "fn f() { warn!(\"a {p}\"); }\n#[cfg(test)]\nmod t {\n    warn!(\"b {q}\");\n}\nfn g() { warn!(\"c {r}\"); }";
+        let idents: Vec<String> = interpolated_body_idents(&strip_test_modules(with_block))
+            .into_iter()
+            .map(|(_, i, _)| i)
+            .collect();
+        assert!(
+            idents.contains(&"p".to_string()) && idents.contains(&"r".to_string()),
+            "code around a test module was stripped with it: {idents:?}"
+        );
+        assert!(
+            !idents.contains(&"q".to_string()),
+            "the test module's own body was scanned: {idents:?}"
+        );
         assert!(
             interpolated_body_idents(r#"fn my_error!(x) { "{msg}" }"#).is_empty(),
             "`my_error!` is a different macro and must not be scanned"
         );
+        // A positional placeholder is caught too - it has no name, but
+        // `warn!("failed for {}", ticket_key)` ships the key all the same.
         assert!(
-            interpolated_body_idents(r#"tracing::warn!(n = 1, "dropped {} rows", n);"#).is_empty(),
-            "a positional `{{}}` placeholder is out of scope - see `placeholders`"
+            interpolated_body_idents(r#"tracing::warn!(n = 1, "dropped {} rows", n);"#)
+                .iter()
+                .any(|(_, i, _)| i == POSITIONAL),
+            "a positional `{{}}` placeholder was not flagged - see `POSITIONAL`"
         );
         assert!(
             interpolated_body_idents(r#"tracing::warn!("100{{msg}} percent");"#).is_empty(),
diff --git a/src/telemetry_spool/redact.rs b/src/telemetry_spool/redact.rs
index d3b81b92e..ddbfec654 100644
--- a/src/telemetry_spool/redact.rs
+++ b/src/telemetry_spool/redact.rs
@@ -125,9 +125,19 @@ const SAFE_STRING_KEYS: &[&str] = &[
     // output, so it needs the full scrub, not just a path scrub.
     "error",
     // Which provider/engine a failure came from. Enum-like values from a fixed
-    // internal set (`claude`, `codex`, `anthropic`, `gemini`, …) — they name
-    // OUR components, never the user's data, and without them an LLM or
-    // summariser failure can't be attributed to a backend at all.
+    // internal set — they name OUR components, never the user's data, and
+    // without them an LLM or summariser failure can't be attributed to a
+    // backend at all.
+    //
+    // TWO value domains share this key, and the second is easy to miss: LLM
+    // engines (`claude`, `codex`, `anthropic`, `gemini`, …) AND task trackers
+    // (`jira`, `linear`, `github`, `azure_devops`, `asana`, `trello`), from the
+    // tray's `ticket-parents`/`ticket-update` shell-outs. That second domain
+    // reaches the tray as a plain `String` from the frontend, so
+    // `commands::cli_exec::provider_label` narrows it to those literals or
+    // `"other"` before it is logged. An allowlist entry whose comment does not
+    // describe all of its emitters is the exact shape of #872 - do not add a
+    // third domain here without naming it.
     "provider",
     "engine",
     // ── health checks (`crate::health::Report::log`) ─────────────────────────
diff --git a/tray/src-tauri/src/commands/cli_exec.rs b/tray/src-tauri/src/commands/cli_exec.rs
index 6b47eb560..b48ef2f48 100644
--- a/tray/src-tauri/src/commands/cli_exec.rs
+++ b/tray/src-tauri/src/commands/cli_exec.rs
@@ -170,6 +170,33 @@ pub(crate) struct NonZeroExit<'a> {
 /// from every shipped record. An `IntValue` is kept unconditionally for any key
 /// ([`meridian::telemetry_spool::redact`]'s first `keep_attribute` arm), so this
 /// change also *restores* a diagnostic the previous form silently lost.
+/// Map a tracker name onto a fixed set of literals, or `"other"`.
+///
+/// `provider` is on `redact::SAFE_STRING_KEYS` and therefore SHIPS, justified
+/// there as "enum-like values from a fixed internal set". At this call site the
+/// value arrives from the frontend as a plain `String` (`get_ticket_parents`'s
+/// and `apply_ticket_fix`'s parameters) and nothing between there and here
+/// validates it - so the allowlist's premise would have rested on the frontend
+/// behaving, which is not a property anyone can audit. Normalising here makes it
+/// structurally true instead, the same way `install::bin_source` can only ever
+/// return one of five literals.
+///
+/// Mirrors `meridian_core::canonical_task::Provider::as_str`. A name that falls
+/// through to `"other"` still says a tracker call failed, which is the whole
+/// diagnostic value; it just cannot smuggle a typed string onto the wire.
+fn provider_label(p: &str) -> &'static str {
+    match p {
+        "jira" => "jira",
+        "linear" => "linear",
+        "github" => "github",
+        "azure_devops" => "azure_devops",
+        "asana" => "asana",
+        "trello" => "trello",
+        "" => "",
+        _ => "other",
+    }
+}
+
 pub(crate) fn log_non_zero_exit(ctx: NonZeroExit<'_>) {
     let NonZeroExit {
         label,
@@ -182,7 +209,7 @@ pub(crate) fn log_non_zero_exit(ctx: NonZeroExit<'_>) {
     tracing::warn!(
         bin = bin.unwrap_or(""),
         bin_source = bin.map(crate::install::bin_source).unwrap_or(""),
-        provider = provider.unwrap_or(""),
+        provider = provider.map(provider_label).unwrap_or(""),
         key = key.unwrap_or(""),
         // `-1` for "signalled, no exit code" - `Option` would stringify.
         code = code.unwrap_or(-1) as i64,
diff --git a/tray/src-tauri/src/commands/cli_exec_tests.rs b/tray/src-tauri/src/commands/cli_exec_tests.rs
index ff2f85a16..53d39da22 100644
--- a/tray/src-tauri/src/commands/cli_exec_tests.rs
+++ b/tray/src-tauri/src/commands/cli_exec_tests.rs
@@ -121,6 +121,55 @@ fn a_non_zero_exit_keeps_subprocess_stderr_out_of_the_message_body() {
     );
 }
 
+/// `provider` SHIPS, so an unrecognised value must not reach the wire verbatim.
+/// It arrives here from the frontend as a plain `String` with nothing
+/// validating it - see `provider_label`.
+#[test]
+fn an_unrecognised_provider_is_narrowed_before_it_ships() {
+    fn shipped_provider(p: &str) -> String {
+        let events = capture(|| {
+            log_non_zero_exit(NonZeroExit {
+                label: "ticket-update",
+                bin: None,
+                provider: Some(p),
+                key: None,
+                code: Some(1),
+                stderr: "boom",
+            })
+        });
+        events[0]
+            .fields
+            .iter()
+            .find(|(k, _)| k == "provider")
+            .map(|(_, v)| v.clone())
+            .expect("provider field missing")
+    }
+
+    let shipped = shipped_provider("acme-internal-tracker-prod");
+    assert!(
+        !shipped.contains("acme-internal-tracker-prod"),
+        "an unvalidated provider name reached an ALLOWLISTED field: {shipped}"
+    );
+    assert!(shipped.contains("other"), "{shipped}");
+
+    // …while every real tracker still reports itself.
+    for p in [
+        "jira",
+        "linear",
+        "github",
+        "azure_devops",
+        "asana",
+        "trello",
+    ] {
+        let shipped = shipped_provider(p);
+        assert!(
+            shipped.contains(p),
+            "`{p}` was narrowed away - provider_label has drifted from \
+             meridian_core::canonical_task::Provider::as_str: {shipped}"
+        );
+    }
+}
+
 /// `stderr_tail` must stay OFF `redact::SAFE_STRING_KEYS`, or moving the
 /// stderr out of the body accomplishes nothing - it would ship under its new
 /// name instead. Pinning it here rather than trusting the reader to

From 97284c30de54bb02752803d3797712673b0b5667 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Thu, 27 Aug 2026 21:42:33 +0530
Subject: [PATCH 26/53] fix(intelligence): sync PM tasks on demand instead of
 on a timer

Production users kept hitting a permanent `refresh_token is invalid` Jira
disconnect. The cause was the background sync timer, not the network.

macOS dark-wakes a sleeping machine every 15-16 minutes. The daemon
resumed, found the OAuth access token expired, and POSTed a refresh;
Atlassian rotated the refresh token and replied; the machine re-suspended
before the response was read. reqwest's timeout could not cancel it - the
timeout is Instant-based and the monotonic clock does not advance while
the system is asleep, so the request simply hung. On the next dark wake
the socket was dead and the retry went out with the OLD refresh token, by
then past Atlassian's 10-minute reuse leeway: `invalid_grant`, classified
terminal, grant dead forever.

The dark-wake interval is LONGER than the leeway, which is why no retry
policy fixes this from inside the daemon. A sleeping machine has no work
to do, so it must attempt no token refreshes. That is the whole change.

Removed
* The every-tick `run_pm_sync` in the daemon poll loop.
* The one-time startup pass. launchd KeepAlive restarts the daemon on
  every wake, so sync-on-boot is a wake-triggered refresh in disguise.

Added, all of them things a PRESENT user did
* `meridian pm-sync` - a gated CLI sibling of `tasks-sync`.
* Dashboard opened (popover button, notification click, tray menu) ->
  gated background sync. Not hung off the dashboard's own read commands:
  TasksPanel polls `get_tasks` every 60s and OverviewPanel `get_plan`
  every 30s, so attaching it there would have recreated the timer inside
  the tray's read path.
* Tracker connected (API token, loopback OAuth, GitHub device flow) ->
  FORCED sync. Forced because `pm_sync_state` can read "synced 2 minutes
  ago" from a previous account while `pm_tasks` holds another board.
* Before the worklog drafting sweep, and in `worklog-generate`. This is
  the one consumer where a stale board is harmful rather than cosmetic:
  it binds an hour of work to a ticket closed hours ago.

Single source of truth, no duplicate fetches
* Staleness is still decided in exactly one place per provider -
  `refresh_if_stale` reading `pm_sync_state.last_synced_at`. No second
  notion of freshness was introduced.
* `intelligence::sync_lock`: an advisory FILE lock, plus an in-process
  mutex (flock is per open-file-description, so two tasks in one process
  would each be granted it). Gated callers skip on contention; forced
  callers wait, then proceed. Opening the dashboard while a drafting
  sweep starts is the ordinary case, and now costs one fetch, not two.

Deliberately NOT a table, and this is the point
The reverted `pm_sync_requests` outbox (#909/#910) coordinated the tray
and the daemon through meridian.db, and the tray's read-back of the
outcome is what failed in production with SQLITE_IOERR_SHORT_READ (522) -
a short read while the daemon truncated the WAL on shutdown. Here the
tray spawns `meridian pm-sync` and forgets it: no handshake, no outcome
to read, no new table, no migration. `git status src/migrations/` is
empty and the diff contains no DDL, so shipping this cannot damage a
database or leave a request wedged.

Health check
`health::jira::sync_freshness` warned purely on elapsed time (>1h =>
"fetch may be failing silently"). That was a fair proxy only while a
timer synced regardless; now a machine shut all weekend would warn every
Monday. It reads `pm_sync_state.last_error` instead - a recorded failure
warns with the provider's own message, elapsed time is context only.

Tests
* `the_daemon_poll_loop_never_syncs_pm_tasks` - source-level, because a
  reintroduced timer would work perfectly and only destroy grants months
  later. Mutation-checked: planting a call in the poll loop fails it.
* `neither_sweep_is_gated_on_a_connected_tracker` now scans BOTH halves
  of the split `auto_generate` module. Splitting it for the 500-line cap
  would otherwise have silently halved the guard's reach; mutation-checked
  by planting the gate in sweep.rs alone.
* sync_lock contention/timeout/uncontended, and four sync_freshness cases
  including the stale-but-healthy false positive.

`auto_generate.rs` was 511 lines after the pre-draft sync landed, so it
splits into mod.rs (the clock gate) + sweep.rs (what a sweep does).

Not addressed here, deliberately: the refresh POST still has no
wall-clock deadline, there is still no wake detection, and OAuth remains
structurally vulnerable to a >10-minute suspend landing mid-refresh.
Those are the hardening slice. Scoped API tokens are the only immune
option and are a separate change again.
---
 src/health/jira.rs                            | 144 +++++++-
 src/intelligence/mod.rs                       | 115 +++++++
 src/intelligence/sync_lock.rs                 | 238 ++++++++++++++
 src/main.rs                                   | 105 ++++--
 .../mod.rs}                                   | 280 +---------------
 src/pm_worklog/auto_generate/sweep.rs         | 308 ++++++++++++++++++
 tray/src-tauri/src/commands/integrations.rs   |  35 +-
 tray/src-tauri/src/commands/system.rs         |  10 +
 tray/src-tauri/src/commands/tasks.rs          | 185 ++++++++---
 tray/src-tauri/src/tray.rs                    |  10 +
 .../timeline/settings/IntegrationsSection.tsx |   2 +-
 11 files changed, 1090 insertions(+), 342 deletions(-)
 create mode 100644 src/intelligence/sync_lock.rs
 rename src/pm_worklog/{auto_generate.rs => auto_generate/mod.rs} (52%)
 create mode 100644 src/pm_worklog/auto_generate/sweep.rs

diff --git a/src/health/jira.rs b/src/health/jira.rs
index ac4ec38a6..fa35db6d5 100644
--- a/src/health/jira.rs
+++ b/src/health/jira.rs
@@ -12,9 +12,6 @@ use crate::intelligence::oauth::{jira as oauth_jira, store as oauth_store};
 use sqlx::SqlitePool;
 use std::time::Duration;
 
-/// Cache older than this (2× the 30-min sync interval) ⇒ fetch likely failing.
-const SYNC_STALE_SECS: f64 = 3600.0;
-
 pub async fn checks(_cfg: &Config, pool: Option<&SqlitePool>) -> Vec<Check> {
     let mut out = Vec::new();
 
@@ -132,28 +129,47 @@ async fn classify_auth(send: reqwest::Result<reqwest::Response>) -> Check {
     }
 }
 
+/// Report whether the last Jira sync FAILED, not whether it was long ago.
+///
+/// This used to warn purely on elapsed time (`age > 3600s` => "fetch may be
+/// failing silently"), which was a reasonable proxy only while a background
+/// timer synced every few minutes no matter what. PM sync is on-demand now (see
+/// [`crate::intelligence::run_pm_sync`]): a machine that was shut all weekend,
+/// or a user who has not opened the dashboard since Friday, has a legitimately
+/// old cache and nothing is wrong. Warning on that is a false alarm nobody can
+/// act on - and a check that cries wolf during normal operation is worse than no
+/// check, because it teaches people to ignore the one that matters.
+///
+/// So the signal is the OUTCOME instead: `pm_sync_state.last_error`, written by
+/// `providers::record_sync_failure` and cleared by `clear_sync_error`. A recorded
+/// failure warns and carries the provider's own message; anything else reports
+/// elapsed time as context only, never as a fault.
 async fn sync_freshness(pool: &SqlitePool) -> Check {
-    match sqlx::query_scalar::<_, Option<f64>>(
-        "SELECT (julianday('now') - julianday(MAX(last_synced_at))) * 86400.0
+    match sqlx::query_as::<_, (Option<f64>, Option<String>)>(
+        "SELECT (julianday('now') - julianday(last_synced_at)) * 86400.0, last_error
          FROM pm_sync_state WHERE provider = 'jira'",
     )
-    .fetch_one(pool)
+    .fetch_optional(pool)
     .await
     {
-        Ok(Some(age)) if age > SYNC_STALE_SECS => Check::warn(
-            "ticket sync",
-            "L3",
-            format!(
-                "cache {:.0}m stale — fetch may be failing silently",
-                age / 60.0
-            ),
-        )
-        .with_remedy("check the auth row above; the daemon refreshes every 30m"),
-        Ok(Some(age)) => Check::ok(
+        // A recorded failure is the ONLY thing that warns. `last_error` is set by
+        // the provider itself, so the text is the real cause rather than this
+        // check's guess at one.
+        Ok(Some((_, Some(err)))) if !err.trim().is_empty() => {
+            Check::warn("ticket sync", "L3", format!("last sync failed: {err}")).with_remedy(
+                "check the auth row above; a sync retries on the next on-demand trigger",
+            )
+        }
+        // Elapsed time as context. An old cache is normal when nothing asked for a sync.
+        Ok(Some((Some(age), _))) => Check::ok(
             "ticket sync",
             "L3",
-            format!("fresh ({:.0}m ago)", age / 60.0),
+            format!("last synced {:.0}m ago, no errors", age / 60.0),
         ),
+        // A row with neither a parseable timestamp nor an error: nothing to report.
+        Ok(Some((None, _))) => {
+            Check::info("ticket sync", "L3", "no successful Jira sync recorded yet")
+        }
         Ok(None) => Check::info("ticket sync", "L3", "no Jira sync recorded yet"),
         Err(e) => Check::warn(
             "ticket sync",
@@ -188,3 +204,97 @@ async fn candidate_count(pool: &SqlitePool) -> Check {
         ),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::health::Severity;
+    use sqlx::sqlite::SqlitePoolOptions;
+
+    async fn db() -> SqlitePool {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .unwrap();
+        sqlx::migrate!("src/migrations").run(&pool).await.unwrap();
+        pool
+    }
+
+    /// Seed `pm_sync_state` with a sync `days_ago` in the past and an optional
+    /// recorded error.
+    async fn seed(pool: &SqlitePool, days_ago: f64, last_error: Option<&str>) {
+        sqlx::query(
+            "INSERT INTO pm_sync_state (provider, last_synced_at, last_error)
+             VALUES ('jira', strftime('%Y-%m-%dT%H:%M:%SZ', 'now', ?), ?)",
+        )
+        .bind(format!("-{days_ago} days"))
+        .bind(last_error)
+        .execute(pool)
+        .await
+        .unwrap();
+    }
+
+    /// THE REGRESSION THIS EXISTS FOR. A three-day-old cache with no recorded
+    /// failure is normal once syncing is on-demand - the machine was shut, or
+    /// nobody opened the dashboard. The old elapsed-time rule warned at one hour,
+    /// which would now fire on healthy installs every Monday morning.
+    #[tokio::test]
+    async fn a_long_quiet_period_with_no_error_is_not_a_fault() {
+        let pool = db().await;
+        seed(&pool, 3.0, None).await;
+        let check = sync_freshness(&pool).await;
+        assert_eq!(
+            check.severity,
+            Severity::Ok,
+            "a stale-but-successful sync must not warn, got {check:?}"
+        );
+    }
+
+    /// A recorded failure warns and carries the provider's own message, so the
+    /// user sees the real cause rather than this check's guess at one.
+    #[tokio::test]
+    async fn a_recorded_failure_warns_with_the_providers_own_message() {
+        let pool = db().await;
+        seed(&pool, 0.01, Some("refresh_token is invalid")).await;
+        let check = sync_freshness(&pool).await;
+        assert_eq!(
+            check.severity,
+            Severity::Warn,
+            "a recorded failure must warn"
+        );
+        assert!(
+            check.detail.contains("refresh_token is invalid"),
+            "the provider's message must survive into the detail, got {:?}",
+            check.detail
+        );
+    }
+
+    /// An empty string is not a failure. `clear_sync_error` blanks the column on
+    /// success on some paths, and treating `''` as an error would leave a
+    /// permanent warn on a perfectly healthy install.
+    #[tokio::test]
+    async fn a_blank_last_error_is_not_a_failure() {
+        let pool = db().await;
+        seed(&pool, 0.5, Some("   ")).await;
+        let check = sync_freshness(&pool).await;
+        assert_eq!(
+            check.severity,
+            Severity::Ok,
+            "a blank last_error must not warn, got {check:?}"
+        );
+    }
+
+    /// No row at all - a tracker that has never synced. Informational, never a
+    /// fault: this is every fresh install for its first few minutes.
+    #[tokio::test]
+    async fn never_synced_is_informational() {
+        let pool = db().await;
+        let check = sync_freshness(&pool).await;
+        assert_eq!(
+            check.severity,
+            Severity::Info,
+            "never-synced must be info, got {check:?}"
+        );
+    }
+}
diff --git a/src/intelligence/mod.rs b/src/intelligence/mod.rs
index 269728fd4..c57130f24 100644
--- a/src/intelligence/mod.rs
+++ b/src/intelligence/mod.rs
@@ -3,6 +3,7 @@
 pub mod oauth;
 pub mod providers;
 pub mod session_categorizer;
+pub mod sync_lock;
 pub mod task_triage;
 pub mod ticket_update;
 
@@ -11,6 +12,24 @@ use sqlx::SqlitePool;
 
 use crate::config::{Config, PmProviderConfig};
 
+/// Serialises PM sync WITHIN this process, above [`sync_lock`]'s cross-process
+/// file lock.
+///
+/// Both layers are needed and neither subsumes the other: `flock` is held per
+/// open-file-description, so two tasks in ONE process would each open the lock
+/// file and each be granted it. The daemon has two callers that can overlap (a
+/// worklog drafting sweep and a forced sync from `ticket-update`), so without
+/// this the file lock would not dedupe them at all.
+///
+/// A `tokio::sync::Mutex` rather than a `std` one because it is held across the
+/// provider loop's `.await`s.
+static IN_PROCESS_SYNC: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
+
+/// How long a FORCED sync waits for a gated one to finish before giving up on
+/// the lock. Comfortably inside the tray's 30 s `tasks-sync` budget, so the
+/// caller reports honestly instead of being killed mid-wait.
+const FORCE_LOCK_WAIT: std::time::Duration = std::time::Duration::from_secs(20);
+
 /// True once at least one PM task is cached. Rows only land in `pm_tasks` after a
 /// provider authenticated and fetched successfully, so a non-zero count is proof
 /// a tracker actually WORKS (not merely that keys are present — bad creds 401 and
@@ -39,6 +58,31 @@ pub async fn run_pm_force_sync(meridian: &SqlitePool, config: &Config) -> Result
     if config.pm_providers.is_empty() {
         return Ok(());
     }
+    let _in_process = IN_PROCESS_SYNC.lock().await;
+    // A forced sync must NOT skip on contention - somebody pressed "Sync now",
+    // or a tracker write just landed and the board is knowingly behind. So wait
+    // for the holder, and if the budget expires proceed anyway: a duplicate
+    // fetch is wasteful, whereas silently doing nothing after an explicit
+    // request is the "sync is still running" dead end users already hit.
+    // Lock evaluation failing is logged and ignored for the same reason - the
+    // dedup lock must never become a new way for a sync to fail.
+    let _cross_process = match sync_lock::acquire_waiting(FORCE_LOCK_WAIT).await {
+        Ok(Some(guard)) => Some(guard),
+        Ok(None) => {
+            tracing::info!(
+                waited_s = FORCE_LOCK_WAIT.as_secs(),
+                "force sync: another sync still holds the lock - proceeding anyway"
+            );
+            None
+        }
+        Err(e) => {
+            tracing::warn!(
+                error = %crate::errors::chain(&e),
+                "force sync: could not evaluate the PM sync lock - proceeding without dedup"
+            );
+            None
+        }
+    };
     for provider in &config.pm_providers {
         let name = provider.provider_name();
         let result = match provider {
@@ -80,6 +124,35 @@ pub async fn run_pm_sync(meridian: &SqlitePool, config: &Config) -> Result<()> {
         tracing::warn!("no PM providers configured — pm_tasks will stay empty (set JIRA_BASE_URL/GITHUB_TOKEN/LINEAR_API_KEY/AZURE_DEVOPS_PAT)");
         return Ok(());
     }
+    let _in_process = IN_PROCESS_SYNC.lock().await;
+    // Gated callers SKIP when another sync is in flight: that run is already
+    // fetching the board this one wanted, so a second fetch is pure duplicate
+    // load on the tracker's API. This is the only thing standing between "the
+    // dashboard was opened while a drafting sweep started" and two identical
+    // board fetches.
+    let _cross_process = match sync_lock::try_acquire() {
+        Ok(Some(guard)) => guard,
+        Ok(None) => {
+            tracing::debug!("pm sync already in flight in another process - skipping");
+            return Ok(());
+        }
+        // Never fail a sync because the DEDUP lock was unreadable - degrading to
+        // "no dedup" is strictly better than degrading to "no sync".
+        Err(e) => {
+            tracing::warn!(
+                error = %crate::errors::chain(&e),
+                "could not evaluate the PM sync lock - proceeding without dedup"
+            );
+            return run_pm_sync_providers(meridian, config).await;
+        }
+    };
+    run_pm_sync_providers(meridian, config).await
+}
+
+/// The provider loop itself, split from [`run_pm_sync`] so the locking policy
+/// above has exactly one body to guard and cannot drift from it.
+#[tracing::instrument(skip_all)]
+async fn run_pm_sync_providers(meridian: &SqlitePool, config: &Config) -> Result<()> {
     let provider_count = config.pm_providers.len();
     tracing::debug!(provider_count, "syncing PM providers");
 
@@ -220,4 +293,46 @@ mod tests {
         .unwrap();
         assert_eq!(queued, 0, "the board hygiene digest producer was removed");
     }
+
+    /// NO TIMER MAY SYNC THE BOARD. This is a source-level guard because the
+    /// regression it prevents is invisible: a `run_pm_sync` call added back into
+    /// the daemon's poll loop would work perfectly, sync the board, pass every
+    /// test - and start silently destroying users' Jira OAuth grants again.
+    ///
+    /// The mechanism, in one paragraph, because it is not guessable from the call
+    /// site: macOS dark-wakes a sleeping machine every 15-16 minutes. A timer
+    /// resumed, found the access token expired, and POSTed a refresh; Atlassian
+    /// rotated the refresh token and replied; the machine re-suspended before the
+    /// response was read. `reqwest`'s timeout could not cancel it, because the
+    /// timeout is `Instant`-based and the monotonic clock does not advance while
+    /// the system is asleep. The next dark wake retried with the OLD refresh
+    /// token, by then past Atlassian's 10-minute reuse leeway - `invalid_grant`,
+    /// terminal, grant dead forever. The dark-wake interval is LONGER than the
+    /// leeway, which is why no retry policy fixes it and why the only fix is to
+    /// attempt no refresh while nobody is there.
+    ///
+    /// Every legitimate caller is a ONE-SHOT CLI arm, all of which sit before the
+    /// daemon boots. So the rule is positional: nothing after the poll loop
+    /// begins. If this fails, do not silence it - move the trigger to something a
+    /// present user did (see `tray/src-tauri/src/commands/tasks.rs`).
+    #[test]
+    fn the_daemon_poll_loop_never_syncs_pm_tasks() {
+        let main_rs = include_str!("../main.rs");
+        // The loop's own `tokio::select!` is the boundary: CLI arms are all above
+        // it, the daemon's recurring work is all below.
+        let loop_start = main_rs
+            .find("tokio::select! {")
+            .expect("main.rs must still have the poll loop's tokio::select!");
+        let after = &main_rs[loop_start..];
+        let offenders: Vec<&str> = after
+            .lines()
+            .filter(|l| !l.trim_start().starts_with("//"))
+            .filter(|l| l.contains("run_pm_sync(") || l.contains("run_pm_force_sync("))
+            .collect();
+        assert!(
+            offenders.is_empty(),
+            "PM sync is back on a timer, which permanently kills Jira OAuth grants \
+             on sleeping machines - see this test's doc comment. Offending lines: {offenders:?}"
+        );
+    }
 }
diff --git a/src/intelligence/sync_lock.rs b/src/intelligence/sync_lock.rs
new file mode 100644
index 000000000..abfdc635a
--- /dev/null
+++ b/src/intelligence/sync_lock.rs
@@ -0,0 +1,238 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Cross-process deduplication for PM task sync.
+//!
+//! PM sync is on-demand (see [`crate::intelligence::run_pm_sync`]): the tray
+//! triggers it by spawning `meridian pm-sync` when the user connects a tracker
+//! or opens the dashboard, and the daemon triggers it before a worklog drafting
+//! sweep. Several of those can land within a second of each other - opening the
+//! dashboard while a drafting sweep is starting is the ordinary case, not a
+//! corner one - and each would independently read `pm_sync_state`, independently
+//! decide the cache is stale, and fetch the same board again.
+//!
+//! This is the ONE mechanism that stops that. It is deliberately a **file** lock
+//! and not a table:
+//!
+//! * The reverted `pm_sync_requests` outbox (PRs #909/#910) coordinated the tray
+//!   and the daemon through `meridian.db`, and the tray's read-back of the
+//!   outcome is what failed in production with `SQLITE_IOERR_SHORT_READ` (522) -
+//!   a short read while the daemon truncated the WAL on shutdown. Coordination
+//!   state that lives outside the database cannot fail that way, and needs no
+//!   migration, so shipping it cannot damage anyone's data.
+//! * A crashed holder releases automatically: the lock dies with its fd. No
+//!   stale-row cleanup, no `claimed_at` timestamps to reap.
+//!
+//! # Who calls this
+//! [`crate::intelligence::run_pm_sync`] (gated - skips on contention) and
+//! [`crate::intelligence::run_pm_force_sync`] (forced - waits, then proceeds).
+//!
+//! # Related
+//! - [`meridian_oauth::store::lock_provider`] - the same advisory-file-lock
+//!   pattern, guarding the rotating OAuth refresh token. That one serialises
+//!   *token* writes and is unaffected by this module; a duplicate fetch is
+//!   wasteful, a duplicate token refresh is destructive, so they stay separate
+//!   locks with different contention policies.
+
+use std::path::PathBuf;
+
+use anyhow::{Context, Result};
+
+/// Held for the duration of one sync. Releasing is `Drop` (the fd closes), so a
+/// panic or a killed process frees it without any cleanup path.
+#[derive(Debug)]
+pub struct SyncLock {
+    _file: std::fs::File,
+}
+
+/// `~/.meridian/pm-sync.lock`. Alongside the OAuth store's lock files rather
+/// than in a temp dir: a per-user path that survives reboots and is not shared
+/// between accounts on one machine.
+fn lock_path() -> Result<PathBuf> {
+    let home = meridian_core::paths::home_dir()
+        .context("resolving the home directory for the PM sync lock")?;
+    Ok(home.join(".meridian").join("pm-sync.lock"))
+}
+
+/// Open (creating if needed) the lock file. Split out so both acquire paths
+/// share it and neither can drift on flags - `truncate(false)` matters: the file
+/// is a lock, never a payload, and truncating it would be a pointless write on
+/// every sync.
+fn open_lock_file() -> Result<std::fs::File> {
+    let path = lock_path()?;
+    if let Some(dir) = path.parent() {
+        std::fs::create_dir_all(dir)
+            .with_context(|| format!("creating {} for the PM sync lock", dir.display()))?;
+    }
+    std::fs::OpenOptions::new()
+        .write(true)
+        .create(true)
+        .truncate(false)
+        .open(&path)
+        .with_context(|| format!("opening PM sync lock {}", path.display()))
+}
+
+/// Try to take the lock without waiting.
+///
+/// `Ok(Some(_))` - acquired, this process owns the sync.
+/// `Ok(None)`   - another process is syncing right now; the caller should SKIP,
+///                because that run is already doing the work this one wanted.
+/// `Err(_)`     - the lock could not be evaluated at all (no home dir,
+///                unwritable `~/.meridian`).
+///
+/// Used by the gated path. Skipping on contention is the whole point: two
+/// concurrent gated syncs would fetch the same board twice.
+pub fn try_acquire() -> Result<Option<SyncLock>> {
+    let file = open_lock_file()?;
+    match file.try_lock() {
+        Ok(()) => Ok(Some(SyncLock { _file: file })),
+        Err(std::fs::TryLockError::WouldBlock) => Ok(None),
+        Err(std::fs::TryLockError::Error(e)) => {
+            Err(anyhow::Error::new(e).context("evaluating the PM sync lock"))
+        }
+    }
+}
+
+/// Wait up to `timeout` for the lock, then give up.
+///
+/// `Ok(Some(_))` - acquired. `Ok(None)` - still held when the budget ran out.
+///
+/// Used by the FORCED path, which must not silently skip: a user pressing "Sync
+/// now" has to get a sync. Waiting is nearly always brief (a gated sync is one
+/// HTTP fetch per provider), and a caller that times out is told so rather than
+/// racing the holder - see [`crate::intelligence::run_pm_force_sync`].
+///
+/// Polls a non-blocking try-lock rather than blocking on `flock`, so the async
+/// executor is never parked - identical reasoning to
+/// [`meridian_oauth::store::lock_provider`].
+pub async fn acquire_waiting(timeout: std::time::Duration) -> Result<Option<SyncLock>> {
+    let step = std::time::Duration::from_millis(100);
+    let mut waited = std::time::Duration::ZERO;
+    loop {
+        if let Some(guard) = try_acquire()? {
+            return Ok(Some(guard));
+        }
+        if waited >= timeout {
+            return Ok(None);
+        }
+        tokio::time::sleep(step).await;
+        waited += step;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Serialises the tests below. Both mutate `HOME` (process-global) to point
+    /// `lock_path` at a scratch dir, and cargo runs tests in parallel threads -
+    /// so without this one test's `set_var` lands mid-flight in the other and it
+    /// contends on the WRONG lock file. That is not hypothetical: it is exactly
+    /// how these two first failed. Mirrors `meridian_oauth::env_test_guard`.
+    fn env_guard() -> std::sync::MutexGuard<'static, ()> {
+        static LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+        LOCK.lock().unwrap_or_else(|p| p.into_inner())
+    }
+
+    /// Point `HOME` at a fresh scratch dir for the duration of a test, restoring
+    /// it afterwards so a failure cannot leak a bogus `HOME` into later tests.
+    struct ScratchHome {
+        dir: std::path::PathBuf,
+        prev: Option<std::ffi::OsString>,
+        _guard: std::sync::MutexGuard<'static, ()>,
+    }
+
+    impl ScratchHome {
+        fn new(tag: &str) -> Self {
+            let guard = env_guard();
+            let dir = std::env::temp_dir()
+                .join(format!("meridian_synclock_{tag}_{}", std::process::id()));
+            std::fs::create_dir_all(&dir).unwrap();
+            let prev = std::env::var_os("HOME");
+            std::env::set_var("HOME", &dir);
+            Self {
+                dir,
+                prev,
+                _guard: guard,
+            }
+        }
+    }
+
+    impl Drop for ScratchHome {
+        fn drop(&mut self) {
+            match self.prev.take() {
+                Some(v) => std::env::set_var("HOME", v),
+                None => std::env::remove_var("HOME"),
+            }
+            std::fs::remove_dir_all(&self.dir).ok();
+        }
+    }
+
+    /// Two acquisitions contend and the second is refused, then succeeds once
+    /// the first is dropped. `flock` is per-open-file-description, so two opens
+    /// in ONE process contend exactly as two processes would - which is what
+    /// makes this testable without spawning anything.
+    #[test]
+    fn a_second_acquire_is_refused_until_the_first_drops() {
+        let _home = ScratchHome::new("basic");
+
+        let held = try_acquire().unwrap();
+        assert!(held.is_some(), "the first acquire must succeed");
+
+        let contended = try_acquire().unwrap();
+        assert!(
+            contended.is_none(),
+            "a gated caller must be refused while another sync holds the lock, \
+             not granted a duplicate"
+        );
+
+        drop(held);
+        let reacquired = try_acquire().unwrap();
+        assert!(
+            reacquired.is_some(),
+            "the lock must be free again once the holder drops it"
+        );
+    }
+
+    /// The waiting path returns `Ok(None)` rather than erroring or hanging when
+    /// the budget expires - the forced caller needs to distinguish "I have the
+    /// lock" from "someone else still does" to report honestly.
+    #[test]
+    fn waiting_gives_up_with_none_when_the_budget_expires() {
+        let _home = ScratchHome::new("waiting");
+
+        let rt = tokio::runtime::Builder::new_current_thread()
+            .enable_time()
+            .build()
+            .unwrap();
+        let held = try_acquire().unwrap().expect("first acquire");
+        let timed_out = rt.block_on(acquire_waiting(std::time::Duration::from_millis(250)));
+        assert!(
+            matches!(timed_out, Ok(None)),
+            "a contended wait must expire as Ok(None), got {timed_out:?}"
+        );
+        drop(held);
+    }
+
+    /// The waiting path takes a FREE lock immediately rather than sleeping out
+    /// its budget - the forced path runs on a user's click, so a 20 s wait for
+    /// an uncontended lock would be a visible regression.
+    #[test]
+    fn waiting_acquires_immediately_when_uncontended() {
+        let _home = ScratchHome::new("free");
+
+        let rt = tokio::runtime::Builder::new_current_thread()
+            .enable_time()
+            .build()
+            .unwrap();
+        let started = std::time::Instant::now();
+        let got = rt.block_on(acquire_waiting(std::time::Duration::from_secs(20)));
+        assert!(
+            matches!(got, Ok(Some(_))),
+            "an uncontended wait must acquire, got {got:?}"
+        );
+        assert!(
+            started.elapsed() < std::time::Duration::from_secs(1),
+            "an uncontended wait must not sleep - took {:?}",
+            started.elapsed()
+        );
+    }
+}
diff --git a/src/main.rs b/src/main.rs
index f52889729..5da6f296b 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -373,6 +373,38 @@ async fn main() -> Result<()> {
         return Ok(());
     }
 
+    // `meridian pm-sync` — the GATED sibling of `tasks-sync`: sync all configured
+    // PM providers, but honour each provider's staleness gate so a fresh cache is
+    // a cheap no-op. This is what every ON-DEMAND trigger spawns (tracker
+    // connected, dashboard opened), which is why it must not be `tasks-sync`:
+    // those triggers can fire repeatedly within seconds and a forced fetch each
+    // time would be exactly the API hammering the timer used to do.
+    //
+    // Exits 0 whether it fetched, skipped as fresh, or skipped because another
+    // sync held the dedup lock — all three are successful outcomes for a
+    // best-effort trigger, and only a DB that cannot be opened is a real failure.
+    if std::env::args().nth(1).as_deref() == Some("pm-sync") {
+        let cfg = Config::from_env();
+        match setup_db(&cfg.meridian_db_uri()).await {
+            Ok(pool) => {
+                if let Err(e) = run_pm_sync(&pool, &cfg).await {
+                    eprintln!("pm-sync: {}", meridian::errors::chain(&e));
+                }
+                // Close the pool explicitly, same as `tasks-sync`: this is a
+                // short-lived process writing the SAME meridian.db the daemon and
+                // tray hold open, and dropping a pool without closing it can
+                // leave the WAL un-checkpointed behind a connection the OS is
+                // still tearing down.
+                pool.close().await;
+            }
+            Err(e) => {
+                eprintln!("pm-sync: open db: {e:#}");
+                std::process::exit(1);
+            }
+        }
+        return Ok(());
+    }
+
     // `meridian ticket-update --provider P --key K --field F --value V` — apply
     // ONE board-hygiene fix to the real tracker (due date, assignee, label, …).
     // Prints a JSON result the UI reads: {"status":"applied"} or
@@ -694,6 +726,18 @@ async fn main() -> Result<()> {
         let obs_guard = observability::init("meridian-rust").ok();
         match setup_db(&cfg.meridian_db_uri()).await {
             Ok(pool) => {
+                // Refresh the board BEFORE matching, now that nothing does it on
+                // a timer. A stale `pm_tasks` is not a cosmetic problem here: it
+                // is what silently binds an hour of work to a ticket that was
+                // closed or reassigned hours ago. Gated (a fresh cache no-ops)
+                // and log-and-continue — drafting from a slightly stale board
+                // beats not drafting at all.
+                if let Err(e) = run_pm_sync(&pool, &cfg).await {
+                    tracing::warn!(
+                        error = %meridian::errors::chain(&e),
+                        "worklog-generate: pre-draft PM sync failed — matching against the cached board"
+                    );
+                }
                 match meridian::pm_worklog::generate(&pool, &cfg, &day, &task_id).await {
                     Ok(mut draft) => {
                         // A matched draft carries a target_key we can link even
@@ -1355,9 +1399,12 @@ async fn main() -> Result<()> {
     }
 
     // 7c. Run ETL once immediately before entering the loop.
-    //     Re-read config so that any settings.json present at startup takes effect.
+    //
+    //     No `Config::from_env()` re-read here any more: it existed only to hand
+    //     a fresh config to the startup PM sync that used to live at the end of
+    //     this block, and nothing else in the block reads it. ETL and the
+    //     retention sweep take the pool alone.
     {
-        let cfg = Config::from_env();
         let startup_tick = tracing::info_span!("startup_tick");
         *etl_tick_span.lock().unwrap_or_else(|e| e.into_inner()) = Some(startup_tick.clone());
         let _guard = startup_tick.enter();
@@ -1381,12 +1428,11 @@ async fn main() -> Result<()> {
                 tracing::warn!(error = %meridian::errors::chain(&e), "capture retention sweep failed");
             }
         }
-        if let Err(e) = run_pm_sync(&meridian, &cfg).await {
-            tracing::error!(
-                error = %meridian::errors::chain(&e),
-                "intelligence run failed"
-            );
-        }
+        // No startup PM sync either, for the same reason as the poll tick above:
+        // launchd `KeepAlive` restarts this process on every wake, so a
+        // sync-on-boot IS a wake-triggered token refresh wearing different
+        // clothes. Nothing at startup needs a fresh board - `pm_tasks_present`
+        // and `daily_plan::maybe_nudge` only check EXISTENCE, not freshness.
     }
 
     let (shutdown_tx, shutdown_rx) = tokio::sync::watch::channel(false);
@@ -1605,17 +1651,38 @@ async fn main() -> Result<()> {
                     tracing::debug!(error = %meridian::errors::chain(&e), "notification response consume skipped");
                 }
 
-                // Refresh the PM task cache (pm_tasks) every tick — interval-gated
-                // per provider (~5 min), so this is a cheap no-op most ticks. The
-                // legacy drafting driver that used to trigger this before every
-                // pass was retired when the worklog pipeline moved to the
-                // clock-aligned Python trigger, which never calls this itself —
-                // leaving pm_tasks (and hence a ticket's title on the timeline)
-                // stuck at whatever it was at the last daemon restart. This is
-                // the only thing that keeps it live during normal operation.
-                if let Err(e) = run_pm_sync(&meridian, &cfg).await {
-                    tracing::warn!(error = %meridian::errors::chain(&e), "pm_tasks refresh failed — using cached tasks");
-                }
+        // ── NO PM SYNC ON THE POLL TICK. ────────────────────────────────────
+        //
+        // This used to call `run_pm_sync` every tick (~60 s), interval-gated per
+        // provider to ~5 min. It was removed because the timer, not the network,
+        // is what was permanently destroying production users' Jira grants.
+        //
+        // macOS dark-wakes a sleeping machine every 15-16 minutes. The daemon
+        // resumed, found the OAuth access token expired, and POSTed a refresh.
+        // Atlassian rotated the refresh token and replied - and the machine
+        // re-suspended before the response was read. `reqwest`'s timeout could
+        // not save it: the timeout is `Instant`-based and the monotonic clock
+        // does not advance while the system is asleep, so the request simply
+        // hung. On the NEXT dark wake, 15-16 minutes later, the socket was dead
+        // and the retry went out with the OLD refresh token - now past
+        // Atlassian's 10-minute reuse leeway. `invalid_grant`, classified
+        // terminal, grant dead forever, user sees "refresh_token is invalid".
+        //
+        // The dark-wake interval being LONGER than the leeway is why no retry
+        // policy can fix this from inside the daemon; see
+        // `~/.claude` notes and `meridian-oauth::jira::ensure_fresh`.
+        //
+        // A sleeping machine has no work to do, so it must attempt no token
+        // refreshes. Nothing here needs `pm_tasks` fresh on a clock either: the
+        // hourly worklog fold never reads it, and the one place that matches
+        // sessions to tickets now syncs for itself
+        // (`pm_worklog::auto_generate::sweep::draft_qualifying_tasks`). The
+        // remaining triggers are all things a PRESENT user did - connecting a
+        // tracker, opening the dashboard, pressing Sync now, a tracker write -
+        // and they live in `tray/src-tauri/src/commands/tasks.rs`.
+        //
+        // Do not reintroduce a timer here. If something needs a fresher board,
+        // give it its own trigger and let `intelligence::sync_lock` dedupe it.
             }
         }
     }
diff --git a/src/pm_worklog/auto_generate.rs b/src/pm_worklog/auto_generate/mod.rs
similarity index 52%
rename from src/pm_worklog/auto_generate.rs
rename to src/pm_worklog/auto_generate/mod.rs
index 8e693e819..b8446b205 100644
--- a/src/pm_worklog/auto_generate.rs
+++ b/src/pm_worklog/auto_generate/mod.rs
@@ -93,7 +93,10 @@ use tracing::field::Empty;
 use tracing::Instrument;
 
 use crate::config::Config;
-use crate::pm_worklog;
+
+mod sweep;
+
+use sweep::draft_qualifying_tasks;
 
 /// Fixed qualifying threshold — a day-task needs more than this many tracked
 /// minutes to be auto-drafted. Not user-configurable: only WHEN Meridian checks
@@ -187,267 +190,9 @@ pub async fn generate_now(pool: &SqlitePool, config: &Config, day_local: &str) {
     .await
 }
 
-/// What one sweep did. Returned rather than only recorded onto the span so the
-/// behaviour is assertable: "did this run at all" and "did it early-return" are
-/// otherwise indistinguishable from outside, which is exactly how a tracker gate
-/// silently disabled the whole feature for solo users once already.
-#[derive(Debug, Default, PartialEq, Eq)]
-struct SweepCounts {
-    total: usize,
-    qualifying: u32,
-    already_drafted: u32,
-    drafted: u32,
-    failed: u32,
-}
-
-/// Draft a worklog for every qualifying, not-yet-drafted day-task of `day_local`,
-/// recording per-run counts onto `span` and returning them. The shared body of
-/// [`maybe_auto_generate`] (gated on the clock) and [`generate_now`] (on demand); it
-/// assumes its caller has already decided a run is warranted.
-///
-/// Deliberately NOT gated on a connected tracker - a personal day-task is matched and
-/// drafted like any ticket, and only the propose branch needs one (it already fails
-/// per-task). See [`neither_sweep_is_gated_on_a_connected_tracker`].
-async fn draft_qualifying_tasks(
-    pool: &SqlitePool,
-    config: &Config,
-    day_local: &str,
-    span: &tracing::Span,
-) -> SweepCounts {
-    let tasks = match meridian_core::day_tasks::get_day_tasks(pool, day_local).await {
-        Ok(resp) => resp.tasks,
-        Err(e) => {
-            tracing::warn!(
-                day = day_local, error = %e,
-                "worklog: auto-generate day-task read failed — skipping this run"
-            );
-            return SweepCounts::default();
-        }
-    };
-    span.record("tasks_total", tasks.len());
-    let total = tasks.len();
-
-    let mut qualifying = 0u32;
-    let mut already_drafted = 0u32;
-    let mut drafted = 0u32;
-    let mut failed = 0u32;
-
-    for task in tasks {
-        if task.minutes < QUALIFYING_MINUTES {
-            continue;
-        }
-        qualifying += 1;
-
-        // Already drafted — by an earlier auto-generate run, or by the user
-        // clicking "Generate worklog" themselves. Either way this task is now the
-        // user's to drive (Regenerate in the panel), never auto-generate's again.
-        match meridian_core::day_task_worklogs::get_day_task_worklog(pool, day_local, &task.id)
-            .await
-        {
-            Ok(Some(_)) => {
-                already_drafted += 1;
-                continue;
-            }
-            Ok(None) => {}
-            Err(e) => {
-                failed += 1;
-                tracing::warn!(
-                    day = day_local, task_id = %task.id, error = %e,
-                    "worklog: auto-generate existing-draft check failed — skipping this task this run"
-                );
-                continue;
-            }
-        }
-
-        tracing::info!(
-            day = day_local, task_id = %task.id, minutes = task.minutes,
-            "worklog: threshold crossed — drafting"
-        );
-        match pm_worklog::generate(pool, config, day_local, &task.id).await {
-            Ok(draft) => {
-                drafted += 1;
-                tracing::info!(
-                    day = day_local, task_id = %task.id, state = draft.state,
-                    "worklog: auto-generated (draft only — never posted)"
-                );
-            }
-            Err(e) => {
-                failed += 1;
-                tracing::warn!(
-                    day = day_local, task_id = %task.id, error = %e,
-                    "worklog: auto-generate failed — the user can still generate it manually"
-                );
-            }
-        }
-    }
-
-    span.record("tasks_qualifying", qualifying);
-    span.record("tasks_already_drafted", already_drafted);
-    span.record("tasks_drafted", drafted);
-    span.record("tasks_failed", failed);
-    tracing::info!(
-        day = day_local,
-        qualifying,
-        already_drafted,
-        drafted,
-        failed,
-        "worklog: auto-generate run complete"
-    );
-
-    SweepCounts {
-        total,
-        qualifying,
-        already_drafted,
-        drafted,
-        failed,
-    }
-}
-
 #[cfg(test)]
 mod tests {
-    use super::{draft_qualifying_tasks, parse_hh_mm, SweepCounts, QUALIFYING_MINUTES};
-    use crate::config::Config;
-    use sqlx::sqlite::SqlitePoolOptions;
-    use sqlx::SqlitePool;
-
-    const DAY: &str = "2026-08-07";
-
-    /// The two tables the sweep reads: day-tasks to enumerate, worklogs to skip
-    /// ones already drafted. `pm_providers` is a CONFIG field, not a table, so a
-    /// tracker-less user is modelled by the empty `Config` below.
-    async fn seeded() -> SqlitePool {
-        let pool = SqlitePoolOptions::new()
-            .max_connections(1)
-            .connect("sqlite::memory:")
-            .await
-            .unwrap();
-        for ddl in [
-            "CREATE TABLE day_tasks (day_local TEXT NOT NULL, task_id TEXT NOT NULL, \
-                title TEXT, summary TEXT, hours_json TEXT, segments_json TEXT, \
-                minutes INTEGER, status TEXT, linked_ticket TEXT, \
-                PRIMARY KEY (day_local, task_id))",
-            // Mirrors `meridian-core/src/readers/day_task_worklogs/tests.rs`'s fixture -
-            // `get_day_task_worklog` reads the targets table too, and a column short of
-            // it the read fails and every task counts as `failed` rather than
-            // `already_drafted`, which would make this test pass for the wrong reason.
-            "CREATE TABLE day_task_worklogs (day_local TEXT NOT NULL, task_id TEXT NOT NULL, \
-                provider TEXT NOT NULL DEFAULT 'local', state TEXT NOT NULL DEFAULT 'drafted', \
-                update_summary TEXT NOT NULL DEFAULT '', update_json TEXT NOT NULL DEFAULT '{}', \
-                reasoning TEXT NOT NULL DEFAULT '', propose_issue_type TEXT, propose_title TEXT, \
-                propose_description TEXT, created_task_key TEXT, last_error TEXT, \
-                create_attempt_at TEXT, drafted_minutes INTEGER, \
-                created_at TEXT NOT NULL DEFAULT '', updated_at TEXT NOT NULL DEFAULT '', \
-                PRIMARY KEY (day_local, task_id))",
-            "CREATE TABLE day_task_worklog_targets (day_local TEXT NOT NULL, \
-                task_id TEXT NOT NULL, task_key TEXT NOT NULL, provider TEXT NOT NULL, \
-                confidence REAL NOT NULL DEFAULT 0, manual INTEGER NOT NULL DEFAULT 0, \
-                position INTEGER NOT NULL DEFAULT 0, posted_comment_id TEXT, browse_url TEXT, \
-                posted_at TEXT, last_error TEXT, post_attempt_at TEXT, \
-                created_at TEXT NOT NULL DEFAULT '', update_json TEXT, \
-                PRIMARY KEY (day_local, task_id, task_key))",
-            "CREATE TABLE pm_tasks (task_key TEXT PRIMARY KEY, title TEXT NOT NULL)",
-        ] {
-            sqlx::query(ddl).execute(&pool).await.unwrap();
-        }
-        pool
-    }
-
-    async fn put_task(pool: &SqlitePool, task_id: &str, minutes: i64) {
-        sqlx::query(
-            "INSERT INTO day_tasks (day_local, task_id, title, minutes) VALUES (?, ?, ?, ?)",
-        )
-        .bind(DAY)
-        .bind(task_id)
-        .bind(format!("Task {task_id}"))
-        .bind(minutes)
-        .execute(pool)
-        .await
-        .unwrap();
-    }
-
-    async fn put_draft(pool: &SqlitePool, task_id: &str) {
-        sqlx::query("INSERT INTO day_task_worklogs (day_local, task_id) VALUES (?, ?)")
-            .bind(DAY)
-            .bind(task_id)
-            .execute(pool)
-            .await
-            .unwrap();
-    }
-
-    /// A user with NO tracker connected - the exact configuration the removed
-    /// gate used to abandon.
-    fn no_tracker_config() -> Config {
-        Config {
-            meridian_db: ":memory:".into(),
-            poll_interval_secs: 60,
-            pm_providers: Vec::new(),
-            jira_update_enabled: false,
-            jira_update_interval_s: 14_400,
-            jira_office_start_hour: 9,
-            jira_office_end_hour: 17,
-            runtime: Default::default(),
-        }
-    }
-
-    /// The functional half of [`neither_sweep_is_gated_on_a_connected_tracker`].
-    ///
-    /// That test greps the source for the gate's return; this one proves the sweep
-    /// actually walks its task list with `pm_providers` empty. The two together
-    /// close the hole: a gate written a DIFFERENT way (a different field, an early
-    /// `return` above the read) would slip past the grep, but not past this.
-    ///
-    /// Every task here is pre-drafted on purpose, so the loop reaches its
-    /// already-drafted branch and returns without ever calling `pm_worklog::generate`
-    /// - no LLM, no network, no CLI spawn. Counting the tasks it CONSIDERED is
-    /// enough: an early return yields zeroes, and nothing else does.
-    #[tokio::test]
-    async fn the_sweep_walks_its_tasks_with_no_tracker_connected() {
-        let pool = seeded().await;
-        put_task(&pool, "T1", QUALIFYING_MINUTES + 5).await;
-        put_task(&pool, "T2", QUALIFYING_MINUTES + 90).await;
-        put_draft(&pool, "T1").await;
-        put_draft(&pool, "T2").await;
-
-        let counts =
-            draft_qualifying_tasks(&pool, &no_tracker_config(), DAY, &tracing::Span::none()).await;
-
-        assert_eq!(
-            counts,
-            SweepCounts {
-                total: 2,
-                qualifying: 2,
-                already_drafted: 2,
-                drafted: 0,
-                failed: 0,
-            },
-            "a tracker-less user's tasks must still be considered"
-        );
-    }
-
-    /// The threshold still applies - "not gated on a tracker" must not become
-    /// "not gated at all".
-    #[tokio::test]
-    async fn short_tasks_are_still_below_the_threshold() {
-        let pool = seeded().await;
-        put_task(&pool, "T1", QUALIFYING_MINUTES - 1).await;
-        put_draft(&pool, "T1").await;
-
-        let counts =
-            draft_qualifying_tasks(&pool, &no_tracker_config(), DAY, &tracing::Span::none()).await;
-
-        assert_eq!(counts.total, 1);
-        assert_eq!(counts.qualifying, 0, "under the threshold, never drafted");
-        assert_eq!(counts.already_drafted, 0);
-    }
-
-    /// A day with nothing on it returns cleanly rather than erroring.
-    #[tokio::test]
-    async fn an_empty_day_sweeps_to_zero() {
-        let pool = seeded().await;
-        let counts =
-            draft_qualifying_tasks(&pool, &no_tracker_config(), DAY, &tracing::Span::none()).await;
-        assert_eq!(counts, SweepCounts::default());
-    }
+    use super::parse_hh_mm;
 
     #[test]
     fn parses_valid_times() {
@@ -474,15 +219,26 @@ mod tests {
     /// output to assert on - it just made the feature silently do nothing for every
     /// tracker-less user, in a build that otherwise looked healthy. Drafting works
     /// without a tracker (a personal day-task is matched and drafted like any
+    /// The tracker gate must not come back, in EITHER half of this module.
+    ///
+    /// Source-level because the gate was a bare early return with no observable
+    /// output to assert on - it just made the feature silently do nothing for every
+    /// tracker-less user, in a build that otherwise looked healthy. Drafting works
+    /// without a tracker (a personal day-task is matched and drafted like any
     /// ticket); only the propose branch needs one, and it already fails per-task.
+    ///
+    /// Scans `mod.rs` AND `sweep.rs`. When this module was one file the scan was
+    /// one `include_str!`; splitting it for the 500-line cap would have quietly
+    /// halved the guard's reach, leaving the sweep itself - the half that
+    /// actually enumerates tasks - uncovered while the test still passed.
     #[test]
     fn neither_sweep_is_gated_on_a_connected_tracker() {
-        let src = include_str!("auto_generate.rs");
+        let src = concat!(include_str!("mod.rs"), "\n", include_str!("sweep.rs"));
         // Comment lines dropped, not just their markers - the module doc above
         // quotes the removed gate verbatim to explain why it went.
         let code: String = src
             .lines()
-            .filter(|l| !l.trim_start().starts_with("//"))
+            .filter(|l: &&str| !l.trim_start().starts_with("//"))
             .collect::<Vec<_>>()
             .join("\n");
         // Assembled, not written out: a literal would match itself on this very line.
diff --git a/src/pm_worklog/auto_generate/sweep.rs b/src/pm_worklog/auto_generate/sweep.rs
new file mode 100644
index 000000000..f0f66e796
--- /dev/null
+++ b/src/pm_worklog/auto_generate/sweep.rs
@@ -0,0 +1,308 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! The auto-generate SWEEP: refresh the board, then draft a worklog for every
+//! qualifying, not-yet-drafted day-task.
+//!
+//! Split out of [`super`] purely for the 500-line file cap; the clock gate that
+//! decides WHEN a sweep runs stays there, and this is WHAT a sweep does. Both of
+//! `super`'s entry points ([`super::maybe_auto_generate`], the daily clock
+//! trigger, and [`super::generate_now`], the on-demand one) funnel through
+//! [`draft_qualifying_tasks`], which is the single place that refreshes
+//! `pm_tasks` before matching - see its body for why that call cannot live in
+//! the two callers instead.
+//!
+//! # Who calls this
+//! [`super::run`] and [`super::generate_now`], via [`draft_qualifying_tasks`].
+//! Nothing outside `auto_generate` may call it - the clock/consent gate is
+//! `super`'s job.
+//!
+//! # Related
+//! - [`crate::intelligence::run_pm_sync`] - the gated board refresh this runs
+//!   first, and [`crate::intelligence::sync_lock`] for why a concurrent sweep
+//!   and dashboard-open do not both fetch.
+//! - [`crate::pm_worklog::generate`] - the per-task draft this loop calls.
+
+use sqlx::SqlitePool;
+
+use crate::config::Config;
+use crate::pm_worklog;
+
+use super::QUALIFYING_MINUTES;
+
+/// What one sweep did. Returned rather than only recorded onto the span so the
+/// behaviour is assertable: "did this run at all" and "did it early-return" are
+/// otherwise indistinguishable from outside, which is exactly how a tracker gate
+/// silently disabled the whole feature for solo users once already.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub(super) struct SweepCounts {
+    pub(super) total: usize,
+    pub(super) qualifying: u32,
+    pub(super) already_drafted: u32,
+    pub(super) drafted: u32,
+    pub(super) failed: u32,
+}
+
+/// Draft a worklog for every qualifying, not-yet-drafted day-task of `day_local`,
+/// recording per-run counts onto `span` and returning them. The shared body of
+/// [`maybe_auto_generate`] (gated on the clock) and [`generate_now`] (on demand); it
+/// assumes its caller has already decided a run is warranted.
+///
+/// Deliberately NOT gated on a connected tracker - a personal day-task is matched and
+/// drafted like any ticket, and only the propose branch needs one (it already fails
+/// per-task). See [`neither_sweep_is_gated_on_a_connected_tracker`].
+pub(super) async fn draft_qualifying_tasks(
+    pool: &SqlitePool,
+    config: &Config,
+    day_local: &str,
+    span: &tracing::Span,
+) -> SweepCounts {
+    // Refresh the board before matching work to tickets. Nothing does this on a
+    // timer any more (see `main.rs`'s poll loop), and this is the one consumer
+    // where a stale `pm_tasks` is actively harmful rather than merely cosmetic:
+    // matching against a ticket that was closed or reassigned hours ago writes a
+    // wrong worklog, which is worse than writing none.
+    //
+    // Placed HERE rather than in `maybe_auto_generate` and `generate_now`
+    // separately, so both sweeps get it from one call site and the two can never
+    // disagree about whether a run refreshed first. Gated (a fresh cache is a
+    // no-op) and log-and-continue: a failed sync must not cancel drafting.
+    if let Err(e) = crate::intelligence::run_pm_sync(pool, config).await {
+        tracing::warn!(
+            day = day_local, error = %crate::errors::chain(&e),
+            "worklog: pre-draft PM sync failed — matching against the cached board"
+        );
+    }
+    let tasks = match meridian_core::day_tasks::get_day_tasks(pool, day_local).await {
+        Ok(resp) => resp.tasks,
+        Err(e) => {
+            tracing::warn!(
+                day = day_local, error = %e,
+                "worklog: auto-generate day-task read failed — skipping this run"
+            );
+            return SweepCounts::default();
+        }
+    };
+    span.record("tasks_total", tasks.len());
+    let total = tasks.len();
+
+    let mut qualifying = 0u32;
+    let mut already_drafted = 0u32;
+    let mut drafted = 0u32;
+    let mut failed = 0u32;
+
+    for task in tasks {
+        if task.minutes < QUALIFYING_MINUTES {
+            continue;
+        }
+        qualifying += 1;
+
+        // Already drafted — by an earlier auto-generate run, or by the user
+        // clicking "Generate worklog" themselves. Either way this task is now the
+        // user's to drive (Regenerate in the panel), never auto-generate's again.
+        match meridian_core::day_task_worklogs::get_day_task_worklog(pool, day_local, &task.id)
+            .await
+        {
+            Ok(Some(_)) => {
+                already_drafted += 1;
+                continue;
+            }
+            Ok(None) => {}
+            Err(e) => {
+                failed += 1;
+                tracing::warn!(
+                    day = day_local, task_id = %task.id, error = %e,
+                    "worklog: auto-generate existing-draft check failed — skipping this task this run"
+                );
+                continue;
+            }
+        }
+
+        tracing::info!(
+            day = day_local, task_id = %task.id, minutes = task.minutes,
+            "worklog: threshold crossed — drafting"
+        );
+        match pm_worklog::generate(pool, config, day_local, &task.id).await {
+            Ok(draft) => {
+                drafted += 1;
+                tracing::info!(
+                    day = day_local, task_id = %task.id, state = draft.state,
+                    "worklog: auto-generated (draft only — never posted)"
+                );
+            }
+            Err(e) => {
+                failed += 1;
+                tracing::warn!(
+                    day = day_local, task_id = %task.id, error = %e,
+                    "worklog: auto-generate failed — the user can still generate it manually"
+                );
+            }
+        }
+    }
+
+    span.record("tasks_qualifying", qualifying);
+    span.record("tasks_already_drafted", already_drafted);
+    span.record("tasks_drafted", drafted);
+    span.record("tasks_failed", failed);
+    tracing::info!(
+        day = day_local,
+        qualifying,
+        already_drafted,
+        drafted,
+        failed,
+        "worklog: auto-generate run complete"
+    );
+
+    SweepCounts {
+        total,
+        qualifying,
+        already_drafted,
+        drafted,
+        failed,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{draft_qualifying_tasks, SweepCounts, QUALIFYING_MINUTES};
+    use crate::config::Config;
+    use sqlx::sqlite::SqlitePoolOptions;
+    use sqlx::SqlitePool;
+
+    const DAY: &str = "2026-08-07";
+
+    /// The two tables the sweep reads: day-tasks to enumerate, worklogs to skip
+    /// ones already drafted. `pm_providers` is a CONFIG field, not a table, so a
+    /// tracker-less user is modelled by the empty `Config` below.
+    async fn seeded() -> SqlitePool {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .unwrap();
+        for ddl in [
+            "CREATE TABLE day_tasks (day_local TEXT NOT NULL, task_id TEXT NOT NULL, \
+                title TEXT, summary TEXT, hours_json TEXT, segments_json TEXT, \
+                minutes INTEGER, status TEXT, linked_ticket TEXT, \
+                PRIMARY KEY (day_local, task_id))",
+            // Mirrors `meridian-core/src/readers/day_task_worklogs/tests.rs`'s fixture -
+            // `get_day_task_worklog` reads the targets table too, and a column short of
+            // it the read fails and every task counts as `failed` rather than
+            // `already_drafted`, which would make this test pass for the wrong reason.
+            "CREATE TABLE day_task_worklogs (day_local TEXT NOT NULL, task_id TEXT NOT NULL, \
+                provider TEXT NOT NULL DEFAULT 'local', state TEXT NOT NULL DEFAULT 'drafted', \
+                update_summary TEXT NOT NULL DEFAULT '', update_json TEXT NOT NULL DEFAULT '{}', \
+                reasoning TEXT NOT NULL DEFAULT '', propose_issue_type TEXT, propose_title TEXT, \
+                propose_description TEXT, created_task_key TEXT, last_error TEXT, \
+                create_attempt_at TEXT, drafted_minutes INTEGER, \
+                created_at TEXT NOT NULL DEFAULT '', updated_at TEXT NOT NULL DEFAULT '', \
+                PRIMARY KEY (day_local, task_id))",
+            "CREATE TABLE day_task_worklog_targets (day_local TEXT NOT NULL, \
+                task_id TEXT NOT NULL, task_key TEXT NOT NULL, provider TEXT NOT NULL, \
+                confidence REAL NOT NULL DEFAULT 0, manual INTEGER NOT NULL DEFAULT 0, \
+                position INTEGER NOT NULL DEFAULT 0, posted_comment_id TEXT, browse_url TEXT, \
+                posted_at TEXT, last_error TEXT, post_attempt_at TEXT, \
+                created_at TEXT NOT NULL DEFAULT '', update_json TEXT, \
+                PRIMARY KEY (day_local, task_id, task_key))",
+            "CREATE TABLE pm_tasks (task_key TEXT PRIMARY KEY, title TEXT NOT NULL)",
+        ] {
+            sqlx::query(ddl).execute(&pool).await.unwrap();
+        }
+        pool
+    }
+
+    async fn put_task(pool: &SqlitePool, task_id: &str, minutes: i64) {
+        sqlx::query(
+            "INSERT INTO day_tasks (day_local, task_id, title, minutes) VALUES (?, ?, ?, ?)",
+        )
+        .bind(DAY)
+        .bind(task_id)
+        .bind(format!("Task {task_id}"))
+        .bind(minutes)
+        .execute(pool)
+        .await
+        .unwrap();
+    }
+
+    async fn put_draft(pool: &SqlitePool, task_id: &str) {
+        sqlx::query("INSERT INTO day_task_worklogs (day_local, task_id) VALUES (?, ?)")
+            .bind(DAY)
+            .bind(task_id)
+            .execute(pool)
+            .await
+            .unwrap();
+    }
+
+    /// A user with NO tracker connected - the exact configuration the removed
+    /// gate used to abandon.
+    fn no_tracker_config() -> Config {
+        Config {
+            meridian_db: ":memory:".into(),
+            poll_interval_secs: 60,
+            pm_providers: Vec::new(),
+            jira_update_enabled: false,
+            jira_update_interval_s: 14_400,
+            jira_office_start_hour: 9,
+            jira_office_end_hour: 17,
+            runtime: Default::default(),
+        }
+    }
+
+    /// The functional half of [`neither_sweep_is_gated_on_a_connected_tracker`].
+    ///
+    /// That test greps the source for the gate's return; this one proves the sweep
+    /// actually walks its task list with `pm_providers` empty. The two together
+    /// close the hole: a gate written a DIFFERENT way (a different field, an early
+    /// `return` above the read) would slip past the grep, but not past this.
+    ///
+    /// Every task here is pre-drafted on purpose, so the loop reaches its
+    /// already-drafted branch and returns without ever calling `pm_worklog::generate`
+    /// - no LLM, no network, no CLI spawn. Counting the tasks it CONSIDERED is
+    /// enough: an early return yields zeroes, and nothing else does.
+    #[tokio::test]
+    async fn the_sweep_walks_its_tasks_with_no_tracker_connected() {
+        let pool = seeded().await;
+        put_task(&pool, "T1", QUALIFYING_MINUTES + 5).await;
+        put_task(&pool, "T2", QUALIFYING_MINUTES + 90).await;
+        put_draft(&pool, "T1").await;
+        put_draft(&pool, "T2").await;
+
+        let counts =
+            draft_qualifying_tasks(&pool, &no_tracker_config(), DAY, &tracing::Span::none()).await;
+
+        assert_eq!(
+            counts,
+            SweepCounts {
+                total: 2,
+                qualifying: 2,
+                already_drafted: 2,
+                drafted: 0,
+                failed: 0,
+            },
+            "a tracker-less user's tasks must still be considered"
+        );
+    }
+
+    /// The threshold still applies - "not gated on a tracker" must not become
+    /// "not gated at all".
+    #[tokio::test]
+    async fn short_tasks_are_still_below_the_threshold() {
+        let pool = seeded().await;
+        put_task(&pool, "T1", QUALIFYING_MINUTES - 1).await;
+        put_draft(&pool, "T1").await;
+
+        let counts =
+            draft_qualifying_tasks(&pool, &no_tracker_config(), DAY, &tracing::Span::none()).await;
+
+        assert_eq!(counts.total, 1);
+        assert_eq!(counts.qualifying, 0, "under the threshold, never drafted");
+        assert_eq!(counts.already_drafted, 0);
+    }
+
+    /// A day with nothing on it returns cleanly rather than erroring.
+    #[tokio::test]
+    async fn an_empty_day_sweeps_to_zero() {
+        let pool = seeded().await;
+        let counts =
+            draft_qualifying_tasks(&pool, &no_tracker_config(), DAY, &tracing::Span::none()).await;
+        assert_eq!(counts, SweepCounts::default());
+    }
+}
diff --git a/tray/src-tauri/src/commands/integrations.rs b/tray/src-tauri/src/commands/integrations.rs
index 5dbe8b53a..c075ce230 100644
--- a/tray/src-tauri/src/commands/integrations.rs
+++ b/tray/src-tauri/src/commands/integrations.rs
@@ -681,6 +681,17 @@ pub async fn save_integration_token(
         tracing::debug!("daemon reload after token save (non-fatal — will pick up on next start)");
     }
 
+    // POPULATE THE BOARD NOW. Nothing syncs on a timer any more (see
+    // `commands::tasks`'s header for why that timer was destroying OAuth
+    // grants), so without this a freshly connected tracker showed an empty
+    // board until the user happened to reopen the dashboard.
+    //
+    // FORCED, not gated: `pm_sync_state` can say "synced 2 minutes ago" from
+    // a previous account or provider while `pm_tasks` still holds that other
+    // board's tickets, and the staleness gate would wrongly skip. Connecting
+    // is rare and user-initiated, so a guaranteed fetch is the right cost.
+    crate::commands::tasks::trigger_background_pm_force_sync("token_connected");
+
     Ok(serde_json::json!({ "ok": true, "reloaded": reloaded }))
 }
 
@@ -1343,7 +1354,19 @@ fn start_oauth_in_process(provider: String) -> Result<StartOAuthResponse, String
         // Always clear the in-flight flag before returning, regardless of outcome.
         in_flight.store(false, Ordering::SeqCst);
         match result {
-            Ok(()) => tracing::info!(provider = %task_provider, "in-process OAuth login succeeded"),
+            Ok(()) => {
+                tracing::info!(provider = %task_provider, "in-process OAuth login succeeded");
+                // POPULATE THE BOARD NOW. Nothing syncs on a timer any more (see
+                // `commands::tasks`'s header for why that timer was destroying OAuth
+                // grants), so without this a freshly connected tracker showed an empty
+                // board until the user happened to reopen the dashboard.
+                //
+                // FORCED, not gated: `pm_sync_state` can say "synced 2 minutes ago" from
+                // a previous account or provider while `pm_tasks` still holds that other
+                // board's tickets, and the staleness gate would wrongly skip. Connecting
+                // is rare and user-initiated, so a guaranteed fetch is the right cost.
+                crate::commands::tasks::trigger_background_pm_force_sync("oauth_connected");
+            }
             Err(e) => {
                 let msg = format!("{e:#}");
                 tracing::warn!(provider = %task_provider, error = %msg, "in-process OAuth login failed");
@@ -1461,6 +1484,16 @@ async fn start_oauth_github_device(
                 if let Err(e) = crate::commands::daemon::reload_daemon_with(db_pool).await {
                     tracing::debug!(error = %e, "daemon reload after GitHub connect (non-fatal)");
                 }
+                // POPULATE THE BOARD NOW. Nothing syncs on a timer any more (see
+                // `commands::tasks`'s header for why that timer was destroying OAuth
+                // grants), so without this a freshly connected tracker showed an empty
+                // board until the user happened to reopen the dashboard.
+                //
+                // FORCED, not gated: `pm_sync_state` can say "synced 2 minutes ago" from
+                // a previous account or provider while `pm_tasks` still holds that other
+                // board's tickets, and the staleness gate would wrongly skip. Connecting
+                // is rare and user-initiated, so a guaranteed fetch is the right cost.
+                crate::commands::tasks::trigger_background_pm_force_sync("oauth_connected");
             }
             Err(e) => {
                 let msg = format!("{e:#}");
diff --git a/tray/src-tauri/src/commands/system.rs b/tray/src-tauri/src/commands/system.rs
index 48d8c364d..d09390b0b 100644
--- a/tray/src-tauri/src/commands/system.rs
+++ b/tray/src-tauri/src/commands/system.rs
@@ -42,6 +42,16 @@ pub async fn open_dashboard(app: tauri::AppHandle) -> Result<(), String> {
         crate::tray::open_wizard_window(&app);
         return Ok(());
     }
+    // ON-DEMAND PM SYNC. The daemon no longer syncs the board on a timer (see
+    // `commands::tasks`'s header for why that timer was killing OAuth grants),
+    // so opening the dashboard is one of the moments that has to ask for a
+    // refresh. Placed AFTER the onboarding gate: a fresh install has no tracker
+    // to sync and the redirect above returns before reaching here.
+    //
+    // Fire-and-forget and gated - the window paints from the cached board
+    // immediately and never waits on the network, and a re-open seconds later
+    // no-ops on the staleness gate rather than re-fetching.
+    crate::commands::tasks::trigger_background_pm_sync("dashboard_open");
     dismiss_popover(&app);
     if let Some(win) = app.get_webview_window("dashboard") {
         let _ = win.show();
diff --git a/tray/src-tauri/src/commands/tasks.rs b/tray/src-tauri/src/commands/tasks.rs
index 882eb515e..97b58e872 100644
--- a/tray/src-tauri/src/commands/tasks.rs
+++ b/tray/src-tauri/src/commands/tasks.rs
@@ -8,13 +8,35 @@
 //! not in meridian-core. (The per-task *read*, `get_tasks`, stays in
 //! [`crate::commands::dashboard`].)
 //!
+//! Also home to the ON-DEMAND sync triggers that replaced the daemon's standing
+//! timer. PM sync used to run on every poll tick forever, which is what put a
+//! rotating-OAuth-token refresh POST in flight during a macOS dark wake: the
+//! machine re-suspended mid-request, the reply was lost, and the retry landed
+//! outside Atlassian's 10-minute reuse leeway, killing the grant permanently.
+//! A sleeping machine has no work to do, so it should attempt no refreshes -
+//! these triggers fire on things a PRESENT user did instead.
+//!
+//! # Why a process spawn and not a table
+//! The reverted `pm_sync_requests` outbox (PRs #909/#910) coordinated the tray
+//! and the daemon through `meridian.db`, and the tray's read-back of the outcome
+//! is what failed in production with `SQLITE_IOERR_SHORT_READ` (522) - a short
+//! read while the daemon truncated the WAL on shutdown. These triggers have no
+//! outcome to read: they spawn `meridian pm-sync` and forget it. There is no
+//! handshake, no new table, and no migration, so shipping them cannot damage a
+//! database or leave a request stuck.
+//!
 //! # Who calls this
 //! Registered in `lib.rs`'s `invoke_handler!`; consumed by `TasksView.tsx`'s Sync
 //! button via `ui/lib/bridge.ts::mutate` (success → re-fetch; error → inline msg).
+//! [`trigger_background_pm_sync`] is called by [`crate::commands::system::open_dashboard`]
+//! and [`crate::tray`]'s menu opener; [`trigger_background_pm_force_sync`] by
+//! [`crate::commands::integrations`] on a successful tracker connect.
 //!
 //! # Related
 //! - [`crate::install::meridian_bin`] — the shared native-first binary resolver.
 //! - [`crate::commands::parents`] — the other read-side `meridian` CLI shell-out.
+//! - `meridian::intelligence::sync_lock` — the cross-process lock that stops two
+//!   near-simultaneous triggers both fetching the same board.
 
 use meridian_core::proc_ext::NoWindow;
 use serde::Serialize;
@@ -40,6 +62,52 @@ pub struct SyncResult {
 #[tauri::command]
 #[tracing::instrument]
 pub async fn sync_tasks() -> Result<SyncResult, String> {
+    let output = spawn_meridian_cli("tasks-sync", SYNC_TIMEOUT).await?;
+
+    if output.status.success() {
+        let detail = String::from_utf8_lossy(&output.stdout).trim().to_string();
+        tracing::info!("tasks-sync ok");
+        Ok(SyncResult { ok: true, detail })
+    } else {
+        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+        // Log the CLI's own reason, not just the exit code. `status=Some(1)` alone
+        // says nothing — the failure is always explained in stderr, and dropping it
+        // turned a one-line diagnosis into a manual re-run of the subcommand.
+        tracing::warn!(
+            status = ?output.status.code(),
+            stderr = %stderr,
+            "tasks-sync non-zero"
+        );
+        Err(if stderr.is_empty() {
+            "tasks-sync failed".to_string()
+        } else {
+            stderr
+        })
+    }
+}
+
+/// Budget for a background trigger's `meridian pm-sync`.
+///
+/// Longer than [`SYNC_TIMEOUT`] because nobody is watching a spinner - but still
+/// bounded, and bounded for a specific reason: a `pm-sync` whose HTTP request
+/// straddles a system suspend does NOT time out on its own (`reqwest`'s timeout
+/// is `Instant`-based, and the monotonic clock does not advance while macOS is
+/// asleep), so without a ceiling here an orphan can sit holding the cross-process
+/// sync lock and starve every later trigger.
+const TRIGGER_TIMEOUT: Duration = Duration::from_secs(90);
+
+/// Spawn `meridian <subcommand>` and wait for it, with `timeout` and
+/// `kill_on_drop`.
+///
+/// Factored out of [`sync_tasks`] so the button and the background triggers can
+/// never drift on the two things that are easy to get wrong and invisible when
+/// wrong: the cwd (which picks the credentials, because dotenvy walks up from it)
+/// and `kill_on_drop` (without which a timed-out child keeps running and can
+/// still mutate the board after the caller gave up).
+async fn spawn_meridian_cli(
+    subcommand: &str,
+    timeout: Duration,
+) -> Result<std::process::Output, String> {
     let bin = crate::install::meridian_bin();
     // The cwd picks the credentials, because dotenvy walks up from it: a release
     // build lands on the canonical ~/.meridian/.env (AZURE_DEVOPS_PAT, JIRA_URL, …),
@@ -49,67 +117,100 @@ pub async fn sync_tasks() -> Result<SyncResult, String> {
     // WHICH binary ran, and from where, are the two facts that make a failure here
     // legible: a stale installed CLI against a DB the dev daemon migrated ahead
     // exits non-zero with nothing but `status=Some(1)` in the log otherwise.
-    tracing::debug!(bin = %bin, cwd = %cwd.display(), "tasks-sync: spawning");
+    tracing::debug!(subcommand, bin = %bin, cwd = %cwd.display(), "meridian cli: spawning");
     let child = tokio::process::Command::new(&bin)
-        .arg("tasks-sync")
+        .arg(subcommand)
         .current_dir(&cwd)
         .stdin(std::process::Stdio::null())
         .stdout(std::process::Stdio::piped())
         .stderr(std::process::Stdio::piped())
         // On timeout below, `tokio::time::timeout` drops the output future; without
-        // this the orphaned `meridian tasks-sync` keeps running (and can still mutate
-        // the board) after the UI reports a failure. The deleted /api/tasks/sync route
-        // called child.kill() on its 30s timer — kill_on_drop preserves that contract.
+        // this the orphaned child keeps running (and can still mutate the board)
+        // after the caller reports a failure.
         .kill_on_drop(true)
         .no_window()
         .output();
 
-    let output = match tokio::time::timeout(SYNC_TIMEOUT, child).await {
+    match tokio::time::timeout(timeout, child).await {
         Err(_) => {
             // `kill_on_drop` reaps the child here, taking its stderr with it, so
             // this log is the ONLY record a timeout ever leaves. Emitting a bare
-            // "tasks-sync timed out" (as it did) makes the two cases that matter
-            // indistinguishable in a support bundle: a genuinely slow tracker
-            // sync vs. a `meridian` binary that never got past opening a corrupt
-            // meridian.db. WHICH binary and WHICH cwd is what separates them —
-            // the same two facts the spawn/non-zero arms below already log.
+            // "timed out" makes the two cases that matter indistinguishable in a
+            // support bundle: a genuinely slow tracker sync vs. a `meridian`
+            // binary that never got past opening a corrupt meridian.db.
             tracing::warn!(
+                subcommand,
                 bin = %bin,
                 cwd = %cwd.display(),
-                timeout_s = SYNC_TIMEOUT.as_secs(),
-                "tasks-sync timed out"
+                timeout_s = timeout.as_secs() as f64,
+                "meridian cli timed out"
             );
-            return Err(format!(
-                "tasks-sync timed out after {}s",
-                SYNC_TIMEOUT.as_secs()
-            ));
+            Err(format!(
+                "{subcommand} timed out after {}s",
+                timeout.as_secs()
+            ))
         }
         Ok(Err(e)) => {
-            tracing::warn!(bin = %bin, error = %e, "tasks-sync spawn failed");
-            return Err(format!("spawn error: {e}"));
+            tracing::warn!(subcommand, bin = %bin, error = %e, "meridian cli spawn failed");
+            Err(format!("spawn error: {e}"))
         }
-        Ok(Ok(o)) => o,
-    };
-
-    if output.status.success() {
-        let detail = String::from_utf8_lossy(&output.stdout).trim().to_string();
-        tracing::info!("tasks-sync ok");
-        Ok(SyncResult { ok: true, detail })
-    } else {
-        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-        // Log the CLI's own reason, not just the exit code. `status=Some(1)` alone
-        // says nothing — the failure is always explained in stderr, and dropping it
-        // turned a one-line diagnosis into a manual re-run of the subcommand.
-        tracing::warn!(
-            status = ?output.status.code(),
-            bin = %bin,
-            stderr = %stderr,
-            "tasks-sync non-zero"
-        );
-        Err(if stderr.is_empty() {
-            "tasks-sync failed".to_string()
-        } else {
-            stderr
-        })
+        Ok(Ok(o)) => Ok(o),
     }
 }
+
+/// Fire off a GATED background sync and return immediately.
+///
+/// `reason` names the trigger (`"dashboard_open"`, `"token_connected"`, …) and is
+/// logged, so the on-demand schedule is legible in a support bundle - "why did
+/// this install sync at 09:14" has an answer.
+///
+/// Detached on purpose: the caller is opening a window or finishing a settings
+/// save, and must not wait on the network to do it. Every outcome logs at
+/// `debug`/`warn` and NOTHING is surfaced to the UI - a best-effort refresh that
+/// failed is not a thing to interrupt someone with, and the next trigger retries.
+///
+/// Gated, not forced: these fire repeatedly within seconds (open the dashboard,
+/// close it, open it again), and a forced fetch each time would recreate exactly
+/// the API hammering the removed timer was doing.
+pub(crate) fn trigger_background_pm_sync(reason: &'static str) {
+    spawn_trigger("pm-sync", reason);
+}
+
+/// Fire off a FORCED background sync and return immediately.
+///
+/// For the moments where the cache is knowingly wrong and the staleness gate
+/// would wrongly skip: a tracker was just connected, so `pm_sync_state` may say
+/// "synced 2 minutes ago" from a previous account while `pm_tasks` holds another
+/// board's tickets. Same detached, best-effort, never-surfaced discipline as
+/// [`trigger_background_pm_sync`].
+pub(crate) fn trigger_background_pm_force_sync(reason: &'static str) {
+    spawn_trigger("tasks-sync", reason);
+}
+
+/// Shared body of the two triggers: spawn onto the runtime, log the outcome,
+/// surface nothing. One place so the two can never disagree about what
+/// "best-effort" means.
+fn spawn_trigger(subcommand: &'static str, reason: &'static str) {
+    tauri::async_runtime::spawn(async move {
+        match spawn_meridian_cli(subcommand, TRIGGER_TIMEOUT).await {
+            Ok(o) if o.status.success() => {
+                tracing::debug!(subcommand, reason, "background pm sync finished");
+            }
+            Ok(o) => {
+                // WARN, not ERROR: a tracker being briefly unreachable is
+                // ordinary, and the next trigger retries. Carrying stderr means
+                // a real fault (dead grant, bad JQL) is still diagnosable.
+                tracing::warn!(
+                    subcommand,
+                    reason,
+                    status = ?o.status.code(),
+                    stderr = %String::from_utf8_lossy(&o.stderr).trim(),
+                    "background pm sync exited non-zero"
+                );
+            }
+            Err(e) => {
+                tracing::warn!(subcommand, reason, detail = %e, "background pm sync failed");
+            }
+        }
+    });
+}
diff --git a/tray/src-tauri/src/tray.rs b/tray/src-tauri/src/tray.rs
index 58c61b322..0066a1b0c 100644
--- a/tray/src-tauri/src/tray.rs
+++ b/tray/src-tauri/src/tray.rs
@@ -116,6 +116,16 @@ pub(crate) fn open_native_dashboard(app: &tauri::AppHandle) {
         open_wizard_window(app);
         return;
     }
+    // ON-DEMAND PM SYNC. The daemon no longer syncs the board on a timer (see
+    // `commands::tasks`'s header for why that timer was killing OAuth grants),
+    // so opening the dashboard is one of the moments that has to ask for a
+    // refresh. Placed AFTER the onboarding gate: a fresh install has no tracker
+    // to sync and the redirect above returns before reaching here.
+    //
+    // Fire-and-forget and gated - the window paints from the cached board
+    // immediately and never waits on the network, and a re-open seconds later
+    // no-ops on the staleness gate rather than re-fetching.
+    crate::commands::tasks::trigger_background_pm_sync("dashboard_open_menu");
     crate::commands::system::dismiss_popover(app);
     if let Some(win) = app.get_webview_window("dashboard") {
         let _ = win.show();
diff --git a/ui/components/timeline/settings/IntegrationsSection.tsx b/ui/components/timeline/settings/IntegrationsSection.tsx
index 76fe3acb5..11e2ac66e 100644
--- a/ui/components/timeline/settings/IntegrationsSection.tsx
+++ b/ui/components/timeline/settings/IntegrationsSection.tsx
@@ -64,7 +64,7 @@ export function IntegrationsSection({ integrations, onChanged, gate = false, onD
               Connected to {connected.map(t => t.name).join(', ')}
             </p>
             <p className="text-[11.5px] font-semibold mt-0.5" style={{ color: 'color-mix(in srgb, var(--color-state-approved) 75%, var(--t-muted))' }}>
-              Syncing every hour
+              Kept in sync automatically
             </p>
           </div>
         </div>

From 4a0a2fc4e44a193a978161937c83634460ca3707 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Fri, 28 Aug 2026 15:03:31 +0530
Subject: [PATCH 27/53] fix(oauth): make the Jira refresh-token exchange crash-
 and suspend-safe

The previous commit removed the timer that made a lost refresh LIKELY.
This fixes the exchange itself so a lost response is RECOVERABLE.

Atlassian rotates the refresh token on every use, so the exchange has a
window where the old token is already dead server-side and we do not yet
know its replacement. Nothing recorded that a spend had been attempted,
so there was no way to tell "never spent" from "spent, answer lost" - and
those need opposite handling. Every lost response destroyed the grant
permanently and the user had to re-authenticate by hand.

Three mechanisms, all load-bearing:

* meridian-oauth/src/refresh_journal.rs - the token about to be spent is
  written and fsync'd (file AND directory) BEFORE the POST, and cleared
  only AFTER the new pair is persisted. Recovery is decided by COMPARING
  TOKENS, not by trusting a flag: journalled == stored means the save
  never landed, so replay; journalled != stored means it did land and we
  died before clearing, so the journal is stale. That makes every crash
  point recoverable and needs no "in progress" boolean that could itself
  go stale.

* A wall-clock deadline on each token POST (flow.rs). Every `.timeout()`
  and every tokio timer measures `Instant`, which on macOS does not
  advance while the system sleeps - so a request in flight when the lid
  closes was not cancelled by its 8s timeout, it hung for the entire
  suspend. The watchdog still sleeps monotonically (that is the only
  timer available) but compares the WALL clock on each tick, so nothing
  fires mid-suspend and it gives up immediately on resume. Abandoning
  promptly is what leaves enough of the provider's reuse grace to replay.

* ensure_fresh replays an unresolved spend with the journalled token.
  Atlassian honours the previous refresh token for a grace period after
  rotation, so re-presenting it returns the current pair and recovers the
  grant. REPLAY_WINDOW_SECS is 8 minutes against a documented 10, leaving
  margin for NTP skew on wake and for the request's own duration.

Two failure modes deliberately chosen:

* If the journal cannot be written, the refresh is ABANDONED rather than
  attempted. Spending a rotating token with no durable record is the
  unrecoverable state this exists to prevent.
* If `store::save` fails after a successful exchange, the journal is
  KEPT. The new pair is only in memory, so the journal is the only thing
  that says the stored token may already be spent.

The fast path now also checks the journal: a valid access token can
coexist with a refresh token already consumed server-side, and returning
early on "not expired" would leave that unresolved for up to an hour -
long past the grace, turning a late recovery into an impossible one.

Escalation no longer false-positives on normal quiet periods
------------------------------------------------------------
note_transient_sync_failure escalated when there had been no successful
sync for 6 hours. That was correct under a timer - its own doc said
"comfortably longer than any provider's sync interval" - but with
on-demand sync a weekend of quiet is normal, so the first two failures
after any gap escalated. Opening the dashboard on Monday before Wi-Fi
associated raised a red "sync failing" banner on a healthy install,
bodied "No successful sync in the last 6 hours" while describing normal
use. That was a regression introduced by the previous commit.

It now counts CONSECUTIVE failures (threshold 4), held in memory rather
than in pm_sync_state: no migration, cannot corrupt a database, and
resetting on restart is the safe direction - a fresh process starts at
zero, so a wake can never inherit a stale streak. A blocked proxy fails
every attempt; a wake-time blip fails once or twice and then works.

This deletes the grace-row/epoch-sentinel mechanism, which also fixes a
display bug: mark_first_stale_failure stamped last_synced_at back to
1970, and the health check would have rendered that as "last synced
29799360m ago". stamp_sync_error still writes the sentinel on a
never-synced provider, so the health check now detects it explicitly.

The wake-triggered drafting pass no longer refreshes
---------------------------------------------------
worklog_pipeline::run_loop is a clock-aligned HH:03 timer that also runs
once at startup, and launchd KeepAlive restarts the daemon on every wake
- so the startup pass is wake-triggered by construction, and the previous
commit's pre-draft sync made it a wake-triggered token refresh. A new
RefreshBoard enum splits them: the startup pass drafts against the cached
board, the chosen-hour tick (when the user is far more likely to be
present) refreshes first. I stated "no polling" absolutely in the
previous commit; that was wrong, and this is the correction.

Tests
-----
* Both journal crash points, the corrupt-journal path, 0600 permissions,
  the wall-clock window's clamping, and that a fresh access token cannot
  hide an unresolved spend.
* Escalation: a single blip and a blip after 72h of quiet both stay
  silent; four consecutive failures escalate with wording that names the
  evidence rather than a duration; a success resets; streaks do not leak
  between providers.
* the_startup_pass_never_refreshes_and_the_chosen_hour_tick_does pins the
  pairing source-level, because the wrong value there is silent.
* Two pre-existing tests were sharing a provider name and leaking the
  streak between parallel threads; they now use unique keys.

No migration, no DDL, no new table - verified. jira.rs and
auto_generate.rs both passed 500 lines and were split.

Still not immune: a suspend longer than the reuse grace, landing inside
the exchange, remains unrecoverable. Scoped API tokens are the only
structurally immune credential and are a separate change.
---
 meridian-oauth/src/flow.rs                    |  75 ++-
 meridian-oauth/src/{jira.rs => jira/mod.rs}   | 214 +++++---
 meridian-oauth/src/jira/tests.rs              | 184 +++++++
 meridian-oauth/src/lib.rs                     |   1 +
 meridian-oauth/src/refresh_journal.rs         | 338 ++++++++++++
 src/health/jira.rs                            |  46 +-
 src/intelligence/providers/mod.rs             | 303 +++--------
 .../providers/sync_failure_tests.rs           | 514 ++++++------------
 src/pm_worklog/auto_generate/mod.rs           |  84 ++-
 src/pm_worklog/auto_generate/sweep.rs         |  53 +-
 src/worklog_pipeline.rs                       |  26 +-
 11 files changed, 1188 insertions(+), 650 deletions(-)
 rename meridian-oauth/src/{jira.rs => jira/mod.rs} (66%)
 create mode 100644 meridian-oauth/src/jira/tests.rs
 create mode 100644 meridian-oauth/src/refresh_journal.rs

diff --git a/meridian-oauth/src/flow.rs b/meridian-oauth/src/flow.rs
index 6bd3689e1..0968646e5 100644
--- a/meridian-oauth/src/flow.rs
+++ b/meridian-oauth/src/flow.rs
@@ -255,6 +255,77 @@ fn truncate_body(text: &str) -> String {
     format!("{} (truncated, {} bytes total)", &text[..end], text.len())
 }
 
+/// Wall-clock ceiling for ONE token-endpoint attempt, in seconds.
+///
+/// Sits alongside `reqwest`'s own 8 s `.timeout()` rather than replacing it, and
+/// the two measure different things on purpose.
+const WALL_CLOCK_BUDGET_SECS: i64 = 20;
+
+/// Run `fut`, abandoning it if the WALL CLOCK advances past `budget_secs`.
+///
+/// # Why `reqwest`'s own timeout is not enough
+///
+/// Every `.timeout()` in this codebase - and every `tokio::time` primitive -
+/// measures `Instant`, which on macOS is `mach_absolute_time` and DOES NOT ADVANCE
+/// while the system is asleep. So a request in flight when the lid closes is not
+/// cancelled by its 8 s timeout: it hangs for the entire suspend, and on wake the
+/// retry goes out with a refresh token that the provider rotated (and stopped
+/// honouring) half an hour ago. That is the exact sequence that killed production
+/// grants; see [`crate::refresh_journal`]'s header for the measured case.
+///
+/// The watchdog below still SLEEPS on the monotonic clock - it has to, that is the
+/// only timer available - but every time it wakes it compares the WALL clock. A
+/// suspend freezes both clocks, so nothing fires mid-suspend; the instant the
+/// machine resumes, the first tick sees the wall clock has jumped and gives up
+/// immediately. Abandoning promptly on wake is the whole point: it is what leaves
+/// enough of the provider's reuse grace to replay the spend and recover the grant,
+/// instead of discovering the loss when the window has already closed.
+///
+/// Abandoning is classified TRANSIENT: an unanswered request says nothing about
+/// whether the grant is valid, and treating it as terminal is what turned a
+/// suspend into "re-authenticate".
+async fn with_wall_clock_deadline<F, T>(budget_secs: i64, fut: F) -> Result<T, TokenError>
+where
+    F: std::future::Future<Output = Result<T, TokenError>>,
+{
+    let started = wall_clock_unix();
+    // Boxed so the future can be polled repeatedly across successive `timeout`
+    // slices: `timeout` takes its future by value, but `&mut Pin<Box<F>>` is
+    // itself a future, so borrowing it preserves the in-flight request between
+    // slices instead of restarting it.
+    let mut fut = Box::pin(fut);
+    loop {
+        // The MONOTONIC slice is just a heartbeat, not the deadline. Deliberately
+        // short so that the wall-clock check below runs promptly after a resume.
+        match tokio::time::timeout(Duration::from_millis(500), &mut fut).await {
+            // The request answered. Checked before the clock on purpose: a
+            // response already in hand must never be discarded, because the
+            // refresh token it cost has already been spent.
+            Ok(out) => return out,
+            Err(_) => {
+                let elapsed = wall_clock_unix().saturating_sub(started);
+                if elapsed > budget_secs {
+                    return Err(TokenError::transient(format!(
+                        "token endpoint did not answer within {elapsed}s of wall-clock \
+                         time (a system suspend, or a stalled connection); abandoning \
+                         so the spend can be replayed while the provider still \
+                         honours the previous token"
+                    )));
+                }
+            }
+        }
+    }
+}
+
+/// Wall-clock unix seconds. `0` if the clock is before the epoch, which only
+/// happens on a badly misconfigured machine and would otherwise panic.
+fn wall_clock_unix() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs() as i64)
+        .unwrap_or(0)
+}
+
 /// [`post_token`] with bounded retry-with-backoff for transient failures. Only
 /// [`TokenFailure::Transient`] errors are retried; a terminal rejection returns
 /// immediately so a genuinely dead token isn't hidden behind seconds of backoff.
@@ -272,7 +343,9 @@ async fn post_token_retrying(
         .map_err(|e| TokenError::transient(format!("building HTTP client: {e}")))?;
     let mut backoff = Duration::from_millis(400);
     for attempt in 1..=TOKEN_POST_ATTEMPTS {
-        match post_token(&client, token_url, body).await {
+        match with_wall_clock_deadline(WALL_CLOCK_BUDGET_SECS, post_token(&client, token_url, body))
+            .await
+        {
             Ok(resp) => return Ok(resp),
             Err(e) if e.is_transient() && attempt < TOKEN_POST_ATTEMPTS => {
                 tracing::warn!(
diff --git a/meridian-oauth/src/jira.rs b/meridian-oauth/src/jira/mod.rs
similarity index 66%
rename from meridian-oauth/src/jira.rs
rename to meridian-oauth/src/jira/mod.rs
index 198901125..54b147edb 100644
--- a/meridian-oauth/src/jira.rs
+++ b/meridian-oauth/src/jira/mod.rs
@@ -236,28 +236,55 @@ pub async fn login(client_id: &str, client_secret: &str, port: u16) -> Result<St
     Ok(site_url)
 }
 
-/// Load the stored tokens, refreshing the access token if it's within 120 s of
-/// expiry. Persists the rotated refresh token. Returns ready-to-use tokens.
+/// Load the stored tokens, refreshing the access token if it is within 120 s of
+/// expiry. Returns ready-to-use tokens.
 ///
-/// Refreshes are serialised on TWO levels so the rotating refresh token is never
-/// double-spent: a static mutex within this process, and an advisory FILE lock
-/// ([`store::lock_provider`]) across every Meridian process. After taking the file
-/// lock it RE-LOADS and re-checks expiry — so a process that waited on the lock
-/// adopts the peer's freshly-refreshed token instead of POSTing again with the
-/// now-consumed one (the old single-process-mutex behaviour caused that 401 loop).
+/// # Why this is more than "POST if expired"
+///
+/// Atlassian ROTATES the refresh token on every use, so a refresh has a window in
+/// which the old token is already dead server-side and we do not yet know its
+/// replacement. Losing the response in that window destroyed production users'
+/// grants permanently. Three mechanisms close it, and all three are load-bearing:
+///
+/// 1. **Serialisation.** A static mutex within this process and an advisory FILE
+///    lock across every Meridian process ([`store::lock_provider`]), so the token
+///    is never double-spent. After taking the file lock this RE-LOADS and
+///    re-checks expiry, so a process that waited adopts the peer's fresh token
+///    rather than POSTing with the now-consumed one.
+/// 2. **A durable journal** ([`crate::refresh_journal`]) written and `fsync`ed
+///    BEFORE the POST, and cleared only AFTER the new pair is persisted. That is
+///    what makes a lost response recoverable at all: without it there is no way to
+///    tell "never spent" from "spent, answer lost", and those need opposite
+///    handling.
+/// 3. **A wall-clock deadline** on the POST itself (in [`flow`]), because every
+///    `Instant`-based timeout sleeps straight through a system suspend. Abandoning
+///    promptly on wake is what leaves enough of the provider's reuse grace for the
+///    replay in (2) to succeed.
+///
+/// # What a replay does
+///
+/// If a journal entry survives, the previous spend's outcome is unknown. Atlassian
+/// honours the PREVIOUS refresh token for a short grace period after rotation, so
+/// re-presenting it returns the current pair and recovers the grant. That is only
+/// possible while the grace holds, which is why (3) exists.
 pub async fn ensure_fresh() -> Result<OAuthTokens> {
     let _guard = refresh_lock().lock().await; // intra-process serialisation
 
-    // Fast path: a still-fresh token needs neither a refresh nor the file lock.
+    // Fast path: a still-fresh token with no unresolved spend needs neither a
+    // refresh nor the file lock. The journal check is part of the condition, not
+    // an afterthought - a fresh access token can coexist with a spend whose
+    // outcome was lost, and skipping straight past that would leave the stored
+    // refresh token dead and only discover it an hour later, outside the grace.
     let t = store::load("jira")?;
-    if !t.is_expired(now_unix(), 120) {
+    if !t.is_expired(now_unix(), 120) && crate::refresh_journal::load("jira").is_none() {
         return Ok(t);
     }
 
-    // Slow path: enter the cross-process critical section. A peer (a second daemon,
-    // the tray's in-process refresh) may be rotating the SAME refresh token right
-    // now. Best-effort — if the lock can't be taken we log and proceed rather than
-    // turn the lock itself into a new way for Jira auth to fail.
+    // Slow path: enter the cross-process critical section. A peer (a second
+    // daemon, the tray's in-process refresh) may be rotating the SAME refresh
+    // token right now. Best-effort - if the lock cannot be taken we log and
+    // proceed rather than turn the lock itself into a new way for Jira auth to
+    // fail.
     let _flock = match store::lock_provider("jira").await {
         Ok(g) => Some(g),
         Err(e) => {
@@ -273,17 +300,68 @@ pub async fn ensure_fresh() -> Result<OAuthTokens> {
     // adopt their token instead of refreshing again with the dead one. This
     // double-check is what actually breaks the race.
     let mut t = store::load("jira")?;
-    if !t.is_expired(now_unix(), 120) {
+    let pending = reconcile_journal("jira", &t);
+    if pending.is_none() && !t.is_expired(now_unix(), 120) {
         tracing::debug!("jira token already refreshed by another process — adopting it");
         return Ok(t);
     }
 
-    tracing::debug!("jira OAuth access token expired — refreshing");
-    let resp = flow::refresh(&t.client_id, &spec(), &t.refresh_token)
+    // WHICH token to send. A pending spend means the last attempt's outcome is
+    // unknown and the stored token may already be consumed; the journalled one is
+    // the only thing the provider might still honour, so it is re-presented
+    // verbatim. Otherwise this is an ordinary refresh with the stored token.
+    let (refresh_token, client_id, replaying) = match &pending {
+        Some(spend) => {
+            let age = spend.age_secs(now_unix());
+            if spend.within_replay_window(now_unix()) {
+                tracing::warn!(
+                    age_s = age as f64,
+                    "replaying an unresolved Jira refresh inside the provider's reuse grace"
+                );
+            } else {
+                // Attempted anyway: it costs one HTTP call, and the alternative is
+                // a guaranteed re-authentication. Logged as expected-to-fail so it
+                // does not read as a surprise in a support bundle.
+                tracing::warn!(
+                    age_s = age as f64,
+                    window_s = crate::refresh_journal::REPLAY_WINDOW_SECS as f64,
+                    "replaying an unresolved Jira refresh PAST the reuse grace - \
+                     likely to fail; re-authentication may be required"
+                );
+            }
+            (spend.refresh_token.clone(), spend.client_id.clone(), true)
+        }
+        None => {
+            tracing::debug!("jira OAuth access token expired — refreshing");
+            (t.refresh_token.clone(), t.client_id.clone(), false)
+        }
+    };
+
+    // JOURNAL BEFORE SPENDING. If this write fails the refresh is ABANDONED
+    // rather than attempted: proceeding would spend a rotating token with no
+    // record of having done so, which is precisely the unrecoverable state this
+    // whole path exists to prevent. Refusing costs one stale sync cycle; the
+    // access token in hand is still returned by the error path's caller on the
+    // next attempt.
+    if !replaying {
+        let spend = crate::refresh_journal::PendingSpend {
+            refresh_token: refresh_token.clone(),
+            started_at_unix: now_unix(),
+            client_id: client_id.clone(),
+        };
+        crate::refresh_journal::record_spend("jira", &spend).context(
+            "could not journal the Jira refresh before spending it — refusing to spend a \
+             rotating refresh token without a durable record, since a lost response would \
+             then be unrecoverable. Check permissions on ~/.meridian/oauth/.",
+        )?;
+    }
+
+    let resp = flow::refresh(&client_id, &spec(), &refresh_token)
         .await
         .context(
             "refreshing Jira OAuth token — re-run `meridian oauth-login jira` if this persists",
         )?;
+
     t.access_token = resp.access_token;
     if !resp.refresh_token.is_empty() {
         t.refresh_token = resp.refresh_token; // Atlassian rotates the refresh token
@@ -292,25 +370,61 @@ pub async fn ensure_fresh() -> Result<OAuthTokens> {
     if !resp.scope.is_empty() {
         t.scopes = resp.scope;
     }
-    // Save the rotated tokens. If save fails (disk full, permissions), log a
-    // critical error and return the in-memory tokens anyway — the access token
-    // is valid for ~1h so the current request succeeds. On the next expiry the
-    // stored (now-invalid) refresh token will cause a 401 and the user must
-    // re-authenticate. A critical log surfaces this before it happens.
+
+    // PERSIST FIRST, CLEAR SECOND. A crash between the two is harmless:
+    // `reconcile_journal` compares the journalled token against the stored one,
+    // sees they differ, and clears the journal then. The reverse order would lose
+    // the only record of the spend at exactly the wrong moment.
     match store::save(&t) {
-        Ok(()) => {}
+        Ok(()) => {
+            crate::refresh_journal::clear("jira");
+            if replaying {
+                tracing::info!("recovered the Jira grant by replaying an unresolved refresh");
+            }
+        }
         Err(e) => {
+            // The journal is deliberately LEFT IN PLACE. The new pair is only in
+            // memory, so on the next process the stored refresh token is the old
+            // one and the journal is what says "that one may already be spent" -
+            // deleting it here would throw away the recovery path.
             tracing::error!(
                 error = %e,
-                "CRITICAL: failed to persist rotated Jira refresh token — access token \
-                 valid for ~1h but re-authentication required after expiry. Fix \
-                 permissions at ~/.meridian/oauth/ then re-run `meridian oauth-login jira`."
+                "CRITICAL: failed to persist rotated Jira refresh token — the access token \
+                 is valid for ~1h and the refresh journal has been kept so the next attempt \
+                 can recover. Fix permissions at ~/.meridian/oauth/."
             );
         }
     }
     Ok(t)
 }
 
+/// Decide what an existing journal entry means, and return the spend that still
+/// needs resolving (if any).
+///
+/// The decision is made by COMPARING TOKENS rather than trusting a flag, which is
+/// what makes every crash point recoverable:
+///
+/// * journalled == stored -> the save never landed. The outcome is unknown, so
+///   this spend must be replayed.
+/// * journalled != stored -> the save DID land and we died before clearing. The
+///   stored pair is newer and valid; the journal is stale, so clear it.
+fn reconcile_journal(
+    provider: &str,
+    stored: &OAuthTokens,
+) -> Option<crate::refresh_journal::PendingSpend> {
+    let spend = crate::refresh_journal::load(provider)?;
+    if spend.refresh_token == stored.refresh_token {
+        Some(spend)
+    } else {
+        tracing::debug!(
+            provider,
+            "refresh journal predates the stored token pair — the save landed, clearing it"
+        );
+        crate::refresh_journal::clear(provider);
+        None
+    }
+}
+
 /// Resolved per-request auth context. OAuth and basic auth differ in BOTH the API
 /// base (gateway vs site) and the auth header, so call sites go through this.
 pub enum JiraReqCtx {
@@ -370,50 +484,4 @@ impl JiraReqCtx {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn oauth_ctx() -> JiraReqCtx {
-        JiraReqCtx::OAuth {
-            token: "tok".into(),
-            cloud_id: "cloud-xyz".into(),
-            site_url: "https://acme.atlassian.net".into(),
-        }
-    }
-
-    fn basic_ctx() -> JiraReqCtx {
-        JiraReqCtx::Basic {
-            base_url: "https://acme.atlassian.net/".into(),
-            email: "a@b.com".into(),
-            api_token: "tok".into(),
-        }
-    }
-
-    #[test]
-    fn oauth_api_url_uses_gateway() {
-        assert_eq!(
-            oauth_ctx().api_url("/rest/api/3/search/jql"),
-            "https://api.atlassian.com/ex/jira/cloud-xyz/rest/api/3/search/jql"
-        );
-    }
-
-    #[test]
-    fn basic_api_url_uses_site_and_trims_slash() {
-        assert_eq!(
-            basic_ctx().api_url("/rest/api/3/search/jql"),
-            "https://acme.atlassian.net/rest/api/3/search/jql"
-        );
-    }
-
-    #[test]
-    fn browse_url_uses_site_in_both_modes() {
-        assert_eq!(
-            oauth_ctx().browse_url("KAN-1"),
-            "https://acme.atlassian.net/browse/KAN-1"
-        );
-        assert_eq!(
-            basic_ctx().browse_url("KAN-1"),
-            "https://acme.atlassian.net/browse/KAN-1"
-        );
-    }
-}
+mod tests;
diff --git a/meridian-oauth/src/jira/tests.rs b/meridian-oauth/src/jira/tests.rs
new file mode 100644
index 000000000..d54f440e1
--- /dev/null
+++ b/meridian-oauth/src/jira/tests.rs
@@ -0,0 +1,184 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Tests for [`super`] - the Atlassian 3LO wiring.
+//!
+//! Split into its own file on size (`jira.rs` passed the 500-line rule once the
+//! refresh journal's crash-point cases landed). Nothing here is a pure unit test
+//! of URL building alone: the journal cases below pin the recovery behaviour that
+//! decides whether a lost response destroys a user's grant, so they are the most
+//! load-bearing tests in this crate.
+
+use super::*;
+
+fn tokens(refresh: &str) -> OAuthTokens {
+    OAuthTokens {
+        provider: "jira".into(),
+        client_id: "cid".into(),
+        access_token: "access".into(),
+        refresh_token: refresh.into(),
+        expires_at: 0,
+        scopes: String::new(),
+        cloud_id: String::new(),
+        site_url: String::new(),
+    }
+}
+
+/// Scratch `HOME` so the journal lands in a temp dir. Serialised through the
+/// crate's env guard because `HOME` is process-global and cargo runs tests in
+/// parallel threads.
+struct ScratchHome {
+    dir: std::path::PathBuf,
+    prev: Option<std::ffi::OsString>,
+    _guard: std::sync::MutexGuard<'static, ()>,
+}
+
+impl ScratchHome {
+    fn new(tag: &str) -> Self {
+        let guard = crate::env_test_guard();
+        let dir = std::env::temp_dir().join(format!("meridian_jira_{tag}_{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let prev = std::env::var_os("HOME");
+        std::env::set_var("HOME", &dir);
+        Self {
+            dir,
+            prev,
+            _guard: guard,
+        }
+    }
+}
+
+impl Drop for ScratchHome {
+    fn drop(&mut self) {
+        match self.prev.take() {
+            Some(v) => std::env::set_var("HOME", v),
+            None => std::env::remove_var("HOME"),
+        }
+        std::fs::remove_dir_all(&self.dir).ok();
+    }
+}
+
+fn journal(token: &str) -> crate::refresh_journal::PendingSpend {
+    crate::refresh_journal::PendingSpend {
+        refresh_token: token.into(),
+        started_at_unix: now_unix(),
+        client_id: "cid".into(),
+    }
+}
+
+/// CRASH POINT A: died before `store::save` landed. The journalled token still
+/// matches the stored one, so the spend's outcome is unknown and MUST be
+/// replayed - re-presenting it inside the provider's grace is the only thing
+/// that recovers the grant.
+#[test]
+fn an_unresolved_spend_is_replayed_when_the_save_never_landed() {
+    let _home = ScratchHome::new("unresolved");
+    let stored = tokens("refresh-A");
+    crate::refresh_journal::record_spend("jira", &journal("refresh-A")).unwrap();
+
+    let pending = reconcile_journal("jira", &stored);
+    assert_eq!(
+        pending.map(|p| p.refresh_token),
+        Some("refresh-A".to_string()),
+        "a journal matching the stored token means the outcome is unknown - replay it"
+    );
+}
+
+/// CRASH POINT B: `store::save` landed, then we died before clearing. The
+/// stored pair is NEWER than the journal, so there is nothing to recover and
+/// replaying would spend a live token for no reason. The journal must be
+/// recognised as stale and removed.
+#[test]
+fn a_journal_older_than_the_stored_pair_is_stale_and_cleared() {
+    let _home = ScratchHome::new("stale");
+    let stored = tokens("refresh-B"); // save landed: B replaced A
+    crate::refresh_journal::record_spend("jira", &journal("refresh-A")).unwrap();
+
+    let pending = reconcile_journal("jira", &stored);
+    assert!(
+        pending.is_none(),
+        "the save landed, so nothing needs replaying"
+    );
+    assert!(
+        crate::refresh_journal::load("jira").is_none(),
+        "a stale journal must be cleared, not left to trigger a pointless replay \
+         on every future refresh"
+    );
+}
+
+/// The ordinary case: no journal, nothing to reconcile.
+#[test]
+fn no_journal_means_nothing_to_reconcile() {
+    let _home = ScratchHome::new("none");
+    assert!(reconcile_journal("jira", &tokens("refresh-A")).is_none());
+}
+
+/// A pending spend must defeat the fast path even when the access token is
+/// still fresh.
+///
+/// This is the subtle one, and getting it wrong reintroduces the whole bug: a
+/// valid access token can coexist with a refresh token that was already
+/// consumed server-side. Returning early on "not expired" would leave that
+/// unresolved for up to an hour - long past the provider's reuse grace - and
+/// the recovery would then be impossible rather than merely late.
+#[test]
+fn a_fresh_access_token_does_not_hide_an_unresolved_spend() {
+    let _home = ScratchHome::new("fastpath");
+    let mut fresh = tokens("refresh-A");
+    fresh.expires_at = now_unix() + 3600; // comfortably fresh
+    assert!(
+        !fresh.is_expired(now_unix(), 120),
+        "precondition: the access token must look fresh"
+    );
+
+    crate::refresh_journal::record_spend("jira", &journal("refresh-A")).unwrap();
+    // The fast path's condition, mirrored: freshness alone must NOT be enough.
+    let would_take_fast_path =
+        !fresh.is_expired(now_unix(), 120) && crate::refresh_journal::load("jira").is_none();
+    assert!(
+        !would_take_fast_path,
+        "a fresh access token must not short-circuit past an unresolved refresh spend"
+    );
+}
+
+fn oauth_ctx() -> JiraReqCtx {
+    JiraReqCtx::OAuth {
+        token: "tok".into(),
+        cloud_id: "cloud-xyz".into(),
+        site_url: "https://acme.atlassian.net".into(),
+    }
+}
+
+fn basic_ctx() -> JiraReqCtx {
+    JiraReqCtx::Basic {
+        base_url: "https://acme.atlassian.net/".into(),
+        email: "a@b.com".into(),
+        api_token: "tok".into(),
+    }
+}
+
+#[test]
+fn oauth_api_url_uses_gateway() {
+    assert_eq!(
+        oauth_ctx().api_url("/rest/api/3/search/jql"),
+        "https://api.atlassian.com/ex/jira/cloud-xyz/rest/api/3/search/jql"
+    );
+}
+
+#[test]
+fn basic_api_url_uses_site_and_trims_slash() {
+    assert_eq!(
+        basic_ctx().api_url("/rest/api/3/search/jql"),
+        "https://acme.atlassian.net/rest/api/3/search/jql"
+    );
+}
+
+#[test]
+fn browse_url_uses_site_in_both_modes() {
+    assert_eq!(
+        oauth_ctx().browse_url("KAN-1"),
+        "https://acme.atlassian.net/browse/KAN-1"
+    );
+    assert_eq!(
+        basic_ctx().browse_url("KAN-1"),
+        "https://acme.atlassian.net/browse/KAN-1"
+    );
+}
diff --git a/meridian-oauth/src/lib.rs b/meridian-oauth/src/lib.rs
index 46bb9966d..686aa17b3 100644
--- a/meridian-oauth/src/lib.rs
+++ b/meridian-oauth/src/lib.rs
@@ -28,6 +28,7 @@ pub mod flow;
 pub mod github;
 pub mod jira;
 pub mod pkce;
+pub mod refresh_journal;
 pub mod store;
 pub mod trello;
 
diff --git a/meridian-oauth/src/refresh_journal.rs b/meridian-oauth/src/refresh_journal.rs
new file mode 100644
index 000000000..2b26752eb
--- /dev/null
+++ b/meridian-oauth/src/refresh_journal.rs
@@ -0,0 +1,338 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Crash-safe and suspend-safe record of a refresh-token spend.
+//!
+//! # The bug this exists to close
+//!
+//! Atlassian ROTATES the refresh token on every use: a successful refresh
+//! returns a new pair and invalidates the one you sent. So the exchange has a
+//! window in which the token has already been consumed server-side and we do not
+//! yet know the replacement. If the response is lost in that window, the grant is
+//! gone forever and the user must re-authenticate by hand.
+//!
+//! Production users hit this repeatedly. The mechanism, measured on one install:
+//! a refresh POST was in flight when the Mac suspended for 28 minutes. Atlassian
+//! rotated the token and replied; the reply went nowhere. `reqwest`'s timeout
+//! could not cancel the request, because that timeout is `Instant`-based and the
+//! monotonic clock does not advance while macOS sleeps. On wake the socket was
+//! dead, and the retry went out with the OLD refresh token - by then 28 minutes
+//! stale, well outside Atlassian's reuse leeway. `invalid_grant`, terminal, grant
+//! dead.
+//!
+//! Nothing in the old code recorded that a spend had been attempted, so there was
+//! no way to distinguish "the token was never consumed" from "it was consumed and
+//! we lost the answer" - and those need opposite handling.
+//!
+//! # The rule that makes recovery possible
+//!
+//! Atlassian permits the PREVIOUS refresh token to be presented again within a
+//! grace period after rotation, returning the current pair rather than an error.
+//! That is the recovery mechanism, and it is time-bounded, so the only thing that
+//! matters is replaying the spend QUICKLY - which is impossible without knowing a
+//! spend happened. Hence this journal.
+//!
+//! # Ordering, which is the whole correctness argument
+//!
+//! 1. Journal the token we are about to spend, and `fsync` it. Only then POST.
+//! 2. On success: persist the new pair, `fsync`, and only THEN clear the journal.
+//! 3. On any indeterminate outcome (transport error, timeout, killed process,
+//!    suspend), the journal survives and the next attempt replays it.
+//!
+//! Steps 1 and 2 are deliberately ordered so that every crash point is
+//! recoverable, and the recovery is decided by COMPARING TOKENS rather than by
+//! trusting a flag:
+//!
+//! * journalled token == stored token -> the save never happened. The outcome is
+//!   unknown; replay with the journalled token.
+//! * journalled token != stored token -> the save DID happen and we died before
+//!   clearing. The stored pair is newer and valid; just clear the journal.
+//!
+//! That comparison is why a crash between step 2's write and its journal-clear is
+//! harmless, and why this needs no "in progress" boolean that could itself be
+//! stale.
+//!
+//! # Why a file and not the database
+//!
+//! The OAuth token store is already a per-provider file (see [`crate::store`]);
+//! the journal belongs beside it. It is also deliberately NOT in `meridian.db`:
+//! two processes write that database, and coordination state living there is what
+//! produced a `SQLITE_IOERR_SHORT_READ` in production when a reader hit it during
+//! the daemon's WAL checkpoint. A `0600` file written temp-then-rename cannot
+//! corrupt a database, needs no migration, and cannot fail a sync.
+//!
+//! # Who calls this
+//! [`crate::jira::ensure_fresh`], under the same locks that serialise the spend
+//! itself ([`crate::store::lock_provider`] plus the in-process mutex).
+
+use std::path::PathBuf;
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+
+/// How long after a spend a replay is still worth attempting.
+///
+/// Atlassian's documented reuse grace for a rotated refresh token is 10 minutes.
+/// This is deliberately SHORTER: the clock we compare against is the wall clock,
+/// which can be adjusted by NTP after a wake, and a replay attempted a second
+/// after the real deadline is indistinguishable from a genuinely dead grant. 8
+/// minutes keeps a margin for that skew and for the request's own duration.
+///
+/// Past this window a replay is still attempted ONCE (it costs one HTTP call and
+/// the alternative is a guaranteed re-authentication), but it is expected to fail
+/// and is logged as such rather than as a surprise.
+pub const REPLAY_WINDOW_SECS: i64 = 8 * 60;
+
+/// A refresh-token spend that was started and whose outcome may be unknown.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct PendingSpend {
+    /// The refresh token that was sent. Compared against the stored token to
+    /// decide whether the save landed - see the module header.
+    pub refresh_token: String,
+    /// Wall-clock unix seconds at which the POST was issued.
+    ///
+    /// WALL clock, not monotonic, on purpose: the entire point is to measure a
+    /// span that may include a system suspend, and a monotonic clock does not
+    /// advance across one. This is the same property whose absence let the
+    /// original 8-second request timeout sleep through a 28-minute suspend.
+    pub started_at_unix: i64,
+    /// The client id the spend was made with, so a replay reconstructs the exact
+    /// same request even if configuration changed in between.
+    pub client_id: String,
+}
+
+impl PendingSpend {
+    /// Seconds elapsed since the spend was issued, per the wall clock. Clamped at
+    /// zero so a backwards clock adjustment cannot produce a negative age that
+    /// would read as "in the future" and be treated as fresh forever.
+    pub fn age_secs(&self, now_unix: i64) -> i64 {
+        (now_unix - self.started_at_unix).max(0)
+    }
+
+    /// Whether a replay is still inside the window where the provider is expected
+    /// to honour the previous token.
+    pub fn within_replay_window(&self, now_unix: i64) -> bool {
+        self.age_secs(now_unix) <= REPLAY_WINDOW_SECS
+    }
+}
+
+fn journal_path(provider: &str) -> Result<PathBuf> {
+    // Reuses `store`'s provider validation and directory resolution, so a journal
+    // path can never escape the oauth dir and never disagrees with where the
+    // token it describes lives.
+    let token_path = crate::store::path(provider)?;
+    let dir = token_path
+        .parent()
+        .context("resolving the OAuth directory for the refresh journal")?;
+    Ok(dir.join(format!(".{provider}.refresh-journal.json")))
+}
+
+/// Record that `refresh_token` is about to be spent, durably, before the POST.
+///
+/// `fsync`s the file AND its directory before returning. Both matter: without the
+/// file sync the record can be in the page cache only, and without the directory
+/// sync the rename itself can be lost - either way a crash leaves no journal,
+/// which is exactly the state this function exists to prevent.
+pub fn record_spend(provider: &str, spend: &PendingSpend) -> Result<()> {
+    let path = journal_path(provider)?;
+    let dir = path
+        .parent()
+        .context("resolving the OAuth directory for the refresh journal")?;
+    std::fs::create_dir_all(dir)
+        .with_context(|| format!("creating {} for the refresh journal", dir.display()))?;
+    let tmp = dir.join(format!(".{provider}.refresh-journal.tmp"));
+    let json = serde_json::to_vec_pretty(spend).context("serialising the refresh journal")?;
+
+    {
+        use std::io::Write;
+        let mut file = open_private(&tmp)?;
+        file.write_all(&json)
+            .with_context(|| format!("writing {}", tmp.display()))?;
+        file.sync_all()
+            .with_context(|| format!("fsync {}", tmp.display()))?;
+    }
+    std::fs::rename(&tmp, &path)
+        .with_context(|| format!("renaming {} -> {}", tmp.display(), path.display()))?;
+    sync_dir(dir);
+    Ok(())
+}
+
+/// Read the pending spend, if any. A malformed journal is treated as ABSENT and
+/// removed rather than surfaced as an error: it cannot be acted on, and failing
+/// the refresh over an unreadable side-file would turn a recovery aid into a new
+/// way for auth to break.
+pub fn load(provider: &str) -> Option<PendingSpend> {
+    let path = journal_path(provider).ok()?;
+    let raw = std::fs::read_to_string(&path).ok()?;
+    match serde_json::from_str(&raw) {
+        Ok(spend) => Some(spend),
+        Err(e) => {
+            tracing::warn!(
+                provider,
+                error = %e,
+                "refresh journal is unreadable - discarding it and refreshing normally"
+            );
+            let _ = std::fs::remove_file(&path);
+            None
+        }
+    }
+}
+
+/// Clear the journal once the new pair is durably stored.
+///
+/// Best-effort by design: the new tokens are already persisted at this point, so
+/// a leftover journal is harmless - the next `ensure_fresh` compares its token
+/// against the stored one, sees they differ, and clears it then. Failing the
+/// refresh here would discard a SUCCESSFUL exchange.
+pub fn clear(provider: &str) {
+    if let Ok(path) = journal_path(provider) {
+        match std::fs::remove_file(&path) {
+            Ok(()) => tracing::debug!(provider, "refresh journal cleared"),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => tracing::warn!(
+                provider,
+                error = %e,
+                "could not clear the refresh journal - the next refresh will reconcile it"
+            ),
+        }
+    }
+}
+
+/// Create/truncate a file that only the owner can read. The mode is set AT OPEN
+/// on Unix rather than afterwards, so there is no window in which the file exists
+/// world-readable while holding a refresh token.
+fn open_private(path: &std::path::Path) -> Result<std::fs::File> {
+    let mut opts = std::fs::OpenOptions::new();
+    opts.write(true).create(true).truncate(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        opts.mode(0o600);
+    }
+    opts.open(path)
+        .with_context(|| format!("creating {}", path.display()))
+}
+
+/// `fsync` a directory so a rename into it is durable. Unix-only and
+/// best-effort: on Windows a directory handle cannot be opened this way, and
+/// there `rename` over an existing file is already ordered by the filesystem.
+fn sync_dir(dir: &std::path::Path) {
+    #[cfg(unix)]
+    if let Ok(handle) = std::fs::File::open(dir) {
+        if let Err(e) = handle.sync_all() {
+            tracing::debug!(dir = %dir.display(), error = %e, "directory fsync failed");
+        }
+    }
+    #[cfg(not(unix))]
+    let _ = dir;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn spend(token: &str, started_at_unix: i64) -> PendingSpend {
+        PendingSpend {
+            refresh_token: token.into(),
+            started_at_unix,
+            client_id: "cid".into(),
+        }
+    }
+
+    struct ScratchHome {
+        dir: std::path::PathBuf,
+        prev: Option<std::ffi::OsString>,
+        _guard: std::sync::MutexGuard<'static, ()>,
+    }
+
+    impl ScratchHome {
+        fn new(tag: &str) -> Self {
+            let guard = crate::env_test_guard();
+            let dir =
+                std::env::temp_dir().join(format!("meridian_journal_{tag}_{}", std::process::id()));
+            std::fs::create_dir_all(&dir).unwrap();
+            let prev = std::env::var_os("HOME");
+            std::env::set_var("HOME", &dir);
+            Self {
+                dir,
+                prev,
+                _guard: guard,
+            }
+        }
+    }
+
+    impl Drop for ScratchHome {
+        fn drop(&mut self) {
+            match self.prev.take() {
+                Some(v) => std::env::set_var("HOME", v),
+                None => std::env::remove_var("HOME"),
+            }
+            std::fs::remove_dir_all(&self.dir).ok();
+        }
+    }
+
+    #[test]
+    fn a_recorded_spend_survives_and_round_trips() {
+        let _home = ScratchHome::new("roundtrip");
+        assert!(load("jira").is_none(), "no journal before recording");
+        let s = spend("old-refresh", 1_000);
+        record_spend("jira", &s).unwrap();
+        assert_eq!(load("jira").as_ref(), Some(&s));
+        clear("jira");
+        assert!(
+            load("jira").is_none(),
+            "cleared journal must read as absent"
+        );
+    }
+
+    /// The journal holds a refresh token, so it must never be world-readable -
+    /// same requirement as the token file itself.
+    #[cfg(unix)]
+    #[test]
+    fn the_journal_is_owner_only() {
+        use std::os::unix::fs::PermissionsExt;
+        let _home = ScratchHome::new("perms");
+        record_spend("jira", &spend("t", 1)).unwrap();
+        let path = journal_path("jira").unwrap();
+        let mode = std::fs::metadata(&path).unwrap().permissions().mode();
+        assert_eq!(mode & 0o777, 0o600, "journal must be 0600, got {mode:o}");
+    }
+
+    /// A garbage journal must not fail the refresh. It is discarded, so the
+    /// caller proceeds with a normal refresh rather than erroring on a side-file.
+    #[test]
+    fn a_corrupt_journal_reads_as_absent_and_is_removed() {
+        let _home = ScratchHome::new("corrupt");
+        record_spend("jira", &spend("t", 1)).unwrap();
+        let path = journal_path("jira").unwrap();
+        std::fs::write(&path, b"{not json").unwrap();
+        assert!(
+            load("jira").is_none(),
+            "a corrupt journal must read as absent"
+        );
+        assert!(
+            !path.exists(),
+            "a corrupt journal must be removed, not left to be re-read forever"
+        );
+    }
+
+    /// The replay window is measured on the WALL clock so it spans a suspend.
+    #[test]
+    fn the_replay_window_is_bounded_and_clamped() {
+        let s = spend("t", 1_000);
+        assert!(
+            s.within_replay_window(1_000),
+            "a spend just issued is in window"
+        );
+        assert!(
+            s.within_replay_window(1_000 + REPLAY_WINDOW_SECS),
+            "the boundary itself is in window"
+        );
+        assert!(
+            !s.within_replay_window(1_000 + REPLAY_WINDOW_SECS + 1),
+            "one second past the window is out"
+        );
+        // A backwards clock jump must not read as "issued in the future", which
+        // would make the spend look permanently fresh and replay forever.
+        assert_eq!(s.age_secs(500), 0, "age is clamped at zero");
+        assert!(s.within_replay_window(500));
+    }
+}
diff --git a/src/health/jira.rs b/src/health/jira.rs
index fa35db6d5..b8b3d29eb 100644
--- a/src/health/jira.rs
+++ b/src/health/jira.rs
@@ -145,8 +145,15 @@ async fn classify_auth(send: reqwest::Result<reqwest::Response>) -> Check {
 /// failure warns and carries the provider's own message; anything else reports
 /// elapsed time as context only, never as a fault.
 async fn sync_freshness(pool: &SqlitePool) -> Check {
-    match sqlx::query_as::<_, (Option<f64>, Option<String>)>(
-        "SELECT (julianday('now') - julianday(last_synced_at)) * 86400.0, last_error
+    // `last_synced_at` is NOT always a real success timestamp: `stamp_sync_error`
+    // inserts the epoch sentinel when it creates a row for a provider that has
+    // never synced. Reporting an age off that renders as "last synced 29799360m
+    // ago", so the sentinel is detected and reported as never-synced instead of
+    // being arithmetic'd into a nonsense duration.
+    match sqlx::query_as::<_, (Option<f64>, Option<String>, Option<String>)>(
+        "SELECT (julianday('now') - julianday(last_synced_at)) * 86400.0,
+                last_error,
+                last_synced_at
          FROM pm_sync_state WHERE provider = 'jira'",
     )
     .fetch_optional(pool)
@@ -155,19 +162,23 @@ async fn sync_freshness(pool: &SqlitePool) -> Check {
         // A recorded failure is the ONLY thing that warns. `last_error` is set by
         // the provider itself, so the text is the real cause rather than this
         // check's guess at one.
-        Ok(Some((_, Some(err)))) if !err.trim().is_empty() => {
+        Ok(Some((_, Some(err), _))) if !err.trim().is_empty() => {
             Check::warn("ticket sync", "L3", format!("last sync failed: {err}")).with_remedy(
                 "check the auth row above; a sync retries on the next on-demand trigger",
             )
         }
+        // The epoch sentinel means "a row exists but no sync ever succeeded".
+        Ok(Some((_, _, Some(stamp)))) if stamp.starts_with("1970") => {
+            Check::info("ticket sync", "L3", "no successful Jira sync recorded yet")
+        }
         // Elapsed time as context. An old cache is normal when nothing asked for a sync.
-        Ok(Some((Some(age), _))) => Check::ok(
+        Ok(Some((Some(age), _, _))) => Check::ok(
             "ticket sync",
             "L3",
             format!("last synced {:.0}m ago, no errors", age / 60.0),
         ),
         // A row with neither a parseable timestamp nor an error: nothing to report.
-        Ok(Some((None, _))) => {
+        Ok(Some((None, _, _))) => {
             Check::info("ticket sync", "L3", "no successful Jira sync recorded yet")
         }
         Ok(None) => Check::info("ticket sync", "L3", "no Jira sync recorded yet"),
@@ -297,4 +308,29 @@ mod tests {
             "never-synced must be info, got {check:?}"
         );
     }
+
+    /// The epoch sentinel must not be rendered as an age.
+    ///
+    /// `stamp_sync_error` inserts `1970-01-01T00:00:00Z` when it creates a row for
+    /// a provider that never synced. Doing the arithmetic on that produced "last
+    /// synced 29799360m ago" - a real string this would have shown a user.
+    #[tokio::test]
+    async fn the_epoch_sentinel_is_not_reported_as_an_age() {
+        let pool = db().await;
+        sqlx::query(
+            "INSERT INTO pm_sync_state (provider, last_synced_at, last_error)
+             VALUES ('jira', '1970-01-01T00:00:00Z', NULL)",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+
+        let check = sync_freshness(&pool).await;
+        assert_eq!(check.severity, Severity::Info, "got {check:?}");
+        assert!(
+            !check.detail.contains('m'),
+            "the sentinel must not be turned into a minutes figure, got {:?}",
+            check.detail
+        );
+    }
 }
diff --git a/src/intelligence/providers/mod.rs b/src/intelligence/providers/mod.rs
index 1e71783ed..b8ab01fb1 100644
--- a/src/intelligence/providers/mod.rs
+++ b/src/intelligence/providers/mod.rs
@@ -91,167 +91,74 @@ pub async fn stamp_sync_error_with_remedy(
     Ok(())
 }
 
-/// How stale the last SUCCESSFUL sync may get before a run of otherwise-
-/// suppressed transient failures is escalated to a user-facing notice.
+/// How many CONSECUTIVE failed sync attempts a provider gets before its
+/// otherwise-suppressed transient failures escalate to a user-facing notice.
 ///
-/// Comfortably longer than any provider's sync interval, so an ordinary flaky
-/// hour never trips it — but short enough that a persistently blocked provider
-/// surfaces the same working day.
-const TRANSIENT_ESCALATION_HOURS: i64 = 6;
-
-/// Record a transient (retryable) sync failure.
-///
-/// Normally raises NOTHING — [`http::SyncFault::Retry`] exists precisely so a
-/// network blip stops producing a "check your credentials" banner for
-/// credentials that are fine.
-///
-/// But silence has to be BOUNDED. A provider blocked persistently (corporate
-/// proxy, TLS interception, a firewall rule) is unreachable on every tick
-/// forever, and suppressing that outright would leave the user's board silently
-/// going stale with no signal at all — strictly worse than the misleading banner
-/// this change removes. So the failure escalates to a normal sync notice once
-/// the provider has not synced successfully within
-/// [`TRANSIENT_ESCALATION_HOURS`].
-///
-/// **A provider that has NEVER synced needs its own handling**, because it has
-/// no `pm_sync_state` row at all, so an age test alone would no-op forever on
-/// exactly the installs that most need it — someone who just connected and whose
-/// network blocks the provider outright.
-///
-/// It gets ONE retry rather than escalating on the first failure. Escalating
-/// immediately would reintroduce the very thing this change removes, just with
-/// connectivity wording instead of credentials wording: connect a tracker, have
-/// the first attempt land on an ordinary blip (a DNS hiccup, a proxy handshake,
-/// a laptop still waking up) and a "sync failing" banner appears seconds later.
-/// So the first failure writes the row and stays silent; the next one sees the
-/// row with an epoch `last_synced_at`, which is not recent, and escalates. One
-/// sync interval of grace, and the persistently-blocked case still surfaces.
-///
-/// **This same one-retry grace applies to a provider that has synced
-/// successfully before**, not just a brand-new one - see the `is_sentinel`
-/// branch in [`note_transient_sync_failure`]. Without it, a provider whose
-/// `last_synced_at` goes stale because the DAEMON WAS ASLEEP (laptop closed
-/// overnight, a longer Wi-Fi/VPN drop) rather than because it kept failing
-/// escalates on its very first retry after waking - the exact false-positive
-/// this module exists to remove, just triggered by a gap in *time* instead of
-/// a gap in connectivity. The grace row and this ONE mechanism (the epoch
-/// sentinel) cover both cases identically, so the escalation check cannot tell
-/// them apart and does not need to.
+/// This replaced a "no successful sync in the last 6 hours" rule. That rule was
+/// correct when written: sync ran on a timer every few minutes, so six hours
+/// without a success reliably meant something was broken - its own doc comment
+/// said "comfortably longer than any provider's sync interval".
 ///
-/// The remedy points at connectivity, NOT credentials: by construction we only
-/// reach here for failures that are not the user's token.
+/// Sync is on-demand now (see [`crate::intelligence::run_pm_sync`]) and that
+/// premise is gone. A machine that slept all weekend, or a user who has not
+/// opened the dashboard since Friday, has no successful sync for DAYS and nothing
+/// is wrong. Under the old rule the first two failures after any quiet period
+/// escalated, so opening the dashboard on Monday before Wi-Fi associated raised a
+/// red "sync failing" banner on a healthy install - with a body reading "No
+/// successful sync in the last 6 hours" while describing normal use.
 ///
-/// Write the epoch-sentinel grace row for a provider that has never synced.
-///
-/// **Deliberately does NOT write `last_error`** (unlike the escalating write
-/// in [`stamp_sync_error_with_remedy`]): `meridian_core::readers::integrations::sync_errors`
-/// reads `last_error IS NOT NULL` to drive the per-provider "Sync failed"
-/// badge on the Integrations page, independent of whether a system-wide
-/// notice was raised. Setting it here would show that badge during a period
-/// this function is specifically trying to keep quiet - `detail` is still
-/// logged (below) so the attempt is not lost from telemetry, just kept out of
-/// the persisted, user-visible column.
-///
-/// # Why `ON CONFLICT DO NOTHING`
-/// The caller's `has_row` check is a SEPARATE statement from this insert, and
-/// `pm_sync_state.provider` is a PRIMARY KEY - so anything that can run two
-/// sync passes for one provider concurrently can have both observe "no row"
-/// and both insert. That is not hypothetical here: `meridian ticket-update`
-/// opens its OWN pool to the same `meridian.db` and calls
-/// `intelligence::run_pm_force_sync` (`src/main.rs`) while the daemon's poll
-/// loop is running `run_pm_sync` against the same file, so the two racers are
-/// separate PROCESSES and no in-process lock would cover them.
-///
-/// Without the clause the loser gets `UNIQUE constraint failed`, which
-/// [`record_sync_failure`] swallows by design - so the grace row would be
-/// silently lost, the next failure would take the same branch again, and the
-/// escalation clock would never start. That is the exact failure this whole
-/// module exists to prevent, reintroduced by a race.
+/// Consecutive failures are the honest evidence: a blocked proxy or a dead route
+/// fails EVERY attempt, whereas a wake-time blip fails once or twice then works.
+/// Elapsed quiet carries no signal at all any more.
+const TRANSIENT_ESCALATION_ATTEMPTS: u32 = 4;
+
+/// Consecutive transient failures per provider, for the CURRENT PROCESS only.
 ///
-/// Doing nothing on conflict is the correct resolution rather than a
-/// compromise: the row the winner wrote carries the same epoch sentinel this
-/// one would have written, so both racers leave the state they intended.
+/// In memory rather than in `pm_sync_state`, deliberately:
 ///
-/// Extracted from [`note_transient_sync_failure`] to give the conflict
-/// behaviour a testable seam - the race itself has no deterministic hook, but
-/// "inserting over an existing row is a no-op, not an error" does.
-async fn insert_grace_row(pool: &SqlitePool, provider: &str, detail: &str) -> Result<()> {
-    tracing::debug!(
-        provider,
-        detail,
-        "grace row: recording the attempt without a user-visible error"
-    );
-    sqlx::query(
-        "INSERT INTO pm_sync_state (provider, last_synced_at, last_error)
-         VALUES (?, '1970-01-01T00:00:00Z', NULL)
-         ON CONFLICT(provider) DO NOTHING",
-    )
-    .bind(provider)
-    .execute(pool)
-    .await
-    .context("recording the first transient failure for a never-synced provider")?;
-    Ok(())
-}
+/// * No migration, and it cannot corrupt a database - the same reasoning that put
+///   the sync dedup lock and the OAuth refresh journal outside `meridian.db`.
+/// * Resetting on restart is the SAFE direction. launchd `KeepAlive` restarts the
+///   daemon on every wake, so a fresh process starts at zero and can never
+///   inherit a stale streak and escalate on its first blip. The cost is that a
+///   persistent block takes a few attempts within one session to surface, which
+///   is the trade we want: quiet by default, loud only on real evidence.
+static TRANSIENT_STREAKS: std::sync::Mutex<Option<std::collections::HashMap<String, u32>>> =
+    std::sync::Mutex::new(None);
 
-/// Downgrade a STALE-BUT-PREVIOUSLY-SUCCESSFUL provider's `last_synced_at` to
-/// the epoch sentinel, marking its one retry of grace as used - WITHOUT
-/// writing `last_error`, for the same reason [`insert_grace_row`] doesn't (see
-/// its doc comment). Mirrors that function's shape but is an UPDATE, not an
-/// INSERT: the row already exists here, carrying a real (if old) past-success
-/// timestamp that this call intentionally overwrites, so the NEXT failure's
-/// `is_sentinel` check reads it identically to a never-synced provider's grace
-/// row and escalates.
-async fn mark_first_stale_failure(pool: &SqlitePool, provider: &str, detail: &str) -> Result<()> {
-    tracing::debug!(
-        provider,
-        detail,
-        "first transient failure since a genuine past success - staying quiet until the next attempt"
-    );
-    // The WHERE clause re-checks, inside the write, the same three conditions
-    // the caller checked in a SEPARATE statement: still stale, not already the
-    // sentinel, and carrying no error.
-    //
-    // For the same reason `insert_grace_row` needs `ON CONFLICT DO NOTHING`:
-    // `meridian ticket-update` opens its own pool to this file and runs
-    // `run_pm_force_sync` while the daemon's poll loop runs `run_pm_sync`, so
-    // the racers are separate PROCESSES and no in-process lock covers them.
-    // That path was guarded for the INSERT and left open for this UPDATE.
-    //
-    // The damage an unconditional write does is not a lost grace tick (both
-    // racers intend the same sentinel) but the opposite: a sync that SUCCEEDS
-    // between the caller's read and this statement has its fresh
-    // `last_synced_at` stamped back to the epoch. The provider then reads as
-    // never-recently-synced, and the next failure escalates a user-visible
-    // notice for a tracker that is working. A single conditional statement is
-    // atomic in SQLite, so the success either lands before this (and the
-    // `last_synced_at` guard makes this a no-op) or after it (and it wins).
-    let updated = sqlx::query(
-        "UPDATE pm_sync_state SET last_synced_at = '1970-01-01T00:00:00Z'
-         WHERE provider = ?
-           AND last_error IS NULL
-           AND last_synced_at != '1970-01-01T00:00:00Z'
-           AND last_synced_at <= strftime('%Y-%m-%dT%H:%M:%SZ', 'now', ?)",
-    )
-    .bind(provider)
-    .bind(format!("-{TRANSIENT_ESCALATION_HOURS} hours"))
-    .execute(pool)
-    .await
-    .context("recording a resumed provider's first quiet failure since its last success")?
-    .rows_affected();
+/// Increment and return this provider's consecutive-failure count.
+fn bump_transient_streak(provider: &str) -> u32 {
+    let mut guard = TRANSIENT_STREAKS
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let map = guard.get_or_insert_with(std::collections::HashMap::new);
+    let counter = map.entry(provider.to_string()).or_insert(0);
+    *counter = counter.saturating_add(1);
+    *counter
+}
 
-    if updated == 0 {
-        // Something changed under us between the read and the write. Staying
-        // quiet is still the right answer for THIS attempt - the caller already
-        // decided not to escalate - but say so, because the alternative reading
-        // ("the write silently did nothing") is the bug this guard introduces
-        // if it is ever wrong.
-        tracing::debug!(
-            provider,
-            "grace write skipped - the row stopped being a clean stale transition \
-             (a concurrent sync succeeded, or another pass already recorded it)"
-        );
+/// Reset this provider's consecutive-failure count after a successful sync.
+///
+/// A success is the ONLY thing that clears it, which is what makes the count mean
+/// "failures in a row" rather than "failures ever".
+pub(crate) fn reset_transient_streak(provider: &str) {
+    let mut guard = TRANSIENT_STREAKS
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    if let Some(map) = guard.as_mut() {
+        map.remove(provider);
     }
-    Ok(())
+}
+
+/// Test-only: force a provider's streak so escalation can be exercised without
+/// calling the recorder N times.
+#[cfg(test)]
+pub(crate) fn set_transient_streak_for_test(provider: &str, value: u32) {
+    let mut guard = TRANSIENT_STREAKS
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let map = guard.get_or_insert_with(std::collections::HashMap::new);
+    map.insert(provider.to_string(), value);
 }
 
 /// Returns whether it escalated.
@@ -264,77 +171,37 @@ pub async fn note_transient_sync_failure(
     provider: &str,
     detail: &str,
 ) -> Result<bool> {
-    let threshold = format!("-{TRANSIENT_ESCALATION_HOURS} hours");
-    let (has_row, recently_synced, is_sentinel, has_error): (i64, i64, i64, i64) = sqlx::query_as(
-        "SELECT
-             EXISTS(SELECT 1 FROM pm_sync_state WHERE provider = ?),
-             EXISTS(
-                 SELECT 1 FROM pm_sync_state
-                 WHERE provider = ?
-                   AND last_synced_at > strftime('%Y-%m-%dT%H:%M:%SZ', 'now', ?)
-             ),
-             EXISTS(
-                 SELECT 1 FROM pm_sync_state
-                 WHERE provider = ? AND last_synced_at = '1970-01-01T00:00:00Z'
-             ),
-             EXISTS(
-                 SELECT 1 FROM pm_sync_state WHERE provider = ? AND last_error IS NOT NULL
-             )",
-    )
-    .bind(provider)
-    .bind(provider)
-    .bind(&threshold)
-    .bind(provider)
-    .bind(provider)
-    .fetch_one(pool)
-    .await
-    .context("checking sync recency for transient-failure escalation")?;
-
-    if recently_synced != 0 {
-        tracing::Span::current().record("escalated", false);
-        return Ok(false);
-    }
+    let streak = bump_transient_streak(provider);
+    let span = tracing::Span::current();
+    span.record("streak", streak);
 
-    if has_row == 0 {
-        // First-ever failure on a provider that has never synced. Record the
-        // attempt so the NEXT one escalates, but raise nothing: a tracker
-        // connected seconds ago that hits one blip must not immediately show a
-        // fault. The epoch sentinel is deliberate - it is not a recent sync, so
-        // the next failure takes the escalation branch below.
-        insert_grace_row(pool, provider, detail).await?;
+    if streak < TRANSIENT_ESCALATION_ATTEMPTS {
+        // Silence, which is the normal outcome. `SyncFault::Retry` exists so a
+        // network blip does not produce a banner for credentials that are fine,
+        // and a wake-time blip is the single most common instance of one.
         tracing::debug!(
             provider,
-            "first transient failure on a never-synced provider - staying quiet until the next attempt"
+            streak,
+            needed = TRANSIENT_ESCALATION_ATTEMPTS,
+            "transient sync failure - staying quiet until the streak is real"
         );
-        tracing::Span::current().record("escalated", false);
-        return Ok(false);
-    }
-
-    // Not recently synced, and the provider HAS synced before. Give it the
-    // SAME one retry of grace a never-synced provider gets, unless there is
-    // already something to weigh against staying quiet: `is_sentinel` covers
-    // "the grace tick already ran" (this branch set `last_synced_at` to the
-    // sentinel with no `last_error`, and a SECOND consecutive failure now
-    // finds it), and `has_error` covers "a fault is already recorded here"
-    // (a terminal failure elsewhere already wrote `last_error` and raised its
-    // own notice - nothing is gained by staying quiet on top of that). Only a
-    // row that has synced before, has since gone stale, and carries neither
-    // signal - a clean transition into staleness - gets the grace write.
-    if has_error == 0 && is_sentinel == 0 {
-        mark_first_stale_failure(pool, provider, detail).await?;
-        tracing::Span::current().record("escalated", false);
+        span.record("escalated", false);
         return Ok(false);
     }
 
+    // Silence has to be BOUNDED. A provider blocked persistently (corporate
+    // proxy, TLS interception, a firewall rule) fails every single attempt
+    // forever, and suppressing that outright would leave the board silently going
+    // stale with no signal at all - strictly worse than a misleading banner.
     tracing::warn!(
         provider,
-        hours = TRANSIENT_ESCALATION_HOURS,
-        "provider unreachable with no recent successful sync - escalating to a notice"
+        streak,
+        "provider unreachable on {streak} consecutive attempts - escalating to a notice"
     );
-    // The title already names the provider, so the body only has to say what is
-    // wrong and carry the cause.
-    let msg =
-        format!("No successful sync in the last {TRANSIENT_ESCALATION_HOURS} hours - {detail}");
+    // The message names the evidence, not a duration. The old wording ("No
+    // successful sync in the last 6 hours") described normal on-demand operation
+    // and so read as a false alarm even when the fault was real.
+    let msg = format!("Unreachable on {streak} consecutive sync attempts - {detail}");
     stamp_sync_error_with_remedy(
         pool,
         provider,
@@ -342,7 +209,7 @@ pub async fn note_transient_sync_failure(
         Some("Check your internet connection, VPN, or proxy settings"),
     )
     .await?;
-    tracing::Span::current().record("escalated", true);
+    span.record("escalated", true);
     Ok(true)
 }
 
@@ -446,6 +313,12 @@ pub async fn record_sync_failure(
 
 /// Clear the last error for a provider after a successful sync.
 pub async fn clear_sync_error(pool: &SqlitePool, provider: &str) -> Result<()> {
+    // A success is the ONLY thing that resets the consecutive-failure streak,
+    // which is what makes that count mean "failures in a row" rather than
+    // "failures ever". Reset FIRST: if the DB write below fails, the streak is
+    // still correct (the sync did succeed), whereas a streak left standing after
+    // a success would escalate on the next single blip.
+    reset_transient_streak(provider);
     sqlx::query("UPDATE pm_sync_state SET last_error = NULL WHERE provider = ?")
         .bind(provider)
         .execute(pool)
diff --git a/src/intelligence/providers/sync_failure_tests.rs b/src/intelligence/providers/sync_failure_tests.rs
index f1af81986..9676b0a58 100644
--- a/src/intelligence/providers/sync_failure_tests.rs
+++ b/src/intelligence/providers/sync_failure_tests.rs
@@ -44,308 +44,197 @@ async fn notice(pool: &SqlitePool, id: &str) -> Option<(String, String, Option<S
         .unwrap()
 }
 
-/// The whole point of suppressing transient failures: an ordinary blip on a
-/// provider that is otherwise working must raise NOTHING. This is the bug
-/// the user reported - a banner telling them to redo working credentials.
+/// Each test gets its own provider name where the streak matters: the streak
+/// lives in a process-global map, and cargo runs these in parallel threads, so
+/// sharing a name would let one test's failures leak into another's count.
+///
+/// Reset explicitly too, because the map outlives any single test.
+fn fresh_streak(provider: &str) {
+    reset_transient_streak(provider);
+}
+
+/// A single network blip must stay SILENT. This is the whole reason
+/// `SyncFault::Retry` exists - one DNS hiccup must not produce a "check your
+/// credentials" banner for credentials that are fine.
 #[tokio::test]
-async fn a_blip_on_a_healthy_provider_stays_silent() {
+async fn a_single_blip_stays_silent() {
     let pool = make_db().await;
-    set_last_sync(&pool, "github", "-5 minutes").await;
+    fresh_streak("blip_single");
+    set_last_sync(&pool, "blip_single", "-2 minutes").await;
 
-    let escalated = note_transient_sync_failure(&pool, "github", "dns error")
+    let escalated = note_transient_sync_failure(&pool, "blip_single", "dns error")
         .await
         .unwrap();
-
-    assert!(!escalated);
+    assert!(!escalated, "one transient failure must not escalate");
     assert!(
-        notice(&pool, "pm.github").await.is_none(),
-        "a network blip must not raise a user-facing fault"
+        notice(&pool, "pm.blip_single").await.is_none(),
+        "one blip must raise no notice"
     );
 }
 
-/// And the counterweight: silence must be BOUNDED. A provider blocked by a
-/// proxy or firewall fails on every tick forever, and going quiet would
-/// leave the board silently stale - worse than the banner we removed.
+/// THE REGRESSION THIS REWRITE EXISTS FOR.
+///
+/// A machine that has not synced for days is NORMAL once sync is on-demand: it
+/// was shut, or nobody opened the dashboard. The old rule ("no successful sync in
+/// the last 6 hours") treated that as evidence of a fault, so the first couple of
+/// failures after any quiet period escalated - meaning a Monday-morning Wi-Fi
+/// blip raised a red banner on a healthy install.
 ///
-/// The FIRST failure after `last_synced_at` goes stale gets one retry of
-/// grace too (same mechanism a never-synced provider gets - see
-/// `a_provider_resuming_after_a_long_gap_gets_one_retry_before_escalating`),
-/// so this simulates genuine persistence with a SECOND consecutive failure,
-/// matching how `a_never_synced_provider_gets_one_retry_before_escalating`
-/// proves the same property for a brand-new connection.
+/// A long quiet period must now carry NO weight at all.
 #[tokio::test]
-async fn a_persistently_unreachable_provider_stops_being_silent() {
+async fn a_blip_after_days_of_quiet_stays_silent() {
     let pool = make_db().await;
-    set_last_sync(&pool, "jira", "-7 hours").await;
-
-    let first = note_transient_sync_failure(&pool, "jira", "connection timed out")
-        .await
-        .unwrap();
-    assert!(
-        !first,
-        "the first failure after going stale must stay silent"
-    );
+    fresh_streak("blip_quiet");
+    // Three days since the last success - a shut laptop, not a fault.
+    set_last_sync(&pool, "blip_quiet", "-72 hours").await;
 
-    let escalated = note_transient_sync_failure(&pool, "jira", "connection timed out")
-        .await
-        .unwrap();
-
-    assert!(escalated);
-    let (title, detail, remedy) = notice(&pool, "pm.jira").await.expect("notice raised");
-    assert_eq!(title, "Jira sync failing");
-    assert!(
-        detail.contains("connection timed out"),
-        "the cause must survive into the notice: {detail}"
-    );
-    let remedy = remedy.expect("remedy set");
-    assert!(
-        remedy.contains("connection") || remedy.contains("proxy"),
-        "an unreachable provider is a connectivity remedy, not a credentials one: {remedy}"
-    );
+    for attempt in 1..=2 {
+        let escalated = note_transient_sync_failure(&pool, "blip_quiet", "dns error")
+            .await
+            .unwrap();
+        assert!(
+            !escalated,
+            "attempt {attempt} after a long quiet period must not escalate - \
+             elapsed quiet is not evidence of a fault under on-demand sync"
+        );
+    }
     assert!(
-        !remedy.contains("TOKEN"),
-        "must not tell the user to redo credentials that are fine: {remedy}"
+        notice(&pool, "pm.blip_quiet").await.is_none(),
+        "a wake-time blip must raise no notice however long the machine slept"
     );
 }
 
-/// The trap this has to survive: transient failures no longer call
-/// `stamp_sync_error`, so a machine that has NEVER reached the provider has
-/// no `pm_sync_state` row at all, and an age test alone would no-op forever
-/// on exactly the installs that need it most - someone who just connected
-/// behind a blocking proxy.
-///
-/// But it must not escalate on failure #1 either, or connecting a tracker
-/// and hitting one DNS hiccup shows a fault seconds later - the same
-/// false-positive banner this change exists to remove, just with
-/// connectivity wording. One retry, then it surfaces.
+/// Silence still has to be BOUNDED. A provider blocked persistently (corporate
+/// proxy, TLS interception, a firewall rule) fails every single attempt, and
+/// suppressing that outright would leave the board silently going stale with no
+/// signal at all - strictly worse than a misleading banner.
 #[tokio::test]
-async fn a_never_synced_provider_gets_one_retry_before_escalating() {
+async fn a_persistently_unreachable_provider_stops_being_silent() {
     let pool = make_db().await;
+    fresh_streak("blocked");
+    set_last_sync(&pool, "blocked", "-2 minutes").await;
 
-    let first = note_transient_sync_failure(&pool, "github", "dns error")
+    for attempt in 1..TRANSIENT_ESCALATION_ATTEMPTS {
+        assert!(
+            !note_transient_sync_failure(&pool, "blocked", "connection timed out")
+                .await
+                .unwrap(),
+            "attempt {attempt} is below the threshold and must stay silent"
+        );
+    }
+    let escalated = note_transient_sync_failure(&pool, "blocked", "connection timed out")
         .await
         .unwrap();
-    assert!(!first, "the first blip after connecting must stay silent");
     assert!(
-        notice(&pool, "pm.github").await.is_none(),
-        "no banner seconds after connecting a tracker"
+        escalated,
+        "the {TRANSIENT_ESCALATION_ATTEMPTS}th consecutive failure must escalate"
     );
 
-    let second = note_transient_sync_failure(&pool, "github", "dns error")
+    let (_, detail, remedy) = notice(&pool, "pm.blocked")
         .await
-        .unwrap();
-    assert!(second, "a second failure means it is not just a blip");
-    assert!(notice(&pool, "pm.github").await.is_some());
-}
-
-/// THE REGRESSION THIS MODULE WAS MISSING: a provider that synced
-/// successfully hours ago - laptop asleep overnight, a longer Wi-Fi/VPN drop,
-/// reconnecting after being away - has `last_synced_at` go stale for a reason
-/// that has NOTHING to do with repeated failed attempts. Before this test
-/// existed, the very first retry after such a gap escalated immediately (zero
-/// grace), while a never-synced provider got one retry first. If the network
-/// is actually back up moments later, the next attempt succeeds and clears
-/// the notice within seconds - a flash-then-clear banner that never should
-/// have shown. This provider must get the SAME one-retry grace a never-synced
-/// provider gets, and the grace attempt must not touch `last_error` either
-/// (see `a_racing_grace_row_insert_is_a_no_op_not_an_error` for the same
-/// guarantee on the never-synced path).
-#[tokio::test]
-async fn a_provider_resuming_after_a_long_gap_gets_one_retry_before_escalating() {
-    let pool = make_db().await;
-    set_last_sync(&pool, "jira", "-9 hours").await;
-
-    let first = note_transient_sync_failure(&pool, "jira", "dns error")
-        .await
-        .unwrap();
+        .expect("a notice must exist once the streak is real");
     assert!(
-        !first,
-        "the first failure after a long gap must stay silent, same as a never-synced provider"
+        detail.contains("consecutive"),
+        "the message must name the real evidence (consecutive failures), not a \
+         duration that now describes normal operation - got {detail:?}"
     );
     assert!(
-        notice(&pool, "pm.jira").await.is_none(),
-        "no banner on the very first retry after waking up"
-    );
-    let (last_error,): (Option<String>,) =
-        sqlx::query_as("SELECT last_error FROM pm_sync_state WHERE provider = 'jira'")
-            .fetch_one(&pool)
-            .await
-            .unwrap();
-    assert_eq!(
-        last_error, None,
-        "the grace attempt must not make the Integrations page show \"Sync failed\""
+        !detail.contains("6 hours"),
+        "the old duration wording must not come back - got {detail:?}"
     );
-
-    let second = note_transient_sync_failure(&pool, "jira", "dns error")
-        .await
-        .unwrap();
     assert!(
-        second,
-        "a second consecutive failure means it is not just a blip"
+        remedy.is_some_and(|r| r.to_lowercase().contains("connection")),
+        "a connectivity fault must point at connectivity"
     );
-    assert!(notice(&pool, "pm.jira").await.is_some());
 }
 
-/// Grace is per-gap, not a one-time allowance for the provider's lifetime: a
-/// genuine intervening success must reset it, or a provider that recovers and
-/// later fails again would skip straight to escalation.
+/// A SUCCESS is the only thing that resets the streak. Without this, failures
+/// accumulate across hours of healthy operation and the Nth blip of the day
+/// escalates for no reason.
 #[tokio::test]
-async fn a_real_success_between_gaps_resets_the_grace() {
+async fn a_success_resets_the_streak() {
     let pool = make_db().await;
-    set_last_sync(&pool, "jira", "-9 hours").await;
+    fresh_streak("resets");
+    set_last_sync(&pool, "resets", "-2 minutes").await;
 
-    assert!(
-        !note_transient_sync_failure(&pool, "jira", "dns error")
+    for _ in 1..TRANSIENT_ESCALATION_ATTEMPTS {
+        assert!(!note_transient_sync_failure(&pool, "resets", "blip")
             .await
-            .unwrap(),
-        "first failure after the first gap: grace"
-    );
-
-    // A real success lands - e.g. the network came back for a while.
-    set_last_sync(&pool, "jira", "-0 hours").await;
+            .unwrap());
+    }
+    // One good sync in between wipes the slate.
+    clear_sync_error(&pool, "resets").await.unwrap();
 
-    // Then a second, later gap starts.
-    set_last_sync(&pool, "jira", "-9 hours").await;
     assert!(
-        !note_transient_sync_failure(&pool, "jira", "dns error")
+        !note_transient_sync_failure(&pool, "resets", "blip")
             .await
             .unwrap(),
-        "first failure after the SECOND gap must get grace again, not skip to escalation"
+        "after a success the count restarts, so this is failure #1 and stays silent"
     );
-}
-
-/// The grace-row insert races a concurrent one across PROCESSES: `meridian
-/// ticket-update` force-syncs through its own pool on the same `meridian.db`
-/// while the daemon polls. Both can observe "no row" and both insert against
-/// the `provider` PRIMARY KEY.
-///
-/// Without `ON CONFLICT DO NOTHING` the loser gets a UNIQUE violation, which
-/// `record_sync_failure` swallows by design - so the grace row vanishes, the
-/// next failure takes the never-synced branch again, and the escalation clock
-/// never starts. A provider blocked forever would then stay silent forever,
-/// which is the failure mode this module exists to prevent.
-///
-/// The race has no deterministic hook, so this pins the property that makes
-/// the race survivable: inserting over an existing row is a no-op, not an
-/// error, and the first writer's row is left intact.
-#[tokio::test]
-async fn a_racing_grace_row_insert_is_a_no_op_not_an_error() {
-    let pool = make_db().await;
-
-    insert_grace_row(&pool, "github", "first writer")
-        .await
-        .unwrap();
-    insert_grace_row(&pool, "github", "second writer")
-        .await
-        .expect("a concurrent grace-row insert must not error");
-
-    let (count,): (i64,) =
-        sqlx::query_as("SELECT COUNT(*) FROM pm_sync_state WHERE provider = 'github'")
-            .fetch_one(&pool)
-            .await
-            .unwrap();
-    assert_eq!(count, 1, "the racing insert must not duplicate the row");
-
-    let (last, detail): (String, Option<String>) = sqlx::query_as(
-        "SELECT last_synced_at, last_error FROM pm_sync_state WHERE provider = 'github'",
-    )
-    .fetch_one(&pool)
-    .await
-    .unwrap();
     assert!(
-        last.starts_with("1970"),
-        "the sentinel must survive the race, or escalation stalls: {last}"
-    );
-    assert_eq!(
-        detail, None,
-        "a grace row must never carry a user-visible last_error, from either writer"
+        notice(&pool, "pm.resets").await.is_none(),
+        "no notice may survive a successful sync"
     );
 }
 
-/// A provider that HAS synced before must still escalate normally after a
-/// grace row lands - i.e. the conflict-tolerant insert did not change the
-/// contract the escalation clock reads.
+/// The streak is per provider. A flaky GitHub must not push Jira toward a notice.
 #[tokio::test]
-async fn a_grace_row_from_a_race_still_escalates_on_the_next_failure() {
+async fn streaks_do_not_leak_between_providers() {
     let pool = make_db().await;
-    insert_grace_row(&pool, "github", "first writer")
-        .await
-        .unwrap();
+    fresh_streak("leak_a");
+    fresh_streak("leak_b");
 
-    let escalated = note_transient_sync_failure(&pool, "github", "dns error")
-        .await
-        .unwrap();
+    for _ in 1..TRANSIENT_ESCALATION_ATTEMPTS {
+        assert!(!note_transient_sync_failure(&pool, "leak_a", "blip")
+            .await
+            .unwrap());
+    }
     assert!(
-        escalated,
-        "the epoch sentinel is not a recent sync, so the next failure must surface"
+        !note_transient_sync_failure(&pool, "leak_b", "blip")
+            .await
+            .unwrap(),
+        "provider b is on its FIRST failure and must be unaffected by a's streak"
     );
-    assert!(notice(&pool, "pm.github").await.is_some());
 }
 
-/// The grace is exactly one retry, not an open-ended reprieve: the row the
-/// first failure writes must carry the epoch sentinel, or it would read as
-/// a recent sync and suppress escalation forever.
+/// A never-synced provider (no `pm_sync_state` row at all) follows the same rule.
+///
+/// It used to need its own branch, because an age test on a missing row no-opped
+/// forever - exactly on the installs that most needed it, someone who just
+/// connected and whose network blocks the provider. Counting attempts removes
+/// that special case entirely, and this pins that it really is gone.
 #[tokio::test]
-async fn the_first_failure_row_does_not_look_like_a_sync() {
+async fn a_never_synced_provider_escalates_on_the_same_streak() {
     let pool = make_db().await;
-    note_transient_sync_failure(&pool, "github", "dns error")
-        .await
-        .unwrap();
+    fresh_streak("virgin");
+    // Deliberately NO set_last_sync: there is no row.
 
-    let (last,): (String,) =
-        sqlx::query_as("SELECT last_synced_at FROM pm_sync_state WHERE provider = 'github'")
-            .fetch_one(&pool)
+    for _ in 1..TRANSIENT_ESCALATION_ATTEMPTS {
+        assert!(!note_transient_sync_failure(&pool, "virgin", "dns error")
             .await
-            .unwrap();
+            .unwrap());
+    }
     assert!(
-        last.starts_with("1970"),
-        "the grace row must not count as a sync: {last}"
+        note_transient_sync_failure(&pool, "virgin", "dns error")
+            .await
+            .unwrap(),
+        "a provider that never synced must still escalate on a real streak"
     );
 }
 
-/// A row left by an earlier TERMINAL failure carries the epoch sentinel
-/// (`stamp_sync_error` inserts `1970-01-01`), which is a row but not a
-/// success. It must not be mistaken for one.
+/// The test seam exists and drives escalation, so a future test does not have to
+/// know the threshold's value to exercise the loud path.
 #[tokio::test]
-async fn an_epoch_sentinel_row_is_not_a_recent_success() {
+async fn the_streak_can_be_forced_for_tests() {
     let pool = make_db().await;
-    stamp_sync_error(&pool, "github", "bad credentials")
-        .await
-        .unwrap();
-
-    let escalated = note_transient_sync_failure(&pool, "github", "dns error")
-        .await
-        .unwrap();
-
-    assert!(escalated, "an epoch last_synced_at is not a success");
-}
-
-/// The window itself, from both sides.
-#[tokio::test]
-async fn the_escalation_window_holds_on_both_sides() {
-    let pool = make_db().await;
-
-    set_last_sync(&pool, "jira", "-1 hours").await;
-    assert!(
-        !note_transient_sync_failure(&pool, "jira", "blip")
-            .await
-            .unwrap(),
-        "inside the window must stay silent"
-    );
-
-    set_last_sync(&pool, "jira", "-7 hours").await;
-    assert!(
-        !note_transient_sync_failure(&pool, "jira", "blip")
-            .await
-            .unwrap(),
-        "the first failure outside the window still gets one retry of grace"
-    );
+    set_transient_streak_for_test("forced", TRANSIENT_ESCALATION_ATTEMPTS - 1);
     assert!(
-        note_transient_sync_failure(&pool, "jira", "blip")
+        note_transient_sync_failure(&pool, "forced", "blip")
             .await
             .unwrap(),
-        "the second consecutive failure outside the window must escalate"
+        "one more failure on top of a forced near-threshold streak must escalate"
     );
+    reset_transient_streak("forced");
 }
 
 /// The escalation must self-heal: once the provider is reachable again the
@@ -353,10 +242,10 @@ async fn the_escalation_window_holds_on_both_sides() {
 #[tokio::test]
 async fn a_successful_sync_clears_an_escalated_notice() {
     let pool = make_db().await;
-    // Two failures: the first is the never-synced grace attempt.
-    note_transient_sync_failure(&pool, "github", "dns error")
-        .await
-        .unwrap();
+    // Drive the streak to one below the threshold, so the next failure is the
+    // one that escalates. Forced rather than looped so the test does not have to
+    // restate the threshold's value.
+    set_transient_streak_for_test("github", TRANSIENT_ESCALATION_ATTEMPTS - 1);
     note_transient_sync_failure(&pool, "github", "dns error")
         .await
         .unwrap();
@@ -370,16 +259,16 @@ async fn a_successful_sync_clears_an_escalated_notice() {
     );
 }
 
-/// The coupling that makes escalation reachable at all: recording an error
-/// must NEVER write a fresh `last_synced_at`.
+/// Recording an error must NEVER write a fresh `last_synced_at`.
 ///
-/// Every provider gates its whole fetch on that column being recent, and
-/// [`note_transient_sync_failure`] keys its escalation clock on the SAME
-/// column. So stamping `now` here would do two invisible things at once:
-/// suppress the next tick's retry, and reset the escalation clock on every
-/// failure so the threshold is never reached. The provider would go silent
-/// permanently, which is the exact regression this whole change exists to
-/// prevent. `azure_devops` had precisely this bug in its own `stamp_error`.
+/// Every provider gates its whole fetch on that column being recent, so stamping
+/// `now` while recording a FAILURE would suppress the next attempt's retry - the
+/// provider would go quiet permanently, having convinced itself it had just
+/// succeeded. `azure_devops` had precisely this bug in its own `stamp_error`.
+///
+/// This used to also guard the escalation clock, which keyed on the same column.
+/// That clock is gone (escalation counts consecutive attempts now), but the
+/// retry-suppression half is untouched and is the reason this still matters.
 #[tokio::test]
 async fn recording_an_error_never_looks_like_a_successful_sync() {
     let pool = make_db().await;
@@ -397,15 +286,24 @@ async fn recording_an_error_never_looks_like_a_successful_sync() {
         "an error must not be recorded as a sync: {last}"
     );
 
-    // And on a row that already holds a real (old) success, recording a
-    // failure must leave the clock alone rather than pushing it forward.
+    // And on a row that already holds a real (old) success, recording a failure
+    // must leave that timestamp alone rather than pushing it forward.
     set_last_sync(&pool, "github", "-10 hours").await;
+    let (before,): (String,) =
+        sqlx::query_as("SELECT last_synced_at FROM pm_sync_state WHERE provider = 'github'")
+            .fetch_one(&pool)
+            .await
+            .unwrap();
     stamp_sync_error(&pool, "github", "boom").await.unwrap();
-    assert!(
-        note_transient_sync_failure(&pool, "github", "unreachable")
+    let (after,): (String,) =
+        sqlx::query_as("SELECT last_synced_at FROM pm_sync_state WHERE provider = 'github'")
+            .fetch_one(&pool)
             .await
-            .unwrap(),
-        "recording an error must not reset the escalation clock"
+            .unwrap();
+    assert_eq!(
+        before, after,
+        "recording an error must not move last_synced_at - doing so would make the \
+         provider skip its next fetch as though it had just succeeded"
     );
 }
 
@@ -451,12 +349,25 @@ fn status_err(status: u16, body: &str) -> anyhow::Error {
 #[tokio::test]
 async fn a_transient_failure_at_the_catch_all_raises_no_notice() {
     let pool = make_db().await;
-    set_last_sync(&pool, "azure_devops", "-5 minutes").await;
+    // A UNIQUE provider key, not a real provider name. The consecutive-failure
+    // streak lives in a process-global map, and several tests in this file drive
+    // transient failures through `azure_devops`; sharing the key let one test's
+    // failures count toward another's streak under cargo's parallel threads.
+    // Nothing here depends on the name being a real provider - the assertion is
+    // that no notice is raised at all.
+    reset_transient_streak("catchall_transient");
+    set_last_sync(&pool, "catchall_transient", "-5 minutes").await;
 
-    record_sync_failure(&pool, "azure_devops", "wiql", &status_err(503, "down")).await;
+    record_sync_failure(
+        &pool,
+        "catchall_transient",
+        "wiql",
+        &status_err(503, "down"),
+    )
+    .await;
 
     assert!(
-        notice(&pool, "pm.azure_devops").await.is_none(),
+        notice(&pool, "pm.catchall_transient").await.is_none(),
         "a 503 reaching the catch-all must not raise a credentials banner"
     );
 }
@@ -516,14 +427,21 @@ async fn recording_the_same_failure_twice_cannot_degrade_it() {
 #[tokio::test]
 async fn re_reporting_a_transient_failure_still_raises_nothing() {
     let pool = make_db().await;
-    set_last_sync(&pool, "azure_devops", "-5 minutes").await;
+    // A UNIQUE provider key, not a real provider name. The consecutive-failure
+    // streak lives in a process-global map, and several tests in this file drive
+    // transient failures through `azure_devops`; sharing the key let one test's
+    // failures count toward another's streak under cargo's parallel threads.
+    // Nothing here depends on the name being a real provider - the assertion is
+    // that no notice is raised at all.
+    reset_transient_streak("rereport_transient");
+    set_last_sync(&pool, "rereport_transient", "-5 minutes").await;
     let err = status_err(503, "down");
 
-    record_sync_failure(&pool, "azure_devops", "wiql", &err).await;
-    record_sync_failure(&pool, "azure_devops", "refresh", &err).await;
+    record_sync_failure(&pool, "rereport_transient", "wiql", &err).await;
+    record_sync_failure(&pool, "rereport_transient", "refresh", &err).await;
 
     assert!(
-        notice(&pool, "pm.azure_devops").await.is_none(),
+        notice(&pool, "pm.rereport_transient").await.is_none(),
         "a re-reported blip must stay silent"
     );
 }
@@ -597,79 +515,3 @@ async fn every_default_remedy_names_a_place_in_the_app() {
         );
     }
 }
-
-/// The grace write must not clobber a sync that SUCCEEDED under it.
-///
-/// `note_transient_sync_failure` reads the row's state, then writes the epoch
-/// sentinel in a SEPARATE statement. `meridian ticket-update` opens its own
-/// pool to this file and runs `run_pm_force_sync` while the daemon's poll loop
-/// runs `run_pm_sync`, so a success can land between those two - and the write
-/// used to be unconditional, stamping the fresh `last_synced_at` back to the
-/// epoch. The provider then read as never-recently-synced and the NEXT failure
-/// escalated a user-visible notice for a tracker that was working.
-///
-/// Simulating the interleaving directly needs a hook that does not exist, so
-/// this drives the same end state the racer would leave: a row that is fresh
-/// at the moment of the write. The conditional UPDATE must decline it.
-#[tokio::test]
-async fn a_concurrent_successful_sync_is_not_stamped_back_to_the_epoch() {
-    let pool = make_db().await;
-    // The state the winner of the race leaves behind: a genuinely recent sync.
-    set_last_sync(&pool, "jira", "-1 minutes").await;
-
-    mark_first_stale_failure(&pool, "jira", "dns error")
-        .await
-        .unwrap();
-
-    let (last,): (String,) =
-        sqlx::query_as("SELECT last_synced_at FROM pm_sync_state WHERE provider = 'jira'")
-            .fetch_one(&pool)
-            .await
-            .unwrap();
-    assert_ne!(
-        last, "1970-01-01T00:00:00Z",
-        "a successful sync must not be stamped back to the epoch by the grace write"
-    );
-}
-
-/// The grace write still does its job on the case it exists for: a provider
-/// that genuinely went stale, with no error recorded.
-#[tokio::test]
-async fn a_clean_stale_transition_still_gets_its_grace_tick() {
-    let pool = make_db().await;
-    set_last_sync(&pool, "jira", "-7 hours").await;
-
-    mark_first_stale_failure(&pool, "jira", "dns error")
-        .await
-        .unwrap();
-
-    let (last,): (String,) =
-        sqlx::query_as("SELECT last_synced_at FROM pm_sync_state WHERE provider = 'jira'")
-            .fetch_one(&pool)
-            .await
-            .unwrap();
-    assert_eq!(last, "1970-01-01T00:00:00Z");
-}
-
-/// A row that already carries an error is not a clean stale transition, so the
-/// grace write must decline it - the escalation clock is already running.
-#[tokio::test]
-async fn a_row_with_an_error_does_not_get_a_grace_tick() {
-    let pool = make_db().await;
-    set_last_sync(&pool, "jira", "-7 hours").await;
-    sqlx::query("UPDATE pm_sync_state SET last_error = 'boom' WHERE provider = 'jira'")
-        .execute(&pool)
-        .await
-        .unwrap();
-
-    mark_first_stale_failure(&pool, "jira", "dns error")
-        .await
-        .unwrap();
-
-    let (last,): (String,) =
-        sqlx::query_as("SELECT last_synced_at FROM pm_sync_state WHERE provider = 'jira'")
-            .fetch_one(&pool)
-            .await
-            .unwrap();
-    assert_ne!(last, "1970-01-01T00:00:00Z");
-}
diff --git a/src/pm_worklog/auto_generate/mod.rs b/src/pm_worklog/auto_generate/mod.rs
index b8446b205..5bd5724c2 100644
--- a/src/pm_worklog/auto_generate/mod.rs
+++ b/src/pm_worklog/auto_generate/mod.rs
@@ -98,6 +98,34 @@ mod sweep;
 
 use sweep::draft_qualifying_tasks;
 
+/// Whether a sweep may refresh the PM board before matching work to tickets.
+///
+/// Exists because "refresh the board first" is correct for one caller and
+/// actively unsafe for the other, and the difference is not visible from inside
+/// the sweep.
+///
+/// Refreshing the board can trigger an OAuth access-token refresh, and Atlassian
+/// rotates the refresh token on every use - so a refresh whose response is lost
+/// because the machine suspended mid-request destroys the grant permanently (the
+/// full mechanism is in `meridian_oauth::refresh_journal`). launchd `KeepAlive`
+/// restarts the daemon on every wake, which makes the pipeline's STARTUP pass
+/// wake-triggered by construction: exactly the condition where a suspend can land
+/// mid-request. Its clock-aligned tick is different - it fires at the hour the
+/// user chose for their end-of-day pass, when they are far more likely to be
+/// sitting at the machine.
+///
+/// So the startup pass drafts against the cached board ([`RefreshBoard::No`]) and
+/// the chosen-hour tick refreshes first ([`RefreshBoard::Yes`]). A slightly stale
+/// board costs at worst one mis-bound worklog the user can correct; a destroyed
+/// grant costs a manual re-authentication and every sync until they notice.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RefreshBoard {
+    /// Refresh `pm_tasks` first. For triggers where a user is plausibly present.
+    Yes,
+    /// Draft against whatever is cached. For anything a wake can trigger.
+    No,
+}
+
 /// Fixed qualifying threshold — a day-task needs more than this many tracked
 /// minutes to be auto-drafted. Not user-configurable: only WHEN Meridian checks
 /// (`worklog_auto_generate_time`) is a choice; WHICH tasks qualify is not.
@@ -120,7 +148,12 @@ fn parse_hh_mm(s: &str) -> Option<(u32, u32)> {
 /// time) — see the module docs. Tasks are processed one at a time, in order —
 /// never concurrently.
 #[tracing::instrument(skip(pool, config))]
-pub async fn maybe_auto_generate(pool: &SqlitePool, config: &Config, day_local: &str) {
+pub async fn maybe_auto_generate(
+    pool: &SqlitePool,
+    config: &Config,
+    day_local: &str,
+    refresh: RefreshBoard,
+) {
     let span = tracing::info_span!(
         "worklog.auto_generate.run",
         day = day_local,
@@ -132,10 +165,10 @@ pub async fn maybe_auto_generate(pool: &SqlitePool, config: &Config, day_local:
         tasks_drafted = Empty,
         tasks_failed = Empty,
     );
-    run(pool, config, day_local).instrument(span).await
+    run(pool, config, day_local, refresh).instrument(span).await
 }
 
-async fn run(pool: &SqlitePool, config: &Config, day_local: &str) {
+async fn run(pool: &SqlitePool, config: &Config, day_local: &str, refresh: RefreshBoard) {
     let current_span = tracing::Span::current();
 
     let settings = meridian_core::settings::load_runtime_settings();
@@ -159,7 +192,7 @@ async fn run(pool: &SqlitePool, config: &Config, day_local: &str) {
     }
     current_span.record("gate", "ran");
 
-    draft_qualifying_tasks(pool, config, day_local, &current_span).await;
+    draft_qualifying_tasks(pool, config, day_local, &current_span, refresh).await;
 }
 
 /// The "Generate now" path — the same day-task draft sweep as [`maybe_auto_generate`],
@@ -184,7 +217,9 @@ pub async fn generate_now(pool: &SqlitePool, config: &Config, day_local: &str) {
     async {
         let current_span = tracing::Span::current();
         current_span.record("gate", "ran");
-        draft_qualifying_tasks(pool, config, day_local, &current_span).await;
+        // On-demand: the user pressed Generate, so they are unambiguously present
+        // and this refresh cannot be a wake-triggered one.
+        draft_qualifying_tasks(pool, config, day_local, &current_span, RefreshBoard::Yes).await;
     }
     .instrument(span)
     .await
@@ -248,4 +283,43 @@ mod tests {
             "the tracker gate is back - it disables auto-generate for every solo user"
         );
     }
+
+    /// THE WAKE-TRIGGERED PASS MUST NOT REFRESH THE BOARD.
+    ///
+    /// Source-level, because getting this wrong is silent: the startup pass would
+    /// simply work, refresh the board, and occasionally destroy an Atlassian grant
+    /// when the machine re-suspended mid-token-exchange. launchd `KeepAlive`
+    /// restarts the daemon on every wake, so `run_loop`'s pre-loop
+    /// `end_of_day_pass` IS the wake path - see [`RefreshBoard`].
+    ///
+    /// Pins the pairing rather than the values alone: the startup call must pass
+    /// `No` and the clock-aligned tick must pass `Yes`. A future edit that
+    /// "simplifies" them to one shared argument fails here.
+    #[test]
+    fn the_startup_pass_never_refreshes_and_the_chosen_hour_tick_does() {
+        let src = include_str!("../../worklog_pipeline.rs");
+        let code: String = src
+            .lines()
+            .filter(|l: &&str| !l.trim_start().starts_with("//"))
+            .collect::<Vec<_>>()
+            .join("\n");
+
+        let no_calls = code.matches("RefreshBoard::No").count();
+        let yes_calls = code.matches("RefreshBoard::Yes").count();
+        assert_eq!(
+            no_calls, 1,
+            "exactly one end_of_day_pass call - the wake-triggered startup one - \
+             may pass RefreshBoard::No; found {no_calls}"
+        );
+        assert_eq!(
+            yes_calls, 1,
+            "exactly one end_of_day_pass call - the chosen-hour tick - may pass \
+             RefreshBoard::Yes; found {yes_calls}"
+        );
+        // And no call may omit the decision by defaulting it.
+        assert!(
+            !code.contains("end_of_day_pass(&pool, &full_cfg)."),
+            "every end_of_day_pass call must state its RefreshBoard explicitly"
+        );
+    }
 }
diff --git a/src/pm_worklog/auto_generate/sweep.rs b/src/pm_worklog/auto_generate/sweep.rs
index f0f66e796..3fe573d0b 100644
--- a/src/pm_worklog/auto_generate/sweep.rs
+++ b/src/pm_worklog/auto_generate/sweep.rs
@@ -54,6 +54,7 @@ pub(super) async fn draft_qualifying_tasks(
     config: &Config,
     day_local: &str,
     span: &tracing::Span,
+    refresh: super::RefreshBoard,
 ) -> SweepCounts {
     // Refresh the board before matching work to tickets. Nothing does this on a
     // timer any more (see `main.rs`'s poll loop), and this is the one consumer
@@ -65,11 +66,23 @@ pub(super) async fn draft_qualifying_tasks(
     // separately, so both sweeps get it from one call site and the two can never
     // disagree about whether a run refreshed first. Gated (a fresh cache is a
     // no-op) and log-and-continue: a failed sync must not cancel drafting.
-    if let Err(e) = crate::intelligence::run_pm_sync(pool, config).await {
-        tracing::warn!(
-            day = day_local, error = %crate::errors::chain(&e),
-            "worklog: pre-draft PM sync failed — matching against the cached board"
-        );
+    match refresh {
+        super::RefreshBoard::Yes => {
+            if let Err(e) = crate::intelligence::run_pm_sync(pool, config).await {
+                tracing::warn!(
+                    day = day_local, error = %crate::errors::chain(&e),
+                    "worklog: pre-draft PM sync failed — matching against the cached board"
+                );
+            }
+        }
+        // Not merely skipped for speed: see `super::RefreshBoard`. A refresh here
+        // can trigger a rotating-OAuth-token exchange, and this caller is
+        // wake-triggered, which is the one condition under which losing that
+        // exchange's response destroys the user's grant.
+        super::RefreshBoard::No => tracing::debug!(
+            day = day_local,
+            "worklog: drafting against the cached board - this pass can be wake-triggered"
+        ),
     }
     let tasks = match meridian_core::day_tasks::get_day_tasks(pool, day_local).await {
         Ok(resp) => resp.tasks,
@@ -265,8 +278,14 @@ mod tests {
         put_draft(&pool, "T1").await;
         put_draft(&pool, "T2").await;
 
-        let counts =
-            draft_qualifying_tasks(&pool, &no_tracker_config(), DAY, &tracing::Span::none()).await;
+        let counts = draft_qualifying_tasks(
+            &pool,
+            &no_tracker_config(),
+            DAY,
+            &tracing::Span::none(),
+            crate::pm_worklog::auto_generate::RefreshBoard::No,
+        )
+        .await;
 
         assert_eq!(
             counts,
@@ -289,8 +308,14 @@ mod tests {
         put_task(&pool, "T1", QUALIFYING_MINUTES - 1).await;
         put_draft(&pool, "T1").await;
 
-        let counts =
-            draft_qualifying_tasks(&pool, &no_tracker_config(), DAY, &tracing::Span::none()).await;
+        let counts = draft_qualifying_tasks(
+            &pool,
+            &no_tracker_config(),
+            DAY,
+            &tracing::Span::none(),
+            crate::pm_worklog::auto_generate::RefreshBoard::No,
+        )
+        .await;
 
         assert_eq!(counts.total, 1);
         assert_eq!(counts.qualifying, 0, "under the threshold, never drafted");
@@ -301,8 +326,14 @@ mod tests {
     #[tokio::test]
     async fn an_empty_day_sweeps_to_zero() {
         let pool = seeded().await;
-        let counts =
-            draft_qualifying_tasks(&pool, &no_tracker_config(), DAY, &tracing::Span::none()).await;
+        let counts = draft_qualifying_tasks(
+            &pool,
+            &no_tracker_config(),
+            DAY,
+            &tracing::Span::none(),
+            crate::pm_worklog::auto_generate::RefreshBoard::No,
+        )
+        .await;
         assert_eq!(counts, SweepCounts::default());
     }
 }
diff --git a/src/worklog_pipeline.rs b/src/worklog_pipeline.rs
index ed6fc3196..a17ebd5a5 100644
--- a/src/worklog_pipeline.rs
+++ b/src/worklog_pipeline.rs
@@ -30,6 +30,7 @@ use sqlx::SqlitePool;
 use tokio::sync::watch;
 use tracing::Instrument;
 
+use crate::pm_worklog::auto_generate::RefreshBoard;
 use crate::pm_worklog::{ledger, PmWorklogConfig};
 
 // `pub(crate)` where the LLM-Lab replay ([`crate::llm_experiment`]) reuses the request
@@ -516,7 +517,14 @@ pub async fn run_loop(pool: SqlitePool, db_path: String, mut shutdown_rx: watch:
         tracing::info!("worklog-pipeline driver stopped");
         return;
     }
-    end_of_day_pass(&pool, &full_cfg).await;
+    // `RefreshBoard::No` on the STARTUP pass, and this is a data-safety choice
+    // rather than an optimisation. launchd `KeepAlive` restarts the daemon on
+    // every wake, so anything the startup pass does is wake-triggered - and a
+    // board refresh can trigger an OAuth token refresh, which is the operation
+    // that permanently destroys an Atlassian grant if the machine re-suspends
+    // mid-request (see `meridian_oauth::refresh_journal`). Drafting against the
+    // board the user's last dashboard visit left behind is the safe trade.
+    end_of_day_pass(&pool, &full_cfg, RefreshBoard::No).await;
 
     loop {
         let dur = next_worklog_wake();
@@ -526,7 +534,12 @@ pub async fn run_loop(pool: SqlitePool, db_path: String, mut shutdown_rx: watch:
                 if catch_up_pass(&pool, &cfg, &db_path, &mut shutdown_rx).await {
                     break;
                 }
-                end_of_day_pass(&pool, &full_cfg).await;
+                // The clock-aligned tick MAY refresh: it fires at the hour the
+                // user themselves chose for their end-of-day pass, so they are
+                // far more likely to be at the machine, and a fresh board is what
+                // stops an hour of work being bound to a ticket that closed
+                // earlier today.
+                end_of_day_pass(&pool, &full_cfg, RefreshBoard::Yes).await;
             }
         }
     }
@@ -542,9 +555,14 @@ pub async fn run_loop(pool: SqlitePool, db_path: String, mut shutdown_rx: watch:
 /// summary first would score a plan whose matches had not landed yet. Both gate
 /// themselves on `worklog_auto_generate_time`, so on every hour but the chosen one
 /// (through midnight, self-healing) this is a pair of cheap no-ops.
-async fn end_of_day_pass(pool: &SqlitePool, full_cfg: &crate::config::Config) {
+async fn end_of_day_pass(
+    pool: &SqlitePool,
+    full_cfg: &crate::config::Config,
+    refresh: RefreshBoard,
+) {
     let day_local = Local::now().date_naive().format("%Y-%m-%d").to_string();
-    crate::pm_worklog::auto_generate::maybe_auto_generate(pool, full_cfg, &day_local).await;
+    crate::pm_worklog::auto_generate::maybe_auto_generate(pool, full_cfg, &day_local, refresh)
+        .await;
     crate::day_summary::auto::maybe_auto_summarise(pool, &day_local).await;
 }
 

From f8ef28cdfe566375d524d0d37077f7320f37266c Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Mon, 31 Aug 2026 18:48:38 +0530
Subject: [PATCH 28/53] fix(daemon): bound background-task shutdown and stop
 dev tray false-installing over itself

The coding-agent summariser's drain() ran up to batch_per_tick (32) rows
sequentially with no shutdown check between them, each shelling out to the
agent's own CLI for up to ~2 minutes - so a daemon shutdown mid-batch could
leave meridian.db open far past the tray installer's 10s
wait_for_db_unheld budget, risking the double-writer corruption this repo
has hit before. It now checks shutdown between rows, and main.rs's shutdown
sequence joins all background-task handles (concurrently, bounded to one
shutdown budget) before checkpointing/closing the pool, instead of firing
the signal and moving on with no idea whether they'd stopped.

Separately, bundled_backend_dir() decided "packaged install" purely from
whether a backend/ directory existed under resource_dir() - true even for
a dev/debug tray if a stray directory is ever left there (e.g. from an
earlier debug-profile build), which made a dev tray try to "install" a
mismatched binary over itself, bootout a launchd agent that was never
loaded, then time out waiting for its own sibling dev daemon to release
meridian.db. Gated on !debug_assertions to match the same convention the
encryption-migration path already uses.
---
 .../summariser/mod.rs                         | 103 ++++++++++++++++-
 src/main.rs                                   | 104 +++++++++++++++---
 tray/src-tauri/src/backend_install.rs         |  24 ++++
 3 files changed, 215 insertions(+), 16 deletions(-)

diff --git a/src/coding_agent_session_ingest/summariser/mod.rs b/src/coding_agent_session_ingest/summariser/mod.rs
index bc22f90af..acbff2e31 100644
--- a/src/coding_agent_session_ingest/summariser/mod.rs
+++ b/src/coding_agent_session_ingest/summariser/mod.rs
@@ -595,7 +595,14 @@ pub async fn run_loop(
     // Only rows whose source is in backoff are skipped; other sources continue.
     let mut source_backoff: HashMap<String, std::time::Instant> = HashMap::new();
     loop {
-        let all_backed_off = drain(&pool, &cfg, &mut attempts, &mut source_backoff).await;
+        let all_backed_off = drain(
+            &pool,
+            &cfg,
+            &mut attempts,
+            &mut source_backoff,
+            &shutdown_rx,
+        )
+        .await;
         let wait = if all_backed_off {
             // Nothing could be processed (all pending rows are from backed-off
             // sources). Wait out the backoff period rather than spinning.
@@ -643,6 +650,7 @@ async fn drain(
     cfg: &SummariserConfig,
     attempts: &mut HashMap<i64, u32>,
     source_backoff: &mut HashMap<String, std::time::Instant>,
+    shutdown_rx: &watch::Receiver<bool>,
 ) -> bool {
     // Expire stale backoffs before deciding what to skip.
     let now_instant = std::time::Instant::now();
@@ -671,6 +679,24 @@ async fn drain(
     let mut skipped_backoff = 0u32;
 
     for row in &rows {
+        // Each row shells out to the agent's own CLI (`claude -p` / `codex exec`
+        // / …), which can run for tens of seconds to a couple of minutes — and
+        // this loop runs up to `batch_per_tick` (default 32) of them
+        // sequentially. Without this check, a daemon shutdown mid-batch would
+        // not be observed until the whole batch drained (worst case, tens of
+        // minutes), holding `meridian.db` open long past the tray installer's
+        // 10s `wait_for_db_unheld` budget (`backend_install.rs`) and risking
+        // exactly the double-writer corruption that guard exists to prevent.
+        // Checked between rows, not mid-subprocess-call: the subprocess isn't
+        // cancellation-safe, so bounding exposure to "at most one in-flight
+        // row" is the safe stopping point, not "any point at all".
+        if *shutdown_rx.borrow() {
+            tracing::info!(
+                remaining = rows.len() - summarised as usize - skipped_backoff as usize,
+                "coding-agent summariser: shutdown requested mid-drain — stopping early"
+            );
+            return false;
+        }
         // Skip rows whose agent source is still in rate-limit backoff.
         if source_backoff.contains_key(&row.agent) {
             skipped_backoff += 1;
@@ -946,4 +972,79 @@ mod tests {
             "row 2's independent failure count must be untouched"
         );
     }
+
+    /// THE regression this exists for: `drain()` used to process its whole
+    /// batch (up to `batch_per_tick`, default 32, each shelling out to the
+    /// agent's own CLI) with no shutdown check at all, so a daemon SIGTERM
+    /// mid-batch went unnoticed until every row finished — worst case, tens
+    /// of minutes with `meridian.db` still open. That blew straight through
+    /// the tray installer's 10s `wait_for_db_unheld` budget
+    /// (`backend_install.rs`), which is the guard standing between an update
+    /// and the exact double-writer corruption documented in this repo's
+    /// history.
+    ///
+    /// Pre-signals shutdown BEFORE calling `drain()` (rather than racing a
+    /// real subprocess mid-row, which isn't cancellation-safe) and asserts
+    /// the pending row is untouched — proving the loop bailed before ever
+    /// calling `summarise_one`, not merely that it returned some value.
+    #[tokio::test]
+    async fn drain_stops_before_touching_any_row_once_shutdown_is_signalled() {
+        use crate::coding_agent_session_ingest::db as cdb;
+        use crate::coding_agent_session_ingest::segment::Segment;
+        use sqlx::sqlite::SqliteConnectOptions;
+        use std::str::FromStr;
+
+        let opts = SqliteConnectOptions::from_str("sqlite::memory:")
+            .unwrap()
+            .create_if_missing(true);
+        let pool = SqlitePool::connect_with(opts).await.unwrap();
+        sqlx::migrate!("src/migrations").run(&pool).await.unwrap();
+        db::ensure_summary_source_column(&pool).await.unwrap();
+
+        let seg = Segment {
+            session_uuid: "u1".into(),
+            agent: "claude_code".into(),
+            cwd: Some("/repo".into()),
+            segment_started_at: "2026-05-20T08:00:00.000000+00:00".into(),
+            started_at: "2026-05-20T08:00:00.000000+00:00".into(),
+            ended_at: "2026-05-20T08:30:00.000000+00:00".into(),
+            user_turns: 2,
+            assistant_turns: 2,
+            active_seconds: 300,
+            transcript: "x".repeat(900),
+            is_last: false,
+            title: None,
+        };
+        let id = cdb::upsert_segment(&pool, &seg, true, Some("2026-05-20T09:00:00.000000+00:00"))
+            .await
+            .unwrap()
+            .unwrap();
+
+        let cfg = SummariserConfig::from_env();
+        let mut attempts = HashMap::new();
+        let mut source_backoff = HashMap::new();
+        // Already true when drain() starts — the same state the loop sees
+        // when a SIGTERM lands between two drain() calls, or (with this fix)
+        // between two rows of the same batch.
+        let (_tx, rx) = watch::channel(true);
+
+        let all_backed_off = drain(&pool, &cfg, &mut attempts, &mut source_backoff, &rx).await;
+        assert!(
+            !all_backed_off,
+            "a shutdown bail-out is not a backoff condition"
+        );
+
+        let (method,): (String,) =
+            sqlx::query_as("SELECT task_method FROM app_sessions WHERE id = ?")
+                .bind(id)
+                .fetch_one(&pool)
+                .await
+                .unwrap();
+        assert_eq!(
+            method,
+            db::TASK_METHOD_PENDING,
+            "the row must be untouched — drain() must bail before calling \
+             summarise_one, not merely stop looping afterward"
+        );
+    }
 }
diff --git a/src/main.rs b/src/main.rs
index c01754789..bdfc7c88b 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1460,6 +1460,12 @@ async fn main() -> Result<()> {
     }
 
     let (shutdown_tx, shutdown_rx) = tokio::sync::watch::channel(false);
+    // Every task below holds its own clone of the `meridian` pool and must be
+    // known to have actually stopped touching it before shutdown checkpoints
+    // and closes that pool — see the bounded join at the "9. Shutdown" step,
+    // and its doc comment for why a fire-and-forget `tokio::spawn` here isn't
+    // enough on its own.
+    let mut background_tasks: Vec<(&'static str, tokio::task::JoinHandle<()>)> = Vec::new();
 
     // 8a-bis. Coding-agent tasks (both gated — dormant if neither agent is
     //         present). The indexer turns Claude Code / Codex JSONLs into
@@ -1472,18 +1478,26 @@ async fn main() -> Result<()> {
         let pool_idx = meridian.clone();
         let notify_idx = ca_notify.clone();
         let rx_idx = shutdown_rx.clone();
-        tokio::spawn(async move {
-            meridian::coding_agent_session_ingest::indexer::run_loop(pool_idx, notify_idx, rx_idx)
+        background_tasks.push((
+            "coding_agent_indexer",
+            tokio::spawn(async move {
+                meridian::coding_agent_session_ingest::indexer::run_loop(
+                    pool_idx, notify_idx, rx_idx,
+                )
                 .await;
-        });
+            }),
+        ));
         let pool_sum = meridian.clone();
         let rx_sum = shutdown_rx.clone();
-        tokio::spawn(async move {
-            meridian::coding_agent_session_ingest::summariser::run_loop(
-                pool_sum, ca_notify, rx_sum,
-            )
-            .await;
-        });
+        background_tasks.push((
+            "coding_agent_summariser",
+            tokio::spawn(async move {
+                meridian::coding_agent_session_ingest::summariser::run_loop(
+                    pool_sum, ca_notify, rx_sum,
+                )
+                .await;
+            }),
+        ));
     }
 
     // 7d. PM-worklog driver: hour-level pipeline — clock-aligned (HH:03 local), runs
@@ -1493,9 +1507,12 @@ async fn main() -> Result<()> {
         let pool_pm = meridian.clone();
         let db_path_pm = initial_cfg.meridian_db.clone();
         let rx_pm = shutdown_rx.clone();
-        tokio::spawn(async move {
-            meridian::worklog_pipeline::run_loop(pool_pm, db_path_pm, rx_pm).await;
-        });
+        background_tasks.push((
+            "worklog_pipeline",
+            tokio::spawn(async move {
+                meridian::worklog_pipeline::run_loop(pool_pm, db_path_pm, rx_pm).await;
+            }),
+        ));
     }
 
     // 7e. PM-worklog approved-poster: the ~60s sweep that posts worklogs the user
@@ -1505,9 +1522,12 @@ async fn main() -> Result<()> {
     {
         let pool_post = meridian.clone();
         let rx_post = shutdown_rx.clone();
-        tokio::spawn(async move {
-            meridian::pm_worklog::run_post_loop(pool_post, rx_post).await;
-        });
+        background_tasks.push((
+            "pm_worklog_post",
+            tokio::spawn(async move {
+                meridian::pm_worklog::run_post_loop(pool_post, rx_post).await;
+            }),
+        ));
     }
 
     // 7f. Telemetry spool shipper: drains ~/.meridian/telemetry/pending/ to
@@ -1717,6 +1737,60 @@ async fn main() -> Result<()> {
 
     // 9. Shutdown
     tracing::info!(pid = std::process::id() as i64, "shutting down");
+
+    // Wait for every background task to actually stop touching `meridian`
+    // before checkpointing/closing it, instead of just firing the shutdown
+    // signal and hoping. Each task above holds its own clone of this same
+    // pool, and closing it while one is still mid-query races the exact
+    // "held open after stopping the daemon" failure `wait_for_db_unheld`
+    // (`backend_install.rs`) exists to catch during an app update: on macOS
+    // the rename underneath a live writer SUCCEEDS, so two writers end up
+    // sharing one WAL — the root cause of the `code: 11` corruption in this
+    // repo's history. Bounded rather than unconditional: a task that is
+    // stuck on an external subprocess (the coding-agent summariser's `claude
+    // -p` / `codex exec`) must not hang the daemon's own shutdown forever.
+    // The bound is loud on expiry so a future recurrence shows up in
+    // `meridian logs` instead of silently racing the checkpoint below — see
+    // the module doc on `poll::permissions` for why a silent failure mode
+    // here previously cost days to diagnose.
+    const BACKGROUND_TASK_SHUTDOWN_BUDGET: std::time::Duration = std::time::Duration::from_secs(5);
+    // Joined CONCURRENTLY, not one after another: these tasks are already
+    // running in parallel, so waiting on them sequentially would let 4 tasks
+    // each burn their own 5s budget and add up to 20s to every shutdown - on
+    // a machine slow enough to need the full budget even once, that's also
+    // long enough to blow past `bootout_agent_and_wait`'s own 15s wait for
+    // the launchd label to clear (`backend_install.rs`), turning a slow but
+    // healthy shutdown into a failed update. `join_all` bounds the total added
+    // latency to one budget's worth, matching how long the slowest task
+    // actually needed.
+    let results = futures::future::join_all(background_tasks.into_iter().map(
+        |(name, handle)| async move {
+            (
+                name,
+                tokio::time::timeout(BACKGROUND_TASK_SHUTDOWN_BUDGET, handle).await,
+            )
+        },
+    ))
+    .await;
+    for (name, outcome) in results {
+        match outcome {
+            Ok(Ok(())) => tracing::debug!(task = name, "background task stopped for shutdown"),
+            Ok(Err(e)) => tracing::warn!(
+                task = name,
+                error = %e, // not-anyhow: tokio::task::JoinError, no chain to walk
+                "background task panicked during shutdown"
+            ),
+            Err(_) => tracing::error!(
+                task = name,
+                budget_s = BACKGROUND_TASK_SHUTDOWN_BUDGET.as_secs(),
+                "background task did not stop within the shutdown budget — \
+                 it may still be holding the database open (e.g. mid an \
+                 external subprocess call); proceeding with checkpoint/close \
+                 anyway rather than hanging shutdown indefinitely"
+            ),
+        }
+    }
+
     meridian::platform::release_endpoint();
     // See `db::meridian::checkpoint_wal`'s doc for why this runs before every
     // close, not just a plain shutdown. Best-effort: a failed checkpoint must
diff --git a/tray/src-tauri/src/backend_install.rs b/tray/src-tauri/src/backend_install.rs
index 5cdf9fd7b..2c12fc046 100644
--- a/tray/src-tauri/src/backend_install.rs
+++ b/tray/src-tauri/src/backend_install.rs
@@ -485,7 +485,31 @@ pub(crate) async fn ensure_daemon_running(home: &Path) {
 }
 
 /// `Meridian.app/Contents/Resources/backend/` when it exists, else `None`.
+///
+/// Gated on `!cfg!(debug_assertions)` as well as the directory check — a
+/// `tauri dev` / `cargo run` build's `resource_dir()` resolves under
+/// `target/debug/`, and if ANYTHING ever leaves a `backend/` subdirectory
+/// there (a stray artifact from an earlier debug-profile `tauri build`, a
+/// manual test, whatever), `dir.is_dir()` alone can't tell that apart from a
+/// real packaged install. That false positive is not cosmetic:
+/// [`ensure_backend_installed`] would then call [`install`], which on macOS
+/// runs [`stop_daemon_for_migration`] against `meridian.db` — booting out a
+/// launchd agent that was never registered for this run (a no-op) and then
+/// polling `lsof` for up to 10s, which always times out because the actual
+/// holder is the sibling `cargo run` daemon `bootout` can't touch, not the
+/// launchd job it targets. That raises `tray.backend_install_failed`
+/// ("meridian.db is still held open 10s after stopping the daemon") on every
+/// dev-tray launch, with a timestamp that tracks each restart — measured
+/// verbatim on 2026-08-31, traced to exactly one stray directory left over
+/// from an Aug 16 debug build. `debug_assertions` is a compile-time constant
+/// for the running binary's own profile, so this can never be fooled by
+/// what's left lying around on disk the way the directory check alone was.
+/// Matches the same convention already used for the encryption-migration
+/// gate in `lib.rs`'s setup hook.
 fn bundled_backend_dir(app: &tauri::AppHandle) -> Option<PathBuf> {
+    if cfg!(debug_assertions) {
+        return None;
+    }
     let dir = app.path().resource_dir().ok()?.join("backend");
     dir.is_dir().then_some(dir)
 }

From 0dc9bf4346ed0dd28cbc7148067949ca0794eb4d Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 1 Sep 2026 08:38:45 +0530
Subject: [PATCH 29/53] fix(cli): reject unrecognised flags instead of running
 the command bare

Every subcommand parses argv by searching for tokens it knows, so an
unknown flag contributed nothing and left the command running its
DEFAULTS. `meridian coding-agent-summarise --help` therefore summarised
and persisted real rows (reported from production 2026-08-27), and the
same hole sat in front of `worklog-post-approved`, which takes no
arguments and posts every approved worklog as a real comment to Jira,
Linear and GitHub - so `--help` on it would have written irreversibly to
a customer's tracker. `tasks-sync` and `pm-sync` were the same shape one
tier down. The other subcommands were safe only because they happen to
require a positional argument.

