diff --git a/.github/workflows/lint-prettier.yml b/.github/workflows/lint-prettier.yml
index 41c746117..b5677fc63 100644
--- a/.github/workflows/lint-prettier.yml
+++ b/.github/workflows/lint-prettier.yml
@@ -2,6 +2,11 @@ name: Lint & Prettier
 on:
   pull_request:
     branches: [main, dev]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 5b2cfe08b..c522f18c1 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -9,6 +9,10 @@ on:
 permissions:
   pull-requests: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   scout:
     # Docker Hub secrets are not exposed to pull requests from forks, so the
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a19cbbc3b..293d8fd92 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,46 +1,91 @@
-name: Tests
+name: Tests & SonarQube
 
 permissions:
   contents: read
 
+# The repo's test/quality CI and SonarQube Cloud analysis in one workflow, so
+# each test suite runs once per event instead of once for the old test.yml and
+# once more for Sonar's coverage. Pushes to dev and main produce branch
+# analysis; pull requests get PR analysis with decoration on the PR itself
+# (the scanner picks the context up from the Actions environment).
+#
+# Job layout — three tiers:
+#   - Preflight: plugin-facts, i18n-parity and the quality jobs
+#     (server-quality, client-quality, plugin-sdk-quality) hold the cheap
+#     generated-code/typecheck/lint/smoke gates. Every test job `needs:` all
+#     of them, so a gate failure stops the run before the expensive coverage
+#     fan-out spends ~15 runner-minutes on a result the gates already sank.
+#   - Tests: the *-coverage jobs run the suites and upload lcov; s3-contract
+#     runs the MinIO contract suite. Coverage jobs run tests only — with the
+#     gates cleared in preflight, they can only fail because tests failed.
+#   - Scan `needs:` exactly the four coverage jobs. A coverage job failing
+#     must stop the scan — a missing lcov file would make every line of that
+#     package report as uncovered, and the dashboard would show a collapse
+#     that did not happen. (The preflight gates stop it transitively.)
+#   - Fork PRs don't receive secrets, so the two jobs that need them skip
+#     themselves: s3-contract (MINIO_LICENSE_KEY) and scan (SONAR_TOKEN).
+#     Everything else runs on fork PRs so outside contributors still get the
+#     full test signal.
+#
+# Automatic Analysis must stay disabled on sonarcloud.io — it is mutually
+# exclusive with CI-based analysis, and it cannot import the lcov coverage
+# this workflow produces.
 on:
+  push:
+    branches: [main, dev]
   pull_request:
     branches: [main, dev]
+    # A PR that touches none of these can't change the tests or the analysis,
+    # so don't spend the coverage fan-out on it. Pushes stay unfiltered so the
+    # branch view is always refreshed from the merge result.
     paths:
       - 'server/**'
       - 'client/**'
       - 'shared/**'
       - 'plugin-sdk/**'
-      # npm workspaces hoist every dependency into the single root lockfile, so
-      # a dependency bump touches none of the four directories above — and a
-      # native binding like better-sqlite3 is exactly what needs the suite.
+      # npm workspaces hoist every dependency into the single root lockfile,
+      # so a dependency bump touches none of the four directories above — and
+      # a native binding like better-sqlite3 is exactly what needs the suite.
       - 'package.json'
       - 'package-lock.json'
       - 'Dockerfile'
       - 'docker-compose.yml'
-      - '.github/workflows/test.yml'
+      - 'sonar-project.properties'
+      - '.github/workflows/sonarqube.yml'
+  workflow_dispatch:
+
+# A newer push to the same branch/PR supersedes the running one — cancel it
+# rather than spending the coverage fan-out on a stale commit. Safe here
+# because the Sonar scan job runs last and only the latest commit matters.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   plugin-facts:
     name: Plugin Permission Facts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
+          # 22 matches the TREK server runtime (same choice as the plugin-sdk
+          # jobs and publish-plugin-sdk.yml).
           node-version: 22
           cache: npm
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci --workspace server
 
       # The plugin permission facts live once, in
-      # server/src/nest/plugins/protocol/envelope.ts. Every other copy - the SDK's
-      # generated/host-facts.ts and shared's plugin-permissions.ts - is generated from it
-      # and checked in, because publish-plugin-sdk builds from a standalone checkout with
-      # no server present. This fails the PR if a copy drifts, if a new permission has no
-      # admin.plugins.perm.* translation, or if the CLI has no hint for it.
+      # server/src/nest/plugins/protocol/envelope.ts. Every other copy — the
+      # SDK's generated/host-facts.ts and shared's plugin-permissions.ts — is
+      # generated from it and checked in, because publish-plugin-sdk builds
+      # from a standalone checkout with no server present. This fails the run
+      # if a copy drifts, if a new permission has no admin.plugins.perm.*
+      # translation, or if the CLI has no hint for it.
       - name: Check the generated plugin facts are in sync
         run: cd server && npm run check:plugin-facts
 
@@ -58,32 +103,9 @@ jobs:
       - name: Check i18n key parity
         run: node shared/scripts/i18n-parity.mjs --strict
 
-  shared-contracts:
-    name: Shared Contracts (Zod)
+  server-quality:
+    name: Server Types & Lint
     runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: npm
-          cache-dependency-path: package-lock.json
-
-      - name: Install dependencies
-        run: npm ci --workspace shared
-
-      - name: Typecheck
-        run: cd shared && npm run typecheck
-
-      - name: Run tests
-        run: cd shared && npm test
-
-  server-tests:
-    name: Server Tests
-    runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v6
 
@@ -96,18 +118,15 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Ensure @swc/core's Linux binary for unplugin-swc
-        # The lockfile was generated on Windows and omits @swc/core's Linux
-        # optional native binary, so npm ci/install skips it on the runner.
-        # Install the matching version explicitly so the server's SWC transform
-        # (server/vitest.config.ts) can load.
-        run: |
-          SWC_VERSION=$(node -p "require('@swc/core/package.json').version")
-          npm install --no-save --legacy-peer-deps "@swc/core-linux-x64-gnu@$SWC_VERSION"
-
       - name: Build shared
         run: npm run build --workspace=shared
 
+      - name: Typecheck shared
+        # Rides along here rather than in shared-coverage: this job already
+        # pays the root install and shared build, and a coverage job may only
+        # fail because tests failed (it gates the scan).
+        run: cd shared && npm run typecheck
+
       - name: Build server (tsc -> dist)
         run: cd server && npm run build
 
@@ -123,30 +142,73 @@ jobs:
       - name: Typecheck tests
         # tests/ is outside the build tsconfig, so a service that grows a
         # constructor parameter does not break its hand-wired call sites at
-        # compile time: the argument arrives as undefined and throws at runtime,
-        # if anything reads it at all. This is the step that catches it.
+        # compile time: the argument arrives as undefined and throws at
+        # runtime, if anything reads it at all. This is the step that
+        # catches it.
         run: cd server && npm run typecheck:tests
 
       - name: Lint
         run: cd server && npm run lint:check
 
-      - name: Run tests
-        run: cd server && npm run test:coverage
+  client-quality:
+    name: Client Types & Lint
+    runs-on: ubuntu-latest
 
-      - name: Upload coverage
-        if: success()
-        uses: actions/upload-artifact@v6
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
         with:
-          name: backend-coverage
-          path: server/coverage/
-          retention-days: 7
+          node-version: 24
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install dependencies
+        run: npm ci --workspace shared && npm ci --workspace client
+
+      - name: Build shared
+        run: npm run build --workspace=shared
+
+      - name: Typecheck
+        run: cd client && npm run typecheck
+
+      - name: Lint
+        run: cd client && npm run lint:check
+
+      - name: Page pattern check
+        run: cd client && npm run lint:pages
+
+  plugin-sdk-quality:
+    name: Plugin SDK Types
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: plugin-sdk
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+
+      # plugin-sdk is standalone (own lockfile, not a root workspace), so it
+      # installs from its own directory.
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
 
   s3-contract:
     name: S3 Driver Contract (MinIO)
     runs-on: ubuntu-latest
-    # Fork PRs don't get repo secrets, so MINIO_LICENSE_KEY would be empty
-    # and the AIStor container would fail to boot.
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
+    # Fork PRs don't get repo secrets, so MINIO_LICENSE_KEY would be empty and
+    # the AIStor container would fail to boot. Pushes and manual dispatches do
+    # have secrets, so only fork PRs are filtered out. (The implicit success()
+    # on this expression also keeps the job skipped when a preflight fails.)
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
 
     steps:
       - uses: actions/checkout@v6
@@ -210,14 +272,10 @@ jobs:
           TREK_TEST_S3_SECRET_ACCESS_KEY: trekci-secret
         run: cd server && npx vitest run tests/unit/nest/storage/s3.driver.contract.test.ts
 
-  client-quality:
-    # Split out of client-tests: the suite takes ~11 minutes, and having the
-    # gates in front of it meant a single lint finding threw away the whole test
-    # signal for that run. Both jobs pay the install/build, which is cheap next
-    # to running the two in series.
-    name: Client Types & Lint
+  server-coverage:
+    name: Server Coverage
     runs-on: ubuntu-latest
-
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     steps:
       - uses: actions/checkout@v6
 
@@ -228,24 +286,34 @@ jobs:
           cache-dependency-path: package-lock.json
 
       - name: Install dependencies
-        run: npm ci --workspace shared && npm ci --workspace client
+        run: npm ci
+
+      - name: Ensure @swc/core's Linux binary for unplugin-swc
+        # The lockfile was generated on Windows and omits @swc/core's Linux
+        # optional native binary, so npm ci/install skips it on the runner.
+        # Install the matching version explicitly so the server's SWC transform
+        # (server/vitest.config.ts) can load.
+        run: |
+          SWC_VERSION=$(node -p "require('@swc/core/package.json').version")
+          npm install --no-save --legacy-peer-deps "@swc/core-linux-x64-gnu@$SWC_VERSION"
 
       - name: Build shared
         run: npm run build --workspace=shared
 
-      - name: Typecheck
-        run: cd client && npm run typecheck
+      - name: Run tests with coverage
+        run: cd server && npm run test:coverage
 
-      - name: Lint
-        run: cd client && npm run lint:check
+      - name: Upload coverage
+        uses: actions/upload-artifact@v6
+        with:
+          name: sonar-server-coverage
+          path: server/coverage/
+          retention-days: 1
 
-      - name: Page pattern check
-        run: cd client && npm run lint:pages
-
-  client-tests:
-    name: Client Tests
+  client-coverage:
+    name: Client Coverage
     runs-on: ubuntu-latest
-
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     steps:
       - uses: actions/checkout@v6
 
@@ -255,19 +323,142 @@ jobs:
           cache: npm
           cache-dependency-path: package-lock.json
 
+      # Only the shared and client workspaces — a full root npm ci is not
+      # needed, and the scoped install keeps @testing-library/dom (a peer of
+      # @testing-library/react) in the tree without the re-resolution dance
+      # the folded coverage job used to need.
       - name: Install dependencies
         run: npm ci --workspace shared && npm ci --workspace client
 
       - name: Build shared
         run: npm run build --workspace=shared
 
-      - name: Run tests
+      - name: Run tests with coverage
         run: cd client && npm run test:coverage
 