Adds a single table of accepted flags per subcommand, enforced once
before the dispatch chain so no side effect is reachable through a typo,
and answers --help everywhere instead of dispatching it. Only
'-'-prefixed tokens are inspected against a flat allowlist; flag values
are deliberately not modelled, since wrongly rejecting a working
invocation would be worse than the bug.

A source-scan test fails the build when a subcommand is dispatched in
main.rs (or plan_tasks::cli) with no entry in the table, so a new
command cannot silently opt out of validation the way this hole opened.
---
 src/cli_flags.rs | 564 +++++++++++++++++++++++++++++++++++++++++++++++
 src/lib.rs       |   1 +
 src/main.rs      |  13 ++
 3 files changed, 578 insertions(+)
 create mode 100644 src/cli_flags.rs

diff --git a/src/cli_flags.rs b/src/cli_flags.rs
new file mode 100644
index 000000000..1bdf43b8e
--- /dev/null
+++ b/src/cli_flags.rs
@@ -0,0 +1,564 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! Strict flag validation for the hand-rolled subcommand CLI in `main.rs`.
+//!
+//! # The bug this exists for
+//!
+//! Every subcommand parses its arguments by searching argv for tokens it
+//! recognises — `args.iter().any(|a| a == "--dry-run")`, `flag("--day")`.
+//! Nothing ever walked argv asking whether a token *was* recognised, so an
+//! unknown flag contributed nothing and was silently discarded. What ran was
+//! then the command's **default configuration**, byte-identical to invoking it
+//! bare.
+//!
+//! Reported from production on 2026-08-27: an operator investigating a stuck
+//! queue ran `meridian coding-agent-summarise --help` expecting usage text and
+//! instead summarised and persisted real rows (`dry_run` defaults to `false`,
+//! and `summariser::cli_summarise` passes `!dry_run` as its persist flag).
+//!
+//! That was the mild case. The same hole sat in front of
+//! **`worklog-post-approved`**, which takes no arguments at all and posts every
+//! approved worklog as a real comment to Jira / Linear / GitHub
+//! (`pm_worklog::cli_post_approved` — "the only path that writes to real
+//! Jira"). `meridian worklog-post-approved --help` would have written to a
+//! customer's tracker, irreversibly and visibly to their whole team, in
+//! response to the single most natural thing an operator does when probing an
+//! unfamiliar command.
+//!
+//! `tasks-sync` and `pm-sync` were the same shape one tier down (DB mirror
+//! rewrites including terminal-row pruning). The remaining subcommands were
+//! safe only *by accident* — they happen to require a positional argument and
+//! bail without it. That is a coincidence, not a guard, and it would not have
+//! survived the next all-optional-flag subcommand.
+//!
+//! # Why a table rather than a check per call site
+//!
+//! `main.rs` dispatches through ~30 sequential `if argv[1] == "..."` blocks.
+//! Adding a validation call inside each one is a rule that has to be
+//! remembered 30 times and then again for every new subcommand — the same
+//! shape of omission that caused this. Instead [`SPECS`] is a single table
+//! consulted **once**, before the dispatch chain runs, and
+//! [`tests::every_dispatched_subcommand_is_registered`] scans `main.rs` for
+//! dispatch literals and fails the build if one has no entry here. Forgetting
+//! to register a new subcommand is a compile-time-ish error, not a latent
+//! production write.
+//!
+//! # Scope of the check, deliberately narrow
+//!
+//! Only `-`-prefixed tokens are inspected, against a flat allowlist per
+//! subcommand. Flag *values* are not modelled: a value that does not itself
+//! start with `-` is simply not a candidate, and none of the flags below takes
+//! a negative number. Modelling value-consumption would buy nothing and would
+//! introduce a way to *wrongly reject* a working invocation — the one failure
+//! mode worse than the bug being fixed, since these commands are load-bearing
+//! for the tray.
+//!
+//! # Who calls this
+//! [`enforce`] runs from `main.rs` immediately before the subcommand dispatch
+//! chain, ahead of every side effect.
+//!
+//! # Related
+//! - `main.rs`'s unknown-*subcommand* rejection, which this mirrors for flags.
+//!   That check deliberately skips anything starting with `-` (bare `meridian`
+//!   and `meridian --version` still start the daemon), and that exclusion is
+//!   precisely the gap this module closes.
+
+/// One subcommand's accepted flags plus the usage line `--help` prints.
+pub struct Spec {
+    /// The argv[1] literal `main.rs` dispatches on.
+    pub name: &'static str,
+    /// Every `-`-prefixed token this subcommand accepts. `--help` / `-h` are
+    /// accepted everywhere and must not be listed.
+    pub flags: &'static [&'static str],
+    /// Shown by `--help`. One line, plain hyphens only (user-facing text).
+    pub usage: &'static str,
+}
+
+/// Every subcommand `main.rs` dispatches, with the flags it actually reads.
+///
+/// Kept in dispatch order so this table can be diffed against `main.rs` by eye.
+/// A subcommand with no flags gets an empty slice — that is the strongest
+/// entry in the table, not a placeholder: it is what makes
+/// `worklog-post-approved --anything` an error instead of a tracker write.
+pub const SPECS: &[Spec] = &[
+    Spec {
+        name: "coding-agent-hook",
+        flags: &[],
+        usage: "meridian coding-agent-hook   (reads a SessionEnd JSON payload on stdin)",
+    },
+    Spec {
+        name: "coding-agent-summarise",
+        flags: &["--dry-run", "--day", "--limit"],
+        usage: "meridian coding-agent-summarise [--dry-run] [--day YYYY-MM-DD] [--limit N]",
+    },
+    Spec {
+        name: "db",
+        flags: &[],
+        usage: "meridian db <check|repair>",
+    },
+    Spec {
+        name: "oauth-login",
+        flags: &["--app-key", "--client-id", "--port"],
+        usage: "meridian oauth-login <jira|trello> [--client-id ID] [--app-key KEY] [--port N]",
+    },
+    Spec {
+        name: "worklog-hour",
+        flags: &[],
+        usage: "meridian worklog-hour <HH:MM-HH:MM>",
+    },
+    Spec {
+        name: "llm-experiment",
+        flags: &[
+            "--day",
+            "--hour",
+            "--id",
+            "--limit",
+            "--process",
+            "--task-id",
+            "--task-json",
+            "--variant",
+            "--variants",
+        ],
+        usage: "meridian llm-experiment <run|create|exec|list|get|draft-task> [flags]",
+    },
+    Spec {
+        name: "worklog-post-approved",
+        flags: &[],
+        usage: "meridian worklog-post-approved   (posts approved worklogs to your tracker)",
+    },
+    Spec {
+        name: "db-export-plaintext",
+        flags: &["--out"],
+        usage: "meridian db-export-plaintext [--out PATH]",
+    },
+    Spec {
+        name: "tasks-sync",
+        flags: &[],
+        usage: "meridian tasks-sync   (forces a fetch from every configured tracker)",
+    },
+    Spec {
+        name: "pm-sync",
+        flags: &[],
+        usage: "meridian pm-sync   (refreshes the tracker mirror if it is stale)",
+    },
+    Spec {
+        name: "ticket-update",
+        flags: &["--field", "--key", "--provider", "--value"],
+        usage: "meridian ticket-update --key KEY --provider P --field F --value V",
+    },
+    Spec {
+        name: "ticket-parents",
+        flags: &["--key", "--provider"],
+        usage: "meridian ticket-parents --key KEY --provider P",
+    },
+    Spec {
+        name: "ticket-statuses",
+        flags: &["--key", "--provider"],
+        usage: "meridian ticket-statuses --key KEY --provider P",
+    },
+    Spec {
+        name: "ticket-set-status",
+        flags: &["--key", "--provider", "--status"],
+        usage: "meridian ticket-set-status --key KEY --provider P --status S",
+    },
+    Spec {
+        name: "plan-task-draft",
+        flags: &["--note"],
+        usage: "meridian plan-task-draft --note \"<text>\"",
+    },
+    Spec {
+        name: "plan-task-create",
+        flags: &["--title", "--description", "--issue-type"],
+        usage: "meridian plan-task-create --title T [--description D] [--issue-type Task|Bug]",
+    },
+    Spec {
+        name: "plan-task-edit",
+        flags: &["--key", "--title", "--description"],
+        usage: "meridian plan-task-edit --key K [--title T] [--description D]",
+    },
+    Spec {
+        name: "plan-task-done",
+        flags: &["--key", "--done"],
+        usage: "meridian plan-task-done --key K --done true|false",
+    },
+    Spec {
+        name: "plan-task-delete",
+        flags: &["--key"],
+        usage: "meridian plan-task-delete --key K",
+    },
+    Spec {
+        name: "day-summary",
+        flags: &["--day", "--now"],
+        usage: "meridian day-summary [--day YYYY-MM-DD] [--now]",
+    },
+    Spec {
+        name: "day-summary-get",
+        flags: &["--day"],
+        usage: "meridian day-summary-get [--day YYYY-MM-DD]",
+    },
+    Spec {
+        name: "day-summary-data",
+        flags: &["--day"],
+        usage: "meridian day-summary-data [--day YYYY-MM-DD]",
+    },
+    Spec {
+        name: "worklog-generate",
+        flags: &["--day", "--task-id"],
+        usage: "meridian worklog-generate --task-id ID [--day YYYY-MM-DD]",
+    },
+    Spec {
+        name: "worklog-generate-get",
+        flags: &["--day", "--task-id"],
+        usage: "meridian worklog-generate-get --task-id ID [--day YYYY-MM-DD]",
+    },
+    Spec {
+        name: "worklog-generate-approve",
+        flags: &["--day", "--task-id"],
+        usage: "meridian worklog-generate-approve --task-id ID [--day YYYY-MM-DD]",
+    },
+    Spec {
+        name: "worklog-escalate-create",
+        flags: &["--task"],
+        usage: "meridian worklog-escalate-create --task ID",
+    },
+    Spec {
+        name: "worklog-escalate-match",
+        flags: &["--target", "--task"],
+        usage: "meridian worklog-escalate-match --task ID --target KEY",
+    },
+    Spec {
+        name: "worklog-status",
+        flags: &["--day"],
+        usage: "meridian worklog-status [--day YYYY-MM-DD]",
+    },
+    Spec {
+        name: "doctor",
+        flags: &["--dry-run", "--fix", "--porcelain"],
+        usage: "meridian doctor [--fix] [--dry-run] [--porcelain]",
+    },
+    Spec {
+        name: "uninstall",
+        flags: &[
+            "--dry-run",
+            "--json",
+            "--purge",
+            "--remove-data",
+            "--remove-models",
+            "--remove-runtime",
+            "--yes",
+        ],
+        usage: "meridian uninstall [--dry-run] [--purge] [--remove-data] \
+                [--remove-models] [--remove-runtime] [--yes] [--json]",
+    },
+    Spec {
+        name: "telemetry",
+        flags: &["--auth", "--endpoint", "--out", "--since"],
+        usage: "meridian telemetry <status|export|import> [--out PATH] [--since MICROS] \
+                [--endpoint URL] [--auth BASE64]",
+    },
+    Spec {
+        name: "logs",
+        flags: &["--min-severity", "--service", "-n", "-f"],
+        usage: "meridian logs [--service NAME] [--min-severity LEVEL] [-n N] [-f]",
+    },
+];
+
+/// What [`check`] decided about an argv.
+#[derive(Debug, PartialEq, Eq)]
+pub enum Outcome {
+    /// Not a registered subcommand (bare daemon start, `--version`, or a typo
+    /// the unknown-subcommand check in `main.rs` will catch). No opinion.
+    NotOurs,
+    /// Every flag is recognised — carry on and dispatch.
+    Ok,
+    /// `--help` / `-h` was asked for; print this and exit 0.
+    Help(&'static str),
+    /// An unrecognised flag. Carries the offending token and the usage line.
+    Unknown { flag: String, usage: &'static str },
+}
+
+/// The [`Spec`] for `name`, if it is a registered subcommand.
+pub fn spec(name: &str) -> Option<&'static Spec> {
+    SPECS.iter().find(|s| s.name == name)
+}
+
+/// Decide what to do with `argv` (the full argv, including argv[0]).
+///
+/// Pure so it can be tested without a process: [`enforce`] is the thin wrapper
+/// that prints and exits.
+///
+/// `--help` wins over an unknown flag deliberately. Someone typing
+/// `meridian worklog-post-approved --help --bogus` is asking what the command
+/// does, and answering that is strictly safer than an error that might send
+/// them off to retry it bare — which is the invocation that actually posts.
+pub fn check(argv: &[String]) -> Outcome {
+    let Some(sub) = argv.get(1) else {
+        return Outcome::NotOurs;
+    };
+    let Some(spec) = spec(sub) else {
+        return Outcome::NotOurs;
+    };
+
+    let mut unknown: Option<String> = None;
+    for raw in argv.iter().skip(2) {
+        // `--flag=value` is a shape people type even where the parser wants a
+        // separate token; validate the name half so it reports the flag rather
+        // than the whole pair.
+        let token = raw.split('=').next().unwrap_or(raw.as_str());
+        if !token.starts_with('-') {
+            continue; // positional, or a flag's value
+        }
+        if token == "--help" || token == "-h" {
+            return Outcome::Help(spec.usage);
+        }
+        if !spec.flags.contains(&token) && unknown.is_none() {
+            unknown = Some(token.to_string());
+        }
+    }
+
+    match unknown {
+        Some(flag) => Outcome::Unknown {
+            flag,
+            usage: spec.usage,
+        },
+        None => Outcome::Ok,
+    }
+}
+
+/// Apply [`check`] to the real argv, printing and exiting where it says to.
+///
+/// Exit 2 for a bad flag matches the code `main.rs` already uses for an unknown
+/// subcommand, so callers see one consistent bad-usage code.
+pub fn enforce() {
+    let argv: Vec<String> = std::env::args().collect();
+    match check(&argv) {
+        Outcome::NotOurs | Outcome::Ok => {}
+        Outcome::Help(usage) => {
+            println!("{usage}");
+            std::process::exit(0);
+        }
+        Outcome::Unknown { flag, usage } => {
+            eprintln!(
+                "meridian: unknown flag {flag:?}\nusage: {usage}\n\n\
+                 Refusing to run rather than ignoring it - an unrecognised flag \
+                 used to be silently dropped, which ran the command with its \
+                 defaults instead."
+            );
+            std::process::exit(2);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn argv(rest: &[&str]) -> Vec<String> {
+        std::iter::once("meridian".to_string())
+            .chain(rest.iter().map(|s| s.to_string()))
+            .collect()
+    }
+
+    /// THE incident, at its worst reachable point. `worklog-post-approved`
+    /// takes no arguments and posts real comments to a customer's tracker;
+    /// before this module `--help` ran it.
+    #[test]
+    fn help_never_reaches_a_command_that_writes_to_a_real_tracker() {
+        assert_eq!(
+            check(&argv(&["worklog-post-approved", "--help"])),
+            Outcome::Help(
+                "meridian worklog-post-approved   (posts approved worklogs to your tracker)"
+            ),
+            "--help must be answered, never dispatched - this command posts to Jira"
+        );
+        assert!(
+            matches!(
+                check(&argv(&["worklog-post-approved", "--dry-run"])),
+                Outcome::Unknown { .. }
+            ),
+            "an unknown flag must be refused, not dropped so the command runs bare"
+        );
+    }
+
+    /// The reported incident itself.
+    #[test]
+    fn the_reported_summarise_incident_is_refused() {
+        assert!(matches!(
+            check(&argv(&["coding-agent-summarise", "--help"])),
+            Outcome::Help(_)
+        ));
+    }
+
+    /// The other direction, and the one that would be a worse regression than
+    /// the bug: every flag these commands genuinely read must still be accepted.
+    /// The tray shells out to several of these.
+    #[test]
+    fn real_invocations_still_pass() {
+        for a in [
+            vec!["coding-agent-summarise", "--dry-run", "--day", "2026-08-27"],
+            vec!["coding-agent-summarise", "--limit", "8"],
+            vec![
+                "ticket-update",
+                "--key",
+                "KAN-1",
+                "--provider",
+                "jira",
+                "--field",
+                "f",
+                "--value",
+                "v",
+            ],
+            vec!["day-summary", "--day", "2026-08-27", "--now"],
+            vec!["doctor", "--fix", "--dry-run", "--porcelain"],
+            vec!["logs", "--service", "meridian-rust", "-n", "50", "-f"],
+            vec!["uninstall", "--purge", "--yes", "--json"],
+            vec!["db", "repair"],
+            vec![
+                "oauth-login",
+                "jira",
+                "--client-id",
+                "abc",
+                "--port",
+                "1234",
+            ],
+            vec![
+                "telemetry",
+                "import",
+                "bundle.tar.gz",
+                "--endpoint",
+                "http://x",
+                "--auth",
+                "eyJ",
+            ],
+            vec!["plan-task-done", "--key", "K", "--done", "true"],
+            vec!["worklog-post-approved"],
+            vec!["tasks-sync"],
+        ] {
+            assert_eq!(
+                check(&argv(&a)),
+                Outcome::Ok,
+                "a working invocation was rejected: {a:?}"
+            );
+        }
+    }
+
+    /// A flag's value is not a flag, and `--flag=value` reports the name half.
+    #[test]
+    fn values_are_not_mistaken_for_flags() {
+        assert_eq!(
+            check(&argv(&["day-summary", "--day", "2026-08-27"])),
+            Outcome::Ok
+        );
+        assert_eq!(
+            check(&argv(&["day-summary", "--day=2026-08-27"])),
+            Outcome::Ok
+        );
+        match check(&argv(&["day-summary", "--nope=1"])) {
+            Outcome::Unknown { flag, .. } => assert_eq!(flag, "--nope"),
+            other => panic!("expected the flag name alone, got {other:?}"),
+        }
+    }
+
+    /// Bare `meridian` and `meridian --version` start the daemon; that is the
+    /// documented entry point and this module must not interfere with it.
+    #[test]
+    fn the_daemon_entry_point_is_untouched() {
+        assert_eq!(check(&argv(&[])), Outcome::NotOurs);
+        assert_eq!(check(&argv(&["--version"])), Outcome::NotOurs);
+        // A typo is left to main.rs's unknown-subcommand path, which has a
+        // better message for it (it names the stale-binary case).
+        assert_eq!(check(&argv(&["restrt"])), Outcome::NotOurs);
+    }
+
+    /// THE guard that keeps this fix from decaying. A new subcommand added to
+    /// `main.rs` without an entry here would silently return `NotOurs` and get
+    /// no flag checking at all - the original hole, reopened one command at a
+    /// time. Source-scanned because the dispatch chain is `if` statements, not
+    /// data, so there is nothing else to enumerate it from.
+    #[test]
+    fn every_dispatched_subcommand_is_registered() {
+        let main_rs = include_str!("main.rs");
+        let mut missing = Vec::new();
+        for line in main_rs.lines() {
+            // Matches `nth(1).as_deref() == Some("name")`.
+            let Some(rest) = line.split("nth(1).as_deref() == Some(\"").nth(1) else {
+                continue;
+            };
+            let Some(name) = rest.split('"').next() else {
+                continue;
+            };
+            if spec(name).is_none() {
+                missing.push(name.to_string());
+            }
+        }
+        assert!(
+            missing.is_empty(),
+            "subcommand(s) dispatched in main.rs with no cli_flags::SPECS entry: {missing:?}\n\
+             Add one. Without it the subcommand accepts any flag silently, which is how \
+             `worklog-post-approved --help` came to post to a real tracker."
+        );
+    }
+
+    /// The `plan-task-*` family dispatches from `plan_tasks::cli`, not through
+    /// `main.rs`'s chain, so the scan above cannot see it. Pin it separately
+    /// rather than leaving the family unguarded.
+    #[test]
+    fn the_plan_task_family_is_registered() {
+        let cli_rs = include_str!("plan_tasks/cli.rs");
+        let mut missing = Vec::new();
+        for line in cli_rs.lines() {
+            let trimmed = line.trim();
+            let Some(rest) = trimmed.strip_prefix("\"plan-task-") else {
+                continue;
+            };
+            let Some(tail) = rest.split('"').next() else {
+                continue;
+            };
+            let name = format!("plan-task-{tail}");
+            if spec(&name).is_none() {
+                missing.push(name);
+            }
+        }
+        assert!(
+            missing.is_empty(),
+            "plan-task subcommand(s) with no SPECS entry: {missing:?}"
+        );
+    }
+
+    /// Usage strings are user-facing app text: plain hyphens only, per the
+    /// repo's hard rule on dashes in displayed strings.
+    #[test]
+    fn usage_lines_use_plain_hyphens() {
+        for s in SPECS {
+            for bad in ['\u{2014}', '\u{2013}'] {
+                assert!(
+                    !s.usage.contains(bad),
+                    "{}'s usage line contains {bad:?} - user-facing text takes a plain hyphen",
+                    s.name
+                );
+            }
+        }
+    }
+
+    /// `--help` is handled centrally, so listing it in a spec would be dead
+    /// weight that implies it is optional per-command.
+    #[test]
+    fn help_is_not_listed_per_command() {
+        for s in SPECS {
+            assert!(
+                !s.flags.contains(&"--help") && !s.flags.contains(&"-h"),
+                "{} lists --help/-h; they are accepted for every subcommand",
+                s.name
+            );
+        }
+    }
+
+    /// Duplicate entries would make the table's behaviour depend on order.
+    #[test]
+    fn no_duplicate_specs() {
+        let mut names: Vec<&str> = SPECS.iter().map(|s| s.name).collect();
+        names.sort_unstable();
+        let before = names.len();
+        names.dedup();
+        assert_eq!(before, names.len(), "duplicate subcommand in SPECS");
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
index 2c9b1c477..892432bbb 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -10,6 +10,7 @@
 #[global_allocator]
 static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;
 
+pub mod cli_flags;
 pub mod coding_agent_session_ingest;
 pub mod config;
 pub mod daily_plan;
diff --git a/src/main.rs b/src/main.rs
index c01754789..9199876a3 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -60,6 +60,19 @@ async fn main() -> Result<()> {
         let _ = dotenvy::from_path(home.join(".meridian").join(".env"));
     }
 
+    // 1a-bis. Reject unrecognised flags BEFORE any subcommand can act on them.
+    //
+    //     Every block below parses argv by searching for tokens it knows, so an
+    //     unknown flag used to contribute nothing and leave the command running
+    //     its DEFAULTS. `meridian coding-agent-summarise --help` therefore
+    //     summarised and persisted real rows (reported from production
+    //     2026-08-27), and `meridian worklog-post-approved --help` would have
+    //     posted approved worklogs to a customer's real tracker. This runs
+    //     ahead of the whole chain, so no side effect is reachable through a
+    //     typo. See `meridian::cli_flags` for the table and the test that keeps
+    //     new subcommands from slipping past it.
+    meridian::cli_flags::enforce();
+
     // 1b. Subcommand dispatch. `meridian coding-agent-hook` is the Claude Code
     //     SessionEnd hook entry point: one-shot, reads a JSON payload on stdin,
     //     seals that session, exits 0. It must stay light (no daemon init, no

From 8eb42055c9998c77f9362f4e8ebf7a5dc54d8f56 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 1 Sep 2026 08:49:00 +0530
Subject: [PATCH 30/53] fix(etl): recover from the corruption latch instead of
 stopping forever

`db_corrupt` was a one-way flag: stored `true` in three places and
`false` in none, so the first corruption signal stopped the ETL, the
task-linker wakeups and capture retention for the life of the process.
It also went silent - one error at the moment it tripped, then nothing.

Its justification, that the condition "cannot clear without an
operator", is false in practice. Reported from production 2026-08-25: a
daemon latched at startup against a file that was still being rebuilt,
the rebuild finished ~45 minutes later, and the daemon then sat idle
against a healthy database for 44.7 hours until a manual restart, whose
very first ETL pass succeeded and caught up 12,642 frames. Nothing could
have caught it either - the tray watchdog explicitly rules out `etl_runs`
as a heartbeat BECAUSE of this latch.

It was also invisible: `db::repair::rebuild` clears the `db.corrupt`
notice from the file it rebuilds, so the banner - the only user-visible
signal - disappears while a still-running daemon stays latched. The
dashboard reported a healthy system with a dead ETL.

A latched daemon now re-checks every 15 minutes (not every ~60s tick;
quick_check reads every page) and resumes when the database is provably
sound, clearing its own notice. If it stays damaged it says so on every
re-check rather than going quiet.

Checked BEFORE health: whether the file was replaced underneath us. A
repair rebuilds into a new inode, so re-checking through the existing
pool could never observe the fix - and because SQLite addresses -wal and
-shm by path, checkpointing or closing that stale pool would write its
journal state against the NEW file, which is the v1.80.0 corruption
mechanism exactly. On a detected swap the daemon exits without touching
the database and lets the service manager restart it. "Could not stat"
never counts as "changed".
---
 src/db/integrity.rs |  41 +++++
 src/main.rs         | 378 ++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 402 insertions(+), 17 deletions(-)

diff --git a/src/db/integrity.rs b/src/db/integrity.rs
index 1932e0d89..f2fb99dd4 100644
--- a/src/db/integrity.rs
+++ b/src/db/integrity.rs
@@ -353,6 +353,47 @@ async fn scan_one(pool: &SqlitePool, table: &str) -> Result<()> {
     Ok(())
 }
 
+/// Identity of the file currently at `path` - `(device, inode)` on unix, `None`
+/// elsewhere or when it cannot be stated.
+///
+/// # Why a process needs this
+///
+/// `db::repair` rebuilds into a NEW file and renames it over `meridian.db`. A
+/// daemon holding a pool open across that swap keeps its connections on the
+/// OLD, now-unlinked inode: its reads see the damaged file forever and its
+/// writes land somewhere no reader will ever look. Re-running an integrity
+/// check through that pool therefore cannot ever observe the repair - it is
+/// checking the wrong file. Comparing this value against the one captured at
+/// startup is the only way the daemon can notice.
+///
+/// Worse than useless-but-harmless: SQLite addresses the `-wal` and `-shm`
+/// sidecars **by path, not by inode**, so a stale pool that checkpoints or
+/// closes writes its journal state against the NEW file's sidecars. That is
+/// the exact mechanism behind this repo's v1.80.0 macOS corruption. A daemon
+/// that detects a swap must exit WITHOUT checkpointing or closing.
+///
+/// Unix-only by design rather than by omission: the swap this detects requires
+/// renaming over a file another process holds open, which Windows refuses
+/// outright (os error 32). There is nothing to detect there.
+///
+/// # Who calls this
+/// `main.rs` captures it at startup and re-checks it while the ETL is latched
+/// on [`is_corrupt_error`], the one state in which the file is likely to be
+/// replaced underneath a running daemon.
+pub fn file_identity(path: &str) -> Option<(u64, u64)> {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        let md = std::fs::metadata(path).ok()?;
+        Some((md.dev(), md.ino()))
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = path;
+        None
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/src/main.rs b/src/main.rs
index c01754789..accbe7892 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1377,6 +1377,15 @@ async fn main() -> Result<()> {
     //     stop the daemon anyway — exiting here would just crash-loop under
     //     launchd's KeepAlive.
     let db_corrupt = Arc::new(std::sync::atomic::AtomicBool::new(false));
+    // Identity of meridian.db as this process opened it. Re-checked only while
+    // latched, to tell "the file was repaired and swapped underneath us" (our
+    // pool is now on a dead inode) apart from "the same file is still damaged".
+    // See `integrity::file_identity` for why the distinction is load-bearing.
+    let db_identity_at_start = meridian::db::integrity::file_identity(&initial_cfg.meridian_db);
+    // When the swap above is detected, the pool must NOT be checkpointed or
+    // closed on the way out - SQLite addresses -wal/-shm by path, so a stale
+    // pool's journal state would land on the NEW file. Set only on that path.
+    let mut db_file_swapped = false;
     {
         let meridian = meridian.clone();
         let db_corrupt = db_corrupt.clone();
@@ -1545,6 +1554,11 @@ async fn main() -> Result<()> {
     // Track the last-applied log level so we can detect changes and hot-reload
     // the EnvFilter without restarting the daemon.
     let mut last_log_level = initial_cfg.runtime.log_level.clone();
+    // Paces the latched-state re-check. `None` = never checked, so the first
+    // latched tick re-checks immediately rather than waiting out a full
+    // interval - a daemon that latches during startup (the reported case) then
+    // recovers as soon as the rebuild it raced finishes.
+    let mut last_corrupt_check: Option<std::time::Instant> = None;
 
     loop {
         // Determine the sleep duration from the current settings.json before sleeping.
@@ -1579,10 +1593,30 @@ async fn main() -> Result<()> {
                 *etl_tick_span.lock().unwrap_or_else(|e| e.into_inner()) = Some(poll_tick.clone());
                 let _guard = poll_tick.enter();
                 tracing::debug!("starting ETL tick");
-                // Latched, never re-tried — see DB_CORRUPT_NOTICE. Everything
-                // else in the tick (PM sync, notifications, plan nudge) reads
-                // tables corruption may not have touched, so the daemon stays
-                // useful instead of exiting.
+                // Latched on corruption — but NOT forever. Everything else in
+                // the tick (PM sync, notifications, plan nudge) reads tables
+                // corruption may not have touched, so the daemon stays useful
+                // instead of exiting; the ETL itself waits for the database to
+                // be provably healthy again. See `recover_from_corruption`.
+                if db_corrupt.load(std::sync::atomic::Ordering::Relaxed) {
+                    match recover_from_corruption(
+                        &meridian,
+                        &initial_cfg.meridian_db,
+                        db_identity_at_start,
+                        &mut last_corrupt_check,
+                    )
+                    .await
+                    {
+                        CorruptionRecheck::Waiting => {}
+                        CorruptionRecheck::Recovered => {
+                            db_corrupt.store(false, std::sync::atomic::Ordering::Relaxed);
+                        }
+                        CorruptionRecheck::FileSwapped => {
+                            db_file_swapped = true;
+                            break;
+                        }
+                    }
+                }
                 if !db_corrupt.load(std::sync::atomic::Ordering::Relaxed) {
                     if etl_tick(&meridian).await {
                         db_corrupt.store(true, std::sync::atomic::Ordering::Relaxed);
@@ -1729,21 +1763,37 @@ async fn main() -> Result<()> {
     // the entire question when a `meridian.db` is later found malformed. A
     // corruption investigation on 2026-08-25 stalled on exactly this ambiguity
     // and had to withdraw its conclusion. Now silence here means killed.
-    match meridian::db::meridian::checkpoint_wal(&meridian).await {
-        Ok(()) => tracing::info!(
-            pid = std::process::id() as i64,
-            "WAL checkpoint on shutdown complete"
-        ),
-        // `pid` here too: the whole reason both outcomes are logged is to
-        // attribute a checkpoint to a generation, and a FAILED checkpoint is
-        // the one most worth attributing.
-        Err(e) => tracing::warn!(
+    //
+    // Skipped ENTIRELY when the database file was replaced underneath us. The
+    // pool's connections are on the old, unlinked inode, but SQLite addresses
+    // the `-wal` and `-shm` sidecars BY PATH - so checkpointing or closing here
+    // would write this process's stale journal state against the NEW file. That
+    // is not a lesser version of the corruption this checkpoint prevents, it is
+    // precisely the v1.80.0 mechanism. Leaking the pool on the way out of a
+    // process that is exiting anyway costs nothing by comparison.
+    if db_file_swapped {
+        tracing::error!(
             pid = std::process::id() as i64,
-            error = %meridian::errors::chain(&e),
-            "WAL checkpoint on shutdown failed - continuing anyway"
-        ),
+            "exiting without a WAL checkpoint: meridian.db was replaced underneath this \
+             process, so this pool's journal state must not be written back"
+        );
+    } else {
+        match meridian::db::meridian::checkpoint_wal(&meridian).await {
+            Ok(()) => tracing::info!(
+                pid = std::process::id() as i64,
+                "WAL checkpoint on shutdown complete"
+            ),
+            // `pid` here too: the whole reason both outcomes are logged is to
+            // attribute a checkpoint to a generation, and a FAILED checkpoint is
+            // the one most worth attributing.
+            Err(e) => tracing::warn!(
+                pid = std::process::id() as i64,
+                error = %meridian::errors::chain(&e),
+                "WAL checkpoint on shutdown failed - continuing anyway"
+            ),
+        }
+        meridian.close().await;
     }
-    meridian.close().await;
 
     // Flush OTel exporters FIRST, while the runtime is alive — this writes the
     // daemon's final shutdown spans/logs into the spool's pending/ dir...
@@ -1758,6 +1808,140 @@ async fn main() -> Result<()> {
     Ok(())
 }
 
+/// How long a latched daemon waits between re-checks of whether the database
+/// has become healthy underneath it.
+///
+/// Far slower than the ~60 s poll tick on purpose. The original latch existed
+/// because "retrying only re-reads damaged pages", and that reasoning is sound
+/// for the ETL itself - `quick_check` reads every page in the file, which is
+/// multi-second on a multi-GB database. Fifteen minutes keeps that cost
+/// negligible while bounding an outage at minutes instead of "until a human
+/// notices and restarts the daemon", which in the reported incident was 44.7
+/// hours.
+const CORRUPT_RECHECK_EVERY: std::time::Duration = std::time::Duration::from_secs(900);
+
+/// What a latched daemon should do after re-examining its database.
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+enum CorruptionRecheck {
+    /// Still damaged, or not yet due for a re-check. Stay latched.
+    Waiting,
+    /// The database is provably sound again - resume the ETL.
+    Recovered,
+    /// The file was replaced underneath this process (a repair rebuilt and
+    /// renamed it). The pool is on a dead inode; the daemon must exit WITHOUT
+    /// touching the database so launchd restarts it against the new file.
+    FileSwapped,
+}
+
+/// Re-examine a database the ETL has latched on, and say whether to resume.
+///
+/// # The bug this closes
+///
+/// `db_corrupt` used to be a one-way flag: set on the first corruption signal
+/// and never cleared for the life of the process. That silently disabled the
+/// ETL, the task-linker wakeups and capture retention, and emitted nothing
+/// after the single error that tripped it. The justification - that the
+/// condition "cannot clear without an operator" - is false in practice, and
+/// production disproved it on 2026-08-25: a daemon latched at startup against
+/// a file that was still being rebuilt, the rebuild finished ~45 minutes
+/// later, and the daemon then sat idle against a perfectly healthy database
+/// for 44.7 hours until someone restarted it by hand. The very first ETL pass
+/// after that restart succeeded, catching up 12,642 frames.
+///
+/// It was also unobservable from outside: `db::repair::rebuild` clears the
+/// `db.corrupt` notice from the file it rebuilds, so the banner - the only
+/// user-visible signal - disappears while a still-running daemon stays
+/// latched. The dashboard reported a healthy system with a dead ETL.
+///
+/// # Why the file-identity check comes first
+///
+/// A repair rebuilds into a new file and renames it into place, so the
+/// recovered database is a DIFFERENT inode. Re-running `quick_check` through
+/// the existing pool would keep examining the old, unlinked one and could
+/// never observe the fix. Worse, that pool must not be checkpointed or closed
+/// (see [`meridian::db::integrity::file_identity`]). So identity is checked
+/// before health, and a swap short-circuits to [`CorruptionRecheck::FileSwapped`].
+///
+/// # Safety of resuming
+///
+/// `quick_check` returning clean is not a promise the database is perfect - it
+/// skips the index-vs-table checks `integrity_check` performs. It does not
+/// need to be a promise: if damage remains, the next ETL pass hits it and
+/// `etl_tick` latches again, costing one pass. The failure is self-correcting
+/// in the safe direction, which is what makes resuming reasonable at all.
+async fn recover_from_corruption(
+    pool: &sqlx::SqlitePool,
+    db_path: &str,
+    identity_at_start: Option<(u64, u64)>,
+    last_check: &mut Option<std::time::Instant>,
+) -> CorruptionRecheck {
+    let now = std::time::Instant::now();
+    if let Some(prev) = *last_check {
+        if now.duration_since(prev) < CORRUPT_RECHECK_EVERY {
+            return CorruptionRecheck::Waiting;
+        }
+    }
+    *last_check = Some(now);
+
+    // Only meaningful when both readings exist: `file_identity` is `None` on
+    // non-unix and on a stat failure, and "could not tell" must never be read
+    // as "it changed" - that would exit the daemon on a transient stat error.
+    let identity_now = meridian::db::integrity::file_identity(db_path);
+    if let (Some(before), Some(after)) = (identity_at_start, identity_now) {
+        if before != after {
+            tracing::error!(
+                db_path,
+                "meridian.db was replaced underneath this process (a repair rebuilt it) - \
+                 this pool is on the old, unlinked file and must not write to it. Exiting \
+                 without checkpointing so the service manager restarts against the new file."
+            );
+            return CorruptionRecheck::FileSwapped;
+        }
+    }
+
+    match meridian::db::integrity::quick_check(pool, 20).await {
+        Ok(problems) if problems.is_empty() => {
+            tracing::info!(
+                "meridian.db passes its integrity check again - resuming the ETL (it was \
+                 stopped when corruption was detected)"
+            );
+            // The daemon raised this notice, so the daemon clears it. Without
+            // this the banner outlives the fault it reports.
+            if let Err(e) =
+                meridian::notices::clear_typed(pool, DB_CORRUPT_NOTICE, DB_CORRUPT_NOTICE).await
+            {
+                tracing::warn!(
+                    error = %meridian::errors::chain(&e),
+                    "could not clear the db.corrupt notice after recovery"
+                );
+            }
+            CorruptionRecheck::Recovered
+        }
+        Ok(problems) => {
+            // WARN every recheck interval, not once. The original latch went
+            // silent after a single error, which is why 44.7 hours of total
+            // ETL outage left nothing in `meridian logs` to find.
+            tracing::warn!(
+                problem_count = problems.len(),
+                first = %problems.first().map(String::as_str).unwrap_or_default(),
+                recheck_s = CORRUPT_RECHECK_EVERY.as_secs(),
+                "ETL is still stopped: meridian.db remains damaged. Run 'meridian db repair' \
+                 with Meridian quit."
+            );
+            CorruptionRecheck::Waiting
+        }
+        Err(e) => {
+            // The check failing is not evidence either way, so stay latched -
+            // but say so, for the same reason as above.
+            tracing::warn!(
+                error = %meridian::errors::chain(&e),
+                "ETL is still stopped: the integrity re-check could not run"
+            );
+            CorruptionRecheck::Waiting
+        }
+    }
+}
+
 /// Runs one ETL pass and maps the outcome onto the notice bus.
 ///
 /// Returns `true` when the failure was database corruption, which the caller
@@ -1828,6 +2012,166 @@ async fn etl_tick(meridian: &meridian::db::SqlitePool) -> bool {
 /// `db::repair` must clear the very same id from a rebuilt database.
 const DB_CORRUPT_NOTICE: &str = meridian::notices::DB_CORRUPT;
 
+#[cfg(test)]
+mod corruption_recovery_tests {
+    use super::{recover_from_corruption, CorruptionRecheck, CORRUPT_RECHECK_EVERY};
+    use sqlx::sqlite::SqliteConnectOptions;
+    use sqlx::SqlitePool;
+    use std::str::FromStr;
+    use std::time::Instant;
+
+    async fn fresh_db() -> SqlitePool {
+        let opts = SqliteConnectOptions::from_str("sqlite::memory:")
+            .unwrap()
+            .create_if_missing(true);
+        let pool = SqlitePool::connect_with(opts).await.unwrap();
+        sqlx::migrate!("src/migrations").run(&pool).await.unwrap();
+        pool
+    }
+
+    /// THE regression. The latch had no way out: `db_corrupt` was stored `true`
+    /// in three places and `false` in none, so a database that became healthy
+    /// underneath a running daemon left the ETL stopped for the life of the
+    /// process - 44.7 hours in the reported incident, ended only by a manual
+    /// restart whose very first pass succeeded.
+    #[tokio::test]
+    async fn a_healthy_database_resumes_the_etl() {
+        let pool = fresh_db().await;
+        let mut last = None;
+        assert_eq!(
+            recover_from_corruption(&pool, ":memory:", None, &mut last).await,
+            CorruptionRecheck::Recovered,
+            "a database that passes its integrity check must un-latch the ETL"
+        );
+    }
+
+    /// Recovery must also retract the banner the daemon itself raised,
+    /// otherwise the notice outlives the fault it reports.
+    #[tokio::test]
+    async fn recovery_clears_the_notice_the_daemon_raised() {
+        let pool = fresh_db().await;
+        meridian::notices::raise_typed(
+            &pool,
+            meridian::notices::Notice {
+                id: meridian::notices::DB_CORRUPT,
+                severity: "error",
+                title: "Meridian's database is damaged",
+                detail: "test",
+                remedy: None,
+                event_key: meridian::notices::DB_CORRUPT,
+                deep_link: None,
+            },
+        )
+        .await
+        .unwrap();
+
+        let mut last = None;
+        assert_eq!(
+            recover_from_corruption(&pool, ":memory:", None, &mut last).await,
+            CorruptionRecheck::Recovered
+        );
+
+        let notices = meridian_core::notices::read_notices(&pool).await;
+        assert!(
+            !notices
+                .iter()
+                .any(|n| n.notice_id == meridian::notices::DB_CORRUPT),
+            "the db.corrupt banner must not survive the recovery that fixes it"
+        );
+    }
+
+    /// The re-check reads every page of the database, so it must not run on
+    /// every ~60 s poll tick. The first latched tick checks immediately
+    /// (`last` is `None`); the next one waits out the interval.
+    #[tokio::test]
+    async fn the_recheck_is_throttled() {
+        let pool = fresh_db().await;
+        let mut last = Some(Instant::now());
+        assert_eq!(
+            recover_from_corruption(&pool, ":memory:", None, &mut last).await,
+            CorruptionRecheck::Waiting,
+            "a re-check ran before its interval elapsed - this reads every page in the file"
+        );
+
+        // Once the interval has passed it runs again and, on a clean database,
+        // recovers. Drives the clock rather than sleeping 15 minutes.
+        last = Some(Instant::now() - CORRUPT_RECHECK_EVERY);
+        assert_eq!(
+            recover_from_corruption(&pool, ":memory:", None, &mut last).await,
+            CorruptionRecheck::Recovered
+        );
+    }
+
+    /// A repair rebuilds into a NEW file and renames it into place, so the pool
+    /// is left on the old, unlinked inode. Re-checking through it could never
+    /// see the fix, and - the dangerous half - checkpointing or closing it
+    /// writes stale journal state against the NEW file's `-wal`/`-shm`, which
+    /// is the v1.80.0 corruption mechanism exactly.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn a_replaced_file_is_detected_rather_than_re_checked() {
+        let pool = fresh_db().await;
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("meridian.db");
+        std::fs::write(&path, b"first").unwrap();
+        let before = meridian::db::integrity::file_identity(path.to_str().unwrap());
+        assert!(before.is_some(), "identity must be readable on unix");
+
+        // Replace it the way a repair does: a different file renamed into place.
+        let replacement = dir.path().join("rebuilt");
+        std::fs::write(&replacement, b"second").unwrap();
+        std::fs::rename(&replacement, &path).unwrap();
+
+        let mut last = None;
+        assert_eq!(
+            recover_from_corruption(&pool, path.to_str().unwrap(), before, &mut last).await,
+            CorruptionRecheck::FileSwapped,
+            "a swapped database must be detected, not re-checked through the dead pool"
+        );
+    }
+
+    /// The same file must NOT read as swapped, or a healthy latched daemon
+    /// would exit every re-check interval.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn an_unchanged_file_is_not_mistaken_for_a_swap() {
+        let pool = fresh_db().await;
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("meridian.db");
+        std::fs::write(&path, b"same").unwrap();
+        let ident = meridian::db::integrity::file_identity(path.to_str().unwrap());
+
+        let mut last = None;
+        assert_ne!(
+            recover_from_corruption(&pool, path.to_str().unwrap(), ident, &mut last).await,
+            CorruptionRecheck::FileSwapped,
+            "an unchanged file read as swapped - the daemon would exit on every re-check"
+        );
+    }
+
+    /// "Could not tell" must never be read as "it changed". `file_identity`
+    /// returns `None` on a stat failure and on non-unix; treating that as a
+    /// swap would exit the daemon on a transient error, or on every re-check
+    /// on Windows.
+    #[tokio::test]
+    async fn an_unreadable_identity_never_reads_as_swapped() {
+        let pool = fresh_db().await;
+        let mut last = None;
+        let outcome = recover_from_corruption(
+            &pool,
+            "/nonexistent/path/that/cannot/be/stated.db",
+            Some((1, 2)),
+            &mut last,
+        )
+        .await;
+        assert_ne!(
+            outcome,
+            CorruptionRecheck::FileSwapped,
+            "an unreadable identity must not be treated as evidence of a swap"
+        );
+    }
+}
+
 #[cfg(test)]
 mod startup_order_tests {
     /// The single-instance guard's CHECK must run before `setup_db` opens the

From 3fe39c4983c76673abd7e6c4b3d31fd3a678d809 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 1 Sep 2026 09:04:22 +0530
Subject: [PATCH 31/53] fix(summariser): bound rate-limited retries and pace a
 failing queue

Two independent defects behind the same production symptom: a queue that
sat flat at 59-61 rows for 46 hours while the daemon forked 18,674 times
(one every ~9 seconds, continuously).

Immortal rows. Of drain()'s three outcome branches, `rate_limited` was
the one that never recorded an attempt, so MAX_ROW_ATTEMPTS did not
apply to it and such a row was retried forever. That is not theoretical:
RATE_LIMIT_MARKERS matches bare substrings including "429" and "quota"
anywhere in an engine's output, and this is a developer tool whose
transcripts are full of both, so a row failing for an unrelated reason
can be misfiled as rate-limited and then never terminate. Consecutive
rate-limited reports are now counted against their own, far more
generous cap (~a day of 30-minute backoff) before dead-lettering, which
keeps the "a quota refills, wait it out" intent while making
immortality impossible.

The classifier itself is deliberately left alone. Narrowing those
markers risks MISSING a genuine limit, which would dead-letter
legitimate rows against an exhausted quota - a worse failure than the
one being fixed, and no longer necessary now that the accounting bounds
it either way.

Fork storm. The loop could not tell "nothing to do" from "everything I
tried failed", so a batch of 32 fast-failing rows (2 spawns each) was
re-attempted every 5 seconds forever. drain() now reports what it did
and the wait backs off exponentially, capped at 5 minutes, whenever work
was attempted and nothing succeeded. Note this is the opposite of the
reported diagnosis: a row that HANGS produces few forks, since it waits
in wait_with_output rather than spawn, so a high fork rate is evidence
of fast failures and pacing is the fix.

Also corrects the wait signal itself. The old `all_backed_off` bool
required skipped_backoff == rows.len(), so one failing row alongside
backed-off ones collapsed the 30-minute rate-limit wait back to the
5-second sweep - which is what let both defects run in the same batch.
---
 .../summariser/mod.rs                         | 344 ++++++++++++++++--
 1 file changed, 323 insertions(+), 21 deletions(-)

diff --git a/src/coding_agent_session_ingest/summariser/mod.rs b/src/coding_agent_session_ingest/summariser/mod.rs
index bc22f90af..bf2f94901 100644
--- a/src/coding_agent_session_ingest/summariser/mod.rs
+++ b/src/coding_agent_session_ingest/summariser/mod.rs
@@ -11,7 +11,11 @@
 // Escalation, in order:
 //   1. the session's OWN agent CLI, `primary_attempts` times
 //   2. a rate limit → stop immediately, back the source off, retry on a later
-//      tick. A quota refills; it is waited out, never routed around.
+//      tick. A quota refills; it is waited out, never routed around — but only
+//      up to MAX_RATE_LIMITED_ROW_ATTEMPTS (~a day of backoff), because this
+//      branch used to be the one outcome that never recorded an attempt, so a
+//      row misclassified as rate-limited retried forever and the queue never
+//      drained. See that constant.
 //   3. otherwise (crashed / not installed / signed out / unusable output) → the
 //      user's globally chosen AI provider, once (`fallback`). Usually the same
 //      CLI, in which case it is skipped without a call.
@@ -565,6 +569,79 @@ pub(crate) fn cap_transcript(transcript: &str, cap: usize) -> String {
 
 // ──────────────────────── Loop ──────────────────────────────────────────────
 
+/// What one [`drain`] pass actually did, so the loop can pace itself.
+///
+/// Replaces a bare `bool` ("were all rows backed off?") that could not
+/// distinguish the three cases the wait needs to tell apart: real progress, a
+/// quota wall, and *work attempted that failed*. The old signal also
+/// miscounted - it compared `skipped_backoff` against the whole batch, so a
+/// single failing row alongside backed-off ones collapsed the 30-minute
+/// rate-limit wait back to the 5-second sweep.
+#[derive(Debug, Default, PartialEq, Eq, Clone, Copy)]
+struct DrainOutcome {
+    /// Rows fetched for consideration this pass.
+    seen: u32,
+    /// Rows summarised and persisted.
+    summarised: u32,
+    /// Rows not attempted because their source is in rate-limit backoff, plus
+    /// rows whose attempt reported a rate limit.
+    skipped_backoff: u32,
+    /// Rows attempted that failed for a non-rate-limit reason.
+    failed: u32,
+    /// Rows not attempted because they have exhausted an attempt cap.
+    skipped_exhausted: u32,
+}
+
+/// Longest the loop will wait when nothing is succeeding.
+///
+/// Bounds the retry storm without letting a transient outage park the queue
+/// for the full rate-limit backoff: a pass that fails is retried within five
+/// minutes, not five seconds.
+const MAX_IDLE_BACKOFF_SECS: u64 = 300;
+
+/// Seconds to wait before the next pass, given what the last one did.
+///
+/// # The fork storm this bounds
+///
+/// Measured in production over ~46 hours: 18,674 forks, one every ~9 seconds,
+/// continuously, while the queue sat flat at 59-61 rows. The shape is a batch
+/// of `batch_per_tick` (32) rows that each fail FAST - two primary attempts,
+/// so 64 spawns - re-attempted every `sweep_interval_secs` (5 s). Nothing in
+/// the loop distinguished "nothing to do" from "everything I tried failed", so
+/// a failing queue was retried at the same cadence as an idle one forever.
+///
+/// Note this is the opposite of the reported diagnosis. A row that *hangs*
+/// produces FEW forks - it sits in `wait_with_output`, not in `spawn` - so a
+/// high fork rate is positive evidence of fast failures, and pacing them is
+/// the fix rather than a timeout change.
+fn next_wait_secs(out: DrainOutcome, cfg: &SummariserConfig, consecutive_idle: u32) -> u64 {
+    // Progress, or nothing pending: keep the responsive cadence. An empty
+    // queue costs nothing to re-check, and the indexer's notify wakes it
+    // sooner anyway.
+    if out.summarised > 0 || out.seen == 0 {
+        return cfg.sweep_interval_secs;
+    }
+    // Everything that could have been worked on is waiting out a quota, and
+    // nothing failed for another reason. Wait out the backoff properly - this
+    // is the case the old `all_backed_off` flag was trying to express.
+    if out.failed == 0 && out.skipped_backoff > 0 {
+        return cfg.rate_limit_backoff_secs;
+    }
+    // Rows were attempted and none succeeded. Back off exponentially from the
+    // normal sweep so a wedged queue costs a fork every few minutes instead of
+    // 64 every few seconds. Capped, so recovery is still prompt.
+    if out.failed > 0 {
+        let factor = 1u64 << consecutive_idle.min(6);
+        return cfg
+            .sweep_interval_secs
+            .saturating_mul(factor)
+            .min(MAX_IDLE_BACKOFF_SECS);
+    }
+    // Everything left is exhausted (dead-lettered or capped) - there is
+    // nothing to retry until new rows seal, and the notify covers that.
+    cfg.sweep_interval_secs
+}
+
 /// The summariser task: drain the queue, then wait for an indexer notify or the
 /// catch-up sweep. Dormant if no coding agent is present. Backs off when the
 /// primary engine is unavailable (a failed row stays pending for a later drain).
@@ -594,15 +671,28 @@ pub async fn run_loop(
     // engine is available again. Keyed on app_name ("Claude Code", "Codex", …).
     // Only rows whose source is in backoff are skipped; other sources continue.
     let mut source_backoff: HashMap<String, std::time::Instant> = HashMap::new();
+    // Separate ledger for consecutive rate-limited reports — see
+    // `MAX_RATE_LIMITED_ROW_ATTEMPTS`.
+    let mut rate_limited_attempts: HashMap<i64, u32> = HashMap::new();
+    // Consecutive passes that attempted work and summarised nothing. Drives
+    // `next_wait_secs`'s exponential backoff so a wedged queue stops re-forking
+    // its whole batch every few seconds.
+    let mut consecutive_idle: u32 = 0;
     loop {
-        let all_backed_off = drain(&pool, &cfg, &mut attempts, &mut source_backoff).await;
-        let wait = if all_backed_off {
-            // Nothing could be processed (all pending rows are from backed-off
-            // sources). Wait out the backoff period rather than spinning.
-            cfg.rate_limit_backoff_secs
+        let out = drain(
+            &pool,
+            &cfg,
+            &mut attempts,
+            &mut rate_limited_attempts,
+            &mut source_backoff,
+        )
+        .await;
+        if out.summarised > 0 || out.failed == 0 {
+            consecutive_idle = 0;
         } else {
-            cfg.sweep_interval_secs
-        };
+            consecutive_idle = consecutive_idle.saturating_add(1);
+        }
+        let wait = next_wait_secs(out, &cfg, consecutive_idle);
         tokio::select! {
             _ = shutdown_rx.changed() => break,
             _ = notify.notified() => {}
@@ -642,8 +732,9 @@ async fn drain(
     pool: &SqlitePool,
     cfg: &SummariserConfig,
     attempts: &mut HashMap<i64, u32>,
+    rate_limited_attempts: &mut HashMap<i64, u32>,
     source_backoff: &mut HashMap<String, std::time::Instant>,
-) -> bool {
+) -> DrainOutcome {
     // Expire stale backoffs before deciding what to skip.
     let now_instant = std::time::Instant::now();
     source_backoff.retain(|_, until| *until > now_instant);
@@ -659,43 +750,82 @@ async fn drain(
         Ok(r) => r,
         Err(e) => {
             tracing::warn!(error = %crate::errors::chain(&e), "summariser: fetch_pending failed");
-            return false;
+            return DrainOutcome::default();
         }
     };
 
     if rows.is_empty() {
-        return false;
+        return DrainOutcome::default();
     }
 
-    let mut summarised = 0u32;
-    let mut skipped_backoff = 0u32;
+    let mut out = DrainOutcome {
+        seen: rows.len() as u32,
+        ..DrainOutcome::default()
+    };
 
     for row in &rows {
         // Skip rows whose agent source is still in rate-limit backoff.
         if source_backoff.contains_key(&row.agent) {
-            skipped_backoff += 1;
+            out.skipped_backoff += 1;
             continue;
         }
 
         let tries = attempts.get(&row.id).copied().unwrap_or(0);
         if tries >= MAX_ROW_ATTEMPTS {
+            out.skipped_exhausted += 1;
             continue; // dead-lettered this daemon lifetime
         }
+        if rate_limited_attempts.get(&row.id).copied().unwrap_or(0) >= MAX_RATE_LIMITED_ROW_ATTEMPTS
+        {
+            out.skipped_exhausted += 1;
+            continue; // gave up on this row's endless "rate limited" reports
+        }
 
         let outcome = summarise_one(pool, row, cfg, true).await;
         if outcome.written {
-            summarised += 1;
+            out.summarised += 1;
             // Row succeeded and moved past pending_summariser — drop its
             // ledger entry via record_attempt so `attempts` only ever holds
             // currently-pending rows that have failed at least once, not
             // every row that ever failed once over the daemon's lifetime.
             record_attempt(attempts, row.id, true);
+            // Same for the rate-limit ledger: a success means whatever quota
+            // was in the way has refilled, so the row starts clean if it is
+            // ever retried.
+            rate_limited_attempts.remove(&row.id);
         } else if outcome.rate_limited {
             // Apply per-source backoff so other sources can still drain.
             let until =
                 std::time::Instant::now() + Duration::from_secs(cfg.rate_limit_backoff_secs);
             source_backoff.insert(row.agent.clone(), until);
-            skipped_backoff += 1;
+            out.skipped_backoff += 1;
+            // Count it. This branch used to be the ONE outcome that never
+            // touched the ledger, which made `MAX_ROW_ATTEMPTS` inapplicable to
+            // it: a row that classified `RateLimited` on every attempt was
+            // retried forever and could never dead-letter. That is not a
+            // theoretical hole - `RATE_LIMIT_MARKERS` matches bare substrings
+            // like "429" and "quota" anywhere in an engine's output, and this
+            // is a developer tool whose transcripts are full of both, so a row
+            // failing for an unrelated reason can be misfiled as rate-limited
+            // and then never terminate.
+            //
+            // Counted against its OWN, much more generous cap rather than
+            // `MAX_ROW_ATTEMPTS`, because the intent behind this branch is
+            // still right: a quota refills, and it should be waited out rather
+            // than routed around. See `MAX_RATE_LIMITED_ROW_ATTEMPTS`.
+            let tries = record_rate_limited_attempt(rate_limited_attempts, row.id);
+            if tries >= MAX_RATE_LIMITED_ROW_ATTEMPTS {
+                if let Err(e) = db::write_dead_letter(pool, row.id).await {
+                    tracing::error!(row_id = row.id, error = %crate::errors::chain(&e), "failed to dead-letter a persistently rate-limited row");
+                }
+                tracing::warn!(
+                    row_id = row.id,
+                    attempts = tries,
+                    "row has reported rate-limited on every attempt for far longer than a \
+                     quota takes to refill - dead-lettering it rather than retrying forever \
+                     (it may be a misclassified failure)"
+                );
+            }
             tracing::warn!(
                 row_id = outcome.row_id,
                 source = %row.agent,
@@ -704,6 +834,7 @@ async fn drain(
             );
         } else {
             // Transient failure. Leave pending for retry; log so it isn't silent.
+            out.failed += 1;
             let tries = record_attempt(attempts, row.id, false)
                 .expect("record_attempt(.., written=false) always returns Some");
             if tries >= MAX_ROW_ATTEMPTS {
@@ -727,13 +858,11 @@ async fn drain(
         }
     }
 
-    if summarised > 0 {
-        tracing::info!(summarised, "summariser drain");
+    if out.summarised > 0 {
+        tracing::info!(summarised = out.summarised, "summariser drain");
     }
 
-    // Signal global backoff only when ALL rows were skipped due to source
-    // backoffs — nothing useful can be done until at least one source recovers.
-    skipped_backoff > 0 && skipped_backoff == rows.len() as u32 && summarised == 0
+    out
 }
 
 /// Updates the per-row failure ledger (`attempts`, see [`MAX_ROW_ATTEMPTS`])
@@ -748,6 +877,28 @@ async fn drain(
 /// On failure (`written = false`) the row's attempt count is incremented and
 /// the new count returned as `Some(tries)`, for the caller to compare against
 /// [`MAX_ROW_ATTEMPTS`].
+/// How many consecutive `RateLimited` outcomes a single row may report before
+/// it is dead-lettered anyway.
+///
+/// Deliberately far larger than [`MAX_ROW_ATTEMPTS`], and paced by
+/// `rate_limit_backoff_secs` (30 minutes by default) rather than the 5-second
+/// sweep - so this is roughly a day of genuinely waiting out a quota before
+/// giving up. A real usage limit refills long inside that; a row still
+/// reporting "rate limited" a day later is almost certainly a misclassified
+/// failure, and the alternative to giving up is retrying it forever.
+const MAX_RATE_LIMITED_ROW_ATTEMPTS: u32 = 48;
+
+/// Increment and return a row's consecutive rate-limited count.
+///
+/// Kept in a ledger separate from [`record_attempt`]'s so the two caps cannot
+/// interfere: a row that fails twice, then hits a genuine quota, must not
+/// arrive at the rate-limit cap carrying unrelated strikes.
+fn record_rate_limited_attempt(attempts: &mut HashMap<i64, u32>, row_id: i64) -> u32 {
+    let tries = attempts.get(&row_id).copied().unwrap_or(0) + 1;
+    attempts.insert(row_id, tries);
+    tries
+}
+
 fn record_attempt(attempts: &mut HashMap<i64, u32>, row_id: i64, written: bool) -> Option<u32> {
     if written {
         attempts.remove(&row_id);
@@ -946,4 +1097,155 @@ mod tests {
             "row 2's independent failure count must be untouched"
         );
     }
+
+    // ── pacing + the rate-limit cap ─────────────────────────────────────────
+
+    fn cfg_for_pacing() -> SummariserConfig {
+        let mut c = SummariserConfig::from_env();
+        c.sweep_interval_secs = 5;
+        c.rate_limit_backoff_secs = 1800;
+        c
+    }
+
+    /// THE fork storm. Measured in production: 18,674 forks over ~46 hours,
+    /// one every ~9 s, while the queue sat flat. A batch of 32 rows that each
+    /// fail fast costs 64 spawns, and it used to be re-attempted every 5 s
+    /// forever because the loop could not tell "nothing to do" from
+    /// "everything I tried failed".
+    #[test]
+    fn a_failing_pass_backs_off_instead_of_re_forking_every_sweep() {
+        let cfg = cfg_for_pacing();
+        let failing = DrainOutcome {
+            seen: 32,
+            failed: 32,
+            ..DrainOutcome::default()
+        };
+        let mut prev = 0;
+        for idle in 1..=6 {
+            let w = next_wait_secs(failing, &cfg, idle);
+            assert!(
+                w > prev,
+                "wait must grow while nothing succeeds (idle={idle} gave {w}, previous {prev})"
+            );
+            prev = w;
+        }
+        assert!(
+            next_wait_secs(failing, &cfg, 1) > cfg.sweep_interval_secs,
+            "the first failing pass must already back off past the normal sweep"
+        );
+        assert_eq!(
+            next_wait_secs(failing, &cfg, 99),
+            MAX_IDLE_BACKOFF_SECS,
+            "backoff must cap so recovery stays prompt"
+        );
+    }
+
+    /// Progress and an empty queue both keep the responsive cadence - backing
+    /// off a working summariser would delay every summary.
+    #[test]
+    fn progress_and_idleness_keep_the_normal_sweep() {
+        let cfg = cfg_for_pacing();
+        let progressing = DrainOutcome {
+            seen: 4,
+            summarised: 4,
+            ..DrainOutcome::default()
+        };
+        assert_eq!(
+            next_wait_secs(progressing, &cfg, 3),
+            cfg.sweep_interval_secs,
+            "a pass that summarised must not inherit an earlier backoff"
+        );
+        assert_eq!(
+            next_wait_secs(DrainOutcome::default(), &cfg, 3),
+            cfg.sweep_interval_secs,
+            "an empty queue is cheap to re-check"
+        );
+    }
+
+    /// A genuine quota wall waits the full backoff rather than spinning.
+    #[test]
+    fn an_entirely_rate_limited_pass_waits_out_the_quota() {
+        let cfg = cfg_for_pacing();
+        let walled = DrainOutcome {
+            seen: 6,
+            skipped_backoff: 6,
+            ..DrainOutcome::default()
+        };
+        assert_eq!(
+            next_wait_secs(walled, &cfg, 0),
+            cfg.rate_limit_backoff_secs,
+            "nothing can proceed until a quota refills - do not spin on it"
+        );
+    }
+
+    /// The old `all_backed_off` flag required `skipped_backoff == rows.len()`,
+    /// so ONE failing row alongside backed-off ones collapsed the 30-minute
+    /// wait back to the 5-second sweep. It must still not spin - but it also
+    /// must not wait out the full quota, because the failing row is real work
+    /// that deserves a retry sooner than that.
+    #[test]
+    fn one_failure_beside_backed_off_rows_neither_spins_nor_stalls() {
+        let cfg = cfg_for_pacing();
+        let mixed = DrainOutcome {
+            seen: 10,
+            skipped_backoff: 9,
+            failed: 1,
+            ..DrainOutcome::default()
+        };
+        let w = next_wait_secs(mixed, &cfg, 1);
+        assert!(
+            w > cfg.sweep_interval_secs,
+            "a mixed pass collapsed back to the bare sweep - this is the spin"
+        );
+        assert!(
+            w < cfg.rate_limit_backoff_secs,
+            "the failing row must be retried well before the quota window elapses"
+        );
+    }
+
+    /// THE immortality bug. The `rate_limited` branch was the one outcome that
+    /// never touched a ledger, so `MAX_ROW_ATTEMPTS` did not apply to it and a
+    /// row misclassified as rate-limited retried forever. `RATE_LIMIT_MARKERS`
+    /// matches bare "429"/"quota" anywhere in an engine's output, and this is a
+    /// developer tool whose transcripts are full of both.
+    #[test]
+    fn a_persistently_rate_limited_row_eventually_terminates() {
+        let mut ledger: HashMap<i64, u32> = HashMap::new();
+        let mut last = 0;
+        for _ in 0..MAX_RATE_LIMITED_ROW_ATTEMPTS {
+            last = record_rate_limited_attempt(&mut ledger, 7);
+        }
+        assert_eq!(
+            last, MAX_RATE_LIMITED_ROW_ATTEMPTS,
+            "consecutive rate-limited reports must be counted, not ignored"
+        );
+    }
+
+    /// The two caps are independent: a row that failed twice and then hits a
+    /// genuine quota must not arrive at the rate-limit cap carrying unrelated
+    /// strikes, and vice versa.
+    #[test]
+    fn the_two_attempt_ledgers_do_not_bleed_into_each_other() {
+        let mut failures: HashMap<i64, u32> = HashMap::new();
+        let mut rate_limits: HashMap<i64, u32> = HashMap::new();
+        record_attempt(&mut failures, 42, false);
+        record_attempt(&mut failures, 42, false);
+        assert_eq!(record_rate_limited_attempt(&mut rate_limits, 42), 1);
+        assert_eq!(failures.get(&42), Some(&2));
+    }
+
+    /// Waiting out a quota must be generous - far longer than the fast-failure
+    /// cap - or a real usage limit would dead-letter a legitimate row.
+    #[test]
+    fn the_rate_limit_cap_is_far_more_patient_than_the_failure_cap() {
+        // Read through locals so this is a value comparison rather than an
+        // assertion on a constant expression (which clippy rejects).
+        let patient: u32 = MAX_RATE_LIMITED_ROW_ATTEMPTS;
+        let strict: u32 = MAX_ROW_ATTEMPTS;
+        assert!(
+            patient > strict.saturating_mul(10),
+            "a refilling quota must be waited out, not treated like a broken row \
+             (rate-limit cap {patient}, failure cap {strict})"
+        );
+    }
 }

From b64b780ee0ae9ef1c8ef83c250f398c2e0594636 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 1 Sep 2026 09:15:09 +0530
Subject: [PATCH 32/53] fix(cli): add the restart subcommand five remedies
 already recommend

`meridian restart` did not exist in this binary, while five places in it
told users to run it: doctor's etl-freshness remedy, the Jira and Trello
OAuth handlers' SUCCESS output ("Tokens saved - run `meridian restart`
to pick them up"), diagnose's expired-token remedy, and capture's
persistent-failure remedy.

It survived because it works for whoever wrote it. A source install
symlinks ~/.local/bin/meridian at scripts/meridian-cli.sh, whose bash
cmd_restart has always existed; a DMG install runs this native binary
and got `unknown subcommand "restart"`. The OAuth case is the damaging
one and has nothing to do with doctor: a packaged user connects Jira, is
told to run a command that does not exist, and their tracker integration
silently never picks up the tokens.

Uses `launchctl kickstart -k` on macOS and schtasks /End + /Run on
Windows. `-k` is right here and wrong in the tray's watchdog for two
reasons: the user asked for it, and this is a separate short-lived
process rather than the daemon signalling itself. Deliberately not
bootout+bootstrap - the `launchctl disable` that travels with it has
already wedged a plist in this repo badly enough to need a manual
reinstall. A source checkout with no registered service is told so
rather than getting a silent exit 0 that looks like a restart.

Two neighbouring remedies pointed at `meridian start`, which also does
not exist; kickstart covers stopped-and-loaded too, so they now say
restart.

Also fixes the discoverability half of the logging report: doctor now
points at `meridian logs -f` and notes that the files in ~/.meridian/logs
are normally empty. Those files are a crash-only safety net by design and
every structured log goes to the telemetry spool - but nothing said so,
so an operator debugging a stalled ETL read 0 bytes, concluded logging
was broken, and never ran the one tool that would have shown the fault.
---
 src/cli_flags.rs       |   5 +
 src/health/diagnose.rs |  13 ++-
 src/health/mod.rs      |  16 +++
 src/health/platform.rs |   5 +-
 src/lib.rs             |   1 +
 src/main.rs            |  24 ++++
 src/restart.rs         | 250 +++++++++++++++++++++++++++++++++++++++++
 7 files changed, 309 insertions(+), 5 deletions(-)
 create mode 100644 src/restart.rs

diff --git a/src/cli_flags.rs b/src/cli_flags.rs
index 1bdf43b8e..693f2b053 100644
--- a/src/cli_flags.rs
+++ b/src/cli_flags.rs
@@ -255,6 +255,11 @@ pub const SPECS: &[Spec] = &[
         usage: "meridian telemetry <status|export|import> [--out PATH] [--since MICROS] \
                 [--endpoint URL] [--auth BASE64]",
     },
+    Spec {
+        name: "restart",
+        flags: &[],
+        usage: "meridian restart   (restarts the background daemon)",
+    },
     Spec {
         name: "logs",
         flags: &["--min-severity", "--service", "-n", "-f"],
diff --git a/src/health/diagnose.rs b/src/health/diagnose.rs
index 99a7a0dce..a026efb5e 100644
--- a/src/health/diagnose.rs
+++ b/src/health/diagnose.rs
@@ -97,7 +97,7 @@ pub fn root_causes(report: &Report) -> Vec<Diagnosis> {
                 ("jira", "ticket sync"),
                 ("worklog", "hour ledger"),
             ]),
-            action: "`meridian start` (or `meridian doctor --fix`).".into(),
+            action: "`meridian restart` (or `meridian doctor --fix`).".into(),
         });
     }
 
@@ -194,11 +194,20 @@ pub fn escalation_hint(color: bool) -> String {
     };
     let bold = |s: &str| paint("\x1b[1m", s);
     let dim = |s: &str| paint("\x1b[2m", s);
+    // The `meridian logs` line is here because an operator debugging a stalled
+    // ETL on 2026-08-27 went to the paths in the launchd plist, found
+    // `daemon.log` at 0 bytes, and reported that logging was broken. It is not:
+    // those files are a crash-only safety net by design and every structured
+    // log goes to the telemetry spool, which `meridian logs` decodes. Nothing
+    // told them that, so the one tool that would have shown the fault went
+    // unused for 44.7 hours.
     format!(
-        "\n  {}\n    • {}  {}\n    • {}\n",
+        "\n  {}\n    • {}  {}\n    • {}  {}\n    • {}\n",
         bold("Still stuck?"),
         "meridian doctor --fix",
         dim("attempt automatic + guided repair"),
+        "meridian logs -f",
+        dim("live daemon logs (the files in ~/.meridian/logs are normally empty)"),
         dim("share this output with the team, or run: claude \"debug my meridian doctor output\""),
     )
 }
diff --git a/src/health/mod.rs b/src/health/mod.rs
index 1fcc1c92e..4ebedae70 100644
--- a/src/health/mod.rs
+++ b/src/health/mod.rs
@@ -247,6 +247,22 @@ impl Report {
             _ => paint("\x1b[32m", "  ✓ all systems healthy"),
         };
         out.push_str(&format!("{verdict}\n"));
+        // Where to look next. Reported from production 2026-08-27: an operator
+        // debugging a stalled ETL went to the paths in the launchd plist
+        // (`~/.meridian/logs/daemon.log`), found 0 bytes, and concluded logging
+        // was broken. It is not - those files are a crash-only safety net by
+        // design, and every structured log goes to the telemetry spool, which
+        // `meridian logs` decodes. Nothing anywhere told them that, so the one
+        // tool that would have shown the fault went unused. Printed
+        // unconditionally rather than only on a warning: the times you most
+        // need it are the times `doctor` looks fine and something is still off.
+        out.push_str(&format!(
+            "\n  {}\n",
+            dim(
+                "Logs: meridian logs [-f]   (the files in ~/.meridian/logs are a crash-only \
+                 safety net and are normally empty)"
+            )
+        ));
         out
     }
 
diff --git a/src/health/platform.rs b/src/health/platform.rs
index 82195f322..394e27b09 100644
--- a/src/health/platform.rs
+++ b/src/health/platform.rs
@@ -181,9 +181,8 @@ pub fn daemon_service() -> Vec<Check> {
     use crate::platform::ServiceStatus;
     let run_check = match crate::platform::service_status(LABEL_DAEMON) {
         ServiceStatus::Running(pid) => Check::ok("daemon running", "system", format!("pid {pid}")),
-        ServiceStatus::NotRunning => {
-            Check::critical("daemon running", "system", "not loaded").with_remedy("meridian start")
-        }
+        ServiceStatus::NotRunning => Check::critical("daemon running", "system", "not loaded")
+            .with_remedy("meridian restart"),
         // Not "not running" — we have not looked. See ServiceStatus's docs.
         ServiceStatus::Unknown => Check::info(
             "daemon running",
diff --git a/src/lib.rs b/src/lib.rs
index 892432bbb..d6ac04626 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -30,6 +30,7 @@ pub mod observability;
 pub mod plan_tasks;
 pub mod platform;
 pub mod pm_worklog;
+pub mod restart;
 pub mod telemetry_spool;
 pub mod uninstall;
 pub mod worklog_pipeline;
diff --git a/src/main.rs b/src/main.rs
index 9199876a3..2a6558eea 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1040,6 +1040,30 @@ async fn main() -> Result<()> {
     // bash `meridian logs` (which tailed launchd-redirected stdout/stderr
     // text) now that the OTel spool is the sole log/trace sink — see
     // observability.rs's module doc. No daemon init needed.
+    // `meridian restart` - restart the managed daemon. This subcommand did not
+    //     exist while FIVE places in this same binary told users to run it,
+    //     including the Jira/Trello OAuth handlers' success output and
+    //     `doctor`'s etl-freshness remedy. It works on a source install only
+    //     because that path symlinks `meridian` at `scripts/meridian-cli.sh`,
+    //     whose bash `cmd_restart` has always existed; a DMG install runs this
+    //     binary directly and got `unknown subcommand "restart"`.
+    if std::env::args().nth(1).as_deref() == Some("restart") {
+        let outcome = meridian::restart::run();
+        let text = meridian::restart::describe(&outcome);
+        match outcome {
+            meridian::restart::Outcome::Restarted => {
+                println!("{text}");
+                return Ok(());
+            }
+            // Exit non-zero so a script (or the tray) can tell "restarted" from
+            // "there was nothing to restart" without parsing the message.
+            _ => {
+                eprintln!("{text}");
+                std::process::exit(1);
+            }
+        }
+    }
+
     if std::env::args().nth(1).as_deref() == Some("logs") {
         let args: Vec<String> = std::env::args().collect();
         meridian::telemetry_spool::render::run(&args).await;
diff --git a/src/restart.rs b/src/restart.rs
new file mode 100644
index 000000000..dc858ba9c
--- /dev/null
+++ b/src/restart.rs
@@ -0,0 +1,250 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! `meridian restart` - stop and restart the background daemon.
+//!
+//! # Why this had to exist
+//!
+//! Five places in this binary already told users to run `meridian restart`,
+//! and on a packaged install the command did not exist:
+//!
+//! - `health::daemon`'s `etl freshness` remedy (the one a production user hit
+//!   on 2026-08-27, staring at a stalled ETL while `doctor` recommended a
+//!   command that answered `unknown subcommand "restart"`)
+//! - `main.rs`'s Jira and Trello OAuth handlers, printed on the **success**
+//!   path: "Tokens saved ... run `meridian restart` to pick them up"
+//! - `health::diagnose`'s expired-token remedy
+//! - `health::capture`'s persistent-failure remedy
+//!
+//! It worked for whoever wrote it, which is exactly why it survived: the
+//! **source** install symlinks `~/.local/bin/meridian` at
+//! `scripts/meridian-cli.sh`, whose bash `cmd_restart` has always existed. A
+//! **DMG** install has no wrapper - `~/.meridian/bin/meridian` is this native
+//! binary - so the same advice was a dead end for every packaged user.
+//!
+//! The OAuth case is the damaging one and had nothing to do with `doctor`: a
+//! user connects Jira, is told to run a command that does not exist, doesn't
+//! run it, and their tracker integration silently never picks up the tokens
+//! until something else happens to restart the daemon.
+//!
+//! # Why `kickstart -k` and not `bootout` + `bootstrap`
+//!
+//! `-k` is precisely what kills a running instance, and here that is what was
+//! asked for - unlike the tray's daemon watchdog, where `-k` on a daemon that
+//! was merely slow to answer an 800 ms probe corrupted `meridian.db` on every
+//! macOS install for days (see `tray/src-tauri/src/poll/watchdog.rs`, which
+//! now drops `-k` for exactly that reason).
+//! Two things make it correct in this module and not there: the user typed the
+//! command, and this runs in a **separate short-lived process**, so it is not
+//! the daemon signalling itself.
+//!
+//! `bootout` + `bootstrap` is deliberately NOT used. It is heavier, and the
+//! `launchctl disable` that tends to travel with it has already wedged a plist
+//! in this repo badly enough that `bootstrap` returned EIO and the agent had to
+//! be reinstalled by hand - see `crate::db::repair::marker`'s module docs.
+//! Recovery tooling must not be able to brick the thing it is recovering.
+//!
+//! # Who calls this
+//! `main.rs`'s subcommand dispatch, and every remedy string listed above.
+
+/// The daemon's launchd label on macOS. Must match the plist that
+/// `tray/src-tauri/src/backend_install.rs` renders.
+#[cfg(target_os = "macos")]
+const DAEMON_LABEL: &str = "com.meridiona.daemon";
+
+/// The daemon's Task Scheduler name on Windows. Must match
+/// `backend_install::WINDOWS_TASK_NAME`.
+#[cfg(target_os = "windows")]
+const WINDOWS_TASK_NAME: &str = "Meridian Daemon";
+
+/// What `meridian restart` did.
+#[derive(Debug, PartialEq, Eq)]
+pub enum Outcome {
+    /// The service manager was asked to restart the daemon.
+    Restarted,
+    /// No service is registered for this user - a source/dev checkout, where
+    /// the daemon is run by hand or by `cargo watch`. Reported rather than
+    /// silently "succeeding", because a bare exit 0 here would look like the
+    /// restart happened.
+    NotRegistered,
+    /// The service manager refused.
+    Failed(String),
+}
+
+/// Human-readable result, ready to print. Separated from [`run`] so the
+/// wording is testable without a service manager.
+pub fn describe(outcome: &Outcome) -> String {
+    match outcome {
+        Outcome::Restarted => "Meridian daemon restarted.".to_string(),
+        Outcome::NotRegistered => {
+            // Plain hyphens: user-facing text (see the repo's hard rule).
+            "No Meridian daemon service is registered for your user.\n\
+             This is expected on a source checkout - start it the way you \
+             normally do (for example 'cargo run --bin meridian'), or install \
+             the app to get a managed daemon."
+                .to_string()
+        }
+        Outcome::Failed(why) => format!("Could not restart the Meridian daemon: {why}"),
+    }
+}
+
+/// Restart the managed daemon for the current user.
+pub fn run() -> Outcome {
+    #[cfg(target_os = "macos")]
+    {
+        let target = format!("gui/{}/{}", uid_str(), DAEMON_LABEL);
+        // Ask first, so a source checkout gets an explanation instead of
+        // launchctl's "Could not find service" spelled as a raw error.
+        if !service_is_loaded(&target) {
+            return Outcome::NotRegistered;
+        }
+        match std::process::Command::new("launchctl")
+            .args(["kickstart", "-k", &target])
+            .output()
+        {
+            Ok(o) if o.status.success() => Outcome::Restarted,
+            Ok(o) => Outcome::Failed(format!(
+                "launchctl kickstart exited {}: {}",
+                o.status,
+                String::from_utf8_lossy(&o.stderr).trim()
+            )),
+            Err(e) => Outcome::Failed(format!("could not run launchctl: {e}")),
+        }
+    }
+    #[cfg(target_os = "windows")]
+    {
+        // No atomic restart verb in Task Scheduler: end it, then run it. `/End`
+        // failing is not fatal - the task may simply not have been running -
+        // so only `/Run` decides the outcome.
+        let _ = std::process::Command::new("schtasks")
+            .args(["/End", "/TN", WINDOWS_TASK_NAME])
+            .output();
+        match std::process::Command::new("schtasks")
+            .args(["/Run", "/TN", WINDOWS_TASK_NAME])
+            .output()
+        {
+            Ok(o) if o.status.success() => Outcome::Restarted,
+            // schtasks reports a missing task on stderr with a non-zero exit;
+            // that is the Windows shape of "no service registered".
+            Ok(o) => {
+                let err = String::from_utf8_lossy(&o.stderr).trim().to_string();
+                if err.contains("cannot find the file specified") || err.contains("does not exist")
+                {
+                    Outcome::NotRegistered
+                } else {
+                    Outcome::Failed(format!("schtasks /Run exited {}: {err}", o.status))
+                }
+            }
+            Err(e) => Outcome::Failed(format!("could not run schtasks: {e}")),
+        }
+    }
+    #[cfg(not(any(target_os = "macos", target_os = "windows")))]
+    {
+        Outcome::NotRegistered
+    }
+}
+
+/// Whether launchd has the label loaded for this user.
+///
+/// `launchctl print` exits non-zero for a label that is not loaded at all,
+/// which is the source/dev case; it exits 0 both for "loaded and running" and
+/// "loaded but stopped", and `kickstart` is correct for either.
+#[cfg(target_os = "macos")]
+fn service_is_loaded(target: &str) -> bool {
+    std::process::Command::new("launchctl")
+        .args(["print", target])
+        .output()
+        .map(|o| o.status.success())
+        .unwrap_or(false)
+}
+
+/// The current user's uid as launchd wants it in a `gui/<uid>/<label>` target.
+///
+/// Falls back to `501` (the first console user on macOS) rather than failing:
+/// a wrong uid produces a clean "not registered" message, whereas refusing to
+/// run produces nothing useful at all.
+#[cfg(target_os = "macos")]
+fn uid_str() -> String {
+    std::process::Command::new("id")
+        .arg("-u")
+        .output()
+        .ok()
+        .and_then(|o| String::from_utf8(o.stdout).ok())
+        .map(|s| s.trim().to_string())
+        .unwrap_or_else(|| "501".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Every message this prints is user-facing app text, so it takes plain
+    /// hyphens only - no em-dash or en-dash (repo hard rule).
+    #[test]
+    fn messages_use_plain_hyphens() {
+        for o in [
+            Outcome::Restarted,
+            Outcome::NotRegistered,
+            Outcome::Failed("boom".into()),
+        ] {
+            let s = describe(&o);
+            for bad in ['\u{2014}', '\u{2013}'] {
+                assert!(
+                    !s.contains(bad),
+                    "{s:?} contains {bad:?} - user-facing text takes a plain hyphen"
+                );
+            }
+        }
+    }
+
+    /// A source checkout must be told what happened rather than getting a
+    /// silent exit 0 that looks like the restart worked.
+    #[test]
+    fn an_unregistered_service_is_explained_not_faked() {
+        let s = describe(&Outcome::NotRegistered);
+        assert!(
+            s.contains("source checkout"),
+            "the dev case must say why there is no service: {s:?}"
+        );
+        assert!(
+            !s.contains("restarted"),
+            "must not imply a restart happened: {s:?}"
+        );
+    }
+
+    /// A failure has to carry the reason - the whole point is that the
+    /// previous behaviour ("unknown subcommand") told the operator nothing.
+    #[test]
+    fn a_failure_names_its_cause() {
+        assert!(
+            describe(&Outcome::Failed("launchctl exited 1".into())).contains("launchctl exited 1")
+        );
+    }
+
+    /// THE regression this module exists for. Every in-binary string that
+    /// tells a user to run `meridian restart` is only correct while the
+    /// subcommand is actually dispatched. Source-scanned because the dispatch
+    /// chain is `if` statements, not data.
+    #[test]
+    fn the_restart_subcommand_is_actually_dispatched() {
+        let main_rs = include_str!("main.rs");
+        assert!(
+            main_rs.contains("nth(1).as_deref() == Some(\"restart\")"),
+            "main.rs no longer dispatches `restart`, but health remedies and the \
+             OAuth success paths still tell users to run it - which is exactly the \
+             dead end reported from production on 2026-08-27"
+        );
+    }
+
+    /// The remedy strings and the subcommand must not drift apart again: if
+    /// something still recommends `meridian restart`, the command must exist
+    /// (asserted above), and if nothing recommends it any more this test
+    /// should be revisited rather than silently passing.
+    #[test]
+    fn something_still_recommends_the_command_this_module_implements() {
+        let health = include_str!("health/daemon.rs");
+        assert!(
+            health.contains("meridian restart"),
+            "health::daemon no longer recommends `meridian restart`; if that was \
+             deliberate, re-check whether this subcommand is still needed"
+        );
+    }
+}

From 1c39edfb6771db78b582db284cc89317bd5f2bd8 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 1 Sep 2026 09:27:04 +0530
Subject: [PATCH 33/53] fix(telemetry): batch the spool and bound sent/ and
 quarantine/

Retention was never broken. The reported ~155k files spanning exactly
seven days is the signature of a 7-day policy working, and retention.rs
already documents this steady state at ~264k files (measured 263,787 on
2026-08-05). Reproduced independently: 149,179 files / 839MB, oldest
exactly 7 days back. The defect is the write rate, not the cleanup.

Each OTel export batch becomes one spool file, and the SDK defaults were
taken as-is: 1000ms scheduled_delay for logs, 5s for traces. That is one
logs file per second per install, retained for a week. Both pipelines now
batch on 30s with a larger max_export_batch_size (the default 512 forces
extra out-of-band exports on a burst, i.e. extra files, defeating the
longer delay). Nothing reads the spool in real time - the shipper has its
own ~30s tick and `meridian logs` reads what is on disk - so the only
cost is up to 30s of records held in memory, lost on a hard kill, which
is exactly what the launchd stdout/stderr files exist to cover. Every
ordinary shutdown force-flushes first.

sent/ had an age policy and no volume policy at all, so its size was
whatever the emission rate produced inside the window; pending/ has had a
512MB cap all along. Adds a 256MB ceiling, evicting oldest-first by the
same (micros, seq) order the shipper uses. Generous on purpose: sent/ is
what gives `meridian logs` more than thirty seconds of history.

quarantine/ was pruned by nothing and read by nothing - not retention,
not build_export_bundle, not `meridian logs` - so a permanently-rejected
payload was immortal and invisible. It now ages out with the rest.

Measured after the change: individual spool files went from a ~5.6KB
average to 12KB and 52KB, and `meridian logs` still decodes them.
---
 src/observability/mod.rs         |  48 +++++++-
 src/telemetry_spool/retention.rs | 196 ++++++++++++++++++++++++++++++-
 src/telemetry_spool/shipper.rs   |   9 +-
 3 files changed, 245 insertions(+), 8 deletions(-)

diff --git a/src/observability/mod.rs b/src/observability/mod.rs
index fdd75954d..891d6a46a 100644
--- a/src/observability/mod.rs
+++ b/src/observability/mod.rs
@@ -64,10 +64,10 @@ use opentelemetry::{global, trace::TracerProvider as _, KeyValue};
 use opentelemetry_appender_tracing::layer::OpenTelemetryTracingBridge;
 use opentelemetry_otlp::{Protocol, WithExportConfig, WithHttpConfig};
 use opentelemetry_sdk::{
-    logs::LoggerProvider,
+    logs::{BatchLogProcessor, LoggerProvider},
     propagation::TraceContextPropagator,
     runtime,
-    trace::{RandomIdGenerator, Sampler, Tracer, TracerProvider},
+    trace::{BatchSpanProcessor, RandomIdGenerator, Sampler, Tracer, TracerProvider},
     Resource,
 };
 use std::collections::HashMap;
@@ -484,8 +484,20 @@ fn try_build_otel_providers(
         .build()
         .context("build OTLP span exporter (spool)")?;
 
+    // Batched on the same 30 s cadence as the log pipeline below, for the same
+    // reason and with the same trade. The SDK's trace default is 5 s, which is
+    // less pathological than the logs default of 1 s but still writes ~17k
+    // spool files a day on its own - and once the log pipeline is batched,
+    // traces become the dominant contributor to the file count.
+    let span_batch = opentelemetry_sdk::trace::BatchConfigBuilder::default()
+        .with_scheduled_delay(std::time::Duration::from_secs(30))
+        .with_max_export_batch_size(2048)
+        .build();
+    let span_processor = BatchSpanProcessor::builder(span_exporter, runtime::Tokio)
+        .with_batch_config(span_batch)
+        .build();
     let tracer_provider = TracerProvider::builder()
-        .with_batch_exporter(span_exporter, runtime::Tokio)
+        .with_span_processor(span_processor)
         .with_sampler(Sampler::AlwaysOn)
         .with_id_generator(RandomIdGenerator::default())
         .with_resource(resource.clone())
@@ -506,8 +518,36 @@ fn try_build_otel_providers(
         .build()
         .context("build OTLP log exporter (spool)")?;
 
+    // Batch the LOG pipeline explicitly rather than taking the SDK default.
+    //
+    // Each export batch becomes one file in the spool
+    // (`spool_client::SpoolClient::send`), and opentelemetry_sdk 0.27's default
+    // `scheduled_delay` for logs is **1000 ms** (traces default to 5 s). One
+    // logs file per second, per install, retained for the 7-day window, is what
+    // produces the ~150k-file / ~800 MB `sent/` directory measured on two
+    // machines - and `retention.rs` already documents that steady state at
+    // ~264k files. Retention is working; the write rate is the defect.
+    //
+    // 30 s is chosen against what the files are FOR. Nothing reads the spool in
+    // real time: the shipper drains on its own ~30 s tick, and `meridian logs`
+    // decodes whatever is on disk. The cost is that up to 30 s of records sit in
+    // memory, so a hard kill (SIGKILL, OOM, panic before the flush) loses them -
+    // acceptable, because that is precisely the case the launchd stdout/stderr
+    // files exist to cover, and every ordinary shutdown path calls
+    // `obs_guard.shutdown()`, which force-flushes first.
+    //
+    // `max_export_batch_size` is raised to match: at the default 512 a busy
+    // burst forces extra out-of-band exports, i.e. extra files, defeating the
+    // longer delay.
+    let log_batch = opentelemetry_sdk::logs::BatchConfigBuilder::default()
+        .with_scheduled_delay(std::time::Duration::from_secs(30))
+        .with_max_export_batch_size(2048)
+        .build();
+    let log_processor = BatchLogProcessor::builder(log_exporter, runtime::Tokio)
+        .with_batch_config(log_batch)
+        .build();
     let logger_provider = LoggerProvider::builder()
-        .with_batch_exporter(log_exporter, runtime::Tokio)
+        .with_log_processor(log_processor)
         .with_resource(resource)
         .build();
 
diff --git a/src/telemetry_spool/retention.rs b/src/telemetry_spool/retention.rs
index 358107605..e897bc535 100644
--- a/src/telemetry_spool/retention.rs
+++ b/src/telemetry_spool/retention.rs
@@ -133,6 +133,7 @@ pub(super) fn prune_due(tick: u64) -> bool {
 pub(super) fn run_housekeeping(
     pending: &Path,
     sent: &Path,
+    quarantine: &Path,
     cutoff_secs: u64,
     prune: bool,
 ) -> Result<()> {
@@ -140,9 +141,22 @@ pub(super) fn run_housekeeping(
     if prune {
         prune_by_age(pending, cutoff_secs)?;
         prune_by_age(sent, cutoff_secs)?;
+        // `quarantine/` was covered by nothing: not by retention, and not by
+        // any reader either - neither `build_export_bundle` nor `meridian logs`
+        // looks at it. A permanently-rejected payload was therefore immortal
+        // AND invisible, the one genuinely unbounded directory in the spool.
+        prune_by_age(quarantine, cutoff_secs)?;
     }
     crate::telemetry_spool::launchd_log_cap::cap_launchd_logs();
-    enforce_pending_cap(pending)
+    enforce_pending_cap(pending)?;
+    // `sent/` had an age policy and no volume policy at all, so its size was
+    // whatever the emission rate happened to produce inside the 7-day window -
+    // ~800 MB across ~150k files on the two machines measured, and nothing
+    // would have stopped 2 GB on a busier one. The batching fix in
+    // `observability::init` addresses the rate; this bounds the outcome
+    // regardless of rate, which is what makes it a ceiling rather than a
+    // second guess.
+    enforce_sent_cap(sent)
 }
 
 /// Delete `.otlp` files in `dir` whose mtime is older than `cutoff_secs`.
@@ -244,6 +258,99 @@ pub(super) fn enforce_pending_cap(pending: &Path) -> Result<()> {
     Ok(())
 }
 
+/// Default ceiling on `sent/`, the local archive of already-delivered payloads.
+///
+/// Generous on purpose: `sent/` is not dead weight. `meridian logs` reads
+/// `pending/` AND `sent/` (`render::collect_all_records`), so without it local
+/// log history on a shipping install would be about thirty seconds deep, and
+/// `build_export_bundle` archives both. The point is a ceiling, not a purge.
+const DEFAULT_MAX_SENT_MB: u64 = 256;
+
+/// Ceiling for [`enforce_sent_cap`], overridable for operators with unusual
+/// retention needs.
+pub(super) fn max_sent_bytes() -> u64 {
+    let mb = std::env::var("MERIDIAN_TELEMETRY_MAX_SENT_MB")
+        .ok()
+        .and_then(|v| v.parse::<u64>().ok())
+        .unwrap_or(DEFAULT_MAX_SENT_MB);
+    mb.saturating_mul(1024 * 1024)
+}
+
+/// Drop the OLDEST already-shipped files once `sent/` exceeds its size cap.
+///
+/// # Why an age policy was not enough
+///
+/// `sent/` had a 7-day cutoff and no volume policy, so its size was whatever
+/// the emission rate produced inside that window. Measured on two machines:
+/// ~150k files and ~800 MB, with the module's own docs recording a ~264k-file
+/// steady state. Nothing in the code would have stopped 2 GB on a busier
+/// machine - the bound was on time, not on space.
+///
+/// That is not only a disk-usage problem. `build_export_bundle` archives every
+/// file in here, and `docs/privacy.md` asks the user to inspect the archive
+/// before sending it to support. Nobody inspects 150,000 protobuf files, so
+/// the consent step that makes Export Diagnostics acceptable was defeated by
+/// sheer count.
+///
+/// Evicts oldest-first by `(micros, seq)` - the same total order the shipper
+/// and [`enforce_pending_cap`] use - so the newest, most diagnostically useful
+/// records are the ones kept. Logged at `debug`, not `warn`: unlike the pending
+/// cap, dropping something already delivered to OpenObserve loses no data that
+/// was not already sent, so it is routine housekeeping rather than a fault.
+pub(super) fn enforce_sent_cap(sent: &Path) -> Result<()> {
+    let max = max_sent_bytes();
+
+    let Ok(entries) = std::fs::read_dir(sent) else {
+        return Ok(());
+    };
+
+    let mut files: Vec<(u64, u64, u64, PathBuf)> = entries
+        .flatten()
+        .filter_map(|e| {
+            let p = e.path();
+            let name = p.file_name()?.to_str()?.to_string();
+            if !name.ends_with(".otlp") {
+                return None;
+            }
+            let micros = micros_from_filename(&name)?;
+            let seq = seq_from_filename(&name)?;
+            let size = std::fs::metadata(&p).map(|m| m.len()).unwrap_or(0);
+            Some((micros, seq, size, p))
+        })
+        .collect();
+
+    files.sort_by_key(|(m, s, _, _)| (*m, *s));
+
+    let total: u64 = files.iter().map(|(_, _, s, _)| s).sum();
+    if total <= max {
+        return Ok(());
+    }
+
+    let mut to_drop = total - max;
+    let mut dropped_count = 0u64;
+    let mut dropped_bytes = 0u64;
+    for (_, _, size, path) in &files {
+        if to_drop == 0 {
+            break;
+        }
+        let _ = std::fs::remove_file(path);
+        dropped_bytes += size;
+        dropped_count += 1;
+        to_drop = to_drop.saturating_sub(*size);
+    }
+
+    if dropped_count > 0 {
+        tracing::debug!(
+            dropped_files = dropped_count,
+            dropped_bytes,
+            cap_bytes = max,
+            "sent telemetry cap exceeded - oldest already-shipped files dropped"
+        );
+    }
+
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -346,12 +453,15 @@ mod tests {
         let s = sent.join("traces-1-0.otlp");
         std::fs::write(&s, b"x").unwrap();
 
+        let quarantine = dir.path().join("quarantine");
+        std::fs::create_dir_all(&quarantine).unwrap();
+
         // Not due: survives a keep-nothing cutoff.
-        run_housekeeping(&pending, &sent, 0, false).unwrap();
+        run_housekeeping(&pending, &sent, &quarantine, 0, false).unwrap();
         assert!(s.exists(), "not-due housekeeping must not prune");
 
         // Due: the 0-second cutoff removes it.
-        run_housekeeping(&pending, &sent, 0, true).unwrap();
+        run_housekeeping(&pending, &sent, &quarantine, 0, true).unwrap();
         assert!(!s.exists(), "due housekeeping must prune");
     }
 
@@ -420,4 +530,84 @@ mod tests {
 
         std::env::remove_var("MERIDIAN_TELEMETRY_MAX_PENDING_MB");
     }
+
+    /// `quarantine/` was pruned by nothing and read by nothing - not by
+    /// retention, not by `build_export_bundle`, not by `meridian logs`. A
+    /// permanently-rejected payload was immortal AND invisible, the one
+    /// genuinely unbounded directory in the spool.
+    #[test]
+    fn housekeeping_prunes_quarantine_too() {
+        let dir = TempDir::new().unwrap();
+        let pending = pending_dir(dir.path());
+        std::fs::create_dir_all(&pending).unwrap();
+        let sent = dir.path().join("sent");
+        std::fs::create_dir_all(&sent).unwrap();
+        let quarantine = dir.path().join("quarantine");
+        std::fs::create_dir_all(&quarantine).unwrap();
+        let q = quarantine.join("traces-1-0.otlp");
+        std::fs::write(&q, b"rejected").unwrap();
+
+        run_housekeeping(&pending, &sent, &quarantine, 0, false).unwrap();
+        assert!(q.exists(), "not-due housekeeping must not prune quarantine");
+
+        run_housekeeping(&pending, &sent, &quarantine, 0, true).unwrap();
+        assert!(
+            !q.exists(),
+            "a quarantined payload must age out - it was previously immortal"
+        );
+    }
+
+    /// `sent/` had an age policy and NO volume policy, so its size was whatever
+    /// the emission rate produced inside the 7-day window (~800 MB / ~150k
+    /// files measured). The cap evicts oldest-first so the newest, most useful
+    /// records survive.
+    #[test]
+    fn the_sent_cap_evicts_oldest_first() {
+        let dir = TempDir::new().unwrap();
+        let sent = dir.path().join("sent");
+        std::fs::create_dir_all(&sent).unwrap();
+        // 3 files, ~4KB each, against a cap of 0MB -> everything over the cap
+        // goes, oldest first.
+        let oldest = sent.join("traces-100-0.otlp");
+        let middle = sent.join("traces-200-0.otlp");
+        let newest = sent.join("traces-300-0.otlp");
+        for p in [&oldest, &middle, &newest] {
+            std::fs::write(p, vec![b'x'; 4096]).unwrap();
+        }
+
+        std::env::set_var("MERIDIAN_TELEMETRY_MAX_SENT_MB", "0");
+        enforce_sent_cap(&sent).unwrap();
+        std::env::remove_var("MERIDIAN_TELEMETRY_MAX_SENT_MB");
+
+        assert!(!oldest.exists(), "the oldest shipped file must go first");
+        assert!(
+            !middle.exists() || !newest.exists(),
+            "the cap must actually reclaim space"
+        );
+    }
+
+    /// A `sent/` under its ceiling must be left completely alone - this is an
+    /// archive `meridian logs` reads, not scratch.
+    #[test]
+    fn the_sent_cap_keeps_everything_under_the_ceiling() {
+        let dir = TempDir::new().unwrap();
+        let sent = dir.path().join("sent");
+        std::fs::create_dir_all(&sent).unwrap();
+        let f = sent.join("traces-100-0.otlp");
+        std::fs::write(&f, b"small").unwrap();
+
+        enforce_sent_cap(&sent).unwrap();
+        assert!(f.exists(), "a spool under its cap must not be pruned");
+    }
+
+    /// The ceiling has to leave room for the log history it backs; a tiny cap
+    /// would silently turn `meridian logs` into a thirty-second window.
+    #[test]
+    fn the_sent_ceiling_leaves_room_for_real_log_history() {
+        let bytes = max_sent_bytes();
+        assert!(
+            bytes >= 64 * 1024 * 1024,
+            "sent/ backs `meridian logs`; {bytes} bytes is too small to be useful"
+        );
+    }
 }
diff --git a/src/telemetry_spool/shipper.rs b/src/telemetry_spool/shipper.rs
index 211a0d6c8..2fbbaaa43 100644
--- a/src/telemetry_spool/shipper.rs
+++ b/src/telemetry_spool/shipper.rs
@@ -137,9 +137,16 @@ async fn run_tick() -> Result<()> {
     {
         let pending = pending.clone();
         let sent = sent.clone();
+        let quarantine = quarantine.clone();
         let retention_secs = retention_days() * 24 * 3600;
         tokio::task::spawn_blocking(move || {
-            run_housekeeping(&pending, &sent, retention_secs, prune_due(tick))
+            run_housekeeping(
+                &pending,
+                &sent,
+                &quarantine,
+                retention_secs,
+                prune_due(tick),
+            )
         })
         .await
         .context("telemetry housekeeping task")??;

From b30e789498d373b6b6bfa7376569c97c9aa0ceed Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 1 Sep 2026 09:42:26 +0530
Subject: [PATCH 34/53] feat(llm): connect any OpenAI-compatible endpoint,
 local or cloud

Adds a base-URL + API-key path so a user can point Meridian at any
OpenAI-compatible server - Ollama or LM Studio on their own machine, a
vLLM box on the network, or a cloud provider on their own key.

Most of this already existed. `OpenAiCompatBackend`, the
`CustomLlmProvider` registry, the schema probe and `add_custom_llm_provider`
all take an arbitrary base URL already. Three things blocked it:

1. No UI path. The free-text form was deliberately deleted for standing on
   the no-subscription gate, where it handed a questionnaire to the one
   person who came to avoid one. That rationale is kept: the gate still
   routes straight to `<CloudKeySetup>`, and the new `<CustomEndpointSetup>`
   sits behind `!gate`, the same condition the existing cloud tiles use.
   It is not the old form rebuilt - no vendor dropdown (the vendor is a
   constant) and no hand-guessed rate-limit fields (0/0 = "not known").

2. The API key was mandatory at `validate_transport_inputs`, which made
   every keyless local server unconfigurable - and it gates the model
   listing too, so the flow died before the add. A blank key is now
   allowed; the newline-injection and scheme checks are untouched.

3. `.bearer_auth()` was unconditional, so a blank key sent `Authorization:
   Bearer ` - a well-formed header with an empty credential, which some
   servers reject. `with_auth` now sends no header at all.

The production gate is NOT weakened: an endpoint still has to measure at
`SchemaRung::JsonSchema` or better across all four pipeline schemas. When
it does not, the form names the rung it did hold instead of failing blankly.

Also fixes a bug this would have shipped: `usingHiddenCloud` matches any
vendor absent from CLOUD_PRESETS, so a self-configured endpoint would have
told its owner it was discontinued and not being sent requests.

Tests: the pinned "the add form stays gone" test passed unchanged against
this feature - it scanned for three identifiers the new file does not use.
Rewritten to pin the invariant that actually survives (the gate renders the
walkthrough, never the form) and verified to fail when the gate is pointed
at the form. Keyless validation and the absent auth header are pinned too.
---
 src/llm/openai_compat.rs                  |  70 +++-
 tray/src-tauri/src/commands/custom_llm.rs |  42 ++-
 ui/__tests__/llm-provider-gate.test.ts    |  76 +++-
 ui/components/CustomEndpointSetup.tsx     | 433 ++++++++++++++++++++++
 ui/components/LlmProviderPicker.tsx       | 148 +++++++-
 ui/lib/llm-providers.ts                   | 123 +++++-
 6 files changed, 855 insertions(+), 37 deletions(-)
 create mode 100644 ui/components/CustomEndpointSetup.tsx

diff --git a/src/llm/openai_compat.rs b/src/llm/openai_compat.rs
index 9124a56fb..d86e0e3d3 100644
--- a/src/llm/openai_compat.rs
+++ b/src/llm/openai_compat.rs
@@ -15,6 +15,11 @@
 //! the standard OpenAI chat-completions protocol; the deltas from a bare call are the
 //! base URL, `Authorization: Bearer`, and [`crate::llm::schema::strictify`] on the way out.
 //!
+//! # Not every endpoint has a key
+//! A self-hosted server (Ollama, LM Studio, llama.cpp, vLLM) typically has no auth, so an
+//! empty `api_key` is a supported configuration and [`with_auth`] then sends NO
+//! `Authorization` header — which is a different thing on the wire from an empty one.
+//!
 //! # Structured output is measured, never assumed
 //! "OpenAI-compatible" endpoints disagree about schemas — measured 2026-07-17, OpenAI
 //! rejects a schema whose `required` omits an optional key while Gemini's compat endpoint
@@ -140,6 +145,26 @@ async fn read_capped_body(mut resp: reqwest::Response) -> Result<String, LlmErro
     Ok(String::from_utf8_lossy(&buf).into_owned())
 }
 
+/// Attach `Authorization: Bearer <key>` — unless the endpoint is KEYLESS, in which case no
+/// auth header is sent at all.
+///
+/// An empty key is a real configuration, not a mistake: a self-hosted OpenAI-compatible
+/// server (Ollama, LM Studio, llama.cpp, vLLM) usually has no auth, and there is nothing to
+/// send it. The distinction matters on the wire — `.bearer_auth("")` sends a well-formed
+/// header with an empty credential, which is NOT the same as sending none, and some servers
+/// reject the former while accepting the latter. Sending nothing is also the honest
+/// description of what the user configured.
+///
+/// Whether an empty key is ALLOWED is decided at the door, in the tray's
+/// `validate_transport_inputs`; by the time a request is built the answer is already yes.
+fn with_auth(rb: reqwest::RequestBuilder, api_key: &str) -> reqwest::RequestBuilder {
+    if api_key.is_empty() {
+        rb
+    } else {
+        rb.bearer_auth(api_key)
+    }
+}
+
 /// Ask an OpenAI-compatible endpoint what models it serves — `GET <base_url>/models`.
 ///
 /// Takes the base URL and key rather than a [`CustomEndpoint`] because the main caller is the
@@ -177,9 +202,7 @@ pub async fn list_models(
         .build()
         .map_err(|e| LlmError::Failed(format!("custom provider client: {e}")))?;
 
-    let resp = client
-        .get(&url)
-        .bearer_auth(api_key)
+    let resp = with_auth(client.get(&url), api_key)
         .send()
         .await
         // As in `complete`: `e` can carry the URL but never the key (reqwest redacts auth).
@@ -262,9 +285,7 @@ impl LlmBackend for OpenAiCompatBackend {
             .build()
             .map_err(|e| LlmError::Failed(format!("custom provider client: {e}")))?;
 
-        let resp = client
-            .post(&url)
-            .bearer_auth(&ep.api_key)
+        let resp = with_auth(client.post(&url), &ep.api_key)
             .json(&body)
             .send()
             .await
@@ -495,6 +516,43 @@ fn classify_error(
     LlmError::Failed(format!("custom provider {status}: {head}"))
 }
 
+#[cfg(test)]
+mod auth_header_tests {
+    use super::*;
+
+    /// Build a request the way the real call sites do and report its `Authorization` header.
+    fn auth_of(api_key: &str) -> Option<String> {
+        let client = reqwest::Client::new();
+        let req = with_auth(client.get("http://localhost:11434/v1/models"), api_key)
+            .build()
+            .expect("request builds");
+        req.headers()
+            .get(reqwest::header::AUTHORIZATION)
+            .map(|v| v.to_str().unwrap_or_default().to_string())
+    }
+
+    /// A keyless endpoint must send NO `Authorization` header - not an empty one.
+    ///
+    /// The distinction is invisible in the source (`.bearer_auth("")` reads as "no key") and
+    /// very visible on the wire: it sends `Authorization: Bearer `, a well-formed header with
+    /// an empty credential, which some servers reject outright while accepting a request that
+    /// simply carries no auth. This is the whole reason a local model can be connected, so it
+    /// is pinned at the header rather than trusted to the call sites.
+    #[test]
+    fn a_keyless_endpoint_sends_no_authorization_header() {
+        assert_eq!(auth_of(""), None);
+    }
+
+    /// The other half: a key that IS present must still be sent, unchanged.
+    #[test]
+    fn a_key_is_still_sent_as_a_bearer_token() {
+        assert_eq!(
+            auth_of("sk-test-123"),
+            Some("Bearer sk-test-123".to_string())
+        );
+    }
+}
+
 #[cfg(test)]
 mod models_listing_tests {
     use super::*;
diff --git a/tray/src-tauri/src/commands/custom_llm.rs b/tray/src-tauri/src/commands/custom_llm.rs
index 26b560d5a..461460788 100644
--- a/tray/src-tauri/src/commands/custom_llm.rs
+++ b/tray/src-tauri/src/commands/custom_llm.rs
@@ -255,14 +255,27 @@ fn make_id(name: &str, existing: &[CustomLlmProvider]) -> String {
 /// drift — a rule enforced on the add path but not the listing path would be a rule with a
 /// hole in it.
 fn validate_transport_inputs(base_url: &str, api_key: &str) -> Result<(), String> {
-    if api_key.trim().is_empty() {
-        return Err("API key is required".into());
-    }
+    // NO EMPTY-KEY REJECTION, deliberately. A self-hosted OpenAI-compatible server (Ollama,
+    // LM Studio, llama.cpp, vLLM) usually has no auth at all, and there is no key for the
+    // user to invent - requiring one made every local endpoint unconfigurable, which is the
+    // gap this allowance exists to close. A blank key sends no `Authorization` header (see
+    // `openai_compat::with_auth`), so nothing is leaked by permitting it.
+    //
+    // A blank key against an endpoint that DOES require one is not silently accepted either:
+    // it fails at `list_models` or at the probe, both of which run during setup with the user
+    // watching, and both of which report a 401 in the vendor's own words. That is the right
+    // place to find out - unlike a wrong MODEL, which would only surface hours later.
+    //
+    // The reachability rule that was considered and rejected: allowing a blank key only for
+    // loopback/RFC1918 hosts. It would have refused Tailscale (100.64/10), Docker host
+    // aliases and reverse-proxied local models, all of them legitimate, in exchange for
+    // approximately no security - an EMPTY credential discloses nothing wherever it is sent.
     if !base_url.starts_with("http://") && !base_url.starts_with("https://") {
         return Err("base URL must start with http:// or https://".into());
     }
     // The key becomes an Authorization header and the URL becomes a request line: a newline
     // in either is header injection, exactly as `oo_email`/`oo_password` guard against.
+    // Still checked for a BLANK key: blank is allowed, whitespace-with-a-newline is not.
     for (field, v) in [("API key", api_key), ("base URL", base_url)] {
         if v.contains('\n') || v.contains('\r') {
             return Err(format!("{field} contains invalid characters"));
@@ -876,12 +889,33 @@ mod tests {
         assert!(validate("n", "https://x.test/v1", "m", "k").is_ok());
         assert!(validate("", "https://x.test/v1", "m", "k").is_err());
         assert!(validate("n", "https://x.test/v1", "", "k").is_err());
-        assert!(validate("n", "https://x.test/v1", "m", "").is_err());
         assert!(validate("n", "ftp://x.test", "m", "k").is_err());
         assert!(validate("n", "https://x.test/v1", "m", "k\nX-Evil: 1").is_err());
         assert!(validate("n", "https://x.test/v1\r\nHost: evil", "m", "k").is_err());
     }
 
+    /// A KEYLESS endpoint is a supported configuration, not a half-filled form.
+    ///
+    /// This assertion used to read `is_err()` - "API key is required" - and that single line
+    /// was the whole reason no self-hosted server could be configured: Ollama, LM Studio,
+    /// llama.cpp and vLLM serve the OpenAI protocol with no auth, so there is no key for the
+    /// user to type. Both doors are pinned here because they are separate call sites of the
+    /// shared validator, and the listing one runs FIRST in the setup flow - leaving it strict
+    /// would have failed the flow at "ask the endpoint what it serves", before the add.
+    #[test]
+    fn a_keyless_endpoint_is_allowed_at_both_doors() {
+        assert!(validate("local", "http://localhost:11434/v1", "llama3", "").is_ok());
+        assert!(validate_transport_inputs("http://localhost:1234/v1", "").is_ok());
+        // Plain http is what a local server actually speaks - the scheme check must not have
+        // quietly become https-only while the key rule was being relaxed.
+        assert!(validate_transport_inputs("http://127.0.0.1:8000/v1", "").is_ok());
+        // Blank is allowed; blank-with-a-newline is still header injection.
+        assert!(validate_transport_inputs("http://localhost:11434/v1", " \n ").is_err());
+        // Relaxing the key must not have relaxed anything else on the same path.
+        assert!(validate("local", "localhost:11434", "llama3", "").is_err());
+        assert!(validate("local", "http://localhost:11434/v1", "", "").is_err());
+    }
+
     /// One unreadable row must not cost the user every other endpoint.
     #[test]
     fn an_unreadable_row_is_dropped_not_fatal() {
diff --git a/ui/__tests__/llm-provider-gate.test.ts b/ui/__tests__/llm-provider-gate.test.ts
index 1c34a8c47..10cddff3e 100644
--- a/ui/__tests__/llm-provider-gate.test.ts
+++ b/ui/__tests__/llm-provider-gate.test.ts
@@ -17,6 +17,7 @@ const uiRoot = import.meta.dir + '/..'
 const gate = readFileSync(`${uiRoot}/components/LlmProviderGate.tsx`, 'utf8')
 const cloudSetup = readFileSync(`${uiRoot}/components/CloudKeySetup.tsx`, 'utf8')
 const picker = readFileSync(`${uiRoot}/components/LlmProviderPicker.tsx`, 'utf8')
+const customSetup = readFileSync(`${uiRoot}/components/CustomEndpointSetup.tsx`, 'utf8')
 
 describe('the subscription gate', () => {
   it('asks about all three subscriptions by name', () => {
@@ -118,20 +119,73 @@ describe('the no-subscription presets', () => {
     expect(presetForVendor('does-not-exist')).toBeUndefined()
   })
 
-  it('is the only way an endpoint gets added', () => {
-    // Gemini / OpenRouter / OpenAI / a free-text endpoint all made the no-subscription path
-    // a configuration exercise for someone who came here to avoid one. Once the preset list
-    // was down to a curated set the add FORM was a questionnaire nobody needed, so it and
-    // its tile went too - this pins that they stay gone.
+  it('is the only way an endpoint gets added ON THE NO-SUBSCRIPTION PATH', () => {
+    // WHAT THIS PINS CHANGED, and the old version would not have noticed.
+    //
+    // It used to scan for three dead identifiers (`AddCustomProvider`, `AddForm`,
+    // `CUSTOM_VENDOR_PRESETS`) to pin that the free-text add form stayed deleted. A form has
+    // since been deliberately restored as `<CustomEndpointSetup>`, for the separate need of
+    // connecting an arbitrary OpenAI-compatible endpoint - and every one of those three
+    // assertions still passed, because none of those words appears in the new file. A test
+    // that cannot fail when the thing it describes is reversed is not protecting anything.
+    //
+    // So it now pins the invariant that actually still holds, which was always the real one:
+    // the GATE - the "I have no subscription" answer - routes to the walkthrough and never to
+    // a form. What made the deleted form wrong was where it stood, not that it existed.
+    const gateBranch = picker.slice(
+      picker.indexOf("gateAnswer === 'free'"),
+      picker.indexOf('const usingHidden'),
+    )
+    expect(gateBranch.length).toBeGreaterThan(0)
+    expect(gateBranch).toContain('<CloudKeySetup')
+    expect(gateBranch).not.toContain('<CustomEndpointSetup')
+
+    // And the form is reachable ONLY behind `!gate`, so a first-run user never meets it.
+    const customTile = picker.slice(
+      picker.indexOf('<CustomEndpointTile'),
+      picker.indexOf('<CustomEndpointTile') + 400,
+    )
+    expect(customTile.length).toBeGreaterThan(0)
+    const beforeTile = picker.slice(0, picker.indexOf('<CustomEndpointTile'))
+    expect(beforeTile.endsWith('{!gate && (\n          ')).toBe(true)
+
+    // The registry write survives on both paths, and neither reimplements it.
     const providers = readFileSync(`${uiRoot}/components/CustomProviders.tsx`, 'utf8')
-    for (const dead of ['AddCustomProvider', 'AddForm', 'CUSTOM_VENDOR_PRESETS']) {
-      expect(providers.includes(dead)).toBe(false)
-      expect(picker.includes(dead)).toBe(false)
-    }
-    // But the registry write itself survives - CloudKeySetup is what calls it now, for
-    // whichever preset it was opened with.
     expect(providers).toContain('add_custom_llm_provider')
     expect(cloudSetup).toContain('onAdd(')
+    expect(customSetup).toContain('onAdd(')
+  })
+
+  it('never asks a self-configured endpoint for a vendor or a rate limit', () => {
+    // The three fields that made the OLD form a questionnaire: an open-ended vendor dropdown
+    // (unanswerable - an OpenAI-compatible URL could be anything), and two hand-typed
+    // rate-limit numbers nobody can know for a server they have never seen. The vendor is a
+    // constant now, and the limits are written as 0/0, which `llm_capacity::assess` reads as
+    // "not known" rather than "unmetered".
+    expect(customSetup).toContain('CUSTOM_ENDPOINT_VENDOR')
+    expect(customSetup).toContain('rpm: 0, rpd: 0')
+    for (const dead of ['CUSTOM_VENDOR_PRESETS', 'customVendorPreset']) {
+      expect(customSetup.includes(dead)).toBe(false)
+    }
+  })
+
+  it('lets a self-configured endpoint have no API key at all', () => {
+    // The single reason a local model (Ollama, LM Studio, llama.cpp, vLLM) can be connected
+    // at all: those servers have no auth, so there is no key to type. Rust permits the blank
+    // one at the door and then sends no Authorization header; the form must say so rather
+    // than leaving the user guessing whether blank is allowed.
+    expect(customSetup).toContain('Leave blank if your server does not need one')
+    // The key must never be a precondition for the model listing either - that call runs
+    // FIRST, so gating it on a key would fail the flow before the add.
+    expect(customSetup).toContain('apiKey: apiKey.trim()')
+  })
+
+  it('tells the user WHICH structured-reply mode an endpoint failed', () => {
+    // A local model that answers fine in prose can still sit below the production gate
+    // (`SchemaRung::JsonSchema` across all four pipeline schemas). "It did not work" would
+    // read as a broken button; naming the measured rung is what makes it actionable.
+    expect(customSetup).toContain('rungLabel(outcome.provider.effective_rung)')
+    expect(customSetup).toContain('production_eligible')
   })
 
   for (const preset of [GROQ, OLLAMA]) {
diff --git a/ui/components/CustomEndpointSetup.tsx b/ui/components/CustomEndpointSetup.tsx
new file mode 100644
index 000000000..c62dcc55e
--- /dev/null
+++ b/ui/components/CustomEndpointSetup.tsx
@@ -0,0 +1,433 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+'use client'
+
+// Connect ANY OpenAI-compatible endpoint - a local model or a cloud key - from a base URL.
+//
+// The advanced sibling of <CloudKeySetup>. That one is a walkthrough for someone who said
+// they have no subscription and wants a working key in three clicks; this one is a form for
+// someone who already has an endpoint in mind and needs to describe it. Keeping them apart
+// is deliberate and is the whole reason the deleted add-form's rationale still holds: the
+// no-subscription path never shows this, and the picker only offers it behind `!gate`.
+//
+// # Only what the user can actually tell us
+//
+// Three fields, and no more. The old form's vendor dropdown is gone (the vendor is always
+// `custom` - see `CUSTOM_ENDPOINT_VENDOR`) and so are its two rate-limit boxes: nobody can
+// state the RPM of a server we have never seen, and a guessed number is worse than `0`,
+// which `meridian_core::llm_capacity::assess` reads as "not known" rather than "unmetered".
+//
+// # The API key is optional, and that is the point
+//
+// A local server (Ollama, LM Studio, llama.cpp, vLLM) has no auth, so there is no key to
+// type. Rust permits a blank one at the door (`validate_transport_inputs`) and then sends no
+// `Authorization` header at all (`openai_compat::with_auth`). A blank key against an endpoint
+// that DOES want one fails here, at setup, with the server's own 401 - not hours later.
+//
+// # The model comes from the endpoint, and can still be typed
+//
+// `/models` is asked first, because a mistyped model id is the one error that would not
+// surface until the first real hour. But plenty of OpenAI-compatible servers do not implement
+// `/models` at all, so a failed listing degrades to a text field rather than blocking - the
+// same degradation `openai_compat::list_models` documents for its callers.
+//
+// # Who calls this
+// [`LlmProviderPicker`], for the `custom` vendor tile - never from the gate.
+//
+// # Related
+// - `@/lib/llm-providers` - `CUSTOM_ENDPOINT_VENDOR`, `chatCapableModels`, `rungLabel`
+// - `@/components/CloudKeySetup` - the curated-preset path this deliberately does not merge with
+// - `@/components/CustomProviders` - the registry hook this writes through
+
+import { BackLink } from '@/components/ui/BackLink'
+import { useState } from 'react'
+import { invoke } from '@/lib/bridge'
+import {
+  chatCapableModels, CUSTOM_ENDPOINT_VENDOR, rungLabel, type CustomProviderView,
+  type ProbeOutcome,
+} from '@/lib/llm-providers'
+
+/** The registry write, shared with `<CloudKeySetup>` - `useCustomProviders().add`. */
+type AddFn = (fields: {
+  vendor: string; name: string; base_url: string; model: string
+  api_key: string; rpm: number; rpd: number
+}) => Promise<ProbeOutcome>
+
+type Phase = 'idle' | 'listing' | 'adding' | 'selecting' | 'done'
+
+/** A default name from the URL's host, so the common case needs no thought.
+ *
+ *  Host and port only: two LM Studio instances on different ports are different endpoints and
+ *  must not collide, but the path segment (`/v1`) is noise in a name. Falls back to the raw
+ *  string when `URL` cannot parse it - the field is editable and Rust validates the URL
+ *  properly, so a bad parse here must never block typing. */
+function nameFromUrl(raw: string): string {
+  try {
+    return new URL(raw).host
+  } catch {
+    return raw.replace(/^https?:\/\//, '').split('/')[0] ?? ''
+  }
+}
+
+export default function CustomEndpointSetup({ existing, onBack, onAdd, onPick }: {
+  /** Every endpoint already configured - used ONLY to keep the name unique up front. The
+   *  tray rejects a duplicate name permanently, and it does so AFTER the probe has already
+   *  been paid for, so catching it before the request is the difference between a retryable
+   *  form and a dead end. */
+  existing: CustomProviderView[]
+  onBack: () => void
+  onAdd: AddFn
+  /** Make the freshly added endpoint the live provider. Rejects if the tray refuses. */
+  onPick: (customId: string) => void | Promise<void>
+}) {
+  const [baseUrl, setBaseUrl] = useState('')
+  const [apiKey, setApiKey] = useState('')
+  const [model, setModel] = useState('')
+  const [name, setName] = useState('')
+  const [nameEdited, setNameEdited] = useState(false)
+  const [models, setModels] = useState<string[] | null>(null)
+  const [listError, setListError] = useState<string | null>(null)
+  const [phase, setPhase] = useState<Phase>('idle')
+  const [error, setError] = useState<string | null>(null)
+  // Set once the endpoint EXISTS daemon-side. From here a retry must RE-MEASURE rather than
+  // re-add: the tray refuses a duplicate name forever, so a second add can never succeed and
+  // the screen would be a dead end. Same failure `<CloudKeySetup>` is shaped around.
+  const [addedId, setAddedId] = useState<string | null>(null)
+
+  const busy = phase === 'listing' || phase === 'adding' || phase === 'selecting'
+  const url = baseUrl.trim()
+  const effectiveName = (name.trim() || nameFromUrl(url)).trim()
+  const canList = !busy && !!url
+  // Once the endpoint is SAVED the button must stay live on the fields alone being empty:
+  // the retry path re-measures a row the daemon already holds, so it needs no URL, key or
+  // model from the form. Gating it on the form fields is what made `<CloudKeySetup>`'s
+  // equivalent a dead end after a rate-limited probe.
+  const canConnect = !busy && (addedId !== null || (!!url && !!model.trim() && !!effectiveName))
+
+  /** Ask the endpoint what it serves. Doubles as the first real check that the URL (and the
+   *  key, if the server wants one) work at all - before anything is written to settings. */
+  async function listModels() {
+    if (!canList) return
+    setListError(null)
+    setError(null)
+    setPhase('listing')
+    try {
+      const ids = await invoke<string[]>('list_custom_llm_provider_models', {
+        baseUrl: url,
+        apiKey: apiKey.trim(),
+      })
+      const usable = chatCapableModels(ids)
+      setModels(usable)
+      // Only preselect when there is no ambiguity. Picking the first of many would put a
+      // model in the field the user never chose, and a wrong model fails at the first real
+      // hour rather than here.
+      if (usable.length === 1) setModel(usable[0])
+      if (usable.length === 0) {
+        setListError(
+          ids.length > 0
+            ? 'This endpoint listed only non-chat models (embeddings, speech). Type a model id below if you know one it can chat with.'
+            : 'This endpoint listed no models. Type the model id below.',
+        )
+      }
+    } catch (e) {
+      // NOT fatal. Many OpenAI-compatible servers do not implement /models, and refusing to
+      // continue would make a working endpoint unconfigurable over an optional convenience.
+      setModels([])
+      setListError(
+        `${String(e).replace(/^Error:\s*/, '')} - type the model id below if you know it.`,
+      )
+    } finally {
+      setPhase('idle')
+    }
+  }
+
+  async function connect() {
+    if (busy) return
+    setError(null)
+    try {
+      let outcome: ProbeOutcome
+      if (addedId) {
+        // RETRY, endpoint already saved: re-measure the row rather than create a second one.
+        setPhase('adding')
+        outcome = await invoke<ProbeOutcome>('probe_custom_llm_provider', {
+          id: addedId, refresh: true,
+        })
+      } else {
+        if (!model.trim()) throw new Error('Choose or type a model first.')
+        if (existing.some((p) => p.name.toLowerCase() === effectiveName.toLowerCase())) {
+          throw new Error(`You already have an endpoint named "${effectiveName}". Give this one a different name.`)
+        }
+        setPhase('adding')
+        outcome = await onAdd({
+          vendor: CUSTOM_ENDPOINT_VENDOR,
+          name: effectiveName,
+          base_url: url,
+          model: model.trim(),
+          api_key: apiKey.trim(),
+          // `0/0` is "not known", NOT "unmetered" - see `llm_capacity::assess`. There is no
+          // published limit to read for an endpoint the user brought, and inventing one would
+          // produce a confident verdict about a quota nobody measured.
+          rpm: 0, rpd: 0,
+        })
+        // Recorded BEFORE the eligibility check: the row exists now however that check goes.
+        setAddedId(outcome.provider.id)
+      }
+
+      if (!outcome.provider.production_eligible) {
+        // Say WHICH limitation, not just "failed". The gate wants shape-enforced JSON
+        // (`SchemaRung::JsonSchema` or better) on all four pipeline schemas, and an endpoint
+        // that answers fine in prose can still sit below it - most often a small local model.
+        // Naming the measured rung is what makes this actionable rather than a dead button.
+        const measured = rungLabel(outcome.provider.effective_rung)
+        throw new Error(
+          outcome.incomplete
+            ? `Measuring stopped early: ${outcome.incomplete}. Press Connect again to finish.`
+            : `${outcome.provider.model} answered, but the strongest structured-reply mode it ` +
+              `held across all of Meridian's schemas was "${measured}". Meridian needs enforced ` +
+              `JSON, so it cannot run the pipeline on this model. Try a larger or ` +
+              `instruction-tuned model on the same endpoint - the endpoint is saved, so you ` +
+              `can change its model and re-test from Settings.`,
+        )
+      }
+
+      setPhase('selecting')
+      await onPick(outcome.provider.id)
+      setApiKey('')  // stored daemon-side now, and it never comes back
+      setPhase('done')
+    } catch (e) {
+      setError(String(e).replace(/^Error:\s*/, ''))
+      setPhase('idle')
+    }
+  }
+
+  if (phase === 'done') {
+    return (
+      <div className="flex flex-col mer-pop" style={{ gap: 10, alignItems: 'flex-start' }}>
+        <span className="font-mono self-start" style={{
+          fontSize: 9, letterSpacing: '.1em', color: 'var(--color-state-approved)',
+          border: '1px solid var(--color-state-approved)',
+          background: 'color-mix(in srgb, var(--color-state-approved) 10%, transparent)',
+          borderRadius: 4, padding: '2px 7px',
+        }}>CONNECTED</span>
+        <span style={{ fontSize: 17, fontWeight: 600, color: 'var(--t-title)' }}>
+          You&apos;re set up
+        </span>
+        <p style={{ fontSize: 12, lineHeight: 1.5, color: 'var(--t-muted)', maxWidth: 480 }}>
+          Meridian is using {effectiveName} ({model}) to write your summaries. You can change
+          this any time in Settings.
+        </p>
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex flex-col" style={{ gap: 14 }}>
+      <BackLink onClick={onBack}>Back</BackLink>
+
+      <div className="flex flex-col" style={{ gap: 5 }}>
+        <span style={{ fontSize: 19, fontWeight: 600, color: 'var(--t-title)', letterSpacing: '-.01em' }}>
+          Connect your own endpoint
+        </span>
+        <p style={{ fontSize: 12.5, lineHeight: 1.5, color: 'var(--t-muted)', maxWidth: 520 }}>
+          Anything that speaks the OpenAI chat-completions API - Ollama or LM Studio on this
+          machine, a server on your network, or a cloud provider on your own key.
+        </p>
+      </div>
+
+      {/* Stated, not implied. A local endpoint is the reason most people are on this screen,
+          and "does my screen data leave this machine" is the question it raises. The honest
+          answer depends entirely on the URL they type, so this says exactly that rather than
+          borrowing a preset's privacy badge for a server we know nothing about. */}
+      <p style={{
+        fontSize: 11.5, lineHeight: 1.45, color: 'var(--t-muted)',
+        background: 'var(--t-box)', border: '1px solid var(--t-ctrl-border)',
+        borderRadius: 9, padding: '9px 11px', maxWidth: 520,
+      }}>
+        Meridian sends one hour of activity at a time to whatever address you enter here. Point
+        it at a model on this machine and nothing leaves it; point it at a cloud provider and
+        their privacy policy applies, not ours.
+      </p>
+
+      <Step n={1} title="Where is it?"
+        body="The base URL, including the version segment - Meridian adds /chat/completions itself.">
+        <div className="flex flex-col" style={{ gap: 8 }}>
+          <Field
+            label="Base URL"
+            value={baseUrl}
+            onChange={(v) => {
+              setBaseUrl(v)
+              setModels(null)
+              setListError(null)
+              if (!nameEdited) setName('')
+            }}
+            placeholder="http://localhost:11434/v1"
+            disabled={busy}
+            mono
+          />
+          <Field
+            label="API key"
+            hint="Leave blank if your server does not need one - most local models do not."
+            value={apiKey}
+            onChange={setApiKey}
+            placeholder="Optional"
+            disabled={busy}
+            password
+            mono
+          />
+        </div>
+      </Step>
+
+      <Step n={2} title="Which model?"
+        body="Meridian asks the endpoint what it serves. If it does not answer, type the id yourself.">
+        <div className="flex flex-col" style={{ gap: 8 }}>
+          <button
+            onClick={listModels}
+            disabled={!canList}
+            className="self-start"
+            style={{
+              fontSize: 11.5, fontWeight: 600, color: 'var(--t-title)',
+              padding: '6px 11px', borderRadius: 8,
+              background: 'var(--t-ctrl)', border: '1px solid var(--t-ctrl-border)',
+              opacity: canList ? 1 : 0.5,
+              cursor: canList ? 'pointer' : 'default',
+            }}>
+            {phase === 'listing' ? 'Asking the endpoint…' : 'List models'}
+          </button>
+
+          {models && models.length > 0 && (
+            <select
+              value={model}
+              onChange={(e) => setModel(e.target.value)}
+              disabled={busy}
+              style={{
+                fontSize: 12, padding: '8px 10px', borderRadius: 8, width: '100%',
+                border: '1px solid var(--t-ctrl-border)', background: 'var(--t-ctrl)',
+                color: 'var(--t-title)', cursor: busy ? 'default' : 'pointer',
+              }}>
+              <option value="">Choose a model…</option>
+              {models.map((m) => <option key={m} value={m}>{m}</option>)}
+            </select>
+          )}
+
+          {/* Always available, never only as a fallback: a server may list a hundred models
+              and the user may know exactly which one they want. */}
+          <Field
+            label="Model id"
+            value={model}
+            onChange={setModel}
+            placeholder="llama3.1:8b"
+            disabled={busy}
+            mono
+          />
+
+          {listError && (
+            <p style={{ fontSize: 11, lineHeight: 1.45, color: 'var(--t-muted)' }}>{listError}</p>
+          )}
+        </div>
+      </Step>
+
+      <Step n={3} title="Name it and connect"
+        body="Meridian checks the endpoint can return the structured replies the pipeline needs.">
+        <div className="flex flex-col" style={{ gap: 8 }}>
+          <Field
+            label="Name"
+            value={name}
+            onChange={(v) => { setName(v); setNameEdited(true) }}
+            placeholder={nameFromUrl(url) || 'My endpoint'}
+            disabled={busy}
+          />
+          <button
+            onClick={connect}
+            disabled={!canConnect}
+            className="self-start"
+            style={{
+              fontSize: 12, fontWeight: 700, color: '#fff', padding: '8px 14px',
+              borderRadius: 9, border: 'none',
+              background: 'var(--btn-primary-bg)',
+              opacity: canConnect ? 1 : 0.5,
+              cursor: canConnect ? 'pointer' : 'default',
+            }}>
+            {phase === 'adding' ? 'Testing the endpoint…'
+              : phase === 'selecting' ? 'Almost there…'
+                : addedId ? 'Re-test and connect' : 'Connect'}
+          </button>
+          {/* Named, because this step runs real requests and can sit for a while. */}
+          {phase === 'adding' && (
+            <span style={{ fontSize: 10.5, lineHeight: 1.4, color: 'var(--t-faint)' }}>
+              Checking which replies {model} can give - this takes a few seconds.
+            </span>
+          )}
+          {error && (
+            <p style={{
+              fontSize: 11.5, lineHeight: 1.45, color: 'var(--color-state-pending)',
+              background: 'color-mix(in srgb, var(--color-state-pending) 10%, transparent)',
+              borderRadius: 8, padding: '8px 10px',
+            }}>{error}</p>
+          )}
+        </div>
+      </Step>
+    </div>
+  )
+}
+
+/** A labelled text input. Local to this file: the shape is specific to this form, and the
+ *  repo has no shared field primitive to reach for. */
+function Field({ label, hint, value, onChange, placeholder, disabled, mono, password }: {
+  label: string
+  hint?: string
+  value: string
+  onChange: (v: string) => void
+  placeholder: string
+  disabled: boolean
+  mono?: boolean
+  password?: boolean
+}) {
+  return (
+    <label className="flex flex-col" style={{ gap: 4 }}>
+      <span className="font-mono" style={{
+        fontSize: 9, letterSpacing: '.09em', color: 'var(--t-faint)',
+      }}>{label.toUpperCase()}</span>
+      <input
+        type={password ? 'password' : 'text'}
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        placeholder={placeholder}
+        spellCheck={false}
+        autoComplete="off"
+        disabled={disabled}
+        style={{
+          fontSize: 12, padding: '8px 10px', borderRadius: 8, width: '100%',
+          border: '1px solid var(--t-ctrl-border)', background: 'var(--t-ctrl)',
+          color: 'var(--t-title)',
+          fontFamily: mono ? 'var(--font-mono, ui-monospace)' : undefined,
+          opacity: disabled ? 0.6 : 1,
+        }}
+      />
+      {hint && (
+        <span style={{ fontSize: 10.5, lineHeight: 1.4, color: 'var(--t-faint)' }}>{hint}</span>
+      )}
+    </label>
+  )
+}
+
+/** One numbered step - the same affordance `<CloudKeySetup>` uses, so the two screens read
+ *  as the same product. Duplicated rather than shared because they are three lines of markup
+ *  and lifting them into a shared module would couple two screens that are deliberately
+ *  diverging. */
+function Step({ n, title, body, children }: {
+  n: number; title: string; body: string; children: React.ReactNode
+}) {
+  return (
+    <div className="flex items-start" style={{ gap: 11 }}>
+      <span className="flex items-center justify-center shrink-0 font-mono" style={{
+        width: 22, height: 22, borderRadius: 999, fontSize: 10.5, fontWeight: 700,
+        background: 'var(--t-box)', border: '1px solid var(--t-ctrl-border)',
+        color: 'var(--t-title)', marginTop: 1,
+      }}>{n}</span>
+      <div className="flex flex-col min-w-0 flex-1" style={{ gap: 5 }}>
+        <span style={{ fontSize: 13, fontWeight: 600, color: 'var(--t-title)' }}>{title}</span>
+        <span style={{ fontSize: 11.5, lineHeight: 1.45, color: 'var(--t-muted)' }}>{body}</span>
+        {children}
+      </div>
+    </div>
+  )
+}
diff --git a/ui/components/LlmProviderPicker.tsx b/ui/components/LlmProviderPicker.tsx
index ff5ca91c6..29e419642 100644
--- a/ui/components/LlmProviderPicker.tsx
+++ b/ui/components/LlmProviderPicker.tsx
@@ -26,9 +26,10 @@
 import { BackLink } from '@/components/ui/BackLink'
 import { useCallback, useState } from 'react'
 import {
-  CHOOSER_PROVIDER_IDS, CLOUD_PRESETS, customVariantId, LLM_RANK_FREE, LLM_RANK_SUBSCRIPTION,
-  LLM_RECOMMENDED_NOTE, llmProvider, presetForVendor, type CloudKeyPreset, type CustomProviderView,
-  type LlmProviderId, type LlmRank,
+  CHOOSER_PROVIDER_IDS, CLOUD_PRESETS, CUSTOM_ENDPOINT_DISPLAY, CUSTOM_ENDPOINT_VENDOR,
+  customVariantId, LLM_RANK_CUSTOM, LLM_RANK_FREE, LLM_RANK_SUBSCRIPTION,
+  LLM_RECOMMENDED_NOTE, llmProvider, presetForVendor, type CustomProviderView,
+  type CloudKeyPreset, type LlmProviderId, type LlmRank, type VendorDisplay,
 } from '@/lib/llm-providers'
 import type {
   InstallOutcome, ProviderStatus, ProviderTestOutcome, ProviderTestResult,
@@ -37,6 +38,7 @@ import { CustomVendorLogo, ProviderLogo } from '@/components/LlmProviderLogos'
 import LlmProviderDetail, { phaseFor, type Phase } from '@/components/LlmProviderDetail'
 import LlmProviderGate, { Badge } from '@/components/LlmProviderGate'
 import CloudKeySetup from '@/components/CloudKeySetup'
+import CustomEndpointSetup from '@/components/CustomEndpointSetup'
 
 // Re-exported so the existing `from '@/components/LlmProviderPicker'` imports
 // keep resolving. The definitions now live in api-types.ts, per the repo rule
@@ -280,6 +282,42 @@ export interface LlmProviderPickerProps {
   gate?: boolean
 }
 
+/** The self-configured endpoint's grid tile.
+ *
+ *  Separate from `CloudPresetTile` rather than a `preset`-less mode of it: that one is built
+ *  around a `CloudKeyPreset` it can always name and badge, and this vendor has no preset at
+ *  all. The two do share `vendorPhaseFor`, so a configured endpoint's tile and its card can
+ *  never disagree about whether it is answering - the bug that rule exists to prevent. */
+function CustomEndpointTile({ value, selectedCustomId, status, custom, onOpen }: {
+  value: LlmProviderId
+  selectedCustomId: string | null
+  status: Record<string, ProviderStatus>
+  custom: ReturnType<typeof useCustomProviders>
+  onOpen: () => void
+}) {
+  const rows = custom.providers.filter((p) => p.vendor === CUSTOM_ENDPOINT_VENDOR)
+  const { selectedRow, phase: computedPhase } = vendorPhaseFor(rows, selectedCustomId, status)
+  const selected = value === 'custom' && !!selectedRow
+  // Only a SELECTED row's ladder answers - same rule as `CloudPresetTile`, for the same
+  // reason: an unselected vendor showing a borrowed status reads as a claim about a provider
+  // that is not running.
+  const phase = selected ? computedPhase : phaseFor(false, false, false, undefined, null)
+  return (
+    <ChooserTile
+      id="custom"
+      // The row's own name once one exists - the user named it after their own server, and
+      // "Custom endpoint" would be a worse label than the one they chose.
+      name={selectedRow ? selectedRow.name : CUSTOM_ENDPOINT_DISPLAY.name}
+      rank={LLM_RANK_CUSTOM}
+      selected={selected}
+      subtitle={selectedRow ? `Uses your ${selectedRow.name} endpoint.` : CUSTOM_ENDPOINT_DISPLAY.blurb}
+      phase={phase}
+      logo={<CustomVendorLogo vendor={CUSTOM_ENDPOINT_VENDOR} size={21} />}
+      onOpen={onOpen}
+    />
+  )
+}
+
 export default function LlmProviderPicker({
   value, selectedCustomId, onChange, status, scanning, testingIds, installingIds, signingIds,
   testOne, install, signIn, rescan, gate = false,
@@ -303,6 +341,10 @@ export default function LlmProviderPicker({
   // the main grid's per-vendor tiles - those already know their vendor and skip straight to
   // whichever screen (wizard or registry) that vendor needs, via `openVendor` instead.
   const [pendingPreset, setPendingPreset] = useState<CloudKeyPreset | null>(null)
+  // "Add another" on the self-configured vendor's registry view. A separate flag from
+  // `pendingPreset` because that one carries WHICH preset, and this vendor has none - the
+  // question it answers is only "form or registry view".
+  const [addingCustom, setAddingCustom] = useState(false)
   // A provider the user picked DURING this gated flow. Under the gate nothing is shown as
   // selected on arrival (`value` falls back to Claude whether or not it works), but once
   // they have actually chosen one, coming back to the grid must show which - otherwise the
@@ -358,8 +400,15 @@ export default function LlmProviderPicker({
   // stranded, here's what you're on and where to go" line - otherwise the screen just looks
   // empty where their provider used to be, with no explanation.
   const activeRow = custom.providers.find((p) => p.id === selectedCustomId)
+  //
+  // The `custom` vendor is excluded EXPLICITLY, and this is not a cosmetic exclusion: it is
+  // not in `CLOUD_PRESETS` (it never can be - it has no preset), so without this clause every
+  // self-configured endpoint would match "not an offered preset" and its owner would be told
+  // their working endpoint is discontinued and that Meridian is not sending it any requests.
+  // Both halves of that would be false, and it now has a tile of its own to go back to.
   const usingHiddenCloud =
-    value === 'custom' && !!activeRow && !CLOUD_PRESETS.some((p) => p.vendor === activeRow.vendor)
+    value === 'custom' && !!activeRow && activeRow.vendor !== CUSTOM_ENDPOINT_VENDOR
+    && !CLOUD_PRESETS.some((p) => p.vendor === activeRow.vendor)
 
   // Every preset tile the grid shows: exactly the OFFERED presets (Ollama), full stop.
   //
@@ -393,6 +442,52 @@ export default function LlmProviderPicker({
     )
   }
 
+  // The SELF-CONFIGURED vendor, handled before the preset lookup below because it has no
+  // preset and never will: there is no key URL, sign-up copy or published free-tier limit to
+  // put in one (see `CUSTOM_ENDPOINT_VENDOR`). Falling through would hit the `!preset`
+  // dead-end BackLink and make the tile unopenable.
+  if (openId === 'custom' && openVendor === CUSTOM_ENDPOINT_VENDOR) {
+    const customRows = custom.providers.filter((p) => p.vendor === CUSTOM_ENDPOINT_VENDOR)
+    const backToGrid = () => { setOpenId(null); setOpenVendor(null); setAddingCustom(false) }
+    // Nothing configured yet, or "Add another" pressed: the form owns the screen. `!custom.loading`
+    // so a slow registry read cannot flash the form at someone who already has endpoints.
+    if (addingCustom || (!custom.loading && customRows.length === 0)) {
+      return (
+        <CustomEndpointSetup
+          // EVERY row, not just this vendor's: the tray rejects a duplicate name across the
+          // whole registry, so a check scoped to `custom` rows would miss a clash with an
+          // Ollama or Groq row and fail after the probe was already paid for.
+          existing={custom.providers}
+          onBack={customRows.length > 0 ? () => setAddingCustom(false) : backToGrid}
+          onAdd={custom.add}
+          onPick={(id) => commitAndMark('custom', id)}
+        />
+      )
+    }
+    const { selectedRow, phase: vendorPhase } = vendorPhaseFor(customRows, selectedCustomId ?? null, status)
+    return (
+      <CustomDetail
+        display={CUSTOM_ENDPOINT_DISPLAY}
+        providers={customRows}
+        value={value}
+        selectedCustomId={selectedCustomId ?? null}
+        live={!TILE_NOT_LIVE.includes(vendorPhase.kind)}
+        statusDetail={'message' in vendorPhase ? vendorPhase.message : undefined}
+        custom={custom}
+        onBack={backToGrid}
+        onPick={(id) => commitAndMark('custom', id)}
+        // Always offered, unlike a retired preset: a second endpoint here is a normal thing
+        // to want (a local model and a cloud key, say), and nothing about this vendor can be
+        // discontinued - it is whatever address the user types.
+        onAddAnother={() => setAddingCustom(true)}
+        onVerify={async () => {
+          await testOne(selectedRow ? customVariantId(selectedRow.id) : 'custom')
+          rescan()
+        }}
+      />
+    )
+  }
+
   if (openId === 'custom' && openVendor) {
     // `presetForVendor`, NOT `CLOUD_PRESETS.find` - this is a DISPLAY lookup, and a vendor
     // can have an open tile (and therefore reach this branch) without being currently
@@ -447,7 +542,7 @@ export default function LlmProviderPicker({
     const { selectedRow, phase: vendorPhase } = vendorPhaseFor(vendorRows, selectedCustomId ?? null, status)
     return (
       <CustomDetail
-        preset={preset}
+        display={preset}
         providers={vendorRows}
         value={value}
         selectedCustomId={selectedCustomId ?? null}
@@ -561,6 +656,25 @@ export default function LlmProviderPicker({
             onOpen={() => { setOpenId('custom'); setOpenVendor(preset.vendor) }}
           />
         ))}
+        {/* Bring-your-own endpoint - any OpenAI-compatible base URL, local or cloud.
+            BEHIND `!gate`, exactly like the preset tiles above, and that placement is the
+            point rather than an accident of where it fits. The form this restores was
+            deleted for standing on the no-subscription path, where it handed a questionnaire
+            to the one person who came to avoid one; the gate still never shows a form, and
+            still routes "no subscription" straight to `<CloudKeySetup>`. Here it is reached
+            only by someone who came looking for it.
+            Last in the grid, after the recommended providers and the free presets: it is the
+            option that needs the user to already have something, so it should not compete
+            with the ones that do not. */}
+        {!gate && (
+          <CustomEndpointTile
+            value={value}
+            selectedCustomId={selectedCustomId ?? null}
+            status={status}
+            custom={custom}
+            onOpen={() => { setOpenId('custom'); setOpenVendor(CUSTOM_ENDPOINT_VENDOR) }}
+          />
+        )}
       </div>
 
       <p style={{ fontSize: 13.5, lineHeight: 1.5, fontWeight: 500, color: 'var(--t-muted)' }}>
@@ -640,10 +754,17 @@ export default function LlmProviderPicker({
  *  endpoint bills you per call" is advice for a decision this screen no longer offers, and it
  *  was the loudest text on a screen whose actual subject is free. */
 function CustomDetail({
-  preset, providers, value, selectedCustomId, live, statusDetail, custom, onBack, onPick,
+  display, providers, value, selectedCustomId, live, statusDetail, custom, onBack, onPick,
   onAddAnother, onVerify,
 }: {
-  preset: CloudKeyPreset
+  /** Just the name - NOT a whole `CloudKeyPreset`.
+   *
+   *  This used to take the preset, for the two `.name` reads below, and that was what shut a
+   *  self-configured endpoint out of this screen: satisfying the type would have meant
+   *  inventing a key URL, a FREE badge and privacy claims for a server nobody here has seen,
+   *  and invented trust copy is worse than none. Narrowing the prop to what is actually
+   *  rendered lets both kinds of vendor share one registry view. */
+  display: VendorDisplay
   /** This vendor's OWN rows only - pre-filtered by the caller. */
   providers: CustomProviderView[]
   value: LlmProviderId
@@ -670,12 +791,17 @@ function CustomDetail({
 
       <div className="flex flex-col" style={{ gap: 3 }}>
         <span style={{ fontSize: 18, fontWeight: 600, color: 'var(--t-title)', letterSpacing: '-.01em' }}>
-          Your {preset.name} key
+          {display.detailHeading ?? `Your ${display.name} key`}
         </span>
         {/* One line, and it says what the key DOES rather than what a different kind of key
-            might cost. 13px: a subtitle under an 18px heading, not a footnote. */}
+            might cost. 13px: a subtitle under an 18px heading, not a footnote.
+            OVERRIDABLE because the default's second sentence is a CLAIM, not decoration:
+            "Nothing is charged" is true of every curated free-tier preset and false of an
+            endpoint the user brought, which may be a metered cloud key. A self-configured
+            endpoint supplies its own line rather than inheriting a promise about someone
+            else's pricing. */}
         <p style={{ fontSize: 13, lineHeight: 1.5, color: 'var(--t-muted)' }}>
-          Meridian writes your summaries on this key. Nothing is charged.
+          {display.detailBlurb ?? 'Meridian writes your summaries on this key. Nothing is charged.'}
         </p>
       </div>
 
@@ -713,7 +839,7 @@ function CustomDetail({
             strokeWidth="1.8" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
             <path d="M8 3v10M3 8h10" />
           </svg>
-          Add another {preset.name} key
+          {display.addAnotherLabel ?? `Add another ${display.name} key`}
         </button>
       )}
     </div>
diff --git a/ui/lib/llm-providers.ts b/ui/lib/llm-providers.ts
index 1fb39be27..f0919c8dc 100644
--- a/ui/lib/llm-providers.ts
+++ b/ui/lib/llm-providers.ts
@@ -408,6 +408,15 @@ export const LLM_RANK_SUBSCRIPTION: LlmRank = {
 }
 export const LLM_RANK_FREE: LlmRank = { badge: 'FREE', note: 'GOOD ACCURACY' }
 
+/** The self-configured endpoint's rank - deliberately NOT `LLM_RANK_FREE`.
+ *
+ *  Both of that badge's claims would be false here. "FREE" is a fact about a curated
+ *  preset's published tier, and an endpoint the user brings may be a metered cloud key;
+ *  "GOOD ACCURACY" is a claim about a model we picked, and here the model is theirs. So this
+ *  states what IS known - whose endpoint it is and where it can live - and claims nothing
+ *  about price or quality that only the user can know. */
+export const LLM_RANK_CUSTOM: LlmRank = { badge: 'YOUR OWN', note: 'LOCAL OR CLOUD' }
+
 export const LLM_GATE_TITLE = 'Do you have a Claude, ChatGPT or Cursor subscription?'
 export const LLM_GATE_BODY =
   'Meridian writes your summaries with an AI engine. It can use a subscription you already pay for, or set you up with a free one.'
@@ -476,11 +485,21 @@ export const USAGE_FOOTPRINT_NOTE =
  * the "+ Add a custom endpoint" tile advertised it on the settings screen as though it were a
  * capability rather than a leftover.
  *
- * The cost, stated plainly: an arbitrary OpenAI-compatible endpoint can no longer be added
- * from the UI - only the two curated presets below can. The registry underneath is
- * untouched - `add_custom_llm_provider` still exists, `<CloudKeySetup>` still calls it, and
- * an endpoint added by an older build (or a third vendor added by hand) still loads, runs
- * and can be selected. Only the way to CREATE one from the UI narrowed to these presets.
+ * The cost that used to be stated here - "an arbitrary OpenAI-compatible endpoint can no
+ * longer be added from the UI" - is PAID BACK by `<CustomEndpointSetup>` and
+ * `CUSTOM_ENDPOINT_DISPLAY` below, without reopening what this note was protecting.
+ *
+ * The two are not the same surface and that is the whole point. What made the old form wrong
+ * was WHERE it stood: on the no-subscription path, handing a questionnaire to the one person
+ * who arrived precisely to avoid one. So the free path still gets `<CloudKeySetup>` and only
+ * that, the gate never offers a form, and the free-key tiles still come from `CLOUD_PRESETS`.
+ * The base-URL form lives on the chooser grid behind `!gate` - the same condition those tiles
+ * already use - where it is reached only by someone who went looking for it.
+ *
+ * It is also not the old form rebuilt. There is no vendor dropdown (the vendor is always
+ * `custom`) and no pair of hand-guessed rate-limit fields; what is left is the three things
+ * only the user can know - base URL, key if their server wants one, and which model - and the
+ * model still comes from the endpoint's own `/models` rather than being typed blind.
  */
 
 /**
@@ -708,6 +727,100 @@ export function presetForVendor(vendor: string): CloudKeyPreset | undefined {
   return ALL_KNOWN_PRESETS.find((p) => p.vendor === vendor)
 }
 
+/**
+ * The vendor string every self-configured endpoint is stored under.
+ *
+ * A single literal, not a per-service value, because there is nothing to choose FROM: the
+ * user brings a URL, and "which vendor is behind it" is a question neither they nor we can
+ * answer usefully (an OpenAI-compatible URL may be Ollama, LM Studio, vLLM, a proxy, or a
+ * service nobody here has heard of). The old form asked it anyway via a dropdown, which is
+ * exactly the field that made it a questionnaire - see the note above `CloudKeyPreset`.
+ *
+ * Deliberately NOT a member of `CLOUD_PRESETS` or `ALL_KNOWN_PRESETS`: it is not a curated
+ * free-key vendor and has no key URL, sign-up copy or published limits to put in one. It is
+ * routed by `vendorDisplay`, and rendering it is `<CustomEndpointSetup>`'s job.
+ */
+export const CUSTOM_ENDPOINT_VENDOR = 'custom'
+
+/** The display half of a vendor - the only fields the registry screens actually render.
+ *
+ *  `CustomDetail` used to take a whole `CloudKeyPreset` for two reads (`.name`, `.vendor`),
+ *  which is why a self-configured endpoint could not use it: satisfying that type would have
+ *  meant inventing a key URL, a free badge and privacy copy for an endpoint that has none,
+ *  and invented trust copy is worse than absent trust copy. */
+export interface VendorDisplay {
+  vendor: string
+  name: string
+  blurb: string
+  /** Heading for the registry screen. Defaults to `Your <name> key`, which is right for a
+   *  curated preset and wrong for a self-configured endpoint that may have no key at all. */
+  detailHeading?: string
+  /** The line under that heading. OVERRIDABLE because the default ends in a claim -
+   *  "Nothing is charged" - that is true of every free-tier preset and false of an endpoint
+   *  the user brought, which may be a metered cloud key. */
+  detailBlurb?: string
+  /** The "add another" control's label. Defaults to `Add another <name> key`. */
+  addAnotherLabel?: string
+}
+
+/** How a self-configured endpoint names itself before the user has named it.
+ *
+ *  No FREE badge and no privacy claims, unlike every `CloudKeyPreset`: what this endpoint
+ *  costs and what it does with the data are facts about a server we know nothing about, and
+ *  the presets can make those claims only because each one links the vendor's own policy. */
+export const CUSTOM_ENDPOINT_DISPLAY: VendorDisplay = {
+  vendor: CUSTOM_ENDPOINT_VENDOR,
+  name: 'Custom endpoint',
+  blurb: 'Any OpenAI-compatible API - a local model or your own cloud key.',
+  // "Your Custom endpoint key" is both clumsy and wrong - a local endpoint has no key - so
+  // all three strings are stated rather than derived from `name`.
+  detailHeading: 'Your endpoints',
+  // No cost claim, in either direction. What this endpoint charges is a fact about a server
+  // we know nothing about, and the presets can only promise "nothing is charged" because
+  // each one names a published free tier.
+  detailBlurb: 'Meridian writes your summaries on the endpoint you connected.',
+  addAnotherLabel: 'Add another endpoint',
+}
+
+/** Name and blurb for `vendor`, whether it is a curated preset or a self-configured endpoint.
+ *
+ *  The single display lookup for every registry surface. `presetForVendor` still answers for
+ *  the preset-only questions (which wizard, which key URL) - this one answers "what do I call
+ *  it on screen", which is the question `custom` can also answer. */
+export function vendorDisplay(vendor: string): VendorDisplay | undefined {
+  if (vendor === CUSTOM_ENDPOINT_VENDOR) return CUSTOM_ENDPOINT_DISPLAY
+  return presetForVendor(vendor)
+}
+
+/**
+ * Model-name fragments that cannot answer a chat completion - speech, embeddings, rerankers,
+ * safety classifiers - filtered out of the model list a self-configured endpoint offers.
+ *
+ * The union of what the presets filter, plus the families a LOCAL server characteristically
+ * serves alongside its chat models (`nomic`, `bge`, `minilm`, `rerank`): a local Ollama or
+ * LM Studio install commonly has an embedding model pulled next to a chat one, and offering
+ * it as a chat model produces an endpoint that fails every hour rather than at setup.
+ *
+ * A FILTER, never a ranking. Unlike a preset there is no `modelPreference` to apply: nobody
+ * here can rank the models on a server they have never seen, so the user chooses and this
+ * only removes what provably cannot work.
+ */
+export const NON_CHAT_MODEL_FRAGMENTS: string[] = [
+  'whisper', 'tts', 'embed', 'embedding', 'bge', 'nomic', 'minilm',
+  'rerank', 'guard', 'prompt-guard', 'moderation', 'clip', 'stable-diffusion',
+]
+
+/** The chat-capable subset of what an endpoint reported, in the endpoint's own order.
+ *
+ *  Order is preserved rather than sorted: a server lists its models in an order it chose, and
+ *  alphabetising it would bury the one the user just pulled under whatever starts with an
+ *  early letter. */
+export function chatCapableModels(available: string[]): string[] {
+  return available.filter(
+    (m) => !NON_CHAT_MODEL_FRAGMENTS.some((bad) => m.toLowerCase().includes(bad)),
+  )
+}
+
 /**
  * Choose the model to configure from the ids the endpoint reported, for a given preset.
  *

From fca4f08567f5cf44bd1166cb003127f5a1140e1f Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 1 Sep 2026 09:44:19 +0530
Subject: [PATCH 35/53] fix(llm): never overwrite a typed model id when listing
 models

"List models" called setModel on a single-result listing unconditionally,
so pressing it to check the URL answers would silently replace a model id
the user had already typed - and typing one is the documented path for a
server that does not implement /models. The worst case is the one most
likely to happen: a lone survivor of the non-chat filter replacing a
deliberately chosen chat model with an embedding model.

Preselect now requires the field to be empty. Also documents why changing
the base URL drops the listing but keeps a typed model id.
---
 ui/components/CustomEndpointSetup.tsx | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/ui/components/CustomEndpointSetup.tsx b/ui/components/CustomEndpointSetup.tsx
index c62dcc55e..4f87e3734 100644
--- a/ui/components/CustomEndpointSetup.tsx
+++ b/ui/components/CustomEndpointSetup.tsx
@@ -117,10 +117,17 @@ export default function CustomEndpointSetup({ existing, onBack, onAdd, onPick }:
       })
       const usable = chatCapableModels(ids)
       setModels(usable)
-      // Only preselect when there is no ambiguity. Picking the first of many would put a
-      // model in the field the user never chose, and a wrong model fails at the first real
-      // hour rather than here.
-      if (usable.length === 1) setModel(usable[0])
+      // Only preselect when there is no ambiguity AND the user has not already typed one.
+      // Picking the first of many would put a model in the field the user never chose, and a
+      // wrong model fails at the first real hour rather than here.
+      //
+      // The `!model.trim()` half is the one that is easy to miss: typing an id is the
+      // DOCUMENTED path for a server with no `/models`, so someone may well type
+      // `qwen2.5-coder:7b`, then press List models just to check the URL answers. Without
+      // this guard that press silently replaces what they typed with whatever single id came
+      // back - and a lone survivor of the non-chat filter is exactly the case where the
+      // replacement would be worst.
+      if (usable.length === 1 && !model.trim()) setModel(usable[0])
       if (usable.length === 0) {
         setListError(
           ids.length > 0
@@ -255,6 +262,11 @@ export default function CustomEndpointSetup({ existing, onBack, onAdd, onPick }:
             value={baseUrl}
             onChange={(v) => {
               setBaseUrl(v)
+              // The LISTING is dropped (it described the old address), but a typed model id is
+              // NOT: correcting a typo in the URL must not wipe the id the user just entered.
+              // The dropdown disappears with the listing, so what remains on screen is the
+              // text field showing exactly what will be submitted - no hidden selection can
+              // survive from the previous address.
               setModels(null)
               setListError(null)
               if (!nameEdited) setName('')

From b0ba1d67e19e2182eeb984b2044e9184a111c582 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 1 Sep 2026 11:47:18 +0530
Subject: [PATCH 36/53] fix(llm): drop "Optional" from the API key placeholder

The hint under the field already says a blank key is fine, so the
placeholder was spending itself restating that instead of showing what a
key looks like when you do have one. Now matches the preset flow's voice
("Paste your Ollama API key").
---
 ui/components/CustomEndpointSetup.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/components/CustomEndpointSetup.tsx b/ui/components/CustomEndpointSetup.tsx
index 4f87e3734..a6e0427f2 100644
--- a/ui/components/CustomEndpointSetup.tsx
+++ b/ui/components/CustomEndpointSetup.tsx
@@ -280,7 +280,7 @@ export default function CustomEndpointSetup({ existing, onBack, onAdd, onPick }:
             hint="Leave blank if your server does not need one - most local models do not."
             value={apiKey}
             onChange={setApiKey}
-            placeholder="Optional"
+            placeholder="Paste your API key"
             disabled={busy}
             password
             mono

From 473654fffa9e8756f3586a77ebf2e64c359b4b5a Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 1 Sep 2026 11:51:34 +0530
Subject: [PATCH 37/53] feat(llm): warn that a custom endpoint's usage is
 billed to the user

An endpoint the user brings may be a metered cloud key, and nothing in
Meridian caps or monitors what it spends. Adds an amber notice to the
custom-endpoint form stating that plainly: charges are theirs, including
charges from a leaked key, and we do not monitor, cap or refund them.

Placed ABOVE the fields, not below the Connect button - a cost warning
read after the key is pasted is read after the decision it exists to
inform.

The request counts are concrete (about 23 a day, up to 16 more at setup)
and derived from meridian_core::llm_capacity rather than written as
"usage may apply", so someone can multiply them against their provider's
price. A warning nobody can act on is a warning nobody reads.

Shown for local endpoints too. We cannot tell from a URL whether it
bills, so the framing is conditional ("if this endpoint charges") rather
than a guess about which kind was typed.

Tests pin the disclaimer, its placement above step 1, the concrete
numbers, and that the copy stays free of em-dashes per the user-facing
text rule. The em-dash guard was verified to fail against a planted one.
---
 ui/__tests__/llm-provider-gate.test.ts | 26 +++++++++++++++++++
 ui/components/CustomEndpointSetup.tsx  | 36 ++++++++++++++++++++++++++
 2 files changed, 62 insertions(+)

diff --git a/ui/__tests__/llm-provider-gate.test.ts b/ui/__tests__/llm-provider-gate.test.ts
index 10cddff3e..86424515f 100644
--- a/ui/__tests__/llm-provider-gate.test.ts
+++ b/ui/__tests__/llm-provider-gate.test.ts
@@ -180,6 +180,32 @@ describe('the no-subscription presets', () => {
     expect(customSetup).toContain('apiKey: apiKey.trim()')
   })
 
+  it('warns that the user pays for their own endpoint, before the key field', () => {
+    // A liability notice nobody reads protects nobody, so this pins BOTH halves:
+    // that the disclaimer is present, and that it is placed above the fields - a cost
+    // warning below the Connect button is read after the decision it exists to inform.
+    expect(customSetup).toContain('we are not responsible for')
+    expect(customSetup).toContain('YOU PAY FOR THIS ENDPOINT')
+    // Concrete, so someone can multiply it against their provider's price. These numbers
+    // are derived from `meridian_core::llm_capacity` (2 x 8 + 7 = 23, probe 16 worst case);
+    // if those constants move, this copy is stale and must move with them.
+    expect(customSetup).toContain('23 requests')
+    expect(customSetup).toContain('16 more')
+    // Above the fields: the warning must come before step 1 in source order.
+    expect(customSetup.indexOf('YOU PAY FOR THIS ENDPOINT'))
+      .toBeLessThan(customSetup.indexOf('title="Where is it?"'))
+  })
+
+  it('keeps the cost warning free of em-dashes', () => {
+    // User-facing app text takes a plain hyphen only, per the repo hard rule. Checked on the
+    // rendered strings rather than the file, so a comment above may still discuss an em-dash.
+    const warning = customSetup.slice(
+      customSetup.indexOf('YOU PAY FOR THIS ENDPOINT'),
+      customSetup.indexOf('title="Where is it?"'),
+    )
+    expect(warning).not.toMatch(/[\u2014\u2013]/)
+  })
+
   it('tells the user WHICH structured-reply mode an endpoint failed', () => {
     // A local model that answers fine in prose can still sit below the production gate
     // (`SchemaRung::JsonSchema` across all four pipeline schemas). "It did not work" would
diff --git a/ui/components/CustomEndpointSetup.tsx b/ui/components/CustomEndpointSetup.tsx
index a6e0427f2..4c2d01806 100644
--- a/ui/components/CustomEndpointSetup.tsx
+++ b/ui/components/CustomEndpointSetup.tsx
@@ -254,6 +254,42 @@ export default function CustomEndpointSetup({ existing, onBack, onAdd, onPick }:
         their privacy policy applies, not ours.
       </p>
 
+      {/* THE MONEY WARNING. Amber, and above the fields rather than below them, because it
+          is only useful before the key is pasted - a cost disclaimer under the Connect button
+          is read after the decision it was meant to inform.
+          Concrete numbers, not "usage may apply": the request count is derived from
+          `meridian_core::llm_capacity` (CALLS_PER_ACTIVE_HOUR 2 x ASSUMED_ACTIVE_HOURS 8 +
+          DISCRETIONARY_CALLS_PER_DAY 7 = 23, plus PROBE_MAX_REQUESTS 16 worst case at setup),
+          so someone can actually multiply it against their provider's per-token price. A
+          warning nobody can act on is a warning nobody reads.
+          Shown for every custom endpoint, including a local one where it costs nothing: we
+          cannot tell from a URL whether it bills, and the honest framing is conditional
+          ("if this endpoint charges") rather than a guess about which kind they typed. */}
+      <div className="flex flex-col" style={{
+        gap: 7, padding: '13px 14px', borderRadius: 11, maxWidth: 520,
+        background: 'color-mix(in srgb, var(--color-state-pending) 9%, transparent)',
+        border: '1px solid color-mix(in srgb, var(--color-state-pending) 32%, transparent)',
+      }}>
+        <span className="font-mono" style={{
+          fontSize: 9, letterSpacing: '.1em', color: 'var(--color-state-pending)',
+        }}>YOU PAY FOR THIS ENDPOINT</span>
+        <p style={{ fontSize: 11.5, lineHeight: 1.5, color: 'var(--t-muted)' }}>
+          If the endpoint you connect charges for use, every request Meridian makes is billed
+          to your key. A normal working day is around 23 requests, plus up to 16 more the
+          first time you connect, and each one carries an hour of your activity - so what it
+          costs depends on your provider's pricing and how busy your days are.
+        </p>
+        <p style={{ fontSize: 11.5, lineHeight: 1.5, color: 'var(--t-muted)' }}>
+          Meridian does not monitor, cap or refund that spend, and we are not responsible for
+          any charges your key incurs - including charges from someone else using it if the
+          key is exposed. Set your own spend limits and usage alerts in your provider's
+          console, and keep the key safe.
+        </p>
+        <p style={{ fontSize: 11.5, lineHeight: 1.5, color: 'var(--t-muted)' }}>
+          Your key is stored on this device and is sent only to the address you enter above.
+        </p>
+      </div>
+
       <Step n={1} title="Where is it?"
         body="The base URL, including the version segment - Meridian adds /chat/completions itself.">
         <div className="flex flex-col" style={{ gap: 8 }}>

From 9394293292ab204f57f61aa7f9e5eeb5f47b84d6 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Tue, 1 Sep 2026 11:53:51 +0530
Subject: [PATCH 38/53] fix(llm): say plainly that the key never reaches
 Meridian

"sent only to the address you enter above" was accurate but oblique - it
named neither the field it meant nor the reassurance it was making. It now
names the base URL, and states the part a reader actually wants: the key is
never sent to Meridian and never appears in error reports.

Both halves verified, not assumed: the key reaches only openai_compat's two
call sites (with redirects disabled so a 3xx cannot forward the header), and
it is skipped from every span, so it cannot reach the telemetry spool or a
diagnostics bundle.
---
 ui/components/CustomEndpointSetup.tsx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ui/components/CustomEndpointSetup.tsx b/ui/components/CustomEndpointSetup.tsx
index 4c2d01806..2fdb9df72 100644
--- a/ui/components/CustomEndpointSetup.tsx
+++ b/ui/components/CustomEndpointSetup.tsx
@@ -286,7 +286,8 @@ export default function CustomEndpointSetup({ existing, onBack, onAdd, onPick }:
           console, and keep the key safe.
         </p>
         <p style={{ fontSize: 11.5, lineHeight: 1.5, color: 'var(--t-muted)' }}>
-          Your key is stored on this device and is sent only to the address you enter above.
+          Your key is stored on this device and is only ever sent to the base URL you entered
+          above. It is never sent to Meridian, and it is never included in error reports.
         </p>
       </div>
 

From cea459bb921e66e2d2e66aafc121e5ca290a65ee Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 1 Sep 2026 13:02:04 +0530
Subject: [PATCH 39/53] fix(install): scope the staging stop to the daemon
 binary, not the database

Staging the daemon binary required that NOTHING held meridian.db. It cannot
satisfy that and does not need to: staging overwrites
`~/.meridian/bin/meridian` and never opens the database.

The requirement was inherited, not chosen. `install()` reused
`stop_daemon_for_migration` rather than writing a second stop, and that
function guards the encryption migration - which swaps meridian.db itself, so
"nothing holds the database" is genuinely its precondition. Sharing it gave a
binary update a whole-machine exclusivity precondition, and any unrelated
reader (the tray's own pool, an MCP server, a dev build) then blocked every
daemon update.

It blocks it in the one way that cannot recover, because staging is exactly
what would have replaced a broken daemon. Measured on a dev machine
2026-09-01: a stale v1.86.0 daemon crash-looped 13,306 times over eight days
(~2,800/day) under launchd KeepAlive, failing `run migrations` against a
schema three migrations ahead of it, while every launch's attempt to stage a
current binary over it was declined for holders that had nothing to do with
the binary. The interlock was preventing the repair for the fault it was
reporting.

`stop_daemon_for_staging` boots out the launchd job and then waits on the
binary it is about to overwrite - matching what Windows has always done. The
second-daemon hazard that justified the database check is now the atomic
single-instance lock's job: that comment was written 2026-08-25, and
`acquire_single_instance_lock` landed 2026-08-26, so a second daemon stands
down before it opens the database at all.

The migration keeps the database-wide wait, unchanged.

Also: classify a daemon that is OLDER than its database. That failure is
reported today as "wrong/absent encryption key, a locked file, or corruption"
- three causes, none of them the real one, for the only case here where the
database is perfectly healthy. It is also the only one that never clears on
its own, since KeepAlive retries a daemon that cannot succeed. It now says so
and names the migration version. (The missing cause in the field logs was a
v1.86.0 artifact - `error = %e` drops the anyhow chain - and current code
already uses `errors::chain`; a test now pins that the version survives.)

Tests: staging must not wait on the database and must wait on the binary;
the two stops must stay distinct; an applied-but-unknown migration must name
its version in the rendered error; and only an out-of-date binary classifies
as schema-ahead (a drifted checksum and a half-applied migration must not).
---
 src/db/meridian.rs                    | 170 +++++++++++++++++++++
 src/main.rs                           |  24 ++-
 tray/src-tauri/src/backend_install.rs | 212 +++++++++++++++++++++++---
 3 files changed, 381 insertions(+), 25 deletions(-)

diff --git a/src/db/meridian.rs b/src/db/meridian.rs
index ef4afd364..609fbde00 100644
--- a/src/db/meridian.rs
+++ b/src/db/meridian.rs
@@ -128,6 +128,51 @@ pub async fn setup_db(uri: &str) -> anyhow::Result<SqlitePool> {
     Ok(pool)
 }
 
+/// The migration version in `err` that this binary does not carry, when the
+/// database has been migrated **ahead** of it — otherwise `None`.
+///
+/// # Why this is worth classifying
+///
+/// [`setup_db`] fails for several unrelated reasons and they were all reported
+/// with one sentence naming three of them: a wrong or absent encryption key, a
+/// locked file, corruption. This is a fourth, it is not on that list, and it is
+/// the only one where the database is **perfectly healthy** — the binary is
+/// simply older than the schema. Sending an operator at the database when the
+/// answer is the binary costs hours; it cost several here.
+///
+/// It is also the only one that never resolves on its own. A daemon under
+/// launchd `KeepAlive` retries forever: measured 2026-09-01, a v1.86.0 daemon
+/// carrying 79 migrations against a database at 83 failed **13,306 times over
+/// eight days** (~2,800/day), each attempt opening the database and running
+/// migrations against it.
+///
+/// # What counts
+///
+/// - [`sqlx::migrate::MigrateError::VersionMissing`] — `_sqlx_migrations` has a row for a
+///   migration this build does not carry. This is the observed shape.
+/// - [`sqlx::migrate::MigrateError::VersionTooNew`] — the same condition as sqlx reports it
+///   when it can name the newest applied version.
+///
+/// Deliberately NOT [`sqlx::migrate::MigrateError::VersionMismatch`] (a checksum drift, which
+/// [`reconcile_migration_checksums`] repairs) or [`sqlx::migrate::MigrateError::Dirty`] (a
+/// half-applied migration, which is a genuine repair case). Both are recoverable
+/// in place; neither means the binary is out of date.
+///
+/// `MigrateError` is `#[non_exhaustive]`, so an unrecognised variant falls
+/// through to `None` and keeps the general message. Failing to classify costs a
+/// vaguer log line; misclassifying would tell someone to update a daemon that is
+/// already current.
+pub fn schema_ahead_of_binary(err: &anyhow::Error) -> Option<i64> {
+    use sqlx::migrate::MigrateError;
+    err.chain()
+        .filter_map(|c| c.downcast_ref::<MigrateError>())
+        .find_map(|m| match m {
+            MigrateError::VersionMissing(v) => Some(*v),
+            MigrateError::VersionTooNew(v, _) => Some(*v),
+            _ => None,
+        })
+}
+
 /// Forces the WAL fully into the main database file and truncates it.
 ///
 /// Called from `main.rs`'s shutdown sequence, right before closing the pool.
@@ -636,6 +681,131 @@ mod tests {
             .expect("migrate after reconcile must succeed");
     }
 
+    /// A daemon OLDER than the database must say so, in the error a human reads.
+    ///
+    /// # The condition
+    /// Two daemon builds share one `meridian.db` and the newer one migrates the
+    /// schema forward. The older binary then finds rows in `_sqlx_migrations`
+    /// for migrations it does not carry, and sqlx correctly refuses to run —
+    /// `MigrateError::VersionMissing`. It is correct to refuse: an old binary
+    /// against a new schema would write rows the current code cannot read.
+    ///
+    /// # Why this is a test and not a comment
+    /// Measured on a dev machine 2026-09-01: a v1.86.0 daemon (79 migrations)
+    /// against a database at 83 crash-looped **13,306 times over eight days**
+    /// under launchd `KeepAlive`, at ~2,800/day. Every one of those attempts
+    /// opened the database and tried to migrate it. The only diagnostic it left
+    /// was `error=failed to run migrations` — the outer `.context` with no
+    /// cause — beside a message offering three explanations
+    /// (`wrong/absent encryption key, a locked file, or corruption`), none of
+    /// which was the real one. That sent the investigation at the database
+    /// rather than at the binary.
+    ///
+    /// So this pins the property that actually matters: **the version number
+    /// survives into `errors::chain`**. Without it there is nothing in
+    /// telemetry that distinguishes this from corruption, and it is not
+    /// reproducible on demand — it needs two binaries and a shared database.
+    #[tokio::test]
+    async fn an_applied_migration_the_binary_lacks_names_itself_in_the_error() {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .expect("open in-memory db");
+        let migrator = sqlx::migrate!("src/migrations");
+        migrator.run(&pool).await.expect("initial migrate");
+
+        // Stand in for "a newer daemon applied migration 999999 here". The
+        // version is deliberately far above any real one so this never collides
+        // with a migration added later.
+        sqlx::query(
+            "INSERT INTO _sqlx_migrations \
+             (version, description, installed_on, success, checksum, execution_time) \
+             VALUES (999999, 'from a newer daemon', CURRENT_TIMESTAMP, 1, X'00', 0)",
+        )
+        .execute(&pool)
+        .await
+        .expect("insert phantom applied migration");
+
+        // Reconcile must NOT paper over this: it realigns checksums for
+        // migrations this binary HAS, and has nothing to say about one it does
+        // not. Silently deleting the row would let an old daemon run against a
+        // schema it cannot understand, which is the failure sqlx is preventing.
+        reconcile_migration_checksums(&pool, &migrator)
+            .await
+            .expect("reconcile must tolerate an unknown applied migration");
+
+        let err = migrator
+            .run(&pool)
+            .await
+            .context("failed to run migrations")
+            .expect_err("sqlx must refuse to run against a schema ahead of this binary");
+        let rendered = crate::errors::chain(&err);
+
+        assert!(
+            rendered.contains("999999"),
+            "the offending migration version must reach the log - without it the \
+             operator cannot tell this apart from corruption. got: {rendered}"
+        );
+        assert!(
+            rendered.contains("failed to run migrations"),
+            "the outer context must survive too. got: {rendered}"
+        );
+
+        // ...and it must be CLASSIFIED, not just rendered. The log site picks a
+        // different message on this, so a `None` here means an operator is told
+        // to look at their encryption key and their disk for a healthy database.
+        assert_eq!(
+            schema_ahead_of_binary(&err),
+            Some(999_999),
+            "an applied-but-unknown migration must classify as schema-ahead, and \
+             must name the version"
+        );
+    }
+
+    /// The classifier must stay narrow: only "this binary is out of date".
+    ///
+    /// A checksum drift is repaired in place by [`reconcile_migration_checksums`]
+    /// and a plain open failure has nothing to do with versions. Reporting either
+    /// as "your daemon is older than the database" would send someone to update a
+    /// binary that is already current, which is worse than the vague message it
+    /// replaced.
+    #[test]
+    fn only_an_out_of_date_binary_classifies_as_schema_ahead() {
+        use sqlx::migrate::MigrateError;
+
+        for (label, err) in [
+            (
+                "a drifted checksum",
+                anyhow::Error::new(MigrateError::VersionMismatch(7)),
+            ),
+            (
+                "a half-applied migration",
+                anyhow::Error::new(MigrateError::Dirty(7)),
+            ),
+            (
+                "an unrelated open failure",
+                anyhow::anyhow!("file is not a database"),
+            ),
+        ] {
+            assert_eq!(
+                schema_ahead_of_binary(&err.context("failed to run migrations")),
+                None,
+                "{label} must NOT classify as an out-of-date binary"
+            );
+        }
+
+        // And the positive case still classifies through a context layer, which
+        // is how it always arrives from `setup_db`.
+        assert_eq!(
+            schema_ahead_of_binary(
+                &anyhow::Error::new(MigrateError::VersionMissing(84))
+                    .context("failed to run migrations")
+            ),
+            Some(84),
+        );
+    }
+
     /// A fresh database (no `_sqlx_migrations` table yet) is a clean no-op.
     #[tokio::test]
     async fn reconcile_is_noop_on_fresh_db() {
diff --git a/src/main.rs b/src/main.rs
index bdfc7c88b..d58aa71b8 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1259,10 +1259,26 @@ async fn main() -> Result<()> {
             // locked, corruption — is finally diagnosable in central telemetry
             // instead of crash-looping silently. `shutdown` consumes the guard,
             // but we exit immediately after, so the success path still owns it.
-            tracing::error!(
-                error = %meridian::errors::chain(&e),
-                "daemon startup: failed to open the database — the daemon cannot start (wrong/absent encryption key, a locked file, or corruption)"
-            );
+            //
+            // The "schema ahead of the binary" case is split out because it is
+            // the one failure here where the database is HEALTHY and the general
+            // message actively misleads: it names an encryption key, a lock and
+            // corruption, and the answer is none of those - this build is simply
+            // older than the database. It is also the only one that never clears
+            // on its own, because launchd `KeepAlive` retries a daemon that
+            // cannot possibly succeed. See `db::meridian::schema_ahead_of_binary`
+            // for the 13,306-crash-loop measurement behind both statements.
+            match meridian::db::meridian::schema_ahead_of_binary(&e) {
+                Some(version) => tracing::error!(
+                    error = %meridian::errors::chain(&e),
+                    migration_version = version,
+                    "daemon startup: this daemon is OLDER than meridian.db — the database has migrations this build does not carry, so it cannot start and will keep retrying until the binary is updated. The database itself is fine."
+                ),
+                None => tracing::error!(
+                    error = %meridian::errors::chain(&e),
+                    "daemon startup: failed to open the database — the daemon cannot start (wrong/absent encryption key, a locked file, or corruption)"
+                ),
+            }
             obs_guard.shutdown().await;
             meridian::telemetry_spool::shipper::drain_once().await;
             std::process::exit(1);
diff --git a/tray/src-tauri/src/backend_install.rs b/tray/src-tauri/src/backend_install.rs
index 2c12fc046..a94d9c586 100644
--- a/tray/src-tauri/src/backend_install.rs
+++ b/tray/src-tauri/src/backend_install.rs
@@ -270,12 +270,64 @@ pub(crate) async fn stop_daemon_for_migration(db_path: &Path) -> Result<(), Stri
     }
 }
 
+/// Stop the daemon so [`stage_binary`] can overwrite `~/.meridian/bin/meridian`.
+///
+/// # Why this is NOT [`stop_daemon_for_migration`]
+///
+/// It used to be — `install` called that function directly, reusing the
+/// encryption migration's stop rather than writing a second one. The two
+/// operations guard genuinely different things, and sharing one guard gave
+/// staging a precondition it has no way to satisfy:
+///
+/// - **The migration swaps `meridian.db` itself.** Any process holding that
+///   file is a hazard, because the sidecars are addressed by path and a second
+///   writer ends up sharing one journal. "Nothing at all holds the database" is
+///   the correct precondition, and [`wait_for_db_unheld`] is how it is proved.
+/// - **Staging overwrites `~/.meridian/bin/meridian`.** It does not touch the
+///   database. The only file whose holders matter is the *binary*.
+///
+/// Inheriting the database precondition meant any unrelated reader blocked a
+/// daemon UPDATE — and it blocked it in the one way that cannot recover, because
+/// staging is exactly what would have replaced a broken daemon. Measured on a
+/// dev machine 2026-09-01: a stale v1.86.0 daemon crash-looped 13,306 times over
+/// eight days (`failed to run migrations` against a schema three migrations
+/// ahead of it), while every launch's attempt to stage a current binary over it
+/// was declined because the tray's own pool and an MCP server held the database.
+/// The interlock was preventing the repair for the fault it was reporting. A
+/// user running the Meridian MCP server reaches the same state with no dev build
+/// involved: their daemon silently stops updating, permanently.
+///
+/// # What still guards the second-daemon hazard
+///
+/// The comment that justified the database check in `install` was about
+/// [`register_service`] bootstrapping a new daemon beside a live one. That was
+/// written on 2026-08-25, when the daemon's only defence was a check-then-act
+/// endpoint probe. The **atomic single-instance lock** landed the next day
+/// (`meridian::platform::acquire_single_instance_lock`, taken immediately before
+/// `setup_db`), so a second daemon now stands down before it opens the database
+/// at all, however the two are interleaved. The probe additionally catches a
+/// long-running daemon from a build predating the lock. Neither depends on this
+/// function, so narrowing it here gives up nothing.
+#[cfg(target_os = "macos")]
+pub(crate) async fn stop_daemon_for_staging(daemon_bin: &Path) -> Result<(), String> {
+    bootout_agent_and_wait(DAEMON_LABEL).await?;
+    // A bootout only removes the LAUNCHD-managed daemon, and killing a process
+    // does not release its executable mapping instantly. Overwriting a binary
+    // another process is still executing leaves that process running the old
+    // unlinked inode on macOS - silently, unlike Windows' os error 32 - so prove
+    // the file is unmapped rather than inferring it from the bootout returning.
+    wait_for_path_unheld(daemon_bin, "the daemon binary").await
+}
+
 /// Poll until nothing but this process holds `db_path` open (≤10 s), so the
 /// caller can swap the file knowing there is no second writer.
 ///
 /// Deliberately keyed on **the database file**, not on a daemon binary path:
-/// the hazard is "some process has this file open", and a check that enumerates
-/// known daemon locations misses every writer that isn't at one of them.
+/// for the encryption migration the hazard is "some process has this file open",
+/// and a check that enumerates known daemon locations misses every writer that
+/// isn't at one of them. Staging has the opposite requirement and uses
+/// [`stop_daemon_for_staging`] — see there for why the two must not share a
+/// guard.
 ///
 /// A spawn failure of `lsof` is treated as **still held**, not as clear. Being
 /// unable to prove the file is free is not evidence that it is, and the cost of
@@ -284,10 +336,25 @@ pub(crate) async fn stop_daemon_for_migration(db_path: &Path) -> Result<(), Stri
 /// proceeding corrupts the user's data irrecoverably.
 #[cfg(target_os = "macos")]
 async fn wait_for_db_unheld(db_path: &Path) -> Result<(), String> {
+    wait_for_path_unheld(db_path, "meridian.db").await
+}
+
+/// Poll until nothing but this process holds `path` open (≤10 s).
+///
+/// The shared body of [`wait_for_db_unheld`] and [`stop_daemon_for_staging`].
+/// `subject` names the file in the returned error because that string reaches
+/// the user as the detail of the "Meridian couldn't finish installing" notice,
+/// and "meridian.db is still held open" sent an installation failure chasing a
+/// database problem for weeks.
+///
+/// A spawn failure of `lsof` is an `Err`, never an empty holder list — see
+/// [`wait_for_db_unheld`] for the asymmetry that rule protects.
+#[cfg(target_os = "macos")]
+async fn wait_for_path_unheld(path: &Path, subject: &str) -> Result<(), String> {
     for _ in 0..10 {
         let out = tokio::process::Command::new("lsof")
             .arg("-t")
-            .arg(db_path)
+            .arg(path)
             .output()
             .await
             .map_err(|e| format!("run lsof: {e}"))?;
@@ -297,10 +364,16 @@ async fn wait_for_db_unheld(db_path: &Path) -> Result<(), String> {
         if holders.is_empty() {
             return Ok(());
         }
-        tracing::debug!(holders = ?holders, "backend_install: waiting for db writers to exit");
+        tracing::debug!(
+            holders = ?holders,
+            path = %path.display(),
+            "backend_install: waiting for holders to exit"
+        );
         tokio::time::sleep(std::time::Duration::from_secs(1)).await;
     }
-    Err("meridian.db is still held open 10s after stopping the daemon".to_string())
+    Err(format!(
+        "{subject} is still held open 10s after stopping the daemon"
+    ))
 }
 
 /// The pids in `lsof -t` output, excluding our own — i.e. the processes that
@@ -493,15 +566,16 @@ pub(crate) async fn ensure_daemon_running(home: &Path) {
 /// manual test, whatever), `dir.is_dir()` alone can't tell that apart from a
 /// real packaged install. That false positive is not cosmetic:
 /// [`ensure_backend_installed`] would then call [`install`], which on macOS
-/// runs [`stop_daemon_for_migration`] against `meridian.db` — booting out a
-/// launchd agent that was never registered for this run (a no-op) and then
-/// polling `lsof` for up to 10s, which always times out because the actual
-/// holder is the sibling `cargo run` daemon `bootout` can't touch, not the
-/// launchd job it targets. That raises `tray.backend_install_failed`
-/// ("meridian.db is still held open 10s after stopping the daemon") on every
-/// dev-tray launch, with a timestamp that tracks each restart — measured
-/// verbatim on 2026-08-31, traced to exactly one stray directory left over
-/// from an Aug 16 debug build. `debug_assertions` is a compile-time constant
+/// boots out a launchd agent that was never registered for this run (a no-op)
+/// and then polls `lsof` for up to 10s. That raises
+/// `tray.backend_install_failed` on every dev-tray launch, with a timestamp
+/// that tracks each restart — measured verbatim on 2026-08-31, traced to
+/// exactly one stray directory left over from an Aug 16 debug build. (At the
+/// time the poll was [`stop_daemon_for_migration`]'s, waiting on `meridian.db`
+/// and so timing out against the sibling `cargo run` daemon's pool; it is
+/// [`stop_daemon_for_staging`]'s now, waiting only on the staged binary. This
+/// gate is still required — the bootout alone is wrong to perform from a dev
+/// build.) `debug_assertions` is a compile-time constant
 /// for the running binary's own profile, so this can never be fooled by
 /// what's left lying around on disk the way the directory check alone was.
 /// Matches the same convention already used for the encryption-migration
@@ -596,18 +670,22 @@ async fn install(backend: &Path, home: &Path) -> Result<(), String> {
     // NINE MILLISECONDS before anything asked it to stop, and the stop that did
     // arrive came from `register_agent`'s bootout, after the fact.
     //
-    // Reuses the migration path's stop rather than a second implementation:
-    // bootout the launchd job, then prove via `lsof` that NOTHING holds the
-    // database - a dev `cargo run`, a directly-spawned binary and an orphan
-    // from an overlapping install have all been seen here, and a bootout
-    // removes none of them.
+    // Scoped to the DAEMON BINARY, matching Windows. This used to call
+    // `stop_daemon_for_migration` and therefore required that NOTHING held
+    // meridian.db - a precondition staging cannot satisfy and does not need,
+    // because staging overwrites `~/.meridian/bin/meridian` and never touches
+    // the database. Any unrelated reader (the tray's own pool, an MCP server, a
+    // dev build) blocked every daemon update, permanently and unrecoverably.
+    // `stop_daemon_for_staging`'s doc has the measurement and why the atomic
+    // single-instance lock, not this call, is what now guards the second-daemon
+    // hazard described above.
     //
     // Failing here declines the STAGING, exactly as Windows does: the update
     // does not apply, the existing daemon keeps running, and the next launch
     // retries. That is the right asymmetry - a deferred update costs a version,
     // proceeding costs the user's database.
     #[cfg(target_os = "macos")]
-    stop_daemon_for_migration(std::path::Path::new(&crate::install::meridian_db_path())).await?;
+    stop_daemon_for_staging(&daemon_bin).await?;
 
     stage_binary(&backend.join(DAEMON_FILE), &daemon_bin).await?;
 
@@ -1533,7 +1611,7 @@ mod tests {
 
         for (label, needle) in [
             ("windows", "stop_running_daemon_before_stage("),
-            ("macos", "stop_daemon_for_migration("),
+            ("macos", "stop_daemon_for_staging("),
         ] {
             let stop = body.find(needle).unwrap_or_else(|| {
                 panic!(
@@ -1550,6 +1628,98 @@ mod tests {
         }
     }
 
+    /// Staging must wait on the **daemon binary**, never on `meridian.db`.
+    ///
+    /// The two are one keystroke apart (`stop_daemon_for_staging` vs
+    /// `stop_daemon_for_migration`) and both compile, so nothing but this scan
+    /// catches a revert. What it costs is not a style point:
+    /// `stop_daemon_for_migration` requires that NOTHING holds the database,
+    /// which staging can neither satisfy nor needs to — it overwrites
+    /// `~/.meridian/bin/meridian` and never opens the database. Wiring it back
+    /// means any unrelated reader (the tray's own pool, an MCP server, a dev
+    /// build) blocks every daemon UPDATE, and blocks it unrecoverably, because
+    /// staging is the mechanism that would have replaced a broken daemon.
+    /// Measured 2026-09-01: 13,306 crash-loops of a stale v1.86.0 daemon over
+    /// eight days, none of which could be repaired for exactly this reason.
+    ///
+    /// The migration keeps the database-wide wait, and that is correct — it
+    /// swaps the file itself. This asserts only that STAGING does not.
+    #[test]
+    fn staging_waits_on_the_daemon_binary_not_on_the_database() {
+        const SRC: &str = include_str!("backend_install.rs");
+        let prod = SRC
+            .split_once("\n#[cfg(test)]")
+            .map_or(SRC, |(before, _)| before);
+        let body = prod
+            .split_once("async fn install(backend: &Path, home: &Path)")
+            .expect("install() must exist")
+            .1;
+        let end = ["\npub ", "\npub(crate) ", "\nasync fn", "\nfn "]
+            .iter()
+            .filter_map(|m| body.find(m))
+            .min()
+            .unwrap_or(body.len());
+        let body = &body[..end];
+
+        assert!(
+            !body.contains("stop_daemon_for_migration("),
+            "install() must not call stop_daemon_for_migration - that waits for \
+             meridian.db to be unheld, a precondition staging cannot satisfy. Use \
+             stop_daemon_for_staging, which waits on the binary it is about to \
+             overwrite. See that function's doc for the 13,306-crash-loop measurement."
+        );
+        assert!(
+            !body.contains("meridian_db_path("),
+            "install() must not resolve the database path at all - staging does not \
+             touch meridian.db, and reintroducing the path is the first half of \
+             reintroducing the wait"
+        );
+    }
+
+    /// The two stops must stay distinct functions guarding distinct files.
+    ///
+    /// Collapsing them back into one is the shape of the original bug, and it
+    /// would not fail `staging_waits_on_the_daemon_binary_not_on_the_database`
+    /// if the survivor kept the staging name while regaining the database wait.
+    #[test]
+    fn the_migration_stop_still_guards_the_database_and_staging_does_not() {
+        const SRC: &str = include_str!("backend_install.rs");
+        let prod = SRC
+            .split_once("\n#[cfg(test)]")
+            .map_or(SRC, |(before, _)| before);
+
+        let fn_body = |sig: &str| -> String {
+            let after = prod
+                .split_once(sig)
+                .unwrap_or_else(|| panic!("{sig} must exist"))
+                .1;
+            let end = ["\npub ", "\npub(crate) ", "\nasync fn", "\nfn ", "\n///"]
+                .iter()
+                .filter_map(|m| after.find(m))
+                .min()
+                .unwrap_or(after.len());
+            after[..end].to_string()
+        };
+
+        let migration = fn_body("async fn stop_daemon_for_migration(db_path: &Path)");
+        assert!(
+            migration.contains("wait_for_db_unheld("),
+            "stop_daemon_for_migration must keep the database-wide wait - it swaps \
+             meridian.db itself, so any holder is a corruption hazard"
+        );
+
+        let staging = fn_body("async fn stop_daemon_for_staging(daemon_bin: &Path)");
+        assert!(
+            staging.contains("wait_for_path_unheld(daemon_bin"),
+            "stop_daemon_for_staging must wait on the binary it overwrites"
+        );
+        assert!(
+            !staging.contains("wait_for_db_unheld("),
+            "stop_daemon_for_staging must NOT wait on the database - that is the \
+             precondition it exists to stop requiring"
+        );
+    }
+
     /// The branch that bootstraps a launchd agent whose `bootout` never cleared
     /// must report at **WARN**, because WARN+ is the only severity that leaves
     /// the machine.

From aaabffa25e92ede34ecfd990414074ae2774197c Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 1 Sep 2026 13:50:02 +0530
Subject: [PATCH 40/53] fix(cli): a flag's value that begins with a hyphen is
 not an unknown flag

The strict flag check rejected `meridian plan-task-draft --note "- fixed the
bug"` with `unrecognised flag "- fixed the bug"` and exit 2.

The module header claimed values were safe because "none of the flags below
takes a negative number". That reasoned about numbers and forgot free text:
`--note`, `--title`, `--description` and `--value` all carry user-written
prose, and prose begins with a hyphen often enough to matter - a bullet, a
dash, a diff line. The tray drives `plan-task-draft --note` with whatever the
user typed.

Wrongly rejecting a working invocation is the one failure mode worse than the
bug this module fixes, and it shipped in the module whose own header says so.

Two independent guards, either of which suffices:

1. Shape - a candidate must be `-h`, or `--` followed by a letter. `"- fixed
   the bug"`, `"-5"` and a bare `--` are not flags.
2. Arity - a recognised flag consumes the next token unless it is in
   VALUELESS_FLAGS or already carried its value as `--flag=value`.

They fail in opposite directions, so both are kept. VALUELESS_FLAGS is derived
from how each flag is actually parsed (a presence test, not a value read), and
anything absent is treated as value-taking: over-consuming costs at most a
MISSED unknown flag, while under-consuming reopens this bug.

`every_valueless_flag_is_registered_somewhere` earned its place immediately -
it caught `--force`, which the derivation swept in from cursor_agent.rs where
it is an argument Meridian passes TO the cursor-agent CLI, not one of its own.
Left in, it would have silently swallowed the token after any real `--force`.

Tests: a hyphen-leading value across four commands; `--help` inside a value is
text, not a help request; an unknown flag after a consumed value is still
caught, and an inline `--flag=value` does not consume the next token; a
valueless flag swallows nothing; every VALUELESS_FLAGS entry is registered.
---
 src/cli_flags.rs | 202 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 194 insertions(+), 8 deletions(-)

diff --git a/src/cli_flags.rs b/src/cli_flags.rs
index 1bdf43b8e..38e7cebc0 100644
--- a/src/cli_flags.rs
+++ b/src/cli_flags.rs
@@ -47,10 +47,31 @@
 //! Only `-`-prefixed tokens are inspected, against a flat allowlist per
 //! subcommand. Flag *values* are not modelled: a value that does not itself
 //! start with `-` is simply not a candidate, and none of the flags below takes
-//! a negative number. Modelling value-consumption would buy nothing and would
-//! introduce a way to *wrongly reject* a working invocation — the one failure
-//! mode worse than the bug being fixed, since these commands are load-bearing
-//! for the tray.
+//! a negative number.
+//!
+//! That reasoning was **wrong**, and the fix for it is [`VALUELESS_FLAGS`]. It
+//! covered negative numbers and forgot free text: `--note`, `--title`,
+//! `--description` and `--value` all carry user-written prose, and prose starts
+//! with a hyphen often enough to matter — a bullet, a dash, a diff line.
+//! `meridian plan-task-draft --note "- fixed the bug"` was rejected with
+//! `unrecognised flag "- fixed the bug"` and exit 2, and the tray drives that
+//! command with text the user typed. Wrongly rejecting a working invocation is
+//! the one failure mode worse than the bug this module fixes, and it shipped in
+//! the module that says so.
+//!
+//! Two independent guards now stop it, either of which suffices:
+//!
+//! 1. **Shape** ([`looks_like_a_flag`]): a candidate must be `-h` or `--` plus
+//!    a letter. `"- fixed the bug"`, `"-5"` and a bare `"--"` are not flags.
+//! 2. **Arity**: a recognised flag consumes the next token unless it is in
+//!    [`VALUELESS_FLAGS`] or already carried its value as `--flag=value`.
+//!
+//! The two fail in opposite directions, which is why both are kept. Arity alone
+//! mis-set (a value-taking flag wrongly listed as valueless) reopens the bug for
+//! that flag; shape alone still trips on a value that begins `--word`. Getting
+//! [`VALUELESS_FLAGS`] wrong in the other direction — omitting a boolean — costs
+//! only a *missed* unknown flag, never a wrongly rejected command, which is the
+//! direction to err in.
 //!
 //! # Who calls this
 //! [`enforce`] runs from `main.rs` immediately before the subcommand dispatch
@@ -290,6 +311,43 @@ pub fn spec(name: &str) -> Option<&'static Spec> {
 /// `meridian worklog-post-approved --help --bogus` is asking what the command
 /// does, and answering that is strictly safer than an error that might send
 /// them off to retry it bare — which is the invocation that actually posts.
+/// The registered flags that are a bare switch and consume no following token.
+///
+/// Derived from how each is actually parsed - a presence test
+/// (`args.iter().any(|a| a == "--fix")`) rather than a value read
+/// (`flag_value(args, "--day")`) - not from how the name reads. Anything absent
+/// here is treated as value-taking, which is the safe default: over-consuming
+/// costs at most a *missed* unknown flag, while under-consuming lets a value
+/// beginning with a hyphen be reported as one. See the module header.
+const VALUELESS_FLAGS: &[&str] = &[
+    "--dry-run",
+    "--fix",
+    "--json",
+    "--now",
+    "--porcelain",
+    "--purge",
+    "--remove-data",
+    "--remove-models",
+    "--remove-runtime",
+    "--yes",
+];
+
+/// Whether `token` is shaped like a flag rather than like a value.
+///
+/// `-h` (the only single-letter flag registered anywhere here) or `--` followed
+/// by a letter. Deliberately NOT "starts with `-`", which is what let
+/// `"- fixed the bug"` and `"-5"` be read as flags.
+///
+/// A bare `--` is excluded too: it is the conventional end-of-options marker, is
+/// not registered on any subcommand, and rejecting it would break an invocation
+/// that works today.
+fn looks_like_a_flag(token: &str) -> bool {
+    token == "-h"
+        || token
+            .strip_prefix("--")
+            .is_some_and(|rest| rest.starts_with(|c: char| c.is_ascii_alphabetic()))
+}
+
 pub fn check(argv: &[String]) -> Outcome {
     let Some(sub) = argv.get(1) else {
         return Outcome::NotOurs;
@@ -299,18 +357,34 @@ pub fn check(argv: &[String]) -> Outcome {
     };
 
     let mut unknown: Option<String> = None;
+    // Set after a recognised value-taking flag: the NEXT token is that flag's
+    // value and must not be inspected, however it is spelled. See the module
+    // header - a value beginning with a hyphen was reported as an unknown flag.
+    let mut expect_value = false;
     for raw in argv.iter().skip(2) {
+        if expect_value {
+            expect_value = false;
+            continue;
+        }
         // `--flag=value` is a shape people type even where the parser wants a
         // separate token; validate the name half so it reports the flag rather
-        // than the whole pair.
-        let token = raw.split('=').next().unwrap_or(raw.as_str());
-        if !token.starts_with('-') {
+        // than the whole pair. It also carries its own value, so it must not
+        // additionally consume the token after it.
+        let (token, inline_value) = match raw.split_once('=') {
+            Some((name, _)) => (name, true),
+            None => (raw.as_str(), false),
+        };
+        if !looks_like_a_flag(token) {
             continue; // positional, or a flag's value
         }
         if token == "--help" || token == "-h" {
             return Outcome::Help(spec.usage);
         }
-        if !spec.flags.contains(&token) && unknown.is_none() {
+        if spec.flags.contains(&token) {
+            expect_value = !inline_value && !VALUELESS_FLAGS.contains(&token);
+            continue;
+        }
+        if unknown.is_none() {
             unknown = Some(token.to_string());
         }
     }
@@ -458,6 +532,118 @@ mod tests {
         }
     }
 
+    /// A value that begins with a hyphen is still a value.
+    ///
+    /// This shipped broken: `--note "- fixed the bug"` was rejected as
+    /// `unrecognised flag "- fixed the bug"` with exit 2. The module header's
+    /// claim that values were safe reasoned only about negative numbers and
+    /// missed free text, which is exactly what `--note`, `--title`,
+    /// `--description` and `--value` carry - and the tray drives
+    /// `plan-task-draft --note` with whatever the user typed.
+    ///
+    /// A guard that wrongly rejects a working command is worse than the missing
+    /// guard it replaced, so these cases are pinned individually rather than as
+    /// one representative.
+    #[test]
+    fn a_value_beginning_with_a_hyphen_is_not_a_flag() {
+        for (label, args) in [
+            (
+                "a bulleted note",
+                vec!["plan-task-draft", "--note", "- fixed the bug"],
+            ),
+            (
+                "an em-dash-ish title",
+                vec!["plan-task-create", "--title", "-- rework"],
+            ),
+            (
+                "a negative-looking value",
+                vec![
+                    "ticket-update",
+                    "--key",
+                    "K",
+                    "--provider",
+                    "jira",
+                    "--field",
+                    "f",
+                    "--value",
+                    "-1",
+                ],
+            ),
+            (
+                "a diff line as a description",
+                vec![
+                    "plan-task-edit",
+                    "--key",
+                    "K",
+                    "--description",
+                    "-x removed",
+                ],
+            ),
+        ] {
+            assert_eq!(
+                check(&argv(&args)),
+                Outcome::Ok,
+                "{label}: a flag's value must never be inspected as a flag"
+            );
+        }
+    }
+
+    /// `--help` inside a VALUE is text, not a request for help.
+    ///
+    /// Without arity this printed usage and exited 0, so a note containing
+    /// `--help` silently drafted nothing.
+    #[test]
+    fn help_inside_a_value_is_text() {
+        assert_eq!(
+            check(&argv(&["plan-task-draft", "--note", "--help me name this"])),
+            Outcome::Ok
+        );
+        // ...but asked for on its own it is still help.
+        assert!(matches!(
+            check(&argv(&["plan-task-draft", "--help"])),
+            Outcome::Help(_)
+        ));
+    }
+
+    /// Consuming a value must not blind the check to a later unknown flag.
+    #[test]
+    fn an_unknown_flag_after_a_value_is_still_caught() {
+        match check(&argv(&["day-summary", "--day", "2026-08-27", "--bogus"])) {
+            Outcome::Unknown { flag, .. } => assert_eq!(flag, "--bogus"),
+            other => panic!("expected --bogus to be caught, got {other:?}"),
+        }
+        // `--flag=value` carries its own value and must NOT eat the next token.
+        match check(&argv(&["day-summary", "--day=2026-08-27", "--bogus"])) {
+            Outcome::Unknown { flag, .. } => assert_eq!(flag, "--bogus"),
+            other => panic!("an inline value must not consume the next token, got {other:?}"),
+        }
+    }
+
+    /// A valueless flag consumes nothing, so what follows is still checked.
+    #[test]
+    fn a_valueless_flag_does_not_swallow_the_next_token() {
+        match check(&argv(&["doctor", "--fix", "--bogus"])) {
+            Outcome::Unknown { flag, .. } => assert_eq!(flag, "--bogus"),
+            other => panic!("--fix takes no value, so --bogus must be caught, got {other:?}"),
+        }
+    }
+
+    /// Every entry in [`VALUELESS_FLAGS`] must be a flag some subcommand
+    /// actually registers.
+    ///
+    /// A typo here is silent in the dangerous direction: the flag is never
+    /// matched, so it is treated as value-taking and swallows the token after
+    /// it, hiding a real unknown flag.
+    #[test]
+    fn every_valueless_flag_is_registered_somewhere() {
+        for f in VALUELESS_FLAGS {
+            assert!(
+                SPECS.iter().any(|s| s.flags.contains(f)),
+                "{f} is in VALUELESS_FLAGS but no subcommand registers it - likely a typo"
+            );
+        }
+    }
+
     /// Bare `meridian` and `meridian --version` start the daemon; that is the
     /// documented entry point and this module must not interfere with it.
     #[test]

From 5e755bcb466eae5ba1e73f6763ef67c9da2fc461 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 1 Sep 2026 14:06:27 +0530
Subject: [PATCH 41/53] fix(telemetry): widen the batch queue to match the 30s
 export delay

Raising the scheduled delay without raising the queue silently drops records.

The SDK's defaults are a matched pair: a 5s delay against a 2,048-record
queue, i.e. ~410 records/second of headroom before the queue is full. This PR
stretched the delay to 30s to cut spool file count and left the queue at the
default, dropping the absorbable rate to ~68/second. A full queue is DISCARDED
by the batch processor - no error at the call site, nothing in the spool, no
way to notice after the fact.

68/second is not headroom to give away. One ETL tick handles BATCH_SIZE = 500
frames and emits several DEBUG records per frame, so a single batch can put
thousands of records on the queue in under a second. The records lost would be
exactly those emitted during a burst, which is what an incident looks like: a
backfill, a crash-loop, a summariser storm. That is the worst available
sampling bias.

16,384 over 30s is ~546/second, above the SDK's own ~410 and enough for
several ETL batches back to back. The cost is transient heap while actually
bursting, which is not a constraint on a desktop daemon.

The delay is now a named constant so the relationship is checkable, and
`batching_cannot_silently_drop_a_burst` asserts the records-per-second ratio
never falls below the SDK's regardless of what either value is changed to. It
has teeth: 8,192 - the first value tried here - fails it at 273/s.
---
 src/observability/mod.rs | 98 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 94 insertions(+), 4 deletions(-)

diff --git a/src/observability/mod.rs b/src/observability/mod.rs
index 891d6a46a..73ff1c792 100644
--- a/src/observability/mod.rs
+++ b/src/observability/mod.rs
@@ -369,6 +369,42 @@ pub fn init(service_name: &str) -> Result<ObservabilityGuard> {
 ///
 /// Only `MERIDIAN_TELEMETRY_DISABLED` skips capture entirely (an explicit
 /// escape hatch, not tied to shipping config).
+///
+/// How often each pipeline drains its queue into one spool file.
+///
+/// The reason this module batches at all: at the SDK defaults (1 s for logs,
+/// 5 s for traces) the spool accumulates tens of thousands of files a day.
+/// Named rather than inlined because [`BATCH_MAX_QUEUE`] has to move with it,
+/// and `batching_cannot_silently_drop_a_burst` checks that it did.
+const BATCH_SCHEDULED_DELAY_SECS: u64 = 30;
+
+/// How many records one export carries. Raised from the SDK default of 512 so a
+/// 30 s window drains in one file rather than several - the point of batching.
+const BATCH_MAX_EXPORT: usize = 2048;
+
+/// How many records may wait in memory between exports.
+///
+/// **This has to move with the delay, and forgetting it silently drops
+/// telemetry.** The SDK's defaults are a matched pair: a 5 s delay against a
+/// 2,048-record queue, i.e. it can absorb ~410 records/second before the queue
+/// is full. Stretching the delay to 30 s without touching the queue leaves the
+/// same 2,048 slots to cover six times the window - ~68 records/second - and a
+/// full queue is DISCARDED, quietly, with no error at the call site and nothing
+/// in the spool to show for it.
+///
+/// 68/second is not hypothetical headroom to give away. One ETL tick processes
+/// `BATCH_SIZE` = 500 frames and emits several DEBUG records per frame, so a
+/// single batch can put thousands of records on the queue in well under a
+/// second. Losing precisely the records emitted during a burst is the worst
+/// available sampling bias, because a burst is what an incident looks like: a
+/// backfill, a crash-loop, a summariser storm.
+///
+/// 16,384 over 30 s is ~546 records/second, comfortably above the SDK's own
+/// ~410 and enough to swallow several ETL batches back to back. The cost is
+/// transient heap in the worst case only - a few tens of MB, and only while
+/// actually bursting - which is not a constraint on a desktop daemon.
+const BATCH_MAX_QUEUE: usize = 16384;
+
 fn try_build_otel_providers(
     service_name: &str,
 ) -> Result<Option<(Tracer, TracerProvider, LoggerProvider)>> {
@@ -489,9 +525,12 @@ fn try_build_otel_providers(
     // less pathological than the logs default of 1 s but still writes ~17k
     // spool files a day on its own - and once the log pipeline is batched,
     // traces become the dominant contributor to the file count.
+    //
+    // The queue MUST be raised alongside the delay - see BATCH_MAX_QUEUE.
     let span_batch = opentelemetry_sdk::trace::BatchConfigBuilder::default()
-        .with_scheduled_delay(std::time::Duration::from_secs(30))
-        .with_max_export_batch_size(2048)
+        .with_scheduled_delay(std::time::Duration::from_secs(BATCH_SCHEDULED_DELAY_SECS))
+        .with_max_export_batch_size(BATCH_MAX_EXPORT)
+        .with_max_queue_size(BATCH_MAX_QUEUE)
         .build();
     let span_processor = BatchSpanProcessor::builder(span_exporter, runtime::Tokio)
         .with_batch_config(span_batch)
@@ -540,8 +579,9 @@ fn try_build_otel_providers(
     // burst forces extra out-of-band exports, i.e. extra files, defeating the
     // longer delay.
     let log_batch = opentelemetry_sdk::logs::BatchConfigBuilder::default()
-        .with_scheduled_delay(std::time::Duration::from_secs(30))
-        .with_max_export_batch_size(2048)
+        .with_scheduled_delay(std::time::Duration::from_secs(BATCH_SCHEDULED_DELAY_SECS))
+        .with_max_export_batch_size(BATCH_MAX_EXPORT)
+        .with_max_queue_size(BATCH_MAX_QUEUE)
         .build();
     let log_processor = BatchLogProcessor::builder(log_exporter, runtime::Tokio)
         .with_batch_config(log_batch)
@@ -617,3 +657,53 @@ pub fn span_context_from_traceparent(
     let sc = cx.span().span_context().clone();
     sc.is_valid().then_some(sc)
 }
+
+#[cfg(test)]
+mod batch_config_tests {
+    use super::{BATCH_MAX_EXPORT, BATCH_MAX_QUEUE, BATCH_SCHEDULED_DELAY_SECS};
+
+    /// The SDK's own defaults, as a reference point for the ratio below.
+    /// `opentelemetry_sdk` 0.27.1, `trace::span_processor`.
+    const SDK_DEFAULT_QUEUE: usize = 2_048;
+    const SDK_DEFAULT_DELAY_SECS: u64 = 5;
+
+    /// Stretching the export delay without widening the queue silently drops
+    /// records.
+    ///
+    /// A full queue is DISCARDED by the batch processor - no error at the call
+    /// site, nothing in the spool, no way to notice after the fact. So the two
+    /// constants are only ever correct as a pair, and the pair is what this
+    /// checks: records-per-second of headroom must stay at least as good as the
+    /// SDK's own defaults, whatever either value is changed to.
+    ///
+    /// This shipped wrong once. The delay went from the SDK default to 30 s to
+    /// cut spool file count, and the queue stayed at 2,048 - dropping the
+    /// absorbable rate from ~410/s to ~68/s. One ETL tick handles `BATCH_SIZE`
+    /// = 500 frames at several DEBUG records each, so a single batch can exceed
+    /// that in under a second, and the records lost would be exactly the ones
+    /// emitted during a burst - which is what an incident looks like.
+    #[test]
+    fn batching_cannot_silently_drop_a_burst() {
+        let ours = BATCH_MAX_QUEUE as f64 / BATCH_SCHEDULED_DELAY_SECS as f64;
+        let sdk = SDK_DEFAULT_QUEUE as f64 / SDK_DEFAULT_DELAY_SECS as f64;
+        assert!(
+            ours >= sdk,
+            "the queue must absorb at least as many records per second as the SDK default \
+             ({ours:.0}/s from {BATCH_MAX_QUEUE} over {BATCH_SCHEDULED_DELAY_SECS}s, vs \
+             {sdk:.0}/s from the SDK's {SDK_DEFAULT_QUEUE} over {SDK_DEFAULT_DELAY_SECS}s). \
+             Raising the delay without raising the queue silently discards bursts."
+        );
+    }
+
+    /// One export must never be asked to carry more than the queue can hold.
+    #[test]
+    fn an_export_batch_fits_in_the_queue() {
+        // Bound to locals first: comparing two `const`s directly is
+        // `clippy::assertions_on_constants`, which is denied workspace-wide.
+        let (export, queue) = (BATCH_MAX_EXPORT, BATCH_MAX_QUEUE);
+        assert!(
+            export <= queue,
+            "max_export_batch_size ({export}) exceeds max_queue_size ({queue})"
+        );
+    }
+}

From d1baab3b1d62c38b73827cb3a7f9edcf226db8e7 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 1 Sep 2026 14:24:59 +0530
Subject: [PATCH 42/53] fix(test): the recheck-throttle test must not underflow
 Instant on Windows

`Instant::now() - CORRUPT_RECHECK_EVERY` panicked with "overflow when
subtracting duration from instant" on the Windows CI job while macOS stayed
green. `Instant` counts from an arbitrary epoch that on Windows is system
boot, so a runner whose uptime is under 15 minutes cannot represent an instant
15 minutes ago.

`checked_sub` returns `Option<Instant>`, which is already the type of the
variable being set. On a long-lived machine that is `Some(an elapsed instant)`
and exercises the elapsed path; on a just-booted one it is `None`, meaning
"never checked", which must also proceed. Both satisfy the assertion, so the
test stays portable without degrading into a no-op on either platform.

Production code was never affected: it only ever calls `duration_since` on an
`Instant` it captured itself. Swept the workspace for the same pattern - the
only other `now() -` is `chrono::Utc::now()`, which is a `DateTime` and does
not underflow.
---
 src/main.rs | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/main.rs b/src/main.rs
index d7268347b..b66d3c7ca 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -2182,7 +2182,19 @@ mod corruption_recovery_tests {
 
         // Once the interval has passed it runs again and, on a clean database,
         // recovers. Drives the clock rather than sleeping 15 minutes.
-        last = Some(Instant::now() - CORRUPT_RECHECK_EVERY);
+        //
+        // `checked_sub`, not `-`. `Instant` is measured from an arbitrary epoch
+        // that on Windows is system boot, so on a CI runner whose uptime is
+        // under CORRUPT_RECHECK_EVERY the subtraction underflows and `std`
+        // panics with "overflow when subtracting duration from instant" - which
+        // is exactly how this failed on the Windows job while macOS stayed
+        // green. It returns `Option<Instant>`, which is already this variable's
+        // type: on a long-lived machine that is `Some(an elapsed instant)` and
+        // exercises the elapsed path, and on a just-booted one it is `None`,
+        // meaning "never checked", which must also proceed. Both satisfy the
+        // assertion below, so the test is portable without being weakened into
+        // a no-op on either.
+        last = Instant::now().checked_sub(CORRUPT_RECHECK_EVERY);
         assert_eq!(
             recover_from_corruption(&pool, ":memory:", None, &mut last).await,
             CorruptionRecheck::Recovered

From 41911b522adb93312497b8d2cf68168158503b0f Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Tue, 1 Sep 2026 15:00:03 +0530
Subject: [PATCH 43/53] fix(test): stop the sent-cap tests exporting an env var
 into their siblings

`the_sent_cap_evicts_oldest_first` set MERIDIAN_TELEMETRY_MAX_SENT_MB=0 to
drive the cap. That variable is PROCESS-global and cargo runs a crate's tests
on parallel threads in one binary, so the write was reaching into every
sibling running at that moment.

It turned the Windows job red while macOS stayed green:
`the_sent_ceiling_leaves_room_for_real_log_history` called `max_sent_bytes()`,
read the concurrent `0`, and failed with "0 bytes is too small to be useful".
The race also ran the other way - `the_sent_cap_keeps_everything_under_the_
ceiling` could observe the same `0` and watch its file be deleted - so the
green runs were luck, not evidence.

`enforce_sent_cap_to(sent, max)` takes the ceiling as a parameter and
`enforce_sent_cap` is the thin wrapper that reads the env for production. The
tests now pass a cap directly and touch no global state. The ceiling test
asserts on DEFAULT_MAX_SENT_MB, which is the property it actually means - "the
value we ship is generous enough" - rather than on whatever the runner's
environment happens to hold. A new read-only test keeps the env path covered.

Parameterising rather than serialising: nothing here needs to be global, and a
mutex leaves the next test reaching for an env var to rediscover this. This is
a recurrence - src/test_env.rs exists because MERIDIAN_SETTINGS_PATH did the
same thing - so the doc now points at it for the cases that genuinely must
read the environment.
---
 src/telemetry_spool/retention.rs | 59 ++++++++++++++++++++++++++++----
 1 file changed, 53 insertions(+), 6 deletions(-)

diff --git a/src/telemetry_spool/retention.rs b/src/telemetry_spool/retention.rs
index e897bc535..12cd4a5e3 100644
--- a/src/telemetry_spool/retention.rs
+++ b/src/telemetry_spool/retention.rs
@@ -298,8 +298,32 @@ pub(super) fn max_sent_bytes() -> u64 {
 /// cap, dropping something already delivered to OpenObserve loses no data that
 /// was not already sent, so it is routine housekeeping rather than a fault.
 pub(super) fn enforce_sent_cap(sent: &Path) -> Result<()> {
-    let max = max_sent_bytes();
+    enforce_sent_cap_to(sent, max_sent_bytes())
+}
 
+/// [`enforce_sent_cap`] against an explicit ceiling.
+///
+/// Split out so tests can choose a cap **without touching the environment**.
+/// `std::env::set_var` is process-global and Rust runs a test binary's tests on
+/// parallel threads in ONE process, so a test that set
+/// `MERIDIAN_TELEMETRY_MAX_SENT_MB` was silently reaching into every sibling
+/// running at the same time. That is not theoretical: it turned the Windows CI
+/// job red while macOS stayed green, because `max_sent_bytes` read the `0` a
+/// concurrent test had set and the ceiling assertion saw 0 bytes. The race ran
+/// in the other direction too - a sibling asserting that an under-cap `sent/`
+/// is left alone could observe the same `0` and watch its file be deleted.
+///
+/// Parameterising is the fix rather than serialising with a mutex: nothing here
+/// needs to be global, and a lock would leave the next test that reaches for an
+/// env var to rediscover this.
+///
+/// This is a recurrence, not a novelty - [`crate::test_env`] exists because
+/// `MERIDIAN_SETTINGS_PATH` produced the same failure, and its header is worth
+/// reading for how quiet these are (the collision needs tests from two modules
+/// in one run, so a filtered run reports green). Prefer this shape where the
+/// value can simply be passed in; reach for that crate-level lock only when the
+/// code under test genuinely has to read the process environment.
+fn enforce_sent_cap_to(sent: &Path, max: u64) -> Result<()> {
     let Ok(entries) = std::fs::read_dir(sent) else {
         return Ok(());
     };
@@ -575,9 +599,11 @@ mod tests {
             std::fs::write(p, vec![b'x'; 4096]).unwrap();
         }
 
-        std::env::set_var("MERIDIAN_TELEMETRY_MAX_SENT_MB", "0");
-        enforce_sent_cap(&sent).unwrap();
-        std::env::remove_var("MERIDIAN_TELEMETRY_MAX_SENT_MB");
+        // The cap is passed in, NOT set via `MERIDIAN_TELEMETRY_MAX_SENT_MB`.
+        // That env var is process-global and these tests run on parallel
+        // threads in one process, so setting it here was corrupting siblings -
+        // see `enforce_sent_cap_to`'s doc for the CI failure it caused.
+        enforce_sent_cap_to(&sent, 0).unwrap();
 
         assert!(!oldest.exists(), "the oldest shipped file must go first");
         assert!(
@@ -596,18 +622,39 @@ mod tests {
         let f = sent.join("traces-100-0.otlp");
         std::fs::write(&f, b"small").unwrap();
 
-        enforce_sent_cap(&sent).unwrap();
+        // Explicit cap for the same reason as the sibling above: reading the
+        // env here would let a concurrent test's `set_var` delete this file.
+        enforce_sent_cap_to(&sent, DEFAULT_MAX_SENT_MB * 1024 * 1024).unwrap();
         assert!(f.exists(), "a spool under its cap must not be pruned");
     }
 
     /// The ceiling has to leave room for the log history it backs; a tiny cap
     /// would silently turn `meridian logs` into a thirty-second window.
+    ///
+    /// Asserts on the shipped DEFAULT, not on `max_sent_bytes()`. The property
+    /// is "the value we ship is generous enough", and reading the env made this
+    /// assert on the machine's environment instead - which is how it failed on
+    /// Windows CI, having picked up the `0` a concurrent test had exported.
     #[test]
     fn the_sent_ceiling_leaves_room_for_real_log_history() {
-        let bytes = max_sent_bytes();
+        let bytes = DEFAULT_MAX_SENT_MB * 1024 * 1024;
         assert!(
             bytes >= 64 * 1024 * 1024,
             "sent/ backs `meridian logs`; {bytes} bytes is too small to be useful"
         );
     }
+
+    /// The override is still wired up - parameterising the tests must not mean
+    /// nothing exercises the env path at all.
+    ///
+    /// Reads without writing, so it is safe beside every parallel sibling: with
+    /// the variable unset (the normal case, including CI) it must resolve to the
+    /// shipped default.
+    #[test]
+    fn the_default_ceiling_applies_when_the_override_is_unset() {
+        if std::env::var_os("MERIDIAN_TELEMETRY_MAX_SENT_MB").is_some() {
+            return; // an operator's own override; nothing to assert about ours
+        }
+        assert_eq!(max_sent_bytes(), DEFAULT_MAX_SENT_MB * 1024 * 1024);
+    }
 }

From 01550c11d8f22e2889d0ecf1660e794151b16dad Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Thu, 3 Sep 2026 09:35:05 +0530
Subject: [PATCH 44/53] feat(auth): add the OTP Cloudflare Worker (send/verify
 email codes via SES)

Standalone infrastructure for the Clerk-to-OTP replacement (see the next
commit for the client cut): two authenticated routes, KV-backed per-email/
per-IP/global rate limiting, HMAC-hashed codes with a bounded verify-attempt
cap, and AWS SES delivery via aws4fetch. Nothing in the shipped app calls
this yet, so this lands with zero risk on its own.

infra/hf-proxy was deleted after shipping unauthenticated with no rate
limit and getting hammered for 173k req/day against a 100k/day account cap
- this Worker is built against that lesson from the start (bearer-token
origin auth, allowlisted paths only, rate limits before the SES call so a
run of delivery failures still counts against budget).

scripts/deploy-otp-worker.sh mirrors deploy-gateway.sh's post-deploy
verification rigor (classify_probe, --self-test, --verify-only).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 infra/otp-worker/.gitignore                   |     5 +
 infra/otp-worker/README.md                    |   327 +
 infra/otp-worker/package-lock.json            |  2836 +++
 infra/otp-worker/package.json                 |    28 +
 infra/otp-worker/src/__tests__/auth.test.ts   |    59 +
 .../src/__tests__/crypto-utils.test.ts        |    61 +
 infra/otp-worker/src/__tests__/email.test.ts  |    53 +
 infra/otp-worker/src/__tests__/index.test.ts  |    88 +
 infra/otp-worker/src/__tests__/kv.test.ts     |    67 +
 infra/otp-worker/src/__tests__/otp.test.ts    |   104 +
 .../src/__tests__/ratelimit.test.ts           |    88 +
 infra/otp-worker/src/__tests__/ses.test.ts    |    79 +
 .../src/__tests__/turnstile.test.ts           |    53 +
 infra/otp-worker/src/auth.ts                  |    74 +
 infra/otp-worker/src/crypto-utils.ts          |    60 +
 infra/otp-worker/src/email.ts                 |    38 +
 infra/otp-worker/src/env.d.ts                 |    43 +
 infra/otp-worker/src/index.ts                 |   218 +
 infra/otp-worker/src/kv.ts                    |    85 +
 infra/otp-worker/src/otp.ts                   |   109 +
 infra/otp-worker/src/ratelimit.ts             |    85 +
 infra/otp-worker/src/responses.ts             |    29 +
 infra/otp-worker/src/ses.ts                   |   120 +
 infra/otp-worker/src/turnstile.ts             |    88 +
 infra/otp-worker/tsconfig.json                |    23 +
 infra/otp-worker/vitest.config.mts            |    22 +
 infra/otp-worker/worker-configuration.d.ts    | 15305 ++++++++++++++++
 infra/otp-worker/wrangler.jsonc               |    80 +
 scripts/deploy-otp-worker.sh                  |   432 +
 29 files changed, 20659 insertions(+)
 create mode 100644 infra/otp-worker/.gitignore
 create mode 100644 infra/otp-worker/README.md
 create mode 100644 infra/otp-worker/package-lock.json
 create mode 100644 infra/otp-worker/package.json
 create mode 100644 infra/otp-worker/src/__tests__/auth.test.ts
 create mode 100644 infra/otp-worker/src/__tests__/crypto-utils.test.ts
 create mode 100644 infra/otp-worker/src/__tests__/email.test.ts
 create mode 100644 infra/otp-worker/src/__tests__/index.test.ts
 create mode 100644 infra/otp-worker/src/__tests__/kv.test.ts
 create mode 100644 infra/otp-worker/src/__tests__/otp.test.ts
 create mode 100644 infra/otp-worker/src/__tests__/ratelimit.test.ts
 create mode 100644 infra/otp-worker/src/__tests__/ses.test.ts
 create mode 100644 infra/otp-worker/src/__tests__/turnstile.test.ts
 create mode 100644 infra/otp-worker/src/auth.ts
 create mode 100644 infra/otp-worker/src/crypto-utils.ts
 create mode 100644 infra/otp-worker/src/email.ts
 create mode 100644 infra/otp-worker/src/env.d.ts
 create mode 100644 infra/otp-worker/src/index.ts
 create mode 100644 infra/otp-worker/src/kv.ts
 create mode 100644 infra/otp-worker/src/otp.ts
 create mode 100644 infra/otp-worker/src/ratelimit.ts
 create mode 100644 infra/otp-worker/src/responses.ts
 create mode 100644 infra/otp-worker/src/ses.ts
 create mode 100644 infra/otp-worker/src/turnstile.ts
 create mode 100644 infra/otp-worker/tsconfig.json
 create mode 100644 infra/otp-worker/vitest.config.mts
 create mode 100644 infra/otp-worker/worker-configuration.d.ts
 create mode 100644 infra/otp-worker/wrangler.jsonc
 create mode 100644 scripts/deploy-otp-worker.sh