       - name: Upload coverage
-        if: success()
         uses: actions/upload-artifact@v6
         with:
-          name: frontend-coverage
+          name: sonar-client-coverage
           path: client/coverage/
-          retention-days: 7
+          retention-days: 1
+
+  shared-coverage:
+    name: Shared Coverage
+    runs-on: ubuntu-latest
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install dependencies
+        run: npm ci --workspace shared
+
+      - name: Run tests with coverage
+        run: cd shared && npm run test:coverage
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v6
+        with:
+          name: sonar-shared-coverage
+          path: shared/coverage/
+          retention-days: 1
+
+  plugin-sdk-coverage:
+    name: Plugin SDK Coverage
+    runs-on: ubuntu-latest
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
+    defaults:
+      run:
+        working-directory: plugin-sdk
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          # 22 matches the TREK server runtime and has node:sqlite, which the
+          # dev-server tests exercise (same choice as publish-plugin-sdk.yml).
+          node-version: 22
+
+      # plugin-sdk is standalone (own lockfile, not a root workspace), so it
+      # installs from its own directory.
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests with coverage
+        run: npm run test:coverage
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v6
+        with:
+          name: sonar-plugin-sdk-coverage
+          path: plugin-sdk/coverage/
+          retention-days: 1
+
+  scan:
+    name: Scan
+    runs-on: ubuntu-latest
+    # Fork PRs don't receive SONAR_TOKEN — skip the scan rather than fail it.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    # Coverage jobs failing must stop the scan: a missing lcov file would make
+    # every line of that package report as uncovered, and the dashboard would
+    # show a collapse that did not happen. The preflight gates already stop it
+    # transitively through these four, so they aren't repeated here.
+    needs: [server-coverage, client-coverage, shared-coverage, plugin-sdk-coverage]
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          # Sonar reads git blame to date each issue and to decide what counts
+          # as new code. A shallow clone leaves it blind to both.
+          fetch-depth: 0
+
+      - name: Download server coverage
+        uses: actions/download-artifact@v6
+        with:
+          name: sonar-server-coverage
+          path: server/coverage/
+
+      - name: Download client coverage
+        uses: actions/download-artifact@v6
+        with:
+          name: sonar-client-coverage
+          path: client/coverage/
+
+      - name: Download shared coverage
+        uses: actions/download-artifact@v6
+        with:
+          name: sonar-shared-coverage
+          path: shared/coverage/
+
+      - name: Download plugin-sdk coverage
+        uses: actions/download-artifact@v6
+        with:
+          name: sonar-plugin-sdk-coverage
+          path: plugin-sdk/coverage/
+
+      - name: Scan
+        uses: SonarSource/sonarqube-scan-action@v8
+        env:
+          # SonarQube Cloud is the scan action's default host, so no
+          # SONAR_HOST_URL — the token is a sonarcloud.io token for the
+          # liketrek org.
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          # New Code is configured as "previous version", so this string is what
+          # draws that line — changing it re-bases every "new code" metric.
+          # Pinned rather than read from package.json on purpose: package.json is
+          # still on 3.4.1 while the project has been analysed as 4.0.0 all along,
+          # and taking the lower number would silently move the baseline. Bump it
+          # here as part of the release, together with the version bump.
+          #
+          # Everything else — sources, tests, exclusions, the documented
+          # false-positive list — lives in sonar-project.properties so it stays
+          # reviewable in a PR rather than buried in workflow YAML.
+          args: -Dsonar.projectVersion=4.0.0
diff --git a/CLAUDE.md b/CLAUDE.md
index 5864762e9..9fa2d44b9 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -4,11 +4,10 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What TREK is
 
-A self-hosted, real-time collaborative travel planner. npm-workspaces monorepo with four workspaces:
+A self-hosted, real-time collaborative travel planner. npm-workspaces monorepo with three workspaces:
 
 - **`shared/`** (`@trek/shared`) — Zod schemas that are the **single source of truth** for API contracts, consumed by both server and client. Also owns all i18n locale files. Must be built before server/client typecheck or run.
-- **`nest-mcp/`** (`@trek/nest-mcp`) — decorator-driven MCP tool/resource/prompt registration for NestJS, consumed by the server. Deliberately **extraction-clean**: no imports from `@trek/server`/`@trek/shared`, no TREK semantics.
-- **`server/`** (`@trek/server`) — NestJS API (Express adapter), SQLite via `better-sqlite3`, WebSocket sync, built-in MCP server, sandboxed plugin runtime.
+- **`server/`** (`@trek/server`) — NestJS API (Express adapter), SQLite via `better-sqlite3`, WebSocket sync, built-in MCP server (decorator-driven registration layer in `server/src/nest-mcp/`, formerly the `@trek/nest-mcp` workspace), sandboxed plugin runtime.
 - **`client/`** (`@trek/client`) — React 19 + Vite + Zustand + Tailwind PWA, offline-first via Dexie/IndexedDB.
 
 **`plugin-sdk/`** (`trek-plugin-sdk`) also lives in the repo but is **not a root workspace** — it has its own lockfile, is published to npm independently, and must ship standalone. Run its commands from `plugin-sdk/`, not the root.
@@ -17,16 +16,16 @@ Each package has its own `CLAUDE.md` with internals; this file covers the monore
 
 ## Commands
 
-Run from the repo root unless noted. Per the user's preference, **use `npm run ... --workspace=<pkg>`, not `npm -w <pkg>`**.
+Run from the repo root unless noted. **Use `npm run ... --workspace=<pkg>`, not `npm -w <pkg>`**.
 
 ```bash
-npm run dev                       # build shared + nest-mcp, then watch shared + server + client concurrently
-npm run build                     # build shared → nest-mcp → server → client (order matters)
-npm run lint                      # lint all four workspaces
-npm run format                    # prettier --write all four
+npm run dev                       # build shared, then watch shared + server + client concurrently
+npm run build                     # build shared → server → client (order matters)
+npm run lint                      # lint all three workspaces
+npm run format                    # prettier --write all three
 ```
 
-Tests (the user runs client tests as `cd client && npm run test`):
+Tests:
 
 ```bash
 npm run test                                       # all workspaces
@@ -35,7 +34,7 @@ npm run test:unit --workspace=server               # tests/unit only
 npm run test:integration --workspace=server
 npm run test:ws --workspace=server                 # websocket tests
 npm run test:e2e                                   # server e2e (boots Nest against temp SQLite)
-npm run test:cov                                   # coverage, server + client
+npm run test:cov                                   # coverage (lcov), all four packages incl. shared + plugin-sdk
 cd client && npm run test                          # client vitest run
 cd client && npm run e2e                           # Playwright
 cd client && npm run lint:pages                    # enforce the Page pattern (see below)
@@ -89,12 +88,12 @@ Offline-first, with a layered data flow. A Page never owns state directly:
 - A route is "done" only once its contract lives in `shared/` and both sides import the inferred types. Edit the Zod schema in `shared/src/<domain>/`, rebuild shared, then both server (validation + DTO types) and client (typed requests) pick it up.
 - **i18n locale files live in `shared/src/i18n/<locale>/`**, one file per domain. `en/` is canonical. When you add/change a translation key, **add it to every locale** or `i18n:parity:strict` fails CI. The client resolves keys via `client/src/i18n/TranslationContext.tsx` (`t(key)`), which only reads top-level string keys.
 
-## Project direction (from the 2026 full-repo audit)
+## Project direction
 
-A verified audit of the whole repo lives in `audit_report/TREK_audit_reports/` (`00_MASTER_SUMMARY.md` is the entrypoint, `01_STEERING_ROADMAP.md` the plan). Its verdict shapes how all new code should be written:
+These principles come out of a verified 2026 full-repo audit and shape how all new code should be written:
 
 - **Protect the crown jewels.** The client's offline-first data core (repos + mutation queue + Dexie), the out-of-process plugin sandbox, the Zod contract layer, and the auth primitives are production-grade. Extend them; never route around them or rewrite them in anger.
-- **No "modern shell over legacy core."** The debt pattern is a modern frame delegating to the old approach underneath (historically Nest controllers over legacy `services/*` — that migration is done; on the client it's feature components calling the raw API past the offline core, still ~190 files). New code goes all-in on the target architecture; when touching a legacy seam, migrate it rather than adding another wrapper.
+- **No "modern shell over legacy core."** The debt pattern is a modern frame delegating to the old approach underneath (historically Nest controllers over legacy `services/*` — that migration is done; on the client it's the long tail of feature components calling the raw API past the offline core). New code goes all-in on the target architecture; when touching a legacy seam, migrate it rather than adding another wrapper.
 - **Single source of truth over manual synchronization.** Never add a hand-mirrored copy of state, schema, or contract (server↔Dexie↔Zustand, schema↔SQL, the plugin contract). Derive from one source, or guard the copy with a parity test that cannot silently skip.
 - **DI over global mutable module state.** The `db` proxy, `ws` singleton, and event-sink globals are what force `require()`-to-dodge-cycles and load-bearing boot ordering. New server code injects its dependencies; new client code avoids `window`-global buses and mutable module state.
 - **Use the runtime's native idioms.** Prefer React 19 features (`useOptimistic`, Actions, `use()`/Suspense) and Nest subsystems (DI providers, pipes, guards, `@nestjs/schedule`) over hand-rolled equivalents of the same machinery.
@@ -105,7 +104,7 @@ A verified audit of the whole repo lives in `audit_report/TREK_audit_reports/` (
 - **Target the `dev` branch** for PRs, not `main` (exception: `wiki/`-only changes).
 - **Discuss first**: outside contributions must be pitched in the `#github-pr` Discord channel before any code is written — undiscussed PRs are closed.
 - **PRs follow `.github/PULL_REQUEST_TEMPLATE.md`** and require a linked issue (`Closes #N`) for bug fixes or an approved feature-request discussion for features — no issue/discussion, no PR.
-- **Conventional commits** (`fix(maps): ...`, `feat(budget): ...`). Per user preference, **do not add Co-Authored-By Claude attribution**.
+- **Conventional commits** (`fix(maps): ...`, `feat(budget): ...`). **Do not add Co-Authored-By or other tool-attribution trailers** to commit messages.
 - One focused change per PR; no breaking changes; no unrelated reformatting/refactors. Tests required — the project holds **80%+ coverage** (the `src/nest/**` vitest coverage gate enforces ≥80%).
 - When migrating/adding a route, **parity is law**: same URL, method, query/body, HTTP status, `Set-Cookie`, and JSON body — including bespoke error strings (e.g. reproduce `{ error: 'Admin only' }` exactly rather than relying on a generic guard message). Note Nest defaults POST to 201; add `@HttpCode(200)` where the legacy contract returned 200. Declare static sub-routes (`/reorder`, `/in-app/all`) **before** `:id` param routes.
 
diff --git a/README.md b/README.md
index 35e54d882..3d25c2354 100644
--- a/README.md
+++ b/README.md
@@ -21,10 +21,14 @@ A self-hosted, real-time collaborative travel planner — with maps, budgets, pa
 &nbsp;
 <a href="https://hub.docker.com/r/mauriceboe/trek"><img alt="Docker" src="https://img.shields.io/badge/Docker-ready-2496ED?style=for-the-badge" /></a>
 &nbsp;
+<a href="https://sonarcloud.io/project/overview?id=liketrek_TREK"><img alt="Sonar Quality Gate" src="https://img.shields.io/sonar/quality_gate/liketrek_TREK?server=https%3A%2F%2Fsonarcloud.io&style=for-the-badge" /></a>
+&nbsp;
+<img alt="GitHub Actions Workflow Status" src="https://img.shields.io/github/actions/workflow/status/liketrek/TREK/test.yml?branch=main&style=for-the-badge">
+&nbsp;
 <a href="https://discord.gg/NhZBDSd4qW"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?style=for-the-badge" /></a>
 &nbsp;
 <a href="https://kanban.pakulat.org/shared/I4wxF6inOOMB0C6hH6kQm3efyNxFjwyI"><img alt="Roadmap" src="https://img.shields.io/badge/Roadmap-view-0EA5E9?style=for-the-badge" /></a>
-<br />
+&nbsp;
 <a href="https://ko-fi.com/mauriceboe"><img alt="Ko-fi" src="https://img.shields.io/badge/Ko--fi-support-FF5E5B?style=for-the-badge" /></a>
 &nbsp;
 <a href="https://www.buymeacoffee.com/mauriceboe"><img alt="BMAC" src="https://img.shields.io/badge/BMAC-support-FFDD00?style=for-the-badge" /></a>
@@ -33,7 +37,6 @@ A self-hosted, real-time collaborative travel planner — with maps, budgets, pa
 <a href="https://github.com/liketrek/TREK/releases"><img alt="Latest Release" src="https://img.shields.io/github/v/release/liketrek/trek?include_prereleases&style=flat-square&color=6B7280" /></a>
 <a href="https://hub.docker.com/r/mauriceboe/trek"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/mauriceboe/trek?style=flat-square&color=6B7280" /></a>
 <a href="https://github.com/liketrek/TREK"><img alt="Stars" src="https://img.shields.io/github/stars/liketrek/trek?style=flat-square&color=6B7280" /></a>
-
 </div>
 
 ---
@@ -238,64 +241,15 @@ Real-time sync via WebSocket (`ws`). Backend on NestJS 11. State with Zustand. A
 
 <h2 id="docker-compose-production">Docker Compose (production)</h2>
 
-<details>
-<summary>Full compose example with secure defaults</summary>
-
-```yaml
-services:
-  app:
-    image: mauriceboe/trek:latest
-    container_name: trek
-    read_only: true
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
-    cap_add:
-      - CHOWN
-      - SETUID
-      - SETGID
-    tmpfs:
-      - /tmp:noexec,nosuid,size=64m
-    ports:
-      - "3000:3000"
-    environment:
-      - NODE_ENV=production
-      - PORT=3000
-      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}   # generate with: openssl rand -hex 32
-      - TZ=${TZ:-UTC}
-      - LOG_LEVEL=${LOG_LEVEL:-info}
-      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-}
-      - APP_URL=${APP_URL:-}                 # required for OIDC + email links
-      # - FORCE_HTTPS=true                   # behind a TLS-terminating proxy
-      # - TRUST_PROXY=1
-      # - OIDC_ISSUER=https://auth.example.com
-      # - OIDC_CLIENT_ID=trek
-      # - OIDC_CLIENT_SECRET=supersecret
-      # - OIDC_DISPLAY_NAME=SSO
-      # - OIDC_ADMIN_CLAIM=groups
-      # - OIDC_ADMIN_VALUE=app-trek-admins
-    volumes:
-      - ./data:/app/data
-      - ./uploads:/app/uploads
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 15s
-```
-
-Then:
+The repository ships a ready-to-use [`docker-compose.yml`](docker-compose.yml)
+with secure defaults and every option documented inline. Download it, then:
 