diff --git a/infra/otp-worker/.gitignore b/infra/otp-worker/.gitignore
new file mode 100644
index 000000000..d633f7e53
--- /dev/null
+++ b/infra/otp-worker/.gitignore
@@ -0,0 +1,5 @@
+node_modules/
+.wrangler/
+.dev.vars
+.dev.vars.*
+*.log
diff --git a/infra/otp-worker/README.md b/infra/otp-worker/README.md
new file mode 100644
index 000000000..37f319089
--- /dev/null
+++ b/infra/otp-worker/README.md
@@ -0,0 +1,327 @@
+# otp-worker
+
+Cloudflare Worker backing Meridian's one-time email+OTP capture step (the
+setup wizard's replacement for Clerk — see the parent plan,
+`giggly-jumping-hopcroft.md`, for the full "why"). Sends a 6-digit code to an
+email address via AWS SES and verifies it. No accounts, no sessions, no
+sign-out — ask once, verify once, store the email locally, never re-check.
+
+This is the **first live Cloudflare Worker in this repo.** Read "Why this
+design" below before changing anything auth- or rate-limit-related — a prior
+Worker (`infra/hf-proxy`, since deleted) shipped unauthenticated with no rate
+limit, got hammered for 173,088 requests in a day against a 100k/day
+account-wide cap, and took `meridiona.com` down. CLAUDE.md's Hard Rules
+section has the full incident writeup; this Worker exists specifically not to
+repeat it.
+
+## Routes
+
+Exactly two exist. Everything else — wrong path, wrong method — gets a plain
+404. Both require `Authorization: Bearer <token>`.
+
+| Route | Body | Purpose |
+|---|---|---|
+| `POST /otp/send` | `{ email, turnstileToken? }` | Generate a code, email it via SES |
+| `POST /otp/verify` | `{ email, code }` | Check a code against the live record |
+
+### Status codes
+
+The plan specified the set of codes (400/401/403/410/429/503) but not the
+full route-by-route mapping; this is what was actually implemented, and each
+distinct code is meant to map to a distinct client-side message:
+
+**`/otp/send`**
+
+| Status | Body | Meaning |
+|---|---|---|
+| 200 | `{ ok: true }` (or `{ ok: true, code }` — staging only, see below) | Email queued for delivery |
+| 400 | `{ error: "invalid_email" \| "invalid_json" \| "invalid_turnstile_token" }` | Malformed request |
+| 401 | `{ error: "unauthorized" }` | Missing/wrong bearer token |
+| 403 | `{ error: "turnstile_failed" }` | A `turnstileToken` was sent and failed verification |
+| 429 | `{ error: "rate_limited", scope: "email" \| "ip" \| "global" }` | One of the three send caps tripped |
+| 503 | `{ error: "email_delivery_failed" }` | SES call failed after all gates passed |
+
+**`/otp/verify`**
+
+| Status | Body | Meaning |
+|---|---|---|
+| 200 | `{ ok: true, verified: true }` | Code matched; record consumed |
+| 200 | `{ ok: true, verified: false, attemptsRemaining }` | Wrong code, record still live — not an error, the caller can retry |
+| 400 | `{ error: "invalid_email" \| "invalid_json" \| "invalid_code" }` | Malformed request |
+| 401 | `{ error: "unauthorized" }` | Missing/wrong bearer token |
+| 410 | `{ error: "code_expired_or_not_found" }` | No live record — never sent, naturally expired, or attempts just exhausted |
+
+`exhausted` (5th wrong guess) and `not_found_or_expired` (no record at all)
+are deliberately collapsed into the same 410 — a caller must not be able to
+tell "you used up your attempts" from "there was never a code for this
+email" from the HTTP layer; both just mean "request a new code."
+
+## Why this design (hf-proxy postmortem, applied)
+
+Four things this Worker does that `infra/hf-proxy` didn't, each mapped to a
+line item in CLAUDE.md's Hard Rules:
+
+1. **Authenticates every request.** `auth.ts` checks `Authorization: Bearer`
+   before any body parsing or KV access, on both routes, with no
+   unauthenticated path. Empty/unconfigured secrets never match (guards the
+   "both sides blank" bypass).
+2. **Allowlists the paths it serves.** The router in `index.ts` is an
+   exhaustive `if/if/else 404` — there is no default-allow branch.
+3. **Rate-limits.** Three independent KV-backed caps (per-email, per-IP,
+   global-daily) gate every send, checked before any SES call is attempted.
+4. **Has exactly one caller** (the Meridian tray) and a name that says so.
+   When the tray stops calling this, delete it — don't leave it running with
+   a live DNS record, the way hf-proxy did after the MLX stack that used it
+   was removed. Cloudflare publishes every hostname to Certificate
+   Transparency logs the moment it issues a cert, so an unused endpoint is
+   discoverable whether or not it's advertised.
+
+Bearer-auth honesty note: the token is compiled into the shipped tray binary
+(mirrors `tray/src-tauri/src/counter_ping.rs`'s `DEFAULT_COUNTER_API_KEY`
+pattern) and is therefore extractable by anyone with the binary. It proves
+"a genuine Meridian build sent this," **not** "a human is present." Rate
+limiting is the actual abuse containment; the bearer token only keeps out
+callers who never had a Meridian binary in the first place.
+
+## KV schema (`OTP_KV`)
+
+Keys are built from `sha256(normalizeEmail(email))` — the raw email is never
+used as a KV key. `rl:ip:<ip>` is the one exception, keyed on the literal
+`CF-Connecting-IP` value, per the plan.
+
+| Key | Value | Notes |
+|---|---|---|
+| `code:<hash>` | `{ codeHash, attempts, expiresAt }` | `codeHash` is `HMAC-SHA256(OTP_CODE_PEPPER, code)` — never the bare code |
+| `rl:email:<hash>` | `{ count, expiresAt }` | Rolling 24h window from first send, cap `RL_EMAIL_PER_DAY` |
+| `rl:ip:<ip>` | `{ count, expiresAt }` | Rolling 1h window, cap `RL_IP_PER_HOUR` |
+| `global:sends:<UTC date>` | `{ count, expiresAt }` | One key per calendar day, cap `RL_GLOBAL_PER_DAY`, cost/abuse containment |
+
+Every record embeds its own authoritative `expiresAt` (epoch ms) rather than
+relying solely on KV's own TTL — two independent reasons, both documented in
+`kv.ts`/`otp.ts`/`ratelimit.ts`:
+
+- A rolling window's expiry must survive a read-modify-write without being
+  reset on every increment, and Cloudflare KV requires `expirationTtl` to be
+  re-specified on **every** `put` (omitting it clears the expiry entirely).
+- **Cloudflare Workers KV enforces a hard minimum `expirationTtl` of 60
+  seconds.** A code with 20 real seconds left cannot be written back with a
+  20-second KV TTL. `kv.ts`'s `ttlSecondsFromExpiry` clamps to that floor —
+  this only affects the KV-level storage-cleanup timer; the embedded
+  `expiresAt` check in `otp.ts`/`ratelimit.ts` is what actually enforces
+  expiry, so a clamped KV TTL can never let an expired record be honoured. It
+  can only make a dead key linger in storage slightly longer before KV itself
+  reaps it.
+
+Counters are persisted **before** the SES call is attempted, not after — the
+caps exist for cost/abuse containment against attempted sends, so a run of
+SES failures (an outage, a bad credential) still counts against budget.
+Otherwise, an attacker (or an outage) could drive unlimited send-attempt
+traffic for free by ensuring every attempt "fails" cheaply.
+
+## Code hashing
+
+`OTP_CODE_PEPPER` (a Worker secret) is mixed into every code via
+HMAC-SHA256 before it touches KV — never a bare hash, since a 6-digit code is
+trivially brute-forced offline from a raw KV dump otherwise. Verify caps
+attempts at `MAX_VERIFY_ATTEMPTS` (5) before invalidating the code and
+forcing a fresh send. **A wrong guess never extends the record's remaining
+TTL** — `otp.ts`'s `verifyOtpAttempt` carries the original `expiresAt`
+forward unchanged on every wrong guess; this is pinned by
+`otp.test.ts`'s "never extends the TTL" cases.
+
+## Email delivery (AWS SES)
+
+`ses.ts` calls SES's `SendEmail` action (Query API, `2010-12-01`),
+SigV4-signed via [`aws4fetch`](https://github.com/mhart/aws4fetch) —
+Workers run on a V8 isolate with no Node.js APIs, so the official AWS SDK
+doesn't work here; `aws4fetch` is the established community pattern for
+calling AWS from a Worker.
+
+**Resolved, not specified by the plan: SES's v1 Query API over SESv2's JSON
+API.** Picked because it's the one with a documented, minimal `aws4fetch`
+example (`service: "email"`, form-urlencoded body) — a single `SendEmail`
+call is low-stakes either way and this was the path of least friction.
+
+`from` is `${FROM_NAME} <${FROM_ADDRESS}>` — currently
+`Meridian <otp@auth.meridiona.com>`, a placeholder verified subdomain of
+`meridiona.com` matching the existing `telemetry.`/`observe.` subdomain
+convention. **DNS verification (SPF/DKIM records in SES, added to the
+existing Cloudflare-managed zone) is a manual step outside this Worker's
+code** — see "Manual steps before first deploy" below.
+
+The email body is plain text, no links: "Your Meridian verification code is:
+`<code>`. This code expires in `<N>` minutes...".
+
+SES error responses are never logged verbatim (`extractSesErrorCode`) —
+SES's sandbox-mode "email address is not verified" error echoes the
+destination address back in the response text, which must never reach
+Workers Logs.
+
+## Turnstile (conditional, per the plan)
+
+**Turnstile support is wired but CONDITIONAL: whether the client actually
+sends a token depends on a separate frontend/Tauri feasibility spike this
+Worker does not block on. The rate-limiting layer above is the mechanism
+that holds either way** — a request with no `turnstileToken` at all is
+accepted purely on bearer-auth + rate limits, exactly as if Turnstile didn't
+exist.
+
+Two independent gates in `turnstile.ts`, both must pass for verification to
+actually run:
+
+1. The request body includes a `turnstileToken` at all. If absent, `index.ts`
+   never calls `turnstile.ts` — the send proceeds on bearer-auth +
+   rate-limits alone (the plan's explicit "if absent, proceed without it").
+2. `TURNSTILE_SECRET_KEY` (a Worker secret, **not** one of the plan's
+   originally-listed secrets — added here since Turnstile wasn't in scope
+   when that table was written) is actually configured. If unset — the
+   expected state until/unless the frontend spike succeeds and a Turnstile
+   site is provisioned — verification is a no-op that returns `true` and
+   logs a warning, rather than rejecting every send because a feature
+   nothing has enabled yet looks "misconfigured."
+
+**Resolved, not specified by the plan: a token that IS present but FAILS
+verification is rejected with 403**, rather than silently ignored — fail
+closed on invalid input, consistent with this repo's conventions elsewhere.
+A present-and-valid token verifies as usual; an absent token skips
+verification entirely (gate 1); an unconfigured secret with a present token
+also proceeds (gate 2), since there's nothing to validate against yet.
+
+## Anti-abuse summary
+
+Defense in depth, in the order a request actually passes through them:
+
+1. Bearer token (attestation, not a strong secret — see above)
+2. Turnstile, if/when wired up client-side (optional, see above)
+3. Three independent KV rate limits (per-email/per-IP/global), checked
+   before any code is generated or SES is called
+4. HMAC-peppered code hash + 5-attempt cap on verify
+
+## Secrets / config split
+
+Mirrors the existing `ops/central-observability` convention (public
+`vars.*` vs. `wrangler secret put`-only values) and the plan's own table:
+
+| Name | Where | Notes |
+|---|---|---|
+| `OTP_CLIENT_TOKEN` | `wrangler secret put` (both envs) | Bearer token the tray sends |
+| `OTP_CODE_PEPPER` | `wrangler secret put` (both envs) | HMAC pepper for code hashing |
+| `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_REGION` | `wrangler secret put` (both envs) | Scoped to an IAM policy permitting only `ses:SendEmail` on the verified identity |
+| `TURNSTILE_SECRET_KEY` | `wrangler secret put` (both envs), optional | Unset until/unless the frontend spike lands — see "Turnstile" above |
+| `CI_TEST_TOKEN` | `wrangler secret put --env staging` **only** | Staging-only auth token that also unlocks the `/otp/send` code echo — see below |
+| `ENVIRONMENT`, `FROM_ADDRESS`, `FROM_NAME`, `OTP_TTL_S`, `MAX_VERIFY_ATTEMPTS`, `RL_EMAIL_PER_DAY`, `RL_IP_PER_HOUR`, `RL_GLOBAL_PER_DAY` | `wrangler.jsonc` `vars` | Public, tunable without touching code |
+
+### Staging-only code echo
+
+`scripts/deploy-otp-worker.sh`'s happy-path send→verify smoke test needs to
+read the generated code without a real inbox. `/otp/send` echoes the code in
+its response body (`{ ok: true, code }`) under **two** conditions, both
+checked at the point of response, not just at auth time:
+
+```ts
+if (env.ENVIRONMENT === "staging" && auth.isCiTestToken) {
+  return ok({ code });
+}
+```
+
+`env.ENVIRONMENT !== "staging"` is an explicit runtime guard, not just "the
+secret happens to be unset" — a `CI_TEST_TOKEN` secret mistakenly present on
+production would still never trigger the echo there. And the echo never
+fires for the normal `OTP_CLIENT_TOKEN` bearer, even on staging — only the
+distinct `CI_TEST_TOKEN` unlocks it (see `auth.ts`'s `isCiTestToken` flag).
+The production bearer token can never reach this path, on any environment.
+
+## Testing
+
+Unit tests (`src/__tests__/*.test.ts`) run inside a real Miniflare-simulated
+Workers runtime via **`@cloudflare/vitest-plugin`** — no Cloudflare account
+or network access required, everything runs locally against
+`wrangler.jsonc`'s binding shapes.
+
+**Resolved, not specified by the plan: `@cloudflare/vitest-plugin`, not
+`@cloudflare/vitest-pool-workers`.** There is no existing Workers test
+convention anywhere else in this repo to mirror (`ui/` and
+`packages/meridian-mcp/` both use plain Node-based test runners with no
+bundler-aware pool), so this is a new precedent for the repo, not an
+established one. `@cloudflare/vitest-pool-workers` (the package named in the
+plan's discussion and in most existing docs/tutorials as of this writing) no
+longer exports `defineWorkersConfig` from `/config` as of its `0.22.x`
+line — that API was replaced by a plugin-based config
+(`cloudflareTest()` from `@cloudflare/vitest-plugin`, used in `vitest.config.mts`
+via `defineConfig({ plugins: [cloudflareTest(...)] })`) to match Vitest 4's
+plugin architecture. This was chosen over falling back to hand-rolled fakes
+for everything because it wasn't more than trivial friction to wire up once
+the correct current package was identified, and it gives real coverage of
+`crypto.subtle.timingSafeEqual` and the actual `KVNamespace` binding
+(`kv.test.ts`) rather than a hand-mocked substitute for either.
+
+Coverage priorities, highest first:
+
+- `otp.test.ts` — the TTL-preservation invariant on a wrong guess, the
+  exact-5th-attempt exhaustion boundary, and the "already exhausted, right
+  code doesn't matter" case. This is the module a regression here would be
+  most dangerous in.
+- `auth.test.ts` — the empty-secret-never-passes and
+  CI-token-never-works-off-staging cases.
+- `ratelimit.test.ts` — window-open/preserve/reset boundaries and the
+  three-scope precedence order.
+- `turnstile.test.ts` — both conditional gates, and fail-closed on network
+  error / non-2xx / explicit failure.
+- `ses.test.ts` — never logging a raw SES error body (which can echo the
+  destination email in sandbox mode), and that the code never leaks into
+  the request URL.
+- `kv.test.ts` — a real KV round-trip (not a fake), plus the 60s-floor
+  clamp math.
+
+```bash
+npm install
+npm run typecheck   # tsc --noEmit
+npm test            # vitest run, inside simulated Workers runtime
+npx wrangler deploy --dry-run              # validates wrangler.jsonc, no auth needed
+npx wrangler deploy --dry-run --env staging
+```
+
+All four commands above were run as part of building this Worker and pass
+with no Cloudflare account access — `--dry-run` bundles and validates
+`wrangler.jsonc` fully offline.
+
+## Manual steps before first deploy
+
+None of the following can be done from this code — they need an operator
+with AWS/Cloudflare account access:
+
+1. **KV namespaces.** `npx wrangler kv namespace create OTP_KV` (production)
+   and `npx wrangler kv namespace create OTP_KV --env staging`, then paste
+   the two returned ids into `wrangler.jsonc`'s
+   `REPLACE_ME_KV_NAMESPACE_ID_PRODUCTION` / `_STAGING` placeholders.
+2. **SES sending identity.** Verify `auth.meridiona.com` (or whatever
+   subdomain is chosen) in the SES console — adds DKIM/SPF DNS records to
+   the existing Cloudflare-managed zone, same pattern as `telemetry.`/
+   `observe.`. Update `wrangler.jsonc`'s `FROM_ADDRESS` if the real verified
+   address differs from the `otp@auth.meridiona.com` placeholder.
+3. **SES production access.** New accounts start in a sandbox: 200
+   emails/24h, 1/sec, and can only send to pre-verified recipients —
+   unusable for real users. File an AWS Support case to request production
+   access before PR 2 (the client cut) ships to real users. Confirm the
+   granted quota in the SES console once approved.
+4. **IAM credentials.** Create a narrowly-scoped IAM user/policy granting
+   only `ses:SendEmail` on the verified identity.
+5. **Secrets**, run for both environments (default + `--env staging`) unless
+   noted:
+   ```bash
+   npx wrangler secret put OTP_CLIENT_TOKEN
+   npx wrangler secret put OTP_CODE_PEPPER
+   npx wrangler secret put AWS_ACCESS_KEY_ID
+   npx wrangler secret put AWS_SECRET_ACCESS_KEY
+   npx wrangler secret put AWS_REGION
+   npx wrangler secret put CI_TEST_TOKEN --env staging   # staging only
+   # optional, only once the Turnstile frontend spike lands:
+   npx wrangler secret put TURNSTILE_SECRET_KEY
+   ```
+6. **Deploy + verify:**
+   ```bash
+   npm run deploy:staging   # wrangler deploy --env staging
+   bash ../../scripts/deploy-otp-worker.sh --verify-only <staging-url>
+   npm run deploy           # wrangler deploy (production)
+   bash ../../scripts/deploy-otp-worker.sh --verify-only <production-url>
+   ```
diff --git a/infra/otp-worker/package-lock.json b/infra/otp-worker/package-lock.json
new file mode 100644
index 000000000..b5756bca7
--- /dev/null
+++ b/infra/otp-worker/package-lock.json
@@ -0,0 +1,2836 @@
+{
+  "name": "otp-worker",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "otp-worker",
+      "version": "1.0.0",
+      "dependencies": {
+        "aws4fetch": "1.0.20"
+      },
+      "devDependencies": {
+        "@cloudflare/vitest-plugin": "1.1.2",
+        "@types/node": "22.20.1",
+        "typescript": "5.9.3",
+        "vitest": "4.1.11",
+        "wrangler": "4.127.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@cloudflare/kv-asset-handler": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/@cloudflare/kv-asset-handler/-/kv-asset-handler-0.5.0.tgz",
+      "integrity": "sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg==",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@cloudflare/unenv-preset": {
+      "version": "2.16.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/unenv-preset/-/unenv-preset-2.16.1.tgz",
+      "integrity": "sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw==",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "peerDependencies": {
+        "unenv": "2.0.0-rc.24",
+        "workerd": ">1.20260305.0 <2.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "workerd": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@cloudflare/vitest-plugin": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@cloudflare/vitest-plugin/-/vitest-plugin-1.1.2.tgz",
+      "integrity": "sha512-TLkPo1JTKk0LyFwQlNWY0MnZ0RW7FsjianjSdrKiPi/NbL7DUnIEe8O8leJAeBboiRyn23g/NG5jLeyZvWlmVA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cjs-module-lexer": "1.2.3",
+        "esbuild": "0.28.1",
+        "miniflare": "5.20260828.0-alpha",
+        "wrangler": "4.127.1",
+        "zod": "4.4.3"
+      },
+      "peerDependencies": {
+        "@vitest/runner": "^4.1.0",
+        "@vitest/snapshot": "^4.1.0",
+        "vitest": "^4.1.0"
+      }
+    },
+    "node_modules/@cloudflare/workerd-darwin-64": {
+      "version": "1.20260828.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260828.1.tgz",
+      "integrity": "sha512-CVd+xPhqUESg8Xhq09TZx0wl4FSirfJGOzvbPz2yHhBIvmNHFFQkSN3rkd7wEwnhQQk37Xi0/aD6ykPLJbmGiQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cloudflare/workerd-darwin-arm64": {
+      "version": "1.20260828.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20260828.1.tgz",
+      "integrity": "sha512-5HDPXRM152vU5JveByGFk34X57TVyIsfp4cabepAf45DC0MKvm52ucJqAjW1h8bvW4X+zRw9GU35OHF9FEC9Ww==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cloudflare/workerd-linux-64": {
+      "version": "1.20260828.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20260828.1.tgz",
+      "integrity": "sha512-MQ1Ll9P7F72HHUKizbb7BlDfbY8fRoNMpbIpZoU6uKsSkneFICWSKv6UlgU9EQZ+w0i7TMa12iUgJ8l29eRI9A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cloudflare/workerd-linux-arm64": {
+      "version": "1.20260828.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20260828.1.tgz",
+      "integrity": "sha512-FBTaUQ1xcU9jcp4OyBPcH8x0QiFvc1iuZL2GkD8zp2q1WyTVHYOptRDQUU+cuHjt0rQ2EIKVPBjahPxfa0joBw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cloudflare/workerd-windows-64": {
+      "version": "1.20260828.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20260828.1.tgz",
+      "integrity": "sha512-yvr77hC7dUbvK5K+SCg062kkPq3sx+drV1PcgHslzHDYcJBtT0V3X80qLE49LW1vq2svaeNmsVQS+vHsqWu8cQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cspotcode/source-map-support": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz",
+      "integrity": "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "0.3.9"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@emnapi/runtime": {
+      "version": "1.11.3",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.3.tgz",
+      "integrity": "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@img/colour": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
+      "integrity": "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@img/sharp-darwin-arm64": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.2.tgz",
+      "integrity": "sha512-eEieHsMksAW4IiO5NzauESRl2D2qz3J/kwUxUrSfV06A93eEaRfMpHXyUb1mAqrR7i8U9A0GRqE9pjn6u1Jjpg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-darwin-arm64": "1.3.1"
+      }
+    },
+    "node_modules/@img/sharp-darwin-x64": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.2.tgz",
+      "integrity": "sha512-BaktuGPCeHJMARpodR8jK4uKiZrPAy9WrfQW0sdI37clracq8Bp01AYS3SZgi5FS/y5twa9t4+LIuuxQjqRrWw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-darwin-x64": "1.3.1"
+      }
+    },
+    "node_modules/@img/sharp-freebsd-wasm32": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.2.tgz",
+      "integrity": "sha512-YoAxdnd8hPUkvLHd3bWY+YA8nw3xM/RyRopYucNsWHVSan8NLVM3X2volsfoRDcXdUJPg6tXahSd7HXPK7lRnw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "dependencies": {
+        "@img/sharp-wasm32": "0.35.2"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-darwin-arm64": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.1.tgz",
+      "integrity": "sha512-4V/M3roRMTYjiwZY9IOVQOE8OyeCxFAkYmyZDrZl51uOKjibm3oeEJ4WAmLxutAfzFbC9jqUiPs2gbnGflH+7g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-darwin-x64": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.1.tgz",
+      "integrity": "sha512-c0/DxItpJv2+dGhgycJBBgotdqruGYDvA79drdh0MD1dFpy7JzJ/PlXwi1H4rFf0eTy8tgbI91aHDnZIceY3jQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-arm": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.1.tgz",
+      "integrity": "sha512-aGGy9aWzXgHBG7HNyQPWorZthlp7+x6fDRoPAQbGO3ThcttuTyKIx3NuSHb6zb4gBNq6/yNn9f1cy9nFKS/Vmg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-arm64": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.1.tgz",
+      "integrity": "sha512-JznefmcK9j1JKPz8AkQDh89kjojubyfOasWBPKfzMIhPwsgDy9evpE/naJTXXXmghS1iFwR8u/kTwh/I2/+GCw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-ppc64": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.1.tgz",
+      "integrity": "sha512-1EkwGNCZk6iWNCMWqrvdJ+r1j0PT1zIz60CNPhYnJlK/zyeWqlsPZIe+ocBVqPF8k/Ssee/NCk+tE9Ryrko6ng==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-riscv64": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.1.tgz",
+      "integrity": "sha512-Ilays+w2bXdnxzxtQdmXR62u8o8GYa3eL4+Gr+1KiE4xperMZUslRaVPJwwPkzlHEjGfXAfRVAa/7CYCtSqsBw==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-s390x": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.1.tgz",
+      "integrity": "sha512-VfBwVHQTbRoj4XlpA/KLZ7ltgMpz+4WSejFzQ+GnoImjo1PtEJ59QB2qR1xQEeRPYIkNrPIm2L4cICMvz4C2ew==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-x64": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.1.tgz",
+      "integrity": "sha512-+c8ukgwU62DS54nCAjw7keOfHUkmr0B5QHEdcOqRnodF/MNXJbVI8Eopoj4B/0H8Asr65I+A4Amrn7a85/md6A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.1.tgz",
+      "integrity": "sha512-qlKb/pwbkAi1WMsJrYHk7CuDrd12s27U2QnRhFYUoJNrRCmkosMTttuRFat/DDB3IlDm5qE1TJgZ4JDnHX8Ldw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linuxmusl-x64": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.1.tgz",
+      "integrity": "sha512-yO21HwoUVLN8Qa+/SBjQLMYwBWAVJjeGPNe+hc0OUeMeifEtJqu5a1c4HayE1nNpDih9y3/KkoltfkDodmKAlg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-linux-arm": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.2.tgz",
+      "integrity": "sha512-SE4kzF2mepn6z+6E7L6lsV8FzuLL6IPQdyX8ZiwROAG/G8td+hP/m7FsFPwidtrF19gvajuC9l6TxAVcsA4S7A==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-arm": "1.3.1"
+      }
+    },
+    "node_modules/@img/sharp-linux-arm64": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.2.tgz",
+      "integrity": "sha512-af12Pnd0ZGu2HfP8NayB0kk6eC/lrfbQE6HlR4jD+34wdJ1Vw9TF6TMn6ZvffT+WgqVsl0hRbmNvz2u/23VmwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-arm64": "1.3.1"
+      }
+    },
+    "node_modules/@img/sharp-linux-ppc64": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.2.tgz",
+      "integrity": "sha512-hYSBm7zcNtDCozCxQHYZJiu63b/bXsgRZuOxCIBZsStMM9Vap47iFHdbX4kCvQsblPB/k+clhELpdQJHQLSHvg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-ppc64": "1.3.1"
+      }
+    },
+    "node_modules/@img/sharp-linux-riscv64": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.2.tgz",
+      "integrity": "sha512-qQt0Kc13+Hoan/Awq/qMSQw3L+RI1NCRPgD5cUJ/1WSSmIoysLOc72jlRM3E0OHN9Yr313jgeQ2T+zW+F03QFA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-riscv64": "1.3.1"
+      }
+    },
+    "node_modules/@img/sharp-linux-s390x": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.2.tgz",
+      "integrity": "sha512-E4fLLfRPzDLlEeDaTzI98OFLcv++WL5ChLLMwPoVd0CIoZQqupBSNbOisPL5am9XsbQ9T84+iiMpUvbFtkunbA==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-s390x": "1.3.1"
+      }
+    },
+    "node_modules/@img/sharp-linux-x64": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.2.tgz",
+      "integrity": "sha512-gi0zFJJRLswfCZmHtJdikXPOc5u7qamSOS3NHedLqLd4W8Q0NqjdBr6TTRIgsfFjqfTsHFgdfvJ9LwqSgcHiAA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-x64": "1.3.1"
+      }
+    },
+    "node_modules/@img/sharp-linuxmusl-arm64": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.2.tgz",
+      "integrity": "sha512-siWbOW1u6HFnFLrp0waKyW7VEf7jYvcDWdrXEFa8AkdAQgEvuu5Fz8/Y70w9EeqAdwDtfU012BhEHHaDqvQNzg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.1"
+      }
+    },
+    "node_modules/@img/sharp-linuxmusl-x64": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.2.tgz",
+      "integrity": "sha512-YBqMMcjDi4QGYiSn4vNOYBhmlC4z5AXqkOUUqI2e0AFA4urNv4ESgOgwNl3K+4etQhha0twXlzeF20bbULm9Yg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.1"
+      }
+    },
+    "node_modules/@img/sharp-wasm32": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.2.tgz",
+      "integrity": "sha512-Mrv4JQNYVQ94xH+jzZ9r+gowleN8mv2FTgKT+PI6bx5C0G8TdNYndu161pg2i7uoBwxy2ImPMHrJOM2LZef7Bw==",
+      "dev": true,
+      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/runtime": "^1.11.1"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-webcontainers-wasm32": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.2.tgz",
+      "integrity": "sha512-QNV27pxs9wpApEiCfvHM1RDoP1w1+2KrUWWDPEhEwg+latvOrfuhWrHWZKwdSFwU6jh3myjw/yOCRsUIuOft3g==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "@img/sharp-wasm32": "0.35.2"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-arm64": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.2.tgz",
+      "integrity": "sha512-BiVRYc/t6/Vl3e1hBx0hugG4oN9Pydf4fgMSpxTQJmwGUg/YoXTWHiFeRymHfCZzifxu4F4rpk/I67D0LQ20wQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-ia32": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.2.tgz",
+      "integrity": "sha512-YYEhx9PImCC7T0tI8JDMi4DB9LwLCXCU5OWNYEXAxh5Q1ShKkyC6byxzoBJ3gEFDnH2lQckWuDe70G7mB2XJog==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-x64": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.2.tgz",
+      "integrity": "sha512-imoOyBcoM/iiUr4J6VPpCNjPnjvP/Gks95898yB8YqoGGYmHYbOyCuNv9FMhFgtaiHFGbHW8bxKqRV6VjtXThQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.9",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.9.tgz",
+      "integrity": "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.0.3",
+        "@jridgewell/sourcemap-codec": "^1.4.10"
+      }
+    },
+    "node_modules/@oxc-project/types": {
+      "version": "0.147.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.147.0.tgz",
+      "integrity": "sha512-IJ3s6ltHLp45S0bh7phkX+gJO7A1Wuz2EaqpAhb8WjqDwbzMiWKHhyyT42tskaWjEYXtHtVCPpnBJVT9+dcRLg==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "node_modules/@poppinss/colors": {
+      "version": "4.1.6",
+      "resolved": "https://registry.npmjs.org/@poppinss/colors/-/colors-4.1.6.tgz",
+      "integrity": "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "kleur": "^4.1.5"
+      }
+    },
+    "node_modules/@poppinss/dumper": {
+      "version": "0.6.5",
+      "resolved": "https://registry.npmjs.org/@poppinss/dumper/-/dumper-0.6.5.tgz",
+      "integrity": "sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@poppinss/colors": "^4.1.5",
+        "@sindresorhus/is": "^7.0.2",
+        "supports-color": "^10.0.0"
+      }
+    },
+    "node_modules/@poppinss/exception": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@poppinss/exception/-/exception-1.2.3.tgz",
+      "integrity": "sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@rolldown/binding-android-arm-eabi": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.6.tgz",
+      "integrity": "sha512-b+jTcARdTiFLI6jB4a5XjTm0RWd6KcRfQj/I2356fxUZemiho9zQLxo0RtCuMDAyKcLo6cEltkgbQp6d1+sjjQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.6.tgz",
+      "integrity": "sha512-lkWU8ZJaRk9q3CIEY1Tc7vIFALp3Xw5NfGJo2hQg5oIqNgxWi1zI+IiDEK3r70BF5Dzol1tcXsnzsRc8NLhG+Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.6.tgz",
+      "integrity": "sha512-dgR56NYnvAszm7Ob1B2/Vn0e8bUQYZH2UjVaMMtMVOCKFSfjhfLmuA/9+O+F+ajUdG6B/bSssrKW6JJYASa8jA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.6.tgz",
+      "integrity": "sha512-vpVxFvUCFioJqug7OTvqptkc4yb8UX0AwfDmJpaR/0sWz+BUmqSVAf7c8JkUgnN8YLspb4a/N6NhTyMAmdyQ7Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.6.tgz",
+      "integrity": "sha512-h1wG6Y6K3JlRswxsI64qQJqBAy4vrLuHgRbc8CZMGSWTOFRY6ghMApM1NKzB2I0n5xV1fjkE18SuVl2QpLeNpA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.6.tgz",
+      "integrity": "sha512-tbCiqub0q2MVWJKgF5PoAlNWCtQydiOYSLIkd8sByqK/6MMYLJRcSXSYodqYtd0O+Fw7QaVmKKlS4oL94YRZ0w==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.6.tgz",
+      "integrity": "sha512-oxK9+baEBPhZG5HB4URY+uU04zJWeZlH6Tb9rB5DK4DF9XR1uXNLXt5Q5ZsugTKayNCNLhkcwz/ye74hRI98dg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.6.tgz",
+      "integrity": "sha512-muWCk27FVBEZtv0MsK8gnfSmgczA8KQ0uRVJbTABKhkRfQc38aUrcb7fhi3BNiyseFmgcRsoMfQsSNJ+DbZdSw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.6.tgz",
+      "integrity": "sha512-eWDoSfU7Co2qj3vgB3Dt4lj1mG6CoWbcJQkRMP3XJplyCMtuaq3LHvPFjS9QIPvMGWVadJC04Xiy0IdcVPtnwQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.6.tgz",
+      "integrity": "sha512-2bWNjRSIayvupRKxXUY2tWG9fYdoUlTqWywHRvE8Eq3GvuQ+f2HeIkve697fIt+IQs/PV8yFsdWuhp1aJ1PdnA==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.6.tgz",
+      "integrity": "sha512-KekI0gS0wLxe1UBSQSjenBVwou/JkcQPDzBPICGZjxUv9k3RteHDPBQaiOicZUFKRIH2wKEimGwVpnJsbPzu7w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.6.tgz",
+      "integrity": "sha512-TvtPnfVr+HtyGiDmPK4VWmlNm7QhNNAcK5Q9A7aOXsI8545yCyaoMaicXrFZ72JzeYjaUVk7yT243zT0jzjFKQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.6.tgz",
+      "integrity": "sha512-iOo0VEay2XFhaCcH0sps5XIimkSuOnNaZrf6+ZkoSOQBJPKNU48RkmJv0/lSpipexu5P+ouFgafe5IGr/DiQfg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.6.tgz",
+      "integrity": "sha512-y5NTmmasMS455JlOCO4ZM9krIchv3Mvm1crL1iUPGOPgEzSkves9n0SdC5Sjz6+qWDFhd8/JpfWMH8NSWNHe+A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.6.tgz",
+      "integrity": "sha512-np8iZSLfXlAD4kWhiyq/u0Yt8oZDtRQ8lGhQaCXo2rl37KNjeU0GjJuwr4P3oeZ++ROfofsKNBqR5LTO8aXyWQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@sindresorhus/is": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-7.2.0.tgz",
+      "integrity": "sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/is?sponsor=1"
+      }
+    },
+    "node_modules/@speed-highlight/core": {
+      "version": "1.2.24",
+      "resolved": "https://registry.npmjs.org/@speed-highlight/core/-/core-1.2.24.tgz",
+      "integrity": "sha512-qeW2e1l78afw8VhRPfPQ1Gjj+KU5XFQ/OFV5ti6eTa9bruO7mJyZtA4vw0ofqmA3tKCkROE9xLk3VZoeRc98nw==",
+      "dev": true,
+      "license": "CC0-1.0"
+    },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
+      }
+    },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "22.20.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.1.tgz",
+      "integrity": "sha512-EANqOCF9QFyra+4pfxUcX9STKJpCLjMbObVzljIJomAWSnuSIEAvyzEU53GaajbXJEgdh0iEcPL+DGvpUd4k1Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/@vitest/expect": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz",
+      "integrity": "sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.1.0",
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "4.1.11",
+        "@vitest/utils": "4.1.11",
+        "chai": "^6.2.2",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/mocker": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz",
+      "integrity": "sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "4.1.11",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.21"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/pretty-format": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz",
+      "integrity": "sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz",
+      "integrity": "sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/utils": "4.1.11",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/snapshot": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz",
+      "integrity": "sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.11",
+        "@vitest/utils": "4.1.11",
+        "magic-string": "^0.30.21",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz",
+      "integrity": "sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/utils": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz",
+      "integrity": "sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.11",
+        "convert-source-map": "^2.0.0",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/aws4fetch": {
+      "version": "1.0.20",
+      "resolved": "https://registry.npmjs.org/aws4fetch/-/aws4fetch-1.0.20.tgz",
+      "integrity": "sha512-/djoAN709iY65ETD6LKCtyyEI04XIBP5xVvfmNxsEP0uJB5tyaGBztSryRr4HqMStr9R06PisQE7m9zDTXKu6g==",
+      "license": "MIT"
+    },
+    "node_modules/blake3-wasm": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/blake3-wasm/-/blake3-wasm-2.1.5.tgz",
+      "integrity": "sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/chai": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/cjs-module-lexer": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-1.2.3.tgz",
+      "integrity": "sha512-0TNiGstbQmCFwt4akjjBg5pLRTSyj/PkWQ1ZoO2zntmg9yLqSRxwEa4iCfQLGjqhiqBfOJa7W/E8wfGrTDmlZQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/convert-source-map": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cookie": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/error-stack-parser-es": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/error-stack-parser-es/-/error-stack-parser-es-1.0.5.tgz",
+      "integrity": "sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/es-module-lexer": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/esbuild": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.28.1",
+        "@esbuild/android-arm": "0.28.1",
+        "@esbuild/android-arm64": "0.28.1",
+        "@esbuild/android-x64": "0.28.1",
+        "@esbuild/darwin-arm64": "0.28.1",
+        "@esbuild/darwin-x64": "0.28.1",
+        "@esbuild/freebsd-arm64": "0.28.1",
+        "@esbuild/freebsd-x64": "0.28.1",
+        "@esbuild/linux-arm": "0.28.1",
+        "@esbuild/linux-arm64": "0.28.1",
+        "@esbuild/linux-ia32": "0.28.1",
+        "@esbuild/linux-loong64": "0.28.1",
+        "@esbuild/linux-mips64el": "0.28.1",
+        "@esbuild/linux-ppc64": "0.28.1",
+        "@esbuild/linux-riscv64": "0.28.1",
+        "@esbuild/linux-s390x": "0.28.1",
+        "@esbuild/linux-x64": "0.28.1",
+        "@esbuild/netbsd-arm64": "0.28.1",
+        "@esbuild/netbsd-x64": "0.28.1",
+        "@esbuild/openbsd-arm64": "0.28.1",
+        "@esbuild/openbsd-x64": "0.28.1",
+        "@esbuild/openharmony-arm64": "0.28.1",
+        "@esbuild/sunos-x64": "0.28.1",
+        "@esbuild/win32-arm64": "0.28.1",
+        "@esbuild/win32-ia32": "0.28.1",
+        "@esbuild/win32-x64": "0.28.1"
+      }
+    },
+    "node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
+    "node_modules/expect-type": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/kleur": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz",
+      "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/lightningcss": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
+      "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.33.0",
+        "lightningcss-darwin-arm64": "1.33.0",
+        "lightningcss-darwin-x64": "1.33.0",
+        "lightningcss-freebsd-x64": "1.33.0",
+        "lightningcss-linux-arm-gnueabihf": "1.33.0",
+        "lightningcss-linux-arm64-gnu": "1.33.0",
+        "lightningcss-linux-arm64-musl": "1.33.0",
+        "lightningcss-linux-x64-gnu": "1.33.0",
+        "lightningcss-linux-x64-musl": "1.33.0",
+        "lightningcss-win32-arm64-msvc": "1.33.0",
+        "lightningcss-win32-x64-msvc": "1.33.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
+      "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
+      "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
+      "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
+      "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
+      "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
+      "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
+      "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
+      "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
+      "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
+      "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
+      "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/miniflare": {
+      "version": "5.20260828.0-alpha",
+      "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-5.20260828.0-alpha.tgz",
+      "integrity": "sha512-6nbxhZEcz/UET3Y1OnYPsrAUjUmuFoib3ynUqteRdn1YnDxsLg8cwgZJZCk9QmtOmGzXwzXzgE/d/C0dJAPtVw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@cspotcode/source-map-support": "0.8.1",
+        "sharp": "0.35.2",
+        "undici": "7.29.0",
+        "workerd": "1.20260828.1",
+        "ws": "8.21.0",
+        "youch": "4.1.0-beta.10"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/obug": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.4.tgz",
+      "integrity": "sha512-4a+OsYv9UktOJKE+l1A4OufDgdRF9PifWj+tJnHURo/P+WOxpG4GzUFL9qCalmWauao6ogiG+QvnCovwPoyAWA==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.3.0.tgz",
+      "integrity": "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/postcss": {
+      "version": "8.5.26",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.17",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/rolldown": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.6.tgz",
+      "integrity": "sha512-vMM4q3aixf46GiF1Kok8jDPFsEpXgFWGjUHXNkNHNm+Y2adXAG2dbX91jkti3i0ZRsOlcmbuzAz1poObSHCmUA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.147.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm-eabi": "1.2.6",
+        "@rolldown/binding-android-arm64": "1.2.6",
+        "@rolldown/binding-darwin-arm64": "1.2.6",
+        "@rolldown/binding-darwin-x64": "1.2.6",
+        "@rolldown/binding-freebsd-x64": "1.2.6",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.2.6",
+        "@rolldown/binding-linux-arm64-gnu": "1.2.6",
+        "@rolldown/binding-linux-arm64-musl": "1.2.6",
+        "@rolldown/binding-linux-ppc64-gnu": "1.2.6",
+        "@rolldown/binding-linux-s390x-gnu": "1.2.6",
+        "@rolldown/binding-linux-x64-gnu": "1.2.6",
+        "@rolldown/binding-linux-x64-musl": "1.2.6",
+        "@rolldown/binding-openharmony-arm64": "1.2.6",
+        "@rolldown/binding-win32-arm64-msvc": "1.2.6",
+        "@rolldown/binding-win32-x64-msvc": "1.2.6"
+      }
+    },
+    "node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/sharp": {
+      "version": "0.35.2",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.2.tgz",
+      "integrity": "sha512-FVtFjtBCMiJS6yb5CX7Sop45WFMpeGw6oRKuJnXYgf/f1ms/D7LE/ZUSNxnW7rZ/dbslQWYkoqFHGPaDBtaK4w==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@img/colour": "^1.1.0",
+        "detect-libc": "^2.1.2",
+        "semver": "^7.8.4"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-darwin-arm64": "0.35.2",
+        "@img/sharp-darwin-x64": "0.35.2",
+        "@img/sharp-freebsd-wasm32": "0.35.2",
+        "@img/sharp-libvips-darwin-arm64": "1.3.1",
+        "@img/sharp-libvips-darwin-x64": "1.3.1",
+        "@img/sharp-libvips-linux-arm": "1.3.1",
+        "@img/sharp-libvips-linux-arm64": "1.3.1",
+        "@img/sharp-libvips-linux-ppc64": "1.3.1",
+        "@img/sharp-libvips-linux-riscv64": "1.3.1",
+        "@img/sharp-libvips-linux-s390x": "1.3.1",
+        "@img/sharp-libvips-linux-x64": "1.3.1",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.1",
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.1",
+        "@img/sharp-linux-arm": "0.35.2",
+        "@img/sharp-linux-arm64": "0.35.2",
+        "@img/sharp-linux-ppc64": "0.35.2",
+        "@img/sharp-linux-riscv64": "0.35.2",
+        "@img/sharp-linux-s390x": "0.35.2",
+        "@img/sharp-linux-x64": "0.35.2",
+        "@img/sharp-linuxmusl-arm64": "0.35.2",
+        "@img/sharp-linuxmusl-x64": "0.35.2",
+        "@img/sharp-webcontainers-wasm32": "0.35.2",
+        "@img/sharp-win32-arm64": "0.35.2",
+        "@img/sharp-win32-ia32": "0.35.2",
+        "@img/sharp-win32-x64": "0.35.2"
+      }
+    },
+    "node_modules/siginfo": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/stackback": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/std-env": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz",
+      "integrity": "sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/supports-color": {
+      "version": "10.2.2",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-10.2.2.tgz",
+      "integrity": "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/supports-color?sponsor=1"
+      }
+    },
+    "node_modules/tinybench": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinyexec": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.0.tgz",
+      "integrity": "sha512-QKAl9m8gWWGHV8jZcPeym6j+XULi6tOf1mT83WYJ4Lk2ytW/uwAWkrP0uFsdoYMdueVJ0qs26wZ+23xeB4ibNQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/tinyrainbow": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.1.tgz",
+      "integrity": "sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "dev": true,
+      "license": "0BSD",
+      "optional": true
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
+      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/unenv": {
+      "version": "2.0.0-rc.24",
+      "resolved": "https://registry.npmjs.org/unenv/-/unenv-2.0.0-rc.24.tgz",
+      "integrity": "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "pathe": "^2.0.3"
+      }
+    },
+    "node_modules/vite": {
+      "version": "8.2.2",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.2.tgz",
+      "integrity": "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lightningcss": "^1.33.0",
+        "picomatch": "^4.0.5",
+        "postcss": "^8.5.26",
+        "rolldown": "~1.2.4",
+        "tinyglobby": "^0.2.17"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "@vitejs/devtools": "^0.4.0 || ^0.5.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
+        "jiti": ">=1.21.0",
+        "less": "^4.0.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.11.tgz",
+      "integrity": "sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/expect": "4.1.11",
+        "@vitest/mocker": "4.1.11",
+        "@vitest/pretty-format": "4.1.11",
+        "@vitest/runner": "4.1.11",
+        "@vitest/snapshot": "4.1.11",
+        "@vitest/spy": "4.1.11",
+        "@vitest/utils": "4.1.11",
+        "es-module-lexer": "^2.0.0",
+        "expect-type": "^1.3.0",
+        "magic-string": "^0.30.21",
+        "obug": "^2.1.1",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.3",
+        "std-env": "^4.0.0-rc.1",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^1.0.2",
+        "tinyglobby": "^0.2.15",
+        "tinyrainbow": "^3.1.0",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@opentelemetry/api": "^1.9.0",
+        "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
+        "@vitest/browser-playwright": "4.1.11",
+        "@vitest/browser-preview": "4.1.11",
+        "@vitest/browser-webdriverio": "4.1.11",
+        "@vitest/coverage-istanbul": "4.1.11",
+        "@vitest/coverage-v8": "4.1.11",
+        "@vitest/ui": "4.1.11",
+        "happy-dom": "*",
+        "jsdom": "*",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/browser-preview": {
+          "optional": true
+        },
+        "@vitest/browser-webdriverio": {
+          "optional": true
+        },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        },
+        "vite": {
+          "optional": false
+        }
+      }
+    },
+    "node_modules/why-is-node-running": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "siginfo": "^2.0.0",
+        "stackback": "0.0.2"
+      },
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/workerd": {
+      "version": "1.20260828.1",
+      "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20260828.1.tgz",
+      "integrity": "sha512-pB9yvt0kkwZDAGZHmpY59r0o3hM0DzdW6BJERqwZOhunZ3ssOyDSgQxOQer2cSZW4YCFeOTIQYN1qwhK5wv/Cw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "workerd": "bin/workerd"
+      },
+      "engines": {
+        "node": ">=16"
+      },
+      "optionalDependencies": {
+        "@cloudflare/workerd-darwin-64": "1.20260828.1",
+        "@cloudflare/workerd-darwin-arm64": "1.20260828.1",
+        "@cloudflare/workerd-linux-64": "1.20260828.1",
+        "@cloudflare/workerd-linux-arm64": "1.20260828.1",
+        "@cloudflare/workerd-windows-64": "1.20260828.1"
+      }
+    },
+    "node_modules/wrangler": {
+      "version": "4.127.1",
+      "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.127.1.tgz",
+      "integrity": "sha512-OzsiNgaI8i681L/+KnAKc+uEZ5D57xK5JuNvCOpRKICF4/5Q3Cu1oTGuUiT/f3GDUqQb3gzXNT0tfOHGMEtknw==",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@cloudflare/kv-asset-handler": "0.5.0",
+        "@cloudflare/unenv-preset": "2.16.1",
+        "blake3-wasm": "2.1.5",
+        "esbuild": "0.28.1",
+        "miniflare": "5.20260828.0-alpha",
+        "path-to-regexp": "6.3.0",
+        "unenv": "2.0.0-rc.24",
+        "workerd": "1.20260828.1"
+      },
+      "bin": {
+        "cf-wrangler": "bin/cf-wrangler.js",
+        "wrangler": "bin/wrangler.js",
+        "wrangler2": "bin/wrangler.js"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.3"
+      },
+      "peerDependencies": {
+        "@cloudflare/workers-types": "^5.20260828.1"
+      },
+      "peerDependenciesMeta": {
+        "@cloudflare/workers-types": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/youch": {
+      "version": "4.1.0-beta.10",
+      "resolved": "https://registry.npmjs.org/youch/-/youch-4.1.0-beta.10.tgz",
+      "integrity": "sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@poppinss/colors": "^4.1.5",
+        "@poppinss/dumper": "^0.6.4",
+        "@speed-highlight/core": "^1.2.7",
+        "cookie": "^1.0.2",
+        "youch-core": "^0.3.3"
+      }
+    },
+    "node_modules/youch-core": {
+      "version": "0.3.3",
+      "resolved": "https://registry.npmjs.org/youch-core/-/youch-core-0.3.3.tgz",
+      "integrity": "sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@poppinss/exception": "^1.2.2",
+        "error-stack-parser-es": "^1.0.5"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
+  }
+}
diff --git a/infra/otp-worker/package.json b/infra/otp-worker/package.json
new file mode 100644
index 000000000..6aa5029df
--- /dev/null
+++ b/infra/otp-worker/package.json
@@ -0,0 +1,28 @@
+{
+  "name": "otp-worker",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Cloudflare Worker: one-time email+OTP send/verify, backing Meridian's account-email capture step. Not published to npm.",
+  "main": "src/index.ts",
+  "scripts": {
+    "dev": "wrangler dev",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "deploy": "wrangler deploy",
+    "deploy:staging": "wrangler deploy --env staging",
+    "types": "wrangler types"
+  },
+  "dependencies": {
+    "aws4fetch": "1.0.20"
+  },
+  "devDependencies": {
+    "@cloudflare/vitest-plugin": "1.1.2",
+    "@types/node": "22.20.1",
+    "typescript": "5.9.3",
+    "vitest": "4.1.11",
+    "wrangler": "4.127.1"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  }
+}
diff --git a/infra/otp-worker/src/__tests__/auth.test.ts b/infra/otp-worker/src/__tests__/auth.test.ts
new file mode 100644
index 000000000..4815bd2f0
--- /dev/null
+++ b/infra/otp-worker/src/__tests__/auth.test.ts
@@ -0,0 +1,59 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { describe, expect, it } from "vitest";
+import { checkBearerAuth } from "../auth";
+
+const PROD_ENV = { OTP_CLIENT_TOKEN: "real-client-token", ENVIRONMENT: "production" };
+const STAGING_ENV = {
+  OTP_CLIENT_TOKEN: "real-client-token",
+  CI_TEST_TOKEN: "real-ci-token",
+  ENVIRONMENT: "staging",
+};
+
+describe("checkBearerAuth", () => {
+  it("accepts the correct client token", () => {
+    const result = checkBearerAuth("Bearer real-client-token", PROD_ENV);
+    expect(result).toEqual({ ok: true, isCiTestToken: false });
+  });
+
+  it("rejects a missing Authorization header", () => {
+    expect(checkBearerAuth(null, PROD_ENV).ok).toBe(false);
+  });
+
+  it("rejects a header with no Bearer prefix", () => {
+    expect(checkBearerAuth("real-client-token", PROD_ENV).ok).toBe(false);
+  });
+
+  it("rejects the wrong token", () => {
+    expect(checkBearerAuth("Bearer wrong-token", PROD_ENV).ok).toBe(false);
+  });
+
+  it("rejects an empty bearer token even against an empty configured secret", () => {
+    // Guards the "both sides blank" bypass: an unconfigured OTP_CLIENT_TOKEN
+    // must never accept a request just because both are empty strings.
+    expect(checkBearerAuth("Bearer ", { OTP_CLIENT_TOKEN: "", ENVIRONMENT: "production" }).ok).toBe(false);
+    expect(checkBearerAuth(null, { OTP_CLIENT_TOKEN: "", ENVIRONMENT: "production" }).ok).toBe(false);
+  });
+
+  it("never accepts the CI test token on a non-staging environment, even if the secret is present", () => {
+    const result = checkBearerAuth("Bearer real-ci-token", {
+      OTP_CLIENT_TOKEN: "real-client-token",
+      CI_TEST_TOKEN: "real-ci-token",
+      ENVIRONMENT: "production",
+    });
+    expect(result.ok).toBe(false);
+  });
+
+  it("accepts the CI test token on staging and flags isCiTestToken", () => {
+    const result = checkBearerAuth("Bearer real-ci-token", STAGING_ENV);
+    expect(result).toEqual({ ok: true, isCiTestToken: true });
+  });
+
+  it("accepts the normal client token on staging without flagging isCiTestToken", () => {
+    const result = checkBearerAuth("Bearer real-client-token", STAGING_ENV);
+    expect(result).toEqual({ ok: true, isCiTestToken: false });
+  });
+
+  it("rejects a wrong token on staging even when a CI token is configured", () => {
+    expect(checkBearerAuth("Bearer neither-token", STAGING_ENV).ok).toBe(false);
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/crypto-utils.test.ts b/infra/otp-worker/src/__tests__/crypto-utils.test.ts
new file mode 100644
index 000000000..1e2b47326
--- /dev/null
+++ b/infra/otp-worker/src/__tests__/crypto-utils.test.ts
@@ -0,0 +1,61 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { describe, expect, it } from "vitest";
+import { hmacSha256Hex, sha256Hex, timingSafeEqualStrings } from "../crypto-utils";
+
+describe("timingSafeEqualStrings", () => {
+  it("returns true for identical strings", () => {
+    expect(timingSafeEqualStrings("abc123", "abc123")).toBe(true);
+  });
+
+  it("returns false for different strings of the same length", () => {
+    expect(timingSafeEqualStrings("abc123", "abc124")).toBe(false);
+  });
+
+  it("returns false for different-length strings without throwing", () => {
+    expect(timingSafeEqualStrings("short", "a-lot-longer-string")).toBe(false);
+  });
+
+  it("returns false comparing against an empty string", () => {
+    expect(timingSafeEqualStrings("nonempty", "")).toBe(false);
+  });
+
+  it("treats two empty strings as equal", () => {
+    expect(timingSafeEqualStrings("", "")).toBe(true);
+  });
+});
+
+describe("sha256Hex", () => {
+  it("is deterministic for the same input", async () => {
+    const a = await sha256Hex("test@example.com");
+    const b = await sha256Hex("test@example.com");
+    expect(a).toBe(b);
+    expect(a).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it("differs for different input", async () => {
+    const a = await sha256Hex("a@example.com");
+    const b = await sha256Hex("b@example.com");
+    expect(a).not.toBe(b);
+  });
+});
+
+describe("hmacSha256Hex", () => {
+  it("is deterministic for the same key and message", async () => {
+    const a = await hmacSha256Hex("pepper", "123456");
+    const b = await hmacSha256Hex("pepper", "123456");
+    expect(a).toBe(b);
+    expect(a).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it("differs when the pepper differs — a code hash from one pepper must not verify under another", async () => {
+    const a = await hmacSha256Hex("pepper-one", "123456");
+    const b = await hmacSha256Hex("pepper-two", "123456");
+    expect(a).not.toBe(b);
+  });
+
+  it("differs when the code differs", async () => {
+    const a = await hmacSha256Hex("pepper", "123456");
+    const b = await hmacSha256Hex("pepper", "654321");
+    expect(a).not.toBe(b);
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/email.test.ts b/infra/otp-worker/src/__tests__/email.test.ts
new file mode 100644
index 000000000..e713fee67
--- /dev/null
+++ b/infra/otp-worker/src/__tests__/email.test.ts
@@ -0,0 +1,53 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { describe, expect, it } from "vitest";
+import { emailHash, normalizeEmail } from "../email";
+
+describe("normalizeEmail", () => {
+  it("trims and lowercases a valid address", () => {
+    expect(normalizeEmail("  Test@Example.COM  ")).toBe("test@example.com");
+  });
+
+  it("rejects non-string input", () => {
+    expect(normalizeEmail(undefined)).toBeNull();
+    expect(normalizeEmail(null)).toBeNull();
+    expect(normalizeEmail(12345)).toBeNull();
+    expect(normalizeEmail({})).toBeNull();
+  });
+
+  it("rejects an empty or whitespace-only string", () => {
+    expect(normalizeEmail("")).toBeNull();
+    expect(normalizeEmail("   ")).toBeNull();
+  });
+
+  it("rejects a string with no @", () => {
+    expect(normalizeEmail("not-an-email")).toBeNull();
+  });
+
+  it("rejects a string with no domain dot", () => {
+    expect(normalizeEmail("a@b")).toBeNull();
+  });
+
+  it("rejects an address longer than the RFC 5321 bound", () => {
+    const longLocal = "a".repeat(310);
+    expect(normalizeEmail(`${longLocal}@example.com`)).toBeNull();
+  });
+
+  it("rejects a string containing whitespace inside the address", () => {
+    expect(normalizeEmail("a b@example.com")).toBeNull();
+  });
+});
+
+describe("emailHash", () => {
+  it("is deterministic and hex-encoded", async () => {
+    const a = await emailHash("test@example.com");
+    const b = await emailHash("test@example.com");
+    expect(a).toBe(b);
+    expect(a).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it("differs for a different normalized email", async () => {
+    const a = await emailHash("a@example.com");
+    const b = await emailHash("b@example.com");
+    expect(a).not.toBe(b);
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/index.test.ts b/infra/otp-worker/src/__tests__/index.test.ts
new file mode 100644
index 000000000..73fc422d1
--- /dev/null
+++ b/infra/otp-worker/src/__tests__/index.test.ts
@@ -0,0 +1,88 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Wiring-level tests for `index.ts`'s router and auth gate — every gate
+ * module (`auth.ts`, `otp.ts`, `ratelimit.ts`, `turnstile.ts`) has its own
+ * thorough unit tests, but until this file nothing ever exercised the actual
+ * exported `fetch` handler that composes them. That left CLAUDE.md's Hard
+ * Rules #1 ("authenticate every request") and #3 ("allowlist the paths it
+ * serves") — the two properties this Worker exists specifically to get
+ * right, per README.md's "Why this design" — asserted by NOTHING: the
+ * deploy script's mock-server exercise (see scripts/deploy-otp-worker.sh)
+ * only ever tests the SCRIPT, not this Worker.
+ *
+ * Deliberately scoped to what needs no secrets: there is no `.dev.vars` here
+ * (and shouldn't be — that would mean committing a bearer token, even a fake
+ * one, next to code path this repo is specifically careful about), so
+ * `OTP_CLIENT_TOKEN` is unset in this simulated environment. Per `auth.ts`,
+ * an empty/unset configured token never matches ANY provided token — which
+ * means these cases require zero setup AND incidentally re-confirm the
+ * empty-secret-never-passes guarantee from `auth.test.ts` one layer up, at
+ * the real `fetch` handler rather than the isolated `checkBearerAuth` call.
+ *
+ * # Related
+ * - `index.ts` — the handler under test
+ * - `scripts/deploy-otp-worker.sh` — the live-deploy counterpart of these
+ *   same 401/404 assertions, run against a real deployed Worker
+ */
+import { SELF } from "cloudflare:test";
+import { describe, expect, it } from "vitest";
+
+describe("router: only POST /otp/send and POST /otp/verify exist", () => {
+  it("404s a GET to /otp/send — a method mismatch is not the allowlisted route", async () => {
+    const res = await SELF.fetch("https://example.com/otp/send");
+    expect(res.status).toBe(404);
+    expect(await res.json()).toEqual({ error: "not_found" });
+  });
+
+  it("404s POST to an unknown path", async () => {
+    const res = await SELF.fetch("https://example.com/otp/unknown", { method: "POST" });
+    expect(res.status).toBe(404);
+  });
+
+  it("404s POST to the bare root", async () => {
+    const res = await SELF.fetch("https://example.com/", { method: "POST" });
+    expect(res.status).toBe(404);
+  });
+});
+
+describe("auth gate: unauthenticated requests never reach KV/SES", () => {
+  it("401s POST /otp/send with no Authorization header", async () => {
+    const res = await SELF.fetch("https://example.com/otp/send", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: "test@example.com" }),
+    });
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "unauthorized" });
+  });
+
+  it("401s POST /otp/verify with no Authorization header", async () => {
+    const res = await SELF.fetch("https://example.com/otp/verify", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: "test@example.com", code: "123456" }),
+    });
+    expect(res.status).toBe(401);
+  });
+
+  it("401s POST /otp/send with a bearer token, since no OTP_CLIENT_TOKEN secret is configured here", async () => {
+    // This is the empty-secret-never-passes guarantee (auth.test.ts) proven
+    // at the real handler: an unconfigured secret must reject EVERY token,
+    // not just requests with none at all.
+    const res = await SELF.fetch("https://example.com/otp/send", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: "Bearer anything-at-all" },
+      body: JSON.stringify({ email: "test@example.com" }),
+    });
+    expect(res.status).toBe(401);
+  });
+
+  it("auth is checked before body parsing — malformed JSON with no auth still 401s, not 400", async () => {
+    const res = await SELF.fetch("https://example.com/otp/send", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "not json at all {{{",
+    });
+    expect(res.status).toBe(401);
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/kv.test.ts b/infra/otp-worker/src/__tests__/kv.test.ts
new file mode 100644
index 000000000..e0fce1544
--- /dev/null
+++ b/infra/otp-worker/src/__tests__/kv.test.ts
@@ -0,0 +1,67 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { env } from "cloudflare:test";
+import { beforeEach, describe, expect, it } from "vitest";
+import { deleteOtpRecord, getCounter, getOtpRecord, putCounter, putOtpRecord, ttlSecondsFromExpiry } from "../kv";
+
+describe("ttlSecondsFromExpiry", () => {
+  it("computes the ceiling of the remaining seconds", () => {
+    expect(ttlSecondsFromExpiry(1_000_000 + 90_500, 1_000_000)).toBe(91);
+  });
+
+  it("clamps to KV's 60s minimum when less than 60s remain", () => {
+    expect(ttlSecondsFromExpiry(1_000_000 + 5_000, 1_000_000)).toBe(60);
+  });
+
+  it("clamps to 60s even when the record is already expired (negative remaining)", () => {
+    expect(ttlSecondsFromExpiry(1_000_000 - 5_000, 1_000_000)).toBe(60);
+  });
+});
+
+// Integration-style tests against the real (Miniflare-simulated) OTP_KV
+// binding declared in wrangler.jsonc — no network, no Cloudflare account,
+// but exercises the actual KVNamespace.get/put/delete round trip rather than
+// a hand-rolled fake, so a real serialization or TTL-argument mistake in
+// kv.ts would actually be caught here.
+describe("OtpRecord KV round-trip", () => {
+  const HASH = "deadbeef".repeat(8); // stand-in for a real sha256 hex hash
+
+  beforeEach(async () => {
+    await deleteOtpRecord(env.OTP_KV, HASH);
+  });
+
+  it("returns null for a key that was never written", async () => {
+    expect(await getOtpRecord(env.OTP_KV, HASH)).toBeNull();
+  });
+
+  it("round-trips a written record byte-for-byte", async () => {
+    const now = Date.now();
+    const record = { codeHash: "somehash", attempts: 2, expiresAt: now + 600_000 };
+    await putOtpRecord(env.OTP_KV, HASH, record, now);
+    expect(await getOtpRecord(env.OTP_KV, HASH)).toEqual(record);
+  });
+
+  it("delete removes the record", async () => {
+    const now = Date.now();
+    await putOtpRecord(env.OTP_KV, HASH, { codeHash: "x", attempts: 0, expiresAt: now + 600_000 }, now);
+    await deleteOtpRecord(env.OTP_KV, HASH);
+    expect(await getOtpRecord(env.OTP_KV, HASH)).toBeNull();
+  });
+});
+
+describe("CounterRecord KV round-trip", () => {
+  const KEY = "rl:email:test-key";
+
+  it("round-trips a counter record", async () => {
+    const now = Date.now();
+    const record = { count: 2, expiresAt: now + 3_600_000 };
+    await putCounter(env.OTP_KV, KEY, record, now);
+    expect(await getCounter(env.OTP_KV, KEY)).toEqual(record);
+  });
+
+  it("honours a ttlOverrideS without changing the stored record shape", async () => {
+    const now = Date.now();
+    const record = { count: 1, expiresAt: now + 86_400_000 };
+    await putCounter(env.OTP_KV, "global:sends:test-date", record, now, 90_000);
+    expect(await getCounter(env.OTP_KV, "global:sends:test-date")).toEqual(record);
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/otp.test.ts b/infra/otp-worker/src/__tests__/otp.test.ts
new file mode 100644
index 000000000..84beb632b
--- /dev/null
+++ b/infra/otp-worker/src/__tests__/otp.test.ts
@@ -0,0 +1,104 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { describe, expect, it } from "vitest";
+import { createOtpRecord, generateCode, hashCode, verifyOtpAttempt, type OtpRecord } from "../otp";
+
+describe("generateCode", () => {
+  it("produces a 6-digit numeric string by default", () => {
+    const code = generateCode();
+    expect(code).toMatch(/^\d{6}$/);
+  });
+
+  it("produces different codes across calls (not a fixed value)", () => {
+    const codes = new Set(Array.from({ length: 20 }, () => generateCode()));
+    expect(codes.size).toBeGreaterThan(1);
+  });
+
+  it("honours a custom length", () => {
+    expect(generateCode(4)).toMatch(/^\d{4}$/);
+  });
+});
+
+describe("hashCode / createOtpRecord", () => {
+  it("hashCode is deterministic for the same pepper and code", async () => {
+    const a = await hashCode("123456", "pepper");
+    const b = await hashCode("123456", "pepper");
+    expect(a).toBe(b);
+  });
+
+  it("createOtpRecord starts at zero attempts with the given expiry", () => {
+    const record = createOtpRecord("somehash", 1000, 600_000);
+    expect(record).toEqual({ codeHash: "somehash", attempts: 0, expiresAt: 601_000 });
+  });
+});
+
+describe("verifyOtpAttempt", () => {
+  const NOW = 1_000_000;
+  const MAX_ATTEMPTS = 5;
+
+  async function makeRecord(code: string, expiresAt: number, attempts = 0): Promise<OtpRecord> {
+    return { codeHash: await hashCode(code, "pepper"), attempts, expiresAt };
+  }
+
+  it("verifies a correct code", async () => {
+    const record = await makeRecord("123456", NOW + 60_000);
+    const providedHash = await hashCode("123456", "pepper");
+    const outcome = verifyOtpAttempt(record, providedHash, NOW, MAX_ATTEMPTS);
+    expect(outcome.kind).toBe("verified");
+  });
+
+  it("returns not_found_or_expired for a null record", () => {
+    const outcome = verifyOtpAttempt(null, "any-hash", NOW, MAX_ATTEMPTS);
+    expect(outcome.kind).toBe("not_found_or_expired");
+  });
+
+  it("returns not_found_or_expired once now has reached expiresAt", async () => {
+    const record = await makeRecord("123456", NOW); // expires exactly at NOW
+    const providedHash = await hashCode("123456", "pepper");
+    const outcome = verifyOtpAttempt(record, providedHash, NOW, MAX_ATTEMPTS);
+    expect(outcome.kind).toBe("not_found_or_expired");
+  });
+
+  it("a wrong guess increments attempts but returns the SAME expiresAt — never extends the TTL", async () => {
+    const record = await makeRecord("123456", NOW + 60_000, 0);
+    const wrongHash = await hashCode("000000", "pepper");
+    const outcome = verifyOtpAttempt(record, wrongHash, NOW, MAX_ATTEMPTS);
+    expect(outcome.kind).toBe("wrong");
+    if (outcome.kind !== "wrong") throw new Error("unreachable");
+    expect(outcome.nextRecord.expiresAt).toBe(record.expiresAt);
+    expect(outcome.nextRecord.attempts).toBe(1);
+    expect(outcome.nextRecord.codeHash).toBe(record.codeHash);
+    expect(outcome.attemptsRemaining).toBe(MAX_ATTEMPTS - 1);
+  });
+
+  it("the exact 5th wrong guess (maxAttempts reached) exhausts the record instead of returning wrong", async () => {
+    const record = await makeRecord("123456", NOW + 60_000, MAX_ATTEMPTS - 1); // one guess left
+    const wrongHash = await hashCode("000000", "pepper");
+    const outcome = verifyOtpAttempt(record, wrongHash, NOW, MAX_ATTEMPTS);
+    expect(outcome.kind).toBe("exhausted");
+  });
+
+  it("a record that already reached maxAttempts is exhausted even before this call's comparison", async () => {
+    const record = await makeRecord("123456", NOW + 60_000, MAX_ATTEMPTS);
+    const providedHash = await hashCode("123456", "pepper"); // even the RIGHT code
+    const outcome = verifyOtpAttempt(record, providedHash, NOW, MAX_ATTEMPTS);
+    expect(outcome.kind).toBe("exhausted");
+  });
+
+  it("four consecutive wrong guesses each preserve expiresAt, the fifth exhausts", async () => {
+    let record = await makeRecord("123456", NOW + 60_000, 0);
+    const wrongHash = await hashCode("000000", "pepper");
+    const originalExpiry = record.expiresAt;
+
+    for (let i = 0; i < MAX_ATTEMPTS - 1; i++) {
+      const outcome = verifyOtpAttempt(record, wrongHash, NOW, MAX_ATTEMPTS);
+      expect(outcome.kind).toBe("wrong");
+      if (outcome.kind !== "wrong") throw new Error("unreachable");
+      expect(outcome.nextRecord.expiresAt).toBe(originalExpiry);
+      record = outcome.nextRecord;
+    }
+    expect(record.attempts).toBe(MAX_ATTEMPTS - 1);
+
+    const finalOutcome = verifyOtpAttempt(record, wrongHash, NOW, MAX_ATTEMPTS);
+    expect(finalOutcome.kind).toBe("exhausted");
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/ratelimit.test.ts b/infra/otp-worker/src/__tests__/ratelimit.test.ts
new file mode 100644
index 000000000..98fbf10fa
--- /dev/null
+++ b/infra/otp-worker/src/__tests__/ratelimit.test.ts
@@ -0,0 +1,88 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { describe, expect, it } from "vitest";
+import { evaluateRateLimits, incrementCounter, isOverCap, utcDateString } from "../ratelimit";
+
+describe("incrementCounter", () => {
+  it("opens a fresh window (count 1) when there is no existing record", () => {
+    const now = 1_000_000;
+    const windowMs = 3600_000;
+    expect(incrementCounter(null, now, windowMs)).toEqual({ count: 1, expiresAt: now + windowMs });
+  });
+
+  it("opens a fresh window when the existing one has expired", () => {
+    const now = 1_000_000;
+    const windowMs = 3600_000;
+    const expired = { count: 9, expiresAt: now - 1 };
+    expect(incrementCounter(expired, now, windowMs)).toEqual({ count: 1, expiresAt: now + windowMs });
+  });
+
+  it("increments in place and preserves expiresAt within an open window", () => {
+    const now = 1_000_000;
+    const existing = { count: 2, expiresAt: now + 500_000 };
+    const next = incrementCounter(existing, now, 3600_000);
+    expect(next).toEqual({ count: 3, expiresAt: existing.expiresAt });
+  });
+});
+
+describe("isOverCap", () => {
+  it("is false for a null record", () => {
+    expect(isOverCap(null, 1000, 3)).toBe(false);
+  });
+
+  it("is false for an expired record regardless of count", () => {
+    expect(isOverCap({ count: 999, expiresAt: 999 }, 1000, 3)).toBe(false);
+  });
+
+  it("is false below the cap", () => {
+    expect(isOverCap({ count: 2, expiresAt: 2000 }, 1000, 3)).toBe(false);
+  });
+
+  it("is true at exactly the cap", () => {
+    expect(isOverCap({ count: 3, expiresAt: 2000 }, 1000, 3)).toBe(true);
+  });
+
+  it("is true above the cap", () => {
+    expect(isOverCap({ count: 10, expiresAt: 2000 }, 1000, 3)).toBe(true);
+  });
+});
+
+describe("evaluateRateLimits", () => {
+  const now = 1000;
+  const caps = { email: 3, ip: 10, global: 2000 };
+  const underCap = { count: 1, expiresAt: 2000 };
+  // Comfortably exceeds every cap in `caps` above (email:3, ip:10, global:2000).
+  const overCap = { count: 100_000, expiresAt: 2000 };
+
+  it("allows when all three counters are under cap", () => {
+    const decision = evaluateRateLimits({ emailRecord: underCap, ipRecord: underCap, globalRecord: underCap, now, caps });
+    expect(decision).toEqual({ allowed: true });
+  });
+
+  it("allows when all three counters are absent", () => {
+    const decision = evaluateRateLimits({ emailRecord: null, ipRecord: null, globalRecord: null, now, caps });
+    expect(decision).toEqual({ allowed: true });
+  });
+
+  it("denies with scope 'email' when only the email cap is tripped, checked first", () => {
+    const decision = evaluateRateLimits({ emailRecord: overCap, ipRecord: overCap, globalRecord: overCap, now, caps });
+    expect(decision).toEqual({ allowed: false, scope: "email" });
+  });
+
+  it("denies with scope 'ip' when only the ip cap is tripped", () => {
+    const decision = evaluateRateLimits({ emailRecord: underCap, ipRecord: overCap, globalRecord: underCap, now, caps });
+    expect(decision).toEqual({ allowed: false, scope: "ip" });
+  });
+
+  it("denies with scope 'global' when only the global cap is tripped", () => {
+    const decision = evaluateRateLimits({ emailRecord: underCap, ipRecord: underCap, globalRecord: overCap, now, caps });
+    expect(decision).toEqual({ allowed: false, scope: "global" });
+  });
+});
+
+describe("utcDateString", () => {
+  it("formats as YYYY-MM-DD in UTC", () => {
+    // 2026-03-05T23:30:00Z
+    const ms = Date.UTC(2026, 2, 5, 23, 30, 0);
+    expect(utcDateString(ms)).toBe("2026-03-05");
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/ses.test.ts b/infra/otp-worker/src/__tests__/ses.test.ts
new file mode 100644
index 000000000..c8076b014
--- /dev/null
+++ b/infra/otp-worker/src/__tests__/ses.test.ts
@@ -0,0 +1,79 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { describe, expect, it, vi } from "vitest";
+import { buildOtpEmailBody, extractSesErrorCode, sendOtpEmail, type AwsFetcher } from "../ses";
+
+const ENV = {
+  AWS_ACCESS_KEY_ID: "AKIA_FAKE",
+  AWS_SECRET_ACCESS_KEY: "fake-secret",
+  AWS_REGION: "us-east-1",
+  FROM_ADDRESS: "otp@auth.meridiona.com",
+  FROM_NAME: "Meridian",
+};
+
+describe("buildOtpEmailBody", () => {
+  it("includes the code and the TTL, and no links", () => {
+    const body = buildOtpEmailBody("123456", 10);
+    expect(body).toContain("123456");
+    expect(body).toContain("10 minutes");
+    expect(body).not.toMatch(/https?:\/\//);
+  });
+});
+
+describe("extractSesErrorCode", () => {
+  it("extracts an AWS-shaped Error.Code", () => {
+    expect(extractSesErrorCode(JSON.stringify({ Error: { Code: "MessageRejected" } }))).toBe("MessageRejected");
+  });
+
+  it("falls back to a top-level message field", () => {
+    expect(extractSesErrorCode(JSON.stringify({ message: "Some SES error" }))).toBe("Some SES error");
+  });
+
+  it("never echoes an arbitrary raw body back — unparseable text yields a fixed placeholder", () => {
+    // This is the security-relevant case: SES sandbox errors echo the
+    // destination email address in the raw text. This must not leak through.
+    const result = extractSesErrorCode("plain text mentioning victim@example.com is not verified");
+    expect(result).toBe("unparseable_ses_error_response");
+    expect(result).not.toContain("victim@example.com");
+  });
+
+  it("returns a fixed placeholder for a JSON body with neither known shape", () => {
+    expect(extractSesErrorCode(JSON.stringify({ somethingElse: true }))).toBe("unknown_ses_error_shape");
+  });
+});
+
+describe("sendOtpEmail", () => {
+  it("returns true on a 2xx response and posts to the region-specific SES endpoint", async () => {
+    const fakeClient: AwsFetcher = { fetch: vi.fn(async () => new Response("{}", { status: 200 })) };
+    const result = await sendOtpEmail("user@example.com", "123456", 10, ENV, fakeClient);
+    expect(result).toBe(true);
+    expect(fakeClient.fetch).toHaveBeenCalledWith(
+      "https://email.us-east-1.amazonaws.com/",
+      expect.objectContaining({ method: "POST" }),
+    );
+  });
+
+  it("returns false on a non-2xx response without throwing", async () => {
+    const fakeClient: AwsFetcher = {
+      fetch: vi.fn(async () => new Response(JSON.stringify({ Error: { Code: "Throttling" } }), { status: 429 })),
+    };
+    const result = await sendOtpEmail("user@example.com", "123456", 10, ENV, fakeClient);
+    expect(result).toBe(false);
+  });
+
+  it("returns false (never throws) when the underlying fetch rejects", async () => {
+    const fakeClient: AwsFetcher = {
+      fetch: vi.fn(async () => {
+        throw new Error("network down");
+      }),
+    };
+    const result = await sendOtpEmail("user@example.com", "123456", 10, ENV, fakeClient);
+    expect(result).toBe(false);
+  });
+
+  it("never includes the code in the visible request URL (it belongs in the signed body only)", async () => {
+    const fakeClient: AwsFetcher = { fetch: vi.fn(async () => new Response("{}", { status: 200 })) };
+    await sendOtpEmail("user@example.com", "999999", 10, ENV, fakeClient);
+    const [url] = (fakeClient.fetch as ReturnType<typeof vi.fn>).mock.calls[0] as [string, RequestInit];
+    expect(url).not.toContain("999999");
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/turnstile.test.ts b/infra/otp-worker/src/__tests__/turnstile.test.ts
new file mode 100644
index 000000000..34217d0c5
--- /dev/null
+++ b/infra/otp-worker/src/__tests__/turnstile.test.ts
@@ -0,0 +1,53 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { describe, expect, it, vi } from "vitest";
+import { verifyTurnstileToken } from "../turnstile";
+
+function fakeFetch(response: Partial<{ ok: boolean; status: number; json: () => unknown }>): typeof fetch {
+  return vi.fn(async () => ({
+    ok: response.ok ?? true,
+    status: response.status ?? 200,
+    json: response.json ?? (async () => ({ success: true })),
+  })) as unknown as typeof fetch;
+}
+
+describe("verifyTurnstileToken", () => {
+  it("skips verification (returns true) when no secret is configured — gate 2", async () => {
+    const fetchImpl = fakeFetch({});
+    const result = await verifyTurnstileToken("some-token", undefined, "1.2.3.4", fetchImpl);
+    expect(result).toBe(true);
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it("skips verification when the secret is an empty string", async () => {
+    const fetchImpl = fakeFetch({});
+    const result = await verifyTurnstileToken("some-token", "", "1.2.3.4", fetchImpl);
+    expect(result).toBe(true);
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it("returns true when siteverify reports success", async () => {
+    const fetchImpl = fakeFetch({ json: async () => ({ success: true }) });
+    const result = await verifyTurnstileToken("good-token", "secret", "1.2.3.4", fetchImpl);
+    expect(result).toBe(true);
+  });
+
+  it("fails closed when siteverify reports failure — a present-but-invalid token is rejected", async () => {
+    const fetchImpl = fakeFetch({ json: async () => ({ success: false, "error-codes": ["invalid-input-response"] }) });
+    const result = await verifyTurnstileToken("bad-token", "secret", "1.2.3.4", fetchImpl);
+    expect(result).toBe(false);
+  });
+
+  it("fails closed on a non-2xx siteverify response", async () => {
+    const fetchImpl = fakeFetch({ ok: false, status: 500 });
+    const result = await verifyTurnstileToken("token", "secret", "1.2.3.4", fetchImpl);
+    expect(result).toBe(false);
+  });
+
+  it("fails closed when the fetch itself throws (network error)", async () => {
+    const throwingFetch = vi.fn(async () => {
+      throw new Error("network down");
+    }) as unknown as typeof fetch;
+    const result = await verifyTurnstileToken("token", "secret", "1.2.3.4", throwingFetch);
+    expect(result).toBe(false);
+  });
+});
diff --git a/infra/otp-worker/src/auth.ts b/infra/otp-worker/src/auth.ts
new file mode 100644
index 000000000..8b31db2ff
--- /dev/null
+++ b/infra/otp-worker/src/auth.ts
@@ -0,0 +1,74 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Bearer-token origin auth — proves "a genuine Meridian binary sent this",
+ * not "this is a human". Mirrors the pattern already in production at
+ * `tray/src-tauri/src/counter_ping.rs` (compiled-in default, bearer auth),
+ * ported to the Worker side of that same handshake. Documented honestly per
+ * the plan: this is attestation, not a strong secret — the token is
+ * extractable from the shipped tray binary. Rate limiting (`ratelimit.ts`)
+ * and, optionally, Turnstile (`turnstile.ts`) are the actual abuse
+ * containment; this only keeps out casual/opportunistic callers who never
+ * had a Meridian binary at all.
+ *
+ * # Who calls this
+ * - `index.ts`, on every request, before any body parsing or KV access.
+ *
+ * # Related
+ * - `crypto-utils.ts` — the timing-safe comparison this relies on.
+ */
+
+import { timingSafeEqualStrings } from "./crypto-utils";
+
+export interface AuthEnv {
+  OTP_CLIENT_TOKEN?: string;
+  /** Staging-only, see below — absent in production. */
+  CI_TEST_TOKEN?: string;
+  ENVIRONMENT?: string;
+}
+
+export interface AuthResult {
+  ok: boolean;
+  /**
+   * True only when the request authenticated with the staging-only
+   * `CI_TEST_TOKEN` rather than the normal `OTP_CLIENT_TOKEN`. This is what
+   * gates the staging code-echo in `/otp/send` — never true outside
+   * `env.ENVIRONMENT === "staging"`, checked again explicitly below rather
+   * than relying solely on the secret being unset in production (the plan's
+   * "never reachable with the production bearer token, enforced with an
+   * explicit `env.ENVIRONMENT !== "staging"` guard, not just an unset var").
+   */
+  isCiTestToken: boolean;
+}
+
+const DENY: AuthResult = { ok: false, isCiTestToken: false };
+
+function extractBearerToken(header: string | null): string | null {
+  if (!header) return null;
+  const match = /^Bearer\s+(.+)$/.exec(header);
+  return match?.[1] ?? null;
+}
+
+/**
+ * Check the `Authorization` header against the configured client token (and,
+ * on staging only, the CI test token). An unconfigured/empty secret never
+ * matches an empty or missing token — guards against the classic "both
+ * sides blank" bypass if a secret was never set.
+ */
+export function checkBearerAuth(authorizationHeader: string | null, env: AuthEnv): AuthResult {
+  const token = extractBearerToken(authorizationHeader);
+  if (!token) return DENY;
+
+  const clientToken = env.OTP_CLIENT_TOKEN ?? "";
+  if (clientToken.length > 0 && timingSafeEqualStrings(token, clientToken)) {
+    return { ok: true, isCiTestToken: false };
+  }
+
+  if (env.ENVIRONMENT === "staging") {
+    const ciToken = env.CI_TEST_TOKEN ?? "";
+    if (ciToken.length > 0 && timingSafeEqualStrings(token, ciToken)) {
+      return { ok: true, isCiTestToken: true };
+    }
+  }
+
+  return DENY;
+}
diff --git a/infra/otp-worker/src/crypto-utils.ts b/infra/otp-worker/src/crypto-utils.ts
new file mode 100644
index 000000000..53013e772
--- /dev/null
+++ b/infra/otp-worker/src/crypto-utils.ts
@@ -0,0 +1,60 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Small crypto primitives shared by {@link "./auth"}, {@link "./otp"} and
+ * {@link "./email"}. Split out on its own so none of those three modules
+ * import from each other just to reach a hex-encode helper.
+ *
+ * # Related
+ * - `auth.ts` — bearer-token comparison
+ * - `otp.ts` — OTP code hashing/verification
+ * - `email.ts` — email-address hashing for KV keys
+ */
+
+/** Hex-encode a digest/signature buffer. */
+export function bufferToHex(buf: ArrayBuffer): string {
+  return Array.from(new Uint8Array(buf))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/**
+ * Constant-time string comparison, guarding both a bearer token check and an
+ * OTP-code-hash check against timing side-channels (see
+ * `workers-best-practices`: "Direct string comparison for secret values").
+ *
+ * Cloudflare's `crypto.subtle.timingSafeEqual` requires equal-length inputs
+ * and throws otherwise, so an unequal-length pair returns `false` up front
+ * without calling it. That is a length-based timing signal in principle, but
+ * length alone is not the secret here (a bearer token's length isn't
+ * sensitive, and OTP-code HMACs are always the same fixed digest length) —
+ * only the content comparison needs to be constant-time, which is what this
+ * still guarantees for any two equal-length inputs.
+ */
+export function timingSafeEqualStrings(a: string, b: string): boolean {
+  const enc = new TextEncoder();
+  const aBytes = enc.encode(a);
+  const bBytes = enc.encode(b);
+  if (aBytes.byteLength !== bBytes.byteLength) {
+    return false;
+  }
+  return crypto.subtle.timingSafeEqual(aBytes, bBytes);
+}
+
+/** SHA-256 hex digest of a UTF-8 string — used for the KV email-hash key. */
+export async function sha256Hex(input: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+  return bufferToHex(digest);
+}
+
+/** HMAC-SHA256 hex digest of `message` under `key` — used for OTP code hashing. */
+export async function hmacSha256Hex(key: string, message: string): Promise<string> {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(key),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const sig = await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(message));
+  return bufferToHex(sig);
+}
diff --git a/infra/otp-worker/src/email.ts b/infra/otp-worker/src/email.ts
new file mode 100644
index 000000000..85b02710d
--- /dev/null
+++ b/infra/otp-worker/src/email.ts
@@ -0,0 +1,38 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Email normalization and the KV-key hash. Raw email addresses are NEVER
+ * used as a KV key directly — always {@link emailHash} of the
+ * {@link normalizeEmail}-d form, per the plan's KV schema.
+ *
+ * # Related
+ * - `crypto-utils.ts` — the underlying `sha256Hex`
+ * - `index.ts` — the only caller
+ */
+
+import { sha256Hex } from "./crypto-utils";
+
+/** RFC 5321 hard upper bound on a full email address. */
+const MAX_EMAIL_LENGTH = 320;
+
+/**
+ * Normalize a raw email for hashing/delivery: trim, lowercase, and a
+ * deliberately permissive syntactic check.
+ *
+ * Full RFC 5322 validation is not this Worker's job — SES will bounce
+ * anything it can't deliver. This only needs to reject obviously-malformed
+ * input before it becomes a KV key or an SES recipient.
+ *
+ * Returns `null` for anything that doesn't look like an email at all.
+ */
+export function normalizeEmail(raw: unknown): string | null {
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim().toLowerCase();
+  if (trimmed.length === 0 || trimmed.length > MAX_EMAIL_LENGTH) return null;
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(trimmed)) return null;
+  return trimmed;
+}
+
+/** sha256 hex digest of a normalized email — the KV key material. */
+export async function emailHash(normalizedEmail: string): Promise<string> {
+  return sha256Hex(normalizedEmail);
+}
diff --git a/infra/otp-worker/src/env.d.ts b/infra/otp-worker/src/env.d.ts
new file mode 100644
index 000000000..567827442
--- /dev/null
+++ b/infra/otp-worker/src/env.d.ts
@@ -0,0 +1,43 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Augments the generated `Env` interface (`worker-configuration.d.ts`, from
+ * `npm run types` / `wrangler types`) with the secrets that only ever exist
+ * via `wrangler secret put` — `wrangler types` has no way to see these since
+ * they're never written to `wrangler.jsonc`.
+ *
+ * Deliberately NOT using a hand-written `Env` interface for everything
+ * (`workers-best-practices`' anti-pattern list flags exactly that): the
+ * bindings/vars half of `Env` still comes from the generated file, this only
+ * adds the secret-shaped half on top via declaration merging.
+ *
+ * # Related
+ * - `worker-configuration.d.ts` — generated, not committed by hand; run
+ *   `npm run types` after any `wrangler.jsonc` binding/vars change.
+ */
+
+export {};
+
+declare global {
+  interface Env {
+    /** Bearer token the tray binary sends — see `auth.ts`. */
+    OTP_CLIENT_TOKEN: string;
+    /** HMAC pepper for OTP code hashing — see `otp.ts`. Never the bare code. */
+    OTP_CODE_PEPPER: string;
+    AWS_ACCESS_KEY_ID: string;
+    AWS_SECRET_ACCESS_KEY: string;
+    AWS_REGION: string;
+    /**
+     * Staging-only bearer token that also unlocks the `/otp/send` code-echo
+     * (see `auth.ts`). Never set outside `env.staging` — its mere presence on
+     * production would still be inert there (see `auth.ts`'s `ENVIRONMENT`
+     * check), but it should never be set there in the first place.
+     */
+    CI_TEST_TOKEN?: string;
+    /**
+     * Cloudflare Turnstile secret key. Unset until/unless the frontend
+     * feasibility spike (see plan) lands and a Turnstile site is
+     * provisioned — see `turnstile.ts` for the unconfigured-secret behaviour.
+     */
+    TURNSTILE_SECRET_KEY?: string;
+  }
+}
diff --git a/infra/otp-worker/src/index.ts b/infra/otp-worker/src/index.ts
new file mode 100644
index 000000000..c57ef1972
--- /dev/null
+++ b/infra/otp-worker/src/index.ts
@@ -0,0 +1,218 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Meridian's OTP send/verify Worker — the backend for the setup wizard's
+ * one-time email capture step (see the parent plan,
+ * `giggly-jumping-hopcroft.md`, Part 1).
+ *
+ * Exactly two routes exist; everything else 404s:
+ *   `POST /otp/send`   `{ email, turnstileToken? }`
+ *   `POST /otp/verify` `{ email, code }`
+ * Both require `Authorization: Bearer <token>` — see `auth.ts`.
+ *
+ * This file is intentionally thin: routing, request-body validation, and
+ * gate ordering only. Every gate below (`auth.ts`, `turnstile.ts`,
+ * `ratelimit.ts`, `otp.ts`) is independently unit-tested as a pure function;
+ * this is the only place they're wired to a real `KVNamespace` and real
+ * `fetch` calls (`kv.ts`, `ses.ts`, `turnstile.ts`).
+ *
+ * # Who calls this
+ * - `tray/src-tauri/src/commands/otp.rs` (Part 2 of the plan, out of this
+ *   Worker's scope) — `request_account_otp` / `confirm_account_otp`.
+ *
+ * # Related
+ * - README.md — design rationale, KV schema, status-code mapping, manual
+ *   deploy prerequisites.
+ * - `scripts/deploy-otp-worker.sh` — post-deploy smoke test against these
+ *   exact routes/status codes.
+ */
+
+import { checkBearerAuth } from "./auth";
+import { emailHash, normalizeEmail } from "./email";
+import { getCounter, getOtpRecord, deleteOtpRecord, putCounter, putOtpRecord } from "./kv";
+import { createOtpRecord, generateCode, hashCode, verifyOtpAttempt } from "./otp";
+import { evaluateRateLimits, incrementCounter, utcDateString, type RateLimitScope } from "./ratelimit";
+import {
+  badRequest,
+  forbidden,
+  gone,
+  notFound,
+  ok,
+  rateLimited,
+  serviceUnavailable,
+  unauthorized,
+} from "./responses";
+import { sendOtpEmail } from "./ses";
+import { verifyTurnstileToken } from "./turnstile";
+
+const HOUR_MS = 60 * 60 * 1000;
+const DAY_MS = 24 * HOUR_MS;
+/** Fixed KV cleanup TTL for `global:sends:<date>` — see `kv.ts`'s `putCounter`. */
+const GLOBAL_COUNTER_KV_TTL_S = 90_000;
+
+function clientIp(request: Request): string {
+  return request.headers.get("CF-Connecting-IP") ?? "unknown";
+}
+
+/** Parse and loosely-type the JSON body; `null` on anything unparseable or non-object. */
+async function readJsonBody(request: Request): Promise<Record<string, unknown> | null> {
+  let parsed: unknown;
+  try {
+    parsed = await request.json();
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+  return parsed as Record<string, unknown>;
+}
+
+async function handleSend(request: Request, env: Env): Promise<Response> {
+  const auth = checkBearerAuth(request.headers.get("Authorization"), env);
+  if (!auth.ok) return unauthorized();
+
+  const body = await readJsonBody(request);
+  if (!body) return badRequest("invalid_json");
+
+  const email = normalizeEmail(body.email);
+  if (!email) return badRequest("invalid_email");
+
+  const turnstileToken = body.turnstileToken;
+  if (turnstileToken !== undefined && typeof turnstileToken !== "string") {
+    return badRequest("invalid_turnstile_token");
+  }
+
+  const ip = clientIp(request);
+
+  // Gate: Turnstile, only when the client actually sent a token (see
+  // turnstile.ts's module header for the full conditional-support story).
+  if (typeof turnstileToken === "string" && turnstileToken.length > 0) {
+    const passed = await verifyTurnstileToken(
+      turnstileToken,
+      env.TURNSTILE_SECRET_KEY,
+      ip !== "unknown" ? ip : undefined,
+    );
+    if (!passed) return forbidden("turnstile_failed");
+  }
+
+  const now = Date.now();
+  const hash = await emailHash(email);
+  const dateKey = `global:sends:${utcDateString(now)}`;
+
+  const [emailCounter, ipCounter, globalCounter] = await Promise.all([
+    getCounter(env.OTP_KV, `rl:email:${hash}`),
+    getCounter(env.OTP_KV, `rl:ip:${ip}`),
+    getCounter(env.OTP_KV, dateKey),
+  ]);
+
+  const decision = evaluateRateLimits({
+    emailRecord: emailCounter,
+    ipRecord: ipCounter,
+    globalRecord: globalCounter,
+    now,
+    caps: {
+      email: Number(env.RL_EMAIL_PER_DAY),
+      ip: Number(env.RL_IP_PER_HOUR),
+      global: Number(env.RL_GLOBAL_PER_DAY),
+    },
+  });
+  if (!decision.allowed) {
+    const scope: RateLimitScope = decision.scope ?? "global";
+    console.warn("otp-worker: send rate limited", { scope, emailHashPrefix: hash.slice(0, 8) });
+    return rateLimited(scope);
+  }
+
+  // Counters are persisted BEFORE the SES call, deliberately: the caps exist
+  // for cost/abuse containment against ATTEMPTED sends, so a run of SES
+  // failures (an outage, a bad credential) must still count against budget —
+  // otherwise an attacker (or a genuine outage) could drive unlimited
+  // send-attempt traffic for free by ensuring every attempt "fails" cheaply.
+  const ttlMs = Number(env.OTP_TTL_S) * 1000;
+  const code = generateCode();
+  const codeHash = await hashCode(code, env.OTP_CODE_PEPPER);
+  const record = createOtpRecord(codeHash, now, ttlMs);
+
+  await Promise.all([
+    putOtpRecord(env.OTP_KV, hash, record, now),
+    putCounter(env.OTP_KV, `rl:email:${hash}`, incrementCounter(emailCounter, now, DAY_MS), now),
+    putCounter(env.OTP_KV, `rl:ip:${ip}`, incrementCounter(ipCounter, now, HOUR_MS), now),
+    putCounter(
+      env.OTP_KV,
+      dateKey,
+      incrementCounter(globalCounter, now, DAY_MS),
+      now,
+      GLOBAL_COUNTER_KV_TTL_S,
+    ),
+  ]);
+
+  const ttlMinutes = Math.max(1, Math.round(Number(env.OTP_TTL_S) / 60));
+  const sent = await sendOtpEmail(email, code, ttlMinutes, env);
+  if (!sent) {
+    return serviceUnavailable("email_delivery_failed");
+  }
+
+  // Staging-only code echo for scripts/deploy-otp-worker.sh's happy-path
+  // send->verify probe. Both conditions are required and checked here, not
+  // just at auth time, so this can never fire on production even if a
+  // CI_TEST_TOKEN secret were mistakenly present there.
+  if (env.ENVIRONMENT === "staging" && auth.isCiTestToken) {
+    return ok({ code });
+  }
+  return ok();
+}
+
+async function handleVerify(request: Request, env: Env): Promise<Response> {
+  const auth = checkBearerAuth(request.headers.get("Authorization"), env);
+  if (!auth.ok) return unauthorized();
+
+  const body = await readJsonBody(request);
+  if (!body) return badRequest("invalid_json");
+
+  const email = normalizeEmail(body.email);
+  if (!email) return badRequest("invalid_email");
+
+  const rawCode = body.code;
+  if (typeof rawCode !== "string" || !/^\d{6}$/.test(rawCode)) {
+    return badRequest("invalid_code");
+  }
+
+  const now = Date.now();
+  const hash = await emailHash(email);
+  const [record, providedHash] = await Promise.all([
+    getOtpRecord(env.OTP_KV, hash),
+    hashCode(rawCode, env.OTP_CODE_PEPPER),
+  ]);
+
+  const maxAttempts = Number(env.MAX_VERIFY_ATTEMPTS);
+  const outcome = verifyOtpAttempt(record, providedHash, now, maxAttempts);
+
+  switch (outcome.kind) {
+    case "verified":
+      await deleteOtpRecord(env.OTP_KV, hash);
+      return ok({ verified: true });
+    case "wrong":
+      await putOtpRecord(env.OTP_KV, hash, outcome.nextRecord, now);
+      return ok({ verified: false, attemptsRemaining: outcome.attemptsRemaining });
+    case "exhausted":
+      await deleteOtpRecord(env.OTP_KV, hash);
+      return gone("code_expired_or_not_found");
+    case "not_found_or_expired":
+      return gone("code_expired_or_not_found");
+  }
+}
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const url = new URL(request.url);
+    try {
+      if (request.method === "POST" && url.pathname === "/otp/send") {
+        return await handleSend(request, env);
+      }
+      if (request.method === "POST" && url.pathname === "/otp/verify") {
+        return await handleVerify(request, env);
+      }
+      return notFound();
+    } catch (err) {
+      console.error("otp-worker: unhandled error", { error: String(err), path: url.pathname });
+      return serviceUnavailable("internal_error");
+    }
+  },
+} satisfies ExportedHandler<Env>;
diff --git a/infra/otp-worker/src/kv.ts b/infra/otp-worker/src/kv.ts
new file mode 100644
index 000000000..ab79c2a63
--- /dev/null
+++ b/infra/otp-worker/src/kv.ts
@@ -0,0 +1,85 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Thin `KVNamespace` read/write glue for `OTP_KV`. Deliberately the only
+ * module that touches the binding directly — `otp.ts` and `ratelimit.ts`
+ * stay pure and unit-testable, this just serializes their record shapes to
+ * and from JSON with the right TTL.
+ *
+ * Every record embeds its own authoritative `expiresAt` (epoch ms) rather
+ * than relying solely on KV's own TTL, for two reasons documented on
+ * `otp.ts`/`ratelimit.ts`: (1) a rolling window's expiry must survive a
+ * read-modify-write without being reset on every increment, which KV's
+ * `expirationTtl` alone can't do (it must be re-specified on every `put`);
+ * and (2) **Cloudflare Workers KV requires `expirationTtl >= 60`** — a
+ * record with, say, 20 real seconds left cannot be written back with a
+ * 20-second KV TTL. {@link ttlSecondsFromExpiry} clamps to that floor, which
+ * only affects the KV-level storage cleanup timer; `verifyOtpAttempt` and
+ * `isOverCap`'s own `now >= expiresAt` checks are what actually enforce
+ * expiry, so a clamped KV TTL can never let an expired record be honoured —
+ * it can only make the dead key sit in storage a little longer before KV
+ * itself reaps it.
+ *
+ * # Who calls this
+ * - `index.ts`'s `/otp/send` and `/otp/verify` handlers.
+ *
+ * # Related
+ * - `otp.ts` — `OtpRecord`, the pure verify state machine
+ * - `ratelimit.ts` — `CounterRecord`, the pure cap-decision logic
+ */
+
+import type { OtpRecord } from "./otp";
+import type { CounterRecord } from "./ratelimit";
+
+/** Cloudflare Workers KV's hard minimum for `expirationTtl`, in seconds. */
+const KV_MIN_TTL_S = 60;
+
+/** Seconds until `expiresAt`, clamped to KV's minimum TTL. See module header. */
+export function ttlSecondsFromExpiry(expiresAt: number, now: number): number {
+  return Math.max(KV_MIN_TTL_S, Math.ceil((expiresAt - now) / 1000));
+}
+
+function otpKey(emailHash: string): string {
+  return `code:${emailHash}`;
+}
+
+export async function getOtpRecord(kv: KVNamespace, emailHashValue: string): Promise<OtpRecord | null> {
+  return kv.get<OtpRecord>(otpKey(emailHashValue), "json");
+}
+
+export async function putOtpRecord(
+  kv: KVNamespace,
+  emailHashValue: string,
+  record: OtpRecord,
+  now: number,
+): Promise<void> {
+  await kv.put(otpKey(emailHashValue), JSON.stringify(record), {
+    expirationTtl: ttlSecondsFromExpiry(record.expiresAt, now),
+  });
+}
+
+export async function deleteOtpRecord(kv: KVNamespace, emailHashValue: string): Promise<void> {
+  await kv.delete(otpKey(emailHashValue));
+}
+
+export async function getCounter(kv: KVNamespace, key: string): Promise<CounterRecord | null> {
+  return kv.get<CounterRecord>(key, "json");
+}
+
+/**
+ * Write a counter record. `ttlOverrideS`, when given, is used verbatim
+ * instead of the derived clamp — used for `global:sends:<date>`, whose KV
+ * TTL is a fixed 90000s cleanup buffer per the plan (deliberately longer
+ * than one calendar day) rather than something derived from the embedded
+ * window, since that key's real "window" is just "this UTC date".
+ */
+export async function putCounter(
+  kv: KVNamespace,
+  key: string,
+  record: CounterRecord,
+  now: number,
+  ttlOverrideS?: number,
+): Promise<void> {
+  await kv.put(key, JSON.stringify(record), {
+    expirationTtl: ttlOverrideS ?? ttlSecondsFromExpiry(record.expiresAt, now),
+  });
+}
diff --git a/infra/otp-worker/src/otp.ts b/infra/otp-worker/src/otp.ts
new file mode 100644
index 000000000..14ab7a7d7
--- /dev/null
+++ b/infra/otp-worker/src/otp.ts
@@ -0,0 +1,109 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * OTP code generation, hashing, and the verify-attempt state machine. This
+ * is the single most security-sensitive module in the Worker — a 6-digit
+ * code is trivially brute-forced offline from a raw KV dump, which is why
+ * `code:<hash>` never stores the plain code (see {@link hashCode}) and why
+ * {@link verifyOtpAttempt} is written as a pure function: the one invariant
+ * it exists to protect — a wrong guess must NEVER extend the record's
+ * remaining TTL — is exactly the kind of thing that's easy to regress inside
+ * a KV read/write handler and easy to pin with a unit test outside one.
+ *
+ * # Who calls this
+ * - `index.ts`'s `/otp/send` handler (`generateCode`, `hashCode`,
+ *   `createOtpRecord`)
+ * - `index.ts`'s `/otp/verify` handler (`hashCode`, `verifyOtpAttempt`)
+ *
+ * # Related
+ * - `crypto-utils.ts` — `hmacSha256Hex` (the actual HMAC), `timingSafeEqualStrings`
+ * - `ratelimit.ts` — the sibling KV-record state machine for send caps,
+ *   built on the same "pure decision, thin KV glue" split
+ */
+
+import { hmacSha256Hex, timingSafeEqualStrings } from "./crypto-utils";
+
+/** The `code:<hash>` KV value shape. */
+export interface OtpRecord {
+  /** HMAC-SHA256(pepper, code) — never the bare code. */
+  codeHash: string;
+  attempts: number;
+  /** Epoch ms. Authoritative expiry check — KV's own TTL is best-effort cleanup only. */
+  expiresAt: number;
+}
+
+/**
+ * Cryptographically random 6-digit code via rejection sampling — avoids the
+ * modulo-bias `byte % 10` would introduce (256 is not a multiple of 10, so a
+ * plain modulo maps bytes 0-5 to digit 0-5 with a fractionally higher chance
+ * than 6-9; discarding bytes 250-255 removes that bias entirely). Per
+ * `workers-best-practices`: never `Math.random()` for anything
+ * security-sensitive.
+ */
+export function generateCode(length = 6): string {
+  const digits: string[] = [];
+  const buf = new Uint8Array(1);
+  while (digits.length < length) {
+    crypto.getRandomValues(buf);
+    const byte = buf[0] as number;
+    if (byte >= 250) continue; // 250-255 discarded: 256 % 10 !== 0
+    digits.push(String(byte % 10));
+  }
+  return digits.join("");
+}
+
+/** HMAC-SHA256(pepper, code), hex-encoded — the only form of the code that touches KV. */
+export async function hashCode(code: string, pepper: string): Promise<string> {
+  return hmacSha256Hex(pepper, code);
+}
+
+/** Build a fresh record for a newly-sent code. `ttlMs` comes from `vars.OTP_TTL_S * 1000`. */
+export function createOtpRecord(codeHash: string, now: number, ttlMs: number): OtpRecord {
+  return { codeHash, attempts: 0, expiresAt: now + ttlMs };
+}
+
+export type VerifyOutcome =
+  | { kind: "verified" }
+  | { kind: "wrong"; nextRecord: OtpRecord; attemptsRemaining: number }
+  | { kind: "exhausted" }
+  | { kind: "not_found_or_expired" };
+
+/**
+ * Apply one verify attempt against the current record. Pure: takes the
+ * record read from KV and returns what to write back (or `null` via the
+ * `verified`/`exhausted`/`not_found_or_expired` kinds, all of which mean
+ * "the caller deletes the KV key").
+ *
+ * `exhausted` and `not_found_or_expired` are deliberately the SAME outward
+ * HTTP response (410, see `responses.ts`) — a caller must not be able to
+ * distinguish "you used up your 5 attempts" from "there was never a live
+ * code for this email" from the HTTP layer alone; both just mean "request a
+ * new code".
+ */
+export function verifyOtpAttempt(
+  record: OtpRecord | null,
+  providedCodeHash: string,
+  now: number,
+  maxAttempts: number,
+): VerifyOutcome {
+  if (!record) return { kind: "not_found_or_expired" };
+  if (now >= record.expiresAt) return { kind: "not_found_or_expired" };
+  if (record.attempts >= maxAttempts) return { kind: "exhausted" };
+
+  if (timingSafeEqualStrings(providedCodeHash, record.codeHash)) {
+    return { kind: "verified" };
+  }
+
+  const nextAttempts = record.attempts + 1;
+  if (nextAttempts >= maxAttempts) {
+    return { kind: "exhausted" };
+  }
+
+  // Preserve `expiresAt` EXACTLY — a wrong guess must never extend the
+  // record's remaining TTL. This line is the one this module exists to get
+  // right; see `otp.test.ts`'s `wrong guess never extends expiresAt` case.
+  return {
+    kind: "wrong",
+    nextRecord: { codeHash: record.codeHash, attempts: nextAttempts, expiresAt: record.expiresAt },
+    attemptsRemaining: maxAttempts - nextAttempts,
+  };
+}
diff --git a/infra/otp-worker/src/ratelimit.ts b/infra/otp-worker/src/ratelimit.ts
new file mode 100644
index 000000000..3c4c5f8a2
--- /dev/null
+++ b/infra/otp-worker/src/ratelimit.ts
@@ -0,0 +1,85 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Pure rate-limit decision logic for `/otp/send`, kept separate from the KV
+ * read/write glue in `index.ts` so the caps themselves are unit-testable
+ * without mocking a `KVNamespace`.
+ *
+ * Three independent caps, checked in this order (cheapest/most-specific
+ * first, matching the plan's KV schema): per-email, per-IP, then global.
+ * `rl:email:<hash>` and `rl:ip:<ip>` are rolling fixed windows that open on
+ * the first send and reset only once that window's `expiresAt` has passed —
+ * NOT a calendar-boundary reset — which is why, like `otp.ts`'s record, the
+ * expiry is carried in the value itself rather than relied on purely via
+ * KV's own TTL (KV requires re-specifying `expirationTtl` on every write, so
+ * a naive re-put on each increment would either reset the window every
+ * request or silently drop expiry entirely).
+ *
+ * `global:sends:<date>` is different: its KV key is itself namespaced by UTC
+ * date (see {@link utcDateString}), so the "window" is just "this key exists
+ * for one calendar day" — no embedded expiry needed, a plain KV
+ * `expirationTtl` for cleanup is enough (see the plan's 90000s, deliberately
+ * longer than a day as a timezone-drift safety margin, not a precise window).
+ *
+ * # Who calls this
+ * - `index.ts`'s `/otp/send` handler, after auth and body validation, before
+ *   generating a code or spending an SES send.
+ *
+ * # Related
+ * - `otp.ts` — the sibling pure state machine for the OTP record itself.
+ */
+
+/** A rolling fixed-window counter (`rl:email:*`, `rl:ip:*`). */
+export interface CounterRecord {
+  count: number;
+  /** Epoch ms — when this window resets, opening a fresh one on next write. */
+  expiresAt: number;
+}
+
+/** UTC calendar-day string (`YYYY-MM-DD`) — the `global:sends:<date>` key suffix. */
+export function utcDateString(now: number): string {
+  return new Date(now).toISOString().slice(0, 10);
+}
+
+/**
+ * Fold one more send into a rolling counter. Starts a fresh window (count 1)
+ * if there is no existing record or the existing window has already expired;
+ * otherwise increments in place, leaving `expiresAt` untouched.
+ */
+export function incrementCounter(existing: CounterRecord | null, now: number, windowMs: number): CounterRecord {
+  if (!existing || now >= existing.expiresAt) {
+    return { count: 1, expiresAt: now + windowMs };
+  }
+  return { count: existing.count + 1, expiresAt: existing.expiresAt };
+}
+
+/** Whether a counter is currently at or past its cap. An expired/absent window is never over cap. */
+export function isOverCap(record: CounterRecord | null, now: number, cap: number): boolean {
+  if (!record || now >= record.expiresAt) return false;
+  return record.count >= cap;
+}
+
+export type RateLimitScope = "email" | "ip" | "global";
+
+export interface RateLimitDecision {
+  allowed: boolean;
+  scope?: RateLimitScope;
+}
+
+/**
+ * Evaluate all three caps against counters already read from KV. Checked
+ * before any counter is incremented — a request that trips a cap must not
+ * also consume budget from the caps it didn't trip.
+ */
+export function evaluateRateLimits(params: {
+  emailRecord: CounterRecord | null;
+  ipRecord: CounterRecord | null;
+  globalRecord: CounterRecord | null;
+  now: number;
+  caps: { email: number; ip: number; global: number };
+}): RateLimitDecision {
+  const { emailRecord, ipRecord, globalRecord, now, caps } = params;
+  if (isOverCap(emailRecord, now, caps.email)) return { allowed: false, scope: "email" };
+  if (isOverCap(ipRecord, now, caps.ip)) return { allowed: false, scope: "ip" };
+  if (isOverCap(globalRecord, now, caps.global)) return { allowed: false, scope: "global" };
+  return { allowed: true };
+}
diff --git a/infra/otp-worker/src/responses.ts b/infra/otp-worker/src/responses.ts
new file mode 100644
index 000000000..d592efb09
--- /dev/null
+++ b/infra/otp-worker/src/responses.ts
@@ -0,0 +1,29 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Small, consistent JSON response builders for the exact status codes the
+ * plan specifies (400/401/403/404/410/429/503) — kept out of `index.ts` so
+ * the handler reads as "gate, gate, gate, do the thing" rather than inline
+ * `Response.json(...)` literals repeated across `/otp/send` and
+ * `/otp/verify`.
+ *
+ * # Related
+ * - `index.ts` — the only caller
+ * - README.md — the status-code-to-meaning mapping, documented there since
+ *   the plan states the set of codes but not the full route-by-route mapping
+ */
+
+function jsonResponse(body: unknown, status: number): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+export const notFound = (): Response => jsonResponse({ error: "not_found" }, 404);
+export const unauthorized = (): Response => jsonResponse({ error: "unauthorized" }, 401);
+export const badRequest = (error: string): Response => jsonResponse({ error }, 400);
+export const forbidden = (error: string): Response => jsonResponse({ error }, 403);
+export const gone = (error: string): Response => jsonResponse({ error }, 410);
+export const rateLimited = (scope: string): Response => jsonResponse({ error: "rate_limited", scope }, 429);
+export const serviceUnavailable = (error: string): Response => jsonResponse({ error }, 503);
+export const ok = (body: Record<string, unknown> = {}): Response => jsonResponse({ ok: true, ...body }, 200);
diff --git a/infra/otp-worker/src/ses.ts b/infra/otp-worker/src/ses.ts
new file mode 100644
index 000000000..7915b985d
--- /dev/null
+++ b/infra/otp-worker/src/ses.ts
@@ -0,0 +1,120 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Email delivery via AWS SES's `SendEmail` (Query API, v1,
+ * `2010-12-01`), SigV4-signed with `aws4fetch` — Workers run on a V8
+ * isolate with no Node.js APIs, so the official AWS SDK doesn't work here;
+ * `aws4fetch` is the established community pattern for calling AWS from a
+ * Worker. Resolved (not specified by the plan): SES v1's Query API over
+ * SESv2's JSON API, because it's the one with a documented `aws4fetch`
+ * example (`service: "email"`, form-urlencoded body) — this is a low-stakes
+ * choice per a single `SendEmail` call either way.
+ *
+ * `from` is always `${FROM_NAME} <${FROM_ADDRESS}>` where `FROM_ADDRESS` is
+ * a verified subdomain of meridiona.com (`vars.FROM_ADDRESS` in
+ * `wrangler.jsonc`, currently the placeholder `otp@auth.meridiona.com` —
+ * DNS verification is a manual step outside this Worker's code, see
+ * README.md). Plain code, no links, per the plan.
+ *
+ * # Who calls this
+ * - `index.ts`'s `/otp/send` handler, after the OTP record is written and
+ *   all rate-limit/Turnstile gates have passed.
+ *
+ * # Related
+ * - README.md — the SES-vs-Resend rationale and the sandbox/production-access
+ *   prerequisite (external, not something this code can detect at runtime
+ *   beyond a failed send surfacing as a 503).
+ */
+
+import { AwsClient } from "aws4fetch";
+
+export interface SesEnv {
+  AWS_ACCESS_KEY_ID: string;
+  AWS_SECRET_ACCESS_KEY: string;
+  AWS_REGION: string;
+  FROM_ADDRESS: string;
+  FROM_NAME: string;
+}
+
+/**
+ * The slice of `AwsClient` this module actually uses. Tests inject a fake
+ * implementing just this shape instead of a real `AwsClient` — `AwsClient`
+ * has no `fetch` override in its `RequestInit` (only an `aws` signing-options
+ * override), so the only way to intercept the network call for a test is at
+ * this level, not by passing a custom `fetch` down into `client.fetch()`.
+ */
+export interface AwsFetcher {
+  fetch(input: string, init?: RequestInit): Promise<Response>;
+}
+
+/** The exact body sent to the user — no links, matching the plan. */
+export function buildOtpEmailBody(code: string, ttlMinutes: number): string {
+  return (
+    `Your Meridian verification code is: ${code}\n\n` +
+    `This code expires in ${ttlMinutes} minutes. If you didn't request this, you can safely ignore this email.`
+  );
+}
+
+/**
+ * Extract a safe, loggable identifier from an SES error response WITHOUT
+ * ever logging the raw body — SES's sandbox-mode "email address is not
+ * verified" error echoes the destination address back in the response text,
+ * which must never reach Workers Logs verbatim.
+ */
+export function extractSesErrorCode(responseText: string): string {
+  try {
+    const parsed = JSON.parse(responseText) as { Error?: { Code?: string }; message?: string };
+    return parsed.Error?.Code ?? parsed.message ?? "unknown_ses_error_shape";
+  } catch {
+    return "unparseable_ses_error_response";
+  }
+}
+
+/**
+ * Send the OTP email. Returns `false` (never throws) on any failure so the
+ * caller can map it to a 503 without a try/catch of its own — network
+ * errors, non-2xx SES responses, and thrown exceptions are all "delivery
+ * failed" from the caller's point of view.
+ */
+export async function sendOtpEmail(
+  toEmail: string,
+  code: string,
+  ttlMinutes: number,
+  env: SesEnv,
+  client: AwsFetcher = new AwsClient({
+    accessKeyId: env.AWS_ACCESS_KEY_ID,
+    secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+    service: "email",
+    region: env.AWS_REGION,
+  }),
+): Promise<boolean> {
+  const body = new URLSearchParams({
+    Action: "SendEmail",
+    Version: "2010-12-01",
+    Source: `${env.FROM_NAME} <${env.FROM_ADDRESS}>`,
+    "Destination.ToAddresses.member.1": toEmail,
+    "Message.Subject.Data": "Your Meridian verification code",
+    "Message.Subject.Charset": "UTF-8",
+    "Message.Body.Text.Data": buildOtpEmailBody(code, ttlMinutes),
+    "Message.Body.Text.Charset": "UTF-8",
+  });
+
+  try {
+    const res = await client.fetch(`https://email.${env.AWS_REGION}.amazonaws.com/`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: body.toString(),
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      console.error("otp-worker: ses send failed", { status: res.status, errorCode: extractSesErrorCode(text) });
+      return false;
+    }
+    return true;
+  } catch (err) {
+    console.error("otp-worker: ses send threw", { error: String(err) });
+    return false;
+  }
+}
diff --git a/infra/otp-worker/src/turnstile.ts b/infra/otp-worker/src/turnstile.ts
new file mode 100644
index 000000000..747be8d6b
--- /dev/null
+++ b/infra/otp-worker/src/turnstile.ts
@@ -0,0 +1,88 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * Optional server-side Turnstile verification for `/otp/send`.
+ *
+ * Turnstile support is wired but CONDITIONAL, per the plan: whether the
+ * client actually sends a `turnstileToken` depends on a separate
+ * frontend/Tauri feasibility spike this Worker's implementation does not
+ * block on (see README.md's "Turnstile" section for the full reasoning and
+ * the resolved edge case below).
+ *
+ * Two independent gates, both must be satisfied for verification to run:
+ *  1. The request body actually included a `turnstileToken` — if absent,
+ *     `index.ts` never calls this module at all and the send proceeds on
+ *     bearer-auth + rate-limits alone (the plan's explicit "if absent,
+ *     proceed without it").
+ *  2. `env.TURNSTILE_SECRET_KEY` is actually configured — if it's unset
+ *     (the expected state until/unless the frontend spike succeeds and a
+ *     site is provisioned), verification is a no-op: {@link verifyTurnstileToken}
+ *     returns `true` and logs a warning, rather than rejecting every send
+ *     because a feature nothing has enabled yet is "misconfigured". Once a
+ *     secret IS configured, gate 1 is what actually matters day to day.
+ *
+ * Resolved (not specified by the plan): a token that IS present but FAILS
+ * verification is rejected (403) rather than silently ignored — fail closed
+ * on invalid input, consistent with this repo's conventions elsewhere. A
+ * present-and-valid token verifies as usual; an absent token skips this
+ * module entirely (per gate 1 above); an unconfigured secret with a present
+ * token also proceeds (per gate 2), since without a secret there's nothing
+ * to validate against.
+ *
+ * # Who calls this
+ * - `index.ts`'s `/otp/send` handler, only when `turnstileToken` is present
+ *   in the request body.
+ *
+ * # Related
+ * - README.md — the Turnstile spike status and the secret name
+ *   (`TURNSTILE_SECRET_KEY`) is documented there since it's not one of the
+ *   plan's originally-listed secrets.
+ */
+
+const SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+
+interface SiteverifyResponse {
+  success?: boolean;
+  "error-codes"?: string[];
+}
+
+/**
+ * Verify a Turnstile token via Cloudflare's siteverify API.
+ *
+ * Fails closed on any network error, non-2xx response, or unparseable body —
+ * an inability to verify is treated the same as a failed verification, never
+ * as an implicit pass.
+ */
+export async function verifyTurnstileToken(
+  token: string,
+  secretKey: string | undefined,
+  remoteIp: string | undefined,
+  fetchImpl: typeof fetch = fetch,
+): Promise<boolean> {
+  if (!secretKey || secretKey.length === 0) {
+    // Gate 2: feature not provisioned yet — see module header.
+    console.warn("otp-worker: turnstileToken present but TURNSTILE_SECRET_KEY unset — skipping verification");
+    return true;
+  }
+
+  const body = new URLSearchParams();
+  body.set("secret", secretKey);
+  body.set("response", token);
+  if (remoteIp) body.set("remoteip", remoteIp);
+
+  try {
+    const res = await fetchImpl(SITEVERIFY_URL, { method: "POST", body });
+    if (!res.ok) {
+      console.warn("otp-worker: turnstile siteverify non-2xx", { status: res.status });
+      return false;
+    }
+    const data = (await res.json()) as SiteverifyResponse;
+    if (data.success !== true) {
+      console.warn("otp-worker: turnstile siteverify rejected", { errorCodes: data["error-codes"] ?? [] });
+      return false;
+    }
+    return true;
+  } catch (err) {
+    console.error("otp-worker: turnstile siteverify request failed", { error: String(err) });
+    return false;
+  }
+}
diff --git a/infra/otp-worker/tsconfig.json b/infra/otp-worker/tsconfig.json
new file mode 100644
index 000000000..bf0028475
--- /dev/null
+++ b/infra/otp-worker/tsconfig.json
@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022"],
+    "module": "ES2022",
+    "moduleResolution": "Bundler",
+    "types": ["vitest/globals"],
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true
+  },
+  // `files` (not `include`) for the ambient `cloudflare:test` module
+  // declaration — it lives under node_modules, and `exclude` below prunes
+  // node_modules paths even when they're listed explicitly in `include`;
+  // `files` is the one list `exclude` never filters.
+  "files": ["node_modules/@cloudflare/vitest-plugin/types/cloudflare-test.d.ts"],
+  "include": ["src/**/*", "vitest.config.mts", "worker-configuration.d.ts"],
+  "exclude": ["node_modules"]
+}
diff --git a/infra/otp-worker/vitest.config.mts b/infra/otp-worker/vitest.config.mts
new file mode 100644
index 000000000..2b220e6eb
--- /dev/null
+++ b/infra/otp-worker/vitest.config.mts
@@ -0,0 +1,22 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { cloudflareTest } from "@cloudflare/vitest-plugin";
+import { defineConfig } from "vitest/config";
+
+// Runs tests inside a real Miniflare-simulated Workers runtime (Web Crypto,
+// KVNamespace, etc. all behave like the deployed Worker) rather than plain
+// Node — chosen over hand-mocked globals because several modules here
+// (crypto-utils.ts's `crypto.subtle.timingSafeEqual`, otp.ts's
+// `crypto.getRandomValues`) are Workers-runtime APIs, not standard Node ones.
+// No Cloudflare account or network access needed: Miniflare runs entirely
+// locally, reading only `wrangler.jsonc` for binding shapes.
+//
+// `@cloudflare/vitest-plugin` (not the older `@cloudflare/vitest-pool-workers`,
+// which has no `defineWorkersConfig` export as of Vitest 4 / pool-workers
+// 0.22.x) is Cloudflare's Vite-plugin-based successor for Vitest v4+.
+export default defineConfig({
+  plugins: [
+    cloudflareTest({
+      wrangler: { configPath: "./wrangler.jsonc" },
+    }),
+  ],
+});
diff --git a/infra/otp-worker/worker-configuration.d.ts b/infra/otp-worker/worker-configuration.d.ts
new file mode 100644
index 000000000..b56f45b2f
--- /dev/null
+++ b/infra/otp-worker/worker-configuration.d.ts
@@ -0,0 +1,15305 @@
+/* eslint-disable */
+// Generated by Wrangler by running `wrangler types` (hash: cbacf9a3a99dc169dcf7d94a0727f327)
+// Runtime types generated with workerd@1.20260828.1 2026-08-25 nodejs_compat
+interface __BaseEnv_Env {
+	OTP_KV: KVNamespace;
+	ENVIRONMENT: "staging" | "production";
+	FROM_ADDRESS: "otp@auth.meridiona.com";
+	FROM_NAME: "Meridian (staging)" | "Meridian";
+	OTP_TTL_S: 600;
+	MAX_VERIFY_ATTEMPTS: 5;
+	RL_EMAIL_PER_DAY: 3;
+	RL_IP_PER_HOUR: 5 | 10;
+	RL_GLOBAL_PER_DAY: 500 | 2000;
+}
+declare namespace Cloudflare {
+	interface GlobalProps {
+		mainModule: typeof import("./src/index");
+	}
+	interface StagingEnv {
+		OTP_KV: KVNamespace;
+		ENVIRONMENT: "staging";
+		FROM_ADDRESS: "otp@auth.meridiona.com";
+		FROM_NAME: "Meridian (staging)";
+		OTP_TTL_S: 600;
+		MAX_VERIFY_ATTEMPTS: 5;
+		RL_EMAIL_PER_DAY: 3;
+		RL_IP_PER_HOUR: 5;
+		RL_GLOBAL_PER_DAY: 500;
+	}
+	interface Env extends __BaseEnv_Env {}
+}
+interface Env extends __BaseEnv_Env {}
+type StringifyValues<EnvType extends Record<string, unknown>> = {
+	[Binding in keyof EnvType]: EnvType[Binding] extends string ? EnvType[Binding] : string;
+};
+declare namespace NodeJS {
+	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "ENVIRONMENT" | "FROM_ADDRESS" | "FROM_NAME" | "OTP_TTL_S" | "MAX_VERIFY_ATTEMPTS" | "RL_EMAIL_PER_DAY" | "RL_IP_PER_HOUR" | "RL_GLOBAL_PER_DAY">> {}
+}
+
+// Begin runtime types
+/*! *****************************************************************************
+Copyright (c) Cloudflare. All rights reserved.
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License. You may obtain a copy of the
+License at http://www.apache.org/licenses/LICENSE-2.0
+THIS CODE IS PROVIDED ON AN *AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED
+WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A PARTICULAR PURPOSE,
+MERCHANTABLITY OR NON-INFRINGEMENT.
+See the Apache Version 2.0 License for specific language governing permissions
+and limitations under the License.
+***************************************************************************** */
+/* eslint-disable */
+// noinspection JSUnusedGlobalSymbols
+declare var onmessage: never;
+/**
+ * The **`DOMException`** interface represents an abnormal event (called an exception) that occurs as a result of calling a method or accessing a property of a web API. This is how error conditions are described in web APIs.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/DOMException)
+ */
+declare class DOMException extends Error {
+    constructor(message?: string, name?: string);
+    /**
+     * The **`message`** read-only property of the DOMException interface returns a string representing a message or description associated with the given error name.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/DOMException/message)
+     */
+    readonly message: string;
+    /**
+     * The **`name`** read-only property of the DOMException interface returns a string that contains one of the strings associated with an error name.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/DOMException/name)
+     */
+    readonly name: string;
+    /**
+     * The **`code`** read-only property of the DOMException interface returns one of the legacy error code constants, or 0 if none match.
+     * @deprecated
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/DOMException/code)
+     */
+    readonly code: number;
+    static readonly INDEX_SIZE_ERR: number;
+    static readonly DOMSTRING_SIZE_ERR: number;
+    static readonly HIERARCHY_REQUEST_ERR: number;
+    static readonly WRONG_DOCUMENT_ERR: number;
+    static readonly INVALID_CHARACTER_ERR: number;
+    static readonly NO_DATA_ALLOWED_ERR: number;
+    static readonly NO_MODIFICATION_ALLOWED_ERR: number;
+    static readonly NOT_FOUND_ERR: number;
+    static readonly NOT_SUPPORTED_ERR: number;
+    static readonly INUSE_ATTRIBUTE_ERR: number;
+    static readonly INVALID_STATE_ERR: number;
+    static readonly SYNTAX_ERR: number;
+    static readonly INVALID_MODIFICATION_ERR: number;
+    static readonly NAMESPACE_ERR: number;
+    static readonly INVALID_ACCESS_ERR: number;
+    static readonly VALIDATION_ERR: number;
+    static readonly TYPE_MISMATCH_ERR: number;
+    static readonly SECURITY_ERR: number;
+    static readonly NETWORK_ERR: number;
+    static readonly ABORT_ERR: number;
+    static readonly URL_MISMATCH_ERR: number;
+    static readonly QUOTA_EXCEEDED_ERR: number;
+    static readonly TIMEOUT_ERR: number;
+    static readonly INVALID_NODE_TYPE_ERR: number;
+    static readonly DATA_CLONE_ERR: number;
+    get stack(): any;
+    set stack(value: any);
+}
+type WorkerGlobalScopeEventMap = {
+    fetch: FetchEvent;
+    scheduled: ScheduledEvent;
+    queue: QueueEvent;
+    unhandledrejection: PromiseRejectionEvent;
+    rejectionhandled: PromiseRejectionEvent;
+};
+declare abstract class WorkerGlobalScope extends EventTarget<WorkerGlobalScopeEventMap> {
+    EventTarget: typeof EventTarget;
+}
+/* The **`console`** object provides access to the debugging console (e.g., the Web console in Firefox). *
+ * The **`console`** object provides access to the debugging console (e.g., the Web console in Firefox).
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console)
+ */
+interface Console {
+    "assert"(condition?: boolean, ...data: any[]): void;
+    /**
+     * The **`console.clear()`** static method clears the console if possible.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/clear_static)
+     */
+    clear(): void;
+    /**
+     * The **`console.count()`** static method logs the number of times that this particular call to count() has been called.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/count_static)
+     */
+    count(label?: string): void;
+    /**
+     * The **`console.countReset()`** static method resets counter used with console.count().
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/countReset_static)
+     */
+    countReset(label?: string): void;
+    /**
+     * The **`console.debug()`** static method outputs a message to the console at the "debug" log level. The message is only displayed to the user if the console is configured to display debug output. In most cases, the log level is configured within the console UI. This log level might correspond to the Debug or Verbose log level.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/debug_static)
+     */
+    debug(...data: any[]): void;
+    /**
+     * The **`console.dir()`** static method displays a list of the properties of the specified JavaScript object. In browser consoles, the output is presented as a hierarchical listing with disclosure triangles that let you see the contents of child objects.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/dir_static)
+     */
+    dir(item?: any, options?: any): void;
+    /**
+     * The **`console.dirxml()`** static method displays an interactive tree of the descendant elements of the specified XML/HTML element. If it is not possible to display as an element the JavaScript Object view is shown instead. The output is presented as a hierarchical listing of expandable nodes that let you see the contents of child nodes.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/dirxml_static)
+     */
+    dirxml(...data: any[]): void;
+    /**
+     * The **`console.error()`** static method outputs a message to the console at the "error" log level. The message is only displayed to the user if the console is configured to display error output. In most cases, the log level is configured within the console UI. The message may be formatted as an error, with red colors and call stack information.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/error_static)
+     */
+    error(...data: any[]): void;
+    /**
+     * The **`console.group()`** static method creates a new inline group in the Web console log, causing any subsequent console messages to be indented by an additional level, until console.groupEnd() is called.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/group_static)
+     */
+    group(...data: any[]): void;
+    /**
+     * The **`console.groupCollapsed()`** static method creates a new inline group in the console. Unlike console.group(), however, the new group is created collapsed. The user will need to use the disclosure button next to it to expand it, revealing the entries created in the group.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/groupCollapsed_static)
+     */
+    groupCollapsed(...data: any[]): void;
+    /**
+     * The **`console.groupEnd()`** static method exits the current inline group in the console. See Using groups in the console in the console documentation for details and examples.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/groupEnd_static)
+     */
+    groupEnd(): void;
+    /**
+     * The **`console.info()`** static method outputs a message to the console at the "info" log level. The message is only displayed to the user if the console is configured to display info output. In most cases, the log level is configured within the console UI. The message may receive special formatting, such as a small "i" icon next to it.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/info_static)
+     */
+    info(...data: any[]): void;
+    /**
+     * The **`console.log()`** static method outputs a message to the console.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/log_static)
+     */
+    log(...data: any[]): void;
+    /**
+     * The **`console.table()`** static method displays tabular data as a table.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/table_static)
+     */
+    table(tabularData?: any, properties?: string[]): void;
+    /**
+     * The **`console.time()`** static method starts a timer you can use to track how long an operation takes. You give each timer a unique name, and may have up to 10,000 timers running on a given page. When you call console.timeEnd() with the same name, the browser will output the time, in milliseconds, that elapsed since the timer was started.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/time_static)
+     */
+    time(label?: string): void;
+    /**
+     * The **`console.timeEnd()`** static method stops a timer that was previously started by calling console.time().
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/timeEnd_static)
+     */
+    timeEnd(label?: string): void;
+    /**
+     * The **`console.timeLog()`** static method logs the current value of a timer that was previously started by calling console.time().
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/timeLog_static)
+     */
+    timeLog(label?: string, ...data: any[]): void;
+    /* The **`console.timeStamp()`** static method adds a single marker to the browser's Performance tool (Firefox bug 1387528, Chrome). This lets you correlate a point in your code with the other events recorded in the timeline, such as layout and paint events. */
+    timeStamp(label?: string): void;
+    /**
+     * The **`console.trace()`** static method outputs a stack trace to the console.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/trace_static)
+     */
+    trace(...data: any[]): void;
+    /**
+     * The **`console.warn()`** static method outputs a warning message to the console at the "warning" log level. The message is only displayed to the user if the console is configured to display warning output. In most cases, the log level is configured within the console UI. The message may receive special formatting, such as yellow colors and a warning icon.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/warn_static)
+     */
+    warn(...data: any[]): void;
+}
+declare const console: Console;
+type BufferSource = ArrayBufferView | ArrayBuffer;
+type TypedArray = Int8Array | Uint8Array | Uint8ClampedArray | Int16Array | Uint16Array | Int32Array | Uint32Array | Float32Array | Float64Array | BigInt64Array | BigUint64Array;
+declare namespace WebAssembly {
+    class CompileError extends Error {
+        constructor(message?: string);
+    }
+    class RuntimeError extends Error {
+        constructor(message?: string);
+    }
+    type ValueType = "anyfunc" | "externref" | "f32" | "f64" | "i32" | "i64" | "v128";
+    interface GlobalDescriptor {
+        value: ValueType;
+        mutable?: boolean;
+    }
+    class Global {
+        constructor(descriptor: GlobalDescriptor, value?: any);
+        value: any;
+        valueOf(): any;
+    }
+    type ImportValue = ExportValue | number;
+    type ModuleImports = Record<string, ImportValue>;
+    type Imports = Record<string, ModuleImports>;
+    type ExportValue = Function | Global | Memory | Table;
+    type Exports = Record<string, ExportValue>;
+    class Instance {
+        constructor(module: Module, imports?: Imports);
+        readonly exports: Exports;
+    }
+    interface MemoryDescriptor {
+        initial: number;
+        maximum?: number;
+        shared?: boolean;
+    }
+    class Memory {
+        constructor(descriptor: MemoryDescriptor);
+        readonly buffer: ArrayBuffer;
+        grow(delta: number): number;
+    }
+    type ImportExportKind = "function" | "global" | "memory" | "table";
+    interface ModuleExportDescriptor {
+        kind: ImportExportKind;
+        name: string;
+    }
+    interface ModuleImportDescriptor {
+        kind: ImportExportKind;
+        module: string;
+        name: string;
+    }
+    abstract class Module {
+        static customSections(module: Module, sectionName: string): ArrayBuffer[];
+        static exports(module: Module): ModuleExportDescriptor[];
+        static imports(module: Module): ModuleImportDescriptor[];
+    }
+    type TableKind = "anyfunc" | "externref";
+    interface TableDescriptor {
+        element: TableKind;
+        initial: number;
+        maximum?: number;
+    }
+    class Table {
+        constructor(descriptor: TableDescriptor, value?: any);
+        readonly length: number;
+        get(index: number): any;
+        grow(delta: number, value?: any): number;
+        set(index: number, value?: any): void;
+    }
+    function instantiate(module: Module, imports?: Imports): Promise<Instance>;
+    function validate(bytes: BufferSource): boolean;
+}
+/**
+ * The **`ServiceWorkerGlobalScope`** interface of the Service Worker API represents the global execution context of a service worker.
+ * Available only in secure contexts.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ServiceWorkerGlobalScope)
+ */
+interface ServiceWorkerGlobalScope extends WorkerGlobalScope {
+    DOMException: typeof DOMException;
+    WorkerGlobalScope: typeof WorkerGlobalScope;
+    btoa(data: string): string;
+    atob(data: string): string;
+    setTimeout(callback: (...args: any[]) => void, msDelay?: number): number;
+    setTimeout<Args extends any[]>(callback: (...args: Args) => void, msDelay?: number, ...args: Args): number;
+    clearTimeout(timeoutId: number | null): void;
+    setInterval(callback: (...args: any[]) => void, msDelay?: number): number;
+    setInterval<Args extends any[]>(callback: (...args: Args) => void, msDelay?: number, ...args: Args): number;
+    clearInterval(timeoutId: number | null): void;
+    queueMicrotask(task: Function): void;
+    structuredClone<T>(value: T, options?: StructuredSerializeOptions): T;
+    reportError(error: any): void;
+    fetch(input: RequestInfo | URL, init?: RequestInit<RequestInitCfProperties>): Promise<Response>;
+    self: ServiceWorkerGlobalScope;
+    crypto: Crypto;
+    caches: CacheStorage;
+    scheduler: Scheduler;
+    performance: Performance;
+    Cloudflare: Cloudflare;
+    readonly origin: string;
+    Event: typeof Event;
+    ExtendableEvent: typeof ExtendableEvent;
+    CustomEvent: typeof CustomEvent;
+    PromiseRejectionEvent: typeof PromiseRejectionEvent;
+    FetchEvent: typeof FetchEvent;
+    TailEvent: typeof TailEvent;
+    TraceEvent: typeof TailEvent;
+    ScheduledEvent: typeof ScheduledEvent;
+    MessageEvent: typeof MessageEvent;
+    CloseEvent: typeof CloseEvent;
+    ReadableStreamDefaultReader: typeof ReadableStreamDefaultReader;
+    ReadableStreamBYOBReader: typeof ReadableStreamBYOBReader;
+    ReadableStream: typeof ReadableStream;
+    WritableStream: typeof WritableStream;
+    WritableStreamDefaultWriter: typeof WritableStreamDefaultWriter;
+    TransformStream: typeof TransformStream;
+    ByteLengthQueuingStrategy: typeof ByteLengthQueuingStrategy;
+    CountQueuingStrategy: typeof CountQueuingStrategy;
+    ErrorEvent: typeof ErrorEvent;
+    MessageChannel: typeof MessageChannel;
+    MessagePort: typeof MessagePort;
+    EventSource: typeof EventSource;
+    ReadableStreamBYOBRequest: typeof ReadableStreamBYOBRequest;
+    ReadableStreamDefaultController: typeof ReadableStreamDefaultController;
+    ReadableByteStreamController: typeof ReadableByteStreamController;
+    WritableStreamDefaultController: typeof WritableStreamDefaultController;
+    TransformStreamDefaultController: typeof TransformStreamDefaultController;
+    CompressionStream: typeof CompressionStream;
+    DecompressionStream: typeof DecompressionStream;
+    TextEncoderStream: typeof TextEncoderStream;
+    TextDecoderStream: typeof TextDecoderStream;
+    Headers: typeof Headers;
+    Body: typeof Body;
+    Request: typeof Request;
+    Response: typeof Response;
+    WebSocket: typeof WebSocket;
+    WebSocketPair: typeof WebSocketPair;
+    WebSocketRequestResponsePair: typeof WebSocketRequestResponsePair;
+    AbortController: typeof AbortController;
+    AbortSignal: typeof AbortSignal;
+    TextDecoder: typeof TextDecoder;
+    TextEncoder: typeof TextEncoder;
+    navigator: Navigator;
+    Navigator: typeof Navigator;
+    URL: typeof URL;
+    URLSearchParams: typeof URLSearchParams;
+    URLPattern: typeof URLPattern;
+    Blob: typeof Blob;
+    File: typeof File;
+    FormData: typeof FormData;
+    Crypto: typeof Crypto;
+    SubtleCrypto: typeof SubtleCrypto;
+    CryptoKey: typeof CryptoKey;
+    CacheStorage: typeof CacheStorage;
+    Cache: typeof Cache;
+    FixedLengthStream: typeof FixedLengthStream;
+    IdentityTransformStream: typeof IdentityTransformStream;
+    HTMLRewriter: typeof HTMLRewriter;
+}
+declare function addEventListener<Type extends keyof WorkerGlobalScopeEventMap>(type: Type, handler: EventListenerOrEventListenerObject<WorkerGlobalScopeEventMap[Type]>, options?: EventTargetAddEventListenerOptions | boolean): void;
+declare function removeEventListener<Type extends keyof WorkerGlobalScopeEventMap>(type: Type, handler: EventListenerOrEventListenerObject<WorkerGlobalScopeEventMap[Type]>, options?: EventTargetEventListenerOptions | boolean): void;
+/**
+ * The **`dispatchEvent()`** method of the EventTarget sends an Event to the object, (synchronously) invoking the affected event listeners in the appropriate order. The normal event processing rules (including the capturing and optional bubbling phase) also apply to events dispatched manually with dispatchEvent().
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventTarget/dispatchEvent)
+ */
+declare function dispatchEvent(event: WorkerGlobalScopeEventMap[keyof WorkerGlobalScopeEventMap]): boolean;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/btoa) */
+declare function btoa(data: string): string;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/atob) */
+declare function atob(data: string): string;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/setTimeout) */
+declare function setTimeout(callback: (...args: any[]) => void, msDelay?: number): number;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/setTimeout) */
+declare function setTimeout<Args extends any[]>(callback: (...args: Args) => void, msDelay?: number, ...args: Args): number;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/clearTimeout) */
+declare function clearTimeout(timeoutId: number | null): void;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/setInterval) */
+declare function setInterval(callback: (...args: any[]) => void, msDelay?: number): number;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/setInterval) */
+declare function setInterval<Args extends any[]>(callback: (...args: Args) => void, msDelay?: number, ...args: Args): number;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/clearInterval) */
+declare function clearInterval(timeoutId: number | null): void;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/queueMicrotask) */
+declare function queueMicrotask(task: Function): void;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/structuredClone) */
+declare function structuredClone<T>(value: T, options?: StructuredSerializeOptions): T;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/reportError) */
+declare function reportError(error: any): void;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/fetch) */
+declare function fetch(input: RequestInfo | URL, init?: RequestInit<RequestInitCfProperties>): Promise<Response>;
+declare const self: ServiceWorkerGlobalScope;
+/**
+* The Web Crypto API provides a set of low-level functions for common cryptographic tasks.
+* The Workers runtime implements the full surface of this API, but with some differences in
+* the [supported algorithms](https://developers.cloudflare.com/workers/runtime-apis/web-crypto/#supported-algorithms)
+* compared to those implemented in most browsers.
+*
+* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/web-crypto/)
+*/
+declare const crypto: Crypto;
+/**
+* The Cache API allows fine grained control of reading and writing from the Cloudflare global network cache.
+*
+* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/cache/)
+*/
+declare const caches: CacheStorage;
+/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/scheduler) */
+declare const scheduler: Scheduler;
+/**
+* The Workers runtime supports a subset of the Performance API, used to measure timing and performance,
+* as well as timing of subrequests and other operations.
+*
+* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/performance/)
+*/
+declare const performance: Performance;
+declare const Cloudflare: Cloudflare;
+declare const origin: string;
+declare const navigator: Navigator;
+interface TestController {
+}
+interface ExecutionContext<Props = unknown> {
+    waitUntil(promise: Promise<any>): void;
+    passThroughOnException(): void;
+    readonly exports: Cloudflare.Exports;
+    readonly props: Props;
+    cache?: CacheContext;
+    readonly access?: CloudflareAccessContext;
+    tracing: Tracing;
+    abort(reason?: any): void;
+}
+type ExportedHandlerFetchHandler<Env = unknown, CfHostMetadata = unknown, Props = unknown> = (request: Request<CfHostMetadata, IncomingRequestCfProperties<CfHostMetadata>>, env: Env, ctx: ExecutionContext<Props>) => Response | Promise<Response>;
+type ExportedHandlerConnectHandler<Env = unknown, Props = unknown> = (socket: Socket, env: Env, ctx: ExecutionContext<Props>) => void | Promise<void>;
+type ExportedHandlerTailHandler<Env = unknown, Props = unknown> = (events: TraceItem[], env: Env, ctx: ExecutionContext<Props>) => void | Promise<void>;
+type ExportedHandlerTraceHandler<Env = unknown, Props = unknown> = (traces: TraceItem[], env: Env, ctx: ExecutionContext<Props>) => void | Promise<void>;
+type ExportedHandlerTailStreamHandler<Env = unknown, Props = unknown> = (event: TailStream.TailEvent<TailStream.Onset>, env: Env, ctx: ExecutionContext<Props>) => TailStream.TailEventHandlerType | Promise<TailStream.TailEventHandlerType>;
+type ExportedHandlerScheduledHandler<Env = unknown, Props = unknown> = (controller: ScheduledController, env: Env, ctx: ExecutionContext<Props>) => void | Promise<void>;
+type ExportedHandlerQueueHandler<Env = unknown, Message = unknown, Props = unknown> = (batch: MessageBatch<Message>, env: Env, ctx: ExecutionContext<Props>) => void | Promise<void>;
+type ExportedHandlerTestHandler<Env = unknown, Props = unknown> = (controller: TestController, env: Env, ctx: ExecutionContext<Props>) => void | Promise<void>;
+interface ExportedHandler<Env = unknown, QueueHandlerMessage = unknown, CfHostMetadata = unknown, Props = unknown> {
+    fetch?: ExportedHandlerFetchHandler<Env, CfHostMetadata, Props>;
+    connect?: ExportedHandlerConnectHandler<Env, Props>;
+    tail?: ExportedHandlerTailHandler<Env, Props>;
+    trace?: ExportedHandlerTraceHandler<Env, Props>;
+    tailStream?: ExportedHandlerTailStreamHandler<Env, Props>;
+    scheduled?: ExportedHandlerScheduledHandler<Env, Props>;
+    test?: ExportedHandlerTestHandler<Env, Props>;
+    email?: EmailExportedHandler<Env, Props>;
+    queue?: ExportedHandlerQueueHandler<Env, QueueHandlerMessage, Props>;
+}
+interface StructuredSerializeOptions {
+    transfer?: any[];
+}
+declare abstract class Navigator {
+    sendBeacon(url: string, body?: BodyInit): boolean;
+    readonly userAgent: string;
+    readonly hardwareConcurrency: number;
+    readonly platform: string;
+    readonly language: string;
+    readonly languages: string[];
+}
+interface AlarmInvocationInfo {
+    readonly isRetry: boolean;
+    readonly retryCount: number;
+    readonly scheduledTime: number;
+}
+interface Cloudflare {
+    readonly compatibilityFlags: Record<string, boolean>;
+}
+interface CachePurgeError {
+    code: number;
+    message: string;
+}
+interface CachePurgeResult {
+    success: boolean;
+    errors: CachePurgeError[];
+}
+interface CachePurgeOptions {
+    tags?: string[];
+    pathPrefixes?: string[];
+    purgeEverything?: boolean;
+}
+interface CacheContext {
+    purge(options: CachePurgeOptions): Promise<CachePurgeResult>;
+}
+interface CloudflareAccessContext {
+    readonly aud: string;
+    getIdentity(): Promise<CloudflareAccessIdentity | undefined>;
+}
+declare abstract class ColoLocalActorNamespace {
+    get(actorId: string): Fetcher;
+}
+interface DurableObject {
+    fetch(request: Request): Response | Promise<Response>;
+    connect?(socket: Socket): void | Promise<void>;
+    alarm?(alarmInfo?: AlarmInvocationInfo): void | Promise<void>;
+    webSocketMessage?(ws: WebSocket, message: string | ArrayBuffer): void | Promise<void>;
+    webSocketClose?(ws: WebSocket, code: number, reason: string, wasClean: boolean): void | Promise<void>;
+    webSocketError?(ws: WebSocket, error: unknown): void | Promise<void>;
+}
+type DurableObjectStub<T extends Rpc.DurableObjectBranded | undefined = undefined> = Fetcher<T, "alarm" | "connect" | "webSocketMessage" | "webSocketClose" | "webSocketError"> & {
+    readonly id: DurableObjectId;
+    readonly name?: string;
+};
+interface DurableObjectId {
+    toString(): string;
+    equals(other: DurableObjectId): boolean;
+    readonly name?: string;
+    readonly jurisdiction?: string;
+}
+declare abstract class DurableObjectNamespace<T extends Rpc.DurableObjectBranded | undefined = undefined> {
+    newUniqueId(options?: DurableObjectNamespaceNewUniqueIdOptions): DurableObjectId;
+    idFromName(name: string): DurableObjectId;
+    idFromString(id: string): DurableObjectId;
+    get(id: DurableObjectId, options?: DurableObjectNamespaceGetDurableObjectOptions): DurableObjectStub<T>;
+    getByName(name: string, options?: DurableObjectNamespaceGetDurableObjectOptions): DurableObjectStub<T>;
+    jurisdiction(jurisdiction: DurableObjectJurisdiction): DurableObjectNamespace<T>;
+}
+type DurableObjectJurisdiction = "eu" | "fedramp" | "fedramp-high" | "us";
+interface DurableObjectNamespaceNewUniqueIdOptions {
+    jurisdiction?: DurableObjectJurisdiction;
+}
+type DurableObjectLocationHint = "wnam" | "enam" | "sam" | "weur" | "eeur" | "apac" | "apac-ne" | "apac-se" | "oc" | "afr" | "me";
+type DurableObjectRoutingMode = "primary-only";
+interface DurableObjectNamespaceGetDurableObjectOptions {
+    locationHint?: DurableObjectLocationHint;
+    routingMode?: DurableObjectRoutingMode;
+}
+interface DurableObjectClass<_T extends Rpc.DurableObjectBranded | undefined = undefined> {
+}
+interface DurableObjectState<Props = unknown> {
+    waitUntil(promise: Promise<any>): void;
+    readonly exports: Cloudflare.Exports;
+    readonly props: Props;
+    readonly id: DurableObjectId;
+    readonly storage: DurableObjectStorage;
+    container?: Container;
+    facets: DurableObjectFacets;
+    blockConcurrencyWhile<T>(callback: () => Promise<T>): Promise<T>;
+    acceptWebSocket(ws: WebSocket, tags?: string[]): void;
+    getWebSockets(tag?: string): WebSocket[];
+    setWebSocketAutoResponse(maybeReqResp?: WebSocketRequestResponsePair): void;
+    getWebSocketAutoResponse(): WebSocketRequestResponsePair | null;
+    getWebSocketAutoResponseTimestamp(ws: WebSocket): Date | null;
+    setHibernatableWebSocketEventTimeout(timeoutMs?: number): void;
+    getHibernatableWebSocketEventTimeout(): number | null;
+    getTags(ws: WebSocket): string[];
+    abort(reason?: string, options?: DurableObjectAbortOptions): void;
+}
+interface DurableObjectTransaction {
+    get<T = unknown>(key: string, options?: DurableObjectGetOptions): Promise<T | undefined>;
+    get<T = unknown>(keys: string[], options?: DurableObjectGetOptions): Promise<Map<string, T>>;
+    list<T = unknown>(options?: DurableObjectListOptions): Promise<Map<string, T>>;
+    put<T>(key: string, value: T, options?: DurableObjectPutOptions): Promise<void>;
+    put<T>(entries: Record<string, T>, options?: DurableObjectPutOptions): Promise<void>;
+    delete(key: string, options?: DurableObjectPutOptions): Promise<boolean>;
+    delete(keys: string[], options?: DurableObjectPutOptions): Promise<number>;
+    rollback(): void;
+    getAlarm(options?: DurableObjectGetAlarmOptions): Promise<number | null>;
+    setAlarm(scheduledTime: number | Date, options?: DurableObjectSetAlarmOptions): Promise<void>;
+    deleteAlarm(options?: DurableObjectSetAlarmOptions): Promise<void>;
+}
+interface DurableObjectStorage {
+    get<T = unknown>(key: string, options?: DurableObjectGetOptions): Promise<T | undefined>;
+    get<T = unknown>(keys: string[], options?: DurableObjectGetOptions): Promise<Map<string, T>>;
+    list<T = unknown>(options?: DurableObjectListOptions): Promise<Map<string, T>>;
+    put<T>(key: string, value: T, options?: DurableObjectPutOptions): Promise<void>;
+    put<T>(entries: Record<string, T>, options?: DurableObjectPutOptions): Promise<void>;
+    delete(key: string, options?: DurableObjectPutOptions): Promise<boolean>;
+    delete(keys: string[], options?: DurableObjectPutOptions): Promise<number>;
+    deleteAll(options?: DurableObjectPutOptions): Promise<void>;
+    transaction<T>(closure: (txn: DurableObjectTransaction) => Promise<T>): Promise<T>;
+    getAlarm(options?: DurableObjectGetAlarmOptions): Promise<number | null>;
+    setAlarm(scheduledTime: number | Date, options?: DurableObjectSetAlarmOptions): Promise<void>;
+    deleteAlarm(options?: DurableObjectSetAlarmOptions): Promise<void>;
+    sync(): Promise<void>;
+    sql: SqlStorage;
+    kv: SyncKvStorage;
+    transactionSync<T>(closure: () => T): T;
+    getCurrentBookmark(): Promise<string>;
+    getBookmarkForTime(timestamp: number | Date): Promise<string>;
+    onNextSessionRestoreBookmark(bookmark: string): Promise<string>;
+}
+interface DurableObjectAbortOptions {
+    retryAlarm?: boolean;
+}
+interface DurableObjectListOptions {
+    start?: string;
+    startAfter?: string;
+    end?: string;
+    prefix?: string;
+    reverse?: boolean;
+    limit?: number;
+    allowConcurrency?: boolean;
+    noCache?: boolean;
+}
+interface DurableObjectGetOptions {
+    allowConcurrency?: boolean;
+    noCache?: boolean;
+}
+interface DurableObjectGetAlarmOptions {
+    allowConcurrency?: boolean;
+}
+interface DurableObjectPutOptions {
+    allowConcurrency?: boolean;
+    allowUnconfirmed?: boolean;
+    noCache?: boolean;
+}
+interface DurableObjectSetAlarmOptions {
+    allowConcurrency?: boolean;
+    allowUnconfirmed?: boolean;
+}
+declare class WebSocketRequestResponsePair {
+    constructor(request: string, response: string);
+    get request(): string;
+    get response(): string;
+}
+interface DurableObjectFacets {
+    get<T extends Rpc.DurableObjectBranded | undefined = undefined>(name: string, getStartupOptions: () => FacetStartupOptions<T> | Promise<FacetStartupOptions<T>>): Fetcher<T>;
+    abort(name: string, reason: any): void;
+    delete(name: string): void;
+    clone(src: string, dst: string): void;
+}
+interface FacetStartupOptions<T extends Rpc.DurableObjectBranded | undefined = undefined> {
+    id?: DurableObjectId | string;
+    class: DurableObjectClass<T>;
+}
+interface AnalyticsEngineDataset {
+    writeDataPoint(event?: AnalyticsEngineDataPoint): void;
+}
+interface AnalyticsEngineDataPoint {
+    indexes?: ((ArrayBuffer | string) | null)[];
+    doubles?: number[];
+    blobs?: ((ArrayBuffer | string) | null)[];
+}
+/**
+ * The **`Event`** interface represents an event which takes place on an EventTarget.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event)
+ */
+declare class Event {
+    constructor(type: string, init?: EventInit);
+    /**
+     * The **`type`** read-only property of the Event interface returns a string containing the event's type. It is set when the event is constructed and is the name commonly used to refer to the specific event, such as click, load, or error.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/type)
+     */
+    get type(): string;
+    /**
+     * The **`eventPhase`** read-only property of the Event interface indicates which phase of the event flow is currently being evaluated.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/eventPhase)
+     */
+    get eventPhase(): number;
+    /**
+     * The read-only **`composed`** property of the Event interface returns a boolean value which indicates whether or not the event will propagate across the shadow DOM boundary into the standard DOM.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/composed)
+     */
+    get composed(): boolean;
+    /**
+     * The **`bubbles`** read-only property of the Event interface indicates whether the event bubbles up through the DOM tree or not.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/bubbles)
+     */
+    get bubbles(): boolean;
+    /**
+     * The **`cancelable`** read-only property of the Event interface indicates whether the event can be canceled, and therefore prevented as if the event never happened.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/cancelable)
+     */
+    get cancelable(): boolean;
+    /**
+     * The **`defaultPrevented`** read-only property of the Event interface returns a boolean value indicating whether or not the call to Event.preventDefault() canceled the event.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/defaultPrevented)
+     */
+    get defaultPrevented(): boolean;
+    /**
+     * The Event property **`returnValue`** indicates whether the default action for this event has been prevented or not.
+     * @deprecated
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/returnValue)
+     */
+    get returnValue(): boolean;
+    /**
+     * The **`currentTarget`** read-only property of the Event interface identifies the element to which the event handler has been attached.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/currentTarget)
+     */
+    get currentTarget(): EventTarget | undefined;
+    /**
+     * The read-only **`target`** property of the Event interface is a reference to the object onto which the event was dispatched. It is different from Event.currentTarget when the event handler is called during the bubbling or capturing phase of the event.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/target)
+     */
+    get target(): EventTarget | undefined;
+    /**
+     * The deprecated **`Event.srcElement`** is an alias for the Event.target property. Use Event.target instead.
+     * @deprecated
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/srcElement)
+     */
+    get srcElement(): EventTarget | undefined;
+    /**
+     * The **`timeStamp`** read-only property of the Event interface returns the time (in milliseconds) at which the event was created.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/timeStamp)
+     */
+    get timeStamp(): number;
+    /**
+     * The **`isTrusted`** read-only property of the Event interface is a boolean value that is true when the event was generated by the user agent (including via user actions and programmatic methods such as HTMLElement.focus()), and false when the event was dispatched via EventTarget.dispatchEvent(). The only exception is the click event, which initializes the isTrusted property to false in user agents.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/isTrusted)
+     */
+    get isTrusted(): boolean;
+    /**
+     * The **`cancelBubble`** property of the Event interface is deprecated. Use Event.stopPropagation() instead. Setting its value to true before returning from an event handler prevents propagation of the event. In later implementations, setting this to false does nothing. See Browser compatibility for details.
+     * @deprecated
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/cancelBubble)
+     */
+    get cancelBubble(): boolean;
+    /**
+     * The **`cancelBubble`** property of the Event interface is deprecated. Use Event.stopPropagation() instead. Setting its value to true before returning from an event handler prevents propagation of the event. In later implementations, setting this to false does nothing. See Browser compatibility for details.
+     * @deprecated
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/cancelBubble)
+     */
+    set cancelBubble(value: boolean);
+    /**
+     * The **`stopImmediatePropagation()`** method of the Event interface prevents other listeners of the same event from being called.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/stopImmediatePropagation)
+     */
+    stopImmediatePropagation(): void;
+    /**
+     * The **`preventDefault()`** method of the Event interface tells the user agent that the event is being explicitly handled, so its default action, such as page scrolling, link navigation, or pasting text, should not be taken.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/preventDefault)
+     */
+    preventDefault(): void;
+    /**
+     * The **`stopPropagation()`** method of the Event interface prevents further propagation of the current event in the capturing and bubbling phases. It does not, however, prevent any default behaviors from occurring; for instance, clicks on links are still processed. If you want to stop those behaviors, see the preventDefault() method. It also does not prevent propagation to other event-handlers of the current element. If you want to stop those, see stopImmediatePropagation().
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/stopPropagation)
+     */
+    stopPropagation(): void;
+    /**
+     * The **`composedPath()`** method of the Event interface returns the event's path which is an array of the objects on which listeners will be invoked. This does not include nodes in shadow trees if the shadow root was created with its ShadowRoot.mode closed.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Event/composedPath)
+     */
+    composedPath(): EventTarget[];
+    static readonly NONE: number;
+    static readonly CAPTURING_PHASE: number;
+    static readonly AT_TARGET: number;
+    static readonly BUBBLING_PHASE: number;
+}
+interface EventInit {
+    bubbles?: boolean;
+    cancelable?: boolean;
+    composed?: boolean;
+}
+type EventListener<EventType extends Event = Event> = (event: EventType) => void;
+interface EventListenerObject<EventType extends Event = Event> {
+    handleEvent(event: EventType): void;
+}
+type EventListenerOrEventListenerObject<EventType extends Event = Event> = EventListener<EventType> | EventListenerObject<EventType>;
+/**
+ * The **`EventTarget`** interface is implemented by objects that can receive events and may have listeners for them. In other words, any target of events implements the three methods associated with this interface.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventTarget)
+ */
+declare class EventTarget<EventMap extends Record<string, Event> = Record<string, Event>> {
+    constructor();
+    /**
+     * The **`addEventListener()`** method of the EventTarget interface sets up a function that will be called whenever the specified event is delivered to the target.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventTarget/addEventListener)
+     */
+    addEventListener<Type extends keyof EventMap>(type: Type, handler: EventListenerOrEventListenerObject<EventMap[Type]>, options?: EventTargetAddEventListenerOptions | boolean): void;
+    /**
+     * The **`removeEventListener()`** method of the EventTarget interface removes an event listener previously registered with EventTarget.addEventListener() from the target. The event listener to be removed is identified using a combination of the event type, the event listener function itself, and various optional options that may affect the matching process; see Matching event listeners for removal.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventTarget/removeEventListener)
+     */
+    removeEventListener<Type extends keyof EventMap>(type: Type, handler: EventListenerOrEventListenerObject<EventMap[Type]>, options?: EventTargetEventListenerOptions | boolean): void;
+    /**
+     * The **`dispatchEvent()`** method of the EventTarget sends an Event to the object, (synchronously) invoking the affected event listeners in the appropriate order. The normal event processing rules (including the capturing and optional bubbling phase) also apply to events dispatched manually with dispatchEvent().
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventTarget/dispatchEvent)
+     */
+    dispatchEvent(event: EventMap[keyof EventMap]): boolean;
+}
+interface EventTargetEventListenerOptions {
+    capture?: boolean;
+}
+interface EventTargetAddEventListenerOptions {
+    capture?: boolean;
+    passive?: boolean;
+    once?: boolean;
+    signal?: AbortSignal;
+}
+interface EventTargetHandlerObject {
+    handleEvent: (event: Event) => any | undefined;
+}
+/**
+ * The **`AbortController`** interface represents a controller object that allows you to abort one or more Web requests as and when desired.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortController)
+ */
+declare class AbortController {
+    constructor();
+    /**
+     * The **`signal`** read-only property of the AbortController interface returns an AbortSignal object instance, which can be used to communicate with/abort an asynchronous operation as desired.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortController/signal)
+     */
+    get signal(): AbortSignal;
+    /**
+     * The **`abort()`** method of the AbortController interface aborts an asynchronous operation before it has completed. This is able to abort fetch requests, the consumption of any response bodies, or streams.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortController/abort)
+     */
+    abort(reason?: any): void;
+}
+/**
+ * The **`AbortSignal`** interface represents a signal object that allows you to communicate with an asynchronous operation (such as a fetch request) and abort it if required via an AbortController object.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortSignal)
+ */
+declare abstract class AbortSignal extends EventTarget {
+    /**
+     * The **`AbortSignal.abort()`** static method returns an AbortSignal that is already set as aborted (and which does not trigger an abort event).
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortSignal/abort_static)
+     */
+    static abort(reason?: any): AbortSignal;
+    /**
+     * The **`AbortSignal.timeout()`** static method returns an AbortSignal that will automatically abort after a specified time.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortSignal/timeout_static)
+     */
+    static timeout(delay: number): AbortSignal;
+    /**
+     * The **`AbortSignal.any()`** static method takes an iterable of abort signals and returns an AbortSignal. The returned abort signal is aborted when any of the input iterable abort signals are aborted. The abort reason will be set to the reason of the first signal that is aborted. If any of the given abort signals are already aborted then so will be the returned AbortSignal.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortSignal/any_static)
+     */
+    static any(signals: AbortSignal[]): AbortSignal;
+    /**
+     * The **`aborted`** read-only property returns a value that indicates whether the asynchronous operations the signal is communicating with are aborted (true) or not (false).
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortSignal/aborted)
+     */
+    get aborted(): boolean;
+    /**
+     * The **`reason`** read-only property returns a JavaScript value that indicates the abort reason.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortSignal/reason)
+     */
+    get reason(): any;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortSignal/abort_event) */
+    get onabort(): any | null;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortSignal/abort_event) */
+    set onabort(value: any | null);
+    /**
+     * The **`throwIfAborted()`** method throws the signal's abort reason if the signal has been aborted; otherwise it does nothing.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/AbortSignal/throwIfAborted)
+     */
+    throwIfAborted(): void;
+}
+/**
+ * The **`Scheduler`** interface of the Prioritized Task Scheduling API provides methods for scheduling prioritized tasks.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Scheduler)
+ */
+interface Scheduler {
+    wait(delay: number, maybeOptions?: SchedulerWaitOptions): Promise<void>;
+}
+interface SchedulerWaitOptions {
+    signal?: AbortSignal;
+}
+/**
+ * The **`ExtendableEvent`** interface extends the lifetime of the install and activate events dispatched on the global scope as part of the service worker lifecycle. This ensures that any functional events (like FetchEvent) are not dispatched until it upgrades database schemas and deletes the outdated cache entries.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ExtendableEvent)
+ */
+declare abstract class ExtendableEvent extends Event {
+    /**
+     * The **`ExtendableEvent.waitUntil()`** method tells the event dispatcher that work is ongoing. It can also be used to detect whether that work was successful. In service workers, waitUntil() tells the browser that work is ongoing until the promise settles, and it shouldn't terminate the service worker if it wants that work to complete.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ExtendableEvent/waitUntil)
+     */
+    waitUntil(promise: Promise<any>): void;
+}
+/**
+ * The **`CustomEvent`** interface can be used to attach custom data to an event generated by an application.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CustomEvent)
+ */
+declare class CustomEvent<T = any> extends Event {
+    constructor(type: string, init?: CustomEventCustomEventInit);
+    /**
+     * The read-only **`detail`** property of the CustomEvent interface returns any data passed when initializing the event.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CustomEvent/detail)
+     */
+    get detail(): T;
+}
+interface CustomEventCustomEventInit {
+    bubbles?: boolean;
+    cancelable?: boolean;
+    composed?: boolean;
+    detail?: any;
+}
+/**
+ * The **`Blob`** interface represents a blob, which is a file-like object of immutable, raw data; they can be read as text or binary data, or converted into a ReadableStream so its methods can be used for processing the data.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob)
+ */
+declare class Blob {
+    constructor(bits?: ((ArrayBuffer | ArrayBufferView) | string | Blob)[], options?: BlobOptions);
+    /**
+     * The **`size`** read-only property of the Blob interface returns the size of the Blob or File in bytes.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/size)
+     */
+    get size(): number;
+    /**
+     * The **`type`** read-only property of the Blob interface returns the MIME type of the file.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/type)
+     */
+    get type(): string;
+    /**
+     * The **`slice()`** method of the Blob interface creates and returns a new Blob object which contains data from a subset of the blob on which it's called.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/slice)
+     */
+    slice(start?: number, end?: number, type?: string): Blob;
+    /**
+     * The **`arrayBuffer()`** method of the Blob interface returns a Promise that resolves with the contents of the blob as binary data contained in an ArrayBuffer.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/arrayBuffer)
+     */
+    arrayBuffer(): Promise<ArrayBuffer>;
+    /**
+     * The **`bytes()`** method of the Blob interface returns a Promise that resolves with a Uint8Array containing the contents of the blob as an array of bytes.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/bytes)
+     */
+    bytes(): Promise<Uint8Array>;
+    /**
+     * The **`text()`** method of the Blob interface returns a Promise that resolves with a string containing the contents of the blob, interpreted as UTF-8.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/text)
+     */
+    text(): Promise<string>;
+    /**
+     * The **`stream()`** method of the Blob interface returns a ReadableStream which upon reading returns the data contained within the Blob.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/stream)
+     */
+    stream(): ReadableStream;
+}
+interface BlobOptions {
+    type?: string;
+}
+/**
+ * The **`File`** interface provides information about files and allows JavaScript in a web page to access their content.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/File)
+ */
+declare class File extends Blob {
+    constructor(bits: ((ArrayBuffer | ArrayBufferView) | string | Blob)[] | undefined, name: string, options?: FileOptions);
+    /**
+     * The **`name`** read-only property of the File interface returns the name of the file represented by a File object. For security reasons, the path is excluded from this property.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/File/name)
+     */
+    get name(): string;
+    /**
+     * The **`lastModified`** read-only property of the File interface provides the last modified date of the file as the number of milliseconds since the Unix epoch (January 1, 1970 at midnight). Files without a known last modified date return the current date.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/File/lastModified)
+     */
+    get lastModified(): number;
+}
+interface FileOptions {
+    type?: string;
+    lastModified?: number;
+}
+/**
+* The Cache API allows fine grained control of reading and writing from the Cloudflare global network cache.
+*
+* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/cache/)
+*/
+declare abstract class CacheStorage {
+    /**
+     * The **`open()`** method of the CacheStorage interface returns a Promise that resolves to the Cache object matching the cacheName.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CacheStorage/open)
+     */
+    open(cacheName: string): Promise<Cache>;
+    readonly default: Cache;
+}
+/**
+* The Cache API allows fine grained control of reading and writing from the Cloudflare global network cache.
+*
+* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/cache/)
+*/
+declare abstract class Cache {
+    /* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/cache/#delete) */
+    delete(request: RequestInfo | URL, options?: CacheQueryOptions): Promise<boolean>;
+    /* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/cache/#match) */
+    match(request: RequestInfo | URL, options?: CacheQueryOptions): Promise<Response | undefined>;
+    /* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/cache/#put) */
+    put(request: RequestInfo | URL, response: Response): Promise<void>;
+}
+interface CacheQueryOptions {
+    ignoreMethod?: boolean;
+}
+/**
+* The Web Crypto API provides a set of low-level functions for common cryptographic tasks.
+* The Workers runtime implements the full surface of this API, but with some differences in
+* the [supported algorithms](https://developers.cloudflare.com/workers/runtime-apis/web-crypto/#supported-algorithms)
+* compared to those implemented in most browsers.
+*
+* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/web-crypto/)
+*/
+declare abstract class Crypto {
+    /**
+     * The **`Crypto.subtle`** read-only property returns a SubtleCrypto which can then be used to perform low-level cryptographic operations.
+     * Available only in secure contexts.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Crypto/subtle)
+     */
+    get subtle(): SubtleCrypto;
+    /**
+     * The **`Crypto.getRandomValues()`** method lets you get cryptographically strong random values. The array given as the parameter is filled with random numbers (random in its cryptographic meaning).
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Crypto/getRandomValues)
+     */
+    getRandomValues<T extends Int8Array | Uint8Array | Int16Array | Uint16Array | Int32Array | Uint32Array | BigInt64Array | BigUint64Array>(buffer: T): T;
+    /**
+     * The **`randomUUID()`** method of the Crypto interface is used to generate a v4 UUID using a cryptographically secure random number generator.
+     * Available only in secure contexts.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Crypto/randomUUID)
+     */
+    randomUUID(): string;
+    DigestStream: typeof DigestStream;
+}
+/**
+ * The **`SubtleCrypto`** interface of the Web Crypto API provides a number of low-level cryptographic functions.
+ * Available only in secure contexts.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto)
+ */
+declare abstract class SubtleCrypto {
+    /**
+     * The **`encrypt()`** method of the SubtleCrypto interface encrypts data.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/encrypt)
+     */
+    encrypt(algorithm: string | SubtleCryptoEncryptAlgorithm, key: CryptoKey, plainText: ArrayBuffer | ArrayBufferView): Promise<ArrayBuffer>;
+    /**
+     * The **`decrypt()`** method of the SubtleCrypto interface decrypts some encrypted data. It takes as arguments a key to decrypt with, some optional extra parameters, and the data to decrypt (also known as "ciphertext"). It returns a Promise which will be fulfilled with the decrypted data (also known as "plaintext").
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/decrypt)
+     */
+    decrypt(algorithm: string | SubtleCryptoEncryptAlgorithm, key: CryptoKey, cipherText: ArrayBuffer | ArrayBufferView): Promise<ArrayBuffer>;
+    /**
+     * The **`sign()`** method of the SubtleCrypto interface generates a digital signature.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/sign)
+     */
+    sign(algorithm: string | SubtleCryptoSignAlgorithm, key: CryptoKey, data: ArrayBuffer | ArrayBufferView): Promise<ArrayBuffer>;
+    /**
+     * The **`verify()`** method of the SubtleCrypto interface verifies a digital signature.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/verify)
+     */
+    verify(algorithm: string | SubtleCryptoSignAlgorithm, key: CryptoKey, signature: ArrayBuffer | ArrayBufferView, data: ArrayBuffer | ArrayBufferView): Promise<boolean>;
+    /**
+     * The **`digest()`** method of the SubtleCrypto interface generates a digest of the given data, using the specified hash function. A digest is a short fixed-length value derived from some variable-length input. Cryptographic digests should exhibit collision-resistance, meaning that it's hard to come up with two different inputs that have the same digest value.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/digest)
+     */
+    digest(algorithm: string | SubtleCryptoHashAlgorithm, data: ArrayBuffer | ArrayBufferView): Promise<ArrayBuffer>;
+    /**
+     * The **`generateKey()`** method of the SubtleCrypto interface is used to generate a new key (for symmetric algorithms) or key pair (for public-key algorithms).
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/generateKey)
+     */
+    generateKey(algorithm: string | SubtleCryptoGenerateKeyAlgorithm, extractable: boolean, keyUsages: string[]): Promise<CryptoKey | CryptoKeyPair>;
+    /**
+     * The **`deriveKey()`** method of the SubtleCrypto interface can be used to derive a secret key from a master key.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/deriveKey)
+     */
+    deriveKey(algorithm: string | SubtleCryptoDeriveKeyAlgorithm, baseKey: CryptoKey, derivedKeyAlgorithm: string | SubtleCryptoImportKeyAlgorithm, extractable: boolean, keyUsages: string[]): Promise<CryptoKey>;
+    /**
+     * The **`deriveBits()`** method of the SubtleCrypto interface can be used to derive an array of bits from a base key.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/deriveBits)
+     */
+    deriveBits(algorithm: string | SubtleCryptoDeriveKeyAlgorithm, baseKey: CryptoKey, length?: number | null): Promise<ArrayBuffer>;
+    /**
+     * The **`importKey()`** method of the SubtleCrypto interface imports a key: that is, it takes as input a key in an external, portable format and gives you a CryptoKey object that you can use in the Web Crypto API.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/importKey)
+     */
+    importKey(format: string, keyData: (ArrayBuffer | ArrayBufferView) | JsonWebKey, algorithm: string | SubtleCryptoImportKeyAlgorithm, extractable: boolean, keyUsages: string[]): Promise<CryptoKey>;
+    /**
+     * The **`exportKey()`** method of the SubtleCrypto interface exports a key: that is, it takes as input a CryptoKey object and gives you the key in an external, portable format.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/exportKey)
+     */
+    exportKey(format: string, key: CryptoKey): Promise<ArrayBuffer | JsonWebKey>;
+    /**
+     * The **`wrapKey()`** method of the SubtleCrypto interface "wraps" a key. This means that it exports the key in an external, portable format, then encrypts the exported key. Wrapping a key helps protect it in untrusted environments, such as inside an otherwise unprotected data store or in transmission over an unprotected network.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/wrapKey)
+     */
+    wrapKey(format: string, key: CryptoKey, wrappingKey: CryptoKey, wrapAlgorithm: string | SubtleCryptoEncryptAlgorithm): Promise<ArrayBuffer>;
+    /**
+     * The **`unwrapKey()`** method of the SubtleCrypto interface "unwraps" a key. This means that it takes as its input a key that has been exported and then encrypted (also called "wrapped"). It decrypts the key and then imports it, returning a CryptoKey object that can be used in the Web Crypto API.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/SubtleCrypto/unwrapKey)
+     */
+    unwrapKey(format: string, wrappedKey: ArrayBuffer | ArrayBufferView, unwrappingKey: CryptoKey, unwrapAlgorithm: string | SubtleCryptoEncryptAlgorithm, unwrappedKeyAlgorithm: string | SubtleCryptoImportKeyAlgorithm, extractable: boolean, keyUsages: string[]): Promise<CryptoKey>;
+    timingSafeEqual(a: ArrayBuffer | ArrayBufferView, b: ArrayBuffer | ArrayBufferView): boolean;
+}
+/**
+ * The **`CryptoKey`** interface of the Web Crypto API represents a cryptographic key obtained from one of the SubtleCrypto methods generateKey(), deriveKey(), importKey(), or unwrapKey().
+ * Available only in secure contexts.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CryptoKey)
+ */
+declare abstract class CryptoKey {
+    /**
+     * The read-only **`type`** property of the CryptoKey interface indicates which kind of key is represented by the object. It can have the following values:
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CryptoKey/type)
+     */
+    readonly type: string;
+    /**
+     * The read-only **`extractable`** property of the CryptoKey interface indicates whether or not the key may be extracted using SubtleCrypto.exportKey() or SubtleCrypto.wrapKey().
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CryptoKey/extractable)
+     */
+    readonly extractable: boolean;
+    /**
+     * The read-only **`algorithm`** property of the CryptoKey interface returns an object describing the algorithm for which this key can be used, and any associated extra parameters.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CryptoKey/algorithm)
+     */
+    readonly algorithm: CryptoKeyKeyAlgorithm | CryptoKeyAesKeyAlgorithm | CryptoKeyHmacKeyAlgorithm | CryptoKeyRsaKeyAlgorithm | CryptoKeyEllipticKeyAlgorithm | CryptoKeyArbitraryKeyAlgorithm;
+    /**
+     * The read-only **`usages`** property of the CryptoKey interface indicates what can be done with the key.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CryptoKey/usages)
+     */
+    readonly usages: string[];
+}
+interface CryptoKeyPair {
+    publicKey: CryptoKey;
+    privateKey: CryptoKey;
+}
+interface JsonWebKey {
+    kty: string;
+    use?: string;
+    key_ops?: string[];
+    alg?: string;
+    ext?: boolean;
+    crv?: string;
+    x?: string;
+    y?: string;
+    d?: string;
+    n?: string;
+    e?: string;
+    p?: string;
+    q?: string;
+    dp?: string;
+    dq?: string;
+    qi?: string;
+    oth?: RsaOtherPrimesInfo[];
+    k?: string;
+}
+interface RsaOtherPrimesInfo {
+    r?: string;
+    d?: string;
+    t?: string;
+}
+interface SubtleCryptoDeriveKeyAlgorithm {
+    name: string;
+    salt?: (ArrayBuffer | ArrayBufferView);
+    iterations?: number;
+    hash?: (string | SubtleCryptoHashAlgorithm);
+    $public?: CryptoKey;
+    info?: (ArrayBuffer | ArrayBufferView);
+}
+interface SubtleCryptoEncryptAlgorithm {
+    name: string;
+    iv?: (ArrayBuffer | ArrayBufferView);
+    additionalData?: (ArrayBuffer | ArrayBufferView);
+    tagLength?: number;
+    counter?: (ArrayBuffer | ArrayBufferView);
+    length?: number;
+    label?: (ArrayBuffer | ArrayBufferView);
+}
+interface SubtleCryptoGenerateKeyAlgorithm {
+    name: string;
+    hash?: (string | SubtleCryptoHashAlgorithm);
+    modulusLength?: number;
+    publicExponent?: (ArrayBuffer | ArrayBufferView);
+    length?: number;
+    namedCurve?: string;
+}
+interface SubtleCryptoHashAlgorithm {
+    name: string;
+}
+interface SubtleCryptoImportKeyAlgorithm {
+    name: string;
+    hash?: (string | SubtleCryptoHashAlgorithm);
+    length?: number;
+    namedCurve?: string;
+    compressed?: boolean;
+}
+interface SubtleCryptoSignAlgorithm {
+    name: string;
+    hash?: (string | SubtleCryptoHashAlgorithm);
+    dataLength?: number;
+    saltLength?: number;
+}
+interface CryptoKeyKeyAlgorithm {
+    name: string;
+}
+interface CryptoKeyAesKeyAlgorithm {
+    name: string;
+    length: number;
+}
+interface CryptoKeyHmacKeyAlgorithm {
+    name: string;
+    hash: CryptoKeyKeyAlgorithm;
+    length: number;
+}
+interface CryptoKeyRsaKeyAlgorithm {
+    name: string;
+    modulusLength: number;
+    publicExponent: ArrayBuffer | ArrayBufferView;
+    hash?: CryptoKeyKeyAlgorithm;
+}
+interface CryptoKeyEllipticKeyAlgorithm {
+    name: string;
+    namedCurve: string;
+}
+interface CryptoKeyArbitraryKeyAlgorithm {
+    name: string;
+    hash?: CryptoKeyKeyAlgorithm;
+    namedCurve?: string;
+    length?: number;
+}
+declare class DigestStream extends WritableStream<ArrayBuffer | ArrayBufferView> {
+    constructor(algorithm: string | SubtleCryptoHashAlgorithm, options?: DigestStreamOptions);
+    readonly digest: Promise<ArrayBuffer>;
+    get bytesWritten(): number | bigint;
+}
+interface DigestStreamOptions {
+    toWellFormed?: boolean;
+}
+/**
+ * The **`TextDecoder`** interface represents a decoder for a specific text encoding, such as UTF-8, ISO-8859-2, or GBK. A decoder takes an array of bytes as input and returns a JavaScript string.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TextDecoder)
+ */
+declare class TextDecoder {
+    constructor(label?: string, options?: TextDecoderConstructorOptions);
+    /**
+     * The **`TextDecoder.decode()`** method returns a string containing text decoded from the buffer passed as a parameter.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TextDecoder/decode)
+     */
+    decode(input?: (ArrayBuffer | ArrayBufferView), options?: TextDecoderDecodeOptions): string;
+    get encoding(): string;
+    get fatal(): boolean;
+    get ignoreBOM(): boolean;
+}
+/**
+ * The **`TextEncoder`** interface enables you to encode a JavaScript string using UTF-8.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TextEncoder)
+ */
+declare class TextEncoder {
+    constructor();
+    /**
+     * The **`TextEncoder.encode()`** method takes a string as input, and returns a Uint8Array containing the string encoded using UTF-8.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TextEncoder/encode)
+     */
+    encode(input?: string): Uint8Array;
+    /**
+     * The **`TextEncoder.encodeInto()`** method takes a string to encode and a destination Uint8Array to put resulting UTF-8 encoded text into, and returns an object indicating the progress of the encoding. This is potentially more performant than the encode() method — especially when the target buffer is a view into a Wasm heap.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TextEncoder/encodeInto)
+     */
+    encodeInto(input: string, buffer: Uint8Array): TextEncoderEncodeIntoResult;
+    get encoding(): string;
+}
+interface TextDecoderConstructorOptions {
+    fatal: boolean;
+    ignoreBOM: boolean;
+}
+interface TextDecoderDecodeOptions {
+    stream: boolean;
+}
+interface TextEncoderEncodeIntoResult {
+    read: number;
+    written: number;
+}
+/**
+ * The **`ErrorEvent`** interface represents events providing information related to errors in scripts or in files.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent)
+ */
+declare class ErrorEvent extends Event {
+    constructor(type: string, init?: ErrorEventErrorEventInit);
+    /**
+     * The **`filename`** read-only property of the ErrorEvent interface returns a string containing the name of the script file in which the error occurred.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent/filename)
+     */
+    get filename(): string;
+    /**
+     * The **`message`** read-only property of the ErrorEvent interface returns a string containing a human-readable error message describing the problem.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent/message)
+     */
+    get message(): string;
+    /**
+     * The **`lineno`** read-only property of the ErrorEvent interface returns an integer containing the line number of the script file on which the error occurred.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent/lineno)
+     */
+    get lineno(): number;
+    /**
+     * The **`colno`** read-only property of the ErrorEvent interface returns an integer containing the column number of the script file on which the error occurred.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent/colno)
+     */
+    get colno(): number;
+    /**
+     * The **`error`** read-only property of the ErrorEvent interface returns a JavaScript value, such as an Error or DOMException, representing the error associated with this event.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent/error)
+     */
+    get error(): any;
+}
+interface ErrorEventErrorEventInit {
+    bubbles?: boolean;
+    cancelable?: boolean;
+    composed?: boolean;
+    message?: string;
+    filename?: string;
+    lineno?: number;
+    colno?: number;
+    error?: any;
+}
+/**
+ * The **`MessageEvent`** interface represents a message received by a target object.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent)
+ */
+declare class MessageEvent extends Event {
+    constructor(type: string, initializer?: MessageEventInit);
+    /**
+     * The **`data`** read-only property of the MessageEvent interface represents the data sent by the message emitter.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/data)
+     */
+    readonly data: any;
+    /**
+     * The **`origin`** read-only property of the MessageEvent interface is a string representing the origin of the message emitter.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/origin)
+     */
+    readonly origin: string | null;
+    /**
+     * The **`lastEventId`** read-only property of the MessageEvent interface is a string representing a unique ID for the event.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/lastEventId)
+     */
+    readonly lastEventId: string;
+    /**
+     * The **`source`** read-only property of the MessageEvent interface is a MessageEventSource (which can be a WindowProxy, MessagePort, or ServiceWorker object) representing the message emitter.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/source)
+     */
+    readonly source: MessagePort | null;
+    /**
+     * The **`ports`** read-only property of the MessageEvent interface is an array of MessagePort objects containing all MessagePort objects sent with the message, in order.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/ports)
+     */
+    readonly ports: MessagePort[];
+}
+interface MessageEventInit {
+    bubbles?: boolean;
+    cancelable?: boolean;
+    composed?: boolean;
+    data?: any;
+    origin?: string;
+    lastEventId?: string;
+    source?: MessagePort;
+    ports?: MessagePort[];
+}
+/**
+ * The **`PromiseRejectionEvent`** interface represents events which are sent to the global script context when JavaScript Promises are rejected. These events are particularly useful for telemetry and debugging purposes.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/PromiseRejectionEvent)
+ */
+declare abstract class PromiseRejectionEvent extends Event {
+    /**
+     * The PromiseRejectionEvent interface's **`promise`** read-only property indicates the JavaScript Promise which was rejected. You can examine the event's PromiseRejectionEvent.reason property to learn why the promise was rejected.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/PromiseRejectionEvent/promise)
+     */
+    readonly promise: Promise<any>;
+    /**
+     * The PromiseRejectionEvent **`reason`** read-only property is any JavaScript value or Object which provides the reason passed into Promise.reject(). This in theory provides information about why the promise was rejected.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/PromiseRejectionEvent/reason)
+     */
+    readonly reason: any;
+}
+/**
+ * The **`FormData`** interface provides a way to construct a set of key/value pairs representing form fields and their values, which can be sent using the fetch(), XMLHttpRequest.send() or navigator.sendBeacon() methods. It uses the same format a form would use if the encoding type were set to "multipart/form-data".
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData)
+ */
+declare class FormData {
+    constructor();
+    /**
+     * The **`append()`** method of the FormData interface appends a new value onto an existing key inside a FormData object, or adds the key if it does not already exist.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData/append)
+     */
+    append(name: string, value: string | Blob): void;
+    /**
+     * The **`append()`** method of the FormData interface appends a new value onto an existing key inside a FormData object, or adds the key if it does not already exist.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData/append)
+     */
+    append(name: string, value: string): void;
+    /**
+     * The **`append()`** method of the FormData interface appends a new value onto an existing key inside a FormData object, or adds the key if it does not already exist.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData/append)
+     */
+    append(name: string, value: Blob, filename?: string): void;
+    /**
+     * The **`delete()`** method of the FormData interface deletes a key and its value(s) from a FormData object.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData/delete)
+     */
+    delete(name: string): void;
+    /**
+     * The **`get()`** method of the FormData interface returns the first value associated with a given key from within a FormData object. If you expect multiple values and want all of them, use the getAll() method instead.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData/get)
+     */
+    get(name: string): (File | string) | null;
+    /**
+     * The **`getAll()`** method of the FormData interface returns all the values associated with a given key from within a FormData object.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData/getAll)
+     */
+    getAll(name: string): (File | string)[];
+    /**
+     * The **`has()`** method of the FormData interface returns whether a FormData object contains a certain key.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData/has)
+     */
+    has(name: string): boolean;
+    /**
+     * The **`set()`** method of the FormData interface sets a new value for an existing key inside a FormData object, or adds the key/value if it does not already exist.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData/set)
+     */
+    set(name: string, value: string | Blob): void;
+    /**
+     * The **`set()`** method of the FormData interface sets a new value for an existing key inside a FormData object, or adds the key/value if it does not already exist.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData/set)
+     */
+    set(name: string, value: string): void;
+    /**
+     * The **`set()`** method of the FormData interface sets a new value for an existing key inside a FormData object, or adds the key/value if it does not already exist.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FormData/set)
+     */
+    set(name: string, value: Blob, filename?: string): void;
+    entries(): IterableIterator<[
+        key: string,
+        value: File | string
+    ]>;
+    keys(): IterableIterator<string>;
+    values(): IterableIterator<(File | string)>;
+    forEach<This = unknown>(callback: (this: This, value: File | string, key: string, parent: FormData) => void, thisArg?: This): void;
+    [Symbol.iterator](): IterableIterator<[
+        key: string,
+        value: File | string
+    ]>;
+}
+interface ContentOptions {
+    html?: boolean;
+}
+declare class HTMLRewriter {
+    constructor();
+    on(selector: string, handlers: HTMLRewriterElementContentHandlers): HTMLRewriter;
+    onDocument(handlers: HTMLRewriterDocumentContentHandlers): HTMLRewriter;
+    transform(response: Response): Response;
+}
+interface HTMLRewriterElementContentHandlers {
+    element?(element: Element): void | Promise<void>;
+    comments?(comment: Comment): void | Promise<void>;
+    text?(element: Text): void | Promise<void>;
+}
+interface HTMLRewriterDocumentContentHandlers {
+    doctype?(doctype: Doctype): void | Promise<void>;
+    comments?(comment: Comment): void | Promise<void>;
+    text?(text: Text): void | Promise<void>;
+    end?(end: DocumentEnd): void | Promise<void>;
+}
+interface Doctype {
+    readonly name: string | null;
+    readonly publicId: string | null;
+    readonly systemId: string | null;
+}
+interface Element {
+    tagName: string;
+    readonly attributes: IterableIterator<string[]>;
+    readonly removed: boolean;
+    readonly namespaceURI: string;
+    getAttribute(name: string): string | null;
+    hasAttribute(name: string): boolean;
+    setAttribute(name: string, value: string): Element;
+    removeAttribute(name: string): Element;
+    before(content: string | ReadableStream | Response, options?: ContentOptions): Element;
+    after(content: string | ReadableStream | Response, options?: ContentOptions): Element;
+    prepend(content: string | ReadableStream | Response, options?: ContentOptions): Element;
+    append(content: string | ReadableStream | Response, options?: ContentOptions): Element;
+    replace(content: string | ReadableStream | Response, options?: ContentOptions): Element;
+    remove(): Element;
+    removeAndKeepContent(): Element;
+    setInnerContent(content: string | ReadableStream | Response, options?: ContentOptions): Element;
+    onEndTag(handler: (tag: EndTag) => void | Promise<void>): void;
+}
+interface EndTag {
+    name: string;
+    before(content: string | ReadableStream | Response, options?: ContentOptions): EndTag;
+    after(content: string | ReadableStream | Response, options?: ContentOptions): EndTag;
+    remove(): EndTag;
+}
+interface Comment {
+    text: string;
+    readonly removed: boolean;
+    before(content: string, options?: ContentOptions): Comment;
+    after(content: string, options?: ContentOptions): Comment;
+    replace(content: string, options?: ContentOptions): Comment;
+    remove(): Comment;
+}
+interface Text {
+    readonly text: string;
+    readonly lastInTextNode: boolean;
+    readonly removed: boolean;
+    before(content: string | ReadableStream | Response, options?: ContentOptions): Text;
+    after(content: string | ReadableStream | Response, options?: ContentOptions): Text;
+    replace(content: string | ReadableStream | Response, options?: ContentOptions): Text;
+    remove(): Text;
+}
+interface DocumentEnd {
+    append(content: string, options?: ContentOptions): DocumentEnd;
+}
+/**
+ * This is the event type for fetch events dispatched on the service worker global scope. It contains information about the fetch, including the request and how the receiver will treat the response. It provides the event.respondWith() method, which allows us to provide a response to this fetch.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FetchEvent)
+ */
+declare abstract class FetchEvent extends ExtendableEvent {
+    /**
+     * The **`request`** read-only property of the FetchEvent interface returns the Request that triggered the event handler.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FetchEvent/request)
+     */
+    readonly request: Request;
+    /**
+     * The **`respondWith()`** method of FetchEvent prevents the browser's default fetch handling, and allows you to provide a promise for a Response yourself.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/FetchEvent/respondWith)
+     */
+    respondWith(promise: Response | Promise<Response>): void;
+    passThroughOnException(): void;
+}
+type HeadersInit = Headers | Iterable<Iterable<string>> | Record<string, string>;
+/**
+ * The **`Headers`** interface of the Fetch API allows you to perform various actions on HTTP request and response headers. These actions include retrieving, setting, adding to, and removing headers from the list of the request's headers.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Headers)
+ */
+declare class Headers {
+    constructor(init?: HeadersInit);
+    /**
+     * The **`get()`** method of the Headers interface returns a byte string of all the values of a header within a Headers object with a given name. If the requested header doesn't exist in the Headers object, it returns null.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Headers/get)
+     */
+    get(name: string): string | null;
+    getAll(name: string): string[];
+    /**
+     * The **`getSetCookie()`** method of the Headers interface returns an array containing the values of all Set-Cookie headers associated with a response. This allows Headers objects to handle having multiple Set-Cookie headers, which wasn't possible prior to its implementation.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Headers/getSetCookie)
+     */
+    getSetCookie(): string[];
+    /**
+     * The **`has()`** method of the Headers interface returns a boolean stating whether a Headers object contains a certain header.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Headers/has)
+     */
+    has(name: string): boolean;
+    /**
+     * The **`set()`** method of the Headers interface sets a new value for an existing header inside a Headers object, or adds the header if it does not already exist.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Headers/set)
+     */
+    set(name: string, value: string): void;
+    /**
+     * The **`append()`** method of the Headers interface appends a new value onto an existing header inside a Headers object, or adds the header if it does not already exist.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Headers/append)
+     */
+    append(name: string, value: string): void;
+    /**
+     * The **`delete()`** method of the Headers interface deletes a header from the current Headers object.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Headers/delete)
+     */
+    delete(name: string): void;
+    forEach<This = unknown>(callback: (this: This, value: string, key: string, parent: Headers) => void, thisArg?: This): void;
+    entries(): IterableIterator<[
+        key: string,
+        value: string
+    ]>;
+    keys(): IterableIterator<string>;
+    values(): IterableIterator<string>;
+    [Symbol.iterator](): IterableIterator<[
+        key: string,
+        value: string
+    ]>;
+}
+type BodyInit = ReadableStream<Uint8Array> | string | ArrayBuffer | ArrayBufferView | Blob | URLSearchParams | FormData | Iterable<ArrayBuffer | ArrayBufferView> | AsyncIterable<ArrayBuffer | ArrayBufferView>;
+declare abstract class Body {
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/body) */
+    get body(): ReadableStream | null;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/bodyUsed) */
+    get bodyUsed(): boolean;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/arrayBuffer) */
+    arrayBuffer(): Promise<ArrayBuffer>;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/bytes) */
+    bytes(): Promise<Uint8Array>;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/text) */
+    text(): Promise<string>;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/json) */
+    json<T>(): Promise<T>;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/formData) */
+    formData(): Promise<FormData>;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/blob) */
+    blob(): Promise<Blob>;
+}
+/**
+ * The **`Response`** interface of the Fetch API represents the response to a request.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Response)
+ */
+declare var Response: {
+    prototype: Response;
+    new (body?: BodyInit | null, init?: ResponseInit): Response;
+    error(): Response;
+    redirect(url: string, status?: number): Response;
+    json(any: any, maybeInit?: (ResponseInit | Response)): Response;
+};
+/**
+ * The **`Response`** interface of the Fetch API represents the response to a request.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Response)
+ */
+interface Response extends Body {
+    /**
+     * The **`clone()`** method of the Response interface creates a clone of a response object, identical in every way, but stored in a different variable.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Response/clone)
+     */
+    clone(): Response;
+    /**
+     * The **`status`** read-only property of the Response interface contains the HTTP status codes of the response.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Response/status)
+     */
+    status: number;
+    /**
+     * The **`statusText`** read-only property of the Response interface contains the status message corresponding to the HTTP status code in Response.status.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Response/statusText)
+     */
+    statusText: string;
+    /**
+     * The **`headers`** read-only property of the Response interface contains the Headers object associated with the response.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Response/headers)
+     */
+    headers: Headers;
+    /**
+     * The **`ok`** read-only property of the Response interface contains a Boolean stating whether the response was successful (status in the range 200-299) or not.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Response/ok)
+     */
+    ok: boolean;
+    /**
+     * The **`redirected`** read-only property of the Response interface indicates whether or not the response is the result of a request you made which was redirected.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Response/redirected)
+     */
+    redirected: boolean;
+    /**
+     * The **`url`** read-only property of the Response interface contains the URL of the response. The value of the url property will be the final URL obtained after any redirects.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Response/url)
+     */
+    url: string;
+    webSocket: WebSocket | null;
+    cf: any | undefined;
+    /**
+     * The **`type`** read-only property of the Response interface contains the type of the response. The type determines whether scripts are able to access the response body and headers.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Response/type)
+     */
+    type: "default" | "error";
+}
+interface ResponseInit {
+    status?: number;
+    statusText?: string;
+    headers?: HeadersInit;
+    cf?: any;
+    webSocket?: (WebSocket | null);
+    encodeBody?: "automatic" | "manual";
+}
+type RequestInfo<CfHostMetadata = unknown, Cf = CfProperties<CfHostMetadata>> = Request<CfHostMetadata, Cf> | string;
+/**
+ * The **`Request`** interface of the Fetch API represents a resource request.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request)
+ */
+declare var Request: {
+    prototype: Request;
+    new <CfHostMetadata = unknown, Cf = CfProperties<CfHostMetadata>>(input: RequestInfo<CfProperties> | URL, init?: RequestInit<Cf>): Request<CfHostMetadata, Cf>;
+};
+/**
+ * The **`Request`** interface of the Fetch API represents a resource request.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request)
+ */
+interface Request<CfHostMetadata = unknown, Cf = CfProperties<CfHostMetadata>> extends Body {
+    /**
+     * The **`clone()`** method of the Request interface creates a copy of the current Request object.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/clone)
+     */
+    clone(): Request<CfHostMetadata, Cf>;
+    /**
+     * The **`method`** read-only property of the Request interface contains the request's method (GET, POST, etc.)
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/method)
+     */
+    method: string;
+    /**
+     * The **`url`** read-only property of the Request interface contains the URL of the request.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/url)
+     */
+    url: string;
+    /**
+     * The **`headers`** read-only property of the Request interface contains the Headers object associated with the request.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/headers)
+     */
+    headers: Headers;
+    /**
+     * The **`redirect`** read-only property of the Request interface contains the mode for how redirects are handled.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/redirect)
+     */
+    redirect: string;
+    fetcher: Fetcher | null;
+    /**
+     * The read-only **`signal`** property of the Request interface returns the AbortSignal associated with the request.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/signal)
+     */
+    signal: AbortSignal;
+    cf?: Cf;
+    /**
+     * The **`integrity`** read-only property of the Request interface contains the subresource integrity value of the request.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/integrity)
+     */
+    integrity: string;
+    /**
+     * The **`keepalive`** read-only property of the Request interface contains the request's keepalive setting (true or false), which indicates whether the browser will keep the associated request alive if the page that initiated it is unloaded before the request is complete.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/keepalive)
+     */
+    keepalive: boolean;
+    /**
+     * The **`cache`** read-only property of the Request interface contains the cache mode of the request. It controls how the request will interact with the browser's HTTP cache.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/cache)
+     */
+    cache?: "no-store" | "no-cache";
+}
+interface RequestInit<Cf = CfProperties> {
+    /* A string to set request's method. */
+    method?: string;
+    /* A Headers object, an object literal, or an array of two-item arrays to set request's headers. */
+    headers?: HeadersInit;
+    /* A BodyInit object or null to set request's body. */
+    body?: BodyInit | null;
+    /* A string indicating whether request follows redirects, results in an error upon encountering a redirect, or returns the redirect (in an opaque fashion). Sets request's redirect. */
+    redirect?: string;
+    fetcher?: (Fetcher | null);
+    cf?: Cf;
+    /* A string indicating how the request will interact with the browser's cache to set request's cache. */
+    cache?: "no-store" | "no-cache";
+    /* A cryptographic hash of the resource to be fetched by request. Sets request's integrity. */
+    integrity?: string;
+    /* An AbortSignal to set request's signal. */
+    signal?: (AbortSignal | null);
+    encodeResponseBody?: "automatic" | "manual";
+}
+type Service<T extends (new (...args: any[]) => Rpc.WorkerEntrypointBranded) | Rpc.WorkerEntrypointBranded | ExportedHandler<any, any, any> | undefined = undefined> = T extends new (...args: any[]) => Rpc.WorkerEntrypointBranded ? Fetcher<InstanceType<T>> : T extends Rpc.WorkerEntrypointBranded ? Fetcher<T> : T extends Exclude<Rpc.EntrypointBranded, Rpc.WorkerEntrypointBranded> ? never : Fetcher<undefined>;
+type Fetcher<T extends Rpc.EntrypointBranded | undefined = undefined, Reserved extends string = never> = (T extends Rpc.EntrypointBranded ? Rpc.Provider<T, Reserved | "fetch" | "connect"> : unknown) & {
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    connect(address: SocketAddress | string, options?: SocketOptions): Socket;
+};
+interface KVNamespaceListKey<Metadata, Key extends string = string> {
+    name: Key;
+    expiration?: number;
+    metadata?: Metadata;
+}
+type KVNamespaceListResult<Metadata, Key extends string = string> = {
+    list_complete: false;
+    keys: KVNamespaceListKey<Metadata, Key>[];
+    cursor: string;
+    cacheStatus: string | null;
+} | {
+    list_complete: true;
+    keys: KVNamespaceListKey<Metadata, Key>[];
+    cacheStatus: string | null;
+};
+interface KVNamespace<Key extends string = string> {
+    get(key: Key, options?: Partial<KVNamespaceGetOptions<undefined>>): Promise<string | null>;
+    get(key: Key, type: "text"): Promise<string | null>;
+    get<ExpectedValue = unknown>(key: Key, type: "json"): Promise<ExpectedValue | null>;
+    get(key: Key, type: "arrayBuffer"): Promise<ArrayBuffer | null>;
+    get(key: Key, type: "stream"): Promise<ReadableStream | null>;
+    get(key: Key, options?: KVNamespaceGetOptions<"text">): Promise<string | null>;
+    get<ExpectedValue = unknown>(key: Key, options?: KVNamespaceGetOptions<"json">): Promise<ExpectedValue | null>;
+    get(key: Key, options?: KVNamespaceGetOptions<"arrayBuffer">): Promise<ArrayBuffer | null>;
+    get(key: Key, options?: KVNamespaceGetOptions<"stream">): Promise<ReadableStream | null>;
+    get(key: Array<Key>, type: "text"): Promise<Map<string, string | null>>;
+    get<ExpectedValue = unknown>(key: Array<Key>, type: "json"): Promise<Map<string, ExpectedValue | null>>;
+    get(key: Array<Key>, options?: Partial<KVNamespaceGetOptions<undefined>>): Promise<Map<string, string | null>>;
+    get(key: Array<Key>, options?: KVNamespaceGetOptions<"text">): Promise<Map<string, string | null>>;
+    get<ExpectedValue = unknown>(key: Array<Key>, options?: KVNamespaceGetOptions<"json">): Promise<Map<string, ExpectedValue | null>>;
+    list<Metadata = unknown>(options?: KVNamespaceListOptions): Promise<KVNamespaceListResult<Metadata, Key>>;
+    put(key: Key, value: string | ArrayBuffer | ArrayBufferView | ReadableStream, options?: KVNamespacePutOptions): Promise<void>;
+    getWithMetadata<Metadata = unknown>(key: Key, options?: Partial<KVNamespaceGetOptions<undefined>>): Promise<KVNamespaceGetWithMetadataResult<string, Metadata>>;
+    getWithMetadata<Metadata = unknown>(key: Key, type: "text"): Promise<KVNamespaceGetWithMetadataResult<string, Metadata>>;
+    getWithMetadata<ExpectedValue = unknown, Metadata = unknown>(key: Key, type: "json"): Promise<KVNamespaceGetWithMetadataResult<ExpectedValue, Metadata>>;
+    getWithMetadata<Metadata = unknown>(key: Key, type: "arrayBuffer"): Promise<KVNamespaceGetWithMetadataResult<ArrayBuffer, Metadata>>;
+    getWithMetadata<Metadata = unknown>(key: Key, type: "stream"): Promise<KVNamespaceGetWithMetadataResult<ReadableStream, Metadata>>;
+    getWithMetadata<Metadata = unknown>(key: Key, options: KVNamespaceGetOptions<"text">): Promise<KVNamespaceGetWithMetadataResult<string, Metadata>>;
+    getWithMetadata<ExpectedValue = unknown, Metadata = unknown>(key: Key, options: KVNamespaceGetOptions<"json">): Promise<KVNamespaceGetWithMetadataResult<ExpectedValue, Metadata>>;
+    getWithMetadata<Metadata = unknown>(key: Key, options: KVNamespaceGetOptions<"arrayBuffer">): Promise<KVNamespaceGetWithMetadataResult<ArrayBuffer, Metadata>>;
+    getWithMetadata<Metadata = unknown>(key: Key, options: KVNamespaceGetOptions<"stream">): Promise<KVNamespaceGetWithMetadataResult<ReadableStream, Metadata>>;
+    getWithMetadata<Metadata = unknown>(key: Array<Key>, type: "text"): Promise<Map<string, KVNamespaceGetWithMetadataResult<string, Metadata>>>;
+    getWithMetadata<ExpectedValue = unknown, Metadata = unknown>(key: Array<Key>, type: "json"): Promise<Map<string, KVNamespaceGetWithMetadataResult<ExpectedValue, Metadata>>>;
+    getWithMetadata<Metadata = unknown>(key: Array<Key>, options?: Partial<KVNamespaceGetOptions<undefined>>): Promise<Map<string, KVNamespaceGetWithMetadataResult<string, Metadata>>>;
+    getWithMetadata<Metadata = unknown>(key: Array<Key>, options?: KVNamespaceGetOptions<"text">): Promise<Map<string, KVNamespaceGetWithMetadataResult<string, Metadata>>>;
+    getWithMetadata<ExpectedValue = unknown, Metadata = unknown>(key: Array<Key>, options?: KVNamespaceGetOptions<"json">): Promise<Map<string, KVNamespaceGetWithMetadataResult<ExpectedValue, Metadata>>>;
+    delete(key: Key): Promise<void>;
+}
+interface KVNamespaceListOptions {
+    limit?: number;
+    prefix?: (string | null);
+    cursor?: (string | null);
+}
+interface KVNamespaceGetOptions<Type> {
+    type: Type;
+    cacheTtl?: number;
+}
+interface KVNamespacePutOptions {
+    expiration?: number;
+    expirationTtl?: number;
+    metadata?: (any | null);
+}
+interface KVNamespaceGetWithMetadataResult<Value, Metadata> {
+    value: Value | null;
+    metadata: Metadata | null;
+    cacheStatus: string | null;
+}
+type QueueContentType = "text" | "bytes" | "json" | "v8";
+interface Queue<Body = unknown> {
+    metrics(): Promise<QueueMetrics>;
+    send(message: Body, options?: QueueSendOptions): Promise<QueueSendResponse>;
+    sendBatch(messages: Iterable<MessageSendRequest<Body>>, options?: QueueSendBatchOptions): Promise<QueueSendBatchResponse>;
+}
+interface QueueSendMetrics {
+    backlogCount: number;
+    backlogBytes: number;
+    oldestMessageTimestamp?: Date;
+}
+interface QueueSendMetadata {
+    metrics: QueueSendMetrics;
+}
+interface QueueSendResponse {
+    metadata: QueueSendMetadata;
+}
+interface QueueSendBatchMetrics {
+    backlogCount: number;
+    backlogBytes: number;
+    oldestMessageTimestamp?: Date;
+}
+interface QueueSendBatchMetadata {
+    metrics: QueueSendBatchMetrics;
+}
+interface QueueSendBatchResponse {
+    metadata: QueueSendBatchMetadata;
+}
+interface QueueSendOptions {
+    contentType?: QueueContentType;
+    delaySeconds?: number;
+}
+interface QueueSendBatchOptions {
+    delaySeconds?: number;
+}
+interface MessageSendRequest<Body = unknown> {
+    body: Body;
+    contentType?: QueueContentType;
+    delaySeconds?: number;
+}
+interface QueueMetrics {
+    backlogCount: number;
+    backlogBytes: number;
+    oldestMessageTimestamp?: Date;
+}
+interface MessageBatchMetrics {
+    backlogCount: number;
+    backlogBytes: number;
+    oldestMessageTimestamp?: Date;
+}
+interface MessageBatchMetadata {
+    metrics: MessageBatchMetrics;
+}
+interface QueueRetryOptions {
+    delaySeconds?: number;
+}
+interface Message<Body = unknown> {
+    readonly id: string;
+    readonly timestamp: Date;
+    readonly body: Body;
+    readonly attempts: number;
+    retry(options?: QueueRetryOptions): void;
+    ack(): void;
+}
+interface QueueEvent<Body = unknown> extends ExtendableEvent {
+    readonly messages: readonly Message<Body>[];
+    readonly queue: string;
+    readonly metadata: MessageBatchMetadata;
+    retryAll(options?: QueueRetryOptions): void;
+    ackAll(): void;
+}
+interface MessageBatch<Body = unknown> {
+    readonly messages: readonly Message<Body>[];
+    readonly queue: string;
+    readonly metadata: MessageBatchMetadata;
+    retryAll(options?: QueueRetryOptions): void;
+    ackAll(): void;
+}
+interface R2Error extends Error {
+    readonly name: string;
+    readonly code: number;
+    readonly message: string;
+    readonly action: string;
+    readonly stack: any;
+}
+interface R2ListOptions {
+    limit?: number;
+    prefix?: string;
+    cursor?: string;
+    delimiter?: string;
+    startAfter?: string;
+    include?: ("httpMetadata" | "customMetadata")[];
+}
+interface R2Bucket {
+    head(key: string): Promise<R2Object | null>;
+    get(key: string, options: R2GetOptions & {
+        onlyIf: R2Conditional | Headers;
+    }): Promise<R2ObjectBody | R2Object | null>;
+    get(key: string, options?: R2GetOptions): Promise<R2ObjectBody | null>;
+    put(key: string, value: ReadableStream | ArrayBuffer | ArrayBufferView | string | null | Blob, options?: R2PutOptions & {
+        onlyIf: R2Conditional | Headers;
+    }): Promise<R2Object | null>;
+    put(key: string, value: ReadableStream | ArrayBuffer | ArrayBufferView | string | null | Blob, options?: R2PutOptions): Promise<R2Object>;
+    createMultipartUpload(key: string, options?: R2MultipartOptions): Promise<R2MultipartUpload>;
+    resumeMultipartUpload(key: string, uploadId: string): R2MultipartUpload;
+    delete(keys: string | string[]): Promise<void>;
+    list(options?: R2ListOptions): Promise<R2Objects>;
+}
+interface R2MultipartUpload {
+    readonly key: string;
+    readonly uploadId: string;
+    uploadPart(partNumber: number, value: ReadableStream | (ArrayBuffer | ArrayBufferView) | string | Blob, options?: R2UploadPartOptions): Promise<R2UploadedPart>;
+    abort(): Promise<void>;
+    complete(uploadedParts: R2UploadedPart[]): Promise<R2Object>;
+}
+interface R2UploadedPart {
+    partNumber: number;
+    etag: string;
+}
+declare abstract class R2Object {
+    readonly key: string;
+    readonly version: string;
+    readonly size: number;
+    readonly etag: string;
+    readonly httpEtag: string;
+    readonly checksums: R2Checksums;
+    readonly uploaded: Date;
+    readonly httpMetadata?: R2HTTPMetadata;
+    readonly customMetadata?: Record<string, string>;
+    readonly range?: R2Range;
+    readonly storageClass: string;
+    readonly ssecKeyMd5?: string;
+    writeHttpMetadata(headers: Headers): void;
+}
+interface R2ObjectBody extends R2Object {
+    get body(): ReadableStream;
+    get bodyUsed(): boolean;
+    arrayBuffer(): Promise<ArrayBuffer>;
+    bytes(): Promise<Uint8Array>;
+    text(): Promise<string>;
+    json<T>(): Promise<T>;
+    blob(): Promise<Blob>;
+}
+type R2Range = {
+    offset: number;
+    length?: number;
+} | {
+    offset?: number;
+    length: number;
+} | {
+    suffix: number;
+};
+interface R2Conditional {
+    etagMatches?: string;
+    etagDoesNotMatch?: string;
+    uploadedBefore?: Date;
+    uploadedAfter?: Date;
+    secondsGranularity?: boolean;
+}
+interface R2GetOptions {
+    onlyIf?: (R2Conditional | Headers);
+    range?: (R2Range | Headers);
+    ssecKey?: (ArrayBuffer | string);
+}
+interface R2PutOptions {
+    onlyIf?: (R2Conditional | Headers);
+    httpMetadata?: (R2HTTPMetadata | Headers);
+    customMetadata?: Record<string, string>;
+    md5?: ((ArrayBuffer | ArrayBufferView) | string);
+    sha1?: ((ArrayBuffer | ArrayBufferView) | string);
+    sha256?: ((ArrayBuffer | ArrayBufferView) | string);
+    sha384?: ((ArrayBuffer | ArrayBufferView) | string);
+    sha512?: ((ArrayBuffer | ArrayBufferView) | string);
+    storageClass?: string;
+    ssecKey?: (ArrayBuffer | string);
+}
+interface R2MultipartOptions {
+    httpMetadata?: (R2HTTPMetadata | Headers);
+    customMetadata?: Record<string, string>;
+    storageClass?: string;
+    ssecKey?: (ArrayBuffer | string);
+}
+interface R2Checksums {
+    readonly md5?: ArrayBuffer;
+    readonly sha1?: ArrayBuffer;
+    readonly sha256?: ArrayBuffer;
+    readonly sha384?: ArrayBuffer;
+    readonly sha512?: ArrayBuffer;
+    toJSON(): R2StringChecksums;
+}
+interface R2StringChecksums {
+    md5?: string;
+    sha1?: string;
+    sha256?: string;
+    sha384?: string;
+    sha512?: string;
+}
+interface R2HTTPMetadata {
+    contentType?: string;
+    contentLanguage?: string;
+    contentDisposition?: string;
+    contentEncoding?: string;
+    cacheControl?: string;
+    cacheExpiry?: Date;
+}
+type R2Objects = {
+    objects: R2Object[];
+    delimitedPrefixes: string[];
+} & ({
+    truncated: true;
+    cursor: string;
+} | {
+    truncated: false;
+});
+interface R2UploadPartOptions {
+    ssecKey?: (ArrayBuffer | string);
+}
+declare abstract class ScheduledEvent extends ExtendableEvent {
+    readonly scheduledTime: number;
+    readonly cron: string;
+    noRetry(): void;
+}
+interface ScheduledController {
+    readonly scheduledTime: number;
+    readonly cron: string;
+    noRetry(): void;
+}
+interface QueuingStrategy<T = any> {
+    highWaterMark?: (number | bigint);
+    size?: (chunk: T) => number | bigint;
+}
+interface UnderlyingSink<W = any> {
+    type?: string;
+    start?: (controller: WritableStreamDefaultController) => void | Promise<void>;
+    write?: (chunk: W, controller: WritableStreamDefaultController) => void | Promise<void>;
+    abort?: (reason: any) => void | Promise<void>;
+    close?: () => void | Promise<void>;
+}
+interface UnderlyingByteSource {
+    type: "bytes";
+    autoAllocateChunkSize?: number;
+    start?: (controller: ReadableByteStreamController) => void | Promise<void>;
+    pull?: (controller: ReadableByteStreamController) => void | Promise<void>;
+    cancel?: (reason: any) => void | Promise<void>;
+}
+interface UnderlyingSource<R = any> {
+    type?: "" | undefined;
+    start?: (controller: ReadableStreamDefaultController<R>) => void | Promise<void>;
+    pull?: (controller: ReadableStreamDefaultController<R>) => void | Promise<void>;
+    cancel?: (reason: any) => void | Promise<void>;
+    expectedLength?: (number | bigint);
+}
+interface Transformer<I = any, O = any> {
+    readableType?: string;
+    writableType?: string;
+    start?: (controller: TransformStreamDefaultController<O>) => void | Promise<void>;
+    transform?: (chunk: I, controller: TransformStreamDefaultController<O>) => void | Promise<void>;
+    flush?: (controller: TransformStreamDefaultController<O>) => void | Promise<void>;
+    cancel?: (reason: any) => void | Promise<void>;
+    expectedLength?: number;
+}
+interface StreamPipeOptions {
+    preventAbort?: boolean;
+    preventCancel?: boolean;
+    /**
+     * Pipes this readable stream to a given writable stream destination. The way in which the piping process behaves under various error conditions can be customized with a number of passed options. It returns a promise that fulfills when the piping process completes successfully, or rejects if any errors were encountered.
+     *
+     * Piping a stream will lock it for the duration of the pipe, preventing any other consumer from acquiring a reader.
+     *
+     * Errors and closures of the source and destination streams propagate as follows:
+     *
+     * An error in this source readable stream will abort destination, unless preventAbort is truthy. The returned promise will be rejected with the source's error, or with any error that occurs during aborting the destination.
+     *
+     * An error in destination will cancel this source readable stream, unless preventCancel is truthy. The returned promise will be rejected with the destination's error, or with any error that occurs during canceling the source.
+     *
+     * When this source readable stream closes, destination will be closed, unless preventClose is truthy. The returned promise will be fulfilled once this process completes, unless an error is encountered while closing the destination, in which case it will be rejected with that error.
+     *
+     * If destination starts out closed or closing, this source readable stream will be canceled, unless preventCancel is true. The returned promise will be rejected with an error indicating piping to a closed stream failed, or with any error that occurs during canceling the source.
+     *
+     * The signal option can be set to an AbortSignal to allow aborting an ongoing pipe operation via the corresponding AbortController. In this case, this source readable stream will be canceled, and destination aborted, unless the respective options preventCancel or preventAbort are set.
+     */
+    preventClose?: boolean;
+    signal?: AbortSignal;
+}
+type ReadableStreamReadResult<R = any> = {
+    done: false;
+    value: R;
+} | {
+    done: true;
+    value?: undefined;
+};
+/**
+ * The **`ReadableStream`** interface of the Streams API represents a readable stream of byte data. The Fetch API offers a concrete instance of a ReadableStream through the body property of a Response object.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStream)
+ */
+interface ReadableStream<R = any> {
+    /**
+     * The **`locked`** read-only property of the ReadableStream interface returns whether or not the readable stream is locked to a reader.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStream/locked)
+     */
+    get locked(): boolean;
+    /**
+     * The **`cancel()`** method of the ReadableStream interface returns a Promise that resolves when the stream is canceled.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStream/cancel)
+     */
+    cancel(reason?: any): Promise<void>;
+    /**
+     * The **`getReader()`** method of the ReadableStream interface creates a reader and locks the stream to it. While the stream is locked, no other reader can be acquired until this one is released.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStream/getReader)
+     */
+    getReader(): ReadableStreamDefaultReader<R>;
+    /**
+     * The **`getReader()`** method of the ReadableStream interface creates a reader and locks the stream to it. While the stream is locked, no other reader can be acquired until this one is released.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStream/getReader)
+     */
+    getReader(options: ReadableStreamGetReaderOptions): ReadableStreamBYOBReader;
+    /**
+     * The **`pipeThrough()`** method of the ReadableStream interface provides a chainable way of piping the current stream through a transform stream or any other writable/readable pair.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStream/pipeThrough)
+     */
+    pipeThrough<T>(transform: ReadableWritablePair<T, R>, options?: StreamPipeOptions): ReadableStream<T>;
+    /**
+     * The **`pipeTo()`** method of the ReadableStream interface pipes the current ReadableStream to a given WritableStream and returns a Promise that fulfills when the piping process completes successfully, or rejects if any errors were encountered.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStream/pipeTo)
+     */
+    pipeTo(destination: WritableStream<R>, options?: StreamPipeOptions): Promise<void>;
+    /**
+     * The **`tee()`** method of the ReadableStream interface tees the current readable stream, returning a two-element array containing the two resulting branches as new ReadableStream instances.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStream/tee)
+     */
+    tee(): [
+        ReadableStream<R>,
+        ReadableStream<R>
+    ];
+    values(options?: ReadableStreamValuesOptions): AsyncIterableIterator<R>;
+    [Symbol.asyncIterator](options?: ReadableStreamValuesOptions): AsyncIterableIterator<R>;
+}
+/**
+ * The **`ReadableStream`** interface of the Streams API represents a readable stream of byte data. The Fetch API offers a concrete instance of a ReadableStream through the body property of a Response object.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStream)
+ */
+declare const ReadableStream: {
+    prototype: ReadableStream;
+    new (underlyingSource: UnderlyingByteSource, strategy?: QueuingStrategy<Uint8Array>): ReadableStream<Uint8Array>;
+    new <R = any>(underlyingSource?: UnderlyingSource<R>, strategy?: QueuingStrategy<R>): ReadableStream<R>;
+};
+/**
+ * The **`ReadableStreamDefaultReader`** interface of the Streams API represents a default reader that can be used to read stream data supplied from a network (such as a fetch request).
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamDefaultReader)
+ */
+declare class ReadableStreamDefaultReader<R = any> {
+    constructor(stream: ReadableStream);
+    get closed(): Promise<void>;
+    cancel(reason?: any): Promise<void>;
+    /**
+     * The **`read()`** method of the ReadableStreamDefaultReader interface returns a Promise providing access to the next chunk in the stream's internal queue.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamDefaultReader/read)
+     */
+    read(): Promise<ReadableStreamReadResult<R>>;
+    /**
+     * The **`releaseLock()`** method of the ReadableStreamDefaultReader interface releases the reader's lock on the stream.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamDefaultReader/releaseLock)
+     */
+    releaseLock(): void;
+}
+/**
+ * The **`ReadableStreamBYOBReader`** interface of the Streams API defines a reader for a ReadableStream that supports zero-copy reading from an underlying byte source. It is used for efficient copying from underlying sources where the data is delivered as an "anonymous" sequence of bytes, such as files.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamBYOBReader)
+ */
+declare class ReadableStreamBYOBReader {
+    constructor(stream: ReadableStream);
+    get closed(): Promise<void>;
+    cancel(reason?: any): Promise<void>;
+    /**
+     * The **`read()`** method of the ReadableStreamBYOBReader interface is used to read data into a view on a user-supplied buffer from an associated readable byte stream. A request for data will be satisfied from the stream's internal queues if there is any data present. If the stream queues are empty, the request may be supplied as a zero-copy transfer from the underlying byte source.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamBYOBReader/read)
+     */
+    read<T extends ArrayBufferView>(view: T): Promise<ReadableStreamReadResult<T>>;
+    /**
+     * The **`releaseLock()`** method of the ReadableStreamBYOBReader interface releases the reader's lock on the stream. After the lock is released, the reader is no longer active.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamBYOBReader/releaseLock)
+     */
+    releaseLock(): void;
+    readAtLeast<T extends ArrayBufferView>(minElements: number, view: T): Promise<ReadableStreamReadResult<T>>;
+}
+interface ReadableStreamBYOBReaderReadableStreamBYOBReaderReadOptions {
+    min?: number;
+}
+interface ReadableStreamGetReaderOptions {
+    /**
+     * Creates a ReadableStreamBYOBReader and locks the stream to the new reader.
+     *
+     * This call behaves the same way as the no-argument variant, except that it only works on readable byte streams, i.e. streams which were constructed specifically with the ability to handle "bring your own buffer" reading. The returned BYOB reader provides the ability to directly read individual chunks from the stream via its read() method, into developer-supplied buffers, allowing more precise control over allocation.
+     */
+    mode: "byob";
+}
+/**
+ * The **`ReadableStreamBYOBRequest`** interface of the Streams API represents a "pull request" for data from an underlying source that will made as a zero-copy transfer to a consumer (bypassing the stream's internal queues).
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamBYOBRequest)
+ */
+declare abstract class ReadableStreamBYOBRequest {
+    /**
+     * The **`view`** getter property of the ReadableStreamBYOBRequest interface returns the current view.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamBYOBRequest/view)
+     */
+    get view(): Uint8Array | null;
+    /**
+     * The **`respond()`** method of the ReadableStreamBYOBRequest interface is used to signal to the associated readable byte stream that the specified number of bytes were written into the ReadableStreamBYOBRequest.view.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamBYOBRequest/respond)
+     */
+    respond(bytesWritten: number): void;
+    /**
+     * The **`respondWithNewView()`** method of the ReadableStreamBYOBRequest interface specifies a new view that the consumer of the associated readable byte stream should write to instead of ReadableStreamBYOBRequest.view.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamBYOBRequest/respondWithNewView)
+     */
+    respondWithNewView(view: ArrayBuffer | ArrayBufferView): void;
+    get atLeast(): number | null;
+}
+/**
+ * The **`ReadableStreamDefaultController`** interface of the Streams API represents a controller allowing control of a ReadableStream's state and internal queue. Default controllers are for streams that are not byte streams.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamDefaultController)
+ */
+declare abstract class ReadableStreamDefaultController<R = any> {
+    /**
+     * The **`desiredSize`** read-only property of the ReadableStreamDefaultController interface returns the desired size required to fill the stream's internal queue.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamDefaultController/desiredSize)
+     */
+    get desiredSize(): number | null;
+    /**
+     * The **`close()`** method of the ReadableStreamDefaultController interface closes the associated stream.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamDefaultController/close)
+     */
+    close(): void;
+    /**
+     * The **`enqueue()`** method of the ReadableStreamDefaultController interface enqueues a given chunk in the associated stream.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamDefaultController/enqueue)
+     */
+    enqueue(chunk?: R): void;
+    /**
+     * The **`error()`** method of the ReadableStreamDefaultController interface causes any future interactions with the associated stream to error.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableStreamDefaultController/error)
+     */
+    error(reason: any): void;
+}
+/**
+ * The **`ReadableByteStreamController`** interface of the Streams API represents a controller for a readable byte stream. It allows control of the state and internal queue of a ReadableStream with an underlying byte source, and enables efficient zero-copy transfer of data from the underlying source to a consumer when the stream's internal queue is empty.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableByteStreamController)
+ */
+declare abstract class ReadableByteStreamController {
+    /**
+     * The **`byobRequest`** read-only property of the ReadableByteStreamController interface returns the current BYOB request, or null if there are no pending requests.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableByteStreamController/byobRequest)
+     */
+    get byobRequest(): ReadableStreamBYOBRequest | null;
+    /**
+     * The **`desiredSize`** read-only property of the ReadableByteStreamController interface returns the number of bytes required to fill the stream's internal queue to its "desired size".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableByteStreamController/desiredSize)
+     */
+    get desiredSize(): number | null;
+    /**
+     * The **`close()`** method of the ReadableByteStreamController interface closes the associated stream.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableByteStreamController/close)
+     */
+    close(): void;
+    /**
+     * The **`enqueue()`** method of the ReadableByteStreamController interface enqueues a given chunk on the associated readable byte stream (the chunk is transferred into the stream's internal queues).
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableByteStreamController/enqueue)
+     */
+    enqueue(chunk: ArrayBuffer | ArrayBufferView): void;
+    /**
+     * The **`error()`** method of the ReadableByteStreamController interface causes any future interactions with the associated stream to error with the specified reason.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ReadableByteStreamController/error)
+     */
+    error(reason: any): void;
+}
+/**
+ * The **`WritableStreamDefaultController`** interface of the Streams API represents a controller allowing control of a WritableStream's state. When constructing a WritableStream, the underlying sink is given a corresponding WritableStreamDefaultController instance to manipulate.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultController)
+ */
+declare abstract class WritableStreamDefaultController {
+    /**
+     * The read-only **`signal`** property of the WritableStreamDefaultController interface returns the AbortSignal associated with the controller.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultController/signal)
+     */
+    get signal(): AbortSignal;
+    /**
+     * The **`error()`** method of the WritableStreamDefaultController interface causes any future interactions with the associated stream to error.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultController/error)
+     */
+    error(reason?: any): void;
+}
+/**
+ * The **`TransformStreamDefaultController`** interface of the Streams API provides methods to manipulate the associated ReadableStream and WritableStream.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TransformStreamDefaultController)
+ */
+declare abstract class TransformStreamDefaultController<O = any> {
+    /**
+     * The **`desiredSize`** read-only property of the TransformStreamDefaultController interface returns the desired size to fill the queue of the associated ReadableStream.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TransformStreamDefaultController/desiredSize)
+     */
+    get desiredSize(): number | null;
+    /**
+     * The **`enqueue()`** method of the TransformStreamDefaultController interface enqueues the given chunk in the readable side of the stream.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TransformStreamDefaultController/enqueue)
+     */
+    enqueue(chunk?: O): void;
+    /**
+     * The **`error()`** method of the TransformStreamDefaultController interface errors both sides of the stream. Any further interactions with it will fail with the given error message, and any chunks in the queue will be discarded.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TransformStreamDefaultController/error)
+     */
+    error(reason: any): void;
+    /**
+     * The **`terminate()`** method of the TransformStreamDefaultController interface closes the readable side and errors the writable side of the stream.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TransformStreamDefaultController/terminate)
+     */
+    terminate(): void;
+}
+interface ReadableWritablePair<R = any, W = any> {
+    readable: ReadableStream<R>;
+    /**
+     * Provides a convenient, chainable way of piping this readable stream through a transform stream (or any other { writable, readable } pair). It simply pipes the stream into the writable side of the supplied pair, and returns the readable side for further use.
+     *
+     * Piping a stream will lock it for the duration of the pipe, preventing any other consumer from acquiring a reader.
+     */
+    writable: WritableStream<W>;
+}
+/**
+ * The **`WritableStream`** interface of the Streams API provides a standard abstraction for writing streaming data to a destination, known as a sink. This object comes with built-in backpressure and queuing.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStream)
+ */
+declare class WritableStream<W = any> {
+    constructor(underlyingSink?: UnderlyingSink, queuingStrategy?: QueuingStrategy);
+    /**
+     * The **`locked`** read-only property of the WritableStream interface returns a boolean indicating whether the WritableStream is locked to a writer.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStream/locked)
+     */
+    get locked(): boolean;
+    /**
+     * The **`abort()`** method of the WritableStream interface aborts the stream, signaling that the producer can no longer successfully write to the stream and it is to be immediately moved to an error state, with any queued writes discarded.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStream/abort)
+     */
+    abort(reason?: any): Promise<void>;
+    /**
+     * The **`close()`** method of the WritableStream interface closes the associated stream. All chunks written before this method is called are sent before the returned promise is fulfilled.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStream/close)
+     */
+    close(): Promise<void>;
+    /**
+     * The **`getWriter()`** method of the WritableStream interface returns a new instance of WritableStreamDefaultWriter and locks the stream to that instance. While the stream is locked, no other writer can be acquired until this one is released.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStream/getWriter)
+     */
+    getWriter(): WritableStreamDefaultWriter<W>;
+}
+/**
+ * The **`WritableStreamDefaultWriter`** interface of the Streams API is the object returned by WritableStream.getWriter() and once created locks the writer to the WritableStream ensuring that no other streams can write to the underlying sink.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultWriter)
+ */
+declare class WritableStreamDefaultWriter<W = any> {
+    constructor(stream: WritableStream);
+    /**
+     * The **`closed`** read-only property of the WritableStreamDefaultWriter interface returns a Promise that fulfills if the stream becomes closed, or rejects if the stream errors or the writer's lock is released.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultWriter/closed)
+     */
+    get closed(): Promise<void>;
+    /**
+     * The **`ready`** read-only property of the WritableStreamDefaultWriter interface returns a Promise that resolves when the desired size of the stream's internal queue transitions from non-positive to positive, signaling that it is no longer applying backpressure.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultWriter/ready)
+     */
+    get ready(): Promise<void>;
+    /**
+     * The **`desiredSize`** read-only property of the WritableStreamDefaultWriter interface returns the desired size required to fill the stream's internal queue.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultWriter/desiredSize)
+     */
+    get desiredSize(): number | null;
+    /**
+     * The **`abort()`** method of the WritableStreamDefaultWriter interface aborts the stream, signaling that the producer can no longer successfully write to the stream and it is to be immediately moved to an error state, with any queued writes discarded.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultWriter/abort)
+     */
+    abort(reason?: any): Promise<void>;
+    /**
+     * The **`close()`** method of the WritableStreamDefaultWriter interface closes the associated writable stream.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultWriter/close)
+     */
+    close(): Promise<void>;
+    /**
+     * The **`write()`** method of the WritableStreamDefaultWriter interface writes a passed chunk of data to a WritableStream and its underlying sink, then returns a Promise that resolves to indicate the success or failure of the write operation.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultWriter/write)
+     */
+    write(chunk?: W): Promise<void>;
+    /**
+     * The **`releaseLock()`** method of the WritableStreamDefaultWriter interface releases the writer's lock on the corresponding stream. After the lock is released, the writer is no longer active. If the associated stream is errored when the lock is released, the writer will appear errored in the same way from now on; otherwise, the writer will appear closed.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultWriter/releaseLock)
+     */
+    releaseLock(): void;
+}
+/**
+ * The **`TransformStream`** interface of the Streams API represents a concrete implementation of the pipe chain transform stream concept.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TransformStream)
+ */
+declare class TransformStream<I = any, O = any> {
+    constructor(transformer?: Transformer<I, O>, writableStrategy?: QueuingStrategy<I>, readableStrategy?: QueuingStrategy<O>);
+    /**
+     * The **`readable`** read-only property of the TransformStream interface returns the ReadableStream instance controlled by this TransformStream. This stream emits the transformed output data.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TransformStream/readable)
+     */
+    get readable(): ReadableStream<O>;
+    /**
+     * The **`writable`** read-only property of the TransformStream interface returns the WritableStream instance controlled by this TransformStream. This stream accepts input data that will be transformed and emitted to the readable stream.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TransformStream/writable)
+     */
+    get writable(): WritableStream<I>;
+}
+declare class FixedLengthStream extends IdentityTransformStream {
+    constructor(expectedLength: number | bigint, queuingStrategy?: IdentityTransformStreamQueuingStrategy);
+}
+declare class IdentityTransformStream extends TransformStream<ArrayBuffer | ArrayBufferView, Uint8Array> {
+    constructor(queuingStrategy?: IdentityTransformStreamQueuingStrategy);
+}
+interface IdentityTransformStreamQueuingStrategy {
+    highWaterMark?: (number | bigint);
+}
+interface ReadableStreamValuesOptions {
+    preventCancel?: boolean;
+}
+/**
+ * The **`CompressionStream`** interface of the Compression Streams API compresses a stream of data. It implements the same shape as a TransformStream, allowing it to be used in ReadableStream.pipeThrough() and similar methods.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CompressionStream)
+ */
+declare class CompressionStream extends TransformStream<ArrayBuffer | ArrayBufferView, Uint8Array> {
+    constructor(format: "gzip" | "deflate" | "deflate-raw");
+}
+/**
+ * The **`DecompressionStream`** interface of the Compression Streams API decompresses a stream of data. It implements the same shape as a TransformStream, allowing it to be used in ReadableStream.pipeThrough() and similar methods.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/DecompressionStream)
+ */
+declare class DecompressionStream extends TransformStream<ArrayBuffer | ArrayBufferView, Uint8Array> {
+    constructor(format: "gzip" | "deflate" | "deflate-raw");
+}
+/**
+ * The **`TextEncoderStream`** interface of the Encoding API converts a stream of strings into bytes in the UTF-8 encoding. It is the streaming equivalent of TextEncoder. It implements the same shape as a TransformStream, allowing it to be used in ReadableStream.pipeThrough() and similar methods.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TextEncoderStream)
+ */
+declare class TextEncoderStream extends TransformStream<string, Uint8Array> {
+    constructor();
+    get encoding(): string;
+}
+/**
+ * The **`TextDecoderStream`** interface of the Encoding API converts a stream of text in a binary encoding, such as UTF-8 etc., to a stream of strings. It is the streaming equivalent of TextDecoder. It implements the same shape as a TransformStream, allowing it to be used in ReadableStream.pipeThrough() and similar methods.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/TextDecoderStream)
+ */
+declare class TextDecoderStream extends TransformStream<ArrayBuffer | ArrayBufferView, string> {
+    constructor(label?: string, options?: TextDecoderStreamTextDecoderStreamInit);
+    get encoding(): string;
+    get fatal(): boolean;
+    get ignoreBOM(): boolean;
+}
+interface TextDecoderStreamTextDecoderStreamInit {
+    fatal?: boolean;
+    ignoreBOM?: boolean;
+}
+/**
+ * The **`ByteLengthQueuingStrategy`** interface of the Streams API provides a built-in byte length queuing strategy that can be used when constructing streams.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ByteLengthQueuingStrategy)
+ */
+declare class ByteLengthQueuingStrategy implements QueuingStrategy<ArrayBufferView> {
+    constructor(init: QueuingStrategyInit);
+    /**
+     * The read-only **`ByteLengthQueuingStrategy.highWaterMark`** property returns the total number of bytes that can be contained in the internal queue before backpressure is applied.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ByteLengthQueuingStrategy/highWaterMark)
+     */
+    get highWaterMark(): number;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/ByteLengthQueuingStrategy/size) */
+    get size(): (chunk?: any) => number;
+}
+/**
+ * The **`CountQueuingStrategy`** interface of the Streams API provides a built-in chunk counting queuing strategy that can be used when constructing streams.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CountQueuingStrategy)
+ */
+declare class CountQueuingStrategy implements QueuingStrategy {
+    constructor(init: QueuingStrategyInit);
+    /**
+     * The read-only **`CountQueuingStrategy.highWaterMark`** property returns the total number of chunks that can be contained in the internal queue before backpressure is applied.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CountQueuingStrategy/highWaterMark)
+     */
+    get highWaterMark(): number;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/CountQueuingStrategy/size) */
+    get size(): (chunk?: any) => number;
+}
+interface QueuingStrategyInit {
+    /**
+     * Creates a new ByteLengthQueuingStrategy with the provided high water mark.
+     *
+     * Note that the provided high water mark will not be validated ahead of time. Instead, if it is negative, NaN, or not a number, the resulting ByteLengthQueuingStrategy will cause the corresponding stream constructor to throw.
+     */
+    highWaterMark: number;
+}
+interface TracePreviewInfo {
+    id: string;
+    slug: string;
+    name: string;
+}
+interface ScriptVersion {
+    id?: string;
+    tag?: string;
+    message?: string;
+}
+declare abstract class TailEvent extends ExtendableEvent {
+    readonly events: TraceItem[];
+    readonly traces: TraceItem[];
+}
+interface TraceItem {
+    readonly event: (TraceItemFetchEventInfo | TraceItemJsRpcEventInfo | TraceItemConnectEventInfo | TraceItemScheduledEventInfo | TraceItemAlarmEventInfo | TraceItemQueueEventInfo | TraceItemEmailEventInfo | TraceItemTailEventInfo | TraceItemCustomEventInfo | TraceItemHibernatableWebSocketEventInfo) | null;
+    readonly eventTimestamp: number | null;
+    readonly logs: TraceLog[];
+    readonly exceptions: TraceException[];
+    readonly diagnosticsChannelEvents: TraceDiagnosticChannelEvent[];
+    readonly scriptName: string | null;
+    readonly entrypoint?: string;
+    readonly scriptVersion?: ScriptVersion;
+    readonly dispatchNamespace?: string;
+    readonly scriptTags?: string[];
+    readonly tailAttributes?: Record<string, boolean | number | string>;
+    readonly preview?: TracePreviewInfo;
+    readonly durableObjectId?: string;
+    readonly outcome: string;
+    readonly executionModel: string;
+    readonly truncated: boolean;
+    readonly cpuTime: number;
+    readonly wallTime: number;
+}
+interface TraceItemAlarmEventInfo {
+    readonly scheduledTime: Date;
+}
+interface TraceItemConnectEventInfo {
+}
+interface TraceItemCustomEventInfo {
+}
+interface TraceItemScheduledEventInfo {
+    readonly scheduledTime: number;
+    readonly cron: string;
+}
+interface TraceItemQueueEventInfo {
+    readonly queue: string;
+    readonly batchSize: number;
+}
+interface TraceItemEmailEventInfo {
+    readonly mailFrom: string;
+    readonly rcptTo: string;
+    readonly rawSize: number;
+}
+interface TraceItemTailEventInfo {
+    readonly consumedEvents: TraceItemTailEventInfoTailItem[];
+}
+interface TraceItemTailEventInfoTailItem {
+    readonly scriptName: string | null;
+}
+interface TraceItemFetchEventInfo {
+    readonly response?: TraceItemFetchEventInfoResponse;
+    readonly request: TraceItemFetchEventInfoRequest;
+}
+interface TraceItemFetchEventInfoRequest {
+    readonly cf?: any;
+    readonly headers: Record<string, string>;
+    readonly method: string;
+    readonly url: string;
+    getUnredacted(): TraceItemFetchEventInfoRequest;
+}
+interface TraceItemFetchEventInfoResponse {
+    readonly status: number;
+}
+interface TraceItemJsRpcEventInfo {
+    readonly rpcMethod: string;
+}
+interface TraceItemHibernatableWebSocketEventInfo {
+    readonly getWebSocketEvent: TraceItemHibernatableWebSocketEventInfoMessage | TraceItemHibernatableWebSocketEventInfoClose | TraceItemHibernatableWebSocketEventInfoError;
+}
+interface TraceItemHibernatableWebSocketEventInfoMessage {
+    readonly webSocketEventType: string;
+}
+interface TraceItemHibernatableWebSocketEventInfoClose {
+    readonly webSocketEventType: string;
+    readonly code: number;
+    readonly wasClean: boolean;
+}
+interface TraceItemHibernatableWebSocketEventInfoError {
+    readonly webSocketEventType: string;
+}
+interface TraceLog {
+    readonly timestamp: number;
+    readonly level: string;
+    readonly message: any;
+    readonly errorInfo?: (TraceLogErrorInfo | null)[];
+}
+interface TraceLogErrorInfo {
+    name: string;
+    message: string;
+    stack?: string;
+}
+interface TraceException {
+    readonly timestamp: number;
+    readonly message: string;
+    readonly name: string;
+    readonly stack?: string;
+}
+interface TraceDiagnosticChannelEvent {
+    readonly timestamp: number;
+    readonly channel: string;
+    readonly message: any;
+}
+interface TraceMetrics {
+    readonly cpuTime: number;
+    readonly wallTime: number;
+}
+interface UnsafeTraceMetrics {
+    fromTrace(item: TraceItem): TraceMetrics;
+}
+/**
+ * The **`URL`** interface is used to parse, construct, normalize, and encode URLs. It works by providing properties which allow you to easily read and modify the components of a URL.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL)
+ */
+declare class URL {
+    constructor(url: string | URL, base?: string | URL);
+    /**
+     * The **`origin`** read-only property of the URL interface returns a string containing the Unicode serialization of the origin of the represented URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/origin)
+     */
+    get origin(): string;
+    /**
+     * The **`href`** property of the URL interface is a string containing the whole URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/href)
+     */
+    get href(): string;
+    /**
+     * The **`href`** property of the URL interface is a string containing the whole URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/href)
+     */
+    set href(value: string);
+    /**
+     * The **`protocol`** property of the URL interface is a string containing the protocol or scheme of the URL, including the final ":".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/protocol)
+     */
+    get protocol(): string;
+    /**
+     * The **`protocol`** property of the URL interface is a string containing the protocol or scheme of the URL, including the final ":".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/protocol)
+     */
+    set protocol(value: string);
+    /**
+     * The **`username`** property of the URL interface is a string containing the username component of the URL. If the URL does not have a username, this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/username)
+     */
+    get username(): string;
+    /**
+     * The **`username`** property of the URL interface is a string containing the username component of the URL. If the URL does not have a username, this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/username)
+     */
+    set username(value: string);
+    /**
+     * The **`password`** property of the URL interface is a string containing the password component of the URL. If the URL does not have a password, this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/password)
+     */
+    get password(): string;
+    /**
+     * The **`password`** property of the URL interface is a string containing the password component of the URL. If the URL does not have a password, this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/password)
+     */
+    set password(value: string);
+    /**
+     * The **`host`** property of the URL interface is a string containing the host, which is the hostname, and then, if the port of the URL is nonempty, a ":", followed by the port of the URL. If the URL does not have a hostname, this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/host)
+     */
+    get host(): string;
+    /**
+     * The **`host`** property of the URL interface is a string containing the host, which is the hostname, and then, if the port of the URL is nonempty, a ":", followed by the port of the URL. If the URL does not have a hostname, this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/host)
+     */
+    set host(value: string);
+    /**
+     * The **`hostname`** property of the URL interface is a string containing either the domain name or IP address of the URL. If the URL does not have a hostname, this property contains an empty string, "". IPv4 and IPv6 addresses are normalized, such as stripping leading zeros, and domain names are converted to IDN.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/hostname)
+     */
+    get hostname(): string;
+    /**
+     * The **`hostname`** property of the URL interface is a string containing either the domain name or IP address of the URL. If the URL does not have a hostname, this property contains an empty string, "". IPv4 and IPv6 addresses are normalized, such as stripping leading zeros, and domain names are converted to IDN.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/hostname)
+     */
+    set hostname(value: string);
+    /**
+     * The **`port`** property of the URL interface is a string containing the port number of the URL. If the port is the default for the protocol (80 for ws: and http:, 443 for wss: and https:, and 21 for ftp:), this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/port)
+     */
+    get port(): string;
+    /**
+     * The **`port`** property of the URL interface is a string containing the port number of the URL. If the port is the default for the protocol (80 for ws: and http:, 443 for wss: and https:, and 21 for ftp:), this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/port)
+     */
+    set port(value: string);
+    /**
+     * The **`pathname`** property of the URL interface represents a location in a hierarchical structure. It is a string constructed from a list of path segments, each of which is prefixed by a / character.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/pathname)
+     */
+    get pathname(): string;
+    /**
+     * The **`pathname`** property of the URL interface represents a location in a hierarchical structure. It is a string constructed from a list of path segments, each of which is prefixed by a / character.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/pathname)
+     */
+    set pathname(value: string);
+    /**
+     * The **`search`** property of the URL interface is a search string, also called a query string, that is a string containing a "?" followed by the parameters of the URL. If the URL does not have a search query, this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/search)
+     */
+    get search(): string;
+    /**
+     * The **`search`** property of the URL interface is a search string, also called a query string, that is a string containing a "?" followed by the parameters of the URL. If the URL does not have a search query, this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/search)
+     */
+    set search(value: string);
+    /**
+     * The **`hash`** property of the URL interface is a string containing a "#" followed by the fragment identifier of the URL. If the URL does not have a fragment identifier, this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/hash)
+     */
+    get hash(): string;
+    /**
+     * The **`hash`** property of the URL interface is a string containing a "#" followed by the fragment identifier of the URL. If the URL does not have a fragment identifier, this property contains an empty string, "".
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/hash)
+     */
+    set hash(value: string);
+    /**
+     * The **`searchParams`** read-only property of the URL interface returns a URLSearchParams object allowing access to the GET decoded query arguments contained in the URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/searchParams)
+     */
+    get searchParams(): URLSearchParams;
+    /**
+     * The **`toJSON()`** method of the URL interface returns a string containing a serialized version of the URL, although in practice it seems to have the same effect as URL.toString().
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/toJSON)
+     */
+    toJSON(): string;
+    /*function toString() { [native code] }*/
+    toString(): string;
+    /**
+     * The **`URL.canParse()`** static method of the URL interface returns a boolean indicating whether or not an absolute URL, or a relative URL combined with a base URL, are parsable and valid.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/canParse_static)
+     */
+    static canParse(url: string, base?: string): boolean;
+    /**
+     * The **`URL.parse()`** static method of the URL interface returns a newly created URL object representing the URL defined by the parameters.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/parse_static)
+     */
+    static parse(url: string, base?: string): URL | null;
+    /**
+     * The **`createObjectURL()`** static method of the URL interface creates a string containing a blob URL pointing to the object given in the parameter.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/createObjectURL_static)
+     */
+    static createObjectURL(object: File | Blob): string;
+    /**
+     * The **`revokeObjectURL()`** static method of the URL interface releases an existing object URL which was previously created by calling URL.createObjectURL().
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URL/revokeObjectURL_static)
+     */
+    static revokeObjectURL(object_url: string): void;
+}
+/**
+ * The **`URLSearchParams`** interface defines utility methods to work with the query string of a URL.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLSearchParams)
+ */
+declare class URLSearchParams {
+    constructor(init?: (Iterable<Iterable<string>> | Record<string, string> | string));
+    /**
+     * The **`size`** read-only property of the URLSearchParams interface indicates the total number of search parameter entries.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLSearchParams/size)
+     */
+    get size(): number;
+    /**
+     * The **`append()`** method of the URLSearchParams interface appends a specified key/value pair as a new search parameter.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLSearchParams/append)
+     */
+    append(name: string, value: string): void;
+    /**
+     * The **`delete()`** method of the URLSearchParams interface deletes specified parameters and their associated value(s) from the list of all search parameters.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLSearchParams/delete)
+     */
+    delete(name: string, value?: string): void;
+    /**
+     * The **`get()`** method of the URLSearchParams interface returns the first value associated to the given search parameter.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLSearchParams/get)
+     */
+    get(name: string): string | null;
+    /**
+     * The **`getAll()`** method of the URLSearchParams interface returns all the values associated with a given search parameter as an array.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLSearchParams/getAll)
+     */
+    getAll(name: string): string[];
+    /**
+     * The **`has()`** method of the URLSearchParams interface returns a boolean value that indicates whether the specified parameter is in the search parameters.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLSearchParams/has)
+     */
+    has(name: string, value?: string): boolean;
+    /**
+     * The **`set()`** method of the URLSearchParams interface sets the value associated with a given search parameter to the given value. If there were several matching values, this method deletes the others. If the search parameter doesn't exist, this method creates it.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLSearchParams/set)
+     */
+    set(name: string, value: string): void;
+    /**
+     * The **`URLSearchParams.sort()`** method sorts all key/value pairs contained in this object in place and returns undefined. Key/value pairs are sorted by the values of the UTF-16 code units of the keys. This method uses a stable sorting algorithm (i.e., the relative order between key/value pairs with equal keys will be preserved).
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLSearchParams/sort)
+     */
+    sort(): void;
+    entries(): IterableIterator<[
+        key: string,
+        value: string
+    ]>;
+    keys(): IterableIterator<string>;
+    values(): IterableIterator<string>;
+    forEach<This = unknown>(callback: (this: This, value: string, key: string, parent: URLSearchParams) => void, thisArg?: This): void;
+    /*function toString() { [native code] }*/
+    toString(): string;
+    [Symbol.iterator](): IterableIterator<[
+        key: string,
+        value: string
+    ]>;
+}
+/**
+ * The **`URLPattern`** interface of the URL Pattern API matches URLs or parts of URLs against a pattern. The pattern can contain capturing groups that extract parts of the matched URL.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern)
+ */
+declare class URLPattern {
+    constructor(input?: (string | URLPatternInit), baseURL?: (string | URLPatternOptions), patternOptions?: URLPatternOptions);
+    /**
+     * The **`protocol`** read-only property of the URLPattern interface is a string containing the pattern used to match the protocol part of a URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/protocol)
+     */
+    get protocol(): string;
+    /**
+     * The **`username`** read-only property of the URLPattern interface is a string containing the pattern used to match the username part of a URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/username)
+     */
+    get username(): string;
+    /**
+     * The **`password`** read-only property of the URLPattern interface is a string containing the pattern used to match the password part of a URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/password)
+     */
+    get password(): string;
+    /**
+     * The **`hostname`** read-only property of the URLPattern interface is a string containing the pattern used to match the hostname part of a URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/hostname)
+     */
+    get hostname(): string;
+    /**
+     * The **`port`** read-only property of the URLPattern interface is a string containing the pattern used to match the port part of a URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/port)
+     */
+    get port(): string;
+    /**
+     * The **`pathname`** read-only property of the URLPattern interface is a string containing the pattern used to match the pathname part of a URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/pathname)
+     */
+    get pathname(): string;
+    /**
+     * The **`search`** read-only property of the URLPattern interface is a string containing the pattern used to match the search part of a URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/search)
+     */
+    get search(): string;
+    /**
+     * The **`hash`** read-only property of the URLPattern interface is a string containing the pattern used to match the fragment part of a URL.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/hash)
+     */
+    get hash(): string;
+    /**
+     * The **`hasRegExpGroups`** read-only property of the URLPattern interface is a boolean indicating whether or not any of the URLPattern components contain regular expression capturing groups.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/hasRegExpGroups)
+     */
+    get hasRegExpGroups(): boolean;
+    /**
+     * The **`test()`** method of the URLPattern interface takes a URL string or object of URL parts, and returns a boolean indicating if the given input matches the current pattern.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/test)
+     */
+    test(input?: (string | URLPatternInit), baseURL?: string): boolean;
+    /**
+     * The **`exec()`** method of the URLPattern interface takes a URL or object of URL parts, and returns either an object containing the results of matching the URL to the pattern, or null if the URL does not match the pattern.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/URLPattern/exec)
+     */
+    exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;
+}
+interface URLPatternInit {
+    protocol?: string;
+    username?: string;
+    password?: string;
+    hostname?: string;
+    port?: string;
+    pathname?: string;
+    search?: string;
+    hash?: string;
+    baseURL?: string;
+}
+interface URLPatternComponentResult {
+    input: string;
+    groups: Record<string, string>;
+}
+interface URLPatternResult {
+    inputs: (string | URLPatternInit)[];
+    protocol: URLPatternComponentResult;
+    username: URLPatternComponentResult;
+    password: URLPatternComponentResult;
+    hostname: URLPatternComponentResult;
+    port: URLPatternComponentResult;
+    pathname: URLPatternComponentResult;
+    search: URLPatternComponentResult;
+    hash: URLPatternComponentResult;
+}
+interface URLPatternOptions {
+    ignoreCase?: boolean;
+}
+/**
+ * A **`CloseEvent`** is sent to clients using WebSockets when the connection is closed. This is delivered to the listener indicated by the WebSocket object's onclose attribute.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CloseEvent)
+ */
+declare class CloseEvent extends Event {
+    constructor(type: string, initializer?: CloseEventInit);
+    /**
+     * The **`code`** read-only property of the CloseEvent interface returns a WebSocket connection close code indicating the reason the connection was closed.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CloseEvent/code)
+     */
+    readonly code: number;
+    /**
+     * The **`reason`** read-only property of the CloseEvent interface returns the WebSocket connection close reason the server gave for closing the connection; that is, a concise human-readable prose explanation for the closure.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CloseEvent/reason)
+     */
+    readonly reason: string;
+    /**
+     * The **`wasClean`** read-only property of the CloseEvent interface returns true if the connection closed cleanly.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/CloseEvent/wasClean)
+     */
+    readonly wasClean: boolean;
+}
+interface CloseEventInit {
+    bubbles?: boolean;
+    cancelable?: boolean;
+    composed?: boolean;
+    code?: number;
+    reason?: string;
+    wasClean?: boolean;
+}
+type WebSocketEventMap = {
+    close: CloseEvent;
+    message: MessageEvent;
+    open: Event;
+    error: ErrorEvent;
+};
+/**
+ * The **`WebSocket`** object provides the API for creating and managing a WebSocket connection to a server, as well as for sending and receiving data on the connection.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WebSocket)
+ */
+declare var WebSocket: {
+    prototype: WebSocket;
+    new (url: string, protocols?: (string[] | string)): WebSocket;
+    readonly READY_STATE_CONNECTING: number;
+    readonly CONNECTING: number;
+    readonly READY_STATE_OPEN: number;
+    readonly OPEN: number;
+    readonly READY_STATE_CLOSING: number;
+    readonly CLOSING: number;
+    readonly READY_STATE_CLOSED: number;
+    readonly CLOSED: number;
+};
+/**
+ * The **`WebSocket`** object provides the API for creating and managing a WebSocket connection to a server, as well as for sending and receiving data on the connection.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WebSocket)
+ */
+interface WebSocket extends EventTarget<WebSocketEventMap> {
+    accept(options?: WebSocketAcceptOptions): void;
+    /**
+     * The **`WebSocket.send()`** method enqueues the specified data to be transmitted to the server over the WebSocket connection, increasing the value of bufferedAmount by the number of bytes needed to contain the data. If the data can't be sent (for example, because it needs to be buffered but the buffer is full), the socket is closed automatically. The browser will throw an exception if you call send() when the connection is in the CONNECTING state. If you call send() when the connection is in the CLOSING or CLOSED states, the browser will silently discard the data.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WebSocket/send)
+     */
+    send(message: (ArrayBuffer | ArrayBufferView) | string): void;
+    /**
+     * The **`WebSocket.close()`** method closes the WebSocket connection or connection attempt, if any. If the connection is already CLOSED, this method does nothing.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WebSocket/close)
+     */
+    close(code?: number, reason?: string): void;
+    serializeAttachment(attachment: any): void;
+    deserializeAttachment(): any | null;
+    /**
+     * The **`WebSocket.readyState`** read-only property returns the current state of the WebSocket connection.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WebSocket/readyState)
+     */
+    readyState: number;
+    /**
+     * The **`WebSocket.url`** read-only property returns the absolute URL of the WebSocket as resolved by the constructor.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WebSocket/url)
+     */
+    url: string | null;
+    /**
+     * The **`WebSocket.protocol`** read-only property returns the name of the sub-protocol the server selected; this will be one of the strings specified in the protocols parameter when creating the WebSocket object, or the empty string if no connection is established.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WebSocket/protocol)
+     */
+    protocol: string | null;
+    /**
+     * The **`WebSocket.extensions`** read-only property returns the extensions selected by the server. This is currently only the empty string or a list of extensions as negotiated by the connection.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WebSocket/extensions)
+     */
+    extensions: string | null;
+    /**
+     * The **`WebSocket.binaryType`** property controls the type of binary data being received over the WebSocket connection.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/WebSocket/binaryType)
+     */
+    binaryType: "blob" | "arraybuffer";
+}
+interface WebSocketAcceptOptions {
+    /**
+     * When set to `true`, receiving a server-initiated WebSocket Close frame will not
+     * automatically send a reciprocal Close frame, leaving the connection in a half-open
+     * state. This is useful for proxying scenarios where you need to coordinate closing
+     * both sides independently. Defaults to `false` when the
+     * `no_web_socket_half_open_by_default` compatibility flag is enabled.
+     */
+    allowHalfOpen?: boolean;
+}
+declare const WebSocketPair: {
+    new (): {
+        0: WebSocket;
+        1: WebSocket;
+    };
+};
+interface SqlStorage {
+    exec<T extends Record<string, SqlStorageValue>>(query: string, ...bindings: any[]): SqlStorageCursor<T>;
+    get databaseSize(): number;
+    Cursor: typeof SqlStorageCursor;
+    Statement: typeof SqlStorageStatement;
+}
+declare abstract class SqlStorageStatement {
+}
+type SqlStorageValue = ArrayBuffer | string | number | null;
+declare abstract class SqlStorageCursor<T extends Record<string, SqlStorageValue>> {
+    next(): {
+        done?: false;
+        value: T;
+    } | {
+        done: true;
+        value?: never;
+    };
+    toArray(): T[];
+    one(): T;
+    raw<U extends SqlStorageValue[]>(): IterableIterator<U>;
+    columnNames: string[];
+    get rowsRead(): number;
+    get rowsWritten(): number;
+    [Symbol.iterator](): IterableIterator<T>;
+}
+interface Socket {
+    get readable(): ReadableStream;
+    get writable(): WritableStream;
+    get closed(): Promise<void>;
+    get opened(): Promise<SocketInfo>;
+    get upgraded(): boolean;
+    get secureTransport(): "on" | "off" | "starttls";
+    close(): Promise<void>;
+    startTls(options?: TlsOptions): Socket;
+}
+interface SocketOptions {
+    secureTransport?: string;
+    allowHalfOpen: boolean;
+    highWaterMark?: (number | bigint);
+}
+interface SocketAddress {
+    hostname: string;
+    port: number;
+}
+interface TlsOptions {
+    expectedServerHostname?: string;
+}
+interface SocketInfo {
+    remoteAddress?: string;
+    localAddress?: string;
+}
+/**
+ * The **`EventSource`** interface is web content's interface to server-sent events.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource)
+ */
+declare class EventSource extends EventTarget {
+    constructor(url: string, init?: EventSourceEventSourceInit);
+    /**
+     * The **`close()`** method of the EventSource interface closes the connection, if one is made, and sets the EventSource.readyState attribute to 2 (closed).
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/close)
+     */
+    close(): void;
+    /**
+     * The **`url`** read-only property of the EventSource interface returns a string representing the URL of the source.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/url)
+     */
+    get url(): string;
+    /**
+     * The **`withCredentials`** read-only property of the EventSource interface returns a boolean value indicating whether the EventSource object was instantiated with CORS credentials set.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/withCredentials)
+     */
+    get withCredentials(): boolean;
+    /**
+     * The **`readyState`** read-only property of the EventSource interface returns a number representing the state of the connection.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/readyState)
+     */
+    get readyState(): number;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/open_event) */
+    get onopen(): any | null;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/open_event) */
+    set onopen(value: any | null);
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/message_event) */
+    get onmessage(): any | null;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/message_event) */
+    set onmessage(value: any | null);
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/error_event) */
+    get onerror(): any | null;
+    /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/error_event) */
+    set onerror(value: any | null);
+    static readonly CONNECTING: number;
+    static readonly OPEN: number;
+    static readonly CLOSED: number;
+    static from(stream: ReadableStream): EventSource;
+}
+interface EventSourceEventSourceInit {
+    withCredentials?: boolean;
+    fetcher?: Fetcher;
+}
+interface ExecOutput {
+    readonly stdout: ArrayBuffer;
+    readonly stderr: ArrayBuffer;
+    readonly exitCode: number;
+}
+interface ContainerExecOptions {
+    cwd?: string;
+    env?: Record<string, string>;
+    user?: string;
+    signal?: AbortSignal;
+    pty?: boolean | ContainerExecPtyOptions;
+    stdin?: ReadableStream | "pipe";
+    stdout?: "pipe" | "ignore";
+    stderr?: "pipe" | "ignore" | "combined";
+}
+interface ContainerExecPtyOptions {
+    cols?: number;
+    rows?: number;
+}
+interface ExecProcess {
+    readonly stdin: WritableStream | null;
+    readonly stdout: ReadableStream | null;
+    readonly stderr: ReadableStream | null;
+    readonly pid: number;
+    readonly isPty: boolean;
+    readonly exitCode: Promise<number>;
+    output(): Promise<ExecOutput>;
+    kill(signal?: number): void;
+    resize(cols: number, rows: number): void;
+}
+interface Container {
+    get running(): boolean;
+    start(options?: ContainerStartupOptions): void;
+    monitor(): Promise<void>;
+    destroy(error?: any): Promise<void>;
+    signal(signo: number): void;
+    getTcpPort(port: number): Fetcher;
+    setInactivityTimeout(durationMs: number | bigint): Promise<void>;
+    interceptOutboundHttp(addr: string, binding: Fetcher): Promise<void>;
+    interceptAllOutboundHttp(binding: Fetcher): Promise<void>;
+    snapshotDirectory(options: ContainerDirectorySnapshotOptions): Promise<ContainerDirectorySnapshot>;
+    snapshotContainer(options: ContainerSnapshotOptions): Promise<ContainerSnapshot>;
+    interceptOutboundHttps(addr: string, binding: Fetcher): Promise<void>;
+    exec(cmd: string[], options?: ContainerExecOptions): Promise<ExecProcess>;
+}
+interface ContainerDirectorySnapshot {
+    id: string;
+    size: number;
+    dir: string;
+    name?: string;
+}
+interface ContainerDirectorySnapshotOptions {
+    dir: string;
+    name?: string;
+}
+type ContainerDirectorySnapshotRestoreParams = {
+    snapshot: ContainerDirectorySnapshot;
+    mountPoint?: string;
+} | {
+    snapshot?: undefined;
+    mountPoint: string;
+};
+interface ContainerSnapshot {
+    id: string;
+    size: number;
+    name?: string;
+}
+interface ContainerSnapshotRestoreParams {
+    id: string;
+}
+interface ContainerSnapshotOptions {
+    name?: string;
+}
+type ContainerStartupOptions = {
+    entrypoint?: string[];
+    enableInternet: boolean;
+    env?: Record<string, string>;
+    instance?: "lite" | "standard-1" | "standard-2" | "standard-3" | "standard-4" | ContainerStartResources;
+    labels?: Record<string, string>;
+    directorySnapshots?: ContainerDirectorySnapshotRestoreParams[];
+} & ({
+    image: string;
+    containerSnapshot?: never;
+} | {
+    image?: never;
+    containerSnapshot?: ContainerSnapshotRestoreParams;
+});
+interface ContainerStartResources {
+    vcpu: number;
+    memoryMib: number;
+    diskMb: number;
+}
+/**
+ * The **`MessagePort`** interface of the Channel Messaging API represents one of the two ports of a MessageChannel, allowing messages to be sent from one port and listening out for them arriving at the other.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessagePort)
+ */
+declare abstract class MessagePort extends EventTarget {
+    /**
+     * The **`postMessage()`** method of the MessagePort interface sends a message from the port, and optionally, transfers ownership of objects to other browsing contexts.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessagePort/postMessage)
+     */
+    postMessage(data?: any, options?: (any[] | MessagePortPostMessageOptions)): void;
+    /**
+     * The **`close()`** method of the MessagePort interface disconnects the port, so it is no longer active. This stops the flow of messages to that port.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessagePort/close)
+     */
+    close(): void;
+    /**
+     * The **`start()`** method of the MessagePort interface starts the sending of messages queued on the port. This method is only needed when using EventTarget.addEventListener; it is implied when using onmessage.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessagePort/start)
+     */
+    start(): void;
+    get onmessage(): any | null;
+    set onmessage(value: any | null);
+}
+/**
+ * The **`MessageChannel`** interface of the Channel Messaging API allows us to create a new message channel and send data through it via its two MessagePort properties.
+ *
+ * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageChannel)
+ */
+declare class MessageChannel {
+    constructor();
+    /**
+     * The **`port1`** read-only property of the MessageChannel interface returns the first port of the message channel — the port attached to the context that originated the channel.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageChannel/port1)
+     */
+    readonly port1: MessagePort;
+    /**
+     * The **`port2`** read-only property of the MessageChannel interface returns the second port of the message channel — the port attached to the context at the other end of the channel, which the message is initially sent to.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageChannel/port2)
+     */
+    readonly port2: MessagePort;
+}
+interface MessagePortPostMessageOptions {
+    transfer?: any[];
+}
+type LoopbackForExport<T extends (new (...args: any[]) => Rpc.EntrypointBranded) | ExportedHandler<any, any, any> | undefined = undefined> = T extends new (...args: any[]) => Rpc.WorkerEntrypointBranded ? LoopbackServiceStub<InstanceType<T>> : T extends new (...args: any[]) => Rpc.DurableObjectBranded ? LoopbackDurableObjectClass<InstanceType<T>> : T extends ExportedHandler<any, any, any> ? LoopbackServiceStub<undefined> : undefined;
+type LoopbackServiceStub<T extends Rpc.WorkerEntrypointBranded | undefined = undefined> = Fetcher<T> & (T extends CloudflareWorkersModule.WorkerEntrypoint<any, infer Props> ? (opts: {
+    props?: Props;
+}) => Fetcher<T> : (opts: {
+    props?: any;
+}) => Fetcher<T>);
+type LoopbackDurableObjectClass<T extends Rpc.DurableObjectBranded | undefined = undefined> = DurableObjectClass<T> & (T extends CloudflareWorkersModule.DurableObject<any, infer Props> ? (opts: {
+    props?: Props;
+}) => DurableObjectClass<T> : (opts: {
+    props?: any;
+}) => DurableObjectClass<T>);
+interface LoopbackDurableObjectNamespace extends DurableObjectNamespace {
+}
+interface LoopbackColoLocalActorNamespace extends ColoLocalActorNamespace {
+}
+interface SyncKvStorage {
+    get<T = unknown>(key: string): T | undefined;
+    list<T = unknown>(options?: SyncKvListOptions): Iterable<[
+        string,
+        T
+    ]>;
+    put<T>(key: string, value: T): void;
+    delete(key: string): boolean;
+}
+interface SyncKvListOptions {
+    start?: string;
+    startAfter?: string;
+    end?: string;
+    prefix?: string;
+    reverse?: boolean;
+    limit?: number;
+}
+interface WorkerStub {
+    getEntrypoint<T extends Rpc.WorkerEntrypointBranded | undefined>(name?: string, options?: WorkerStubEntrypointOptions): Fetcher<T>;
+    getDurableObjectClass<T extends Rpc.DurableObjectBranded | undefined>(name?: string, options?: WorkerStubEntrypointOptions): DurableObjectClass<T>;
+}
+interface WorkerStubEntrypointOptions {
+    props?: any;
+    limits?: workerdResourceLimits;
+}
+interface WorkerLoader {
+    get(name: string | null, getCode: () => WorkerLoaderWorkerCode | Promise<WorkerLoaderWorkerCode>): WorkerStub;
+    load(code: WorkerLoaderWorkerCode): WorkerStub;
+}
+interface WorkerLoaderModule {
+    js?: string;
+    cjs?: string;
+    text?: string;
+    data?: ArrayBuffer;
+    json?: any;
+    py?: string;
+    wasm?: ArrayBuffer | ArrayBufferView | WebAssembly.Module;
+}
+interface WorkerLoaderWorkerCode {
+    compatibilityDate: string;
+    compatibilityFlags?: string[];
+    allowExperimental?: boolean;
+    limits?: workerdResourceLimits;
+    mainModule: string;
+    modules: Record<string, string | WebAssembly.Module | WorkerLoaderModule>;
+    env?: any;
+    globalOutbound?: (Fetcher | null);
+    tails?: Fetcher[];
+    streamingTails?: Fetcher[];
+}
+interface workerdResourceLimits {
+    cpuMs?: number;
+    subRequests?: number;
+}
+/**
+* The Workers runtime supports a subset of the Performance API, used to measure timing and performance,
+* as well as timing of subrequests and other operations.
+*
+* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/performance/)
+*/
+declare abstract class Performance {
+    /* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/performance/#performancetimeorigin) */
+    get timeOrigin(): number;
+    /* [Cloudflare Docs Reference](https://developers.cloudflare.com/workers/runtime-apis/performance/#performancenow) */
+    now(): number;
+    /**
+     * The **`toJSON()`** method of the Performance interface is a serializer; it returns a JSON representation of the Performance object.
+     *
+     * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Performance/toJSON)
+     */
+    toJSON(): object;
+}
+interface Tracing {
+    enterSpan<T, A extends unknown[]>(name: string, callback: (span: Span, ...args: A) => T, ...args: A): T;
+    startActiveSpan<T, A extends unknown[]>(name: string, callback: (span: Span, ...args: A) => T, ...args: A): T;
+    startSpan(name: string): Span;
+    Span: typeof Span;
+}
+declare abstract class Span {
+    get isTraced(): boolean;
+    setAttribute(key: string, value: boolean | number | string): this;
+    setAttributes(attributes: Record<string, boolean | number | string | undefined>): this;
+    end(): void;
+}
+/**
+ * Represents the identity of a user authenticated via Cloudflare Access.
+ * This matches the result of calling /cdn-cgi/access/get-identity.
+ *
+ * The exact structure of the returned object depends on the identity provider
+ * configuration for the Access application. The fields below represent commonly
+ * available properties, but additional provider-specific fields may be present.
+ */
+interface CloudflareAccessIdentity extends Record<string, unknown> {
+    /** The user's email address, if available from the identity provider. */
+    email?: string;
+    /** The user's display name. */
+    name?: string;
+    /** The user's unique identifier. */
+    user_uuid?: string;
+    /** The Cloudflare account ID. */
+    account_id?: string;
+    /** Login timestamp (Unix epoch seconds). */
+    iat?: number;
+    /** The user's IP address at authentication time. */
+    ip?: string;
+    /** Authentication methods used (e.g., "pwd"). */
+    amr?: string[];
+    /** Identity provider information. */
+    idp?: {
+        id: string;
+        type: string;
+    };
+    /** Geographic information about where the user authenticated. */
+    geo?: {
+        country: string;
+    };
+    /** Group memberships from the identity provider. */
+    groups?: Array<{
+        id: string;
+        name: string;
+        email?: string;
+    }>;
+    /** Device posture check results, keyed by check ID. */
+    devicePosture?: Record<string, unknown>;
+    /** True if the user connected via Cloudflare WARP. */
+    is_warp?: boolean;
+    /** True if the user is authenticated via Cloudflare Gateway. */
+    is_gateway?: boolean;
+}
+// ============================================================================
+// Agent Memory
+//
+// Public type surface for user Workers binding to an Agent Memory namespace.
+// ============================================================================
+/** Memory type — every memory is classified into exactly one. */
+type AgentMemoryMemoryType = "fact" | "event" | "instruction" | "task";
+/** Search intensity for recall. */
+type AgentMemoryThinkingLevel = "low" | "medium" | "high";
+/** Response verbosity for recall. */
+type AgentMemoryResponseLength = "short" | "medium" | "long";
+/** A conversation message passed to ingest(). */
+interface AgentMemoryMessage {
+    role: "system" | "user" | "assistant";
+    content: string;
+    /** Optional message timestamp. */
+    timestamp?: Date;
+}
+/** Raw memory content passed to remember(). */
+interface AgentMemoryIncomingMemory {
+    /** Raw memory content. The service classifies and summarizes automatically. */
+    content: string;
+    /** Optional session identifier to associate with this memory. */
+    sessionId?: string | null | undefined;
+}
+/** A stored memory returned from remember(), get(), and delete(). */
+interface AgentMemoryMemory {
+    /** Memory ID. */
+    id: string;
+    /** Memory type. */
+    type: AgentMemoryMemoryType;
+    /** Text summary. */
+    summary: string;
+    /** Memory text. */
+    content: string;
+    /** Session that created this memory. */
+    sessionId: string | null;
+    /** Memory creation time. */
+    createdAt: Date;
+    /** Memory last-update time. */
+    updatedAt: Date;
+}
+/** Single entry in a list() response. Same shape as Memory minus full content. */
+type AgentMemoryMemoryListEntry = Omit<AgentMemoryMemory, "content">;
+/** A scored memory candidate in a recall result. */
+interface AgentMemoryScoredCandidate {
+    /** Candidate ID. */
+    id: string;
+    /** Text summary. */
+    summary: string;
+    /** Session that created this candidate, when known. */
+    sessionId: string | null;
+    /** Relevance score (higher is better). Comparable only within a single query. */
+    score: number;
+}
+/** Options for the ingest() method. */
+interface AgentMemoryIngestOptions {
+    /** Session identifier to associate with memories created during ingestion. */
+    sessionId?: string | null | undefined;
+}
+/** Options for the getSummary() method. */
+interface AgentMemoryGetSummaryOptions {
+    /** Session identifier to retrieve session summary for. */
+    sessionId?: string | null | undefined;
+}
+/** Response from the getSummary() method. */
+interface AgentMemoryGetSummaryResponse {
+    /** Markdown summary. */
+    summary: string;
+}
+/**
+ * Options for the recall() method.
+ *
+ * `referenceDate` accepts a Date object, an ISO-8601 date string
+ * (YYYY-MM-DD), or a full ISO-8601 datetime string. When provided, this
+ * date is used as "today" for resolving relative time references
+ * ("how many days ago", "last week") instead of the server's wall-clock time.
+ */
+interface AgentMemoryRecallOptions {
+    /** Recall intensity: "low" (default), "medium", or "high". */
+    thinkingLevel?: AgentMemoryThinkingLevel;
+    /** Response verbosity: "short", "medium" (default), or "long". */
+    responseLength?: AgentMemoryResponseLength;
+    /** Temporal anchor for date arithmetic. */
+    referenceDate?: Date | string;
+}
+/** Response from the recall() method. */
+interface AgentMemoryRecallResult {
+    /** Number of memories retrieved. */
+    count: number;
+    /** LLM-generated answer synthesizing the matching memories. */
+    answer: string;
+    /** Matching memories ranked by relevance. */
+    candidates: AgentMemoryScoredCandidate[];
+}
+/**
+ * Options for the list() method.
+ *
+ * `cursor` is the opaque continuation token returned by the previous page;
+ * pass it back unchanged to fetch the next page. `sessionId` and `type`
+ * are exact-match filters; combining them is allowed.
+ */
+interface AgentMemoryListMemoriesOptions {
+    /** Maximum number of memories to return. Default 20, max 500. */
+    limit?: number;
+    /** Opaque cursor from a previous page. */
+    cursor?: string;
+    /** Exact-match session filter. */
+    sessionId?: string;
+    /** Exact-match memory-type filter. */
+    type?: AgentMemoryMemoryType;
+}
+/** Response from the list() method. */
+interface AgentMemoryListMemoriesResult {
+    memories: AgentMemoryMemoryListEntry[];
+    /** Continuation cursor; absent when this page exhausted the result set. */
+    cursor?: string;
+}
+/**
+ * A single Agent Memory profile, scoped to a profile name.
+ *
+ * Returned by {@link AgentMemoryNamespace.getProfile}.
+ */
+declare abstract class AgentMemoryProfile {
+    /**
+     * Retrieve a memory by ID.
+     *
+     * @param memoryId - ULID of the memory to retrieve.
+     * @throws if the memory does not exist.
+     */
+    get(memoryId: string): Promise<AgentMemoryMemory>;
+    /**
+     * Delete a memory by ID.
+     *
+     * Removes the memory and any source messages linked by the memory's
+     * source message IDs.
+     *
+     * @param memoryId - ULID of the memory to delete.
+     * @throws if the memory does not exist.
+     */
+    delete(memoryId: string): Promise<AgentMemoryMemory>;
+    /**
+     * Store a memory in this profile. The content is automatically classified,
+     * summarized, and indexed.
+     *
+     * @param memory - Raw memory content to persist.
+     */
+    remember(memory: AgentMemoryIncomingMemory): Promise<AgentMemoryMemory>;
+    /**
+     * Extract memories from a conversation.
+     *
+     * @param messages - Conversation messages to extract memories from.
+     * @param options  - Optional ingest options.
+     */
+    ingest(messages: Iterable<AgentMemoryMessage>, options?: AgentMemoryIngestOptions): Promise<void>;
+    /**
+     * Get a profile summary.
+     *
+     * @param options - Optional getSummary options.
+     */
+    getSummary(options?: AgentMemoryGetSummaryOptions): Promise<AgentMemoryGetSummaryResponse>;
+    /**
+     * Recall memories in this profile.
+     *
+     * @param query   - Recall query matched against memory content and keywords.
+     * @param options - Optional recall parameters.
+     * @returns Matching memories with relevance scores and a synthesized answer.
+     */
+    recall(query: string, options?: AgentMemoryRecallOptions): Promise<AgentMemoryRecallResult>;
+    /**
+     * List active memories in this profile.
+     *
+     * Returns a paginated, filterable view of stored memories. Superseded
+     * versions are excluded. Use the returned `cursor` (when present) to
+     * fetch the next page.
+     *
+     * @param options - Optional pagination and filter options.
+     */
+    list(options?: AgentMemoryListMemoriesOptions): Promise<AgentMemoryListMemoriesResult>;
+    /**
+     * Soft-delete every memory and message in this profile that is tagged
+     * with `sessionId`.
+     *
+     * Idempotent: deleting a sessionId that has no rows is a no-op.
+     *
+     * @param sessionId - Session to delete.
+     */
+    deleteSession(sessionId: string): Promise<void>;
+}
+/**
+ * Namespace-level Agent Memory binding.
+ *
+ * Used as the type of an `env.MEMORY`-style binding backed by the Agent
+ * Memory product.
+ *
+ * @example
+ * ```ts
+ * export default {
+ *   async fetch(_request: Request, env: Env): Promise<Response> {
+ *     const profile = await env.MEMORY.getProfile("wrangler-e2e");
+ *     const summary = await profile.getSummary();
+ *     return Response.json(summary);
+ *   },
+ * };
+ * ```
+ */
+declare abstract class AgentMemoryNamespace {
+    /**
+     * Get a memory profile by name. Profiles are isolated by namespace and
+     * addressed by a compound key (namespaceId:profileName).
+     *
+     * @param profileName - Profile name (validated against naming rules).
+     * @returns RPC target for interacting with the profile.
+     */
+    getProfile(profileName: string): Promise<AgentMemoryProfile>;
+    /**
+     * Soft-delete a profile and schedule deferred purge. Marks all
+     * memories and messages as deleted.
+     *
+     * @param profileName - Name of the profile to delete.
+     */
+    deleteProfile(profileName: string): Promise<void>;
+}
+// ============ AI Search Error Interfaces ============
+interface AiSearchInternalError extends Error {
+}
+interface AiSearchNotFoundError extends Error {
+}
+// ============ AI Search Common Types ============
+/** A single message in a conversation-style search or chat request. */
+type AiSearchMessage = {
+    role: 'system' | 'developer' | 'user' | 'assistant' | 'tool';
+    content: string | null;
+};
+/**
+ * Common shape for `ai_search_options` used by both single-instance and multi-instance requests.
+ * Contains retrieval, query rewrite, reranking, and cache sub-options.
+ */
+type AiSearchOptions = {
+    retrieval?: {
+        /** Which retrieval backend to use. Defaults to the instance's configured index_method. */
+        retrieval_type?: 'vector' | 'keyword' | 'hybrid';
+        /** Fusion method for combining vector + keyword results. */
+        fusion_method?: 'max' | 'rrf';
+        /** How keyword terms are combined: "and" = all terms must match, "or" = any term matches. */
+        keyword_match_mode?: 'and' | 'or';
+        /** Minimum similarity score (0-1) for a result to be included. Default 0.4. */
+        match_threshold?: number;
+        /** Maximum number of results to return (1-50). Default 10. */
+        max_num_results?: number;
+        /** Vectorize metadata filters applied to the search. */
+        filters?: VectorizeVectorMetadataFilter;
+        /** Number of surrounding chunks to include for context (0-3). Default 0. */
+        context_expansion?: number;
+        /** If true, return only item metadata without chunk text. */
+        metadata_only?: boolean;
+        /** If true (default), return empty results on retrieval failure instead of throwing. */
+        return_on_failure?: boolean;
+        /** Boost results by metadata field values. Max 3 entries. */
+        boost_by?: Array<{
+            field: string;
+            direction?: 'asc' | 'desc' | 'exists' | 'not_exists';
+        }>;
+        [key: string]: unknown;
+    };
+    query_rewrite?: {
+        enabled?: boolean;
+        model?: string;
+        rewrite_prompt?: string;
+        [key: string]: unknown;
+    };
+    reranking?: {
+        enabled?: boolean;
+        model?: string;
+        /** Match threshold (0-1, default 0.4) */
+        match_threshold?: number;
+        [key: string]: unknown;
+    };
+    cache?: {
+        enabled?: boolean;
+        cache_threshold?: 'super_strict_match' | 'close_enough' | 'flexible_friend' | 'anything_goes';
+    };
+    [key: string]: unknown;
+};
+// ============ AI Search Request Types ============
+/**
+ * Request body for single-instance search.
+ * Exactly one of `query` or `messages` must be provided.
+ */
+type AiSearchSearchRequest = {
+    /** Simple query string. */
+    query: string;
+    messages?: never;
+    ai_search_options?: AiSearchOptions;
+} | {
+    query?: never;
+    /** Conversation-style input. At least one user message with non-empty content is required. */
+    messages: AiSearchMessage[];
+    ai_search_options?: AiSearchOptions;
+};
+type AiSearchChatCompletionsRequest = {
+    messages: AiSearchMessage[];
+    model?: string;
+    stream?: boolean;
+    ai_search_options?: AiSearchOptions;
+    [key: string]: unknown;
+};
+// ============ AI Search Multi-Instance Types (Namespace-Scoped) ============
+/** `ai_search_options` shape for multi-instance requests — requires `instance_ids`. */
+type AiSearchMultiSearchOptions = AiSearchOptions & {
+    /** Instance IDs to search across (1-10). */
+    instance_ids: string[];
+};
+/**
+ * Request for searching across multiple instances within a namespace.
+ * `ai_search_options` is required and must include `instance_ids`.
+ * Exactly one of `query` or `messages` must be provided.
+ */
+type AiSearchMultiSearchRequest = {
+    /** Simple query string. */
+    query: string;
+    messages?: never;
+    ai_search_options: AiSearchMultiSearchOptions;
+} | {
+    query?: never;
+    /** Conversation-style input. */
+    messages: AiSearchMessage[];
+    ai_search_options: AiSearchMultiSearchOptions;
+};
+/** A search result chunk tagged with the instance it originated from. */
+type AiSearchMultiSearchChunk = AiSearchSearchResponse['chunks'][number] & {
+    instance_id: string;
+};
+/** Describes a per-instance error during a multi-instance operation. */
+type AiSearchMultiSearchError = {
+    instance_id: string;
+    message: string;
+};
+/** Response from a multi-instance search, with chunks tagged by instance and optional partial-failure errors. */
+type AiSearchMultiSearchResponse = {
+    search_query: string;
+    chunks: AiSearchMultiSearchChunk[];
+    errors?: AiSearchMultiSearchError[];
+};
+/** Request for chat completions across multiple instances within a namespace. `ai_search_options` is required and must include `instance_ids`. */
+type AiSearchMultiChatCompletionsRequest = Omit<AiSearchChatCompletionsRequest, 'ai_search_options'> & {
+    ai_search_options: AiSearchMultiSearchOptions;
+};
+/** Response from multi-instance chat completions, with chunks tagged by instance and optional partial-failure errors. */
+type AiSearchMultiChatCompletionsResponse = Omit<AiSearchChatCompletionsResponse, 'chunks'> & {
+    chunks: AiSearchMultiSearchChunk[];
+    errors?: AiSearchMultiSearchError[];
+};
+// ============ AI Search Response Types ============
+type AiSearchSearchResponse = {
+    search_query: string;
+    chunks: Array<{
+        id: string;
+        type: string;
+        /** Match score (0-1) */
+        score: number;
+        text: string;
+        item: {
+            timestamp?: number;
+            key: string;
+            metadata?: Record<string, unknown>;
+        };
+        scoring_details?: {
+            /** Keyword match score (0-1) */
+            keyword_score?: number;
+            /** Vector similarity score (0-1) */
+            vector_score?: number;
+            /** Keyword rank position */
+            keyword_rank?: number;
+            /** Vector rank position */
+            vector_rank?: number;
+            /** Reranking model score */
+            reranking_score?: number;
+            /** Fusion method used to combine results */
+            fusion_method?: 'rrf' | 'max';
+            [key: string]: unknown;
+        };
+    }>;
+};
+type AiSearchChatCompletionsResponse = {
+    id?: string;
+    object?: string;
+    model?: string;
+    choices: Array<{
+        index?: number;
+        message: {
+            role: 'system' | 'developer' | 'user' | 'assistant' | 'tool';
+            content: string | null;
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    }>;
+    chunks: AiSearchSearchResponse['chunks'];
+    [key: string]: unknown;
+};
+type AiSearchStatsResponse = {
+    queued?: number;
+    running?: number;
+    completed?: number;
+    error?: number;
+    skipped?: number;
+    outdated?: number;
+    last_activity?: string;
+    /** Storage engine statistics. */
+    engine?: {
+        vectorize?: {
+            vectorsCount: number;
+            dimensions: number;
+        };
+        r2?: {
+            payloadSizeBytes: number;
+            metadataSizeBytes: number;
+            objectCount: number;
+        };
+    };
+};
+// ============ AI Search Instance Info Types ============
+type AiSearchInstanceInfo = {
+    id: string;
+    type?: 'r2' | 'web-crawler' | string;
+    source?: string;
+    source_params?: unknown;
+    paused?: boolean;
+    status?: string;
+    namespace?: string;
+    created_at?: string;
+    modified_at?: string;
+    token_id?: string;
+    ai_gateway_id?: string;
+    rewrite_query?: boolean;
+    reranking?: boolean;
+    embedding_model?: string;
+    ai_search_model?: string;
+    rewrite_model?: string;
+    reranking_model?: string;
+    /** @deprecated Use index_method instead. */
+    hybrid_search_enabled?: boolean;
+    /** Controls which storage backends are active. */
+    index_method?: {
+        vector?: boolean;
+        keyword?: boolean;
+    };
+    /** Fusion method for combining vector and keyword results. */
+    fusion_method?: 'max' | 'rrf';
+    indexing_options?: {
+        keyword_tokenizer?: 'porter' | 'trigram';
+    } | null;
+    retrieval_options?: {
+        keyword_match_mode?: 'and' | 'or';
+        boost_by?: Array<{
+            field: string;
+            direction?: 'asc' | 'desc' | 'exists' | 'not_exists';
+        }>;
+    } | null;
+    chunk?: boolean;
+    chunk_size?: number;
+    chunk_overlap?: number;
+    score_threshold?: number;
+    max_num_results?: number;
+    cache?: boolean;
+    cache_threshold?: 'super_strict_match' | 'close_enough' | 'flexible_friend' | 'anything_goes';
+    custom_metadata?: Array<{
+        field_name: string;
+        data_type: 'text' | 'number' | 'boolean' | 'datetime';
+    }>;
+    /** Sync interval in seconds. */
+    sync_interval?: 3600 | 7200 | 14400 | 21600 | 43200 | 86400;
+    metadata?: Record<string, unknown>;
+    [key: string]: unknown;
+};
+/** Pagination, search, and ordering parameters for listing instances within a namespace. */
+type AiSearchListInstancesParams = {
+    page?: number;
+    per_page?: number;
+    /** Search instances by ID. */
+    search?: string;
+    /** Field to sort by. */
+    order_by?: 'created_at';
+    /** Sort direction. */
+    order_by_direction?: 'asc' | 'desc';
+};
+type AiSearchListResponse = {
+    result: AiSearchInstanceInfo[];
+    result_info?: {
+        count: number;
+        page: number;
+        per_page: number;
+        total_count: number;
+    };
+};
+// ============ AI Search Config Types ============
+type AiSearchConfig = {
+    /** Instance ID (1-32 chars, pattern: ^[a-z0-9_]+(?:-[a-z0-9_]+)*$) */
+    id: string;
+    /** Instance type. Omit to create with built-in storage. */
+    type?: 'r2' | 'web-crawler' | string;
+    /** Source URL (required for web-crawler type). */
+    source?: string;
+    source_params?: unknown;
+    /** Token ID (UUID format) */
+    token_id?: string;
+    ai_gateway_id?: string;
+    /** Enable query rewriting (default false) */
+    rewrite_query?: boolean;
+    /** Enable reranking (default false) */
+    reranking?: boolean;
+    embedding_model?: string;
+    ai_search_model?: string;
+    rewrite_model?: string;
+    reranking_model?: string;
+    /** @deprecated Use index_method instead. */
+    hybrid_search_enabled?: boolean;
+    /** Controls which storage backends are used during indexing. Defaults to vector-only. */
+    index_method?: {
+        vector?: boolean;
+        keyword?: boolean;
+    };
+    /** Fusion method for combining vector and keyword results. "rrf" = reciprocal rank fusion (default), "max" = maximum score. */
+    fusion_method?: 'max' | 'rrf';
+    indexing_options?: {
+        keyword_tokenizer?: 'porter' | 'trigram';
+    } | null;
+    retrieval_options?: {
+        keyword_match_mode?: 'and' | 'or';
+        boost_by?: Array<{
+            field: string;
+            direction?: 'asc' | 'desc' | 'exists' | 'not_exists';
+        }>;
+    } | null;
+    chunk?: boolean;
+    chunk_size?: number;
+    chunk_overlap?: number;
+    /** Minimum similarity score (0-1) for a result to be included. */
+    score_threshold?: number;
+    max_num_results?: number;
+    cache?: boolean;
+    /** Similarity threshold for cache hits. Stricter = fewer cache hits but higher relevance. */
+    cache_threshold?: 'super_strict_match' | 'close_enough' | 'flexible_friend' | 'anything_goes';
+    custom_metadata?: Array<{
+        field_name: string;
+        data_type: 'text' | 'number' | 'boolean' | 'datetime';
+    }>;
+    namespace?: string;
+    /** Sync interval in seconds. 3600=1h, 7200=2h, 14400=4h, 21600=6h, 43200=12h, 86400=24h. */
+    sync_interval?: 3600 | 7200 | 14400 | 21600 | 43200 | 86400;
+    metadata?: Record<string, unknown>;
+    [key: string]: unknown;
+};
+// ============ AI Search Item Types ============
+type AiSearchItemInfo = {
+    id: string;
+    key: string;
+    status: 'completed' | 'error' | 'skipped' | 'queued' | 'running' | 'outdated';
+    next_action?: 'INDEX' | 'DELETE' | null;
+    error?: string;
+    checksum?: string;
+    namespace?: string;
+    chunks_count?: number | null;
+    file_size?: number | null;
+    source_id?: string | null;
+    last_seen_at?: string;
+    created_at?: string;
+    metadata?: Record<string, unknown>;
+    [key: string]: unknown;
+};
+type AiSearchItemContentResult = {
+    body: ReadableStream;
+    contentType: string;
+    filename: string;
+    size: number;
+};
+type AiSearchUploadItemOptions = {
+    metadata?: Record<string, unknown>;
+};
+type AiSearchListItemsParams = {
+    page?: number;
+    per_page?: number;
+    /** Search items by key name. */
+    search?: string;
+    /** Sort order for results. */
+    sort_by?: 'status' | 'modified_at';
+    /** Filter items by processing status. */
+    status?: 'queued' | 'running' | 'completed' | 'error' | 'skipped' | 'outdated';
+    /** Filter items by source (e.g. "builtin" or "web-crawler:https://example.com"). */
+    source?: string;
+    /** JSON-encoded Vectorize filter for metadata filtering. */
+    metadata_filter?: string;
+    /** Filter items by their unique ID. Returns at most one item. */
+    item_id?: string;
+    /**
+     * Filter items by their exact key (object key / filename). Keys are unique
+     * per source, so combine with `source` to disambiguate across data sources.
+     */
+    key?: string;
+};
+type AiSearchListItemsResponse = {
+    result: AiSearchItemInfo[];
+    result_info?: {
+        count: number;
+        page: number;
+        per_page: number;
+        total_count: number;
+    };
+};
+// ============ AI Search Item Logs Types ============
+type AiSearchItemLogsParams = {
+    /** Maximum number of log entries to return (1-100, default 50). */
+    limit?: number;
+    /** Opaque cursor for pagination. Pass the `cursor` value from a previous response. */
+    cursor?: string;
+};
+type AiSearchItemLog = {
+    timestamp: string;
+    action: string;
+    message: string;
+    fileKey?: string;
+    chunkCount?: number;
+    processingTimeMs?: number;
+    errorType?: string;
+};
+/** Paginated response for item processing logs (cursor-based). */
+type AiSearchItemLogsResponse = {
+    result: AiSearchItemLog[];
+    result_info: {
+        count: number;
+        per_page: number;
+        cursor: string | null;
+        truncated: boolean;
+    };
+};
+// ============ AI Search Item Chunks Types ============
+type AiSearchItemChunksParams = {
+    /** Maximum number of chunks to return (1-100, default 20). */
+    limit?: number;
+    /** Offset into the chunks list (default 0). */
+    offset?: number;
+};
+/** A single indexed chunk belonging to an item, including its text content and byte range. */
+type AiSearchItemChunk = {
+    id: string;
+    text: string;
+    start_byte: number;
+    end_byte: number;
+    item?: {
+        timestamp?: number;
+        key: string;
+        metadata?: Record<string, unknown>;
+    };
+};
+/** Paginated response for item chunks (offset-based). */
+type AiSearchItemChunksResponse = {
+    result: AiSearchItemChunk[];
+    result_info: {
+        count: number;
+        total: number;
+        limit: number;
+        offset: number;
+    };
+};
+// ============ AI Search Job Types ============
+type AiSearchJobInfo = {
+    id: string;
+    source: 'user' | 'schedule';
+    description?: string;
+    last_seen_at?: string;
+    started_at?: string;
+    ended_at?: string;
+    end_reason?: string;
+};
+type AiSearchJobLog = {
+    id: number;
+    message: string;
+    message_type: number;
+    created_at: number;
+};
+type AiSearchCreateJobParams = {
+    description?: string;
+};
+type AiSearchListJobsParams = {
+    page?: number;
+    per_page?: number;
+};
+type AiSearchListJobsResponse = {
+    result: AiSearchJobInfo[];
+    result_info?: {
+        count: number;
+        page: number;
+        per_page: number;
+        total_count: number;
+    };
+};
+type AiSearchJobLogsParams = {
+    page?: number;
+    per_page?: number;
+};
+type AiSearchJobLogsResponse = {
+    result: AiSearchJobLog[];
+    result_info?: {
+        count: number;
+        page: number;
+        per_page: number;
+        total_count: number;
+    };
+};
+// ============ AI Search Sub-Service Classes ============
+/**
+ * Single item service for an AI Search instance.
+ * Provides info, download, sync, logs, and chunks operations on a specific item.
+ */
+declare abstract class AiSearchItem {
+    /** Get metadata about this item. */
+    info(): Promise<AiSearchItemInfo>;
+    /**
+     * Download the item's content.
+     * @returns Object with body stream, content type, filename, and size.
+     */
+    download(): Promise<AiSearchItemContentResult>;
+    /**
+     * Trigger re-indexing of this item.
+     * @returns The updated item info.
+     */
+    sync(): Promise<AiSearchItemInfo>;
+    /**
+     * Retrieve processing logs for this item (cursor-based pagination).
+     * @param params Optional pagination parameters (limit, cursor).
+     * @returns Paginated log entries for this item.
+     */
+    logs(params?: AiSearchItemLogsParams): Promise<AiSearchItemLogsResponse>;
+    /**
+     * List indexed chunks for this item (offset-based pagination).
+     * @param params Optional pagination parameters (limit, offset).
+     * @returns Paginated chunk entries for this item.
+     */
+    chunks(params?: AiSearchItemChunksParams): Promise<AiSearchItemChunksResponse>;
+}
+/**
+ * Items collection service for an AI Search instance.
+ * Provides list, upload, and access to individual items.
+ */
+declare abstract class AiSearchItems {
+    /** List items in this instance. */
+    list(params?: AiSearchListItemsParams): Promise<AiSearchListItemsResponse>;
+    /**
+     * Upload a file as an item. Behaves as an upsert: if an item with the same
+     * filename already exists, it is overwritten and re-indexed.
+     * @param name Filename for the uploaded item.
+     * @param content File content as a ReadableStream, Blob, or string.
+     * @param options Optional metadata to attach to the item.
+     * @returns The created item info.
+     */
+    upload(name: string, content: ReadableStream | Blob | string, options?: AiSearchUploadItemOptions): Promise<AiSearchItemInfo>;
+    /**
+     * Upload a file and poll until processing completes.
+     * Behaves as an upsert: if an item with the same filename already exists,
+     * it is overwritten and re-indexed.
+     * @param name Filename for the uploaded item.
+     * @param content File content as a ReadableStream, Blob, or string.
+     * @param options Optional metadata and polling configuration.
+     * @returns The item info after processing completes (or timeout).
+     */
+    uploadAndPoll(name: string, content: ReadableStream | Blob | string, options?: AiSearchUploadItemOptions & {
+        /** Polling interval in milliseconds (default 1000). */
+        pollIntervalMs?: number;
+        /** Maximum time to wait in milliseconds (default 30000). */
+        timeoutMs?: number;
+    }): Promise<AiSearchItemInfo>;
+    /**
+     * Get an item by ID.
+     * @param itemId The item identifier.
+     * @returns Item service for info, download, sync, logs, and chunks operations.
+     */
+    get(itemId: string): AiSearchItem;
+    /**
+     * Delete an item from the instance.
+     * @param itemId The item identifier.
+     */
+    delete(itemId: string): Promise<void>;
+}
+/**
+ * Single job service for an AI Search instance.
+ * Provides info, logs, and cancel operations for a specific job.
+ */
+declare abstract class AiSearchJob {
+    /** Get metadata about this job. */
+    info(): Promise<AiSearchJobInfo>;
+    /** Get logs for this job. */
+    logs(params?: AiSearchJobLogsParams): Promise<AiSearchJobLogsResponse>;
+    /**
+     * Cancel a running job.
+     * @returns The updated job info.
+     * @throws AiSearchNotFoundError if the job does not exist.
+     */
+    cancel(): Promise<AiSearchJobInfo>;
+}
+/**
+ * Jobs collection service for an AI Search instance.
+ * Provides list, create, and access to individual jobs.
+ */
+declare abstract class AiSearchJobs {
+    /** List jobs for this instance. */
+    list(params?: AiSearchListJobsParams): Promise<AiSearchListJobsResponse>;
+    /**
+     * Create a new indexing job.
+     * @param params Optional job parameters.
+     * @returns The created job info.
+     */
+    create(params?: AiSearchCreateJobParams): Promise<AiSearchJobInfo>;
+    /**
+     * Get a job by ID.
+     * @param jobId The job identifier.
+     * @returns Job service for info, logs, and cancel operations.
+     */
+    get(jobId: string): AiSearchJob;
+}
+// ============ AI Search Binding Classes ============
+/**
+ * Instance-level AI Search service.
+ *
+ * Used as:
+ * - The return type of `AiSearchNamespace.get(name)` (namespace binding)
+ * - The type of `env.BLOG_SEARCH` (single instance binding via `ai_search`)
+ *
+ * Provides search, chat, update, stats, items, and jobs operations.
+ *
+ * @example
+ * ```ts
+ * // Via namespace binding
+ * const instance = env.AI_SEARCH.get("blog");
+ * const results = await instance.search({
+ *   query: "How does caching work?",
+ * });
+ *
+ * // Via single instance binding
+ * const results = await env.BLOG_SEARCH.search({
+ *   messages: [{ role: "user", content: "How does caching work?" }],
+ * });
+ * ```
+ */
+declare abstract class AiSearchInstance {
+    /**
+     * Search the AI Search instance for relevant chunks.
+     * @param params Search request with query or messages and optional AI search options.
+     * @returns Search response with matching chunks and search query.
+     */
+    search(params: AiSearchSearchRequest): Promise<AiSearchSearchResponse>;
+    /**
+     * Generate chat completions with AI Search context (streaming).
+     * @param params Chat completions request with stream: true.
+     * @returns ReadableStream of server-sent events.
+     */
+    chatCompletions(params: AiSearchChatCompletionsRequest & {
+        stream: true;
+    }): Promise<ReadableStream>;
+    /**
+     * Generate chat completions with AI Search context.
+     * @param params Chat completions request.
+     * @returns Chat completion response with choices and RAG chunks.
+     */
+    chatCompletions(params: AiSearchChatCompletionsRequest): Promise<AiSearchChatCompletionsResponse>;
+    /**
+     * Update the instance configuration.
+     * @param config Partial configuration to update.
+     * @returns Updated instance info.
+     */
+    update(config: Partial<AiSearchConfig>): Promise<AiSearchInstanceInfo>;
+    /** Get metadata about this instance. */
+    info(): Promise<AiSearchInstanceInfo>;
+    /**
+     * Get instance statistics (item count, indexing status, etc.).
+     * @returns Statistics with counts per status, last activity time, and engine details.
+     */
+    stats(): Promise<AiSearchStatsResponse>;
+    /** Items collection — list, upload, and manage items in this instance. */
+    get items(): AiSearchItems;
+    /** Jobs collection — list, create, and inspect indexing jobs. */
+    get jobs(): AiSearchJobs;
+}
+/**
+ * Namespace-level AI Search service.
+ *
+ * Used as the type of `env.AI_SEARCH` (namespace binding via `ai_search_namespaces`).
+ * Scoped to a single namespace. Provides dynamic instance access, creation, deletion,
+ * and multi-instance search/chat operations.
+ *
+ * @example
+ * ```ts
+ * // Access an instance within the namespace
+ * const blog = env.AI_SEARCH.get("blog");
+ * const results = await blog.search({ query: "How does caching work?" });
+ *
+ * // List all instances in the namespace
+ * const instances = await env.AI_SEARCH.list();
+ *
+ * // Create a new instance with built-in storage
+ * const tenant = await env.AI_SEARCH.create({ id: "tenant-123" });
+ *
+ * // Upload items into the instance
+ * await tenant.items.upload("doc.pdf", fileContent);
+ *
+ * // Search across multiple instances
+ * const multi = await env.AI_SEARCH.search({
+ *   query: "caching",
+ *   ai_search_options: { instance_ids: ["blog", "docs"] },
+ * });
+ *
+ * // Delete an instance
+ * await env.AI_SEARCH.delete("tenant-123");
+ * ```
+ */
+declare abstract class AiSearchNamespace {
+    /**
+     * Get an instance by name within the bound namespace.
+     * @param name Instance name.
+     * @returns Instance service for search, chat, update, stats, items, and jobs.
+     */
+    get(name: string): AiSearchInstance;
+    /**
+     * List instances in the bound namespace.
+     * @param params Optional pagination, search, and ordering parameters.
+     * @returns Array of instance metadata with pagination info.
+     */
+    list(params?: AiSearchListInstancesParams): Promise<AiSearchListResponse>;
+    /**
+     * Create a new instance within the bound namespace.
+     * @param config Instance configuration. Only `id` is required — omit `type` and `source` to create with built-in storage.
+     * @returns Instance service for the newly created instance.
+     *
+     * @example
+     * ```ts
+     * // Create with built-in storage (upload items manually)
+     * const instance = await env.AI_SEARCH.create({ id: "my-search" });
+     *
+     * // Create with web crawler source
+     * const instance = await env.AI_SEARCH.create({
+     *   id: "docs-search",
+     *   type: "web-crawler",
+     *   source: "https://developers.cloudflare.com",
+     * });
+     * ```
+     */
+    create(config: AiSearchConfig): Promise<AiSearchInstance>;
+    /**
+     * Delete an instance from the bound namespace.
+     * @param name Instance name to delete.
+     */
+    delete(name: string): Promise<void>;
+    /**
+     * Search across multiple instances within the bound namespace.
+     * Fans out to the specified instance_ids and merges results.
+     * @param params Search request with required `ai_search_options.instance_ids`.
+     * @returns Search response with chunks tagged by instance_id and optional partial-failure errors.
+     */
+    search(params: AiSearchMultiSearchRequest): Promise<AiSearchMultiSearchResponse>;
+    /**
+     * Generate chat completions across multiple instances within the bound namespace (streaming).
+     * Fans out to the specified instance_ids, merges context, and generates a response.
+     * @param params Chat completions request with stream: true and required `ai_search_options.instance_ids`.
+     * @returns ReadableStream of server-sent events.
+     */
+    chatCompletions(params: AiSearchMultiChatCompletionsRequest & {
+        stream: true;
+    }): Promise<ReadableStream>;
+    /**
+     * Generate chat completions across multiple instances within the bound namespace.
+     * Fans out to the specified instance_ids, merges context, and generates a response.
+     * @param params Chat completions request with required `ai_search_options.instance_ids`.
+     * @returns Chat completion response with choices, chunks tagged by instance_id, and optional partial-failure errors.
+     */
+    chatCompletions(params: AiSearchMultiChatCompletionsRequest): Promise<AiSearchMultiChatCompletionsResponse>;
+}
+type AiImageClassificationInput = {
+    image: number[];
+};
+type AiImageClassificationOutput = {
+    score?: number;
+    label?: string;
+}[];
+declare abstract class BaseAiImageClassification {
+    inputs: AiImageClassificationInput;
+    postProcessedOutputs: AiImageClassificationOutput;
+}
+type AiImageToTextInput = {
+    image: number[];
+    prompt?: string;
+    max_tokens?: number;
+    temperature?: number;
+    top_p?: number;
+    top_k?: number;
+    seed?: number;
+    repetition_penalty?: number;
+    frequency_penalty?: number;
+    presence_penalty?: number;
+    raw?: boolean;
+    messages?: RoleScopedChatInput[];
+};
+type AiImageToTextOutput = {
+    description: string;
+};
+declare abstract class BaseAiImageToText {
+    inputs: AiImageToTextInput;
+    postProcessedOutputs: AiImageToTextOutput;
+}
+type AiImageTextToTextInput = {
+    image: string;
+    prompt?: string;
+    max_tokens?: number;
+    temperature?: number;
+    ignore_eos?: boolean;
+    top_p?: number;
+    top_k?: number;
+    seed?: number;
+    repetition_penalty?: number;
+    frequency_penalty?: number;
+    presence_penalty?: number;
+    raw?: boolean;
+    messages?: RoleScopedChatInput[];
+};
+type AiImageTextToTextOutput = {
+    description: string;
+};
+declare abstract class BaseAiImageTextToText {
+    inputs: AiImageTextToTextInput;
+    postProcessedOutputs: AiImageTextToTextOutput;
+}
+type AiMultimodalEmbeddingsInput = {
+    image: string;
+    text: string[];
+};
+type AiIMultimodalEmbeddingsOutput = {
+    data: number[][];
+    shape: number[];
+};
+declare abstract class BaseAiMultimodalEmbeddings {
+    inputs: AiImageTextToTextInput;
+    postProcessedOutputs: AiImageTextToTextOutput;
+}
+type AiObjectDetectionInput = {
+    image: number[];
+};
+type AiObjectDetectionOutput = {
+    score?: number;
+    label?: string;
+}[];
+declare abstract class BaseAiObjectDetection {
+    inputs: AiObjectDetectionInput;
+    postProcessedOutputs: AiObjectDetectionOutput;
+}
+type AiSentenceSimilarityInput = {
+    source: string;
+    sentences: string[];
+};
+type AiSentenceSimilarityOutput = number[];
+declare abstract class BaseAiSentenceSimilarity {
+    inputs: AiSentenceSimilarityInput;
+    postProcessedOutputs: AiSentenceSimilarityOutput;
+}
+type AiAutomaticSpeechRecognitionInput = {
+    audio: number[];
+};
+type AiAutomaticSpeechRecognitionOutput = {
+    text?: string;
+    words?: {
+        word: string;
+        start: number;
+        end: number;
+    }[];
+    vtt?: string;
+};
+declare abstract class BaseAiAutomaticSpeechRecognition {
+    inputs: AiAutomaticSpeechRecognitionInput;
+    postProcessedOutputs: AiAutomaticSpeechRecognitionOutput;
+}
+type AiSummarizationInput = {
+    input_text: string;
+    max_length?: number;
+};
+type AiSummarizationOutput = {
+    summary: string;
+};
+declare abstract class BaseAiSummarization {
+    inputs: AiSummarizationInput;
+    postProcessedOutputs: AiSummarizationOutput;
+}
+type AiTextClassificationInput = {
+    text: string;
+};
+type AiTextClassificationOutput = {
+    score?: number;
+    label?: string;
+}[];
+declare abstract class BaseAiTextClassification {
+    inputs: AiTextClassificationInput;
+    postProcessedOutputs: AiTextClassificationOutput;
+}
+type AiTextEmbeddingsInput = {
+    text: string | string[];
+};
+type AiTextEmbeddingsOutput = {
+    shape: number[];
+    data: number[][];
+};
+declare abstract class BaseAiTextEmbeddings {
+    inputs: AiTextEmbeddingsInput;
+    postProcessedOutputs: AiTextEmbeddingsOutput;
+}
+type RoleScopedChatInput = {
+    role: "user" | "assistant" | "system" | "tool" | (string & NonNullable<unknown>);
+    content: string;
+    name?: string;
+};
+type AiTextGenerationToolLegacyInput = {
+    name: string;
+    description: string;
+    parameters?: {
+        type: "object" | (string & NonNullable<unknown>);
+        properties: {
+            [key: string]: {
+                type: string;
+                description?: string;
+            };
+        };
+        required: string[];
+    };
+};
+type AiTextGenerationToolInput = {
+    type: "function" | (string & NonNullable<unknown>);
+    function: {
+        name: string;
+        description: string;
+        parameters?: {
+            type: "object" | (string & NonNullable<unknown>);
+            properties: {
+                [key: string]: {
+                    type: string;
+                    description?: string;
+                };
+            };
+            required: string[];
+        };
+    };
+};
+type AiTextGenerationFunctionsInput = {
+    name: string;
+    code: string;
+};
+type AiTextGenerationResponseFormat = {
+    type: string;
+    json_schema?: any;
+};
+type AiTextGenerationInput = {
+    prompt?: string;
+    raw?: boolean;
+    stream?: boolean;
+    max_tokens?: number;
+    temperature?: number;
+    top_p?: number;
+    top_k?: number;
+    seed?: number;
+    repetition_penalty?: number;
+    frequency_penalty?: number;
+    presence_penalty?: number;
+    messages?: RoleScopedChatInput[];
+    response_format?: AiTextGenerationResponseFormat;
+    tools?: AiTextGenerationToolInput[] | AiTextGenerationToolLegacyInput[] | (object & NonNullable<unknown>);
+    functions?: AiTextGenerationFunctionsInput[];
+};
+type AiTextGenerationToolLegacyOutput = {
+    name: string;
+    arguments: unknown;
+};
+type AiTextGenerationToolOutput = {
+    id: string;
+    type: "function";
+    function: {
+        name: string;
+        arguments: string;
+    };
+};
+type UsageTags = {
+    prompt_tokens: number;
+    completion_tokens: number;
+    total_tokens: number;
+};
+type AiTextGenerationOutput = {
+    response?: string;
+    tool_calls?: AiTextGenerationToolLegacyOutput[] & AiTextGenerationToolOutput[];
+    usage?: UsageTags;
+};
+declare abstract class BaseAiTextGeneration {
+    inputs: AiTextGenerationInput;
+    postProcessedOutputs: AiTextGenerationOutput;
+}
+type AiTextToSpeechInput = {
+    prompt: string;
+    lang?: string;
+};
+type AiTextToSpeechOutput = Uint8Array | {
+    audio: string;
+};
+declare abstract class BaseAiTextToSpeech {
+    inputs: AiTextToSpeechInput;
+    postProcessedOutputs: AiTextToSpeechOutput;
+}
+type AiTextToImageInput = {
+    prompt: string;
+    negative_prompt?: string;
+    height?: number;
+    width?: number;
+    image?: number[];
+    image_b64?: string;
+    mask?: number[];
+    num_steps?: number;
+    strength?: number;
+    guidance?: number;
+    seed?: number;
+};
+type AiTextToImageOutput = ReadableStream<Uint8Array>;
+declare abstract class BaseAiTextToImage {
+    inputs: AiTextToImageInput;
+    postProcessedOutputs: AiTextToImageOutput;
+}
+type AiTranslationInput = {
+    text: string;
+    target_lang: string;
+    source_lang?: string;
+};
+type AiTranslationOutput = {
+    translated_text?: string;
+};
+declare abstract class BaseAiTranslation {
+    inputs: AiTranslationInput;
+    postProcessedOutputs: AiTranslationOutput;
+}
+/**
+ * Workers AI support for OpenAI's Chat Completions API
+ */
+type ChatCompletionContentPartText = {
+    type: "text";
+    text: string;
+};
+type ChatCompletionContentPartImage = {
+    type: "image_url";
+    image_url: {
+        url: string;
+        detail?: "auto" | "low" | "high";
+    };
+};
+type ChatCompletionContentPartInputAudio = {
+    type: "input_audio";
+    input_audio: {
+        /** Base64 encoded audio data. */
+        data: string;
+        format: "wav" | "mp3";
+    };
+};
+type ChatCompletionContentPartFile = {
+    type: "file";
+    file: {
+        /** Base64 encoded file data. */
+        file_data?: string;
+        /** The ID of an uploaded file. */
+        file_id?: string;
+        filename?: string;
+    };
+};
+type ChatCompletionContentPartRefusal = {
+    type: "refusal";
+    refusal: string;
+};
+type ChatCompletionContentPart = ChatCompletionContentPartText | ChatCompletionContentPartImage | ChatCompletionContentPartInputAudio | ChatCompletionContentPartFile;
+type FunctionDefinition = {
+    name: string;
+    description?: string;
+    parameters?: Record<string, unknown>;
+    strict?: boolean | null;
+};
+type ChatCompletionFunctionTool = {
+    type: "function";
+    function: FunctionDefinition;
+};
+type ChatCompletionCustomToolGrammarFormat = {
+    type: "grammar";
+    grammar: {
+        definition: string;
+        syntax: "lark" | "regex";
+    };
+};
+type ChatCompletionCustomToolTextFormat = {
+    type: "text";
+};
+type ChatCompletionCustomToolFormat = ChatCompletionCustomToolTextFormat | ChatCompletionCustomToolGrammarFormat;
+type ChatCompletionCustomTool = {
+    type: "custom";
+    custom: {
+        name: string;
+        description?: string;
+        format?: ChatCompletionCustomToolFormat;
+    };
+};
+type ChatCompletionTool = ChatCompletionFunctionTool | ChatCompletionCustomTool;
+type ChatCompletionMessageFunctionToolCall = {
+    id: string;
+    type: "function";
+    function: {
+        name: string;
+        /** JSON-encoded arguments string. */
+        arguments: string;
+    };
+};
+type ChatCompletionMessageCustomToolCall = {
+    id: string;
+    type: "custom";
+    custom: {
+        name: string;
+        input: string;
+    };
+};
+type ChatCompletionMessageToolCall = ChatCompletionMessageFunctionToolCall | ChatCompletionMessageCustomToolCall;
+type ChatCompletionToolChoiceFunction = {
+    type: "function";
+    function: {
+        name: string;
+    };
+};
+type ChatCompletionToolChoiceCustom = {
+    type: "custom";
+    custom: {
+        name: string;
+    };
+};
+type ChatCompletionToolChoiceAllowedTools = {
+    type: "allowed_tools";
+    allowed_tools: {
+        mode: "auto" | "required";
+        tools: Array<Record<string, unknown>>;
+    };
+};
+type ChatCompletionToolChoiceOption = "none" | "auto" | "required" | ChatCompletionToolChoiceFunction | ChatCompletionToolChoiceCustom | ChatCompletionToolChoiceAllowedTools;
+type DeveloperMessage = {
+    role: "developer";
+    content: string | Array<{
+        type: "text";
+        text: string;
+    }>;
+    name?: string;
+};
+type SystemMessage = {
+    role: "system";
+    content: string | Array<{
+        type: "text";
+        text: string;
+    }>;
+    name?: string;
+};
+/**
+ * Permissive merged content part used inside UserMessage arrays.
+ *
+ * Cabidela has a limitation where anyOf/oneOf with enum-based discrimination
+ * inside nested array items does not correctly match different branches for
+ * different array elements, so the schema uses a single merged object.
+ */
+type UserMessageContentPart = {
+    type: "text" | "image_url" | "input_audio" | "file";
+    text?: string;
+    image_url?: {
+        url?: string;
+        detail?: "auto" | "low" | "high";
+    };
+    input_audio?: {
+        data?: string;
+        format?: "wav" | "mp3";
+    };
+    file?: {
+        file_data?: string;
+        file_id?: string;
+        filename?: string;
+    };
+};
+type UserMessage = {
+    role: "user";
+    content: string | Array<UserMessageContentPart>;
+    name?: string;
+};
+type AssistantMessageContentPart = {
+    type: "text" | "refusal";
+    text?: string;
+    refusal?: string;
+};
+type AssistantMessage = {
+    role: "assistant";
+    content?: string | null | Array<AssistantMessageContentPart>;
+    refusal?: string | null;
+    name?: string;
+    audio?: {
+        id: string;
+    };
+    tool_calls?: Array<ChatCompletionMessageToolCall>;
+    function_call?: {
+        name: string;
+        arguments: string;
+    };
+};
+type ToolMessage = {
+    role: "tool";
+    content: string | Array<{
+        type: "text";
+        text: string;
+    }>;
+    tool_call_id: string;
+};
+type FunctionMessage = {
+    role: "function";
+    content: string;
+    name: string;
+};
+type ChatCompletionMessageParam = DeveloperMessage | SystemMessage | UserMessage | AssistantMessage | ToolMessage | FunctionMessage;
+type ChatCompletionsResponseFormatText = {
+    type: "text";
+};
+type ChatCompletionsResponseFormatJSONObject = {
+    type: "json_object";
+};
+type ResponseFormatJSONSchema = {
+    type: "json_schema";
+    json_schema: {
+        name: string;
+        description?: string;
+        schema?: Record<string, unknown>;
+        strict?: boolean | null;
+    };
+};
+type ResponseFormat = ChatCompletionsResponseFormatText | ChatCompletionsResponseFormatJSONObject | ResponseFormatJSONSchema;
+type ChatCompletionsStreamOptions = {
+    include_usage?: boolean;
+    include_obfuscation?: boolean;
+};
+type PredictionContent = {
+    type: "content";
+    content: string | Array<{
+        type: "text";
+        text: string;
+    }>;
+};
+type AudioParams = {
+    voice: string | {
+        id: string;
+    };
+    format: "wav" | "aac" | "mp3" | "flac" | "opus" | "pcm16";
+};
+type WebSearchUserLocation = {
+    type: "approximate";
+    approximate: {
+        city?: string;
+        country?: string;
+        region?: string;
+        timezone?: string;
+    };
+};
+type WebSearchOptions = {
+    search_context_size?: "low" | "medium" | "high";
+    user_location?: WebSearchUserLocation;
+};
+type ChatTemplateKwargs = {
+    /** Whether to enable reasoning, enabled by default. */
+    enable_thinking?: boolean;
+    /** If false, preserves reasoning context between turns. */
+    clear_thinking?: boolean;
+};
+/** Shared optional properties used by both Prompt and Messages input branches. */
+type ChatCompletionsCommonOptions = {
+    model?: string;
+    audio?: AudioParams;
+    frequency_penalty?: number | null;
+    logit_bias?: Record<string, unknown> | null;
+    logprobs?: boolean | null;
+    top_logprobs?: number | null;
+    max_tokens?: number | null;
+    max_completion_tokens?: number | null;
+    metadata?: Record<string, unknown> | null;
+    modalities?: Array<"text" | "audio"> | null;
+    n?: number | null;
+    parallel_tool_calls?: boolean;
+    prediction?: PredictionContent;
+    presence_penalty?: number | null;
+    reasoning_effort?: "low" | "medium" | "high" | null;
+    chat_template_kwargs?: ChatTemplateKwargs;
+    response_format?: ResponseFormat;
+    seed?: number | null;
+    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | null;
+    stop?: string | Array<string> | null;
+    store?: boolean | null;
+    stream?: boolean | null;
+    stream_options?: ChatCompletionsStreamOptions;
+    temperature?: number | null;
+    tool_choice?: ChatCompletionToolChoiceOption;
+    tools?: Array<ChatCompletionTool>;
+    top_p?: number | null;
+    user?: string;
+    web_search_options?: WebSearchOptions;
+    function_call?: "none" | "auto" | {
+        name: string;
+    };
+    functions?: Array<FunctionDefinition>;
+};
+type PromptTokensDetails = {
+    cached_tokens?: number;
+    audio_tokens?: number;
+};
+type CompletionTokensDetails = {
+    reasoning_tokens?: number;
+    audio_tokens?: number;
+    accepted_prediction_tokens?: number;
+    rejected_prediction_tokens?: number;
+};
+type CompletionUsage = {
+    prompt_tokens: number;
+    completion_tokens: number;
+    total_tokens: number;
+    prompt_tokens_details?: PromptTokensDetails;
+    completion_tokens_details?: CompletionTokensDetails;
+};
+type ChatCompletionTopLogprob = {
+    token: string;
+    logprob: number;
+    bytes: Array<number> | null;
+};
+type ChatCompletionTokenLogprob = {
+    token: string;
+    logprob: number;
+    bytes: Array<number> | null;
+    top_logprobs: Array<ChatCompletionTopLogprob>;
+};
+type ChatCompletionAudio = {
+    id: string;
+    /** Base64 encoded audio bytes. */
+    data: string;
+    expires_at: number;
+    transcript: string;
+};
+type ChatCompletionUrlCitation = {
+    type: "url_citation";
+    url_citation: {
+        url: string;
+        title: string;
+        start_index: number;
+        end_index: number;
+    };
+};
+type ChatCompletionResponseMessage = {
+    role: "assistant";
+    content: string | null;
+    refusal: string | null;
+    annotations?: Array<ChatCompletionUrlCitation>;
+    audio?: ChatCompletionAudio;
+    tool_calls?: Array<ChatCompletionMessageToolCall>;
+    function_call?: {
+        name: string;
+        arguments: string;
+    } | null;
+};
+type ChatCompletionLogprobs = {
+    content: Array<ChatCompletionTokenLogprob> | null;
+    refusal?: Array<ChatCompletionTokenLogprob> | null;
+};
+type ChatCompletionChoice = {
+    index: number;
+    message: ChatCompletionResponseMessage;
+    finish_reason: "stop" | "length" | "tool_calls" | "content_filter" | "function_call";
+    logprobs: ChatCompletionLogprobs | null;
+};
+type ChatCompletionsMessagesInput = {
+    messages: Array<ChatCompletionMessageParam>;
+} & ChatCompletionsCommonOptions;
+type ChatCompletionsOutput = {
+    id: string;
+    object: string;
+    created: number;
+    model: string;
+    choices: Array<ChatCompletionChoice>;
+    usage?: CompletionUsage;
+    system_fingerprint?: string | null;
+    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | null;
+};
+/**
+ * Workers AI support for OpenAI's Responses API
+ * Reference: https://github.com/openai/openai-node/blob/master/src/resources/responses/responses.ts
+ *
+ * It's a stripped down version from its source.
+ * It currently supports basic function calling, json mode and accepts images as input.
+ *
+ * It does not include types for WebSearch, CodeInterpreter, FileInputs, MCP, CustomTools.
+ * We plan to add those incrementally as model + platform capabilities evolve.
+ */
+type ResponsesInput = {
+    background?: boolean | null;
+    conversation?: string | ResponseConversationParam | null;
+    include?: Array<ResponseIncludable> | null;
+    input?: string | ResponseInput;
+    instructions?: string | null;
+    max_output_tokens?: number | null;
+    parallel_tool_calls?: boolean | null;
+    previous_response_id?: string | null;
+    prompt_cache_key?: string;
+    reasoning?: Reasoning | null;
+    safety_identifier?: string;
+    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | null;
+    stream?: boolean | null;
+    stream_options?: StreamOptions | null;
+    temperature?: number | null;
+    text?: ResponseTextConfig;
+    tool_choice?: ToolChoiceOptions | ToolChoiceFunction;
+    tools?: Array<Tool>;
+    top_p?: number | null;
+    truncation?: "auto" | "disabled" | null;
+};
+type ResponsesOutput = {
+    id?: string;
+    created_at?: number;
+    output_text?: string;
+    error?: ResponseError | null;
+    incomplete_details?: ResponseIncompleteDetails | null;
+    instructions?: string | Array<ResponseInputItem> | null;
+    object?: "response";
+    output?: Array<ResponseOutputItem>;
+    parallel_tool_calls?: boolean;
+    temperature?: number | null;
+    tool_choice?: ToolChoiceOptions | ToolChoiceFunction;
+    tools?: Array<Tool>;
+    top_p?: number | null;
+    max_output_tokens?: number | null;
+    previous_response_id?: string | null;
+    prompt?: ResponsePrompt | null;
+    reasoning?: Reasoning | null;
+    safety_identifier?: string;
+    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | null;
+    status?: ResponseStatus;
+    text?: ResponseTextConfig;
+    truncation?: "auto" | "disabled" | null;
+    usage?: ResponseUsage;
+};
+type EasyInputMessage = {
+    content: string | ResponseInputMessageContentList;
+    role: "user" | "assistant" | "system" | "developer";
+    type?: "message";
+};
+type ResponsesFunctionTool = {
+    name: string;
+    parameters: {
+        [key: string]: unknown;
+    } | null;
+    strict: boolean | null;
+    type: "function";
+    description?: string | null;
+};
+type ResponseIncompleteDetails = {
+    reason?: "max_output_tokens" | "content_filter";
+};
+type ResponsePrompt = {
+    id: string;
+    variables?: {
+        [key: string]: string | ResponseInputText | ResponseInputImage;
+    } | null;
+    version?: string | null;
+};
+type Reasoning = {
+    effort?: ReasoningEffort | null;
+    generate_summary?: "auto" | "concise" | "detailed" | null;
+    summary?: "auto" | "concise" | "detailed" | null;
+};
+type ResponseContent = ResponseInputText | ResponseInputImage | ResponseOutputText | ResponseOutputRefusal | ResponseContentReasoningText;
+type ResponseContentReasoningText = {
+    text: string;
+    type: "reasoning_text";
+};
+type ResponseConversationParam = {
+    id: string;
+};
+type ResponseCreatedEvent = {
+    response: Response;
+    sequence_number: number;
+    type: "response.created";
+};
+type ResponseCustomToolCallOutput = {
+    call_id: string;
+    output: string | Array<ResponseInputText | ResponseInputImage>;
+    type: "custom_tool_call_output";
+    id?: string;
+};
+type ResponseError = {
+    code: "server_error" | "rate_limit_exceeded" | "invalid_prompt" | "vector_store_timeout" | "invalid_image" | "invalid_image_format" | "invalid_base64_image" | "invalid_image_url" | "image_too_large" | "image_too_small" | "image_parse_error" | "image_content_policy_violation" | "invalid_image_mode" | "image_file_too_large" | "unsupported_image_media_type" | "empty_image_file" | "failed_to_download_image" | "image_file_not_found";
+    message: string;
+};
+type ResponseErrorEvent = {
+    code: string | null;
+    message: string;
+    param: string | null;
+    sequence_number: number;
+    type: "error";
+};
+type ResponseFailedEvent = {
+    response: Response;
+    sequence_number: number;
+    type: "response.failed";
+};
+type ResponseFormatText = {
+    type: "text";
+};
+type ResponseFormatJSONObject = {
+    type: "json_object";
+};
+type ResponseFormatTextConfig = ResponseFormatText | ResponseFormatTextJSONSchemaConfig | ResponseFormatJSONObject;
+type ResponseFormatTextJSONSchemaConfig = {
+    name: string;
+    schema: {
+        [key: string]: unknown;
+    };
+    type: "json_schema";
+    description?: string;
+    strict?: boolean | null;
+};
+type ResponseFunctionCallArgumentsDeltaEvent = {
+    delta: string;
+    item_id: string;
+    output_index: number;
+    sequence_number: number;
+    type: "response.function_call_arguments.delta";
+};
+type ResponseFunctionCallArgumentsDoneEvent = {
+    arguments: string;
+    item_id: string;
+    name: string;
+    output_index: number;
+    sequence_number: number;
+    type: "response.function_call_arguments.done";
+};
+type ResponseFunctionCallOutputItem = ResponseInputTextContent | ResponseInputImageContent;
+type ResponseFunctionCallOutputItemList = Array<ResponseFunctionCallOutputItem>;
+type ResponseFunctionToolCall = {
+    arguments: string;
+    call_id: string;
+    name: string;
+    type: "function_call";
+    id?: string;
+    status?: "in_progress" | "completed" | "incomplete";
+};
+interface ResponseFunctionToolCallItem extends ResponseFunctionToolCall {
+    id: string;
+}
+type ResponseFunctionToolCallOutputItem = {
+    id: string;
+    call_id: string;
+    output: string | Array<ResponseInputText | ResponseInputImage>;
+    type: "function_call_output";
+    status?: "in_progress" | "completed" | "incomplete";
+};
+type ResponseIncludable = "message.input_image.image_url" | "message.output_text.logprobs";
+type ResponseIncompleteEvent = {
+    response: Response;
+    sequence_number: number;
+    type: "response.incomplete";
+};
+type ResponseInput = Array<ResponseInputItem>;
+type ResponseInputContent = ResponseInputText | ResponseInputImage;
+type ResponseInputImage = {
+    detail: "low" | "high" | "auto";
+    type: "input_image";
+    /**
+     * Base64 encoded image
+     */
+    image_url?: string | null;
+};
+type ResponseInputImageContent = {
+    type: "input_image";
+    detail?: "low" | "high" | "auto" | null;
+    /**
+     * Base64 encoded image
+     */
+    image_url?: string | null;
+};
+type ResponseInputItem = EasyInputMessage | ResponseInputItemMessage | ResponseOutputMessage | ResponseFunctionToolCall | ResponseInputItemFunctionCallOutput | ResponseReasoningItem;
+type ResponseInputItemFunctionCallOutput = {
+    call_id: string;
+    output: string | ResponseFunctionCallOutputItemList;
+    type: "function_call_output";
+    id?: string | null;
+    status?: "in_progress" | "completed" | "incomplete" | null;
+};
+type ResponseInputItemMessage = {
+    content: ResponseInputMessageContentList;
+    role: "user" | "system" | "developer";
+    status?: "in_progress" | "completed" | "incomplete";
+    type?: "message";
+};
+type ResponseInputMessageContentList = Array<ResponseInputContent>;
+type ResponseInputMessageItem = {
+    id: string;
+    content: ResponseInputMessageContentList;
+    role: "user" | "system" | "developer";
+    status?: "in_progress" | "completed" | "incomplete";
+    type?: "message";
+};
+type ResponseInputText = {
+    text: string;
+    type: "input_text";
+};
+type ResponseInputTextContent = {
+    text: string;
+    type: "input_text";
+};
+type ResponseItem = ResponseInputMessageItem | ResponseOutputMessage | ResponseFunctionToolCallItem | ResponseFunctionToolCallOutputItem;
+type ResponseOutputItem = ResponseOutputMessage | ResponseFunctionToolCall | ResponseReasoningItem;
+type ResponseOutputItemAddedEvent = {
+    item: ResponseOutputItem;
+    output_index: number;
+    sequence_number: number;
+    type: "response.output_item.added";
+};
+type ResponseOutputItemDoneEvent = {
+    item: ResponseOutputItem;
+    output_index: number;
+    sequence_number: number;
+    type: "response.output_item.done";
+};
+type ResponseOutputMessage = {
+    id: string;
+    content: Array<ResponseOutputText | ResponseOutputRefusal>;
+    role: "assistant";
+    status: "in_progress" | "completed" | "incomplete";
+    type: "message";
+};
+type ResponseOutputRefusal = {
+    refusal: string;
+    type: "refusal";
+};
+type ResponseOutputText = {
+    text: string;
+    type: "output_text";
+    logprobs?: Array<Logprob>;
+};
+type ResponseReasoningItem = {
+    id: string;
+    summary: Array<ResponseReasoningSummaryItem>;
+    type: "reasoning";
+    content?: Array<ResponseReasoningContentItem>;
+    encrypted_content?: string | null;
+    status?: "in_progress" | "completed" | "incomplete";
+};
+type ResponseReasoningSummaryItem = {
+    text: string;
+    type: "summary_text";
+};
+type ResponseReasoningContentItem = {
+    text: string;
+    type: "reasoning_text";
+};
+type ResponseReasoningTextDeltaEvent = {
+    content_index: number;
+    delta: string;
+    item_id: string;
+    output_index: number;
+    sequence_number: number;
+    type: "response.reasoning_text.delta";
+};
+type ResponseReasoningTextDoneEvent = {
+    content_index: number;
+    item_id: string;
+    output_index: number;
+    sequence_number: number;
+    text: string;
+    type: "response.reasoning_text.done";
+};
+type ResponseRefusalDeltaEvent = {
+    content_index: number;
+    delta: string;
+    item_id: string;
+    output_index: number;
+    sequence_number: number;
+    type: "response.refusal.delta";
+};
+type ResponseRefusalDoneEvent = {
+    content_index: number;
+    item_id: string;
+    output_index: number;
+    refusal: string;
+    sequence_number: number;
+    type: "response.refusal.done";
+};
+type ResponseStatus = "completed" | "failed" | "in_progress" | "cancelled" | "queued" | "incomplete";
+type ResponseStreamEvent = ResponseCompletedEvent | ResponseCreatedEvent | ResponseErrorEvent | ResponseFunctionCallArgumentsDeltaEvent | ResponseFunctionCallArgumentsDoneEvent | ResponseFailedEvent | ResponseIncompleteEvent | ResponseOutputItemAddedEvent | ResponseOutputItemDoneEvent | ResponseReasoningTextDeltaEvent | ResponseReasoningTextDoneEvent | ResponseRefusalDeltaEvent | ResponseRefusalDoneEvent | ResponseTextDeltaEvent | ResponseTextDoneEvent;
+type ResponseCompletedEvent = {
+    response: Response;
+    sequence_number: number;
+    type: "response.completed";
+};
+type ResponseTextConfig = {
+    format?: ResponseFormatTextConfig;
+    verbosity?: "low" | "medium" | "high" | null;
+};
+type ResponseTextDeltaEvent = {
+    content_index: number;
+    delta: string;
+    item_id: string;
+    logprobs: Array<Logprob>;
+    output_index: number;
+    sequence_number: number;
+    type: "response.output_text.delta";
+};
+type ResponseTextDoneEvent = {
+    content_index: number;
+    item_id: string;
+    logprobs: Array<Logprob>;
+    output_index: number;
+    sequence_number: number;
+    text: string;
+    type: "response.output_text.done";
+};
+type Logprob = {
+    token: string;
+    logprob: number;
+    top_logprobs?: Array<TopLogprob>;
+};
+type TopLogprob = {
+    token?: string;
+    logprob?: number;
+};
+type ResponseUsage = {
+    input_tokens: number;
+    output_tokens: number;
+    total_tokens: number;
+};
+type Tool = ResponsesFunctionTool;
+type ToolChoiceFunction = {
+    name: string;
+    type: "function";
+};
+type ToolChoiceOptions = "none";
+type ReasoningEffort = "minimal" | "low" | "medium" | "high" | null;
+type StreamOptions = {
+    include_obfuscation?: boolean;
+};
+/** Marks keys from T that aren't in U as optional never */
+type Without<T, U> = {
+    [P in Exclude<keyof T, keyof U>]?: never;
+};
+/** Either T or U, but not both (mutually exclusive) */
+type XOR<T, U> = (T & Without<U, T>) | (U & Without<T, U>);
+type Ai_Cf_Baai_Bge_Base_En_V1_5_Input = {
+    text: string | string[];
+    /**
+     * The pooling method used in the embedding process. `cls` pooling will generate more accurate embeddings on larger inputs - however, embeddings created with cls pooling are not compatible with embeddings generated with mean pooling. The default pooling method is `mean` in order for this to not be a breaking change, but we highly suggest using the new `cls` pooling for better accuracy.
+     */
+    pooling?: "mean" | "cls";
+} | {
+    /**
+     * Batch of the embeddings requests to run using async-queue
+     */
+    requests: {
+        text: string | string[];
+        /**
+         * The pooling method used in the embedding process. `cls` pooling will generate more accurate embeddings on larger inputs - however, embeddings created with cls pooling are not compatible with embeddings generated with mean pooling. The default pooling method is `mean` in order for this to not be a breaking change, but we highly suggest using the new `cls` pooling for better accuracy.
+         */
+        pooling?: "mean" | "cls";
+    }[];
+};
+type Ai_Cf_Baai_Bge_Base_En_V1_5_Output = {
+    shape?: number[];
+    /**
+     * Embeddings of the requested text values
+     */
+    data?: number[][];
+    /**
+     * The pooling method used in the embedding process.
+     */
+    pooling?: "mean" | "cls";
+} | Ai_Cf_Baai_Bge_Base_En_V1_5_AsyncResponse;
+interface Ai_Cf_Baai_Bge_Base_En_V1_5_AsyncResponse {
+    /**
+     * The async request id that can be used to obtain the results.
+     */
+    request_id?: string;
+}
+declare abstract class Base_Ai_Cf_Baai_Bge_Base_En_V1_5 {
+    inputs: Ai_Cf_Baai_Bge_Base_En_V1_5_Input;
+    postProcessedOutputs: Ai_Cf_Baai_Bge_Base_En_V1_5_Output;
+}
+type Ai_Cf_Openai_Whisper_Input = string | {
+    /**
+     * An array of integers that represent the audio data constrained to 8-bit unsigned integer values
+     */
+    audio: number[];
+};
+interface Ai_Cf_Openai_Whisper_Output {
+    /**
+     * The transcription
+     */
+    text: string;
+    word_count?: number;
+    words?: {
+        word?: string;
+        /**
+         * The second this word begins in the recording
+         */
+        start?: number;
+        /**
+         * The ending second when the word completes
+         */
+        end?: number;
+    }[];
+    vtt?: string;
+}
+declare abstract class Base_Ai_Cf_Openai_Whisper {
+    inputs: Ai_Cf_Openai_Whisper_Input;
+    postProcessedOutputs: Ai_Cf_Openai_Whisper_Output;
+}
+type Ai_Cf_Meta_M2M100_1_2B_Input = {
+    /**
+     * The text to be translated
+     */
+    text: string;
+    /**
+     * The language code of the source text (e.g., 'en' for English). Defaults to 'en' if not specified
+     */
+    source_lang?: string;
+    /**
+     * The language code to translate the text into (e.g., 'es' for Spanish)
+     */
+    target_lang: string;
+} | {
+    /**
+     * Batch of the embeddings requests to run using async-queue
+     */
+    requests: {
+        /**
+         * The text to be translated
+         */
+        text: string;
+        /**
+         * The language code of the source text (e.g., 'en' for English). Defaults to 'en' if not specified
+         */
+        source_lang?: string;
+        /**
+         * The language code to translate the text into (e.g., 'es' for Spanish)
+         */
+        target_lang: string;
+    }[];
+};
+type Ai_Cf_Meta_M2M100_1_2B_Output = {
+    /**
+     * The translated text in the target language
+     */
+    translated_text?: string;
+} | Ai_Cf_Meta_M2M100_1_2B_AsyncResponse;
+interface Ai_Cf_Meta_M2M100_1_2B_AsyncResponse {
+    /**
+     * The async request id that can be used to obtain the results.
+     */
+    request_id?: string;
+}
+declare abstract class Base_Ai_Cf_Meta_M2M100_1_2B {
+    inputs: Ai_Cf_Meta_M2M100_1_2B_Input;
+    postProcessedOutputs: Ai_Cf_Meta_M2M100_1_2B_Output;
+}
+type Ai_Cf_Baai_Bge_Small_En_V1_5_Input = {
+    text: string | string[];
+    /**
+     * The pooling method used in the embedding process. `cls` pooling will generate more accurate embeddings on larger inputs - however, embeddings created with cls pooling are not compatible with embeddings generated with mean pooling. The default pooling method is `mean` in order for this to not be a breaking change, but we highly suggest using the new `cls` pooling for better accuracy.
+     */
+    pooling?: "mean" | "cls";
+} | {
+    /**
+     * Batch of the embeddings requests to run using async-queue
+     */
+    requests: {
+        text: string | string[];
+        /**
+         * The pooling method used in the embedding process. `cls` pooling will generate more accurate embeddings on larger inputs - however, embeddings created with cls pooling are not compatible with embeddings generated with mean pooling. The default pooling method is `mean` in order for this to not be a breaking change, but we highly suggest using the new `cls` pooling for better accuracy.
+         */
+        pooling?: "mean" | "cls";
+    }[];
+};
+type Ai_Cf_Baai_Bge_Small_En_V1_5_Output = {
+    shape?: number[];
+    /**
+     * Embeddings of the requested text values
+     */
+    data?: number[][];
+    /**
+     * The pooling method used in the embedding process.
+     */
+    pooling?: "mean" | "cls";
+} | Ai_Cf_Baai_Bge_Small_En_V1_5_AsyncResponse;
+interface Ai_Cf_Baai_Bge_Small_En_V1_5_AsyncResponse {
+    /**
+     * The async request id that can be used to obtain the results.
+     */
+    request_id?: string;
+}
+declare abstract class Base_Ai_Cf_Baai_Bge_Small_En_V1_5 {
+    inputs: Ai_Cf_Baai_Bge_Small_En_V1_5_Input;
+    postProcessedOutputs: Ai_Cf_Baai_Bge_Small_En_V1_5_Output;
+}
+type Ai_Cf_Baai_Bge_Large_En_V1_5_Input = {
+    text: string | string[];
+    /**
+     * The pooling method used in the embedding process. `cls` pooling will generate more accurate embeddings on larger inputs - however, embeddings created with cls pooling are not compatible with embeddings generated with mean pooling. The default pooling method is `mean` in order for this to not be a breaking change, but we highly suggest using the new `cls` pooling for better accuracy.
+     */
+    pooling?: "mean" | "cls";
+} | {
+    /**
+     * Batch of the embeddings requests to run using async-queue
+     */
+    requests: {
+        text: string | string[];
+        /**
+         * The pooling method used in the embedding process. `cls` pooling will generate more accurate embeddings on larger inputs - however, embeddings created with cls pooling are not compatible with embeddings generated with mean pooling. The default pooling method is `mean` in order for this to not be a breaking change, but we highly suggest using the new `cls` pooling for better accuracy.
+         */
+        pooling?: "mean" | "cls";
+    }[];
+};
+type Ai_Cf_Baai_Bge_Large_En_V1_5_Output = {
+    shape?: number[];
+    /**
+     * Embeddings of the requested text values
+     */
+    data?: number[][];
+    /**
+     * The pooling method used in the embedding process.
+     */
+    pooling?: "mean" | "cls";
+} | Ai_Cf_Baai_Bge_Large_En_V1_5_AsyncResponse;
+interface Ai_Cf_Baai_Bge_Large_En_V1_5_AsyncResponse {
+    /**
+     * The async request id that can be used to obtain the results.
+     */
+    request_id?: string;
+}
+declare abstract class Base_Ai_Cf_Baai_Bge_Large_En_V1_5 {
+    inputs: Ai_Cf_Baai_Bge_Large_En_V1_5_Input;
+    postProcessedOutputs: Ai_Cf_Baai_Bge_Large_En_V1_5_Output;
+}
+type Ai_Cf_Unum_Uform_Gen2_Qwen_500M_Input = string | {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt?: string;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * Controls the creativity of the AI's responses by adjusting how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+    image: number[] | (string & NonNullable<unknown>);
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+};
+interface Ai_Cf_Unum_Uform_Gen2_Qwen_500M_Output {
+    description?: string;
+}
+declare abstract class Base_Ai_Cf_Unum_Uform_Gen2_Qwen_500M {
+    inputs: Ai_Cf_Unum_Uform_Gen2_Qwen_500M_Input;
+    postProcessedOutputs: Ai_Cf_Unum_Uform_Gen2_Qwen_500M_Output;
+}
+type Ai_Cf_Openai_Whisper_Tiny_En_Input = string | {
+    /**
+     * An array of integers that represent the audio data constrained to 8-bit unsigned integer values
+     */
+    audio: number[];
+};
+interface Ai_Cf_Openai_Whisper_Tiny_En_Output {
+    /**
+     * The transcription
+     */
+    text: string;
+    word_count?: number;
+    words?: {
+        word?: string;
+        /**
+         * The second this word begins in the recording
+         */
+        start?: number;
+        /**
+         * The ending second when the word completes
+         */
+        end?: number;
+    }[];
+    vtt?: string;
+}
+declare abstract class Base_Ai_Cf_Openai_Whisper_Tiny_En {
+    inputs: Ai_Cf_Openai_Whisper_Tiny_En_Input;
+    postProcessedOutputs: Ai_Cf_Openai_Whisper_Tiny_En_Output;
+}
+interface Ai_Cf_Openai_Whisper_Large_V3_Turbo_Input {
+    audio: string | {
+        body?: object;
+        contentType?: string;
+    };
+    /**
+     * Supported tasks are 'translate' or 'transcribe'.
+     */
+    task?: string;
+    /**
+     * The language of the audio being transcribed or translated.
+     */
+    language?: string;
+    /**
+     * Preprocess the audio with a voice activity detection model.
+     */
+    vad_filter?: boolean;
+    /**
+     * A text prompt to help provide context to the model on the contents of the audio.
+     */
+    initial_prompt?: string;
+    /**
+     * The prefix appended to the beginning of the output of the transcription and can guide the transcription result.
+     */
+    prefix?: string;
+    /**
+     * The number of beams to use in beam search decoding. Higher values may improve accuracy at the cost of speed.
+     */
+    beam_size?: number;
+    /**
+     * Whether to condition on previous text during transcription. Setting to false may help prevent hallucination loops.
+     */
+    condition_on_previous_text?: boolean;
+    /**
+     * Threshold for detecting no-speech segments. Segments with no-speech probability above this value are skipped.
+     */
+    no_speech_threshold?: number;
+    /**
+     * Threshold for filtering out segments with high compression ratio, which often indicate repetitive or hallucinated text.
+     */
+    compression_ratio_threshold?: number;
+    /**
+     * Threshold for filtering out segments with low average log probability, indicating low confidence.
+     */
+    log_prob_threshold?: number;
+    /**
+     * Optional threshold (in seconds) to skip silent periods that may cause hallucinations.
+     */
+    hallucination_silence_threshold?: number;
+}
+interface Ai_Cf_Openai_Whisper_Large_V3_Turbo_Output {
+    transcription_info?: {
+        /**
+         * The language of the audio being transcribed or translated.
+         */
+        language?: string;
+        /**
+         * The confidence level or probability of the detected language being accurate, represented as a decimal between 0 and 1.
+         */
+        language_probability?: number;
+        /**
+         * The total duration of the original audio file, in seconds.
+         */
+        duration?: number;
+        /**
+         * The duration of the audio after applying Voice Activity Detection (VAD) to remove silent or irrelevant sections, in seconds.
+         */
+        duration_after_vad?: number;
+    };
+    /**
+     * The complete transcription of the audio.
+     */
+    text: string;
+    /**
+     * The total number of words in the transcription.
+     */
+    word_count?: number;
+    segments?: {
+        /**
+         * The starting time of the segment within the audio, in seconds.
+         */
+        start?: number;
+        /**
+         * The ending time of the segment within the audio, in seconds.
+         */
+        end?: number;
+        /**
+         * The transcription of the segment.
+         */
+        text?: string;
+        /**
+         * The temperature used in the decoding process, controlling randomness in predictions. Lower values result in more deterministic outputs.
+         */
+        temperature?: number;
+        /**
+         * The average log probability of the predictions for the words in this segment, indicating overall confidence.
+         */
+        avg_logprob?: number;
+        /**
+         * The compression ratio of the input to the output, measuring how much the text was compressed during the transcription process.
+         */
+        compression_ratio?: number;
+        /**
+         * The probability that the segment contains no speech, represented as a decimal between 0 and 1.
+         */
+        no_speech_prob?: number;
+        words?: {
+            /**
+             * The individual word transcribed from the audio.
+             */
+            word?: string;
+            /**
+             * The starting time of the word within the audio, in seconds.
+             */
+            start?: number;
+            /**
+             * The ending time of the word within the audio, in seconds.
+             */
+            end?: number;
+        }[];
+    }[];
+    /**
+     * The transcription in WebVTT format, which includes timing and text information for use in subtitles.
+     */
+    vtt?: string;
+}
+declare abstract class Base_Ai_Cf_Openai_Whisper_Large_V3_Turbo {
+    inputs: Ai_Cf_Openai_Whisper_Large_V3_Turbo_Input;
+    postProcessedOutputs: Ai_Cf_Openai_Whisper_Large_V3_Turbo_Output;
+}
+type Ai_Cf_Baai_Bge_M3_Input = Ai_Cf_Baai_Bge_M3_Input_QueryAnd_Contexts | Ai_Cf_Baai_Bge_M3_Input_Embedding | {
+    /**
+     * Batch of the embeddings requests to run using async-queue
+     */
+    requests: (Ai_Cf_Baai_Bge_M3_Input_QueryAnd_Contexts_1 | Ai_Cf_Baai_Bge_M3_Input_Embedding_1)[];
+};
+interface Ai_Cf_Baai_Bge_M3_Input_QueryAnd_Contexts {
+    /**
+     * A query you wish to perform against the provided contexts. If no query is provided the model with respond with embeddings for contexts
+     */
+    query?: string;
+    /**
+     * List of provided contexts. Note that the index in this array is important, as the response will refer to it.
+     */
+    contexts: {
+        /**
+         * One of the provided context content
+         */
+        text?: string;
+    }[];
+    /**
+     * When provided with too long context should the model error out or truncate the context to fit?
+     */
+    truncate_inputs?: boolean;
+}
+interface Ai_Cf_Baai_Bge_M3_Input_Embedding {
+    text: string | string[];
+    /**
+     * When provided with too long context should the model error out or truncate the context to fit?
+     */
+    truncate_inputs?: boolean;
+}
+interface Ai_Cf_Baai_Bge_M3_Input_QueryAnd_Contexts_1 {
+    /**
+     * A query you wish to perform against the provided contexts. If no query is provided the model with respond with embeddings for contexts
+     */
+    query?: string;
+    /**
+     * List of provided contexts. Note that the index in this array is important, as the response will refer to it.
+     */
+    contexts: {
+        /**
+         * One of the provided context content
+         */
+        text?: string;
+    }[];
+    /**
+     * When provided with too long context should the model error out or truncate the context to fit?
+     */
+    truncate_inputs?: boolean;
+}
+interface Ai_Cf_Baai_Bge_M3_Input_Embedding_1 {
+    text: string | string[];
+    /**
+     * When provided with too long context should the model error out or truncate the context to fit?
+     */
+    truncate_inputs?: boolean;
+}
+type Ai_Cf_Baai_Bge_M3_Output = Ai_Cf_Baai_Bge_M3_Output_Query | Ai_Cf_Baai_Bge_M3_Output_EmbeddingFor_Contexts | Ai_Cf_Baai_Bge_M3_Output_Embedding | Ai_Cf_Baai_Bge_M3_AsyncResponse;
+interface Ai_Cf_Baai_Bge_M3_Output_Query {
+    response?: {
+        /**
+         * Index of the context in the request
+         */
+        id?: number;
+        /**
+         * Score of the context under the index.
+         */
+        score?: number;
+    }[];
+}
+interface Ai_Cf_Baai_Bge_M3_Output_EmbeddingFor_Contexts {
+    response?: number[][];
+    shape?: number[];
+    /**
+     * The pooling method used in the embedding process.
+     */
+    pooling?: "mean" | "cls";
+}
+interface Ai_Cf_Baai_Bge_M3_Output_Embedding {
+    shape?: number[];
+    /**
+     * Embeddings of the requested text values
+     */
+    data?: number[][];
+    /**
+     * The pooling method used in the embedding process.
+     */
+    pooling?: "mean" | "cls";
+}
+interface Ai_Cf_Baai_Bge_M3_AsyncResponse {
+    /**
+     * The async request id that can be used to obtain the results.
+     */
+    request_id?: string;
+}
+declare abstract class Base_Ai_Cf_Baai_Bge_M3 {
+    inputs: Ai_Cf_Baai_Bge_M3_Input;
+    postProcessedOutputs: Ai_Cf_Baai_Bge_M3_Output;
+}
+interface Ai_Cf_Black_Forest_Labs_Flux_1_Schnell_Input {
+    /**
+     * A text description of the image you want to generate.
+     */
+    prompt: string;
+    /**
+     * The number of diffusion steps; higher values can improve quality but take longer.
+     */
+    steps?: number;
+}
+interface Ai_Cf_Black_Forest_Labs_Flux_1_Schnell_Output {
+    /**
+     * The generated image in Base64 format.
+     */
+    image?: string;
+}
+declare abstract class Base_Ai_Cf_Black_Forest_Labs_Flux_1_Schnell {
+    inputs: Ai_Cf_Black_Forest_Labs_Flux_1_Schnell_Input;
+    postProcessedOutputs: Ai_Cf_Black_Forest_Labs_Flux_1_Schnell_Output;
+}
+type Ai_Cf_Meta_Llama_3_2_11B_Vision_Instruct_Input = Ai_Cf_Meta_Llama_3_2_11B_Vision_Instruct_Prompt | Ai_Cf_Meta_Llama_3_2_11B_Vision_Instruct_Messages;
+interface Ai_Cf_Meta_Llama_3_2_11B_Vision_Instruct_Prompt {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    image?: number[] | (string & NonNullable<unknown>);
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+    /**
+     * Name of the LoRA (Low-Rank Adaptation) model to fine-tune the base model.
+     */
+    lora?: string;
+}
+interface Ai_Cf_Meta_Llama_3_2_11B_Vision_Instruct_Messages {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role?: string;
+        /**
+         * The tool call id. If you don't know what to put here you can fall back to 000000001
+         */
+        tool_call_id?: string;
+        content?: string | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        }[] | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        };
+    }[];
+    image?: number[] | (string & NonNullable<unknown>);
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    /**
+     * If true, the response will be streamed back incrementally.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Controls the creativity of the AI's responses by adjusting how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+type Ai_Cf_Meta_Llama_3_2_11B_Vision_Instruct_Output = {
+    /**
+     * The generated text response from the model
+     */
+    response?: string;
+    /**
+     * An array of tool calls requests made during the response generation
+     */
+    tool_calls?: {
+        /**
+         * The arguments passed to be passed to the tool call request
+         */
+        arguments?: object;
+        /**
+         * The name of the tool to be called
+         */
+        name?: string;
+    }[];
+};
+declare abstract class Base_Ai_Cf_Meta_Llama_3_2_11B_Vision_Instruct {
+    inputs: Ai_Cf_Meta_Llama_3_2_11B_Vision_Instruct_Input;
+    postProcessedOutputs: Ai_Cf_Meta_Llama_3_2_11B_Vision_Instruct_Output;
+}
+type Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_Input = Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_Prompt | Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_Messages | Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_Async_Batch;
+interface Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_Prompt {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * Name of the LoRA (Low-Rank Adaptation) model to fine-tune the base model.
+     */
+    lora?: string;
+    response_format?: Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_JSON_Mode;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_JSON_Mode {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+interface Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_Messages {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role: string;
+        content: string | {
+            /**
+             * Type of the content (text)
+             */
+            type?: string;
+            /**
+             * Text content
+             */
+            text?: string;
+        }[];
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    response_format?: Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_JSON_Mode_1;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_JSON_Mode_1 {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+interface Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_Async_Batch {
+    requests?: {
+        /**
+         * User-supplied reference. This field will be present in the response as well it can be used to reference the request and response. It's NOT validated to be unique.
+         */
+        external_reference?: string;
+        /**
+         * Prompt for the text generation model
+         */
+        prompt?: string;
+        /**
+         * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+         */
+        stream?: boolean;
+        /**
+         * The maximum number of tokens to generate in the response.
+         */
+        max_tokens?: number;
+        /**
+         * Controls the randomness of the output; higher values produce more random results.
+         */
+        temperature?: number;
+        /**
+         * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+         */
+        top_p?: number;
+        /**
+         * Random seed for reproducibility of the generation.
+         */
+        seed?: number;
+        /**
+         * Penalty for repeated tokens; higher values discourage repetition.
+         */
+        repetition_penalty?: number;
+        /**
+         * Decreases the likelihood of the model repeating the same lines verbatim.
+         */
+        frequency_penalty?: number;
+        /**
+         * Increases the likelihood of the model introducing new topics.
+         */
+        presence_penalty?: number;
+        response_format?: Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_JSON_Mode_2;
+    }[];
+}
+interface Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_JSON_Mode_2 {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+type Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_Output = {
+    /**
+     * The generated text response from the model
+     */
+    response: string;
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+    /**
+     * An array of tool calls requests made during the response generation
+     */
+    tool_calls?: {
+        /**
+         * The arguments passed to be passed to the tool call request
+         */
+        arguments?: object;
+        /**
+         * The name of the tool to be called
+         */
+        name?: string;
+    }[];
+} | string | Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_AsyncResponse;
+interface Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_AsyncResponse {
+    /**
+     * The async request id that can be used to obtain the results.
+     */
+    request_id?: string;
+}
+declare abstract class Base_Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast {
+    inputs: Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_Input;
+    postProcessedOutputs: Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast_Output;
+}
+interface Ai_Cf_Meta_Llama_Guard_3_8B_Input {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender must alternate between 'user' and 'assistant'.
+         */
+        role: "user" | "assistant";
+        /**
+         * The content of the message as a string.
+         */
+        content: string;
+    }[];
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Dictate the output format of the generated response.
+     */
+    response_format?: {
+        /**
+         * Set to json_object to process and output generated text as JSON.
+         */
+        type?: string;
+    };
+}
+interface Ai_Cf_Meta_Llama_Guard_3_8B_Output {
+    response?: string | {
+        /**
+         * Whether the conversation is safe or not.
+         */
+        safe?: boolean;
+        /**
+         * A list of what hazard categories predicted for the conversation, if the conversation is deemed unsafe.
+         */
+        categories?: string[];
+    };
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+}
+declare abstract class Base_Ai_Cf_Meta_Llama_Guard_3_8B {
+    inputs: Ai_Cf_Meta_Llama_Guard_3_8B_Input;
+    postProcessedOutputs: Ai_Cf_Meta_Llama_Guard_3_8B_Output;
+}
+interface Ai_Cf_Baai_Bge_Reranker_Base_Input {
+    /**
+     * A query you wish to perform against the provided contexts.
+     */
+    /**
+     * Number of returned results starting with the best score.
+     */
+    top_k?: number;
+    /**
+     * List of provided contexts. Note that the index in this array is important, as the response will refer to it.
+     */
+    contexts: {
+        /**
+         * One of the provided context content
+         */
+        text?: string;
+    }[];
+}
+interface Ai_Cf_Baai_Bge_Reranker_Base_Output {
+    response?: {
+        /**
+         * Index of the context in the request
+         */
+        id?: number;
+        /**
+         * Score of the context under the index.
+         */
+        score?: number;
+    }[];
+}
+declare abstract class Base_Ai_Cf_Baai_Bge_Reranker_Base {
+    inputs: Ai_Cf_Baai_Bge_Reranker_Base_Input;
+    postProcessedOutputs: Ai_Cf_Baai_Bge_Reranker_Base_Output;
+}
+type Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_Input = Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_Prompt | Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_Messages;
+interface Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_Prompt {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * Name of the LoRA (Low-Rank Adaptation) model to fine-tune the base model.
+     */
+    lora?: string;
+    response_format?: Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_JSON_Mode;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_JSON_Mode {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+interface Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_Messages {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role: string;
+        /**
+         * The content of the message as a string.
+         */
+        content: string;
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    response_format?: Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_JSON_Mode_1;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_JSON_Mode_1 {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+type Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_Output = {
+    /**
+     * The generated text response from the model
+     */
+    response: string;
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+    /**
+     * An array of tool calls requests made during the response generation
+     */
+    tool_calls?: {
+        /**
+         * The arguments passed to be passed to the tool call request
+         */
+        arguments?: object;
+        /**
+         * The name of the tool to be called
+         */
+        name?: string;
+    }[];
+};
+declare abstract class Base_Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct {
+    inputs: Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_Input;
+    postProcessedOutputs: Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct_Output;
+}
+type Ai_Cf_Qwen_Qwq_32B_Input = Ai_Cf_Qwen_Qwq_32B_Prompt | Ai_Cf_Qwen_Qwq_32B_Messages;
+interface Ai_Cf_Qwen_Qwq_32B_Prompt {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * JSON schema that should be fulfilled for the response.
+     */
+    guided_json?: object;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Qwen_Qwq_32B_Messages {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role?: string;
+        /**
+         * The tool call id. If you don't know what to put here you can fall back to 000000001
+         */
+        tool_call_id?: string;
+        content?: string | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        }[] | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        };
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    /**
+     * JSON schema that should be fufilled for the response.
+     */
+    guided_json?: object;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+type Ai_Cf_Qwen_Qwq_32B_Output = {
+    /**
+     * The generated text response from the model
+     */
+    response: string;
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+    /**
+     * An array of tool calls requests made during the response generation
+     */
+    tool_calls?: {
+        /**
+         * The arguments passed to be passed to the tool call request
+         */
+        arguments?: object;
+        /**
+         * The name of the tool to be called
+         */
+        name?: string;
+    }[];
+};
+declare abstract class Base_Ai_Cf_Qwen_Qwq_32B {
+    inputs: Ai_Cf_Qwen_Qwq_32B_Input;
+    postProcessedOutputs: Ai_Cf_Qwen_Qwq_32B_Output;
+}
+type Ai_Cf_Mistralai_Mistral_Small_3_1_24B_Instruct_Input = Ai_Cf_Mistralai_Mistral_Small_3_1_24B_Instruct_Prompt | Ai_Cf_Mistralai_Mistral_Small_3_1_24B_Instruct_Messages;
+interface Ai_Cf_Mistralai_Mistral_Small_3_1_24B_Instruct_Prompt {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * JSON schema that should be fulfilled for the response.
+     */
+    guided_json?: object;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Mistralai_Mistral_Small_3_1_24B_Instruct_Messages {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role?: string;
+        /**
+         * The tool call id. Must be supplied for tool calls for Mistral-3. If you don't know what to put here you can fall back to 000000001
+         */
+        tool_call_id?: string;
+        content?: string | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        }[] | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        };
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    /**
+     * JSON schema that should be fufilled for the response.
+     */
+    guided_json?: object;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+type Ai_Cf_Mistralai_Mistral_Small_3_1_24B_Instruct_Output = {
+    /**
+     * The generated text response from the model
+     */
+    response: string;
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+    /**
+     * An array of tool calls requests made during the response generation
+     */
+    tool_calls?: {
+        /**
+         * The arguments passed to be passed to the tool call request
+         */
+        arguments?: object;
+        /**
+         * The name of the tool to be called
+         */
+        name?: string;
+    }[];
+};
+declare abstract class Base_Ai_Cf_Mistralai_Mistral_Small_3_1_24B_Instruct {
+    inputs: Ai_Cf_Mistralai_Mistral_Small_3_1_24B_Instruct_Input;
+    postProcessedOutputs: Ai_Cf_Mistralai_Mistral_Small_3_1_24B_Instruct_Output;
+}
+type Ai_Cf_Google_Gemma_3_12B_It_Input = Ai_Cf_Google_Gemma_3_12B_It_Prompt | Ai_Cf_Google_Gemma_3_12B_It_Messages;
+interface Ai_Cf_Google_Gemma_3_12B_It_Prompt {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * JSON schema that should be fufilled for the response.
+     */
+    guided_json?: object;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Google_Gemma_3_12B_It_Messages {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role?: string;
+        content?: string | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        }[];
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    /**
+     * JSON schema that should be fufilled for the response.
+     */
+    guided_json?: object;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+type Ai_Cf_Google_Gemma_3_12B_It_Output = {
+    /**
+     * The generated text response from the model
+     */
+    response: string;
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+    /**
+     * An array of tool calls requests made during the response generation
+     */
+    tool_calls?: {
+        /**
+         * The arguments passed to be passed to the tool call request
+         */
+        arguments?: object;
+        /**
+         * The name of the tool to be called
+         */
+        name?: string;
+    }[];
+};
+declare abstract class Base_Ai_Cf_Google_Gemma_3_12B_It {
+    inputs: Ai_Cf_Google_Gemma_3_12B_It_Input;
+    postProcessedOutputs: Ai_Cf_Google_Gemma_3_12B_It_Output;
+}
+type Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Input = Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Prompt | Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Messages | Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Async_Batch;
+interface Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Prompt {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * JSON schema that should be fulfilled for the response.
+     */
+    guided_json?: object;
+    response_format?: Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_JSON_Mode;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_JSON_Mode {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+interface Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Messages {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role?: string;
+        /**
+         * The tool call id. If you don't know what to put here you can fall back to 000000001
+         */
+        tool_call_id?: string;
+        content?: string | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        }[] | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        };
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    response_format?: Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_JSON_Mode;
+    /**
+     * JSON schema that should be fufilled for the response.
+     */
+    guided_json?: object;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Async_Batch {
+    requests: (Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Prompt_Inner | Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Messages_Inner)[];
+}
+interface Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Prompt_Inner {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * JSON schema that should be fulfilled for the response.
+     */
+    guided_json?: object;
+    response_format?: Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_JSON_Mode;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Messages_Inner {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role?: string;
+        /**
+         * The tool call id. If you don't know what to put here you can fall back to 000000001
+         */
+        tool_call_id?: string;
+        content?: string | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        }[] | {
+            /**
+             * Type of the content provided
+             */
+            type?: string;
+            text?: string;
+            image_url?: {
+                /**
+                 * image uri with data (e.g. data:image/jpeg;base64,/9j/...). HTTP URL will not be accepted
+                 */
+                url?: string;
+            };
+        };
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    response_format?: Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_JSON_Mode;
+    /**
+     * JSON schema that should be fufilled for the response.
+     */
+    guided_json?: object;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+type Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Output = {
+    /**
+     * The generated text response from the model
+     */
+    response: string;
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+    /**
+     * An array of tool calls requests made during the response generation
+     */
+    tool_calls?: {
+        /**
+         * The tool call id.
+         */
+        id?: string;
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type?: string;
+        /**
+         * Details of the function tool.
+         */
+        function?: {
+            /**
+             * The name of the tool to be called
+             */
+            name?: string;
+            /**
+             * The arguments passed to be passed to the tool call request
+             */
+            arguments?: object;
+        };
+    }[];
+};
+declare abstract class Base_Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct {
+    inputs: Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Input;
+    postProcessedOutputs: Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Output;
+}
+type Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Input = Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Prompt | Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Messages | Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Async_Batch;
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Prompt {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * Name of the LoRA (Low-Rank Adaptation) model to fine-tune the base model.
+     */
+    lora?: string;
+    response_format?: Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_JSON_Mode;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_JSON_Mode {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Messages {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role: string;
+        content: string | {
+            /**
+             * Type of the content (text)
+             */
+            type?: string;
+            /**
+             * Text content
+             */
+            text?: string;
+        }[];
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    response_format?: Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_JSON_Mode_1;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_JSON_Mode_1 {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Async_Batch {
+    requests: (Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Prompt_1 | Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Messages_1)[];
+}
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Prompt_1 {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * Name of the LoRA (Low-Rank Adaptation) model to fine-tune the base model.
+     */
+    lora?: string;
+    response_format?: Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_JSON_Mode_2;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_JSON_Mode_2 {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Messages_1 {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role: string;
+        content: string | {
+            /**
+             * Type of the content (text)
+             */
+            type?: string;
+            /**
+             * Text content
+             */
+            text?: string;
+        }[];
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    response_format?: Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_JSON_Mode_3;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_JSON_Mode_3 {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+type Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Output = Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Chat_Completion_Response | Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Text_Completion_Response | string | Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_AsyncResponse;
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Chat_Completion_Response {
+    /**
+     * Unique identifier for the completion
+     */
+    id?: string;
+    /**
+     * Object type identifier
+     */
+    object?: "chat.completion";
+    /**
+     * Unix timestamp of when the completion was created
+     */
+    created?: number;
+    /**
+     * Model used for the completion
+     */
+    model?: string;
+    /**
+     * List of completion choices
+     */
+    choices?: {
+        /**
+         * Index of the choice in the list
+         */
+        index?: number;
+        /**
+         * The message generated by the model
+         */
+        message?: {
+            /**
+             * Role of the message author
+             */
+            role: string;
+            /**
+             * The content of the message
+             */
+            content: string;
+            /**
+             * Internal reasoning content (if available)
+             */
+            reasoning_content?: string;
+            /**
+             * Tool calls made by the assistant
+             */
+            tool_calls?: {
+                /**
+                 * Unique identifier for the tool call
+                 */
+                id: string;
+                /**
+                 * Type of tool call
+                 */
+                type: "function";
+                function: {
+                    /**
+                     * Name of the function to call
+                     */
+                    name: string;
+                    /**
+                     * JSON string of arguments for the function
+                     */
+                    arguments: string;
+                };
+            }[];
+        };
+        /**
+         * Reason why the model stopped generating
+         */
+        finish_reason?: string;
+        /**
+         * Stop reason (may be null)
+         */
+        stop_reason?: string | null;
+        /**
+         * Log probabilities (if requested)
+         */
+        logprobs?: {} | null;
+    }[];
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+    /**
+     * Log probabilities for the prompt (if requested)
+     */
+    prompt_logprobs?: {} | null;
+}
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Text_Completion_Response {
+    /**
+     * Unique identifier for the completion
+     */
+    id?: string;
+    /**
+     * Object type identifier
+     */
+    object?: "text_completion";
+    /**
+     * Unix timestamp of when the completion was created
+     */
+    created?: number;
+    /**
+     * Model used for the completion
+     */
+    model?: string;
+    /**
+     * List of completion choices
+     */
+    choices?: {
+        /**
+         * Index of the choice in the list
+         */
+        index: number;
+        /**
+         * The generated text completion
+         */
+        text: string;
+        /**
+         * Reason why the model stopped generating
+         */
+        finish_reason: string;
+        /**
+         * Stop reason (may be null)
+         */
+        stop_reason?: string | null;
+        /**
+         * Log probabilities (if requested)
+         */
+        logprobs?: {} | null;
+        /**
+         * Log probabilities for the prompt (if requested)
+         */
+        prompt_logprobs?: {} | null;
+    }[];
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+}
+interface Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_AsyncResponse {
+    /**
+     * The async request id that can be used to obtain the results.
+     */
+    request_id?: string;
+}
+declare abstract class Base_Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8 {
+    inputs: Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Input;
+    postProcessedOutputs: Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8_Output;
+}
+interface Ai_Cf_Deepgram_Nova_3_Input {
+    audio: {
+        body: object;
+        contentType: string;
+    };
+    /**
+     * Sets how the model will interpret strings submitted to the custom_topic param. When strict, the model will only return topics submitted using the custom_topic param. When extended, the model will return its own detected topics in addition to those submitted using the custom_topic param.
+     */
+    custom_topic_mode?: "extended" | "strict";
+    /**
+     * Custom topics you want the model to detect within your input audio or text if present Submit up to 100
+     */
+    custom_topic?: string;
+    /**
+     * Sets how the model will interpret intents submitted to the custom_intent param. When strict, the model will only return intents submitted using the custom_intent param. When extended, the model will return its own detected intents in addition those submitted using the custom_intents param
+     */
+    custom_intent_mode?: "extended" | "strict";
+    /**
+     * Custom intents you want the model to detect within your input audio if present
+     */
+    custom_intent?: string;
+    /**
+     * Identifies and extracts key entities from content in submitted audio
+     */
+    detect_entities?: boolean;
+    /**
+     * Identifies the dominant language spoken in submitted audio
+     */
+    detect_language?: boolean;
+    /**
+     * Recognize speaker changes. Each word in the transcript will be assigned a speaker number starting at 0
+     */
+    diarize?: boolean;
+    /**
+     * Identify and extract key entities from content in submitted audio
+     */
+    dictation?: boolean;
+    /**
+     * Specify the expected encoding of your submitted audio
+     */
+    encoding?: "linear16" | "flac" | "mulaw" | "amr-nb" | "amr-wb" | "opus" | "speex" | "g729";
+    /**
+     * Arbitrary key-value pairs that are attached to the API response for usage in downstream processing
+     */
+    extra?: string;
+    /**
+     * Filler Words can help transcribe interruptions in your audio, like 'uh' and 'um'
+     */
+    filler_words?: boolean;
+    /**
+     * Key term prompting can boost or suppress specialized terminology and brands.
+     */
+    keyterm?: string;
+    /**
+     * Keywords can boost or suppress specialized terminology and brands.
+     */
+    keywords?: string;
+    /**
+     * The BCP-47 language tag that hints at the primary spoken language. Depending on the Model and API endpoint you choose only certain languages are available.
+     */
+    language?: string;
+    /**
+     * Spoken measurements will be converted to their corresponding abbreviations.
+     */
+    measurements?: boolean;
+    /**
+     * Opts out requests from the Deepgram Model Improvement Program. Refer to our Docs for pricing impacts before setting this to true. https://dpgr.am/deepgram-mip.
+     */
+    mip_opt_out?: boolean;
+    /**
+     * Mode of operation for the model representing broad area of topic that will be talked about in the supplied audio
+     */
+    mode?: "general" | "medical" | "finance";
+    /**
+     * Transcribe each audio channel independently.
+     */
+    multichannel?: boolean;
+    /**
+     * Numerals converts numbers from written format to numerical format.
+     */
+    numerals?: boolean;
+    /**
+     * Splits audio into paragraphs to improve transcript readability.
+     */
+    paragraphs?: boolean;
+    /**
+     * Profanity Filter looks for recognized profanity and converts it to the nearest recognized non-profane word or removes it from the transcript completely.
+     */
+    profanity_filter?: boolean;
+    /**
+     * Add punctuation and capitalization to the transcript.
+     */
+    punctuate?: boolean;
+    /**
+     * Redaction removes sensitive information from your transcripts.
+     */
+    redact?: string;
+    /**
+     * Search for terms or phrases in submitted audio and replaces them.
+     */
+    replace?: string;
+    /**
+     * Search for terms or phrases in submitted audio.
+     */
+    search?: string;
+    /**
+     * Recognizes the sentiment throughout a transcript or text.
+     */
+    sentiment?: boolean;
+    /**
+     * Apply formatting to transcript output. When set to true, additional formatting will be applied to transcripts to improve readability.
+     */
+    smart_format?: boolean;
+    /**
+     * Detect topics throughout a transcript or text.
+     */
+    topics?: boolean;
+    /**
+     * Segments speech into meaningful semantic units.
+     */
+    utterances?: boolean;
+    /**
+     * Seconds to wait before detecting a pause between words in submitted audio.
+     */
+    utt_split?: number;
+    /**
+     * The number of channels in the submitted audio
+     */
+    channels?: number;
+    /**
+     * Specifies whether the streaming endpoint should provide ongoing transcription updates as more audio is received. When set to true, the endpoint sends continuous updates, meaning transcription results may evolve over time. Note: Supported only for webosockets.
+     */
+    interim_results?: boolean;
+    /**
+     * Indicates how long model will wait to detect whether a speaker has finished speaking or pauses for a significant period of time. When set to a value, the streaming endpoint immediately finalizes the transcription for the processed time range and returns the transcript with a speech_final parameter set to true. Can also be set to false to disable endpointing
+     */
+    endpointing?: string;
+    /**
+     * Indicates that speech has started. You'll begin receiving Speech Started messages upon speech starting. Note: Supported only for webosockets.
+     */
+    vad_events?: boolean;
+    /**
+     * Indicates how long model will wait to send an UtteranceEnd message after a word has been transcribed. Use with interim_results. Note: Supported only for webosockets.
+     */
+    utterance_end_ms?: boolean;
+}
+interface Ai_Cf_Deepgram_Nova_3_Output {
+    results?: {
+        channels?: {
+            alternatives?: {
+                confidence?: number;
+                transcript?: string;
+                words?: {
+                    confidence?: number;
+                    end?: number;
+                    start?: number;
+                    word?: string;
+                }[];
+            }[];
+        }[];
+        summary?: {
+            result?: string;
+            short?: string;
+        };
+        sentiments?: {
+            segments?: {
+                text?: string;
+                start_word?: number;
+                end_word?: number;
+                sentiment?: string;
+                sentiment_score?: number;
+            }[];
+            average?: {
+                sentiment?: string;
+                sentiment_score?: number;
+            };
+        };
+    };
+}
+declare abstract class Base_Ai_Cf_Deepgram_Nova_3 {
+    inputs: Ai_Cf_Deepgram_Nova_3_Input;
+    postProcessedOutputs: Ai_Cf_Deepgram_Nova_3_Output;
+}
+interface Ai_Cf_Qwen_Qwen3_Embedding_0_6B_Input {
+    queries?: string | string[];
+    /**
+     * Optional instruction for the task
+     */
+    instruction?: string;
+    documents?: string | string[];
+    text?: string | string[];
+}
+interface Ai_Cf_Qwen_Qwen3_Embedding_0_6B_Output {
+    data?: number[][];
+    shape?: number[];
+}
+declare abstract class Base_Ai_Cf_Qwen_Qwen3_Embedding_0_6B {
+    inputs: Ai_Cf_Qwen_Qwen3_Embedding_0_6B_Input;
+    postProcessedOutputs: Ai_Cf_Qwen_Qwen3_Embedding_0_6B_Output;
+}
+type Ai_Cf_Pipecat_Ai_Smart_Turn_V2_Input = {
+    /**
+     * readable stream with audio data and content-type specified for that data
+     */
+    audio: {
+        body: object;
+        contentType: string;
+    };
+    /**
+     * type of data PCM data that's sent to the inference server as raw array
+     */
+    dtype?: "uint8" | "float32" | "float64";
+} | {
+    /**
+     * base64 encoded audio data
+     */
+    audio: string;
+    /**
+     * type of data PCM data that's sent to the inference server as raw array
+     */
+    dtype?: "uint8" | "float32" | "float64";
+};
+interface Ai_Cf_Pipecat_Ai_Smart_Turn_V2_Output {
+    /**
+     * if true, end-of-turn was detected
+     */
+    is_complete?: boolean;
+    /**
+     * probability of the end-of-turn detection
+     */
+    probability?: number;
+}
+declare abstract class Base_Ai_Cf_Pipecat_Ai_Smart_Turn_V2 {
+    inputs: Ai_Cf_Pipecat_Ai_Smart_Turn_V2_Input;
+    postProcessedOutputs: Ai_Cf_Pipecat_Ai_Smart_Turn_V2_Output;
+}
+declare abstract class Base_Ai_Cf_Openai_Gpt_Oss_120B {
+    inputs: XOR<ResponsesInput, ChatCompletionsMessagesInput>;
+    postProcessedOutputs: XOR<ResponsesOutput, ChatCompletionsOutput>;
+}
+declare abstract class Base_Ai_Cf_Openai_Gpt_Oss_20B {
+    inputs: XOR<ResponsesInput, ChatCompletionsMessagesInput>;
+    postProcessedOutputs: XOR<ResponsesOutput, ChatCompletionsOutput>;
+}
+interface Ai_Cf_Leonardo_Phoenix_1_0_Input {
+    /**
+     * A text description of the image you want to generate.
+     */
+    prompt: string;
+    /**
+     * Controls how closely the generated image should adhere to the prompt; higher values make the image more aligned with the prompt
+     */
+    guidance?: number;
+    /**
+     * Random seed for reproducibility of the image generation
+     */
+    seed?: number;
+    /**
+     * The height of the generated image in pixels
+     */
+    height?: number;
+    /**
+     * The width of the generated image in pixels
+     */
+    width?: number;
+    /**
+     * The number of diffusion steps; higher values can improve quality but take longer
+     */
+    num_steps?: number;
+    /**
+     * Specify what to exclude from the generated images
+     */
+    negative_prompt?: string;
+}
+/**
+ * The generated image in JPEG format
+ */
+type Ai_Cf_Leonardo_Phoenix_1_0_Output = string;
+declare abstract class Base_Ai_Cf_Leonardo_Phoenix_1_0 {
+    inputs: Ai_Cf_Leonardo_Phoenix_1_0_Input;
+    postProcessedOutputs: Ai_Cf_Leonardo_Phoenix_1_0_Output;
+}
+interface Ai_Cf_Leonardo_Lucid_Origin_Input {
+    /**
+     * A text description of the image you want to generate.
+     */
+    prompt: string;
+    /**
+     * Controls how closely the generated image should adhere to the prompt; higher values make the image more aligned with the prompt
+     */
+    guidance?: number;
+    /**
+     * Random seed for reproducibility of the image generation
+     */
+    seed?: number;
+    /**
+     * The height of the generated image in pixels
+     */
+    height?: number;
+    /**
+     * The width of the generated image in pixels
+     */
+    width?: number;
+    /**
+     * The number of diffusion steps; higher values can improve quality but take longer
+     */
+    num_steps?: number;
+    /**
+     * The number of diffusion steps; higher values can improve quality but take longer
+     */
+    steps?: number;
+}
+interface Ai_Cf_Leonardo_Lucid_Origin_Output {
+    /**
+     * The generated image in Base64 format.
+     */
+    image?: string;
+}
+declare abstract class Base_Ai_Cf_Leonardo_Lucid_Origin {
+    inputs: Ai_Cf_Leonardo_Lucid_Origin_Input;
+    postProcessedOutputs: Ai_Cf_Leonardo_Lucid_Origin_Output;
+}
+interface Ai_Cf_Deepgram_Aura_1_Input {
+    /**
+     * Speaker used to produce the audio.
+     */
+    speaker?: "angus" | "asteria" | "arcas" | "orion" | "orpheus" | "athena" | "luna" | "zeus" | "perseus" | "helios" | "hera" | "stella";
+    /**
+     * Encoding of the output audio.
+     */
+    encoding?: "linear16" | "flac" | "mulaw" | "alaw" | "mp3" | "opus" | "aac";
+    /**
+     * Container specifies the file format wrapper for the output audio. The available options depend on the encoding type..
+     */
+    container?: "none" | "wav" | "ogg";
+    /**
+     * The text content to be converted to speech
+     */
+    text: string;
+    /**
+     * Sample Rate specifies the sample rate for the output audio. Based on the encoding, different sample rates are supported. For some encodings, the sample rate is not configurable
+     */
+    sample_rate?: number;
+    /**
+     * The bitrate of the audio in bits per second. Choose from predefined ranges or specific values based on the encoding type.
+     */
+    bit_rate?: number;
+}
+/**
+ * The generated audio in MP3 format
+ */
+type Ai_Cf_Deepgram_Aura_1_Output = string;
+declare abstract class Base_Ai_Cf_Deepgram_Aura_1 {
+    inputs: Ai_Cf_Deepgram_Aura_1_Input;
+    postProcessedOutputs: Ai_Cf_Deepgram_Aura_1_Output;
+}
+interface Ai_Cf_Ai4Bharat_Indictrans2_En_Indic_1B_Input {
+    /**
+     * Input text to translate. Can be a single string or a list of strings.
+     */
+    text: string | string[];
+    /**
+     * Target langauge to translate to
+     */
+    target_language: "asm_Beng" | "awa_Deva" | "ben_Beng" | "bho_Deva" | "brx_Deva" | "doi_Deva" | "eng_Latn" | "gom_Deva" | "gon_Deva" | "guj_Gujr" | "hin_Deva" | "hne_Deva" | "kan_Knda" | "kas_Arab" | "kas_Deva" | "kha_Latn" | "lus_Latn" | "mag_Deva" | "mai_Deva" | "mal_Mlym" | "mar_Deva" | "mni_Beng" | "mni_Mtei" | "npi_Deva" | "ory_Orya" | "pan_Guru" | "san_Deva" | "sat_Olck" | "snd_Arab" | "snd_Deva" | "tam_Taml" | "tel_Telu" | "urd_Arab" | "unr_Deva";
+}
+interface Ai_Cf_Ai4Bharat_Indictrans2_En_Indic_1B_Output {
+    /**
+     * Translated texts
+     */
+    translations: string[];
+}
+declare abstract class Base_Ai_Cf_Ai4Bharat_Indictrans2_En_Indic_1B {
+    inputs: Ai_Cf_Ai4Bharat_Indictrans2_En_Indic_1B_Input;
+    postProcessedOutputs: Ai_Cf_Ai4Bharat_Indictrans2_En_Indic_1B_Output;
+}
+type Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Input = Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Prompt | Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Messages | Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Async_Batch;
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Prompt {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * Name of the LoRA (Low-Rank Adaptation) model to fine-tune the base model.
+     */
+    lora?: string;
+    response_format?: Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_JSON_Mode;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_JSON_Mode {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Messages {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role: string;
+        content: string | {
+            /**
+             * Type of the content (text)
+             */
+            type?: string;
+            /**
+             * Text content
+             */
+            text?: string;
+        }[];
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    response_format?: Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_JSON_Mode_1;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_JSON_Mode_1 {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Async_Batch {
+    requests: (Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Prompt_1 | Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Messages_1)[];
+}
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Prompt_1 {
+    /**
+     * The input text prompt for the model to generate a response.
+     */
+    prompt: string;
+    /**
+     * Name of the LoRA (Low-Rank Adaptation) model to fine-tune the base model.
+     */
+    lora?: string;
+    response_format?: Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_JSON_Mode_2;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_JSON_Mode_2 {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Messages_1 {
+    /**
+     * An array of message objects representing the conversation history.
+     */
+    messages: {
+        /**
+         * The role of the message sender (e.g., 'user', 'assistant', 'system', 'tool').
+         */
+        role: string;
+        content: string | {
+            /**
+             * Type of the content (text)
+             */
+            type?: string;
+            /**
+             * Text content
+             */
+            text?: string;
+        }[];
+    }[];
+    functions?: {
+        name: string;
+        code: string;
+    }[];
+    /**
+     * A list of tools available for the assistant to use.
+     */
+    tools?: ({
+        /**
+         * The name of the tool. More descriptive the better.
+         */
+        name: string;
+        /**
+         * A brief description of what the tool does.
+         */
+        description: string;
+        /**
+         * Schema defining the parameters accepted by the tool.
+         */
+        parameters: {
+            /**
+             * The type of the parameters object (usually 'object').
+             */
+            type: string;
+            /**
+             * List of required parameter names.
+             */
+            required?: string[];
+            /**
+             * Definitions of each parameter.
+             */
+            properties: {
+                [k: string]: {
+                    /**
+                     * The data type of the parameter.
+                     */
+                    type: string;
+                    /**
+                     * A description of the expected parameter.
+                     */
+                    description: string;
+                };
+            };
+        };
+    } | {
+        /**
+         * Specifies the type of tool (e.g., 'function').
+         */
+        type: string;
+        /**
+         * Details of the function tool.
+         */
+        function: {
+            /**
+             * The name of the function.
+             */
+            name: string;
+            /**
+             * A brief description of what the function does.
+             */
+            description: string;
+            /**
+             * Schema defining the parameters accepted by the function.
+             */
+            parameters: {
+                /**
+                 * The type of the parameters object (usually 'object').
+                 */
+                type: string;
+                /**
+                 * List of required parameter names.
+                 */
+                required?: string[];
+                /**
+                 * Definitions of each parameter.
+                 */
+                properties: {
+                    [k: string]: {
+                        /**
+                         * The data type of the parameter.
+                         */
+                        type: string;
+                        /**
+                         * A description of the expected parameter.
+                         */
+                        description: string;
+                    };
+                };
+            };
+        };
+    })[];
+    response_format?: Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_JSON_Mode_3;
+    /**
+     * If true, a chat template is not applied and you must adhere to the specific model's expected formatting.
+     */
+    raw?: boolean;
+    /**
+     * If true, the response will be streamed back incrementally using SSE, Server Sent Events.
+     */
+    stream?: boolean;
+    /**
+     * The maximum number of tokens to generate in the response.
+     */
+    max_tokens?: number;
+    /**
+     * Controls the randomness of the output; higher values produce more random results.
+     */
+    temperature?: number;
+    /**
+     * Adjusts the creativity of the AI's responses by controlling how many possible words it considers. Lower values make outputs more predictable; higher values allow for more varied and creative responses.
+     */
+    top_p?: number;
+    /**
+     * Limits the AI to choose from the top 'k' most probable words. Lower values make responses more focused; higher values introduce more variety and potential surprises.
+     */
+    top_k?: number;
+    /**
+     * Random seed for reproducibility of the generation.
+     */
+    seed?: number;
+    /**
+     * Penalty for repeated tokens; higher values discourage repetition.
+     */
+    repetition_penalty?: number;
+    /**
+     * Decreases the likelihood of the model repeating the same lines verbatim.
+     */
+    frequency_penalty?: number;
+    /**
+     * Increases the likelihood of the model introducing new topics.
+     */
+    presence_penalty?: number;
+}
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_JSON_Mode_3 {
+    type?: "json_object" | "json_schema";
+    json_schema?: unknown;
+}
+type Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Output = Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Chat_Completion_Response | Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Text_Completion_Response | string | Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_AsyncResponse;
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Chat_Completion_Response {
+    /**
+     * Unique identifier for the completion
+     */
+    id?: string;
+    /**
+     * Object type identifier
+     */
+    object?: "chat.completion";
+    /**
+     * Unix timestamp of when the completion was created
+     */
+    created?: number;
+    /**
+     * Model used for the completion
+     */
+    model?: string;
+    /**
+     * List of completion choices
+     */
+    choices?: {
+        /**
+         * Index of the choice in the list
+         */
+        index?: number;
+        /**
+         * The message generated by the model
+         */
+        message?: {
+            /**
+             * Role of the message author
+             */
+            role: string;
+            /**
+             * The content of the message
+             */
+            content: string;
+            /**
+             * Internal reasoning content (if available)
+             */
+            reasoning_content?: string;
+            /**
+             * Tool calls made by the assistant
+             */
+            tool_calls?: {
+                /**
+                 * Unique identifier for the tool call
+                 */
+                id: string;
+                /**
+                 * Type of tool call
+                 */
+                type: "function";
+                function: {
+                    /**
+                     * Name of the function to call
+                     */
+                    name: string;
+                    /**
+                     * JSON string of arguments for the function
+                     */
+                    arguments: string;
+                };
+            }[];
+        };
+        /**
+         * Reason why the model stopped generating
+         */
+        finish_reason?: string;
+        /**
+         * Stop reason (may be null)
+         */
+        stop_reason?: string | null;
+        /**
+         * Log probabilities (if requested)
+         */
+        logprobs?: {} | null;
+    }[];
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+    /**
+     * Log probabilities for the prompt (if requested)
+     */
+    prompt_logprobs?: {} | null;
+}
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Text_Completion_Response {
+    /**
+     * Unique identifier for the completion
+     */
+    id?: string;
+    /**
+     * Object type identifier
+     */
+    object?: "text_completion";
+    /**
+     * Unix timestamp of when the completion was created
+     */
+    created?: number;
+    /**
+     * Model used for the completion
+     */
+    model?: string;
+    /**
+     * List of completion choices
+     */
+    choices?: {
+        /**
+         * Index of the choice in the list
+         */
+        index: number;
+        /**
+         * The generated text completion
+         */
+        text: string;
+        /**
+         * Reason why the model stopped generating
+         */
+        finish_reason: string;
+        /**
+         * Stop reason (may be null)
+         */
+        stop_reason?: string | null;
+        /**
+         * Log probabilities (if requested)
+         */
+        logprobs?: {} | null;
+        /**
+         * Log probabilities for the prompt (if requested)
+         */
+        prompt_logprobs?: {} | null;
+    }[];
+    /**
+     * Usage statistics for the inference request
+     */
+    usage?: {
+        /**
+         * Total number of tokens in input
+         */
+        prompt_tokens?: number;
+        /**
+         * Total number of tokens in output
+         */
+        completion_tokens?: number;
+        /**
+         * Total number of input and output tokens
+         */
+        total_tokens?: number;
+    };
+}
+interface Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_AsyncResponse {
+    /**
+     * The async request id that can be used to obtain the results.
+     */
+    request_id?: string;
+}
+declare abstract class Base_Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It {
+    inputs: Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Input;
+    postProcessedOutputs: Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It_Output;
+}
+interface Ai_Cf_Pfnet_Plamo_Embedding_1B_Input {
+    /**
+     * Input text to embed. Can be a single string or a list of strings.
+     */
+    text: string | string[];
+}
+interface Ai_Cf_Pfnet_Plamo_Embedding_1B_Output {
+    /**
+     * Embedding vectors, where each vector is a list of floats.
+     */
+    data: number[][];
+    /**
+     * Shape of the embedding data as [number_of_embeddings, embedding_dimension].
+     *
+     * @minItems 2
+     * @maxItems 2
+     */
+    shape: [
+        number,
+        number
+    ];
+}
+declare abstract class Base_Ai_Cf_Pfnet_Plamo_Embedding_1B {
+    inputs: Ai_Cf_Pfnet_Plamo_Embedding_1B_Input;
+    postProcessedOutputs: Ai_Cf_Pfnet_Plamo_Embedding_1B_Output;
+}
+interface Ai_Cf_Deepgram_Flux_Input {
+    /**
+     * Encoding of the audio stream. Currently only supports raw signed little-endian 16-bit PCM.
+     */
+    encoding: "linear16";
+    /**
+     * Sample rate of the audio stream in Hz.
+     */
+    sample_rate: string;
+    /**
+     * End-of-turn confidence required to fire an eager end-of-turn event. When set, enables EagerEndOfTurn and TurnResumed events. Valid Values 0.3 - 0.9.
+     */
+    eager_eot_threshold?: string;
+    /**
+     * End-of-turn confidence required to finish a turn. Valid Values 0.5 - 0.9.
+     */
+    eot_threshold?: string;
+    /**
+     * A turn will be finished when this much time has passed after speech, regardless of EOT confidence.
+     */
+    eot_timeout_ms?: string;
+    /**
+     * Keyterm prompting can improve recognition of specialized terminology. Pass multiple keyterm query parameters to boost multiple keyterms.
+     */
+    keyterm?: string;
+    /**
+     * Opts out requests from the Deepgram Model Improvement Program. Refer to Deepgram Docs for pricing impacts before setting this to true. https://dpgr.am/deepgram-mip
+     */
+    mip_opt_out?: "true" | "false";
+    /**
+     * Label your requests for the purpose of identification during usage reporting
+     */
+    tag?: string;
+}
+/**
+ * Output will be returned as websocket messages.
+ */
+interface Ai_Cf_Deepgram_Flux_Output {
+    /**
+     * The unique identifier of the request (uuid)
+     */
+    request_id?: string;
+    /**
+     * Starts at 0 and increments for each message the server sends to the client.
+     */
+    sequence_id?: number;
+    /**
+     * The type of event being reported.
+     */
+    event?: "Update" | "StartOfTurn" | "EagerEndOfTurn" | "TurnResumed" | "EndOfTurn";
+    /**
+     * The index of the current turn
+     */
+    turn_index?: number;
+    /**
+     * Start time in seconds of the audio range that was transcribed
+     */
+    audio_window_start?: number;
+    /**
+     * End time in seconds of the audio range that was transcribed
+     */
+    audio_window_end?: number;
+    /**
+     * Text that was said over the course of the current turn
+     */
+    transcript?: string;
+    /**
+     * The words in the transcript
+     */
+    words?: {
+        /**
+         * The individual punctuated, properly-cased word from the transcript
+         */
+        word: string;
+        /**
+         * Confidence that this word was transcribed correctly
+         */
+        confidence: number;
+    }[];
+    /**
+     * Confidence that no more speech is coming in this turn
+     */
+    end_of_turn_confidence?: number;
+}
+declare abstract class Base_Ai_Cf_Deepgram_Flux {
+    inputs: Ai_Cf_Deepgram_Flux_Input;
+    postProcessedOutputs: Ai_Cf_Deepgram_Flux_Output;
+}
+interface Ai_Cf_Deepgram_Aura_2_En_Input {
+    /**
+     * Speaker used to produce the audio.
+     */
+    speaker?: "amalthea" | "andromeda" | "apollo" | "arcas" | "aries" | "asteria" | "athena" | "atlas" | "aurora" | "callista" | "cora" | "cordelia" | "delia" | "draco" | "electra" | "harmonia" | "helena" | "hera" | "hermes" | "hyperion" | "iris" | "janus" | "juno" | "jupiter" | "luna" | "mars" | "minerva" | "neptune" | "odysseus" | "ophelia" | "orion" | "orpheus" | "pandora" | "phoebe" | "pluto" | "saturn" | "thalia" | "theia" | "vesta" | "zeus";
+    /**
+     * Encoding of the output audio.
+     */
+    encoding?: "linear16" | "flac" | "mulaw" | "alaw" | "mp3" | "opus" | "aac";
+    /**
+     * Container specifies the file format wrapper for the output audio. The available options depend on the encoding type..
+     */
+    container?: "none" | "wav" | "ogg";
+    /**
+     * The text content to be converted to speech
+     */
+    text: string;
+    /**
+     * Sample Rate specifies the sample rate for the output audio. Based on the encoding, different sample rates are supported. For some encodings, the sample rate is not configurable
+     */
+    sample_rate?: number;
+    /**
+     * The bitrate of the audio in bits per second. Choose from predefined ranges or specific values based on the encoding type.
+     */
+    bit_rate?: number;
+}
+/**
+ * The generated audio in MP3 format
+ */
+type Ai_Cf_Deepgram_Aura_2_En_Output = string;
+declare abstract class Base_Ai_Cf_Deepgram_Aura_2_En {
+    inputs: Ai_Cf_Deepgram_Aura_2_En_Input;
+    postProcessedOutputs: Ai_Cf_Deepgram_Aura_2_En_Output;
+}
+interface Ai_Cf_Deepgram_Aura_2_Es_Input {
+    /**
+     * Speaker used to produce the audio.
+     */
+    speaker?: "sirio" | "nestor" | "carina" | "celeste" | "alvaro" | "diana" | "aquila" | "selena" | "estrella" | "javier";
+    /**
+     * Encoding of the output audio.
+     */
+    encoding?: "linear16" | "flac" | "mulaw" | "alaw" | "mp3" | "opus" | "aac";
+    /**
+     * Container specifies the file format wrapper for the output audio. The available options depend on the encoding type..
+     */
+    container?: "none" | "wav" | "ogg";
+    /**
+     * The text content to be converted to speech
+     */
+    text: string;
+    /**
+     * Sample Rate specifies the sample rate for the output audio. Based on the encoding, different sample rates are supported. For some encodings, the sample rate is not configurable
+     */
+    sample_rate?: number;
+    /**
+     * The bitrate of the audio in bits per second. Choose from predefined ranges or specific values based on the encoding type.
+     */
+    bit_rate?: number;
+}
+/**
+ * The generated audio in MP3 format
+ */
+type Ai_Cf_Deepgram_Aura_2_Es_Output = string;
+declare abstract class Base_Ai_Cf_Deepgram_Aura_2_Es {
+    inputs: Ai_Cf_Deepgram_Aura_2_Es_Input;
+    postProcessedOutputs: Ai_Cf_Deepgram_Aura_2_Es_Output;
+}
+interface Ai_Cf_Black_Forest_Labs_Flux_2_Dev_Input {
+    multipart: {
+        body?: object;
+        contentType?: string;
+    };
+}
+interface Ai_Cf_Black_Forest_Labs_Flux_2_Dev_Output {
+    /**
+     * Generated image as Base64 string.
+     */
+    image?: string;
+}
+declare abstract class Base_Ai_Cf_Black_Forest_Labs_Flux_2_Dev {
+    inputs: Ai_Cf_Black_Forest_Labs_Flux_2_Dev_Input;
+    postProcessedOutputs: Ai_Cf_Black_Forest_Labs_Flux_2_Dev_Output;
+}
+interface Ai_Cf_Black_Forest_Labs_Flux_2_Klein_4B_Input {
+    multipart: {
+        body?: object;
+        contentType?: string;
+    };
+}
+interface Ai_Cf_Black_Forest_Labs_Flux_2_Klein_4B_Output {
+    /**
+     * Generated image as Base64 string.
+     */
+    image?: string;
+}
+declare abstract class Base_Ai_Cf_Black_Forest_Labs_Flux_2_Klein_4B {
+    inputs: Ai_Cf_Black_Forest_Labs_Flux_2_Klein_4B_Input;
+    postProcessedOutputs: Ai_Cf_Black_Forest_Labs_Flux_2_Klein_4B_Output;
+}
+interface Ai_Cf_Black_Forest_Labs_Flux_2_Klein_9B_Input {
+    multipart: {
+        body?: object;
+        contentType?: string;
+    };
+}
+interface Ai_Cf_Black_Forest_Labs_Flux_2_Klein_9B_Output {
+    /**
+     * Generated image as Base64 string.
+     */
+    image?: string;
+}
+declare abstract class Base_Ai_Cf_Black_Forest_Labs_Flux_2_Klein_9B {
+    inputs: Ai_Cf_Black_Forest_Labs_Flux_2_Klein_9B_Input;
+    postProcessedOutputs: Ai_Cf_Black_Forest_Labs_Flux_2_Klein_9B_Output;
+}
+declare abstract class Base_Ai_Cf_Zai_Org_Glm_4_7_Flash {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+declare abstract class Base_Ai_Cf_Moonshotai_Kimi_K2_5 {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+declare abstract class Base_Ai_Cf_Moonshotai_Kimi_K2_6 {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+declare abstract class Base_Ai_Cf_Nvidia_Nemotron_3_120B_A12B {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+declare abstract class Base_Ai_Cf_Google_Gemma_4_26B_A4B_IT {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+declare abstract class Base_Ai_Cf_Moonshotai_Kimi_K2_7_Code {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+declare abstract class Base_Ai_Cf_Zai_Org_Glm_5_2 {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+interface Ai_Cf_Moondream_Moondream3_1_9B_A2B_Input {
+    /**
+     * Which Moondream skill to run.
+     */
+    task?: "query" | "caption" | "point" | "detect";
+    /**
+     * Input image as a public HTTPS URL or base64 data URI. Optional for `query`; required for `caption`, `point`, and `detect`.
+     */
+    image?: string;
+    /**
+     * Question for the `query` task.
+     */
+    question?: string;
+    /**
+     * Caption length for the `caption` task.
+     */
+    caption_length?: "short" | "normal" | "long";
+    /**
+     * Object phrase to locate for `point` and `detect` tasks (e.g. 'person wearing a red shirt').
+     */
+    target?: string;
+    /**
+     * Enable reasoning trace for the `query` task.
+     */
+    reasoning?: boolean;
+    /**
+     * Sampling temperature.
+     */
+    temperature?: number;
+    /**
+     * Top-p (nucleus) sampling.
+     */
+    top_p?: number;
+    /**
+     * Max tokens to generate for `query` and `caption`.
+     */
+    max_tokens?: number;
+    /**
+     * Max objects to return for `point` and `detect`.
+     */
+    max_objects?: number;
+    /**
+     * Return incremental tokens for `query` and `caption`. `point` and `detect` do not support streaming.
+     */
+    stream?: boolean;
+}
+interface Ai_Cf_Moondream_Moondream3_1_9B_A2B_Output {
+    /**
+     * Reason the generation finished.
+     */
+    finish_reason: string;
+    metrics: {
+        /**
+         * Number of input tokens consumed.
+         */
+        input_tokens: number;
+        /**
+         * Number of output tokens generated.
+         */
+        output_tokens: number;
+        /**
+         * Prefill time in milliseconds.
+         */
+        prefill_time_ms: number;
+        /**
+         * Decode time in milliseconds.
+         */
+        decode_time_ms: number;
+        /**
+         * Time to first token in milliseconds.
+         */
+        ttft_ms: number;
+    };
+    /**
+     * Answer text for the `query` task. Null for other tasks.
+     */
+    answer?: string;
+    /**
+     * Caption text for the `caption` task. Null for other tasks.
+     */
+    caption?: string;
+    /**
+     * Located points for the `point` task. Null for other tasks.
+     */
+    points?: {
+        /**
+         * X coordinate.
+         */
+        x: number;
+        /**
+         * Y coordinate.
+         */
+        y: number;
+    }[];
+    /**
+     * Detected bounding boxes for the `detect` task. Null for other tasks.
+     */
+    objects?: {
+        /**
+         * Minimum X coordinate.
+         */
+        x_min: number;
+        /**
+         * Minimum Y coordinate.
+         */
+        y_min: number;
+        /**
+         * Maximum X coordinate.
+         */
+        x_max: number;
+        /**
+         * Maximum Y coordinate.
+         */
+        y_max: number;
+    }[];
+    /**
+     * Reasoning trace for the `query` task when reasoning=true. Null otherwise.
+     */
+    reasoning?: {
+        /**
+         * Reasoning text.
+         */
+        text: string;
+        /**
+         * Grounding information.
+         */
+        grounding?: {}[];
+    };
+}
+declare abstract class Base_Ai_Cf_Moondream_Moondream3_1_9B_A2B {
+    inputs: Ai_Cf_Moondream_Moondream3_1_9B_A2B_Input;
+    postProcessedOutputs: Ai_Cf_Moondream_Moondream3_1_9B_A2B_Output;
+}
+declare abstract class Base_Ai_Cf_Deepseek_Ai_Deepseek_V4_Flash_0731 {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+declare abstract class Base_Ai_Cf_Deepseek_Ai_Deepseek_V4_Pro_0813 {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+declare abstract class Base_Ai_Cf_Qwen_Qwen3_8_27B {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+declare abstract class Base_Ai_Cf_Zai_Org_Glm_5_3_Flash {
+    inputs: ChatCompletionsInput;
+    postProcessedOutputs: ChatCompletionsOutput;
+}
+interface AiModels {
+    "@cf/huggingface/distilbert-sst-2-int8": BaseAiTextClassification;
+    "@cf/stabilityai/stable-diffusion-xl-base-1.0": BaseAiTextToImage;
+    "@cf/runwayml/stable-diffusion-v1-5-inpainting": BaseAiTextToImage;
+    "@cf/runwayml/stable-diffusion-v1-5-img2img": BaseAiTextToImage;
+    "@cf/lykon/dreamshaper-8-lcm": BaseAiTextToImage;
+    "@cf/bytedance/stable-diffusion-xl-lightning": BaseAiTextToImage;
+    "@cf/myshell-ai/melotts": BaseAiTextToSpeech;
+    "@cf/google/embeddinggemma-300m": BaseAiTextEmbeddings;
+    "@cf/microsoft/resnet-50": BaseAiImageClassification;
+    "@cf/meta/llama-2-7b-chat-int8": BaseAiTextGeneration;
+    "@cf/mistral/mistral-7b-instruct-v0.1": BaseAiTextGeneration;
+    "@cf/meta/llama-2-7b-chat-fp16": BaseAiTextGeneration;
+    "@hf/thebloke/llama-2-13b-chat-awq": BaseAiTextGeneration;
+    "@hf/thebloke/mistral-7b-instruct-v0.1-awq": BaseAiTextGeneration;
+    "@hf/thebloke/zephyr-7b-beta-awq": BaseAiTextGeneration;
+    "@hf/thebloke/openhermes-2.5-mistral-7b-awq": BaseAiTextGeneration;
+    "@hf/thebloke/neural-chat-7b-v3-1-awq": BaseAiTextGeneration;
+    "@hf/thebloke/deepseek-coder-6.7b-base-awq": BaseAiTextGeneration;
+    "@hf/thebloke/deepseek-coder-6.7b-instruct-awq": BaseAiTextGeneration;
+    "@cf/deepseek-ai/deepseek-math-7b-instruct": BaseAiTextGeneration;
+    "@cf/defog/sqlcoder-7b-2": BaseAiTextGeneration;
+    "@cf/openchat/openchat-3.5-0106": BaseAiTextGeneration;
+    "@cf/tiiuae/falcon-7b-instruct": BaseAiTextGeneration;
+    "@cf/thebloke/discolm-german-7b-v1-awq": BaseAiTextGeneration;
+    "@cf/qwen/qwen1.5-0.5b-chat": BaseAiTextGeneration;
+    "@cf/qwen/qwen1.5-7b-chat-awq": BaseAiTextGeneration;
+    "@cf/qwen/qwen1.5-14b-chat-awq": BaseAiTextGeneration;
+    "@cf/tinyllama/tinyllama-1.1b-chat-v1.0": BaseAiTextGeneration;
+    "@cf/microsoft/phi-2": BaseAiTextGeneration;
+    "@cf/qwen/qwen1.5-1.8b-chat": BaseAiTextGeneration;
+    "@cf/mistral/mistral-7b-instruct-v0.2-lora": BaseAiTextGeneration;
+    "@hf/nousresearch/hermes-2-pro-mistral-7b": BaseAiTextGeneration;
+    "@hf/nexusflow/starling-lm-7b-beta": BaseAiTextGeneration;
+    "@hf/google/gemma-7b-it": BaseAiTextGeneration;
+    "@cf/meta-llama/llama-2-7b-chat-hf-lora": BaseAiTextGeneration;
+    "@cf/google/gemma-2b-it-lora": BaseAiTextGeneration;
+    "@cf/google/gemma-7b-it-lora": BaseAiTextGeneration;
+    "@hf/mistral/mistral-7b-instruct-v0.2": BaseAiTextGeneration;
+    "@cf/meta/llama-3-8b-instruct": BaseAiTextGeneration;
+    "@cf/fblgit/una-cybertron-7b-v2-bf16": BaseAiTextGeneration;
+    "@cf/meta/llama-3-8b-instruct-awq": BaseAiTextGeneration;
+    "@cf/meta/llama-3.1-8b-instruct-fp8": BaseAiTextGeneration;
+    "@cf/meta/llama-3.1-8b-instruct-awq": BaseAiTextGeneration;
+    "@cf/meta/llama-3.2-3b-instruct": BaseAiTextGeneration;
+    "@cf/meta/llama-3.2-1b-instruct": BaseAiTextGeneration;
+    "@cf/deepseek-ai/deepseek-r1-distill-qwen-32b": BaseAiTextGeneration;
+    "@cf/ibm-granite/granite-4.0-h-micro": BaseAiTextGeneration;
+    "@cf/facebook/bart-large-cnn": BaseAiSummarization;
+    "@cf/llava-hf/llava-1.5-7b-hf": BaseAiImageToText;
+    "@cf/baai/bge-base-en-v1.5": Base_Ai_Cf_Baai_Bge_Base_En_V1_5;
+    "@cf/openai/whisper": Base_Ai_Cf_Openai_Whisper;
+    "@cf/meta/m2m100-1.2b": Base_Ai_Cf_Meta_M2M100_1_2B;
+    "@cf/baai/bge-small-en-v1.5": Base_Ai_Cf_Baai_Bge_Small_En_V1_5;
+    "@cf/baai/bge-large-en-v1.5": Base_Ai_Cf_Baai_Bge_Large_En_V1_5;
+    "@cf/unum/uform-gen2-qwen-500m": Base_Ai_Cf_Unum_Uform_Gen2_Qwen_500M;
+    "@cf/openai/whisper-tiny-en": Base_Ai_Cf_Openai_Whisper_Tiny_En;
+    "@cf/openai/whisper-large-v3-turbo": Base_Ai_Cf_Openai_Whisper_Large_V3_Turbo;
+    "@cf/baai/bge-m3": Base_Ai_Cf_Baai_Bge_M3;
+    "@cf/black-forest-labs/flux-1-schnell": Base_Ai_Cf_Black_Forest_Labs_Flux_1_Schnell;
+    "@cf/meta/llama-3.2-11b-vision-instruct": Base_Ai_Cf_Meta_Llama_3_2_11B_Vision_Instruct;
+    "@cf/meta/llama-3.3-70b-instruct-fp8-fast": Base_Ai_Cf_Meta_Llama_3_3_70B_Instruct_Fp8_Fast;
+    "@cf/meta/llama-guard-3-8b": Base_Ai_Cf_Meta_Llama_Guard_3_8B;
+    "@cf/baai/bge-reranker-base": Base_Ai_Cf_Baai_Bge_Reranker_Base;
+    "@cf/qwen/qwen2.5-coder-32b-instruct": Base_Ai_Cf_Qwen_Qwen2_5_Coder_32B_Instruct;
+    "@cf/qwen/qwq-32b": Base_Ai_Cf_Qwen_Qwq_32B;
+    "@cf/mistralai/mistral-small-3.1-24b-instruct": Base_Ai_Cf_Mistralai_Mistral_Small_3_1_24B_Instruct;
+    "@cf/google/gemma-3-12b-it": Base_Ai_Cf_Google_Gemma_3_12B_It;
+    "@cf/meta/llama-4-scout-17b-16e-instruct": Base_Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct;
+    "@cf/qwen/qwen3-30b-a3b-fp8": Base_Ai_Cf_Qwen_Qwen3_30B_A3B_Fp8;
+    "@cf/deepgram/nova-3": Base_Ai_Cf_Deepgram_Nova_3;
+    "@cf/qwen/qwen3-embedding-0.6b": Base_Ai_Cf_Qwen_Qwen3_Embedding_0_6B;
+    "@cf/pipecat-ai/smart-turn-v2": Base_Ai_Cf_Pipecat_Ai_Smart_Turn_V2;
+    "@cf/openai/gpt-oss-120b": Base_Ai_Cf_Openai_Gpt_Oss_120B;
+    "@cf/openai/gpt-oss-20b": Base_Ai_Cf_Openai_Gpt_Oss_20B;
+    "@cf/leonardo/phoenix-1.0": Base_Ai_Cf_Leonardo_Phoenix_1_0;
+    "@cf/leonardo/lucid-origin": Base_Ai_Cf_Leonardo_Lucid_Origin;
+    "@cf/deepgram/aura-1": Base_Ai_Cf_Deepgram_Aura_1;
+    "@cf/ai4bharat/indictrans2-en-indic-1B": Base_Ai_Cf_Ai4Bharat_Indictrans2_En_Indic_1B;
+    "@cf/aisingapore/gemma-sea-lion-v4-27b-it": Base_Ai_Cf_Aisingapore_Gemma_Sea_Lion_V4_27B_It;
+    "@cf/pfnet/plamo-embedding-1b": Base_Ai_Cf_Pfnet_Plamo_Embedding_1B;
+    "@cf/deepgram/flux": Base_Ai_Cf_Deepgram_Flux;
+    "@cf/deepgram/aura-2-en": Base_Ai_Cf_Deepgram_Aura_2_En;
+    "@cf/deepgram/aura-2-es": Base_Ai_Cf_Deepgram_Aura_2_Es;
+    "@cf/black-forest-labs/flux-2-dev": Base_Ai_Cf_Black_Forest_Labs_Flux_2_Dev;
+    "@cf/black-forest-labs/flux-2-klein-4b": Base_Ai_Cf_Black_Forest_Labs_Flux_2_Klein_4B;
+    "@cf/black-forest-labs/flux-2-klein-9b": Base_Ai_Cf_Black_Forest_Labs_Flux_2_Klein_9B;
+    "@cf/zai-org/glm-4.7-flash": Base_Ai_Cf_Zai_Org_Glm_4_7_Flash;
+    "@cf/moonshotai/kimi-k2.5": Base_Ai_Cf_Moonshotai_Kimi_K2_5;
+    "@cf/moonshotai/kimi-k2.6": Base_Ai_Cf_Moonshotai_Kimi_K2_6;
+    "@cf/nvidia/nemotron-3-120b-a12b": Base_Ai_Cf_Nvidia_Nemotron_3_120B_A12B;
+    "@cf/google/gemma-4-26b-a4b-it": Base_Ai_Cf_Google_Gemma_4_26B_A4B_IT;
+    "@cf/moonshotai/kimi-k2.7-code": Base_Ai_Cf_Moonshotai_Kimi_K2_7_Code;
+    "@cf/zai-org/glm-5.2": Base_Ai_Cf_Zai_Org_Glm_5_2;
+    "@cf/moondream/moondream3.1-9B-A2B": Base_Ai_Cf_Moondream_Moondream3_1_9B_A2B;
+    "@cf/deepseek-ai/deepseek-v4-flash-0731": Base_Ai_Cf_Deepseek_Ai_Deepseek_V4_Flash_0731;
+    "@cf/deepseek-ai/deepseek-v4-pro-0813": Base_Ai_Cf_Deepseek_Ai_Deepseek_V4_Pro_0813;
+    "@cf/qwen/qwen3.8-27b": Base_Ai_Cf_Qwen_Qwen3_8_27B;
+    "@cf/zai-org/glm-5.3-flash": Base_Ai_Cf_Zai_Org_Glm_5_3_Flash;
+}
+type AiOptions = {
+    /**
+     * Send requests as an asynchronous batch job, only works for supported models
+     * https://developers.cloudflare.com/workers-ai/features/batch-api
+     */
+    queueRequest?: boolean;
+    /**
+     * Establish websocket connections, only works for supported models
+     */
+    websocket?: boolean;
+    /**
+     * Tag your requests to group and view them in Cloudflare dashboard.
+     *
+     * Rules:
+     * Tags must only contain letters, numbers, and the symbols: : - . / @
+     * Each tag can have maximum 50 characters.
+     * Maximum 5 tags are allowed each request.
+     * Duplicate tags will removed.
+     */
+    tags?: string[];
+    gateway?: GatewayOptions;
+    returnRawResponse?: boolean;
+    prefix?: string;
+    extraHeaders?: object;
+    signal?: AbortSignal;
+};
+type AiModelsSearchParams = {
+    author?: string;
+    hide_experimental?: boolean;
+    page?: number;
+    per_page?: number;
+    search?: string;
+    source?: number;
+    task?: string;
+};
+type AiModelsSearchObject = {
+    id: string;
+    source: number;
+    name: string;
+    description: string;
+    task: {
+        id: string;
+        name: string;
+        description: string;
+    };
+    tags: string[];
+    properties: {
+        property_id: string;
+        value: string;
+    }[];
+};
+type ChatCompletionsBase = ChatCompletionsMessagesInput;
+type ChatCompletionsInput = ChatCompletionsMessagesInput;
+interface InferenceUpstreamError extends Error {
+}
+interface AiInternalError extends Error {
+}
+type AiModelListType = Record<string, any>;
+type AiAsyncBatchResponse = {
+    request_id: string;
+};
+declare abstract class Ai<AiModelList extends AiModelListType = AiModels> {
+    aiGatewayLogId: string | null;
+    gateway(gatewayId: string): AiGateway;
+    /**
+     * @deprecated Use the standalone `ai_search_namespaces` or `ai_search` Workers bindings instead.
+     * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+     */
+    aiSearch(): AiSearchNamespace;
+    /**
+     * @deprecated AutoRAG has been replaced by AI Search.
+     * Use the standalone `ai_search_namespaces` or `ai_search` Workers bindings instead.
+     * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+     *
+     * @param autoragId Instance ID
+     */
+    autorag(autoragId: string): AutoRAG;
+    // Batch request
+    run<Name extends keyof AiModelList>(model: Name, inputs: {
+        requests: AiModelList[Name]['inputs'][];
+    }, options: AiOptions & {
+        queueRequest: true;
+    }): Promise<AiAsyncBatchResponse>;
+    // Raw response
+    run<Name extends keyof AiModelList>(model: Name, inputs: AiModelList[Name]['inputs'], options: AiOptions & {
+        returnRawResponse: true;
+    }): Promise<Response>;
+    // WebSocket
+    run<Name extends keyof AiModelList>(model: Name, inputs: AiModelList[Name]['inputs'], options: AiOptions & {
+        websocket: true;
+    }): Promise<Response>;
+    // Streaming
+    run<Name extends keyof AiModelList>(model: Name, inputs: AiModelList[Name]['inputs'] & {
+        stream: true;
+    }, options?: AiOptions): Promise<ReadableStream>;
+    // Normal (default) - known model
+    run<Name extends keyof AiModelList>(model: Name, inputs: AiModelList[Name]['inputs'], options?: AiOptions): Promise<AiModelList[Name]['postProcessedOutputs']>;
+    // Unknown model (fallback).
+    //
+    // The `Exclude<..., keyof AiModelList>` constraint forces TypeScript to
+    // route any model name that is a literal key of `AiModelList` to one of
+    // the known-model overloads above (so input/output mismatches surface as
+    // type errors rather than silently falling back to `Record<string, unknown>`).
+    // Names that aren't in `AiModelList` — e.g. third-party gateway models
+    // like `"google/nano-banana"` — still hit this overload.
+    run<Model extends string>(model: Model extends keyof AiModelList ? never : Model, inputs: Record<string, unknown>, options?: AiOptions): Promise<Record<string, unknown>>;
+    models(params?: AiModelsSearchParams): Promise<AiModelsSearchObject[]>;
+    toMarkdown(): ToMarkdownService;
+    toMarkdown(files: MarkdownDocument[], options?: ConversionRequestOptions): Promise<ConversionResponse[]>;
+    toMarkdown(files: MarkdownDocument, options?: ConversionRequestOptions): Promise<ConversionResponse>;
+}
+type GatewayRetries = {
+    maxAttempts?: 1 | 2 | 3 | 4 | 5;
+    retryDelayMs?: number;
+    backoff?: 'constant' | 'linear' | 'exponential';
+};
+type GatewayOptions = {
+    id: string;
+    cacheKey?: string;
+    cacheTtl?: number;
+    skipCache?: boolean;
+    metadata?: Record<string, number | string | boolean | null | bigint>;
+    collectLog?: boolean;
+    eventId?: string;
+    requestTimeoutMs?: number;
+    retries?: GatewayRetries;
+};
+type UniversalGatewayOptions = Exclude<GatewayOptions, 'id'> & {
+    /**
+     ** @deprecated
+     */
+    id?: string;
+};
+type AiGatewayPatchLog = {
+    score?: number | null;
+    feedback?: -1 | 1 | null;
+    metadata?: Record<string, number | string | boolean | null | bigint> | null;
+};
+type AiGatewayLog = {
+    id: string;
+    provider: string;
+    model: string;
+    model_type?: string;
+    path: string;
+    duration: number;
+    request_type?: string;
+    request_content_type?: string;
+    status_code: number;
+    response_content_type?: string;
+    success: boolean;
+    cached: boolean;
+    tokens_in?: number;
+    tokens_out?: number;
+    metadata?: Record<string, number | string | boolean | null | bigint>;
+    step?: number;
+    cost?: number;
+    custom_cost?: boolean;
+    request_size: number;
+    request_head?: string;
+    request_head_complete: boolean;
+    response_size: number;
+    response_head?: string;
+    response_head_complete: boolean;
+    created_at: Date;
+};
+type AIGatewayProviders = 'workers-ai' | 'anthropic' | 'aws-bedrock' | 'azure-openai' | 'google-vertex-ai' | 'huggingface' | 'openai' | 'perplexity-ai' | 'replicate' | 'groq' | 'cohere' | 'google-ai-studio' | 'mistral' | 'grok' | 'openrouter' | 'deepseek' | 'cerebras' | 'cartesia' | 'elevenlabs' | 'adobe-firefly';
+type AIGatewayHeaders = {
+    'cf-aig-metadata': Record<string, number | string | boolean | null | bigint> | string;
+    'cf-aig-custom-cost': {
+        per_token_in?: number;
+        per_token_out?: number;
+    } | {
+        total_cost?: number;
+    } | string;
+    'cf-aig-cache-ttl': number | string;
+    'cf-aig-skip-cache': boolean | string;
+    'cf-aig-cache-key': string;
+    'cf-aig-event-id': string;
+    'cf-aig-request-timeout': number | string;
+    'cf-aig-max-attempts': number | string;
+    'cf-aig-retry-delay': number | string;
+    'cf-aig-backoff': string;
+    'cf-aig-collect-log': boolean | string;
+    Authorization: string;
+    'Content-Type': string;
+    [key: string]: string | number | boolean | object;
+};
+type AIGatewayUniversalRequest = {
+    provider: AIGatewayProviders | string; // eslint-disable-line
+    endpoint: string;
+    headers: Partial<AIGatewayHeaders>;
+    query: unknown;
+};
+interface AiGatewayInternalError extends Error {
+}
+interface AiGatewayLogNotFound extends Error {
+}
+declare abstract class AiGateway {
+    patchLog(logId: string, data: AiGatewayPatchLog): Promise<void>;
+    getLog(logId: string): Promise<AiGatewayLog>;
+    run(data: AIGatewayUniversalRequest | AIGatewayUniversalRequest[], options?: {
+        gateway?: UniversalGatewayOptions;
+        extraHeaders?: object;
+        signal?: AbortSignal;
+    }): Promise<Response>;
+    getUrl(provider?: AIGatewayProviders | string): Promise<string>; // eslint-disable-line
+}
+// Copyright (c) 2022-2025 Cloudflare, Inc.
+// Licensed under the Apache 2.0 license found in the LICENSE file or at:
+//     https://opensource.org/licenses/Apache-2.0
+/**
+ * Artifacts — Git-compatible file storage on Cloudflare Workers.
+ *
+ * Provides programmatic access to create, manage, and fork repositories,
+ * and to issue and revoke scoped access tokens.
+ */
+/** Information about a repository. */
+interface ArtifactsRepoInfo {
+    /** Unique repository ID. */
+    id: string;
+    /** Repository name. */
+    name: string;
+    /** Repository description, or null if not set. */
+    description: string | null;
+    /** Default branch name (e.g. "main"). */
+    defaultBranch: string;
+    /** ISO 8601 creation timestamp. */
+    createdAt: string;
+    /** ISO 8601 last-updated timestamp. */
+    updatedAt: string;
+    /** ISO 8601 timestamp of the last push, or null if never pushed. */
+    lastPushAt: string | null;
+    /** Fork source (e.g. "github:owner/repo", "artifacts:namespace/repo"), or null if not a fork. */
+    source: string | null;
+    /** Whether the repository is read-only. */
+    readOnly: boolean;
+    /** HTTPS git remote URL. */
+    remote: string;
+}
+/** Result of creating a repository — includes the initial access token. */
+interface ArtifactsCreateRepoResult {
+    /** Unique repository ID. */
+    id: string;
+    /** Repository name. */
+    name: string;
+    /** Repository description, or null if not set. */
+    description: string | null;
+    /** Default branch name. */
+    defaultBranch: string;
+    /** HTTPS git remote URL. */
+    remote: string;
+    /** Plaintext access token (only returned at creation time). */
+    token: string;
+    /** ISO 8601 token expiry timestamp. */
+    tokenExpiresAt: string;
+}
+/** Paginated list of repositories. */
+interface ArtifactsRepoListResult {
+    /** Repositories in this page (without the `remote` field). */
+    repos: Omit<ArtifactsRepoInfo, 'remote'>[];
+    /** Total number of repositories in the namespace. */
+    total: number;
+    /** Cursor for the next page, if there are more results. */
+    cursor?: string;
+}
+/** Result of creating an access token. */
+interface ArtifactsCreateTokenResult {
+    /** Unique token ID. */
+    id: string;
+    /** Plaintext token (only returned at creation time). */
+    plaintext: string;
+    /** Token scope: "read" or "write". */
+    scope: 'read' | 'write';
+    /** ISO 8601 token expiry timestamp. */
+    expiresAt: string;
+}
+/** Token metadata (no plaintext). */
+interface ArtifactsTokenInfo {
+    /** Unique token ID. */
+    id: string;
+    /** Token scope: "read" or "write". */
+    scope: 'read' | 'write';
+    /** Token state: "active", "expired", or "revoked". */
+    state: 'active' | 'expired' | 'revoked';
+    /** ISO 8601 creation timestamp. */
+    createdAt: string;
+    /** ISO 8601 expiry timestamp. */
+    expiresAt: string;
+}
+/** Paginated list of tokens for a repository. */
+interface ArtifactsTokenListResult {
+    /** Tokens in this page. */
+    tokens: ArtifactsTokenInfo[];
+    /** Total number of tokens for the repository. */
+    total: number;
+}
+/**
+ * Handle for a single repository. Returned by Artifacts.get().
+ *
+ * Methods may throw `ArtifactsError` with code `INTERNAL_ERROR` if an unexpected service error occurs.
+ */
+interface ArtifactsRepo extends ArtifactsRepoInfo {
+    /**
+     * Create an access token for this repo.
+     * @param scope Token scope: "write" (default) or "read".
+     * @param ttl Time-to-live in seconds (default 86400, min 60, max 31536000).
+     * @throws {ArtifactsError} with code `INVALID_TTL` if ttl is out of range.
+     */
+    createToken(scope?: 'write' | 'read', ttl?: number): Promise<ArtifactsCreateTokenResult>;
+    /** List tokens for this repo (metadata only, no plaintext). */
+    listTokens(): Promise<ArtifactsTokenListResult>;
+    /**
+     * Revoke a token by plaintext or ID.
+     * @param tokenOrId Plaintext token or token ID.
+     * @returns true if revoked, false if not found.
+     * @throws {ArtifactsError} with code `INVALID_INPUT` if tokenOrId is empty.
+     */
+    revokeToken(tokenOrId: string): Promise<boolean>;
+    // ── Fork ──
+    /**
+     * Fork this repo to a new repo.
+     * @param name Target repository name.
+     * @param opts Optional: description, readOnly flag, defaultBranchOnly (default true).
+     * @throws {ArtifactsError} with code `INVALID_REPO_NAME` if name is invalid.
+     * @throws {ArtifactsError} with code `ALREADY_EXISTS` if the target repo already exists.
+     * @throws {ArtifactsError} with code `FORK_IN_PROGRESS` if a fork is already running.
+     */
+    fork(name: string, opts?: {
+        description?: string;
+        readOnly?: boolean;
+        defaultBranchOnly?: boolean;
+    }): Promise<ArtifactsCreateRepoResult>;
+}
+// ── Error types ──────────────────────────────────────────────────────────────
+/**
+ * Error codes returned by Artifacts binding operations.
+ *
+ * Each code maps to a numeric code available on `ArtifactsError.numericCode`.
+ */
+type ArtifactsErrorCode = 'ALREADY_EXISTS' | 'NOT_FOUND' | 'IMPORT_IN_PROGRESS' | 'FORK_IN_PROGRESS' | 'INVALID_INPUT' | 'INVALID_REPO_NAME' | 'INVALID_TTL' | 'INVALID_URL' | 'REMOTE_AUTH_REQUIRED' | 'UPSTREAM_UNAVAILABLE' | 'MEMORY_LIMIT' | 'INTERNAL_ERROR';
+/**
+ * Error thrown by Artifacts binding operations.
+ *
+ * Uses a string `.code` discriminator following the Cloudflare platform
+ * convention (StreamError, ImagesError, etc.). The `.numericCode` matches
+ * the REST API `errors[].code` values.
+ */
+interface ArtifactsError extends Error {
+    readonly name: 'ArtifactsError';
+    /** String error code for programmatic matching. */
+    readonly code: ArtifactsErrorCode;
+    /** Numeric error code matching the REST API. */
+    readonly numericCode: number;
+}
+// ── Binding ──────────────────────────────────────────────────────────────────
+/**
+ * Artifacts binding — namespace-level operations.
+ *
+ * Methods may throw `ArtifactsError` with code `INTERNAL_ERROR` if an unexpected service error occurs.
+ */
+interface Artifacts {
+    /**
+     * Create a new repository with an initial access token.
+     * @param name Repository name (alphanumeric, dots, hyphens, underscores).
+     * @param opts Optional: readOnly flag, description, default branch name.
+     * @returns Repo metadata with initial token.
+     * @throws {ArtifactsError} with code `INVALID_REPO_NAME` if name is invalid.
+     * @throws {ArtifactsError} with code `ALREADY_EXISTS` if the repo already exists.
+     */
+    create(name: string, opts?: {
+        readOnly?: boolean;
+        description?: string;
+        setDefaultBranch?: string;
+    }): Promise<ArtifactsCreateRepoResult>;
+    /**
+     * Get a handle to an existing repository.
+     * @param name Repository name.
+     * @returns Repo handle.
+     * @throws {ArtifactsError} with code `NOT_FOUND` if the repo does not exist.
+     * @throws {ArtifactsError} with code `IMPORT_IN_PROGRESS` if the repo is still importing.
+     * @throws {ArtifactsError} with code `FORK_IN_PROGRESS` if the repo is still forking.
+     */
+    get(name: string): Promise<ArtifactsRepo>;
+    /**
+     * Import a repository from an external git remote.
+     * @param params Source URL and optional branch/depth, plus target name and options.
+     * @returns Repo metadata with initial token.
+     * @throws {ArtifactsError} with code `INVALID_REPO_NAME` if the target name is invalid.
+     * @throws {ArtifactsError} with code `INVALID_INPUT` if the source URL is not valid HTTPS.
+     * @throws {ArtifactsError} with code `INVALID_URL` if the source URL does not point to a git repository.
+     * @throws {ArtifactsError} with code `REMOTE_AUTH_REQUIRED` if the remote requires authentication.
+     * @throws {ArtifactsError} with code `NOT_FOUND` if the remote repository does not exist.
+     * @throws {ArtifactsError} with code `UPSTREAM_UNAVAILABLE` if the remote cannot be reached.
+     * @throws {ArtifactsError} with code `MEMORY_LIMIT` if the import exceeds service memory limits.
+     * @throws {ArtifactsError} with code `ALREADY_EXISTS` if the target repo already exists.
+     */
+    import(params: {
+        source: {
+            url: string;
+            branch?: string;
+            depth?: number;
+        };
+        target: {
+            name: string;
+            opts?: {
+                description?: string;
+                readOnly?: boolean;
+            };
+        };
+    }): Promise<ArtifactsCreateRepoResult>;
+    /**
+     * List repositories with cursor-based pagination.
+     * @param opts Optional: limit (1–200, default 50), cursor for next page.
+     */
+    list(opts?: {
+        limit?: number;
+        cursor?: string;
+    }): Promise<ArtifactsRepoListResult>;
+    /**
+     * Delete a repository and all associated tokens.
+     * @param name Repository name.
+     * @returns true if deleted, false if not found.
+     * @throws {ArtifactsError} with code `INVALID_REPO_NAME` if name is invalid.
+     */
+    delete(name: string): Promise<boolean>;
+}
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+interface AutoRAGInternalError extends Error {
+}
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+interface AutoRAGNotFoundError extends Error {
+}
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+interface AutoRAGUnauthorizedError extends Error {
+}
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+interface AutoRAGNameNotSetError extends Error {
+}
+type ComparisonFilter = {
+    key: string;
+    type: 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte';
+    value: string | number | boolean;
+};
+type CompoundFilter = {
+    type: 'and' | 'or';
+    filters: ComparisonFilter[];
+};
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+type AutoRagSearchRequest = {
+    query: string;
+    filters?: CompoundFilter | ComparisonFilter;
+    max_num_results?: number;
+    ranking_options?: {
+        ranker?: string;
+        score_threshold?: number;
+    };
+    reranking?: {
+        enabled?: boolean;
+        model?: string;
+    };
+    rewrite_query?: boolean;
+};
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+type AutoRagAiSearchRequest = AutoRagSearchRequest & {
+    stream?: boolean;
+    system_prompt?: string;
+};
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+type AutoRagAiSearchRequestStreaming = Omit<AutoRagAiSearchRequest, 'stream'> & {
+    stream: true;
+};
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+type AutoRagSearchResponse = {
+    object: 'vector_store.search_results.page';
+    search_query: string;
+    data: {
+        file_id: string;
+        filename: string;
+        score: number;
+        attributes: Record<string, string | number | boolean | null>;
+        content: {
+            type: 'text';
+            text: string;
+        }[];
+    }[];
+    has_more: boolean;
+    next_page: string | null;
+};
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+type AutoRagListResponse = {
+    id: string;
+    enable: boolean;
+    type: string;
+    source: string;
+    vectorize_name: string;
+    paused: boolean;
+    status: string;
+}[];
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+type AutoRagAiSearchResponse = AutoRagSearchResponse & {
+    response: string;
+};
+/**
+ * @deprecated Use the standalone AI Search Workers binding instead.
+ * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+ */
+declare abstract class AutoRAG {
+    /**
+     * @deprecated Use the standalone AI Search Workers binding instead.
+     * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+     */
+    list(): Promise<AutoRagListResponse>;
+    /**
+     * @deprecated Use the standalone AI Search Workers binding instead.
+     * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+     */
+    search(params: AutoRagSearchRequest): Promise<AutoRagSearchResponse>;
+    /**
+     * @deprecated Use the standalone AI Search Workers binding instead.
+     * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+     */
+    aiSearch(params: AutoRagAiSearchRequestStreaming): Promise<Response>;
+    /**
+     * @deprecated Use the standalone AI Search Workers binding instead.
+     * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+     */
+    aiSearch(params: AutoRagAiSearchRequest): Promise<AutoRagAiSearchResponse>;
+    /**
+     * @deprecated Use the standalone AI Search Workers binding instead.
+     * See https://developers.cloudflare.com/ai-search/usage/workers-binding/
+     */
+    aiSearch(params: AutoRagAiSearchRequest): Promise<AutoRagAiSearchResponse | Response>;
+}
+type BrowserRunLifecycleEvent = 'load' | 'domcontentloaded' | 'networkidle0' | 'networkidle2';
+type BrowserRunResourceType = 'document' | 'stylesheet' | 'image' | 'media' | 'font' | 'script' | 'texttrack' | 'xhr' | 'fetch' | 'prefetch' | 'eventsource' | 'websocket' | 'manifest' | 'signedexchange' | 'ping' | 'cspviolationreport' | 'preflight' | 'other';
+/** Options fields shared by all quick actions. */
+interface BrowserRunBaseOptions {
+    /** Adds `<script>` tags into the page with the desired URL or content.
+     * @see https://pptr.dev/api/puppeteer.frameaddscripttagoptions
+     */
+    addScriptTag?: Array<{
+        content?: string;
+        url?: string;
+        type?: string;
+        id?: string;
+    }>;
+    /** Adds `<link rel="stylesheet">` or `<style>` tags into the page.
+     * @see https://pptr.dev/api/puppeteer.frameaddstyletagoptions
+     */
+    addStyleTag?: Array<{
+        content?: string;
+        url?: string;
+    }>;
+    /** Provide credentials for HTTP authentication. @see https://pptr.dev/api/puppeteer.credentials */
+    authenticate?: {
+        username: string;
+        password: string;
+    };
+    /** Set cookies before navigating. @see https://pptr.dev/api/puppeteer.cookieparam */
+    cookies?: Array<{
+        name: string;
+        value: string;
+        url?: string;
+        domain?: string;
+        path?: string;
+        secure?: boolean;
+        httpOnly?: boolean;
+        sameSite?: 'Strict' | 'Lax' | 'None';
+        expires?: number;
+        priority?: 'Low' | 'Medium' | 'High';
+        sameParty?: boolean;
+        sourceScheme?: 'Unset' | 'NonSecure' | 'Secure';
+        sourcePort?: number;
+        partitionKey?: string;
+    }>;
+    /** Emulate a specific CSS media type (e.g. `"screen"`, `"print"`). */
+    emulateMediaType?: string;
+    /** Navigation options. @see https://pptr.dev/api/puppeteer.gotooptions */
+    gotoOptions?: {
+        /** Navigation timeout in milliseconds (max 60 000). @default 30000 */
+        timeout?: number;
+        /** When to consider navigation complete. @default "domcontentloaded" */
+        waitUntil?: BrowserRunLifecycleEvent | BrowserRunLifecycleEvent[];
+        referer?: string;
+        referrerPolicy?: string;
+    };
+    /** Block requests matching these regex patterns. Mutually exclusive with `allowRequestPattern`. */
+    rejectRequestPattern?: string[];
+    /** Only allow requests matching these regex patterns. Mutually exclusive with `rejectRequestPattern`. */
+    allowRequestPattern?: string[];
+    /** Block requests of these resource types. Mutually exclusive with `allowResourceTypes`. */
+    rejectResourceTypes?: BrowserRunResourceType[];
+    /** Only allow requests of these resource types. Mutually exclusive with `rejectResourceTypes`. */
+    allowResourceTypes?: BrowserRunResourceType[];
+    /** Additional HTTP headers sent with every request. */
+    setExtraHTTPHeaders?: Record<string, string>;
+    /** Whether JavaScript is enabled on the page. */
+    setJavaScriptEnabled?: boolean;
+    /** Override the default user agent string.
+     * @default "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
+     * */
+    userAgent?: string;
+    /** Set the browser viewport size.
+     * @see https://pptr.dev/api/puppeteer.viewport
+     * @default {width:1920,height:1080}
+     * */
+    viewport?: {
+        width: number;
+        height: number;
+        deviceScaleFactor?: number;
+        isMobile?: boolean;
+        isLandscape?: boolean;
+        hasTouch?: boolean;
+    };
+    /** Wait for a CSS selector to appear in the page before proceeding.
+     * @see https://pptr.dev/api/puppeteer.waitforselectoroptions
+     */
+    waitForSelector?: {
+        selector: string;
+        hidden?: true;
+        visible?: true;
+        /** Timeout in milliseconds. Max 120000 */
+        timeout?: number;
+    };
+    /** Wait for a fixed delay in milliseconds before proceeding. Max 120000 */
+    waitForTimeout?: number;
+    /** When true, continue on best-effort when awaited events fail or timeout. */
+    bestAttempt?: boolean;
+    /** Maximum duration in milliseconds for the browser action after page load. Max 120000 */
+    actionTimeout?: number;
+    /** Cache time to live in seconds (0-86400). Set to 0 to disable.
+     * @default 5
+     */
+    cacheTTL?: number;
+}
+/** Common options shared by all quick actions. Exactly one of `url` or `html` must be provided.*/
+type BrowserRunCommonOptions = (BrowserRunBaseOptions & {
+    /** URL to navigate to, e.g. `"https://example.com"`. */
+    url: string;
+}) | (BrowserRunBaseOptions & {
+    /** Set the HTML content of the page directly. */
+    html: string;
+});
+type BrowserRunPuppeteerScreenshotOptions = {
+    /** @default "png" */
+    type?: 'png' | 'jpeg' | 'webp';
+    /** @default "binary" */
+    encoding?: 'binary' | 'base64';
+    quality?: number;
+    fullPage?: boolean;
+    clip?: {
+        x: number;
+        y: number;
+        width: number;
+        height: number;
+        scale?: number;
+    };
+    omitBackground?: boolean;
+    optimizeForSpeed?: boolean;
+    captureBeyondViewport?: boolean;
+    fromSurface?: boolean;
+};
+type BrowserRunScreenshotOptions = BrowserRunCommonOptions & {
+    /** CSS selector of the element to screenshot. */
+    selector?: string;
+    /** When true, scroll the entire page before taking the screenshot. */
+    scrollPage?: boolean;
+    /** @see https://pptr.dev/api/puppeteer.screenshotoptions */
+    screenshotOptions?: BrowserRunPuppeteerScreenshotOptions;
+};
+type BrowserRunPDFOptions = BrowserRunCommonOptions & {
+    /** @see https://pptr.dev/api/puppeteer.pdfoptions */
+    pdfOptions?: {
+        /** @default 1 */
+        scale?: number;
+        /** @default false */
+        displayHeaderFooter?: boolean;
+        headerTemplate?: string;
+        footerTemplate?: string;
+        /** @default false */
+        printBackground?: boolean;
+        /** @default false */
+        landscape?: boolean;
+        pageRanges?: string;
+        /** @default "letter" */
+        format?: 'letter' | 'legal' | 'tabloid' | 'ledger' | 'a0' | 'a1' | 'a2' | 'a3' | 'a4' | 'a5' | 'a6';
+        width?: string | number;
+        height?: string | number;
+        /** @default false */
+        preferCSSPageSize?: boolean;
+        margin?: {
+            top?: string | number;
+            right?: string | number;
+            bottom?: string | number;
+            left?: string | number;
+        };
+        /** @default false */
+        omitBackground?: boolean;
+        /** @default true */
+        tagged?: boolean;
+        /** @default false */
+        outline?: boolean;
+        /** @default 30000 */
+        timeout?: number;
+    };
+};
+type BrowserRunScrapeOptions = BrowserRunCommonOptions & {
+    /** CSS selectors to scrape. At least one element is required. */
+    elements: Array<{
+        selector: string;
+    }>;
+};
+type BrowserRunLinksOptions = BrowserRunCommonOptions & {
+    /** When true, only return links that are visible on the page. @default false */
+    visibleLinksOnly?: boolean;
+    /** When true, exclude links pointing to external domains. @default false */
+    excludeExternalLinks?: boolean;
+};
+type BrowserRunSnapshotFormat = 'content' | 'screenshot' | 'markdown' | 'accessibilityTree';
+type BrowserRunSnapshotOptions = BrowserRunCommonOptions & {
+    /** Which representations of the page to return. At least two distinct formats
+     * are required; request a single format from its dedicated action instead.
+     * @default ["content","screenshot"]
+     */
+    formats?: BrowserRunSnapshotFormat[];
+    /** @see https://pptr.dev/api/puppeteer.screenshotoptions */
+    screenshotOptions?: Omit<BrowserRunPuppeteerScreenshotOptions, 'encoding'>;
+};
+/** Options for the `accessibilityTree` quick action. */
+type BrowserRunAccessibilityTreeOptions = BrowserRunCommonOptions & {
+    /** When true, prune nodes that carry no semantic meaning, such as generic
+     * containers. Defaults to true, or to false when `root` is set so that the
+     * requested subtree is returned as-is.
+     */
+    interestingOnly?: boolean;
+    /** CSS selector limiting the tree to the matching element's subtree.
+     * A selector that matches nothing yields `accessibilityTree: null` with
+     * HTTP 200; a malformed selector is an error.
+     */
+    root?: string;
+};
+interface BrowserRunJsonBaseOptions {
+    /** Custom AI models to try in order. Max 3. Falls back to next on error. */
+    custom_ai?: Array<{
+        /** Model ID in `<provider>/<model_name>` format, e.g. `"workers-ai/@cf/meta/llama-3.3-70b-instruct-fp8-fast"`. */
+        model: string;
+        /** Bearer token. Not needed for workers-ai models. */
+        authorization?: string;
+    }>;
+}
+/**
+ * Options for the `json` quick action.
+ * At least one of `prompt` or `response_format` must be provided.
+ */
+type BrowserRunJsonOptions = BrowserRunCommonOptions & BrowserRunJsonBaseOptions & ({
+    /** Natural-language prompt describing what data to extract. */
+    prompt: string;
+    /** Structured output schema for the AI model. @see https://developers.cloudflare.com/workers-ai/json-mode/ */
+    response_format?: AiTextGenerationResponseFormat;
+} | {
+    /** Natural-language prompt describing what data to extract. */
+    prompt?: string;
+    /** Structured output schema for the AI model. @see https://developers.cloudflare.com/workers-ai/json-mode/ */
+    response_format: AiTextGenerationResponseFormat;
+});
+type BrowserRunContentOptions = BrowserRunCommonOptions;
+type BrowserRunMarkdownOptions = BrowserRunCommonOptions;
+type BrowserRunRedirectHop = {
+    /** URL that returned the redirect. */
+    url: string;
+    /** HTTP status of the redirect. */
+    status: number;
+    /** Redirect response headers, including `location`. */
+    headers: Record<string, string>;
+};
+type BrowserRunResponseMeta = {
+    /** HTTP status code of the rendered page */
+    status: number;
+    /** Page title */
+    title: string;
+    /** Origin response headers, lowercased. Repeated headers are joined with a newline. Credential and transport-only headers that do not survive rendering are omitted. */
+    headers?: Record<string, string>;
+    /** URL that served the response, after any redirects the browser followed. */
+    finalUrl?: string;
+    /** HTTP redirects followed to reach `finalUrl`, oldest first. Omitted for direct navigation and for client-side redirects such as meta refresh. An empty array means redirects occurred but their intermediate responses could not be read. */
+    redirectChain?: BrowserRunRedirectHop[];
+};
+/**
+ * A node in the page's accessibility tree, as exposed to assistive technology.
+ * `role` is the only field always present; the rest are populated when the
+ * underlying element defines them.
+ * @see https://pptr.dev/api/puppeteer.serializedaxnode
+ */
+interface BrowserRunSerializedAXNode {
+    /** The ARIA role, e.g. `"button"`, `"heading"`, `"RootWebArea"`. */
+    role: string;
+    /** The `aria-autocomplete` value. */
+    autocomplete?: string;
+    /** Checked state of a checkbox, radio, or menu item. */
+    checked?: boolean | 'mixed';
+    /** Accessible description, typically from `aria-describedby` or `title`. */
+    description?: string;
+    disabled?: boolean;
+    expanded?: boolean;
+    /** Whether the element currently holds keyboard focus. */
+    focused?: boolean;
+    /** The kind of popup the element triggers, e.g. `"menu"`, `"dialog"`. */
+    haspopup?: string;
+    /** The `aria-invalid` value. */
+    invalid?: string;
+    /** Keyboard shortcuts bound to the element, from `aria-keyshortcuts`. */
+    keyshortcuts?: string;
+    /** Hierarchical level, e.g. the heading level of an `<h2>`. */
+    level?: number;
+    /** Whether the element is a modal dialog. */
+    modal?: boolean;
+    /** Whether a text input accepts multiple lines. */
+    multiline?: boolean;
+    /** Whether more than one option can be selected. */
+    multiselectable?: boolean;
+    /** Accessible name, e.g. a button's label or an image's alt text. */
+    name?: string;
+    orientation?: string;
+    /** Pressed state of a toggle button. */
+    pressed?: boolean | 'mixed';
+    readonly?: boolean;
+    required?: boolean;
+    /** Author-supplied role description, from `aria-roledescription`. */
+    roledescription?: string;
+    selected?: boolean;
+    /** Current value of an input or range element. */
+    value?: string | number;
+    valuemax?: number;
+    valuemin?: number;
+    /** Human-readable form of `value`, from `aria-valuetext`. */
+    valuetext?: string;
+    /** Child nodes. Absent for leaf nodes. */
+    children?: BrowserRunSerializedAXNode[];
+}
+/** Success response for `content` action. */
+type BrowserRunContentSuccessResponse = {
+    success: true;
+    /** Extracted HTML content */
+    result: string;
+    meta: BrowserRunResponseMeta;
+};
+/** Success response for `links` action. */
+type BrowserRunLinksSuccessResponse = {
+    success: true;
+    /** Extracted links */
+    result: string[];
+    meta: BrowserRunResponseMeta;
+};
+/** Success response for `scrape` action. */
+type BrowserRunScrapeSuccessResponse = {
+    success: true;
+    result: Array<{
+        /** The CSS selector used to find elements. */
+        selector: string;
+        /** Array of elements matching the selector. */
+        results: Array<{
+            /** Outer HTML of the element. */
+            html: string;
+            /** Text content of the element. */
+            text: string;
+            /** Width of the element in pixels. */
+            width: number;
+            /** Height of the element in pixels. */
+            height: number;
+            /** Top position of the element relative to the viewport in pixels. */
+            top: number;
+            /** Left position of the element relative to the viewport in pixels. */
+            left: number;
+            /** Array of HTML attributes on the element. */
+            attributes: Array<{
+                /** Attribute name. */
+                name: string;
+                /** Attribute value. */
+                value: string;
+            }>;
+        }>;
+    }>;
+    meta: BrowserRunResponseMeta;
+};
+/** Success response for `snapshot` action. Each field is present only when the
+ * corresponding entry was requested in `formats`.
+ */
+type BrowserRunSnapshotSuccessResponse = {
+    success: true;
+    result: {
+        /** HTML content of the page. */
+        content?: string;
+        /** Base64-encoded screenshot image. */
+        screenshot?: string;
+        /** Markdown content. Prefixed with YAML frontmatter (e.g. `title`) when the
+         * page provides that metadata.
+         */
+        markdown?: string;
+        /** Root of the page's accessibility tree. */
+        accessibilityTree?: BrowserRunSerializedAXNode;
+    };
+    meta: BrowserRunResponseMeta;
+};
+/** Success response for `accessibilityTree` action. */
+type BrowserRunAccessibilityTreeSuccessResponse = {
+    success: true;
+    result: {
+        /** Root of the accessibility tree, or `null` when `root` matched no element. */
+        accessibilityTree: BrowserRunSerializedAXNode | null;
+    };
+    meta: BrowserRunResponseMeta;
+};
+/** Success response for `json` action. */
+type BrowserRunJsonSuccessResponse = {
+    success: true;
+    /** JSON data extracted from the page using an AI model */
+    result: Record<string, unknown>;
+    meta: BrowserRunResponseMeta;
+};
+/** Success response for `markdown` action. */
+type BrowserRunMarkdownSuccessResponse = {
+    success: true;
+    /** Extracted markdown content */
+    result: string;
+    meta: BrowserRunResponseMeta;
+};
+/** Error response for BrowserRun actions. */
+type BrowserRunErrorResponse = {
+    success: false;
+    errors: {
+        message: string;
+        code?: number;
+        detail?: string;
+        path?: string;
+    }[];
+};
+/** Error response for BrowserRun `json` action. */
+type BrowserRunJsonErrorResponse = BrowserRunErrorResponse & {
+    /** Raw AI response text for debugging */
+    rawAiResponse?: string;
+};
+/**
+ * Browser Run API binding for automating headless browsers.
+ * @see https://developers.cloudflare.com/browser-run/
+ */
+declare abstract class BrowserRun {
+    /**
+     * Send a raw HTTP request to the Browser Run API.
+     * Used by libraries like `@cloudflare/puppeteer` to acquire and connect to a browser instance.
+     * @see https://developers.cloudflare.com/browser-run/
+     */
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    /**
+     * Take a screenshot of a web page.
+     * @param action - Must be `'screenshot'`.
+     * @param options - Screenshot options including viewport, selectors, and image format.
+     * @returns A `Response` containing one of:
+     *
+     * **Success (HTTP 200):**
+     * - Binary image data with `Content-Type: image/png`, `image/jpeg`, or `image/webp` (when `encoding: 'binary'`, the default)
+     * - Data URI string with `Content-Type: text/plain` (when `encoding: 'base64'`)
+     *
+     * **Error:**
+     * - `BrowserRunErrorResponse` JSON with appropriate HTTP status code (400, 422, 429, 500, 503)
+     *
+     * **Headers:**
+     * - `X-Browser-Ms-Used`: Browser time consumed in milliseconds (set when status < 500)
+     */
+    quickAction(action: 'screenshot', options: BrowserRunScreenshotOptions): Promise<Response>;
+    /**
+     * Generate a PDF of a web page.
+     * @param action - Must be `'pdf'`.
+     * @param options - PDF generation options including page size, margins, and headers/footers.
+     * @returns A `Response` containing one of:
+     *
+     * **Success (HTTP 200):**
+     * - Binary PDF data with `Content-Type: application/pdf`
+     *
+     * **Error:**
+     * - `BrowserRunErrorResponse` JSON with appropriate HTTP status code (400, 422, 429, 500, 503)
+     *
+     * **Headers:**
+     * - `X-Browser-Ms-Used`: Browser time consumed in milliseconds (set when status < 500)
+     */
+    quickAction(action: 'pdf', options: BrowserRunPDFOptions): Promise<Response>;
+    /**
+     * Get the HTML content of a web page.
+     * @param action - Must be `'content'`.
+     * @param options - Navigation and page interaction options.
+     * @returns A `Response` containing one of:
+     *
+     * **Success (HTTP 200):**
+     * - `BrowserRunContentSuccessResponse` JSON with `Content-Type: application/json`
+     *
+     * **Error:**
+     * - `BrowserRunErrorResponse` JSON with appropriate HTTP status code (400, 422, 429, 500, 503)
+     *
+     * **Headers:**
+     * - `X-Browser-Ms-Used`: Browser time consumed in milliseconds (set when status < 500)
+     */
+    quickAction(action: 'content', options: BrowserRunContentOptions): Promise<Response>;
+    /**
+     * Scrape elements from a web page by CSS selector.
+     * @param action - Must be `'scrape'`.
+     * @param options - Scrape options with CSS selectors for elements to extract.
+     * @returns A `Response` containing one of:
+     *
+     * **Success (HTTP 200):**
+     * - `BrowserRunScrapeSuccessResponse` JSON with `Content-Type: application/json`
+     *
+     * **Error:**
+     * - `BrowserRunErrorResponse` JSON with appropriate HTTP status code (400, 422, 429, 500, 503)
+     *
+     * **Headers:**
+     * - `X-Browser-Ms-Used`: Browser time consumed in milliseconds (set when status < 500)
+     */
+    quickAction(action: 'scrape', options: BrowserRunScrapeOptions): Promise<Response>;
+    /**
+     * Extract all links from a web page.
+     * @param action - Must be `'links'`.
+     * @param options - Options to filter visible or internal links only.
+     * @returns A `Response` containing one of:
+     *
+     * **Success (HTTP 200):**
+     * - `BrowserRunLinksSuccessResponse` JSON with `Content-Type: application/json`
+     *
+     * **Error:**
+     * - `BrowserRunErrorResponse` JSON with appropriate HTTP status code (400, 422, 429, 500, 503)
+     *
+     * **Headers:**
+     * - `X-Browser-Ms-Used`: Browser time consumed in milliseconds (set when status < 500)
+     */
+    quickAction(action: 'links', options: BrowserRunLinksOptions): Promise<Response>;
+    /**
+     * Get several representations of a web page in one request.
+     * @param action - Must be `'snapshot'`.
+     * @param options - Snapshot options including the `formats` to return and
+     * screenshot settings (encoding is always base64).
+     * @returns A `Response` containing one of:
+     *
+     * **Success (HTTP 200):**
+     * - `BrowserRunSnapshotSuccessResponse` JSON with `Content-Type: application/json`
+     *
+     * **Error:**
+     * - `BrowserRunErrorResponse` JSON with appropriate HTTP status code (400, 422, 429, 500, 503)
+     *
+     * **Headers:**
+     * - `X-Browser-Ms-Used`: Browser time consumed in milliseconds (set when status < 500)
+     */
+    quickAction(action: 'snapshot', options: BrowserRunSnapshotOptions): Promise<Response>;
+    /**
+     * Extract structured JSON data from a web page using AI.
+     * @param action - Must be `'json'`.
+     * @param options - JSON extraction options with prompt or response_format schema.
+     * @returns A `Response` containing one of:
+     *
+     * **Success (HTTP 200):**
+     * - `BrowserRunJsonSuccessResponse` JSON with `Content-Type: application/json`
+     *
+     * **Error:**
+     * - `BrowserRunErrorResponse` JSON with appropriate HTTP status code (400, 422, 429, 500, 503)
+     * - HTTP 422 with code `2012` for HTML-to-markdown conversion failures
+     * - HTTP 422/500 for AI extraction failures (may include `rawAiResponse` field)
+     *
+     * **Headers:**
+     * - `X-Browser-Ms-Used`: Browser time consumed in milliseconds (set when status < 500)
+     */
+    quickAction(action: 'json', options: BrowserRunJsonOptions): Promise<Response>;
+    /**
+     * Convert a web page to Markdown.
+     * @param action - Must be `'markdown'`.
+     * @param options - Navigation and page interaction options.
+     * @returns A `Response` containing one of:
+     *
+     * **Success (HTTP 200):**
+     * - `BrowserRunMarkdownSuccessResponse` JSON with `Content-Type: application/json`
+     *
+     * **Error:**
+     * - `BrowserRunErrorResponse` JSON with appropriate HTTP status code (400, 422, 429, 500, 503)
+     * - HTTP 422 with code `2012` for HTML-to-markdown conversion failures
+     *
+     * **Headers:**
+     * - `X-Browser-Ms-Used`: Browser time consumed in milliseconds (set when status < 500)
+     */
+    quickAction(action: 'markdown', options: BrowserRunMarkdownOptions): Promise<Response>;
+    /**
+     * Get the accessibility tree of a web page.
+     * @param action - Must be `'accessibilityTree'`.
+     * @param options - Options to scope the tree to a subtree and to control
+     * whether semantically uninteresting nodes are pruned.
+     * @returns A `Response` containing one of:
+     *
+     * **Success (HTTP 200):**
+     * - `BrowserRunAccessibilityTreeSuccessResponse` JSON with `Content-Type: application/json`
+     * - `result.accessibilityTree` is `null` when `root` matched no element
+     *
+     * **Error:**
+     * - `BrowserRunErrorResponse` JSON with appropriate HTTP status code (400, 422, 429, 500, 503)
+     * - HTTP 422 for a malformed `root` selector
+     * - HTTP 500 with code `2017` or `2018` when the tree could not be built
+     *
+     * **Headers:**
+     * - `X-Browser-Ms-Used`: Browser time consumed in milliseconds (set when status < 500)
+     */
+    quickAction(action: 'accessibilityTree', options: BrowserRunAccessibilityTreeOptions): Promise<Response>;
+}
+/**
+ * In addition to the properties you can set in the RequestInit dict
+ * that you pass as an argument to the Request constructor, you can
+ * set certain properties of a `cf` object to control how Cloudflare
+ * features are applied to that new Request.
+ *
+ * Note: Currently, these properties cannot be tested in the
+ * playground.
+ */
+interface RequestInitCfProperties extends Record<string, unknown> {
+    cacheEverything?: boolean;
+    /**
+     * A request's cache key is what determines if two requests are
+     * "the same" for caching purposes. If a request has the same cache key
+     * as some previous request, then we can serve the same cached response for
+     * both. (e.g. 'some-key')
+     *
+     * Only available for Enterprise customers.
+     */
+    cacheKey?: string;
+    /**
+     * This allows you to append additional Cache-Tag response headers
+     * to the origin response without modifications to the origin server.
+     * This will allow for greater control over the Purge by Cache Tag feature
+     * utilizing changes only in the Workers process.
+     *
+     * Only available for Enterprise customers.
+     */
+    cacheTags?: string[];
+    /**
+     * Force response to be cached for a given number of seconds. (e.g. 300)
+     */
+    cacheTtl?: number;
+    /**
+     * Force response to be cached for a given number of seconds based on the Origin status code.
+     * (e.g. { '200-299': 86400, '404': 1, '500-599': 0 })
+     */
+    cacheTtlByStatus?: Record<string, number>;
+    /** Controls how responses with a `Vary` header are cached for this request. */
+    vary?: RequestInitCfPropertiesVary;
+    /**
+     * Explicit Cache-Control header value to set on the response stored in cache.
+     * This gives full control over cache directives (e.g. 'public, max-age=3600, s-maxage=86400').
+     *
+     * Cannot be used together with `cacheTtl` or the `cache` request option (`no-store`/`no-cache`),
+     * as these are mutually exclusive cache control mechanisms. Setting both will throw a TypeError.
+     *
+     * Can be used together with `cacheTtlByStatus`.
+     */
+    cacheControl?: string;
+    /**
+     * Whether the response should be eligible for Cache Reserve storage.
+     */
+    cacheReserveEligible?: boolean;
+    /**
+     * Whether to respect strong ETags (as opposed to weak ETags) from the origin.
+     */
+    respectStrongEtag?: boolean;
+    /**
+     * Whether to strip ETag headers from the origin response before caching.
+     */
+    stripEtags?: boolean;
+    /**
+     * Whether to strip Last-Modified headers from the origin response before caching.
+     */
+    stripLastModified?: boolean;
+    /**
+     * Whether to enable Cache Deception Armor, which protects against web cache
+     * deception attacks by verifying the Content-Type matches the URL extension.
+     */
+    cacheDeceptionArmor?: boolean;
+    /**
+     * Minimum file size in bytes for a response to be eligible for Cache Reserve storage.
+     */
+    cacheReserveMinimumFileSize?: number;
+    scrapeShield?: boolean;
+    apps?: boolean;
+    /**
+     * Controls whether an outbound gRPC-web subrequest from this Worker is
+     * converted to gRPC at the Cloudflare edge.
+     *
+     * - `"passthrough"`: forward the subrequest unchanged as gRPC-web (default).
+     * - `"convert"`: convert the gRPC-web subrequest to gRPC at the edge.
+     *
+     * Provides per-request control over the same edge conversion behavior
+     * gated by the `auto_grpc_convert` compatibility flag.
+     */
+    grpcWeb?: "passthrough" | "convert";
+    image?: RequestInitCfPropertiesImage;
+    minify?: RequestInitCfPropertiesImageMinify;
+    mirage?: boolean;
+    polish?: "lossy" | "lossless" | "off";
+    r2?: RequestInitCfPropertiesR2;
+    /**
+     * Redirects the request to an alternate origin server. You can use this,
+     * for example, to implement load balancing across several origins.
+     * (e.g.us-east.example.com)
+     *
+     * Note - For security reasons, the hostname set in resolveOverride must
+     * be proxied on the same Cloudflare zone of the incoming request.
+     * Otherwise, the setting is ignored. CNAME hosts are allowed, so to
+     * resolve to a host under a different domain or a DNS only domain first
+     * declare a CNAME record within your own zone’s DNS mapping to the
+     * external hostname, set proxy on Cloudflare, then set resolveOverride
+     * to point to that CNAME record.
+     */
+    resolveOverride?: string;
+}
+/**
+ * Controls how Workers Standard Vary handles a request header listed by an
+ * origin `Vary` response header:
+ *
+ * - `"normalize"`: normalize the request header value before it is used in the
+ *   cache variance key.
+ * - `"passthrough"`: use the raw request header value in the cache variance
+ *   key.
+ * - `"bypass"`: bypass cache when the header appears in the origin `Vary`
+ *   response header.
+ */
+type RequestInitCfPropertiesVaryAction = "normalize" | "passthrough" | "bypass";
+/** Configuration for Workers Standard Vary support. */
+interface RequestInitCfPropertiesVary {
+    /** The fallback action for varied request headers not listed in `headers`. */
+    default: RequestInitCfPropertiesVaryHeader;
+    /**
+     * Lowercase request header names and their Vary configuration.
+     *
+     * The `accept` header can include `media_types`, the `accept-language`
+     * header can include `languages`, and other headers support only `action`.
+     */
+    headers?: RequestInitCfPropertiesVaryHeaders;
+}
+/** Common Vary behavior for a single request header. */
+interface RequestInitCfPropertiesVaryHeader {
+    /** How this request header contributes to cache variance. */
+    action: RequestInitCfPropertiesVaryAction;
+}
+/** Vary behavior for the `accept` request header. */
+interface RequestInitCfPropertiesVaryAcceptHeader extends RequestInitCfPropertiesVaryHeader {
+    /**
+     * Media types to keep when normalizing the `Accept` request header.
+     *
+     * Named `media_types` to match the serialized `cf.vary` configuration.
+     */
+    media_types?: string[];
+}
+/** Vary behavior for the `accept-language` request header. */
+interface RequestInitCfPropertiesVaryAcceptLanguageHeader extends RequestInitCfPropertiesVaryHeader {
+    /**
+     * Language tags to keep when normalizing the `Accept-Language` request
+     * header.
+     */
+    languages?: string[];
+}
+/**
+ * Lowercase request header names and their Vary behavior.
+ *
+ * The index signature allows arbitrary custom request headers beyond the
+ * well-known `accept` and `accept-language` specializations.
+ */
+interface RequestInitCfPropertiesVaryHeaders {
+    accept?: RequestInitCfPropertiesVaryAcceptHeader;
+    "accept-language"?: RequestInitCfPropertiesVaryAcceptLanguageHeader;
+    [header: string]: RequestInitCfPropertiesVaryHeader | RequestInitCfPropertiesVaryAcceptHeader | RequestInitCfPropertiesVaryAcceptLanguageHeader | undefined;
+}
+interface BasicImageTransformations {
+    /**
+     * Maximum width in image pixels. The value must be an integer.
+     */
+    width?: number;
+    /**
+     * Maximum height in image pixels. The value must be an integer.
+     */
+    height?: number;
+    /**
+     * When cropping with fit: "cover", this defines the side or point that should
+     * be left uncropped. The value is either a string
+     * "left", "right", "top", "bottom", "auto", or "center" (the default),
+     * or an object {x, y} containing focal point coordinates in the original
+     * image expressed as fractions ranging from 0.0 (top or left) to 1.0
+     * (bottom or right), 0.5 being the center. {fit: "cover", gravity: "top"} will
+     * crop bottom or left and right sides as necessary, but won’t crop anything
+     * from the top. {fit: "cover", gravity: {x:0.5, y:0.2}} will crop each side to
+     * preserve as much as possible around a point at 20% of the height of the
+     * source image.
+     */
+    gravity?: 'face' | 'left' | 'right' | 'top' | 'bottom' | 'center' | 'auto' | 'entropy' | BasicImageTransformationsGravityCoordinates;
+    /**
+     * Specifies how closely the image is cropped toward detected faces when combined
+     * with the gravity=face option. Accepts a valid range between 0.0 (includes as much
+     * of the background as possible) and 1.0 (crops the image as closely to the face as
+     * possible). The default is 0.
+     */
+    zoom?: number;
+    /**
+     * Resizing mode as a string. It affects interpretation of width and height
+     * options:
+     *  - scale-down: Similar to contain, but the image is never enlarged. If
+     *    the image is larger than given width or height, it will be resized.
+     *    Otherwise its original size will be kept.
+     *  - scale-up: Similar to contain, but the image is never shrunk. If the
+     *    image is smaller than the given width or height, it will be resized.
+     *    Otherwise its original size will be kept.
+     *  - contain: Resizes to maximum size that fits within the given width and
+     *    height. If only a single dimension is given (e.g. only width), the
+     *    image will be shrunk or enlarged to exactly match that dimension.
+     *    Aspect ratio is always preserved.
+     *  - cover: Resizes (shrinks or enlarges) to fill the entire area of width
+     *    and height. If the image has an aspect ratio different from the ratio
+     *    of width and height, it will be cropped to fit.
+     *  - crop: The image will be shrunk and cropped to fit within the area
+     *    specified by width and height. The image will not be enlarged. For images
+     *    smaller than the given dimensions it's the same as scale-down. For
+     *    images larger than the given dimensions, it's the same as cover.
+     *    See also trim.
+     *  - pad: Resizes to the maximum size that fits within the given width and
+     *    height, and then fills the remaining area with a background color
+     *    (white by default). Use of this mode is not recommended, as the same
+     *    effect can be more efficiently achieved with the contain mode and the
+     *    CSS object-fit: contain property.
+     *  - squeeze: Stretches and deforms to the width and height given, even if it
+     *    breaks aspect ratio
+     */
+    fit?: "scale-down" | "scale-up" | "contain" | "cover" | "crop" | "pad" | "squeeze";
+    /**
+     * Allows you to trim your image. Takes dpr into account and is performed before
+     * resizing or rotation.
+     *
+     * It can be used as:
+     * - left, top, right, bottom - it will specify the number of pixels to cut
+     *   off each side
+     * - width, height - the width/height you'd like to end up with - can be used
+     *   in combination with the properties above
+     * - border - this will automatically trim the surroundings of an image based on
+     *   it's color. It consists of three properties:
+     *    - color: rgb or hex representation of the color you wish to trim (todo: verify the rgba bit)
+     *    - tolerance: difference from color to treat as color
+     *    - keep: the number of pixels of border to keep
+     */
+    trim?: "border" | {
+        top?: number;
+        bottom?: number;
+        left?: number;
+        right?: number;
+        width?: number;
+        height?: number;
+        border?: boolean | {
+            color?: string;
+            tolerance?: number;
+            keep?: number;
+        };
+    };
+    /**
+     * Background color to add underneath the image. Applies only to images with
+     * transparency (such as PNG). Accepts any CSS color (#RRGGBB, rgba(…),
+     * hsl(…), etc.)
+     */
+    background?: string;
+    /**
+     * Flips the images horizontally, vertically, or both. Flipping is applied before
+     * rotation, so if you apply flip=h,rotate=90 then the image will be flipped
+     * horizontally, then rotated by 90 degrees.
+     */
+    flip?: 'h' | 'v' | 'hv';
+    /**
+     * Number of degrees (90, 180, 270) to rotate the image by. width and height
+     * options refer to axes after rotation.
+     */
+    rotate?: 0 | 90 | 180 | 270 | 360;
+    /**
+     * Strength of sharpening filter to apply to the image. Floating-point
+     * number between 0 (no sharpening, default) and 10 (maximum). 1.0 is a
+     * recommended value for downscaled images.
+     */
+    sharpen?: number;
+    /**
+     * Radius of a blur filter (approximate gaussian). Maximum supported radius
+     * is 250.
+     */
+    blur?: number;
+    /**
+     * Increase contrast by a factor. A value of 1.0 equals no change, a value of
+     * 0.5 equals low contrast, and a value of 2.0 equals high contrast. 0 is
+     * ignored.
+     */
+    contrast?: number;
+    /**
+     * Increase brightness by a factor. A value of 1.0 equals no change, a value
+     * of 0.5 equals half brightness, and a value of 2.0 equals twice as bright.
+     * 0 is ignored.
+     */
+    brightness?: number;
+    /**
+     * Increase exposure by a factor. A value of 1.0 equals no change, a value of
+     * 0.5 darkens the image, and a value of 2.0 lightens the image. 0 is ignored.
+     */
+    gamma?: number;
+    /**
+     * Increase contrast by a factor. A value of 1.0 equals no change, a value of
+     * 0.5 equals low contrast, and a value of 2.0 equals high contrast. 0 is
+     * ignored.
+     */
+    saturation?: number;
+    /**
+     * Device Pixel Ratio. Default 1. Multiplier for width/height that makes it
+     * easier to specify higher-DPI sizes in <img srcset>.
+     */
+    dpr?: number;
+    /**
+     * Adds a border around the image. The border is added after resizing. Border
+     * width takes dpr into account, and can be specified either using a single
+     * width property, or individually for each side.
+     */
+    border?: {
+        color: string;
+        width: number;
+    } | {
+        color: string;
+        top: number;
+        right: number;
+        bottom: number;
+        left: number;
+    };
+    /**
+     * Image segmentation using artificial intelligence models. Sets pixels not
+     * within selected segment area to transparent e.g "foreground" sets every
+     * background pixel as transparent.
+     */
+    segment?: "foreground";
+    /**
+     * Controls the algorithm used when an image needs to be enlarged. This
+     * parameter works with any fit mode that upscales, such as `contain`,
+     * `cover`, and `scale-up`. It has no effect when `fit=scale-down` or when
+     * the target dimensions are smaller than the source.
+     * - interpolate: Uses bicubic interpolation, which may reduce image quality.
+     *   This is the default behavior when `upscale` is not specified.
+     * - generate: Uses AI upscaling to produce sharper, more detailed results
+     *   when enlarging images.
+     */
+    upscale?: "interpolate" | "generate";
+}
+interface BasicImageTransformationsGravityCoordinates {
+    x?: number;
+    y?: number;
+    mode?: 'remainder' | 'box-center';
+}
+interface RequestInitCfPropertiesImageDraw extends BasicImageTransformations {
+    /**
+     * Absolute URL of the image file to use for the drawing. It can be any of
+     * the supported file formats. For drawing of watermarks or non-rectangular
+     * overlays we recommend using PNG or WebP images.
+     */
+    url: string;
+    /**
+     * Floating-point number between 0 (transparent) and 1 (opaque).
+     * For example, opacity: 0.5 makes overlay semitransparent.
+     */
+    opacity?: number;
+    /**
+     * - If set to true, the overlay image will be tiled to cover the entire
+     *   area. This is useful for stock-photo-like watermarks.
+     * - If set to "x", the overlay image will be tiled horizontally only
+     *   (form a line).
+     * - If set to "y", the overlay image will be tiled vertically only
+     *   (form a line).
+     */
+    repeat?: true | "x" | "y";
+    /**
+     * How to combine the foreground and backdrop pixels to create the result
+     */
+    composite?: 
+    /** Foreground drawn on top of backdrop (default) */
+    'over'
+    /** Foreground shown only where backdrop is opaque */
+     | 'in'
+    /** Foreground drawn on top, but clipped to the backdrop's shape */
+     | 'atop'
+    /** Foreground shown only where backdrop is transparent */
+     | 'out'
+    /** Foreground and backdrop visible only where the other is not */
+     | 'xor'
+    /** Foreground and backdrop channels added (brightening) */
+     | 'lighter';
+    /**
+     * Position of the overlay image relative to a given edge. Each property is
+     * an offset in pixels. 0 aligns exactly to the edge. For example, left: 10
+     * positions left side of the overlay 10 pixels from the left edge of the
+     * image it's drawn over. bottom: 0 aligns bottom of the overlay with bottom
+     * of the background image.
+     *
+     * Setting both left & right, or both top & bottom is an error.
+     *
+     * If no position is specified, the image will be centered.
+     */
+    top?: number;
+    left?: number;
+    bottom?: number;
+    right?: number;
+}
+interface RequestInitCfPropertiesImage extends BasicImageTransformations {
+    /**
+     * Quality setting from 1-100 (useful values are in 60-90 range). Lower values
+     * make images look worse, but load faster. The default is 85. It applies only
+     * to JPEG and WebP images. It doesn’t have any effect on PNG.
+     */
+    quality?: number | "low" | "medium-low" | "medium-high" | "high";
+    /**
+     * Output format to generate. It can be:
+     *  - avif: generate images in AVIF format.
+     *  - webp: generate images in Google WebP format. Set quality to 100 to get
+     *    the WebP-lossless format.
+     *  - json: instead of generating an image, outputs information about the
+     *    image, in JSON format. The JSON object will contain image size
+     *    (before and after resizing), source image’s MIME type, file size, etc.
+     * - jpeg: generate images in JPEG format.
+     * - png: generate images in PNG format.
+     */
+    format?: "avif" | "webp" | "json" | "jpeg" | "png" | "baseline-jpeg" | "png-force" | "svg";
+    /**
+     * Whether to preserve animation frames from input files. Default is true.
+     * Setting it to false reduces animations to still images. This setting is
+     * recommended when enlarging images or processing arbitrary user content,
+     * because large GIF animations can weigh tens or even hundreds of megabytes.
+     * It is also useful to set anim:false when using format:"json" to get the
+     * response quicker without the number of frames.
+     */
+    anim?: boolean;
+    /**
+     * What EXIF data should be preserved in the output image. Note that EXIF
+     * rotation and embedded color profiles are always applied ("baked in" into
+     * the image), and aren't affected by this option. Note that if the Polish
+     * feature is enabled, all metadata may have been removed already and this
+     * option may have no effect.
+     *  - keep: Preserve most of EXIF metadata, including GPS location if there's
+     *    any.
+     *  - copyright: Only keep the copyright tag, and discard everything else.
+     *    This is the default behavior for JPEG files.
+     *  - none: Discard all invisible EXIF metadata. Currently WebP and PNG
+     *    output formats always discard metadata.
+     */
+    metadata?: "keep" | "copyright" | "none";
+    /**
+     * Overlays are drawn in the order they appear in the array (last array
+     * entry is the topmost layer).
+     */
+    draw?: RequestInitCfPropertiesImageDraw[];
+    /**
+     * Fetching image from authenticated origin. Setting this property will
+     * pass authentication headers (Authorization, Cookie, etc.) through to
+     * the origin.
+     */
+    "origin-auth"?: "share-publicly";
+    /**
+     * Slightly reduces latency on a cache miss by selecting a
+     * quickest-to-compress file format, at a cost of increased file size and
+     * lower image quality. It will usually override the format option and choose
+     * JPEG over WebP or AVIF. We do not recommend using this option, except in
+     * unusual circumstances like resizing uncacheable dynamically-generated
+     * images.
+     */
+    compression?: "fast";
+}
+interface RequestInitCfPropertiesImageMinify {
+    javascript?: boolean;
+    css?: boolean;
+    html?: boolean;
+}
+interface RequestInitCfPropertiesR2 {
+    /**
+     * Colo id of bucket that an object is stored in
+     */
+    bucketColoId?: number;
+}
+/**
+ * Request metadata provided by Cloudflare's edge.
+ */
+type IncomingRequestCfProperties<HostMetadata = unknown> = IncomingRequestCfPropertiesBase & IncomingRequestCfPropertiesBotManagementEnterprise & IncomingRequestCfPropertiesCloudflareForSaaSEnterprise<HostMetadata> & IncomingRequestCfPropertiesGeographicInformation & IncomingRequestCfPropertiesCloudflareAccessOrApiShield;
+interface IncomingRequestCfPropertiesBase extends Record<string, unknown> {
+    /**
+     * [ASN](https://www.iana.org/assignments/as-numbers/as-numbers.xhtml) of the incoming request.
+     *
+     * @example 395747
+     */
+    asn?: number;
+    /**
+     * The organization which owns the ASN of the incoming request.
+     *
+     * @example "Google Cloud"
+     */
+    asOrganization?: string;
+    /**
+     * The original value of the `Accept-Encoding` header if Cloudflare modified it.
+     *
+     * @example "gzip, deflate, br"
+     */
+    clientAcceptEncoding?: string;
+    /**
+     * The number of milliseconds it took for the request to reach your worker.
+     *
+     * @example 22
+     */
+    clientTcpRtt?: number;
+    /**
+     * The three-letter [IATA](https://en.wikipedia.org/wiki/IATA_airport_code)
+     * airport code of the data center that the request hit.
+     *
+     * @example "DFW"
+     */
+    colo: string;
+    /**
+     * Represents the upstream's response to a
+     * [TCP `keepalive` message](https://tldp.org/HOWTO/TCP-Keepalive-HOWTO/overview.html)
+     * from cloudflare.
+     *
+     * For workers with no upstream, this will always be `1`.
+     *
+     * @example 3
+     */
+    edgeRequestKeepAliveStatus: IncomingRequestCfPropertiesEdgeRequestKeepAliveStatus;
+    /**
+     * The HTTP Protocol the request used.
+     *
+     * @example "HTTP/2"
+     */
+    httpProtocol: string;
+    /**
+     * The browser-requested prioritization information in the request object.
+     *
+     * If no information was set, defaults to the empty string `""`
+     *
+     * @example "weight=192;exclusive=0;group=3;group-weight=127"
+     * @default ""
+     */
+    requestPriority: string;
+    /**
+     * The TLS version of the connection to Cloudflare.
+     * In requests served over plaintext (without TLS), this property is the empty string `""`.
+     *
+     * @example "TLSv1.3"
+     */
+    tlsVersion: string;
+    /**
+     * The cipher for the connection to Cloudflare.
+     * In requests served over plaintext (without TLS), this property is the empty string `""`.
+     *
+     * @example "AEAD-AES128-GCM-SHA256"
+     */
+    tlsCipher: string;
+    /**
+     * Metadata containing the [`HELLO`](https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.2) and [`FINISHED`](https://www.rfc-editor.org/rfc/rfc5246#section-7.4.9) messages from this request's TLS handshake.
+     *
+     * If the incoming request was served over plaintext (without TLS) this field is undefined.
+     */
+    tlsExportedAuthenticator?: IncomingRequestCfPropertiesExportedAuthenticatorMetadata;
+}
+interface IncomingRequestCfPropertiesBotManagementBase {
+    /**
+     * Cloudflare’s [level of certainty](https://developers.cloudflare.com/bots/concepts/bot-score/) that a request comes from a bot,
+     * represented as an integer percentage between `1` (almost certainly a bot) and `99` (almost certainly human).
+     *
+     * @example 54
+     */
+    score: number;
+    /**
+     * A boolean value that is true if the request comes from a good bot, like Google or Bing.
+     * Most customers choose to allow this traffic. For more details, see [Traffic from known bots](https://developers.cloudflare.com/firewall/known-issues-and-faq/#how-does-firewall-rules-handle-traffic-from-known-bots).
+     */
+    verifiedBot: boolean;
+    /**
+     * A boolean value that is true if the request originates from a
+     * Cloudflare-verified proxy service.
+     */
+    corporateProxy: boolean;
+    /**
+     * A boolean value that's true if the request matches [file extensions](https://developers.cloudflare.com/bots/reference/static-resources/) for many types of static resources.
+     */
+    staticResource: boolean;
+    /**
+     * List of IDs that correlate to the Bot Management heuristic detections made on a request (you can have multiple heuristic detections on the same request).
+     */
+    detectionIds: number[];
+}
+interface IncomingRequestCfPropertiesBotManagement {
+    /**
+     * Results of Cloudflare's Bot Management analysis
+     */
+    botManagement: IncomingRequestCfPropertiesBotManagementBase;
+    /**
+     * Duplicate of `botManagement.score`.
+     *
+     * @deprecated
+     */
+    clientTrustScore: number;
+}
+interface IncomingRequestCfPropertiesBotManagementEnterprise extends IncomingRequestCfPropertiesBotManagement {
+    /**
+     * Results of Cloudflare's Bot Management analysis
+     */
+    botManagement: IncomingRequestCfPropertiesBotManagementBase & {
+        /**
+         * A [JA3 Fingerprint](https://developers.cloudflare.com/bots/concepts/ja3-fingerprint/) to help profile specific SSL/TLS clients
+         * across different destination IPs, Ports, and X509 certificates.
+         */
+        ja3Hash: string;
+    };
+}
+interface IncomingRequestCfPropertiesCloudflareForSaaSEnterprise<HostMetadata> {
+    /**
+     * Custom metadata set per-host in [Cloudflare for SaaS](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/).
+     *
+     * This field is only present if you have Cloudflare for SaaS enabled on your account
+     * and you have followed the [required steps to enable it]((https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/custom-metadata/)).
+     */
+    hostMetadata?: HostMetadata;
+}
+interface IncomingRequestCfPropertiesCloudflareAccessOrApiShield {
+    /**
+     * Information about the client certificate presented to Cloudflare.
+     *
+     * This is populated when the incoming request is served over TLS using
+     * either Cloudflare Access or API Shield (mTLS)
+     * and the presented SSL certificate has a valid
+     * [Certificate Serial Number](https://ldapwiki.com/wiki/Certificate%20Serial%20Number)
+     * (i.e., not `null` or `""`).
+     *
+     * Otherwise, a set of placeholder values are used.
+     *
+     * The property `certPresented` will be set to `"1"` when
+     * the object is populated (i.e. the above conditions were met).
+     */
+    tlsClientAuth: IncomingRequestCfPropertiesTLSClientAuth | IncomingRequestCfPropertiesTLSClientAuthPlaceholder;
+}
+/**
+ * Metadata about the request's TLS handshake
+ */
+interface IncomingRequestCfPropertiesExportedAuthenticatorMetadata {
+    /**
+     * The client's [`HELLO` message](https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.2), encoded in hexadecimal
+     *
+     * @example "44372ba35fa1270921d318f34c12f155dc87b682cf36a790cfaa3ba8737a1b5d"
+     */
+    clientHandshake: string;
+    /**
+     * The server's [`HELLO` message](https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.2), encoded in hexadecimal
+     *
+     * @example "44372ba35fa1270921d318f34c12f155dc87b682cf36a790cfaa3ba8737a1b5d"
+     */
+    serverHandshake: string;
+    /**
+     * The client's [`FINISHED` message](https://www.rfc-editor.org/rfc/rfc5246#section-7.4.9), encoded in hexadecimal
+     *
+     * @example "084ee802fe1348f688220e2a6040a05b2199a761f33cf753abb1b006792d3f8b"
+     */
+    clientFinished: string;
+    /**
+     * The server's [`FINISHED` message](https://www.rfc-editor.org/rfc/rfc5246#section-7.4.9), encoded in hexadecimal
+     *
+     * @example "084ee802fe1348f688220e2a6040a05b2199a761f33cf753abb1b006792d3f8b"
+     */
+    serverFinished: string;
+}
+/**
+ * Geographic data about the request's origin.
+ */
+interface IncomingRequestCfPropertiesGeographicInformation {
+    /**
+     * The [ISO 3166-1 Alpha 2](https://www.iso.org/iso-3166-country-codes.html) country code the request originated from.
+     *
+     * If your worker is [configured to accept TOR connections](https://support.cloudflare.com/hc/en-us/articles/203306930-Understanding-Cloudflare-Tor-support-and-Onion-Routing), this may also be `"T1"`, indicating a request that originated over TOR.
+     *
+     * If Cloudflare is unable to determine where the request originated this property is omitted.
+     *
+     * The country code `"T1"` is used for requests originating on TOR.
+     *
+     * @example "GB"
+     */
+    country?: Iso3166Alpha2Code | "T1";
+    /**
+     * If present, this property indicates that the request originated in the EU
+     *
+     * @example "1"
+     */
+    isEUCountry?: "1";
+    /**
+     * A two-letter code indicating the continent the request originated from.
+     *
+     * @example "AN"
+     */
+    continent?: ContinentCode;
+    /**
+     * The city the request originated from
+     *
+     * @example "Austin"
+     */
+    city?: string;
+    /**
+     * Postal code of the incoming request
+     *
+     * @example "78701"
+     */
+    postalCode?: string;
+    /**
+     * Latitude of the incoming request
+     *
+     * @example "30.27130"
+     */
+    latitude?: string;
+    /**
+     * Longitude of the incoming request
+     *
+     * @example "-97.74260"
+     */
+    longitude?: string;
+    /**
+     * Timezone of the incoming request
+     *
+     * @example "America/Chicago"
+     */
+    timezone?: string;
+    /**
+     * If known, the ISO 3166-2 name for the first level region associated with
+     * the IP address of the incoming request
+     *
+     * @example "Texas"
+     */
+    region?: string;
+    /**
+     * If known, the ISO 3166-2 code for the first-level region associated with
+     * the IP address of the incoming request
+     *
+     * @example "TX"
+     */
+    regionCode?: string;
+    /**
+     * Metro code (DMA) of the incoming request
+     *
+     * @example "635"
+     */
+    metroCode?: string;
+}
+/** Data about the incoming request's TLS certificate */
+interface IncomingRequestCfPropertiesTLSClientAuth {
+    /** Always `"1"`, indicating that the certificate was presented */
+    certPresented: "1";
+    /**
+     * Result of certificate verification.
+     *
+     * @example "FAILED:self signed certificate"
+     */
+    certVerified: Exclude<CertVerificationStatus, "NONE">;
+    /** The presented certificate's revokation status.
+     *
+     * - A value of `"1"` indicates the certificate has been revoked
+     * - A value of `"0"` indicates the certificate has not been revoked
+     */
+    certRevoked: "1" | "0";
+    /**
+     * The certificate issuer's [distinguished name](https://knowledge.digicert.com/generalinformation/INFO1745.html)
+     *
+     * @example "CN=cloudflareaccess.com, C=US, ST=Texas, L=Austin, O=Cloudflare"
+     */
+    certIssuerDN: string;
+    /**
+     * The certificate subject's [distinguished name](https://knowledge.digicert.com/generalinformation/INFO1745.html)
+     *
+     * @example "CN=*.cloudflareaccess.com, C=US, ST=Texas, L=Austin, O=Cloudflare"
+     */
+    certSubjectDN: string;
+    /**
+     * The certificate issuer's [distinguished name](https://knowledge.digicert.com/generalinformation/INFO1745.html) ([RFC 2253](https://www.rfc-editor.org/rfc/rfc2253.html) formatted)
+     *
+     * @example "CN=cloudflareaccess.com, C=US, ST=Texas, L=Austin, O=Cloudflare"
+     */
+    certIssuerDNRFC2253: string;
+    /**
+     * The certificate subject's [distinguished name](https://knowledge.digicert.com/generalinformation/INFO1745.html) ([RFC 2253](https://www.rfc-editor.org/rfc/rfc2253.html) formatted)
+     *
+     * @example "CN=*.cloudflareaccess.com, C=US, ST=Texas, L=Austin, O=Cloudflare"
+     */
+    certSubjectDNRFC2253: string;
+    /** The certificate issuer's distinguished name (legacy policies) */
+    certIssuerDNLegacy: string;
+    /** The certificate subject's distinguished name (legacy policies) */
+    certSubjectDNLegacy: string;
+    /**
+     * The certificate's serial number
+     *
+     * @example "00936EACBE07F201DF"
+     */
+    certSerial: string;
+    /**
+     * The certificate issuer's serial number
+     *
+     * @example "2489002934BDFEA34"
+     */
+    certIssuerSerial: string;
+    /**
+     * The certificate's Subject Key Identifier
+     *
+     * @example "BB:AF:7E:02:3D:FA:A6:F1:3C:84:8E:AD:EE:38:98:EC:D9:32:32:D4"
+     */
+    certSKI: string;
+    /**
+     * The certificate issuer's Subject Key Identifier
+     *
+     * @example "BB:AF:7E:02:3D:FA:A6:F1:3C:84:8E:AD:EE:38:98:EC:D9:32:32:D4"
+     */
+    certIssuerSKI: string;
+    /**
+     * The certificate's SHA-1 fingerprint
+     *
+     * @example "6b9109f323999e52259cda7373ff0b4d26bd232e"
+     */
+    certFingerprintSHA1: string;
+    /**
+     * The certificate's SHA-256 fingerprint
+     *
+     * @example "acf77cf37b4156a2708e34c4eb755f9b5dbbe5ebb55adfec8f11493438d19e6ad3f157f81fa3b98278453d5652b0c1fd1d71e5695ae4d709803a4d3f39de9dea"
+     */
+    certFingerprintSHA256: string;
+    /**
+     * The effective starting date of the certificate
+     *
+     * @example "Dec 22 19:39:00 2018 GMT"
+     */
+    certNotBefore: string;
+    /**
+     * The effective expiration date of the certificate
+     *
+     * @example "Dec 22 19:39:00 2018 GMT"
+     */
+    certNotAfter: string;
+    /**
+     * The client leaf certificate in [RFC 9440](https://www.rfc-editor.org/rfc/rfc9440)
+     * format (`:base64-DER:`). Empty if no client certificate was presented or if
+     * the leaf certificate exceeded 10 KB (see {@link certRFC9440TooLarge}).
+     *
+     * Suitable for forwarding to an origin via the `Client-Cert` HTTP header.
+     */
+    certRFC9440: string;
+    /**
+     * `true` if the leaf certificate exceeded 10 KB and was omitted from
+     * {@link certRFC9440}.
+     */
+    certRFC9440TooLarge: boolean;
+    /**
+     * The intermediate certificate chain in [RFC 9440](https://www.rfc-editor.org/rfc/rfc9440)
+     * format as a comma-separated list. Empty if no intermediates were sent or
+     * if the chain exceeded 16 KB (see {@link certChainRFC9440TooLarge}).
+     *
+     * Suitable for forwarding to an origin via the `Client-Cert-Chain` HTTP header.
+     */
+    certChainRFC9440: string;
+    /**
+     * `true` if the intermediate chain exceeded 16 KB and was omitted from
+     * {@link certChainRFC9440}.
+     */
+    certChainRFC9440TooLarge: boolean;
+}
+/** Placeholder values for TLS Client Authorization */
+interface IncomingRequestCfPropertiesTLSClientAuthPlaceholder {
+    certPresented: "0";
+    certVerified: "NONE";
+    certRevoked: "0";
+    certIssuerDN: "";
+    certSubjectDN: "";
+    certIssuerDNRFC2253: "";
+    certSubjectDNRFC2253: "";
+    certIssuerDNLegacy: "";
+    certSubjectDNLegacy: "";
+    certSerial: "";
+    certIssuerSerial: "";
+    certSKI: "";
+    certIssuerSKI: "";
+    certFingerprintSHA1: "";
+    certFingerprintSHA256: "";
+    certNotBefore: "";
+    certNotAfter: "";
+    certRFC9440: "";
+    certRFC9440TooLarge: false;
+    certChainRFC9440: "";
+    certChainRFC9440TooLarge: false;
+}
+/** Possible outcomes of TLS verification */
+declare type CertVerificationStatus = 
+/** Authentication succeeded */
+"SUCCESS"
+/** No certificate was presented */
+ | "NONE"
+/** Failed because the certificate was self-signed */
+ | "FAILED:self signed certificate"
+/** Failed because the certificate failed a trust chain check */
+ | "FAILED:unable to verify the first certificate"
+/** Failed because the certificate not yet valid */
+ | "FAILED:certificate is not yet valid"
+/** Failed because the certificate is expired */
+ | "FAILED:certificate has expired"
+/** Failed for another unspecified reason */
+ | "FAILED";
+/**
+ * An upstream endpoint's response to a TCP `keepalive` message from Cloudflare.
+ */
+declare type IncomingRequestCfPropertiesEdgeRequestKeepAliveStatus = 0 /** Unknown */ | 1 /** no keepalives (not found) */ | 2 /** no connection re-use, opening keepalive connection failed */ | 3 /** no connection re-use, keepalive accepted and saved */ | 4 /** connection re-use, refused by the origin server (`TCP FIN`) */ | 5; /** connection re-use, accepted by the origin server */
+/** ISO 3166-1 Alpha-2 codes */
+declare type Iso3166Alpha2Code = "AD" | "AE" | "AF" | "AG" | "AI" | "AL" | "AM" | "AO" | "AQ" | "AR" | "AS" | "AT" | "AU" | "AW" | "AX" | "AZ" | "BA" | "BB" | "BD" | "BE" | "BF" | "BG" | "BH" | "BI" | "BJ" | "BL" | "BM" | "BN" | "BO" | "BQ" | "BR" | "BS" | "BT" | "BV" | "BW" | "BY" | "BZ" | "CA" | "CC" | "CD" | "CF" | "CG" | "CH" | "CI" | "CK" | "CL" | "CM" | "CN" | "CO" | "CR" | "CU" | "CV" | "CW" | "CX" | "CY" | "CZ" | "DE" | "DJ" | "DK" | "DM" | "DO" | "DZ" | "EC" | "EE" | "EG" | "EH" | "ER" | "ES" | "ET" | "FI" | "FJ" | "FK" | "FM" | "FO" | "FR" | "GA" | "GB" | "GD" | "GE" | "GF" | "GG" | "GH" | "GI" | "GL" | "GM" | "GN" | "GP" | "GQ" | "GR" | "GS" | "GT" | "GU" | "GW" | "GY" | "HK" | "HM" | "HN" | "HR" | "HT" | "HU" | "ID" | "IE" | "IL" | "IM" | "IN" | "IO" | "IQ" | "IR" | "IS" | "IT" | "JE" | "JM" | "JO" | "JP" | "KE" | "KG" | "KH" | "KI" | "KM" | "KN" | "KP" | "KR" | "KW" | "KY" | "KZ" | "LA" | "LB" | "LC" | "LI" | "LK" | "LR" | "LS" | "LT" | "LU" | "LV" | "LY" | "MA" | "MC" | "MD" | "ME" | "MF" | "MG" | "MH" | "MK" | "ML" | "MM" | "MN" | "MO" | "MP" | "MQ" | "MR" | "MS" | "MT" | "MU" | "MV" | "MW" | "MX" | "MY" | "MZ" | "NA" | "NC" | "NE" | "NF" | "NG" | "NI" | "NL" | "NO" | "NP" | "NR" | "NU" | "NZ" | "OM" | "PA" | "PE" | "PF" | "PG" | "PH" | "PK" | "PL" | "PM" | "PN" | "PR" | "PS" | "PT" | "PW" | "PY" | "QA" | "RE" | "RO" | "RS" | "RU" | "RW" | "SA" | "SB" | "SC" | "SD" | "SE" | "SG" | "SH" | "SI" | "SJ" | "SK" | "SL" | "SM" | "SN" | "SO" | "SR" | "SS" | "ST" | "SV" | "SX" | "SY" | "SZ" | "TC" | "TD" | "TF" | "TG" | "TH" | "TJ" | "TK" | "TL" | "TM" | "TN" | "TO" | "TR" | "TT" | "TV" | "TW" | "TZ" | "UA" | "UG" | "UM" | "US" | "UY" | "UZ" | "VA" | "VC" | "VE" | "VG" | "VI" | "VN" | "VU" | "WF" | "WS" | "YE" | "YT" | "ZA" | "ZM" | "ZW";
+/** The 2-letter continent codes Cloudflare uses */
+declare type ContinentCode = "AF" | "AN" | "AS" | "EU" | "NA" | "OC" | "SA";
+type CfProperties<HostMetadata = unknown> = IncomingRequestCfProperties<HostMetadata> | RequestInitCfProperties;
+interface D1Meta {
+    duration: number;
+    size_after: number;
+    rows_read: number;
+    rows_written: number;
+    last_row_id: number;
+    changed_db: boolean;
+    changes: number;
+    /**
+     * The region of the database instance that executed the query.
+     */
+    served_by_region?: string;
+    /**
+     * The three letters airport code of the colo that executed the query.
+     */
+    served_by_colo?: string;
+    /**
+     * True if-and-only-if the database instance that executed the query was the primary.
+     */
+    served_by_primary?: boolean;
+    timings?: {
+        /**
+         * The duration of the SQL query execution by the database instance. It doesn't include any network time.
+         */
+        sql_duration_ms: number;
+    };
+    /**
+     * Number of total attempts to execute the query, due to automatic retries.
+     * Note: All other fields in the response like `timings` only apply to the last attempt.
+     */
+    total_attempts?: number;
+}
+interface D1Response {
+    success: true;
+    meta: D1Meta & Record<string, unknown>;
+    error?: never;
+}
+type D1Result<T = unknown> = D1Response & {
+    results: T[];
+};
+interface D1ExecResult {
+    count: number;
+    duration: number;
+}
+type D1SessionConstraint = 
+// Indicates that the first query should go to the primary, and the rest queries
+// using the same D1DatabaseSession will go to any replica that is consistent with
+// the bookmark maintained by the session (returned by the first query).
+'first-primary'
+// Indicates that the first query can go anywhere (primary or replica), and the rest queries
+// using the same D1DatabaseSession will go to any replica that is consistent with
+// the bookmark maintained by the session (returned by the first query).
+ | 'first-unconstrained';
+type D1SessionBookmark = string;
+declare abstract class D1Database {
+    prepare(query: string): D1PreparedStatement;
+    batch<T = unknown>(statements: D1PreparedStatement[]): Promise<D1Result<T>[]>;
+    exec(query: string): Promise<D1ExecResult>;
+    /**
+     * Creates a new D1 Session anchored at the given constraint or the bookmark.
+     * All queries executed using the created session will have sequential consistency,
+     * meaning that all writes done through the session will be visible in subsequent reads.
+     *
+     * @param constraintOrBookmark Either the session constraint or the explicit bookmark to anchor the created session.
+     */
+    withSession(constraintOrBookmark?: D1SessionBookmark | D1SessionConstraint): D1DatabaseSession;
+    /**
+     * @deprecated dump() will be removed soon, only applies to deprecated alpha v1 databases.
+     */
+    dump(): Promise<ArrayBuffer>;
+}
+declare abstract class D1DatabaseSession {
+    prepare(query: string): D1PreparedStatement;
+    batch<T = unknown>(statements: D1PreparedStatement[]): Promise<D1Result<T>[]>;
+    /**
+     * @returns The latest session bookmark across all executed queries on the session.
+     *          If no query has been executed yet, `null` is returned.
+     */
+    getBookmark(): D1SessionBookmark | null;
+}
+declare abstract class D1PreparedStatement {
+    bind(...values: unknown[]): D1PreparedStatement;
+    first<T = unknown>(colName: string): Promise<T | null>;
+    first<T = Record<string, unknown>>(): Promise<T | null>;
+    run<T = Record<string, unknown>>(): Promise<D1Result<T>>;
+    all<T = Record<string, unknown>>(): Promise<D1Result<T>>;
+    raw<T = unknown[]>(options: {
+        columnNames: true;
+    }): Promise<[
+        string[],
+        ...T[]
+    ]>;
+    raw<T = unknown[]>(options?: {
+        columnNames?: false;
+    }): Promise<T[]>;
+}
+// `Disposable` was added to TypeScript's standard lib types in version 5.2.
+// To support older TypeScript versions, define an empty `Disposable` interface.
+// Users won't be able to use `using`/`Symbol.dispose` without upgrading to 5.2,
+// but this will ensure type checking on older versions still passes.
+// TypeScript's interface merging will ensure our empty interface is effectively
+// ignored when `Disposable` is included in the standard lib.
+interface Disposable {
+}
+/**
+ * The returned data after sending an email
+ */
+interface EmailSendResult {
+    /**
+     * The Email Message ID
+     */
+    messageId: string;
+}
+/**
+ * An email message that can be sent from a Worker.
+ */
+interface EmailMessage {
+    /**
+     * Envelope From attribute of the email message.
+     */
+    readonly from: string;
+    /**
+     * Envelope To attribute of the email message.
+     */
+    readonly to: string;
+}
+/**
+ * An email message that is sent to a consumer Worker and can be rejected/forwarded.
+ */
+interface ForwardableEmailMessage extends EmailMessage {
+    /**
+     * Stream of the email message content.
+     */
+    readonly raw: ReadableStream<Uint8Array>;
+    /**
+     * An [Headers object](https://developer.mozilla.org/en-US/docs/Web/API/Headers).
+     */
+    readonly headers: Headers;
+    /**
+     * Size of the email message content.
+     */
+    readonly rawSize: number;
+    /**
+     * Reject this email message by returning a permanent SMTP error back to the connecting client including the given reason.
+     * @param reason The reject reason.
+     * @returns void
+     */
+    setReject(reason: string): void;
+    /**
+     * Forward this email message to a verified destination address of the account.
+     * @param rcptTo Verified destination address.
+     * @param headers A [Headers object](https://developer.mozilla.org/en-US/docs/Web/API/Headers).
+     * @returns A promise that resolves when the email message is forwarded.
+     */
+    forward(rcptTo: string, headers?: Headers): Promise<EmailSendResult>;
+    /**
+     * Reply to the sender of this email message with a new EmailMessage object.
+     * @param message The reply message.
+     * @returns A promise that resolves when the email message is replied.
+     */
+    reply(message: EmailMessage): Promise<EmailSendResult>;
+    /**
+     * Reply to the sender of this email message with a message built from the given
+     * fields. Threading headers (In-Reply-To/References) are set automatically.
+     * @param builder The reply message contents.
+     * @returns A promise that resolves when the email message is replied.
+     */
+    reply(builder: EmailReplyMessageBuilder): Promise<EmailSendResult>;
+}
+/** A file attachment for an email message */
+type EmailAttachment = {
+    disposition: 'inline';
+    contentId: string;
+    filename: string;
+    type: string;
+    content: string | ArrayBuffer | ArrayBufferView;
+} | {
+    disposition: 'attachment';
+    contentId?: undefined;
+    filename: string;
+    type: string;
+    content: string | ArrayBuffer | ArrayBufferView;
+};
+/** An Email Address */
+interface EmailAddress {
+    name: string;
+    email: string;
+}
+/**
+ * Recipient fields for `SendEmail.send()`. At least one of `to`, `cc`, or
+ * `bcc` must be provided.
+ */
+type EmailDestinations = {
+    to?: string | EmailAddress | (string | EmailAddress)[];
+    cc?: string | EmailAddress | (string | EmailAddress)[];
+    bcc?: string | EmailAddress | (string | EmailAddress)[];
+} & ({
+    to: string | EmailAddress | (string | EmailAddress)[];
+} | {
+    cc: string | EmailAddress | (string | EmailAddress)[];
+} | {
+    bcc: string | EmailAddress | (string | EmailAddress)[];
+});
+/**
+ * Fields shared by all composed emails (no recipients). Used directly by
+ * `ForwardableEmailMessage.reply()`, which always replies to the original
+ * sender, and extended by `EmailMessageBuilder` for `SendEmail.send()`.
+ */
+interface EmailReplyMessageBuilder {
+    from: string | EmailAddress;
+    subject: string;
+    replyTo?: string | EmailAddress;
+    headers?: Record<string, string>;
+    text?: string;
+    html?: string;
+    attachments?: EmailAttachment[];
+}
+/**
+ * Fields for composing an email without constructing raw MIME, for
+ * `SendEmail.send()`. Requires at least one of `to`, `cc`, or `bcc`.
+ */
+type EmailMessageBuilder = EmailReplyMessageBuilder & EmailDestinations;
+/**
+ * A binding that allows a Worker to send email messages.
+ */
+interface SendEmail {
+    send(message: EmailMessage): Promise<EmailSendResult>;
+    send(builder: EmailMessageBuilder): Promise<EmailSendResult>;
+}
+declare abstract class EmailEvent extends ExtendableEvent {
+    readonly message: ForwardableEmailMessage;
+}
+declare type EmailExportedHandler<Env = unknown, Props = unknown> = (message: ForwardableEmailMessage, env: Env, ctx: ExecutionContext<Props>) => void | Promise<void>;
+declare module "cloudflare:email" {
+    let _EmailMessage: {
+        prototype: EmailMessage;
+        new (from: string, to: string, raw: ReadableStream | string): EmailMessage;
+    };
+    export { _EmailMessage as EmailMessage };
+}
+/**
+ * Evaluation context for targeting rules.
+ * Keys are attribute names (e.g. "userId", "country"), values are the attribute values.
+ */
+type FlagshipEvaluationContext = Record<string, string | number | boolean>;
+interface FlagshipEvaluationDetails<T> {
+    flagKey: string;
+    value: T;
+    variant?: string | undefined;
+    reason?: string | undefined;
+    errorCode?: string | undefined;
+    errorMessage?: string | undefined;
+}
+interface FlagshipEvaluationError extends Error {
+}
+/**
+ * Feature flags binding for evaluating feature flags from a Cloudflare Workers script.
+ *
+ * @example
+ * ```typescript
+ * // Get a boolean flag value with a default
+ * const enabled = await env.FLAGS.getBooleanValue('my-feature', false);
+ *
+ * // Get a flag value with evaluation context for targeting
+ * const variant = await env.FLAGS.getStringValue('experiment', 'control', {
+ *   userId: 'user-123',
+ *   country: 'US',
+ * });
+ *
+ * // Get full evaluation details including variant and reason
+ * const details = await env.FLAGS.getBooleanDetails('my-feature', false);
+ * console.log(details.variant, details.reason);
+ * ```
+ */
+declare abstract class Flagship {
+    /**
+     * Get a flag value without type checking.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Optional default value returned when evaluation fails.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    get(flagKey: string, defaultValue?: unknown, context?: FlagshipEvaluationContext): Promise<unknown>;
+    /**
+     * Get a boolean flag value.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Default value returned when evaluation fails or the flag type does not match.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    getBooleanValue(flagKey: string, defaultValue: boolean, context?: FlagshipEvaluationContext): Promise<boolean>;
+    /**
+     * Get a string flag value.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Default value returned when evaluation fails or the flag type does not match.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    getStringValue(flagKey: string, defaultValue: string, context?: FlagshipEvaluationContext): Promise<string>;
+    /**
+     * Get a number flag value.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Default value returned when evaluation fails or the flag type does not match.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    getNumberValue(flagKey: string, defaultValue: number, context?: FlagshipEvaluationContext): Promise<number>;
+    /**
+     * Get an object flag value.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Default value returned when evaluation fails or the flag type does not match.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    getObjectValue<T extends object>(flagKey: string, defaultValue: T, context?: FlagshipEvaluationContext): Promise<T>;
+    /**
+     * Get a boolean flag value with full evaluation details.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Default value returned when evaluation fails or the flag type does not match.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    getBooleanDetails(flagKey: string, defaultValue: boolean, context?: FlagshipEvaluationContext): Promise<FlagshipEvaluationDetails<boolean>>;
+    /**
+     * Get a string flag value with full evaluation details.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Default value returned when evaluation fails or the flag type does not match.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    getStringDetails(flagKey: string, defaultValue: string, context?: FlagshipEvaluationContext): Promise<FlagshipEvaluationDetails<string>>;
+    /**
+     * Get a number flag value with full evaluation details.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Default value returned when evaluation fails or the flag type does not match.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    getNumberDetails(flagKey: string, defaultValue: number, context?: FlagshipEvaluationContext): Promise<FlagshipEvaluationDetails<number>>;
+    /**
+     * Get an object flag value with full evaluation details.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Default value returned when evaluation fails or the flag type does not match.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    getObjectDetails<T extends object>(flagKey: string, defaultValue: T, context?: FlagshipEvaluationContext): Promise<FlagshipEvaluationDetails<T>>;
+}
+/**
+ * Hello World binding to serve as an explanatory example. DO NOT USE
+ */
+interface HelloWorldBinding {
+    /**
+     * Retrieve the current stored value
+     */
+    get(): Promise<{
+        value: string;
+        ms?: number;
+    }>;
+    /**
+     * Set a new stored value
+     */
+    set(value: string): Promise<void>;
+}
+interface Hyperdrive {
+    /**
+     * Connect directly to Hyperdrive as if it's your database, returning a TCP socket.
+     *
+     * Calling this method returns an identical socket to if you call
+     * `connect("host:port")` using the `host` and `port` fields from this object.
+     * Pick whichever approach works better with your preferred DB client library.
+     *
+     * Note that this socket is not yet authenticated -- it's expected that your
+     * code (or preferably, the client library of your choice) will authenticate
+     * using the information in this class's readonly fields.
+     */
+    connect(): Socket;
+    /**
+     * A valid DB connection string that can be passed straight into the typical
+     * client library/driver/ORM. This will typically be the easiest way to use
+     * Hyperdrive.
+     */
+    readonly connectionString: string;
+    /*
+     * A randomly generated hostname that is only valid within the context of the
+     * currently running Worker which, when passed into `connect()` function from
+     * the "cloudflare:sockets" module, will connect to the Hyperdrive instance
+     * for your database.
+     */
+    readonly host: string;
+    /*
+     * A synthetic IPv4 address (in the reserved 240.0.0.0/4 range) that, like the
+     * host field, is only valid within the context of the currently running
+     * Worker and, when passed into the `connect()` function from the
+     * "cloudflare:sockets" module, will connect to the Hyperdrive instance for
+     * your database. This is provided for database drivers that require the host
+     * to be an IP literal rather than a hostname.
+     */
+    readonly ip: string;
+    /*
+     * The port that must be paired the the host field when connecting.
+     */
+    readonly port: number;
+    /*
+     * The username to use when authenticating to your database via Hyperdrive.
+     * Unlike the host and password, this will be the same every time
+     */
+    readonly user: string;
+    /*
+     * The randomly generated password to use when authenticating to your
+     * database via Hyperdrive. Like the host field, this password is only valid
+     * within the context of the currently running Worker instance from which
+     * it's read.
+     */
+    readonly password: string;
+    /*
+     * The name of the database to connect to.
+     */
+    readonly database: string;
+}
+// Copyright (c) 2024 Cloudflare, Inc.
+// Licensed under the Apache 2.0 license found in the LICENSE file or at:
+//     https://opensource.org/licenses/Apache-2.0
+type ImageInfoResponse = {
+    format: 'image/svg+xml';
+} | {
+    format: string;
+    fileSize: number;
+    width: number;
+    height: number;
+};
+/**
+ * Parameters for rasterizing text into an image.
+ */
+type TextRasterize = {
+    /** The text content to render */
+    content: string;
+    /** rasterization options for the text **/
+    options: TextOptions;
+};
+type TextOptions = {
+    /** Font configuration */
+    font: {
+        /** URL to a font file in TrueType (.ttf), OpenType (.otf), WOFF (.woff), or WOFF2 (.woff2) format */
+        url: string;
+    };
+    /** Font size in points (pt) */
+    size?: number;
+    /** Text color in CSS format: hex (#RRGGBB or #RRGGBBAA), rgb(r,g,b), rgba(r,g,b,a), or named colors */
+    color?: string;
+};
+type ImageSource = ReadableStream<Uint8Array> | TextRasterize;
+type ImageTransform = {
+    width?: number;
+    height?: number;
+    background?: string;
+    blur?: number;
+    border?: {
+        color?: string;
+        width?: number;
+    } | {
+        top?: number;
+        bottom?: number;
+        left?: number;
+        right?: number;
+    };
+    brightness?: number;
+    contrast?: number;
+    fit?: 'scale-down' | 'contain' | 'pad' | 'squeeze' | 'cover' | 'crop';
+    flip?: 'h' | 'v' | 'hv';
+    gamma?: number;
+    segment?: 'foreground';
+    gravity?: 'face' | 'left' | 'right' | 'top' | 'bottom' | 'center' | 'auto' | 'entropy' | {
+        x?: number;
+        y?: number;
+        mode: 'remainder' | 'box-center';
+    };
+    rotate?: 0 | 90 | 180 | 270;
+    saturation?: number;
+    sharpen?: number;
+    trim?: 'border' | {
+        top?: number;
+        bottom?: number;
+        left?: number;
+        right?: number;
+        width?: number;
+        height?: number;
+        border?: boolean | {
+            color?: string;
+            tolerance?: number;
+            keep?: number;
+        };
+    };
+};
+type ImageDrawOptions = {
+    opacity?: number;
+    repeat?: boolean | string;
+    composite?: ImageCompositeMode;
+    top?: number;
+    left?: number;
+    bottom?: number;
+    right?: number;
+};
+type ImageCompositeMode = 
+/** Foreground drawn on top of backdrop (default) */
+'over'
+/** Foreground shown only where backdrop is opaque */
+ | 'in'
+/** Foreground drawn on top, but clipped to the backdrop's shape */
+ | 'atop'
+/** Foreground shown only where backdrop is transparent */
+ | 'out'
+/** Foreground and backdrop visible only where the other is not */
+ | 'xor'
+/** Foreground and backdrop channels added (brightening) */
+ | 'lighter';
+type ImageInputOptions = {
+    encoding?: 'base64';
+};
+type ImageOutputOptions = {
+    format: 'image/jpeg' | 'image/png' | 'image/gif' | 'image/webp' | 'image/avif' | 'rgb' | 'rgba';
+    quality?: number;
+    background?: string;
+    anim?: boolean;
+};
+interface ImageMetadata {
+    id: string;
+    filename?: string;
+    uploaded?: string;
+    requireSignedURLs: boolean;
+    meta?: Record<string, unknown>;
+    variants: string[];
+    draft?: boolean;
+    creator?: string;
+}
+interface ImageUploadOptions {
+    id?: string;
+    filename?: string;
+    requireSignedURLs?: boolean;
+    metadata?: Record<string, unknown>;
+    creator?: string;
+    /**
+     * If 'base64', the input data will be decoded from base64 before processing
+     */
+    encoding?: 'base64';
+}
+interface ImageUpdateOptions {
+    requireSignedURLs?: boolean;
+    metadata?: Record<string, unknown>;
+    creator?: string;
+}
+type ImageMetadataFilterOperators = {
+    eq?: string | number | boolean;
+    in?: string[] | number[];
+    gt?: number;
+    gte?: number;
+    lt?: number;
+    lte?: number;
+};
+type ImageMetadataFilterValue = string | number | boolean | ImageMetadataFilterOperators;
+interface ImageListFilter {
+    metadata?: Record<string, ImageMetadataFilterValue>;
+}
+interface ImageListOptions {
+    limit?: number;
+    cursor?: string;
+    sortOrder?: 'asc' | 'desc';
+    creator?: string;
+    filter?: ImageListFilter;
+}
+interface ImageSignedUrlOptions {
+    variant: string;
+    expiresIn?: number;
+    keyName?: string;
+}
+interface ImageDirectUploadOptions {
+    id?: string;
+    requireSignedURLs?: boolean;
+    metadata?: Record<string, unknown>;
+    creator?: string;
+    expiresIn?: number;
+}
+interface ImageDirectUploadResult {
+    id: string;
+    uploadURL: string;
+}
+interface ImageList {
+    images: ImageMetadata[];
+    cursor?: string;
+    listComplete: boolean;
+}
+interface ImageHandle {
+    /**
+     * Get metadata for a hosted image
+     * @returns Image metadata, or null if not found
+     */
+    details(): Promise<ImageMetadata | null>;
+    /**
+     * Get the raw image data for a hosted image
+     * @returns ReadableStream of image bytes, or null if not found
+     */
+    bytes(): Promise<ReadableStream<Uint8Array> | null>;
+    /**
+     * Generate a signed delivery URL for this hosted image.
+     * @param options Signing configuration
+     * @returns A signed image delivery URL
+     * @throws {@link ImagesError} if signing fails
+     */
+    signedUrl(options: ImageSignedUrlOptions): Promise<string>;
+    /**
+     * Update hosted image metadata
+     * @param options Properties to update
+     * @returns Updated image metadata
+     * @throws {@link ImagesError} if update fails
+     */
+    update(options: ImageUpdateOptions): Promise<ImageMetadata>;
+    /**
+     * Delete a hosted image
+     * @returns True if deleted, false if not found
+     */
+    delete(): Promise<boolean>;
+}
+interface HostedImagesBinding {
+    /**
+     * Get a handle for a hosted image
+     * @param imageId The ID of the image (UUID or custom ID)
+     * @returns A handle for per-image operations
+     */
+    image(imageId: string): ImageHandle;
+    /**
+     * Upload a new hosted image
+     * @param image The image file to upload
+     * @param options Upload configuration
+     * @returns Metadata for the uploaded image
+     * @throws {@link ImagesError} if upload fails
+     */
+    upload(image: ReadableStream<Uint8Array> | ArrayBuffer, options?: ImageUploadOptions): Promise<ImageMetadata>;
+    /**
+     * List hosted images with pagination
+     * @param options List configuration
+     * @returns List of images with pagination info
+     * @throws {@link ImagesError} if list fails
+     */
+    list(options?: ImageListOptions): Promise<ImageList>;
+    /**
+     * Create a Direct Creator Upload link, letting an end user upload an
+     * image straight to Cloudflare without exposing an API token
+     * @param options Upload link configuration
+     * @returns The new image ID and the upload URL to hand to the end user
+     * @throws {@link ImagesError} if creation fails
+     */
+    createDirectUpload(options?: ImageDirectUploadOptions): Promise<ImageDirectUploadResult>;
+}
+interface ImagesBinding {
+    /**
+     * Get image metadata (type, width and height)
+     * @throws {@link ImagesError} with code 9412 if input is not an image
+     * @param stream The image bytes
+     */
+    info(stream: ReadableStream<Uint8Array>, options?: ImageInputOptions): Promise<ImageInfoResponse>;
+    /**
+     * Begin applying a series of transformations to an image
+     * @param stream The image bytes
+     * @returns A transform handle
+     */
+    input(stream: ReadableStream<Uint8Array>, options?: ImageInputOptions): ImageTransformer;
+    /**
+     * Begin applying a series of transformations to text
+     * @param content string to be rendered
+     * @param options font, optional color and size to use in rendering text
+     * @returns A transform handle
+     */
+    text(content: string, options: TextOptions): ImageTransformer;
+    /**
+     * Access hosted images CRUD operations
+     */
+    readonly hosted: HostedImagesBinding;
+}
+interface ImageTransformer {
+    /**
+     * Apply transform next, returning a transform handle.
+     * You can then apply more transformations, draw, or retrieve the output.
+     * @param transform
+     */
+    transform(transform: ImageTransform): ImageTransformer;
+    /**
+     * Draw an image on this transformer, returning a transform handle.
+     * You can then apply more transformations, draw, or retrieve the output.
+     * @param image The image (or transformer that will give the image) to draw
+     * @param options The options configuring how to draw the image
+     */
+    draw(image: ReadableStream<Uint8Array> | ImageTransformer, options?: ImageDrawOptions): ImageTransformer;
+    /**
+     * Retrieve the image that results from applying the transforms to the
+     * provided input
+     * @param options Options that apply to the output e.g. output format
+     */
+    output(options: ImageOutputOptions): Promise<ImageTransformationResult>;
+}
+type ImageTransformationOutputOptions = {
+    encoding?: 'base64';
+};
+type ImageTransformationResponseOptions = {
+    headers?: HeadersInit;
+};
+interface ImageTransformationResult {
+    /**
+     * The image as a response, ready to store in cache or return to users
+     * @param options Options that apply to the returned response, e.g. additional headers
+     */
+    response(options?: ImageTransformationResponseOptions): Response;
+    /**
+     * The content type of the returned image
+     */
+    contentType(): string;
+    /**
+     * The bytes of the response
+     */
+    image(options?: ImageTransformationOutputOptions): ReadableStream<Uint8Array>;
+}
+interface ImagesError extends Error {
+    readonly code: number;
+    readonly message: string;
+    readonly stack?: string;
+}
+/**
+ * Media binding for transforming media streams.
+ * Provides the entry point for media transformation operations.
+ */
+interface MediaBinding {
+    /**
+     * Creates a media transformer from an input stream.
+     * @param media - The input media bytes
+     * @returns A MediaTransformer instance for applying transformations
+     */
+    input(media: ReadableStream<Uint8Array>): MediaTransformer;
+}
+/**
+ * Media transformer for applying transformation operations to media content.
+ * Handles sizing, fitting, and other input transformation parameters.
+ */
+interface MediaTransformer {
+    /**
+     * Applies transformation options to the media content.
+     * @param transform - Configuration for how the media should be transformed
+     * @returns A generator for producing the transformed media output
+     */
+    transform(transform?: MediaTransformationInputOptions): MediaTransformationGenerator;
+    /**
+     * Generates the final media output with specified options.
+     * @param output - Configuration for the output format and parameters
+     * @returns The final transformation result containing the transformed media
+     */
+    output(output?: MediaTransformationOutputOptions): MediaTransformationResult;
+}
+/**
+ * Generator for producing media transformation results.
+ * Configures the output format and parameters for the transformed media.
+ */
+interface MediaTransformationGenerator {
+    /**
+     * Generates the final media output with specified options.
+     * @param output - Configuration for the output format and parameters
+     * @returns The final transformation result containing the transformed media
+     */
+    output(output?: MediaTransformationOutputOptions): MediaTransformationResult;
+}
+/**
+ * Result of a media transformation operation.
+ * Provides multiple ways to access the transformed media content.
+ */
+interface MediaTransformationResult {
+    /**
+     * Returns the transformed media as a readable stream of bytes.
+     * @returns A promise containing a readable stream with the transformed media
+     */
+    media(): Promise<ReadableStream<Uint8Array>>;
+    /**
+     * Returns the transformed media as an HTTP response object.
+     * @returns The transformed media as a Promise<Response>, ready to store in cache or return to users
+     */
+    response(): Promise<Response>;
+    /**
+     * Returns the MIME type of the transformed media.
+     * @returns A promise containing the content type string (e.g., 'image/jpeg', 'video/mp4')
+     */
+    contentType(): Promise<string>;
+}
+/**
+ * Configuration options for transforming media input.
+ * Controls how the media should be resized and fitted.
+ */
+type MediaTransformationInputOptions = {
+    /** How the media should be resized to fit the specified dimensions */
+    fit?: 'contain' | 'cover' | 'scale-down';
+    /** Target width in pixels */
+    width?: number;
+    /** Target height in pixels */
+    height?: number;
+};
+/**
+ * Configuration options for Media Transformations output.
+ * Controls the format, timing, and type of the generated output.
+ */
+type MediaTransformationOutputOptions = {
+    /**
+     * Output mode determining the type of media to generate
+     */
+    mode?: 'video' | 'spritesheet' | 'frame' | 'audio';
+    /** Whether to include audio in the output */
+    audio?: boolean;
+    /**
+     * Starting timestamp for frame extraction or start time for clips. (e.g. '2s').
+     */
+    time?: string;
+    /**
+     * Duration for video clips, audio extraction, and spritesheet generation (e.g. '5s').
+     */
+    duration?: string;
+    /**
+     * Number of frames in the spritesheet.
+     */
+    imageCount?: number;
+    /**
+     * Output format for the generated media.
+     */
+    format?: 'jpg' | 'png' | 'm4a';
+};
+/**
+ * Error object for media transformation operations.
+ * Extends the standard Error interface with additional media-specific information.
+ */
+interface MediaError extends Error {
+    readonly code: number;
+    readonly message: string;
+    readonly stack?: string;
+}
+declare module 'cloudflare:node' {
+    interface NodeStyleServer {
+        listen(...args: unknown[]): this;
+        address(): {
+            port?: number | null | undefined;
+        };
+    }
+    export function httpServerHandler(port: number): ExportedHandler;
+    export function httpServerHandler(options: {
+        port: number;
+    }): ExportedHandler;
+    export function httpServerHandler(server: NodeStyleServer): ExportedHandler;
+}
+type Params<P extends string = any> = Record<P, string | string[]>;
+type EventContext<Env, P extends string, Data> = {
+    request: Request<unknown, IncomingRequestCfProperties<unknown>>;
+    functionPath: string;
+    waitUntil: (promise: Promise<any>) => void;
+    passThroughOnException: () => void;
+    next: (input?: Request | string, init?: RequestInit) => Promise<Response>;
+    env: Env & {
+        ASSETS: {
+            fetch: typeof fetch;
+        };
+    };
+    params: Params<P>;
+    data: Data;
+};
+type PagesFunction<Env = unknown, Params extends string = any, Data extends Record<string, unknown> = Record<string, unknown>> = (context: EventContext<Env, Params, Data>) => Response | Promise<Response>;
+type EventPluginContext<Env, P extends string, Data, PluginArgs> = {
+    request: Request<unknown, IncomingRequestCfProperties<unknown>>;
+    functionPath: string;
+    waitUntil: (promise: Promise<any>) => void;
+    passThroughOnException: () => void;
+    next: (input?: Request | string, init?: RequestInit) => Promise<Response>;
+    env: Env & {
+        ASSETS: {
+            fetch: typeof fetch;
+        };
+    };
+    params: Params<P>;
+    data: Data;
+    pluginArgs: PluginArgs;
+};
+type PagesPluginFunction<Env = unknown, Params extends string = any, Data extends Record<string, unknown> = Record<string, unknown>, PluginArgs = unknown> = (context: EventPluginContext<Env, Params, Data, PluginArgs>) => Response | Promise<Response>;
+declare module "assets:*" {
+    export const onRequest: PagesFunction;
+}
+// Copyright (c) 2022-2023 Cloudflare, Inc.
+// Licensed under the Apache 2.0 license found in the LICENSE file or at:
+//     https://opensource.org/licenses/Apache-2.0
+declare module "cloudflare:pipelines" {
+    export abstract class PipelineTransformationEntrypoint<Env = unknown, I extends PipelineRecord = PipelineRecord, O extends PipelineRecord = PipelineRecord> {
+        protected env: Env;
+        protected ctx: ExecutionContext;
+        constructor(ctx: ExecutionContext, env: Env);
+        /**
+         * run receives an array of PipelineRecord which can be
+         * transformed and returned to the pipeline
+         * @param records Incoming records from the pipeline to be transformed
+         * @param metadata Information about the specific pipeline calling the transformation entrypoint
+         * @returns A promise containing the transformed PipelineRecord array
+         */
+        public run(records: I[], metadata: PipelineBatchMetadata): Promise<O[]>;
+    }
+    export type PipelineRecord = Record<string, unknown>;
+    export type PipelineBatchMetadata = {
+        pipelineId: string;
+        pipelineName: string;
+    };
+    export interface Pipeline<T extends PipelineRecord = PipelineRecord> {
+        /**
+         * The Pipeline interface represents the type of a binding to a Pipeline
+         *
+         * @param records The records to send to the pipeline
+         */
+        send(records: T[]): Promise<void>;
+    }
+}
+// PubSubMessage represents an incoming PubSub message.
+// The message includes metadata about the broker, the client, and the payload
+// itself.
+// https://developers.cloudflare.com/pub-sub/
+interface PubSubMessage {
+    // Message ID
+    readonly mid: number;
+    // MQTT broker FQDN in the form mqtts://BROKER.NAMESPACE.cloudflarepubsub.com:PORT
+    readonly broker: string;
+    // The MQTT topic the message was sent on.
+    readonly topic: string;
+    // The client ID of the client that published this message.
+    readonly clientId: string;
+    // The unique identifier (JWT ID) used by the client to authenticate, if token
+    // auth was used.
+    readonly jti?: string;
+    // A Unix timestamp (seconds from Jan 1, 1970), set when the Pub/Sub Broker
+    // received the message from the client.
+    readonly receivedAt: number;
+    // An (optional) string with the MIME type of the payload, if set by the
+    // client.
+    readonly contentType: string;
+    // Set to 1 when the payload is a UTF-8 string
+    // https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#_Toc3901063
+    readonly payloadFormatIndicator: number;
+    // Pub/Sub (MQTT) payloads can be UTF-8 strings, or byte arrays.
+    // You can use payloadFormatIndicator to inspect this before decoding.
+    payload: string | Uint8Array;
+}
+// JsonWebKey extended by kid parameter
+interface JsonWebKeyWithKid extends JsonWebKey {
+    // Key Identifier of the JWK
+    readonly kid: string;
+}
+interface RateLimitOptions {
+    key: string;
+}
+interface RateLimitOutcome {
+    success: boolean;
+}
+interface RateLimit {
+    /**
+     * Rate limit a request based on the provided options.
+     * @see https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/
+     * @returns A promise that resolves with the outcome of the rate limit.
+     */
+    limit(options: RateLimitOptions): Promise<RateLimitOutcome>;
+}
+// Namespace for RPC utility types. Unfortunately, we can't use a `module` here as these types need
+// to referenced by `Fetcher`. This is included in the "importable" version of the types which
+// strips all `module` blocks.
+declare namespace Rpc {
+    // Branded types for identifying `WorkerEntrypoint`/`DurableObject`/`Target`s.
+    // TypeScript uses *structural* typing meaning anything with the same shape as type `T` is a `T`.
+    // For the classes exported by `cloudflare:workers` we want *nominal* typing (i.e. we only want to
+    // accept `WorkerEntrypoint` from `cloudflare:workers`, not any other class with the same shape)
+    export const __RPC_STUB_BRAND: '__RPC_STUB_BRAND';
+    export const __RPC_TARGET_BRAND: '__RPC_TARGET_BRAND';
+    export const __WORKER_ENTRYPOINT_BRAND: '__WORKER_ENTRYPOINT_BRAND';
+    export const __DURABLE_OBJECT_BRAND: '__DURABLE_OBJECT_BRAND';
+    export const __WORKFLOW_ENTRYPOINT_BRAND: '__WORKFLOW_ENTRYPOINT_BRAND';
+    export interface RpcTargetBranded {
+        [__RPC_TARGET_BRAND]: never;
+    }
+    export interface WorkerEntrypointBranded {
+        [__WORKER_ENTRYPOINT_BRAND]: never;
+    }
+    export interface DurableObjectBranded {
+        [__DURABLE_OBJECT_BRAND]: never;
+    }
+    export interface WorkflowEntrypointBranded {
+        [__WORKFLOW_ENTRYPOINT_BRAND]: never;
+    }
+    export type EntrypointBranded = WorkerEntrypointBranded | DurableObjectBranded | WorkflowEntrypointBranded;
+    // Types that can be used through `Stub`s
+    export type Stubable = RpcTargetBranded | ((...args: any[]) => any);
+    // Types that can be passed over RPC
+    // The reason for using a generic type here is to build a serializable subset of structured
+    //   cloneable composite types. This allows types defined with the "interface" keyword to pass the
+    //   serializable check as well. Otherwise, only types defined with the "type" keyword would pass.
+    type Serializable<T> = 
+    // Structured cloneables
+    BaseType
+    // Structured cloneable composites
+     | Map<T extends Map<infer U, unknown> ? Serializable<U> : never, T extends Map<unknown, infer U> ? Serializable<U> : never> | Set<T extends Set<infer U> ? Serializable<U> : never> | ReadonlyArray<T extends ReadonlyArray<infer U> ? Serializable<U> : never> | {
+        [K in keyof T]: K extends number | string ? Serializable<T[K]> : never;
+    }
+    // Special types
+     | Stub<Stubable>
+    // Serialized as stubs, see `Stubify`
+     | Stubable;
+    // Base type for all RPC stubs, including common memory management methods.
+    // `T` is used as a marker type for unwrapping `Stub`s later.
+    interface StubBase<T extends Stubable> extends Disposable {
+        [__RPC_STUB_BRAND]: T;
+        dup(): this;
+    }
+    export type Stub<T extends Stubable> = Provider<T> & StubBase<T>;
+    // This represents all the types that can be sent as-is over an RPC boundary
+    type BaseType = void | undefined | null | boolean | number | bigint | string | TypedArray | ArrayBuffer | DataView | Date | Error | RegExp | ReadableStream<Uint8Array> | WritableStream<Uint8Array> | Request | Response | Headers;
+    // Recursively rewrite all `Stubable` types with `Stub`s
+    // prettier-ignore
+    type Stubify<T> = T extends Stubable ? Stub<T> : T extends Map<infer K, infer V> ? Map<Stubify<K>, Stubify<V>> : T extends Set<infer V> ? Set<Stubify<V>> : T extends Array<infer V> ? Array<Stubify<V>> : T extends ReadonlyArray<infer V> ? ReadonlyArray<Stubify<V>> : T extends BaseType ? T : T extends {
+        [key: string | number]: any;
+    } ? {
+        [K in keyof T]: Stubify<T[K]>;
+    } : T;
+    // Recursively rewrite all `Stub<T>`s with the corresponding `T`s.
+    // Note we use `StubBase` instead of `Stub` here to avoid circular dependencies:
+    // `Stub` depends on `Provider`, which depends on `Unstubify`, which would depend on `Stub`.
+    // prettier-ignore
+    type Unstubify<T> = T extends StubBase<infer V> ? V : T extends Map<infer K, infer V> ? Map<Unstubify<K>, Unstubify<V>> : T extends Set<infer V> ? Set<Unstubify<V>> : T extends Array<infer V> ? Array<Unstubify<V>> : T extends ReadonlyArray<infer V> ? ReadonlyArray<Unstubify<V>> : T extends BaseType ? T : T extends {
+        [key: string | number]: unknown;
+    } ? {
+        [K in keyof T]: Unstubify<T[K]>;
+    } : T;
+    type UnstubifyAll<A extends any[]> = {
+        [I in keyof A]: Unstubify<A[I]>;
+    };
+    // Utility type for adding `Provider`/`Disposable`s to `object` types only.
+    // Note `unknown & T` is equivalent to `T`.
+    type MaybeProvider<T> = T extends object ? Provider<T> : unknown;
+    type MaybeDisposable<T> = T extends object ? Disposable : unknown;
+    // Type for method return or property on an RPC interface.
+    // - Stubable types are replaced by stubs.
+    // - Serializable types are passed by value, with stubable types replaced by stubs
+    //   and a top-level `Disposer`.
+    // Everything else can't be passed over PRC.
+    // Technically, we use custom thenables here, but they quack like `Promise`s.
+    // Intersecting with `(Maybe)Provider` allows pipelining.
+    // prettier-ignore
+    type Result<R> = R extends Stubable ? Promise<Stub<R>> & Provider<R> : R extends Serializable<R> ? Promise<Stubify<R> & MaybeDisposable<R>> & MaybeProvider<R> : never;
+    // Type for method or property on an RPC interface.
+    // For methods, unwrap `Stub`s in parameters, and rewrite returns to be `Result`s.
+    // Unwrapping `Stub`s allows calling with `Stubable` arguments.
+    // For properties, rewrite types to be `Result`s.
+    // In each case, unwrap `Promise`s.
+    type MethodOrProperty<V> = V extends (...args: infer P) => infer R ? (...args: UnstubifyAll<P>) => Result<Awaited<R>> : Result<Awaited<V>>;
+    // Type for the callable part of an `Provider` if `T` is callable.
+    // This is intersected with methods/properties.
+    type MaybeCallableProvider<T> = T extends (...args: any[]) => any ? MethodOrProperty<T> : unknown;
+    // Base type for all other types providing RPC-like interfaces.
+    // Rewrites all methods/properties to be `MethodOrProperty`s, while preserving callable types.
+    // `Reserved` names (e.g. stub method names like `dup()`) and symbols can't be accessed over RPC.
+    export type Provider<T extends object, Reserved extends string = never> = MaybeCallableProvider<T> & Pick<{
+        [K in keyof T]: MethodOrProperty<T[K]>;
+    }, Exclude<keyof T, Reserved | symbol | keyof StubBase<never>>>;
+}
+declare namespace Cloudflare {
+    // Type of `env`.
+    //
+    // The specific project can extend `Env` by redeclaring it in project-specific files. Typescript
+    // will merge all declarations.
+    //
+    // You can use `wrangler types` to generate the `Env` type automatically.
+    interface Env {
+    }
+    // Project-specific parameters used to inform types.
+    //
+    // This interface is, again, intended to be declared in project-specific files, and then that
+    // declaration will be merged with this one.
+    //
+    // A project should have a declaration like this:
+    //
+    //     interface GlobalProps {
+    //       // Declares the main module's exports. Used to populate Cloudflare.Exports aka the type
+    //       // of `ctx.exports`.
+    //       mainModule: typeof import("my-main-module");
+    //
+    //       // Declares which of the main module's exports are configured with durable storage, and
+    //       // thus should behave as Durable Object namsepace bindings.
+    //       durableNamespaces: "MyDurableObject" | "AnotherDurableObject";
+    //     }
+    //
+    // You can use `wrangler types` to generate `GlobalProps` automatically.
+    interface GlobalProps {
+    }
+    // Evaluates to the type of a property in GlobalProps, defaulting to `Default` if it is not
+    // present.
+    type GlobalProp<K extends string, Default> = K extends keyof GlobalProps ? GlobalProps[K] : Default;
+    // The type of the program's main module exports, if known. Requires `GlobalProps` to declare the
+    // `mainModule` property.
+    type MainModule = GlobalProp<"mainModule", {}>;
+    // The type of ctx.exports, which contains loopback bindings for all top-level exports.
+    type Exports = {
+        [K in keyof MainModule]: LoopbackForExport<MainModule[K]>
+        // If the export is listed in `durableNamespaces`, then it is also a
+        // DurableObjectNamespace.
+         & (K extends GlobalProp<"durableNamespaces", never> ? MainModule[K] extends new (...args: any[]) => infer DoInstance ? DoInstance extends Rpc.DurableObjectBranded ? DurableObjectNamespace<DoInstance> : DurableObjectNamespace<undefined> : DurableObjectNamespace<undefined> : {});
+    };
+}
+declare namespace CloudflareWorkersModule {
+    export type RpcStub<T extends Rpc.Stubable> = Rpc.Stub<T>;
+    export const RpcStub: {
+        new <T extends Rpc.Stubable>(value: T): Rpc.Stub<T>;
+    };
+    export abstract class RpcTarget implements Rpc.RpcTargetBranded {
+        [Rpc.__RPC_TARGET_BRAND]: never;
+    }
+    // `protected` fields don't appear in `keyof`s, so can't be accessed over RPC
+    export abstract class WorkerEntrypoint<Env = Cloudflare.Env, Props = {}> implements Rpc.WorkerEntrypointBranded {
+        [Rpc.__WORKER_ENTRYPOINT_BRAND]: never;
+        protected ctx: ExecutionContext<Props>;
+        protected env: Env;
+        constructor(ctx: ExecutionContext, env: Env);
+        email?(message: ForwardableEmailMessage): void | Promise<void>;
+        fetch?(request: Request): Response | Promise<Response>;
+        connect?(socket: Socket): void | Promise<void>;
+        queue?(batch: MessageBatch): void | Promise<void>;
+        scheduled?(controller: ScheduledController): void | Promise<void>;
+        tail?(events: TraceItem[]): void | Promise<void>;
+        tailStream?(event: TailStream.TailEvent<TailStream.Onset>): TailStream.TailEventHandlerType | Promise<TailStream.TailEventHandlerType>;
+        test?(controller: TestController): void | Promise<void>;
+        trace?(traces: TraceItem[]): void | Promise<void>;
+    }
+    export abstract class DurableObject<Env = Cloudflare.Env, Props = {}> implements Rpc.DurableObjectBranded {
+        [Rpc.__DURABLE_OBJECT_BRAND]: never;
+        protected ctx: DurableObjectState<Props>;
+        protected env: Env;
+        constructor(ctx: DurableObjectState, env: Env);
+        alarm?(alarmInfo?: AlarmInvocationInfo): void | Promise<void>;
+        fetch?(request: Request): Response | Promise<Response>;
+        connect?(socket: Socket): void | Promise<void>;
+        webSocketMessage?(ws: WebSocket, message: string | ArrayBuffer): void | Promise<void>;
+        webSocketClose?(ws: WebSocket, code: number, reason: string, wasClean: boolean): void | Promise<void>;
+        webSocketError?(ws: WebSocket, error: unknown): void | Promise<void>;
+    }
+    export type WorkflowDurationLabel = 'second' | 'minute' | 'hour' | 'day' | 'week' | 'month' | 'year';
+    export type WorkflowSleepDuration = `${number} ${WorkflowDurationLabel}${'s' | ''}` | number;
+    export type WorkflowDelayDuration = WorkflowSleepDuration;
+    export type WorkflowDynamicDelayContext = {
+        ctx: WorkflowStepContext<WorkflowDelayFunction>;
+        error: Error;
+    };
+    export type WorkflowDelayFunction = (input: WorkflowDynamicDelayContext) => WorkflowDelayDuration | Promise<WorkflowDelayDuration>;
+    export type WorkflowTimeoutDuration = WorkflowSleepDuration;
+    export type WorkflowRetentionDuration = WorkflowSleepDuration;
+    export type WorkflowBackoff = 'constant' | 'linear' | 'exponential';
+    export type WorkflowStepSensitivity = 'output';
+    export type WorkflowStepConfig = {
+        retries?: {
+            limit: number;
+            delay: WorkflowDelayDuration | number | WorkflowDelayFunction;
+            backoff?: WorkflowBackoff;
+        };
+        timeout?: WorkflowTimeoutDuration | number;
+        sensitive?: WorkflowStepSensitivity;
+    };
+    // Internal discriminators used only for `WorkflowStep.do` overload
+    // resolution. They mirror `WorkflowStepConfig` but pin `retries.delay` to a
+    // single kind so the callback context can be narrowed based on the shape of
+    // the config argument (rather than on an inferred type parameter, which is
+    // lost when the caller supplies an explicit return-type argument). Not
+    // exported: they must not widen the public type surface.
+    type WorkflowStepConfigWithStaticDelay = Omit<WorkflowStepConfig, 'retries'> & {
+        retries?: {
+            limit: number;
+            delay: WorkflowDelayDuration | number;
+            backoff?: WorkflowBackoff;
+        };
+    };
+    type WorkflowStepConfigWithDelayFunction = Omit<WorkflowStepConfig, 'retries'> & {
+        retries: {
+            limit: number;
+            delay: WorkflowDelayFunction;
+            backoff?: WorkflowBackoff;
+        };
+    };
+    export type WorkflowStepRollbackConfig = Pick<WorkflowStepConfig, 'retries' | 'timeout'>;
+    export type WorkflowCronSchedule = {
+        /** Cron expression that triggered this event. */
+        cron: string;
+        /** Timestamp of the scheduled trigger, in milliseconds since the Unix epoch. */
+        scheduledTime: number;
+    };
+    export type WorkflowEvent<T> = {
+        payload: Readonly<T>;
+        timestamp: Date;
+        instanceId: string;
+        workflowName: string;
+        schedule?: WorkflowCronSchedule;
+    };
+    export type WorkflowStepEvent<T> = {
+        payload: Readonly<T>;
+        timestamp: Date;
+        type: string;
+        sensitive?: WorkflowStepSensitivity;
+    };
+    export type WorkflowStepContext<Delay = WorkflowDelayDuration | number> = {
+        step: {
+            name: string;
+            count: number;
+        };
+        attempt: number;
+        config: {
+            retries?: {
+                limit: number;
+                backoff?: WorkflowBackoff;
+            } & (Delay extends WorkflowDelayFunction ? {} : {
+                delay: WorkflowDelayDuration | number;
+            });
+            timeout?: WorkflowTimeoutDuration | number;
+            sensitive?: WorkflowStepSensitivity;
+        };
+    };
+    // The rollback handler receives the step context, so it mirrors the same
+    // delay discriminant as the step callback: when the step was configured with
+    // a dynamic delay function the resolved `config.retries.delay` is omitted,
+    // otherwise it is present. `Delay` is threaded from the `WorkflowStep.do`
+    // overload that matched the step config.
+    export type WorkflowRollbackContext<T = unknown, Delay = WorkflowDelayDuration | number> = {
+        ctx: WorkflowStepContext<Delay>;
+        error: Error;
+        output: T | undefined;
+        /** @deprecated Use `ctx.step.name` and `ctx.step.count` instead. */
+        stepName: string;
+    };
+    export type WorkflowRollbackHandler<T = unknown, Delay = WorkflowDelayDuration | number> = (ctx: WorkflowRollbackContext<T, Delay>) => Promise<void>;
+    export type WorkflowStepRollbackOptions<T = unknown, Delay = WorkflowDelayDuration | number> = {
+        rollback: WorkflowRollbackHandler<T, Delay>;
+        rollbackConfig?: WorkflowStepRollbackConfig;
+    };
+    export abstract class WorkflowStep {
+        do<T extends Rpc.Serializable<T>>(name: string, callback: (ctx: WorkflowStepContext) => Promise<T>, rollbackOptions?: WorkflowStepRollbackOptions<T>): Promise<T>;
+        // The config overloads discriminate on the shape of `config.retries.delay`
+        // so the callback context reflects whether the resolved delay is present
+        // (static delay) or omitted (dynamic delay function). Each has a single
+        // type parameter, so an explicit return-type argument (`do<T>(...)`) still
+        // resolves here. ORDERING IS LOAD-BEARING: the broad `WorkflowStepConfig`
+        // fallback MUST remain last, otherwise it shadows the discriminating
+        // overloads and narrowing is silently lost.
+        do<T extends Rpc.Serializable<T>>(name: string, config: WorkflowStepConfigWithDelayFunction, callback: (ctx: WorkflowStepContext<WorkflowDelayFunction>) => Promise<T>, rollbackOptions?: WorkflowStepRollbackOptions<T, WorkflowDelayFunction>): Promise<T>;
+        do<T extends Rpc.Serializable<T>>(name: string, config: WorkflowStepConfigWithStaticDelay, callback: (ctx: WorkflowStepContext<WorkflowDelayDuration | number>) => Promise<T>, rollbackOptions?: WorkflowStepRollbackOptions<T, WorkflowDelayDuration | number>): Promise<T>;
+        do<T extends Rpc.Serializable<T>>(name: string, config: WorkflowStepConfig, callback: (ctx: WorkflowStepContext) => Promise<T>, rollbackOptions?: WorkflowStepRollbackOptions<T>): Promise<T>;
+        sleep: (name: string, duration: WorkflowSleepDuration) => Promise<void>;
+        sleepUntil: (name: string, timestamp: Date | number) => Promise<void>;
+        waitForEvent<T extends Rpc.Serializable<T>>(name: string, options: {
+            type: string;
+            timeout?: WorkflowTimeoutDuration | number;
+        }): Promise<WorkflowStepEvent<T>>;
+    }
+    export type WorkflowInstanceStatus = 'queued' | 'running' | 'paused' | 'errored' | 'terminated' | 'complete' | 'waiting' | 'waitingForPause' | 'unknown';
+    export abstract class WorkflowEntrypoint<Env = unknown, T extends Rpc.Serializable<T> | unknown = unknown> implements Rpc.WorkflowEntrypointBranded {
+        [Rpc.__WORKFLOW_ENTRYPOINT_BRAND]: never;
+        protected ctx: ExecutionContext;
+        protected env: Env;
+        constructor(ctx: ExecutionContext, env: Env);
+        run(event: Readonly<WorkflowEvent<T>>, step: WorkflowStep): Promise<unknown>;
+    }
+    export function waitUntil(promise: Promise<unknown>): void;
+    export function withEnv(newEnv: unknown, fn: () => unknown): unknown;
+    export function withExports(newExports: unknown, fn: () => unknown): unknown;
+    export function withEnvAndExports(newEnv: unknown, newExports: unknown, fn: () => unknown): unknown;
+    export const env: Cloudflare.Env;
+    export const exports: Cloudflare.Exports;
+    export const cache: CacheContext;
+    export const tracing: Tracing;
+}
+declare module 'cloudflare:workers' {
+    export = CloudflareWorkersModule;
+}
+interface SecretsStoreSecret {
+    /**
+     * Get a secret from the Secrets Store, returning a string of the secret value
+     * if it exists, or throws an error if it does not exist
+     */
+    get(): Promise<string>;
+}
+declare module "cloudflare:sockets" {
+    function _connect(address: string | SocketAddress, options?: SocketOptions): Socket;
+    export { _connect as connect };
+}
+/**
+ * Binding entrypoint for Cloudflare Stream.
+ *
+ * Usage:
+ * - Binding-level operations:
+ *   `await env.STREAM.videos.upload`
+ *   `await env.STREAM.videos.createDirectUpload`
+ *   `await env.STREAM.videos.*`
+ *   `await env.STREAM.watermarks.*`
+ * - Per-video operations:
+ *   `await env.STREAM.video(id).downloads.*`
+ *   `await env.STREAM.video(id).captions.*`
+ *
+ * Example usage:
+ * ```ts
+ * await env.STREAM.video(id).downloads.generate();
+ *
+ * const video = env.STREAM.video(id)
+ * const captions = video.captions.list();
+ * const videoDetails = video.details()
+ * ```
+ */
+interface StreamBinding {
+    /**
+     * Returns a handle scoped to a single video for per-video operations.
+     * @param id The unique identifier for the video.
+     * @returns A handle for per-video operations.
+     */
+    video(id: string): StreamVideoHandle;
+    /**
+     * Uploads a new video from a provided URL.
+     * @param url The URL to upload from.
+     * @param params Optional upload parameters.
+     * @returns The uploaded video details.
+     * @throws {BadRequestError} if the upload parameter is invalid or the URL is invalid
+     * @throws {QuotaReachedError} if the account storage capacity is exceeded
+     * @throws {MaxFileSizeError} if the file size is too large
+     * @throws {RateLimitedError} if the server received too many requests
+     * @throws {AlreadyUploadedError} if a video was already uploaded to this URL
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    upload(url: string, params?: StreamUrlUploadParams): Promise<StreamVideo>;
+    /**
+     * Creates a direct upload that allows video uploads without an API key.
+     * @param params Parameters for the direct upload
+     * @returns The direct upload details.
+     * @throws {BadRequestError} if the parameters are invalid
+     * @throws {RateLimitedError} if the server received too many requests
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    createDirectUpload(params: StreamDirectUploadCreateParams): Promise<StreamDirectUpload>;
+    videos: StreamVideos;
+    watermarks: StreamWatermarks;
+}
+/**
+ * Handle for operations scoped to a single Stream video.
+ */
+interface StreamVideoHandle {
+    /**
+     * The unique identifier for the video.
+     */
+    id: string;
+    /**
+     * Get a full videos details
+     * @returns The full video details.
+     * @throws {NotFoundError} if the video is not found
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    details(): Promise<StreamVideo>;
+    /**
+     * Update details for a single video.
+     * @param params The fields to update for the video.
+     * @returns The updated video details.
+     * @throws {NotFoundError} if the video is not found
+     * @throws {BadRequestError} if the parameters are invalid
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    update(params: StreamUpdateVideoParams): Promise<StreamVideo>;
+    /**
+     * Deletes a video and its copies from Cloudflare Stream.
+     * @returns A promise that resolves when deletion completes.
+     * @throws {NotFoundError} if the video is not found
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    delete(): Promise<void>;
+    /**
+     * Creates a signed URL token for a video.
+     * @returns The signed token that was created.
+     * @throws {InternalError} if the signing key cannot be retrieved or the token cannot be signed
+     */
+    generateToken(): Promise<string>;
+    downloads: StreamScopedDownloads;
+    captions: StreamScopedCaptions;
+}
+interface StreamVideo {
+    /**
+     * The unique identifier for the video.
+     */
+    id: string;
+    /**
+     * A user-defined identifier for the media creator.
+     */
+    creator: string | null;
+    /**
+     * The thumbnail URL for the video.
+     */
+    thumbnail: string;
+    /**
+     * The thumbnail timestamp percentage.
+     */
+    thumbnailTimestampPct: number;
+    /**
+     * Indicates whether the video is ready to stream.
+     */
+    readyToStream: boolean;
+    /**
+     * The date and time the video became ready to stream.
+     */
+    readyToStreamAt: string | null;
+    /**
+     * Processing status information.
+     */
+    status: StreamVideoStatus;
+    /**
+     * A user modifiable key-value store.
+     */
+    meta: Record<string, string>;
+    /**
+     * The date and time the video was created.
+     */
+    created: string;
+    /**
+     * The date and time the video was last modified.
+     */
+    modified: string;
+    /**
+     * The date and time at which the video will be deleted.
+     */
+    scheduledDeletion: string | null;
+    /**
+     * The size of the video in bytes.
+     */
+    size: number;
+    /**
+     * The preview URL for the video.
+     */
+    preview?: string;
+    /**
+     * Origins allowed to display the video.
+     */
+    allowedOrigins: Array<string>;
+    /**
+     * Indicates whether signed URLs are required.
+     */
+    requireSignedURLs: boolean | null;
+    /**
+     * The date and time the video was uploaded.
+     */
+    uploaded: string | null;
+    /**
+     * The date and time when the upload URL expires.
+     */
+    uploadExpiry: string | null;
+    /**
+     * The maximum size in bytes for direct uploads.
+     */
+    maxSizeBytes: number | null;
+    /**
+     * The maximum duration in seconds for direct uploads.
+     */
+    maxDurationSeconds: number | null;
+    /**
+     * The video duration in seconds. -1 indicates unknown.
+     */
+    duration: number;
+    /**
+     * Input metadata for the original upload.
+     */
+    input: StreamVideoInput;
+    /**
+     * Playback URLs for the video.
+     */
+    hlsPlaybackUrl: string;
+    dashPlaybackUrl: string;
+    /**
+     * The watermark applied to the video, if any.
+     */
+    watermark: StreamWatermark | null;
+    /**
+     * The live input id associated with the video, if any.
+     */
+    liveInputId?: string | null;
+    /**
+     * The source video id if this is a clip.
+     */
+    clippedFromId: string | null;
+    /**
+     * Public details associated with the video.
+     */
+    publicDetails: StreamPublicDetails | null;
+}
+type StreamVideoStatus = {
+    /**
+     * The current processing state.
+     */
+    state: string;
+    /**
+     * The current processing step.
+     */
+    step?: string;
+    /**
+     * The percent complete as a string.
+     */
+    pctComplete?: string;
+    /**
+     * An error reason code, if applicable.
+     */
+    errorReasonCode: string;
+    /**
+     * An error reason text, if applicable.
+     */
+    errorReasonText: string;
+};
+type StreamVideoInput = {
+    /**
+     * The input width in pixels.
+     */
+    width: number;
+    /**
+     * The input height in pixels.
+     */
+    height: number;
+};
+type StreamPublicDetails = {
+    /**
+     * The public title for the video.
+     */
+    title: string | null;
+    /**
+     * The public share link.
+     */
+    share_link: string | null;
+    /**
+     * The public channel link.
+     */
+    channel_link: string | null;
+    /**
+     * The public logo URL.
+     */
+    logo: string | null;
+};
+type StreamDirectUpload = {
+    /**
+     * The URL an unauthenticated upload can use for a single multipart request.
+     */
+    uploadURL: string;
+    /**
+     * A Cloudflare-generated unique identifier for a media item.
+     */
+    id: string;
+    /**
+     * The watermark profile applied to the upload.
+     */
+    watermark: StreamWatermark | null;
+    /**
+     * The scheduled deletion time, if any.
+     */
+    scheduledDeletion: string | null;
+};
+type StreamDirectUploadCreateParams = {
+    /**
+     * The maximum duration in seconds for a video upload.
+     */
+    maxDurationSeconds: number;
+    /**
+     * The date and time after upload when videos will not be accepted.
+     */
+    expiry?: string;
+    /**
+     * A user-defined identifier for the media creator.
+     */
+    creator?: string;
+    /**
+     * A user modifiable key-value store used to reference other systems of record for
+     * managing videos.
+     */
+    meta?: Record<string, string>;
+    /**
+     * Lists the origins allowed to display the video.
+     */
+    allowedOrigins?: Array<string>;
+    /**
+     * Indicates whether the video can be accessed using the id. When set to `true`,
+     * a signed token must be generated with a signing key to view the video.
+     */
+    requireSignedURLs?: boolean;
+    /**
+     * The thumbnail timestamp percentage.
+     */
+    thumbnailTimestampPct?: number;
+    /**
+     * The date and time at which the video will be deleted. Include `null` to remove
+     * a scheduled deletion.
+     */
+    scheduledDeletion?: string | null;
+    /**
+     * The watermark profile to apply.
+     */
+    watermark?: StreamDirectUploadWatermark;
+};
+type StreamDirectUploadWatermark = {
+    /**
+     * The unique identifier for the watermark profile.
+     */
+    id: string;
+};
+type StreamUrlUploadParams = {
+    /**
+     * Lists the origins allowed to display the video. Enter allowed origin
+     * domains in an array and use `*` for wildcard subdomains. Empty arrays allow the
+     * video to be viewed on any origin.
+     */
+    allowedOrigins?: Array<string>;
+    /**
+     * A user-defined identifier for the media creator.
+     */
+    creator?: string;
+    /**
+     * A user modifiable key-value store used to reference other systems of
+     * record for managing videos.
+     */
+    meta?: Record<string, string>;
+    /**
+     * Indicates whether the video can be a accessed using the id. When
+     * set to `true`, a signed token must be generated with a signing key to view the
+     * video.
+     */
+    requireSignedURLs?: boolean;
+    /**
+     * Indicates the date and time at which the video will be deleted. Omit
+     * the field to indicate no change, or include with a `null` value to remove an
+     * existing scheduled deletion. If specified, must be at least 30 days from upload
+     * time.
+     */
+    scheduledDeletion?: string | null;
+    /**
+     * The timestamp for a thumbnail image calculated as a percentage value
+     * of the video's duration. To convert from a second-wise timestamp to a
+     * percentage, divide the desired timestamp by the total duration of the video. If
+     * this value is not set, the default thumbnail image is taken from 0s of the
+     * video.
+     */
+    thumbnailTimestampPct?: number;
+    /**
+     * The identifier for the watermark profile
+     */
+    watermarkId?: string;
+};
+interface StreamScopedCaptions {
+    /**
+     * Uploads the caption or subtitle file to the endpoint for a specific BCP47 language.
+     * One caption or subtitle file per language is allowed.
+     * @param language The BCP 47 language tag for the caption or subtitle.
+     * @param input The caption or subtitle stream to upload.
+     * @returns The created caption entry.
+     * @throws {NotFoundError} if the video is not found
+     * @throws {BadRequestError} if the language or file is invalid
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    upload(language: string, input: ReadableStream): Promise<StreamCaption>;
+    /**
+     * Generate captions or subtitles for the provided language via AI.
+     * @param language The BCP 47 language tag to generate.
+     * @returns The generated caption entry.
+     * @throws {NotFoundError} if the video is not found
+     * @throws {BadRequestError} if the language is invalid
+     * @throws {StreamError} if a generated caption already exists
+     * @throws {StreamError} if the video duration is too long
+     * @throws {StreamError} if the video is missing audio
+     * @throws {StreamError} if the requested language is not supported
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    generate(language: string): Promise<StreamCaption>;
+    /**
+     * Lists the captions or subtitles.
+     * Use the language parameter to filter by a specific language.
+     * @param language The optional BCP 47 language tag to filter by.
+     * @returns The list of captions or subtitles.
+     * @throws {NotFoundError} if the video or caption is not found
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    list(language?: string): Promise<StreamCaption[]>;
+    /**
+     * Removes the captions or subtitles from a video.
+     * @param language The BCP 47 language tag to remove.
+     * @returns A promise that resolves when deletion completes.
+     * @throws {NotFoundError} if the video or caption is not found
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    delete(language: string): Promise<void>;
+}
+interface StreamScopedDownloads {
+    /**
+     * Generates a download for a video when a video is ready to view. Available
+     * types are `default` and `audio`. Defaults to `default` when omitted.
+     * @param downloadType The download type to create.
+     * @returns The current downloads for the video.
+     * @throws {NotFoundError} if the video is not found
+     * @throws {BadRequestError} if the download type is invalid
+     * @throws {StreamError} if the video duration is too long to generate a download
+     * @throws {StreamError} if the video is not ready to stream
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    generate(downloadType?: StreamDownloadType): Promise<StreamDownloadGetResponse>;
+    /**
+     * Lists the downloads created for a video.
+     * @returns The current downloads for the video.
+     * @throws {NotFoundError} if the video or downloads are not found
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    get(): Promise<StreamDownloadGetResponse>;
+    /**
+     * Delete the downloads for a video. Available types are `default` and `audio`.
+     * Defaults to `default` when omitted.
+     * @param downloadType The download type to delete.
+     * @returns A promise that resolves when deletion completes.
+     * @throws {NotFoundError} if the video or downloads are not found
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    delete(downloadType?: StreamDownloadType): Promise<void>;
+}
+interface StreamVideos {
+    /**
+     * Lists all videos in a users account.
+     * @returns The list of videos.
+     * @throws {BadRequestError} if the parameters are invalid
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    list(params?: StreamVideosListParams): Promise<StreamVideo[]>;
+}
+interface StreamWatermarks {
+    /**
+     * Generate a new watermark profile
+     * @param input The image stream to upload
+     * @param params The watermark creation parameters.
+     * @returns The created watermark profile.
+     * @throws {BadRequestError} if the parameters are invalid
+     * @throws {InvalidURLError} if the URL is invalid
+     * @throws {TooManyWatermarksError} if the number of allowed watermarks is reached
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    generate(input: ReadableStream, params: StreamWatermarkCreateParams): Promise<StreamWatermark>;
+    /**
+     * Generate a new watermark profile
+     * @param url The image url to upload
+     * @param params The watermark creation parameters.
+     * @returns The created watermark profile.
+     * @throws {BadRequestError} if the parameters are invalid
+     * @throws {InvalidURLError} if the URL is invalid
+     * @throws {TooManyWatermarksError} if the number of allowed watermarks is reached
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    generate(url: string, params: StreamWatermarkCreateParams): Promise<StreamWatermark>;
+    /**
+     * Lists all watermark profiles for an account.
+     * @returns The list of watermark profiles.
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    list(): Promise<StreamWatermark[]>;
+    /**
+     * Retrieves details for a single watermark profile.
+     * @param watermarkId The watermark profile identifier.
+     * @returns The watermark profile details.
+     * @throws {NotFoundError} if the watermark is not found
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    get(watermarkId: string): Promise<StreamWatermark>;
+    /**
+     * Deletes a watermark profile.
+     * @param watermarkId The watermark profile identifier.
+     * @returns A promise that resolves when deletion completes.
+     * @throws {NotFoundError} if the watermark is not found
+     * @throws {InternalError} if an unexpected error occurs
+     */
+    delete(watermarkId: string): Promise<void>;
+}
+type StreamUpdateVideoParams = {
+    /**
+     * Lists the origins allowed to display the video. Enter allowed origin
+     * domains in an array and use `*` for wildcard subdomains. Empty arrays allow the
+     * video to be viewed on any origin.
+     */
+    allowedOrigins?: Array<string>;
+    /**
+     * A user-defined identifier for the media creator.
+     */
+    creator?: string;
+    /**
+     * The maximum duration in seconds for a video upload. Can be set for a
+     * video that is not yet uploaded to limit its duration. Uploads that exceed the
+     * specified duration will fail during processing. A value of `-1` means the value
+     * is unknown.
+     */
+    maxDurationSeconds?: number;
+    /**
+     * A user modifiable key-value store used to reference other systems of
+     * record for managing videos.
+     */
+    meta?: Record<string, string>;
+    /**
+     * Indicates whether the video can be a accessed using the id. When
+     * set to `true`, a signed token must be generated with a signing key to view the
+     * video.
+     */
+    requireSignedURLs?: boolean;
+    /**
+     * Indicates the date and time at which the video will be deleted. Omit
+     * the field to indicate no change, or include with a `null` value to remove an
+     * existing scheduled deletion. If specified, must be at least 30 days from upload
+     * time.
+     */
+    scheduledDeletion?: string | null;
+    /**
+     * The timestamp for a thumbnail image calculated as a percentage value
+     * of the video's duration. To convert from a second-wise timestamp to a
+     * percentage, divide the desired timestamp by the total duration of the video. If
+     * this value is not set, the default thumbnail image is taken from 0s of the
+     * video.
+     */
+    thumbnailTimestampPct?: number;
+};
+type StreamCaption = {
+    /**
+     * Whether the caption was generated via AI.
+     */
+    generated?: boolean;
+    /**
+     * The language label displayed in the native language to users.
+     */
+    label: string;
+    /**
+     * The language tag in BCP 47 format.
+     */
+    language: string;
+    /**
+     * The status of a generated caption.
+     */
+    status?: 'ready' | 'inprogress' | 'error';
+};
+type StreamDownloadStatus = 'ready' | 'inprogress' | 'error';
+type StreamDownloadType = 'default' | 'audio';
+type StreamDownload = {
+    /**
+     * Indicates the progress as a percentage between 0 and 100.
+     */
+    percentComplete: number;
+    /**
+     * The status of a generated download.
+     */
+    status: StreamDownloadStatus;
+    /**
+     * The URL to access the generated download.
+     */
+    url?: string;
+};
+/**
+ * An object with download type keys. Each key is optional and only present if that
+ * download type has been created.
+ */
+type StreamDownloadGetResponse = {
+    /**
+     * The audio-only download. Only present if this download type has been created.
+     */
+    audio?: StreamDownload;
+    /**
+     * The default video download. Only present if this download type has been created.
+     */
+    default?: StreamDownload;
+};
+type StreamWatermarkPosition = 'upperRight' | 'upperLeft' | 'lowerLeft' | 'lowerRight' | 'center';
+type StreamWatermark = {
+    /**
+     * The unique identifier for a watermark profile.
+     */
+    id: string;
+    /**
+     * The size of the image in bytes.
+     */
+    size: number;
+    /**
+     * The height of the image in pixels.
+     */
+    height: number;
+    /**
+     * The width of the image in pixels.
+     */
+    width: number;
+    /**
+     * The date and a time a watermark profile was created.
+     */
+    created: string;
+    /**
+     * The source URL for a downloaded image. If the watermark profile was created via
+     * direct upload, this field is null.
+     */
+    downloadedFrom: string | null;
+    /**
+     * A short description of the watermark profile.
+     */
+    name: string;
+    /**
+     * The translucency of the image. A value of `0.0` makes the image completely
+     * transparent, and `1.0` makes the image completely opaque. Note that if the image
+     * is already semi-transparent, setting this to `1.0` will not make the image
+     * completely opaque.
+     */
+    opacity: number;
+    /**
+     * The whitespace between the adjacent edges (determined by position) of the video
+     * and the image. `0.0` indicates no padding, and `1.0` indicates a fully padded
+     * video width or length, as determined by the algorithm.
+     */
+    padding: number;
+    /**
+     * The size of the image relative to the overall size of the video. This parameter
+     * will adapt to horizontal and vertical videos automatically. `0.0` indicates no
+     * scaling (use the size of the image as-is), and `1.0 `fills the entire video.
+     */
+    scale: number;
+    /**
+     * The location of the image. Valid positions are: `upperRight`, `upperLeft`,
+     * `lowerLeft`, `lowerRight`, and `center`. Note that `center` ignores the
+     * `padding` parameter.
+     */
+    position: StreamWatermarkPosition;
+};
+type StreamWatermarkCreateParams = {
+    /**
+     * A short description of the watermark profile.
+     */
+    name?: string;
+    /**
+     * The translucency of the image. A value of `0.0` makes the image completely
+     * transparent, and `1.0` makes the image completely opaque. Note that if the
+     * image is already semi-transparent, setting this to `1.0` will not make the
+     * image completely opaque.
+     */
+    opacity?: number;
+    /**
+     * The whitespace between the adjacent edges (determined by position) of the
+     * video and the image. `0.0` indicates no padding, and `1.0` indicates a fully
+     * padded video width or length, as determined by the algorithm.
+     */
+    padding?: number;
+    /**
+     * The size of the image relative to the overall size of the video. This
+     * parameter will adapt to horizontal and vertical videos automatically. `0.0`
+     * indicates no scaling (use the size of the image as-is), and `1.0 `fills the
+     * entire video.
+     */
+    scale?: number;
+    /**
+     * The location of the image.
+     */
+    position?: StreamWatermarkPosition;
+};
+type StreamVideosListParams = {
+    /**
+     * The maximum number of videos to return.
+     */
+    limit?: number;
+    /**
+     * Return videos created before this timestamp.
+     * (RFC3339/RFC3339Nano)
+     */
+    before?: string;
+    /**
+     * Comparison operator for the `before` field.
+     * @default 'lt'
+     */
+    beforeComp?: StreamPaginationComparison;
+    /**
+     * Return videos created after this timestamp.
+     * (RFC3339/RFC3339Nano)
+     */
+    after?: string;
+    /**
+     * Comparison operator for the `after` field.
+     * @default 'gte'
+     */
+    afterComp?: StreamPaginationComparison;
+};
+type StreamPaginationComparison = 'eq' | 'gt' | 'gte' | 'lt' | 'lte';
+/**
+ * Error object for Stream binding operations.
+ */
+interface StreamError extends Error {
+    readonly code: number;
+    readonly statusCode: number;
+    readonly message: string;
+    readonly stack?: string;
+}
+interface InternalError extends StreamError {
+    name: 'InternalError';
+}
+interface BadRequestError extends StreamError {
+    name: 'BadRequestError';
+}
+interface NotFoundError extends StreamError {
+    name: 'NotFoundError';
+}
+interface ForbiddenError extends StreamError {
+    name: 'ForbiddenError';
+}
+interface RateLimitedError extends StreamError {
+    name: 'RateLimitedError';
+}
+interface QuotaReachedError extends StreamError {
+    name: 'QuotaReachedError';
+}
+interface MaxFileSizeError extends StreamError {
+    name: 'MaxFileSizeError';
+}
+interface InvalidURLError extends StreamError {
+    name: 'InvalidURLError';
+}
+interface AlreadyUploadedError extends StreamError {
+    name: 'AlreadyUploadedError';
+}
+interface TooManyWatermarksError extends StreamError {
+    name: 'TooManyWatermarksError';
+}
+type MarkdownDocument = {
+    name: string;
+    blob: Blob;
+};
+type OutputFormat = 'markdown' | 'text';
+type ConversionResponse = {
+    id: string;
+    name: string;
+    mimeType: string;
+    format: OutputFormat;
+    tokens: number;
+    data: string;
+} | {
+    id: string;
+    name: string;
+    mimeType: string;
+    format: 'error';
+    error: string;
+};
+type ImageConversionOptions = {
+    descriptionLanguage?: 'en' | 'es' | 'fr' | 'it' | 'pt' | 'de';
+};
+type EmbeddedImageConversionOptions = ImageConversionOptions & {
+    convert?: boolean;
+    maxConvertedImages?: number;
+};
+type ConversionOutputOptions = {
+    format?: OutputFormat;
+};
+type ConversionOptions = {
+    output?: ConversionOutputOptions;
+    html?: {
+        images?: EmbeddedImageConversionOptions & {
+            convertOGImage?: boolean;
+        };
+        hostname?: string;
+        cssSelector?: string;
+    };
+    docx?: {
+        images?: EmbeddedImageConversionOptions;
+    };
+    image?: ImageConversionOptions;
+    pdf?: {
+        images?: EmbeddedImageConversionOptions;
+        metadata?: boolean;
+    };
+};
+type ConversionRequestOptions = {
+    gateway?: GatewayOptions;
+    extraHeaders?: object;
+    conversionOptions?: ConversionOptions;
+};
+type SupportedFileFormat = {
+    mimeType: string;
+    extension: string;
+};
+declare abstract class ToMarkdownService {
+    transform(files: MarkdownDocument[], options?: ConversionRequestOptions): Promise<ConversionResponse[]>;
+    transform(files: MarkdownDocument, options?: ConversionRequestOptions): Promise<ConversionResponse>;
+    supported(): Promise<SupportedFileFormat[]>;
+}
+declare namespace TailStream {
+    interface Header {
+        readonly name: string;
+        readonly value: string;
+    }
+    interface FetchEventInfo {
+        readonly type: "fetch";
+        readonly method: string;
+        readonly url: string;
+        readonly cfJson?: object;
+        readonly headers: Header[];
+    }
+    interface JsRpcEventInfo {
+        readonly type: "jsrpc";
+    }
+    interface ScheduledEventInfo {
+        readonly type: "scheduled";
+        readonly scheduledTime: Date;
+        readonly cron: string;
+    }
+    interface AlarmEventInfo {
+        readonly type: "alarm";
+        readonly scheduledTime: Date;
+    }
+    interface QueueEventInfo {
+        readonly type: "queue";
+        readonly queueName: string;
+        readonly batchSize: number;
+    }
+    interface EmailEventInfo {
+        readonly type: "email";
+        readonly mailFrom: string;
+        readonly rcptTo: string;
+        readonly rawSize: number;
+    }
+    interface TraceEventInfo {
+        readonly type: "trace";
+        readonly traces: (string | null)[];
+    }
+    interface HibernatableWebSocketEventInfoMessage {
+        readonly type: "message";
+    }
+    interface HibernatableWebSocketEventInfoError {
+        readonly type: "error";
+    }
+    interface HibernatableWebSocketEventInfoClose {
+        readonly type: "close";
+        readonly code: number;
+        readonly wasClean: boolean;
+    }
+    interface HibernatableWebSocketEventInfo {
+        readonly type: "hibernatableWebSocket";
+        readonly info: HibernatableWebSocketEventInfoClose | HibernatableWebSocketEventInfoError | HibernatableWebSocketEventInfoMessage;
+    }
+    interface CustomEventInfo {
+        readonly type: "custom";
+    }
+    interface FetchResponseInfo {
+        readonly type: "fetch";
+        readonly statusCode: number;
+    }
+    interface ConnectEventInfo {
+        readonly type: "connect";
+    }
+    type EventOutcome = "ok" | "canceled" | "exception" | "unknown" | "killSwitch" | "daemonDown" | "exceededCpu" | "exceededMemory" | "loadShed" | "responseStreamDisconnected" | "scriptNotFound" | "internalError" | "exceededWallTime" | "aborted";
+    interface ScriptVersion {
+        readonly id: string;
+        readonly tag?: string;
+        readonly message?: string;
+    }
+    interface TracePreviewInfo {
+        readonly id: string;
+        readonly slug: string;
+        readonly name: string;
+    }
+    interface Onset {
+        readonly type: "onset";
+        readonly attributes: Attribute[];
+        // id for the span being opened by this Onset event.
+        readonly spanId: string;
+        readonly dispatchNamespace?: string;
+        readonly entrypoint?: string;
+        readonly executionModel: string;
+        readonly durableObjectId?: string;
+        readonly scriptName?: string;
+        readonly scriptTags?: string[];
+        readonly scriptVersion?: ScriptVersion;
+        readonly preview?: TracePreviewInfo;
+        readonly info: FetchEventInfo | ConnectEventInfo | JsRpcEventInfo | ScheduledEventInfo | AlarmEventInfo | QueueEventInfo | EmailEventInfo | TraceEventInfo | HibernatableWebSocketEventInfo | CustomEventInfo;
+    }
+    interface Outcome {
+        readonly type: "outcome";
+        readonly outcome: EventOutcome;
+        readonly cpuTime: number;
+        readonly wallTime: number;
+    }
+    interface SpanOpen {
+        readonly type: "spanOpen";
+        readonly name: string;
+        // id for the span being opened by this SpanOpen event.
+        readonly spanId: string;
+        readonly info?: FetchEventInfo | JsRpcEventInfo | Attributes;
+    }
+    interface SpanClose {
+        readonly type: "spanClose";
+        readonly outcome: EventOutcome;
+    }
+    interface DiagnosticChannelEvent {
+        readonly type: "diagnosticChannel";
+        readonly channel: string;
+        readonly message: any;
+    }
+    interface Exception {
+        readonly type: "exception";
+        readonly name: string;
+        readonly message: string;
+        readonly stack?: string;
+    }
+    interface TailStreamErrorInfo {
+        readonly name: string;
+        readonly message: string;
+        readonly stack?: string;
+    }
+    type Log = {
+        readonly type: "log";
+        readonly level: "debug" | "error" | "info" | "log" | "warn";
+        readonly errorInfo?: readonly (TailStreamErrorInfo | null)[];
+    } & ({
+        readonly message: object;
+        readonly truncated?: false;
+    } | {
+        readonly message: string;
+        readonly truncated: true;
+    });
+    interface DroppedEventsDiagnostic {
+        readonly diagnosticsType: "droppedEvents";
+        readonly count: number;
+    }
+    interface StreamDiagnostic {
+        readonly type: 'streamDiagnostic';
+        // To add new diagnostic types, define a new interface and add it to this union type.
+        readonly diagnostic: DroppedEventsDiagnostic;
+    }
+    // This marks the worker handler return information.
+    // This is separate from Outcome because the worker invocation can live for a long time after
+    // returning. For example - Websockets that return an http upgrade response but then continue
+    // streaming information or SSE http connections.
+    interface Return {
+        readonly type: "return";
+        readonly info?: FetchResponseInfo;
+    }
+    interface Attribute {
+        readonly name: string;
+        readonly value: string | string[] | boolean | boolean[] | number | number[] | bigint | bigint[];
+    }
+    interface Attributes {
+        readonly type: "attributes";
+        readonly info: Attribute[];
+    }
+    type EventType = Onset | Outcome | SpanOpen | SpanClose | DiagnosticChannelEvent | Exception | Log | StreamDiagnostic | Return | Attributes;
+    // Context in which this trace event lives.
+    interface SpanContext {
+        // Single id for the entire top-level invocation
+        // This should be a new traceId for the first worker stage invoked in the eyeball request and then
+        // same-account service-bindings should reuse the same traceId but cross-account service-bindings
+        // should use a new traceId.
+        readonly traceId: string;
+        // spanId in which this event is handled
+        // for Onset and SpanOpen events this would be the parent span id
+        // for Outcome and SpanClose these this would be the span id of the opening Onset and SpanOpen events
+        // For Hibernate and Mark this would be the span under which they were emitted.
+        // spanId is not set ONLY if:
+        //  1. This is an Onset event
+        //  2. We are not inheriting any SpanContext. (e.g. this is a cross-account service binding or a new top-level invocation)
+        readonly spanId?: string;
+        // W3C trace flags from an upstream traceparent. Absent when no upstream
+        // sampling decision was made.
+        readonly traceFlags?: number;
+    }
+    interface TailEvent<Event extends EventType> {
+        // invocation id of the currently invoked worker stage.
+        // invocation id will always be unique to every Onset event and will be the same until the Outcome event.
+        readonly invocationId: string;
+        // Inherited spanContext for this event.
+        readonly spanContext: SpanContext;
+        readonly timestamp: Date;
+        readonly sequence: number;
+        readonly event: Event;
+    }
+    type TailEventHandler<Event extends EventType = EventType> = (event: TailEvent<Event>) => void | Promise<void>;
+    type TailEventHandlerObject = {
+        outcome?: TailEventHandler<Outcome>;
+        spanOpen?: TailEventHandler<SpanOpen>;
+        spanClose?: TailEventHandler<SpanClose>;
+        diagnosticChannel?: TailEventHandler<DiagnosticChannelEvent>;
+        exception?: TailEventHandler<Exception>;
+        log?: TailEventHandler<Log>;
+        return?: TailEventHandler<Return>;
+        attributes?: TailEventHandler<Attributes>;
+    };
+    type TailEventHandlerType = TailEventHandler | TailEventHandlerObject;
+}
+// Copyright (c) 2022-2023 Cloudflare, Inc.
+// Licensed under the Apache 2.0 license found in the LICENSE file or at:
+//     https://opensource.org/licenses/Apache-2.0
+/**
+ * Data types supported for holding vector metadata.
+ */
+type VectorizeVectorMetadataValue = string | number | boolean | string[];
+/**
+ * Additional information to associate with a vector.
+ */
+type VectorizeVectorMetadata = VectorizeVectorMetadataValue | Record<string, VectorizeVectorMetadataValue>;
+type VectorFloatArray = Float32Array | Float64Array;
+interface VectorizeError {
+    code?: number;
+    error: string;
+}
+/**
+ * Comparison logic/operation to use for metadata filtering.
+ *
+ * This list is expected to grow as support for more operations are released.
+ */
+type VectorizeVectorMetadataFilterOp = '$eq' | '$ne' | '$lt' | '$lte' | '$gt' | '$gte';
+type VectorizeVectorMetadataFilterCollectionOp = '$in' | '$nin';
+/**
+ * Filter criteria for vector metadata used to limit the retrieved query result set.
+ */
+type VectorizeVectorMetadataFilter = {
+    [field: string]: Exclude<VectorizeVectorMetadataValue, string[]> | null | {
+        [Op in VectorizeVectorMetadataFilterOp]?: Exclude<VectorizeVectorMetadataValue, string[]> | null;
+    } | {
+        [Op in VectorizeVectorMetadataFilterCollectionOp]?: Exclude<VectorizeVectorMetadataValue, string[]>[];
+    };
+};
+/**
+ * Supported distance metrics for an index.
+ * Distance metrics determine how other "similar" vectors are determined.
+ */
+type VectorizeDistanceMetric = "euclidean" | "cosine" | "dot-product";
+/**
+ * Metadata return levels for a Vectorize query.
+ *
+ * Default to "none".
+ *
+ * @property all      Full metadata for the vector return set, including all fields (including those un-indexed) without truncation. This is a more expensive retrieval, as it requires additional fetching & reading of un-indexed data.
+ * @property indexed  Return all metadata fields configured for indexing in the vector return set. This level of retrieval is "free" in that no additional overhead is incurred returning this data. However, note that indexed metadata is subject to truncation (especially for larger strings).
+ * @property none     No indexed metadata will be returned.
+ */
+type VectorizeMetadataRetrievalLevel = "all" | "indexed" | "none";
+interface VectorizeQueryOptions {
+    topK?: number;
+    namespace?: string;
+    returnValues?: boolean;
+    returnMetadata?: boolean | VectorizeMetadataRetrievalLevel;
+    filter?: VectorizeVectorMetadataFilter;
+}
+/**
+ * Information about the configuration of an index.
+ */
+type VectorizeIndexConfig = {
+    dimensions: number;
+    metric: VectorizeDistanceMetric;
+} | {
+    preset: string; // keep this generic, as we'll be adding more presets in the future and this is only in a read capacity
+};
+/**
+ * Metadata about an existing index.
+ *
+ * This type is exclusively for the Vectorize **beta** and will be deprecated once Vectorize RC is released.
+ * See {@link VectorizeIndexInfo} for its post-beta equivalent.
+ */
+interface VectorizeIndexDetails {
+    /** The unique ID of the index */
+    readonly id: string;
+    /** The name of the index. */
+    name: string;
+    /** (optional) A human readable description for the index. */
+    description?: string;
+    /** The index configuration, including the dimension size and distance metric. */
+    config: VectorizeIndexConfig;
+    /** The number of records containing vectors within the index. */
+    vectorsCount: number;
+}
+/**
+ * Metadata about an existing index.
+ */
+interface VectorizeIndexInfo {
+    /** The number of records containing vectors within the index. */
+    vectorCount: number;
+    /** Number of dimensions the index has been configured for. */
+    dimensions: number;
+    /** ISO 8601 datetime of the last processed mutation on in the index. All changes before this mutation will be reflected in the index state. */
+    processedUpToDatetime: number;
+    /** UUIDv4 of the last mutation processed by the index. All changes before this mutation will be reflected in the index state. */
+    processedUpToMutation: number;
+}
+/**
+ * Represents a single vector value set along with its associated metadata.
+ */
+interface VectorizeVector {
+    /** The ID for the vector. This can be user-defined, and must be unique. It should uniquely identify the object, and is best set based on the ID of what the vector represents. */
+    id: string;
+    /** The vector values */
+    values: VectorFloatArray | number[];
+    /** The namespace this vector belongs to. */
+    namespace?: string;
+    /** Metadata associated with the vector. Includes the values of other fields and potentially additional details. */
+    metadata?: Record<string, VectorizeVectorMetadata>;
+}
+/**
+ * Represents a matched vector for a query along with its score and (if specified) the matching vector information.
+ */
+type VectorizeMatch = Pick<Partial<VectorizeVector>, "values"> & Omit<VectorizeVector, "values"> & {
+    /** The score or rank for similarity, when returned as a result */
+    score: number;
+};
+/**
+ * A set of matching {@link VectorizeMatch} for a particular query.
+ */
+interface VectorizeMatches {
+    matches: VectorizeMatch[];
+    count: number;
+}
+/**
+ * Results of an operation that performed a mutation on a set of vectors.
+ * Here, `ids` is a list of vectors that were successfully processed.
+ *
+ * This type is exclusively for the Vectorize **beta** and will be deprecated once Vectorize RC is released.
+ * See {@link VectorizeAsyncMutation} for its post-beta equivalent.
+ */
+interface VectorizeVectorMutation {
+    /* List of ids of vectors that were successfully processed. */
+    ids: string[];
+    /* Total count of the number of processed vectors. */
+    count: number;
+}
+/**
+ * Result type indicating a mutation on the Vectorize Index.
+ * Actual mutations are processed async where the `mutationId` is the unique identifier for the operation.
+ */
+interface VectorizeAsyncMutation {
+    /** The unique identifier for the async mutation operation containing the changeset. */
+    mutationId: string;
+}
+/**
+ * A Vectorize Vector Search Index for querying vectors/embeddings.
+ *
+ * This type is exclusively for the Vectorize **beta** and will be deprecated once Vectorize RC is released.
+ * See {@link Vectorize} for its new implementation.
+ */
+declare abstract class VectorizeIndex {
+    /**
+     * Get information about the currently bound index.
+     * @returns A promise that resolves with information about the current index.
+     */
+    public describe(): Promise<VectorizeIndexDetails>;
+    /**
+     * Use the provided vector to perform a similarity search across the index.
+     * @param vector Input vector that will be used to drive the similarity search.
+     * @param options Configuration options to massage the returned data.
+     * @returns A promise that resolves with matched and scored vectors.
+     */
+    public query(vector: VectorFloatArray | number[], options?: VectorizeQueryOptions): Promise<VectorizeMatches>;
+    /**
+     * Insert a list of vectors into the index dataset. If a provided id exists, an error will be thrown.
+     * @param vectors List of vectors that will be inserted.
+     * @returns A promise that resolves with the ids & count of records that were successfully processed.
+     */
+    public insert(vectors: VectorizeVector[]): Promise<VectorizeVectorMutation>;
+    /**
+     * Upsert a list of vectors into the index dataset. If a provided id exists, it will be replaced with the new values.
+     * @param vectors List of vectors that will be upserted.
+     * @returns A promise that resolves with the ids & count of records that were successfully processed.
+     */
+    public upsert(vectors: VectorizeVector[]): Promise<VectorizeVectorMutation>;
+    /**
+     * Delete a list of vectors with a matching id.
+     * @param ids List of vector ids that should be deleted.
+     * @returns A promise that resolves with the ids & count of records that were successfully processed (and thus deleted).
+     */
+    public deleteByIds(ids: string[]): Promise<VectorizeVectorMutation>;
+    /**
+     * Get a list of vectors with a matching id.
+     * @param ids List of vector ids that should be returned.
+     * @returns A promise that resolves with the raw unscored vectors matching the id set.
+     */
+    public getByIds(ids: string[]): Promise<VectorizeVector[]>;
+}
+/**
+ * A Vectorize Vector Search Index for querying vectors/embeddings.
+ *
+ * Mutations in this version are async, returning a mutation id.
+ */
+declare abstract class Vectorize {
+    /**
+     * Get information about the currently bound index.
+     * @returns A promise that resolves with information about the current index.
+     */
+    public describe(): Promise<VectorizeIndexInfo>;
+    /**
+     * Use the provided vector to perform a similarity search across the index.
+     * @param vector Input vector that will be used to drive the similarity search.
+     * @param options Configuration options to massage the returned data.
+     * @returns A promise that resolves with matched and scored vectors.
+     */
+    public query(vector: VectorFloatArray | number[], options?: VectorizeQueryOptions): Promise<VectorizeMatches>;
+    /**
+     * Use the provided vector-id to perform a similarity search across the index.
+     * @param vectorId Id for a vector in the index against which the index should be queried.
+     * @param options Configuration options to massage the returned data.
+     * @returns A promise that resolves with matched and scored vectors.
+     */
+    public queryById(vectorId: string, options?: VectorizeQueryOptions): Promise<VectorizeMatches>;
+    /**
+     * Insert a list of vectors into the index dataset. If a provided id exists, an error will be thrown.
+     * @param vectors List of vectors that will be inserted.
+     * @returns A promise that resolves with a unique identifier of a mutation containing the insert changeset.
+     */
+    public insert(vectors: VectorizeVector[]): Promise<VectorizeAsyncMutation>;
+    /**
+     * Upsert a list of vectors into the index dataset. If a provided id exists, it will be replaced with the new values.
+     * @param vectors List of vectors that will be upserted.
+     * @returns A promise that resolves with a unique identifier of a mutation containing the upsert changeset.
+     */
+    public upsert(vectors: VectorizeVector[]): Promise<VectorizeAsyncMutation>;
+    /**
+     * Delete a list of vectors with a matching id.
+     * @param ids List of vector ids that should be deleted.
+     * @returns A promise that resolves with a unique identifier of a mutation containing the delete changeset.
+     */
+    public deleteByIds(ids: string[]): Promise<VectorizeAsyncMutation>;
+    /**
+     * Get a list of vectors with a matching id.
+     * @param ids List of vector ids that should be returned.
+     * @returns A promise that resolves with the raw unscored vectors matching the id set.
+     */
+    public getByIds(ids: string[]): Promise<VectorizeVector[]>;
+}
+/**
+ * The interface for "version_metadata" binding
+ * providing metadata about the Worker Version using this binding.
+ */
+type WorkerVersionMetadata = {
+    /** The ID of the Worker Version using this binding */
+    id: string;
+    /** The tag of the Worker Version using this binding */
+    tag: string;
+    /** The timestamp of when the Worker Version was uploaded */
+    timestamp: string;
+};
+// ============ Web Search Request Types ============
+/**
+ * Options for a Web Search query.
+ */
+type WebSearchSearchOptions = {
+    /** The search query. */
+    query: string;
+    /**
+     * Maximum number of results to return. Defaults to 10, capped at 20.
+     * The actual count may be lower if fewer matches exist.
+     */
+    limit?: number;
+};
+// ============ Web Search Response Types ============
+/**
+ * A single Web Search result.
+ *
+ * Web Search is discovery-only -- results carry catalog metadata about a page
+ * but never the page body. To read a result's content the caller invokes the
+ * global `fetch()` API against the result's `url`, at which point the
+ * destination's own access controls apply (including Cloudflare Pay-per-Crawl).
+ */
+type WebSearchResult = {
+    /** Canonical URL. */
+    url: string;
+    /** Page title. */
+    title: string;
+    /** Page-level description. May be absent. */
+    description?: string;
+    /**
+     * Last-modified date for the page, when known. Naive (no timezone)
+     * ISO-8601 datetime, e.g. `"2025-11-30T04:39:48"`.
+     */
+    lastModifiedDate?: string;
+    /**
+     * Page meta image URL (typically the `og:image`). May be absent.
+     */
+    imageUrl?: string;
+    /** Optional favicon URL for UI hints. */
+    faviconUrl?: string;
+};
+/**
+ * Per-response metadata for a Web Search query. Carries operational
+ * fields useful for support and debugging.
+ */
+type WebSearchResponseMetadata = {
+    /** The query that was executed. */
+    query: string;
+    /** Opaque request identifier used for support and debugging. */
+    requestId: string;
+    /** End-to-end latency for this search request, in milliseconds. */
+    latencyMs: number;
+};
+/**
+ * Response from a Web Search query.
+ */
+type WebSearchSearchResponse = {
+    items: WebSearchResult[];
+    metadata: WebSearchResponseMetadata;
+};
+// ============ Web Search Binding Class ============
+/**
+ * Cloudflare Web Search binding.
+ *
+ * Discovery-only primitive for agents and Workers. Returns URLs and catalog
+ * metadata for a query; never returns page content or excerpts. To read a
+ * result's body, fetch the URL with the global `fetch()` API.
+ *
+ * Declared in wrangler with a single object (there is exactly one corpus, the
+ * public web, so there is no name, namespace, or instance to specify):
+ *
+ * ```jsonc
+ * { "web_search": { "binding": "WEBSEARCH" } }
+ * ```
+ *
+ * @example
+ * ```ts
+ * const { items, metadata } = await env.WEBSEARCH.search({
+ *   query: "Cloudflare Workers",
+ * });
+ *
+ * const top = items[0];
+ * console.log(top.url, top.title, metadata.latencyMs);
+ *
+ * // Read content yourself; pay-per-crawl and other publisher
+ * // controls apply at the fetch site, not at search time.
+ * const page = await fetch(top.url);
+ * ```
+ */
+declare abstract class WebSearch {
+    /**
+     * Run a Web Search query.
+     * @param options Search options. Only `query` is required.
+     * @returns The matching results plus per-response metadata.
+     */
+    search(options: WebSearchSearchOptions): Promise<WebSearchSearchResponse>;
+}
+interface DynamicDispatchLimits {
+    /**
+     * Limit CPU time in milliseconds.
+     */
+    cpuMs?: number;
+    /**
+     * Limit number of subrequests.
+     */
+    subRequests?: number;
+}
+interface DynamicDispatchOptions {
+    /**
+     * Limit resources of invoked Worker script.
+     */
+    limits?: DynamicDispatchLimits;
+    /**
+     * Arguments for outbound Worker script, if configured.
+     */
+    outbound?: {
+        [key: string]: any;
+    };
+}
+interface DispatchNamespace {
+    /**
+    * @param name Name of the Worker script.
+    * @param args Arguments to Worker script.
+    * @param options Options for Dynamic Dispatch invocation.
+    * @returns A Fetcher object that allows you to send requests to the Worker script.
+    * @throws If the Worker script does not exist in this dispatch namespace, an error will be thrown.
+    */
+    get(name: string, args?: {
+        [key: string]: any;
+    }, options?: DynamicDispatchOptions): Fetcher;
+}
+declare module 'cloudflare:workflows' {
+    /**
+     * NonRetryableError allows for a user to throw a fatal error
+     * that makes a Workflow instance fail immediately without triggering a retry
+     */
+    export class NonRetryableError extends Error {
+        public constructor(message: string, name?: string);
+    }
+}
+declare abstract class Workflow<PARAMS = unknown> {
+    /**
+     * Get a handle to an existing instance of the Workflow.
+     * @param id Id for the instance of this Workflow
+     * @returns A promise that resolves with a handle for the Instance
+     */
+    public get(id: string): Promise<WorkflowInstance>;
+    /**
+     * Create a new instance and return a handle to it. If a provided id exists, an error will be thrown.
+     * @param options Options when creating an instance including id and params
+     * @returns A promise that resolves with a handle for the Instance
+     */
+    public create(options?: WorkflowInstanceCreateOptions<PARAMS>): Promise<WorkflowInstance>;
+    /**
+     * Create a batch of instances and return handle for all of them. If a provided id exists, an error will be thrown.
+     * `createBatch` is limited at 100 instances at a time or when the RPC limit for the batch (1MiB) is reached.
+     * @param batch List of Options when creating an instance including name and params
+     * @returns A promise that resolves with a list of handles for the created instances.
+     */
+    public createBatch(batch: WorkflowInstanceCreateOptions<PARAMS>[]): Promise<WorkflowInstance[]>;
+    /**
+     * Delete a batch of Workflow instances and their stored state.
+     * `deleteBatch` is limited to 100 instances at a time. Duplicate IDs are deleted once.
+     * The result contains one entry for each input position; IDs that do not exist are returned as per-instance errors.
+     * @param instanceIds IDs of the Workflow instances to delete
+     * @returns A promise that resolves with the successfully deleted instances and any per-instance errors.
+     */
+    public deleteBatch(instanceIds: string[]): Promise<WorkflowBatchDeleteResult>;
+}
+type WorkflowBatchDeleteResult = {
+    deleted: {
+        id: string;
+    }[];
+    errors: {
+        id: string;
+        code: number;
+        message: string;
+    }[];
+};
+type WorkflowDurationLabel = 'second' | 'minute' | 'hour' | 'day' | 'week' | 'month' | 'year';
+type WorkflowSleepDuration = `${number} ${WorkflowDurationLabel}${'s' | ''}` | number;
+type WorkflowRetentionDuration = WorkflowSleepDuration;
+/** Geographic regions supported when creating a Workflow instance.
+ * Location hints are best-effort placement preferences. */
+type WorkflowInstanceLocationHint = 'wnam' | 'enam' | 'sam' | 'weur' | 'eeur' | 'apac' | 'apac-ne' | 'apac-se' | 'oc' | 'afr' | 'me';
+interface WorkflowInstanceCreateOptions<PARAMS = unknown> {
+    /**
+     * An id for your Workflow instance. Must be unique within the Workflow.
+     */
+    id?: string;
+    /**
+     * The event payload the Workflow instance is triggered with
+     */
+    params?: PARAMS;
+    /**
+     * The retention policy for Workflow instance.
+     * Defaults to the maximum retention period available for the owner's account.
+     */
+    retention?: {
+        successRetention?: WorkflowRetentionDuration;
+        errorRetention?: WorkflowRetentionDuration;
+    };
+    /** A best-effort geographic placement preference for the Workflow instance.
+     * See `WorkflowInstanceLocationHint` for supported regions. */
+    locationHint?: WorkflowInstanceLocationHint;
+}
+type InstanceStatus = {
+    status: 'queued' // means that instance is waiting to be started (see concurrency limits)
+     | 'running' | 'paused' | 'errored' | 'terminated' // user terminated the instance while it was running
+     | 'complete' | 'waiting' // instance is hibernating and waiting for sleep or event to finish
+     | 'waitingForPause' // instance is finishing the current work to pause
+     | 'unknown';
+    error?: {
+        name: string;
+        message: string;
+    };
+    output?: unknown;
+};
+interface WorkflowError {
+    code?: number;
+    message: string;
+}
+interface WorkflowInstanceTerminateOptions {
+    /**
+     * If true, run registered rollback handlers before terminating the instance.
+     * Only steps that registered rollback handlers are rolled back.
+     */
+    rollback?: boolean;
+}
+interface WorkflowInstanceRestartOptions {
+    /**
+     * Restart from a specific step. If omitted, the instance restarts from the beginning.
+     * The step must exist in the instance's execution history.
+     */
+    from?: {
+        /**
+         * The step name as defined in your workflow code.
+         */
+        name: string;
+        /**
+         * 1-indexed occurrence of this step name. Use when the same step name appears multiple times (e.g. in a loop).
+         * @default 1
+         */
+        count?: number;
+        /**
+         * Step type filter. Use when different step types share the same name.
+         */
+        type?: 'do' | 'sleep' | 'waitForEvent';
+    };
+}
+declare abstract class WorkflowInstance {
+    public id: string;
+    /**
+     * Pause the instance.
+     */
+    public pause(): Promise<void>;
+    /**
+     * Resume the instance. If it is already running, an error will be thrown.
+     */
+    public resume(): Promise<void>;
+    /**
+     * Terminate the instance. If it is errored, terminated or complete, an error will be thrown.
+     * @param options Options for termination, including whether registered rollback handlers should run.
+     */
+    public terminate(options?: WorkflowInstanceTerminateOptions): Promise<void>;
+    /**
+     * Restart the instance. Optionally restart from a specific step, preserving
+     * cached results for all steps before it.
+     * @param options Options for the restart, including an optional step to restart from.
+     */
+    public restart(options?: WorkflowInstanceRestartOptions): Promise<void>;
+    /**
+     * Delete the instance and its stored state.
+     */
+    public delete(): Promise<void>;
+    /**
+     * Returns the current status of the instance.
+     */
+    public status(): Promise<InstanceStatus>;
+    /**
+     * Send an event to this instance.
+     */
+    public sendEvent({ type, payload, }: {
+        type: string;
+        payload: unknown;
+    }): Promise<void>;
+}
diff --git a/infra/otp-worker/wrangler.jsonc b/infra/otp-worker/wrangler.jsonc
new file mode 100644
index 000000000..0f5bbfb5c
--- /dev/null
+++ b/infra/otp-worker/wrangler.jsonc
@@ -0,0 +1,80 @@
+{
+  "$schema": "./node_modules/wrangler/config-schema.json",
+  // First live Cloudflare Worker in this repo (infra/hf-proxy, the prior one,
+  // was deleted after shipping unauthenticated with no rate limit and taking
+  // the whole Cloudflare account down — see README.md "Why this design"
+  // before changing anything auth- or rate-limit-related here).
+  "name": "meridian-otp-worker",
+  "main": "src/index.ts",
+  "compatibility_date": "2026-08-25",
+  "compatibility_flags": ["nodejs_compat"],
+  "observability": {
+    "enabled": true,
+    "head_sampling_rate": 1
+  },
+
+  // ── KV namespace ──────────────────────────────────────────────────────────
+  // A human must run `wrangler kv namespace create OTP_KV` (and again with
+  // `--env staging`) and paste the returned ids below before this can be
+  // deployed for real. See README.md "Manual steps before first deploy".
+  "kv_namespaces": [
+    {
+      "binding": "OTP_KV",
+      "id": "REPLACE_ME_KV_NAMESPACE_ID_PRODUCTION"
+    }
+  ],
+
+  // ── Non-secret tunables ───────────────────────────────────────────────────
+  // Real credentials (OTP_CLIENT_TOKEN, OTP_CODE_PEPPER, AWS_*, CI_TEST_TOKEN)
+  // are `wrangler secret put` ONLY — never here. See README.md's secrets table.
+  "vars": {
+    // Distinguishes prod from staging inside the Worker without relying on an
+    // unset-vs-set secret (the staging-only code-echo path checks this
+    // explicitly: `env.ENVIRONMENT !== "staging"` short-circuits it even if a
+    // CI_TEST_TOKEN secret were ever mistakenly set on the production
+    // environment).
+    "ENVIRONMENT": "production",
+    "FROM_ADDRESS": "otp@auth.meridiona.com",
+    "FROM_NAME": "Meridian",
+    "OTP_TTL_S": 600,
+    "MAX_VERIFY_ATTEMPTS": 5,
+    "RL_EMAIL_PER_DAY": 3,
+    "RL_IP_PER_HOUR": 10,
+    "RL_GLOBAL_PER_DAY": 2000
+  },
+
+  "env": {
+    "staging": {
+      "name": "meridian-otp-worker-staging",
+      "kv_namespaces": [
+        {
+          "binding": "OTP_KV",
+          "id": "REPLACE_ME_KV_NAMESPACE_ID_STAGING"
+        }
+      ],
+      "vars": {
+        "ENVIRONMENT": "staging",
+        "FROM_ADDRESS": "otp@auth.meridiona.com",
+        "FROM_NAME": "Meridian (staging)",
+        "OTP_TTL_S": 600,
+        "MAX_VERIFY_ATTEMPTS": 5,
+        // RL_IP_PER_HOUR is deliberately HIGHER here than the per-email cap
+        // needs, not lower — scripts/deploy-otp-worker.sh's probes (the
+        // rate-limit-trip probe, which sends RL_EMAIL_PER_DAY+1 requests from
+        // one IP, plus the happy-path send) burn several units of per-IP
+        // budget from a single source IP on every run. A cap sized close to
+        // RL_EMAIL_PER_DAY (as an earlier version of this file had it, at 5)
+        // means a SECOND `--verify-only` run against the same staging
+        // deployment within the hour trips the IP cap on the happy-path send
+        // and fails with a misleading "happy-path send -> 429" — reading as a
+        // regression rather than the smoke test having rate-limited itself.
+        // Sized well above one run's worst-case spend so re-running the
+        // script repeatedly while debugging a real failure doesn't itself
+        // become a source of failures.
+        "RL_EMAIL_PER_DAY": 3,
+        "RL_IP_PER_HOUR": 30,
+        "RL_GLOBAL_PER_DAY": 500
+      }
+    }
+  }
+}
diff --git a/scripts/deploy-otp-worker.sh b/scripts/deploy-otp-worker.sh
new file mode 100644
index 000000000..0635a1304
--- /dev/null
+++ b/scripts/deploy-otp-worker.sh
@@ -0,0 +1,432 @@
+#!/usr/bin/env bash
+# ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+#
+# Deploy infra/otp-worker/ (the OTP send/verify Cloudflare Worker) and assert
+# it actually behaves the way CLAUDE.md's Hard Rules require of every
+# publicly reachable service we run: authenticate every request, rate-limit,
+# and answer nothing outside its allowlisted routes.
+#
+# This mirrors scripts/deploy-gateway.sh's shape and its reasoning almost
+# exactly — read that file's header first if this is your first time here.
+# The short version: infra/hf-proxy shipped unauthenticated with no rate
+# limit and took the whole Cloudflare account down at 173,088 requests/day
+# against a 100k/day cap. This script is what stands between "the Worker
+# deployed" and "the Worker deployed correctly" — a deploy that goes green
+# without these checks is exactly how that happened.
+#
+# Four probes, all against the SAME deployed Worker:
+#   1. POST /otp/send,   no Authorization header       -> 401
+#   2. POST /otp/send,   wrong bearer token             -> 401
+#   3. POST /otp/verify, real auth, never-sent email    -> 410
+#   4. POST /otp/send,   real auth, hammered past cap   -> 429
+# Probes 3 and 4 need real auth to even reach the gated logic being tested,
+# so they require OTP_CLIENT_TOKEN in the environment (the same value as the
+# `wrangler secret put OTP_CLIENT_TOKEN` on the target Worker) — probes 1-2
+# run without it.
+#
+# A fifth check (--verify-only / the post-deploy step only) exercises the
+# actual happy path — send a real code, verify it — using the staging-only
+# code echo (`{ ok: true, code }`) documented in infra/otp-worker/README.md.
+# It runs ONLY when CI_TEST_TOKEN is set in the environment, which must never
+# be true against a production deploy (CI_TEST_TOKEN is a staging-only
+# secret, and the Worker itself refuses to echo the code unless
+# `env.ENVIRONMENT === "staging"` AND the caller authenticated with
+# CI_TEST_TOKEN specifically — see auth.ts/index.ts). If CI_TEST_TOKEN is
+# unset, this check is SKIPPED with a clear message, never silently treated
+# as passing, and never attempted with OTP_CLIENT_TOKEN as a substitute.
+#
+# Usage:
+#   bash scripts/deploy-otp-worker.sh --env staging
+#   bash scripts/deploy-otp-worker.sh --env production
+#   bash scripts/deploy-otp-worker.sh --verify-only <url>
+#   bash scripts/deploy-otp-worker.sh --self-test
+#
+# Env (probes 3/4 and the happy-path check only):
+#   OTP_CLIENT_TOKEN   required for probes 3 and 4, and for verify in the happy-path check
+#   CI_TEST_TOKEN      required to run the happy-path send->verify check at all; unset = skipped
+#   RL_EMAIL_PER_DAY   per-email send cap the target Worker is configured with (default 3,
+#                      matching wrangler.jsonc's default for both environments) — the rate-limit
+#                      probe sends this many requests + 1 to guarantee tripping the cap
+#   PROBE_TIMEOUT_S / PROBE_INTERVAL_S   as in deploy-gateway.sh
+
+set -euo pipefail
+
+RL_EMAIL_PER_DAY="${RL_EMAIL_PER_DAY:-3}"
+PROBE_TIMEOUT_S="${PROBE_TIMEOUT_S:-60}"
+PROBE_INTERVAL_S="${PROBE_INTERVAL_S:-3}"
+
+# ── Status classifier ────────────────────────────────────────────────────────
+#
+# Pure — no network, no globals — so `--self-test` can exercise every branch
+# offline. Takes the code we actually got and the code THIS probe expects
+# (unlike deploy-gateway.sh, which only ever expects 401, this script expects
+# four different codes across its four probes, so the expected code is a
+# parameter rather than a constant).
+#
+# Only "the stack isn't up yet" codes retry: 000 (curl's "no response at
+# all"), and 502/503/504 (upstream not ready). ANYTHING else — including any
+# 2xx, and including a wrong-but-plausible 4xx — rejects immediately. A 200
+# on the no-auth probe is exactly the catastrophe this script exists to
+# catch, and retrying it only delays the failure.
+classify_probe() {
+	local actual="$1" expected="$2"
+	if [ "${actual}" = "${expected}" ]; then
+		echo pass
+		return
+	fi
+	case "${actual}" in
+	000 | 502 | 503 | 504) echo retry ;;
+	*) echo reject ;;
+	esac
+}
+
+# POST to `${url}${path}` and print the HTTP status code. `--noproxy '*'` for
+# the same reason as deploy-gateway.sh: the point is that THE WORKER rejects
+# the caller, not an intercepting proxy.
+http_post_code() {
+	local url="$1"
+	shift
+	curl -s --noproxy '*' -o /dev/null -w '%{http_code}' --max-time 15 -X POST "$@" "${url}" || true
+}
+
+# Same, but also captures the response body (needed for the happy-path check,
+# which has to read the echoed code and the verify result out of the body).
+http_post_code_and_body() {
+	local url="$1" body_out="$2"
+	shift 2
+	curl -s --noproxy '*' -o "${body_out}" -w '%{http_code}' --max-time 15 -X POST "$@" "${url}" || true
+}
+
+# Retry one probe until it matches `expected` or the timeout budget runs out.
+probe_expect() {
+	local label="$1" url="$2" expected="$3"
+	shift 3
+	local deadline=$((SECONDS + PROBE_TIMEOUT_S)) code verdict
+	while :; do
+		code="$(http_post_code "${url}" "$@")"
+		verdict="$(classify_probe "${code}" "${expected}")"
+		case "${verdict}" in
+		pass)
+			echo "  ok   ${label} -> ${code}"
+			return 0
+			;;
+		reject)
+			echo "  FAIL ${label} -> ${code} (expected ${expected})" >&2
+			return 1
+			;;
+		retry)
+			if [ "${SECONDS}" -ge "${deadline}" ]; then
+				echo "  FAIL ${label} -> ${code} after ${PROBE_TIMEOUT_S}s (expected ${expected})" >&2
+				return 1
+			fi
+			sleep "${PROBE_INTERVAL_S}"
+			;;
+		esac
+	done
+}
+
+# Probe 4: hammer /otp/send for one fixed probe email until the per-email cap
+# trips. Deliberately does NOT check that the first `cap` attempts succeed —
+# whether SES actually delivers (e.g. a staging SES account still in
+# sandbox mode, unable to send to an unverified recipient) is irrelevant
+# here, and by design (see README.md: "counters are persisted before the SES
+# call") the rate-limit counters increment regardless of delivery outcome.
+# Only the FINAL attempt (cap + 1) is required to be 429.
+probe_rate_limit_trip() {
+	local url="$1" token="$2"
+	local probe_email="deploy-otp-worker-ratelimit-probe-$$-$(date +%s)@example.com"
+	local attempts=$((RL_EMAIL_PER_DAY + 1))
+	local code=""
+	for _ in $(seq 1 "${attempts}"); do
+		code="$(http_post_code "${url}/otp/send" \
+			-H 'Content-Type: application/json' \
+			-H "Authorization: Bearer ${token}" \
+			--data "{\"email\":\"${probe_email}\"}")"
+	done
+	local verdict
+	verdict="$(classify_probe "${code}" 429)"
+	if [ "${verdict}" = "pass" ]; then
+		echo "  ok   send   rate limit trips after ${RL_EMAIL_PER_DAY} sends -> 429"
+		return 0
+	fi
+	echo "  FAIL send   rate limit -> ${code} after ${attempts} attempts (expected 429)" >&2
+	return 1
+}
+
+# The four required probes. Probes 3 and 4 need OTP_CLIENT_TOKEN to reach the
+# gated logic under test at all — without it, they can't distinguish
+# "correctly returns 410/429" from "incorrectly returns 401 for an unrelated
+# reason," so they're skipped with a loud warning rather than silently
+# passing or failing on the wrong thing.
+run_required_probes() {
+	local url="$1"
+	local failed=0
+
+	probe_expect "send   no credentials     " "${url}/otp/send" 401 \
+		-H 'Content-Type: application/json' --data '{"email":"deploy-otp-worker-probe@example.com"}' || failed=1
+
+	probe_expect "send   wrong bearer token " "${url}/otp/send" 401 \
+		-H 'Content-Type: application/json' \
+		-H 'Authorization: Bearer deploy-otp-worker-probe-not-a-real-token' \
+		--data '{"email":"deploy-otp-worker-probe@example.com"}' || failed=1
+
+	if [ -z "${OTP_CLIENT_TOKEN:-}" ]; then
+		cat >&2 <<-EOF
+			  SKIP verify never-sent-code (410) and send rate-limit (429) probes:
+			       OTP_CLIENT_TOKEN is not set. These two probes need real auth to
+			       reach the logic under test — set OTP_CLIENT_TOKEN to the same
+			       value as the target Worker's \`OTP_CLIENT_TOKEN\` secret to run them.
+		EOF
+	else
+		local never_sent_email="deploy-otp-worker-never-sent-$$-$(date +%s)@example.com"
+		probe_expect "verify never-sent code  " "${url}/otp/verify" 410 \
+			-H 'Content-Type: application/json' \
+			-H "Authorization: Bearer ${OTP_CLIENT_TOKEN}" \
+			--data "{\"email\":\"${never_sent_email}\",\"code\":\"000000\"}" || failed=1
+
+		probe_rate_limit_trip "${url}" "${OTP_CLIENT_TOKEN}" || failed=1
+	fi
+
+	return "${failed}"
+}
+
+# The happy-path send->verify check, gated on CI_TEST_TOKEN being set (see
+# the file header — this must never be attempted with OTP_CLIENT_TOKEN, and
+# the Worker itself refuses the echo outside env.ENVIRONMENT === "staging").
+run_happy_path_check() {
+	local url="$1"
+
+	if [ -z "${CI_TEST_TOKEN:-}" ]; then
+		cat >&2 <<-EOF
+			  SKIP happy-path send->verify check: CI_TEST_TOKEN is not set.
+			       This is expected against a production deploy — CI_TEST_TOKEN is a
+			       staging-only secret and must never be set anywhere else. Set it
+			       (to the target staging Worker's \`CI_TEST_TOKEN\` secret) to run
+			       this check against staging.
+		EOF
+		return 0
+	fi
+	if [ -z "${OTP_CLIENT_TOKEN:-}" ]; then
+		echo "  FAIL happy-path check requires OTP_CLIENT_TOKEN (for the verify call) as well as CI_TEST_TOKEN" >&2
+		return 1
+	fi
+
+	local happy_email="deploy-otp-worker-happy-$$-$(date +%s)@example.com"
+	local send_body verify_body send_code verify_code code result=0
+
+	# Explicit cleanup at every return path rather than a RETURN trap: a
+	# function-local RETURN trap fires after the function's own locals have
+	# already gone out of scope in some bash versions, which under `set -u`
+	# turns "clean up my temp files" into an unbound-variable crash instead —
+	# exactly the kind of failure this script exists to never produce.
+	send_body="$(mktemp)"
+	verify_body="$(mktemp)"
+
+	send_code="$(http_post_code_and_body "${url}/otp/send" "${send_body}" \
+		-H 'Content-Type: application/json' \
+		-H "Authorization: Bearer ${CI_TEST_TOKEN}" \
+		--data "{\"email\":\"${happy_email}\"}")"
+	if [ "${send_code}" != "200" ]; then
+		echo "  FAIL happy-path send -> ${send_code} (expected 200)" >&2
+		rm -f "${send_body}" "${verify_body}"
+		return 1
+	fi
+
+	code="$(grep -oE '"code"[[:space:]]*:[[:space:]]*"[0-9]{6}"' "${send_body}" | grep -oE '[0-9]{6}' || true)"
+	if [ -z "${code}" ]; then
+		echo "  FAIL happy-path send returned 200 but no echoed code was found in the body" >&2
+		echo "       (staging-only echo requires env.ENVIRONMENT===\"staging\" AND auth via CI_TEST_TOKEN — check both)" >&2
+		rm -f "${send_body}" "${verify_body}"
+		return 1
+	fi
+
+	verify_code="$(http_post_code_and_body "${url}/otp/verify" "${verify_body}" \
+		-H 'Content-Type: application/json' \
+		-H "Authorization: Bearer ${OTP_CLIENT_TOKEN}" \
+		--data "{\"email\":\"${happy_email}\",\"code\":\"${code}\"}")"
+	if [ "${verify_code}" != "200" ]; then
+		echo "  FAIL happy-path verify -> ${verify_code} (expected 200)" >&2
+		result=1
+	elif ! grep -qE '"verified"[[:space:]]*:[[:space:]]*true' "${verify_body}"; then
+		echo "  FAIL happy-path verify returned 200 but verified was not true: $(cat "${verify_body}")" >&2
+		result=1
+	else
+		echo "  ok   happy path: send (staging echo) -> verify round-trips"
+	fi
+
+	rm -f "${send_body}" "${verify_body}"
+	return "${result}"
+}
+
+verify_deployed_worker() {
+	local url="$1"
+	local failed=0
+	echo "==> verifying ${url}"
+	run_required_probes "${url}" || failed=1
+	run_happy_path_check "${url}" || failed=1
+	return "${failed}"
+}
+
+# ── Argument dispatch ────────────────────────────────────────────────────────
+#
+# Same discipline as deploy-gateway.sh: every argument is either recognised
+# or an error, so a typo or an unfamiliar flag never falls through to a real
+# deploy.
+usage() {
+	cat <<-USAGE
+		usage: deploy-otp-worker.sh --env <staging|production>
+		       deploy-otp-worker.sh --verify-only <url>
+		       deploy-otp-worker.sh --self-test
+
+		  --env <name>     deploy infra/otp-worker/ to that wrangler environment,
+		                    then run the required probes (+ happy-path check if
+		                    CI_TEST_TOKEN is set) against the deployed URL
+		  --verify-only    run the probes against an already-deployed URL,
+		                    deploying nothing
+		  --self-test      offline check of the status classifier
+
+		env: OTP_CLIENT_TOKEN CI_TEST_TOKEN RL_EMAIL_PER_DAY
+		     PROBE_TIMEOUT_S PROBE_INTERVAL_S
+	USAGE
+}
+
+case "${1:-}" in
+--self-test)
+	if [ "$#" -ne 1 ]; then
+		echo "deploy-otp-worker.sh: --self-test takes no further arguments" >&2
+		exit 2
+	fi
+	self_test_failures=0
+	while read -r actual expected want; do
+		[ -z "${actual}" ] && continue
+		got="$(classify_probe "${actual}" "${expected}")"
+		if [ "${got}" != "${want}" ]; then
+			echo "FAIL classify_probe(${actual}, ${expected}): want ${want}, got ${got}" >&2
+			self_test_failures=$((self_test_failures + 1))
+		fi
+	done <<-'CASES'
+		401 401 pass
+		410 410 pass
+		429 429 pass
+		200 401 reject
+		200 410 reject
+		200 429 reject
+		201 401 reject
+		400 410 reject
+		403 429 reject
+		404 401 reject
+		401 410 reject
+		410 401 reject
+		429 410 reject
+		000 401 retry
+		502 401 retry
+		503 410 retry
+		504 429 retry
+	CASES
+	if [ "${self_test_failures}" -ne 0 ]; then
+		echo "self-test: ${self_test_failures} case(s) failed" >&2
+		exit 1
+	fi
+	echo "self-test: classify_probe ok"
+	exit 0
+	;;
+--verify-only)
+	if [ "$#" -ne 2 ] || [ -z "${2}" ]; then
+		echo "deploy-otp-worker.sh: --verify-only requires exactly one URL argument" >&2
+		usage >&2
+		exit 2
+	fi
+	target_url="${2%/}"
+	if verify_deployed_worker "${target_url}"; then
+		echo "==> ok."
+		exit 0
+	fi
+	echo "==> FAILED. See above." >&2
+	exit 1
+	;;
+--env)
+	if [ "$#" -ne 2 ] || [ -z "${2}" ]; then
+		echo "deploy-otp-worker.sh: --env requires an environment name" >&2
+		usage >&2
+		exit 2
+	fi
+	case "${2}" in
+	staging | production) ;;
+	*)
+		echo "deploy-otp-worker.sh: unknown environment '${2}' (expected 'staging' or 'production')" >&2
+		exit 2
+		;;
+	esac
+	;;
+-h | --help)
+	usage
+	exit 0
+	;;
+"")
+	echo "deploy-otp-worker.sh: no arguments given — a deploy requires --env <staging|production>" >&2
+	usage >&2
+	exit 2
+	;;
+*)
+	echo "deploy-otp-worker.sh: unknown argument '${1}'" >&2
+	usage >&2
+	exit 2
+	;;
+esac
+
+# Only reached for `--env <name>`, which is validated above.
+TARGET_ENV="${2}"
+
+# Resolved here, not at the top, so --self-test and --verify-only stay purely
+# offline / independent of running from inside a checkout.
+WORKER_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../infra/otp-worker" && pwd)"
+
+echo "==> deploying ${WORKER_DIR} to wrangler environment '${TARGET_ENV}'"
+# Captured via `if ! deploy_output=...; then` rather than a bare assignment —
+# under `set -e`, a bare `deploy_output="$(cmd)"` takes the command
+# substitution's exit status, so a FAILING `wrangler deploy` would abort the
+# script right here, before the `echo` below ever ran, leaving the operator
+# with no output explaining why. This is not hypothetical: the very first
+# real deploy runs against the `REPLACE_ME_KV_NAMESPACE_ID_*` placeholders in
+# wrangler.jsonc until an operator has run `wrangler kv namespace create` and
+# filled them in, so it WILL fail on the first attempt.
+deploy_failed=0
+if [ "${TARGET_ENV}" = "production" ]; then
+	deploy_output="$(cd "${WORKER_DIR}" && npx wrangler deploy 2>&1)" || deploy_failed=1
+else
+	deploy_output="$(cd "${WORKER_DIR}" && npx wrangler deploy --env "${TARGET_ENV}" 2>&1)" || deploy_failed=1
+fi
+echo "${deploy_output}"
+if [ "${deploy_failed}" -ne 0 ]; then
+	echo "==> wrangler deploy FAILED. See output above." >&2
+	exit 1
+fi
+
+deployed_url="$(echo "${deploy_output}" | grep -oE 'https://[a-zA-Z0-9.-]+\.workers\.dev' | tail -1 || true)"
+if [ -z "${deployed_url}" ]; then
+	cat >&2 <<-EOF
+
+		Could not parse the deployed Worker URL out of \`wrangler deploy\`'s output.
+		If this Worker is bound to a custom domain instead of the default
+		*.workers.dev route, re-run with:
+		  bash scripts/deploy-otp-worker.sh --verify-only <your-custom-domain-url>
+	EOF
+	exit 1
+fi
+
+if verify_deployed_worker "${deployed_url}"; then
+	echo "==> done."
+	exit 0
+fi
+
+cat >&2 <<-EOF
+
+	DEPLOY FAILED ITS VERIFICATION CHECKS.
+
+	The new code IS already live — this check runs after \`wrangler deploy\`.
+	Treat this as live: Cloudflare publishes every hostname to the Certificate
+	Transparency logs the moment it issues the cert, so scanners find it
+	whether or not it is advertised. Roll back (\`npx wrangler rollback\` from
+	infra/otp-worker/) or fix forward, but do not walk away from it.
+EOF
+exit 1