 ```bash
 docker compose up -d
 ```
 
-**HTTPS notes:** `FORCE_HTTPS=true` is optional — it adds a 301 redirect, HSTS, CSP upgrade-insecure-requests, and forces the `secure` cookie flag. Only use it behind a TLS-terminating reverse proxy. `TRUST_PROXY=1` tells the server how many proxies sit in front so real client IPs and `X-Forwarded-Proto` work.
-
-</details>
+See [Install with Docker Compose](https://github.com/liketrek/TREK/wiki/Install-Docker-Compose)
+for the full walkthrough.
 
 <br />
 
@@ -309,6 +263,8 @@ helm install trek trek/trek
 
 See [`charts/README.md`](https://github.com/liketrek/TREK/blob/main/charts/README.md) for values.
 
+<br />
+
 <h2 id="install-as-app-pwa">Install as App (PWA)</h2>
 
 TREK works as a Progressive Web App — no App Store needed.
@@ -323,36 +279,10 @@ TREK then launches fullscreen with its own icon, just like a native app.
 
 ## Updating
 
-**Docker Compose:**
+See [Updating](https://github.com/liketrek/TREK/wiki/Updating) — Docker Compose,
+Docker run, Helm, Portainer, Unraid and Proxmox, plus the encryption-key note.
 
-```bash
-docker compose pull && docker compose up -d
-```
-
-**Docker run** — reuse the original volume paths:
-
-```bash
-docker pull mauriceboe/trek
-docker rm -f trek
-docker run -d --name trek -p 3000:3000 -v ./data:/app/data -v ./uploads:/app/uploads --restart unless-stopped mauriceboe/trek
-```
-
-> Not sure which paths you used? `docker inspect trek --format '{{json .Mounts}}'` before removing the container.
-
-Your data stays in the mounted `data` and `uploads` volumes — updates never touch it.
-
-> [!IMPORTANT]
-> Mount **only** the data and uploads directories — `-v ./data:/app/data -v ./uploads:/app/uploads`. **Never mount a volume at `/app`.** Doing so hides the application code shipped in the image and the container fails to start with `Cannot find module 'tsconfig-paths/register'`. If you previously mounted `/app`, switch to the two mounts above; your data in `data/` and `uploads/` is preserved.
-
-<h3>Rotating the Encryption Key</h3>
-
-If you need to rotate `ENCRYPTION_KEY` (e.g. upgrading from a version that derived encryption from `JWT_SECRET`):
-
-```bash
-docker exec -it trek node --import tsx scripts/migrate-encryption.ts
-```
-
-The script creates a timestamped DB backup before making changes and prompts for old + new keys (input is not echoed).
+<br />
 
 <h2 id="reverse-proxy">Reverse Proxy</h2>
 
@@ -432,175 +362,8 @@ Caddy handles TLS and WebSockets automatically.
 
 ## Environment variables
 
-> [!NOTE]
-> Variables are validated at startup (fail-fast). An unset or blank variable
-> always falls back to its default, but a variable set to a malformed value
-> (e.g. `PORT=abc`, `SESSION_DURATION=bogus`, `DEMO_MODE=maybe`) aborts boot
-> with a report listing every offending variable. Boolean switches accept
-> `true`/`false`, `1`/`0`, `on`/`off` and `yes`/`no` (any casing).
-
-<details>
-<summary><b>Full reference</b></summary>
-
-<br />
-
-| Variable | Description | Default |
-|----------|-------------|---------|
-| **Core** | | |
-| `PORT` | Server port | `3000` |
-| `NODE_ENV` | Environment (`production` / `development`) | `production` |
-| `ENCRYPTION_KEY` | At-rest encryption key for stored secrets (API keys, MFA, SMTP, OIDC). Recommended: generate with `openssl rand -hex 32`. If unset, falls back to `data/.jwt_secret` (existing installs) or auto-generates a key (fresh installs). | Auto |
-| `TZ` | Timezone for logs, reminders and cron jobs (e.g. `Europe/Berlin`) | `UTC` |
-| `LOG_LEVEL` | `info` = concise user actions, `debug` = verbose details | `info` |
-| `TREK_WIKI_DIR` | Where the in-app Help pages (`/help`) read their content from. TREK ships its wiki and serves it from disk, so Help always matches the version you are running — you should not need to set this. Point it at your own directory to serve custom docs. If the path does not exist, Help falls back to fetching the public GitHub wiki (needs outbound network, and tracks the latest release). | bundled `wiki/` |
-| `DEFAULT_LANGUAGE` | Default language on the login page for users with no saved preference. Browser/OS language is auto-detected first; this is the fallback. Supported: `de`, `en`, `es`, `fr`, `hu`, `nl`, `br`, `cs`, `pl`, `ru`, `zh`, `zh-TW`, `it`, `ar`, `id`, `tr`, `ja`, `ko`, `uk`, `gr` | `en` |
-| `ALLOWED_ORIGINS` | Comma-separated origins for CORS and email links | same-origin |
-| `FORCE_HTTPS` | Optional. When `true`: 301-redirects HTTP to HTTPS, sends HSTS, adds CSP `upgrade-insecure-requests`, forces the session cookie `secure` flag. Useful behind a TLS-terminating reverse proxy. Requires `TRUST_PROXY`. | `false` |
-| `HSTS_INCLUDE_SUBDOMAINS` | When `true`: adds the `includeSubDomains` directive to the HSTS header, extending HTTPS enforcement to all subdomains. Only effective when HSTS is active (`FORCE_HTTPS=true` or `NODE_ENV=production`). Leave `false` if you run other services on sibling subdomains over plain HTTP. | `false` |
-| `COOKIE_SECURE` | Controls the `secure` flag on the `trek_session` cookie. Auto-derived: on when `NODE_ENV=production` or `FORCE_HTTPS=true`. Escape hatch: set `false` to allow session cookies over plain HTTP. Not recommended in production. | auto |
-| `SESSION_DURATION` | How long a login session stays valid when **"Remember me" is unchecked** (the default): sets the `trek_session` JWT `exp` and issues a browser-session cookie (cleared when the browser closes). Accepts `ms`-style strings: `1h`, `12h`, `7d`, `30d`, `90d`. Invalid values warn at startup and fall back to the default. | `24h` |
-| `SESSION_DURATION_REMEMBER` | Session length when **"Remember me" is ticked** at login: a longer-lived JWT plus a persistent `trek_session` cookie that survives browser restarts. Same format and startup-fallback behaviour as `SESSION_DURATION`. | `30d` |
-| `TRUST_PROXY` | Number of trusted reverse proxies. Tells the server to read client IP from `X-Forwarded-For` and protocol from `X-Forwarded-Proto`. Defaults to `1` in production; off in dev unless set. | `1` |
-| `ALLOW_INTERNAL_NETWORK` | Allow outbound requests to private/RFC-1918 IPs (e.g. Immich on your LAN). Loopback and link-local addresses remain blocked. | `false` |
-| `APP_URL` | Public base URL of this instance (e.g. `https://trek.example.com`). Required when OIDC is enabled; used as base for email notification links. | — |
-| **OIDC / SSO** | | |
-| `OIDC_ISSUER` | OpenID Connect provider URL | — |
-| `OIDC_CLIENT_ID` | OIDC client ID | — |
-| `OIDC_CLIENT_SECRET` | OIDC client secret | — |
-| `OIDC_DISPLAY_NAME` | Label shown on the SSO login button | `SSO` |
-| `OIDC_ONLY` | Force SSO-only mode: disables password login + registration, regardless of Admin > Settings. The first SSO login becomes admin. | `false` |
-| `OIDC_ADMIN_CLAIM` | OIDC claim used to identify admin users | — |
-| `OIDC_ADMIN_VALUE` | Value of the OIDC claim that grants admin role | — |
-| `OIDC_SCOPE` | Space-separated OIDC scopes. **Fully replaces** the default — always include `openid email profile`. | `openid email profile` |
-| `OIDC_DISCOVERY_URL` | Override the auto-constructed OIDC discovery endpoint (e.g. Authentik: `.../application/o/trek/.well-known/openid-configuration`) | — |
-| **Initial setup** | | |
-| `ADMIN_EMAIL` | Email for the first admin on initial boot. Must be set together with `ADMIN_PASSWORD`. If either is omitted a random password is printed to the server log. No effect once a user exists. | `admin@trek.local` |
-| `ADMIN_PASSWORD` | Password for the first admin on initial boot. Pairs with `ADMIN_EMAIL`. | random |
-| **Other** | | |
-| `TREK_MANAGED` | Marks the install as centrally administered: the operator owns the configuration, credentials and upgrades, so the instance admin is not offered settings the operator sets. Leave unset when you run TREK yourself. | `false` |
-| `PLACES_API_KEY` | Places credential supplied by whoever operates the install. When set, it is used for every lookup and the per-user keys in Admin > Settings are ignored. Leave unset to keep the stored keys. | — |
-| `PLACES_API_BASE` | Send the Places calls to this origin instead of `https://places.googleapis.com` (an egress proxy, a cache, a gateway holding the key). Path and query are unchanged, so it has to speak the same API. | — |
-| `DEMO_MODE` | Enable demo mode (hourly data resets) | `false` |
-| `UNSPLASH_ACCESS_KEY` | Optional Unsplash Access Key for trip-cover and place-image search. Without one, TREK uses Unsplash's unauthenticated endpoint, which some datacenter/VPS IPs are blocked from. Get a free key at [unsplash.com/developers](https://unsplash.com/developers). Overrides any per-admin key set in Admin > Settings (where it can also be configured instead). | — |
-| `MCP_RATE_LIMIT` | Max MCP API requests per user per minute | `300` |
-| `MCP_MAX_SESSION_PER_USER` | Max concurrent MCP sessions per user. At the cap, the least-recently-active session is closed to make room | `20` |
-
-</details>
-
-<br />
-
-<h2 id="storage">Storage</h2>
-
-TREK separates *what* it stores (eight content categories — trip documents,
-journey photos, cover images, profile pictures, place images, the two photo
-caches, and backups) from *where* it stores it (named backends). Out of the
-box everything lives on local disk (`uploads/` and `data/backups`). From
-**Admin → Storage** you can:
-
-- **Add S3-compatible backends** (AWS S3, Cloudflare R2, Backblaze B2, Garage,
-  MinIO/AIStor) and assign any category to them.
-- **Replicate a backend**: edit it and pick **Mirror targets** — every write is
-  then also copied to each target. The classic off-site backup setup is:
-  add an S3 backend, edit `backups-local`, tick the S3 backend as a mirror
-  target, save. Replica writes happen one after another during each upload, so
-  a slow or unreachable target slows every upload of every category on that
-  backend — fine for backups, worth weighing for hot categories. Existing
-  objects are not replicated when you add a target — press **Sync now** on
-  the backend to copy them (one sync at a time; progress and cancel in the
-  panel).
-- **Watch the Health strip**: replica failures never fail the original
-  request; they are recorded and shown there instead. All-clear means every
-  replicated write landed. Failures also notify admins over the configured
-  notification channels (first failure immediately, then hourly summaries) —
-  tune it under Admin → Notifications.
-- **Test** any backend from its row (for a replicated backend it probes the
-  primary and each target individually). Targets must be saved before Test
-  can probe them.
-- **Usage**: per-category and per-backend object counts and sizes, scanned
-  nightly and on demand.
-
-Backend credentials are encrypted at rest. Without an explicit
-`ENCRYPTION_KEY` the implicit key from the data directory is used — that
-works, but the implicit key rides inside backups, so setting `ENCRYPTION_KEY`
-explicitly is recommended for credentialed backends. On an existing install
-that has been running without an explicit key, do not just set a new one —
-that would orphan already-stored secrets; use the key-rotation procedure (see
-*Rotating the Encryption Key* under Updating) to move to an explicit key.
-
-Notes and limits: reassigning a populated category prompts to move its
-existing objects — accepting copies everything to the new backend, flips the
-category, then sweeps any writes that raced the copy; source objects are kept
-(not deleted) and reported as reclaimable (count + size) to reclaim manually;