From c9f155969d8b93ee3d8ab4fc6dec3a894700fb10 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Thu, 3 Sep 2026 09:35:38 +0530
Subject: [PATCH 45/53] fix(auth): replace Clerk with a one-time email+OTP
 capture

Clerk caused seven production incidents (PRs #726->#892) where its JS
serializer and clerk-fapi-rs's strict Rust models drifted apart, silently
breaking the offline session cache and logging users out after time off -
plus a known plaintext-session-token vuln (#727). Clerk was never used as
real IAM here: no org/role model, no paid-feature gating, no backend that
verifies its tokens. The only things it provided were knowing who's using
the app (for PostHog/Support ID correlation) and an invite-only alpha gate
that lived entirely in Clerk's own dashboard config, not in this repo.

Replaces it with a much lighter capture: ask for an email once, verify it
once via a real code (the new infra/otp-worker), store it locally, never
re-check. No login state, no sign-out, no token expiry to manage - fixes
the whole bug class rather than patching the eighth incident.

- account.rs: keep save_account_email/read_account_email/clear_account_email
  (Clerk-independent, load-bearing for analytics/mod.rs's "no anonymous
  events ever" gate) unchanged; drop the Clerk key/gate machinery.
- New otp.rs: request_account_otp/confirm_account_otp against the Worker's
  documented contract, reusing the existing reqwest dependency.
- RequireSignIn -> RequireEmailCapture: a fire-once gate that fails OPEN on
  a read error (a transient IPC hiccup must not lock out an already-
  captured user) rather than fail-closed like the old session gate.
- EmailCodeForm -> OtpForm; AccountAuthControl's Sign Out becomes a Change
  Email control since there's no session to sign out of.
- Removes the vendored tauri-plugin-clerk fork, tauri-plugin-http/store
  (both existed only to support Clerk), and capabilities/clerk.json.
- Alpha access-gating is dropped entirely per product decision - open to
  anyone now that the invite gate's only enforcement lived in Clerk itself.

Verified: cargo fmt/clippy/test --workspace all green, bun test 916/916,
clean static export build.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .env.example                                  |   11 +-
 .github/workflows/release-build.yml           |   10 +-
 ARCHITECTURE.md                               |    5 +-
 CONTRIBUTING.md                               |    3 +-
 Cargo.lock                                    |  337 +-
 Cargo.toml                                    |   12 -
 SECURITY.md                                   |    2 +-
 docs/privacy.md                               |    4 +-
 meridian-core/src/settings.rs                 |    2 +-
 scripts/dev-reset-onboarding.sh               |   17 +-
 src/observability/filter.rs                   |   24 +-
 tray/src-tauri/Cargo.toml                     |   24 -
 tray/src-tauri/capabilities/clerk.json        |   16 -
 tray/src-tauri/src/commands.rs                |    5 +-
 tray/src-tauri/src/commands/account.rs        |  203 +-
 tray/src-tauri/src/commands/otp.rs            |  360 +
 tray/src-tauri/src/install.rs                 |    2 +-
 tray/src-tauri/src/lib.rs                     |   31 +-
 .../vendor/tauri-plugin-clerk/Cargo.toml      |   29 -
 .../vendor/tauri-plugin-clerk/LICENSE         |   21 -
 .../vendor/tauri-plugin-clerk/README.md       |  182 -
 .../vendor/tauri-plugin-clerk/build.rs        |   13 -
 .../get_client_authorization_header.toml      |   13 -
 .../autogenerated/commands/initialize.toml    |   13 -
 .../set_client_authorization_header.toml      |   13 -
 .../permissions/autogenerated/reference.md    |  108 -
 .../permissions/default.toml                  |   14 -
 .../permissions/schemas/schema.json           |  348 -
 .../vendor/tauri-plugin-clerk/src/commands.rs |   64 -
 .../vendor/tauri-plugin-clerk/src/events.rs   |   52 -
 .../tauri-plugin-clerk/src/json_backfill.rs   | 1385 ---
 .../vendor/tauri-plugin-clerk/src/lib.rs      |  345 -
 .../tauri-plugin-clerk/src/tauri_store.rs     |   35 -
 tray/src/app.js                               |   14 +-
 ui/__tests__/clerkNetworkError.test.ts        |   62 -
 ui/__tests__/otp-errors.test.ts               |  117 +
 ui/__tests__/require-email-capture.test.ts    |   70 +
 ui/__tests__/setup-one-typeface.test.ts       |    2 +-
 ui/__tests__/signin-required.test.ts          |  107 -
 .../windows-notification-permission.test.ts   |    4 +-
 ui/app/page.tsx                               |   12 +-
 ui/app/setup/page.tsx                         |   35 +-
 ui/app/setup/signin.tsx                       |   65 +-
 ui/app/setup/signin/AccountAuthControl.tsx    |  168 +-
 ui/app/setup/signin/ClerkErrorBoundary.tsx    |   71 -
 ui/app/setup/signin/ClerkGate.tsx             |  101 -
 .../signin/{EmailCodeForm.tsx => OtpForm.tsx} |  161 +-
 ui/app/setup/signin/RequireEmailCapture.tsx   |  106 +
 ui/app/setup/signin/RequireSignIn.tsx         |   92 -
 ui/app/setup/signin/SignInWidget.tsx          |   32 -
 ui/app/setup/signin/errors.ts                 |   28 -
 ui/app/setup/signin/identity.tsx              |    8 +-
 ui/app/setup/signin/useSignedInEmail.ts       |   31 -
 ui/app/setup/steps.tsx                        |   61 +-
 .../timeline/settings/AccountSection.tsx      |    3 -
 .../timeline/settings/IntelligenceSection.tsx |    3 +-
 ui/lib/clerkNetworkError.ts                   |   61 -
 ui/lib/otp-errors.ts                          |   76 +
 ui/lib/signin-required.ts                     |   61 -
 ui/package-lock.json                          | 7588 ++---------------
 ui/package.json                               |    4 +-
 61 files changed, 1872 insertions(+), 10974 deletions(-)
 delete mode 100644 tray/src-tauri/capabilities/clerk.json
 create mode 100644 tray/src-tauri/src/commands/otp.rs
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/Cargo.toml
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/LICENSE
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/README.md
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/build.rs
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/get_client_authorization_header.toml
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/initialize.toml
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/set_client_authorization_header.toml
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/reference.md
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/permissions/default.toml
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/permissions/schemas/schema.json
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/src/commands.rs
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/src/events.rs
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/src/json_backfill.rs
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/src/lib.rs
 delete mode 100644 tray/src-tauri/vendor/tauri-plugin-clerk/src/tauri_store.rs
 delete mode 100644 ui/__tests__/clerkNetworkError.test.ts
 create mode 100644 ui/__tests__/otp-errors.test.ts
 create mode 100644 ui/__tests__/require-email-capture.test.ts
 delete mode 100644 ui/__tests__/signin-required.test.ts
 delete mode 100644 ui/app/setup/signin/ClerkErrorBoundary.tsx
 delete mode 100644 ui/app/setup/signin/ClerkGate.tsx
 rename ui/app/setup/signin/{EmailCodeForm.tsx => OtpForm.tsx} (53%)
 create mode 100644 ui/app/setup/signin/RequireEmailCapture.tsx
 delete mode 100644 ui/app/setup/signin/RequireSignIn.tsx
 delete mode 100644 ui/app/setup/signin/SignInWidget.tsx
 delete mode 100644 ui/app/setup/signin/errors.ts
 delete mode 100644 ui/app/setup/signin/useSignedInEmail.ts
 delete mode 100644 ui/lib/clerkNetworkError.ts
 create mode 100644 ui/lib/otp-errors.ts
 delete mode 100644 ui/lib/signin-required.ts

diff --git a/.env.example b/.env.example
index df28cdfa8..55afc52a1 100644
--- a/.env.example
+++ b/.env.example
@@ -4,9 +4,12 @@
 # Optional - a release bakes this in, a source checkout runs without it.
 # Connect trackers in the setup wizard; tuning knobs are in CLAUDE.md.
 
-# Optional. Blank means a dev build skips sign-in entirely, so a fresh clone
-# just runs. Set a Clerk dev instance key (pk_test_...) to exercise the real
-# sign-in path locally. Packaged builds always require sign-in regardless.
-CLERK_PUBLISHABLE_KEY=
+# Optional. Blank means the OTP sign-in flow is disabled - the wizard's Email
+# step reports "not configured" on the first attempt and lets you continue
+# without signing in (the same dev-bypass shape the old Clerk key had). Set
+# these to a deployed infra/otp-worker instance (staging or your own) to
+# exercise the real send/verify path locally.
+OTP_API_URL=
+OTP_CLIENT_TOKEN=
 
 
diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
index 20b6aefe8..a2eb12d09 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -458,7 +458,8 @@ jobs:
       MERIDIAN_GITHUB_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
       MERIDIAN_POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
       MERIDIAN_COUNTER_API_KEY: ${{ secrets.COUNTER_API_KEY }}
-      MERIDIAN_CLERK_PUBLISHABLE_KEY: ${{ secrets.CLERK_PUBLISHABLE_KEY_PROD }}
+      MERIDIAN_OTP_API_URL: ${{ vars.MERIDIAN_OTP_API_URL }}
+      MERIDIAN_OTP_CLIENT_TOKEN: ${{ secrets.MERIDIAN_OTP_CLIENT_TOKEN }}
       MERIDIAN_CHANNEL: ${{ needs.prepare.outputs.channel }}
       # Signing + updater material. TAURI_SIGNING_* is consumed at BUNDLE time.
       TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
@@ -933,13 +934,14 @@ jobs:
       # comment) — these are cross-platform values (OAuth client ids, public
       # analytics keys), not macOS-specific ones, so skipping them here would
       # silently ship a Windows build with Jira sign-in, GitHub device flow,
-      # analytics, or Clerk sign-in missing. Keep this list in sync with the
-      # macOS job's, minus the Apple-only signing/notarization secrets.
+      # analytics, or email sign-in (the OTP Worker) missing. Keep this list in
+      # sync with the macOS job's, minus the Apple-only signing/notarization secrets.
       MERIDIAN_JIRA_OAUTH_CLIENT_SECRET: ${{ secrets.JIRA_OAUTH_CLIENT_SECRET }}
       MERIDIAN_GITHUB_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
       MERIDIAN_POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
       MERIDIAN_COUNTER_API_KEY: ${{ secrets.COUNTER_API_KEY }}
-      MERIDIAN_CLERK_PUBLISHABLE_KEY: ${{ secrets.CLERK_PUBLISHABLE_KEY_PROD }}
+      MERIDIAN_OTP_API_URL: ${{ vars.MERIDIAN_OTP_API_URL }}
+      MERIDIAN_OTP_CLIENT_TOKEN: ${{ secrets.MERIDIAN_OTP_CLIENT_TOKEN }}
       MERIDIAN_CHANNEL: ${{ needs.prepare.outputs.channel }}
       # The updater's minisign keypair is cross-platform — the SAME key signs
       # the macOS tarball and the Windows installer, and the pubkey baked into
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 97acc848d..e7fec4f64 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -65,10 +65,7 @@ listens on no port.
 | **MCP server** | `packages/meridian-mcp/` | TypeScript. Exposes the same data to AI clients over the Model Context Protocol. |
 | **OAuth** | `meridian-oauth/` | Browser-based OAuth flows for Jira and Trello. |
 
-The Rust workspace is `[".", "meridian-core", "meridian-oauth", "tray/src-tauri",
-"tray/src-tauri/vendor/tauri-plugin-clerk"]`. That last one is a patched copy of a
-third-party crate, and it is a member rather than excluded precisely so its regression
-tests run - see `tray/src-tauri/vendor/tauri-plugin-clerk/README.md`.
+The Rust workspace is `[".", "meridian-core", "meridian-oauth", "tray/src-tauri"]`.
 
 Because the repo root is itself a package, **`cargo test` and `cargo clippy` must be
 run with `--workspace`** or they silently test only the daemon. This is the single
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cc5252720..4b0d09907 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -125,8 +125,7 @@ bare `cd ui` on both would put the second one in `ui/ui`.
 
 > **`--workspace` is not optional.** The repo root is itself a package, so a bare
 > `cargo test` or `cargo clippy` runs against the daemon **alone** and silently skips
-> `meridian-core`, `meridian-oauth`, the tray, and the vendored `tauri-plugin-clerk`
-> (a workspace member so its regression tests run). They still compile, which is what
+> `meridian-core`, `meridian-oauth`, and the tray. They still compile, which is what
 > makes the omission so convincing - they are simply never tested. CI and the git hooks
 > pass `--workspace` for exactly this reason.
 
diff --git a/Cargo.lock b/Cargo.lock
index 208b610e2..44f28986c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1441,28 +1441,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
-[[package]]
-name = "clerk-fapi-rs"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e239d6a45c0bc0725bd254dbdd6f89918ea27c634cc753c173caca2f5b60fd0"
-dependencies = [
- "anyhow",
- "base64 0.22.1",
- "futures",
- "getrandom 0.3.4",
- "http",
- "log",
- "parking_lot",
- "pin-project-lite",
- "reqwest 0.12.28",
- "serde",
- "serde_json",
- "serde_with",
- "url",
- "uuid",
-]
-
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
@@ -1498,7 +1476,7 @@ dependencies = [
  "cocoa-foundation",
  "core-foundation 0.10.1",
  "core-graphics 0.24.0",
- "foreign-types 0.5.0",
+ "foreign-types",
  "libc",
  "objc",
 ]
@@ -1589,7 +1567,6 @@ version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
 dependencies = [
- "percent-encoding",
  "time",
  "version_check",
 ]
@@ -1600,24 +1577,6 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9885fa71e26b8ab7855e2ec7cae6e9b380edff76cd052e07c683a0319d51b3a2"
 
-[[package]]
-name = "cookie_store"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15b2c103cf610ec6cae3da84a766285b42fd16aad564758459e6ecf128c75206"
-dependencies = [
- "cookie",
- "document-features",
- "idna",
- "log",
- "publicsuffix",
- "serde",
- "serde_derive",
- "serde_json",
- "time",
- "url",
-]
-
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -1653,7 +1612,7 @@ dependencies = [
  "bitflags 2.11.1",
  "core-foundation 0.10.1",
  "core-graphics-types",
- "foreign-types 0.5.0",
+ "foreign-types",
  "libc",
 ]
 
@@ -1666,7 +1625,7 @@ dependencies = [
  "bitflags 2.11.1",
  "core-foundation 0.10.1",
  "core-graphics-types",
- "foreign-types 0.5.0",
+ "foreign-types",
  "libc",
 ]
 
@@ -2093,12 +2052,6 @@ version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
-[[package]]
-name = "data-url"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be1e0bca6c3637f992fc1cc7cbc52a78c1ef6db076dbf1059c4323d6a2048376"
-
 [[package]]
 name = "dbus"
 version = "0.9.11"
@@ -2357,15 +2310,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "document-features"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
-dependencies = [
- "litrs",
-]
-
 [[package]]
 name = "dom_query"
 version = "0.27.0"
@@ -2612,15 +2556,6 @@ version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7"
 
-[[package]]
-name = "encoding_rs"
-version = "0.8.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
-dependencies = [
- "cfg-if",
-]
-
 [[package]]
 name = "endi"
 version = "1.1.1"
@@ -2985,15 +2920,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
-[[package]]
-name = "foreign-types"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
-dependencies = [
- "foreign-types-shared 0.1.1",
-]
-
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -3001,7 +2927,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
 dependencies = [
  "foreign-types-macros",
- "foreign-types-shared 0.3.1",
+ "foreign-types-shared",
 ]
 
 [[package]]
@@ -3015,12 +2941,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "foreign-types-shared"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
-
 [[package]]
 name = "foreign-types-shared"
 version = "0.3.1"
@@ -3710,25 +3630,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "h2"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
-dependencies = [
- "atomic-waker",
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "http",
- "indexmap 2.14.0",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -3974,7 +3875,6 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
- "h2",
  "http",
  "http-body",
  "httparse",
@@ -4003,22 +3903,6 @@ dependencies = [
  "webpki-roots 1.0.7",
 ]
 
-[[package]]
-name = "hyper-tls"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
-dependencies = [
- "bytes",
- "http-body-util",
- "hyper",
- "hyper-util",
- "native-tls",
- "tokio",
- "tokio-native-tls",
- "tower-service",
-]
-
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -4037,11 +3921,9 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "socket2 0.6.3",
- "system-configuration",
  "tokio",
  "tower-service",
  "tracing",
- "windows-registry",
 ]
 
 [[package]]
@@ -4943,12 +4825,6 @@ version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
-[[package]]
-name = "litrs"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
-
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -5249,14 +5125,11 @@ dependencies = [
  "sysinfo",
  "tauri",
  "tauri-build",
- "tauri-plugin-clerk",
- "tauri-plugin-http",
  "tauri-plugin-notifications",
  "tauri-plugin-opener",
  "tauri-plugin-positioner",
  "tauri-plugin-sentry",
  "tauri-plugin-single-instance",
- "tauri-plugin-store",
  "tauri-plugin-updater",
  "tempfile",
  "tokio",
@@ -5477,23 +5350,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "native-tls"
-version = "0.2.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
-dependencies = [
- "libc",
- "log",
- "openssl",
- "openssl-probe",
- "openssl-sys",
- "schannel",
- "security-framework 3.7.0",
- "security-framework-sys",
- "tempfile",
-]
-
 [[package]]
 name = "ndk"
 version = "0.9.0"
@@ -6347,31 +6203,6 @@ dependencies = [
  "serde_json",
 ]
 
-[[package]]
-name = "openssl"
-version = "0.10.81"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
-dependencies = [
- "bitflags 2.11.1",
- "cfg-if",
- "foreign-types 0.3.2",
- "libc",
- "openssl-macros",
- "openssl-sys",
-]
-
-[[package]]
-name = "openssl-macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
@@ -7237,22 +7068,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "psl-types"
-version = "2.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
-
-[[package]]
-name = "publicsuffix"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42ea446cab60335f76979ec15e12619a2165b5ae2c12166bef27d283a9fadf"
-dependencies = [
- "idna",
- "psl-types",
-]
-
 [[package]]
 name = "pulp"
 version = "0.22.3"
@@ -7731,25 +7546,17 @@ checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64 0.22.1",
  "bytes",
- "cookie",
- "cookie_store",
- "encoding_rs",
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2",
  "http",
  "http-body",
  "http-body-util",
  "hyper",
  "hyper-rustls",
- "hyper-tls",
  "hyper-util",
  "js-sys",
  "log",
- "mime",
- "mime_guess",
- "native-tls",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -7761,7 +7568,6 @@ dependencies = [
  "serde_urlencoded",
  "sync_wrapper",
  "tokio",
- "tokio-native-tls",
  "tokio-rustls",
  "tokio-util",
  "tower",
@@ -9844,27 +9650,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "system-configuration"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
-dependencies = [
- "bitflags 2.11.1",
- "core-foundation 0.9.4",
- "system-configuration-sys",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
 [[package]]
 name = "system-deps"
 version = "6.2.2"
@@ -10102,73 +9887,6 @@ dependencies = [
  "walkdir",
 ]
 
-[[package]]
-name = "tauri-plugin-clerk"
-version = "0.1.1"
-dependencies = [
- "clerk-fapi-rs",
- "log",
- "parking_lot",
- "serde",
- "serde_json",
- "serde_path_to_error",
- "tauri",
- "tauri-plugin",
- "tauri-plugin-http",
- "tauri-plugin-store",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "tauri-plugin-fs"
-version = "2.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7ecc274121aca0c036a2b42d1cbe83d368d348f54e0bb8a735c2b1548e8f371"
-dependencies = [
- "anyhow",
- "dunce",
- "glob",
- "log",
- "objc2-foundation",
- "percent-encoding",
- "schemars 0.8.22",
- "serde",
- "serde_json",
- "serde_repr",
- "tauri",
- "tauri-plugin",
- "tauri-utils",
- "thiserror 2.0.18",
- "toml 1.1.2+spec-1.1.0",
- "url",
-]
-
-[[package]]
-name = "tauri-plugin-http"
-version = "2.5.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5bd512048e1985b7ec78f96d99083e2ddaf7e0d906b2b63c44ce5bb8b894067"
-dependencies = [
- "bytes",
- "cookie_store",
- "data-url",
- "http",
- "regex",
- "reqwest 0.12.28",
- "schemars 0.8.22",
- "serde",
- "serde_json",
- "tauri",
- "tauri-plugin",
- "tauri-plugin-fs",
- "thiserror 2.0.18",
- "tokio",
- "url",
- "urlpattern",
-]
-
 [[package]]
 name = "tauri-plugin-notifications"
 version = "0.4.6"
@@ -10259,22 +9977,6 @@ dependencies = [
  "zbus",
 ]
 
-[[package]]
-name = "tauri-plugin-store"
-version = "2.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c72dda16786eb4a3f903e43a17b64d8d78dc0f00fe2aa4b757c28f617a8630b"
-dependencies = [
- "dunce",
- "serde",
- "serde_json",
- "tauri",
- "tauri-plugin",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "tauri-plugin-updater"
 version = "2.10.1"
@@ -10666,16 +10368,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "tokio-native-tls"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
-dependencies = [
- "native-tls",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.26.4"
@@ -11323,19 +11015,9 @@ dependencies = [
  "getrandom 0.4.2",
  "js-sys",
  "serde_core",
- "uuid-rng-internal",
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "uuid-rng-internal"
-version = "1.23.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13ab16e069e7562ecbdfa2e7858097deff01e13284d62921b6db087d0d66dd76"
-dependencies = [
- "getrandom 0.4.2",
-]
-
 [[package]]
 name = "uuid-simd"
 version = "0.8.0"
@@ -12102,17 +11784,6 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
-[[package]]
-name = "windows-registry"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
-dependencies = [
- "windows-link 0.2.1",
- "windows-result 0.4.1",
- "windows-strings 0.5.1",
-]
-
 [[package]]
 name = "windows-result"
 version = "0.2.0"
diff --git a/Cargo.toml b/Cargo.toml
index ce21fde30..cef0e37d9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,21 +1,9 @@
 [workspace]
-# The last entry is the vendored, patched fork of tauri-plugin-clerk (see
-# tray/src-tauri/Cargo.toml's dependency comment + vendor/tauri-plugin-clerk's
-# module doc). It is a MEMBER, not an `exclude`, on purpose: it is where the
-# session-persistence fix and its regression tests live, and excluding it —
-# the obvious call for vendored third-party code — takes it out of
-# `cargo test --workspace`, `clippy --workspace`, `fmt --check`, CI and the
-# pre-push hook in one move. That is the same shape as the trap documented
-# below (`.` being a package, so a bare `cargo test` skips the rest): every
-# gate green while the tests guarding the fix never ran. It costs nothing —
-# upstream 0.1.1 is already clippy- and fmt-clean — and if a future upstream
-# re-sync isn't, that is worth finding out at the re-sync rather than never.
 members = [
     ".",
     "meridian-core",
     "meridian-oauth",
     "tray/src-tauri",
-    "tray/src-tauri/vendor/tauri-plugin-clerk",
 ]
 resolver = "2"
 
diff --git a/SECURITY.md b/SECURITY.md
index 3b8ebf6bb..c19f5eb85 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -48,7 +48,7 @@ Meridian is designed to contain blast radius by default:
 
 - **Capture and classification are on-device** — screen content does not leave the machine except via the LLM provider you configure for summarisation
 - **The activity database is encrypted at rest** — `~/.meridian/meridian.db` uses SQLCipher, with the key generated on first run and held in the OS keychain (macOS Keychain / Windows Credential Manager)
-- **Credentials are stored locally with restrictive permissions** — OAuth tokens in `~/.meridian/oauth/<provider>.json` and tracker credentials in `~/.meridian/.env`, both at mode `0600`. One known exception is tracked publicly: the Clerk session token is persisted as plaintext JSON by the upstream auth plugin ([#727](https://github.com/Meridiona/meridian/issues/727))
+- **Credentials are stored locally with restrictive permissions** — OAuth tokens in `~/.meridian/oauth/<provider>.json` and tracker credentials in `~/.meridian/.env`, both at mode `0600`. [#727](https://github.com/Meridiona/meridian/issues/727) (the Clerk session token persisted as plaintext JSON by the upstream auth plugin) no longer applies: Clerk has been removed entirely in favor of a stateless one-time email code, so there is no session token of any kind to persist. (Unrelated and pre-existing: `~/.meridian/account.json` stores the captured sign-in email as plaintext JSON — this predates #727, was never part of it, and is not a session or credential.)
 - **Product analytics are minimal and content-free** — three events (an install, a daily "was active" heartbeat, and a daily count of what Meridian did plus an install-health snapshot), sent only after sign-in, identified by account email, and switchable off in Settings. Counts, booleans, and fixed internal codes only: no screen content, window titles, application names, ticket data, notification text, or file paths. These events also carry the Support ID, which links them to that machine's error reports — stated plainly in [docs/privacy.md](docs/privacy.md#product-analytics). A separate payload-free counter ping fires per posted worklog.
 - **Error reporting is redacted, error-only, and switchable** — packaged builds send WARN-and-above logs and ERROR-status spans to Meridiana's own observability backend, on by default, with an off switch at Settings → Capture & Privacy. Content-bearing attributes are stripped on-device before the network leg and the hostname is replaced by a one-way pseudonym; source builds never ship at all. Full detail in [docs/privacy.md](docs/privacy.md#error-reporting)
 - **Approved ticket updates go directly from your machine** to the trackers you connect (Jira, GitHub, Linear, Trello, Azure DevOps) — never proxied through Meridiana
diff --git a/docs/privacy.md b/docs/privacy.md
index 4e16df438..8eb2af817 100644
--- a/docs/privacy.md
+++ b/docs/privacy.md
@@ -238,7 +238,7 @@ There is no on-device generative model. The only model that runs fully locally i
 
 ## Accounts
 
-Signing in is optional and is currently used to gate the invite-only alpha. Your email address is held by our authentication provider (Clerk); during the alpha window it is also attached directly to your error and crash reports so support can identify which tester and machine an issue came from — see the alpha note under [How reports are identified](#how-reports-are-identified) for the full detail and its end date.
+Signing in is required to use Meridian - it is a one-time step, not an account with a password: you verify a code sent to your email, delivered via AWS SES and checked through a Cloudflare Worker we operate. There is no invite-only alpha it gates. During the alpha window described below, your email is also attached directly to your error and crash reports so support can identify which tester and machine an issue came from — see the alpha note under [How reports are identified](#how-reports-are-identified) for the full detail and its end date.
 
 ---
 
@@ -248,7 +248,7 @@ Signing in is optional and is currently used to gate the invite-only alpha. Your
 - **Delete** — `meridian uninstall` removes Meridian's local data and services. Deleting `~/.meridian/` by hand does the same for data alone.
 - **Portability** — export your activity data and switch tools; there is no lock-in.
 - **Opt out of error reporting or product analytics** — each has its own switch at Settings → Capture & Privacy, and they can be turned off independently. Staying signed out disables product analytics entirely regardless of the switch.
-- **No behavioural tracking** — Meridian does not follow you across websites, does not record sessions, and never sells your data or shares it for advertising. It does reach the service providers named throughout this document to do the job each is described for - PostHog for product analytics, Sentry for crash reports, Clerk for sign-in - and nowhere else. The only usage data collected is the three events described under [Product analytics](#product-analytics).
+- **No behavioural tracking** — Meridian does not follow you across websites, does not record sessions, and never sells your data or shares it for advertising. It does reach the service providers named throughout this document to do the job each is described for - PostHog for product analytics, Sentry for crash reports, AWS SES and a Cloudflare Worker we operate for sign-in - and nowhere else. The only usage data collected is the three events described under [Product analytics](#product-analytics).
 
 ---
 
diff --git a/meridian-core/src/settings.rs b/meridian-core/src/settings.rs
index 94fb849f6..1e335426c 100644
--- a/meridian-core/src/settings.rs
+++ b/meridian-core/src/settings.rs
@@ -342,7 +342,7 @@ pub struct RuntimeSettings {
     pub worklog_auto_generate_prompted: bool,
     // ALPHA TESTING ONLY (hand-picked users, all on the same `stable`
     // production channel as everyone else — there's no separate alpha
-    // channel to gate on). A domain-separated, one-way hash of the signed-in Clerk
+    // channel to gate on). A domain-separated, one-way hash of the captured
     // account email — NEVER the raw email — written by the tray's
     // `commands::account::save_account_email` (cleared on sign-out) and read
     // by `telemetry_spool::redact::local_host_pseudonym` to seed the Support
diff --git a/scripts/dev-reset-onboarding.sh b/scripts/dev-reset-onboarding.sh
index 45ec92063..39835b16d 100644
--- a/scripts/dev-reset-onboarding.sh
+++ b/scripts/dev-reset-onboarding.sh
@@ -20,8 +20,9 @@
 #             sign-in and permission grants all survive. This is the loop you
 #             want for wizard copy/logic/step-ordering iteration.
 #   --data    --soft plus user data: meridian.db, settings.json, oauth/, .env,
-#             account.json and the WebKit caches that hold the signed-in session.
-#             Keeps the keychain key and the TCC grants.
+#             account.json (the whole sign-in state - no session lives anywhere
+#             else) and the WebKit caches, cleared for general webview-cache
+#             hygiene. Keeps the keychain key and the TCC grants.
 #   --deep    shells out to `meridian uninstall --remove-data --yes` — the real
 #             uninstall path: launchd agents, staged binaries, the install
 #             marker, ~/.meridian data, the OS keychain entry and a tccutil
@@ -101,8 +102,10 @@ SOFT_MARKERS=(
     provider_runtime_health.json
 )
 
-# Additional user data for --data. account.json alone does NOT sign you out —
-# the session lives in the WebKit caches below.
+# Additional user data for --data. account.json ALONE is now the full sign-in
+# state — there is no separate client session to also clear (email capture is
+# a one-time write, not a login). The WebKit caches below are cleared for
+# general webview-cache hygiene, unrelated to sign-in.
 DATA_ITEMS=(
     meridian.db
     meridian.db-shm
@@ -116,8 +119,10 @@ DATA_ITEMS=(
     icon-cache
 )
 
-# macOS OS-managed app data for the tray's bundle id — cookies/localStorage, i.e.
-# where the signed-in Clerk session actually lives. Mirrors `app_cache_items()`.
+# macOS OS-managed app data for the tray's bundle id — cookies/localStorage/
+# webview cache. No sign-in state lives here anymore (see DATA_ITEMS' note on
+# account.json above) — kept for general webview-cache hygiene. Mirrors
+# `app_cache_items()`.
 app_cache_paths() {
     printf '%s\n' \
         "${HOME}/Library/Application Support/${TRAY_BUNDLE_ID}" \
diff --git a/src/observability/filter.rs b/src/observability/filter.rs
index 6ee65f147..b4270a324 100644
--- a/src/observability/filter.rs
+++ b/src/observability/filter.rs
@@ -53,22 +53,12 @@ pub(super) static FILTER_HANDLE: OnceLock<FilterHandle> = OnceLock::new();
 /// **Re-audit if the fork's revision is bumped** — this is exactly the class of
 /// change that could start shipping captured content.
 ///
-/// `tauri_plugin_clerk` was added alongside its `vendor/tauri-plugin-clerk`
-/// session-persistence fix (`tray/src-tauri/vendor/tauri-plugin-clerk`) so the
-/// new `tracing::warn!` sites that replaced a swallowed deserialize error are
-/// actually visible in `meridian logs`/OpenObserve instead of only the local
-/// terminal. Audited every event site in that crate, not only the ones this
-/// change added — the `warn!`/`error!` sites interpolate only
-/// `serde_json::Error`'s and the Tauri emit error's `Display` (schema-mismatch
-/// messages — field names, not field values), and the two `DEBUG` sites that
-/// upstream wrote as `{payload:?}` were rewritten to log presence booleans.
-/// That rewrite is load-bearing, not tidying: `ClientSession` carries
-/// `last_active_token.jwt`, so a `Debug`-rendered payload is a live bearer
-/// token, and naming the crate here is exactly what would route it into the
-/// full-fidelity local spool. Nothing in this crate may interpolate the Clerk
-/// payload (email, JWT, name). **Re-audit alongside the vendored crate** — on
-/// any upstream re-sync, and if it's ever un-vendored back to a crates.io
-/// release (see that crate's module doc for the un-vendor plan).
+/// `tauri_plugin_clerk` briefly lived in this list (a vendored Clerk sign-in
+/// plugin, added so its own `tracing::warn!` sites were visible in
+/// `meridian logs`/OpenObserve rather than only the local terminal) and was
+/// removed along with the plugin itself when Clerk was replaced by a stateless
+/// one-time email code (`tray/src-tauri/src/commands/otp.rs`) — there is no
+/// client-side auth library left with events of its own to capture.
 ///
 /// # Adding to this list
 /// Add the bare target (crate) name here and every log level picks it up
@@ -76,7 +66,7 @@ pub(super) static FILTER_HANDLE: OnceLock<FilterHandle> = OnceLock::new();
 /// directive string: the level varies per branch in [`build_default_filter`],
 /// and hardcoding the pairs in each branch is how a new entry silently ends up
 /// with no coverage at one level.
-const CAPTURE_TARGETS: &[&str] = &["screenpipe_screen", "screenpipe_a11y", "tauri_plugin_clerk"];
+const CAPTURE_TARGETS: &[&str] = &["screenpipe_screen", "screenpipe_a11y"];
 
 /// Render [`CAPTURE_TARGETS`] as `EnvFilter` directives at `level`.
 fn capture_directives(level: &str) -> String {
diff --git a/tray/src-tauri/Cargo.toml b/tray/src-tauri/Cargo.toml
index ca3eafdf6..ea57dfe70 100644
--- a/tray/src-tauri/Cargo.toml
+++ b/tray/src-tauri/Cargo.toml
@@ -67,30 +67,6 @@ tauri-plugin-notifications = { version = "=0.4.6", default-features = false }
 # capture writer before it exits.
 tauri-plugin-single-instance = "2"
 tauri-plugin-opener = "2"
-# Email sign-in on the setup wizard's Sign-in step (see ui/app/setup/signin.tsx).
-# Community-maintained (Nipsuli/tauri-plugin-clerk) — originally pinned exact
-# for supply-chain control, same as tauri-plugin-notifications above. It
-# patches `fetch` to route Clerk's session calls through tauri-plugin-http,
-# working around Clerk's own documented limitation that cookies don't work on
-# Tauri's custom-domain webview. OAuth/social sign-in is NOT supported by this
-# plugin — email-code only, which matches the passwordless flow this app uses
-# (see clerk.json capability + the manual Clerk dashboard config note in
-# commands/account.rs).
-#
-# VENDORED at 0.1.1 (not the crates.io release) to carry a fix for
-# https://github.com/Nipsuli/tauri-plugin-clerk/issues/7: the JS->Rust
-# auth-event sync silently failed to persist a signed-in user's session into
-# the offline cache for EVERY real signed-in user, so any cold start that
-# couldn't complete a live Clerk fetch (e.g. no network yet) showed
-# signed-out despite a genuine prior sign-in. See
-# `vendor/tauri-plugin-clerk/src/lib.rs`'s module doc for the full writeup
-# and `src/json_backfill.rs` for the fix + regression tests. Un-vendor once
-# upstream ships a fix (issue #7 has an open, unmerged PR #9) — restore the
-# line below to `tauri-plugin-clerk = "=0.1.1"` (or whatever version carries
-# the fix) and delete `vendor/tauri-plugin-clerk/`.
-tauri-plugin-clerk = { path = "vendor/tauri-plugin-clerk" }
-tauri-plugin-http = "=2.5.9"
-tauri-plugin-store = "=2.4.3"
 # DMG auto-update (Step 1 of the public-distribution plan). Checks the GitHub
 # `latest.json` against the running version, downloads the signed `.app.tar.gz`,
 # verifies it against the minisign pubkey in tauri.conf.json, swaps it in, and
diff --git a/tray/src-tauri/capabilities/clerk.json b/tray/src-tauri/capabilities/clerk.json
deleted file mode 100644
index 1d521eba7..000000000
--- a/tray/src-tauri/capabilities/clerk.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "identifier": "clerk",
-  "description": "Clerk email sign-in — the setup wizard's Sign-in step and Settings → Account's sign-in/sign-out control (see ui/app/setup/signin.tsx).",
-  "windows": ["setup", "dashboard"],
-  "permissions": [
-    "clerk:default",
-    {
-      "identifier": "http:default",
-      "allow": [
-        { "url": "https://*.clerk.accounts.dev/*" },
-        { "url": "https://clerk.meridiona.com/*" },
-        { "url": "https://accounts.meridiona.com/*" }
-      ]
-    }
-  ]
-}
diff --git a/tray/src-tauri/src/commands.rs b/tray/src-tauri/src/commands.rs
index c1bd9bbaa..d2413a7da 100644
--- a/tray/src-tauri/src/commands.rs
+++ b/tray/src-tauri/src/commands.rs
@@ -7,7 +7,7 @@
 //! name them flatly regardless of which submodule they sit in.
 //!
 //! - [`dashboard`] — the ported `/api/*` DB reads (active/today/week/tasks/…).
-//! - [`account`]   — Clerk publishable-key resolution + the captured sign-in email.
+//! - [`account`]   — the captured account email + its ALPHA telemetry mirror.
 //! - [`app_icons`] — real macOS app icon extraction for "Time by app" (`get_app_icon`).
 //! - [`daemon`]    — daemon lifecycle (restart/pause/resume) + status probes.
 //! - [`system`]    — OS/window actions (open URLs, System Settings panes).
@@ -18,6 +18,7 @@
 //!   module and its dashboard consumer are both gone).
 //! - [`integrations`] — which trackers are connected (`/api/integrations`).
 //! - [`notices`]   — clear a fault banner (`/api/notices/[id]` DELETE).
+//! - [`otp`]       — send/verify a one-time email code via the OTP Worker.
 //! - [`notifications`] — the in-app banner dismiss write.
 //! - [`parents`]   — valid parent tickets for the hygiene "link a parent" fix.
 //! - [`pm_tool_request`] — "I don't see my tool" on `ConnectTrackers`: local
@@ -52,6 +53,7 @@ pub mod integrations;
 pub mod llm_lab;
 pub mod notices;
 pub mod notifications;
+pub mod otp;
 pub mod parents;
 pub mod pause;
 pub mod plan_tasks;
@@ -86,6 +88,7 @@ pub use integrations::*;
 pub use llm_lab::*;
 pub use notices::*;
 pub use notifications::*;
+pub use otp::*;
 pub use parents::*;
 pub use pause::*;
 pub use plan_tasks::*;
diff --git a/tray/src-tauri/src/commands/account.rs b/tray/src-tauri/src/commands/account.rs
index 9fa1bdc02..1ca995a40 100644
--- a/tray/src-tauri/src/commands/account.rs
+++ b/tray/src-tauri/src/commands/account.rs
@@ -1,29 +1,18 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Clerk email sign-in — publishable-key resolution + the captured account email.
+//! One-time email capture — the captured account email + its ALPHA telemetry mirror.
 //!
 //! # What this is
-//! The setup wizard's Sign-in step and Settings → Account's control
+//! The setup wizard's Email step and Settings → Account's control
 //! (`ui/app/setup/signin.tsx` / the `ui/app/setup/signin/` module — see
-//! `SignInWidget.tsx`/`AccountAuthControl.tsx`) drive Clerk entirely
-//! client-side via `tauri-plugin-clerk` (see `lib.rs`'s plugin registration)
-//! — email one-time-code only, no OAuth
-//! (the plugin doesn't support it) and no password (disabled on the Clerk
-//! instance itself; see the manual dashboard step below). Once a session
-//! exists, the frontend calls [`save_account_email`] so the Rust side also
-//! knows who's signed in, since Clerk's own session lives only in the
-//! webview's persisted store.
-//!
-//! **Manual prerequisite (not code):** the Clerk application's email
-//! auth strategy must have `sign_in_strategies: ["email_code"]` and
-//! `auth_password.enabled = false` (Clerk dashboard → Configure → Email,
-//! phone, username) so sign-up never asks for a password. Verify with
-//! `clerk config pull` after linking the app (`clerk link --app <id>`).
+//! `OtpForm.tsx`/`AccountAuthControl.tsx`) send/verify a one-time code via
+//! `crate::commands::otp` (a small Cloudflare Worker + AWS SES, no client-side
+//! auth library, no session). Once a code verifies, the frontend calls
+//! [`save_account_email`] to persist the address — there is no session to mirror;
+//! this file's `account.json` IS the whole record of who's signed in.
 //!
 //! # Who calls this
-//! - [`clerk_publishable_key`]: `lib.rs`'s builder, to construct the
-//!   `tauri_plugin_clerk::ClerkPluginBuilder`.
-//! - [`save_account_email`]: `ui/app/setup/signin/SignInWidget.tsx` and
-//!   `AccountAuthControl.tsx` on successful sign-in.
+//! - [`save_account_email`]: `ui/app/setup/signin/OtpForm.tsx` (on a verified
+//!   code) and `AccountAuthControl.tsx`'s "Change email" control.
 //! - [`read_account_email`]: `crate::analytics`, the identity gate — no
 //!   PostHog event is sent at all until this returns `Some` (the email
 //!   becomes the event's `distinct_id` directly, never an anonymous id).
@@ -57,102 +46,6 @@ use anyhow::Context;
 use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
 
-/// Clerk publishable key — a **public** identifier (safe to embed in a shipped
-/// client, unlike a secret key), baked in at compile time mirroring
-/// `analytics.rs`'s `DEFAULT_POSTHOG_API_KEY`. Both release workflows
-/// (`release.yml` and `release-staging.yml`) set `MERIDIAN_CLERK_PUBLISHABLE_KEY`
-/// to the **production** Clerk instance's key (`meridiona.com`) — every
-/// packaged, downloadable build uses production, staging channel included,
-/// per the rule: only a bare source checkout gets the dev instance. A local
-/// `cargo run`/`tauri dev` build compiles this constant empty (no CI env var
-/// set), but never actually falls through to it — [`clerk_publishable_key`]
-/// resolves the **dev** instance's key first from the repo root `.env`
-/// (`CLERK_PUBLISHABLE_KEY=pk_test_...`) via the `InstallMode::Dev` branch
-/// below, same as the tracker keys `commands::integrations` reads. This
-/// constant is really only reached by `InstallMode::Canonical`/`Bare` (a real
-/// install) when, for whatever reason, no CI-baked key made it into the
-/// binary. The frontend never needs its own copy — `initClerk()`
-/// (`tauri-plugin-clerk`) returns the key from this Rust-side config, so
-/// `ClerkProvider` reads `clerk.publishableKey` off that, not a
-/// `NEXT_PUBLIC_*` env var.
-const DEFAULT_CLERK_PUBLISHABLE_KEY: &str = match option_env!("MERIDIAN_CLERK_PUBLISHABLE_KEY") {
-    Some(k) => k,
-    None => "",
-};
-
-/// Resolve the publishable key, in priority order: the `CLERK_PUBLISHABLE_KEY`
-/// process env (an explicit override — a launcher/shell export, or local
-/// testing against a different instance), then the same key read straight out
-/// of [`crate::install::detect_install_mode`]'s `.env` file (the tray doesn't
-/// auto-load env the way the daemon does — see `install.rs`'s
-/// `env_key_from_path` doc; this is where a source checkout picks up the repo
-/// root `.env`'s **dev** instance key), then the compiled-in
-/// [`DEFAULT_CLERK_PUBLISHABLE_KEY`] (the **production** instance key, for
-/// any real install with no `.env` override).
-pub fn clerk_publishable_key() -> String {
-    if let Some(v) = std::env::var("CLERK_PUBLISHABLE_KEY")
-        .ok()
-        .filter(|s| !s.trim().is_empty())
-    {
-        return v;
-    }
-    if let Some(v) = crate::install::detect_install_mode()
-        .env_path()
-        .and_then(|p| crate::install::env_key_from_path(p, "CLERK_PUBLISHABLE_KEY"))
-    {
-        return v;
-    }
-    DEFAULT_CLERK_PUBLISHABLE_KEY.to_string()
-}
-
-/// Whether the app must be signed in to be usable — the single switch behind
-/// BOTH sign-in gates (`RequireSignIn`, which hides the whole dashboard, and
-/// the setup wizard's sign-in step, whose Next button is otherwise dead).
-/// They read one answer rather than each re-deriving it, so the two can never
-/// disagree and strand a user in a wizard they cannot leave.
-///
-/// **False only in a DEBUG build with no publishable key configured.** That is
-/// the contributor case: `git clone` → `dev-start.sh` with no `.env`, where
-/// requiring sign-in means requiring a Clerk key we cannot ship, and the app is
-/// simply unusable.
-///
-/// # Why `debug_assertions` and not [`crate::install::detect_install_mode`]
-///
-/// The obvious-looking `InstallMode::Dev` check is WRONG here, and quietly so:
-/// `detect_install_mode` returns `Dev` only when a `.env` **already exists**, so
-/// a fresh clone — precisely the case this exists for — is `Bare`, and `Bare` is
-/// also what a real install with no `.env` reports. Keying on it would both miss
-/// the contributor and hand a shipped build a path to unlock itself.
-///
-/// `debug_assertions` cannot do either. A packaged build is compiled in release,
-/// so this whole branch is compiled OUT of the shipped binary — sign-in there is
-/// not "enforced at runtime", it is the only code that exists. There is no
-/// setting, env var, or file a user can reach that turns it off.
-///
-/// Setting `CLERK_PUBLISHABLE_KEY` in a dev `.env` flips this back to `true`, so
-/// a maintainer's dev build exercises the real production sign-in path end to
-/// end. The key's presence IS the mode switch — nothing else to remember.
-#[tauri::command]
-#[tracing::instrument]
-pub async fn sign_in_required() -> bool {
-    sign_in_required_for(&clerk_publishable_key())
-}
-
-/// The decision itself, taking the resolved key rather than looking it up.
-///
-/// Split this way ON PURPOSE: [`clerk_publishable_key`] consults the process env
-/// AND the checkout's `.env`, so a test calling it would answer differently on a
-/// maintainer's machine (key present) than in CI (absent) — the "no key" case
-/// would silently stop being tested by whoever most needs it to hold. Passing
-/// the key in makes both branches deterministic everywhere.
-fn sign_in_required_for(key: &str) -> bool {
-    // Release builds compile this out entirely — see [`sign_in_required`].
-    if !cfg!(debug_assertions) {
-        return true;
-    }
-    !key.trim().is_empty()
-}
-
 /// Persisted account state — deliberately its own file (`~/.meridian/account.json`),
 /// never merged into `settings.json` (which the dashboard reads/writes/displays),
 /// same rationale as `analytics.rs`'s `analytics_state.json`.
@@ -165,10 +58,10 @@ fn account_path() -> Option<PathBuf> {
     meridian_core::paths::home_dir().map(|h| h.join(".meridian/account.json"))
 }
 
-/// Persist the signed-in user's email after the setup wizard's sign-in step
-/// completes. Crash-safe write (temp + rename), mirroring
-/// `analytics.rs::save_state`. Idempotent — safe to call again (e.g. a
-/// relaunch that re-verifies the persisted Clerk session). The next
+/// Persist the captured user's email after the setup wizard's Email step (or
+/// Settings → Account's "Change email") verifies a code. Crash-safe write
+/// (temp + rename), mirroring `analytics.rs::save_state`. Idempotent — a plain
+/// overwrite, safe to call again for the same or a changed address. The next
 /// scheduled poll tick picks up the email and starts sending
 /// `app_installed`/`daily_usage` identified by it (see `crate::analytics`).
 #[tauri::command]
@@ -347,22 +240,26 @@ pub(crate) fn read_account_email() -> Option<String> {
         .map(|a| a.email)
 }
 
-/// Frontend-facing read of the persisted account email — backs the Settings →
-/// Account panel (`ui/components/timeline/settings/AccountSection.tsx`) so it
-/// can show who's signed in without waiting on Clerk's own (async) session
-/// check first.
+/// Frontend-facing read of the persisted account email — backs
+/// `RequireEmailCapture`'s one-time gate check and the Settings → Account
+/// panel (`ui/components/timeline/settings/AccountSection.tsx`), both of which
+/// need to know synchronously (no session object to inspect) whether an
+/// address has ever been captured.
 #[tauri::command]
 #[tracing::instrument]
 pub async fn get_account_email() -> Option<String> {
     read_account_email()
 }
 
-/// Clear the persisted account email on sign-out. Called by the Settings →
-/// Account panel right after the webview's Clerk session itself is torn down
-/// (`useClerk().signOut()` in `AccountAuthControl.tsx`'s `AccountStatus`) — this file
-/// is the Rust-side mirror of that session, so it must be cleared in lockstep
-/// or a stale email would keep surfacing in Settings/analytics after logout.
-/// Not an error if never signed in (no file to remove).
+/// Clear the persisted account email. There is no session to sign out of, so
+/// nothing in the shipped UI calls this today (`AccountAuthControl.tsx` offers
+/// "Change email" — a plain overwrite via [`save_account_email`] — rather than
+/// a sign-out that would need this). Kept as a real command rather than
+/// deleted: it is the only way to fully reset a machine's captured identity
+/// (e.g. for local testing, or a future account-reset affordance), and
+/// deleting it would mean reinventing the ALPHA-pseudonym-clearing ordering
+/// below from scratch if that need ever comes back. Not an error if never
+/// captured (no file to remove).
 #[tauri::command]
 #[tracing::instrument]
 pub async fn clear_account_email() -> Result<(), String> {
@@ -387,52 +284,6 @@ pub async fn clear_account_email() -> Result<(), String> {
     }
 }
 
-#[cfg(test)]
-mod sign_in_gate_tests {
-    use super::sign_in_required_for;
-
-    /// A key configured means the real gate, even in dev — this is how a
-    /// maintainer exercises the production sign-in path locally.
-    #[test]
-    fn a_configured_key_always_requires_sign_in() {
-        assert!(sign_in_required_for("pk_test_abc123"));
-        assert!(sign_in_required_for("pk_live_abc123"));
-    }
-
-    /// The contributor case, and the ONLY case that may bypass: a debug build
-    /// with nothing configured. Whitespace counts as nothing — a `.env` line
-    /// left as `CLERK_PUBLISHABLE_KEY= ` must not register as a real key and
-    /// lock a contributor out of a gate they have no way to satisfy.
-    #[test]
-    fn an_unset_key_bypasses_only_in_debug() {
-        let expected = !cfg!(debug_assertions);
-        assert_eq!(sign_in_required_for(""), expected);
-        assert_eq!(sign_in_required_for("   "), expected);
-        assert_eq!(sign_in_required_for("\t\n"), expected);
-    }
-
-    /// THE SHIPPING INVARIANT. A release build gates unconditionally — no key
-    /// state, env var, or file can unlock it. If this ever fails, a packaged
-    /// build can be opened without an account.
-    ///
-    /// Only meaningful under `cargo test --release`; in a debug run it asserts
-    /// the (true) claim that the release branch is compiled out. The guard is
-    /// deliberate rather than `#[cfg(not(debug_assertions))]` so the test is
-    /// visible in both modes instead of silently vanishing from the default run.
-    #[test]
-    fn a_release_build_can_never_bypass() {
-        if cfg!(debug_assertions) {
-            return;
-        }
-        for key in ["", "   ", "pk_test_abc123"] {
-            assert!(
-                sign_in_required_for(key),
-                "release build bypassed sign-in for key {key:?}"
-            );
-        }
-    }
-}
-
 #[cfg(test)]
 mod account_email_retention_tests {
     use super::*;
diff --git a/tray/src-tauri/src/commands/otp.rs b/tray/src-tauri/src/commands/otp.rs
new file mode 100644
index 000000000..82e9b9c16
--- /dev/null
+++ b/tray/src-tauri/src/commands/otp.rs
@@ -0,0 +1,360 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//! One-time email code capture — the OTP Worker client.
+//!
+//! # What this is
+//! Two commands backing the setup wizard's Email step
+//! (`ui/app/setup/signin/OtpForm.tsx`) and Settings → Account's "Change email"
+//! control (`AccountAuthControl.tsx`): send a 6-digit code to an address via
+//! `infra/otp-worker`'s `POST /otp/send`, then verify it via
+//! `POST /otp/verify`. Neither command persists anything — [`confirm_account_otp`]
+//! returns `Ok(true)`/`Ok(false)` only; the frontend calls
+//! `commands::account::save_account_email` itself after a `true` result,
+//! keeping that function's existing contract (idempotent plain-overwrite
+//! write) untouched. There is no session, no token, no expiry to manage here
+//! — the Worker is stateless from this client's point of view.
+//!
+//! # Error taxonomy
+//! Both commands return `Err(String)` with one of a small set of stable
+//! sentinel strings the frontend switches on for distinct copy (see
+//! `ui/lib/otp-errors.ts`), rather than a free-form message:
+//! `"not_configured"` (no Worker URL baked in or set — the fresh-clone dev
+//! case), `"invalid_email"`/`"invalid_input"`, `"unauthorized"` (the
+//! attestation bearer token was rejected — a build/config problem, not a
+//! user-fixable one), `"blocked"` (a Turnstile challenge attached to the
+//! request failed — unreachable today since this client doesn't send a
+//! token yet, kept for when it does), `"rate_limited"`, `"unavailable"` (the
+//! Worker/SES is down), and `"expired"` (the code was never sent, has
+//! expired, or its 5-attempt verify cap was hit — the Worker deliberately
+//! returns the same `410` for all three so a caller can never distinguish
+//! "you ran out of guesses" from "there was nothing to guess," see
+//! `infra/otp-worker/src/otp.ts`'s `VerifyOutcome` doc). Anything else
+//! (a transport failure, or a status code outside this contract) carries a
+//! diagnostic message but maps to the same generic "something went wrong"
+//! copy client-side.
+//!
+//! # Verify response body
+//! `/otp/verify`'s `200` response is NOT itself proof of a correct code — it
+//! means "the request was well-formed and a live code exists," and carries
+//! `{ ok: true, verified: bool, attemptsRemaining? }` in the body. A wrong
+//! (but well-formed) guess is `200 { verified: false }`, not an HTTP error —
+//! see `infra/otp-worker/src/index.ts`'s `handleVerify`. [`confirm_account_otp`]
+//! parses this body rather than trusting the status code alone; treating a
+//! bare `200` as "verified" would accept ANY well-formed code as correct.
+//!
+//! # Who calls this
+//! - [`request_account_otp`] / [`confirm_account_otp`]: `OtpForm.tsx` (the
+//!   wizard's Email step, and inline in `AccountAuthControl.tsx`'s
+//!   "Change email").
+//!
+//! # Related
+//! - `crate::commands::account` — `save_account_email`, called by the
+//!   frontend on a `true` verify result, never by this module.
+//! - `crate::counter_ping` — the sibling `option_env!` → resolver →
+//!   `.bearer_auth()` pattern this mirrors for `OTP_CLIENT_TOKEN`.
+
+use std::time::Duration;
+
+/// Compiled-in default Worker base URL — public (baked via
+/// `MERIDIAN_OTP_API_URL`, mirrors `MERIDIAN_CENTRAL_OTLP_ENDPOINT`'s public
+/// `vars.*` treatment, not a secret). Empty in a plain source build with no
+/// CI-injected value.
+const DEFAULT_OTP_API_URL: &str = match option_env!("MERIDIAN_OTP_API_URL") {
+    Some(v) => v,
+    None => "",
+};
+
+/// Compiled-in default bearer token — mirrors
+/// `counter_ping::DEFAULT_COUNTER_API_KEY`. This proves "a genuine Meridian
+/// binary sent this," not "this is a human" — it is attestation, not a strong
+/// secret (extractable from the shipped binary), same honesty the Worker's own
+/// docs carry. Empty in a plain source build.
+const DEFAULT_OTP_CLIENT_TOKEN: &str = match option_env!("MERIDIAN_OTP_CLIENT_TOKEN") {
+    Some(v) => v,
+    None => "",
+};
+
+/// Priority-order env resolution, factored out as a pure function so the
+/// order itself is unit-testable without mutating real process env (which is
+/// process-global and racy under cargo's parallel test threads — see
+/// `account.rs`'s own note on `MERIDIAN_SETTINGS_PATH` for the same problem).
+/// Priority: an explicit non-blank `process_env` value, then a non-blank
+/// `dotenv` value, then `default`. Blank/whitespace-only counts as absent at
+/// every step, mirroring the old `clerk_publishable_key`'s treatment of a
+/// `.env` line left as `KEY= `.
+fn resolve_priority(process_env: Option<String>, dotenv: Option<String>, default: &str) -> String {
+    if let Some(v) = process_env.filter(|s| !s.trim().is_empty()) {
+        return v;
+    }
+    if let Some(v) = dotenv.filter(|s| !s.trim().is_empty()) {
+        return v;
+    }
+    default.to_string()
+}
+
+/// Resolve the Worker base URL: the `OTP_API_URL` process env override (an
+/// explicit override — a launcher/shell export, or local testing against a
+/// different deploy) → the same key read from the current install's `.env`
+/// (`install::detect_install_mode()`, exactly the branch the old
+/// `clerk_publishable_key` took for `CLERK_PUBLISHABLE_KEY` — the tray doesn't
+/// auto-load env the way the daemon does) → the compiled-in
+/// [`DEFAULT_OTP_API_URL`]. Blank at every step means "not configured" —
+/// callers must treat that as a distinct case, not attempt a request against
+/// an empty URL.
+fn otp_api_url() -> String {
+    resolve_priority(
+        std::env::var("OTP_API_URL").ok(),
+        crate::install::detect_install_mode()
+            .env_path()
+            .and_then(|p| crate::install::env_key_from_path(p, "OTP_API_URL")),
+        DEFAULT_OTP_API_URL,
+    )
+}
+
+/// Resolve the bearer token, same three-step priority as [`otp_api_url`],
+/// env var `OTP_CLIENT_TOKEN`.
+fn otp_client_token() -> String {
+    resolve_priority(
+        std::env::var("OTP_CLIENT_TOKEN").ok(),
+        crate::install::detect_install_mode()
+            .env_path()
+            .and_then(|p| crate::install::env_key_from_path(p, "OTP_CLIENT_TOKEN")),
+        DEFAULT_OTP_CLIENT_TOKEN,
+    )
+}
+
+/// Trim, lowercase, and reject anything without an `@` that has at least one
+/// character on either side. Pure and unit-tested — the Worker does its own
+/// stricter validation server-side; this only avoids sending obviously
+/// malformed input and normalizes casing so `Foo@Bar.com` and `foo@bar.com`
+/// hit the same KV rate-limit bucket (keyed on `sha256(normalize(email))`
+/// Worker-side).
+fn normalize_email(raw: &str) -> Option<String> {
+    let trimmed = raw.trim();
+    if trimmed.is_empty() {
+        return None;
+    }
+    let lower = trimmed.to_lowercase();
+    let at = lower.find('@')?;
+    if at == 0 || at == lower.len() - 1 {
+        return None;
+    }
+    Some(lower)
+}
+
+/// Map `/otp/send`'s response status to this command's outcome. Split out
+/// from [`request_account_otp`] so the mapping itself is unit-testable
+/// without a network call. `403` is a failed Turnstile challenge
+/// (`infra/otp-worker/src/index.ts`'s `handleSend`) — distinct from `401`'s
+/// "the bearer token itself was rejected" — kept as its own sentinel even
+/// though this client doesn't attach a Turnstile token yet, so the mapping
+/// stays correct the day it does.
+fn map_send_status(status: u16) -> Result<(), String> {
+    match status {
+        200..=299 => Ok(()),
+        400 => Err("invalid_email".into()),
+        401 => Err("unauthorized".into()),
+        403 => Err("blocked".into()),
+        429 => Err("rate_limited".into()),
+        503 => Err("unavailable".into()),
+        other => Err(format!("unexpected_status:{other}")),
+    }
+}
+
+/// Body shape of a `200` response from `/otp/verify`
+/// (`infra/otp-worker/src/index.ts`'s `handleVerify`/`ok({verified, ...})`).
+/// `attempts_remaining` is available but not surfaced by this command today —
+/// see the module doc.
+#[derive(serde::Deserialize)]
+struct VerifyResponseBody {
+    verified: bool,
+}
+
+/// Map `/otp/verify`'s response to this command's outcome. A `200` status is
+/// NOT itself "verified" — see the module doc's "Verify response body"
+/// section — so this parses `body` rather than trusting the status code
+/// alone. A wrong-but-well-formed code is `200 { verified: false }`, decoded
+/// here as `Ok(false)`: an expected, retryable outcome the frontend already
+/// has copy for, never an `Err`. `410` covers both "the 5-attempt cap was
+/// hit" and "no live code for this email" (never sent, or expired) —
+/// deliberately indistinguishable Worker-side, so both map to `"expired"`.
+fn map_verify_status(status: u16, body: &str) -> Result<bool, String> {
+    match status {
+        200 => serde_json::from_str::<VerifyResponseBody>(body)
+            .map(|b| b.verified)
+            .map_err(|e| format!("malformed_response:{e}")),
+        400 => Err("invalid_input".into()),
+        401 => Err("unauthorized".into()),
+        410 => Err("expired".into()),
+        429 => Err("rate_limited".into()),
+        503 => Err("unavailable".into()),
+        other => Err(format!("unexpected_status:{other}")),
+    }
+}
+
+/// Send a fresh 6-digit code to `email` via the Worker's `/otp/send`. Returns
+/// `Err("not_configured")` immediately (no network call) when no Worker URL
+/// is resolved — see the module doc's error taxonomy, and `OtpForm.tsx`'s
+/// handling of that specific case (a dev-notice, not a user-facing failure).
+#[tauri::command]
+#[tracing::instrument(skip(email), err)]
+pub async fn request_account_otp(email: String) -> Result<(), String> {
+    let email = normalize_email(&email).ok_or("invalid_email")?;
+    let base = otp_api_url();
+    if base.is_empty() {
+        tracing::info!("request_account_otp: no OTP_API_URL configured — not_configured");
+        return Err("not_configured".into());
+    }
+    let resp = reqwest::Client::new()
+        .post(format!("{base}/otp/send"))
+        .bearer_auth(otp_client_token())
+        .json(&serde_json::json!({ "email": email }))
+        .timeout(Duration::from_secs(10))
+        .send()
+        .await
+        .map_err(|e| {
+            tracing::warn!(error = %e, "request_account_otp: request failed");
+            format!("request_failed:{e}")
+        })?;
+    map_send_status(resp.status().as_u16())
+}
+
+/// Verify `code` for `email` via the Worker's `/otp/verify`. `Ok(true)` means
+/// verified — the frontend is responsible for calling
+/// `commands::account::save_account_email` next, this command does not.
+/// `Ok(false)` means the code was wrong but the attempt was otherwise valid
+/// (retryable). Returns `Err("not_configured")` immediately when no Worker
+/// URL is resolved, same as [`request_account_otp`].
+#[tauri::command]
+#[tracing::instrument(skip(email, code), err)]
+pub async fn confirm_account_otp(email: String, code: String) -> Result<bool, String> {
+    let email = normalize_email(&email).ok_or("invalid_email")?;
+    let code = code.trim();
+    if code.is_empty() {
+        return Err("invalid_input".into());
+    }
+    let base = otp_api_url();
+    if base.is_empty() {
+        tracing::info!("confirm_account_otp: no OTP_API_URL configured — not_configured");
+        return Err("not_configured".into());
+    }
+    let resp = reqwest::Client::new()
+        .post(format!("{base}/otp/verify"))
+        .bearer_auth(otp_client_token())
+        .json(&serde_json::json!({ "email": email, "code": code }))
+        .timeout(Duration::from_secs(10))
+        .send()
+        .await
+        .map_err(|e| {
+            tracing::warn!(error = %e, "confirm_account_otp: request failed");
+            format!("request_failed:{e}")
+        })?;
+    let status = resp.status().as_u16();
+    let body = resp.text().await.unwrap_or_default();
+    map_verify_status(status, &body)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn normalize_email_trims_and_lowercases() {
+        assert_eq!(
+            normalize_email("  Foo@Bar.COM  "),
+            Some("foo@bar.com".to_string())
+        );
+    }
+
+    #[test]
+    fn normalize_email_rejects_empty_or_missing_at() {
+        assert_eq!(normalize_email(""), None);
+        assert_eq!(normalize_email("   "), None);
+        assert_eq!(normalize_email("not-an-email"), None);
+    }
+
+    #[test]
+    fn normalize_email_rejects_at_on_either_edge() {
+        assert_eq!(normalize_email("@bar.com"), None);
+        assert_eq!(normalize_email("foo@"), None);
+    }
+
+    #[test]
+    fn normalize_email_accepts_a_minimal_valid_address() {
+        assert_eq!(normalize_email("a@b"), Some("a@b".to_string()));
+    }
+
+    /// Priority order: process env wins over dotenv, dotenv wins over default.
+    #[test]
+    fn resolve_priority_prefers_process_env_over_dotenv_over_default() {
+        assert_eq!(
+            resolve_priority(Some("process".into()), Some("dotenv".into()), "default"),
+            "process"
+        );
+        assert_eq!(
+            resolve_priority(None, Some("dotenv".into()), "default"),
+            "dotenv"
+        );
+        assert_eq!(resolve_priority(None, None, "default"), "default");
+    }
+
+    /// Whitespace-only values at any step count as absent — a `.env` line left
+    /// as `OTP_API_URL= ` must not shadow a real default, mirroring the old
+    /// `clerk_publishable_key`'s treatment of the same case.
+    #[test]
+    fn resolve_priority_treats_blank_values_as_absent() {
+        assert_eq!(
+            resolve_priority(Some("   ".into()), Some("dotenv".into()), "default"),
+            "dotenv"
+        );
+        assert_eq!(
+            resolve_priority(Some("\t\n".into()), Some("  ".into()), "default"),
+            "default"
+        );
+    }
+
+    #[test]
+    fn map_send_status_matches_the_documented_contract() {
+        assert_eq!(map_send_status(200), Ok(()));
+        assert_eq!(map_send_status(204), Ok(()));
+        assert_eq!(map_send_status(400), Err("invalid_email".to_string()));
+        assert_eq!(map_send_status(401), Err("unauthorized".to_string()));
+        assert_eq!(map_send_status(403), Err("blocked".to_string()));
+        assert_eq!(map_send_status(429), Err("rate_limited".to_string()));
+        assert_eq!(map_send_status(503), Err("unavailable".to_string()));
+        assert!(map_send_status(500).is_err());
+    }
+
+    /// The bug this pins: a `200` status is NOT itself "verified" — the
+    /// Worker returns `200 { verified: false }` for a wrong-but-well-formed
+    /// code (`infra/otp-worker/src/index.ts`'s `handleVerify`). Trusting the
+    /// status code alone would accept ANY well-formed code as correct.
+    #[test]
+    fn map_verify_status_reads_the_body_not_just_the_status() {
+        assert_eq!(
+            map_verify_status(200, r#"{"ok":true,"verified":true}"#),
+            Ok(true)
+        );
+        assert_eq!(
+            map_verify_status(200, r#"{"ok":true,"verified":false,"attemptsRemaining":4}"#),
+            Ok(false)
+        );
+    }
+
+    #[test]
+    fn map_verify_status_rejects_a_malformed_200_body() {
+        assert!(map_verify_status(200, "not json").is_err());
+        assert!(map_verify_status(200, "{}").is_err());
+    }
+
+    #[test]
+    fn map_verify_status_matches_the_documented_contract() {
+        assert_eq!(map_verify_status(400, ""), Err("invalid_input".to_string()));
+        assert_eq!(map_verify_status(401, ""), Err("unauthorized".to_string()));
+        // 410 covers BOTH the 5-attempt cap and "no live code for this
+        // email" — the Worker deliberately makes these indistinguishable.
+        assert_eq!(map_verify_status(410, ""), Err("expired".to_string()));
+        assert_eq!(map_verify_status(429, ""), Err("rate_limited".to_string()));
+        assert_eq!(map_verify_status(503, ""), Err("unavailable".to_string()));
+        assert!(map_verify_status(500, "").is_err());
+    }
+}
diff --git a/tray/src-tauri/src/install.rs b/tray/src-tauri/src/install.rs
index 29a8f2d9c..ed4c8dcdd 100644
--- a/tray/src-tauri/src/install.rs
+++ b/tray/src-tauri/src/install.rs
@@ -345,7 +345,7 @@ fn dotenv_line_value(line: &str, key: &str) -> Option<String> {
 /// tray does NOT auto-load env into its own process; see the crate-level
 /// gotcha in CLAUDE.md). Used wherever a command needs one credential from
 /// [`InstallMode::env_path`] — e.g. `commands::integrations`'s tracker keys,
-/// `commands::account::clerk_publishable_key`.
+/// `commands::otp::otp_api_url`/`otp_client_token`.
 pub(crate) fn env_key_from_path(path: &std::path::Path, key: &str) -> Option<String> {
     let contents = std::fs::read_to_string(path).ok()?;
     contents.lines().find_map(|l| dotenv_line_value(l, key))
diff --git a/tray/src-tauri/src/lib.rs b/tray/src-tauri/src/lib.rs
index f366137a4..19f772793 100644
--- a/tray/src-tauri/src/lib.rs
+++ b/tray/src-tauri/src/lib.rs
@@ -303,34 +303,6 @@ pub fn run() {
     if let Some(client) = &sentry_client {
         builder = builder.plugin(tauri_plugin_sentry::init(client));
     }
-    // Clerk email sign-in on the setup wizard (see commands::account and
-    // ui/app/setup/signin.tsx). `ClerkPluginBuilder::build()` HARD-FAILS
-    // `.setup()` (killing the whole tray, not just sign-in) when the
-    // publishable key is empty or malformed — so, like the notifications
-    // plugin below, this only registers when a real key is configured. A
-    // source build with no `MERIDIAN_CLERK_PUBLISHABLE_KEY` baked in and no
-    // `CLERK_PUBLISHABLE_KEY` env override degrades to no Clerk plugin at
-    // all; `signin.tsx`'s `SignInGate` catches `initClerk()` failing to find
-    // the plugin and shows a message instead of hanging. `tauri_plugin_http`
-    // is the transport the Clerk plugin patches `fetch` through;
-    // `tauri_plugin_store` gives it persistent session storage so a relaunch
-    // doesn't force re-login.
-    let clerk_key = commands::account::clerk_publishable_key();
-    if !clerk_key.is_empty() {
-        builder = builder
-            .plugin(tauri_plugin_http::init())
-            .plugin(tauri_plugin_store::Builder::new().build())
-            .plugin(
-                tauri_plugin_clerk::ClerkPluginBuilder::new()
-                    .publishable_key(clerk_key)
-                    .with_tauri_store()
-                    .build(),
-            );
-    } else {
-        tracing::info!(
-            "no Clerk publishable key configured — Clerk plugin not registered, setup wizard sign-in unavailable"
-        );
-    }
     // Interactive notifications (UNUserNotificationCenter via the community
     // notifications plugin). Its init HARD-FAILS outside a `.app` bundle, which
     // would crash `tauri dev` / `cargo run` — so it's registered only when
@@ -1399,7 +1371,8 @@ pub fn run() {
             commands::get_platform,
             commands::save_account_email,
             commands::get_account_email,
-            commands::sign_in_required,
+            commands::request_account_otp,
+            commands::confirm_account_otp,
             commands::clear_account_email,
             commands::check_accessibility,
             commands::check_screen_recording,
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/Cargo.toml b/tray/src-tauri/vendor/tauri-plugin-clerk/Cargo.toml
deleted file mode 100644
index 393626b82..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/Cargo.toml
+++ /dev/null
@@ -1,29 +0,0 @@
-[package]
-name = "tauri-plugin-clerk"
-version = "0.1.1"
-authors = ["@Nipsuli"]
-homepage = "https://github.com/Nipsuli/tauri-plugin-clerk/"
-repository = "https://github.com/Nipsuli/tauri-plugin-clerk/"
-description = "An unofficial Tauri SDK for Clerk"
-keywords = ["clerk", "tauri", "auth", "frontend"]
-edition = "2021"
-exclude = ["/examples", "/dist-js", "/guest-js", "/node_modules"]
-links = "tauri-plugin-clerk"
-license = "MIT"
-
-[dependencies]
-tauri = { version = "2" }
-serde = "1.0"
-thiserror = "2"
-clerk-fapi-rs = "0.2.0"
-tokio = { version = "1", features = ["sync"] }
-tracing = "0.1.41"
-parking_lot = "0.12"
-tauri-plugin-http = { version = "2.4", features = ['unsafe-headers'] }
-serde_json = "1.0.140"
-serde_path_to_error = "0.1"
-log = "0.4"
-tauri-plugin-store = "2"
-
-[build-dependencies]
-tauri-plugin = { version = "2.1.1", features = ["build"] }
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/LICENSE b/tray/src-tauri/vendor/tauri-plugin-clerk/LICENSE
deleted file mode 100644
index f065734c7..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/LICENSE
+++ /dev/null
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025 Niko Korvenlaita
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/README.md b/tray/src-tauri/vendor/tauri-plugin-clerk/README.md
deleted file mode 100644
index 16055d0e7..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/README.md
+++ /dev/null
@@ -1,182 +0,0 @@
-# Clerk Tauri SDK
-
-> **Meridian note - this is a vendored, patched copy of upstream 0.1.1, not the
-> crates.io release.** It carries a fix for
-> [issue #7](https://github.com/Nipsuli/tauri-plugin-clerk/issues/7), without
-> which a signed-in session is never written to the offline cache and the app
-> shows signed-out after a relaunch. `tray/src-tauri/Cargo.toml` therefore
-> depends on it by path (`tauri-plugin-clerk = { path =
-> "vendor/tauri-plugin-clerk" }`) - **do not follow the `cargo add` line below,
-> and do not swap the path dependency back to a registry version until a
-> release contains that fix**, or the bug returns silently. See
-> `src/lib.rs`'s module doc for the full writeup and the un-vendor plan. The
-> rest of this file is upstream's, unedited.
-
-Community maintained Clerk SDK for Tauri apps.
-
-There's also platform agnostic Rust implementations of
-[Clerk's Frontend API (FAPI)](https://github.com/Nipsuli/clerk-fapi-rs) and
-[Clerk's Backend API (BAPI)](https://github.com/DarrenBaldwin07/clerk-rs)
-available.
-
-This package is in use in production at [reconfigured](https://reconfigured.io/)
-
-## Usage
-
-Install both the Rust and js packages:
-
-In the `src-tauri` directory
-
-```bash
-cargo add tauri-plugin-clerk
-```
-
-In the app directory
-
-```bash
-npm install tauri-plugin-clerk
-```
-
-Add `clerk:default` to the permissions. And ensure the `http` permissions allow
-connecting to your Clerk host. Simple `src-tauri/capabilities/default.json`
-
-```json
-{
-  "$schema": "../gen/schemas/desktop-schema.json",
-  "identifier": "default",
-  "description": "",
-  "windows": ["main"],
-  "permissions": [
-    "clerk:default",
-    {
-      "identifier": "http:default",
-      "allow": [
-        {
-          "url": "https://*"
-        }
-      ]
-    }
-    ... rest of the permissions
-  ],
-}
-```
-
-Initialize the plugin on the tauri entrypoint
-
-```rs
-#[cfg_attr(mobile, tauri::mobile_entry_point)]
-pub fn run() {
-    let clerk_publishable_key = todo!("Load the way you want");
-
-    tauri::Builder::default()
-        // needed for the request routing
-        .plugin(tauri_plugin_http::init())
-        // Optional if one wants to persist the auth state
-        .plugin(tauri_plugin_store::Builder::new().build())
-        .plugin(
-            tauri_plugin_clerk::ClerkPluginBuilder::new()
-                .publishable_key(clerk_publishable_key)
-                // Optional if one wants to persist the auth state
-                .with_tauri_store()
-                .build(),
-        )
-        // All the other plugins etc
-        .run(tauri::generate_context!())
-        .expect("error while running tauri application");
-}
-```
-
-Example minimal client with React
-
-```tsx
-import type { Clerk } from "@clerk/clerk-js";
-import { ClerkProvider } from "@clerk/react";
-import { initClerk } from "tauri-plugin-clerk";
-
-export const App = () => {
-  const clerkPromise = initClerk();
-  return (
-    <Suspense fallback={<div>loading...</div>}>
-      <AppWithClerk clerkPromise={clerkPromise} />
-    </Suspense>
-  );
-};
-
-const AppLoaded = ({ clerkPromise }: { clerkPromise: Promise<Clerk> }) => {
-  const clerk = use(clerkPromise);
-  return (
-    <ClerkProvider publishableKey={clerk.publishableKey} Clerk={clerk}>
-      <ActualApp />
-    </ClerkProvider>
-  );
-};
-```
-
-See examples for more
-
-## Core Idea
-
-The Javascript side of Clerk is the one that orchestrates everything but the
-auth state is propagated to Rust side as well so one can get the current auth
-state in rust code as well. The syncing of client state from rust side back to
-javascript is still in the works.
-
-One can use the js side Clerk functionality almost as in browser environment and
-in combination of other Clerk frontend SDK's such as `@clerk/react`
-
-Some limitations:
-
-- OAuth flows do not work in the default signin component. Haven't figured out a
-  good way to do those in Tauri, one might be able to build custom auth flow for
-  that, haven't tested yet.
-- Magic links don't work, haven't figured out a way to make those work in Tauri
-- DomainOrProxy is not yet implemented
-
-## Notes
-
-Due to some limitations of Tauri platform:
-
-- Requires `tauri_plugin_http` to be initialized
-- This package patches `globalThis.fetch` to be able to route Clerk calls via
-  rust
-
-## Why this package works the way it does?
-
-As tauri uses native webview (=browser) the first question easily is why is this
-package needed? The reason why one cannot use the default Clerk web packages is
-how web views on different platform deals with cookies. Example on mac cookies
-do not work on custom domains such as Tauri uses. One way around this is to
-patch `document.cookies` but that leaves the authenticated state only on the
-client side and would still require patching fetch calls to intercept cookies.
-Another solution is to have the the authentication state fully on rust side and
-for that there is [clerk-fapi-rs](https://crates.io/crates/clerk-fapi-rs) which
-works well with Tauri in case one is building more rust heavy Tauri app.
-
-The solution this package takes is to patch global fetch and pipe fetch calls
-that have `x-tauri-fetch` header through
-[tauri-plugin-http](https://crates.io/crates/tauri-plugin-http) this is because
-of the limitations of the the API resulting in error if one just appends the JWT
-token in client side calls:
-
-```json
-{
-  "errors": [
-    {
-      "message": "Setting both the 'Origin' and 'Authorization' headers is forbidden",
-      "long_message": "For security purposes, only one of the 'Origin' and 'Authorization' headers should be provided, but not both. In browser contexts, the 'Origin' header is set automatically by the browser. In native application contexts (e.g. mobile apps), set the 'Authorization' header.",
-      "code": "origin_authorization_headers_conflict"
-    }
-  ],
-  "clerk_trace_id": "..."
-}
-```
-
-By patching the global fetch to direct api calls through rust we can use the
-Clerk javascript package as is and hook to the `onBeforeRequest` and
-`onAfterResponse` hooks similarly as in the Clerk expo package does. In addition
-this package allows one to persist the Clerk session on disk to maintain the
-login state.
-
-## Contributing
-
-Contributions in form of issues and prs are welcome.
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/build.rs b/tray/src-tauri/vendor/tauri-plugin-clerk/build.rs
deleted file mode 100644
index bcf8d1145..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/build.rs
+++ /dev/null
@@ -1,13 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-const COMMANDS: &[&str] = &[
-    "initialize",
-    "set_client_authorization_header",
-    "get_client_authorization_header",
-];
-
-fn main() {
-    tauri_plugin::Builder::new(COMMANDS)
-        .android_path("android")
-        .ios_path("ios")
-        .build();
-}
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/get_client_authorization_header.toml b/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/get_client_authorization_header.toml
deleted file mode 100644
index 1420902ea..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/get_client_authorization_header.toml
+++ /dev/null
@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-client-authorization-header"
-description = "Enables the get_client_authorization_header command without any pre-configured scope."
-commands.allow = ["get_client_authorization_header"]
-
-[[permission]]
-identifier = "deny-get-client-authorization-header"
-description = "Denies the get_client_authorization_header command without any pre-configured scope."
-commands.deny = ["get_client_authorization_header"]
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/initialize.toml b/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/initialize.toml
deleted file mode 100644
index 73961d137..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/initialize.toml
+++ /dev/null
@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-initialize"
-description = "Enables the initialize command without any pre-configured scope."
-commands.allow = ["initialize"]
-
-[[permission]]
-identifier = "deny-initialize"
-description = "Denies the initialize command without any pre-configured scope."
-commands.deny = ["initialize"]
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/set_client_authorization_header.toml b/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/set_client_authorization_header.toml
deleted file mode 100644
index 01050a6ea..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/commands/set_client_authorization_header.toml
+++ /dev/null
@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-set-client-authorization-header"
-description = "Enables the set_client_authorization_header command without any pre-configured scope."
-commands.allow = ["set_client_authorization_header"]
-
-[[permission]]
-identifier = "deny-set-client-authorization-header"
-description = "Denies the set_client_authorization_header command without any pre-configured scope."
-commands.deny = ["set_client_authorization_header"]
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/reference.md b/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/reference.md
deleted file mode 100644
index a9fda7236..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/autogenerated/reference.md
+++ /dev/null
@@ -1,108 +0,0 @@
-## Default Permission
-
-Default permissions for the plugin
-
-#### This default permission set includes the following:
-
-- `allow-client`
-
-## Permission Table
-
-<table>
-<tr>
-<th>Identifier</th>
-<th>Description</th>
-</tr>
-
-
-<tr>
-<td>
-
-`clerk:allow-get-client-authorization-header`
-
-</td>
-<td>
-
-Enables the get_client_authorization_header command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`clerk:deny-get-client-authorization-header`
-
-</td>
-<td>
-
-Denies the get_client_authorization_header command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`clerk:allow-initialize`
-
-</td>
-<td>
-
-Enables the initialize command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`clerk:deny-initialize`
-
-</td>
-<td>
-
-Denies the initialize command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`clerk:allow-set-client-authorization-header`
-
-</td>
-<td>
-
-Enables the set_client_authorization_header command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`clerk:deny-set-client-authorization-header`
-
-</td>
-<td>
-
-Denies the set_client_authorization_header command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`clerk:allow-client`
-
-</td>
-<td>
-
-Enables use of Clerk in JS code
-
-</td>
-</tr>
-</table>
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/default.toml b/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/default.toml
deleted file mode 100644
index 7d6aac964..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/default.toml
+++ /dev/null
@@ -1,14 +0,0 @@
-"$schema" = "schemas/schema.json"
-
-[default]
-description = "Default permissions for the plugin"
-permissions = ["allow-client"]
-
-[[permission]]
-identifier = "allow-client"
-description = "Enables use of Clerk in JS code"
-commands.allow = [
-    "initialize",
-    "get_client_authorization_header",
-    "set_client_authorization_header",
-]
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/schemas/schema.json b/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/schemas/schema.json
deleted file mode 100644
index f6015e4ce..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/permissions/schemas/schema.json
+++ /dev/null
@@ -1,348 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "PermissionFile",
-  "description": "Permission file that can define a default permission, a set of permissions or a list of inlined permissions.",
-  "type": "object",
-  "properties": {
-    "default": {
-      "description": "The default permission set for the plugin",
-      "anyOf": [
-        {
-          "$ref": "#/definitions/DefaultPermission"
-        },
-        {
-          "type": "null"
-        }
-      ]
-    },
-    "set": {
-      "description": "A list of permissions sets defined",
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/PermissionSet"
-      }
-    },
-    "permission": {
-      "description": "A list of inlined permissions",
-      "default": [],
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/Permission"
-      }
-    }
-  },
-  "definitions": {
-    "DefaultPermission": {
-      "description": "The default permission set of the plugin.\n\nWorks similarly to a permission with the \"default\" identifier.",
-      "type": "object",
-      "required": [
-        "permissions"
-      ],
-      "properties": {
-        "version": {
-          "description": "The version of the permission.",
-          "type": [
-            "integer",
-            "null"
-          ],
-          "format": "uint64",
-          "minimum": 1.0
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does. Tauri convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "permissions": {
-          "description": "All permissions this set contains.",
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "PermissionSet": {
-      "description": "A set of direct permissions grouped together under a new name.",
-      "type": "object",
-      "required": [
-        "description",
-        "identifier",
-        "permissions"
-      ],
-      "properties": {
-        "identifier": {
-          "description": "A unique identifier for the permission.",
-          "type": "string"
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does.",
-          "type": "string"
-        },
-        "permissions": {
-          "description": "All permissions this set contains.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/PermissionKind"
-          }
-        }
-      }
-    },
-    "Permission": {
-      "description": "Descriptions of explicit privileges of commands.\n\nIt can enable commands to be accessible in the frontend of the application.\n\nIf the scope is defined it can be used to fine grain control the access of individual or multiple commands.",
-      "type": "object",
-      "required": [
-        "identifier"
-      ],
-      "properties": {
-        "version": {
-          "description": "The version of the permission.",
-          "type": [
-            "integer",
-            "null"
-          ],
-          "format": "uint64",
-          "minimum": 1.0
-        },
-        "identifier": {
-          "description": "A unique identifier for the permission.",
-          "type": "string"
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does. Tauri internal convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "commands": {
-          "description": "Allowed or denied commands when using this permission.",
-          "default": {
-            "allow": [],
-            "deny": []
-          },
-          "allOf": [
-            {
-              "$ref": "#/definitions/Commands"
-            }
-          ]
-        },
-        "scope": {
-          "description": "Allowed or denied scoped when using this permission.",
-          "allOf": [
-            {
-              "$ref": "#/definitions/Scopes"
-            }
-          ]
-        },
-        "platforms": {
-          "description": "Target platforms this permission applies. By default all platforms are affected by this permission.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Target"
-          }
-        }
-      }
-    },
-    "Commands": {
-      "description": "Allowed and denied commands inside a permission.\n\nIf two commands clash inside of `allow` and `deny`, it should be denied by default.",
-      "type": "object",
-      "properties": {
-        "allow": {
-          "description": "Allowed command.",
-          "default": [],
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "deny": {
-          "description": "Denied command, which takes priority.",
-          "default": [],
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "Scopes": {
-      "description": "An argument for fine grained behavior control of Tauri commands.\n\nIt can be of any serde serializable type and is used to allow or prevent certain actions inside a Tauri command. The configured scope is passed to the command and will be enforced by the command implementation.\n\n## Example\n\n```json { \"allow\": [{ \"path\": \"$HOME/**\" }], \"deny\": [{ \"path\": \"$HOME/secret.txt\" }] } ```",
-      "type": "object",
-      "properties": {
-        "allow": {
-          "description": "Data that defines what is allowed by the scope.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        },
-        "deny": {
-          "description": "Data that defines what is denied by the scope. This should be prioritized by validation logic.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        }
-      }
-    },
-    "Value": {
-      "description": "All supported ACL values.",
-      "anyOf": [
-        {
-          "description": "Represents a null JSON value.",
-          "type": "null"
-        },
-        {
-          "description": "Represents a [`bool`].",
-          "type": "boolean"
-        },
-        {
-          "description": "Represents a valid ACL [`Number`].",
-          "allOf": [
-            {
-              "$ref": "#/definitions/Number"
-            }
-          ]
-        },
-        {
-          "description": "Represents a [`String`].",
-          "type": "string"
-        },
-        {
-          "description": "Represents a list of other [`Value`]s.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        },
-        {
-          "description": "Represents a map of [`String`] keys to [`Value`]s.",
-          "type": "object",
-          "additionalProperties": {
-            "$ref": "#/definitions/Value"
-          }
-        }
-      ]
-    },
-    "Number": {
-      "description": "A valid ACL number.",
-      "anyOf": [
-        {
-          "description": "Represents an [`i64`].",
-          "type": "integer",
-          "format": "int64"
-        },
-        {
-          "description": "Represents a [`f64`].",
-          "type": "number",
-          "format": "double"
-        }
-      ]
-    },
-    "Target": {
-      "description": "Platform target.",
-      "oneOf": [
-        {
-          "description": "MacOS.",
-          "type": "string",
-          "enum": [
-            "macOS"
-          ]
-        },
-        {
-          "description": "Windows.",
-          "type": "string",
-          "enum": [
-            "windows"
-          ]
-        },
-        {
-          "description": "Linux.",
-          "type": "string",
-          "enum": [
-            "linux"
-          ]
-        },
-        {
-          "description": "Android.",
-          "type": "string",
-          "enum": [
-            "android"
-          ]
-        },
-        {
-          "description": "iOS.",
-          "type": "string",
-          "enum": [
-            "iOS"
-          ]
-        }
-      ]
-    },
-    "PermissionKind": {
-      "type": "string",
-      "oneOf": [
-        {
-          "description": "Enables the get_client_authorization_header command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-get-client-authorization-header",
-          "markdownDescription": "Enables the get_client_authorization_header command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the get_client_authorization_header command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-get-client-authorization-header",
-          "markdownDescription": "Denies the get_client_authorization_header command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the initialize command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-initialize",
-          "markdownDescription": "Enables the initialize command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the initialize command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-initialize",
-          "markdownDescription": "Denies the initialize command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the set_client_authorization_header command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-set-client-authorization-header",
-          "markdownDescription": "Enables the set_client_authorization_header command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the set_client_authorization_header command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-set-client-authorization-header",
-          "markdownDescription": "Denies the set_client_authorization_header command without any pre-configured scope."
-        },
-        {
-          "description": "Default permissions for the plugin\n#### This default permission set includes:\n\n- `allow-client`",
-          "type": "string",
-          "const": "default",
-          "markdownDescription": "Default permissions for the plugin\n#### This default permission set includes:\n\n- `allow-client`"
-        },
-        {
-          "description": "Enables use of Clerk in JS code",
-          "type": "string",
-          "const": "allow-client",
-          "markdownDescription": "Enables use of Clerk in JS code"
-        }
-      ]
-    }
-  }
-}
\ No newline at end of file
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/src/commands.rs b/tray/src-tauri/vendor/tauri-plugin-clerk/src/commands.rs
deleted file mode 100644
index f0647a9a3..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/src/commands.rs
+++ /dev/null
@@ -1,64 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-use crate::ClerkExt;
-use clerk_fapi_rs::models::{ClientClient, ClientEnvironment};
-use serde::{Deserialize, Serialize};
-use tauri::{AppHandle, Runtime};
-
-/// Need to keep in sync with ClerkInitResponse in
-/// guest-js/sync.ts
-#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub(crate) struct ClerkInitResponse {
-    environment: ClientEnvironment,
-    client: ClientClient,
-    publishable_key: String,
-    // TODO: DomainOrProxyUrl
-    /* ts side
-    export type DomainOrProxyUrl =
-      | {
-          /**
-           * **Required for applications that run behind a reverse proxy**. The URL that Clerk will proxy requests to. Can be either a relative path (`/__clerk`) or a full URL (`https://<your-domain>/__clerk`).
-           */
-          proxyUrl?: never;
-          /**
-           * **Required if your application is a satellite application**. Sets the domain of the satellite application.
-           */
-          domain?: string | ((url: URL) => string);
-        }
-      | {
-          proxyUrl?: string | ((url: URL) => string);
-          domain?: never;
-        };
-    */
-}
-
-/// Authorization header to be injected in clerk-js __unstable__onBeforeRequest
-#[tauri::command]
-pub(crate) async fn get_client_authorization_header<R: Runtime>(
-    app: AppHandle<R>,
-) -> Option<String> {
-    app.clerk().get_client_authorization_header()
-}
-
-/// Authorization header read in __unstable__onAfterResponse
-#[tauri::command]
-pub(crate) async fn set_client_authorization_header<R: Runtime>(
-    app: AppHandle<R>,
-    header: Option<String>,
-) -> () {
-    app.clerk().set_client_authorization_header(header)
-}
-
-#[tauri::command]
-pub(crate) async fn initialize<R: Runtime>(app: AppHandle<R>) -> Result<ClerkInitResponse, String> {
-    app.ensure_clerk_initialized().await?;
-    let client = app.clerk().client().map_err(|e| e.to_string())?;
-    let environment = app.clerk().environment().map_err(|e| e.to_string())?;
-    let publishable_key = app.clerk_store().publishable_key;
-
-    Ok(ClerkInitResponse {
-        environment,
-        client,
-        publishable_key,
-    })
-}
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/src/events.rs b/tray/src-tauri/vendor/tauri-plugin-clerk/src/events.rs
deleted file mode 100644
index 5ee4b72e2..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/src/events.rs
+++ /dev/null
@@ -1,52 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-use clerk_fapi_rs::models::{ClientClient, ClientOrganization, ClientSession, ClientUser};
-use serde::{Deserialize, Serialize};
-use tauri::{AppHandle, Emitter, Runtime};
-
-pub const CLERK_AUTH_EVENT_NAME: &str = "plugin-clerk-auth-cb";
-pub const RUST_EVENT_SOURCE: &str = "rust";
-
-/// Need to be in sync with ClerkAuthEventPayload in
-/// guest-js/sync.ts
-#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
-pub struct ClerkAuthEventPayload {
-    pub client: ClientClient,
-    pub session: Option<ClientSession>,
-    pub user: Option<ClientUser>,
-    pub organization: Option<ClientOrganization>,
-}
-/// Need to be in sync with ClerkAuthEvent in
-/// guest-js/sync.ts
-#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
-pub struct ClerkAuthEvent {
-    // Window name or "rust" to identify sender
-    pub source: String,
-    pub payload: ClerkAuthEventPayload,
-}
-
-pub fn emit_clerk_auth_event<R: Runtime>(app: AppHandle<R>, payload: ClerkAuthEventPayload) {
-    // MERIDIAN PATCH: upstream logged the whole payload here with `{payload:?}`.
-    // `ClientSession` carries `last_active_token.jwt` — a live session
-    // credential — so that line writes a bearer token into whatever sink the
-    // `log` facade is wired to. It is inert today (nothing installs a `log`
-    // logger, and no `LogTracer` bridge exists), but this crate is now on
-    // `CAPTURE_TARGETS` in `src/observability/filter.rs`, so the day anyone adds
-    // `tauri-plugin-log` or a bridge, those tokens land in the full-fidelity
-    // local telemetry spool. Log presence, never contents.
-    tracing::debug!(
-        has_session = payload.session.is_some(),
-        has_user = payload.user.is_some(),
-        has_organization = payload.organization.is_some(),
-        "clerk: emitting auth event"
-    );
-
-    if let Err(e) = app.emit(
-        CLERK_AUTH_EVENT_NAME,
-        ClerkAuthEvent {
-            source: RUST_EVENT_SOURCE.to_string(),
-            payload,
-        },
-    ) {
-        tracing::error!(error = %e, "clerk: failed to emit auth change event");
-    }
-}
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/src/json_backfill.rs b/tray/src-tauri/vendor/tauri-plugin-clerk/src/json_backfill.rs
deleted file mode 100644
index bb26afc78..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/src/json_backfill.rs
+++ /dev/null
@@ -1,1385 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Backfills fields guest-js's Clerk-object serializers omit but
-//! `clerk-fapi-rs`'s OpenAPI-generated models require present — see the
-//! parent module doc (`lib.rs`) for the full incident writeup and
-//! <https://github.com/Nipsuli/tauri-plugin-clerk/issues/7> for the upstream
-//! report this mirrors.
-//!
-//! # Design: dispatch on the `"object"` discriminator, not a path list
-//! Every Clerk-serialized JSON object carries an `"object"` field naming its
-//! own type (`"email_address"`, `"user"`, `"session"`, …) — see
-//! `clerkClientToClientJSON` and friends in the `tauri-plugin-clerk` npm
-//! package's `guest-js/clerk-utils.ts`. [`backfill_clerk_client_json`] walks
-//! the whole tree recursively and, at every object, dispatches on that
-//! discriminator rather than a hardcoded field path (`client.sessions[].user…`).
-//! That means it also covers `email_addresses`/`phone_numbers`/`web3_wallets`
-//! nested inside `sign_in`/`sign_up` (not just the top-level user), and any
-//! future nesting depth, without new cases — the same objects need the same
-//! defaults wherever they appear.
-
-use serde_json::{json, Map, Value};
-
-/// Object-type-keyed field defaults, applied only when the key is ABSENT
-/// (never overwrites a value guest-js did emit). Timestamp fields
-/// (`created_at`/`updated_at`/`last_active_at`/`expire_at`/`abandon_at`) are
-/// handled separately below since that's a float-to-int conversion on a
-/// PRESENT value, not a missing-key backfill.
-type FieldDefault = (&'static str, fn() -> Value);
-
-fn defaults_for(object_type: &str) -> &'static [FieldDefault] {
-    match object_type {
-        // Table from upstream issue #7: these three object types all lack
-        // `reserved`/`created_at`/`updated_at` in the guest-js payload.
-        "email_address" | "phone_number" | "web3_wallet" => &[
-            ("reserved", || json!(false)),
-            ("created_at", || json!(0)),
-            ("updated_at", || json!(0)),
-        ],
-        // Additionally lacks `verification` (the "latent" field issue #7
-        // calls out for OAuth users specifically).
-        "external_account" => &[
-            ("reserved", || json!(false)),
-            ("created_at", || json!(0)),
-            ("updated_at", || json!(0)),
-            ("verification", || Value::Null),
-        ],
-        "user" => &[
-            ("saml_accounts", || json!([])),
-            ("banned", || json!(false)),
-            ("locked", || json!(false)),
-            ("lockout_expires_in_seconds", || Value::Null),
-            ("verification_attempts_remaining", || Value::Null),
-            ("last_active_at", || Value::Null),
-            ("mfa_enabled_at", || Value::Null),
-            ("mfa_disabled_at", || Value::Null),
-        ],
-        // clerk-js gives `[number, number] | null`; a `null` would itself
-        // fail to deserialize into `Vec<i64>` too, but guest-js's `?? []`
-        // already handles that — this only covers the KEY being absent.
-        "session" => &[("factor_verification_age", || json!([]))],
-        // `clerkSignInToSignInJSON` emits no `abandon_at` at all, but
-        // `ClientSignIn.abandon_at` is a bare `i64`. Found by writing a
-        // fixture straight off guest-js's real serializer rather than by
-        // hand — the pre-existing `sign_in` fixture in this module's tests
-        // included `abandon_at`, which guest-js never sends, so it round-tripped
-        // and hid this. `0` matches how every other missing timestamp is
-        // defaulted here.
-        //
-        // EVERY OTHER FIELD ON THE MODEL IS LISTED TOO, and that is the point —
-        // see the `sign_up_attempt` note below for why this object type is
-        // defaulted exhaustively rather than field-by-field as each one is
-        // observed failing.
-        "sign_in_attempt" => &[
-            ("id", || json!("")),
-            ("status", || json!("abandoned")),
-            ("supported_identifiers", || json!([])),
-            ("supported_first_factors", || Value::Null),
-            ("supported_second_factors", || Value::Null),
-            ("first_factor_verification", || Value::Null),
-            ("second_factor_verification", || Value::Null),
-            ("identifier", || Value::Null),
-            ("user_data", || Value::Null),
-            ("created_session_id", || Value::Null),
-            ("abandon_at", || json!(0)),
-        ],
-        // `clerkSignUpToSignUpJSON` is missing more than one required field:
-        // it emits `has_password` where the model wants `password_enabled`,
-        // and never emits `custom_action` — both bare `bool`s upstream. It
-        // DOES emit `abandon_at` — as `signUp.abandonAt` with no `?? …` guard
-        // (`dist-js/index.js`), so a scratch object with no attempt in flight
-        // sends it as a literal JSON `null`, not an absent key. That is the
-        // FIFTH incident on this object (observed live on 1.90.0-staging.7,
-        // `path = payload.client.sign_up.abandon_at`, `error = invalid type:
-        // null, expected i64`) — this entry's `0` default was never a no-op
-        // on a real payload, the backfill loop just could not reach a
-        // present-but-null value to apply it. See the loop below.
-        //
-        // None of this had been observed in production yet. It is fixed anyway:
-        // it is the same untouched guest-js code path that has now produced
-        // three separate production incidents, and the cost of a fourth is the
-        // whole offline session cache, silently.
-        // `external_id` is `Option<String>` but carries
-        // `deserialize_with = "Option::deserialize"`, which requires the KEY to
-        // be present even for a null — and guest-js omits it entirely. That
-        // distinction (optional VALUE, mandatory KEY) is the trap running
-        // through this whole module: `Option<T>` reads as "safe to leave out"
-        // and is not.
-        //
-        // # Why both scratch types are now defaulted EXHAUSTIVELY
-        //
-        // `client.sign_in` / `client.sign_up` are scratch objects: clerk-js
-        // keeps them on every client whether or not an attempt is in flight,
-        // and when none is, their fields are `undefined`. `JSON.stringify`
-        // DROPS undefined-valued keys, so what reaches Rust for the ordinary
-        // signed-in user is close to `{"object": "sign_up", "status": null}` —
-        // nearly every required key absent at once.
-        //
-        // That is why this object type has now produced FOUR production
-        // incidents in a row (`status`, `verifications`,
-        // `password_enabled`/`custom_action`, and `id` — observed 2026-08-24,
-        // firing every ~43 s). Each fix repaired the one field serde happened
-        // to report, deserialization then advanced by one field, and the next
-        // release failed on the next one. Listing every field the model
-        // requires ends that sequence: there is no "next field" left.
-        //
-        // Fixtures could not catch this because a transcription of the
-        // serializer is faithful to the CODE and silently wrong about the
-        // RUNTIME - it shows `"id": signUp.id`, and a human writing the fixture
-        // fills in `"sua_abc123"`. `a_bare_sign_up_scratch_object_deserializes_
-        // after_backfill` tests the empty object instead, so it cannot rot the
-        // same way.
-        //
-        // Every value here matches the model's own `impl Default` (`""` for the
-        // `String` id, `abandoned` for the status enum, `[]` for the `Vec`s),
-        // and each is an `or_insert`, so a key guest-js DID send always wins.
-        "sign_up_attempt" => &[
-            ("id", || json!("")),
-            ("status", || json!("abandoned")),
-            ("required_fields", || json!([])),
-            ("optional_fields", || json!([])),
-            ("missing_fields", || json!([])),
-            ("unverified_fields", || json!([])),
-            ("username", || Value::Null),
-            ("email_address", || Value::Null),
-            ("phone_number", || Value::Null),
-            ("web3_wallet", || Value::Null),
-            ("first_name", || Value::Null),
-            ("last_name", || Value::Null),
-            ("created_session_id", || Value::Null),
-            ("created_user_id", || Value::Null),
-            ("legal_accepted_at", || Value::Null),
-            ("abandon_at", || json!(0)),
-            ("password_enabled", || json!(false)),
-            ("custom_action", || json!(false)),
-            ("external_id", || Value::Null),
-        ],
-        _ => &[],
-    }
-}
-
-/// Carry guest-js's `has_password` across to the `password_enabled` the model
-/// wants, when the payload said so.
-///
-/// The rename is already documented in [`defaults_for`] — but the default
-/// there is a flat `false`, which is only right when guest-js said nothing.
-/// A sign-up that DID set a password sends `"has_password": true`, and
-/// defaulting past it writes the opposite of the truth into the cached session
-/// before `ClientSignUp` ever deserializes. Silent, and exactly wrong on the
-/// account state a user would notice.
-///
-/// Runs BEFORE `defaults_for`'s `or_insert`, so the carried value wins and the
-/// `false` default only applies when neither key holds a usable answer.
-///
-/// # A present key with the wrong TYPE is treated as absent
-/// `ClientSignUp.password_enabled` is a bare `bool`, so `null`, a string, or a
-/// number there fails deserialization exactly as a missing key does — and
-/// `defaults_for`'s `or_insert` cannot rescue it, because the key exists. This
-/// is the module's "optional VALUE, mandatory KEY" trap running the other way:
-/// present, but unusable. Keying the guard on `contains_key` would leave that
-/// payload broken, so it keys on actually holding a boolean.
-fn carry_over_has_password(canonical: &str, map: &mut serde_json::Map<String, Value>) {
-    if canonical != "sign_up_attempt" {
-        return;
-    }
-    if map.get("password_enabled").is_some_and(Value::is_boolean) {
-        return; // Already a usable answer — authoritative, never overwritten.
-    }
-    let carried = map
-        .get("has_password")
-        .and_then(Value::as_bool)
-        .unwrap_or(false);
-    // Observability: the SHAPE, never the payload. `carried` is one bit of
-    // account state and `had_key` says only whether a key was present — no
-    // email, no token, no field values. Worth recording because this is a
-    // silent rewrite of cached auth state, and because a `present_but_unusable`
-    // hit means guest-js sent a type we did not expect, which is the leading
-    // indicator for the next incident in this module's history.
-    let present_but_unusable = map.contains_key("password_enabled");
-    if present_but_unusable {
-        tracing::warn!(
-            object = "sign_up_attempt",
-            carried,
-            "clerk backfill: password_enabled present but not a boolean - normalized"
-        );
-    } else {
-        tracing::debug!(
-            object = "sign_up_attempt",
-            carried,
-            had_has_password = map.contains_key("has_password"),
-            "clerk backfill: password_enabled filled in"
-        );
-    }
-    map.insert("password_enabled".to_string(), json!(carried));
-}
-
-/// Ensure `verifications` is an object carrying ALL four keys.
-///
-/// Replacing only a non-object (the shape this started as) is not enough: every
-/// field is `Option` but carries `deserialize_with = "Option::deserialize"`, so
-/// a PARTIAL object — say one that names `email_address` alone — is missing
-/// required keys just as surely as `{}` is, and fails with `missing field`
-/// all the same. See [`empty_sign_up_verifications`] for the same reasoning
-/// applied to the empty case.
-///
-/// Populated entries are preserved; only the absent keys get a `null`.
-fn complete_sign_up_verifications(map: &mut serde_json::Map<String, Value>) {
-    let mut filled = empty_sign_up_verifications();
-    let mut carried_over = 0usize;
-    if let (Value::Object(required), Some(Value::Object(existing))) =
-        (&mut filled, map.get("verifications"))
-    {
-        // Start from the all-null skeleton and overlay whatever was populated,
-        // so a key guest-js omitted is present-and-null rather than missing.
-        for (key, value) in existing {
-            required.insert(key.clone(), value.clone());
-            carried_over += 1;
-        }
-    }
-    // COUNTS ONLY. A verification entry carries the email address or phone
-    // number being verified, so the keys and values stay out of the record
-    // entirely - `carried_over` and `filled_in` are enough to tell "guest-js
-    // sent a partial object" from "it sent nothing", which is the whole
-    // diagnostic question here.
-    let total = filled.as_object().map_or(0, serde_json::Map::len);
-    tracing::debug!(
-        object = "sign_up_attempt",
-        carried_over,
-        filled_in = total.saturating_sub(carried_over),
-        "clerk backfill: sign_up verifications completed"
-    );
-    map.insert("verifications".to_string(), filled);
-}
-
-/// `clerkSignUpToSignUpJSON` hardcodes `verifications: null`, but
-/// `ClientSignUp.verifications` is a non-`Option` `Box<ClientSignUpVerifications>`
-/// — so the null is rejected outright.
-///
-/// The replacement has to spell out all four keys rather than being `{}`:
-/// every field on `ClientSignUpVerifications` is `Option` but carries
-/// `deserialize_with = "Option::deserialize"`, which requires the key to be
-/// PRESENT even when its value is null. An empty object fails with
-/// `missing field`.
-fn empty_sign_up_verifications() -> Value {
-    json!({
-        "email_address": null,
-        "phone_number": null,
-        "web3_wallet": null,
-        "external_account": null,
-    })
-}
-
-/// Timestamp keys clerk-fapi-rs types as `i64`, which guest-js emits as
-/// `date.getTime() / 1e3` — a fractional-second float (e.g.
-/// `1719765690.123`) that `serde_json` will not coerce into an `i64`.
-const TIMESTAMP_KEYS: &[&str] = &[
-    "created_at",
-    "updated_at",
-    "last_active_at",
-    "expire_at",
-    "abandon_at",
-    "last_sign_in_at",
-    "password_last_updated_at",
-    "legal_accepted_at",
-    "cookie_expires_at",
-    "mfa_enabled_at",
-    "mfa_disabled_at",
-    "last_used_at",
-];
-
-/// guest-js serializes the client's in-flight `sign_in`/`sign_up` resources
-/// with the short JS-side object name (`"sign_in"` / `"sign_up"`) instead of
-/// clerk-js's real `object` value. `clerk-fapi-rs`'s generated `ClientSignIn`/
-/// `ClientSignUp` models each type `object` as a single-variant enum that only
-/// accepts `"sign_in_attempt"` / `"sign_up_attempt"` (see
-/// `client_sign_in.rs`/`client_sign_up.rs` upstream), so the mismatch fails
-/// deserialization with `unknown variant "sign_in", expected "sign_in_attempt"`
-/// on every real sign-in — a fresh sibling of the missing-field bug this module
-/// otherwise fixes, but on a key that IS present rather than absent, so
-/// `defaults_for`'s `entry(..).or_insert(..)` can never reach it; the value
-/// has to be rewritten in place instead.
-fn canonical_object_type(raw: &str) -> &str {
-    match raw {
-        "sign_in" => "sign_in_attempt",
-        "sign_up" => "sign_up_attempt",
-        other => other,
-    }
-}
-
-/// The `status` fallback for an object type whose `status` guest-js can emit
-/// as `null` while `clerk-fapi-rs` types it as a required, non-`Option` enum.
-///
-/// # Why this is a table rather than one special case
-/// guest-js passes `status` straight through on `session`, `sign_in` and
-/// `sign_up` alike (`status: session.status`, `status: signIn.status`,
-/// `status: signUp.status` in `clerk-utils.ts`) with none of the `?? …`
-/// fallbacks it applies to its other fields. Every one of those three lands in
-/// a generated model whose `status` is a bare enum, so a `null` fails with
-/// `invalid type: null, expected string or map` and takes the whole
-/// `set_client` write down with it — no offline session cache, sign-in screen
-/// on the next cold start.
-///
-/// This has now happened three times on three different fields:
-/// `ClientSession.status` (fixed first), and `ClientSignIn.status` — observed
-/// in production on 2026-08-20, firing twice every ~44 s on a machine whose
-/// user WAS signed in, which is why the original fix appeared to work while
-/// persistence stayed broken. `sign_up` had not been seen yet and is included
-/// anyway: it is the same field, emitted by the same untouched code path, into
-/// the same shape of model. Fixing only what has been observed is what turned
-/// one bug into three.
-///
-/// Each fallback matches that model's own `impl Default for Status`, so the
-/// value chosen here is the one the library itself would pick:
-/// `session` → `active` (`client_session::Status`), `sign_in_attempt` →
-/// `abandoned` (`client_sign_in::Status`), `sign_up_attempt` → `abandoned`
-/// (`client_sign_up::Status`). `abandoned` is also the semantically right
-/// answer: a client's `sign_in`/`sign_up` are scratch objects for an
-/// in-flight attempt, and a null status means there is no attempt in flight.
-fn null_status_fallback(canonical_object_type: &str) -> Option<&'static str> {
-    match canonical_object_type {
-        "session" => Some("active"),
-        "sign_in_attempt" | "sign_up_attempt" => Some("abandoned"),
-        _ => None,
-    }
-}
-
-/// True when `status` is present but `null` — the case
-/// [`defaults_for`]'s `entry(..).or_insert(..)` structurally cannot reach,
-/// since the key exists.
-fn has_null_status(map: &Map<String, Value>) -> bool {
-    matches!(map.get("status"), Some(Value::Null))
-}
-
-/// Apply an object type's [`FieldDefault`] table, treating a key that is
-/// PRESENT but `null` the same as one that is ABSENT.
-///
-/// `entry(..).or_insert_with(..)` alone only ever catches the absent case,
-/// which is `defaults_for`'s namesake trap ("optional VALUE, mandatory KEY")
-/// but not its mirror: several guest-js fields (`status`, and — the fifth
-/// incident on this object, `sign_up.abandon_at` — see [`defaults_for`]'s
-/// `"sign_up_attempt"` doc) are passed straight through with no `?? …` guard,
-/// so a scratch object with nothing in flight sends them as a literal JSON
-/// `null` rather than omitting the key. A required (non-`Option`) field
-/// fails deserialization on `null` exactly as it does on absence, and
-/// `or_insert_with` cannot reach it because the key already exists.
-///
-/// Safe uniformly across every table entry, not just the ones known to hit
-/// this: any entry whose own default IS `Value::Null` (i.e. the model treats
-/// that key as genuinely optional) turns this into a null-over-null no-op,
-/// and every other entry's default is exactly the value already used to
-/// backfill an absence — the same repair, only reachable one case wider.
-fn apply_defaults(map: &mut Map<String, Value>, defaults: &[FieldDefault]) {
-    for (key, default) in defaults {
-        let needs_default = map.get(*key).is_none_or(Value::is_null);
-        if needs_default {
-            map.insert((*key).to_string(), default());
-        }
-    }
-}
-
-/// Recursively normalize a Clerk `client` JSON tree (or any subtree of one)
-/// so it deserializes cleanly into `clerk-fapi-rs`'s models. Mutates in
-/// place; safe to call on an already-well-formed payload (every backfill in
-/// [`apply_defaults`] is a no-op on a value that is neither absent nor null,
-/// every timestamp rewrite is a no-op on an already-integral value, and
-/// `canonical_object_type` is a no-op on an already-canonical `object`).
-pub(crate) fn backfill_clerk_client_json(value: &mut Value) {
-    match value {
-        Value::Array(items) => {
-            for item in items {
-                backfill_clerk_client_json(item);
-            }
-        }
-        Value::Object(map) => {
-            floor_timestamp_fields(map);
-            if let Some(object_type) = map.get("object").and_then(Value::as_str) {
-                // Borrow-check: collect the (owned) defaults before touching
-                // `map` again, since `object_type` borrows from it.
-                let object_type = object_type.to_string();
-                let canonical = canonical_object_type(&object_type).to_string();
-                if canonical != object_type {
-                    map.insert("object".to_string(), json!(canonical));
-                }
-                // BEFORE the blanket defaults: `password_enabled` has a real
-                // source in the payload and must not be defaulted past it.
-                carry_over_has_password(&canonical, map);
-                apply_defaults(map, defaults_for(&canonical));
-                if has_null_status(map) {
-                    if let Some(fallback) = null_status_fallback(&canonical) {
-                        map.insert("status".to_string(), json!(fallback));
-                    }
-                }
-                if canonical == "sign_up_attempt" {
-                    complete_sign_up_verifications(map);
-                }
-            }
-            for v in map.values_mut() {
-                backfill_clerk_client_json(v);
-            }
-        }
-        _ => {}
-    }
-}
-
-fn floor_timestamp_fields(map: &mut Map<String, Value>) {
-    for key in TIMESTAMP_KEYS {
-        if let Some(f) = map.get(*key).and_then(Value::as_f64) {
-            map.insert((*key).to_string(), json!(f.floor() as i64));
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use clerk_fapi_rs::models::ClientClient;
-
-    /// A realistic client JSON payload for a signed-in email+password user
-    /// belonging to an Organization, shaped exactly as guest-js's
-    /// `clerkClientToClientJSON`/`clerkSessionToSessionJSON`/
-    /// `clerkUserToUserJSON`/`clerkEmailAddressToEmailAdressJSON` actually
-    /// emit it (per `tauri-plugin-clerk`'s `dist-js/index.js`) — i.e. WITH
-    /// the fields upstream issue #7 documents as missing, and with
-    /// fractional-second timestamps. This is the exact shape that, before
-    /// this fix, made `set_client` silently never run for a real user.
-    ///
-    /// Deliberately omits: `sessions[].factor_verification_age` (clerk-js
-    /// gave `null`, guest-js's `?? []` only fixes the Vec-vs-null shape, not
-    /// a missing key), `sessions[].user.email_addresses[].{reserved,
-    /// created_at,updated_at}`, and `sessions[].user.{saml_accounts,banned,
-    /// locked,lockout_expires_in_seconds,verification_attempts_remaining,
-    /// last_active_at,mfa_enabled_at,mfa_disabled_at}` — the exact set from
-    /// issue #7's table. Parsed from a raw string (not the `json!` macro) to
-    /// keep this fixture's macro-expansion depth off the crate's recursion
-    /// limit.
-    fn guest_js_shaped_client_json() -> Value {
-        serde_json::from_str(
-            r#"{
-                "object": "client",
-                "id": "client_abc123",
-                "sessions": [{
-                    "object": "session",
-                    "id": "sess_abc123",
-                    "status": "active",
-                    "expire_at": 1719765690.123,
-                    "abandon_at": 1719765690.123,
-                    "last_active_at": 1719765690.123,
-                    "last_active_token": { "object": "token", "id": "tok_1", "jwt": "jwt-value" },
-                    "last_active_organization_id": null,
-                    "actor": null,
-                    "tasks": null,
-                    "user": {
-                        "object": "user",
-                        "id": "user_abc123",
-                        "external_id": null,
-                        "primary_email_address_id": "idn_email1",
-                        "primary_phone_number_id": null,
-                        "primary_web3_wallet_id": null,
-                        "image_url": "https://img.clerk.com/x",
-                        "has_image": true,
-                        "username": null,
-                        "email_addresses": [{
-                            "object": "email_address",
-                            "id": "idn_email1",
-                            "email_address": "user@example.com",
-                            "linked_to": [],
-                            "matches_sso_connection": false,
-                            "verification": null
-                        }],
-                        "phone_numbers": [],
-                        "web3_wallets": [],
-                        "external_accounts": [],
-                        "enterprise_accounts": [],
-                        "passkeys": [],
-                        "organization_memberships": [],
-                        "password_enabled": true,
-                        "profile_image_id": "https://img.clerk.com/x",
-                        "first_name": "Test",
-                        "last_name": "User",
-                        "totp_enabled": false,
-                        "backup_code_enabled": false,
-                        "two_factor_enabled": false,
-                        "public_metadata": {},
-                        "unsafe_metadata": {},
-                        "last_sign_in_at": 1719765690.123,
-                        "create_organization_enabled": true,
-                        "create_organizations_limit": null,
-                        "delete_self_enabled": true,
-                        "legal_accepted_at": null,
-                        "updated_at": 1719765690.123,
-                        "created_at": 1719765690.123
-                    },
-                    "public_user_data": null,
-                    "created_at": 1719765690.123,
-                    "updated_at": 1719765690.123
-                }],
-                "sign_up": null,
-                "sign_in": null,
-                "captcha_bypass": false,
-                "last_active_session_id": "sess_abc123",
-                "cookie_expires_at": null,
-                "created_at": 1719765600.0,
-                "updated_at": 1719765690.123
-            }"#,
-        )
-        .expect("fixture literal must be valid JSON")
-    }
-
-    #[test]
-    fn without_backfill_the_guest_js_shape_fails_to_deserialize() {
-        // Pins the regression this whole module exists to fix: without the
-        // backfill, this payload — representative of ANY real signed-in
-        // user — does not parse into clerk-fapi-rs's model.
-        let value = guest_js_shaped_client_json();
-        assert!(
-            serde_json::from_value::<ClientClient>(value).is_err(),
-            "fixture no longer reproduces the upstream bug — if clerk-fapi-rs \
-             relaxed its schema, this test (not the fix) should be revisited"
-        );
-    }
-
-    #[test]
-    fn backfill_makes_the_guest_js_shape_deserialize() {
-        let mut value = guest_js_shaped_client_json();
-        backfill_clerk_client_json(&mut value);
-        let client = serde_json::from_value::<ClientClient>(value)
-            .expect("backfilled payload must deserialize into clerk-fapi-rs's ClientClient");
-        assert_eq!(client.sessions.len(), 1);
-        let session = &client.sessions[0];
-        assert!(session.factor_verification_age.is_empty());
-        let user = session.user.as_ref().expect("session must carry its user");
-        assert!(!user.banned);
-        assert!(!user.locked);
-        assert!(user.saml_accounts.is_empty());
-        assert_eq!(user.email_addresses.len(), 1);
-        assert!(!user.email_addresses[0].reserved);
-        // The fractional timestamps must have survived as the same second,
-        // just floored to an integer — not zeroed out.
-        assert_eq!(client.updated_at, 1719765690);
-    }
-
-    #[test]
-    fn backfill_never_overwrites_a_value_guest_js_did_emit() {
-        let mut value = json!({
-            "object": "user",
-            "banned": true,
-            "saml_accounts": [{"object": "saml_account", "id": "saml_1"}]
-        });
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["banned"], json!(true));
-        assert_eq!(value["saml_accounts"].as_array().unwrap().len(), 1);
-    }
-
-    #[test]
-    fn backfill_is_idempotent_on_an_already_well_formed_payload() {
-        let mut value = guest_js_shaped_client_json();
-        backfill_clerk_client_json(&mut value);
-        let once = value.clone();
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(once, value);
-    }
-
-    #[test]
-    fn floors_fractional_timestamps_at_every_depth() {
-        let mut value = json!({
-            "object": "client",
-            "created_at": 100.999,
-            "sessions": [{ "object": "session", "created_at": 200.001 }]
-        });
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["created_at"], json!(100));
-        assert_eq!(value["sessions"][0]["created_at"], json!(200));
-    }
-
-    /// A client's in-flight sign-in, shaped exactly as guest-js emits it: the
-    /// `object` discriminator is the short JS resource name `"sign_in"`, not
-    /// clerk-fapi-rs's `"sign_in_attempt"`. Every other field is present and
-    /// well-typed — this is purely the discriminator mismatch production hit.
-    fn guest_js_shaped_sign_in_json() -> Value {
-        json!({
-            "object": "sign_in",
-            "id": "sign_in_abc123",
-            "status": "needs_first_factor",
-            "supported_identifiers": ["email_address"],
-            "supported_first_factors": null,
-            "supported_second_factors": null,
-            "first_factor_verification": null,
-            "second_factor_verification": null,
-            "identifier": "user@example.com",
-            "user_data": null,
-            "created_session_id": null,
-            "abandon_at": 1719765690
-        })
-    }
-
-    /// Pins the production bug: `unknown variant "sign_in", expected
-    /// "sign_in_attempt"`, hit by every real user with an in-flight sign-in.
-    #[test]
-    fn without_the_fix_guest_js_sign_in_object_type_fails_to_deserialize() {
-        let value = guest_js_shaped_sign_in_json();
-        assert!(
-            serde_json::from_value::<clerk_fapi_rs::models::ClientSignIn>(value).is_err(),
-            "fixture no longer reproduces the upstream mismatch — if clerk-fapi-rs \
-             relaxed its schema, this test (not the fix) should be revisited"
-        );
-    }
-
-    #[test]
-    fn backfill_canonicalizes_the_sign_in_object_type() {
-        let mut value = guest_js_shaped_sign_in_json();
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["object"], json!("sign_in_attempt"));
-        serde_json::from_value::<clerk_fapi_rs::models::ClientSignIn>(value).expect(
-            "backfilled sign_in payload must deserialize into clerk-fapi-rs's ClientSignIn",
-        );
-    }
-
-    /// The same rewrite applied recursively, inside a whole client tree —
-    /// not just when `ClientSignIn` is deserialized standalone.
-    #[test]
-    fn backfill_canonicalizes_sign_in_nested_inside_a_client() {
-        let mut value = json!({
-            "object": "client",
-            "sign_in": guest_js_shaped_sign_in_json(),
-            "sign_up": null,
-        });
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["sign_in"]["object"], json!("sign_in_attempt"));
-    }
-
-    /// `sign_up` carries the identical bug class (`"sign_up"` vs
-    /// `"sign_up_attempt"`) — covered at the canonicalizer level since a full
-    /// `ClientSignUp` fixture needs a `verifications` sub-object this bug has
-    /// nothing to do with.
-    #[test]
-    fn canonicalizes_sign_up_the_same_way_as_sign_in() {
-        assert_eq!(canonical_object_type("sign_up"), "sign_up_attempt");
-    }
-
-    /// An already-canonical `object` must not be touched — only the two known
-    /// guest-js short names are remapped.
-    #[test]
-    fn canonical_object_type_is_a_no_op_on_correct_and_unrelated_values() {
-        assert_eq!(canonical_object_type("sign_in_attempt"), "sign_in_attempt");
-        assert_eq!(canonical_object_type("user"), "user");
-    }
-
-    /// An in-flight sign-up with the `object` discriminator guest-js uses but
-    /// otherwise ALREADY-VALID field values — used only by the discriminator
-    /// tests below, which is all it is good for.
-    ///
-    /// It is deliberately NOT what guest-js emits, despite what its name
-    /// suggests, and the mismatch is worth reading before trusting any fixture
-    /// in this module: a hand-written "realistic" payload quietly supplied
-    /// `password_enabled`, `custom_action`, a populated `verifications` and an
-    /// integral `abandon_at` — all four of which guest-js gets wrong or omits.
-    /// Because those tests passed, three real defects on this object went
-    /// unnoticed until `real_guest_js_sign_up_json` was transcribed
-    /// field-for-field from the npm package's `dist-js/index.js`. When adding a
-    /// fixture here, copy the serializer, do not describe it.
-    fn idealized_sign_up_json() -> Value {
-        json!({
-            "object": "sign_up",
-            "id": "sign_up_abc123",
-            "status": "missing_requirements",
-            "required_fields": ["email_address"],
-            "optional_fields": [],
-            "missing_fields": ["email_address"],
-            "unverified_fields": [],
-            "verifications": {
-                "email_address": null,
-                "phone_number": null,
-                "web3_wallet": null,
-                "external_account": null
-            },
-            "username": null,
-            "email_address": "user@example.com",
-            "phone_number": null,
-            "web3_wallet": null,
-            "password_enabled": true,
-            "first_name": null,
-            "last_name": null,
-            "custom_action": false,
-            "external_id": null,
-            "created_session_id": null,
-            "created_user_id": null,
-            "abandon_at": 1719765690,
-            "legal_accepted_at": null
-        })
-    }
-
-    /// The `sign_up` counterpart to `without_the_fix_guest_js_sign_in_object_type_fails_to_deserialize`
-    /// — pins that the discriminator mismatch is not sign_in-specific.
-    #[test]
-    fn without_the_fix_guest_js_sign_up_object_type_fails_to_deserialize() {
-        let value = idealized_sign_up_json();
-        assert!(
-            serde_json::from_value::<clerk_fapi_rs::models::ClientSignUp>(value).is_err(),
-            "fixture no longer reproduces the upstream mismatch — if clerk-fapi-rs \
-             relaxed its schema, this test (not the fix) should be revisited"
-        );
-    }
-
-    #[test]
-    fn backfill_canonicalizes_the_sign_up_object_type() {
-        let mut value = idealized_sign_up_json();
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["object"], json!("sign_up_attempt"));
-        serde_json::from_value::<clerk_fapi_rs::models::ClientSignUp>(value).expect(
-            "backfilled sign_up payload must deserialize into clerk-fapi-rs's ClientSignUp",
-        );
-    }
-
-    #[test]
-    fn backfill_canonicalizes_sign_up_nested_inside_a_client() {
-        let mut value = json!({
-            "object": "client",
-            "sign_in": null,
-            "sign_up": idealized_sign_up_json(),
-        });
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["sign_up"]["object"], json!("sign_up_attempt"));
-    }
-
-    /// Idempotency across the REWRITE path specifically — the existing
-    /// `backfill_is_idempotent_on_an_already_well_formed_payload` only covers
-    /// the original fixture, whose `sign_in`/`sign_up` are `null` and so never
-    /// touch `canonical_object_type` at all.
-    #[test]
-    fn backfill_is_idempotent_after_canonicalizing_a_populated_sign_in() {
-        let mut value = json!({
-            "object": "client",
-            "sign_in": guest_js_shaped_sign_in_json(),
-            "sign_up": null,
-        });
-        backfill_clerk_client_json(&mut value);
-        let once = value.clone();
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(
-            once, value,
-            "a second pass over an already-canonicalized sign_in must be a no-op"
-        );
-    }
-
-    /// The full end-to-end case none of the standalone `ClientSignIn` tests
-    /// reach: a whole `ClientClient` with a LIVE (non-null) `sign_in`, shaped
-    /// exactly as guest-js emits it end to end, deserializing successfully
-    /// after backfill — not just the `object` field in isolation. This is the
-    /// actual shape `set_client` receives in production the moment a user is
-    /// mid-sign-in (MFA prompt, etc.) rather than already fully signed in.
-    #[test]
-    fn backfill_makes_a_client_with_a_live_sign_in_deserialize() {
-        let mut value = json!({
-            "object": "client",
-            "id": "client_abc123",
-            "sessions": [],
-            "sign_in": guest_js_shaped_sign_in_json(),
-            "sign_up": null,
-            "last_active_session_id": null,
-            "cookie_expires_at": null,
-            "captcha_bypass": false,
-            "created_at": 1719765600,
-            "updated_at": 1719765690
-        });
-        backfill_clerk_client_json(&mut value);
-        let client = serde_json::from_value::<ClientClient>(value).expect(
-            "a client with a live sign_in must deserialize into ClientClient after backfill",
-        );
-        let sign_in = client.sign_in.expect("sign_in must survive the round trip");
-        assert_eq!(sign_in.id, "sign_in_abc123");
-    }
-
-    /// A `session` object shaped exactly as `clerkSessionToSessionJSON` emits
-    /// it when `Session.status` is `null` — the same realistic shape as
-    /// `guest_js_shaped_client_json`'s nested session, with only `status`
-    /// changed. Observed live in production: this is what made offline
-    /// sign-in caching silently stop working even after the `sign_in`/
-    /// `sign_up` discriminator fix.
-    fn guest_js_shaped_session_with_null_status_json() -> Value {
-        serde_json::from_str(
-            r#"{
-                "object": "session",
-                "id": "sess_abc123",
-                "status": null,
-                "expire_at": 1719765690.123,
-                "abandon_at": 1719765690.123,
-                "last_active_at": 1719765690.123,
-                "last_active_token": { "object": "token", "id": "tok_1", "jwt": "jwt-value" },
-                "last_active_organization_id": null,
-                "actor": null,
-                "tasks": null,
-                "user": {
-                    "object": "user",
-                    "id": "user_abc123",
-                    "external_id": null,
-                    "primary_email_address_id": "idn_email1",
-                    "primary_phone_number_id": null,
-                    "primary_web3_wallet_id": null,
-                    "image_url": "https://img.clerk.com/x",
-                    "has_image": true,
-                    "username": null,
-                    "email_addresses": [{
-                        "object": "email_address",
-                        "id": "idn_email1",
-                        "email_address": "user@example.com",
-                        "linked_to": [],
-                        "matches_sso_connection": false,
-                        "verification": null
-                    }],
-                    "phone_numbers": [],
-                    "web3_wallets": [],
-                    "external_accounts": [],
-                    "enterprise_accounts": [],
-                    "passkeys": [],
-                    "organization_memberships": [],
-                    "password_enabled": true,
-                    "profile_image_id": "https://img.clerk.com/x",
-                    "first_name": "Test",
-                    "last_name": "User",
-                    "totp_enabled": false,
-                    "backup_code_enabled": false,
-                    "two_factor_enabled": false,
-                    "public_metadata": {},
-                    "unsafe_metadata": {},
-                    "last_sign_in_at": 1719765690.123,
-                    "create_organization_enabled": true,
-                    "create_organizations_limit": null,
-                    "delete_self_enabled": true,
-                    "legal_accepted_at": null,
-                    "updated_at": 1719765690.123,
-                    "created_at": 1719765690.123
-                },
-                "public_user_data": null,
-                "created_at": 1719765690.123,
-                "updated_at": 1719765690.123
-            }"#,
-        )
-        .expect("fixture literal must be valid JSON")
-    }
-
-    /// Pins the production bug: `invalid type: null, expected string or map`,
-    /// hit whenever clerk-js hands guest-js a session whose `status` hasn't
-    /// been set yet.
-    #[test]
-    fn without_the_fix_a_null_session_status_fails_to_deserialize() {
-        let value = guest_js_shaped_session_with_null_status_json();
-        assert!(
-            serde_json::from_value::<clerk_fapi_rs::models::ClientSession>(value).is_err(),
-            "fixture no longer reproduces the production null-status bug — if clerk-fapi-rs \
-             relaxed its schema, this test (not the fix) should be revisited"
-        );
-    }
-
-    #[test]
-    fn backfill_falls_back_a_null_session_status_to_active() {
-        let mut value = guest_js_shaped_session_with_null_status_json();
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["status"], json!("active"));
-        serde_json::from_value::<clerk_fapi_rs::models::ClientSession>(value)
-            .expect("a session backfilled from a null status must deserialize into ClientSession");
-    }
-
-    #[test]
-    fn backfill_never_overwrites_a_non_null_session_status() {
-        let mut value = json!({ "object": "session", "status": "ended" });
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["status"], json!("ended"));
-    }
-
-    /// The same rewrite applied recursively, inside a whole client tree —
-    /// not just when `ClientSession` is deserialized standalone.
-    #[test]
-    fn backfill_falls_back_a_null_session_status_nested_inside_a_client() {
-        let mut value = json!({
-            "object": "client",
-            "sessions": [guest_js_shaped_session_with_null_status_json()],
-        });
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["sessions"][0]["status"], json!("active"));
-    }
-
-    #[test]
-    fn backfill_is_idempotent_after_falling_back_a_null_session_status() {
-        let mut value = guest_js_shaped_session_with_null_status_json();
-        backfill_clerk_client_json(&mut value);
-        let once = value.clone();
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(
-            once, value,
-            "a second pass over an already-fallen-back session must be a no-op"
-        );
-    }
-
-    /// A client's `sign_in` scratch object as `clerkSignInToSignInJSON`
-    /// actually emits it when no sign-in attempt is in flight: `status` passed
-    /// straight through as `null`.
-    ///
-    /// This is the SECOND null-status field to reach production. On
-    /// 2026-08-20 a machine whose user was genuinely signed in logged
-    /// `invalid type: null, expected string or map` at
-    /// `payload.client.sign_in.status` twice every ~44 s — so `set_client`
-    /// never ran, the offline cache stayed empty, and the previous
-    /// null-session-status fix looked like it had worked while session
-    /// persistence was still completely broken.
-    fn guest_js_shaped_sign_in_with_null_status_json() -> Value {
-        serde_json::from_str(
-            r#"{
-                "object": "sign_in",
-                "id": "sia_abc123",
-                "status": null,
-                "supported_identifiers": [],
-                "identifier": null,
-                "user_data": {
-                    "first_name": "",
-                    "last_name": "",
-                    "image_url": "",
-                    "has_image": false
-                },
-                "supported_first_factors": [],
-                "supported_second_factors": [],
-                "first_factor_verification": null,
-                "second_factor_verification": null,
-                "created_session_id": null
-            }"#,
-        )
-        .expect("fixture literal must be valid JSON")
-    }
-
-    /// Pins the production failure before asserting the fix, so a
-    /// clerk-fapi-rs schema relaxation shows up here as a stale test rather
-    /// than as a fix that silently stopped being needed.
-    #[test]
-    fn without_the_fix_a_null_sign_in_status_fails_to_deserialize() {
-        let mut value = guest_js_shaped_sign_in_with_null_status_json();
-        // Canonicalize `object` only, so this isolates the STATUS failure
-        // rather than re-testing the discriminator bug.
-        value["object"] = json!("sign_in_attempt");
-        assert!(
-            serde_json::from_value::<clerk_fapi_rs::models::ClientSignIn>(value).is_err(),
-            "fixture no longer reproduces the production null-sign_in-status bug"
-        );
-    }
-
-    #[test]
-    fn backfill_falls_back_a_null_sign_in_status_to_abandoned() {
-        let mut value = guest_js_shaped_sign_in_with_null_status_json();
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["status"], json!("abandoned"));
-        serde_json::from_value::<clerk_fapi_rs::models::ClientSignIn>(value)
-            .expect("a sign_in backfilled from a null status must deserialize into ClientSignIn");
-    }
-
-    /// The shape actually observed in production: the null status is nested on
-    /// the CLIENT, alongside a real signed-in session. Deserializing the whole
-    /// `ClientClient` is the operation that was failing, and it is the only one
-    /// that matters - a standalone `ClientSignIn` is never parsed at runtime.
-    #[test]
-    fn a_client_carrying_a_null_status_sign_in_deserializes_after_backfill() {
-        let mut value = guest_js_shaped_client_json();
-        value["sign_in"] = guest_js_shaped_sign_in_with_null_status_json();
-        assert!(
-            serde_json::from_value::<ClientClient>(value.clone()).is_err(),
-            "fixture must reproduce the production failure before the backfill runs"
-        );
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["sign_in"]["status"], json!("abandoned"));
-        serde_json::from_value::<ClientClient>(value)
-            .expect("this is the exact payload that broke session persistence in production");
-    }
-
-    /// `sign_up` is the same field on the same untouched guest-js code path
-    /// into the same shape of model, so it is covered pre-emptively. Fixing
-    /// only the field that had been observed is what turned one bug into three.
-    #[test]
-    fn backfill_falls_back_a_null_sign_up_status_to_abandoned() {
-        let mut value = json!({ "object": "sign_up", "status": null });
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["status"], json!("abandoned"));
-    }
-
-    /// A client's `sign_up` scratch object exactly as
-    /// `clerkSignUpToSignUpJSON` emits it — transcribed field-for-field from
-    /// the npm package's `dist-js/index.js`, deliberately NOT hand-tidied.
-    /// Writing the `sign_in` fixture this way is what exposed the missing
-    /// `abandon_at`; the pre-existing hand-written one had silently included
-    /// fields guest-js never sends.
-    ///
-    /// Note what it does and does not contain: `has_password` (the model wants
-    /// `password_enabled`), no `custom_action` at all, and
-    /// `verifications: null` against a non-`Option` field.
-    fn real_guest_js_sign_up_json() -> Value {
-        serde_json::from_str(
-            r#"{
-                "object": "sign_up",
-                "id": "sua_abc123",
-                "status": null,
-                "required_fields": ["email_address"],
-                "optional_fields": [],
-                "missing_fields": [],
-                "unverified_fields": [],
-                "username": null,
-                "first_name": null,
-                "last_name": null,
-                "email_address": null,
-                "phone_number": null,
-                "web3_wallet": null,
-                "external_account_strategy": null,
-                "external_account": null,
-                "has_password": false,
-                "unsafe_metadata": {},
-                "created_session_id": null,
-                "created_user_id": null,
-                "abandon_at": 1719765690.123,
-                "legal_accepted_at": null,
-                "verifications": null,
-                "locale": null
-            }"#,
-        )
-        .expect("fixture literal must be valid JSON")
-    }
-
-    /// Three separate defects on one object - a null `status`, a null
-    /// `verifications` against a non-Option field, and two required bools
-    /// guest-js never emits. None had reached production; all three would have
-    /// taken down the same `set_client` write the moment a client carried a
-    /// sign-up attempt.
-    #[test]
-    fn a_client_carrying_a_guest_js_shaped_sign_up_deserializes_after_backfill() {
-        let mut value = guest_js_shaped_client_json();
-        value["sign_up"] = real_guest_js_sign_up_json();
-        assert!(
-            serde_json::from_value::<ClientClient>(value.clone()).is_err(),
-            "fixture must reproduce the failure before the backfill runs"
-        );
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["sign_up"]["status"], json!("abandoned"));
-        assert_eq!(value["sign_up"]["password_enabled"], json!(false));
-        assert_eq!(value["sign_up"]["custom_action"], json!(false));
-        assert!(value["sign_up"]["verifications"].is_object());
-        serde_json::from_value::<ClientClient>(value)
-            .expect("a guest-js-shaped sign_up must survive the round trip");
-    }
-
-    /// Pins the production failure observed 2026-08-24 on 1.90.0-staging.5:
-    /// `missing field `id``, firing every ~43 s on a machine whose user WAS
-    /// signed in.
-    ///
-    /// # Why every fixture in this module hid it
-    /// `client.signIn` / `client.signUp` are SCRATCH objects — they exist even
-    /// when no attempt is in flight, and then their `id` is `undefined`.
-    /// `JSON.stringify` drops undefined-valued keys entirely, so the key never
-    /// reaches the wire. Transcribing the serializer (as
-    /// [`real_guest_js_sign_up_json`] correctly did) still gives you `"id":
-    /// signUp.id` and a plausible-looking `"sua_abc123"` filled in by hand —
-    /// the transcription is faithful to the CODE and wrong about the RUNTIME.
-    /// That is the same trap the `abandon_at` note in [`idealized_sign_up_json`]
-    /// describes, one level deeper: it is not enough to copy the serializer, the
-    /// fixture also has to reflect what its inputs actually hold.
-    /// `id` is dropped AFTER the backfill runs, so every other defect on this
-    /// fixture (the null `status`, the null `verifications`, the float
-    /// `abandon_at`, the renamed `has_password`) is already repaired and the
-    /// absent `id` is provably the sole remaining cause. Removing it from the
-    /// raw fixture instead would report whichever defect serde happened to
-    /// reach first — which is the float `abandon_at`, not `id`.
-    #[test]
-    fn a_sign_up_whose_only_remaining_defect_is_a_missing_id_names_that_field() {
-        let mut value = real_guest_js_sign_up_json();
-        backfill_clerk_client_json(&mut value);
-        value
-            .as_object_mut()
-            .expect("fixture is an object")
-            .remove("id");
-        let err = serde_json::from_value::<clerk_fapi_rs::models::ClientSignUp>(value)
-            .expect_err("a sign_up with no id must not deserialize");
-        assert!(
-            err.to_string().contains("missing field `id`"),
-            "expected the exact error production reported, got: {err}"
-        );
-    }
-
-    /// Pins the production failure observed live on 1.90.0-staging.7 — this
-    /// module's FIFTH incident on this object: `path =
-    /// payload.client.sign_up.abandon_at`, `error = invalid type: null,
-    /// expected i64`.
-    ///
-    /// # Why this one got past the "completeness proof" tests too
-    /// `clerkSignUpToSignUpJSON` emits `abandon_at: signUp.abandonAt` with no
-    /// `?? …` guard (`dist-js/index.js`), exactly like the `status` field the
-    /// third incident fixed — but `real_guest_js_sign_up_json` (transcribed
-    /// for the FOURTH incident) happened to carry a real float there, and
-    /// `a_bare_sign_up_scratch_object_deserializes_after_backfill`'s
-    /// discriminator-only fixture has the key ABSENT rather than present-null,
-    /// so neither exercised this. Present-but-null needs its own fixture
-    /// because it is a different failure mode than either.
-    #[test]
-    fn a_sign_up_whose_only_remaining_defect_is_a_null_abandon_at_names_that_field() {
-        let mut value = real_guest_js_sign_up_json();
-        backfill_clerk_client_json(&mut value);
-        value
-            .as_object_mut()
-            .expect("fixture is an object")
-            .insert("abandon_at".to_string(), Value::Null);
-        let err = serde_json::from_value::<clerk_fapi_rs::models::ClientSignUp>(value)
-            .expect_err("a sign_up with a null abandon_at must not deserialize");
-        assert!(
-            err.to_string().contains("invalid type: null, expected i64"),
-            "expected the exact error production reported, got: {err}"
-        );
-    }
-
-    #[test]
-    fn backfill_repairs_a_present_but_null_abandon_at_on_sign_up() {
-        let mut value = real_guest_js_sign_up_json();
-        value["abandon_at"] = Value::Null;
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["abandon_at"], json!(0));
-        serde_json::from_value::<clerk_fapi_rs::models::ClientSignUp>(value)
-            .expect("a sign_up backfilled from a null abandon_at must deserialize");
-    }
-
-    /// The end-to-end case: a whole `ClientClient` carrying the exact scratch
-    /// shape production sent — no attempt in flight, `abandon_at` present and
-    /// `null` rather than an absent key or a real timestamp.
-    #[test]
-    fn a_client_carrying_a_null_abandon_at_sign_up_deserializes_after_backfill() {
-        let mut value = guest_js_shaped_client_json();
-        let mut sign_up = real_guest_js_sign_up_json();
-        sign_up["abandon_at"] = Value::Null;
-        value["sign_up"] = sign_up;
-        assert!(
-            serde_json::from_value::<ClientClient>(value.clone()).is_err(),
-            "fixture must reproduce the failure before the backfill runs"
-        );
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["sign_up"]["abandon_at"], json!(0));
-        serde_json::from_value::<ClientClient>(value).expect(
-            "a signed-in user whose sign_up scratch object has a null abandon_at is the \
-             COMMON case, not an edge one - this is the payload that broke session \
-             persistence in production on 1.90.0-staging.7",
-        );
-    }
-
-    /// The completeness proof for `sign_in`, and the reason it is shaped this
-    /// way rather than as another transcribed fixture.
-    ///
-    /// The input is the worst case the wire can carry: the discriminator and
-    /// NOTHING else. A test built on a realistic payload can only ever prove
-    /// that payload works, which is precisely how four separate defects
-    /// (`status`, `verifications`, `password_enabled`/`custom_action`, `id`)
-    /// went to production on this one object. This cannot pass while any
-    /// required key is unhandled, and it keeps holding if clerk-fapi-rs adds
-    /// one — a new required field breaks it immediately rather than six weeks
-    /// later on a user's machine.
-    #[test]
-    fn a_bare_sign_in_scratch_object_deserializes_after_backfill() {
-        let mut value = json!({ "object": "sign_in" });
-        backfill_clerk_client_json(&mut value);
-        serde_json::from_value::<clerk_fapi_rs::models::ClientSignIn>(value).expect(
-            "a sign_in carrying only its discriminator must round-trip - guest-js omits \
-             every key whose value is undefined, which is all of them when no sign-in is \
-             in flight",
-        );
-    }
-
-    /// The `sign_up` half of
-    /// [`a_bare_sign_in_scratch_object_deserializes_after_backfill`].
-    #[test]
-    fn a_bare_sign_up_scratch_object_deserializes_after_backfill() {
-        let mut value = json!({ "object": "sign_up" });
-        backfill_clerk_client_json(&mut value);
-        serde_json::from_value::<clerk_fapi_rs::models::ClientSignUp>(value).expect(
-            "a sign_up carrying only its discriminator must round-trip - see the sign_in \
-             counterpart for why this is the shape that proves completeness",
-        );
-    }
-
-    /// The end-to-end case, which is the only one that reflects runtime: a
-    /// standalone `ClientSignIn` is never parsed on its own — `set_client`
-    /// deserializes the whole `ClientClient` tree, so one unhandled key inside
-    /// a scratch object takes the entire session write down with it.
-    #[test]
-    fn a_client_whose_scratch_objects_have_no_id_survives_the_round_trip() {
-        let mut value = guest_js_shaped_client_json();
-        value["sign_in"] = json!({ "object": "sign_in", "status": null });
-        value["sign_up"] = json!({ "object": "sign_up", "status": null });
-        assert!(
-            serde_json::from_value::<ClientClient>(value.clone()).is_err(),
-            "fixture must reproduce the failure before the backfill runs"
-        );
-        backfill_clerk_client_json(&mut value);
-        serde_json::from_value::<ClientClient>(value).expect(
-            "a signed-in user with no attempt in flight is the COMMON case, not an edge \
-             one - this is the payload that broke session persistence in production",
-        );
-    }
-
-    /// The replacement must spell out all four keys: they are `Option` but
-    /// carry `deserialize_with = "Option::deserialize"`, so an empty object
-    /// fails with `missing field`. This is the trap that makes `json!({})`
-    /// look correct.
-    #[test]
-    fn sign_up_verifications_replacement_is_not_an_empty_object() {
-        serde_json::from_value::<clerk_fapi_rs::models::ClientSignUpVerifications>(
-            empty_sign_up_verifications(),
-        )
-        .expect("the replacement must deserialize into ClientSignUpVerifications");
-        assert!(
-            serde_json::from_value::<clerk_fapi_rs::models::ClientSignUpVerifications>(json!({}))
-                .is_err(),
-            "if an empty object now works, empty_sign_up_verifications can be simplified"
-        );
-    }
-
-    /// A `verifications` object guest-js DID populate must survive untouched -
-    /// the rewrite is for null/absent only.
-    #[test]
-    fn backfill_never_overwrites_a_populated_sign_up_verifications() {
-        let mut value = json!({
-            "object": "sign_up",
-            "verifications": { "email_address": { "sentinel": true } },
-        });
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(
-            value["verifications"]["email_address"]["sentinel"],
-            json!(true)
-        );
-    }
-
-    #[test]
-    fn backfill_never_overwrites_a_non_null_sign_in_or_sign_up_status() {
-        let mut value = json!({
-            "object": "client",
-            "sign_in": { "object": "sign_in", "status": "needs_first_factor" },
-            "sign_up": { "object": "sign_up", "status": "missing_requirements" },
-        });
-        backfill_clerk_client_json(&mut value);
-        assert_eq!(value["sign_in"]["status"], json!("needs_first_factor"));
-        assert_eq!(value["sign_up"]["status"], json!("missing_requirements"));
-    }
-
-    /// Every object type whose `status` clerk-fapi-rs types as a bare enum
-    /// must have a fallback, and no other type may acquire one by accident -
-    /// an over-broad rule would invent a `status` on objects that have none.
-    #[test]
-    fn only_the_bare_enum_status_types_get_a_fallback() {
-        assert_eq!(null_status_fallback("session"), Some("active"));
-        assert_eq!(null_status_fallback("sign_in_attempt"), Some("abandoned"));
-        assert_eq!(null_status_fallback("sign_up_attempt"), Some("abandoned"));
-        for other in ["client", "user", "email_address", "token", "organization"] {
-            assert_eq!(null_status_fallback(other), None, "{other}");
-        }
-        // The fallback is keyed on the CANONICAL type, so the raw guest-js
-        // spellings must not match - they are rewritten first.
-        assert_eq!(null_status_fallback("sign_in"), None);
-        assert_eq!(null_status_fallback("sign_up"), None);
-    }
-}
-
-#[cfg(test)]
-mod backfill_gap_tests {
-    use super::*;
-
-    /// The rename `has_password` -> `password_enabled` is documented in
-    /// `defaults_for`, but the default there is a flat `false`. A sign-up that
-    /// DID set a password says so, and defaulting past it writes the opposite
-    /// of the truth into the cached session.
-    #[test]
-    fn a_real_has_password_is_carried_over_not_defaulted_to_false() {
-        let mut v = json!({ "object": "sign_up_attempt", "has_password": true });
-        backfill_clerk_client_json(&mut v);
-        assert_eq!(v["password_enabled"], json!(true));
-    }
-
-    #[test]
-    fn has_password_false_still_reads_false() {
-        let mut v = json!({ "object": "sign_up_attempt", "has_password": false });
-        backfill_clerk_client_json(&mut v);
-        assert_eq!(v["password_enabled"], json!(false));
-    }
-
-    /// Neither key present: the existing `false` default still applies.
-    #[test]
-    fn absent_on_both_sides_keeps_the_false_default() {
-        let mut v = json!({ "object": "sign_up_attempt" });
-        backfill_clerk_client_json(&mut v);
-        assert_eq!(v["password_enabled"], json!(false));
-    }
-
-    /// A present-but-non-BOOLEAN `password_enabled` is unusable: the field is a
-    /// bare `bool` upstream, so it fails deserialization exactly like a missing
-    /// key - and `defaults_for`'s `or_insert` cannot rescue it, because the key
-    /// exists. It must be normalized, not left alone.
-    #[test]
-    fn a_non_boolean_password_enabled_is_normalized() {
-        for bad in [Value::Null, json!("yes"), json!(1)] {
-            let mut v = json!({
-                "object": "sign_up_attempt",
-                "password_enabled": bad,
-                "has_password": true,
-            });
-            backfill_clerk_client_json(&mut v);
-            assert_eq!(v["password_enabled"], json!(true), "from {v:?}");
-        }
-    }
-
-    /// ...and with no usable `has_password` either, it falls back to `false`
-    /// rather than staying a value that cannot deserialize.
-    #[test]
-    fn a_non_boolean_password_enabled_falls_back_to_false() {
-        let mut v = json!({ "object": "sign_up_attempt", "password_enabled": Value::Null });
-        backfill_clerk_client_json(&mut v);
-        assert_eq!(v["password_enabled"], json!(false));
-    }
-
-    /// An explicit `password_enabled` is authoritative and must not be
-    /// overwritten by `has_password`.
-    #[test]
-    fn an_explicit_password_enabled_wins() {
-        let mut v = json!({
-            "object": "sign_up_attempt",
-            "password_enabled": true,
-            "has_password": false,
-        });
-        backfill_clerk_client_json(&mut v);
-        assert_eq!(v["password_enabled"], json!(true));
-    }
-
-    /// The gap this closes: only a NON-object `verifications` used to be
-    /// replaced, so a partial object kept its missing keys - and every field
-    /// carries `deserialize_with = "Option::deserialize"`, which needs the key
-    /// PRESENT even for a null. A partial object fails exactly like `{}` does.
-    #[test]
-    fn a_partial_verifications_object_is_completed_not_left_short() {
-        let mut v = json!({
-            "object": "sign_up_attempt",
-            "verifications": { "email_address": { "status": "verified" } },
-        });
-        backfill_clerk_client_json(&mut v);
-
-        let ver = v["verifications"].as_object().unwrap();
-        for key in [
-            "email_address",
-            "phone_number",
-            "web3_wallet",
-            "external_account",
-        ] {
-            assert!(ver.contains_key(key), "missing {key}: {ver:?}");
-        }
-        // The populated entry survives untouched.
-        assert_eq!(ver["email_address"]["status"], json!("verified"));
-        assert_eq!(ver["phone_number"], Value::Null);
-    }
-
-    /// The pre-existing cases must keep working: null and absent both become
-    /// the full all-null skeleton.
-    #[test]
-    fn a_null_or_absent_verifications_still_becomes_the_full_skeleton() {
-        for mut v in [
-            json!({ "object": "sign_up_attempt", "verifications": Value::Null }),
-            json!({ "object": "sign_up_attempt" }),
-        ] {
-            backfill_clerk_client_json(&mut v);
-            let ver = v["verifications"].as_object().unwrap();
-            assert_eq!(ver.len(), 4, "{ver:?}");
-        }
-    }
-}
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/src/lib.rs b/tray/src-tauri/vendor/tauri-plugin-clerk/src/lib.rs
deleted file mode 100644
index bc42e32a6..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/src/lib.rs
+++ /dev/null
@@ -1,345 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//! Vendored, patched fork of `tauri-plugin-clerk` 0.1.1
-//! (<https://github.com/Nipsuli/tauri-plugin-clerk>), pinned exact upstream
-//! for supply-chain control per `tray/src-tauri/Cargo.toml`'s original
-//! comment. Vendored (not forked on GitHub) so the fix lives in this repo,
-//! under the same review/CI/test gates as everything else, rather than in an
-//! external fork Meridian would have to maintain a build/publish pipeline
-//! for.
-//!
-//! # The bug this fixes
-//! Upstream issue: <https://github.com/Nipsuli/tauri-plugin-clerk/issues/7>
-//! ("`CLERK_AUTH_EVENT -> set_client` silently fails"), with an open,
-//! unmerged fix PR (#9) as of this vendoring. guest-js's client serializers
-//! (the separate `tauri-plugin-clerk` npm package, not vendored here — see
-//! [`backfill_clerk_client_json`] for why the fix lives Rust-side instead)
-//! omit several fields `clerk-fapi-rs`'s OpenAPI-generated models require to
-//! be explicitly present — a plain `Option<T>` field is optional under serde,
-//! but several of these use `deserialize_with = "Option::deserialize"`,
-//! which opts back into "key must be present" (accepts `null`, rejects
-//! absence) — and emit timestamps as fractional-second floats where the
-//! model wants an `i64`. Before this fix, deserializing the auth-change event
-//! for ANY real signed-in user failed on the first such field, silently (a
-//! bare `if let Ok(...)` with no `else`), so [`ClerkExt::clerk`]'s
-//! `set_client` was never called and the persisted offline session cache
-//! (`clerk-store.json`, via `with_tauri_store()`) never reflected a signed-in
-//! user. The user-visible effect: `ensure_clerk_initialized`'s `clerk.load()`
-//! falls back to that cache only when the live Clerk API fetch fails (e.g. no
-//! network yet at a fresh process's cold start), and the fallback was always
-//! empty — so the app would show the sign-in screen despite the user
-//! genuinely having signed in before. Fixed by [`backfill_clerk_client_json`]
-//! (structural, JSON-shape-driven — not a hardcoded field list) plus
-//! replacing the swallowed `if let Ok` with a `match` that surfaces both the
-//! outer-JSON and the post-backfill deserialize failure via `tracing::warn!`
-//! (see `meridian`'s `src/observability/filter.rs::CAPTURE_TARGETS`, which
-//! must include `"tauri_plugin_clerk"` for these to actually ship anywhere).
-//! The post-backfill deserialize error is wrapped in `serde_path_to_error` so
-//! the WARN log carries a JSON pointer to the exact failing field (e.g.
-//! `payload.session.status`) — added after a second, distinct instance of
-//! this same class of bug (`ClientSession.status` arriving `null`; see
-//! [`json_backfill::backfill_clerk_client_json`]'s doc) needed a raw-OTLP-spool
-//! read in production, with nothing but a bare `serde_json::Error` Display, to
-//! pin down which field it was.
-//!
-//! # Third incident (2026-08-20): the JSON pointer earned its keep
-//! The first two fixes did not end this. On 2026-08-20 a machine whose user
-//! WAS signed in logged this same WARN twice every ~44 seconds, with
-//! `path = payload.client.sign_in.status` and
-//! `error = invalid type: null, expected string or map`. So `set_client` had
-//! still never run, the offline cache was still empty, and session persistence
-//! had been broken the whole time the previous fix looked successful.
-//!
-//! Two lessons are worth more than the one-line fix:
-//!
-//! 1. **The `serde_path_to_error` pointer turned a spool dig into a grep.**
-//!    Diagnosing incident two needed raw-OTLP archaeology. This one was named
-//!    outright in the log line. Keep that wrapper.
-//! 2. **Hand-written "realistic" test fixtures hid the bugs.** The pre-existing
-//!    `sign_up`/`sign_in` fixtures were described as guest-js-shaped but had
-//!    been written from the model's requirements rather than transcribed from
-//!    the serializer, so they supplied fields guest-js never sends
-//!    (`abandon_at`, `password_enabled`, `custom_action`, `external_id`, a
-//!    populated `verifications`) and round-tripped cleanly. Transcribing the
-//!    real serializer exposed five more defects at once — see
-//!    `json_backfill`'s `idealized_sign_up_json` doc. **Copy the serializer;
-//!    do not describe it.**
-//!
-//! # Un-vendoring
-//! Once upstream releases a version with #9 (or an equivalent fix) merged,
-//! drop this directory, restore the crates.io dependency + version pin in
-//! `tray/src-tauri/Cargo.toml`, and delete this module doc.
-
-use clerk_fapi_rs::{
-    configuration::{ClientKind, Store as ClerkStateStore},
-    models::{ClientClient, ClientOrganization, ClientSession, ClientUser},
-    Clerk, ClerkFapiConfiguration,
-};
-use events::{
-    emit_clerk_auth_event, ClerkAuthEvent, ClerkAuthEventPayload, CLERK_AUTH_EVENT_NAME,
-    RUST_EVENT_SOURCE,
-};
-use parking_lot::RwLock;
-use std::sync::Arc;
-use tauri::{
-    plugin::{Builder, TauriPlugin},
-    AppHandle, Listener, Manager, Runtime,
-};
-use tauri_store::ClerkTauriStore;
-
-mod commands;
-mod events;
-mod json_backfill;
-mod tauri_store;
-
-use json_backfill::backfill_clerk_client_json;
-
-//
-#[derive(Clone)]
-pub struct ClerkStoreInternal {
-    pub clerk: Clerk,
-    pub publishable_key: String,
-    // TODO: proxy or domain
-}
-pub type ClerkStore = RwLock<ClerkStoreInternal>;
-
-/// Extensions to [`tauri::App`], [`tauri::AppHandle`] and [`tauri::Window`] to access the clerk APIs.
-#[allow(async_fn_in_trait)]
-pub trait ClerkExt<R: Runtime> {
-    /// Get the whole clerk store
-    fn clerk_store(&self) -> ClerkStoreInternal;
-    /// Get the Clerk instance
-    fn clerk(&self) -> Clerk;
-    /// Init method, idempotent
-    async fn ensure_clerk_initialized(&self) -> Result<(), String>;
-}
-
-fn clerk_auth_cb<R: Runtime>(
-    app: AppHandle<R>,
-    client: ClientClient,
-    session: Option<ClientSession>,
-    user: Option<ClientUser>,
-    organization: Option<ClientOrganization>,
-) {
-    emit_clerk_auth_event(
-        app,
-        ClerkAuthEventPayload {
-            client,
-            session,
-            user,
-            organization,
-        },
-    )
-}
-
-impl<R: Runtime, T: Manager<R>> crate::ClerkExt<R> for T {
-    fn clerk_store(&self) -> ClerkStoreInternal {
-        let app = self.app_handle();
-        let clerk_store = {
-            let app_clerk = app.state::<ClerkStore>();
-            let app_clerk = app_clerk.read();
-            app_clerk.clone()
-        };
-        clerk_store
-    }
-
-    fn clerk(&self) -> Clerk {
-        self.clerk_store().clerk
-    }
-
-    async fn ensure_clerk_initialized(&self) -> Result<(), String> {
-        let app_handle = self.app_handle();
-
-        // To avoid concurrent load calls, example multi window apps
-        // or running init call in React.useEffect hook
-        let app_clerk_init_lock = app_handle.state::<ClerkInitLock>();
-        let _app_clerk_init_lock = app_clerk_init_lock.lock().await;
-        //
-
-        let clerk = self.clerk();
-        if !clerk.loaded() {
-            // Clerk load will default loading from API and does fall back on cached
-            // resources in case of not being able to load resources from API. This
-            // allows the app to work in offline mode for signedin users.
-            clerk.load().await.map_err(|e| e.to_string())?;
-            let app_handle_inner = app_handle.clone();
-            clerk.add_listener(move |client, session, user, organization| {
-                let app_handle_clone = app_handle_inner.clone();
-                clerk_auth_cb(app_handle_clone, client, session, user, organization);
-            });
-
-            let app_handle_inner = app_handle.clone();
-            app_handle.listen(CLERK_AUTH_EVENT_NAME, move |event| {
-                let app_handle = app_handle_inner.clone();
-                let raw_payload = event.payload();
-                // Parse to a bare Value first (rather than straight to
-                // ClerkAuthEvent) so backfill_clerk_client_json can patch the
-                // fields guest-js omits before the strict, OpenAPI-generated
-                // clerk-fapi-rs models ever see it. See the module doc for
-                // why this exists (upstream issue #7).
-                let mut value = match serde_json::from_str::<serde_json::Value>(raw_payload) {
-                    Ok(value) => value,
-                    Err(e) => {
-                        tracing::warn!(
-                            error = %e,
-                            "clerk: auth event payload was not valid JSON"
-                        );
-                        return;
-                    }
-                };
-                backfill_clerk_client_json(&mut value);
-                // serde_path_to_error rather than a bare serde_json::from_value:
-                // a bare error's Display carries no field path, which is why
-                // the null-session-status bug (fixed alongside this) needed a
-                // raw-spool archaeology dig in production to pin down. `path`
-                // is a JSON pointer (e.g. `payload.session.status`), never a
-                // value, so it's safe to log at WARN.
-                let payload: ClerkAuthEvent = match serde_path_to_error::deserialize(&value) {
-                    Ok(payload) => payload,
-                    Err(e) => {
-                        // If this fires, a Clerk client shape appeared that
-                        // backfill_clerk_client_json doesn't yet normalize —
-                        // extend it (see json_backfill's tests for the
-                        // pattern) rather than re-swallowing the error.
-                        // `json_pointer`, NOT `path`: the value is safe to ship
-                        // either way, but `path` is denied by
-                        // `telemetry_spool::redact` on purpose (it normally means
-                        // a filesystem path), so naming it that dropped it from
-                        // every shipped record - and this field exists precisely
-                        // so a failure here does NOT need a raw-spool dig. The
-                        // 2026-08-24 `missing field \`id\`` incident was
-                        // diagnosed without it, by enumerating the model's
-                        // required fields by hand.
-                        tracing::warn!(
-                            error = %e.inner(),
-                            json_pointer = %e.path(),
-                            "clerk: auth event JSON still failed to deserialize after field \
-                             backfill — the offline session cache will not reflect this \
-                             sign-in, so a cold start without network will show signed-out"
-                        );
-                        return;
-                    }
-                };
-                if payload.source != RUST_EVENT_SOURCE {
-                    // MERIDIAN PATCH: was `debug!("Received ClerkAuthEvent:
-                    // {payload:?}")`, which renders the session JWT. See the
-                    // note in `events::emit_clerk_auth_event` for why presence
-                    // is the only thing this may say.
-                    tracing::debug!(
-                        source = %payload.source,
-                        has_session = payload.payload.session.is_some(),
-                        has_user = payload.payload.user.is_some(),
-                        "clerk: received auth event"
-                    );
-                    if let Err(e) = app_handle
-                        .clerk()
-                        .set_client(payload.payload.client.clone())
-                    {
-                        tracing::warn!(
-                            error = %e,
-                            "clerk: failed to persist signed-in client after auth event"
-                        );
-                    }
-                }
-            });
-        }
-        Ok(())
-    }
-}
-
-#[derive(Default)]
-pub struct ClerkInitLockInner {}
-pub type ClerkInitLock = tokio::sync::Mutex<ClerkInitLockInner>;
-
-/// Builder for the Clerk plugin
-#[derive(Default)]
-pub struct ClerkPluginBuilder {
-    /// Clerk publishable key
-    pub publishable_key: Option<String>,
-    // TODO: the proxy and domain should be
-    // mutually exclusive
-    /// Proxy URL
-    pub proxy: Option<String>,
-    /// Domain
-    pub domain: Option<String>,
-    /// Store
-    pub store: Option<Arc<dyn ClerkStateStore>>,
-    /// Flag to use tauri store, requires tauri-store-plugin
-    pub with_tauri_store: bool,
-}
-
-impl ClerkPluginBuilder {
-    /// Create a new builder instance
-    pub fn new() -> Self {
-        ClerkPluginBuilder::default()
-    }
-
-    /// Set the Clerk publishable key
-    pub fn publishable_key(mut self, key: impl Into<String>) -> Self {
-        self.publishable_key = Some(key.into());
-        self
-    }
-
-    /// Set the proxy URL
-    pub fn proxy(mut self, proxy: impl Into<String>) -> Self {
-        self.proxy = Some(proxy.into());
-        self
-    }
-
-    /// Set the domain
-    pub fn domain(mut self, domain: impl Into<String>) -> Self {
-        self.domain = Some(domain.into());
-        self
-    }
-
-    /// Set the store
-    pub fn store(mut self, store: impl ClerkStateStore + 'static) -> Self {
-        self.store = Some(Arc::new(store));
-        self
-    }
-
-    /// Set the Tauri store
-    pub fn with_tauri_store(mut self) -> Self {
-        self.with_tauri_store = true;
-        self
-    }
-
-    /// Build the Tauri plugin
-    pub fn build<R: Runtime>(self) -> TauriPlugin<R> {
-        Builder::<R>::new("clerk")
-            .invoke_handler(tauri::generate_handler![
-                commands::initialize,
-                commands::get_client_authorization_header,
-                commands::set_client_authorization_header
-            ])
-            .setup(move |app, _api| {
-                let publishable_key = self
-                    .publishable_key
-                    .ok_or("Clerk: Missing publishable_key".to_string())?;
-
-                let mut store = self.store;
-                if store.is_none() && self.with_tauri_store {
-                    use tauri_plugin_store::StoreExt;
-                    let clerk_store = app.store("clerk-store")?;
-                    store = Some(Arc::new(ClerkTauriStore::new(clerk_store)));
-                }
-
-                let config = ClerkFapiConfiguration::new_with_store(
-                    publishable_key.clone(),
-                    self.proxy,
-                    self.domain,
-                    store,
-                    None,
-                    ClientKind::NonBrowser,
-                )?;
-
-                let clerk = Clerk::new(config);
-                app.manage(RwLock::new(ClerkStoreInternal {
-                    clerk,
-                    publishable_key: publishable_key.clone(),
-                }));
-                app.manage(tokio::sync::Mutex::new(ClerkInitLockInner::default()));
-                Ok(())
-            })
-            .build()
-    }
-}
diff --git a/tray/src-tauri/vendor/tauri-plugin-clerk/src/tauri_store.rs b/tray/src-tauri/vendor/tauri-plugin-clerk/src/tauri_store.rs
deleted file mode 100644
index 985d9211d..000000000
--- a/tray/src-tauri/vendor/tauri-plugin-clerk/src/tauri_store.rs
+++ /dev/null
@@ -1,35 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-use clerk_fapi_rs::configuration::Store as ClerkStateStore;
-use serde_json::Value as JsonValue;
-use std::sync::Arc;
-use tauri::Runtime;
-use tauri_plugin_store::Store as TauriStore;
-
-#[derive(Clone)]
-pub struct ClerkTauriStore<R: Runtime> {
-    inner: Arc<TauriStore<R>>,
-}
-impl<R: Runtime> ClerkTauriStore<R> {
-    pub fn new(store: Arc<TauriStore<R>>) -> Self {
-        ClerkTauriStore { inner: store }
-    }
-}
-impl<R: Runtime> std::fmt::Debug for ClerkTauriStore<R> {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("ClerkTauriStore").finish()
-    }
-}
-impl<R: Runtime> ClerkStateStore for ClerkTauriStore<R> {
-    fn set(&self, key: &str, value: JsonValue) {
-        self.inner.set(key, value);
-    }
-    fn get(&self, key: &str) -> Option<JsonValue> {
-        self.inner.get(key)
-    }
-    fn has(&self, key: &str) -> bool {
-        self.inner.has(key)
-    }
-    fn delete(&self, key: &str) -> bool {
-        self.inner.delete(key)
-    }
-}
diff --git a/tray/src/app.js b/tray/src/app.js
index ec0f2e494..dcdc35024 100644
--- a/tray/src/app.js
+++ b/tray/src/app.js
@@ -535,11 +535,13 @@ async function armNotificationActions() {
 
 // ── Sign-in gate ────────────────────────────────────────────────────────────
 // The popover is locked until an account email is persisted Rust-side
-// (get_account_email) — the mirror of the dashboard window's Clerk session.
-// Signing in itself happens in the dashboard (its inline sign-in screen), since
-// this vanilla-JS popover can't host Clerk (React); the lock's CTA just routes
-// there. Re-checked on focus so a sign-in / sign-out in the dashboard is
-// reflected here the next time the popover is shown.
+// (get_account_email) — the mirror of the dashboard window's email-capture
+// gate (RequireEmailCapture). Signing in itself happens in the dashboard (its
+// inline capture screen), since this vanilla-JS popover can't host the OTP
+// form (React); the lock's CTA just routes there. Re-checked on focus so a
+// capture completed in the dashboard is reflected here the next time the
+// popover is shown. There is no sign-out anymore, so this only ever
+// transitions locked → unlocked, never back.
 const signinLock = $('signin-lock')
 let signedInKnown = null // last applied state; avoids redundant re-renders
 let liveStarted = false // the live popover machinery (below) runs at most once
@@ -594,7 +596,7 @@ async function checkAuth() {
     applyAuthGate(!!email)
   } catch {
     // A transient read failure must not lock the user out of their own app —
-    // fail open (the dashboard's Clerk gate is the authoritative check).
+    // fail open (the dashboard's email-capture gate is the authoritative check).
     applyAuthGate(true)
   }
 }
diff --git a/ui/__tests__/clerkNetworkError.test.ts b/ui/__tests__/clerkNetworkError.test.ts
deleted file mode 100644
index cd3f9416d..000000000
--- a/ui/__tests__/clerkNetworkError.test.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-import { describe, it, expect, afterEach } from 'bun:test'
-import { isLikelyClerkNetworkError } from '../lib/clerkNetworkError'
-
-// Regression coverage for a real report: a staging build showed "Sign-in
-// couldn't start - check CLERK_PUBLISHABLE_KEY and restart" on a Mac right
-// after a machine restart, with a correctly-configured key. Root cause: the
-// tray auto-launches at login before the OS has network up, so `clerk.load()`
-// rejects on a connection failure - `ClerkErrorBoundary` showed the
-// misconfiguration message for what was actually a transient offline window.
-// This classifier is what lets the boundary tell the two apart.
-
-describe('isLikelyClerkNetworkError', () => {
-  afterEach(() => {
-    // @ts-expect-error -- test-only override of a read-only DOM property
-    delete global.navigator
-  })
-
-  it('is true for a reqwest/clerk-fapi-rs connection failure (Rust side)', () => {
-    expect(isLikelyClerkNetworkError(new Error(
-      'error trying to connect: dns error: failed to lookup address information: nodename nor servname provided, or not known',
-    ))).toBe(true)
-  })
-
-  it('is true for a plain "error sending request" reqwest wrapper', () => {
-    expect(isLikelyClerkNetworkError(new Error('error sending request for url (https://clerk.meridiona.com/v1/client)'))).toBe(true)
-  })
-
-  it('is true for the browser fetch failure wording (JS-side Clerk load)', () => {
-    expect(isLikelyClerkNetworkError(new Error('Failed to fetch'))).toBe(true)
-    expect(isLikelyClerkNetworkError(new Error('NetworkError when attempting to fetch resource.'))).toBe(true)
-  })
-
-  it('is true for a Safari-style offline message', () => {
-    expect(isLikelyClerkNetworkError('The Internet connection appears to be offline.')).toBe(true)
-  })
-
-  it('is true for a Chromium net-error code', () => {
-    expect(isLikelyClerkNetworkError(new Error('net::ERR_INTERNET_DISCONNECTED'))).toBe(true)
-  })
-
-  it('is true whenever the browser itself reports offline, regardless of message', () => {
-    // @ts-expect-error -- test-only global override
-    global.navigator = { onLine: false }
-    expect(isLikelyClerkNetworkError(new Error('some completely unrelated error text'))).toBe(true)
-  })
-
-  it('is false for a malformed/wrong-instance publishable key error', () => {
-    expect(isLikelyClerkNetworkError(new Error('Missing publishableKey'))).toBe(false)
-    expect(isLikelyClerkNetworkError(new Error('Clerk: Missing publishable_key'))).toBe(false)
-  })
-
-  it('is false for an unrelated JS error', () => {
-    expect(isLikelyClerkNetworkError(new TypeError('Cannot read properties of undefined'))).toBe(false)
-  })
-
-  it('handles non-Error rejection shapes without throwing', () => {
-    expect(isLikelyClerkNetworkError(undefined)).toBe(false)
-    expect(isLikelyClerkNetworkError(null)).toBe(false)
-    expect(isLikelyClerkNetworkError({ code: 'native_api_disabled' })).toBe(false)
-  })
-})
diff --git a/ui/__tests__/otp-errors.test.ts b/ui/__tests__/otp-errors.test.ts
new file mode 100644
index 000000000..bd7ed3ffd
--- /dev/null
+++ b/ui/__tests__/otp-errors.test.ts
@@ -0,0 +1,117 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//
+// Coverage for `ui/lib/otp-errors.ts`, the sentinel-string → copy mapping
+// `OtpForm.tsx` renders. Extracted as pure functions specifically so this is
+// testable at all — this codebase's test suite (bun test) has no DOM/React
+// rendering harness, so a component's behavior is only pinned through logic
+// it delegates to a plain function (the same shape `signin-required.test.ts`
+// used for `resolveSignInRequired` before this change removed both).
+//
+// Also source-scans `OtpForm.tsx` for a few static invariants a headless run
+// cannot exercise: no leftover `@clerk/react`/`tauri-plugin-clerk` import, and
+// the plain-hyphen rule (CLAUDE.md's Hard Rules) for user-facing copy.
+
+import { describe, it, expect } from 'bun:test'
+import { readFileSync } from 'node:fs'
+import { classifySendError, classifyVerifyError } from '../lib/otp-errors'
+import { stripComments } from './helpers/source'
+
+const uiRoot = import.meta.dir + '/..'
+
+describe('classifySendError', () => {
+  it('maps invalid_email to a user-fixable message', () => {
+    expect(classifySendError('invalid_email').message).toContain('valid email')
+    expect(classifySendError('invalid_email').isDevBypass).toBe(false)
+  })
+
+  it('maps rate_limited and unavailable to distinct retry copy', () => {
+    const rateLimited = classifySendError('rate_limited').message
+    const unavailable = classifySendError('unavailable').message
+    expect(rateLimited).not.toEqual(unavailable)
+    expect(rateLimited.toLowerCase()).toContain('too many')
+    expect(unavailable.toLowerCase()).toContain('unavailable')
+  })
+
+  it('is the ONLY sentinel that sets isDevBypass — not_configured', () => {
+    expect(classifySendError('not_configured').isDevBypass).toBe(true)
+    for (const other of ['invalid_email', 'rate_limited', 'unavailable', 'unauthorized', 'garbage', '']) {
+      expect(classifySendError(other).isDevBypass).toBe(false)
+    }
+  })
+
+  it('unauthorized (an attestation/config failure) shows the generic message, never a config hint', () => {
+    // An unauthorized bearer token is a build problem, not something the user
+    // can fix — it must not be confused with `not_configured`'s dev-notice copy.
+    const msg = classifySendError('unauthorized').message
+    expect(msg.toLowerCase()).not.toContain('otp_api_url')
+  })
+
+  it('falls back to the generic message for an unrecognised sentinel or a real Error', () => {
+    expect(classifySendError('unexpected_status:500').message).toContain('Something went wrong')
+    expect(classifySendError(new Error('network down')).message).toContain('Something went wrong')
+    expect(classifySendError(undefined).message).toContain('Something went wrong')
+  })
+})
+
+describe('classifyVerifyError', () => {
+  // The Worker deliberately returns the same signal ("expired") for BOTH "no
+  // live code for this email" and "you used up your 5 attempts" - see
+  // infra/otp-worker/src/otp.ts's VerifyOutcome doc - so there is no separate
+  // "too_many_attempts" sentinel to classify here anymore.
+  it('maps expired to a request-a-new-code message', () => {
+    expect(classifyVerifyError('expired').message.toLowerCase()).toContain('request a new')
+  })
+
+  it('flags not_configured as the dev-bypass case', () => {
+    expect(classifyVerifyError('not_configured').isDevBypass).toBe(true)
+    expect(classifyVerifyError('expired').isDevBypass).toBe(false)
+  })
+
+  it('falls back to the generic message for anything unrecognised', () => {
+    expect(classifyVerifyError('unexpected_status:500').message).toContain('Something went wrong')
+  })
+})
+
+describe('user-facing OTP copy follows the plain-hyphen rule', () => {
+  it('never uses an em-dash, en-dash, or double hyphen', () => {
+    const sentinels = [
+      'invalid_email', 'rate_limited', 'unavailable', 'unauthorized', 'not_configured', 'garbage',
+    ]
+    const messages = [
+      ...sentinels.map((s) => classifySendError(s).message),
+      ...sentinels.map((s) => classifyVerifyError(s).message),
+      ...['expired', 'invalid_input'].map((s) => classifyVerifyError(s).message),
+      ...['blocked'].map((s) => classifySendError(s).message),
+    ]
+    for (const m of messages) expect(m).not.toMatch(/[—–]|--/)
+  })
+})
+
+describe('OtpForm.tsx', () => {
+  // Comments stripped first (CLAUDE.md's memory: `include_str!ing`/scanning
+  // your own historical-context prose is how a source scan matches itself —
+  // this file's own module doc mentions "@clerk/react" by name, in prose
+  // explaining what it replaced).
+  const src = stripComments(readFileSync(`${uiRoot}/app/setup/signin/OtpForm.tsx`, 'utf8'))
+
+  it('has no leftover Clerk dependency', () => {
+    expect(src).not.toContain('@clerk/react')
+    expect(src).not.toContain('tauri-plugin-clerk')
+    expect(src).not.toContain('useSignIn')
+    expect(src).not.toContain('useSignUp')
+  })
+
+  it('calls the OTP commands, not a Clerk API', () => {
+    expect(src).toContain("'request_account_otp'")
+    expect(src).toContain("'confirm_account_otp'")
+  })
+
+  it('saves the email itself before reporting a successful sign-in up', () => {
+    // Per the plan: OtpForm calls save_account_email on a verified code, then
+    // the passed-in onSignedIn — confirm_account_otp itself never does this.
+    const saveIdx = src.indexOf("'save_account_email'")
+    const onSignedInCallIdx = src.indexOf('onSignedIn(email)')
+    expect(saveIdx).toBeGreaterThan(-1)
+    expect(onSignedInCallIdx).toBeGreaterThan(saveIdx)
+  })
+})
diff --git a/ui/__tests__/require-email-capture.test.ts b/ui/__tests__/require-email-capture.test.ts
new file mode 100644
index 000000000..7b1c8dc2d
--- /dev/null
+++ b/ui/__tests__/require-email-capture.test.ts
@@ -0,0 +1,70 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+//
+// Replacement coverage for what `signin-required.test.ts` used to pin before
+// this change deleted both it and `RequireSignIn.tsx`.
+//
+// THE POLARITY FLIPPED ON PURPOSE. The old `resolveSignInRequired` failed
+// CLOSED on a rejected `invoke` (a broken bridge must land ON the gate, since
+// `RequireSignIn` was hiding a real, currently-enforced live session
+// requirement — defaulting open would have let anyone past a sign-in that was
+// actually still required). `RequireEmailCapture` is a ONE-TIME capture, not a
+// session: there is nothing to bypass once an email has ever been saved, so a
+// transient IPC hiccup must never re-lock an already-captured user. The cost
+// of failing open here is "show the capture form again, harmlessly" — never a
+// security hole, unlike the case the old test guarded.
+
+import { describe, it, expect } from 'bun:test'
+import { readFileSync } from 'node:fs'
+import { resolveCaptureState } from '../app/setup/signin/RequireEmailCapture'
+import { stripComments } from './helpers/source'
+
+const uiRoot = import.meta.dir + '/..'
+const read = (rel: string) => stripComments(readFileSync(uiRoot + rel, 'utf8'))
+
+describe('resolveCaptureState', () => {
+  it('is needs_capture when nothing has ever been saved', async () => {
+    expect(await resolveCaptureState(async () => null)).toBe('needs_capture')
+  })
+
+  it('is ready when an email is already captured', async () => {
+    expect(await resolveCaptureState(async () => 'user@example.com')).toBe('ready')
+  })
+
+  it('FAILS OPEN when the command rejects — the inverted case', async () => {
+    const boom = async () => { throw new Error('command not found') }
+    expect(await resolveCaptureState(boom)).toBe('ready')
+  })
+
+  it('fails open when the command rejects with a non-Error (Tauri rejects with a plain string)', async () => {
+    const boom = () => Promise.reject('unknown command: get_account_email')
+    expect(await resolveCaptureState(boom)).toBe('ready')
+  })
+
+  it('always settles, so a caller can never hang on it', async () => {
+    const hung = Promise.race([
+      resolveCaptureState(() => Promise.reject(new Error('x'))),
+      new Promise((_, rej) => setTimeout(() => rej(new Error('never settled')), 1000)),
+    ])
+    expect(await hung).toBe('ready')
+  })
+})
+
+describe('RequireEmailCapture.tsx', () => {
+  const src = read('/app/setup/signin/RequireEmailCapture.tsx')
+
+  it('has no leftover Clerk dependency', () => {
+    expect(src).not.toContain('@clerk/react')
+    expect(src).not.toContain('ClerkGate')
+    expect(src).not.toContain('useSignInRequired')
+  })
+
+  it('checks the Tauri runtime before ever calling invoke', () => {
+    // Mirrors the deleted ClerkGate's non-Tauri fallback: outside the webview
+    // there is no bridge to reach at all.
+    expect(src).toContain('isTauri()')
+  })
+
+  it('renders through the shared resolver rather than re-rolling the invoke call inline', () => {
+    expect(src).toContain('resolveCaptureState()')
+  })
+})
diff --git a/ui/__tests__/setup-one-typeface.test.ts b/ui/__tests__/setup-one-typeface.test.ts
index 812ffb8a5..6884c776c 100644
--- a/ui/__tests__/setup-one-typeface.test.ts
+++ b/ui/__tests__/setup-one-typeface.test.ts
@@ -56,7 +56,7 @@ describe('the setup wizard uses one typeface', () => {
 
   it('never hard-codes a font family', () => {
     // `fontFamily: 'inherit'` is allowed and is not a family - it is the opposite,
-    // an explicit refusal to pick one (EmailCodeForm's input uses it so the OTP
+    // an explicit refusal to pick one (OtpForm's input uses it so the OTP
     // boxes match the surrounding card).
     const offenders: string[] = []
     for (const f of files) {
diff --git a/ui/__tests__/signin-required.test.ts b/ui/__tests__/signin-required.test.ts
deleted file mode 100644
index e366484ee..000000000
--- a/ui/__tests__/signin-required.test.ts
+++ /dev/null
@@ -1,107 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-//
-// The sign-in gate: `commands::account::sign_in_required` decides whether this
-// build requires an account, and THREE frontend surfaces have to act on the
-// same answer — the dashboard-wide `RequireSignIn`, the setup wizard's sign-in
-// step, and Settings → Account's `AccountAuthControl`.
-//
-// Two classes of bug this locks down, both of which actually happened:
-//
-//   1. FAILING OPEN. A rejected `invoke` must land on the gate. Two of the
-//      three copies had no `.catch` at all, so a rejection left the promise
-//      unsettled and the surface hung blank forever — and any "fix" that
-//      defaulted to `false` would have been strictly worse: a broken bridge
-//      would unlock the app.
-//   2. RE-ROLLING IT. The copies drifted precisely because each site wrote its
-//      own. The source scan below fails if a new consumer calls the command
-//      directly instead of going through the shared hook.
-//
-// The behavioural half needs no DOM: `resolveSignInRequired` takes its asker as
-// a parameter for exactly this reason (mirroring `sign_in_required_for` on the
-// Rust side, which takes the key rather than looking it up).
-
-import { describe, it, expect } from 'bun:test'
-import { readFileSync } from 'node:fs'
-import { resolveSignInRequired } from '../lib/signin-required'
-import { stripComments } from './helpers/source'
-
-const uiRoot = import.meta.dir + '/..'
-const read = (rel: string) => stripComments(readFileSync(uiRoot + rel, 'utf8'))
-
-/** Every surface that acts on the answer. */
-const CONSUMERS = [
-  '/app/setup/signin/RequireSignIn.tsx',
-  '/app/setup/signin/AccountAuthControl.tsx',
-  '/app/setup/page.tsx',
-]
-
-describe('resolveSignInRequired', () => {
-  it('passes through a true answer', async () => {
-    expect(await resolveSignInRequired(async () => true)).toBe(true)
-  })
-
-  it('passes through a false answer — the contributor bypass', async () => {
-    expect(await resolveSignInRequired(async () => false)).toBe(false)
-  })
-
-  it('fails CLOSED when the command rejects', async () => {
-    const boom = async () => { throw new Error('command not found') }
-    expect(await resolveSignInRequired(boom)).toBe(true)
-  })
-
-  it('fails CLOSED when the command rejects with a non-Error', async () => {
-    // Tauri rejects with a plain string, not an Error — a `catch (e)` that
-    // assumed `e.message` would throw again inside the handler.
-    const boom = () => Promise.reject('unknown command: sign_in_required')
-    expect(await resolveSignInRequired(boom)).toBe(true)
-  })
-
-  it('always settles, so a caller can never hang on it', async () => {
-    // The original bug was an unsettled promise, not a wrong value: the surface
-    // sat on its `null` loading state forever. A timeout race is the only way to
-    // assert "this resolves at all".
-    const hung = Promise.race([
-      resolveSignInRequired(() => Promise.reject(new Error('x'))),
-      new Promise((_, rej) => setTimeout(() => rej(new Error('never settled')), 1000)),
-    ])
-    expect(await hung).toBe(true)
-  })
-})
-
-describe('the gate has one implementation', () => {
-  it('no consumer invokes sign_in_required directly', () => {
-    for (const rel of CONSUMERS) {
-      expect(read(rel)).not.toContain("'sign_in_required'")
-    }
-  })
-
-  it('every consumer goes through the shared hook', () => {
-    for (const rel of CONSUMERS) {
-      expect(read(rel)).toContain('useSignInRequired')
-    }
-  })
-
-  it('only the shared module names the command', () => {
-    expect(read('/lib/signin-required.ts')).toContain("invoke<boolean>('sign_in_required')")
-  })
-})
-
-describe('the gate holds while the answer is unknown', () => {
-  // `null` means "not resolved yet". Treating it as falsy would flash the app
-  // open, or mount a Clerk hook with no provider above it — the crash that took
-  // down the whole Settings modal.
-  it('each consumer branches on an explicit null before acting', () => {
-    for (const rel of CONSUMERS.slice(0, 2)) {
-      expect(read(rel)).toContain('signInRequired === null')
-    }
-  })
-
-  it('the wizard step only opens on an explicit false', () => {
-    const steps = read('/app/setup/steps.tsx')
-    // `canNext` must test `=== false`, never `!signInRequired` — the latter is
-    // true while still loading and would let the user past a step that has not
-    // been decided yet.
-    expect(steps).toContain('signInRequired === false')
-    expect(steps).not.toContain('!s.signInRequired')
-  })
-})
diff --git a/ui/__tests__/windows-notification-permission.test.ts b/ui/__tests__/windows-notification-permission.test.ts
index 68ac0df59..c1d1c6845 100644
--- a/ui/__tests__/windows-notification-permission.test.ts
+++ b/ui/__tests__/windows-notification-permission.test.ts
@@ -12,7 +12,9 @@ import { readFileSync } from 'fs'
 // where a step whose entire content is one satisfied toggle has nothing to ask —
 // and the assertions below pin that condition rather than the branch. This test
 // is a string-source guard (the same pattern as the Settings → Notifications
-// guard) because steps.tsx pulls in the whole React/Clerk import graph.
+// guard) because steps.tsx pulls in the whole wizard's component/import graph
+// (LlmProviderPicker, IntegrationConnect, the OTP form, …), too heavy to mount
+// in this test suite's no-DOM bun test runner.
 //
 // The assertions are ANCHORED to the specific declaration they guard — an
 // earlier version scanned the whole file with `[\s\S]*` and matched the macOS
diff --git a/ui/app/page.tsx b/ui/app/page.tsx
index 8f3b97115..83c19b7a7 100644
--- a/ui/app/page.tsx
+++ b/ui/app/page.tsx
@@ -1,13 +1,15 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
 import MeridianTimelineShell from '@/components/timeline/MeridianTimelineShell'
-import { RequireSignIn } from '@/app/setup/signin'
+import { RequireEmailCapture } from '@/app/setup/signin'
 
-// Sign-in is compulsory: RequireSignIn hides the whole app behind an inline
-// sign-in screen until a live Clerk session exists, and re-locks on sign-out.
+// Email capture is compulsory: RequireEmailCapture hides the whole app behind
+// an inline capture screen until an email has ever been saved. There is no
+// session and no sign-out, so unlike the old RequireSignIn this never re-locks
+// once captured.
 export default function Root() {
   return (
-    <RequireSignIn>
+    <RequireEmailCapture>
       <MeridianTimelineShell />
-    </RequireSignIn>
+    </RequireEmailCapture>
   )
 }
diff --git a/ui/app/setup/page.tsx b/ui/app/setup/page.tsx
index 86b6632c7..04eb4a26b 100644
--- a/ui/app/setup/page.tsx
+++ b/ui/app/setup/page.tsx
@@ -18,7 +18,6 @@ import type { IntegrationsResponse } from '@/lib/api-types'
 import type { RuntimeSettings } from '@/lib/settings'
 import { DEFAULT_LLM_PROVIDER, providerChoiceFields, type LlmProviderId } from '@/lib/llm-providers'
 import { useLlmProviderDetection } from '@/components/LlmProviderPicker'
-import { useSignInRequired } from '@/lib/signin-required'
 import { Btn, DISPLAY, Kicker } from './atoms'
 
 /** Where the wizard stores how far the user got, so quitting mid-setup resumes
@@ -146,15 +145,16 @@ export default function SetupWizard() {
   // (get_integrations) so the rail status + completion summary stay accurate.
   const [integrations, setIntegrations] = useState<IntegrationsResponse | null>(null)
 
-  // Step 3 — sign in (Clerk email one-time-code — see ./signin.tsx). The
-  // widget owns its own form/busy/error state; this just holds the result.
+  // Step 3 — email capture (one-time OTP — see ./signin.tsx). The form owns its
+  // own busy/error state; this just holds the result.
   const [signedInEmail, setSignedInEmail] = useState<string | null>(null)
 
-  // Whether sign-in is required at all — false ONLY in a debug build with no
-  // Clerk publishable key configured, the fresh-clone contributor case. See
-  // `@/lib/signin-required`; the wizard step treats `null` as "required" so a
-  // slow answer never opens the step early.
-  const signInRequired = useSignInRequired()
+  // Whether the OTP Worker reported "not configured" — discovered reactively
+  // from a failed send/verify attempt (see `Wiz.otpNotConfigured`'s doc in
+  // steps.tsx), the fresh-clone contributor case with no `OTP_API_URL` set.
+  // Starts false and never resets once true.
+  const [otpNotConfigured, setOtpNotConfigured] = useState(false)
+  const onDevBypass = useCallback(() => setOtpNotConfigured(true), [])
 
   // Step 4 — intelligence. The provider the whole prose pipeline obeys. Persisted to
   // settings.json immediately on pick (not batched to Finish): if the user quits the
@@ -285,10 +285,11 @@ export default function SetupWizard() {
     } catch (e) { setErr(String(e)) }
   }, [])
 
-  // Persists the Clerk-verified email so the Rust side knows who's signed in
-  // even after this webview session ends (see commands::save_account_email).
-  // Best-effort: a failed write here never blocks the wizard — the widget
-  // already has a live Clerk session and lets the user through regardless.
+  // Persists the verified email so the Rust side knows who's signed in even
+  // after this webview session ends (see commands::save_account_email).
+  // Best-effort: a failed write here never blocks the wizard — `OtpForm`
+  // already made its own (also best-effort) call and lets the user through
+  // regardless.
   const onSignedIn = useCallback((email: string) => {
     setSignedInEmail(email)
     invoke('save_account_email', { email }).catch(() => {})
@@ -298,7 +299,7 @@ export default function SetupWizard() {
     platform,
     perms, openPane, grantScreen, grantNotifications,
     integrations, refetchIntegrations,
-    signedInEmail, onSignedIn, signInRequired,
+    signedInEmail, onSignedIn, otpNotConfigured, onDevBypass,
     provider, providerCustomId, setProvider, providers, scanningProviders,
     testingProviderIds, installingProviderIds, signingProviderIds,
     testProvider, installProvider, signInProvider, rescanProviders,
@@ -359,8 +360,8 @@ export default function SetupWizard() {
   // So on these steps the card is `height: auto`, measures its OWN rendered
   // height (`cardRef` + ResizeObserver below), and the window follows it - the
   // content is never the thing that has to fit, so there is nothing to scroll.
-  const autoSized = !welcome && (meta?.id === 'signin' || meta?.id === 'permissions')
-  const isSignin = !welcome && meta?.id === 'signin'
+  const autoSized = !welcome && (meta?.id === 'email' || meta?.id === 'permissions')
+  const isEmailStep = !welcome && meta?.id === 'email'
   const cardRef = useRef<HTMLDivElement>(null)
   const [measuredHeight, setMeasuredHeight] = useState<number | null>(null)
   // Re-runs on every step change so a stale measurement from the previous
@@ -445,12 +446,12 @@ export default function SetupWizard() {
           />
         ) : (
           <div className="flex flex-col" style={{ height: '100%' }}>
-            <div style={{ padding: '26px 32px 14px', textAlign: isSignin ? 'center' : 'left' }}>
+            <div style={{ padding: '26px 32px 14px', textAlign: isEmailStep ? 'center' : 'left' }}>
               <Kicker style={{ marginBottom: 9 }}>{meta.kicker}</Kicker>
               <h1 style={{ ...DISPLAY, fontSize: 23, lineHeight: 1.1, color: 'var(--t-title)' }}>{meta.title}</h1>
               <p style={{
                 fontSize: 12.5, lineHeight: 1.5, color: 'var(--t-muted)', marginTop: 8,
-                maxWidth: isSignin ? 340 : 620, marginLeft: isSignin ? 'auto' : undefined, marginRight: isSignin ? 'auto' : undefined,
+                maxWidth: isEmailStep ? 340 : 620, marginLeft: isEmailStep ? 'auto' : undefined, marginRight: isEmailStep ? 'auto' : undefined,
                 textWrap: 'pretty',
               }}>{meta.subtitle}</p>
             </div>
diff --git a/ui/app/setup/signin.tsx b/ui/app/setup/signin.tsx
index 379f209ad..1d746c6cf 100644
--- a/ui/app/setup/signin.tsx
+++ b/ui/app/setup/signin.tsx
@@ -1,13 +1,15 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
 'use client'
 
-// Thin `next/dynamic` boundary in front of `./signin/` (the real Clerk
-// sign-in widgets). `{ ssr: false }` is load-bearing here — `@clerk/clerk-js`
-// pulls in a transitive Solana wallet-adapter chain that touches `window` at
-// module-eval time, which Next's Node prerender pass has none of, so a direct
-// import crashes the static export build. Having zero `@clerk/react` imports
-// at this top level is exactly what lets `steps.tsx` (and `AccountSection.tsx`)
-// import this module directly and safely.
+// Thin `next/dynamic` boundary in front of `./signin/` (the OTP email-capture
+// widgets). `{ ssr: false }` keeps this module's importers (`steps.tsx`,
+// `AccountSection.tsx`) free of any heavy client-only dependency the `signin/`
+// module might ever pick up (e.g. a Turnstile script tag) — the same
+// contract this boundary held when the module underneath was Clerk-backed
+// (`@clerk/clerk-js` pulled in a transitive Solana wallet-adapter chain that
+// touched `window` at module-eval time, crashing the static export's Node
+// prerender pass; nothing in the OTP flow does that today, but the boundary
+// costs nothing to keep).
 
 import dynamic from 'next/dynamic'
 import type { ReactNode } from 'react'
@@ -22,7 +24,7 @@ function GateLoading() {
   )
 }
 
-const SignInWidgetImpl = dynamic(() => import('./signin/SignInWidget').then((m) => m.SignInWidget), {
+const OtpFormImpl = dynamic(() => import('./signin/OtpForm').then((m) => m.OtpForm), {
   ssr: false,
   loading: GateLoading,
 })
@@ -32,38 +34,37 @@ const AccountAuthControlImpl = dynamic(() => import('./signin/AccountAuthControl
   loading: GateLoading,
 })
 
-const RequireSignInImpl = dynamic(() => import('./signin/RequireSignIn').then((m) => m.RequireSignIn), {
+const RequireEmailCaptureImpl = dynamic(() => import('./signin/RequireEmailCapture').then((m) => m.RequireEmailCapture), {
   ssr: false,
-  // A signed-out user must sign in before seeing the app, so the pre-Clerk
-  // placeholder is a blank surface, not a spinner over app chrome.
+  // A not-yet-captured user must see the capture screen before the app, so
+  // the pre-mount placeholder is a blank surface, not a spinner over app chrome.
   loading: () => null,
 })
 
-/** The setup wizard's Sign-in step body. Calls `onSignedIn(email)` once a
- *  Clerk session exists (fresh sign-in, or an already-persisted one from a
- *  previous launch) — never gates or hides anything itself; the wizard's
- *  `SignInBody` (steps.tsx) decides what to render based on that callback's
- *  result (`wiz.signedInEmail`). */
-export function SignInWidget({ onSignedIn }: { onSignedIn: (email: string) => void }) {
-  return <SignInWidgetImpl onSignedIn={onSignedIn} />
+/** The setup wizard's Email step body. Calls `onSignedIn(email)` once a code
+ *  verifies (fresh capture, or `onDevBypass` when no Worker is configured) —
+ *  never gates or hides anything itself; the wizard's `SignInBody`
+ *  (steps.tsx) decides what to render based on that callback's result
+ *  (`wiz.signedInEmail`). */
+export function OtpForm({ onSignedIn, onDevBypass }: {
+  onSignedIn: (email: string) => void
+  onDevBypass?: () => void
+}) {
+  return <OtpFormImpl onSignedIn={onSignedIn} onDevBypass={onDevBypass} />
 }
 
-/** Settings → Account's sign-in/sign-out control (see AccountSection.tsx) —
- *  same live Clerk session as the rest of the dashboard (RequireSignIn
- *  already established it; see AccountAuthControl.tsx's module doc for why
- *  this must NOT mount a second ClerkProvider), shows who's signed in and
- *  lets them sign out. */
-export function AccountAuthControl({ onSignedIn, onSignedOut }: {
+/** Settings → Account's account control (see AccountSection.tsx) — shows the
+ *  captured email and lets it be changed. See `./signin/AccountAuthControl.tsx`. */
+export function AccountAuthControl({ onSignedIn }: {
   onSignedIn: (email: string) => void
-  onSignedOut: () => void
 }) {
-  return <AccountAuthControlImpl onSignedIn={onSignedIn} onSignedOut={onSignedOut} />
+  return <AccountAuthControlImpl onSignedIn={onSignedIn} />
 }
 
-/** Product-wide sign-in gate for the dashboard window — renders `children`
- *  only when a live Clerk session exists, otherwise an inline full-window
- *  sign-in screen. Makes sign-in compulsory: sign out and the app re-locks.
- *  See `./signin/RequireSignIn.tsx`. */
-export function RequireSignIn({ children }: { children: ReactNode }) {
-  return <RequireSignInImpl>{children}</RequireSignInImpl>
+/** Product-wide email-capture gate for the dashboard window — renders
+ *  `children` once an email has ever been captured, otherwise an inline
+ *  full-window capture screen. A fire-once check, not a live session: there
+ *  is no sign-out to re-lock against. See `./signin/RequireEmailCapture.tsx`. */
+export function RequireEmailCapture({ children }: { children: ReactNode }) {
+  return <RequireEmailCaptureImpl>{children}</RequireEmailCaptureImpl>
 }
diff --git a/ui/app/setup/signin/AccountAuthControl.tsx b/ui/app/setup/signin/AccountAuthControl.tsx
index ab39b0de1..9633520d9 100644
--- a/ui/app/setup/signin/AccountAuthControl.tsx
+++ b/ui/app/setup/signin/AccountAuthControl.tsx
@@ -1,131 +1,87 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
 'use client'
 
-// Settings → Account's sign-in/sign-out control — see `../signin.tsx` for
-// why this module (and everything it imports) is only ever loaded through a
+// Settings → Account's account control — see `../signin.tsx` for why this
+// module (and everything it imports) is only ever loaded through a
 // `next/dynamic(..., { ssr: false })` boundary, never imported directly.
 //
-// Unlike SignInWidget and RequireSignIn, this does NOT wrap itself in a
-// ClerkGate: Settings is only ever reachable from inside the dashboard,
-// which RequireSignIn (app/page.tsx) already wraps in one ClerkProvider.
-// A second <ClerkProvider> here would nest inside that one, and
-// @clerk/react hard-refuses that ("You've added multiple <ClerkProvider>
-// components") — the exact crash this used to throw, caught by
-// ClerkErrorBoundary and shown as a generic "not configured" message that
-// had nothing to do with configuration. useClerk()/useSignedInEmail() below
-// read from RequireSignIn's already-live provider instead.
+// There is no session to sign out of (see RequireEmailCapture.tsx's module
+// doc), so unlike the old Clerk-backed version this offers "Change email"
+// instead of "Sign out" — a plain overwrite via `save_account_email`, not a
+// clear-then-recapture. `onSignedOut` was dropped from this component's props
+// entirely along with the branch that used it (see AccountSection.tsx, its
+// only caller).
 
-import { useState } from 'react'
-import { useClerk } from '@clerk/react'
-import { useSignInRequired } from '@/lib/signin-required'
+import { useEffect, useState } from 'react'
+import { invoke } from '@/lib/bridge'
 import { Btn, Spinner } from '../atoms'
-import { useSignedInEmail } from './useSignedInEmail'
 import { GateLoading, AccountIdentityRow } from './identity'
-import { EmailCodeForm } from './EmailCodeForm'
+import { OtpForm } from './OtpForm'
 
-const SIGNED_IN_CAPTION = 'Signed in with a one-time email code'
+const SIGNED_IN_CAPTION = 'Verified by a one-time email code'
 
-/** An identity row (avatar, email, how they signed in) with a Sign out
- *  action, or the sign-in form if not signed in yet — the standard "who am I
- *  signed in as" pattern (Linear/Notion/Raycast account rows). Unlike the
- *  setup wizard's `SignInWidget`, this surfaces the signed-in state instead
- *  of hiding it: the user came here specifically to check/change it. */
-function AccountStatus({ onSignedIn, onSignedOut }: {
-  onSignedIn: (email: string) => void
-  onSignedOut: () => void
-}) {
-  const { signOut } = useClerk()
-  const [busy, setBusy] = useState(false)
-  const [err, setErr] = useState('')
-  const { isLoaded, isSignedIn, email, resetNotified } = useSignedInEmail(onSignedIn)
+/** An identity row (avatar, email, how it was captured) with a Change email
+ *  action, or the capture form if nothing has ever been saved — the standard
+ *  "who am I signed in as" pattern (Linear/Notion/Raycast account rows).
+ *  Unlike the setup wizard's step body, this surfaces the captured state
+ *  instead of hiding it: the user came here specifically to check/change it. */
+function AccountStatus({ onSignedIn }: { onSignedIn: (email: string) => void }) {
+  const [email, setEmail] = useState<string | null | undefined>(undefined)
+  const [changing, setChanging] = useState(false)
+
+  useEffect(() => {
+    let live = true
+    invoke<string | null>('get_account_email')
+      .then((e) => { if (live) setEmail(e) })
+      .catch(() => { if (live) setEmail(null) })
+    return () => { live = false }
+  }, [])
 
-  if (!isLoaded) return <GateLoading />
+  if (email === undefined) return <GateLoading />
 
-  if (isSignedIn && email) {
+  if (email && !changing) {
     return (
-      <div className="flex flex-col" style={{ gap: 8 }}>
-        <AccountIdentityRow
-          email={email}
-          caption={SIGNED_IN_CAPTION}
-          action={
-            <Btn
-              variant="secondary"
-              size="sm"
-              disabled={busy}
-              onClick={async () => {
-                setBusy(true); setErr('')
-                try {
-                  await signOut()
-                  resetNotified()
-                  onSignedOut()
-                } catch {
-                  setErr('Could not sign out - try again.')
-                }
-                setBusy(false)
-              }}
-            >
-              {busy ? <Spinner size={13} width={1.8} /> : 'Sign out'}
-            </Btn>
-          }
-        />
-        {err && <p style={{ fontSize: 11, color: 'var(--color-state-pending)' }}>{err}</p>}
-      </div>
+      <AccountIdentityRow
+        email={email}
+        caption={SIGNED_IN_CAPTION}
+        action={
+          <Btn variant="secondary" size="sm" onClick={() => setChanging(true)}>
+            Change email
+          </Btn>
+        }
+      />
     )
   }
 
   return (
     <div className="flex flex-col" style={{ gap: 10 }}>
-      <div>
-        <p className="mt-body-sm font-medium" style={{ color: 'var(--t-title)' }}>You&apos;re not signed in</p>
-        <p style={{ fontSize: 11, color: 'var(--t-faint)', marginTop: 2 }}>
-          Sign in to link this install to your account - we&apos;ll email you a one-time code, no password needed.
-        </p>
-      </div>
-      <EmailCodeForm />
+      {!email && (
+        <div>
+          <p className="mt-body-sm font-medium" style={{ color: 'var(--t-title)' }}>You&apos;re not signed in</p>
+          <p style={{ fontSize: 11, color: 'var(--t-faint)', marginTop: 2 }}>
+            Sign in to link this install to your account - we&apos;ll email you a one-time code, no password needed.
+          </p>
+        </div>
+      )}
+      <OtpForm
+        onSignedIn={(newEmail) => {
+          setEmail(newEmail)
+          setChanging(false)
+          onSignedIn(newEmail)
+        }}
+      />
+      {email && changing && (
+        <Btn variant="ghost" size="sm" onClick={() => setChanging(false)} style={{ alignSelf: 'flex-start' }}>
+          Cancel
+        </Btn>
+      )}
     </div>
   )
 }
 
-/** Settings → Account's sign-in/sign-out control. Renders straight into the
- *  dashboard's existing Clerk session (see the module doc above) — Clerk is
- *  already loaded by the time Settings is reachable, so `AccountStatus`'s
- *  own `!isLoaded` check is the only loading state this needs.
- *
- *  EXCEPT when sign-in isn't required at all. `RequireSignIn` skips mounting
- *  Clerk entirely in a debug build with no publishable key
- *  (`commands::account::sign_in_required`), and this component's whole design
- *  is to borrow THAT provider rather than nest a second one — so with the gate
- *  off there is no provider to borrow and `useClerk()` throws
- *  "useClerk can only be used within the <ClerkProvider /> component",
- *  taking the entire Settings modal down with it. The guard below is why this
- *  asks before rendering `AccountStatus`.
- *
- *  Note the check lives HERE and not at the call site: this is the component
- *  that depends on the provider, so any future caller inherits the guard
- *  instead of having to remember it. */
-export function AccountAuthControl({ onSignedIn, onSignedOut }: {
+/** Settings → Account's account control. */
+export function AccountAuthControl({ onSignedIn }: {
   onSignedIn: (email: string) => void
-  onSignedOut: () => void
 }) {
-  // Same hook, so this can never disagree with `RequireSignIn` — including on
-  // the fail-closed default. That agreement is what keeps this safe: if that
-  // gate decided sign-in was required, a ClerkProvider is mounted above and
-  // `AccountStatus` has one to borrow.
-  const signInRequired = useSignInRequired()
-
-  if (signInRequired === null) return <GateLoading />
-
-  if (!signInRequired) {
-    return (
-      <div className="flex flex-col" style={{ gap: 4 }}>
-        <p className="mt-body-sm font-medium" style={{ color: 'var(--t-title)' }}>Sign-in is off in this build</p>
-        <p style={{ fontSize: 11, color: 'var(--t-faint)' }}>
-          This is a source build with no Clerk key configured. Set CLERK_PUBLISHABLE_KEY
-          in your .env and restart to sign in.
-        </p>
-      </div>
-    )
-  }
-
-  return <AccountStatus onSignedIn={onSignedIn} onSignedOut={onSignedOut} />
+  return <AccountStatus onSignedIn={onSignedIn} />
 }
diff --git a/ui/app/setup/signin/ClerkErrorBoundary.tsx b/ui/app/setup/signin/ClerkErrorBoundary.tsx
deleted file mode 100644
index 6d6e81834..000000000
--- a/ui/app/setup/signin/ClerkErrorBoundary.tsx
+++ /dev/null
@@ -1,71 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-'use client'
-
-import { Component } from 'react'
-import type { ReactNode } from 'react'
-import { isLikelyClerkNetworkError } from '@/lib/clerkNetworkError'
-import { Btn } from '../atoms'
-
-type Props = {
-  children: ReactNode
-  /** Re-mounts the gated subtree with a fresh `initClerk()` call - see
-   *  `ClerkGate`, which passes a `key`-bumping callback so this boundary's own
-   *  `failed` state resets along with it. */
-  onRetry: () => void
-  /** Reported so `ClerkGate` can schedule an automatic retry (backoff timer +
-   *  an `online` listener) when the failure looks like "no network yet"
-   *  rather than a real misconfiguration - that orchestration needs to
-   *  survive across remounts of this boundary, so it lives one level up. */
-  onError: (error: unknown) => void
-}
-
-/** Catches `initClerk()` rejecting inside `ClerkGate`'s `use()` call and shows a
- *  message instead of leaving Suspense's child throw uncaught, which would
- *  otherwise blank the sign-in surface. `use()`/Suspense need a real error
- *  boundary; there is no hook equivalent, hence the class component.
- *
- *  NOTE the "no key at all" case does NOT reach here: `sign_in_required`
- *  (`commands::account`) reports false for a debug build with no key, and the
- *  gates skip Clerk entirely rather than mounting a `ClerkGate` that is certain
- *  to fail. So what lands here is either a key that IS configured and still
- *  didn't init, or a transient network failure - see `isLikelyClerkNetworkError`
- *  for how those two are told apart, and why they need different copy: a real
- *  misconfiguration needs a rebuild, but a login-item launch that raced the
- *  OS's own network bring-up just needs a moment (v1.90.0 staging report:
- *  `docs/vision.md`-adjacent - this is the exact "worked after I reconnected"
- *  case, not a bad key). */
-export class ClerkErrorBoundary extends Component<Props, { failed: boolean; networkIssue: boolean }> {
-  state: { failed: boolean; networkIssue: boolean } = { failed: false, networkIssue: false }
-
-  static getDerivedStateFromError(error: unknown) {
-    return { failed: true, networkIssue: isLikelyClerkNetworkError(error) }
-  }
-
-  componentDidCatch(error: unknown) {
-    // eslint-disable-next-line no-console -- surfaced nowhere else; this is a dev/misconfiguration signal
-    console.error('setup: Clerk sign-in unavailable', error)
-    this.props.onError(error)
-  }
-
-  render() {
-    if (this.state.failed) {
-      if (this.state.networkIssue) {
-        return (
-          <div style={{ display: 'flex', flexDirection: 'column', gap: 8, alignItems: 'flex-start' }}>
-            <p style={{ fontSize: 12.5, color: 'var(--t-muted)' }}>
-              Sign-in couldn&apos;t reach the network. Meridian will retry automatically once
-              you&apos;re back online.
-            </p>
-            <Btn variant="secondary" size="sm" onClick={this.props.onRetry}>Retry now</Btn>
-          </div>
-        )
-      }
-      return (
-        <p style={{ fontSize: 12.5, color: 'var(--t-muted)' }}>
-          Sign-in couldn&apos;t start - check CLERK_PUBLISHABLE_KEY and restart.
-        </p>
-      )
-    }
-    return this.props.children
-  }
-}
diff --git a/ui/app/setup/signin/ClerkGate.tsx b/ui/app/setup/signin/ClerkGate.tsx
deleted file mode 100644
index cedcf2c0d..000000000
--- a/ui/app/setup/signin/ClerkGate.tsx
+++ /dev/null
@@ -1,101 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-'use client'
-
-// Shared Clerk bootstrap for both sign-in surfaces (the setup wizard's
-// SignInWidget and Settings' AccountAuthControl): resolves
-// tauri-plugin-clerk's init promise via Suspense, hands the live instance to
-// ClerkProvider, and degrades gracefully outside Tauri or if init rejects.
-// `notInTauriMessage` and `fallback` differ per call site; everything else
-// about the bootstrap is identical, so it lives here once instead of being
-// duplicated across both widgets.
-
-import { Suspense, use, useCallback, useEffect, useRef, useState } from 'react'
-import type { ReactNode } from 'react'
-import { ClerkProvider } from '@clerk/react'
-// eslint-disable-next-line @typescript-eslint/no-var-requires -- no type defs shipped for this community plugin
-import { initClerk } from 'tauri-plugin-clerk'
-import { isTauri } from '@/lib/bridge'
-import { isLikelyClerkNetworkError } from '@/lib/clerkNetworkError'
-import { ClerkErrorBoundary } from './ClerkErrorBoundary'
-
-// The initialised clerk instance's type isn't exported by this community
-// plugin's (untyped) JS package, so `any` is the only option here.
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function ClerkResolve({ clerkPromise, children }: {
-  clerkPromise: Promise<any>
-  children: (clerk: any) => ReactNode
-}) {
-  const clerk = use(clerkPromise)
-  return (
-    <ClerkProvider publishableKey={clerk.publishableKey} Clerk={clerk}>
-      {children(clerk)}
-    </ClerkProvider>
-  )
-}
-
-const INITIAL_RETRY_MS = 5_000
-const MAX_RETRY_MS = 60_000
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- see ClerkResolve
-type Attempt = { key: number; clerkPromise: Promise<any> | null }
-
-function freshAttempt(key: number): Attempt {
-  return { key, clerkPromise: isTauri() ? initClerk() : null }
-}
-
-export function ClerkGate({ notInTauriMessage, fallback, children }: {
-  notInTauriMessage: string
-  fallback: ReactNode
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- see ClerkResolve
-  children: (clerk: any) => ReactNode
-}) {
-  // `retry()` replaces BOTH the promise `use()` resolves and the boundary's
-  // `key` in one update, so a retry always means a genuinely new
-  // `initClerk()` call feeding a freshly-mounted (failed: false) boundary -
-  // not the same already-rejected promise re-thrown forever.
-  const [attempt, setAttempt] = useState<Attempt>(() => freshAttempt(0))
-  const retry = useCallback(() => setAttempt((prev) => freshAttempt(prev.key + 1)), [])
-
-  const backoffMs = useRef(INITIAL_RETRY_MS)
-  const pending = useRef<{ timer: ReturnType<typeof setTimeout> | null; onlineListener: (() => void) | null }>({
-    timer: null,
-    onlineListener: null,
-  })
-
-  const clearPending = useCallback(() => {
-    if (pending.current.timer) clearTimeout(pending.current.timer)
-    if (pending.current.onlineListener) window.removeEventListener('online', pending.current.onlineListener)
-    pending.current = { timer: null, onlineListener: null }
-  }, [])
-
-  // Only a NETWORK-looking failure gets auto-retried - a bad key won't fix
-  // itself on a timer, so that case is left to the boundary's static message
-  // (see ClerkErrorBoundary's doc). Two independent triggers race to whichever
-  // fires first: the browser's `online` event (instant once connectivity is
-  // back) and a backoff timer (a floor for browsers/WKWebViews that don't fire
-  // `online` reliably in a login-item's background window).
-  const handleError = useCallback((error: unknown) => {
-    if (!isLikelyClerkNetworkError(error)) return
-    clearPending()
-    const onlineListener = () => { clearPending(); retry() }
-    pending.current.onlineListener = onlineListener
-    window.addEventListener('online', onlineListener)
-    pending.current.timer = setTimeout(() => { clearPending(); retry() }, backoffMs.current)
-    backoffMs.current = Math.min(backoffMs.current * 2, MAX_RETRY_MS)
-  }, [clearPending, retry])
-
-  const manualRetry = useCallback(() => { clearPending(); retry() }, [clearPending, retry])
-
-  useEffect(() => clearPending, [clearPending])
-
-  if (!attempt.clerkPromise) {
-    return <p style={{ fontSize: 12.5, color: 'var(--t-muted)' }}>{notInTauriMessage}</p>
-  }
-  return (
-    <ClerkErrorBoundary key={attempt.key} onRetry={manualRetry} onError={handleError}>
-      <Suspense fallback={fallback}>
-        <ClerkResolve clerkPromise={attempt.clerkPromise}>{children}</ClerkResolve>
-      </Suspense>
-    </ClerkErrorBoundary>
-  )
-}
diff --git a/ui/app/setup/signin/EmailCodeForm.tsx b/ui/app/setup/signin/OtpForm.tsx
similarity index 53%
rename from ui/app/setup/signin/EmailCodeForm.tsx
rename to ui/app/setup/signin/OtpForm.tsx
index 144f863dc..5fa9c10f8 100644
--- a/ui/app/setup/signin/EmailCodeForm.tsx
+++ b/ui/app/setup/signin/OtpForm.tsx
@@ -1,17 +1,19 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
 'use client'
 
-// Email + code form — the actual sign-in/up custom flow. Uses @clerk/react's
-// "Future" resource API (signIn.emailCode.*, signUp.verifications.*,
-// .finalize() to activate the session) — the older prepareFirstFactor/
-// attemptFirstFactor + setActive() API this version of @clerk/react
-// replaced. Errors come back as `{ error }`, not thrown.
+// Email + code form — sends/verifies a one-time code via the OTP Worker
+// (tray/src-tauri/src/commands/otp.rs: request_account_otp / confirm_account_otp).
+// Replaces EmailCodeForm.tsx (the old @clerk/react-backed form): no client auth
+// library, no session object, no async plugin-init step — every call here is a
+// plain Tauri `invoke`, so unlike the form it replaces this needs no surrounding
+// gate/boundary to bootstrap against (see RequireEmailCapture.tsx, which is
+// simpler than the ClerkGate it replaces for the same reason).
 
 import { useEffect, useRef, useState } from 'react'
 import type { CSSProperties } from 'react'
-import { useSignIn, useSignUp } from '@clerk/react'
+import { invoke } from '@/lib/bridge'
+import { classifySendError, classifyVerifyError } from '@/lib/otp-errors'
 import { Btn, PermIcon, Spinner } from '../atoms'
-import { clerkErrorCode, clerkErrorMessage } from './errors'
 
 /** A bespoke input for this form rather than the shared `<TextInput>` (used
  *  elsewhere for compact settings rows, 12px/5px padding) - an auth form is
@@ -50,16 +52,24 @@ function AuthInput(props: {
 }
 
 /** Standard OTP-industry resend cooldown (Google/GitHub/Stripe et al. all
- *  gate resend at ~30s) — stops a mis-tap or impatience from spamming Clerk's
- *  email-send endpoint (and racking up its per-instance email quota) for no
- *  benefit, since a code already in flight is usually still on its way. */
+ *  gate resend at ~30s) — stops a mis-tap or impatience from spamming the
+ *  Worker's send endpoint (and racking up its per-email/per-IP KV rate-limit
+ *  caps) for no benefit, since a code already in flight is usually still on
+ *  its way. */
 const RESEND_COOLDOWN_S = 30
 
-export function EmailCodeForm() {
-  const { signIn } = useSignIn()
-  const { signUp } = useSignUp()
+export function OtpForm({ onSignedIn, onDevBypass }: {
+  onSignedIn: (email: string) => void
+  /** Fired the first time a send/verify attempt reports the Worker isn't
+   *  configured (`OTP_API_URL` unset/blank) — the fresh-clone dev case. Only
+   *  meaningful to the wizard step (`steps.tsx`'s `EMAIL_STEP.canNext`), which
+   *  uses it to stop blocking Next even though no email was ever captured.
+   *  Omitted by `AccountAuthControl.tsx`'s "Change email" use, since a signed-in
+   *  user reaching "not configured" there is a genuine misconfiguration with
+   *  nothing to unblock. */
+  onDevBypass?: () => void
+}) {
   const [phase, setPhase] = useState<'email' | 'code'>('email')
-  const [mode, setMode] = useState<'signIn' | 'signUp' | null>(null)
   const [email, setEmail] = useState('')
   const [code, setCode] = useState('')
   const [busy, setBusy] = useState(false)
@@ -86,10 +96,7 @@ export function EmailCodeForm() {
   // A ref, not just the `busy` state, guards against double-submit: a fast
   // double-click/tap can fire a second `onClick` before React has re-rendered
   // the button's `disabled` prop from the first click's `setBusy(true)` —
-  // state updates are async, ref writes aren't. Without this a rapid double
-  // click sends the same code to Clerk twice; the first call actually
-  // succeeds, the second correctly bounces off as "already verified", and
-  // that error used to surface even though sign-in had already worked.
+  // state updates are async, ref writes aren't.
   const submitting = useRef(false)
 
   const submitEmail = async () => {
@@ -97,30 +104,13 @@ export function EmailCodeForm() {
     submitting.current = true
     setBusy(true); setErr('')
     try {
-      const created = await signIn.create({ identifier: email })
-      // No matching account — fall back to sign-up so one form handles both
-      // first-time and returning users.
-      if (clerkErrorCode(created.error) === 'form_identifier_not_found' || signIn.isTransferable) {
-        const su = await signUp.create({ emailAddress: email })
-        if (su.error) { setErr(clerkErrorMessage(su.error, 'Could not send a code - try again.')); return }
-        const sent = await signUp.verifications.sendEmailCode()
-        if (sent.error) { setErr(clerkErrorMessage(sent.error, 'Could not send a code - try again.')); return }
-        setMode('signUp'); setPhase('code'); setResendReadyAt(Date.now() + RESEND_COOLDOWN_S * 1000)
-        return
-      }
-      if (created.error) { setErr(clerkErrorMessage(created.error, 'Could not send a code - try again.')); return }
-      const sent = await signIn.emailCode.sendCode()
-      if (sent.error) { setErr(clerkErrorMessage(sent.error, 'Could not send a code - try again.')); return }
-      setMode('signIn'); setPhase('code'); setResendReadyAt(Date.now() + RESEND_COOLDOWN_S * 1000)
+      await invoke('request_account_otp', { email })
+      setPhase('code')
+      setResendReadyAt(Date.now() + RESEND_COOLDOWN_S * 1000)
     } catch (e) {
-      // Clerk's Future API returns { error } rather than throwing, but a
-      // transport-level failure still rejects. Catch it here so it surfaces to
-      // the user instead of bubbling as an unhandled rejection (the
-      // ClerkErrorBoundary only covers render/use() failures, not these
-      // async handlers).
-      // eslint-disable-next-line no-console -- only diagnostic for this failure
-      console.error('sign-in: submitEmail threw', e)
-      setErr('Something went wrong - check your connection and try again.')
+      const { message, isDevBypass } = classifySendError(e)
+      setErr(message)
+      if (isDevBypass) onDevBypass?.()
     } finally {
       submitting.current = false
       setBusy(false)
@@ -128,87 +118,52 @@ export function EmailCodeForm() {
   }
 
   const submitCode = async () => {
-    if (submitting.current || !mode) return
+    if (submitting.current) return
     submitting.current = true
     setBusy(true); setErr('')
     try {
-      const resource = mode === 'signIn' ? signIn : signUp
-      const verified = mode === 'signIn'
-        ? await signIn.emailCode.verifyCode({ code })
-        : await signUp.verifications.verifyEmailCode({ code })
-      if (verified.error) {
-        // A prior submit of this exact code already completed sign-in (see
-        // `submitting` above, or a second device/window racing the same
-        // code) — there's nothing left to do; the session shows up via
-        // useUser() a moment later. Anything else is a real failure — logged
-        // to the console since Clerk's specific reason (wrong digits,
-        // expired code, too many attempts) is more useful for debugging than
-        // the generic fallback shown in the UI.
-        if (clerkErrorCode(verified.error) !== 'verification_already_verified') {
-          // eslint-disable-next-line no-console -- only diagnostic surfaced anywhere for this failure
-          console.error('sign-in: code verification failed', verified.error)
-          setErr(clerkErrorMessage(verified.error, "That code didn't work - check it and try again."))
-        }
+      const verified = await invoke<boolean>('confirm_account_otp', { email, code })
+      if (verified) {
+        // Best-effort, like every other `save_account_email` call site
+        // (e.g. `page.tsx`'s `onSignedIn`) — a failed write here still lets
+        // the user through; the wizard/dashboard's own `onSignedIn` may retry
+        // the save independently.
+        await invoke('save_account_email', { email }).catch(() => {})
+        onSignedIn(email)
         return
       }
-      if (resource.status !== 'complete') {
-        // `missing_requirements` means the code was right but Clerk wants
-        // more fields (password, name, …) than this passwordless/email-only
-        // form ever collects — a Clerk dashboard config gap (an auth
-        // requirement enabled that we don't ask for), not a code bug. Log
-        // exactly which fields so it's fixable without guessing.
-        const missing = 'missingFields' in resource ? resource.missingFields : undefined
-        // eslint-disable-next-line no-console -- see above
-        console.error('sign-in: verification resolved without completing', { status: resource.status, missing })
-        setErr(
-          resource.status === 'missing_requirements'
-            ? "Your code verified, but sign-in isn't fully configured for email-only access yet - see the console for details."
-            : "That code didn't work - check it and try again.",
-        )
-        return
-      }
-      const finalized = await resource.finalize()
-      if (finalized.error) setErr(clerkErrorMessage(finalized.error, 'Could not complete sign-in - try again.'))
+      // A wrong-but-well-formed code is `Ok(false)`, not a rejection — the
+      // retryable, expected outcome copy lives here rather than in
+      // `classifyVerifyError`.
+      setErr("That code didn't work - check it and try again.")
     } catch (e) {
-      // A transport-level rejection (see submitEmail's note) — surface it
-      // rather than letting it escape as an unhandled rejection.
-      // eslint-disable-next-line no-console -- see above
-      console.error('sign-in: submitCode threw', e)
-      setErr('Something went wrong - check your connection and try again.')
+      const { message, isDevBypass } = classifyVerifyError(e)
+      setErr(message)
+      if (isDevBypass) onDevBypass?.()
     } finally {
       submitting.current = false
       setBusy(false)
     }
   }
 
-  /** Re-sends a fresh code to the same address/resource — separate from
-   *  "Use a different email" (which resets back to the email step) so a
-   *  simply-expired or already-used code doesn't force re-typing the email.
-   *  Gated by `resendCooldownS` (the button itself stays disabled until it
-   *  hits zero), but re-checked here too since disabled state lags a render
-   *  behind the ticking clock. */
+  /** Re-sends a fresh code to the same address — separate from "Use a
+   *  different email" (which resets back to the email step) so a simply
+   *  expired or already-used code doesn't force re-typing the email. Gated by
+   *  `resendCooldownS` (the button itself stays disabled until it hits zero),
+   *  but re-checked here too since disabled state lags a render behind the
+   *  ticking clock. */
   const resendCode = async () => {
-    if (submitting.current || !mode || resendCooldownS > 0) return
+    if (submitting.current || resendCooldownS > 0) return
     submitting.current = true
     setBusy(true); setErr('')
     try {
-      const resent = mode === 'signIn'
-        ? await signIn.emailCode.sendCode()
-        : await signUp.verifications.sendEmailCode()
-      if (resent.error) {
-        // eslint-disable-next-line no-console -- see submitCode's note above
-        console.error('sign-in: resend failed', resent.error)
-        setErr(clerkErrorMessage(resent.error, 'Could not resend the code - try again.'))
-        return
-      }
+      await invoke('request_account_otp', { email })
       setCode('')
       setResendReadyAt(Date.now() + RESEND_COOLDOWN_S * 1000)
     } catch (e) {
-      // A transport-level rejection (see submitEmail's note) — surface it
-      // rather than letting it escape as an unhandled rejection.
-      // eslint-disable-next-line no-console -- see above
-      console.error('sign-in: resendCode threw', e)
-      setErr('Could not resend the code - check your connection and try again.')
+      const { message, isDevBypass } = classifySendError(e)
+      setErr(message)
+      if (isDevBypass) onDevBypass?.()
     } finally {
       submitting.current = false
       setBusy(false)
diff --git a/ui/app/setup/signin/RequireEmailCapture.tsx b/ui/app/setup/signin/RequireEmailCapture.tsx
new file mode 100644
index 000000000..b3d5ed3b3
--- /dev/null
+++ b/ui/app/setup/signin/RequireEmailCapture.tsx
@@ -0,0 +1,106 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+'use client'
+
+// Product-wide email-capture gate for the dashboard window. Replaces
+// RequireSignIn.tsx (the old Clerk session gate): there is no session here,
+// so this is a FIRE-ONCE capture check, not a live one. `get_account_email()`
+// is read exactly once on mount; `null` shows the inline capture screen,
+// anything else renders `children` and this never checks again for the rest
+// of the window's life — there is no sign-out to re-lock against.
+//
+// Loaded only through the `next/dynamic({ ssr: false })` boundary in
+// `../signin.tsx` (as `RequireEmailCapture`) — never imported directly — for
+// the same static-export reason documented there.
+
+import { useEffect, useState, type ReactNode } from 'react'
+import { invoke, isTauri } from '@/lib/bridge'
+import { OtpForm } from './OtpForm'
+
+export type CaptureState = 'loading' | 'needs_capture' | 'ready'
+
+/** Resolve the gate's state from a `get_account_email()`-shaped asker,
+ *  FAILING OPEN.
+ *
+ *  Deliberately inverted from the deleted `resolveSignInRequired`'s
+ *  fail-CLOSED rule: this is a one-time capture, not a live session gate, so
+ *  a rejected `invoke` must land on `'ready'`, never `'needs_capture'`. There
+ *  is no session to bypass here — a transient IPC hiccup re-locking an
+ *  already-captured user would just mean "ask again once, harmlessly," not a
+ *  security hole. The old gate's fail-closed default protected a real,
+ *  currently-enforced requirement (a live sign-in); this one only ever
+ *  protects a first impression.
+ *
+ *  `ask` is injectable, mirroring `resolveSignInRequired`'s own reason for
+ *  taking its asker as a parameter — the rejection branch is the one that
+ *  matters and the one otherwise impossible to reach in a test. */
+export async function resolveCaptureState(
+  ask: () => Promise<string | null> = () => invoke<string | null>('get_account_email'),
+): Promise<CaptureState> {
+  try {
+    const email = await ask()
+    return email ? 'ready' : 'needs_capture'
+  } catch {
+    return 'ready'
+  }
+}
+
+/** Full-window loading/placeholder — fills the whole app surface (not the
+ *  120px inline box the wizard/Settings use) so the gate never flashes a small
+ *  centred spinner over an empty page. */
+function FullScreenCenter({ children }: { children: ReactNode }) {
+  return (
+    <div
+      className="flex flex-col items-center justify-center h-[100svh] overflow-hidden"
+      style={{ background: 'var(--win-bg)', padding: 24 }}
+    >
+      {children}
+    </div>
+  )
+}
+
+/** The inline capture screen shown until an email has ever been saved. Reuses
+ *  the same OTP form as the wizard and Settings, wrapped in a titled card so
+ *  it reads as a deliberate lock, not a stray form. */
+function LockedCaptureScreen({ onSignedIn }: { onSignedIn: (email: string) => void }) {
+  return (
+    <FullScreenCenter>
+      <div style={{ width: '100%', maxWidth: 380 }}>
+        <div style={{ textAlign: 'center', marginBottom: 22 }}>
+          <h1 className="mt-title-lg" style={{ color: 'var(--t-title)' }}>Sign in to Meridian</h1>
+          <p className="mt-body-sm mt-2" style={{ color: 'var(--t-muted)' }}>
+            Sign in to use Meridian - we&apos;ll email you a one-time code, no password needed.
+          </p>
+        </div>
+        <OtpForm onSignedIn={onSignedIn} />
+      </div>
+    </FullScreenCenter>
+  )
+}
+
+function Gate({ children }: { children: ReactNode }) {
+  const [state, setState] = useState<CaptureState>('loading')
+
+  useEffect(() => {
+    let live = true
+    resolveCaptureState().then((s) => { if (live) setState(s) })
+    return () => { live = false }
+  }, [])
+
+  if (state === 'loading') return <FullScreenCenter>{null}</FullScreenCenter>
+  if (state === 'needs_capture') {
+    return <LockedCaptureScreen onSignedIn={() => setState('ready')} />
+  }
+  return <>{children}</>
+}
+
+/** Wrap the dashboard app in this to make email capture compulsory. Outside
+ *  the Tauri webview (a plain browser preview of the static export) there's
+ *  no bridge for `get_account_email` to reach — this shows the same static
+ *  notice the old `ClerkGate` used rather than attempting (and failing) an
+ *  invoke, since the app only ever runs inside Tauri in practice. */
+export function RequireEmailCapture({ children }: { children: ReactNode }) {
+  if (!isTauri()) {
+    return <p style={{ fontSize: 12.5, color: 'var(--t-muted)' }}>Open Meridian to sign in.</p>
+  }
+  return <Gate>{children}</Gate>
+}
diff --git a/ui/app/setup/signin/RequireSignIn.tsx b/ui/app/setup/signin/RequireSignIn.tsx
deleted file mode 100644
index a6b69b760..000000000
--- a/ui/app/setup/signin/RequireSignIn.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-'use client'
-
-// Product-wide sign-in gate for the dashboard window. Unlike the setup
-// wizard's SignInWidget (which reports a session up and lets the wizard decide
-// what to show) and Settings' AccountAuthControl (which surfaces who's signed
-// in), this HIDES the whole app until a live Clerk session exists: signed out
-// => an inline full-window sign-in screen, signed in => the real UI. Sign-out
-// (Settings -> Account) tears down the Clerk session, `useUser().isSignedIn`
-// flips false, and this re-locks immediately.
-//
-// Loaded only through the `next/dynamic({ ssr: false })` boundary in
-// `../signin.tsx` (as `RequireSignIn`) — never imported directly — for the
-// same static-export reason documented there.
-
-import { type ReactNode } from 'react'
-import { invoke } from '@/lib/bridge'
-import { useSignInRequired } from '@/lib/signin-required'
-import { useSignedInEmail } from './useSignedInEmail'
-import { ClerkGate } from './ClerkGate'
-import { EmailCodeForm } from './EmailCodeForm'
-
-/** Full-window loading/placeholder — fills the whole app surface (not the
- *  120px inline box the wizard/Settings use) so the gate never flashes a small
- *  centred spinner over an empty page. */
-function FullScreenCenter({ children }: { children: ReactNode }) {
-  return (
-    <div
-      className="flex flex-col items-center justify-center h-[100svh] overflow-hidden"
-      style={{ background: 'var(--win-bg)', padding: 24 }}
-    >
-      {children}
-    </div>
-  )
-}
-
-/** The inline sign-in screen a signed-out user sees instead of the app. Reuses
- *  the same Clerk email one-time-code form as the wizard and Settings, wrapped
- *  in a titled card so it reads as a deliberate lock, not a stray form. */
-function LockedSignInScreen() {
-  return (
-    <FullScreenCenter>
-      <div style={{ width: '100%', maxWidth: 380 }}>
-        <div style={{ textAlign: 'center', marginBottom: 22 }}>
-          <h1 className="mt-title-lg" style={{ color: 'var(--t-title)' }}>Sign in to Meridian</h1>
-          <p className="mt-body-sm mt-2" style={{ color: 'var(--t-muted)' }}>
-            Sign in to use Meridian - we&apos;ll email you a one-time code, no password needed.
-          </p>
-        </div>
-        <EmailCodeForm />
-      </div>
-    </FullScreenCenter>
-  )
-}
-
-/** Renders `children` only once Clerk reports a live session; otherwise the
- *  inline sign-in screen. Persists the email Rust-side on sign-in (the mirror
- *  Settings/analytics read) via `save_account_email`. */
-function Gate({ children }: { children: ReactNode }) {
-  const { isLoaded, isSignedIn } = useSignedInEmail((email) => {
-    invoke('save_account_email', { email }).catch(() => {})
-  })
-  // Still resolving Clerk's own async session check — hold a blank surface
-  // rather than flashing the sign-in form to an already-signed-in user.
-  if (!isLoaded) return <FullScreenCenter>{null}</FullScreenCenter>
-  if (!isSignedIn) return <LockedSignInScreen />
-  return <>{children}</>
-}
-
-/** Wrap the dashboard app in this to make sign-in compulsory, unless the app
- *  is running in a dev mode with no Clerk key configured — in which case the
- *  gate is skipped and the app is fully usable. A maintainer who wants to
- *  exercise the real sign-in path in dev just sets `CLERK_PUBLISHABLE_KEY` in
- *  `.env` and the gate returns to normal. Outside the Tauri webview (a plain
- *  browser preview of the static export) there's no `tauri-plugin-clerk` bridge,
- *  so it degrades to a notice rather than hanging — the app only ever runs
- *  inside Tauri in practice. */
-export function RequireSignIn({ children }: { children: ReactNode }) {
-  const signInRequired = useSignInRequired()
-
-  // `null` is "not known yet", never "no sign-in needed" — flashing the
-  // dashboard open for a frame before the answer lands would show signed-out
-  // content to a user who has to sign in.
-  if (signInRequired === null) return <FullScreenCenter>{null}</FullScreenCenter>
-  if (!signInRequired) return <>{children}</>
-
-  return (
-    <ClerkGate notInTauriMessage="Open Meridian to sign in." fallback={<FullScreenCenter>{null}</FullScreenCenter>}>
-      {() => <Gate>{children}</Gate>}
-    </ClerkGate>
-  )
-}
diff --git a/ui/app/setup/signin/SignInWidget.tsx b/ui/app/setup/signin/SignInWidget.tsx
deleted file mode 100644
index 5882331f7..000000000
--- a/ui/app/setup/signin/SignInWidget.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-'use client'
-
-// The setup wizard's Sign-in step body — see `../signin.tsx` for why this
-// module (and everything it imports) is only ever loaded through a
-// `next/dynamic(..., { ssr: false })` boundary, never imported directly.
-
-import { useSignedInEmail } from './useSignedInEmail'
-import { ClerkGate } from './ClerkGate'
-import { GateLoading } from './identity'
-import { EmailCodeForm } from './EmailCodeForm'
-
-/** No gating: reports a signed-in session up via `onSignedIn` and renders
- *  the form until then. The wizard step (`steps.tsx`'s `SignInBody`) decides
- *  what to show once `onSignedIn` fires — this component never hides the
- *  rest of the wizard itself. */
-function SignedInOrForm({ onSignedIn }: { onSignedIn: (email: string) => void }) {
-  const { isLoaded, isSignedIn } = useSignedInEmail(onSignedIn)
-  if (!isLoaded || isSignedIn) return <GateLoading />
-  return <EmailCodeForm />
-}
-
-/** The setup wizard's Sign-in step body. Outside the Tauri webview (e.g. a
- *  plain browser preview of the static export) there's no `tauri-plugin-clerk`
- *  bridge to init against, so it degrades to a notice rather than hanging. */
-export function SignInWidget({ onSignedIn }: { onSignedIn: (email: string) => void }) {
-  return (
-    <ClerkGate notInTauriMessage="Open Meridian to sign in." fallback={<GateLoading />}>
-      {() => <SignedInOrForm onSignedIn={onSignedIn} />}
-    </ClerkGate>
-  )
-}
diff --git a/ui/app/setup/signin/errors.ts b/ui/app/setup/signin/errors.ts
deleted file mode 100644
index 90d9444aa..000000000
--- a/ui/app/setup/signin/errors.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-
-// Clerk error-shape helpers, shared by every Clerk call site in `signin/`.
-//
-// `create()`/`sendCode()`/`verifyCode()`/`finalize()` resolve as `{ error }` —
-// `error` is a `ClerkAPIResponseError` whose OWN `.message` is just a generic
-// wrapper string and which has no `.code` at all; the actual per-field
-// code/message Clerk wants you to branch on lives in `error.errors[0]`. Every
-// read of a Clerk error's code or text must go through these two helpers —
-// reading `.code`/`.message` straight off `error` (the bug this replaced)
-// meant a `form_identifier_not_found` check silently never matched, so the
-// sign-up fallback never fired and Clerk's raw per-field text ("Couldn't
-// find your account.") leaked to the screen as a dead end instead of
-// starting sign-up.
-
-export type ClerkErrorLike = {
-  errors?: { code: string; message: string; longMessage?: string }[]
-  message?: string
-} | null | undefined
-
-export function clerkErrorCode(e: ClerkErrorLike): string | undefined {
-  return e?.errors?.[0]?.code
-}
-
-export function clerkErrorMessage(e: ClerkErrorLike, fallback: string): string {
-  const first = e?.errors?.[0]
-  return first?.longMessage || first?.message || e?.message || fallback
-}
diff --git a/ui/app/setup/signin/identity.tsx b/ui/app/setup/signin/identity.tsx
index 1855a1b24..b211322f7 100644
--- a/ui/app/setup/signin/identity.tsx
+++ b/ui/app/setup/signin/identity.tsx
@@ -19,7 +19,7 @@ export function GateLoading() {
 
 /** First one or two letters for an avatar glyph — `first.last@x` → `FL`,
  *  anything without a clean split (`first@x`) → first two chars of the local
- *  part. Never fabricates a name Clerk didn't give us; the email is the only
+ *  part. Never fabricates a name we were never given; the email is the only
  *  identity we have. */
 function emailInitials(email: string): string {
   const local = email.split('@')[0] ?? ''
@@ -45,9 +45,9 @@ function AccountAvatar({ email }: { email: string }) {
 }
 
 /** The standard "who am I signed in as" row (Linear/Notion/Raycast-style
- *  account rows): avatar, email, a caption for how the session was
- *  established, and a trailing action slot — a live Sign out button once
- *  Clerk has loaded, or a spinner for an optimistic pre-load render. */
+ *  account rows): avatar, email, a caption for how the address was captured,
+ *  and a trailing action slot — a "Change email" button once the captured
+ *  address has loaded, or a spinner for an optimistic pre-load render. */
 export function AccountIdentityRow({ email, caption, action }: {
   email: string
   caption: string
diff --git a/ui/app/setup/signin/useSignedInEmail.ts b/ui/app/setup/signin/useSignedInEmail.ts
deleted file mode 100644
index 84a0be5e9..000000000
--- a/ui/app/setup/signin/useSignedInEmail.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-'use client'
-
-import { useEffect, useRef } from 'react'
-import { useUser } from '@clerk/react'
-
-/** Shared "tell the parent once a Clerk session exists" pattern — both the
- *  wizard's sign-in step and Settings' account row need to notice a fresh
- *  sign-in and report the email up exactly once, even across Clerk's own
- *  isLoaded/isSignedIn transitions. A ref (not just a dependency check)
- *  guards the single call. `resetNotified` re-arms it — call after a
- *  sign-out so a subsequent sign-in notifies again. */
-export function useSignedInEmail(onSignedIn: (email: string) => void) {
-  const { isLoaded, isSignedIn, user } = useUser()
-  const notified = useRef(false)
-  const email = user?.primaryEmailAddress?.emailAddress
-
-  useEffect(() => {
-    if (isLoaded && isSignedIn && email && !notified.current) {
-      notified.current = true
-      onSignedIn(email)
-    }
-  }, [isLoaded, isSignedIn, email, onSignedIn])
-
-  return {
-    isLoaded,
-    isSignedIn,
-    email,
-    resetNotified: () => { notified.current = false },
-  }
-}
diff --git a/ui/app/setup/steps.tsx b/ui/app/setup/steps.tsx
index 6b436f44a..902cb8f30 100644
--- a/ui/app/setup/steps.tsx
+++ b/ui/app/setup/steps.tsx
@@ -15,7 +15,7 @@ import { TRACKERS } from '@/lib/integrations'
 import { llmProvider, LLM_INTRO_BODY, LLM_INTRO_TITLE, type LlmProviderId } from '@/lib/llm-providers'
 import ConnectTrackers from '@/components/IntegrationConnect'
 import LlmProviderPicker, { type InstallOutcome, type ProviderStatus } from '@/components/LlmProviderPicker'
-import { SignInWidget } from './signin'
+import { OtpForm } from './signin'
 
 /** The live wizard handle page.tsx builds and threads to every step body. */
 export interface Wiz {
@@ -33,13 +33,16 @@ export interface Wiz {
   // Step 2 — integrations (live connected-state from get_integrations)
   integrations: IntegrationsResponse | null
   refetchIntegrations: () => void
-  // Whether sign-in is required — false only in a dev build with no Clerk key
-  // configured. When false, the sign-in step shows a notice instead of the form,
-  // and never blocks wizard progression.
-  signInRequired: boolean | null
-  // Step 3 — sign in (Clerk email one-time-code — see ui/app/setup/signin.tsx).
-  // The step body owns its own form/busy/error state; `onSignedIn` is just
-  // how it reports a completed sign-in back up to the wizard.
+  // Whether the OTP Worker reported "not configured" on the first send/verify
+  // attempt — the fresh-clone dev case (no `OTP_API_URL` baked in or set).
+  // Starts `false`; flips to `true` via `OtpForm`'s `onDevBypass` and never
+  // resets. When `true`, the Email step's Next button unblocks even with no
+  // captured email — see `EMAIL_STEP.canNext`.
+  otpNotConfigured: boolean
+  onDevBypass: () => void
+  // Step 3 — email capture (one-time OTP — see ui/app/setup/signin.tsx). The
+  // step body owns its own form/busy/error state; `onSignedIn` is just how it
+  // reports a completed capture back up to the wizard.
   signedInEmail: string | null
   onSignedIn: (email: string) => void
   // Step 4 — intelligence. The one AI choice everything downstream obeys
@@ -281,20 +284,22 @@ function IntegrationsBody({ wiz }: { wiz: Wiz }) {
   )
 }
 
-// ── STEP 3 — Sign in ──────────────────────────────────────────────────────────
-// Clerk email one-time-code, entirely inside the webview via tauri-plugin-clerk
-// (see lib.rs's plugin registration + signin.tsx). <SignInWidget> is a thin
-// next/dynamic boundary around the actual Clerk-aware form (the signin/ module —
-// see SignInWidget.tsx/EmailCodeForm.tsx) — importing it here stays safe for the
-// static-export build because signin.tsx itself has no @clerk/react imports at
-// the top level.
+// ── STEP 3 — Email ────────────────────────────────────────────────────────────
+// One-time email + code, sent/verified through a small Cloudflare Worker
+// (tray/src-tauri/src/commands/otp.rs) — no client auth library, no session.
+// <OtpForm> is a thin next/dynamic boundary around the actual form (the
+// signin/ module — see OtpForm.tsx) — importing it here stays safe for the
+// static-export build (see signin.tsx's module doc).
 //
-// When sign-in is disabled in a dev build (no Clerk key configured), this shows
-// a notice instead of the form and the wizard can proceed past this step without
-// signing in.
+// When the Worker isn't configured (a fresh clone with no `OTP_API_URL`), the
+// first send/verify attempt reports that via `onDevBypass` (see `Wiz.otpNotConfigured`),
+// and this shows a notice instead of the form — the wizard can proceed past
+// this step without an email captured.
 function SignInBody({ wiz }: { wiz: Wiz }) {
-  // Dev mode with no Clerk key: sign-in is unavailable, show a notice.
-  if (wiz.signInRequired === false) {
+  // Dev mode with no Worker configured: email capture is unavailable, show a
+  // notice. Discovered reactively (see `Wiz.otpNotConfigured`'s doc) rather
+  // than known up front, so this only appears after a first attempt reports it.
+  if (wiz.otpNotConfigured) {
     return (
       <div className="flex flex-col items-center" style={{ width: '100%', maxWidth: 340, margin: '0 auto' }}>
         <div className="w-full flex flex-col items-center mer-pop" style={{
@@ -305,14 +310,14 @@ function SignInBody({ wiz }: { wiz: Wiz }) {
           <div>
             <p style={{ fontSize: 14.5, fontWeight: 600, color: 'var(--t-title)' }}>Sign-in disabled</p>
             <p style={{ fontSize: 12, color: 'var(--t-muted)', marginTop: 3 }}>
-              This is a source build with no Clerk publishable key configured.<br />
+              This is a source build with no OTP Worker configured.<br />
               {/* `var(--font-mono)`, not the browser's `monospace`: the wizard has ONE
                   voice (SF Pro, via `--font-sans`, which `--font-mono` aliases), and
                   these two `<code>`s were the only things in the whole setup flow
                   still rendering in a different typeface. Kept as `<code>` because
                   they name a literal env var and a literal filename - that is what
                   the element is for; only the family was wrong. */}
-              Set <code style={{ fontFamily: 'var(--font-mono)', fontSize: 11 }}>CLERK_PUBLISHABLE_KEY</code> in <code style={{ fontFamily: 'var(--font-mono)', fontSize: 11 }}>.env</code> to enable sign-in.
+              Set <code style={{ fontFamily: 'var(--font-mono)', fontSize: 11 }}>OTP_API_URL</code> in <code style={{ fontFamily: 'var(--font-mono)', fontSize: 11 }}>.env</code> to enable sign-in.
             </p>
           </div>
         </div>
@@ -341,7 +346,7 @@ function SignInBody({ wiz }: { wiz: Wiz }) {
       </div>
     )
   }
-  return <SignInWidget onSignedIn={wiz.onSignedIn} />
+  return <OtpForm onSignedIn={wiz.onSignedIn} onDevBypass={wiz.onDevBypass} />
 }
 
 // ── STEP 4 — Intelligence (which AI writes the summaries) ────────────────────
@@ -556,13 +561,13 @@ const WINDOWS_NOTIFICATIONS_STEP: StepMeta = {
   canNext: () => true,
 }
 
-const SIGNIN_STEP: StepMeta = {
-  id: 'signin', n: '01', label: 'Sign in', kicker: 'Account',
+const EMAIL_STEP: StepMeta = {
+  id: 'email', n: '01', label: 'Sign in', kicker: 'Account',
   title: 'Sign in to Meridian',
   subtitle: "So we know who's using Meridian.",
   Body: SignInBody,
-  status: (s) => s.signInRequired === false ? 'Disabled in dev' : (s.signedInEmail ?? 'Not signed in'),
-  canNext: (s) => s.signInRequired === false || !!s.signedInEmail,
+  status: (s) => s.otpNotConfigured ? 'Disabled in dev' : (s.signedInEmail ?? 'Not signed in'),
+  canNext: (s) => !!s.signedInEmail || s.otpNotConfigured,
 }
 
 // ── Steps the WIZARD no longer runs — owned by the post-setup walkthrough ─────
@@ -601,7 +606,7 @@ export const PROVIDER_STEP: StepMeta = {
 // The wizard proper: identity, then the grants capture cannot run without.
 // Everything else the user can decide once they have seen what Meridian does.
 const ALL_STEPS: StepMeta[] = [
-  SIGNIN_STEP,
+  EMAIL_STEP,
   PERMISSIONS_STEP,
 ]
 
diff --git a/ui/components/timeline/settings/AccountSection.tsx b/ui/components/timeline/settings/AccountSection.tsx
index 848f3292b..72afbe2dd 100644
--- a/ui/components/timeline/settings/AccountSection.tsx
+++ b/ui/components/timeline/settings/AccountSection.tsx
@@ -72,9 +72,6 @@ export function AccountSection({ onReplayTour, onReplayTourFromDay }: {
           onSignedIn={(email) => {
             invoke('save_account_email', { email }).catch(() => {})
           }}
-          onSignedOut={() => {
-            invoke('clear_account_email').catch(() => {})
-          }}
         />
       </SectionCard>
 
diff --git a/ui/components/timeline/settings/IntelligenceSection.tsx b/ui/components/timeline/settings/IntelligenceSection.tsx
index f50b30620..f13cc14ce 100644
--- a/ui/components/timeline/settings/IntelligenceSection.tsx
+++ b/ui/components/timeline/settings/IntelligenceSection.tsx
@@ -16,8 +16,7 @@
 'use client'
 
 import { useCallback, useEffect, useRef, useState } from 'react'
-import { invoke } from '@tauri-apps/api/core'
-import { load } from '@/lib/bridge'
+import { invoke, load } from '@/lib/bridge'
 import type { RuntimeSettings } from '@/lib/settings'
 import { LLM_INTRO_TITLE, providerChoiceFields, type LlmProviderId } from '@/lib/llm-providers'
 import LlmProviderPicker, { useLlmProviderDetection } from '@/components/LlmProviderPicker'
diff --git a/ui/lib/clerkNetworkError.ts b/ui/lib/clerkNetworkError.ts
deleted file mode 100644
index e5538ef75..000000000
--- a/ui/lib/clerkNetworkError.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-
-// Classifies why `tauri-plugin-clerk`'s `initClerk()` rejected: a machine with
-// no network yet (the login-item auto-launch races the OS's own network
-// bring-up, so `clerk.load()`'s live-API fetch has nothing to reach) versus an
-// actual misconfiguration (a malformed/wrong-instance publishable key).
-// `ClerkErrorBoundary` uses this to pick copy that matches the real cause -
-// "check CLERK_PUBLISHABLE_KEY" is true for the second case and actively wrong
-// for the first, since the key is fine and the fix is just waiting for a
-// connection.
-//
-// The Rust side (`clerk.load()` via clerk-fapi-rs -> reqwest) and the JS side
-// (`@clerk/clerk-js`'s own fetch, and the CDN fetch for prebuilt UI) can each
-// be the one that rejects, on either OS, so this matches substrings from both
-// stacks rather than one platform's wording. False negatives (a network error
-// misread as "other") just fall back to the pre-existing generic message, so
-// the list is kept broad on purpose.
-const NETWORK_ERROR_PATTERNS = [
-  'error trying to connect',
-  'error sending request',
-  'dns error',
-  'failed to lookup address',
-  'connection refused',
-  'network is unreachable',
-  'network is down',
-  'could not connect',
-  'timed out',
-  'operation timed out',
-  'failed to fetch',
-  'load failed',
-  'networkerror',
-  'internet connection appears to be offline',
-  'err_internet_disconnected',
-  'err_network_changed',
-  'err_name_not_resolved',
-]
-
-function errorText(error: unknown): string {
-  if (error instanceof Error) return error.message
-  if (typeof error === 'string') return error
-  if (error === null || error === undefined) return ''
-  try {
-    // JSON.stringify returns `undefined` (not a string) for values like a bare
-    // function, which would otherwise crash the caller's .toLowerCase().
-    return JSON.stringify(error) ?? String(error)
-  } catch {
-    return String(error)
-  }
-}
-
-/** True when `initClerk()`'s rejection looks like "no network yet", not a bad
- *  key. Combines two independent signals: the browser's own connectivity flag
- *  (unavailable outside a browser-like runtime, hence the `typeof` guard) and
- *  substring-matching the error text against known network-failure wording
- *  from reqwest, `@clerk/clerk-js`'s fetch, and Chromium's net-error codes. */
-export function isLikelyClerkNetworkError(error: unknown): boolean {
-  const offline = typeof navigator !== 'undefined' && navigator.onLine === false
-  if (offline) return true
-  const text = errorText(error).toLowerCase()
-  return NETWORK_ERROR_PATTERNS.some((pattern) => text.includes(pattern))
-}
diff --git a/ui/lib/otp-errors.ts b/ui/lib/otp-errors.ts
new file mode 100644
index 000000000..684a742b5
--- /dev/null
+++ b/ui/lib/otp-errors.ts
@@ -0,0 +1,76 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+
+// Maps the error sentinel strings `request_account_otp`/`confirm_account_otp`
+// (tray/src-tauri/src/commands/otp.rs) reject with to the exact copy
+// `OtpForm.tsx` shows. Kept as pure, exported functions so the mapping is
+// unit-tested directly — this codebase's test suite has no DOM/React
+// rendering harness (bun test only), so a component's *behavior* is only
+// testable through logic it delegates to a plain function like this one.
+//
+// Tauri rejects a `Result<_, String>` command with the raw string, not an
+// Error object — `errorCode` handles that shape defensively (a thrown
+// network-transport failure could still arrive as a real `Error`).
+
+const GENERIC_ERROR = 'Something went wrong - check your connection and try again.'
+const NOT_CONFIGURED_MESSAGE =
+  "OTP isn't configured in this build - set OTP_API_URL in your .env to test sign-in."
+
+export type OtpSendOutcome = {
+  message: string
+  /** True only for the fresh-clone dev case (`OTP_API_URL` unset/blank) — the
+   *  wizard step should let the user continue anyway instead of leaving Next
+   *  permanently disabled. See `steps.tsx`'s `EMAIL_STEP.canNext`. */
+  isDevBypass: boolean
+}
+
+function errorCode(err: unknown): string {
+  if (typeof err === 'string') return err
+  if (err instanceof Error) return err.message
+  return ''
+}
+
+/** Maps `request_account_otp`'s rejection to send-phase copy. */
+export function classifySendError(err: unknown): OtpSendOutcome {
+  switch (errorCode(err)) {
+    case 'invalid_email':
+      return { message: "That doesn't look like a valid email address.", isDevBypass: false }
+    case 'rate_limited':
+      return { message: 'Too many codes requested - try again later.', isDevBypass: false }
+    case 'unavailable':
+      return { message: 'Sign-in is temporarily unavailable - try again in a moment.', isDevBypass: false }
+    case 'unauthorized':
+      return { message: GENERIC_ERROR, isDevBypass: false }
+    case 'blocked':
+      return { message: "That request couldn't be verified - try again.", isDevBypass: false }
+    case 'not_configured':
+      return { message: NOT_CONFIGURED_MESSAGE, isDevBypass: true }
+    default:
+      return { message: GENERIC_ERROR, isDevBypass: false }
+  }
+}
+
+/** Maps `confirm_account_otp`'s rejection to verify-phase copy. A wrong (but
+ *  well-formed) code is never a rejection — the command resolves `false` for
+ *  that, handled separately by the caller. `expired` covers BOTH "the code
+ *  expired or was never sent" AND "you used up your attempts" - the Worker
+ *  deliberately returns the same signal for both
+ *  (`infra/otp-worker/src/otp.ts`'s `VerifyOutcome` doc), so this can't and
+ *  shouldn't try to show a distinct "too many attempts" message. */
+export function classifyVerifyError(err: unknown): { message: string; isDevBypass: boolean } {
+  switch (errorCode(err)) {
+    case 'expired':
+      return { message: 'That code no longer works - request a new one.', isDevBypass: false }
+    case 'invalid_input':
+      return { message: "That code didn't work - check it and try again.", isDevBypass: false }
+    case 'rate_limited':
+      return { message: 'Too many codes requested - try again later.', isDevBypass: false }
+    case 'unavailable':
+      return { message: 'Sign-in is temporarily unavailable - try again in a moment.', isDevBypass: false }
+    case 'unauthorized':
+      return { message: GENERIC_ERROR, isDevBypass: false }
+    case 'not_configured':
+      return { message: NOT_CONFIGURED_MESSAGE, isDevBypass: true }
+    default:
+      return { message: GENERIC_ERROR, isDevBypass: false }
+  }
+}
diff --git a/ui/lib/signin-required.ts b/ui/lib/signin-required.ts
deleted file mode 100644
index fab74f871..000000000
--- a/ui/lib/signin-required.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-'use client'
-
-// Is sign-in required in this build? — asked by every surface that touches Clerk.
-//
-// The answer comes from `commands::account::sign_in_required` (Rust), which
-// returns false ONLY for a debug build with no Clerk publishable key configured
-// — the fresh-clone contributor case, where requiring sign-in would mean
-// requiring a key we cannot ship. A packaged build is compiled in release, so
-// the bypass branch does not exist in the shipped binary at all.
-//
-// THREE surfaces need this and they must agree, because they gate the same
-// session from different angles:
-//   - `RequireSignIn`        hides the whole dashboard
-//   - the setup wizard step  blocks Continue (`steps.tsx`'s SIGNIN_STEP)
-//   - `AccountAuthControl`   renders Clerk hooks in Settings → Account
-// They each rolled their own `invoke(...).then(setState)` first, and the copies
-// were NOT identical: two had no `.catch`, so a rejected command left the
-// promise unsettled and the surface stuck blank forever. One hook, one
-// fail-closed rule, one place to change it.
-
-import { useEffect, useState } from 'react'
-import { invoke } from '@/lib/bridge'
-
-/** Resolve the answer, FAILING CLOSED.
- *
- *  A command that cannot be reached must land on the gate, never past it — an
- *  unreachable Rust side is a broken build, not a licence to skip sign-in. This
- *  is the whole reason the function exists rather than a bare `invoke` call.
- *
- *  `ask` is injectable so the fail-closed path is testable without a Tauri
- *  runtime or module mocking — the rejection branch is the one that matters and
- *  the one that is otherwise impossible to reach in a test. */
-export async function resolveSignInRequired(
-  ask: () => Promise<boolean> = () => invoke<boolean>('sign_in_required'),
-): Promise<boolean> {
-  try {
-    return await ask()
-  } catch {
-    return true
-  }
-}
-
-/** `null` while resolving, then the answer.
- *
- *  Callers must treat `null` as "not yet known" and render neither the gated
- *  content nor a Clerk-dependent component — NOT as a falsy "no sign-in
- *  needed", which would flash the app open before the answer arrives. */
-export function useSignInRequired(): boolean | null {
-  const [required, setRequired] = useState<boolean | null>(null)
-  useEffect(() => {
-    let live = true
-    resolveSignInRequired().then((r) => {
-      if (live) setRequired(r)
-    })
-    return () => {
-      live = false
-    }
-  }, [])
-  return required
-}
diff --git a/ui/package-lock.json b/ui/package-lock.json
index 4c31007b9..83c62a801 100644
--- a/ui/package-lock.json
+++ b/ui/package-lock.json
@@ -1,14 +1,13 @@
 {
   "name": "meridian-ui",
-  "version": "1.83.1",
+  "version": "1.90.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meridian-ui",
-      "version": "1.83.1",
+      "version": "1.90.0",
       "dependencies": {
-        "@clerk/react": "^6.12.2",
         "@hello-pangea/dnd": "^18.0.1",
         "@radix-ui/react-select": "^2.2.6",
         "@radix-ui/react-switch": "^1.2.6",
@@ -19,8 +18,7 @@
         "next": "16.2.6",
         "react": "19.2.7",
         "react-dom": "19.2.7",
-        "react-markdown": "^10.1.0",
-        "tauri-plugin-clerk": "0.1.1"
+        "react-markdown": "^10.1.0"
       },
       "devDependencies": {
         "@happy-dom/global-registrator": "^20.10.6",
@@ -34,12 +32,6 @@
         "typescript": "5.8.2"
       }
     },
-    "node_modules/@adraffy/ens-normalize": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@adraffy/ens-normalize/-/ens-normalize-1.11.1.tgz",
-      "integrity": "sha512-nhCBV3quEgesuf7c7KYfperqSS14T8bYuvJ8PcLJp6znkZpFc0AuW4qBtr8eKVyPPe/8RSr7sglCWPU5eaxwKQ==",
-      "license": "MIT"
-    },
     "node_modules/@alloc/quick-lru": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz",
@@ -53,218 +45,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@babel/code-frame": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
-      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.29.7",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/compat-data": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
-      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/core": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
-      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.29.7",
-        "@babel/generator": "^7.29.7",
-        "@babel/helper-compilation-targets": "^7.29.7",
-        "@babel/helper-module-transforms": "^7.29.7",
-        "@babel/helpers": "^7.29.7",
-        "@babel/parser": "^7.29.7",
-        "@babel/template": "^7.29.7",
-        "@babel/traverse": "^7.29.7",
-        "@babel/types": "^7.29.7",
-        "@jridgewell/remapping": "^2.3.5",
-        "convert-source-map": "^2.0.0",
-        "debug": "^4.1.0",
-        "gensync": "^1.0.0-beta.2",
-        "json5": "^2.2.3",
-        "semver": "^6.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/babel"
-      }
-    },
-    "node_modules/@babel/core/node_modules/semver": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
-      "license": "ISC",
-      "peer": true,
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/@babel/generator": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz",
-      "integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/parser": "^7.29.7",
-        "@babel/types": "^7.29.7",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
-      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/compat-data": "^7.29.7",
-        "@babel/helper-validator-option": "^7.29.7",
-        "browserslist": "^4.24.0",
-        "lru-cache": "^5.1.1",
-        "semver": "^6.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
-      "license": "ISC",
-      "peer": true,
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/@babel/helper-globals": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
-      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-module-imports": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
-      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/traverse": "^7.29.7",
-        "@babel/types": "^7.29.7"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-module-transforms": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
-      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-module-imports": "^7.29.7",
-        "@babel/helper-validator-identifier": "^7.29.7",
-        "@babel/traverse": "^7.29.7"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/@babel/helper-string-parser": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
-      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
-      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-validator-option": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
-      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helpers": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
-      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/template": "^7.29.7",
-        "@babel/types": "^7.29.7"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/parser": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
-      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/types": "^7.29.7"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
     "node_modules/@babel/runtime": {
       "version": "7.29.2",
       "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.2.tgz",
@@ -274,164 +54,6 @@
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@babel/template": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
-      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.29.7",
-        "@babel/parser": "^7.29.7",
-        "@babel/types": "^7.29.7"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/traverse": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz",
-      "integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.29.7",
-        "@babel/generator": "^7.29.7",
-        "@babel/helper-globals": "^7.29.7",
-        "@babel/parser": "^7.29.7",
-        "@babel/template": "^7.29.7",
-        "@babel/types": "^7.29.7",
-        "debug": "^4.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/types": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
-      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.29.7",
-        "@babel/helper-validator-identifier": "^7.29.7"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@base-org/account": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@base-org/account/-/account-2.0.1.tgz",
-      "integrity": "sha512-tySVNx+vd6XEynZL0uvB10uKiwnAfThr8AbKTwILVG86mPbLAhEOInQIk+uDnvpTvfdUhC1Bi5T/46JvFoLZQQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@noble/hashes": "1.4.0",
-        "clsx": "1.2.1",
-        "eventemitter3": "5.0.1",
-        "idb-keyval": "6.2.1",
-        "ox": "0.6.9",
-        "preact": "10.24.2",
-        "viem": "^2.31.7",
-        "zustand": "5.0.3"
-      }
-    },
-    "node_modules/@clerk/clerk-js": {
-      "version": "6.25.2",
-      "resolved": "https://registry.npmjs.org/@clerk/clerk-js/-/clerk-js-6.25.2.tgz",
-      "integrity": "sha512-nN8+siCENInyi4gMzLbVJII+NOvytvxPj9VC02p5f9ahUljQRiZ5NDRW5W6AV619s2Y98gVLAoUEdJ0KaarzQw==",
-      "license": "MIT",
-      "dependencies": {
-        "@base-org/account": "2.0.1",
-        "@clerk/shared": "^4.25.2",
-        "@coinbase/wallet-sdk": "4.3.7",
-        "@solana/wallet-adapter-base": "0.9.27",
-        "@solana/wallet-adapter-react": "0.15.39",
-        "@solana/wallet-standard": "1.1.4",
-        "@stripe/stripe-js": "5.6.0",
-        "@swc/helpers": "0.5.21",
-        "@tanstack/query-core": "^5.100.6",
-        "@wallet-standard/core": "1.1.1",
-        "@zxcvbn-ts/core": "3.0.4",
-        "@zxcvbn-ts/language-common": "3.0.4",
-        "alien-signals": "2.0.6",
-        "browser-tabs-lock": "1.3.0",
-        "core-js": "3.47.0",
-        "crypto-js": "^4.2.0",
-        "dequal": "2.0.3"
-      },
-      "engines": {
-        "node": ">=20.9.0"
-      }
-    },
-    "node_modules/@clerk/clerk-js/node_modules/@swc/helpers": {
-      "version": "0.5.21",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.21.tgz",
-      "integrity": "sha512-jI/VAmtdjB/RnI8GTnokyX7Ug8c+g+ffD6QRLa6XQewtnGyukKkKSk3wLTM3b5cjt1jNh9x0jfVlagdN2gDKQg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.8.0"
-      }
-    },
-    "node_modules/@clerk/react": {
-      "version": "6.12.2",
-      "resolved": "https://registry.npmjs.org/@clerk/react/-/react-6.12.2.tgz",
-      "integrity": "sha512-Y+OGZlYfRW+3b+fjdbvSYyYB/IraGitrlLJKYaHxeZYNIwvoUNH0zlreSxUSmxYZ0E2yETSEvkCXszvuZUMa3A==",
-      "license": "MIT",
-      "dependencies": {
-        "@clerk/shared": "^4.25.2",
-        "tslib": "2.8.1"
-      },
-      "engines": {
-        "node": ">=20.9.0"
-      },
-      "peerDependencies": {
-        "react": "^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0",
-        "react-dom": "^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0"
-      }
-    },
-    "node_modules/@clerk/shared": {
-      "version": "4.25.2",
-      "resolved": "https://registry.npmjs.org/@clerk/shared/-/shared-4.25.2.tgz",
-      "integrity": "sha512-v7zgDh0eVLl3KzRHbKYTsPQ+4Xcx8A2oiU5iZ9WhME024WudwkjjPJRK12RycY0VA1Sj8i4Pi5zEpecqB/gp1Q==",
-      "license": "MIT",
-      "dependencies": {
-        "@tanstack/query-core": "^5.100.6",
-        "dequal": "2.0.3",
-        "glob-to-regexp": "0.4.1",
-        "js-cookie": "3.0.7"
-      },
-      "engines": {
-        "node": ">=20.9.0"
-      },
-      "peerDependencies": {
-        "react": "^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0",
-        "react-dom": "^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0"
-      },
-      "peerDependenciesMeta": {
-        "react": {
-          "optional": true
-        },
-        "react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@coinbase/wallet-sdk": {
-      "version": "4.3.7",
-      "resolved": "https://registry.npmjs.org/@coinbase/wallet-sdk/-/wallet-sdk-4.3.7.tgz",
-      "integrity": "sha512-z6e5XDw6EF06RqkeyEa+qD0dZ2ZbLci99vx3zwDY//XO8X7166tqKJrR2XlQnzVmtcUuJtCd5fCvr9Cu6zzX7w==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@noble/hashes": "^1.4.0",
-        "clsx": "^1.2.1",
-        "eventemitter3": "^5.0.1",
-        "preact": "^10.24.2",
-        "viem": "^2.27.2"
-      }
-    },
     "node_modules/@emnapi/runtime": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
@@ -977,154 +599,6 @@
         "url": "https://opencollective.com/libvips"
       }
     },
-    "node_modules/@isaacs/ttlcache": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@isaacs/ttlcache/-/ttlcache-1.4.1.tgz",
-      "integrity": "sha512-RQgQ4uQ+pLbqXfOmieB91ejmLwvSgv9nLx6sT6sD83s7umBypgg+OIBOBbEUiJXrfpnp9j0mRhYYdzp9uqq3lA==",
-      "license": "ISC",
-      "peer": true,
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@jest/schemas": {
-      "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-29.6.3.tgz",
-      "integrity": "sha512-mo5j5X+jIZmJQveBKeS/clAueipV7KgiX1vMgCxam1RNYiqE1w62n0/tJJnHtjW8ZHcQco5gY85jA3mi0L+nSA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@sinclair/typebox": "^0.27.8"
-      },
-      "engines": {
-        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
-      }
-    },
-    "node_modules/@jest/types": {
-      "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-29.6.3.tgz",
-      "integrity": "sha512-u3UPsIilWKOM3F9CXtrG8LEJmNxwoCQC/XVj4IKYXvvpx7QIi/Kg1LI5uDmDpKlac62NUtX7eLjRh+jVZcLOzw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@jest/schemas": "^29.6.3",
-        "@types/istanbul-lib-coverage": "^2.0.0",
-        "@types/istanbul-reports": "^3.0.0",
-        "@types/node": "*",
-        "@types/yargs": "^17.0.8",
-        "chalk": "^4.0.0"
-      },
-      "engines": {
-        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
-      }
-    },
-    "node_modules/@jest/types/node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/@jest/types/node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/@jest/types/node_modules/supports-color": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      }
-    },
-    "node_modules/@jridgewell/remapping": {
-      "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
-      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      }
-    },
-    "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@jridgewell/source-map": {
-      "version": "0.3.11",
-      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.11.tgz",
-      "integrity": "sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.25"
-      }
-    },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@jridgewell/resolve-uri": "^3.1.0",
-        "@jridgewell/sourcemap-codec": "^1.4.14"
-      }
-    },
     "node_modules/@next/env": {
       "version": "16.2.6",
       "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.6.tgz",
@@ -1259,76 +733,25 @@
         "node": ">= 10"
       }
     },
-    "node_modules/@noble/ciphers": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.3.0.tgz",
-      "integrity": "sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw==",
-      "license": "MIT",
-      "engines": {
-        "node": "^14.21.3 || >=16"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
+    "node_modules/@radix-ui/number": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/number/-/number-1.1.1.tgz",
+      "integrity": "sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g==",
+      "license": "MIT"
+    },
+    "node_modules/@radix-ui/primitive": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.1.3.tgz",
+      "integrity": "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==",
+      "license": "MIT"
     },
-    "node_modules/@noble/curves": {
-      "version": "1.9.7",
-      "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-1.9.7.tgz",
-      "integrity": "sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==",
+    "node_modules/@radix-ui/react-arrow": {
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.7.tgz",
+      "integrity": "sha512-F+M1tLhO+mlQaOWspE8Wstg+z6PwxwRd8oQ8IXceWz92kfAmalTRf0EjrouQeo7QssEPfCn05B4Ihs1K9WQ/7w==",
       "license": "MIT",
       "dependencies": {
-        "@noble/hashes": "1.8.0"
-      },
-      "engines": {
-        "node": "^14.21.3 || >=16"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
-    "node_modules/@noble/curves/node_modules/@noble/hashes": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
-      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
-      "license": "MIT",
-      "engines": {
-        "node": "^14.21.3 || >=16"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
-    "node_modules/@noble/hashes": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz",
-      "integrity": "sha512-V1JJ1WTRUqHHrOSh597hURcMqVKVGL/ea3kv0gSnEdsEZ0/+VyPghM1lMNGc00z7CIQorSvbKpuJkxvuHbvdbg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 16"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
-    "node_modules/@radix-ui/number": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/number/-/number-1.1.1.tgz",
-      "integrity": "sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g==",
-      "license": "MIT"
-    },
-    "node_modules/@radix-ui/primitive": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.1.3.tgz",
-      "integrity": "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==",
-      "license": "MIT"
-    },
-    "node_modules/@radix-ui/react-arrow": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.7.tgz",
-      "integrity": "sha512-F+M1tLhO+mlQaOWspE8Wstg+z6PwxwRd8oQ8IXceWz92kfAmalTRf0EjrouQeo7QssEPfCn05B4Ihs1K9WQ/7w==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-primitive": "2.1.3"
+        "@radix-ui/react-primitive": "2.1.3"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -1893,4230 +1316,926 @@
       "integrity": "sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw==",
       "license": "MIT"
     },
-    "node_modules/@react-native-async-storage/async-storage": {
-      "version": "1.24.0",
-      "resolved": "https://registry.npmjs.org/@react-native-async-storage/async-storage/-/async-storage-1.24.0.tgz",
-      "integrity": "sha512-W4/vbwUOYOjco0x3toB8QCr7EjIP6nE9G7o8PMguvvjYT5Awg09lyV4enACRx4s++PPulBiBSjL0KTFx2u0Z/g==",
-      "license": "MIT",
-      "optional": true,
+    "node_modules/@swc/helpers": {
+      "version": "0.5.15",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",
+      "integrity": "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "merge-options": "^3.0.4"
-      },
-      "peerDependencies": {
-        "react-native": "^0.0.0-0 || >=0.60 <1.0"
-      }
-    },
-    "node_modules/@react-native/assets-registry": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/@react-native/assets-registry/-/assets-registry-0.86.0.tgz",
-      "integrity": "sha512-nIaXbm2jX1OTYp0qbviJ3O6KZivoE8z3BnhUQ2LsqfZSWRoOK/n1qsiAr6oALiNKWnXY3j2KPwtYORnZzp8xew==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
+        "tslib": "^2.8.0"
       }
     },
-    "node_modules/@react-native/codegen": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/@react-native/codegen/-/codegen-0.86.0.tgz",
-      "integrity": "sha512-uTs9DBo3+/lUqinsGZK0FKJRBVClrwMXoZToaDxE1Q2SL2e55vs2GwyZfIKzPl5uJnbu4PfFMIp0/mLXLWUMuA==",
+    "node_modules/@tailwindcss/node": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.1.4.tgz",
+      "integrity": "sha512-MT5118zaiO6x6hNA04OWInuAiP1YISXql8Z+/Y8iisV5nuhM8VXlyhRuqc2PEviPszcXI66W44bCIk500Oolhw==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "@babel/core": "^7.25.2",
-        "@babel/parser": "^7.29.0",
-        "hermes-parser": "0.36.0",
-        "invariant": "^2.2.4",
-        "nullthrows": "^1.1.1",
-        "tinyglobby": "^0.2.15",
-        "yargs": "^17.6.2"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "*"
+        "enhanced-resolve": "^5.18.1",
+        "jiti": "^2.4.2",
+        "lightningcss": "1.29.2",
+        "tailwindcss": "4.1.4"
       }
     },
-    "node_modules/@react-native/codegen/node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+    "node_modules/@tailwindcss/oxide": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.1.4.tgz",
+      "integrity": "sha512-p5wOpXyOJx7mKh5MXh5oKk+kqcz8T+bA3z/5VWWeQwFrmuBItGwz8Y2CHk/sJ+dNb9B0nYFfn0rj/cKHZyjahQ==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
       "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/@react-native/codegen/node_modules/cliui": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
-      "license": "ISC",
-      "peer": true,
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.1",
-        "wrap-ansi": "^7.0.0"
+        "node": ">= 10"
       },
-      "engines": {
-        "node": ">=12"
+      "optionalDependencies": {
+        "@tailwindcss/oxide-android-arm64": "4.1.4",
+        "@tailwindcss/oxide-darwin-arm64": "4.1.4",
+        "@tailwindcss/oxide-darwin-x64": "4.1.4",
+        "@tailwindcss/oxide-freebsd-x64": "4.1.4",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.1.4",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.1.4",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.1.4",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.1.4",
+        "@tailwindcss/oxide-linux-x64-musl": "4.1.4",
+        "@tailwindcss/oxide-wasm32-wasi": "4.1.4",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.1.4",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.1.4"
       }
     },
-    "node_modules/@react-native/codegen/node_modules/wrap-ansi": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+    "node_modules/@tailwindcss/oxide-android-arm64": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.1.4.tgz",
+      "integrity": "sha512-xMMAe/SaCN/vHfQYui3fqaBDEXMu22BVwQ33veLc8ep+DNy7CWN52L+TTG9y1K397w9nkzv+Mw+mZWISiqhmlA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/@react-native/codegen/node_modules/y18n": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
-      "license": "ISC",
-      "peer": true,
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": ">=10"
+        "node": ">= 10"
       }
     },
-    "node_modules/@react-native/codegen/node_modules/yargs": {
-      "version": "17.7.3",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
-      "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
+    "node_modules/@tailwindcss/oxide-darwin-arm64": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.1.4.tgz",
+      "integrity": "sha512-JGRj0SYFuDuAGilWFBlshcexev2hOKfNkoX+0QTksKYq2zgF9VY/vVMq9m8IObYnLna0Xlg+ytCi2FN2rOL0Sg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "cliui": "^8.0.1",
-        "escalade": "^3.1.1",
-        "get-caller-file": "^2.0.5",
-        "require-directory": "^2.1.1",
-        "string-width": "^4.2.3",
-        "y18n": "^5.0.5",
-        "yargs-parser": "^21.1.1"
-      },
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": ">=12"
+        "node": ">= 10"
       }
     },
-    "node_modules/@react-native/codegen/node_modules/yargs-parser": {
-      "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
-      "license": "ISC",
-      "peer": true,
+    "node_modules/@tailwindcss/oxide-darwin-x64": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.1.4.tgz",
+      "integrity": "sha512-sdDeLNvs3cYeWsEJ4H1DvjOzaGios4QbBTNLVLVs0XQ0V95bffT3+scptzYGPMjm7xv4+qMhCDrkHwhnUySEzA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": ">=12"
+        "node": ">= 10"
       }
     },
-    "node_modules/@react-native/community-cli-plugin": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/@react-native/community-cli-plugin/-/community-cli-plugin-0.86.0.tgz",
-      "integrity": "sha512-Jv8p1ebEPfTzs8gmrjsdT2XMXFfeAg45Pman+XPLFGaSeGAZkutRFRyX9Cs9aGTSOyIA9YPJ6vDNb1ayTf1FKQ==",
+    "node_modules/@tailwindcss/oxide-freebsd-x64": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.1.4.tgz",
+      "integrity": "sha512-VHxAqxqdghM83HslPhRsNhHo91McsxRJaEnShJOMu8mHmEj9Ig7ToHJtDukkuLWLzLboh2XSjq/0zO6wgvykNA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@react-native/dev-middleware": "0.86.0",
-        "debug": "^4.4.0",
-        "invariant": "^2.2.4",
-        "metro": "^0.84.3",
-        "metro-config": "^0.84.3",
-        "metro-core": "^0.84.3",
-        "semver": "^7.1.3"
-      },
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
       "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      },
-      "peerDependencies": {
-        "@react-native-community/cli": "*",
-        "@react-native/metro-config": "0.86.0"
-      },
-      "peerDependenciesMeta": {
-        "@react-native-community/cli": {
-          "optional": true
-        },
-        "@react-native/metro-config": {
-          "optional": true
-        }
+        "node": ">= 10"
       }
     },
-    "node_modules/@react-native/debugger-frontend": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/@react-native/debugger-frontend/-/debugger-frontend-0.86.0.tgz",
-      "integrity": "sha512-7Mb3nDfyJeys+ELF75Ageu7VKERlnIMoO+aNPoXqTXvz+b41L6l2CqMyLpDHxkBSlenij6gEepPNgaIyWHbJZw==",
-      "license": "BSD-3-Clause",
-      "peer": true,
+    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.1.4.tgz",
+      "integrity": "sha512-OTU/m/eV4gQKxy9r5acuesqaymyeSCnsx1cFto/I1WhPmi5HDxX1nkzb8KYBiwkHIGg7CTfo/AcGzoXAJBxLfg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
+        "node": ">= 10"
       }
     },
-    "node_modules/@react-native/debugger-shell": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/@react-native/debugger-shell/-/debugger-shell-0.86.0.tgz",
-      "integrity": "sha512-Y0zEkZzLz8ou6o/VLml1A31X/rMgc6DRjwxwzPMa94qRTMY070WeBCNTITQo4kKTBAUgbxh07oXPQqp0Tpja8w==",
+    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.1.4.tgz",
+      "integrity": "sha512-hKlLNvbmUC6z5g/J4H+Zx7f7w15whSVImokLPmP6ff1QqTVE+TxUM9PGuNsjHvkvlHUtGTdDnOvGNSEUiXI1Ww==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "cross-spawn": "^7.0.6",
-        "debug": "^4.4.0",
-        "fb-dotslash": "0.5.8"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
+        "node": ">= 10"
       }
     },
-    "node_modules/@react-native/dev-middleware": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/@react-native/dev-middleware/-/dev-middleware-0.86.0.tgz",
-      "integrity": "sha512-20pTO6yTybmvXvro520H6C7jydIQnLKOl5qFtVEcHSdFrY63r3OGei+Rx9bILgSRmH6jgnfEcijcMx7pwWuQtw==",
+    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.1.4.tgz",
+      "integrity": "sha512-X3As2xhtgPTY/m5edUtddmZ8rCruvBvtxYLMw9OsZdH01L2gS2icsHRwxdU0dMItNfVmrBezueXZCHxVeeb7Aw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@isaacs/ttlcache": "^1.4.1",
-        "@react-native/debugger-frontend": "0.86.0",
-        "@react-native/debugger-shell": "0.86.0",
-        "chrome-launcher": "^0.15.2",
-        "chromium-edge-launcher": "^0.3.0",
-        "connect": "^3.6.5",
-        "debug": "^4.4.0",
-        "invariant": "^2.2.4",
-        "nullthrows": "^1.1.1",
-        "open": "^7.0.3",
-        "serve-static": "^1.16.2",
-        "ws": "^7.5.10"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
+        "node": ">= 10"
       }
     },
-    "node_modules/@react-native/dev-middleware/node_modules/ws": {
-      "version": "7.5.11",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.11.tgz",
-      "integrity": "sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA==",
+    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.1.4.tgz",
+      "integrity": "sha512-2VG4DqhGaDSmYIu6C4ua2vSLXnJsb/C9liej7TuSO04NK+JJJgJucDUgmX6sn7Gw3Cs5ZJ9ZLrnI0QRDOjLfNQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
       "license": "MIT",
-      "peer": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=8.3.0"
-      },
-      "peerDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": "^5.0.2"
-      },
-      "peerDependenciesMeta": {
-        "bufferutil": {
-          "optional": true
-        },
-        "utf-8-validate": {
-          "optional": true
-        }
+        "node": ">= 10"
       }
     },
-    "node_modules/@react-native/gradle-plugin": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/@react-native/gradle-plugin/-/gradle-plugin-0.86.0.tgz",
-      "integrity": "sha512-a1RcfaEDqWExCGfCwadIxt4l8FvKYgFqeMf2uzeKyAOnb+vTGNIeCvifFL2MqvgaeYxlER437HbMIajGcuJ1pQ==",
+    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.1.4.tgz",
+      "integrity": "sha512-v+mxVgH2kmur/X5Mdrz9m7TsoVjbdYQT0b4Z+dr+I4RvreCNXyCFELZL/DO0M1RsidZTrm6O1eMnV6zlgEzTMQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
       "license": "MIT",
-      "peer": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
+        "node": ">= 10"
       }
     },
-    "node_modules/@react-native/js-polyfills": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/@react-native/js-polyfills/-/js-polyfills-0.86.0.tgz",
-      "integrity": "sha512-zYy/Cjd1VTnZ2iCNaG9bDF9C3l2ntESiPRscjIlI5FKugu6aeTwsDSv1aI8Bc4Kp3vEdoVg+UQhLAhE4svREaQ==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/@react-native/normalize-colors": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/@react-native/normalize-colors/-/normalize-colors-0.86.0.tgz",
-      "integrity": "sha512-kG0wfCGghUKlfxkJyyHCDVutWVYWK7/DG58ojA/4v9EfulgF+osuSQmlbNb3rcKX58qutm7JcldSeVLgGFha9g==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/@react-native/virtualized-lists": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/@react-native/virtualized-lists/-/virtualized-lists-0.86.0.tgz",
-      "integrity": "sha512-4/ZLXdf/OSpPDVO0AsQ1SJdRIzt5t9BNQ46QwGgxvX7/cirYR5k8KXctNGGgW8lQo2gZChEfY2zFCZg9nM/jiw==",
+    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.1.4.tgz",
+      "integrity": "sha512-2TLe9ir+9esCf6Wm+lLWTMbgklIjiF0pbmDnwmhR9MksVOq+e8aP3TSsXySnBDDvTTVd/vKu1aNttEGj3P6l8Q==",
+      "bundleDependencies": [
+        "@napi-rs/wasm-runtime",
+        "@emnapi/core",
+        "@emnapi/runtime",
+        "@tybys/wasm-util",
+        "@emnapi/wasi-threads",
+        "tslib"
+      ],
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
       "license": "MIT",
-      "peer": true,
+      "optional": true,
       "dependencies": {
-        "invariant": "^2.2.4",
-        "nullthrows": "^1.1.1"
+        "@emnapi/core": "^1.4.0",
+        "@emnapi/runtime": "^1.4.0",
+        "@emnapi/wasi-threads": "^1.0.1",
+        "@napi-rs/wasm-runtime": "^0.2.8",
+        "@tybys/wasm-util": "^0.9.0",
+        "tslib": "^2.8.0"
       },
       "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      },
-      "peerDependencies": {
-        "@types/react": "^19.2.0",
-        "react": "*",
-        "react-native": "0.86.0"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@scure/base": {
-      "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/@scure/base/-/base-1.2.6.tgz",
-      "integrity": "sha512-g/nm5FgUa//MCj1gV09zTJTaM6KBAHqLN907YVQqf7zC49+DcO4B1so4ZX07Ef10Twr6nuqYEH9GEggFXA4Fmg==",
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.4.0",
+      "dev": true,
+      "inBundle": true,
       "license": "MIT",
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.0.1",
+        "tslib": "^2.4.0"
       }
     },
-    "node_modules/@scure/bip32": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/@scure/bip32/-/bip32-1.7.0.tgz",
-      "integrity": "sha512-E4FFX/N3f4B80AKWp5dP6ow+flD1LQZo/w8UnLGYZO674jS6YnYeepycOOksv+vLPSpgN35wgKgy+ybfTb2SMw==",
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.4.0",
+      "dev": true,
+      "inBundle": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "@noble/curves": "~1.9.0",
-        "@noble/hashes": "~1.8.0",
-        "@scure/base": "~1.2.5"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
+        "tslib": "^2.4.0"
       }
     },
-    "node_modules/@scure/bip32/node_modules/@noble/hashes": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
-      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.0.1",
+      "dev": true,
+      "inBundle": true,
       "license": "MIT",
-      "engines": {
-        "node": "^14.21.3 || >=16"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
       }
     },
-    "node_modules/@scure/bip39": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/@scure/bip39/-/bip39-1.6.0.tgz",
-      "integrity": "sha512-+lF0BbLiJNwVlev4eKelw1WWLaiKXw7sSl8T6FvBlWkdX+94aGJ4o8XjUdlyhTCjd8c+B3KT3JfS8P0bLRNU6A==",
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "0.2.8",
+      "dev": true,
+      "inBundle": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "@noble/hashes": "~1.8.0",
-        "@scure/base": "~1.2.5"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
+        "@emnapi/core": "^1.4.0",
+        "@emnapi/runtime": "^1.4.0",
+        "@tybys/wasm-util": "^0.9.0"
       }
     },
-    "node_modules/@scure/bip39/node_modules/@noble/hashes": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
-      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.9.0",
+      "dev": true,
+      "inBundle": true,
       "license": "MIT",
-      "engines": {
-        "node": "^14.21.3 || >=16"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
       }
     },
-    "node_modules/@sinclair/typebox": {
-      "version": "0.27.10",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.10.tgz",
-      "integrity": "sha512-MTBk/3jGLNB2tVxv6uLlFh1iu64iYOQ2PbdOSK3NW8JZsmlaOh2q6sdtKowBhfw8QFLmYNzTW4/oK4uATIi6ZA==",
-      "license": "MIT",
-      "peer": true
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+      "version": "2.8.0",
+      "dev": true,
+      "inBundle": true,
+      "license": "0BSD",
+      "optional": true
     },
-    "node_modules/@solana-mobile/mobile-wallet-adapter-protocol": {
-      "version": "2.2.9",
-      "resolved": "https://registry.npmjs.org/@solana-mobile/mobile-wallet-adapter-protocol/-/mobile-wallet-adapter-protocol-2.2.9.tgz",
-      "integrity": "sha512-qtWJq0hzKgngVG0So2ViBRPYDculaxgj40WDSP1nzgdg85MXyAmTEjQqV10uSVbZRm9b1hl601HDJX1sHTgeiw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@solana/kit": "^6.0.0",
-        "@solana/wallet-standard-features": "^1.3.0",
-        "@solana/wallet-standard-util": "^1.1.2",
-        "@wallet-standard/core": "^1.1.1"
-      },
-      "peerDependencies": {
-        "react-native": ">0.74"
+    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.1.4.tgz",
+      "integrity": "sha512-VlnhfilPlO0ltxW9/BgfLI5547PYzqBMPIzRrk4W7uupgCt8z6Trw/tAj6QUtF2om+1MH281Pg+HHUJoLesmng==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
       }
     },
-    "node_modules/@solana-mobile/mobile-wallet-adapter-protocol-web3js": {
-      "version": "2.2.9",
-      "resolved": "https://registry.npmjs.org/@solana-mobile/mobile-wallet-adapter-protocol-web3js/-/mobile-wallet-adapter-protocol-web3js-2.2.9.tgz",
-      "integrity": "sha512-TAMItAuOb7duwYQ+PZ6JNqw/6TEhCWLObHF5uOBGV9tjCozHGVunxa7lTeuHAWIgO68IAo86MZdE5kethDATpw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@solana-mobile/mobile-wallet-adapter-protocol": "^2.2.9"
-      },
-      "peerDependencies": {
-        "@solana/web3.js": "^1.98.4"
+    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.1.4.tgz",
+      "integrity": "sha512-+7S63t5zhYjslUGb8NcgLpFXD+Kq1F/zt5Xv5qTv7HaFTG/DHyHD9GA6ieNAxhgyA4IcKa/zy7Xx4Oad2/wuhw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
       }
     },
-    "node_modules/@solana-mobile/wallet-adapter-mobile": {
-      "version": "2.2.9",
-      "resolved": "https://registry.npmjs.org/@solana-mobile/wallet-adapter-mobile/-/wallet-adapter-mobile-2.2.9.tgz",
-      "integrity": "sha512-IWzI2pUmEqBsTNo+XqMTY38NL5TSdMetES59N0Cmuf+zYqiS56rHdMwD/R2IOy7E4yKa1CsuHfCh6CE6zk4ViQ==",
-      "license": "Apache-2.0",
+    "node_modules/@tailwindcss/postcss": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.1.4.tgz",
+      "integrity": "sha512-bjV6sqycCEa+AQSt2Kr7wpGF1bOZJ5wsqnLEkqSbM/JEHxx/yhMH8wHmdkPyApF9xhHeMSwnnkDUUMMM/hYnXw==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@solana-mobile/mobile-wallet-adapter-protocol": "^2.2.9",
-        "@solana-mobile/mobile-wallet-adapter-protocol-web3js": "^2.2.9",
-        "@solana-mobile/wallet-standard-mobile": "^0.5.3",
-        "@solana/wallet-adapter-base": "^0.9.27",
-        "@solana/wallet-standard-features": "^1.3.0",
-        "@wallet-standard/core": "^1.1.1",
-        "tslib": "^2.8.1"
-      },
-      "optionalDependencies": {
-        "@react-native-async-storage/async-storage": "^1.17.7"
-      },
-      "peerDependencies": {
-        "@solana/web3.js": "^1.98.4",
-        "react-native": ">0.74"
+        "@alloc/quick-lru": "^5.2.0",
+        "@tailwindcss/node": "4.1.4",
+        "@tailwindcss/oxide": "4.1.4",
+        "postcss": "^8.4.41",
+        "tailwindcss": "4.1.4"
       }
     },
-    "node_modules/@solana-mobile/wallet-standard-mobile": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/@solana-mobile/wallet-standard-mobile/-/wallet-standard-mobile-0.5.3.tgz",
-      "integrity": "sha512-/Ea/CNIWHExpXsA6syVy7fUUhONtYob+VMsmF8flm8GEAZQyzX6UtKSy4NQMMTGBTAGlmmmbBVrZF+Tp5/fDxQ==",
-      "license": "Apache-2.0",
+    "node_modules/@types/bun": {
+      "version": "1.3.14",
+      "resolved": "https://registry.npmjs.org/@types/bun/-/bun-1.3.14.tgz",
+      "integrity": "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@solana-mobile/mobile-wallet-adapter-protocol": "^2.2.9",
-        "@solana/wallet-standard-chains": "^1.1.1",
-        "@solana/wallet-standard-features": "^1.3.0",
-        "@wallet-standard/base": "^1.0.1",
-        "@wallet-standard/features": "^1.0.3",
-        "@wallet-standard/wallet": "^1.1.0",
-        "qrcode": "^1.5.4",
-        "tslib": "^2.8.1"
-      },
-      "optionalDependencies": {
-        "@react-native-async-storage/async-storage": "^1.17.7"
+        "bun-types": "1.3.14"
       }
     },
-    "node_modules/@solana/accounts": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/accounts/-/accounts-6.10.0.tgz",
-      "integrity": "sha512-+FxfDOrnifoPlBkF+fr8eeQdgM6xtIgAg9xKMu3WnIz60oZd4Xnry6+ff6t+ePPoZZp397FSg9ZJet68VCWm5Q==",
+    "node_modules/@types/debug": {
+      "version": "4.1.13",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
+      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
       "license": "MIT",
       "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-strings": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/rpc-spec": "6.10.0",
-        "@solana/rpc-types": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
+        "@types/ms": "*"
       }
     },
-    "node_modules/@solana/addresses": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/addresses/-/addresses-6.10.0.tgz",
-      "integrity": "sha512-vEoCGBTxG0HCERAn84KXkrJjl+pDaNzOpZ0qbgcPS98fYxP5yzbKB8SNOY2bzrbkRUmmw5Q3hqTRERemUN2Gcw==",
+    "node_modules/@types/estree": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/estree-jsx": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@types/estree-jsx/-/estree-jsx-1.0.5.tgz",
+      "integrity": "sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==",
       "license": "MIT",
       "dependencies": {
-        "@solana/assertions": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-strings": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/nominal-types": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
+        "@types/estree": "*"
       }
     },
-    "node_modules/@solana/assertions": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/assertions/-/assertions-6.10.0.tgz",
-      "integrity": "sha512-lKSAdVo+P/6Lp4vs6shstXmFOpvxrABwn4o1462tb7sKkNapk6o9pPFVPGw4DUgPS3WqWRs1j2tmpuVjhQRntg==",
+    "node_modules/@types/hast": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.4.tgz",
+      "integrity": "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==",
       "license": "MIT",
       "dependencies": {
-        "@solana/errors": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
+        "@types/unist": "*"
       }
     },
-    "node_modules/@solana/buffer-layout": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@solana/buffer-layout/-/buffer-layout-4.0.1.tgz",
-      "integrity": "sha512-E1ImOIAD1tBZFRdjeM4/pzTiTApC0AOBGwyAMS4fwIodCWArzJ3DWdoh8cKxeFM2fElkxBh2Aqts1BPC373rHA==",
+    "node_modules/@types/mdast": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
+      "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "buffer": "~6.0.3"
-      },
-      "engines": {
-        "node": ">=5.10"
+        "@types/unist": "*"
       }
     },
-    "node_modules/@solana/codecs": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/codecs/-/codecs-6.10.0.tgz",
-      "integrity": "sha512-lLVuxod4ChWp9i7OvpgIykYG8Q9OGPVXKnHM9VlzDDLylsx7Y1FoQL00sHa7PqFkJVmkBufaA6dcGbQ7FU+lAQ==",
+    "node_modules/@types/ms": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
+      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "22.0.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.0.0.tgz",
+      "integrity": "sha512-VT7KSYudcPOzP5Q0wfbowyNLaVR8QWUdw+088uFWwfvpY6uCWaXpqV6ieLAu9WBcnTa7H4Z5RLK8I5t2FuOcqw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-data-structures": "6.10.0",
-        "@solana/codecs-numbers": "6.10.0",
-        "@solana/codecs-strings": "6.10.0",
-        "@solana/fixed-points": "6.10.0",
-        "@solana/options": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
+        "undici-types": "~6.11.1"
       }
     },
-    "node_modules/@solana/codecs-core": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/codecs-core/-/codecs-core-6.10.0.tgz",
-      "integrity": "sha512-nfAl9OMGo4HanIMxGsQoVB7BxMoqBCYEUxl8oEAZZ09pDxnaXQZkTRXEwPPccag37XfW1ciPd1vWPKwB2b0HHQ==",
+    "node_modules/@types/react": {
+      "version": "19.2.17",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
+      "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
       "license": "MIT",
       "dependencies": {
-        "@solana/errors": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
+        "csstype": "^3.2.2"
       }
     },
-    "node_modules/@solana/codecs-data-structures": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/codecs-data-structures/-/codecs-data-structures-6.10.0.tgz",
-      "integrity": "sha512-CNasJW3bq5u+632Zt5aJ8rOjAjv2HyenpV8o9kAIqdmV4CBpjCCoBnKn8LkuR/sbeREZxJYfhKTXO/9ruAkw7A==",
+    "node_modules/@types/react-dom": {
+      "version": "19.2.3",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz",
+      "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
+      "devOptional": true,
       "license": "MIT",
-      "dependencies": {
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-numbers": "6.10.0",
-        "@solana/errors": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
       "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
+        "@types/react": "^19.2.0"
       }
     },
-    "node_modules/@solana/codecs-numbers": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/codecs-numbers/-/codecs-numbers-6.10.0.tgz",
-      "integrity": "sha512-CcM+wX4zOiA9zkh8A7t1787A0Ehgmu5+6Z2tKoHew6cNw/dkaUTPa8JnNHbvfsLC8dfHC1BhAEJl86sKmRsfkQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/codecs-core": "6.10.0",
-        "@solana/errors": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/codecs-strings": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/codecs-strings/-/codecs-strings-6.10.0.tgz",
-      "integrity": "sha512-zlaqkg7K6F6IN4V/Ec8TWkTn054gxv7ZLagvGkuEyAdPQ6BzzsehOm2TqCuyXgJJTCGPLY1bEk6yH9NxANe0kA==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-numbers": "6.10.0",
-        "@solana/errors": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "fastestsmallesttextencoderdecoder": "^1.0.22",
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "fastestsmallesttextencoderdecoder": {
-          "optional": true
-        },
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/errors": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/errors/-/errors-6.10.0.tgz",
-      "integrity": "sha512-KBLAxCtAXr357JNhCyIDQXWbuSj5vN6w+28FSfcYY6OOSiphmXLAV3V58jgV0C6iNbIzFJFi6yatFyDTdeJsNg==",
-      "license": "MIT",
-      "dependencies": {
-        "chalk": "5.6.2",
-        "commander": "15.0.0"
-      },
-      "bin": {
-        "errors": "bin/cli.mjs"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/fast-stable-stringify": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/fast-stable-stringify/-/fast-stable-stringify-6.10.0.tgz",
-      "integrity": "sha512-iCNed27wk6PKSS3QUtHovRfMWF/jbVWogs2vB4tukKUCsqG4rDfDInIwZ6ur/nY6XTrgi2gMMdZq9GAUlWsbfw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/fixed-points": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/fixed-points/-/fixed-points-6.10.0.tgz",
-      "integrity": "sha512-ZkKL0alXH3L7/wMiVG8YUuG8qBKunlM810+YBD7nUPRhifiGsX1zwADViHLYNqLr/jUk0mTYFUcKznTpB/K+Gg==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/codecs-core": "6.10.0",
-        "@solana/errors": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/functional": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/functional/-/functional-6.10.0.tgz",
-      "integrity": "sha512-P8cevu4mAqHTXC37h1TVoOh8zhWB2tlOI/R9vWjYPpcLwcyWf8p2qq4LEGHl5kY+1C+4PNX39HsmCocXOPCDkQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/instruction-plans": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/instruction-plans/-/instruction-plans-6.10.0.tgz",
-      "integrity": "sha512-YG7mo4zykzdc6ZTV0BuN6pveK9qeBySzlYYerq578A4eQu3xcypMAYRGAvhMZtWTanjjmD6CKtM0M7kVp0TNxg==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/errors": "6.10.0",
-        "@solana/instructions": "6.10.0",
-        "@solana/keys": "6.10.0",
-        "@solana/promises": "6.10.0",
-        "@solana/transaction-messages": "6.10.0",
-        "@solana/transactions": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/instructions": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/instructions/-/instructions-6.10.0.tgz",
-      "integrity": "sha512-0TToYF+8LXQ3ofPMx+yF6yaM9l4YJvcAPMy0qV5JsrBUFlWXBSANRuudKBQLHMvb+a3OiUTq5X7omuorKMBB3A==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/codecs-core": "6.10.0",
-        "@solana/errors": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/keys": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/keys/-/keys-6.10.0.tgz",
-      "integrity": "sha512-26IRfdm/hTUCmM7MeEeX0ULSbCM6OzkZTkfkrPircqmRM7xyNqP4hq7u0P7wjb9dl7NfgyG6K7cdvUxrj2e3mA==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/assertions": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-strings": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/nominal-types": "6.10.0",
-        "@solana/promises": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/kit": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/kit/-/kit-6.10.0.tgz",
-      "integrity": "sha512-/WnnQp3uARh2JCFSfAakejTAqwmXVuMVTcRn5r2yDwY2yzZ4R6mt/Cl59VPimVLNSoTyN/KsEwhv9omr3ERazQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/accounts": "6.10.0",
-        "@solana/addresses": "6.10.0",
-        "@solana/codecs": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/functional": "6.10.0",
-        "@solana/instruction-plans": "6.10.0",
-        "@solana/instructions": "6.10.0",
-        "@solana/keys": "6.10.0",
-        "@solana/offchain-messages": "6.10.0",
-        "@solana/plugin-core": "6.10.0",
-        "@solana/plugin-interfaces": "6.10.0",
-        "@solana/program-client-core": "6.10.0",
-        "@solana/programs": "6.10.0",
-        "@solana/rpc": "6.10.0",
-        "@solana/rpc-api": "6.10.0",
-        "@solana/rpc-parsed-types": "6.10.0",
-        "@solana/rpc-spec-types": "6.10.0",
-        "@solana/rpc-subscriptions": "6.10.0",
-        "@solana/rpc-types": "6.10.0",
-        "@solana/signers": "6.10.0",
-        "@solana/subscribable": "6.10.0",
-        "@solana/sysvars": "6.10.0",
-        "@solana/transaction-confirmation": "6.10.0",
-        "@solana/transaction-messages": "6.10.0",
-        "@solana/transactions": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/nominal-types": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/nominal-types/-/nominal-types-6.10.0.tgz",
-      "integrity": "sha512-9ykyBBvnkInH7fCacjJi7zu2PJyd+OCt+VTjIISv070fHzKIMFqZqJJ/dJ0SRH2aHwfB3n86iVsmtBtuxi4KKA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/offchain-messages": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/offchain-messages/-/offchain-messages-6.10.0.tgz",
-      "integrity": "sha512-RiEgAueeMkFMC1suOXBIcmCZgtXRxy24yk0DldPB37bB4zwOF1SAaRjNRPjIkGK8RhCYrEpPosnzLyavw9ueRg==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-data-structures": "6.10.0",
-        "@solana/codecs-numbers": "6.10.0",
-        "@solana/codecs-strings": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/keys": "6.10.0",
-        "@solana/nominal-types": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/options": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/options/-/options-6.10.0.tgz",
-      "integrity": "sha512-RO9UT3UYD8/Cu2uM6ZXbKvLeMnVD42+g9JRds7Pfs4AhiOyg4R4TJrQUAppTgavPTO3PBRlWtWOC05ZH/yAIbg==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-data-structures": "6.10.0",
-        "@solana/codecs-numbers": "6.10.0",
-        "@solana/codecs-strings": "6.10.0",
-        "@solana/errors": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/plugin-core": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/plugin-core/-/plugin-core-6.10.0.tgz",
-      "integrity": "sha512-JE70YTQOfFACVFGvoJon4Scc/eHUWjMu8Ovo35CcV2kHTAHYMCd4UkBd2gmlhK0vRMMomsQi1ZLPlAlTq0OoUQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/plugin-interfaces": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/plugin-interfaces/-/plugin-interfaces-6.10.0.tgz",
-      "integrity": "sha512-vr0/l9wcM4orwGr8cjkFWaJ9A4HvzuAv00jMFNMg0Spd0GZqnwnpW+D/fXa1lIJnTRaF3EeEjLh4VjKU037T0Q==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/instruction-plans": "6.10.0",
-        "@solana/keys": "6.10.0",
-        "@solana/rpc-spec": "6.10.0",
-        "@solana/rpc-subscriptions-spec": "6.10.0",
-        "@solana/rpc-types": "6.10.0",
-        "@solana/signers": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/program-client-core": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/program-client-core/-/program-client-core-6.10.0.tgz",
-      "integrity": "sha512-4PPbTLdC1ylHIuvhOFDP8RnSkXPCFjNFWGslzc+UFKnoR4ajzBcByX94jmaruDMk5ncxgj7tr9pzJTvfGHIaMA==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/accounts": "6.10.0",
-        "@solana/addresses": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/instruction-plans": "6.10.0",
-        "@solana/instructions": "6.10.0",
-        "@solana/plugin-interfaces": "6.10.0",
-        "@solana/rpc-api": "6.10.0",
-        "@solana/signers": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/programs": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/programs/-/programs-6.10.0.tgz",
-      "integrity": "sha512-qn/HeLP5KGUJXVub3fyGe69/rWaLX4jzwm6V/1pNxJDbdF+MBdgn18hP6F+VmhfdNmwK0lue3J/1HQ1UTMuQeQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/errors": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/promises": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/promises/-/promises-6.10.0.tgz",
-      "integrity": "sha512-oJSIn+VBBMWDo8oqw7RV3tI6Jih+Ieup6FcQLYLDUriaeo7+8l1Zdezl8zh7SIfeU4lOfAbRg6mR0huaS/Lltg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc/-/rpc-6.10.0.tgz",
-      "integrity": "sha512-EwxsqoD+NXV+m+iobnWNtATD93gTgaNsOiQOzYB1/2e+8S6fl6obdNPB55yfXgtl4jt6GV6/ae4xuPhLv76vvg==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/errors": "6.10.0",
-        "@solana/fast-stable-stringify": "6.10.0",
-        "@solana/functional": "6.10.0",
-        "@solana/rpc-api": "6.10.0",
-        "@solana/rpc-spec": "6.10.0",
-        "@solana/rpc-spec-types": "6.10.0",
-        "@solana/rpc-transformers": "6.10.0",
-        "@solana/rpc-transport-http": "6.10.0",
-        "@solana/rpc-types": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-api": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-api/-/rpc-api-6.10.0.tgz",
-      "integrity": "sha512-RjPIVsAb/85P1ptoO3WpC0x7QG6gG/e4q/3lo6gbSznUZOcoM+8sSBnCX7BwP1ZkCDS6NK/ClXLnhhhYZx+OGg==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-strings": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/keys": "6.10.0",
-        "@solana/rpc-parsed-types": "6.10.0",
-        "@solana/rpc-spec": "6.10.0",
-        "@solana/rpc-transformers": "6.10.0",
-        "@solana/rpc-types": "6.10.0",
-        "@solana/transaction-messages": "6.10.0",
-        "@solana/transactions": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-parsed-types": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-parsed-types/-/rpc-parsed-types-6.10.0.tgz",
-      "integrity": "sha512-5275mvSV1mxhwvrMVa+K7BU/nAetpHfcb+8Ql9rtA8RRf6DyiimFQFZUukE4Ez6XJihEpCHNy98yhkgai9wytQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-spec": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-spec/-/rpc-spec-6.10.0.tgz",
-      "integrity": "sha512-yQdbWw5mZEWrwsunHR9NHkuhMXIB9sPOObwm18D53v5tAJnxTB0IcHvO647XqFDLTK/yQ4AdDtlYD1vsY07AMQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/errors": "6.10.0",
-        "@solana/rpc-spec-types": "6.10.0",
-        "@solana/subscribable": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-spec-types": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-spec-types/-/rpc-spec-types-6.10.0.tgz",
-      "integrity": "sha512-NDZrKyZrJk4HaMFhTE/lAiMB824cWAodKqDHyKi0UteHU9pyRmil3BN1jt7e+j08mwMWwfklSgyrTaq52g6DIQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-subscriptions": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-subscriptions/-/rpc-subscriptions-6.10.0.tgz",
-      "integrity": "sha512-6mfuHp/K7unFKCOTCCBC9ziEGnxe2tyJ74EbR51QUnBeCUdYD7Hhdpxic1WRSJ3UeNW/mG4OzFM6z8Wi64Eh9Q==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/errors": "6.10.0",
-        "@solana/fast-stable-stringify": "6.10.0",
-        "@solana/functional": "6.10.0",
-        "@solana/promises": "6.10.0",
-        "@solana/rpc-spec-types": "6.10.0",
-        "@solana/rpc-subscriptions-api": "6.10.0",
-        "@solana/rpc-subscriptions-channel-websocket": "6.10.0",
-        "@solana/rpc-subscriptions-spec": "6.10.0",
-        "@solana/rpc-transformers": "6.10.0",
-        "@solana/rpc-types": "6.10.0",
-        "@solana/subscribable": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-subscriptions-api": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-subscriptions-api/-/rpc-subscriptions-api-6.10.0.tgz",
-      "integrity": "sha512-CRPQoTtT1cOwOQUsqS7jgo7wYdAj7jB5ab/UmMPWVpecf2FNMhWhgvxP2s82M7VkDGTGl13qaQ0WySmi7Egrlg==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/keys": "6.10.0",
-        "@solana/rpc-subscriptions-spec": "6.10.0",
-        "@solana/rpc-transformers": "6.10.0",
-        "@solana/rpc-types": "6.10.0",
-        "@solana/transaction-messages": "6.10.0",
-        "@solana/transactions": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-subscriptions-channel-websocket": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-subscriptions-channel-websocket/-/rpc-subscriptions-channel-websocket-6.10.0.tgz",
-      "integrity": "sha512-KkqP1186HELPlJftA88SNAT2znR8knCVzsUipXVzY4zfW8sN3LOa0ePMzh9VZ/V+J+raTt55laR87ovAO0n+zw==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/errors": "6.10.0",
-        "@solana/functional": "6.10.0",
-        "@solana/rpc-subscriptions-spec": "6.10.0",
-        "@solana/subscribable": "6.10.0",
-        "ws": "^8.21.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-subscriptions-spec": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-subscriptions-spec/-/rpc-subscriptions-spec-6.10.0.tgz",
-      "integrity": "sha512-nWMwGaG4ulzeX2sskY5TywXF3cwEd8FDmUpLe2JBWxE8XDAOGOKcsYPYFcBgb8ee9KqfPT2PTNdcz9jOhJf34w==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/errors": "6.10.0",
-        "@solana/promises": "6.10.0",
-        "@solana/rpc-spec-types": "6.10.0",
-        "@solana/subscribable": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-transformers": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-transformers/-/rpc-transformers-6.10.0.tgz",
-      "integrity": "sha512-2nFUrVTiE720pJOY4XKx3HuYmishw0of/4oScu76YGm6O8wsmvFvPNAkrEinmieWXQkfpBfRvLZmpl8PaAy+ug==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/errors": "6.10.0",
-        "@solana/functional": "6.10.0",
-        "@solana/nominal-types": "6.10.0",
-        "@solana/rpc-spec-types": "6.10.0",
-        "@solana/rpc-types": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-transport-http": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-transport-http/-/rpc-transport-http-6.10.0.tgz",
-      "integrity": "sha512-JrdNuYi0nBbD3X8JUtgX1dQJwIwz/WJvmigDdELysXfGB2bTJpfjqGDLhCLOz2sRl66FASIEqgG/LVa2C9VXcA==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/errors": "6.10.0",
-        "@solana/rpc-spec": "6.10.0",
-        "@solana/rpc-spec-types": "6.10.0",
-        "undici-types": "^8.4.1"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/rpc-transport-http/node_modules/undici-types": {
-      "version": "8.7.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.7.0.tgz",
-      "integrity": "sha512-gbsS+hAjHg9iV+T8XWdFqnOZEk4f5xrrX3eb9Y1GDe+B5u9H68P6SzYXXUw/rkRvJHRgKIdNfAcrcVj/JvayVA==",
-      "license": "MIT"
-    },
-    "node_modules/@solana/rpc-types": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/rpc-types/-/rpc-types-6.10.0.tgz",
-      "integrity": "sha512-zaSecTfCPvz/vcoAmKD6XoRstGHTr1EKJBD8T9UcpEFFB6CtF6DxerDB+wrzkamuT6msmnR2DWXMrYOGDAsgIg==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-numbers": "6.10.0",
-        "@solana/codecs-strings": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/fixed-points": "6.10.0",
-        "@solana/nominal-types": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/signers": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/signers/-/signers-6.10.0.tgz",
-      "integrity": "sha512-+vtCc+mT1FpGxrA5oL2aaMxSHiMJ2hH5PcDIfjo2XJkHz2klZiCZyT5F9+zpltc9vdi1QTElQq59Sfplmtd33A==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/instructions": "6.10.0",
-        "@solana/keys": "6.10.0",
-        "@solana/nominal-types": "6.10.0",
-        "@solana/offchain-messages": "6.10.0",
-        "@solana/transaction-messages": "6.10.0",
-        "@solana/transactions": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/subscribable": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/subscribable/-/subscribable-6.10.0.tgz",
-      "integrity": "sha512-VsR6XMwkiDBkZJUcoGkEOhf397pOV75gKCL9Bx8bpi2T3Bbs0CxUpMn4yaUgAnRba3eXmjbXMNCXjttfa6sKbw==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/errors": "6.10.0",
-        "@solana/promises": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/sysvars": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/sysvars/-/sysvars-6.10.0.tgz",
-      "integrity": "sha512-cG13p1+onxz+20iWjwWQr1Z1jQwPm0fnjoW75fqZq7p4rVCie3L2sXvaJsYPjWKrUvpOzOIEHnqZGkG05rCpjg==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/accounts": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-data-structures": "6.10.0",
-        "@solana/codecs-numbers": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/rpc-types": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/transaction-confirmation": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/transaction-confirmation/-/transaction-confirmation-6.10.0.tgz",
-      "integrity": "sha512-ULvtg65qfenh4T/GYcIlKSUv5EqDcng9UN0dxbHU4kuZdR2e0B8HN2xDC4WhcFQVeFJSbTZmaYFkeTY/Y4gfGQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/codecs-strings": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/keys": "6.10.0",
-        "@solana/promises": "6.10.0",
-        "@solana/rpc": "6.10.0",
-        "@solana/rpc-subscriptions": "6.10.0",
-        "@solana/rpc-types": "6.10.0",
-        "@solana/transaction-messages": "6.10.0",
-        "@solana/transactions": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/transaction-messages": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/transaction-messages/-/transaction-messages-6.10.0.tgz",
-      "integrity": "sha512-s7v8G3BTxGlKYIj3eWCG0g1296v+1LBt16mVnlRH5FuyaJ5AdhlhtRho5HUDpdwE8EXun+y1c48V6uhcZ8wdbQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-data-structures": "6.10.0",
-        "@solana/codecs-numbers": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/functional": "6.10.0",
-        "@solana/instructions": "6.10.0",
-        "@solana/nominal-types": "6.10.0",
-        "@solana/rpc-types": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/transactions": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@solana/transactions/-/transactions-6.10.0.tgz",
-      "integrity": "sha512-VADSqP9OTYmhrox4pcgDd4+RjVmednXSE0+8Y7SPK4PN1pK5Az2RJ0nSsy0xcTnaOr8mF/crwFktqPrRQwSbQA==",
-      "license": "MIT",
-      "dependencies": {
-        "@solana/addresses": "6.10.0",
-        "@solana/codecs-core": "6.10.0",
-        "@solana/codecs-data-structures": "6.10.0",
-        "@solana/codecs-numbers": "6.10.0",
-        "@solana/codecs-strings": "6.10.0",
-        "@solana/errors": "6.10.0",
-        "@solana/functional": "6.10.0",
-        "@solana/instructions": "6.10.0",
-        "@solana/keys": "6.10.0",
-        "@solana/nominal-types": "6.10.0",
-        "@solana/rpc-types": "6.10.0",
-        "@solana/transaction-messages": "6.10.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@solana/wallet-adapter-base": {
-      "version": "0.9.27",
-      "resolved": "https://registry.npmjs.org/@solana/wallet-adapter-base/-/wallet-adapter-base-0.9.27.tgz",
-      "integrity": "sha512-kXjeNfNFVs/NE9GPmysBRKQ/nf+foSaq3kfVSeMcO/iVgigyRmB551OjU3WyAolLG/1jeEfKLqF9fKwMCRkUqg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@solana/wallet-standard-features": "^1.3.0",
-        "@wallet-standard/base": "^1.1.0",
-        "@wallet-standard/features": "^1.1.0",
-        "eventemitter3": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@solana/web3.js": "^1.98.0"
-      }
-    },
-    "node_modules/@solana/wallet-adapter-react": {
-      "version": "0.15.39",
-      "resolved": "https://registry.npmjs.org/@solana/wallet-adapter-react/-/wallet-adapter-react-0.15.39.tgz",
-      "integrity": "sha512-WXtlo88ith5m22qB+qiGw301/Zb9r5pYr4QdXWmlXnRNqwST5MGmJWhG+/RVrzc+OG7kSb3z1gkVNv+2X/Y0Gg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@solana-mobile/wallet-adapter-mobile": "^2.2.0",
-        "@solana/wallet-adapter-base": "^0.9.27",
-        "@solana/wallet-standard-wallet-adapter-react": "^1.1.4"
-      },
-      "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@solana/web3.js": "^1.98.0",
-        "react": "*"
-      }
-    },
-    "node_modules/@solana/wallet-standard": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@solana/wallet-standard/-/wallet-standard-1.1.4.tgz",
-      "integrity": "sha512-NF+MI5tOxyvfTU4A+O5idh/gJFmjm52bMwsPpFGRSL79GECSN0XLmpVOO/jqTKJgac2uIeYDpQw/eMaQuWuUXw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@solana/wallet-standard-core": "^1.1.2",
-        "@solana/wallet-standard-wallet-adapter": "^1.1.4"
-      },
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/@solana/wallet-standard-chains": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@solana/wallet-standard-chains/-/wallet-standard-chains-1.1.2.tgz",
-      "integrity": "sha512-EZobEGclDBAFplpJC5F3d/s8Xnlqc5isNKuPrd5o9ZPZ7tWN84O0e68yIZ8MAOj9V7ieRadNiHtql7uIXCTyXg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@wallet-standard/base": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/@solana/wallet-standard-core": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@solana/wallet-standard-core/-/wallet-standard-core-1.1.3.tgz",
-      "integrity": "sha512-ZD0seJHb3A7QWOlwMECzq3vJR1Dg75+ZoW68lMyO1UfqH+AHMx0j5B6jdjbH3PFoqauU2q3RexWMcD4Jc7D9xA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@solana/wallet-standard-chains": "^1.1.2",
-        "@solana/wallet-standard-features": "^1.4.0",
-        "@solana/wallet-standard-util": "^1.1.3"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/@solana/wallet-standard-features": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/@solana/wallet-standard-features/-/wallet-standard-features-1.4.0.tgz",
-      "integrity": "sha512-f0tAdqwM2aL6CiFbIgt9h5zKFp+mgY/iNGwoxPMTj9VSTeQj7d1GGSmWhZw0XWoZ4N/1tnKTKmYFq+Dyq08jRw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@wallet-standard/base": "^1.1.0",
-        "@wallet-standard/features": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/@solana/wallet-standard-util": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@solana/wallet-standard-util/-/wallet-standard-util-1.1.3.tgz",
-      "integrity": "sha512-aweR5y5FjYaeS9TkoqAWERFpGUj2MJepsDhcekCuoPLcNCquJL85Nsnuy01tBybspN5+Y09SWkxwsODOFGSfkg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@noble/curves": "^1.8.2",
-        "@solana/wallet-standard-chains": "^1.1.2",
-        "@solana/wallet-standard-features": "^1.4.0"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/@solana/wallet-standard-wallet-adapter": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@solana/wallet-standard-wallet-adapter/-/wallet-standard-wallet-adapter-1.1.5.tgz",
-      "integrity": "sha512-6EMRyXzLcXQY9P5Bo8XWh8It6lb4rUbwO+RDdSpEySz/v+ric0W9H3Yzlqted4AIXQMJgxZifgyFxTp6g/bfZA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@solana/wallet-standard-wallet-adapter-base": "^1.1.5",
-        "@solana/wallet-standard-wallet-adapter-react": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/@solana/wallet-standard-wallet-adapter-base": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@solana/wallet-standard-wallet-adapter-base/-/wallet-standard-wallet-adapter-base-1.1.5.tgz",
-      "integrity": "sha512-dbk+4mJAsZ1a2R/v5/Qvp6SleviuSNWd9LnuQ0ekH0HRRJTOWyTBJsdQsVDdAymdPnLAaIN5J10ni1CT2Z+ERg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@solana/wallet-adapter-base": "^0.9.24",
-        "@solana/wallet-standard-chains": "^1.1.2",
-        "@solana/wallet-standard-features": "^1.4.0",
-        "@solana/wallet-standard-util": "^1.1.3",
-        "@wallet-standard/app": "^1.1.0",
-        "@wallet-standard/base": "^1.1.0",
-        "@wallet-standard/features": "^1.1.0",
-        "@wallet-standard/wallet": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=22"
-      },
-      "peerDependencies": {
-        "@solana/web3.js": "^1.98.0",
-        "bs58": "^6.0.0"
-      }
-    },
-    "node_modules/@solana/wallet-standard-wallet-adapter-react": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@solana/wallet-standard-wallet-adapter-react/-/wallet-standard-wallet-adapter-react-1.1.5.tgz",
-      "integrity": "sha512-JfKBU2Mc332pR+9xhxjr5U/Q2aL03mMmSbrcnvfvAjML6zUEzAQ/bV6DchRsdtAT8Rx0zEg8h4OhsXbmteu0Yg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@solana/wallet-standard-wallet-adapter-base": "^1.1.5",
-        "@wallet-standard/app": "^1.1.0",
-        "@wallet-standard/base": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=22"
-      },
-      "peerDependencies": {
-        "@solana/wallet-adapter-base": "*",
-        "react": "*"
-      }
-    },
-    "node_modules/@solana/web3.js": {
-      "version": "1.98.4",
-      "resolved": "https://registry.npmjs.org/@solana/web3.js/-/web3.js-1.98.4.tgz",
-      "integrity": "sha512-vv9lfnvjUsRiq//+j5pBdXig0IQdtzA0BRZ3bXEP4KaIyF1CcaydWqgyzQgfZMNIsWNWmG+AUHwPy4AHOD6gpw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/runtime": "^7.25.0",
-        "@noble/curves": "^1.4.2",
-        "@noble/hashes": "^1.4.0",
-        "@solana/buffer-layout": "^4.0.1",
-        "@solana/codecs-numbers": "^2.1.0",
-        "agentkeepalive": "^4.5.0",
-        "bn.js": "^5.2.1",
-        "borsh": "^0.7.0",
-        "bs58": "^4.0.1",
-        "buffer": "6.0.3",
-        "fast-stable-stringify": "^1.0.0",
-        "jayson": "^4.1.1",
-        "node-fetch": "^2.7.0",
-        "rpc-websockets": "^9.0.2",
-        "superstruct": "^2.0.2"
-      }
-    },
-    "node_modules/@solana/web3.js/node_modules/@solana/codecs-core": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@solana/codecs-core/-/codecs-core-2.3.0.tgz",
-      "integrity": "sha512-oG+VZzN6YhBHIoSKgS5ESM9VIGzhWjEHEGNPSibiDTxFhsFWxNaz8LbMDPjBUE69r9wmdGLkrQ+wVPbnJcZPvw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@solana/errors": "2.3.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.3.3"
-      }
-    },
-    "node_modules/@solana/web3.js/node_modules/@solana/codecs-numbers": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@solana/codecs-numbers/-/codecs-numbers-2.3.0.tgz",
-      "integrity": "sha512-jFvvwKJKffvG7Iz9dmN51OGB7JBcy2CJ6Xf3NqD/VP90xak66m/Lg48T01u5IQ/hc15mChVHiBm+HHuOFDUrQg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@solana/codecs-core": "2.3.0",
-        "@solana/errors": "2.3.0"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.3.3"
-      }
-    },
-    "node_modules/@solana/web3.js/node_modules/@solana/errors": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@solana/errors/-/errors-2.3.0.tgz",
-      "integrity": "sha512-66RI9MAbwYV0UtP7kGcTBVLxJgUxoZGm8Fbc0ah+lGiAw17Gugco6+9GrJCV83VyF2mDWyYnYM9qdI3yjgpnaQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "chalk": "^5.4.1",
-        "commander": "^14.0.0"
-      },
-      "bin": {
-        "errors": "bin/cli.mjs"
-      },
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.3.3"
-      }
-    },
-    "node_modules/@solana/web3.js/node_modules/base-x": {
-      "version": "3.0.11",
-      "resolved": "https://registry.npmjs.org/base-x/-/base-x-3.0.11.tgz",
-      "integrity": "sha512-xz7wQ8xDhdyP7tQxwdteLYeFfS68tSMNCZ/Y37WJ4bhGfKPpqEIlmIyueQHqOyoPhE6xNUqjzRr8ra0eF9VRvA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "safe-buffer": "^5.0.1"
-      }
-    },
-    "node_modules/@solana/web3.js/node_modules/bs58": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/bs58/-/bs58-4.0.1.tgz",
-      "integrity": "sha512-Ok3Wdf5vOIlBrgCvTq96gBkJw+JUEzdBgyaza5HLtPm7yTHkjRy8+JzNyHF7BHa0bNWOQIp3m5YF0nnFcOIKLw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "base-x": "^3.0.2"
-      }
-    },
-    "node_modules/@solana/web3.js/node_modules/commander": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
-      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@stripe/stripe-js": {
-      "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/@stripe/stripe-js/-/stripe-js-5.6.0.tgz",
-      "integrity": "sha512-w8CEY73X/7tw2KKlL3iOk679V9bWseE4GzNz3zlaYxcTjmcmWOathRb0emgo/QQ3eoNzmq68+2Y2gxluAv3xGw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.16"
-      }
-    },
-    "node_modules/@swc/helpers": {
-      "version": "0.5.15",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",
-      "integrity": "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.8.0"
-      }
-    },
-    "node_modules/@tailwindcss/node": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.1.4.tgz",
-      "integrity": "sha512-MT5118zaiO6x6hNA04OWInuAiP1YISXql8Z+/Y8iisV5nuhM8VXlyhRuqc2PEviPszcXI66W44bCIk500Oolhw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "enhanced-resolve": "^5.18.1",
-        "jiti": "^2.4.2",
-        "lightningcss": "1.29.2",
-        "tailwindcss": "4.1.4"
-      }
-    },
-    "node_modules/@tailwindcss/oxide": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.1.4.tgz",
-      "integrity": "sha512-p5wOpXyOJx7mKh5MXh5oKk+kqcz8T+bA3z/5VWWeQwFrmuBItGwz8Y2CHk/sJ+dNb9B0nYFfn0rj/cKHZyjahQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10"
-      },
-      "optionalDependencies": {
-        "@tailwindcss/oxide-android-arm64": "4.1.4",
-        "@tailwindcss/oxide-darwin-arm64": "4.1.4",
-        "@tailwindcss/oxide-darwin-x64": "4.1.4",
-        "@tailwindcss/oxide-freebsd-x64": "4.1.4",
-        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.1.4",
-        "@tailwindcss/oxide-linux-arm64-gnu": "4.1.4",
-        "@tailwindcss/oxide-linux-arm64-musl": "4.1.4",
-        "@tailwindcss/oxide-linux-x64-gnu": "4.1.4",
-        "@tailwindcss/oxide-linux-x64-musl": "4.1.4",
-        "@tailwindcss/oxide-wasm32-wasi": "4.1.4",
-        "@tailwindcss/oxide-win32-arm64-msvc": "4.1.4",
-        "@tailwindcss/oxide-win32-x64-msvc": "4.1.4"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-android-arm64": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.1.4.tgz",
-      "integrity": "sha512-xMMAe/SaCN/vHfQYui3fqaBDEXMu22BVwQ33veLc8ep+DNy7CWN52L+TTG9y1K397w9nkzv+Mw+mZWISiqhmlA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-darwin-arm64": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.1.4.tgz",
-      "integrity": "sha512-JGRj0SYFuDuAGilWFBlshcexev2hOKfNkoX+0QTksKYq2zgF9VY/vVMq9m8IObYnLna0Xlg+ytCi2FN2rOL0Sg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-darwin-x64": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.1.4.tgz",
-      "integrity": "sha512-sdDeLNvs3cYeWsEJ4H1DvjOzaGios4QbBTNLVLVs0XQ0V95bffT3+scptzYGPMjm7xv4+qMhCDrkHwhnUySEzA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-freebsd-x64": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.1.4.tgz",
-      "integrity": "sha512-VHxAqxqdghM83HslPhRsNhHo91McsxRJaEnShJOMu8mHmEj9Ig7ToHJtDukkuLWLzLboh2XSjq/0zO6wgvykNA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.1.4.tgz",
-      "integrity": "sha512-OTU/m/eV4gQKxy9r5acuesqaymyeSCnsx1cFto/I1WhPmi5HDxX1nkzb8KYBiwkHIGg7CTfo/AcGzoXAJBxLfg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.1.4.tgz",
-      "integrity": "sha512-hKlLNvbmUC6z5g/J4H+Zx7f7w15whSVImokLPmP6ff1QqTVE+TxUM9PGuNsjHvkvlHUtGTdDnOvGNSEUiXI1Ww==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.1.4.tgz",
-      "integrity": "sha512-X3As2xhtgPTY/m5edUtddmZ8rCruvBvtxYLMw9OsZdH01L2gS2icsHRwxdU0dMItNfVmrBezueXZCHxVeeb7Aw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.1.4.tgz",
-      "integrity": "sha512-2VG4DqhGaDSmYIu6C4ua2vSLXnJsb/C9liej7TuSO04NK+JJJgJucDUgmX6sn7Gw3Cs5ZJ9ZLrnI0QRDOjLfNQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.1.4.tgz",
-      "integrity": "sha512-v+mxVgH2kmur/X5Mdrz9m7TsoVjbdYQT0b4Z+dr+I4RvreCNXyCFELZL/DO0M1RsidZTrm6O1eMnV6zlgEzTMQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.1.4.tgz",
-      "integrity": "sha512-2TLe9ir+9esCf6Wm+lLWTMbgklIjiF0pbmDnwmhR9MksVOq+e8aP3TSsXySnBDDvTTVd/vKu1aNttEGj3P6l8Q==",
-      "bundleDependencies": [
-        "@napi-rs/wasm-runtime",
-        "@emnapi/core",
-        "@emnapi/runtime",
-        "@tybys/wasm-util",
-        "@emnapi/wasi-threads",
-        "tslib"
-      ],
-      "cpu": [
-        "wasm32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/core": "^1.4.0",
-        "@emnapi/runtime": "^1.4.0",
-        "@emnapi/wasi-threads": "^1.0.1",
-        "@napi-rs/wasm-runtime": "^0.2.8",
-        "@tybys/wasm-util": "^0.9.0",
-        "tslib": "^2.8.0"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
-      "version": "1.4.0",
-      "dev": true,
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/wasi-threads": "1.0.1",
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.4.0",
-      "dev": true,
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
-      "version": "1.0.1",
-      "dev": true,
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
-      "version": "0.2.8",
-      "dev": true,
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/core": "^1.4.0",
-        "@emnapi/runtime": "^1.4.0",
-        "@tybys/wasm-util": "^0.9.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
-      "version": "0.9.0",
-      "dev": true,
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
-      "version": "2.8.0",
-      "dev": true,
-      "inBundle": true,
-      "license": "0BSD",
-      "optional": true
-    },
-    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.1.4.tgz",
-      "integrity": "sha512-VlnhfilPlO0ltxW9/BgfLI5547PYzqBMPIzRrk4W7uupgCt8z6Trw/tAj6QUtF2om+1MH281Pg+HHUJoLesmng==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.1.4.tgz",
-      "integrity": "sha512-+7S63t5zhYjslUGb8NcgLpFXD+Kq1F/zt5Xv5qTv7HaFTG/DHyHD9GA6ieNAxhgyA4IcKa/zy7Xx4Oad2/wuhw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/postcss": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.1.4.tgz",
-      "integrity": "sha512-bjV6sqycCEa+AQSt2Kr7wpGF1bOZJ5wsqnLEkqSbM/JEHxx/yhMH8wHmdkPyApF9xhHeMSwnnkDUUMMM/hYnXw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@alloc/quick-lru": "^5.2.0",
-        "@tailwindcss/node": "4.1.4",
-        "@tailwindcss/oxide": "4.1.4",
-        "postcss": "^8.4.41",
-        "tailwindcss": "4.1.4"
-      }
-    },
-    "node_modules/@tanstack/query-core": {
-      "version": "5.101.2",
-      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.101.2.tgz",
-      "integrity": "sha512-hH5MLoJhF7KaIGd7q3xTXGXvslI+GYlM1Z/35aSHHWaCJWB7XvTSHYuV3eM7tw+aE0mT/xMro4M4Q9rCGHT0lw==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/tannerlinsley"
-      }
-    },
-    "node_modules/@tauri-apps/api": {
-      "version": "2.11.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.11.1.tgz",
-      "integrity": "sha512-M2FPuYND2m+wh5hfW9ZpSdxMPdEJovPBWwoHJmwUpysTYNHaOkVFN419m/K0LIgjb/7KU2vBgsUepJWugQCvAA==",
-      "license": "Apache-2.0 OR MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/tauri"
-      }
-    },
-    "node_modules/@tauri-apps/plugin-http": {
-      "version": "2.5.9",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-http/-/plugin-http-2.5.9.tgz",
-      "integrity": "sha512-lCiY0+vs4HvIUSvZrBs8TC3TiCB0MOPRmiUjTq4prW7SlcJE2jdLeT6KBsJrT9Tlplufl7W1pY6SFAO3gCWxDA==",
-      "license": "MIT OR Apache-2.0",
-      "dependencies": {
-        "@tauri-apps/api": "^2.11.0"
-      }
-    },
-    "node_modules/@types/bun": {
-      "version": "1.3.14",
-      "resolved": "https://registry.npmjs.org/@types/bun/-/bun-1.3.14.tgz",
-      "integrity": "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "bun-types": "1.3.14"
-      }
-    },
-    "node_modules/@types/connect": {
-      "version": "3.4.38",
-      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz",
-      "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
-    "node_modules/@types/debug": {
-      "version": "4.1.13",
-      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
-      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/ms": "*"
-      }
-    },
-    "node_modules/@types/estree": {
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
-      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
-      "license": "MIT"
-    },
-    "node_modules/@types/estree-jsx": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/@types/estree-jsx/-/estree-jsx-1.0.5.tgz",
-      "integrity": "sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "*"
-      }
-    },
-    "node_modules/@types/hast": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.4.tgz",
-      "integrity": "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "*"
-      }
-    },
-    "node_modules/@types/istanbul-lib-coverage": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz",
-      "integrity": "sha512-2QF/t/auWm0lsy8XtKVPG19v3sSOQlJe/YHZgfjb/KBBHOGSV+J2q/S671rcq9uTBrLAXmZpqJiaQbMT+zNU1w==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/@types/istanbul-lib-report": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.3.tgz",
-      "integrity": "sha512-NQn7AHQnk/RSLOxrBbGyJM/aVQ+pjj5HCgasFxc0K/KhoATfQ/47AyUl15I2yBUpihjmas+a+VJBOqecrFH+uA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@types/istanbul-lib-coverage": "*"
-      }
-    },
-    "node_modules/@types/istanbul-reports": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-reports/-/istanbul-reports-3.0.4.tgz",
-      "integrity": "sha512-pk2B1NWalF9toCRu6gjBzR69syFjP4Od8WRAX+0mmf9lAjCRicLOWc+ZrxZHx/0XRjotgkF9t6iaMJ+aXcOdZQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@types/istanbul-lib-report": "*"
-      }
-    },
-    "node_modules/@types/mdast": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
-      "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "*"
-      }
-    },
-    "node_modules/@types/ms": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
-      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
-      "license": "MIT"
-    },
-    "node_modules/@types/node": {
-      "version": "22.0.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.0.0.tgz",
-      "integrity": "sha512-VT7KSYudcPOzP5Q0wfbowyNLaVR8QWUdw+088uFWwfvpY6uCWaXpqV6ieLAu9WBcnTa7H4Z5RLK8I5t2FuOcqw==",
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~6.11.1"
-      }
-    },
-    "node_modules/@types/react": {
-      "version": "19.2.17",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
-      "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
-      "license": "MIT",
-      "dependencies": {
-        "csstype": "^3.2.2"
-      }
-    },
-    "node_modules/@types/react-dom": {
-      "version": "19.2.3",
-      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz",
-      "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
-      "devOptional": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "^19.2.0"
-      }
-    },
-    "node_modules/@types/unist": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
-      "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
-      "license": "MIT"
-    },
-    "node_modules/@types/use-sync-external-store": {
-      "version": "0.0.6",
-      "resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.6.tgz",
-      "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
-      "license": "MIT"
-    },
-    "node_modules/@types/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-7gqG38EyHgyP1S+7+xomFtL+ZNHcKv6DwNaCZmJmo1vgMugyF3TCnXVg4t1uk89mLNwnLtnY3TpOpCOyp1/xHQ==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/@types/whatwg-mimetype": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@types/whatwg-mimetype/-/whatwg-mimetype-3.0.2.tgz",
-      "integrity": "sha512-c2AKvDT8ToxLIOUlN51gTiHXflsfIFisS4pO7pDPoKouJCESkhZnEy623gwP9laCy5lnLDAw1vAzu2vM2YLOrA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/ws": {
-      "version": "8.18.1",
-      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
-      "integrity": "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
-    "node_modules/@types/yargs": {
-      "version": "17.0.35",
-      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.35.tgz",
-      "integrity": "sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@types/yargs-parser": "*"
-      }
-    },
-    "node_modules/@types/yargs-parser": {
-      "version": "21.0.3",
-      "resolved": "https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.3.tgz",
-      "integrity": "sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/@ungap/structured-clone": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.2.tgz",
-      "integrity": "sha512-5jsZFwgR5rTdKwidH9Qmat75RKwqfpKlWWB1frDkljN127mwqBu8K0PYo7/hFpF03IEJpfVPpCQDY/eDx3iHvA==",
-      "license": "ISC"
-    },
-    "node_modules/@wallet-standard/app": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@wallet-standard/app/-/app-1.1.1.tgz",
-      "integrity": "sha512-WDGwoByhP5gwHH01r5EaLgQdLVkACPCdOMQhmhn8rsm10h/siSgTorShzBxrn0ExSPof+Lu+C3TfgqBrPa1xoQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@wallet-standard/base": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/@wallet-standard/base": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@wallet-standard/base/-/base-1.1.1.tgz",
-      "integrity": "sha512-gggIHTtxicF9XFMQ12DkfS6NAG92Ak795JeSA7f2whAQ6Y3AkMWWuCMxSZXG2NIPN42kEaZSNVjqMsJRaJRxMQ==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/@wallet-standard/core": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@wallet-standard/core/-/core-1.1.1.tgz",
-      "integrity": "sha512-5Xmjc6+Oe0hcPfVc5n8F77NVLwx1JVAoCVgQpLyv/43/bhtIif+Gx3WUrDlaSDoM8i2kA2xd6YoFbHCxs+e0zA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@wallet-standard/app": "^1.1.0",
-        "@wallet-standard/base": "^1.1.0",
-        "@wallet-standard/errors": "^0.1.1",
-        "@wallet-standard/features": "^1.1.0",
-        "@wallet-standard/wallet": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/@wallet-standard/errors": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/@wallet-standard/errors/-/errors-0.1.2.tgz",
-      "integrity": "sha512-oEzKUqJefKby6wcIvaJgrSEe/uNn/rnqkJ0P/85K+h0i5Tdo9E3L22VWq/j5K1e8hHMnZd6LgaIr8m/Wn7X/Ng==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "chalk": "^5.4.1",
-        "commander": "^13.1.0"
-      },
-      "bin": {
-        "errors": "bin/cli.mjs"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/@wallet-standard/errors/node_modules/commander": {
-      "version": "13.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-13.1.0.tgz",
-      "integrity": "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@wallet-standard/features": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@wallet-standard/features/-/features-1.1.1.tgz",
-      "integrity": "sha512-aCWYmVeSCGViyEU5k7GMoW8zxE4Gs+C1s1Pp2XLesvSNlnZ4PMES9HUnTB3hl0b3RVj7C61yze3IWyrncqg4MA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@wallet-standard/base": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/@wallet-standard/wallet": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@wallet-standard/wallet/-/wallet-1.1.1.tgz",
-      "integrity": "sha512-8WiRPaKk/wNNRZhB2eVhpR/JW7/aqTCMoZhgVUCujuzDmxxmGvsosMxdCG4NAdYkoyozAHCX8/xLtlWUn5mNdQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@wallet-standard/base": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/@zxcvbn-ts/core": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@zxcvbn-ts/core/-/core-3.0.4.tgz",
-      "integrity": "sha512-aQeiT0F09FuJaAqNrxynlAwZ2mW/1MdXakKWNmGM1Qp/VaY6CnB/GfnMS2T8gB2231Esp1/maCWd8vTG4OuShw==",
-      "license": "MIT",
-      "dependencies": {
-        "fastest-levenshtein": "1.0.16"
-      }
-    },
-    "node_modules/@zxcvbn-ts/language-common": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@zxcvbn-ts/language-common/-/language-common-3.0.4.tgz",
-      "integrity": "sha512-viSNNnRYtc7ULXzxrQIVUNwHAPSXRtoIwy/Tq4XQQdIknBzw4vz36lQLF6mvhMlTIlpjoN/Z1GFu/fwiAlUSsw==",
-      "license": "MIT"
-    },
-    "node_modules/abitype": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/abitype/-/abitype-1.2.4.tgz",
-      "integrity": "sha512-dpKH+N27vRjarMVTFFkeY445VTKftzGWpL0FiT7xmVmzQRKazZexzC5uHG0f6XKsVLAuUlndnbGau6lRejClxg==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/wevm"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.0.4",
-        "zod": "^3.22.0 || ^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        },
-        "zod": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/abort-controller": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
-      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "event-target-shim": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=6.5"
-      }
-    },
-    "node_modules/accepts": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
-      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "mime-types": "^3.0.0",
-        "negotiator": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/acorn": {
-      "version": "8.17.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.17.0.tgz",
-      "integrity": "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==",
-      "license": "MIT",
-      "peer": true,
-      "bin": {
-        "acorn": "bin/acorn"
-      },
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/agent-base": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/agentkeepalive": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.6.0.tgz",
-      "integrity": "sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "humanize-ms": "^1.2.1"
-      },
-      "engines": {
-        "node": ">= 8.0.0"
-      }
-    },
-    "node_modules/alien-signals": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/alien-signals/-/alien-signals-2.0.6.tgz",
-      "integrity": "sha512-P3TxJSe31bUHBiblg59oU1PpaWPtmxF9GhJ/cB7OkgJ0qN/ifFSKUI25/v8ZhsT+lIG6ac8DpTOplXxORX6F3Q==",
-      "license": "MIT"
-    },
-    "node_modules/anser": {
-      "version": "1.4.10",
-      "resolved": "https://registry.npmjs.org/anser/-/anser-1.4.10.tgz",
-      "integrity": "sha512-hCv9AqTQ8ycjpSd3upOJd7vFwW1JaoYQ7tpham03GJ1ca8/65rqn0RpaWpItOAd6ylW9wAw6luXYPJIyPFVOww==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/ansi-styles": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
-      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/aria-hidden": {
-      "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
-      "integrity": "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/asap": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/asap/-/asap-2.0.6.tgz",
-      "integrity": "sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/babel-plugin-syntax-hermes-parser": {
-      "version": "0.36.0",
-      "resolved": "https://registry.npmjs.org/babel-plugin-syntax-hermes-parser/-/babel-plugin-syntax-hermes-parser-0.36.0.tgz",
-      "integrity": "sha512-LhD0xdoedDw7ansQgXbB2DADLZIK/LRXuWNBPuVzMc5S2WK5GyT89tCM+cQzxFGO0mGyLK6D5TrVOJJzAoDy8Q==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "hermes-parser": "0.36.0"
-      }
-    },
-    "node_modules/bail": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz",
-      "integrity": "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/base-x": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/base-x/-/base-x-5.0.1.tgz",
-      "integrity": "sha512-M7uio8Zt++eg3jPj+rHMfCC+IuygQHHCOU+IYsVtik6FWjuYpVt/+MRKcgsAMHh8mMFAwnB+Bs+mTrFiXjMzKg==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/base64-js": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/baseline-browser-mapping": {
-      "version": "2.10.42",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.42.tgz",
-      "integrity": "sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q==",
-      "license": "Apache-2.0",
-      "bin": {
-        "baseline-browser-mapping": "dist/cli.cjs"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/bn.js": {
-      "version": "5.2.5",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.5.tgz",
-      "integrity": "sha512-Vq886eXykuP5E6HcKSSStP3bJgrE6In5WKxVUvJ8XGpWWYs2xZHWqUwzCtGgEtBcxyd57KBFDPFoUfNzdaHCNg==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/borsh": {
-      "version": "0.7.0",
-      "resolved": "https://registry.npmjs.org/borsh/-/borsh-0.7.0.tgz",
-      "integrity": "sha512-CLCsZGIBCFnPtkNnieW/a8wmreDmfUtjU2m9yHrzPXIlNbqVs0AQrSatSG6vdNYUqdc83tkQi2eHfF98ubzQLA==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "bn.js": "^5.2.0",
-        "bs58": "^4.0.0",
-        "text-encoding-utf-8": "^1.0.2"
-      }
-    },
-    "node_modules/borsh/node_modules/base-x": {
-      "version": "3.0.11",
-      "resolved": "https://registry.npmjs.org/base-x/-/base-x-3.0.11.tgz",
-      "integrity": "sha512-xz7wQ8xDhdyP7tQxwdteLYeFfS68tSMNCZ/Y37WJ4bhGfKPpqEIlmIyueQHqOyoPhE6xNUqjzRr8ra0eF9VRvA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "safe-buffer": "^5.0.1"
-      }
-    },
-    "node_modules/borsh/node_modules/bs58": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/bs58/-/bs58-4.0.1.tgz",
-      "integrity": "sha512-Ok3Wdf5vOIlBrgCvTq96gBkJw+JUEzdBgyaza5HLtPm7yTHkjRy8+JzNyHF7BHa0bNWOQIp3m5YF0nnFcOIKLw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "base-x": "^3.0.2"
-      }
-    },
-    "node_modules/braces": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
-      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "fill-range": "^7.1.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/browser-tabs-lock": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/browser-tabs-lock/-/browser-tabs-lock-1.3.0.tgz",
-      "integrity": "sha512-g6nHaobTiT0eMZ7jh16YpD2kcjAp+PInbiVq3M1x6KKaEIVhT4v9oURNIpZLOZ3LQbQ3XYfNhMAb/9hzNLIWrw==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "dependencies": {
-        "lodash": ">=4.17.21"
-      }
-    },
-    "node_modules/browserslist": {
-      "version": "4.28.5",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.5.tgz",
-      "integrity": "sha512-Cu2E6QejHWzuDMTkuwgpABFgDfZrXLQq5V13YOACZx4mFAG4IwGTbTfHPMr4WtxlHoXSM8FIuRwYYCz5XiabaQ==",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/browserslist"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/browserslist"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "baseline-browser-mapping": "^2.10.42",
-        "caniuse-lite": "^1.0.30001800",
-        "electron-to-chromium": "^1.5.387",
-        "node-releases": "^2.0.50",
-        "update-browserslist-db": "^1.2.3"
-      },
-      "bin": {
-        "browserslist": "cli.js"
-      },
-      "engines": {
-        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
-      }
-    },
-    "node_modules/bs58": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/bs58/-/bs58-6.0.0.tgz",
-      "integrity": "sha512-PD0wEnEYg6ijszw/u8s+iI3H17cTymlrwkKhDhPZq+Sokl3AU4htyBFTjAeNAlCCmg0f53g6ih3jATyCKftTfw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "base-x": "^5.0.0"
-      }
-    },
-    "node_modules/bser": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz",
-      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "node-int64": "^0.4.0"
-      }
-    },
-    "node_modules/buffer": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
-      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.2.1"
-      }
-    },
-    "node_modules/buffer-from": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/buffer-image-size": {
-      "version": "0.6.4",
-      "resolved": "https://registry.npmjs.org/buffer-image-size/-/buffer-image-size-0.6.4.tgz",
-      "integrity": "sha512-nEh+kZOPY1w+gcCMobZ6ETUp9WfibndnosbpwB1iJk/8Gt5ZF2bhS6+B6bPYz424KtwsR6Rflc3tCz1/ghX2dQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*"
-      },
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/bufferutil": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bufferutil/-/bufferutil-4.1.0.tgz",
-      "integrity": "sha512-ZMANVnAixE6AWWnPzlW2KpUrxhm9woycYvPOo67jWHyFowASTEd9s+QN1EIMsSDtwhIxN4sWE1jotpuDUIgyIw==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "node-gyp-build": "^4.3.0"
-      },
-      "engines": {
-        "node": ">=6.14.2"
-      }
-    },
-    "node_modules/bun-types": {
-      "version": "1.3.14",
-      "resolved": "https://registry.npmjs.org/bun-types/-/bun-types-1.3.14.tgz",
-      "integrity": "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
-    "node_modules/camelcase": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
-      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/caniuse-lite": {
-      "version": "1.0.30001803",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001803.tgz",
-      "integrity": "sha512-g/uHREV2ZpK9qMalCsWaxmA6ol+DX8GYhuf3T40RKoP+oL7vhRJh8LNt73PCjpnR6l14FzfPrB5Yux4PKm2meg==",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/browserslist"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "CC-BY-4.0"
-    },
-    "node_modules/ccount": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/ccount/-/ccount-2.0.1.tgz",
-      "integrity": "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/chalk": {
-      "version": "5.6.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz",
-      "integrity": "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==",
-      "license": "MIT",
-      "engines": {
-        "node": "^12.17.0 || ^14.13 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/character-entities": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
-      "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/character-entities-html4": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-2.1.0.tgz",
-      "integrity": "sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/character-entities-legacy": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-3.0.0.tgz",
-      "integrity": "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/character-reference-invalid": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/character-reference-invalid/-/character-reference-invalid-2.0.1.tgz",
-      "integrity": "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/chrome-launcher": {
-      "version": "0.15.2",
-      "resolved": "https://registry.npmjs.org/chrome-launcher/-/chrome-launcher-0.15.2.tgz",
-      "integrity": "sha512-zdLEwNo3aUVzIhKhTtXfxhdvZhUghrnmkvcAq2NoDd+LeOHKf03H5jwZ8T/STsAlzyALkBVK552iaG1fGf1xVQ==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@types/node": "*",
-        "escape-string-regexp": "^4.0.0",
-        "is-wsl": "^2.2.0",
-        "lighthouse-logger": "^1.0.0"
-      },
-      "bin": {
-        "print-chrome-path": "bin/print-chrome-path.js"
-      },
-      "engines": {
-        "node": ">=12.13.0"
-      }
-    },
-    "node_modules/chromium-edge-launcher": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/chromium-edge-launcher/-/chromium-edge-launcher-0.3.0.tgz",
-      "integrity": "sha512-p03azHlGjtyRvFEee3cyvtsRYdniSkwjkzmM/KmVnqT5d7QkkwpJBhis/zCLMYdQMVJ5tt140TBNqqrZPaWeFA==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@types/node": "*",
-        "escape-string-regexp": "^4.0.0",
-        "is-wsl": "^2.2.0",
-        "lighthouse-logger": "^1.0.0",
-        "mkdirp": "^1.0.4"
-      }
-    },
-    "node_modules/ci-info": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-2.0.0.tgz",
-      "integrity": "sha512-5tK7EtrZ0N+OLFMthtqOj4fI2Jeb88C4CAZPu25LDVUgXJ0A3Js4PMGqrn0JU1W0Mh1/Z8wZzYPxqUrXeBboCQ==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/client-only": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
-      "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==",
-      "license": "MIT"
-    },
-    "node_modules/cliui": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-6.0.0.tgz",
-      "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==",
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.0",
-        "wrap-ansi": "^6.2.0"
-      }
-    },
-    "node_modules/clsx": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/clsx/-/clsx-1.2.1.tgz",
-      "integrity": "sha512-EcR6r5a8bj6pu3ycsa/E/cKVGuTgZJZdsyUYHOksG/UHIiKfjxzRxYJpyVBwYaQeOvghal9fcc4PidlgzugAQg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "license": "MIT"
-    },
-    "node_modules/comma-separated-tokens": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/comma-separated-tokens/-/comma-separated-tokens-2.0.3.tgz",
-      "integrity": "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/commander": {
-      "version": "15.0.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz",
-      "integrity": "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=22.12.0"
-      }
-    },
-    "node_modules/connect": {
-      "version": "3.7.0",
-      "resolved": "https://registry.npmjs.org/connect/-/connect-3.7.0.tgz",
-      "integrity": "sha512-ZqRXc+tZukToSNmh5C2iWMSoV3X1YUcPbqEM4DkEG5tNQXrQUZCNVGGv3IuicnkMtPfGf3Xtp8WCXs295iQ1pQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "debug": "2.6.9",
-        "finalhandler": "1.1.2",
-        "parseurl": "~1.3.3",
-        "utils-merge": "1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.10.0"
-      }
-    },
-    "node_modules/connect/node_modules/debug": {
-      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ms": "2.0.0"
-      }
-    },
-    "node_modules/connect/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/convert-source-map": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
-      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/core-js": {
-      "version": "3.47.0",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.47.0.tgz",
-      "integrity": "sha512-c3Q2VVkGAUyupsjRnaNX6u8Dq2vAdzm9iuPj5FW0fRxzlxgq9Q39MDq10IvmQSpLgHQNyQzQmOo6bgGHmH3NNg==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/core-js"
-      }
-    },
-    "node_modules/cross-spawn": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/crypto-js": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/crypto-js/-/crypto-js-4.2.0.tgz",
-      "integrity": "sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==",
-      "license": "MIT"
-    },
-    "node_modules/css-box-model": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/css-box-model/-/css-box-model-1.2.1.tgz",
-      "integrity": "sha512-a7Vr4Q/kd/aw96bnJG332W9V9LkJO69JRcaCYDUqjp6/z0w6VcZjgAcTbgFxEPfBgdnAwlh3iwu+hLopa+flJw==",
-      "license": "MIT",
-      "dependencies": {
-        "tiny-invariant": "^1.0.6"
-      }
-    },
-    "node_modules/csstype": {
-      "version": "3.2.3",
-      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
-      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
-      "license": "MIT"
-    },
-    "node_modules/debug": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/decamelize": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz",
-      "integrity": "sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/decode-named-character-reference": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
-      "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
-      "license": "MIT",
-      "dependencies": {
-        "character-entities": "^2.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/delay": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/delay/-/delay-5.0.0.tgz",
-      "integrity": "sha512-ReEBKkIfe4ya47wlPYf/gu5ib6yUG0/Aez0JQZQz94kiWtRQvZIQbTiehsnwHvLSWJnQdhVeqYue7Id1dKr0qw==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/depd": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
-      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/dequal": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
-      "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/destroy": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
-      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.8",
-        "npm": "1.2.8000 || >= 1.4.16"
-      }
-    },
-    "node_modules/detect-libc": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "devOptional": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/detect-node-es": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/detect-node-es/-/detect-node-es-1.1.0.tgz",
-      "integrity": "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==",
-      "license": "MIT"
-    },
-    "node_modules/devlop": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
-      "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
-      "license": "MIT",
-      "dependencies": {
-        "dequal": "^2.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/dijkstrajs": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/dijkstrajs/-/dijkstrajs-1.0.3.tgz",
-      "integrity": "sha512-qiSlmBq9+BCdCA/L46dw8Uy93mloxsPSbwnm5yrKn2vMPiy8KyAskTF6zuV/j5BMsmOGZDPs7KjU+mjb670kfA==",
-      "license": "MIT"
-    },
-    "node_modules/ee-first": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
-      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/electron-to-chromium": {
-      "version": "1.5.389",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.389.tgz",
-      "integrity": "sha512-cEto7aeOqBfU1D+c5py5pE+ooscKE75JifxLBdFUZsqAxRS6y7kebtxAZvICszSl05gPjYHDTjY+lXpyGvpJbg==",
-      "license": "ISC",
-      "peer": true
-    },
-    "node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "license": "MIT"
-    },
-    "node_modules/encodeurl": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
-      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/enhanced-resolve": {
-      "version": "5.21.3",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.3.tgz",
-      "integrity": "sha512-QyL119InA+XXEkNLNTPCXPugSvOfhwv0JOlGNzvxs0hZaiHLNvXSpudUWsOlsXGWJh8G6ckCScEkVHfX3kw/2Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.4",
-        "tapable": "^2.3.3"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/entities": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-7.0.1.tgz",
-      "integrity": "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=0.12"
-      },
-      "funding": {
-        "url": "https://github.com/fb55/entities?sponsor=1"
-      }
-    },
-    "node_modules/error-stack-parser": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/error-stack-parser/-/error-stack-parser-2.1.4.tgz",
-      "integrity": "sha512-Sk5V6wVazPhq5MhpO+AUxJn5x7XSXGl1R93Vn7i+zS15KDVxQijejNCrz8340/2bgLBjR9GtEG8ZVKONDjcqGQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "stackframe": "^1.3.4"
-      }
-    },
-    "node_modules/es6-promise": {
-      "version": "4.2.8",
-      "resolved": "https://registry.npmjs.org/es6-promise/-/es6-promise-4.2.8.tgz",
-      "integrity": "sha512-HJDGx5daxeIvxdBxvG2cb9g4tEvwIk3i8+nhX0yGrYmZUzbkdg8QbDevheDB8gd0//uPj4c1EQua8Q+MViT0/w==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/es6-promisify": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/es6-promisify/-/es6-promisify-5.0.0.tgz",
-      "integrity": "sha512-C+d6UdsYDk0lMebHNR4S2NybQMMngAOnOwYBQjTOiv0MkoJMP0Myw2mgpDLBcpfCmRLxyFqYhS/CfOENq4SJhQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "es6-promise": "^4.0.3"
-      }
-    },
-    "node_modules/escalade": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
-      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/escape-html": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/escape-string-regexp": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
-      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/estree-util-is-identifier-name": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/estree-util-is-identifier-name/-/estree-util-is-identifier-name-3.0.0.tgz",
-      "integrity": "sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/etag": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
-      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/event-target-shim": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
-      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/eventemitter3": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.1.tgz",
-      "integrity": "sha512-GWkBvjiSZK87ELrYOSESUYeVIc9mvLLf/nXalMOS5dYrgZq9o5OVkbZAVM06CVxYsCwH9BDZFPlQTlPA1j4ahA==",
-      "license": "MIT"
-    },
-    "node_modules/exponential-backoff": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz",
-      "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==",
-      "license": "Apache-2.0",
-      "peer": true
-    },
-    "node_modules/extend": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
-      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
-      "license": "MIT"
-    },
-    "node_modules/eyes": {
-      "version": "0.1.8",
-      "resolved": "https://registry.npmjs.org/eyes/-/eyes-0.1.8.tgz",
-      "integrity": "sha512-GipyPsXO1anza0AOZdy69Im7hGFCNB7Y/NGjDlZGJ3GJJLtwNSb2vrzYrTYJRrRloVx7pl+bhUaTB8yiccPvFQ==",
-      "peer": true,
-      "engines": {
-        "node": "> 0.1.90"
-      }
-    },
-    "node_modules/fast-stable-stringify": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fast-stable-stringify/-/fast-stable-stringify-1.0.0.tgz",
-      "integrity": "sha512-wpYMUmFu5f00Sm0cj2pfivpmawLZ0NKdviQ4w9zJeR8JVtOpOxHmLaJuj0vxvGqMJQWyP/COUkF75/57OKyRag==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/fastest-levenshtein": {
-      "version": "1.0.16",
-      "resolved": "https://registry.npmjs.org/fastest-levenshtein/-/fastest-levenshtein-1.0.16.tgz",
-      "integrity": "sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4.9.1"
-      }
-    },
-    "node_modules/fb-dotslash": {
-      "version": "0.5.8",
-      "resolved": "https://registry.npmjs.org/fb-dotslash/-/fb-dotslash-0.5.8.tgz",
-      "integrity": "sha512-XHYLKk9J4BupDxi9bSEhkfss0m+Vr9ChTrjhf9l2iw3jB5C7BnY4GVPoMcqbrTutsKJso6yj2nAB6BI/F2oZaA==",
-      "license": "(MIT OR Apache-2.0)",
-      "peer": true,
-      "bin": {
-        "dotslash": "bin/dotslash"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/fb-watchman": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz",
-      "integrity": "sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "bser": "2.1.1"
-      }
-    },
-    "node_modules/fill-range": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
-      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "to-regex-range": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/finalhandler": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.1.2.tgz",
-      "integrity": "sha512-aAWcW57uxVNrQZqFXjITpW3sIUQmHGG3qSb9mUah9MgMC4NeWhNOlNjXEYq3HjRAvL6arUviZGGJsBg6z0zsWA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "debug": "2.6.9",
-        "encodeurl": "~1.0.2",
-        "escape-html": "~1.0.3",
-        "on-finished": "~2.3.0",
-        "parseurl": "~1.3.3",
-        "statuses": "~1.5.0",
-        "unpipe": "~1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/finalhandler/node_modules/debug": {
-      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ms": "2.0.0"
-      }
-    },
-    "node_modules/finalhandler/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/find-up": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-      "license": "MIT",
-      "dependencies": {
-        "locate-path": "^5.0.0",
-        "path-exists": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/flow-enums-runtime": {
-      "version": "0.0.6",
-      "resolved": "https://registry.npmjs.org/flow-enums-runtime/-/flow-enums-runtime-0.0.6.tgz",
-      "integrity": "sha512-3PYnM29RFXwvAN6Pc/scUfkI7RwhQ/xqyLUyPNlXUp9S40zI8nup9tUSrTLSVnWGBN38FNiGWbwZOB6uR4OGdw==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/framer-motion": {
-      "version": "11.18.2",
-      "resolved": "https://registry.npmjs.org/framer-motion/-/framer-motion-11.18.2.tgz",
-      "integrity": "sha512-5F5Och7wrvtLVElIpclDT0CBzMVg3dL22B64aZwHtsIY8RB4mXICLrkajK4G9R+ieSAGcgrLeae2SeUTg2pr6w==",
-      "license": "MIT",
-      "dependencies": {
-        "motion-dom": "^11.18.1",
-        "motion-utils": "^11.18.1",
-        "tslib": "^2.4.0"
-      },
-      "peerDependencies": {
-        "@emotion/is-prop-valid": "*",
-        "react": "^18.0.0 || ^19.0.0",
-        "react-dom": "^18.0.0 || ^19.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@emotion/is-prop-valid": {
-          "optional": true
-        },
-        "react": {
-          "optional": true
-        },
-        "react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/fresh": {
-      "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
-      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/geist": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/geist/-/geist-1.3.1.tgz",
-      "integrity": "sha512-Q4gC1pBVPN+D579pBaz0TRRnGA4p9UK6elDY/xizXdFk/g4EKR5g0I+4p/Kj6gM0SajDBZ/0FvDV9ey9ud7BWw==",
-      "license": "SIL OPEN FONT LICENSE",
-      "peerDependencies": {
-        "next": ">=13.2.0"
-      }
-    },
-    "node_modules/gensync": {
-      "version": "1.0.0-beta.2",
-      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
-      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/get-caller-file": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
-      "license": "ISC",
-      "engines": {
-        "node": "6.* || 8.* || >= 10.*"
-      }
-    },
-    "node_modules/get-nonce": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/get-nonce/-/get-nonce-1.0.1.tgz",
-      "integrity": "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/glob-to-regexp": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/glob-to-regexp/-/glob-to-regexp-0.4.1.tgz",
-      "integrity": "sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==",
-      "license": "BSD-2-Clause"
-    },
-    "node_modules/graceful-fs": {
-      "version": "4.2.11",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
-      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
-      "license": "ISC"
-    },
-    "node_modules/happy-dom": {
-      "version": "20.10.6",
-      "resolved": "https://registry.npmjs.org/happy-dom/-/happy-dom-20.10.6.tgz",
-      "integrity": "sha512-6QD0ilzDDt93tX44y8tbmZdAcdTRYDhUP+Asgi6pC8Pp5IA3cvaZGyoVN/EGtlq9ziT65iPuBBn3ASLr6hCgVw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": ">=20.0.0",
-        "@types/whatwg-mimetype": "^3.0.2",
-        "@types/ws": "^8.18.1",
-        "buffer-image-size": "^0.6.4",
-        "entities": "^7.0.1",
-        "whatwg-mimetype": "^3.0.0",
-        "ws": "^8.21.0"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/has-flag": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/hast-util-to-jsx-runtime": {
-      "version": "2.3.6",
-      "resolved": "https://registry.npmjs.org/hast-util-to-jsx-runtime/-/hast-util-to-jsx-runtime-2.3.6.tgz",
-      "integrity": "sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.0",
-        "@types/hast": "^3.0.0",
-        "@types/unist": "^3.0.0",
-        "comma-separated-tokens": "^2.0.0",
-        "devlop": "^1.0.0",
-        "estree-util-is-identifier-name": "^3.0.0",
-        "hast-util-whitespace": "^3.0.0",
-        "mdast-util-mdx-expression": "^2.0.0",
-        "mdast-util-mdx-jsx": "^3.0.0",
-        "mdast-util-mdxjs-esm": "^2.0.0",
-        "property-information": "^7.0.0",
-        "space-separated-tokens": "^2.0.0",
-        "style-to-js": "^1.0.0",
-        "unist-util-position": "^5.0.0",
-        "vfile-message": "^4.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/hast-util-whitespace": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/hast-util-whitespace/-/hast-util-whitespace-3.0.0.tgz",
-      "integrity": "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/hast": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
+    "node_modules/@types/unist": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
+      "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
+      "license": "MIT"
     },
-    "node_modules/hermes-compiler": {
-      "version": "250829098.0.14",
-      "resolved": "https://registry.npmjs.org/hermes-compiler/-/hermes-compiler-250829098.0.14.tgz",
-      "integrity": "sha512-5meXwsZxgiqFaJjNzwjzI9IyUkuGGBisu+z9BvQWmGVpjH6nz11hgqkyxe4dl8UAdyIV4lTbz91+Dlnjz0VxqA==",
-      "license": "MIT",
-      "peer": true
+    "node_modules/@types/use-sync-external-store": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.6.tgz",
+      "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
+      "license": "MIT"
     },
-    "node_modules/hermes-estree": {
-      "version": "0.36.0",
-      "resolved": "https://registry.npmjs.org/hermes-estree/-/hermes-estree-0.36.0.tgz",
-      "integrity": "sha512-A1+8zn5oss2CFP7pKsOaxorQG6FNIz1WU1VDqruLPPZl3LVgeE2C5xfFg8Ow6/Ow4mSslLLtYP1J3n38eKyW9w==",
-      "license": "MIT",
-      "peer": true
+    "node_modules/@types/whatwg-mimetype": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/whatwg-mimetype/-/whatwg-mimetype-3.0.2.tgz",
+      "integrity": "sha512-c2AKvDT8ToxLIOUlN51gTiHXflsfIFisS4pO7pDPoKouJCESkhZnEy623gwP9laCy5lnLDAw1vAzu2vM2YLOrA==",
+      "dev": true,
+      "license": "MIT"
     },
-    "node_modules/hermes-parser": {
-      "version": "0.36.0",
-      "resolved": "https://registry.npmjs.org/hermes-parser/-/hermes-parser-0.36.0.tgz",
-      "integrity": "sha512-GdpwMmH5x6IpC1cijvcvYnlPB60Mh6kTSF/NFdYV/j56gYdi+0RIakYs+eqOV+bbO0SW7mgVVGSsTJxyPQfo3w==",
+    "node_modules/@types/ws": {
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
+      "integrity": "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "hermes-estree": "0.36.0"
+        "@types/node": "*"
       }
     },
-    "node_modules/html-url-attributes": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/html-url-attributes/-/html-url-attributes-3.0.1.tgz",
-      "integrity": "sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
+    "node_modules/@ungap/structured-clone": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.2.tgz",
+      "integrity": "sha512-5jsZFwgR5rTdKwidH9Qmat75RKwqfpKlWWB1frDkljN127mwqBu8K0PYo7/hFpF03IEJpfVPpCQDY/eDx3iHvA==",
+      "license": "ISC"
     },
-    "node_modules/http-errors": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+    "node_modules/aria-hidden": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
+      "integrity": "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "depd": "~2.0.0",
-        "inherits": "~2.0.4",
-        "setprototypeof": "~1.2.0",
-        "statuses": "~2.0.2",
-        "toidentifier": "~1.0.1"
+        "tslib": "^2.0.0"
       },
       "engines": {
-        "node": ">= 0.8"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "node": ">=10"
       }
     },
-    "node_modules/http-errors/node_modules/statuses": {
+    "node_modules/bail": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz",
+      "integrity": "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==",
       "license": "MIT",
-      "peer": true,
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/baseline-browser-mapping": {
+      "version": "2.10.42",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.42.tgz",
+      "integrity": "sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q==",
+      "license": "Apache-2.0",
+      "bin": {
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=6.0.0"
       }
     },
-    "node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+    "node_modules/buffer-image-size": {
+      "version": "0.6.4",
+      "resolved": "https://registry.npmjs.org/buffer-image-size/-/buffer-image-size-0.6.4.tgz",
+      "integrity": "sha512-nEh+kZOPY1w+gcCMobZ6ETUp9WfibndnosbpwB1iJk/8Gt5ZF2bhS6+B6bPYz424KtwsR6Rflc3tCz1/ghX2dQ==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "4"
+        "@types/node": "*"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">=4.0"
       }
     },
-    "node_modules/humanize-ms": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz",
-      "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==",
+    "node_modules/bun-types": {
+      "version": "1.3.14",
+      "resolved": "https://registry.npmjs.org/bun-types/-/bun-types-1.3.14.tgz",
+      "integrity": "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "ms": "^2.0.0"
+        "@types/node": "*"
       }
     },
-    "node_modules/idb-keyval": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/idb-keyval/-/idb-keyval-6.2.1.tgz",
-      "integrity": "sha512-8Sb3veuYCyrZL+VBt9LJfZjLUPWVvqn8tG28VqYNFCo43KHcKuq+b4EiXGeuaLAQWL2YmyDgMp2aSpH9JHsEQg==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/ieee754": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001803",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001803.tgz",
+      "integrity": "sha512-g/uHREV2ZpK9qMalCsWaxmA6ol+DX8GYhuf3T40RKoP+oL7vhRJh8LNt73PCjpnR6l14FzfPrB5Yux4PKm2meg==",
       "funding": [
         {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
         },
         {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
         },
         {
-          "type": "consulting",
-          "url": "https://feross.org/support"
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
         }
       ],
-      "license": "BSD-3-Clause",
-      "peer": true
-    },
-    "node_modules/image-size": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/image-size/-/image-size-1.2.1.tgz",
-      "integrity": "sha512-rH+46sQJ2dlwfjfhCyNx5thzrv+dtmBIhPHk0zgRUukHzZ/kRueTJXoYYsclBaKcSMBWuGbOFXtioLpzTb5euw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "queue": "6.0.2"
-      },
-      "bin": {
-        "image-size": "bin/image-size.js"
-      },
-      "engines": {
-        "node": ">=16.x"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC",
-      "peer": true
-    },
-    "node_modules/inline-style-parser": {
-      "version": "0.2.7",
-      "resolved": "https://registry.npmjs.org/inline-style-parser/-/inline-style-parser-0.2.7.tgz",
-      "integrity": "sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==",
-      "license": "MIT"
-    },
-    "node_modules/invariant": {
-      "version": "2.2.4",
-      "resolved": "https://registry.npmjs.org/invariant/-/invariant-2.2.4.tgz",
-      "integrity": "sha512-phJfQVBuaJM5raOpJjSfkiD6BpbCE4Ns//LaXl6wGYtUBY83nWS6Rf9tXm2e8VaK60JEjYldbPif/A2B1C2gNA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "loose-envify": "^1.0.0"
-      }
+      "license": "CC-BY-4.0"
     },
-    "node_modules/is-alphabetical": {
+    "node_modules/ccount": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-alphabetical/-/is-alphabetical-2.0.1.tgz",
-      "integrity": "sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==",
+      "resolved": "https://registry.npmjs.org/ccount/-/ccount-2.0.1.tgz",
+      "integrity": "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==",
       "license": "MIT",
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/is-alphanumerical": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-alphanumerical/-/is-alphanumerical-2.0.1.tgz",
-      "integrity": "sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==",
+    "node_modules/character-entities": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
+      "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
       "license": "MIT",
-      "dependencies": {
-        "is-alphabetical": "^2.0.0",
-        "is-decimal": "^2.0.0"
-      },
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/is-decimal": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-decimal/-/is-decimal-2.0.1.tgz",
-      "integrity": "sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==",
+    "node_modules/character-entities-html4": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-2.1.0.tgz",
+      "integrity": "sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==",
       "license": "MIT",
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/is-docker": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
-      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
-      "license": "MIT",
-      "peer": true,
-      "bin": {
-        "is-docker": "cli.js"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/is-fullwidth-code-point": {
+    "node_modules/character-entities-legacy": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-3.0.0.tgz",
+      "integrity": "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==",
       "license": "MIT",
-      "engines": {
-        "node": ">=8"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/is-hexadecimal": {
+    "node_modules/character-reference-invalid": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-hexadecimal/-/is-hexadecimal-2.0.1.tgz",
-      "integrity": "sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==",
+      "resolved": "https://registry.npmjs.org/character-reference-invalid/-/character-reference-invalid-2.0.1.tgz",
+      "integrity": "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==",
       "license": "MIT",
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/is-number": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
-      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=0.12.0"
-      }
+    "node_modules/client-only": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
+      "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==",
+      "license": "MIT"
     },
-    "node_modules/is-plain-obj": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
-      "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
+    "node_modules/comma-separated-tokens": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/comma-separated-tokens/-/comma-separated-tokens-2.0.3.tgz",
+      "integrity": "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==",
       "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/is-wsl": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
-      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "is-docker": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC",
-      "peer": true
-    },
-    "node_modules/isomorphic-ws": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/isomorphic-ws/-/isomorphic-ws-4.0.1.tgz",
-      "integrity": "sha512-BhBvN2MBpWTaSHdWRb/bwdZJ1WaehQ2L1KngkCkfLUGF0mAWAT1sQUQacEmQ0jXkFw/czDXPNQSL5u2/Krsz1w==",
-      "license": "MIT",
-      "peer": true,
-      "peerDependencies": {
-        "ws": "*"
-      }
-    },
-    "node_modules/isows": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/isows/-/isows-1.0.7.tgz",
-      "integrity": "sha512-I1fSfDCZL5P0v33sVqeTDSpcstAg/N+wF5HS033mogOVIp4B+oHC7oOCsA3axAbBSGTJ8QubbNmnIRN/h8U7hg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/wevm"
-        }
-      ],
-      "license": "MIT",
-      "peerDependencies": {
-        "ws": "*"
-      }
-    },
-    "node_modules/jayson": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/jayson/-/jayson-4.3.0.tgz",
-      "integrity": "sha512-AauzHcUcqs8OBnCHOkJY280VaTiCm57AbuO7lqzcw7JapGj50BisE3xhksye4zlTSR1+1tAz67wLTl8tEH1obQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@types/connect": "^3.4.33",
-        "@types/node": "^12.12.54",
-        "@types/ws": "^7.4.4",
-        "commander": "^2.20.3",
-        "delay": "^5.0.0",
-        "es6-promisify": "^5.0.0",
-        "eyes": "^0.1.8",
-        "isomorphic-ws": "^4.0.1",
-        "json-stringify-safe": "^5.0.1",
-        "stream-json": "^1.9.1",
-        "uuid": "^8.3.2",
-        "ws": "^7.5.10"
-      },
-      "bin": {
-        "jayson": "bin/jayson.js"
-      },
-      "engines": {
-        "node": ">=8"
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/jayson/node_modules/@types/node": {
-      "version": "12.20.55",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.20.55.tgz",
-      "integrity": "sha512-J8xLz7q2OFulZ2cyGTLE1TbbZcjpno7FaN6zdJNrgAdrJ+DZzh/uFR6YrTb4C+nXakvud8Q4+rbhoIWlYQbUFQ==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/jayson/node_modules/@types/ws": {
-      "version": "7.4.7",
-      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-7.4.7.tgz",
-      "integrity": "sha512-JQbbmxZTZehdc2iszGKs5oC3NFnjeay7mtAWrdt7qNtAVK0g19muApzAy4bm9byz79xa2ZnO/BOBC2R8RC5Lww==",
+    "node_modules/css-box-model": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/css-box-model/-/css-box-model-1.2.1.tgz",
+      "integrity": "sha512-a7Vr4Q/kd/aw96bnJG332W9V9LkJO69JRcaCYDUqjp6/z0w6VcZjgAcTbgFxEPfBgdnAwlh3iwu+hLopa+flJw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "@types/node": "*"
-      }
-    },
-    "node_modules/jayson/node_modules/commander": {
-      "version": "2.20.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
-      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/jayson/node_modules/ws": {
-      "version": "7.5.11",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.11.tgz",
-      "integrity": "sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=8.3.0"
-      },
-      "peerDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": "^5.0.2"
-      },
-      "peerDependenciesMeta": {
-        "bufferutil": {
-          "optional": true
-        },
-        "utf-8-validate": {
-          "optional": true
-        }
+        "tiny-invariant": "^1.0.6"
       }
     },
-    "node_modules/jest-get-type": {
-      "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/jest-get-type/-/jest-get-type-29.6.3.tgz",
-      "integrity": "sha512-zrteXnqYxfQh7l5FHyL38jL39di8H8rHoecLH3JNxH3BwOrBsNeabdap5e0I23lD4HHI8W5VFBZqG4Eaq5LNcw==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
-      }
+    "node_modules/csstype": {
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
+      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
+      "license": "MIT"
     },
-    "node_modules/jest-util": {
-      "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-29.7.0.tgz",
-      "integrity": "sha512-z6EbKajIpqGKU56y5KBUgy1dt1ihhQJgWzUlZHArA/+X2ad7Cb5iF+AK1EWVL/Bo7Rz9uurpqw6SiBCefUbCGA==",
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "@jest/types": "^29.6.3",
-        "@types/node": "*",
-        "chalk": "^4.0.0",
-        "ci-info": "^3.2.0",
-        "graceful-fs": "^4.2.9",
-        "picomatch": "^2.2.3"
+        "ms": "^2.1.3"
       },
       "engines": {
-        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
       }
     },
-    "node_modules/jest-util/node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+    "node_modules/decode-named-character-reference": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
+      "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
+        "character-entities": "^2.0.0"
       },
       "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/jest-util/node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+    "node_modules/dequal": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
+      "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
       "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
+        "node": ">=6"
       }
     },
-    "node_modules/jest-util/node_modules/ci-info": {
-      "version": "3.9.0",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz",
-      "integrity": "sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/sibiraj-s"
-        }
-      ],
-      "license": "MIT",
-      "peer": true,
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "devOptional": true,
+      "license": "Apache-2.0",
       "engines": {
         "node": ">=8"
       }
     },
-    "node_modules/jest-util/node_modules/supports-color": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+    "node_modules/detect-node-es": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/detect-node-es/-/detect-node-es-1.1.0.tgz",
+      "integrity": "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==",
+      "license": "MIT"
+    },
+    "node_modules/devlop": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
+      "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "has-flag": "^4.0.0"
+        "dequal": "^2.0.0"
       },
-      "engines": {
-        "node": ">=8"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/jest-validate": {
-      "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-29.7.0.tgz",
-      "integrity": "sha512-ZB7wHqaRGVw/9hST/OuFUReG7M8vKeq0/J2egIGLdvjHCmYqGARhzXmtgi+gVeZ5uXFF219aOc3Ls2yLg27tkw==",
+    "node_modules/enhanced-resolve": {
+      "version": "5.21.3",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.3.tgz",
+      "integrity": "sha512-QyL119InA+XXEkNLNTPCXPugSvOfhwv0JOlGNzvxs0hZaiHLNvXSpudUWsOlsXGWJh8G6ckCScEkVHfX3kw/2Q==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "@jest/types": "^29.6.3",
-        "camelcase": "^6.2.0",
-        "chalk": "^4.0.0",
-        "jest-get-type": "^29.6.3",
-        "leven": "^3.1.0",
-        "pretty-format": "^29.7.0"
+        "graceful-fs": "^4.2.4",
+        "tapable": "^2.3.3"
       },
       "engines": {
-        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
+        "node": ">=10.13.0"
       }
     },
-    "node_modules/jest-validate/node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
+    "node_modules/entities": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-7.0.1.tgz",
+      "integrity": "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==",
+      "dev": true,
+      "license": "BSD-2-Clause",
       "engines": {
-        "node": ">=8"
+        "node": ">=0.12"
       },
       "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+        "url": "https://github.com/fb55/entities?sponsor=1"
       }
     },
-    "node_modules/jest-validate/node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+    "node_modules/estree-util-is-identifier-name": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/estree-util-is-identifier-name/-/estree-util-is-identifier-name-3.0.0.tgz",
+      "integrity": "sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg==",
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
       "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/jest-validate/node_modules/supports-color": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+    "node_modules/extend": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
+      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
+      "license": "MIT"
+    },
+    "node_modules/framer-motion": {
+      "version": "11.18.2",
+      "resolved": "https://registry.npmjs.org/framer-motion/-/framer-motion-11.18.2.tgz",
+      "integrity": "sha512-5F5Och7wrvtLVElIpclDT0CBzMVg3dL22B64aZwHtsIY8RB4mXICLrkajK4G9R+ieSAGcgrLeae2SeUTg2pr6w==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "has-flag": "^4.0.0"
+        "motion-dom": "^11.18.1",
+        "motion-utils": "^11.18.1",
+        "tslib": "^2.4.0"
+      },
+      "peerDependencies": {
+        "@emotion/is-prop-valid": "*",
+        "react": "^18.0.0 || ^19.0.0",
+        "react-dom": "^18.0.0 || ^19.0.0"
       },
+      "peerDependenciesMeta": {
+        "@emotion/is-prop-valid": {
+          "optional": true
+        },
+        "react": {
+          "optional": true
+        },
+        "react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/geist": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/geist/-/geist-1.3.1.tgz",
+      "integrity": "sha512-Q4gC1pBVPN+D579pBaz0TRRnGA4p9UK6elDY/xizXdFk/g4EKR5g0I+4p/Kj6gM0SajDBZ/0FvDV9ey9ud7BWw==",
+      "license": "SIL OPEN FONT LICENSE",
+      "peerDependencies": {
+        "next": ">=13.2.0"
+      }
+    },
+    "node_modules/get-nonce": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-nonce/-/get-nonce-1.0.1.tgz",
+      "integrity": "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==",
+      "license": "MIT",
       "engines": {
-        "node": ">=8"
+        "node": ">=6"
       }
     },
-    "node_modules/jest-worker": {
-      "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-29.7.0.tgz",
-      "integrity": "sha512-eIz2msL/EzL9UFTFFx7jBTkeZfku0yUAyZZZmJ93H2TYEiroIx2PQjEXcwYtYl8zXCxb+PAmA2hLIt/6ZEkPHw==",
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/happy-dom": {
+      "version": "20.10.6",
+      "resolved": "https://registry.npmjs.org/happy-dom/-/happy-dom-20.10.6.tgz",
+      "integrity": "sha512-6QD0ilzDDt93tX44y8tbmZdAcdTRYDhUP+Asgi6pC8Pp5IA3cvaZGyoVN/EGtlq9ziT65iPuBBn3ASLr6hCgVw==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "@types/node": "*",
-        "jest-util": "^29.7.0",
-        "merge-stream": "^2.0.0",
-        "supports-color": "^8.0.0"
+        "@types/node": ">=20.0.0",
+        "@types/whatwg-mimetype": "^3.0.2",
+        "@types/ws": "^8.18.1",
+        "buffer-image-size": "^0.6.4",
+        "entities": "^7.0.1",
+        "whatwg-mimetype": "^3.0.0",
+        "ws": "^8.21.0"
       },
       "engines": {
-        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/jiti": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
-      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
-      "dev": true,
+    "node_modules/hast-util-to-jsx-runtime": {
+      "version": "2.3.6",
+      "resolved": "https://registry.npmjs.org/hast-util-to-jsx-runtime/-/hast-util-to-jsx-runtime-2.3.6.tgz",
+      "integrity": "sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==",
       "license": "MIT",
-      "bin": {
-        "jiti": "lib/jiti-cli.mjs"
+      "dependencies": {
+        "@types/estree": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/unist": "^3.0.0",
+        "comma-separated-tokens": "^2.0.0",
+        "devlop": "^1.0.0",
+        "estree-util-is-identifier-name": "^3.0.0",
+        "hast-util-whitespace": "^3.0.0",
+        "mdast-util-mdx-expression": "^2.0.0",
+        "mdast-util-mdx-jsx": "^3.0.0",
+        "mdast-util-mdxjs-esm": "^2.0.0",
+        "property-information": "^7.0.0",
+        "space-separated-tokens": "^2.0.0",
+        "style-to-js": "^1.0.0",
+        "unist-util-position": "^5.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/js-cookie": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/js-cookie/-/js-cookie-3.0.7.tgz",
-      "integrity": "sha512-z/wZZgDrkNV1eA0ULjM/F9/50Ya8fbzgKneSpoPsXSGd0KnpdtHfOZWK+GcwLk+EZbS4F9RBhU+K2RgzuDaItw==",
+    "node_modules/hast-util-whitespace": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/hast-util-whitespace/-/hast-util-whitespace-3.0.0.tgz",
+      "integrity": "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==",
       "license": "MIT",
-      "engines": {
-        "node": ">=20"
+      "dependencies": {
+        "@types/hast": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/js-tokens": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
-      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+    "node_modules/html-url-attributes": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/html-url-attributes/-/html-url-attributes-3.0.1.tgz",
+      "integrity": "sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==",
       "license": "MIT",
-      "peer": true
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
     },
-    "node_modules/jsc-safe-url": {
-      "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/jsc-safe-url/-/jsc-safe-url-0.2.4.tgz",
-      "integrity": "sha512-0wM3YBWtYePOjfyXQH5MWQ8H7sdk5EXSwZvmSLKk2RboVQ2Bu239jycHDz5J/8Blf3K0Qnoy2b6xD+z10MFB+Q==",
-      "license": "0BSD",
-      "peer": true
+    "node_modules/inline-style-parser": {
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/inline-style-parser/-/inline-style-parser-0.2.7.tgz",
+      "integrity": "sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==",
+      "license": "MIT"
     },
-    "node_modules/jsesc": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
-      "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
+    "node_modules/is-alphabetical": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-alphabetical/-/is-alphabetical-2.0.1.tgz",
+      "integrity": "sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==",
       "license": "MIT",
-      "peer": true,
-      "bin": {
-        "jsesc": "bin/jsesc"
-      },
-      "engines": {
-        "node": ">=6"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/json-stringify-safe": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
-      "integrity": "sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==",
-      "license": "ISC",
-      "peer": true
-    },
-    "node_modules/json5": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
-      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+    "node_modules/is-alphanumerical": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-alphanumerical/-/is-alphanumerical-2.0.1.tgz",
+      "integrity": "sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==",
       "license": "MIT",
-      "peer": true,
-      "bin": {
-        "json5": "lib/cli.js"
+      "dependencies": {
+        "is-alphabetical": "^2.0.0",
+        "is-decimal": "^2.0.0"
       },
-      "engines": {
-        "node": ">=6"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/leven": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz",
-      "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==",
+    "node_modules/is-decimal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-decimal/-/is-decimal-2.0.1.tgz",
+      "integrity": "sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==",
       "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=6"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/lighthouse-logger": {
-      "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/lighthouse-logger/-/lighthouse-logger-1.4.2.tgz",
-      "integrity": "sha512-gPWxznF6TKmUHrOQjlVo2UbaL2EJ71mb2CCeRs/2qBpi4L/g4LUVc9+3lKQ6DTUZwJswfM7ainGrLO1+fOqa2g==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "debug": "^2.6.9",
-        "marky": "^1.2.2"
+    "node_modules/is-hexadecimal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-hexadecimal/-/is-hexadecimal-2.0.1.tgz",
+      "integrity": "sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/lighthouse-logger/node_modules/debug": {
-      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+    "node_modules/is-plain-obj": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
+      "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ms": "2.0.0"
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/lighthouse-logger/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+    "node_modules/jiti": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "dev": true,
       "license": "MIT",
-      "peer": true
+      "bin": {
+        "jiti": "lib/jiti-cli.mjs"
+      }
     },
     "node_modules/lightningcss": {
       "version": "1.29.2",
@@ -6357,31 +2476,6 @@
         "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/locate-path": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-      "license": "MIT",
-      "dependencies": {
-        "p-locate": "^4.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/lodash": {
-      "version": "4.18.1",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
-      "license": "MIT"
-    },
-    "node_modules/lodash.throttle": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/lodash.throttle/-/lodash.throttle-4.1.1.tgz",
-      "integrity": "sha512-wIkUCfVKpVsWo3JSZlc+8MB5it+2AN5W8J7YVMST30UrvcQNZ1Okbj+rbVniijTWE6FGYy4XJq/rHkas8qJMLQ==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/longest-streak": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/longest-streak/-/longest-streak-3.1.0.tgz",
@@ -6392,29 +2486,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/loose-envify": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",
-      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "js-tokens": "^3.0.0 || ^4.0.0"
-      },
-      "bin": {
-        "loose-envify": "cli.js"
-      }
-    },
-    "node_modules/lru-cache": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
-      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
-      "license": "ISC",
-      "peer": true,
-      "dependencies": {
-        "yallist": "^3.0.2"
-      }
-    },
     "node_modules/lucide-react": {
       "version": "0.514.0",
       "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.514.0.tgz",
@@ -6424,23 +2495,6 @@
         "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/makeerror": {
-      "version": "1.0.12",
-      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz",
-      "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==",
-      "license": "BSD-3-Clause",
-      "peer": true,
-      "dependencies": {
-        "tmpl": "1.0.5"
-      }
-    },
-    "node_modules/marky": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/marky/-/marky-1.3.0.tgz",
-      "integrity": "sha512-ocnPZQLNpvbedwTy9kNrQEsknEfgvcLMvOtz3sFeWApDq1MXH1TqkCIx58xlpESsfwQOnuBO9beyQuNGzVvuhQ==",
-      "license": "Apache-2.0",
-      "peer": true
-    },
     "node_modules/mdast-util-from-markdown": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.3.tgz",
@@ -6518,543 +2572,80 @@
         "@types/mdast": "^4.0.0",
         "devlop": "^1.0.0",
         "mdast-util-from-markdown": "^2.0.0",
-        "mdast-util-to-markdown": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/mdast-util-phrasing": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/mdast-util-phrasing/-/mdast-util-phrasing-4.1.0.tgz",
-      "integrity": "sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/mdast": "^4.0.0",
-        "unist-util-is": "^6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/mdast-util-to-hast": {
-      "version": "13.2.1",
-      "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
-      "integrity": "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/hast": "^3.0.0",
-        "@types/mdast": "^4.0.0",
-        "@ungap/structured-clone": "^1.0.0",
-        "devlop": "^1.0.0",
-        "micromark-util-sanitize-uri": "^2.0.0",
-        "trim-lines": "^3.0.0",
-        "unist-util-position": "^5.0.0",
-        "unist-util-visit": "^5.0.0",
-        "vfile": "^6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/mdast-util-to-markdown": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/mdast-util-to-markdown/-/mdast-util-to-markdown-2.1.2.tgz",
-      "integrity": "sha512-xj68wMTvGXVOKonmog6LwyJKrYXZPvlwabaryTjLh9LuvovB/KAH+kvi8Gjj+7rJjsFi23nkUxRQv1KqSroMqA==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/mdast": "^4.0.0",
-        "@types/unist": "^3.0.0",
-        "longest-streak": "^3.0.0",
-        "mdast-util-phrasing": "^4.0.0",
-        "mdast-util-to-string": "^4.0.0",
-        "micromark-util-classify-character": "^2.0.0",
-        "micromark-util-decode-string": "^2.0.0",
-        "unist-util-visit": "^5.0.0",
-        "zwitch": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/mdast-util-to-string": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
-      "integrity": "sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/mdast": "^4.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/memoize-one": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/memoize-one/-/memoize-one-5.2.1.tgz",
-      "integrity": "sha512-zYiwtZUcYyXKo/np96AGZAckk+FWWsUdJ3cHGGmld7+AhvcWmQyGCYUh1hc4Q/pkOhb65dQR/pqCyK0cOaHz4Q==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/merge-options": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/merge-options/-/merge-options-3.0.4.tgz",
-      "integrity": "sha512-2Sug1+knBjkaMsMgf1ctR1Ujx+Ayku4EdJN4Z+C2+JzoeF7A3OZ9KM2GY0CpQS51NR61LTurMJrRKPhSs3ZRTQ==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "is-plain-obj": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/merge-options/node_modules/is-plain-obj": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-2.1.0.tgz",
-      "integrity": "sha512-YWnfyRwxL/+SsrWYfOpUtz5b3YD+nyfkHvjbcanzk8zgyO4ASD67uVMRt8k5bM4lLMDnXfriRhOpemw+NfT1eA==",
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/merge-stream": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
-      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/metro": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro/-/metro-0.84.4.tgz",
-      "integrity": "sha512-8ETTubqfD6ornDy2zYDvRcKnVDOXdFJsjetYDBsY4oAsb6NJkiwFR+FaMESyGppFmQUyBQA4H4sFGxzcQSGtFA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/core": "^7.25.2",
-        "@babel/generator": "^7.29.1",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "accepts": "^2.0.0",
-        "ci-info": "^2.0.0",
-        "connect": "^3.6.5",
-        "debug": "^4.4.0",
-        "error-stack-parser": "^2.0.6",
-        "flow-enums-runtime": "^0.0.6",
-        "graceful-fs": "^4.2.4",
-        "hermes-parser": "0.35.0",
-        "image-size": "^1.0.2",
-        "invariant": "^2.2.4",
-        "jest-worker": "^29.7.0",
-        "jsc-safe-url": "^0.2.2",
-        "lodash.throttle": "^4.1.1",
-        "metro-babel-transformer": "0.84.4",
-        "metro-cache": "0.84.4",
-        "metro-cache-key": "0.84.4",
-        "metro-config": "0.84.4",
-        "metro-core": "0.84.4",
-        "metro-file-map": "0.84.4",
-        "metro-resolver": "0.84.4",
-        "metro-runtime": "0.84.4",
-        "metro-source-map": "0.84.4",
-        "metro-symbolicate": "0.84.4",
-        "metro-transform-plugins": "0.84.4",
-        "metro-transform-worker": "0.84.4",
-        "mime-types": "^3.0.1",
-        "nullthrows": "^1.1.1",
-        "serialize-error": "^2.1.0",
-        "source-map": "^0.5.6",
-        "throat": "^5.0.0",
-        "ws": "^7.5.10",
-        "yargs": "^17.6.2"
-      },
-      "bin": {
-        "metro": "src/cli.js"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-babel-transformer": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-babel-transformer/-/metro-babel-transformer-0.84.4.tgz",
-      "integrity": "sha512-rvCfz8snl9h20VcvpOHxZuHP1SlAkv4HXbzw7nyyVwu6Eqo5PRerbakQ9XmUCOsRy70spJ37O+G1TK8oMzo48g==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/core": "^7.25.2",
-        "flow-enums-runtime": "^0.0.6",
-        "hermes-parser": "0.35.0",
-        "metro-cache-key": "0.84.4",
-        "nullthrows": "^1.1.1"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-babel-transformer/node_modules/hermes-estree": {
-      "version": "0.35.0",
-      "resolved": "https://registry.npmjs.org/hermes-estree/-/hermes-estree-0.35.0.tgz",
-      "integrity": "sha512-xVx5Opwy8Oo1I5yGpVRhCvWL/iV3M+ylksSKVNlxxD90cpDpR/AR1jLYqK8HWihm065a6UI3HeyAmYzwS8NOOg==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/metro-babel-transformer/node_modules/hermes-parser": {
-      "version": "0.35.0",
-      "resolved": "https://registry.npmjs.org/hermes-parser/-/hermes-parser-0.35.0.tgz",
-      "integrity": "sha512-9JLjeHxBx8T4CAsydZR49PNZUaix+WpQJwu9p2010lu+7Kwl6D/7wYFFJxoz+aXkaaClp9Zfg6W6/zVlSJORaA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "hermes-estree": "0.35.0"
-      }
-    },
-    "node_modules/metro-cache": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-cache/-/metro-cache-0.84.4.tgz",
-      "integrity": "sha512-gpcFQdSLUwUCk71saKoE64jLFbx2nwTfVCcPSULMNT8QYq0p1eZZE29Jvd0HtT/UlhC3ZOutLxJME5xqD2JUZg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "exponential-backoff": "^3.1.1",
-        "flow-enums-runtime": "^0.0.6",
-        "https-proxy-agent": "^7.0.5",
-        "metro-core": "0.84.4"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-cache-key": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-cache-key/-/metro-cache-key-0.84.4.tgz",
-      "integrity": "sha512-wVO79aGrkYImpnaVS4+d5RrRBRPX31QtvKB3wKGBuiNSznduZTQHzsrJZRroFJSwnygrzdsGUtDQPuqqFjFdvw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "flow-enums-runtime": "^0.0.6"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-config": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-config/-/metro-config-0.84.4.tgz",
-      "integrity": "sha512-PMotGDjXcXLWo2TMRH+VR99phFNgYTwqh4OoieIKK3yTJa1Jmkl+fZJxDO0jfBvNF+WESHciHvpNuBtXaF3B0Q==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "connect": "^3.6.5",
-        "flow-enums-runtime": "^0.0.6",
-        "jest-validate": "^29.7.0",
-        "metro": "0.84.4",
-        "metro-cache": "0.84.4",
-        "metro-core": "0.84.4",
-        "metro-runtime": "0.84.4",
-        "yaml": "^2.6.1"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-core": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-core/-/metro-core-0.84.4.tgz",
-      "integrity": "sha512-HONpWC5LGXZn3ffkd4Hu6AIrfE7j4Z0g0wMo/goV24WOB3lhuFZ40KgvaDiSw8iyQHloMYay5N/wPX+z8oN/PQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "flow-enums-runtime": "^0.0.6",
-        "lodash.throttle": "^4.1.1",
-        "metro-resolver": "0.84.4"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-file-map": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-file-map/-/metro-file-map-0.84.4.tgz",
-      "integrity": "sha512-KSVDi/u60hKPx++NLu3MTIvyjzNoJnFAF8PQFxaj1jiSka/wjw+Ua6sNuJ0TDHQv+7AAoFQxeMgaRAe8Yic5wQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "debug": "^4.4.0",
-        "fb-watchman": "^2.0.0",
-        "flow-enums-runtime": "^0.0.6",
-        "graceful-fs": "^4.2.4",
-        "invariant": "^2.2.4",
-        "jest-worker": "^29.7.0",
-        "micromatch": "^4.0.4",
-        "nullthrows": "^1.1.1",
-        "walker": "^1.0.7"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-minify-terser": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-minify-terser/-/metro-minify-terser-0.84.4.tgz",
-      "integrity": "sha512-5qpbaVOMC7CPitIpuewzVeGw7E+C3ykbv2mqTjQLl85Z3annSVGlSCTcsZjqXZzjupfK4Ztj3dDc4kc44NZwtQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "flow-enums-runtime": "^0.0.6",
-        "terser": "^5.15.0"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-resolver": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-resolver/-/metro-resolver-0.84.4.tgz",
-      "integrity": "sha512-1qLgbxQ5ZGhhutuPot1Yp348ofDsATL2WkrHF65TobqTT9K3P9qJXw38bomk7ncp5B7OYMfWwtyBZo1lCV792A==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "flow-enums-runtime": "^0.0.6"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-runtime": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-runtime/-/metro-runtime-0.84.4.tgz",
-      "integrity": "sha512-Jibypds4g7AhzdRKY+kDoj51s5EXMwgyp5ddtlreDAsWefMdOx+agWqgm0H2XSZ/ueanHHVM89fnf5OJnlxa8Q==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/runtime": "^7.25.0",
-        "flow-enums-runtime": "^0.0.6"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-source-map": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-source-map/-/metro-source-map-0.84.4.tgz",
-      "integrity": "sha512-jbWkPxIesVuo1IWkvezmMJld6iu8nD62GsrZiV6jP37AOdbo4OBq1FJ+qkOg8sV05wAHB//jAbziuW0SlJfW4g==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "flow-enums-runtime": "^0.0.6",
-        "invariant": "^2.2.4",
-        "metro-symbolicate": "0.84.4",
-        "nullthrows": "^1.1.1",
-        "ob1": "0.84.4",
-        "source-map": "^0.5.6",
-        "vlq": "^1.0.0"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-symbolicate": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-symbolicate/-/metro-symbolicate-0.84.4.tgz",
-      "integrity": "sha512-OnfpacxUqGPZQ27t8qK9mFa7uqHIlVWeqRqkCbvMvreEBiamEeOn8krKtcwgP5M4cYDPwuSmCTopHMVthqG4zA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "flow-enums-runtime": "^0.0.6",
-        "invariant": "^2.2.4",
-        "metro-source-map": "0.84.4",
-        "nullthrows": "^1.1.1",
-        "source-map": "^0.5.6",
-        "vlq": "^1.0.0"
-      },
-      "bin": {
-        "metro-symbolicate": "src/index.js"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-transform-plugins": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-transform-plugins/-/metro-transform-plugins-0.84.4.tgz",
-      "integrity": "sha512-kehr6HbAecqD0/a3xLXobELdPaAmRAl8bel0qagPF4vhZtux93nS8S4eq2kgKt6J2GnQpVjSoW1PXdst04mwow==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/core": "^7.25.2",
-        "@babel/generator": "^7.29.1",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "flow-enums-runtime": "^0.0.6",
-        "nullthrows": "^1.1.1"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro-transform-worker": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/metro-transform-worker/-/metro-transform-worker-0.84.4.tgz",
-      "integrity": "sha512-W1IYMvvXTu4MxYr7d9h7CeG2vpIr3bmLLIavkPY4O1ilzDrvS8z/NEe6y+pC44Ff7raMXQgYSfdqDUwN/i39gg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@babel/core": "^7.25.2",
-        "@babel/generator": "^7.29.1",
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "flow-enums-runtime": "^0.0.6",
-        "metro": "0.84.4",
-        "metro-babel-transformer": "0.84.4",
-        "metro-cache": "0.84.4",
-        "metro-cache-key": "0.84.4",
-        "metro-minify-terser": "0.84.4",
-        "metro-source-map": "0.84.4",
-        "metro-transform-plugins": "0.84.4",
-        "nullthrows": "^1.1.1"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/metro/node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/metro/node_modules/cliui": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
-      "license": "ISC",
-      "peer": true,
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.1",
-        "wrap-ansi": "^7.0.0"
+        "mdast-util-to-markdown": "^2.0.0"
       },
-      "engines": {
-        "node": ">=12"
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/metro/node_modules/hermes-estree": {
-      "version": "0.35.0",
-      "resolved": "https://registry.npmjs.org/hermes-estree/-/hermes-estree-0.35.0.tgz",
-      "integrity": "sha512-xVx5Opwy8Oo1I5yGpVRhCvWL/iV3M+ylksSKVNlxxD90cpDpR/AR1jLYqK8HWihm065a6UI3HeyAmYzwS8NOOg==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/metro/node_modules/hermes-parser": {
-      "version": "0.35.0",
-      "resolved": "https://registry.npmjs.org/hermes-parser/-/hermes-parser-0.35.0.tgz",
-      "integrity": "sha512-9JLjeHxBx8T4CAsydZR49PNZUaix+WpQJwu9p2010lu+7Kwl6D/7wYFFJxoz+aXkaaClp9Zfg6W6/zVlSJORaA==",
+    "node_modules/mdast-util-phrasing": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-phrasing/-/mdast-util-phrasing-4.1.0.tgz",
+      "integrity": "sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "hermes-estree": "0.35.0"
+        "@types/mdast": "^4.0.0",
+        "unist-util-is": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/metro/node_modules/wrap-ansi": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+    "node_modules/mdast-util-to-hast": {
+      "version": "13.2.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
+      "integrity": "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "@ungap/structured-clone": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "trim-lines": "^3.0.0",
+        "unist-util-position": "^5.0.0",
+        "unist-util-visit": "^5.0.0",
+        "vfile": "^6.0.0"
       },
       "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/metro/node_modules/ws": {
-      "version": "7.5.11",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.11.tgz",
-      "integrity": "sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA==",
+    "node_modules/mdast-util-to-markdown": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-markdown/-/mdast-util-to-markdown-2.1.2.tgz",
+      "integrity": "sha512-xj68wMTvGXVOKonmog6LwyJKrYXZPvlwabaryTjLh9LuvovB/KAH+kvi8Gjj+7rJjsFi23nkUxRQv1KqSroMqA==",
       "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=8.3.0"
-      },
-      "peerDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": "^5.0.2"
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "@types/unist": "^3.0.0",
+        "longest-streak": "^3.0.0",
+        "mdast-util-phrasing": "^4.0.0",
+        "mdast-util-to-string": "^4.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-decode-string": "^2.0.0",
+        "unist-util-visit": "^5.0.0",
+        "zwitch": "^2.0.0"
       },
-      "peerDependenciesMeta": {
-        "bufferutil": {
-          "optional": true
-        },
-        "utf-8-validate": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/metro/node_modules/y18n": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
-      "license": "ISC",
-      "peer": true,
-      "engines": {
-        "node": ">=10"
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/metro/node_modules/yargs": {
-      "version": "17.7.3",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
-      "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
+    "node_modules/mdast-util-to-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
+      "integrity": "sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "cliui": "^8.0.1",
-        "escalade": "^3.1.1",
-        "get-caller-file": "^2.0.5",
-        "require-directory": "^2.1.1",
-        "string-width": "^4.2.3",
-        "y18n": "^5.0.5",
-        "yargs-parser": "^21.1.1"
+        "@types/mdast": "^4.0.0"
       },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/metro/node_modules/yargs-parser": {
-      "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
-      "license": "ISC",
-      "peer": true,
-      "engines": {
-        "node": ">=12"
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
     "node_modules/micromark": {
@@ -7499,73 +3090,6 @@
       ],
       "license": "MIT"
     },
-    "node_modules/micromatch": {
-      "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
-      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "braces": "^3.0.3",
-        "picomatch": "^2.3.1"
-      },
-      "engines": {
-        "node": ">=8.6"
-      }
-    },
-    "node_modules/mime": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
-      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
-      "license": "MIT",
-      "peer": true,
-      "bin": {
-        "mime": "cli.js"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/mime-db": {
-      "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/mime-types": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
-      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "mime-db": "^1.54.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/mkdirp": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
-      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
-      "license": "MIT",
-      "peer": true,
-      "bin": {
-        "mkdirp": "bin/cmd.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/motion-dom": {
       "version": "11.18.1",
       "resolved": "https://registry.npmjs.org/motion-dom/-/motion-dom-11.18.1.tgz",
@@ -7575,275 +3099,87 @@
         "motion-utils": "^11.18.1"
       }
     },
-    "node_modules/motion-utils": {
-      "version": "11.18.1",
-      "resolved": "https://registry.npmjs.org/motion-utils/-/motion-utils-11.18.1.tgz",
-      "integrity": "sha512-49Kt+HKjtbJKLtgO/LKj9Ld+6vw9BjH5d9sc40R/kVyH8GLAXgT42M2NnuPcJNuA3s9ZfZBUcwIgpmZWGEE+hA==",
-      "license": "MIT"
-    },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "license": "MIT"
-    },
-    "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "bin": {
-        "nanoid": "bin/nanoid.cjs"
-      },
-      "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
-      }
-    },
-    "node_modules/negotiator": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
-      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/next": {
-      "version": "16.2.6",
-      "resolved": "https://registry.npmjs.org/next/-/next-16.2.6.tgz",
-      "integrity": "sha512-qOVgKJg1+At15NpeUP+eJgCHvTCgXsogweq87Ri/Ix7PkqQHg4sdaXmSFqKlgaIXE4kW0g25LE68W87UANlHtw==",
-      "license": "MIT",
-      "dependencies": {
-        "@next/env": "16.2.6",
-        "@swc/helpers": "0.5.15",
-        "baseline-browser-mapping": "^2.9.19",
-        "caniuse-lite": "^1.0.30001579",
-        "postcss": "8.4.31",
-        "styled-jsx": "5.1.6"
-      },
-      "bin": {
-        "next": "dist/bin/next"
-      },
-      "engines": {
-        "node": ">=20.9.0"
-      },
-      "optionalDependencies": {
-        "@next/swc-darwin-arm64": "16.2.6",
-        "@next/swc-darwin-x64": "16.2.6",
-        "@next/swc-linux-arm64-gnu": "16.2.6",
-        "@next/swc-linux-arm64-musl": "16.2.6",
-        "@next/swc-linux-x64-gnu": "16.2.6",
-        "@next/swc-linux-x64-musl": "16.2.6",
-        "@next/swc-win32-arm64-msvc": "16.2.6",
-        "@next/swc-win32-x64-msvc": "16.2.6",
-        "sharp": "^0.34.5"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.1.0",
-        "@playwright/test": "^1.51.1",
-        "babel-plugin-react-compiler": "*",
-        "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0",
-        "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0",
-        "sass": "^1.3.0"
-      },
-      "peerDependenciesMeta": {
-        "@opentelemetry/api": {
-          "optional": true
-        },
-        "@playwright/test": {
-          "optional": true
-        },
-        "babel-plugin-react-compiler": {
-          "optional": true
-        },
-        "sass": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/node-fetch": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
-      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "whatwg-url": "^5.0.0"
-      },
-      "engines": {
-        "node": "4.x || >=6.0.0"
-      },
-      "peerDependencies": {
-        "encoding": "^0.1.0"
-      },
-      "peerDependenciesMeta": {
-        "encoding": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/node-gyp-build": {
-      "version": "4.8.4",
-      "resolved": "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-4.8.4.tgz",
-      "integrity": "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ==",
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "bin": {
-        "node-gyp-build": "bin.js",
-        "node-gyp-build-optional": "optional.js",
-        "node-gyp-build-test": "build-test.js"
-      }
-    },
-    "node_modules/node-int64": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
-      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/node-releases": {
-      "version": "2.0.51",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.51.tgz",
-      "integrity": "sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/nullthrows": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/nullthrows/-/nullthrows-1.1.1.tgz",
-      "integrity": "sha512-2vPPEi+Z7WqML2jZYddDIfy5Dqb0r2fze2zTxNNknZaFpVHU3mFB3R+DWeJWGVx0ecvttSGlJTI+WG+8Z4cDWw==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/ob1": {
-      "version": "0.84.4",
-      "resolved": "https://registry.npmjs.org/ob1/-/ob1-0.84.4.tgz",
-      "integrity": "sha512-eJXMpz4aQHXF/YBB9ddqZDIS+ooO91hObo9FoW/xBkr54/zCwYYCDqT/O54vNo8kOkWs5Ou/y28NgdrV0edQNA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "flow-enums-runtime": "^0.0.6"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      }
-    },
-    "node_modules/on-finished": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz",
-      "integrity": "sha512-ikqdkGAAyf/X/gPhXGvfgAytDZtDbr+bkNUJ0N9h5MI/dmdgCs3l6hoHrcUv41sRKew3jIwrp4qQDXiK99Utww==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ee-first": "1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/open": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/open/-/open-7.4.2.tgz",
-      "integrity": "sha512-MVHddDVweXZF3awtlAS+6pgKLlm/JgxZ90+/NBurBoQctVOOB/zDdVjcyPzQ+0laDGbsWgrRkflI65sQeOgT9Q==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "is-docker": "^2.0.0",
-        "is-wsl": "^2.1.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/ox": {
-      "version": "0.6.9",
-      "resolved": "https://registry.npmjs.org/ox/-/ox-0.6.9.tgz",
-      "integrity": "sha512-wi5ShvzE4eOcTwQVsIPdFr+8ycyX+5le/96iAJutaZAvCes1J0+RvpEPg5QDPDiaR0XQQAvZVl7AwqQcINuUug==",
+    "node_modules/motion-utils": {
+      "version": "11.18.1",
+      "resolved": "https://registry.npmjs.org/motion-utils/-/motion-utils-11.18.1.tgz",
+      "integrity": "sha512-49Kt+HKjtbJKLtgO/LKj9Ld+6vw9BjH5d9sc40R/kVyH8GLAXgT42M2NnuPcJNuA3s9ZfZBUcwIgpmZWGEE+hA==",
+      "license": "MIT"
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.12",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
+      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
       "funding": [
         {
           "type": "github",
-          "url": "https://github.com/sponsors/wevm"
+          "url": "https://github.com/sponsors/ai"
         }
       ],
       "license": "MIT",
-      "dependencies": {
-        "@adraffy/ens-normalize": "^1.10.1",
-        "@noble/curves": "^1.6.0",
-        "@noble/hashes": "^1.5.0",
-        "@scure/bip32": "^1.5.0",
-        "@scure/bip39": "^1.4.0",
-        "abitype": "^1.0.6",
-        "eventemitter3": "5.0.1"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
       },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/ox/node_modules/@noble/hashes": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
-      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
-      "license": "MIT",
       "engines": {
-        "node": "^14.21.3 || >=16"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
-    "node_modules/p-limit": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+    "node_modules/next": {
+      "version": "16.2.6",
+      "resolved": "https://registry.npmjs.org/next/-/next-16.2.6.tgz",
+      "integrity": "sha512-qOVgKJg1+At15NpeUP+eJgCHvTCgXsogweq87Ri/Ix7PkqQHg4sdaXmSFqKlgaIXE4kW0g25LE68W87UANlHtw==",
       "license": "MIT",
       "dependencies": {
-        "p-try": "^2.0.0"
+        "@next/env": "16.2.6",
+        "@swc/helpers": "0.5.15",
+        "baseline-browser-mapping": "^2.9.19",
+        "caniuse-lite": "^1.0.30001579",
+        "postcss": "8.4.31",
+        "styled-jsx": "5.1.6"
+      },
+      "bin": {
+        "next": "dist/bin/next"
       },
       "engines": {
-        "node": ">=6"
+        "node": ">=20.9.0"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-locate": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-      "license": "MIT",
-      "dependencies": {
-        "p-limit": "^2.2.0"
+      "optionalDependencies": {
+        "@next/swc-darwin-arm64": "16.2.6",
+        "@next/swc-darwin-x64": "16.2.6",
+        "@next/swc-linux-arm64-gnu": "16.2.6",
+        "@next/swc-linux-arm64-musl": "16.2.6",
+        "@next/swc-linux-x64-gnu": "16.2.6",
+        "@next/swc-linux-x64-musl": "16.2.6",
+        "@next/swc-win32-arm64-msvc": "16.2.6",
+        "@next/swc-win32-x64-msvc": "16.2.6",
+        "sharp": "^0.34.5"
       },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/p-try": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
-      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.1.0",
+        "@playwright/test": "^1.51.1",
+        "babel-plugin-react-compiler": "*",
+        "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0",
+        "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0",
+        "sass": "^1.3.0"
+      },
+      "peerDependenciesMeta": {
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@playwright/test": {
+          "optional": true
+        },
+        "babel-plugin-react-compiler": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        }
       }
     },
     "node_modules/parse-entities": {
@@ -7871,63 +3207,12 @@
       "integrity": "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==",
       "license": "MIT"
     },
-    "node_modules/parseurl": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
-      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/path-exists": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
       "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
       "license": "ISC"
     },
-    "node_modules/picomatch": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=8.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "node_modules/pngjs": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-5.0.0.tgz",
-      "integrity": "sha512-40QW5YalBNfQo5yRYmiw7Yz6TKKVr3h6970B2YE+3fQpsWcrbj1PzJgxeJ19DRQjhMbKPIuMY8rFaXc8moolVw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
     "node_modules/postcss": {
       "version": "8.5.15",
       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
@@ -7956,41 +3241,6 @@
         "node": "^10 || ^12 || >=14"
       }
     },
-    "node_modules/preact": {
-      "version": "10.24.2",
-      "resolved": "https://registry.npmjs.org/preact/-/preact-10.24.2.tgz",
-      "integrity": "sha512-1cSoF0aCC8uaARATfrlz4VCBqE8LwZwRfLgkxJOQwAlQt6ayTmi0D9OF7nXid1POI5SZidFuG9CnlXbDfLqY/Q==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/preact"
-      }
-    },
-    "node_modules/pretty-format": {
-      "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-29.7.0.tgz",
-      "integrity": "sha512-Pdlw/oPxN+aXdmM9R00JVC9WVFoCLTKJvDVLgmJ+qAffBMxsV85l/Lu7sNx4zSzPyoL2euImuEwHhOXdEgNFZQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@jest/schemas": "^29.6.3",
-        "ansi-styles": "^5.0.0",
-        "react-is": "^18.0.0"
-      },
-      "engines": {
-        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
-      }
-    },
-    "node_modules/promise": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/promise/-/promise-8.3.0.tgz",
-      "integrity": "sha512-rZPNPKTOYVNEEKFaq1HqTgOwZD+4/YHS5ukLzQCypkj+OkYx7iv0mA91lJlpPPZ8vMau3IIGj5Qlwrx+8iiSmg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "asap": "~2.0.6"
-      }
-    },
     "node_modules/property-information": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.2.0.tgz",
@@ -8001,49 +3251,12 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/qrcode": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/qrcode/-/qrcode-1.5.4.tgz",
-      "integrity": "sha512-1ca71Zgiu6ORjHqFBDpnSMTR2ReToX4l1Au1VFLyVeBTFavzQnv5JxMFr3ukHVKpSrSA2MCk0lNJSykjUfz7Zg==",
-      "license": "MIT",
-      "dependencies": {
-        "dijkstrajs": "^1.0.1",
-        "pngjs": "^5.0.0",
-        "yargs": "^15.3.1"
-      },
-      "bin": {
-        "qrcode": "bin/qrcode"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/queue": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/queue/-/queue-6.0.2.tgz",
-      "integrity": "sha512-iHZWu+q3IdFZFX36ro/lKBkSvfkztY5Y7HMiPlOUjhupPcG2JMfst2KKEpu5XndviX/3UhFbRngUPNKtgvtZiA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "inherits": "~2.0.3"
-      }
-    },
     "node_modules/raf-schd": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/raf-schd/-/raf-schd-4.0.3.tgz",
       "integrity": "sha512-tQkJl2GRWh83ui2DiPTJz9wEiMN20syf+5oKfB03yYP7ioZcJwsIK8FjrtLwH1m7C7e+Tt2yYBlrOpdT+dyeIQ==",
       "license": "MIT"
     },
-    "node_modules/range-parser": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
-      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/react": {
       "version": "19.2.7",
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
@@ -8053,39 +3266,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/react-devtools-core": {
-      "version": "6.1.5",
-      "resolved": "https://registry.npmjs.org/react-devtools-core/-/react-devtools-core-6.1.5.tgz",
-      "integrity": "sha512-ePrwPfxAnB+7hgnEr8vpKxL9cmnp7F322t8oqcPshbIQQhDKgFDW4tjhF2wjVbdXF9O/nyuy3sQWd9JGpiLPvA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "shell-quote": "^1.6.1",
-        "ws": "^7"
-      }
-    },
-    "node_modules/react-devtools-core/node_modules/ws": {
-      "version": "7.5.11",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.11.tgz",
-      "integrity": "sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=8.3.0"
-      },
-      "peerDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": "^5.0.2"
-      },
-      "peerDependenciesMeta": {
-        "bufferutil": {
-          "optional": true
-        },
-        "utf-8-validate": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/react-dom": {
       "version": "19.2.7",
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
@@ -8098,13 +3278,6 @@
         "react": "^19.2.7"
       }
     },
-    "node_modules/react-is": {
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
-      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/react-markdown": {
       "version": "10.1.0",
       "resolved": "https://registry.npmjs.org/react-markdown/-/react-markdown-10.1.0.tgz",
@@ -8120,196 +3293,16 @@
         "remark-parse": "^11.0.0",
         "remark-rehype": "^11.0.0",
         "unified": "^11.0.0",
-        "unist-util-visit": "^5.0.0",
-        "vfile": "^6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      },
-      "peerDependencies": {
-        "@types/react": ">=18",
-        "react": ">=18"
-      }
-    },
-    "node_modules/react-native": {
-      "version": "0.86.0",
-      "resolved": "https://registry.npmjs.org/react-native/-/react-native-0.86.0.tgz",
-      "integrity": "sha512-17ALh/dd6AO4pgOVmOO5Axll5PbErEo3XFyLokyzW6usyi+OShIEPwUW26wLPlhVifgSOIfECCH0WN+0IqtJ1w==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@react-native/assets-registry": "0.86.0",
-        "@react-native/codegen": "0.86.0",
-        "@react-native/community-cli-plugin": "0.86.0",
-        "@react-native/gradle-plugin": "0.86.0",
-        "@react-native/js-polyfills": "0.86.0",
-        "@react-native/normalize-colors": "0.86.0",
-        "@react-native/virtualized-lists": "0.86.0",
-        "abort-controller": "^3.0.0",
-        "anser": "^1.4.9",
-        "ansi-regex": "^5.0.0",
-        "babel-plugin-syntax-hermes-parser": "0.36.0",
-        "base64-js": "^1.5.1",
-        "commander": "^12.0.0",
-        "flow-enums-runtime": "^0.0.6",
-        "hermes-compiler": "250829098.0.14",
-        "invariant": "^2.2.4",
-        "memoize-one": "^5.0.0",
-        "metro-runtime": "^0.84.3",
-        "metro-source-map": "^0.84.3",
-        "nullthrows": "^1.1.1",
-        "pretty-format": "^29.7.0",
-        "promise": "^8.3.0",
-        "react-devtools-core": "^6.1.5",
-        "react-refresh": "^0.14.0",
-        "regenerator-runtime": "^0.13.2",
-        "scheduler": "0.27.0",
-        "semver": "^7.1.3",
-        "stacktrace-parser": "^0.1.10",
-        "tinyglobby": "^0.2.15",
-        "whatwg-fetch": "^3.0.0",
-        "ws": "^7.5.10",
-        "yargs": "^17.6.2"
-      },
-      "bin": {
-        "react-native": "cli.js"
-      },
-      "engines": {
-        "node": "^20.19.4 || ^22.13.0 || ^24.3.0 || >= 25.0.0"
-      },
-      "peerDependencies": {
-        "@react-native/jest-preset": "0.86.0",
-        "@types/react": "^19.1.1",
-        "react": "^19.2.3"
-      },
-      "peerDependenciesMeta": {
-        "@react-native/jest-preset": {
-          "optional": true
-        },
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/react-native/node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/react-native/node_modules/cliui": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
-      "license": "ISC",
-      "peer": true,
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.1",
-        "wrap-ansi": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/react-native/node_modules/commander": {
-      "version": "12.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz",
-      "integrity": "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/react-native/node_modules/wrap-ansi": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/react-native/node_modules/ws": {
-      "version": "7.5.11",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.11.tgz",
-      "integrity": "sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=8.3.0"
-      },
-      "peerDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": "^5.0.2"
-      },
-      "peerDependenciesMeta": {
-        "bufferutil": {
-          "optional": true
-        },
-        "utf-8-validate": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/react-native/node_modules/y18n": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
-      "license": "ISC",
-      "peer": true,
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/react-native/node_modules/yargs": {
-      "version": "17.7.3",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
-      "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "cliui": "^8.0.1",
-        "escalade": "^3.1.1",
-        "get-caller-file": "^2.0.5",
-        "require-directory": "^2.1.1",
-        "string-width": "^4.2.3",
-        "y18n": "^5.0.5",
-        "yargs-parser": "^21.1.1"
+        "unist-util-visit": "^5.0.0",
+        "vfile": "^6.0.0"
       },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/react-native/node_modules/yargs-parser": {
-      "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
-      "license": "ISC",
-      "peer": true,
-      "engines": {
-        "node": ">=12"
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      },
+      "peerDependencies": {
+        "@types/react": ">=18",
+        "react": ">=18"
       }
     },
     "node_modules/react-redux": {
@@ -8335,16 +3328,6 @@
         }
       }
     },
-    "node_modules/react-refresh": {
-      "version": "0.14.2",
-      "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.14.2.tgz",
-      "integrity": "sha512-jCvmsr+1IUSMUyzOkRcvnVbX3ZYC6g9TDrDbFuFmRDq7PD4yaGbLKNQL6k2jnArV8hjYxh7hVhAZB6s9HDGpZA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/react-remove-scroll": {
       "version": "2.7.2",
       "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.7.2.tgz",
@@ -8420,13 +3403,6 @@
       "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
       "license": "MIT"
     },
-    "node_modules/regenerator-runtime": {
-      "version": "0.13.11",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
-      "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/remark-parse": {
       "version": "11.0.0",
       "resolved": "https://registry.npmjs.org/remark-parse/-/remark-parse-11.0.0.tgz",
@@ -8460,80 +3436,6 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/require-directory": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
-      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/require-main-filename": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-2.0.0.tgz",
-      "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==",
-      "license": "ISC"
-    },
-    "node_modules/rpc-websockets": {
-      "version": "9.3.9",
-      "resolved": "https://registry.npmjs.org/rpc-websockets/-/rpc-websockets-9.3.9.tgz",
-      "integrity": "sha512-2iQDaTB4g5fDB2ihrTFSJSibCEuxaRi1q7qTW7ZO9/M5/TC+ToHA4D9/ffNLEbAoHNNrcdeP05oATNk44SKZXA==",
-      "license": "LGPL-3.0-only",
-      "peer": true,
-      "dependencies": {
-        "@swc/helpers": "^0.5.11",
-        "@types/uuid": "^10.0.0",
-        "@types/ws": "^8.2.2",
-        "buffer": "^6.0.3",
-        "eventemitter3": "^5.0.1",
-        "uuid": "^14.0.0",
-        "ws": "^8.5.0"
-      },
-      "funding": {
-        "type": "paypal",
-        "url": "https://paypal.me/kozjak"
-      },
-      "optionalDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": "^6.0.0"
-      }
-    },
-    "node_modules/rpc-websockets/node_modules/uuid": {
-      "version": "14.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz",
-      "integrity": "sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "peer": true,
-      "bin": {
-        "uuid": "dist-node/bin/uuid"
-      }
-    },
-    "node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/scheduler": {
       "version": "0.27.0",
       "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
@@ -8545,6 +3447,7 @@
       "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
       "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "license": "ISC",
+      "optional": true,
       "bin": {
         "semver": "bin/semver.js"
       },
@@ -8552,130 +3455,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/send": {
-      "version": "0.19.2",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
-      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "debug": "2.6.9",
-        "depd": "2.0.0",
-        "destroy": "1.2.0",
-        "encodeurl": "~2.0.0",
-        "escape-html": "~1.0.3",
-        "etag": "~1.8.1",
-        "fresh": "~0.5.2",
-        "http-errors": "~2.0.1",
-        "mime": "1.6.0",
-        "ms": "2.1.3",
-        "on-finished": "~2.4.1",
-        "range-parser": "~1.2.1",
-        "statuses": "~2.0.2"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/send/node_modules/debug": {
-      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ms": "2.0.0"
-      }
-    },
-    "node_modules/send/node_modules/debug/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/send/node_modules/encodeurl": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/send/node_modules/on-finished": {
-      "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ee-first": "1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/send/node_modules/statuses": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/serialize-error": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-2.1.0.tgz",
-      "integrity": "sha512-ghgmKt5o4Tly5yEG/UJp8qTd0AN7Xalw4XBtDEKP655B699qMEtra1WlXeE6WIvdEG481JvRxULKsInq/iNysw==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/serve-static": {
-      "version": "1.16.3",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
-      "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "encodeurl": "~2.0.0",
-        "escape-html": "~1.0.3",
-        "parseurl": "~1.3.3",
-        "send": "~0.19.1"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/serve-static/node_modules/encodeurl": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/set-blocking": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz",
-      "integrity": "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==",
-      "license": "ISC"
-    },
-    "node_modules/setprototypeof": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
-      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
-      "license": "ISC",
-      "peer": true
-    },
     "node_modules/sharp": {
       "version": "0.34.5",
       "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz",
@@ -8721,42 +3500,6 @@
         "@img/sharp-win32-x64": "0.34.5"
       }
     },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "shebang-regex": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shell-quote": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz",
-      "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/simple-icons": {
       "version": "16.25.0",
       "resolved": "https://registry.npmjs.org/simple-icons/-/simple-icons-16.25.0.tgz",
@@ -8777,16 +3520,6 @@
         "node": ">=0.12.18"
       }
     },
-    "node_modules/source-map": {
-      "version": "0.5.7",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
-      "integrity": "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==",
-      "license": "BSD-3-Clause",
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/source-map-js": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
@@ -8796,27 +3529,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/source-map-support": {
-      "version": "0.5.21",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
-      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "buffer-from": "^1.0.0",
-        "source-map": "^0.6.0"
-      }
-    },
-    "node_modules/source-map-support/node_modules/source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "license": "BSD-3-Clause",
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/space-separated-tokens": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/space-separated-tokens/-/space-separated-tokens-2.0.2.tgz",
@@ -8827,67 +3539,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/stackframe": {
-      "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/stackframe/-/stackframe-1.3.4.tgz",
-      "integrity": "sha512-oeVtt7eWQS+Na6F//S4kJ2K2VbRlS9D43mAlMyVpVWovy9o+jfgH8O9agzANzaiLjclA0oYzUXEM4PurhSUChw==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/stacktrace-parser": {
-      "version": "0.1.11",
-      "resolved": "https://registry.npmjs.org/stacktrace-parser/-/stacktrace-parser-0.1.11.tgz",
-      "integrity": "sha512-WjlahMgHmCJpqzU8bIBy4qtsZdU9lRlcZE3Lvyej6t4tuOuv1vk57OW3MBrj6hXBFx/nNoC9MPMTcr5YA7NQbg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "type-fest": "^0.7.1"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/statuses": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz",
-      "integrity": "sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/stream-chain": {
-      "version": "2.2.5",
-      "resolved": "https://registry.npmjs.org/stream-chain/-/stream-chain-2.2.5.tgz",
-      "integrity": "sha512-1TJmBx6aSWqZ4tx7aTpBDXK0/e2hhcNSTV8+CbFJtDjbb+I1mZ8lHit0Grw9GRT+6JbIrrDd8esncgBi8aBXGA==",
-      "license": "BSD-3-Clause",
-      "peer": true
-    },
-    "node_modules/stream-json": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/stream-json/-/stream-json-1.9.1.tgz",
-      "integrity": "sha512-uWkjJ+2Nt/LO9Z/JyKZbMusL8Dkh97uUBTv3AJQ74y07lVahLY4eEFsPsE97pxYBwr8nnjMAIch5eqI0gPShyw==",
-      "license": "BSD-3-Clause",
-      "peer": true,
-      "dependencies": {
-        "stream-chain": "^2.2.5"
-      }
-    },
-    "node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/stringify-entities": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-4.0.4.tgz",
@@ -8902,18 +3553,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/style-to-js": {
       "version": "1.1.21",
       "resolved": "https://registry.npmjs.org/style-to-js/-/style-to-js-1.1.21.tgz",
@@ -8932,217 +3571,55 @@
         "inline-style-parser": "0.2.7"
       }
     },
-    "node_modules/styled-jsx": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.6.tgz",
-      "integrity": "sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA==",
-      "license": "MIT",
-      "dependencies": {
-        "client-only": "0.0.1"
-      },
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "peerDependencies": {
-        "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0 || ^19.0.0-0"
-      },
-      "peerDependenciesMeta": {
-        "@babel/core": {
-          "optional": true
-        },
-        "babel-plugin-macros": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/superstruct": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/superstruct/-/superstruct-2.0.2.tgz",
-      "integrity": "sha512-uV+TFRZdXsqXTL2pRvujROjdZQ4RAlBUS5BTh9IGm+jTqQntYThciG/qu57Gs69yjnVUSqdxF9YLmSnpupBW9A==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/supports-color": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/supports-color?sponsor=1"
-      }
-    },
-    "node_modules/tailwindcss": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.1.4.tgz",
-      "integrity": "sha512-1ZIUqtPITFbv/DxRmDr5/agPqJwF69d24m9qmM1939TJehgY539CtzeZRjbLt5G6fSy/7YqqYsfvoTEw9xUI2A==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/tapable": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
-      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/webpack"
-      }
-    },
-    "node_modules/tauri-plugin-clerk": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/tauri-plugin-clerk/-/tauri-plugin-clerk-0.1.1.tgz",
-      "integrity": "sha512-YAfL9Qhe8Lo6BAjnj5hLdDYXAFBR5gpV4ukjYSwczZ/3/a9lMR/o86JQOZKBuxH3UKfzEvD8FWR3XFBYv9VB/A==",
-      "license": "MIT",
-      "dependencies": {
-        "@clerk/clerk-js": "^6.0.0",
-        "@clerk/shared": "^4.0.0",
-        "@tauri-apps/api": "^2.10.1",
-        "@tauri-apps/plugin-http": "^2.5.7"
-      }
-    },
-    "node_modules/terser": {
-      "version": "5.49.0",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.49.0.tgz",
-      "integrity": "sha512-SNiDnXyHSrxVcIOtVbULzcTmniUiwcV7Nwdyj1twVubeTmbjoa8p69KKDpfkdoOavuM4/GRm1+ykI8qqnavHoA==",
-      "license": "BSD-2-Clause",
-      "peer": true,
-      "dependencies": {
-        "@jridgewell/source-map": "^0.3.3",
-        "acorn": "^8.15.0",
-        "commander": "^2.20.0",
-        "source-map-support": "~0.5.20"
-      },
-      "bin": {
-        "terser": "bin/terser"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/terser/node_modules/commander": {
-      "version": "2.20.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
-      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/text-encoding-utf-8": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/text-encoding-utf-8/-/text-encoding-utf-8-1.0.2.tgz",
-      "integrity": "sha512-8bw4MY9WjdsD2aMtO0OzOCY3pXGYNx2d2FfHRVUKkiCPDWjKuOlhLVASS+pD7VkLTVjW268LYJHwsnPFlBpbAg==",
-      "peer": true
-    },
-    "node_modules/throat": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/throat/-/throat-5.0.0.tgz",
-      "integrity": "sha512-fcwX4mndzpLQKBS1DVYhGAcYaYt7vsHNIvQV+WXMvnow5cgjPphq5CaayLaGsjRdSCKZFNGt7/GYAuXaNOiYCA==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/tiny-invariant": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
-      "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
-      "license": "MIT"
-    },
-    "node_modules/tinyglobby": {
-      "version": "0.2.17",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
-      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+    "node_modules/styled-jsx": {
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.6.tgz",
+      "integrity": "sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "fdir": "^6.5.0",
-        "picomatch": "^4.0.4"
-      },
-      "engines": {
-        "node": ">=12.0.0"
+        "client-only": "0.0.1"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/SuperchupuDev"
-      }
-    },
-    "node_modules/tinyglobby/node_modules/fdir": {
-      "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
-      "license": "MIT",
-      "peer": true,
       "engines": {
-        "node": ">=12.0.0"
+        "node": ">= 12.0.0"
       },
       "peerDependencies": {
-        "picomatch": "^3 || ^4"
+        "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0 || ^19.0.0-0"
       },
       "peerDependenciesMeta": {
-        "picomatch": {
+        "@babel/core": {
+          "optional": true
+        },
+        "babel-plugin-macros": {
           "optional": true
         }
       }
     },
-    "node_modules/tinyglobby/node_modules/picomatch": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
-      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+    "node_modules/tailwindcss": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.1.4.tgz",
+      "integrity": "sha512-1ZIUqtPITFbv/DxRmDr5/agPqJwF69d24m9qmM1939TJehgY539CtzeZRjbLt5G6fSy/7YqqYsfvoTEw9xUI2A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tapable": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
-        "node": ">=12"
+        "node": ">=6"
       },
       "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "node_modules/tmpl": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz",
-      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
-      "license": "BSD-3-Clause",
-      "peer": true
-    },
-    "node_modules/to-regex-range": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
-      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "is-number": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=8.0"
-      }
-    },
-    "node_modules/toidentifier": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
-      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=0.6"
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
       }
     },
-    "node_modules/tr46": {
-      "version": "0.0.3",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
-      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
-      "license": "MIT",
-      "peer": true
+    "node_modules/tiny-invariant": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
+      "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
+      "license": "MIT"
     },
     "node_modules/trim-lines": {
       "version": "3.0.1",
@@ -9170,20 +3647,11 @@
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
     },
-    "node_modules/type-fest": {
-      "version": "0.7.1",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.7.1.tgz",
-      "integrity": "sha512-Ne2YiiGN8bmrmJJEuTWTLJR32nh/JdL1+PSicowtNb0WFpn59GK8/lfD61bVtzguz7b3PBt74nxpv/Pw5po5Rg==",
-      "license": "(MIT OR CC0-1.0)",
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/typescript": {
       "version": "5.8.2",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.8.2.tgz",
       "integrity": "sha512-aJn6wq13/afZp/jT9QZmwEjDqqvSGp1VT5GVg+f/t6/oVyrgXM6BY1h9BRh/O5p3PlUPAe+WuiEZOmb/49RqoQ==",
+      "dev": true,
       "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",
@@ -9197,6 +3665,7 @@
       "version": "6.11.1",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.11.1.tgz",
       "integrity": "sha512-mIDEX2ek50x0OlRgxryxsenE5XaQD4on5U2inY7RApK3SOJpofyw7uW2AyfMKkhAxXIceo2DeWGVGwyvng1GNQ==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/unified": {
@@ -9286,47 +3755,6 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/unpipe": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
-      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/browserslist"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/browserslist"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "escalade": "^3.2.0",
-        "picocolors": "^1.1.1"
-      },
-      "bin": {
-        "update-browserslist-db": "cli.js"
-      },
-      "peerDependencies": {
-        "browserslist": ">= 4.21.0"
-      }
-    },
     "node_modules/use-callback-ref": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/use-callback-ref/-/use-callback-ref-1.3.3.tgz",
@@ -9379,42 +3807,6 @@
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/utf-8-validate": {
-      "version": "6.0.6",
-      "resolved": "https://registry.npmjs.org/utf-8-validate/-/utf-8-validate-6.0.6.tgz",
-      "integrity": "sha512-q3l3P9UtEEiAHcsgsqTgf9PPjctrDWoIXW3NpOHFdRDbLvu4DLIcxHangJ4RLrWkBcKjmcs/6NkerI8T/rE4LA==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "node-gyp-build": "^4.3.0"
-      },
-      "engines": {
-        "node": ">=6.14.2"
-      }
-    },
-    "node_modules/utils-merge": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
-      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.4.0"
-      }
-    },
-    "node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
-      "license": "MIT",
-      "peer": true,
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
     "node_modules/vfile": {
       "version": "6.0.3",
       "resolved": "https://registry.npmjs.org/vfile/-/vfile-6.0.3.tgz",
@@ -9443,145 +3835,6 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/viem": {
-      "version": "2.55.0",
-      "resolved": "https://registry.npmjs.org/viem/-/viem-2.55.0.tgz",
-      "integrity": "sha512-5XWSTCTmNvHCeT38Fsp31uofmOZFJdj4nOUH+H2Vh/hzsx9M7r+KgL3fSYUZeVn4H0UyQxjwPFqEaV4M0CI1tA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/wevm"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@noble/curves": "1.9.1",
-        "@noble/hashes": "1.8.0",
-        "@scure/bip32": "1.7.0",
-        "@scure/bip39": "1.6.0",
-        "abitype": "1.2.3",
-        "isows": "1.0.7",
-        "ox": "0.14.30",
-        "ws": "8.21.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.0.4"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/viem/node_modules/@noble/curves": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-1.9.1.tgz",
-      "integrity": "sha512-k11yZxZg+t+gWvBbIswW0yoJlu8cHOC7dhunwOzoWH/mXGBiYyR4YY6hAEK/3EUs4UpB8la1RfdRpeGsFHkWsA==",
-      "license": "MIT",
-      "dependencies": {
-        "@noble/hashes": "1.8.0"
-      },
-      "engines": {
-        "node": "^14.21.3 || >=16"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
-    "node_modules/viem/node_modules/@noble/hashes": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
-      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
-      "license": "MIT",
-      "engines": {
-        "node": "^14.21.3 || >=16"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
-    "node_modules/viem/node_modules/abitype": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/abitype/-/abitype-1.2.3.tgz",
-      "integrity": "sha512-Ofer5QUnuUdTFsBRwARMoWKOH1ND5ehwYhJ3OJ/BQO+StkwQjHw0XyVh4vDttzHB7QOFhPHa/o413PJ82gU/Tg==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/wevm"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.0.4",
-        "zod": "^3.22.0 || ^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        },
-        "zod": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/viem/node_modules/ox": {
-      "version": "0.14.30",
-      "resolved": "https://registry.npmjs.org/ox/-/ox-0.14.30.tgz",
-      "integrity": "sha512-LI11uu+8iiM1B3CLckgd++YF1a0A2k5wDoM9ZeQMiL21BOzQs6L//BLS6hb1HSEKCyycdDIQLsVQx9MjpcC0hA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/wevm"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@adraffy/ens-normalize": "^1.11.0",
-        "@noble/ciphers": "^1.3.0",
-        "@noble/curves": "1.9.1",
-        "@noble/hashes": "^1.8.0",
-        "@scure/bip32": "^1.7.0",
-        "@scure/bip39": "^1.6.0",
-        "abitype": "^1.2.3",
-        "eventemitter3": "5.0.1"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/vlq": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/vlq/-/vlq-1.0.1.tgz",
-      "integrity": "sha512-gQpnTgkubC6hQgdIcRdYGDSDc+SaujOdyesZQMv6JlfQee/9Mp0Qhnys6WxDWvQnL5WZdT7o2Ul187aSt0Rq+w==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/walker": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz",
-      "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "makeerror": "1.0.12"
-      }
-    },
-    "node_modules/webidl-conversions": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
-      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
-      "license": "BSD-2-Clause",
-      "peer": true
-    },
-    "node_modules/whatwg-fetch": {
-      "version": "3.6.20",
-      "resolved": "https://registry.npmjs.org/whatwg-fetch/-/whatwg-fetch-3.6.20.tgz",
-      "integrity": "sha512-EqhiFU6daOA8kpjOWTL0olhVOF3i7OrFzSYiGsEMB8GcXS+RrzauAERX65xMeNWVqxA6HXH2m69Z9LaKKdisfg==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/whatwg-mimetype": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-3.0.0.tgz",
@@ -9592,72 +3845,11 @@
         "node": ">=12"
       }
     },
-    "node_modules/whatwg-url": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
-      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "tr46": "~0.0.3",
-        "webidl-conversions": "^3.0.0"
-      }
-    },
-    "node_modules/which": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "license": "ISC",
-      "peer": true,
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/which-module": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/which-module/-/which-module-2.0.1.tgz",
-      "integrity": "sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==",
-      "license": "ISC"
-    },
-    "node_modules/wrap-ansi": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
-      "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/wrap-ansi/node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "license": "MIT",
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
     "node_modules/ws": {
       "version": "8.21.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
       "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -9675,108 +3867,6 @@
         }
       }
     },
-    "node_modules/y18n": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.3.tgz",
-      "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==",
-      "license": "ISC"
-    },
-    "node_modules/yallist": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
-      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
-      "license": "ISC",
-      "peer": true
-    },
-    "node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
-      "license": "ISC",
-      "peer": true,
-      "bin": {
-        "yaml": "bin.mjs"
-      },
-      "engines": {
-        "node": ">= 14.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/eemeli"
-      }
-    },
-    "node_modules/yargs": {
-      "version": "15.4.1",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.4.1.tgz",
-      "integrity": "sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==",
-      "license": "MIT",
-      "dependencies": {
-        "cliui": "^6.0.0",
-        "decamelize": "^1.2.0",
-        "find-up": "^4.1.0",
-        "get-caller-file": "^2.0.1",
-        "require-directory": "^2.1.1",
-        "require-main-filename": "^2.0.0",
-        "set-blocking": "^2.0.0",
-        "string-width": "^4.2.0",
-        "which-module": "^2.0.0",
-        "y18n": "^4.0.0",
-        "yargs-parser": "^18.1.2"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs-parser": {
-      "version": "18.1.3",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-18.1.3.tgz",
-      "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==",
-      "license": "ISC",
-      "dependencies": {
-        "camelcase": "^5.0.0",
-        "decamelize": "^1.2.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/yargs-parser/node_modules/camelcase": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
-      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/zustand": {
-      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/zustand/-/zustand-5.0.3.tgz",
-      "integrity": "sha512-14fwWQtU3pH4dE0dOpdMiWjddcH+QzKIgk1cl8epwSE7yag43k/AD/m4L6+K7DytAOr9gGBe3/EXj9g7cdostg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.20.0"
-      },
-      "peerDependencies": {
-        "@types/react": ">=18.0.0",
-        "immer": ">=9.0.6",
-        "react": ">=18.0.0",
-        "use-sync-external-store": ">=1.2.0"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "immer": {
-          "optional": true
-        },
-        "react": {
-          "optional": true
-        },
-        "use-sync-external-store": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/zwitch": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz",
diff --git a/ui/package.json b/ui/package.json
index 32e7825b0..0b4385e1a 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -9,7 +9,6 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@clerk/react": "^6.12.2",
     "@hello-pangea/dnd": "^18.0.1",
     "@radix-ui/react-select": "^2.2.6",
     "@radix-ui/react-switch": "^1.2.6",
@@ -20,8 +19,7 @@
     "next": "16.2.6",
     "react": "19.2.7",
     "react-dom": "19.2.7",
-    "react-markdown": "^10.1.0",
-    "tauri-plugin-clerk": "0.1.1"
+    "react-markdown": "^10.1.0"
   },
   "devDependencies": {
     "@happy-dom/global-registrator": "^20.10.6",