-declining routes only new writes to the new backend, leaving old objects in
-place as before. Only one storage job (a mirror sync or a category migration)
-runs at a time, cancelling before the flip is always safe, and a failed copy
-never flips the category; media categories on S3 work but every served byte
-proxies through the server — the proxy answers conditional GETs (ETag /
-Last-Modified) and a single `Range` request, while a multi-range request is
-answered with the full object; AWS buckets
-with Object-Lock or checksum-requiring policies
-reject the server's uploads; self-hosted endpoints (MinIO/Garage) should be
-addressed by IP or `localhost` unless configured for virtual-hosted buckets.
-The legacy `/uploads/photos` directory from older TREK versions is still
-served and included in backups, but it is not a configurable category.
-Running the storage contract suite against a live MinIO/AIStor is a
-license-gated procedure — CI runs it automatically for same-repo pull
-requests (fork PRs skip it, since they have no access to the license
-secret); to run it yourself locally, see `docker-compose.minio-test.yml`'s
-header for the manual procedure.
-
-### Provisioning at first boot (seed file)
-
-For infrastructure-as-code setups, mount a `storage-config.json` into the
-data directory — it is imported **once**, on the first boot that has no
-stored storage configuration, and loudly ignored afterwards:
-
-```jsonc
-// storage-config.json — secrets may be plaintext (encrypted on import)
-// or already-encrypted enc:v1: values.
-{
-  "backends": [
-    { "name": "off-site", "type": "s3", "options": {
-      "endpoint": "https://s3.example.com", "bucket": "trek",
-      "accessKeyId": "…", "secretAccessKey": "…" } },
-    { "name": "backups-mirror", "type": "mirror", "options": {
-      "primary": "backups-local", "replicas": ["off-site"] } }
-  ],
-  "categories": { "backups": "backups-mirror" }
-}
-```
-
-(The panel presents this exact setup as **Mirror targets** on `backups-local`.)
-
-```yaml
-# docker-compose: add under the trek service's volumes
-      - ./storage-config.json:/app/data/storage-config.json:ro
-```
-
-An invalid seed file aborts boot with the exact validation error — an
-actively-provisioning operator sees the problem instead of a silent default.
-
-### Recovery and restore
-
-To reset storage configuration to the built-in defaults (or to re-import a
-seed file): stop the server, run
-`sqlite3 data/travel.db "DELETE FROM app_settings WHERE key LIKE 'storage.%';"`,
-and start it again.
-
-Backups include the storage configuration (it lives in the database). If your
-only backup sits on S3 and the credentials for it sit inside that backup:
-start a fresh instance, enter the S3 credentials in **Admin → Storage** (or
-mount a seed file), then restore the backup from the Backup panel.
-
-## Data & Backups
-
-- **Database** — SQLite, stored in `./data/travel.db`
-- **Uploads** — stored in `./uploads/` by default; every content category can be reassigned to another backend in **Admin → Storage**
-- **Logs** — `./data/logs/trek.log` (auto-rotated)
-- **Backups** — create and restore via Admin Panel
-- **Auto-Backups** — configurable schedule and retention in Admin Panel
-
-<br />
+Every variable, its default and what it does: see
+[Environment Variables](https://github.com/liketrek/TREK/wiki/Environment-Variables).
 
 ## Data sources
 
@@ -609,6 +372,8 @@ The Atlas map's country and sub-national (province/county) boundaries come from
 [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). See [NOTICE.md](NOTICE.md)
 for full third-party attributions.
 
+<br />
+
 ## License
 
 TREK is [AGPL v3](LICENSE). Self-host freely for personal or internal company use. If you modify and offer TREK as a network service to third parties, your modifications must be open-sourced under the same licence.
diff --git a/client/CLAUDE.md b/client/CLAUDE.md
new file mode 100644
index 000000000..57337de94
--- /dev/null
+++ b/client/CLAUDE.md
@@ -0,0 +1,77 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+Scope: the **`@trek/client`** workspace (React 19 + Vite + Zustand + Tailwind PWA). See the repo-root `CLAUDE.md` for the monorepo picture and `server/CLAUDE.md` for the API. This file covers client internals only.
+
+## Commands (run from `client/`)
+
+```bash
+npm run dev               # Vite dev server; proxies /api,/ws,/uploads,/oauth → http://localhost:3001
+npm run build             # prebuild generates PWA icons, then vite build
+npm run typecheck         # tsc --noEmit
+npm run lint              # eslint .
+npm run lint:pages        # enforce the Page pattern (scripts/check-page-pattern.mjs)
+npm run test              # vitest run (tests/** + src/**/*.test.{ts,tsx})
+npm run test:unit         # tests/unit
+npm run test:integration  # tests/integration + co-located src tests
+npm run test:coverage     # v8 coverage
+npm run e2e               # Playwright
+npm run e2e:report        # open last Playwright report
+npm run shots             # Playwright screenshots project (shots:promote to accept)
+npm run theme:lint        # theme conformance audit (theme:lint:strict exits 1 on findings; not a CI gate)
+```
+
+Single test:
+
+```bash
+npx vitest run src/store/slices/budgetSlice.test.ts
+npx vitest run -t "optimistically adds the place"
+npx vitest watch src/pages/DashboardPage.test.tsx
+```
+
+The dev server needs the API on **:3001** — run the server (`npm run dev` from root or `server/`) alongside, or `npm run dev` at the repo root to start both.
+
+## Page pattern (enforced — `lint:pages` will fail otherwise)
+
+Every `src/pages/*Page.tsx` is a thin **wiring container**; all state/effects/handlers live in a co-located **`use<Page>()` hook** under `src/pages/<page>/`. The page body must **not** call `useState/useReducer/useEffect/useLayoutEffect/useMemo/useCallback/useRef` — only context hooks like `useTranslation()` are allowed. Optional `<page>Model.ts` holds pure (React-free) types/helpers. Full spec in `src/pages/PATTERN.md`. When extracting, keep rendered JSX byte-identical — it's a refactor of where logic lives.
+
+## Data flow — offline-first
+
+The layering is **store → repo → api | Dexie**, and writes go through a mutation queue:
+
+- **`src/store/`** — Zustand. `tripStore.ts` is composed from **slices** in `store/slices/` (places, days, packing, todo, budget, reservations, files, assignments, dayNotes). Other stores: auth, settings, addon, permissions, inAppNotification, journey, vacay, systemNotice, collection, saveToCollection, plugin, backgroundTasks. `slices/remoteEventHandler.ts` applies inbound WebSocket events to local state.
+- **`src/repo/`** — per-entity repositories that mediate between the network and the offline cache. The pattern: if `navigator.onLine`, call the REST API and upsert into Dexie; if offline, read from Dexie. Always go through a repo for trip data, not the API directly.
+- **`src/api/client.ts`** — single Axios instance; request/response types imported from `@trek/shared` Zod schemas. `api/websocket.ts` manages the `/ws` connection.
+- **`src/db/offlineDb.ts`** — Dexie/IndexedDB schema: cached entities + the `QueuedMutation` table + `SyncMeta` (per-trip last-sync, prefetched-tiles bbox) + a `BlobCache` for offline file/photo access.
+- **`src/sync/`** — `mutationQueue.ts`: offline writes do an optimistic Dexie write (with a temporary **negative id** for creates), then on reconnect `flush()` replays REST with the mutation's UUID as the **`X-Idempotency-Key`** header (matching the server interceptor) and reconciles the Dexie row. `tripSyncManager.ts` / `syncTriggers.ts` / `connectivity.ts` drive reconnection sync; `tilePrefetcher.ts` pre-downloads map tiles.
+
+## Direction (from the 2026 audit)
+
+The offline core is flagship work surrounded by a periphery that ignores it. New code must extend the core's discipline, not the periphery's shortcuts:
+
+- **One data path, no layer skips**: component → feature hook → store/slice → `repo/` → `api/` | Dexie. **Never import `api/client` (or raw fetch/axios) from a component or modal** — especially never *write* from one. A long tail of existing files (~190 at last count) bypasses the layering and no lint ratchet holds the line yet; that's debt, not precedent. New API surface goes in a per-domain `api/<domain>.ts`, not the `client.ts` god module.
+- **Offline-first is the product promise, not a trip-planner feature.** New domains should get a repo with both read-through and offline writes (temp id → optimistic Dexie write → idempotent queue entry), extending the existing pattern rather than hand-rolling a variant. If a domain is deliberately online-only, mark it so explicitly.
+- **No God components or God hooks.** The page pattern is a floor, not a ceiling — a 900-line `use<Page>()` hook that satisfies the linter is still coupling. Decompose hooks by concern, split renders into memoizable sections, and don't pass 50-field prop bags with inline-arrow callbacks (it defeats `React.memo`).
+- **Prefer React 19 idioms over hand-rolled machinery**: `useOptimistic` for optimistic updates, `useActionState`/`useFormStatus` for forms, `use()` + Suspense for read paths, `useSyncExternalStore` for external subscriptions (`hooks/useNetworkMode` is the reference implementation).
+- **Optimistic writes must reconcile** — rollback + user-visible toast on failure. No `.catch(() => {})`, no bare `catch {}`; silently keeping state the server rejected is a data-integrity bug.
+- **WS remote-event handling must match local slice reducers field-for-field.** If a slice reducer preserves embedded fields on update (e.g. `place_time`/`end_time`), the corresponding `remoteEventHandler` branch must apply the identical merge semantics — divergence is silent, cross-user data loss.
+- **Subscribe with selectors** (`useShallow` for multi-field reads); never `const s = useStore()` whole-store; no store getters that allocate per call. Use `getState()` for imperative access in effects.
+- **Connectivity**: `isEffectivelyOffline()` is the single source of truth — never read `navigator.onLine` directly in feature code.
+- **Rendering security**: never interpolate user content into HTML strings (map tooltips/popups included — build via DOM + `textContent`); untrusted or cross-user markdown gets `rehype-sanitize`; never `rehype-raw` near those surfaces.
+- **No `window` CustomEvent buses or global mutable `window` state** — use the store or a typed emitter. No `any` at boundaries: WS payloads and map renderer props get real types, validated where they enter.
+- **Hygiene**: error boundaries around new shells/routes; every async `.then(setState)` needs a cancelled flag or `AbortController`; no `eslint-disable exhaustive-deps` as a routine tool (a missing memo dep has already shipped wrong money on screen); no sequential-await N+1 fetch loops — batch; search for an existing utility/hook before writing a duplicate.
+- **Theming**: use the semantic Tailwind tokens (`bg-surface*`, `text-content`, `border-edge`, `bg-accent`, status colors) — no raw palette classes, hex literals, or invented CSS vars; only `applyAppearance()` mutates `<html>` styling.
+
+## Other big-picture pieces
+
+- **Maps** (`src/components/Map/`): two interchangeable renderers — Leaflet (`MapView.tsx`) and Mapbox GL (`MapViewGL.tsx`), chosen at runtime by `MapViewAuto.tsx` based on the tile-source setting. GL-specific overlay/marker logic lives in the `*Mapbox.ts` siblings. Keep both renderers in sync when changing map features. **Offline maps**: only Leaflet supports full pre-download (raster tiles via `sync/tilePrefetcher.ts`, cached by the Workbox `map-tiles` rule). Mapbox GL is best-effort offline — its vector tiles are cached opportunistically as you browse online (the `mapbox-tiles` SW rule), not prefetched. Tile requests stay `no-cors` so self-hosted/custom tile providers without CORS headers keep working; `navigator.storage.persist()` (called at app init) keeps cached tiles from being evicted under storage pressure.
+- **i18n** (`src/i18n/TranslationContext.tsx`): `en` is bundled synchronously as the fallback; every other locale is a **dynamic `import('@trek/shared/i18n/<locale>')`** so Vite code-splits one chunk per locale and only the active one is fetched. `t(key)` resolves top-level keys from `@trek/shared/i18n`. Add new strings to the locale files in **`shared/`**, not here. RTL handled via `isRtlLanguage`.
+- **Mobile shell** (`src/mobile/`): below 768px (`useIsPhone`, reactive via matchMedia) `App.tsx` wraps routes in `MobileShell`, and phone-specific screens under `mobile/screens/<domain>/` (trip, dashboard, atlas, vacay, settings, admin, …) take over; the desktop/tablet experience at ≥768px is untouched. UI changes to a domain that has an `M*` screen usually need both the desktop component and the mobile screen updated.
+- **Plugins UI** (`src/components/Plugins/`): third-party plugin surfaces render in a sandboxed iframe — `PluginFrame.tsx` owns the postMessage bridge and hands the plugin the current theme's design tokens (live re-sync on theme/accent change). Contribution points: `PluginWidgets.tsx` (dashboard), `PluginDaySchedule.tsx` (itinerary rows), `Map/MapPluginLayers.tsx`/`MapPluginMarkers.tsx` (map). `store/pluginStore.ts` holds installed-plugin state; admin install/manage in `components/Admin/AdminPluginsPanel.tsx`. The server-side runtime is `server/src/nest/plugins/`; plugin authoring is covered by the `trek-plugin-dev` skill.
+- **PWA** (`vite.config.js`): `VitePWA` with `registerType: 'autoUpdate'` and Workbox `runtimeCaching` for tiles/API/uploads. `prebuild` (`scripts/generate-icons.mjs`) generates app icons before build.
+- **Native shell** (`client/src/platform/`): the Capacitor apps are not served from the same origin as the API, so `getServerOrigin()` is the single source of truth for where the server lives — `''` in the web build (relative URLs stay relative), the user's chosen server in native. Requests go through `apiFetch` / the `apiClient` interceptor, assets through `resolveAssetUrl` / `<ServerImage>`; ESLint blocks bare `fetch('/api…')` and `/uploads` literals so the seam cannot reopen. Native authenticates with `Authorization: Bearer` because the session cookie is `sameSite: 'lax'` and a webview can never send it cross-site. Saved servers are "profiles" (`serverProfiles.ts`, Capacitor Preferences) with tokens in device secure storage (`serverTokens.ts`) and a per-profile Dexie namespace. **The web build must stay byte-identical — especially Dexie names**; see `offlineDb.naming.test.ts`.
+
+## Tests
+
+vitest with `@vitejs/plugin-react`, jsdom (custom `tests/environment/jsdom-native-abort.ts`), `forks` pool. Tests live both in `tests/{unit,integration}/` and co-located as `src/**/*.test.{ts,tsx}`. `msw` mocks HTTP, `fake-indexeddb` backs Dexie in tests. Page tests render JSX against a mocked hook; hook/slice logic is tested in isolation (see `store/slices/budgetSlice.test.ts`). Playwright e2e config separate (`npm run e2e`).
diff --git a/client/src/api/client.behavior.test.ts b/client/src/api/client.behavior.test.ts
index 71837160a..e33de84f8 100644
--- a/client/src/api/client.behavior.test.ts
+++ b/client/src/api/client.behavior.test.ts
@@ -111,7 +111,7 @@ describe('client > request interceptor', () => {
     expect(sink[0].headers['X-Idempotency-Key']).toBe('queued-key')
   })
 
-  it('FE-APIWIRE-004: falls back to a random token when crypto.randomUUID is missing', async () => {
+  it('FE-APIWIRE-004: falls back to getRandomValues when crypto.randomUUID is missing', async () => {
     const realCrypto = globalThis.crypto
     vi.stubGlobal('crypto', {
       getRandomValues: realCrypto.getRandomValues.bind(realCrypto),
@@ -120,9 +120,30 @@ describe('client > request interceptor', () => {
     const sink: InternalAxiosRequestConfig[] = []
     await apiClient.post('/probe', {}, { adapter: okAdapter(sink) })
 
-    const key = String(sink[0].headers['X-Idempotency-Key'])
-    expect(key).toMatch(/^[a-z0-9]+$/)
-    expect(key).not.toMatch(/-/)
+    // randomUUID needs a secure context, so on the plain-http installs the
+    // README documents this branch is what actually runs. getRandomValues has no
+    // such requirement, so the fallback is still a full v4 UUID.
+    expect(String(sink[0].headers['X-Idempotency-Key'])).toMatch(
+      /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,
+    )
+  })
+
+  it('FE-APIWIRE-004b: the last-resort key is never degenerate, even with no Web Crypto at all', async () => {
+    vi.stubGlobal('crypto', undefined)
+
+    const keys = new Set<string>()
+    for (let i = 0; i < 50; i++) {
+      const sink: InternalAxiosRequestConfig[] = []
+      await apiClient.post('/probe', {}, { adapter: okAdapter(sink) })
+      keys.add(String(sink[0].headers['X-Idempotency-Key']))
+    }
+
+    // The old fallback was Math.random().toString(36).slice(2), which is not
+    // length-stable: 0.5 yields a single character and 0 yields the empty string.
+    // An empty key makes the server skip deduplication entirely, so a retried
+    // write applies twice.
+    for (const k of keys) expect(k.length).toBeGreaterThan(16)
+    expect(keys.size).toBe(50)
   })
 
   it('FE-APIWIRE-005: the socket id header is omitted while no socket is connected', async () => {
diff --git a/client/src/api/client.ts b/client/src/api/client.ts
index d3c60819c..09e90df47 100644
--- a/client/src/api/client.ts
+++ b/client/src/api/client.ts
@@ -1,6 +1,7 @@
 import axios, { AxiosInstance } from 'axios'
 import type { z } from 'zod'
 import type { Place } from '../types'
+import { randomId } from '../utils/randomId'
 import {
   weatherResultSchema, type WeatherResult,
   inAppListResultSchema, type InAppListResult,
@@ -151,10 +152,7 @@ apiClient.interceptors.request.use(
       // The mutation queue sets its own pre-generated key; skip if already set.
       const method = (config.method ?? '').toLowerCase()
       if (MUTATING_METHODS.has(method) && !config.headers['X-Idempotency-Key']) {
-        const key = typeof crypto !== 'undefined' && crypto.randomUUID
-            ? crypto.randomUUID()
-            : Math.random().toString(36).slice(2)
-        config.headers['X-Idempotency-Key'] = key
+        config.headers['X-Idempotency-Key'] = randomId()
       }
       return config
     },
@@ -533,7 +531,12 @@ export const adminApi = {
     apiClient.post('/admin/plugins/install', { id, ...opts }).then(r => r.data),
   pluginActivate: (id: string, consent?: boolean) => apiClient.post(`/admin/plugins/${id}/activate`, consent ? { consent: true } : {}).then(r => r.data),
   pluginDeactivate: (id: string) => apiClient.post(`/admin/plugins/${id}/deactivate`).then(r => r.data),
-  pluginUpdate: (id: string) => apiClient.post(`/admin/plugins/${id}/update`).then(r => r.data),
+  // `version` pins the exact version to install (the rollback path); omitted, the server
+  // resolves the newest TREK-compatible version itself.
+  pluginUpdate: (id: string, version?: string) =>
+    apiClient.post(`/admin/plugins/${id}/update`, version ? { version } : {}).then(r => r.data),
+  // Release a per-plugin update hold (set by a deliberate non-latest install).
+  pluginResumeUpdates: (id: string) => apiClient.post(`/admin/plugins/${id}/resume-updates`).then(r => r.data),
   // Re-trust a ROTATED author signing key and update, in ONE call. `publicKey` is the
   // full key the admin was shown (not a fingerprint): the server compares it exactly, so
   // it can refuse if the registry entry was re-keyed again since the dialog rendered.
diff --git a/client/src/components/Admin/AddonManager.test.tsx b/client/src/components/Admin/AddonManager.test.tsx
index cfffacead..14afcc882 100644
--- a/client/src/components/Admin/AddonManager.test.tsx
+++ b/client/src/components/Admin/AddonManager.test.tsx
@@ -98,7 +98,7 @@ describe('AddonManager', () => {
 
   it('FE-ADMIN-ADDON-002: empty state when addons list is empty', async () => {
     render(<AddonManager />);
-    await screen.findByText('No addons available');
+    expect(await screen.findByText('No addons available')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-ADDON-003: trip addons section renders with correct section header', async () => {
diff --git a/client/src/components/Admin/AddonManager.tsx b/client/src/components/Admin/AddonManager.tsx
index c30e92fb9..c5ea9e6ce 100644
--- a/client/src/components/Admin/AddonManager.tsx
+++ b/client/src/components/Admin/AddonManager.tsx
@@ -196,7 +196,7 @@ export default function AddonManager({ bagTrackingEnabled, onToggleBagTracking,
                           <span className={`hidden sm:inline text-xs font-medium ${bagTrackingEnabled ? 'text-content' : 'text-content-faint'}`}>
                             {bagTrackingEnabled ? t('admin.addons.enabled') : t('admin.addons.disabled')}
                           </span>
-                          <button onClick={onToggleBagTracking}
+                          <button type="button" onClick={onToggleBagTracking}
                             className="relative inline-flex h-6 w-11 items-center rounded-full transition-colors"
                             style={{ background: bagTrackingEnabled ? 'var(--text-primary)' : 'var(--border-primary)' }}>
                             <span className="absolute left-0.5 h-5 w-5 rounded-full bg-white transition-transform duration-200"
@@ -222,7 +222,7 @@ export default function AddonManager({ bagTrackingEnabled, onToggleBagTracking,
                                   <span className={`hidden sm:inline text-xs font-medium ${enabled ? 'text-content' : 'text-content-faint'}`}>
                                     {enabled ? t('admin.addons.enabled') : t('admin.addons.disabled')}
                                   </span>
-                                  <button onClick={() => onToggleCollabFeature(feat.key)}
+                                  <button type="button" onClick={() => onToggleCollabFeature(feat.key)}
                                     className="relative inline-flex h-6 w-11 items-center rounded-full transition-colors"
                                     style={{ background: enabled ? 'var(--text-primary)' : 'var(--border-primary)' }}>
                                     <span className="absolute left-0.5 h-5 w-5 rounded-full bg-white transition-transform duration-200"
@@ -269,7 +269,7 @@ export default function AddonManager({ bagTrackingEnabled, onToggleBagTracking,
                                 <span className={`hidden sm:inline text-xs font-medium ${provider.enabled ? 'text-content' : 'text-content-faint'}`}>
                                   {provider.enabled ? t('admin.addons.enabled') : t('admin.addons.disabled')}
                                 </span>
-                                <button
+                                <button type="button"
                                   onClick={provider.toggle}
                                   className="relative inline-flex h-6 w-11 items-center rounded-full transition-colors"