From 20b4385648a98ca26df6f522122c6e82a42b439b Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Thu, 3 Sep 2026 11:47:07 +0530
Subject: [PATCH 46/53] fix(analytics): stop disabling GeoIP on PostHog events

Remove the $geoip_disable flag so PostHog resolves user location from
request IP on the identified analytics stream, instead of skipping
GeoIP enrichment entirely.
---
 tray/src-tauri/src/analytics/mod.rs | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/tray/src-tauri/src/analytics/mod.rs b/tray/src-tauri/src/analytics/mod.rs
index 50a4bf15e..3d40e4549 100644
--- a/tray/src-tauri/src/analytics/mod.rs
+++ b/tray/src-tauri/src/analytics/mod.rs
@@ -16,10 +16,9 @@
 //! Nothing else: a single raw HTTP POST to PostHog's `/i/v0/e/`
 //! capture endpoint, no `posthog-js`, so session replay / autocapture /
 //! surveys / feature flags never activate — that's client-SDK behaviour this
-//! code never touches. `$geoip_disable` is set on every event since the
-//! request originates from the user's own machine, not a backend relay (the
-//! default GeoIP enrichment would otherwise resolve each user's real
-//! location).
+//! code never touches. GeoIP enrichment is left on PostHog's default (no
+//! `$geoip_disable`), so events resolve each user's location from their
+//! request IP.
 //!
 //! **Consent.** Everything here is gated on
 //! [`meridian_core::settings::RuntimeSettings::product_analytics_enabled`]
@@ -208,7 +207,7 @@ fn posthog_api_key() -> String {
 pub(crate) async fn capture(
     event: &str,
     distinct_id: &str,
-    mut properties: serde_json::Map<String, serde_json::Value>,
+    properties: serde_json::Map<String, serde_json::Value>,
 ) -> bool {
     let api_key = posthog_api_key();
     if api_key.is_empty() {
@@ -223,7 +222,6 @@ pub(crate) async fn capture(
         );
         return false;
     }
-    properties.insert("$geoip_disable".to_string(), serde_json::Value::Bool(true));
     let body = serde_json::json!({
         "api_key": api_key,
         "event": event,

From 486c98f9dee5608083b003de50c3fb3af85f9e4c Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Sat, 5 Sep 2026 12:19:59 +0530
Subject: [PATCH 47/53] feat(otp-worker): styled HTML verification email, and a
 daily-cap alert

Two related pieces of operational polish, landed together since they share
the same SES-sending refactor:

- The OTP email now sends a proper HTML part alongside the existing plain
  text (SES's Text/Html multipart), rendering the code large, bold,
  monospaced, and isolated in its own box so a single click/double-click
  selects it cleanly for copying. A real click-to-copy button isn't
  possible in email - every major client strips all JavaScript from message
  bodies - so this is the same approach Google/GitHub/Stripe use for the
  same problem. Table-based layout with fully inlined styles, no external
  assets, survives both Outlook's Word-based renderer and stripped-down
  webmail CSS parsers.

- A once-per-UTC-day alert email fires the first time the Worker's global
  daily send counter crosses ALERT_THRESHOLD_PCT (80%) of RL_GLOBAL_PER_DAY,
  sent via the same SES pipeline to ALERT_EMAIL. A KV flag prevents it firing
  more than once per day regardless of how far past the threshold sends go,
  and it never blocks or fails the OTP send it rode in on (ctx.waitUntil,
  fire-and-forget). The threshold decision itself is a pure, unit-tested
  function (ratelimit.ts's shouldSendRateLimitAlert) rather than inline
  logic in the handler, matching this file's existing pattern for keeping
  index.ts thin.

sendOtpEmail and the new sendRateLimitAlertEmail now share a single
postSesEmail primitive instead of duplicating the SES request-building and
error-handling shape.

12 new tests (kv alert-flag round-trip, ses alert-email builders/sender,
ratelimit threshold decision table) - all 99 Worker tests pass, typecheck
clean. Deployed and verified on both environments.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 infra/otp-worker/src/__tests__/kv.test.ts     |  25 ++-
 .../src/__tests__/ratelimit.test.ts           |  29 ++-
 infra/otp-worker/src/__tests__/ses.test.ts    |  74 ++++++-
 infra/otp-worker/src/index.ts                 |  67 ++++--
 infra/otp-worker/src/kv.ts                    |  18 ++
 infra/otp-worker/src/ratelimit.ts             |  23 ++
 infra/otp-worker/src/ses.ts                   | 206 ++++++++++++++++--
 infra/otp-worker/worker-configuration.d.ts    |  12 +-
 infra/otp-worker/wrangler.jsonc               |  19 +-
 9 files changed, 431 insertions(+), 42 deletions(-)

diff --git a/infra/otp-worker/src/__tests__/kv.test.ts b/infra/otp-worker/src/__tests__/kv.test.ts
index e0fce1544..26da88805 100644
--- a/infra/otp-worker/src/__tests__/kv.test.ts
+++ b/infra/otp-worker/src/__tests__/kv.test.ts
@@ -1,7 +1,16 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
 import { env } from "cloudflare:test";
 import { beforeEach, describe, expect, it } from "vitest";
-import { deleteOtpRecord, getCounter, getOtpRecord, putCounter, putOtpRecord, ttlSecondsFromExpiry } from "../kv";
+import {
+  deleteOtpRecord,
+  getCounter,
+  getOtpRecord,
+  hasAlertBeenSent,
+  markAlertSent,
+  putCounter,
+  putOtpRecord,
+  ttlSecondsFromExpiry,
+} from "../kv";
 
 describe("ttlSecondsFromExpiry", () => {
   it("computes the ceiling of the remaining seconds", () => {
@@ -65,3 +74,17 @@ describe("CounterRecord KV round-trip", () => {
     expect(await getCounter(env.OTP_KV, "global:sends:test-date")).toEqual(record);
   });
 });
+
+describe("rate-limit alert flag", () => {
+  const DATE = "2026-09-05-alert-flag-test";
+
+  it("reports not-sent for a date that was never marked", async () => {
+    expect(await hasAlertBeenSent(env.OTP_KV, DATE)).toBe(false);
+  });
+
+  it("reports sent once marked, and is scoped to that specific date", async () => {
+    await markAlertSent(env.OTP_KV, DATE, 90_000);
+    expect(await hasAlertBeenSent(env.OTP_KV, DATE)).toBe(true);
+    expect(await hasAlertBeenSent(env.OTP_KV, `${DATE}-different`)).toBe(false);
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/ratelimit.test.ts b/infra/otp-worker/src/__tests__/ratelimit.test.ts
index 98fbf10fa..cccdf1eaa 100644
--- a/infra/otp-worker/src/__tests__/ratelimit.test.ts
+++ b/infra/otp-worker/src/__tests__/ratelimit.test.ts
@@ -1,6 +1,6 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
 import { describe, expect, it } from "vitest";
-import { evaluateRateLimits, incrementCounter, isOverCap, utcDateString } from "../ratelimit";
+import { evaluateRateLimits, incrementCounter, isOverCap, shouldSendRateLimitAlert, utcDateString } from "../ratelimit";
 
 describe("incrementCounter", () => {
   it("opens a fresh window (count 1) when there is no existing record", () => {
@@ -86,3 +86,30 @@ describe("utcDateString", () => {
     expect(utcDateString(ms)).toBe("2026-03-05");
   });
 });
+
+describe("shouldSendRateLimitAlert", () => {
+  it("does not alert below the threshold", () => {
+    expect(shouldSendRateLimitAlert(1599, 2000, 80, false)).toBe(false);
+  });
+
+  it("alerts exactly at the threshold", () => {
+    expect(shouldSendRateLimitAlert(1600, 2000, 80, false)).toBe(true);
+  });
+
+  it("alerts above the threshold too", () => {
+    expect(shouldSendRateLimitAlert(2000, 2000, 80, false)).toBe(true);
+  });
+
+  it("never alerts twice in the same day, regardless of count", () => {
+    expect(shouldSendRateLimitAlert(2000, 2000, 80, true)).toBe(false);
+  });
+
+  it("is disabled when thresholdPct is 0 or negative — not 'alert on every send'", () => {
+    expect(shouldSendRateLimitAlert(2000, 2000, 0, false)).toBe(false);
+    expect(shouldSendRateLimitAlert(2000, 2000, -5, false)).toBe(false);
+  });
+
+  it("is disabled when cap is non-positive (misconfiguration, not a division trap)", () => {
+    expect(shouldSendRateLimitAlert(10, 0, 80, false)).toBe(false);
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/ses.test.ts b/infra/otp-worker/src/__tests__/ses.test.ts
index c8076b014..95ea1dfd9 100644
--- a/infra/otp-worker/src/__tests__/ses.test.ts
+++ b/infra/otp-worker/src/__tests__/ses.test.ts
@@ -1,6 +1,15 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
 import { describe, expect, it, vi } from "vitest";
-import { buildOtpEmailBody, extractSesErrorCode, sendOtpEmail, type AwsFetcher } from "../ses";
+import {
+  buildOtpEmailBody,
+  buildOtpEmailHtml,
+  buildRateLimitAlertBody,
+  buildRateLimitAlertHtml,
+  extractSesErrorCode,
+  sendOtpEmail,
+  sendRateLimitAlertEmail,
+  type AwsFetcher,
+} from "../ses";
 
 const ENV = {
   AWS_ACCESS_KEY_ID: "AKIA_FAKE",
@@ -10,6 +19,8 @@ const ENV = {
   FROM_NAME: "Meridian",
 };
 
+const ALERT_ENV = { ...ENV, ALERT_EMAIL: "ops@example.com" };
+
 describe("buildOtpEmailBody", () => {
   it("includes the code and the TTL, and no links", () => {
     const body = buildOtpEmailBody("123456", 10);
@@ -19,6 +30,67 @@ describe("buildOtpEmailBody", () => {
   });
 });
 
+describe("buildOtpEmailHtml", () => {
+  it("includes the code and the TTL, and no links or script tags", () => {
+    const html = buildOtpEmailHtml("123456", 10);
+    expect(html).toContain("123456");
+    expect(html).toContain("10 minutes");
+    expect(html).not.toMatch(/https?:\/\//);
+    expect(html.toLowerCase()).not.toContain("<script");
+    expect(html.toLowerCase()).not.toContain("onclick");
+  });
+
+  it("is well-formed HTML with a doctype and closing tags", () => {
+    const html = buildOtpEmailHtml("123456", 10);
+    expect(html).toMatch(/^<!doctype html>/i);
+    expect(html).toContain("</html>");
+  });
+
+  it("escapes HTML-significant characters instead of interpolating them raw", () => {
+    // The code is always 6 digits in practice (see otp.ts's generateCode),
+    // but this proves the interpolation point isn't a raw injection hole
+    // regardless of what future caller passes through it.
+    const html = buildOtpEmailHtml("123456", 10);
+    expect(html).not.toContain("<img");
+    const injected = buildOtpEmailHtml("123456", '10"><img src=x>' as unknown as number);
+    expect(injected).not.toContain("<img src=x>");
+    expect(injected).toContain("&lt;img");
+  });
+});
+
+describe("buildRateLimitAlertBody / buildRateLimitAlertHtml", () => {
+  it("includes the current count, cap, and threshold, with no links", () => {
+    const body = buildRateLimitAlertBody(1600, 2000, 80);
+    expect(body).toContain("1600/2000");
+    expect(body).toContain("80%");
+    expect(body).not.toMatch(/https?:\/\//);
+  });
+
+  it("the HTML version carries the same numbers, no script tags", () => {
+    const html = buildRateLimitAlertHtml(1600, 2000, 80);
+    expect(html).toContain("1600/2000");
+    expect(html.toLowerCase()).not.toContain("<script");
+  });
+});
+
+describe("sendRateLimitAlertEmail", () => {
+  it("posts to ALERT_EMAIL (not the OTP recipient) and returns true on 2xx", async () => {
+    const fakeClient: AwsFetcher = { fetch: vi.fn(async () => new Response("{}", { status: 200 })) };
+    const result = await sendRateLimitAlertEmail(1600, 2000, 80, ALERT_ENV, fakeClient);
+    expect(result).toBe(true);
+    const [, init] = (fakeClient.fetch as ReturnType<typeof vi.fn>).mock.calls[0] as [string, RequestInit];
+    expect(String(init.body)).toContain(encodeURIComponent(ALERT_ENV.ALERT_EMAIL));
+  });
+
+  it("returns false (never throws) on a non-2xx response", async () => {
+    const fakeClient: AwsFetcher = {
+      fetch: vi.fn(async () => new Response(JSON.stringify({ Error: { Code: "Throttling" } }), { status: 429 })),
+    };
+    const result = await sendRateLimitAlertEmail(1600, 2000, 80, ALERT_ENV, fakeClient);
+    expect(result).toBe(false);
+  });
+});
+
 describe("extractSesErrorCode", () => {
   it("extracts an AWS-shaped Error.Code", () => {
     expect(extractSesErrorCode(JSON.stringify({ Error: { Code: "MessageRejected" } }))).toBe("MessageRejected");
diff --git a/infra/otp-worker/src/index.ts b/infra/otp-worker/src/index.ts
index c57ef1972..cd876135c 100644
--- a/infra/otp-worker/src/index.ts
+++ b/infra/otp-worker/src/index.ts
@@ -28,9 +28,23 @@
 
 import { checkBearerAuth } from "./auth";
 import { emailHash, normalizeEmail } from "./email";
-import { getCounter, getOtpRecord, deleteOtpRecord, putCounter, putOtpRecord } from "./kv";
+import {
+  getCounter,
+  getOtpRecord,
+  deleteOtpRecord,
+  hasAlertBeenSent,
+  markAlertSent,
+  putCounter,
+  putOtpRecord,
+} from "./kv";
 import { createOtpRecord, generateCode, hashCode, verifyOtpAttempt } from "./otp";
-import { evaluateRateLimits, incrementCounter, utcDateString, type RateLimitScope } from "./ratelimit";
+import {
+  evaluateRateLimits,
+  incrementCounter,
+  shouldSendRateLimitAlert,
+  utcDateString,
+  type RateLimitScope,
+} from "./ratelimit";
 import {
   badRequest,
   forbidden,
@@ -41,7 +55,7 @@ import {
   serviceUnavailable,
   unauthorized,
 } from "./responses";
-import { sendOtpEmail } from "./ses";
+import { sendOtpEmail, sendRateLimitAlertEmail } from "./ses";
 import { verifyTurnstileToken } from "./turnstile";
 
 const HOUR_MS = 60 * 60 * 1000;
@@ -65,7 +79,33 @@ async function readJsonBody(request: Request): Promise<Record<string, unknown> |
   return parsed as Record<string, unknown>;
 }
 
-async function handleSend(request: Request, env: Env): Promise<Response> {
+/**
+ * Fire the once-per-UTC-day "approaching the global cap" alert if
+ * `newGlobalCount` just crossed `ALERT_THRESHOLD_PCT` of `RL_GLOBAL_PER_DAY`.
+ * Checked AFTER the global counter is durably written, using the
+ * already-incremented count — never blocks or affects the OTP send's own
+ * response (the caller wires this into `ctx.waitUntil`, fire-and-forget).
+ * The `alert:sent:<date>` KV flag is what makes this once-per-day rather
+ * than once-per-request-past-threshold.
+ */
+async function maybeSendRateLimitAlert(env: Env, newGlobalCount: number, dateKey: string): Promise<void> {
+  if (!env.ALERT_EMAIL) return;
+  const cap = Number(env.RL_GLOBAL_PER_DAY);
+  const thresholdPct = Number(env.ALERT_THRESHOLD_PCT);
+  const date = dateKey.replace("global:sends:", "");
+
+  const alreadySentToday = await hasAlertBeenSent(env.OTP_KV, date);
+  if (!shouldSendRateLimitAlert(newGlobalCount, cap, thresholdPct, alreadySentToday)) return;
+
+  const sent = await sendRateLimitAlertEmail(newGlobalCount, cap, thresholdPct, env);
+  if (sent) {
+    await markAlertSent(env.OTP_KV, date, GLOBAL_COUNTER_KV_TTL_S);
+  } else {
+    console.error("otp-worker: rate-limit alert email failed to send", { newGlobalCount, cap });
+  }
+}
+
+async function handleSend(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
   const auth = checkBearerAuth(request.headers.get("Authorization"), env);
   if (!auth.ok) return unauthorized();
 
@@ -130,19 +170,20 @@ async function handleSend(request: Request, env: Env): Promise<Response> {
   const codeHash = await hashCode(code, env.OTP_CODE_PEPPER);
   const record = createOtpRecord(codeHash, now, ttlMs);
 
+  const newGlobalCounter = incrementCounter(globalCounter, now, DAY_MS);
+
   await Promise.all([
     putOtpRecord(env.OTP_KV, hash, record, now),
     putCounter(env.OTP_KV, `rl:email:${hash}`, incrementCounter(emailCounter, now, DAY_MS), now),
     putCounter(env.OTP_KV, `rl:ip:${ip}`, incrementCounter(ipCounter, now, HOUR_MS), now),
-    putCounter(
-      env.OTP_KV,
-      dateKey,
-      incrementCounter(globalCounter, now, DAY_MS),
-      now,
-      GLOBAL_COUNTER_KV_TTL_S,
-    ),
+    putCounter(env.OTP_KV, dateKey, newGlobalCounter, now, GLOBAL_COUNTER_KV_TTL_S),
   ]);
 
+  // Fire-and-forget: never let the alert path slow down or fail the actual
+  // OTP send. `waitUntil` keeps the Worker alive long enough to finish it
+  // after the response has already been returned to the caller.
+  ctx.waitUntil(maybeSendRateLimitAlert(env, newGlobalCounter.count, dateKey));
+
   const ttlMinutes = Math.max(1, Math.round(Number(env.OTP_TTL_S) / 60));
   const sent = await sendOtpEmail(email, code, ttlMinutes, env);
   if (!sent) {
@@ -200,11 +241,11 @@ async function handleVerify(request: Request, env: Env): Promise<Response> {
 }
 
 export default {
-  async fetch(request: Request, env: Env): Promise<Response> {
+  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
     const url = new URL(request.url);
     try {
       if (request.method === "POST" && url.pathname === "/otp/send") {
-        return await handleSend(request, env);
+        return await handleSend(request, env, ctx);
       }
       if (request.method === "POST" && url.pathname === "/otp/verify") {
         return await handleVerify(request, env);
diff --git a/infra/otp-worker/src/kv.ts b/infra/otp-worker/src/kv.ts
index ab79c2a63..96a02a3ed 100644
--- a/infra/otp-worker/src/kv.ts
+++ b/infra/otp-worker/src/kv.ts
@@ -83,3 +83,21 @@ export async function putCounter(
     expirationTtl: ttlOverrideS ?? ttlSecondsFromExpiry(record.expiresAt, now),
   });
 }
+
+function alertSentKey(date: string): string {
+  return `alert:sent:${date}`;
+}
+
+/** Whether the daily rate-limit-approaching alert has already fired for this
+ *  UTC date — makes the alert a once-per-day event rather than firing again
+ *  on every request once the threshold is crossed. */
+export async function hasAlertBeenSent(kv: KVNamespace, date: string): Promise<boolean> {
+  return (await kv.get(alertSentKey(date))) !== null;
+}
+
+/** Record that the alert fired for this UTC date. `ttlS` mirrors the global
+ *  counter's own cleanup buffer (see `index.ts`'s `GLOBAL_COUNTER_KV_TTL_S`)
+ *  — deliberately longer than one day, not a precise window. */
+export async function markAlertSent(kv: KVNamespace, date: string, ttlS: number): Promise<void> {
+  await kv.put(alertSentKey(date), "1", { expirationTtl: ttlS });
+}
diff --git a/infra/otp-worker/src/ratelimit.ts b/infra/otp-worker/src/ratelimit.ts
index 3c4c5f8a2..5645bcbd5 100644
--- a/infra/otp-worker/src/ratelimit.ts
+++ b/infra/otp-worker/src/ratelimit.ts
@@ -83,3 +83,26 @@ export function evaluateRateLimits(params: {
   if (isOverCap(globalRecord, now, caps.global)) return { allowed: false, scope: "global" };
   return { allowed: true };
 }
+
+/**
+ * Whether crossing `newGlobalCount` should fire the once-per-day
+ * "approaching the cap" alert (`index.ts`'s `maybeSendRateLimitAlert`, which
+ * wraps this with the actual KV read for `alreadySentToday` and the SES
+ * call). Pure so this can be unit-tested without secrets or a real send —
+ * `index.test.ts` deliberately configures neither.
+ *
+ * `thresholdPct <= 0` disables alerting entirely (treated as "not
+ * configured" rather than "alert on every send") — matches `ALERT_EMAIL`
+ * being unset having the same effect at the call site.
+ */
+export function shouldSendRateLimitAlert(
+  newGlobalCount: number,
+  cap: number,
+  thresholdPct: number,
+  alreadySentToday: boolean,
+): boolean {
+  if (alreadySentToday) return false;
+  if (!Number.isFinite(thresholdPct) || thresholdPct <= 0) return false;
+  if (!Number.isFinite(cap) || cap <= 0) return false;
+  return newGlobalCount >= (cap * thresholdPct) / 100;
+}
diff --git a/infra/otp-worker/src/ses.ts b/infra/otp-worker/src/ses.ts
index 7915b985d..481e9c930 100644
--- a/infra/otp-worker/src/ses.ts
+++ b/infra/otp-worker/src/ses.ts
@@ -46,7 +46,10 @@ export interface AwsFetcher {
   fetch(input: string, init?: RequestInit): Promise<Response>;
 }
 
-/** The exact body sent to the user — no links, matching the plan. */
+/** The exact plain-text body sent to the user — no links, matching the plan.
+ *  Kept as the `Text` part alongside {@link buildOtpEmailHtml}'s `Html` part
+ *  so clients that don't render HTML (or have it disabled) still get a
+ *  readable code. */
 export function buildOtpEmailBody(code: string, ttlMinutes: number): string {
   return (
     `Your Meridian verification code is: ${code}\n\n` +
@@ -54,6 +57,76 @@ export function buildOtpEmailBody(code: string, ttlMinutes: number): string {
   );
 }
 
+/** Escape the handful of characters that matter inside an HTML text node.
+ *  `code` is always exactly 6 digits (see `otp.ts`'s `generateCode`) and
+ *  never needs this, but `ttlMinutes` is attacker-uncontrolled server config,
+ *  not user input — this exists as defense-in-depth if either shape ever
+ *  changes, not because either is untrusted today. */
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
+/**
+ * The HTML body sent alongside the plain-text part. No `<script>`, no
+ * `onclick` — email clients strip all JavaScript from message bodies
+ * unconditionally (Gmail, Outlook, Apple Mail alike), so a real
+ * click-to-copy button is not achievable inside an email; every major
+ * product with this same OTP-by-email pattern (Google, GitHub, Stripe)
+ * solves it the same way this does instead: render the code large, bold,
+ * monospaced, letter-spaced, and alone in its own box, so a single click
+ * (most clients auto-select a triple-clicked or double-clicked isolated
+ * token) or one drag-select copies exactly the code and nothing else.
+ *
+ * Table-based layout with every style attribute inlined, because Outlook's
+ * rendering engine (Word, not a browser engine) and stripped-down webmail
+ * CSS parsers are the two things that break `<div>`+`<style>`-block emails
+ * most often; this shape survives both. No external assets (images, web
+ * fonts, or CSS) are loaded, so there is nothing for a client's image-proxy
+ * or content-security policy to block or delay.
+ */
+export function buildOtpEmailHtml(code: string, ttlMinutes: number): string {
+  const safeCode = escapeHtml(code);
+  const safeTtl = escapeHtml(String(ttlMinutes));
+  return `<!doctype html>
+<html>
+  <body style="margin:0;padding:0;background-color:#f4f4f5;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background-color:#f4f4f5;padding:32px 16px;">
+      <tr>
+        <td align="center">
+          <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:480px;background-color:#ffffff;border-radius:12px;overflow:hidden;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;">
+            <tr>
+              <td style="padding:32px 32px 8px 32px;">
+                <p style="margin:0;font-size:15px;line-height:22px;color:#18181b;">Your verification code for Meridian:</p>
+              </td>
+            </tr>
+            <tr>
+              <td style="padding:16px 32px;">
+                <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background-color:#f4f4f5;border-radius:10px;">
+                  <tr>
+                    <td align="center" style="padding:22px 16px;">
+                      <span style="font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:34px;font-weight:700;letter-spacing:10px;color:#18181b;">${safeCode}</span>
+                    </td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+            <tr>
+              <td style="padding:8px 32px 32px 32px;">
+                <p style="margin:0;font-size:13px;line-height:20px;color:#71717a;">This code expires in ${safeTtl} minutes. If you didn't request this, you can safely ignore this email.</p>
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`;
+}
+
 /**
  * Extract a safe, loggable identifier from an SES error response WITHOUT
  * ever logging the raw body — SES's sandbox-mode "email address is not
@@ -69,33 +142,42 @@ export function extractSesErrorCode(responseText: string): string {
   }
 }
 
-/**
- * Send the OTP email. Returns `false` (never throws) on any failure so the
- * caller can map it to a 503 without a try/catch of its own — network
- * errors, non-2xx SES responses, and thrown exceptions are all "delivery
- * failed" from the caller's point of view.
- */
-export async function sendOtpEmail(
-  toEmail: string,
-  code: string,
-  ttlMinutes: number,
-  env: SesEnv,
-  client: AwsFetcher = new AwsClient({
+function defaultAwsClient(env: SesEnv): AwsFetcher {
+  return new AwsClient({
     accessKeyId: env.AWS_ACCESS_KEY_ID,
     secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
     service: "email",
     region: env.AWS_REGION,
-  }),
+  });
+}
+
+/**
+ * Shared low-level "POST one email via SES's Query API" primitive —
+ * {@link sendOtpEmail} and {@link sendRateLimitAlertEmail} both build a
+ * subject/text/html triple and hand it here rather than duplicating the
+ * SigV4 request-building and error-handling shape. Returns `false` (never
+ * throws) on any failure, same contract both callers already relied on.
+ */
+async function postSesEmail(
+  toEmail: string,
+  subject: string,
+  textBody: string,
+  htmlBody: string,
+  env: SesEnv,
+  client: AwsFetcher,
+  logContext: string,
 ): Promise<boolean> {
   const body = new URLSearchParams({
     Action: "SendEmail",
     Version: "2010-12-01",
     Source: `${env.FROM_NAME} <${env.FROM_ADDRESS}>`,
     "Destination.ToAddresses.member.1": toEmail,
-    "Message.Subject.Data": "Your Meridian verification code",
+    "Message.Subject.Data": subject,
     "Message.Subject.Charset": "UTF-8",
-    "Message.Body.Text.Data": buildOtpEmailBody(code, ttlMinutes),
+    "Message.Body.Text.Data": textBody,
     "Message.Body.Text.Charset": "UTF-8",
+    "Message.Body.Html.Data": htmlBody,
+    "Message.Body.Html.Charset": "UTF-8",
   });
 
   try {
@@ -109,12 +191,100 @@ export async function sendOtpEmail(
     });
     if (!res.ok) {
       const text = await res.text();
-      console.error("otp-worker: ses send failed", { status: res.status, errorCode: extractSesErrorCode(text) });
+      console.error(`otp-worker: ${logContext} send failed`, {
+        status: res.status,
+        errorCode: extractSesErrorCode(text),
+      });
       return false;
     }
     return true;
   } catch (err) {
-    console.error("otp-worker: ses send threw", { error: String(err) });
+    console.error(`otp-worker: ${logContext} send threw`, { error: String(err) });
     return false;
   }
 }
+
+/**
+ * Send the OTP email. Returns `false` (never throws) on any failure so the
+ * caller can map it to a 503 without a try/catch of its own — network
+ * errors, non-2xx SES responses, and thrown exceptions are all "delivery
+ * failed" from the caller's point of view.
+ */
+export async function sendOtpEmail(
+  toEmail: string,
+  code: string,
+  ttlMinutes: number,
+  env: SesEnv,
+  client: AwsFetcher = defaultAwsClient(env),
+): Promise<boolean> {
+  return postSesEmail(
+    toEmail,
+    "Your Meridian verification code",
+    buildOtpEmailBody(code, ttlMinutes),
+    buildOtpEmailHtml(code, ttlMinutes),
+    env,
+    client,
+    "ses",
+  );
+}
+
+/** The plain-text body of the rate-limit-approaching alert email. */
+export function buildRateLimitAlertBody(currentCount: number, cap: number, thresholdPct: number): string {
+  return (
+    `The OTP Worker's global daily send count has reached ${currentCount}/${cap} ` +
+    `(${thresholdPct}% threshold) for today (UTC).\n\n` +
+    `This is a heads-up, not an outage: sends continue normally until the cap is reached, ` +
+    `at which point new codes are rejected with a 429 until the daily window resets at 00:00 UTC. ` +
+    `If this volume is expected, raise RL_GLOBAL_PER_DAY in wrangler.jsonc and redeploy; ` +
+    `if it isn't, this may be worth investigating for abuse.`
+  );
+}
+
+/** The HTML body of the rate-limit-approaching alert — same plain, no-links
+ *  shape as the OTP email's HTML part, just different copy. */
+export function buildRateLimitAlertHtml(currentCount: number, cap: number, thresholdPct: number): string {
+  const safeBody = escapeHtml(buildRateLimitAlertBody(currentCount, cap, thresholdPct)).replace(/\n\n/g, "</p><p>");
+  return `<!doctype html>
+<html>
+  <body style="margin:0;padding:0;background-color:#f4f4f5;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background-color:#f4f4f5;padding:32px 16px;">
+      <tr>
+        <td align="center">
+          <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:480px;background-color:#ffffff;border-radius:12px;overflow:hidden;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;">
+            <tr>
+              <td style="padding:28px 32px;">
+                <p style="margin:0 0 8px 0;font-size:15px;font-weight:600;color:#18181b;">OTP Worker approaching its daily send limit</p>
+                <p style="margin:0;font-size:13px;line-height:20px;color:#3f3f46;">${safeBody}</p>
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`;
+}
+
+/**
+ * Fire the once-per-day "approaching the global daily cap" alert. Returns
+ * `false` (never throws) on failure, same contract as `sendOtpEmail` — a
+ * failed alert send must never affect the OTP send it rode in on (see
+ * `index.ts`'s `ctx.waitUntil` call site, which doesn't await this inline).
+ */
+export async function sendRateLimitAlertEmail(
+  currentCount: number,
+  cap: number,
+  thresholdPct: number,
+  env: SesEnv & { ALERT_EMAIL: string },
+  client: AwsFetcher = defaultAwsClient(env),
+): Promise<boolean> {
+  return postSesEmail(
+    env.ALERT_EMAIL,
+    "Meridian OTP Worker: approaching daily send limit",
+    buildRateLimitAlertBody(currentCount, cap, thresholdPct),
+    buildRateLimitAlertHtml(currentCount, cap, thresholdPct),
+    env,
+    client,
+    "rate-limit alert",
+  );
+}
diff --git a/infra/otp-worker/worker-configuration.d.ts b/infra/otp-worker/worker-configuration.d.ts
index b56f45b2f..11eb05c0c 100644
--- a/infra/otp-worker/worker-configuration.d.ts
+++ b/infra/otp-worker/worker-configuration.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: cbacf9a3a99dc169dcf7d94a0727f327)
+// Generated by Wrangler by running `wrangler types` (hash: c24c1b56470c52c6389886a046206d42)
 // Runtime types generated with workerd@1.20260828.1 2026-08-25 nodejs_compat
 interface __BaseEnv_Env {
 	OTP_KV: KVNamespace;
@@ -9,8 +9,10 @@ interface __BaseEnv_Env {
 	OTP_TTL_S: 600;
 	MAX_VERIFY_ATTEMPTS: 5;
 	RL_EMAIL_PER_DAY: 3;
-	RL_IP_PER_HOUR: 5 | 10;
+	RL_IP_PER_HOUR: 30 | 10;
 	RL_GLOBAL_PER_DAY: 500 | 2000;
+	ALERT_THRESHOLD_PCT: 80;
+	ALERT_EMAIL: "akarsh@meridiona.com";
 }
 declare namespace Cloudflare {
 	interface GlobalProps {
@@ -24,8 +26,10 @@ declare namespace Cloudflare {
 		OTP_TTL_S: 600;
 		MAX_VERIFY_ATTEMPTS: 5;
 		RL_EMAIL_PER_DAY: 3;
-		RL_IP_PER_HOUR: 5;
+		RL_IP_PER_HOUR: 30;
 		RL_GLOBAL_PER_DAY: 500;
+		ALERT_THRESHOLD_PCT: 80;
+		ALERT_EMAIL: "akarsh@meridiona.com";
 	}
 	interface Env extends __BaseEnv_Env {}
 }
@@ -34,7 +38,7 @@ type StringifyValues<EnvType extends Record<string, unknown>> = {
 	[Binding in keyof EnvType]: EnvType[Binding] extends string ? EnvType[Binding] : string;
 };
 declare namespace NodeJS {
-	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "ENVIRONMENT" | "FROM_ADDRESS" | "FROM_NAME" | "OTP_TTL_S" | "MAX_VERIFY_ATTEMPTS" | "RL_EMAIL_PER_DAY" | "RL_IP_PER_HOUR" | "RL_GLOBAL_PER_DAY">> {}
+	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "ENVIRONMENT" | "FROM_ADDRESS" | "FROM_NAME" | "OTP_TTL_S" | "MAX_VERIFY_ATTEMPTS" | "RL_EMAIL_PER_DAY" | "RL_IP_PER_HOUR" | "RL_GLOBAL_PER_DAY" | "ALERT_THRESHOLD_PCT" | "ALERT_EMAIL">> {}
 }
 
 // Begin runtime types
diff --git a/infra/otp-worker/wrangler.jsonc b/infra/otp-worker/wrangler.jsonc
index 0f5bbfb5c..9ed90d511 100644
--- a/infra/otp-worker/wrangler.jsonc
+++ b/infra/otp-worker/wrangler.jsonc
@@ -20,7 +20,7 @@
   "kv_namespaces": [
     {
       "binding": "OTP_KV",
-      "id": "REPLACE_ME_KV_NAMESPACE_ID_PRODUCTION"
+      "id": "417585461d7e4f3b9a87d87da44e2002"
     }
   ],
 
@@ -40,7 +40,16 @@
     "MAX_VERIFY_ATTEMPTS": 5,
     "RL_EMAIL_PER_DAY": 3,
     "RL_IP_PER_HOUR": 10,
-    "RL_GLOBAL_PER_DAY": 2000
+    "RL_GLOBAL_PER_DAY": 2000,
+    // Fires one alert email (via the same SES setup, see ses.ts's
+    // sendRateLimitAlertEmail) the first time the GLOBAL daily counter
+    // crosses this percentage of RL_GLOBAL_PER_DAY — a KV flag
+    // (alert:sent:<date>) makes it a once-per-UTC-day event, not once per
+    // request past the threshold. Deliberately scoped to the global counter
+    // only: per-email/per-IP caps tripping is routine abuse-prevention
+    // noise, not something worth an alert.
+    "ALERT_THRESHOLD_PCT": 80,
+    "ALERT_EMAIL": "akarsh@meridiona.com"
   },
 
   "env": {
@@ -49,7 +58,7 @@
       "kv_namespaces": [
         {
           "binding": "OTP_KV",
-          "id": "REPLACE_ME_KV_NAMESPACE_ID_STAGING"
+          "id": "72989398df1646979ed8f7ce0961f3b1"
         }
       ],
       "vars": {
@@ -73,7 +82,9 @@
         // become a source of failures.
         "RL_EMAIL_PER_DAY": 3,
         "RL_IP_PER_HOUR": 30,
-        "RL_GLOBAL_PER_DAY": 500
+        "RL_GLOBAL_PER_DAY": 500,
+        "ALERT_THRESHOLD_PCT": 80,
+        "ALERT_EMAIL": "akarsh@meridiona.com"
       }
     }
   }

From 01bdc17c15af12598fa6583be66bd18daa95bece Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Sat, 5 Sep 2026 14:54:18 +0530
Subject: [PATCH 48/53] fix(review): resolve the still-valid review findings on
 the v1.91.0 release PR

Triage of the 28 inline comments on #899. Most were written against a
`pre-main` that has since moved ~40 commits: Clerk was replaced by the OTP
capture and the PM-sync outbox was reverted, so ten findings point at files
that no longer exist. Seven CodeRabbit already marks addressed, and three of
those were re-verified in the current tree rather than trusted (the checkpoint
WARN carries `pid`, `is_unprinted_attr` separates exact keys from prefix
namespaces, the quit flush is bounded by `QUIT_FLUSH_BUDGET`).

What actually changed:

- `detect.rs` logged the raw tail of a sign-in CLI's own output as `raw_tail`.
  DEBUG is off by default so it rarely captures, but when it does it lands in
  the telemetry spool - and an Export Diagnostics bundle ships the spool
  UNREDACTED to support. That branch's own comment says a device code or OAuth
  URL can be the only thing in the tail. Now logs a length and the crash
  classification, which is what the line existed to record anyway.
- `startup_health::fast_poll_until_healthy` did real work with no span and no
  outcome logs, so a stale offline banner left no record of which of its four
  exits it took. Instrumented; healthy / timeout / poisoned-lock / failed-emit
  are now distinguishable, with the elapsed cold-start time on the span.
- `release_notes_stay_short` measured the What's New limits with `String::len`
  (UTF-8 bytes) while CLAUDE.md states them in characters. Latent today - the
  file is all-ASCII - so this is the fix before it bites, not after.
- CLAUDE.md's What's New contract said "at most three" items; the assertion
  also rejects an empty list. Now says 1-3, matching what is enforced.
- `WhatsNewModal` keyed items on their title. Siblings are per-release so the
  cross-release collision the review described cannot happen, but two items in
  one release may legitimately share a title.
- The Jira "no auth available" `bail!` reaches the user on stdout, so its em
  dash becomes a plain hyphen. Log message BODIES are left alone: there are 256
  em dashes in Rust string literals, almost all of them log messages, and
  CLAUDE.md's rule enumerates UI copy rather than diagnostics.

Also fixes a red test already on `pre-main`, unrelated to the review: the
provider-unreachable WARN interpolated `{streak}` into its body, which
`log_hygiene::no_user_data_interpolated_into_a_log_body` rejects because a body
ships verbatim to central OpenObserve. `streak` was already a structured field
on the same call, so the body is now static.

Deliberately not done, with reasons recorded on the threads: the `detect.rs`
(3355 lines) and tray `lib.rs` (1912 lines) splits are pre-existing and not a
regression this release introduced; migrations 082/083 stay, because the tables
are inert but `sqlx::migrate!` raises `VersionMissing` for an applied migration
that has left the source tree, which would crash-loop every tester already on
v1.91.0-staging.2+.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CLAUDE.md                                 |  2 +-
 src/intelligence/oauth/jira.rs            |  2 +-
 src/intelligence/providers/mod.rs         |  5 +-
 src/llm/detect.rs                         | 15 +++++-
 tray/src-tauri/src/commands/whats_new.rs  | 11 ++--
 tray/src-tauri/src/poll/startup_health.rs | 61 ++++++++++++++++++++++-
 ui/components/timeline/WhatsNewModal.tsx  |  8 ++-
 7 files changed, 92 insertions(+), 12 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 144b98011..6137ac74b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -621,7 +621,7 @@ the packaged-build test recipe). In short:
 The dashboard's "What's New" modal (`ui/components/timeline/WhatsNewModal.tsx`, opened via the toolbar nav pill or auto-opened once per app version by the tray's `poll::whats_new_auto_open`) is **hand-curated**, deliberately separate from the auto-generated `CHANGELOG.md` — that file is commit-level and too internal to show end users (e.g. `hf-proxy: bake MERIDIAN_HF_ENDPOINT into the staging channel`).
 
 1. Edit `tray/src-tauri/resources/whats-new.json` (compiled into the tray binary via `include_str!`, not Tauri resource-bundling — a rebuild always picks up the change).
-2. Add a new object to the front of `releases` (newest-first): `version`, `date`, and `items` — **at most three**, each a short `title` (≤44 chars) plus a `body` of **one short sentence** (≤160 chars). There is deliberately no highlights/fixes split: which bucket a change came from is our concern, not the reader's, and the split doubled the length of every entry. `release_notes_stay_short` in `whats_new.rs` fails the build if these limits are exceeded — they are the feature, not a style preference, because notes nobody finishes reading are notes nobody reads. Pick the two or three changes a user would actually notice and drop the rest; never paste a commit message verbatim.
+2. Add a new object to the front of `releases` (newest-first): `version`, `date`, and `items` — **1-3**, each a short `title` (≤44 chars) plus a `body` of **one short sentence** (≤160 chars). There is deliberately no highlights/fixes split: which bucket a change came from is our concern, not the reader's, and the split doubled the length of every entry. `release_notes_stay_short` in `whats_new.rs` fails the build if these limits are exceeded — they are the feature, not a style preference, because notes nobody finishes reading are notes nobody reads. Pick the two or three changes a user would actually notice and drop the rest; never paste a commit message verbatim.
 3. Update `roadmap` if upcoming plans changed — `status` is `in-progress` | `planned` | `considering`.
 4. Every string in this file is user-facing app text — plain hyphen `-` only, no em-dash, per the Hard Rules at the top of this file.
 5. `cargo test -p meridian-tray` (from `tray/src-tauri/`) covers `whats_new_json_parses`, which fails the build if the JSON doesn't match the expected shape.
diff --git a/src/intelligence/oauth/jira.rs b/src/intelligence/oauth/jira.rs
index 7af628c62..cbb392178 100644
--- a/src/intelligence/oauth/jira.rs
+++ b/src/intelligence/oauth/jira.rs
@@ -56,7 +56,7 @@ pub async fn resolve(jira: &JiraConfig) -> Result<JiraReqCtx> {
         });
     }
     bail!(
-        "no Jira auth available — run `meridian oauth-login jira`, \
+        "no Jira auth available - run `meridian oauth-login jira`, \
          or set JIRA_BASE_URL / JIRA_EMAIL / JIRA_API_TOKEN"
     )
 }
diff --git a/src/intelligence/providers/mod.rs b/src/intelligence/providers/mod.rs
index b8ab01fb1..7e0b75b94 100644
--- a/src/intelligence/providers/mod.rs
+++ b/src/intelligence/providers/mod.rs
@@ -196,7 +196,10 @@ pub async fn note_transient_sync_failure(
     tracing::warn!(
         provider,
         streak,
-        "provider unreachable on {streak} consecutive attempts - escalating to a notice"
+        // Static body: `streak` is already a structured field above, and a WARN
+        // body ships verbatim to central OpenObserve whatever it interpolates -
+        // see `log_hygiene::no_user_data_interpolated_into_a_log_body`.
+        "provider unreachable on a full escalation streak - escalating to a notice"
     );
     // The message names the evidence, not a duration. The old wording ("No
     // successful sync in the last 6 hours") described normal on-demand operation
diff --git a/src/llm/detect.rs b/src/llm/detect.rs
index 3444a9a89..b8631abc8 100644
--- a/src/llm/detect.rs
+++ b/src/llm/detect.rs
@@ -1363,7 +1363,20 @@ where
                 stderr_tail
             };
             let process_message = if let Some(friendly) = node_crash_message(bin, &reason) {
-                tracing::debug!(bin, raw_tail = %reason, "sign-in CLI crashed at Node module load, showing a friendlier message");
+                // Length and classification, never the body. `reason` is the raw
+                // tail of the CLI's own output, and this branch's own comment
+                // above says a device code or OAuth URL can be the only thing in
+                // it. DEBUG is off by default so this rarely captures at all -
+                // but when it does it lands in the telemetry spool, and an
+                // Export Diagnostics bundle ships the spool UNREDACTED to
+                // support. The classification is what this line exists to
+                // record; the tail adds nothing the friendly message does not.
+                tracing::debug!(
+                    bin,
+                    raw_tail_len = reason.chars().count() as i64,
+                    crash_class = "node_module_load",
+                    "sign-in CLI crashed at Node module load, showing a friendlier message"
+                );
                 friendly
             } else {
                 format!(
diff --git a/tray/src-tauri/src/commands/whats_new.rs b/tray/src-tauri/src/commands/whats_new.rs
index 4414e6307..751d71cee 100644
--- a/tray/src-tauri/src/commands/whats_new.rs
+++ b/tray/src-tauri/src/commands/whats_new.rs
@@ -148,8 +148,8 @@ mod tests {
     }
 
     /// The brevity rule, enforced rather than trusted: What's New is read at a
-    /// glance or not at all, so a release gets at most three entries and each
-    /// body stays one short sentence. Without this the file drifts back into
+    /// glance or not at all, so a release gets 1-3 entries and each body stays
+    /// one short sentence. Without this the file drifts back into
     /// pasted commit messages within a few releases.
     #[test]
     fn release_notes_stay_short() {
@@ -162,14 +162,17 @@ mod tests {
                 r.items.len()
             );
             for it in &r.items {
+                // chars, not bytes: CLAUDE.md states these limits in characters,
+                // and `String::len` counts UTF-8 bytes - a single non-ASCII glyph
+                // would fail an entry that is well inside the documented limit.
                 assert!(
-                    it.title.len() <= 44,
+                    it.title.chars().count() <= 44,
                     "v{}: title too long: {:?}",
                     r.version,
                     it.title
                 );
                 assert!(
-                    it.body.len() <= 160,
+                    it.body.chars().count() <= 160,
                     "v{}: body must be one short sentence: {:?}",
                     r.version,
                     it.body
diff --git a/tray/src-tauri/src/poll/startup_health.rs b/tray/src-tauri/src/poll/startup_health.rs
index fcd166831..fb3e3df3b 100644
--- a/tray/src-tauri/src/poll/startup_health.rs
+++ b/tray/src-tauri/src/poll/startup_health.rs
@@ -55,13 +55,39 @@ const CEILING: Duration = Duration::from_secs(60);
 /// [`CEILING`] elapses), repainting the displayed status the moment it is.
 /// Intended to be spawned once, at tray startup, alongside the main poll
 /// loop — see `lib.rs`.
+#[tracing::instrument(
+    skip(app, state),
+    fields(
+        outcome = tracing::field::Empty,
+        checks = tracing::field::Empty,
+        elapsed_s = tracing::field::Empty
+    )
+)]
 pub async fn fast_poll_until_healthy(app: tauri::AppHandle, state: Arc<Mutex<AppState>>) {
-    let deadline = tokio::time::Instant::now() + CEILING;
+    let span = tracing::Span::current();
+    let started = tokio::time::Instant::now();
+    let deadline = started + CEILING;
+    // Every exit below records these, so a trace answers "did the fast repaint
+    // ever fire, and how long did the cold start actually take" - the question
+    // this loop exists to change the answer to.
+    let mut checks: i64 = 0;
     loop {
         let hr = check_health().await;
+        checks += 1;
         if is_healthy(&hr) {
             let payload = {
                 let Ok(mut s) = state.lock() else {
+                    // A poisoned lock means another thread panicked while
+                    // holding AppState. Bailing is correct - the normal cadence
+                    // still owns the display - but it must not be silent, or a
+                    // permanently stale banner has no record of why.
+                    span.record("outcome", "poisoned_lock");
+                    span.record("checks", checks);
+                    tracing::warn!(
+                        checks,
+                        "startup health repaint: AppState lock poisoned, leaving the \
+                         banner to the normal 60s cadence"
+                    );
                     return;
                 };
                 // A concurrent `refresh_health` tick may already have painted
@@ -71,10 +97,41 @@ pub async fn fast_poll_until_healthy(app: tauri::AppHandle, state: Arc<Mutex<App
                 s.ui_reachable = true;
                 s.to_payload()
             };
-            let _ = app.emit("status-update", payload);
+            let elapsed_s = started.elapsed().as_secs_f64();
+            span.record("outcome", "healthy");
+            span.record("checks", checks);
+            span.record("elapsed_s", elapsed_s);
+            if let Err(e) = app.emit("status-update", payload) {
+                // The state IS repainted; only the push to the webview failed,
+                // so the banner stays stale until the next tick redraws it.
+                // Worth a WARN precisely because the symptom is indistinguishable
+                // from this loop never having run.
+                tracing::warn!(
+                    error = %e,
+                    checks,
+                    elapsed_s,
+                    "startup health repaint: status-update emit failed, banner stays stale \
+                     until the next poll tick"
+                );
+            } else {
+                tracing::info!(
+                    checks,
+                    elapsed_s,
+                    "startup health repaint: healthy, banner repainted ahead of the normal cadence"
+                );
+            }
             return;
         }
         if tokio::time::Instant::now() >= deadline {
+            span.record("outcome", "timeout");
+            span.record("checks", checks);
+            span.record("elapsed_s", started.elapsed().as_secs_f64());
+            tracing::info!(
+                checks,
+                ceiling_s = CEILING.as_secs_f64(),
+                "startup health repaint: still unhealthy at the ceiling, handing back to the \
+                 normal cadence"
+            );
             return;
         }
         tokio::time::sleep(TICK).await;
diff --git a/ui/components/timeline/WhatsNewModal.tsx b/ui/components/timeline/WhatsNewModal.tsx
index 493b30fed..83b0fa869 100644
--- a/ui/components/timeline/WhatsNewModal.tsx
+++ b/ui/components/timeline/WhatsNewModal.tsx
@@ -112,8 +112,12 @@ function ReleaseList({ releases }: { releases: ReleaseNote[] }) {
               <p className="mt-body-sm ml-auto" style={{ color: 'var(--t-faint)' }}>{r.date}</p>
             </div>
             <div className="flex flex-col gap-3">
-              {r.items.map(item => (
-                <div key={item.title}>
+              {/* Keyed on position within the release, not the title: two items
+                  in one release may legitimately share a title, and a duplicate
+                  key makes React reuse the wrong node. The list is static and
+                  never reordered, so the index is a stable identity here. */}
+              {r.items.map((item, idx) => (
+                <div key={`${r.version}-${idx}`}>
                   <p className="mt-body-sm" style={{ color: 'var(--t-title)', fontWeight: 600 }}>{item.title}</p>
                   <p className="mt-body-sm" style={{ color: 'var(--t-muted)', marginTop: 2 }}>{item.body}</p>
                 </div>

From a9255c119d3cfa0e577d2caa957dc67ee93c0a57 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Sat, 5 Sep 2026 16:09:21 +0530
Subject: [PATCH 49/53] feat(otp-worker): notify company@meridiona.com on
 sign-up or email change

On a successful /otp/verify, the Worker now fires a fire-and-forget SES
notification to NOTIFY_EMAIL telling the company an install signed up or
changed its verified email (old -> new). The client sends its locally-known
previous email as an optional, purely-informational previousEmail field;
the Worker never treats it as a security input. Rides on ctx.waitUntil
exactly like the existing rate-limit alert, so a failed notification send
never affects the verify response itself.
---
 infra/otp-worker/README.md                 | 38 +++++++++-
 infra/otp-worker/src/__tests__/ses.test.ts | 70 +++++++++++++++++++
 infra/otp-worker/src/index.ts              | 21 ++++--
 infra/otp-worker/src/ses.ts                | 81 ++++++++++++++++++++++
 infra/otp-worker/worker-configuration.d.ts |  6 +-
 infra/otp-worker/wrangler.jsonc            | 12 +++-
 tray/src-tauri/src/commands/otp.rs         | 46 +++++++++++-
 7 files changed, 263 insertions(+), 11 deletions(-)

diff --git a/infra/otp-worker/README.md b/infra/otp-worker/README.md
index 37f319089..ee0756853 100644
--- a/infra/otp-worker/README.md
+++ b/infra/otp-worker/README.md
@@ -22,7 +22,12 @@ Exactly two exist. Everything else — wrong path, wrong method — gets a plain
 | Route | Body | Purpose |
 |---|---|---|
 | `POST /otp/send` | `{ email, turnstileToken? }` | Generate a code, email it via SES |
-| `POST /otp/verify` | `{ email, code }` | Check a code against the live record |
+| `POST /otp/verify` | `{ email, code, previousEmail? }` | Check a code against the live record |
+
+`previousEmail` is optional and purely informational — the client's best
+knowledge of the address it had on file before this verify, used only to
+decide what (if anything) to tell `NOTIFY_EMAIL` about (see "Account-event
+notification" below). It is never used for any security decision.
 
 ### Status codes
 
@@ -157,6 +162,35 @@ SES's sandbox-mode "email address is not verified" error echoes the
 destination address back in the response text, which must never reach
 Workers Logs.
 
+## Account-event notification
+
+On a successful `/otp/verify` (the `verified` case only — never on a wrong
+guess), `handleVerify` fires a second, unrelated SES send to `NOTIFY_EMAIL`
+(`vars.NOTIFY_EMAIL` in `wrangler.jsonc`, currently `company@meridiona.com` on
+both channels) telling the company that an install signed up or changed its
+email. This rides on `ctx.waitUntil` exactly like the rate-limit alert below —
+fire-and-forget, never awaited inline, so a failed notification send can
+never affect the verify response the caller is waiting on.
+
+`ses.ts`'s `resolveAccountEvent(newEmail, previousEmail)` decides which:
+
+- `previousEmail` absent/null → **sign-up** ("A new Meridian install just
+  verified its email: `<email>`").
+- `previousEmail` present and different → **email changed** ("...changed its
+  verified email from `<old>` to `<new>`").
+- `previousEmail` present and identical to the new email → **no-op**, nothing
+  sent (a "Change email" re-entering the same address that's already on
+  file).
+
+`previousEmail` is sent by the client (`tray/src-tauri/src/commands/otp.rs`'s
+`confirm_account_otp`, reading `commands::account::read_account_email()`
+before the request) and is purely informational — this Worker has no durable
+account state of its own to derive it from independently, and doesn't need
+one: unlike a routine sign-in, every verify in this app is either a genuine
+one-time capture or a deliberate "Change email" action (there is no
+session/re-login concept), so there's no repeat-noise case to dedup against
+and no once-per-day flag like `ALERT_EMAIL`'s.
+
 ## Turnstile (conditional, per the plan)
 
 **Turnstile support is wired but CONDITIONAL: whether the client actually
@@ -209,7 +243,7 @@ Mirrors the existing `ops/central-observability` convention (public
 | `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_REGION` | `wrangler secret put` (both envs) | Scoped to an IAM policy permitting only `ses:SendEmail` on the verified identity |
 | `TURNSTILE_SECRET_KEY` | `wrangler secret put` (both envs), optional | Unset until/unless the frontend spike lands — see "Turnstile" above |
 | `CI_TEST_TOKEN` | `wrangler secret put --env staging` **only** | Staging-only auth token that also unlocks the `/otp/send` code echo — see below |
-| `ENVIRONMENT`, `FROM_ADDRESS`, `FROM_NAME`, `OTP_TTL_S`, `MAX_VERIFY_ATTEMPTS`, `RL_EMAIL_PER_DAY`, `RL_IP_PER_HOUR`, `RL_GLOBAL_PER_DAY` | `wrangler.jsonc` `vars` | Public, tunable without touching code |
+| `ENVIRONMENT`, `FROM_ADDRESS`, `FROM_NAME`, `OTP_TTL_S`, `MAX_VERIFY_ATTEMPTS`, `RL_EMAIL_PER_DAY`, `RL_IP_PER_HOUR`, `RL_GLOBAL_PER_DAY`, `ALERT_THRESHOLD_PCT`, `ALERT_EMAIL`, `NOTIFY_EMAIL` | `wrangler.jsonc` `vars` | Public, tunable without touching code |
 
 ### Staging-only code echo
 
diff --git a/infra/otp-worker/src/__tests__/ses.test.ts b/infra/otp-worker/src/__tests__/ses.test.ts
index 95ea1dfd9..c98cc0d63 100644
--- a/infra/otp-worker/src/__tests__/ses.test.ts
+++ b/infra/otp-worker/src/__tests__/ses.test.ts
@@ -1,11 +1,15 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
 import { describe, expect, it, vi } from "vitest";
 import {
+  buildAccountEventBody,
+  buildAccountEventHtml,
   buildOtpEmailBody,
   buildOtpEmailHtml,
   buildRateLimitAlertBody,
   buildRateLimitAlertHtml,
   extractSesErrorCode,
+  resolveAccountEvent,
+  sendAccountEventEmail,
   sendOtpEmail,
   sendRateLimitAlertEmail,
   type AwsFetcher,
@@ -20,6 +24,7 @@ const ENV = {
 };
 
 const ALERT_ENV = { ...ENV, ALERT_EMAIL: "ops@example.com" };
+const NOTIFY_ENV = { ...ENV, NOTIFY_EMAIL: "company@meridiona.com" };
 
 describe("buildOtpEmailBody", () => {
   it("includes the code and the TTL, and no links", () => {
@@ -149,3 +154,68 @@ describe("sendOtpEmail", () => {
     expect(url).not.toContain("999999");
   });
 });
+
+describe("resolveAccountEvent", () => {
+  it("is a sign-up when there is no previous email", () => {
+    expect(resolveAccountEvent("new@example.com", null)).toEqual({ kind: "signed_up", email: "new@example.com" });
+  });
+
+  it("is an email change when the previous email differs", () => {
+    expect(resolveAccountEvent("new@example.com", "old@example.com")).toEqual({
+      kind: "email_changed",
+      from: "old@example.com",
+      to: "new@example.com",
+    });
+  });
+
+  it("is null (nothing to notify) when the previous email is the SAME as the new one", () => {
+    expect(resolveAccountEvent("same@example.com", "same@example.com")).toBeNull();
+  });
+});
+
+describe("buildAccountEventBody / buildAccountEventHtml", () => {
+  it("a sign-up mentions only the new email, with no links", () => {
+    const body = buildAccountEventBody({ kind: "signed_up", email: "new@example.com" });
+    expect(body).toContain("new@example.com");
+    expect(body).not.toMatch(/https?:\/\//);
+  });
+
+  it("an email change mentions both the old and new addresses", () => {
+    const body = buildAccountEventBody({ kind: "email_changed", from: "old@example.com", to: "new@example.com" });
+    expect(body).toContain("old@example.com");
+    expect(body).toContain("new@example.com");
+  });
+
+  it("the HTML version carries the same addresses, no script tags", () => {
+    const html = buildAccountEventHtml({ kind: "email_changed", from: "old@example.com", to: "new@example.com" });
+    expect(html).toContain("old@example.com");
+    expect(html).toContain("new@example.com");
+    expect(html.toLowerCase()).not.toContain("<script");
+  });
+});
+
+describe("sendAccountEventEmail", () => {
+  it("posts to NOTIFY_EMAIL (not the account's own address) and returns true on 2xx", async () => {
+    const fakeClient: AwsFetcher = { fetch: vi.fn(async () => new Response("{}", { status: 200 })) };
+    const result = await sendAccountEventEmail(
+      { kind: "signed_up", email: "new@example.com" },
+      NOTIFY_ENV,
+      fakeClient,
+    );
+    expect(result).toBe(true);
+    const [, init] = (fakeClient.fetch as ReturnType<typeof vi.fn>).mock.calls[0] as [string, RequestInit];
+    expect(String(init.body)).toContain(encodeURIComponent(NOTIFY_ENV.NOTIFY_EMAIL));
+  });
+
+  it("returns false (never throws) on a non-2xx response", async () => {
+    const fakeClient: AwsFetcher = {
+      fetch: vi.fn(async () => new Response(JSON.stringify({ Error: { Code: "Throttling" } }), { status: 429 })),
+    };
+    const result = await sendAccountEventEmail(
+      { kind: "signed_up", email: "new@example.com" },
+      NOTIFY_ENV,
+      fakeClient,
+    );
+    expect(result).toBe(false);
+  });
+});
diff --git a/infra/otp-worker/src/index.ts b/infra/otp-worker/src/index.ts
index cd876135c..e30b9cee6 100644
--- a/infra/otp-worker/src/index.ts
+++ b/infra/otp-worker/src/index.ts
@@ -55,7 +55,7 @@ import {
   serviceUnavailable,
   unauthorized,
 } from "./responses";
-import { sendOtpEmail, sendRateLimitAlertEmail } from "./ses";
+import { resolveAccountEvent, sendAccountEventEmail, sendOtpEmail, sendRateLimitAlertEmail } from "./ses";
 import { verifyTurnstileToken } from "./turnstile";
 
 const HOUR_MS = 60 * 60 * 1000;
@@ -200,7 +200,7 @@ async function handleSend(request: Request, env: Env, ctx: ExecutionContext): Pr
   return ok();
 }
 
-async function handleVerify(request: Request, env: Env): Promise<Response> {
+async function handleVerify(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
   const auth = checkBearerAuth(request.headers.get("Authorization"), env);
   if (!auth.ok) return unauthorized();
 
@@ -215,6 +215,10 @@ async function handleVerify(request: Request, env: Env): Promise<Response> {
     return badRequest("invalid_code");
   }
 
+  // Optional, client-supplied, purely informational — see resolveAccountEvent's
+  // doc. An absent or unparseable value just reads as "no prior email".
+  const previousEmail = normalizeEmail(body.previousEmail);
+
   const now = Date.now();
   const hash = await emailHash(email);
   const [record, providedHash] = await Promise.all([
@@ -226,9 +230,18 @@ async function handleVerify(request: Request, env: Env): Promise<Response> {
   const outcome = verifyOtpAttempt(record, providedHash, now, maxAttempts);
 
   switch (outcome.kind) {
-    case "verified":
+    case "verified": {
       await deleteOtpRecord(env.OTP_KV, hash);
+      const event = resolveAccountEvent(email, previousEmail);
+      if (event && env.NOTIFY_EMAIL) {
+        ctx.waitUntil(
+          sendAccountEventEmail(event, env).then((sent) => {
+            if (!sent) console.error("otp-worker: account-event notification failed to send", { kind: event.kind });
+          }),
+        );
+      }
       return ok({ verified: true });
+    }
     case "wrong":
       await putOtpRecord(env.OTP_KV, hash, outcome.nextRecord, now);
       return ok({ verified: false, attemptsRemaining: outcome.attemptsRemaining });
@@ -248,7 +261,7 @@ export default {
         return await handleSend(request, env, ctx);
       }
       if (request.method === "POST" && url.pathname === "/otp/verify") {
-        return await handleVerify(request, env);
+        return await handleVerify(request, env, ctx);
       }
       return notFound();
     } catch (err) {
diff --git a/infra/otp-worker/src/ses.ts b/infra/otp-worker/src/ses.ts
index 481e9c930..04841b09f 100644
--- a/infra/otp-worker/src/ses.ts
+++ b/infra/otp-worker/src/ses.ts
@@ -288,3 +288,84 @@ export async function sendRateLimitAlertEmail(
     "rate-limit alert",
   );
 }
+
+/**
+ * `previousEmail` is client-supplied and purely informational (see
+ * `index.ts`'s `handleVerify`) — it is never used for any security decision,
+ * only to word this notification. `null`/absent means "no prior email on
+ * this install", which reads as a first-time sign-up.
+ */
+export type AccountEvent = { kind: "signed_up"; email: string } | { kind: "email_changed"; from: string; to: string };
+
+/**
+ * Decide what (if anything) happened, from `index.ts`'s `handleVerify` point
+ * of view — pure, so this is unit-tested directly rather than only through a
+ * full send→verify round trip. `previousEmail` is whatever the client sent
+ * (already normalized by `email.ts`'s `normalizeEmail`, or `null` if
+ * absent/unparseable) — purely informational, never a security input.
+ * Returns `null` for a no-op re-verify of the SAME address (nothing changed,
+ * nothing to notify) — this can legitimately happen if "Change email" is
+ * used to re-enter the address already on file.
+ */
+export function resolveAccountEvent(newEmail: string, previousEmail: string | null): AccountEvent | null {
+  if (previousEmail === newEmail) return null;
+  if (previousEmail) return { kind: "email_changed", from: previousEmail, to: newEmail };
+  return { kind: "signed_up", email: newEmail };
+}
+
+/** The plain-text body of the "someone signed in / changed their email" notification. */
+export function buildAccountEventBody(event: AccountEvent): string {
+  if (event.kind === "signed_up") {
+    return `A new Meridian install just verified its email: ${event.email}`;
+  }
+  return `A Meridian install changed its verified email from ${event.from} to ${event.to}`;
+}
+
+/** The HTML body — same plain, no-links shape as the other two email kinds. */
+export function buildAccountEventHtml(event: AccountEvent): string {
+  const safeBody = escapeHtml(buildAccountEventBody(event));
+  const heading = event.kind === "signed_up" ? "New sign-up" : "Email changed";
+  return `<!doctype html>
+<html>
+  <body style="margin:0;padding:0;background-color:#f4f4f5;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background-color:#f4f4f5;padding:32px 16px;">
+      <tr>
+        <td align="center">
+          <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:480px;background-color:#ffffff;border-radius:12px;overflow:hidden;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;">
+            <tr>
+              <td style="padding:28px 32px;">
+                <p style="margin:0 0 8px 0;font-size:15px;font-weight:600;color:#18181b;">${heading}</p>
+                <p style="margin:0;font-size:13px;line-height:20px;color:#3f3f46;">${safeBody}</p>
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`;
+}
+
+/**
+ * Notify `NOTIFY_EMAIL` of a sign-up or email change. Returns `false` (never
+ * throws), same contract as the other two senders — this rides on
+ * `ctx.waitUntil` in `index.ts`'s `handleVerify` and must never affect the
+ * verify response it's attached to.
+ */
+export async function sendAccountEventEmail(
+  event: AccountEvent,
+  env: SesEnv & { NOTIFY_EMAIL: string },
+  client: AwsFetcher = defaultAwsClient(env),
+): Promise<boolean> {
+  const subject =
+    event.kind === "signed_up" ? "Meridian: new sign-up" : "Meridian: user changed their email";
+  return postSesEmail(
+    env.NOTIFY_EMAIL,
+    subject,
+    buildAccountEventBody(event),
+    buildAccountEventHtml(event),
+    env,
+    client,
+    "account-event notification",
+  );
+}
diff --git a/infra/otp-worker/worker-configuration.d.ts b/infra/otp-worker/worker-configuration.d.ts
index 11eb05c0c..fce33a481 100644
--- a/infra/otp-worker/worker-configuration.d.ts
+++ b/infra/otp-worker/worker-configuration.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: c24c1b56470c52c6389886a046206d42)
+// Generated by Wrangler by running `wrangler types` (hash: 4cbd50efe476d085fe928ce46f32e312)
 // Runtime types generated with workerd@1.20260828.1 2026-08-25 nodejs_compat
 interface __BaseEnv_Env {
 	OTP_KV: KVNamespace;
@@ -13,6 +13,7 @@ interface __BaseEnv_Env {
 	RL_GLOBAL_PER_DAY: 500 | 2000;
 	ALERT_THRESHOLD_PCT: 80;
 	ALERT_EMAIL: "akarsh@meridiona.com";
+	NOTIFY_EMAIL: "company@meridiona.com";
 }
 declare namespace Cloudflare {
 	interface GlobalProps {
@@ -30,6 +31,7 @@ declare namespace Cloudflare {
 		RL_GLOBAL_PER_DAY: 500;
 		ALERT_THRESHOLD_PCT: 80;
 		ALERT_EMAIL: "akarsh@meridiona.com";
+		NOTIFY_EMAIL: "company@meridiona.com";
 	}
 	interface Env extends __BaseEnv_Env {}
 }
@@ -38,7 +40,7 @@ type StringifyValues<EnvType extends Record<string, unknown>> = {
 	[Binding in keyof EnvType]: EnvType[Binding] extends string ? EnvType[Binding] : string;
 };
 declare namespace NodeJS {
-	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "ENVIRONMENT" | "FROM_ADDRESS" | "FROM_NAME" | "OTP_TTL_S" | "MAX_VERIFY_ATTEMPTS" | "RL_EMAIL_PER_DAY" | "RL_IP_PER_HOUR" | "RL_GLOBAL_PER_DAY" | "ALERT_THRESHOLD_PCT" | "ALERT_EMAIL">> {}
+	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "ENVIRONMENT" | "FROM_ADDRESS" | "FROM_NAME" | "OTP_TTL_S" | "MAX_VERIFY_ATTEMPTS" | "RL_EMAIL_PER_DAY" | "RL_IP_PER_HOUR" | "RL_GLOBAL_PER_DAY" | "ALERT_THRESHOLD_PCT" | "ALERT_EMAIL" | "NOTIFY_EMAIL">> {}
 }
 
 // Begin runtime types
diff --git a/infra/otp-worker/wrangler.jsonc b/infra/otp-worker/wrangler.jsonc
index 9ed90d511..6298ba2d5 100644
--- a/infra/otp-worker/wrangler.jsonc
+++ b/infra/otp-worker/wrangler.jsonc
@@ -49,7 +49,14 @@
     // only: per-email/per-IP caps tripping is routine abuse-prevention
     // noise, not something worth an alert.
     "ALERT_THRESHOLD_PCT": 80,
-    "ALERT_EMAIL": "akarsh@meridiona.com"
+    "ALERT_EMAIL": "akarsh@meridiona.com",
+    // Fires once per successful /otp/verify (sign-up or a changed email) —
+    // see ses.ts's sendAccountEventEmail. Unlike ALERT_EMAIL this has no
+    // once-per-day dedup: every verify here is a genuine one-time capture or
+    // a deliberate "Change email" action, never a routine re-login (this app
+    // has no session/sign-in-again concept), so there's no repeat-noise case
+    // to suppress.
+    "NOTIFY_EMAIL": "company@meridiona.com"
   },
 
   "env": {
@@ -84,7 +91,8 @@
         "RL_IP_PER_HOUR": 30,
         "RL_GLOBAL_PER_DAY": 500,
         "ALERT_THRESHOLD_PCT": 80,
-        "ALERT_EMAIL": "akarsh@meridiona.com"
+        "ALERT_EMAIL": "akarsh@meridiona.com",
+        "NOTIFY_EMAIL": "company@meridiona.com"
       }
     }
   }
diff --git a/tray/src-tauri/src/commands/otp.rs b/tray/src-tauri/src/commands/otp.rs
index 82e9b9c16..9c1fa3d2d 100644
--- a/tray/src-tauri/src/commands/otp.rs
+++ b/tray/src-tauri/src/commands/otp.rs
@@ -169,6 +169,19 @@ struct VerifyResponseBody {
     verified: bool,
 }
 
+/// Build `/otp/verify`'s request body. `previous_email` is whatever
+/// [`crate::commands::account::read_account_email`] returned at call time —
+/// serialized as `null` when absent, which the Worker's `normalizeEmail`
+/// treats as "no prior email" (a first-time sign-up). Pure and
+/// unit-tested separately from the network call it feeds.
+fn build_verify_body(
+    email: &str,
+    code: &str,
+    previous_email: &Option<String>,
+) -> serde_json::Value {
+    serde_json::json!({ "email": email, "code": code, "previousEmail": previous_email })
+}
+
 /// Map `/otp/verify`'s response to this command's outcome. A `200` status is
 /// NOT itself "verified" — see the module doc's "Verify response body"
 /// section — so this parses `body` rather than trusting the status code
@@ -224,6 +237,14 @@ pub async fn request_account_otp(email: String) -> Result<(), String> {
 /// `Ok(false)` means the code was wrong but the attempt was otherwise valid
 /// (retryable). Returns `Err("not_configured")` immediately when no Worker
 /// URL is resolved, same as [`request_account_otp`].
+///
+/// Includes whatever [`crate::commands::account::read_account_email`]
+/// returns as `previousEmail` in the request body — purely informational, so
+/// the Worker can tell the company's `NOTIFY_EMAIL` inbox apart a first-time
+/// sign-up from a "Change email" (`infra/otp-worker/src/ses.ts`'s
+/// `resolveAccountEvent`). Reading it here (rather than having the frontend
+/// pass it) keeps this command's contract unchanged and means a caller can't
+/// forget to include it or spoof a different value.
 #[tauri::command]
 #[tracing::instrument(skip(email, code), err)]
 pub async fn confirm_account_otp(email: String, code: String) -> Result<bool, String> {
@@ -237,10 +258,11 @@ pub async fn confirm_account_otp(email: String, code: String) -> Result<bool, St
         tracing::info!("confirm_account_otp: no OTP_API_URL configured — not_configured");
         return Err("not_configured".into());
     }
+    let previous_email = crate::commands::account::read_account_email();
     let resp = reqwest::Client::new()
         .post(format!("{base}/otp/verify"))
         .bearer_auth(otp_client_token())
-        .json(&serde_json::json!({ "email": email, "code": code }))
+        .json(&build_verify_body(&email, code, &previous_email))
         .timeout(Duration::from_secs(10))
         .send()
         .await
@@ -346,6 +368,28 @@ mod tests {
         assert!(map_verify_status(200, "{}").is_err());
     }
 
+    #[test]
+    fn build_verify_body_includes_previous_email_when_present() {
+        let body = build_verify_body(
+            "new@example.com",
+            "123456",
+            &Some("old@example.com".to_string()),
+        );
+        assert_eq!(body["email"], "new@example.com");
+        assert_eq!(body["code"], "123456");
+        assert_eq!(body["previousEmail"], "old@example.com");
+    }
+
+    /// `None` must serialize as JSON `null`, not be omitted — the Worker's
+    /// `handleVerify` reads `body.previousEmail` unconditionally and treats a
+    /// missing/non-string value as "no prior email" either way, but pinning
+    /// the exact shape here catches an accidental switch to `skip_serializing_if`.
+    #[test]
+    fn build_verify_body_serializes_absent_previous_email_as_null() {
+        let body = build_verify_body("new@example.com", "123456", &None);
+        assert!(body["previousEmail"].is_null());
+    }
+
     #[test]
     fn map_verify_status_matches_the_documented_contract() {
         assert_eq!(map_verify_status(400, ""), Err("invalid_input".to_string()));

From c3c25c129ba2ee0a5a96b20cde5d89b5a1dea558 Mon Sep 17 00:00:00 2001
From: adityaharishch <adityaharish2002@gmail.com>
Date: Sat, 5 Sep 2026 17:43:19 +0530
Subject: [PATCH 50/53] fix(tray): quiesce the database pool across a daemon
 restage

Fifth capture-table corruption on one machine since 17 Aug (17, 19, 20, 27 Aug,
5 Sep). The mechanism is the tray's own connection, held across the restage the
tray itself initiates.

`ensure_backend_installed` stops the running daemon, swaps its binary and
bootstraps a new one. The outgoing daemon checkpoints and RESETS the WAL as it
exits. A connection held across that reset keeps a stale `-shm` index: it still
maps page numbers to WAL frames that have since been recycled for other pages,
so reads and writes through it silently address the wrong content. The tray is
a writer here, not a bystander - capture appends to capture_frames and
capture_ui_events throughout - so those writes deposit one page's bytes into
another page's slot.

Measured 5 Sep: the tray opened meridian.db 100 ms before sending the stop
signal and held it across the 15:54:23.168 checkpoint. The damaged interior
pages carry child pointers to pages 90143-90671 in a database whose highest
page ever allocated was 90093 - pointers into space that never existed, which
is what a page written to the wrong slot looks like. One WAL file held two salt
generations, the fingerprint of a reset spanned by a live connection.

`DbPool::close`/`reopen` has existed since the 24 Aug incident for exactly this
and was wired only into `reload_daemon`. The restage path - the one an ordinary
user hits by installing an update while Meridian is running - never used it.

## Why it could not simply be wired in

`start_capture` took a raw `Option<SqlitePool>` cloned once at startup. `sqlx::Pool`
is Arc-backed and `close()` closes the shared inner pool, so calling
`DbPool::close` killed every capture write permanently: the consumers never
looked at the handle again and so never saw the reopened pool. Wiring the fix in
as-is would have traded a corrupt database for a dead capture engine.

That is also a live bug on its own - `reload_daemon` has been closing and
reopening since it was written, so a daemon reload has been silently ending
capture until the next tray restart.

So capture now takes the swappable handle and calls `get()` per item. A `None`
during the restage window drops that item, which is the same degradation every
reader already has on a cold start; the next item after `reopen` lands normally.
Losing seconds of scratch capture is the cheap failure. The three resume paths
(pause expiry, disk-space recovery, work-hours start) all passed raw clones too
and now go through one `restart_capture` helper, so there is a single place to
be right.

Also folds in the incident report's P2: the capture write sites logged
`error = %e`, which renders only the outermost context and drops the SQLite
result code - which is why the mechanism had to be reconstructed from the file
rather than read from a log line. They use `errors::chain` now.

Test: `the_tray_pool_is_closed_across_the_restage_and_reopened_after` pins that
close precedes install() and reopen follows it. Source-scanned because the
ordering is the behaviour and it needs a real launchd domain, a real daemon and
a real WAL reset to exercise. Verified by moving the close after install() - it
fails with the offsets named.
---
 tray/src-tauri/src/backend_install.rs | 120 ++++++++++++++++++++++++--
 tray/src-tauri/src/commands/pause.rs  |   9 +-
 tray/src-tauri/src/lib.rs             | 105 +++++++++++++++++-----
 tray/src-tauri/src/poll/mod.rs        |  12 ++-
 4 files changed, 212 insertions(+), 34 deletions(-)

diff --git a/tray/src-tauri/src/backend_install.rs b/tray/src-tauri/src/backend_install.rs
index a94d9c586..76c23f422 100644
--- a/tray/src-tauri/src/backend_install.rs
+++ b/tray/src-tauri/src/backend_install.rs
@@ -149,16 +149,59 @@ pub async fn ensure_backend_installed(app: &tauri::AppHandle) {
         return;
     }
 
-    // `ensure_backend_installed` runs off the setup hook, after `app.manage(db_pool)`
-    // (see `lib.rs`), so the pool is already there to raise/clear against —
-    // `None` only when the DB itself couldn't be opened, in which case there's
-    // nowhere to write a notice anyway.
-    let pool = app
+    // QUIESCE THE TRAY'S OWN POOL ACROSS THE RESTAGE.
+    //
+    // `install` below stops the running daemon, swaps its binary and bootstraps
+    // a new one. The outgoing daemon checkpoints and RESETS the WAL as it exits.
+    // A connection held across that reset keeps a stale `-shm` index: it still
+    // maps page numbers to WAL frames that have since been recycled for other
+    // pages, so reads AND writes through it silently address the wrong content.
+    //
+    // The tray is a writer here, not a bystander - the capture engine is
+    // appending to `capture_frames`/`capture_ui_events` throughout - so those
+    // misdirected writes deposit one page's bytes into another page's slot.
+    // Measured 2026-09-05: the tray opened the database 100 ms before it sent
+    // the stop signal, held it across the 15:54:23.168 checkpoint, and the
+    // resulting interior pages carried child pointers to pages 90143-90671 in a
+    // database whose highest page ever allocated was 90093 - pointers to space
+    // that has never existed, which is what a page written to the wrong slot
+    // looks like. One WAL file held two salt generations, the fingerprint of a
+    // reset spanned by a live connection. Fifth occurrence since 17 Aug.
+    //
+    // `DbPool::close`/`reopen` has existed since the 24 Aug incident for exactly
+    // this, but only `commands::daemon::reload_daemon` used it; the restage path
+    // - the one an ordinary user hits by installing an update while Meridian is
+    // running - never did.
+    //
+    // Every reader sees `get() == None` for the window and degrades exactly as
+    // it does on a cold start. That includes capture, which drops the handful of
+    // frames produced during the swap. Losing seconds of scratch capture is the
+    // cheap failure; the expensive one is the b-tree.
+    let db_handle = app
         .try_state::<crate::db_pool::DbPool>()
-        .and_then(|s| s.get());
+        .map(|s| s.inner().clone());
+    if let Some(h) = db_handle.as_ref() {
+        h.close().await;
+        tracing::info!("backend_install: closed the tray db pool for the restage");
+    }
 
     tracing::info!(hash = %bundled_hash, "backend_install: installing bundled backend");
-    if let Err(e) = install(&backend, &home).await {
+    let outcome = install(&backend, &home).await;
+
+    // Reopen BEFORE anything below touches the database. Unconditional on the
+    // install outcome: a failed stage leaves the OLD daemon to be restarted by
+    // `restore_unless_paused`, and the tray needs its pool back either way -
+    // leaving it closed would silently end capture and every dashboard read for
+    // the rest of the session, which is the failure mode `start_capture`'s doc
+    // describes.
+    if let Some(h) = db_handle.as_ref() {
+        h.reopen().await;
+        tracing::info!("backend_install: reopened the tray db pool after the restage");
+    }
+    // Re-read AFTER the reopen - a pool captured before `close` is the shut one.
+    let pool = db_handle.as_ref().and_then(|h| h.get());
+
+    if let Err(e) = outcome {
         tracing::error!(error = %e, "backend_install: install failed — will retry next launch");
         // Previously silent beyond the log line: staging/registration can fail
         // for reasons a user can actually act on (antivirus quarantining the
@@ -1628,6 +1671,69 @@ mod tests {
         }
     }
 
+    /// The tray's pool must be CLOSED before the restage and REOPENED after.
+    ///
+    /// This is the fix for the corruption that has now happened five times on
+    /// one machine (17, 19, 20, 27 Aug and 5 Sep). `install` stops the running
+    /// daemon, and the outgoing daemon checkpoints and RESETS the WAL as it
+    /// goes. A connection held across that reset keeps a stale `-shm` index and
+    /// resolves page numbers to WAL frames that have since been recycled, so
+    /// writes through it land on the wrong pages. The tray is a writer here -
+    /// capture is appending to `capture_frames` throughout - so what it deposits
+    /// is one page's bytes in another page's slot. On 5 Sep that produced
+    /// interior pages pointing at pages 90143-90671 in a database whose highest
+    /// page ever allocated was 90093.
+    ///
+    /// Source-scanned because the ordering IS the behaviour and none of it can
+    /// be exercised in a unit test - it needs a real launchd domain, a real
+    /// daemon and a real WAL reset. The same idiom as the sibling scans here.
+    ///
+    /// Both halves are asserted, and the reopen is not optional politeness: a
+    /// pool left closed silently ends capture and every dashboard read for the
+    /// rest of the session, which would trade a corrupt database for a dead one.
+    #[test]
+    fn the_tray_pool_is_closed_across_the_restage_and_reopened_after() {
+        const SRC: &str = include_str!("backend_install.rs");
+        let prod = SRC
+            .split_once("\n#[cfg(test)]")
+            .map_or(SRC, |(before, _)| before);
+        let body = prod
+            .split_once("pub async fn ensure_backend_installed")
+            .expect("ensure_backend_installed must exist")
+            .1;
+        let end = ["\npub ", "\npub(crate) ", "\nasync fn", "\nfn "]
+            .iter()
+            .filter_map(|m| body.find(m))
+            .min()
+            .unwrap_or(body.len());
+        let body = &body[..end];
+
+        let close = body.find(".close().await").expect(
+            "ensure_backend_installed must close the tray's db pool before staging - a \
+             connection held across the outgoing daemon's WAL reset writes to the wrong \
+             pages, which is the recurring capture-table corruption",
+        );
+        let install = body
+            .find("install(&backend, &home).await")
+            .expect("ensure_backend_installed must call install()");
+        let reopen = body.find(".reopen().await").expect(
+            "ensure_backend_installed must reopen the pool after staging - leaving it \
+             closed ends capture and every dashboard read for the rest of the session",
+        );
+
+        assert!(
+            close < install,
+            "the pool must be closed BEFORE install(), not after - closing afterwards \
+             leaves the connection spanning the daemon restart, which is the whole bug. \
+             close at {close}, install at {install}"
+        );
+        assert!(
+            install < reopen,
+            "the pool must be reopened AFTER install() completes. install at {install}, \
+             reopen at {reopen}"
+        );
+    }
+
     /// Staging must wait on the **daemon binary**, never on `meridian.db`.
     ///
     /// The two are one keystroke apart (`stop_daemon_for_staging` vs
diff --git a/tray/src-tauri/src/commands/pause.rs b/tray/src-tauri/src/commands/pause.rs
index 7d81ccc17..346608dba 100644
--- a/tray/src-tauri/src/commands/pause.rs
+++ b/tray/src-tauri/src/commands/pause.rs
@@ -339,8 +339,15 @@ pub(crate) async fn resume_capture(
     }
 
     // Restart the capture engine so screen recording resumes.
+    //
+    // Takes the SWAPPABLE handle from managed state rather than cloning the raw
+    // `pool` this function was given. A raw clone keeps writing to the pool
+    // object `DbPool::close` shut, so capture would be dead from the next daemon
+    // restart onward - see `crate::start_capture`'s doc. `try_state` because a
+    // tray whose database never opened has no handle to manage, and capture
+    // degrades to dropping frames exactly as it already does on a cold start.
     #[cfg(feature = "capture")]
-    crate::start_capture(state.clone(), pool.cloned());
+    crate::restart_capture(app, state, "pause resumed");
 
     // Emit immediately so the popover reverts to the picker without waiting for the next tick.
     if let Ok(s) = state.lock() {
diff --git a/tray/src-tauri/src/lib.rs b/tray/src-tauri/src/lib.rs
index 525d65110..0ab7ae40b 100644
--- a/tray/src-tauri/src/lib.rs
+++ b/tray/src-tauri/src/lib.rs
@@ -653,20 +653,28 @@ pub fn run() {
                     // as it was before this span grew a wrapper): the capture
                     // feature is the only later consumer, but the clone itself is
                     // cheap and every build needs a value to return.
-                    let capture_pool = db_pool.clone();
                     // The encryption-state notice below needs a pool handle before
                     // db_pool is moved into managed state.
                     let encryption_notice_pool = db_pool.clone();
-                    // Wrapped so `commands::daemon::reload_daemon` can close and
-                    // reopen it around a daemon restart instead of holding one
-                    // connection across two different daemon process
-                    // generations — see `db_pool::DbPool`'s header for the
-                    // corruption incident this closes off.
-                    app.manage(db_pool::DbPool::new(
+                    // Wrapped so `commands::daemon::reload_daemon` and
+                    // `backend_install::install` can close and reopen it around a
+                    // daemon restart instead of holding one connection across two
+                    // different daemon process generations — see
+                    // `db_pool::DbPool`'s header for the corruption this closes
+                    // off.
+                    let handle = db_pool::DbPool::new(
                         db_pool,
                         db_path.clone(),
                         db_key_hex.clone(),
-                    ));
+                    );
+                    // Capture gets the HANDLE, not a pool clone. A clone would go
+                    // on writing to the pool object that `close()` shut, which is
+                    // both a dead capture engine and the reason quiescing across a
+                    // restage was not previously possible — see `start_capture`.
+                    // Returned from this closure so `app.manage` is guaranteed to
+                    // have run before capture starts.
+                    let capture_pool = handle.clone();
+                    app.manage(handle);
 
                     // Report the repair now that there is a pool to write a notice
                     // with. Deliberately after `app.manage`: the notice is the
@@ -676,7 +684,9 @@ pub fn run() {
                     // never the `db_pool` that was just moved above, and the
                     // pool is already managed by the time this block runs at all.
                     if let Some(outcome) = repair_outcome {
-                        if let Some(p) = capture_pool.clone() {
+                        // `.get()`: `capture_pool` is the swappable handle now, not
+                        // an `Option<SqlitePool>`. Same graceful skip when no pool is open.
+                        if let Some(p) = capture_pool.get() {
                             // Own the strings before the task takes them: the
                             // notice borrows its fields, and `outcome` cannot
                             // outlive this scope. `fault_cleared` decides both
@@ -874,8 +884,7 @@ pub fn run() {
 
                     capture_pool
                 }),
-            )
-            .flatten();
+            );
             // `.manage()` no-ops (returns `false`) when the type is already
             // managed — see `tauri::Manager::manage`'s doc — so this only takes
             // effect on the panic path above, where `app.manage(db_pool)` inside
@@ -1218,7 +1227,14 @@ pub fn run() {
             // isolation, so this matters). Frames → capture_frames (slice 4a),
             // input events → capture_ui_events (slice 3c).
             #[cfg(feature = "capture")]
-            start_capture(app_state.clone(), capture_pool);
+            // `capture_pool` is `None` only when the setup span panicked before it
+            // could build the handle. The fallback `app.manage` above guarantees
+            // one is managed even on that path, so fall through to it rather than
+            // leaving capture dead for the session.
+            match capture_pool {
+                Some(h) => start_capture(app_state.clone(), h),
+                None => restart_capture(app.handle(), &app_state, "setup panic fallback"),
+            }
 
             // Auto-open the setup wizard on first launch (no ~/.meridian/onboarded).
             // The 800 ms delay lets the tray menu settle before the window appears.
@@ -1680,10 +1696,52 @@ fn tray_debug(window: tauri::Window, msg: String) {
 /// # Who calls this
 /// Once from `lib.rs`'s `setup()` on launch, and again from
 /// `commands::pause_for_duration` on resume.
+/// Restart capture using the managed [`db_pool::DbPool`] handle.
+///
+/// Every resume path (pause expiry, disk-space recovery, work-hours start)
+/// wants the same thing, and the one way to get it wrong is to pass a raw
+/// `SqlitePool` clone instead - which is what all three did, and why capture
+/// died silently on the first `DbPool::close`. Centralised so there is one
+/// place to be right.
+///
+/// `try_state` rather than `state`: a tray whose database never opened manages
+/// no handle, and that must warn rather than panic in a poll tick.
+#[cfg(feature = "capture")]
+pub(crate) fn restart_capture(
+    app: &tauri::AppHandle,
+    app_state: &std::sync::Arc<std::sync::Mutex<AppState>>,
+    reason: &'static str,
+) {
+    use tauri::Manager as _;
+    match app.try_state::<db_pool::DbPool>() {
+        Some(h) => start_capture(app_state.clone(), h.inner().clone()),
+        None => tracing::warn!(reason, "no db pool handle managed - capture not restarted"),
+    }
+}
+
+/// `pool` is the SWAPPABLE [`db_pool::DbPool`] handle, not a bare
+/// `Option<SqlitePool>`.
+///
+/// The distinction is the whole point. This used to take a pool clone captured
+/// once at startup and hold it for the tray's entire life. `sqlx::Pool` is
+/// `Arc`-backed and `close()` closes the shared inner pool, so the moment
+/// anything called [`db_pool::DbPool::close`] every write here began failing -
+/// permanently, because the consumers never looked at the handle again and so
+/// never saw the reopened pool. `commands::daemon::reload_daemon` has been
+/// doing exactly that close/reopen since it was written, which means a daemon
+/// reload silently ended capture until the next tray restart.
+///
+/// That also blocked the fix for the recurring corruption: quiescing the pool
+/// across a daemon restage (`backend_install::install`) is the right move, and
+/// with a captured clone it would have traded a corrupt database for a dead
+/// capture engine. Reading `get()` per item makes both safe - a `None` during
+/// the restage window drops that item, which is the same graceful degradation
+/// every reader already has on a cold start, and the next item after `reopen`
+/// lands normally.
 #[cfg(feature = "capture")]
 pub(crate) fn start_capture(
     app_state: std::sync::Arc<std::sync::Mutex<AppState>>,
-    pool: Option<meridian_core::SqlitePool>,
+    pool: db_pool::DbPool,
 ) {
     use capture::{screenpipe::ScreenpipeEngine, CaptureEngine};
 
@@ -1783,7 +1841,8 @@ pub(crate) fn start_capture(
                         );
                         continue;
                     }
-                    let Some(p) = consumer_pool.as_ref() else {
+                    // Re-read the handle per item: see `start_capture`'s doc.
+                    let Some(p) = consumer_pool.get() else {
                         continue;
                     };
                     let row = meridian_core::CaptureFrameInsert {
@@ -1794,8 +1853,8 @@ pub(crate) fn start_capture(
                         text: frame.text,
                         text_source: frame.text_source.as_str().to_string(),
                     };
-                    if let Err(e) = meridian_core::insert_capture_frame(p, &row).await {
-                        tracing::warn!(error = %e, "capture: failed to persist frame");
+                    if let Err(e) = meridian_core::insert_capture_frame(&p, &row).await {
+                        tracing::warn!(error = %meridian::errors::chain(&e), "capture: failed to persist frame");
                     }
                 }
                 capture::CaptureItem::Secondary(sample) => {
@@ -1817,7 +1876,8 @@ pub(crate) fn start_capture(
                         );
                         continue;
                     }
-                    let Some(p) = consumer_pool.as_ref() else {
+                    // Re-read the handle per item: see `start_capture`'s doc.
+                    let Some(p) = consumer_pool.get() else {
                         continue;
                     };
                     let row = meridian_core::CaptureSecondaryScreenInsert {
@@ -1827,8 +1887,8 @@ pub(crate) fn start_capture(
                         window_name: sample.window_name,
                         text: sample.text,
                     };
-                    if let Err(e) = meridian_core::insert_capture_secondary_screen(p, &row).await {
-                        tracing::warn!(error = %e, "capture: failed to persist secondary-screen sample");
+                    if let Err(e) = meridian_core::insert_capture_secondary_screen(&p, &row).await {
+                        tracing::warn!(error = %meridian::errors::chain(&e), "capture: failed to persist secondary-screen sample");
                     }
                 }
             }
@@ -1873,9 +1933,10 @@ pub(crate) fn start_capture(
                     if ui_ignore.lock().unwrap().should_drop_app(ev.app_name.as_deref()) {
                         continue;
                     }
-                    let Some(p) = ui_pool.as_ref() else { continue };
-                    if let Err(e) = meridian_core::insert_capture_ui_event(p, &ev).await {
-                        tracing::warn!(error = %e, "capture: failed to persist ui event");
+                    // Re-read the handle per item: see `start_capture`'s doc.
+                    let Some(p) = ui_pool.get() else { continue };
+                    if let Err(e) = meridian_core::insert_capture_ui_event(&p, &ev).await {
+                        tracing::warn!(error = %meridian::errors::chain(&e), "capture: failed to persist ui event");
                     }
                 }
             }
diff --git a/tray/src-tauri/src/poll/mod.rs b/tray/src-tauri/src/poll/mod.rs
index 832a1fc09..768dae060 100644
--- a/tray/src-tauri/src/poll/mod.rs
+++ b/tray/src-tauri/src/poll/mod.rs
@@ -122,7 +122,7 @@ pub async fn run_poll_loop(app: tauri::AppHandle, state: Arc<Mutex<AppState>>) {
         // check_disk_space's doc comment for why writing into a nearly-full
         // disk must stop rather than degrade silently.
         if let Some(pool) = &pool {
-            check_disk_space(&state, pool).await;
+            check_disk_space(&app, &state, pool).await;
         }
         // Work-hours schedule enforcement: auto-pause capture outside the
         // configured window, auto-resume when entering it. Only fires when the
@@ -223,7 +223,11 @@ fn update_tray_icon(app: &tauri::AppHandle, state: &Arc<Mutex<AppState>>) {
 /// timer) is separately gated in [`crate::commands::pause::resume_capture`],
 /// so a still-low disk can't be resumed into from any direction — this
 /// function only owns the disk-low pause's own start/end transition.
-async fn check_disk_space(state: &Arc<Mutex<AppState>>, pool: &meridian_core::SqlitePool) {
+async fn check_disk_space(
+    app: &tauri::AppHandle,
+    state: &Arc<Mutex<AppState>>,
+    pool: &meridian_core::SqlitePool,
+) {
     let low = meridian::health::platform::meridian_data_low_gb().is_some();
 
     let (pause_source, started_at, capture_paused_flag) = {
@@ -348,7 +352,7 @@ async fn check_disk_space(state: &Arc<Mutex<AppState>>, pool: &meridian_core::Sq
             // capturing nothing) rather than a bug worth cross-checking
             // schedule state here too.
             #[cfg(feature = "capture")]
-            crate::start_capture(state.clone(), Some(pool.clone()));
+            crate::restart_capture(app, state, "disk space recovered");
             tracing::info!(duration_s, "disk-space guard: capture resumed");
         }
         _ => {
@@ -446,7 +450,7 @@ async fn check_work_hours(
             }
             // Restart engine so screen recording resumes.
             #[cfg(feature = "capture")]
-            crate::start_capture(state.clone(), Some(pool.clone()));
+            crate::restart_capture(app, state, "work hours started");
             tracing::info!(
                 duration_s,
                 "work-hours: schedule pause ended — capture resumed"

From 50a62ed9ad857e728b08695e6557a7e4af2fffb9 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Sat, 5 Sep 2026 18:10:04 +0530
Subject: [PATCH 51/53] refactor(otp-worker): send the sign-up notification via
 Resend, not SES

The marketing site has sent this exact notification since June via Resend
(Meridian Sign-ins <notify@meridiona.com> -> adithya@meridiona.com, subject
"New sign-up: <email>"). Routing the desktop app's copy through the same
provider keeps web and desktop sign-ups in one inbox with one sender
identity instead of splitting them across two providers by accident of
which codebase emitted them.

This does not reverse the SES-over-Resend decision: that was specifically
about OTP code delivery, where Resend's 100/day free tier cannot cover
hundreds of user-facing sends. An internal notification to one address is a
couple of dozen a day at most. OTP codes and the rate-limit alert stay on
SES, and ses.ts goes back to being purely SES.

Body and subject now mirror the website's format (plain text, no HTML
part), so both sources thread together. The Rust client is unchanged - the
previousEmail plumbing is transport-agnostic.
---
 infra/otp-worker/README.md                    |  48 ++++--
 infra/otp-worker/src/__tests__/resend.test.ts | 162 ++++++++++++++++++
 infra/otp-worker/src/__tests__/ses.test.ts    |  70 --------
 infra/otp-worker/src/env.d.ts                 |   7 +
 infra/otp-worker/src/index.ts                 |   3 +-
 infra/otp-worker/src/resend.ts                | 155 +++++++++++++++++
 infra/otp-worker/src/ses.ts                   |  81 ---------
 infra/otp-worker/worker-configuration.d.ts    |  10 +-
 infra/otp-worker/wrangler.jsonc               |  21 ++-
 9 files changed, 378 insertions(+), 179 deletions(-)
 create mode 100644 infra/otp-worker/src/__tests__/resend.test.ts
 create mode 100644 infra/otp-worker/src/resend.ts

diff --git a/infra/otp-worker/README.md b/infra/otp-worker/README.md
index ee0756853..1b686b528 100644
--- a/infra/otp-worker/README.md
+++ b/infra/otp-worker/README.md
@@ -165,22 +165,37 @@ Workers Logs.
 ## Account-event notification
 
 On a successful `/otp/verify` (the `verified` case only — never on a wrong
-guess), `handleVerify` fires a second, unrelated SES send to `NOTIFY_EMAIL`
-(`vars.NOTIFY_EMAIL` in `wrangler.jsonc`, currently `company@meridiona.com` on
-both channels) telling the company that an install signed up or changed its
-email. This rides on `ctx.waitUntil` exactly like the rate-limit alert below —
-fire-and-forget, never awaited inline, so a failed notification send can
-never affect the verify response the caller is waiting on.
-
-`ses.ts`'s `resolveAccountEvent(newEmail, previousEmail)` decides which:
-
-- `previousEmail` absent/null → **sign-up** ("A new Meridian install just
-  verified its email: `<email>`").
-- `previousEmail` present and different → **email changed** ("...changed its
-  verified email from `<old>` to `<new>`").
+guess), `handleVerify` fires a notification to `NOTIFY_EMAIL` telling the team
+that an install signed up or changed its email. This rides on `ctx.waitUntil`
+exactly like the rate-limit alert below — fire-and-forget, never awaited
+inline, so a failed notification can never affect the verify response the
+caller is waiting on.
+
+**This one email goes via Resend, not SES** (`resend.ts`). The marketing site
+has sent the identical notification since June — `Meridian Sign-ins
+<notify@meridiona.com>` → `adithya@meridiona.com`, subject `New sign-up:
+<email>` — and routing the desktop app's copy through the same provider keeps
+web and desktop sign-ups in one inbox with one sender identity. It does **not**
+reverse the SES-over-Resend decision below: that decision was about OTP *code*
+delivery, where Resend's 100/day free tier cannot cover hundreds of
+user-facing sends. An internal notification to one address is a couple of
+dozen a day at most.
+
+The body deliberately mirrors the website's format (plain text, no HTML part;
+address on line 1, source, then one status line). Where the web version
+carries `Clerk user id: …`, the desktop app has no equivalent since Clerk was
+removed, so line 2 names the source — which is also what distinguishes a
+desktop notification from a web one at a glance.
+
+`resend.ts`'s `resolveAccountEvent(newEmail, previousEmail)` decides which:
+
+- `previousEmail` absent/null → **sign-up**, subject `New sign-up: <email>`
+  (byte-identical to the website's convention).
+- `previousEmail` present and different → **email changed**, subject
+  `Email changed: <old> -> <new>`. No web equivalent exists for this case.
 - `previousEmail` present and identical to the new email → **no-op**, nothing
-  sent (a "Change email" re-entering the same address that's already on
-  file).
+  sent (a "Change email" re-entering the address already on file must not
+  claim something changed).
 
 `previousEmail` is sent by the client (`tray/src-tauri/src/commands/otp.rs`'s
 `confirm_account_otp`, reading `commands::account::read_account_email()`
@@ -241,9 +256,10 @@ Mirrors the existing `ops/central-observability` convention (public
 | `OTP_CLIENT_TOKEN` | `wrangler secret put` (both envs) | Bearer token the tray sends |
 | `OTP_CODE_PEPPER` | `wrangler secret put` (both envs) | HMAC pepper for code hashing |
 | `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_REGION` | `wrangler secret put` (both envs) | Scoped to an IAM policy permitting only `ses:SendEmail` on the verified identity |
+| `RESEND_API_KEY` | `wrangler secret put` (both envs) | Sending-access key scoped to the `meridiona.com` domain - the account-event notification only, see above |
 | `TURNSTILE_SECRET_KEY` | `wrangler secret put` (both envs), optional | Unset until/unless the frontend spike lands — see "Turnstile" above |
 | `CI_TEST_TOKEN` | `wrangler secret put --env staging` **only** | Staging-only auth token that also unlocks the `/otp/send` code echo — see below |
-| `ENVIRONMENT`, `FROM_ADDRESS`, `FROM_NAME`, `OTP_TTL_S`, `MAX_VERIFY_ATTEMPTS`, `RL_EMAIL_PER_DAY`, `RL_IP_PER_HOUR`, `RL_GLOBAL_PER_DAY`, `ALERT_THRESHOLD_PCT`, `ALERT_EMAIL`, `NOTIFY_EMAIL` | `wrangler.jsonc` `vars` | Public, tunable without touching code |
+| `ENVIRONMENT`, `FROM_ADDRESS`, `FROM_NAME`, `OTP_TTL_S`, `MAX_VERIFY_ATTEMPTS`, `RL_EMAIL_PER_DAY`, `RL_IP_PER_HOUR`, `RL_GLOBAL_PER_DAY`, `ALERT_THRESHOLD_PCT`, `ALERT_EMAIL`, `NOTIFY_EMAIL`, `NOTIFY_FROM` | `wrangler.jsonc` `vars` | Public, tunable without touching code |
 
 ### Staging-only code echo
 
diff --git a/infra/otp-worker/src/__tests__/resend.test.ts b/infra/otp-worker/src/__tests__/resend.test.ts
new file mode 100644
index 000000000..8b60b28b5
--- /dev/null
+++ b/infra/otp-worker/src/__tests__/resend.test.ts
@@ -0,0 +1,162 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+import { describe, expect, it, vi } from "vitest";
+import {
+  buildAccountEventBody,
+  buildAccountEventSubject,
+  resolveAccountEvent,
+  sendAccountEventEmail,
+  type Fetcher,
+} from "../resend";
+
+const ENV = {
+  RESEND_API_KEY: "re_fake_key",
+  NOTIFY_FROM: "Meridian Sign-ins <notify@meridiona.com>",
+  NOTIFY_EMAIL: "adithya@meridiona.com",
+};
+
+/** Decode the JSON body a `sendAccountEventEmail` call posted. */
+function postedBody(fetcher: ReturnType<typeof vi.fn>) {
+  const [, init] = fetcher.mock.calls[0] as unknown as [string, RequestInit];
+  return JSON.parse(String(init.body)) as {
+    from: string;
+    to: string[];
+    subject: string;
+    text: string;
+  };
+}
+
+describe("resolveAccountEvent", () => {
+  it("is a sign-up when there is no previous email", () => {
+    expect(resolveAccountEvent("new@example.com", null)).toEqual({
+      kind: "signed_up",
+      email: "new@example.com",
+    });
+  });
+
+  it("is an email change when the previous email differs", () => {
+    expect(resolveAccountEvent("new@example.com", "old@example.com")).toEqual({
+      kind: "email_changed",
+      from: "old@example.com",
+      to: "new@example.com",
+    });
+  });
+
+  it("is null (nothing to notify) when the previous email is the SAME as the new one", () => {
+    // "Change email" re-entering the address already on file must not send a
+    // notification claiming something changed.
+    expect(resolveAccountEvent("same@example.com", "same@example.com")).toBeNull();
+  });
+});
+
+describe("buildAccountEventSubject", () => {
+  /** The marketing site has sent `New sign-up: <email>` since June; both
+   *  sources must thread together in the same inbox. */
+  it("matches the website's existing sign-up convention exactly", () => {
+    expect(buildAccountEventSubject({ kind: "signed_up", email: "a@b.com" })).toBe("New sign-up: a@b.com");
+  });
+
+  it("gives an email change its own prefix carrying both addresses", () => {
+    expect(
+      buildAccountEventSubject({ kind: "email_changed", from: "old@b.com", to: "new@b.com" }),
+    ).toBe("Email changed: old@b.com -> new@b.com");
+  });
+});
+
+describe("buildAccountEventBody", () => {
+  it("puts the address on line 1 and names the source, mirroring the web format", () => {
+    const lines = buildAccountEventBody({ kind: "signed_up", email: "a@b.com" }).trim().split("\n");
+    expect(lines[0]).toBe("a@b.com");
+    expect(lines[1]).toContain("desktop app");
+    expect(lines[2]).toBe("First time signing in.");
+  });
+
+  it("leads an email change with the NEW address and names the old one", () => {
+    const lines = buildAccountEventBody({
+      kind: "email_changed",
+      from: "old@b.com",
+      to: "new@b.com",
+    })
+      .trim()
+      .split("\n");
+    expect(lines[0]).toBe("new@b.com");
+    expect(lines[2]).toBe("Changed from old@b.com.");
+  });
+
+  it("carries no links", () => {
+    expect(buildAccountEventBody({ kind: "signed_up", email: "a@b.com" })).not.toMatch(/https?:\/\//);
+  });
+});
+
+describe("sendAccountEventEmail", () => {
+  it("posts to Resend with bearer auth and returns true on 2xx", async () => {
+    const fetcher = vi.fn(async () => new Response(JSON.stringify({ id: "x" }), { status: 200 }));
+    const result = await sendAccountEventEmail(
+      { kind: "signed_up", email: "a@b.com" },
+      ENV,
+      fetcher as unknown as Fetcher,
+    );
+    expect(result).toBe(true);
+    const [url, init] = fetcher.mock.calls[0] as unknown as [string, RequestInit];
+    expect(url).toBe("https://api.resend.com/emails");
+    expect((init.headers as Record<string, string>).Authorization).toBe("Bearer re_fake_key");
+  });
+
+  it("sends to NOTIFY_EMAIL from NOTIFY_FROM, never to the account's own address", async () => {
+    const fetcher = vi.fn(async () => new Response("{}", { status: 200 }));
+    await sendAccountEventEmail(
+      { kind: "signed_up", email: "auser@example.com" },
+      ENV,
+      fetcher as unknown as Fetcher,
+    );
+    const body = postedBody(fetcher);
+    expect(body.to).toEqual(["adithya@meridiona.com"]);
+    expect(body.from).toBe("Meridian Sign-ins <notify@meridiona.com>");
+    // The signing-up user is the SUBJECT of the mail, never a recipient of it.
+    expect(body.to).not.toContain("auser@example.com");
+  });
+
+  it("sends text only - no HTML part, matching the website's notification", async () => {
+    const fetcher = vi.fn(async () => new Response("{}", { status: 200 }));
+    await sendAccountEventEmail(
+      { kind: "signed_up", email: "a@b.com" },
+      ENV,
+      fetcher as unknown as Fetcher,
+    );
+    expect(postedBody(fetcher)).not.toHaveProperty("html");
+  });
+
+  it("returns false (never throws) on a non-2xx response", async () => {
+    const fetcher = vi.fn(async () => new Response(JSON.stringify({ message: "nope" }), { status: 422 }));
+    const result = await sendAccountEventEmail(
+      { kind: "signed_up", email: "a@b.com" },
+      ENV,
+      fetcher as unknown as Fetcher,
+    );
+    expect(result).toBe(false);
+  });
+
+  it("returns false (never throws) when the fetch itself rejects", async () => {
+    const fetcher = vi.fn(async () => {
+      throw new Error("network down");
+    });
+    const result = await sendAccountEventEmail(
+      { kind: "signed_up", email: "a@b.com" },
+      ENV,
+      fetcher as unknown as Fetcher,
+    );
+    expect(result).toBe(false);
+  });
+
+  /** A Worker deployed without the secret must degrade to "no notification",
+   *  not throw inside the `ctx.waitUntil` where nothing would surface it. */
+  it("returns false without attempting a request when the API key is unset", async () => {
+    const fetcher = vi.fn(async () => new Response("{}", { status: 200 }));
+    const result = await sendAccountEventEmail(
+      { kind: "signed_up", email: "a@b.com" },
+      { ...ENV, RESEND_API_KEY: "" },
+      fetcher as unknown as Fetcher,
+    );
+    expect(result).toBe(false);
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+});
diff --git a/infra/otp-worker/src/__tests__/ses.test.ts b/infra/otp-worker/src/__tests__/ses.test.ts
index c98cc0d63..95ea1dfd9 100644
--- a/infra/otp-worker/src/__tests__/ses.test.ts
+++ b/infra/otp-worker/src/__tests__/ses.test.ts
@@ -1,15 +1,11 @@
 //ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
 import { describe, expect, it, vi } from "vitest";
 import {
-  buildAccountEventBody,
-  buildAccountEventHtml,
   buildOtpEmailBody,
   buildOtpEmailHtml,
   buildRateLimitAlertBody,
   buildRateLimitAlertHtml,
   extractSesErrorCode,
-  resolveAccountEvent,
-  sendAccountEventEmail,
   sendOtpEmail,
   sendRateLimitAlertEmail,
   type AwsFetcher,
@@ -24,7 +20,6 @@ const ENV = {
 };
 
 const ALERT_ENV = { ...ENV, ALERT_EMAIL: "ops@example.com" };
-const NOTIFY_ENV = { ...ENV, NOTIFY_EMAIL: "company@meridiona.com" };
 
 describe("buildOtpEmailBody", () => {
   it("includes the code and the TTL, and no links", () => {
@@ -154,68 +149,3 @@ describe("sendOtpEmail", () => {
     expect(url).not.toContain("999999");
   });
 });
-
-describe("resolveAccountEvent", () => {
-  it("is a sign-up when there is no previous email", () => {
-    expect(resolveAccountEvent("new@example.com", null)).toEqual({ kind: "signed_up", email: "new@example.com" });
-  });
-
-  it("is an email change when the previous email differs", () => {
-    expect(resolveAccountEvent("new@example.com", "old@example.com")).toEqual({
-      kind: "email_changed",
-      from: "old@example.com",
-      to: "new@example.com",
-    });
-  });
-
-  it("is null (nothing to notify) when the previous email is the SAME as the new one", () => {
-    expect(resolveAccountEvent("same@example.com", "same@example.com")).toBeNull();
-  });
-});
-
-describe("buildAccountEventBody / buildAccountEventHtml", () => {
-  it("a sign-up mentions only the new email, with no links", () => {
-    const body = buildAccountEventBody({ kind: "signed_up", email: "new@example.com" });
-    expect(body).toContain("new@example.com");
-    expect(body).not.toMatch(/https?:\/\//);
-  });
-
-  it("an email change mentions both the old and new addresses", () => {
-    const body = buildAccountEventBody({ kind: "email_changed", from: "old@example.com", to: "new@example.com" });
-    expect(body).toContain("old@example.com");
-    expect(body).toContain("new@example.com");
-  });
-
-  it("the HTML version carries the same addresses, no script tags", () => {
-    const html = buildAccountEventHtml({ kind: "email_changed", from: "old@example.com", to: "new@example.com" });
-    expect(html).toContain("old@example.com");
-    expect(html).toContain("new@example.com");
-    expect(html.toLowerCase()).not.toContain("<script");
-  });
-});
-
-describe("sendAccountEventEmail", () => {
-  it("posts to NOTIFY_EMAIL (not the account's own address) and returns true on 2xx", async () => {
-    const fakeClient: AwsFetcher = { fetch: vi.fn(async () => new Response("{}", { status: 200 })) };
-    const result = await sendAccountEventEmail(
-      { kind: "signed_up", email: "new@example.com" },
-      NOTIFY_ENV,
-      fakeClient,
-    );
-    expect(result).toBe(true);
-    const [, init] = (fakeClient.fetch as ReturnType<typeof vi.fn>).mock.calls[0] as [string, RequestInit];
-    expect(String(init.body)).toContain(encodeURIComponent(NOTIFY_ENV.NOTIFY_EMAIL));
-  });
-
-  it("returns false (never throws) on a non-2xx response", async () => {
-    const fakeClient: AwsFetcher = {
-      fetch: vi.fn(async () => new Response(JSON.stringify({ Error: { Code: "Throttling" } }), { status: 429 })),
-    };
-    const result = await sendAccountEventEmail(
-      { kind: "signed_up", email: "new@example.com" },
-      NOTIFY_ENV,
-      fakeClient,
-    );
-    expect(result).toBe(false);
-  });
-});
diff --git a/infra/otp-worker/src/env.d.ts b/infra/otp-worker/src/env.d.ts
index 567827442..19c0188da 100644
--- a/infra/otp-worker/src/env.d.ts
+++ b/infra/otp-worker/src/env.d.ts
@@ -26,6 +26,13 @@ declare global {
     AWS_ACCESS_KEY_ID: string;
     AWS_SECRET_ACCESS_KEY: string;
     AWS_REGION: string;
+    /**
+     * Resend sending key for the team sign-up notification only — see
+     * `resend.ts` for why that one email is not on SES. Scoped in the Resend
+     * dashboard to sending-access on the `meridiona.com` domain, so it cannot
+     * manage the account or send as `mail.meridiona.com`.
+     */
+    RESEND_API_KEY: string;
     /**
      * Staging-only bearer token that also unlocks the `/otp/send` code-echo
      * (see `auth.ts`). Never set outside `env.staging` — its mere presence on
diff --git a/infra/otp-worker/src/index.ts b/infra/otp-worker/src/index.ts
index e30b9cee6..c0c13f900 100644
--- a/infra/otp-worker/src/index.ts
+++ b/infra/otp-worker/src/index.ts
@@ -55,7 +55,8 @@ import {
   serviceUnavailable,
   unauthorized,
 } from "./responses";
-import { resolveAccountEvent, sendAccountEventEmail, sendOtpEmail, sendRateLimitAlertEmail } from "./ses";
+import { resolveAccountEvent, sendAccountEventEmail } from "./resend";
+import { sendOtpEmail, sendRateLimitAlertEmail } from "./ses";
 import { verifyTurnstileToken } from "./turnstile";
 
 const HOUR_MS = 60 * 60 * 1000;
diff --git a/infra/otp-worker/src/resend.ts b/infra/otp-worker/src/resend.ts
new file mode 100644
index 000000000..8a450a373
--- /dev/null
+++ b/infra/otp-worker/src/resend.ts
@@ -0,0 +1,155 @@
+//ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+/**
+ * The "someone signed up / changed their email" notification to the team,
+ * delivered via **Resend** — deliberately a different provider to the OTP
+ * codes themselves, which stay on SES (`ses.ts`).
+ *
+ * # Why this one is not on SES
+ * The marketing site has sent this exact notification since June via Resend
+ * (`Meridian Sign-ins <notify@meridiona.com>` → the team inbox, subject
+ * `New sign-up: <email>`). Routing the desktop app's copy through the same
+ * provider keeps web and desktop sign-ups in one inbox, one dashboard and one
+ * searchable history, with one sender identity, rather than splitting them
+ * across two providers by accident of which codebase emitted them.
+ *
+ * This does NOT reverse the SES-over-Resend decision recorded in
+ * `README.md` — that decision was specifically about OTP *code* delivery,
+ * where Resend's free tier (100/day) cannot cover the expected hundreds of
+ * user-facing sends a day. An internal notification to a single address is a
+ * couple of dozen a day at most, so the volume objection simply does not
+ * apply to it.
+ *
+ * # Who calls this
+ * - `index.ts`'s `/otp/verify` handler, on the `verified` outcome only, via
+ *   `ctx.waitUntil` (fire-and-forget — see {@link sendAccountEventEmail}).
+ *
+ * # Related
+ * - `ses.ts` — OTP code delivery and the rate-limit alert, both still SES.
+ * - README.md — "Account-event notification".
+ */
+
+/** Resend's transactional send endpoint. */
+const RESEND_ENDPOINT = "https://api.resend.com/emails";
+
+export interface ResendEnv {
+  RESEND_API_KEY: string;
+  /** Full RFC 5322 from-header, e.g. `Meridian Sign-ins <notify@meridiona.com>`. */
+  NOTIFY_FROM: string;
+  /** Single internal recipient. Absent/empty disables the notification entirely. */
+  NOTIFY_EMAIL: string;
+}
+
+/**
+ * The `fetch` slice this module uses, so tests can intercept the network call
+ * without a live API key. Mirrors `ses.ts`'s `AwsFetcher` rationale.
+ */
+export type Fetcher = (input: string, init: RequestInit) => Promise<Response>;
+
+/**
+ * `previousEmail` is client-supplied and purely informational (see
+ * `index.ts`'s `handleVerify`) — never used for a security decision, only to
+ * word this notification.
+ */
+export type AccountEvent =
+  | { kind: "signed_up"; email: string }
+  | { kind: "email_changed"; from: string; to: string };
+
+/**
+ * Decide what (if anything) happened, from `handleVerify`'s point of view.
+ * Pure, so it is unit-tested directly rather than only through a full
+ * send→verify round trip.
+ *
+ * `previousEmail` arrives already normalized by `email.ts`'s
+ * `normalizeEmail`, or `null` when absent/unparseable. Returns `null` for a
+ * no-op re-verify of the SAME address — which happens legitimately when
+ * "Change email" is used to re-enter the address already on file, and must
+ * not generate a notification saying nothing changed.
+ */
+export function resolveAccountEvent(
+  newEmail: string,
+  previousEmail: string | null,
+): AccountEvent | null {
+  if (previousEmail === newEmail) return null;
+  if (previousEmail) return { kind: "email_changed", from: previousEmail, to: newEmail };
+  return { kind: "signed_up", email: newEmail };
+}
+
+/**
+ * Subject line, matching the marketing site's existing convention exactly
+ * (`New sign-up: <email>`) so both sources thread together in the inbox.
+ * `email_changed` has no web equivalent and gets its own prefix.
+ */
+export function buildAccountEventSubject(event: AccountEvent): string {
+  return event.kind === "signed_up"
+    ? `New sign-up: ${event.email}`
+    : `Email changed: ${event.from} -> ${event.to}`;
+}
+
+/**
+ * Plain-text body, deliberately mirroring the shape the website already
+ * sends: the address on line 1, an identifying line, then one sentence of
+ * status. **Text only, no HTML part** — the web notification has no HTML
+ * part either, and an internal one-line alert gains nothing from markup.
+ *
+ * Where the web version carries `Clerk user id: …`, the desktop app has no
+ * equivalent (Clerk was removed), so the second line names the source
+ * instead — which is also what makes a desktop notification distinguishable
+ * from a web one at a glance.
+ */
+export function buildAccountEventBody(event: AccountEvent): string {
+  const source = "Source: desktop app (email OTP)";
+  return event.kind === "signed_up"
+    ? `${event.email}\n${source}\nFirst time signing in.\n`
+    : `${event.to}\n${source}\nChanged from ${event.from}.\n`;
+}
+
+/**
+ * Send the notification. Returns `false` (never throws) on any failure —
+ * network error, non-2xx, or an unset API key — because this rides on
+ * `ctx.waitUntil` behind an OTP verify that has already succeeded from the
+ * user's point of view. A failed notification must never turn into a failed
+ * sign-in.
+ *
+ * The API key is checked here rather than at the call site so a Worker
+ * deployed without the secret degrades to "no notification" instead of
+ * throwing inside a `waitUntil` where nothing would surface it.
+ */
+export async function sendAccountEventEmail(
+  event: AccountEvent,
+  env: ResendEnv,
+  fetcher: Fetcher = fetch,
+): Promise<boolean> {
+  if (!env.RESEND_API_KEY) {
+    console.error("otp-worker: RESEND_API_KEY is not configured — account-event notification skipped");
+    return false;
+  }
+  try {
+    const res = await fetcher(RESEND_ENDPOINT, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${env.RESEND_API_KEY}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        from: env.NOTIFY_FROM,
+        to: [env.NOTIFY_EMAIL],
+        subject: buildAccountEventSubject(event),
+        text: buildAccountEventBody(event),
+      }),
+    });
+    if (!res.ok) {
+      // Deliberately logs the STATUS only, never the response body: a Resend
+      // error echoes the `to`/`from` addresses back, and the recipient here
+      // is an internal address we have no reason to put in Workers Logs.
+      console.error("otp-worker: account-event notification failed", {
+        status: res.status,
+        kind: event.kind,
+      });
+      return false;
+    }
+    return true;
+  } catch (err) {
+    console.error("otp-worker: account-event notification threw", { error: String(err) });
+    return false;
+  }
+}
diff --git a/infra/otp-worker/src/ses.ts b/infra/otp-worker/src/ses.ts
index 04841b09f..481e9c930 100644
--- a/infra/otp-worker/src/ses.ts
+++ b/infra/otp-worker/src/ses.ts
@@ -288,84 +288,3 @@ export async function sendRateLimitAlertEmail(
     "rate-limit alert",
   );
 }
-
-/**
- * `previousEmail` is client-supplied and purely informational (see
- * `index.ts`'s `handleVerify`) — it is never used for any security decision,
- * only to word this notification. `null`/absent means "no prior email on
- * this install", which reads as a first-time sign-up.
- */
-export type AccountEvent = { kind: "signed_up"; email: string } | { kind: "email_changed"; from: string; to: string };
-
-/**
- * Decide what (if anything) happened, from `index.ts`'s `handleVerify` point
- * of view — pure, so this is unit-tested directly rather than only through a
- * full send→verify round trip. `previousEmail` is whatever the client sent
- * (already normalized by `email.ts`'s `normalizeEmail`, or `null` if
- * absent/unparseable) — purely informational, never a security input.
- * Returns `null` for a no-op re-verify of the SAME address (nothing changed,
- * nothing to notify) — this can legitimately happen if "Change email" is
- * used to re-enter the address already on file.
- */
-export function resolveAccountEvent(newEmail: string, previousEmail: string | null): AccountEvent | null {
-  if (previousEmail === newEmail) return null;
-  if (previousEmail) return { kind: "email_changed", from: previousEmail, to: newEmail };
-  return { kind: "signed_up", email: newEmail };
-}
-
-/** The plain-text body of the "someone signed in / changed their email" notification. */
-export function buildAccountEventBody(event: AccountEvent): string {
-  if (event.kind === "signed_up") {
-    return `A new Meridian install just verified its email: ${event.email}`;
-  }
-  return `A Meridian install changed its verified email from ${event.from} to ${event.to}`;
-}
-
-/** The HTML body — same plain, no-links shape as the other two email kinds. */
-export function buildAccountEventHtml(event: AccountEvent): string {
-  const safeBody = escapeHtml(buildAccountEventBody(event));
-  const heading = event.kind === "signed_up" ? "New sign-up" : "Email changed";
-  return `<!doctype html>
-<html>
-  <body style="margin:0;padding:0;background-color:#f4f4f5;">
-    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background-color:#f4f4f5;padding:32px 16px;">
-      <tr>
-        <td align="center">
-          <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:480px;background-color:#ffffff;border-radius:12px;overflow:hidden;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;">
-            <tr>
-              <td style="padding:28px 32px;">
-                <p style="margin:0 0 8px 0;font-size:15px;font-weight:600;color:#18181b;">${heading}</p>
-                <p style="margin:0;font-size:13px;line-height:20px;color:#3f3f46;">${safeBody}</p>
-              </td>
-            </tr>
-          </table>
-        </td>
-      </tr>
-    </table>
-  </body>
-</html>`;
-}
-
-/**
- * Notify `NOTIFY_EMAIL` of a sign-up or email change. Returns `false` (never
- * throws), same contract as the other two senders — this rides on
- * `ctx.waitUntil` in `index.ts`'s `handleVerify` and must never affect the
- * verify response it's attached to.
- */
-export async function sendAccountEventEmail(
-  event: AccountEvent,
-  env: SesEnv & { NOTIFY_EMAIL: string },
-  client: AwsFetcher = defaultAwsClient(env),
-): Promise<boolean> {
-  const subject =
-    event.kind === "signed_up" ? "Meridian: new sign-up" : "Meridian: user changed their email";
-  return postSesEmail(
-    env.NOTIFY_EMAIL,
-    subject,
-    buildAccountEventBody(event),
-    buildAccountEventHtml(event),
-    env,
-    client,
-    "account-event notification",
-  );
-}
diff --git a/infra/otp-worker/worker-configuration.d.ts b/infra/otp-worker/worker-configuration.d.ts
index fce33a481..6d4b21d2b 100644
--- a/infra/otp-worker/worker-configuration.d.ts
+++ b/infra/otp-worker/worker-configuration.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: 4cbd50efe476d085fe928ce46f32e312)
+// Generated by Wrangler by running `wrangler types` (hash: eba0940c743da61b832ab350e1f8371d)
 // Runtime types generated with workerd@1.20260828.1 2026-08-25 nodejs_compat
 interface __BaseEnv_Env {
 	OTP_KV: KVNamespace;
@@ -13,7 +13,8 @@ interface __BaseEnv_Env {
 	RL_GLOBAL_PER_DAY: 500 | 2000;
 	ALERT_THRESHOLD_PCT: 80;
 	ALERT_EMAIL: "akarsh@meridiona.com";
-	NOTIFY_EMAIL: "company@meridiona.com";
+	NOTIFY_EMAIL: "adithya@meridiona.com";
+	NOTIFY_FROM: "Meridian Sign-ins (staging) <notify@meridiona.com>" | "Meridian Sign-ins <notify@meridiona.com>";
 }
 declare namespace Cloudflare {
 	interface GlobalProps {
@@ -31,7 +32,8 @@ declare namespace Cloudflare {
 		RL_GLOBAL_PER_DAY: 500;
 		ALERT_THRESHOLD_PCT: 80;
 		ALERT_EMAIL: "akarsh@meridiona.com";
-		NOTIFY_EMAIL: "company@meridiona.com";
+		NOTIFY_EMAIL: "adithya@meridiona.com";
+		NOTIFY_FROM: "Meridian Sign-ins (staging) <notify@meridiona.com>";
 	}
 	interface Env extends __BaseEnv_Env {}
 }
@@ -40,7 +42,7 @@ type StringifyValues<EnvType extends Record<string, unknown>> = {
 	[Binding in keyof EnvType]: EnvType[Binding] extends string ? EnvType[Binding] : string;
 };
 declare namespace NodeJS {
-	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "ENVIRONMENT" | "FROM_ADDRESS" | "FROM_NAME" | "OTP_TTL_S" | "MAX_VERIFY_ATTEMPTS" | "RL_EMAIL_PER_DAY" | "RL_IP_PER_HOUR" | "RL_GLOBAL_PER_DAY" | "ALERT_THRESHOLD_PCT" | "ALERT_EMAIL" | "NOTIFY_EMAIL">> {}
+	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "ENVIRONMENT" | "FROM_ADDRESS" | "FROM_NAME" | "OTP_TTL_S" | "MAX_VERIFY_ATTEMPTS" | "RL_EMAIL_PER_DAY" | "RL_IP_PER_HOUR" | "RL_GLOBAL_PER_DAY" | "ALERT_THRESHOLD_PCT" | "ALERT_EMAIL" | "NOTIFY_EMAIL" | "NOTIFY_FROM">> {}
 }
 
 // Begin runtime types
diff --git a/infra/otp-worker/wrangler.jsonc b/infra/otp-worker/wrangler.jsonc
index 6298ba2d5..13d252a7b 100644
--- a/infra/otp-worker/wrangler.jsonc
+++ b/infra/otp-worker/wrangler.jsonc
@@ -51,12 +51,18 @@
     "ALERT_THRESHOLD_PCT": 80,
     "ALERT_EMAIL": "akarsh@meridiona.com",
     // Fires once per successful /otp/verify (sign-up or a changed email) —
-    // see ses.ts's sendAccountEventEmail. Unlike ALERT_EMAIL this has no
-    // once-per-day dedup: every verify here is a genuine one-time capture or
-    // a deliberate "Change email" action, never a routine re-login (this app
-    // has no session/sign-in-again concept), so there's no repeat-noise case
-    // to suppress.
-    "NOTIFY_EMAIL": "company@meridiona.com"
+    // see resend.ts. Unlike ALERT_EMAIL this has no once-per-day dedup: every
+    // verify here is a genuine one-time capture or a deliberate "Change
+    // email" action, never a routine re-login (this app has no
+    // session/sign-in-again concept), so there's no repeat-noise case to
+    // suppress.
+    //
+    // Recipient and sender deliberately MATCH the marketing site's existing
+    // sign-up notification, so web and desktop sign-ups thread together in
+    // one inbox rather than landing in two places. Delivered via Resend, not
+    // SES, for the same reason - see resend.ts's module header.
+    "NOTIFY_EMAIL": "adithya@meridiona.com",
+    "NOTIFY_FROM": "Meridian Sign-ins <notify@meridiona.com>"
   },
 
   "env": {
@@ -92,7 +98,8 @@
         "RL_GLOBAL_PER_DAY": 500,
         "ALERT_THRESHOLD_PCT": 80,
         "ALERT_EMAIL": "akarsh@meridiona.com",
-        "NOTIFY_EMAIL": "company@meridiona.com"
+        "NOTIFY_EMAIL": "adithya@meridiona.com",
+        "NOTIFY_FROM": "Meridian Sign-ins (staging) <notify@meridiona.com>"
       }
     }
   }

From 65654a5498b30908b4d3dab34d79e8d0feb994a2 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Sat, 5 Sep 2026 18:52:02 +0530
Subject: [PATCH 52/53] fix(otp-worker): point staging's sign-up notification
 at the engineer

A test sign-up on staging is not a real one. Delivering "New sign-up:
<test address>" to the team inbox makes the production notification less
trustworthy every time someone exercises staging, so staging now notifies
akarsh@ and production remains the only channel reaching adithya@.
---
 infra/otp-worker/worker-configuration.d.ts | 6 +++---
 infra/otp-worker/wrangler.jsonc            | 7 ++++++-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/infra/otp-worker/worker-configuration.d.ts b/infra/otp-worker/worker-configuration.d.ts
index 6d4b21d2b..e508e9a33 100644
--- a/infra/otp-worker/worker-configuration.d.ts
+++ b/infra/otp-worker/worker-configuration.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: eba0940c743da61b832ab350e1f8371d)
+// Generated by Wrangler by running `wrangler types` (hash: 6a41e3f36c13b201061c438f4c29532f)
 // Runtime types generated with workerd@1.20260828.1 2026-08-25 nodejs_compat
 interface __BaseEnv_Env {
 	OTP_KV: KVNamespace;
@@ -13,7 +13,7 @@ interface __BaseEnv_Env {
 	RL_GLOBAL_PER_DAY: 500 | 2000;
 	ALERT_THRESHOLD_PCT: 80;
 	ALERT_EMAIL: "akarsh@meridiona.com";
-	NOTIFY_EMAIL: "adithya@meridiona.com";
+	NOTIFY_EMAIL: "akarsh@meridiona.com" | "adithya@meridiona.com";
 	NOTIFY_FROM: "Meridian Sign-ins (staging) <notify@meridiona.com>" | "Meridian Sign-ins <notify@meridiona.com>";
 }
 declare namespace Cloudflare {
@@ -32,7 +32,7 @@ declare namespace Cloudflare {
 		RL_GLOBAL_PER_DAY: 500;
 		ALERT_THRESHOLD_PCT: 80;
 		ALERT_EMAIL: "akarsh@meridiona.com";
-		NOTIFY_EMAIL: "adithya@meridiona.com";
+		NOTIFY_EMAIL: "akarsh@meridiona.com";
 		NOTIFY_FROM: "Meridian Sign-ins (staging) <notify@meridiona.com>";
 	}
 	interface Env extends __BaseEnv_Env {}
diff --git a/infra/otp-worker/wrangler.jsonc b/infra/otp-worker/wrangler.jsonc
index 13d252a7b..f953d2485 100644
--- a/infra/otp-worker/wrangler.jsonc
+++ b/infra/otp-worker/wrangler.jsonc
@@ -98,7 +98,12 @@
         "RL_GLOBAL_PER_DAY": 500,
         "ALERT_THRESHOLD_PCT": 80,
         "ALERT_EMAIL": "akarsh@meridiona.com",
-        "NOTIFY_EMAIL": "adithya@meridiona.com",
+        // Staging notifies the ENGINEER, not the team inbox: a test sign-up
+        // here is not a real one, and delivering "New sign-up: <test
+        // address>" to a colleague makes the production notification less
+        // trustworthy every time someone exercises staging. Production is
+        // the only channel that reaches the team inbox.
+        "NOTIFY_EMAIL": "akarsh@meridiona.com",
         "NOTIFY_FROM": "Meridian Sign-ins (staging) <notify@meridiona.com>"
       }
     }

From 61602c37d7ba24312e1007db0fbdb6a298db7307 Mon Sep 17 00:00:00 2001
From: Akarsh Hegde <hegdeakarsh2002@gmail.com>
Date: Sat, 5 Sep 2026 18:55:03 +0530
Subject: [PATCH 53/53] chore(otp-worker): route both the alert and the
 notification to adithya

Reverts the staging-only notify split and moves the rate-limit alert off
akarsh@ as well, so both emails reach the same team inbox on both channels.
---
 infra/otp-worker/worker-configuration.d.ts | 10 +++++-----
 infra/otp-worker/wrangler.jsonc            | 11 +++--------
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/infra/otp-worker/worker-configuration.d.ts b/infra/otp-worker/worker-configuration.d.ts
index e508e9a33..b778f73e0 100644
--- a/infra/otp-worker/worker-configuration.d.ts
+++ b/infra/otp-worker/worker-configuration.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: 6a41e3f36c13b201061c438f4c29532f)
+// Generated by Wrangler by running `wrangler types` (hash: a22d164b08fe44e1108fc22f4e5eee71)
 // Runtime types generated with workerd@1.20260828.1 2026-08-25 nodejs_compat
 interface __BaseEnv_Env {
 	OTP_KV: KVNamespace;
@@ -12,8 +12,8 @@ interface __BaseEnv_Env {
 	RL_IP_PER_HOUR: 30 | 10;
 	RL_GLOBAL_PER_DAY: 500 | 2000;
 	ALERT_THRESHOLD_PCT: 80;
-	ALERT_EMAIL: "akarsh@meridiona.com";
-	NOTIFY_EMAIL: "akarsh@meridiona.com" | "adithya@meridiona.com";
+	ALERT_EMAIL: "adithya@meridiona.com";
+	NOTIFY_EMAIL: "adithya@meridiona.com";
 	NOTIFY_FROM: "Meridian Sign-ins (staging) <notify@meridiona.com>" | "Meridian Sign-ins <notify@meridiona.com>";
 }
 declare namespace Cloudflare {
@@ -31,8 +31,8 @@ declare namespace Cloudflare {
 		RL_IP_PER_HOUR: 30;
 		RL_GLOBAL_PER_DAY: 500;
 		ALERT_THRESHOLD_PCT: 80;
-		ALERT_EMAIL: "akarsh@meridiona.com";
-		NOTIFY_EMAIL: "akarsh@meridiona.com";
+		ALERT_EMAIL: "adithya@meridiona.com";
+		NOTIFY_EMAIL: "adithya@meridiona.com";
 		NOTIFY_FROM: "Meridian Sign-ins (staging) <notify@meridiona.com>";
 	}
 	interface Env extends __BaseEnv_Env {}
diff --git a/infra/otp-worker/wrangler.jsonc b/infra/otp-worker/wrangler.jsonc
index f953d2485..35f7e15c1 100644
--- a/infra/otp-worker/wrangler.jsonc
+++ b/infra/otp-worker/wrangler.jsonc
@@ -49,7 +49,7 @@
     // only: per-email/per-IP caps tripping is routine abuse-prevention
     // noise, not something worth an alert.
     "ALERT_THRESHOLD_PCT": 80,
-    "ALERT_EMAIL": "akarsh@meridiona.com",
+    "ALERT_EMAIL": "adithya@meridiona.com",
     // Fires once per successful /otp/verify (sign-up or a changed email) —
     // see resend.ts. Unlike ALERT_EMAIL this has no once-per-day dedup: every
     // verify here is a genuine one-time capture or a deliberate "Change
@@ -97,13 +97,8 @@
         "RL_IP_PER_HOUR": 30,
         "RL_GLOBAL_PER_DAY": 500,
         "ALERT_THRESHOLD_PCT": 80,
-        "ALERT_EMAIL": "akarsh@meridiona.com",
-        // Staging notifies the ENGINEER, not the team inbox: a test sign-up
-        // here is not a real one, and delivering "New sign-up: <test
-        // address>" to a colleague makes the production notification less
-        // trustworthy every time someone exercises staging. Production is
-        // the only channel that reaches the team inbox.
-        "NOTIFY_EMAIL": "akarsh@meridiona.com",
+        "ALERT_EMAIL": "adithya@meridiona.com",
+        "NOTIFY_EMAIL": "adithya@meridiona.com",
         "NOTIFY_FROM": "Meridian Sign-ins (staging) <notify@meridiona.com>"
       }
     }