                                   style={{ background: provider.enabled ? 'var(--text-primary)' : 'var(--border-primary)' }}
@@ -451,6 +451,7 @@ function LlmParsingConfig({ addon }: { addon: Addon }) {
         <section className="space-y-3">
           <div className={sectionCls}>Model</div>
           <label className="block">
+            <span className="sr-only">Model</span>
             <input autoComplete="off" className={fieldCls} value={model} onChange={e => setModel(e.target.value)} placeholder={provider === 'anthropic' ? 'claude-opus-4-8' : provider === 'openai' ? 'gpt-4o' : 'select or pull below'} />
           </label>
 
@@ -459,7 +460,7 @@ function LlmParsingConfig({ addon }: { addon: Addon }) {
             <div className="space-y-3 rounded-lg border border-edge-secondary bg-surface p-3">
               <div className="flex items-center justify-between">
                 <span className="text-xs font-medium text-content-secondary">Installed on the server</span>
-                <button onClick={loadModels} disabled={loadingModels} className="text-xs text-content-muted underline disabled:opacity-60">
+                <button type="button" onClick={loadModels} disabled={loadingModels} className="text-xs text-content-muted underline disabled:opacity-60">
                   {loadingModels ? 'Loading…' : 'Refresh'}
                 </button>
               </div>
@@ -470,7 +471,7 @@ function LlmParsingConfig({ addon }: { addon: Addon }) {
               {installed.length > 0 && (
                 <div className="flex flex-wrap gap-1.5">
                   {installed.map(name => (
-                    <button
+                    <button type="button"
                       key={name}
                       title={name}
                       onClick={() => setModel(name)}
@@ -509,11 +510,11 @@ function LlmParsingConfig({ addon }: { addon: Addon }) {
                           )}
                         </div>
                         {installedHere ? (
-                          <button onClick={() => setModel(m.id)} disabled={active} className={`shrink-0 rounded-md px-3 py-1.5 text-xs font-medium transition-colors ${active ? 'bg-surface-tertiary text-content-muted' : 'border border-edge-secondary text-content-secondary hover:border-edge'}`}>
+                          <button type="button" onClick={() => setModel(m.id)} disabled={active} className={`shrink-0 rounded-md px-3 py-1.5 text-xs font-medium transition-colors ${active ? 'bg-surface-tertiary text-content-muted' : 'border border-edge-secondary text-content-secondary hover:border-edge'}`}>
                             {active ? 'Selected' : 'Use'}
                           </button>
                         ) : (
-                          <button onClick={() => pull(m.id)} disabled={!!pulling} className="shrink-0 rounded-md bg-accent px-3 py-1.5 text-xs font-medium text-accent-text disabled:opacity-60">
+                          <button type="button" onClick={() => pull(m.id)} disabled={!!pulling} className="shrink-0 rounded-md bg-accent px-3 py-1.5 text-xs font-medium text-accent-text disabled:opacity-60">
                             {isPulling ? 'Pulling…' : 'Pull'}
                           </button>
                         )}
@@ -526,7 +527,7 @@ function LlmParsingConfig({ addon }: { addon: Addon }) {
           )}
         </section>
 
-        <button onClick={save} disabled={saving} className="rounded-lg bg-accent px-4 py-2 text-sm font-medium text-accent-text transition-opacity disabled:opacity-60">
+        <button type="button" onClick={save} disabled={saving} className="rounded-lg bg-accent px-4 py-2 text-sm font-medium text-accent-text transition-opacity disabled:opacity-60">
           {saving ? 'Saving…' : 'Save'}
         </button>
       </div>
@@ -589,7 +590,7 @@ function AddonRow({ addon, onToggle, t, nameOverride, descriptionOverride, statu
           {isComingSoon ? t('admin.addons.disabled') : enabledState ? t('admin.addons.enabled') : t('admin.addons.disabled')}
         </span>
         {!hideToggle && (
-          <button
+          <button type="button"
             onClick={() => !isComingSoon && onToggle(addon)}
             disabled={isComingSoon}
             className="relative inline-flex h-6 w-11 items-center rounded-full transition-colors"
diff --git a/client/src/components/Admin/AdminMcpTokensPanel.test.tsx b/client/src/components/Admin/AdminMcpTokensPanel.test.tsx
index 8abcd44da..edd016b1c 100644
--- a/client/src/components/Admin/AdminMcpTokensPanel.test.tsx
+++ b/client/src/components/Admin/AdminMcpTokensPanel.test.tsx
@@ -49,7 +49,7 @@ describe('AdminMcpTokensPanel', () => {
 
   it('FE-ADMIN-MCP-002: empty state rendered when no tokens', async () => {
     render(<AdminMcpTokensPanel />);
-    await screen.findByText('No MCP tokens have been created yet');
+    expect(await screen.findByText('No MCP tokens have been created yet')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-MCP-003: token list renders correctly', async () => {
@@ -195,7 +195,7 @@ describe('AdminMcpTokensPanel', () => {
       )
     );
     render(<><ToastContainer /><AdminMcpTokensPanel /></>);
-    await screen.findByText('Failed to load tokens');
+    expect(await screen.findByText('Failed to load tokens')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-MCP-011: OAuth sessions loading spinner shown on mount', async () => {
@@ -216,7 +216,7 @@ describe('AdminMcpTokensPanel', () => {
       )
     );
     render(<AdminMcpTokensPanel />);
-    await screen.findByText('No active OAuth sessions');
+    expect(await screen.findByText('No active OAuth sessions')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-MCP-013: OAuth sessions list renders with scopes', async () => {
@@ -318,6 +318,6 @@ describe('AdminMcpTokensPanel', () => {
     const deleteBtns = screen.getAllByRole('button', { name: 'Delete' });
     const confirmBtn = deleteBtns.find(b => !b.title);
     await user.click(confirmBtn ?? deleteBtns[deleteBtns.length - 1]);
-    await screen.findByText('Failed to revoke session');
+    expect(await screen.findByText('Failed to revoke session')).toBeInTheDocument();
   });
 });
diff --git a/client/src/components/Admin/AdminMcpTokensPanel.tsx b/client/src/components/Admin/AdminMcpTokensPanel.tsx
index 060332ac0..221f4da9c 100644
--- a/client/src/components/Admin/AdminMcpTokensPanel.tsx
+++ b/client/src/components/Admin/AdminMcpTokensPanel.tsx
@@ -126,13 +126,13 @@ export default function AdminMcpTokensPanel() {
                           </span>
                         ))}
                         {!expanded && hidden > 0 && (
-                          <button onClick={() => toggleScopes(session.id)}
+                          <button type="button" onClick={() => toggleScopes(session.id)}
                             className="inline-flex items-center px-1.5 py-0.5 rounded text-xs font-medium transition-colors hover:opacity-80 bg-surface-secondary text-content-secondary border border-edge">
                             +{hidden} more
                           </button>
                         )}
                         {expanded && hidden > 0 && (
-                          <button onClick={() => toggleScopes(session.id)}
+                          <button type="button" onClick={() => toggleScopes(session.id)}
                             className="inline-flex items-center px-1.5 py-0.5 rounded text-xs font-medium transition-colors hover:opacity-80 bg-surface-secondary text-content-secondary border border-edge">
                             show less
                           </button>
@@ -146,7 +146,7 @@ export default function AdminMcpTokensPanel() {
                     <span className="text-xs whitespace-nowrap text-right pt-0.5" style={{ color: 'var(--text-tertiary)' }}>
                       {new Date(session.created_at).toLocaleDateString(locale)}
                     </span>
-                    <button onClick={() => setRevokeConfirmId(session.id)}
+                    <button type="button" onClick={() => setRevokeConfirmId(session.id)}
                       className="p-1.5 rounded-lg transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
                       style={{ color: 'var(--text-tertiary)' }} title={t('common.delete')}>
                       <Trash2 className="w-4 h-4" />
@@ -199,7 +199,7 @@ export default function AdminMcpTokensPanel() {
                   <span className="text-xs whitespace-nowrap text-right" style={{ color: 'var(--text-tertiary)' }}>
                     {token.last_used_at ? new Date(token.last_used_at).toLocaleDateString(locale) : t('admin.mcpTokens.never')}
                   </span>
-                  <button onClick={() => setDeleteConfirmId(token.id)}
+                  <button type="button" onClick={() => setDeleteConfirmId(token.id)}
                     className="p-1.5 rounded-lg transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
                     style={{ color: 'var(--text-tertiary)' }} title={t('common.delete')}>
                     <Trash2 className="w-4 h-4" />
@@ -214,16 +214,21 @@ export default function AdminMcpTokensPanel() {
       {/* Revoke OAuth session modal */}
       {revokeConfirmId !== null && (
         <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
-          onClick={e => { if (e.target === e.currentTarget) setRevokeConfirmId(null) }}>
+          role="button" tabIndex={0} aria-label={t('common.close')}
+          onClick={e => { if (e.target === e.currentTarget) setRevokeConfirmId(null) }}
+          onKeyDown={e => {
+            if (e.target !== e.currentTarget) return
+            if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); setRevokeConfirmId(null) }
+          }}>
           <div className="rounded-xl shadow-xl w-full max-w-sm p-6 space-y-4 bg-surface-card">
             <h3 className="text-base font-semibold text-content">{t('admin.oauthSessions.revokeTitle')}</h3>
             <p className="text-sm text-content-secondary">{t('admin.oauthSessions.revokeMessage')}</p>
             <div className="flex gap-2 justify-end">
-              <button onClick={() => setRevokeConfirmId(null)}
+              <button type="button" onClick={() => setRevokeConfirmId(null)}
                 className="px-4 py-2 rounded-lg text-sm border border-edge text-content-secondary">
                 {t('common.cancel')}
               </button>
-              <button onClick={() => handleRevoke(revokeConfirmId)}
+              <button type="button" onClick={() => handleRevoke(revokeConfirmId)}
                 className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-red-600 hover:bg-red-700">
                 {t('common.delete')}
               </button>
@@ -235,16 +240,21 @@ export default function AdminMcpTokensPanel() {
       {/* Delete MCP token modal */}
       {deleteConfirmId !== null && (
         <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
-          onClick={e => { if (e.target === e.currentTarget) setDeleteConfirmId(null) }}>
+          role="button" tabIndex={0} aria-label={t('common.close')}
+          onClick={e => { if (e.target === e.currentTarget) setDeleteConfirmId(null) }}
+          onKeyDown={e => {
+            if (e.target !== e.currentTarget) return
+            if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); setDeleteConfirmId(null) }
+          }}>
           <div className="rounded-xl shadow-xl w-full max-w-sm p-6 space-y-4 bg-surface-card">
             <h3 className="text-base font-semibold text-content">{t('admin.mcpTokens.deleteTitle')}</h3>
             <p className="text-sm text-content-secondary">{t('admin.mcpTokens.deleteMessage')}</p>
             <div className="flex gap-2 justify-end">
-              <button onClick={() => setDeleteConfirmId(null)}
+              <button type="button" onClick={() => setDeleteConfirmId(null)}
                 className="px-4 py-2 rounded-lg text-sm border border-edge text-content-secondary">
                 {t('common.cancel')}
               </button>
-              <button onClick={() => handleDelete(deleteConfirmId)}
+              <button type="button" onClick={() => handleDelete(deleteConfirmId)}
                 className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-red-600 hover:bg-red-700">
                 {t('common.delete')}
               </button>
diff --git a/client/src/components/Admin/AdminPluginsPanel.test.tsx b/client/src/components/Admin/AdminPluginsPanel.test.tsx
index 371df1556..693925b0c 100644
--- a/client/src/components/Admin/AdminPluginsPanel.test.tsx
+++ b/client/src/components/Admin/AdminPluginsPanel.test.tsx
@@ -201,6 +201,9 @@ function registryEntry(over: Record<string, unknown> = {}) {
     id: 'trek-gotify', name: 'Gotify', author: 'Acme', description: 'Push', repo: 'acme/gotify',
     type: 'integration', latest: '2.0.0', minTrekVersion: null, reviewedAt: null,
     screenshotUrl: null, signed: true, authorPublicKey: 'NEWKEYbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+    // The real browse response always carries latestCompatible (server-side hostCompat);
+    // mirror `latest` by default, exactly like a fully-compatible entry.
+    latestCompatible: (over.latest as string | undefined) ?? '2.0.0',
     ...over,
   }
 }
@@ -1087,6 +1090,235 @@ describe('AdminPluginsPanel — updates', () => {
   })
 })
 
+/**
+ * Update availability must follow what this TREK can actually INSTALL (latestCompatible,
+ * computed server-side), never the absolute newest published version — a banner counting
+ * versions the update endpoint would refuse nags the admin toward a guaranteed 400.
+ */
+describe('AdminPluginsPanel — compatible updates only', () => {
+  const outdated = plugin({ source_repo: 'acme/gotify', version: '1.0.0', operatorEgress: false })
+
+  it('FE-COMP-PLUGINS-UPD-001: an update this TREK cannot install is neither offered nor counted', async () => {
+    panelWith([outdated], {
+      registry: [registryEntry({ latest: '2.0.0', latestCompatible: null, trek: '>=4.0.0', hostVersion: '3.3.0' })],
+    })
+    render(<AdminPluginsPanel />)
+    await screen.findByText('Gotify')
+
+    expect(screen.queryByRole('button', { name: /update → v2\.0\.0/i })).not.toBeInTheDocument()
+    expect(screen.queryByText(/updates available for your plugins/i)).not.toBeInTheDocument()
+  })
+
+  it('FE-COMP-PLUGINS-UPD-002: the update offer is the newest compatible version, not the absolute latest', async () => {
+    panelWith([outdated], {
+      registry: [registryEntry({ latest: '3.0.0', latestCompatible: '2.0.0', trek: '>=4.0.0', hostVersion: '3.3.0' })],
+    })
+    render(<AdminPluginsPanel />)
+
+    expect(await screen.findByRole('button', { name: /update → v2\.0\.0/i })).toBeInTheDocument()
+    expect(screen.getByText('1 updates available for your plugins.')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: /update → v3\.0\.0/i })).not.toBeInTheDocument()
+  })
+
+  it('FE-COMP-PLUGINS-UPD-003: a newer version needing a newer TREK leaves a passive hint on the row', async () => {
+    panelWith([outdated], {
+      registry: [registryEntry({ latest: '2.0.0', latestCompatible: null, trek: '>=4.0.0', hostVersion: '3.3.0' })],
+    })
+    render(<AdminPluginsPanel />)
+
+    expect(await screen.findByText('v2.0.0 available — needs TREK >=4.0.0')).toBeInTheDocument()
+  })
+
+  it('FE-COMP-PLUGINS-UPD-004: a legacy entry with only minTrekVersion still gets a hint range', async () => {
+    panelWith([outdated], {
+      registry: [registryEntry({ latest: '2.0.0', latestCompatible: null, trek: null, minTrekVersion: '4.0.0', hostVersion: '3.3.0' })],
+    })
+    render(<AdminPluginsPanel />)
+
+    expect(await screen.findByText('v2.0.0 available — needs TREK >=4.0.0')).toBeInTheDocument()
+  })
+
+  it('FE-COMP-PLUGINS-UPD-005: no hint when the latest version is the one on offer', async () => {
+    panelWith([outdated], { registry: [registryEntry({ latest: '2.0.0' })] })
+    render(<AdminPluginsPanel />)
+
+    expect(await screen.findByRole('button', { name: /update → v2\.0\.0/i })).toBeInTheDocument()
+    expect(screen.queryByText(/needs TREK/i)).not.toBeInTheDocument()
+  })
+})
+
+/**
+ * The update hold (#plugins): a deliberate non-latest install sets updateHold on the row,
+ * which takes it out of the banner count and "Update all" — a rollback the admin just
+ * made must not be nagged straight back. The row says so and offers to resume.
+ */
+describe('AdminPluginsPanel — update hold', () => {
+  const held = plugin({ source_repo: 'acme/gotify', version: '1.0.0', operatorEgress: false, updateHold: true })
+
+  it('FE-COMP-PLUGINS-HOLD-001: a held plugin leaves the banner and loses its update button', async () => {
+    panelWith([held], { registry: [registryEntry({ latest: '2.0.0' })] })
+    render(<AdminPluginsPanel />)
+    await screen.findByText('Gotify')
+
+    expect(screen.queryByText(/updates available for your plugins/i)).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: /update → v2\.0\.0/i })).not.toBeInTheDocument()
+    expect(screen.getByText('Updates paused at v1.0.0')).toBeInTheDocument()
+  })
+
+  it('FE-COMP-PLUGINS-HOLD-002: Resume updates releases the hold on the server', async () => {
+    let resumed = false
+    panelWith([held], { registry: [registryEntry({ latest: '2.0.0' })] })
+    server.use(http.post('*/api/admin/plugins/trek-gotify/resume-updates', () => {
+      resumed = true
+      return HttpResponse.json({ updateHold: false })
+    }))
+    withToast()
+
+    fireEvent.click(await screen.findByRole('button', { name: /resume updates/i }))
+
+    await waitFor(() => expect(resumed).toBe(true))
+    expect(await screen.findByText('Updates resumed')).toBeInTheDocument()
+  })
+
+  it('FE-COMP-PLUGINS-HOLD-003: Update all skips held plugins', async () => {
+    const updated: string[] = []
+    panelWith(
+      [held, plugin({ id: 'trek-ntfy', name: 'Ntfy', source_repo: 'acme/ntfy', version: '1.0.0', operatorEgress: false })],
+      { registry: [registryEntry({ latest: '2.0.0' }), registryEntry({ id: 'trek-ntfy', latest: '3.0.0' })] },
+    )
+    server.use(http.post('*/api/admin/plugins/:id/update', ({ params }) => {
+      updated.push(String(params.id))
+      return HttpResponse.json({ version: '3.0.0', activated: true, newPermissions: [], newEgress: [] })
+    }))
+    withToast()
+
+    expect(await screen.findByText('1 updates available for your plugins.')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: /update all/i }))
+
+    await waitFor(() => expect(updated).toEqual(['trek-ntfy']))
+  })
+})
+
+/**
+ * The version picker (#plugins): install any published version from the Discover detail
+ * modal, and roll an installed plugin back through the update pipeline (which owns the
+ * stop-child + re-consent machinery). Compat verdicts are SERVER-computed per version —
+ * the picker only renders them, it never re-derives range logic.
+ */
+describe('AdminPluginsPanel — version picker', () => {
+  const VERSIONS = [
+    { version: '3.0.0', publishedAt: '2026-08-01', size: 2048, signed: true, trek: '>=4.0.0', compatible: false },
+    { version: '2.0.0', publishedAt: '2026-07-01', size: 1024, signed: true, trek: '>=3.0.0 <4.0.0', compatible: true },
+    { version: '1.5.0', publishedAt: '2026-06-01', size: 1000, signed: true, trek: '>=3.0.0 <4.0.0', compatible: true },
+  ]
+  const detailWithVersions = () => ({
+    ...registryEntry({ latest: '3.0.0', latestCompatible: '2.0.0', trek: '>=4.0.0', hostVersion: '3.3.0', compatible: false }),
+    size: 1024, publishedAt: null, manifest: null, versions: VERSIONS,
+  })
+
+  function mockDiscoverDetail() {
+    server.use(
+      http.get('*/api/admin/plugins', () => HttpResponse.json({ enabled: true, devLink: false, plugins: [] })),
+      http.get('*/api/admin/plugins/registry', () =>
+        HttpResponse.json([registryEntry({ latest: '3.0.0', latestCompatible: '2.0.0', trek: '>=4.0.0', hostVersion: '3.3.0', compatible: false })])),
+      http.get('*/api/admin/plugins/registry/trek-gotify', () => HttpResponse.json(detailWithVersions())),
+    )
+  }
+
+  it('FE-COMP-PLUGINS-VPICK-001: the detail modal lists every version and installs the picked one', async () => {
+    let body: unknown = null
+    mockDiscoverDetail()
+    server.use(http.post('*/api/admin/plugins/install', async ({ request }) => {
+      body = await request.json()
+      return HttpResponse.json({ id: 'trek-gotify', version: '1.5.0' })
+    }))
+    withToast()
+    const tabs = await screen.findAllByRole('tab', { name: /^discover/i })
+    fireEvent.click(tabs[0])
+    fireEvent.click(await screen.findByText('Gotify'))
+
+    fireEvent.click(await screen.findByRole('button', { name: /^install 1\.5\.0$/i }))
+
+    await waitFor(() => expect(body).toEqual({ id: 'trek-gotify', version: '1.5.0' }))
+  })
+
+  it('FE-COMP-PLUGINS-VPICK-002: an incompatible version is greyed with its TREK requirement, not installable', async () => {
+    mockDiscoverDetail()
+    render(<AdminPluginsPanel />)
+    const tabs = await screen.findAllByRole('tab', { name: /^discover/i })
+    fireEvent.click(tabs[0])
+    fireEvent.click(await screen.findByText('Gotify'))
+
+    expect(await screen.findByText(/^needs TREK >=4\.0\.0$/i)).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: /^install 3\.0\.0$/i })).not.toBeInTheDocument()
+  })
+
+  it('FE-COMP-PLUGINS-VPICK-003: Change version rolls back through update, after an explicit data warning', async () => {
+    let body: unknown = null
+    panelWith([plugin({ source_repo: 'acme/gotify', version: '2.0.0', operatorEgress: false })], {
+      registry: [registryEntry({ latest: '2.0.0' })],
+    })
+    server.use(
+      http.get('*/api/admin/plugins/registry/trek-gotify', () => HttpResponse.json(detailWithVersions())),
+      http.post('*/api/admin/plugins/trek-gotify/update', async ({ request }) => {
+        body = await request.json()
+        return HttpResponse.json({ version: '1.5.0', activated: true, newPermissions: [], newEgress: [] })
+      }),
+    )
+    withToast()
+    fireEvent.click(await screen.findByTestId('plugin-row-menu-btn-trek-gotify'))
+    fireEvent.click(await screen.findByRole('button', { name: /change version/i }))
+    fireEvent.click(await screen.findByRole('button', { name: /^switch to 1\.5\.0$/i }))
+
+    // The rollback keeps the plugin's data — the older code may not read it. Informed consent, no snapshot.
+    expect(await screen.findByText(/data written by the newer version stays in place/i)).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: /roll back/i }))
+
+    await waitFor(() => expect(body).toEqual({ version: '1.5.0' }))
+  })
+
+  it('FE-COMP-PLUGINS-VPICK-004: picking a NEWER version in the picker updates without the downgrade warning', async () => {
+    let body: unknown = null
+    panelWith([plugin({ source_repo: 'acme/gotify', version: '1.5.0', operatorEgress: false })], {
+      registry: [registryEntry({ latest: '2.0.0' })],
+    })
+    server.use(
+      http.get('*/api/admin/plugins/registry/trek-gotify', () => HttpResponse.json(detailWithVersions())),
+      http.post('*/api/admin/plugins/trek-gotify/update', async ({ request }) => {
+        body = await request.json()
+        return HttpResponse.json({ version: '2.0.0', activated: true, newPermissions: [], newEgress: [] })
+      }),
+    )
+    withToast()
+    fireEvent.click(await screen.findByTestId('plugin-row-menu-btn-trek-gotify'))
+    fireEvent.click(await screen.findByRole('button', { name: /change version/i }))
+    fireEvent.click(await screen.findByRole('button', { name: /^switch to 2\.0\.0$/i }))
+
+    await waitFor(() => expect(body).toEqual({ version: '2.0.0' }))
+    expect(screen.queryByText(/data written by the newer version stays in place/i)).not.toBeInTheDocument()
+  })
+
+  it('FE-COMP-PLUGINS-VPICK-005: the installed version is marked and not switchable; sideloads get no picker', async () => {
+    panelWith([
+      plugin({ source_repo: 'acme/gotify', version: '2.0.0', operatorEgress: false }),
+      plugin({ id: 'side-load', name: 'Sideload', source_repo: 'local:upload', version: '1.0.0', operatorEgress: false }),
+    ], { registry: [registryEntry({ latest: '2.0.0' })] })
+    server.use(http.get('*/api/admin/plugins/registry/trek-gotify', () => HttpResponse.json(detailWithVersions())))
+    withToast()
+
+    fireEvent.click(await screen.findByTestId('plugin-row-menu-btn-side-load'))
+    expect(screen.queryByRole('button', { name: /change version/i })).not.toBeInTheDocument()
+    fireEvent.click(screen.getByTestId('plugin-row-menu-btn-side-load')) // close
+
+    fireEvent.click(await screen.findByTestId('plugin-row-menu-btn-trek-gotify'))
+    fireEvent.click(await screen.findByRole('button', { name: /change version/i }))
+
+    const current = await screen.findByTestId('version-row-2.0.0')
+    expect(within(current).getByText('Installed')).toBeInTheDocument()
+    expect(within(current).queryByRole('button', { name: /switch/i })).not.toBeInTheDocument()
+  })
+})
+
 describe('AdminPluginsPanel — capability and dependency chips', () => {
   it('FE-COMP-PLUGINS-PANEL-035: a permission-rich plugin renders one chip per capability', async () => {
     panelWith([plugin({
@@ -1405,7 +1637,7 @@ describe('AdminPluginsPanel toolbar and dialogs', () => {
 
   it('FE-W5PLG-005: the update filter and the updates-first sort both use the registry version', async () => {
     const user = userEvent.setup()
-    mockPanel(three(), [{ id: 'c-page', name: 'Gamma Page', latest: '9.9.9' }])
+    mockPanel(three(), [{ id: 'c-page', name: 'Gamma Page', latest: '9.9.9', latestCompatible: '9.9.9' }])
     render(<AdminPluginsPanel />)
     await screen.findByText('Alpha Widget')
     await waitFor(() => expect(screen.getByText(/updates? available/i)).toBeInTheDocument())
@@ -1423,7 +1655,7 @@ describe('AdminPluginsPanel toolbar and dialogs', () => {
 
   it('FE-W5PLG-006: switching tabs snaps a tab-only sort key back to name', async () => {
     const user = userEvent.setup()
-    mockPanel(three(), [{ id: 'c-page', name: 'Gamma Page', latest: '9.9.9' }])
+    mockPanel(three(), [{ id: 'c-page', name: 'Gamma Page', latest: '9.9.9', latestCompatible: '9.9.9' }])
     render(<AdminPluginsPanel />)
     await screen.findByText('Alpha Widget')
 
@@ -1880,8 +2112,8 @@ describe('AdminPluginsPanel — update all', () => {
         plugins: [updatableRow(), updatableRow({ id: 'b-widget', name: 'Beta Widget' })],
       })),
       http.get('*/api/admin/plugins/registry', () => HttpResponse.json([
-        { id: 'a-widget', name: 'Alpha Widget', author: 'acme', description: 'd', type: 'widget', latest: '2.0.0' },
-        { id: 'b-widget', name: 'Beta Widget', author: 'acme', description: 'd', type: 'widget', latest: '2.0.0' },
+        { id: 'a-widget', name: 'Alpha Widget', author: 'acme', description: 'd', type: 'widget', latest: '2.0.0', latestCompatible: '2.0.0' },
+        { id: 'b-widget', name: 'Beta Widget', author: 'acme', description: 'd', type: 'widget', latest: '2.0.0', latestCompatible: '2.0.0' },
       ])),
       http.post('*/api/admin/plugins/:id/update', async ({ params }) => {
         started.push(String(params.id))
diff --git a/client/src/components/Admin/AdminPluginsPanel.tsx b/client/src/components/Admin/AdminPluginsPanel.tsx
index 4ca8ae1f1..9ba077f3f 100644
--- a/client/src/components/Admin/AdminPluginsPanel.tsx
+++ b/client/src/components/Admin/AdminPluginsPanel.tsx
@@ -5,7 +5,7 @@ import {
   Blocks, AlertTriangle, PackageOpen, RefreshCw, Trash2, Download, Bug, X, ShieldCheck, UploadCloud,
   ArrowUpCircle, Github, ExternalLink, ChevronDown, Check, Lock, Search, Link2, KeyRound, ShieldAlert,
   SlidersHorizontal, ArrowUpDown, CircleDot, MoreHorizontal, RotateCw, ArrowRight, Database, Users, LayoutDashboard,
-  Radio, Luggage, Globe, Image, CalendarDays, Bell,
+  Radio, Luggage, Globe, Image, CalendarDays, Bell, Info, History, PauseCircle,
   Wallet, Puzzle, MapPin, ListChecks, Pencil, Tag, FileText, Route, Navigation, Clock, LocateFixed, Palette,
 } from 'lucide-react'
 import PluginIcon from '../shared/PluginIcon'
@@ -63,6 +63,8 @@ interface PluginRow {
   keyFingerprint?: string | null
   /** Why an update was refused, if one was. `version` is the version that was refused. */
   updateBlock?: { code: string; detail: string | null; version: string | null } | null
+  /** A deliberate non-latest install paused updates: out of the banner/Update all until resumed. */
+  updateHold?: boolean
 }
 interface RegistryItem {
   id: string
@@ -93,9 +95,21 @@ interface RegistryItem {
   /** The full key — public, and carried in full because re-trust compares it exactly. */
   authorPublicKey?: string | null
 }
+/** One published version, with its SERVER-computed compat verdict (the client has no semver). */
+interface VersionInfo {
+  version: string
+  publishedAt: string | null
+  size: number | null
+  signed: boolean
+  /** The declared TREK requirement, or null when the entry carries no bounds at all. */
+  trek: string | null
+  compatible: boolean
+}
 interface RegistryDetail extends RegistryItem {
   size: number | null
   publishedAt: string | null
+  /** Every published version, newest first — the version picker's data. */
+  versions?: VersionInfo[]
   manifest: {
     // Optional because a registry may omit an empty list — the detail view has to
     // degrade rather than throw halfway through its render.
@@ -187,7 +201,7 @@ const PERM_KEYS = PLUGIN_PERMISSIONS
 const KNOWN_TYPES = ['widget', 'page', 'integration', 'trip-page']
 
 function isNewer(a: string, b: string): boolean {
-  const nums = (v: string) => v.split('-')[0].split('.').map(n => parseInt(n, 10) || 0)
+  const nums = (v: string) => v.split('-')[0].split('.').map(n => Number.parseInt(n, 10) || 0)
   const pa = nums(a), pb = nums(b)
   for (let i = 0; i < 3; i++) {
     const x = pa[i] || 0, y = pb[i] || 0
@@ -392,6 +406,12 @@ export default function AdminPluginsPanel() {
   const [egressSaving, setEgressSaving] = useState(false)
   const [egressError, setEgressError] = useState('')
   const [confirmUninstall, setConfirmUninstall] = useState<PluginRow | null>(null)
+  // The version picker for an INSTALLED plugin ("Change version…"); versions land async
+  // from the registry detail endpoint, which computes each version's compat verdict.
+  const [versionPicker, setVersionPicker] = useState<{ plugin: PluginRow; versions: VersionInfo[] | null; failed: boolean } | null>(null)
+  // A picked version OLDER than the installed one — held here until the admin consents
+  // to the data risk (the plugin's data dir stays; older code may not understand it).
+  const [confirmDowngrade, setConfirmDowngrade] = useState<{ plugin: PluginRow; version: string } | null>(null)
   // A QUEUE, not one slot: "Update All" can produce several re-consent prompts —
   // each must be shown, not silently overwritten by the last one.
   const [consentQueue, setConsentQueue] = useState<Array<{ plugin: PluginRow; version: string; newPermissions: string[]; newEgress: string[] }>>([])
@@ -420,10 +440,13 @@ export default function AdminPluginsPanel() {
 
   // Index the registry once per fetch: the version map the update badges read, plus the
   // whole entry (author key + signed flag) the trust badges and re-trust dialog need.
+  // The map holds latestCompatible — the newest version THIS TREK can install (computed
+  // server-side) — not the absolute latest, so the banner never counts an update the
+  // update endpoint would refuse.
   const indexRegistry = (items: RegistryItem[]) => {
     const vers: Record<string, string> = {}
     const byId: Record<string, RegistryItem> = {}
-    items.forEach((i) => { byId[i.id] = i; if (i.latest) vers[i.id] = i.latest })
+    items.forEach((i) => { byId[i.id] = i; if (i.latestCompatible) vers[i.id] = i.latestCompatible })
     setLatest(vers)
     setRegById(byId)
   }
@@ -551,7 +574,21 @@ export default function AdminPluginsPanel() {
       .catch(() => setErrorsFor({ id, rows: [] }))
   }
 
-  const updateAvailable = (p: PluginRow) => !!(p.version && latest[p.id] && isNewer(latest[p.id], p.version))
+  // A held plugin (deliberate non-latest install) is deliberately NOT an update candidate:
+  // the admin just rolled it back, and the banner nagging them straight back would make
+  // the rollback fight the UI. The row carries its own "paused" marker + resume instead.
+  const updateAvailable = (p: PluginRow) => !!(p.version && !p.updateHold && latest[p.id] && isNewer(latest[p.id], p.version))
+  const resumeUpdates = (p: PluginRow) => act(p.id, () => adminApi.pluginResumeUpdates(p.id), t('admin.plugins.updatesResumed'))
+  // A newer version exists but this TREK can't install it (and it isn't the one on offer):
+  // said passively on the row, so the admin learns a TREK upgrade unlocks it instead of
+  // wondering why no update shows. Null when the registry gives no range to point at.
+  const newerIncompatible = (p: PluginRow): { version: string; range: string } | null => {
+    const reg = regById[p.id]
+    if (!reg?.latest || !p.version || !isNewer(reg.latest, p.version)) return null
+    if (latest[p.id] === reg.latest) return null
+    const range = reg.trek ?? (reg.minTrekVersion ? `>=${reg.minTrekVersion}` : null)
+    return range ? { version: reg.latest, range } : null
+  }
   const install = (id: string, version?: string) => act(id, () => adminApi.pluginInstall(id, version ? { version } : undefined), t('admin.plugins.installed'))
   const restart = (id: string) => act(id, async () => { await adminApi.pluginDeactivate(id); await adminApi.pluginActivate(id) }, t('admin.plugins.restarted'))
   // Dev-link: register a plugin from a local built directory (dev only). Reuses the
@@ -639,9 +676,11 @@ export default function AdminPluginsPanel() {
       .finally(() => { setBusy(null); refresh() })
   }
 
-  const runUpdate = (p: PluginRow) => {
+  // `version` pins the exact version to install (rollback / explicit switch); omitted,
+  // the server resolves the newest TREK-compatible version itself.
+  const runUpdate = (p: PluginRow, version?: string) => {
     setBusy(p.id); setMenu(null)
-    return adminApi.pluginUpdate(p.id)
+    return adminApi.pluginUpdate(p.id, version)
       .then((r: { version: string; activated: boolean; newPermissions: string[]; newEgress: string[] }) => {
         if (r.activated || (r.newPermissions.length === 0 && r.newEgress.length === 0)) toast.success(t('admin.plugins.updated'))
         else setConsentQueue(qq => [...qq, { plugin: p, version: r.version, newPermissions: r.newPermissions, newEgress: r.newEgress }])
@@ -673,6 +712,27 @@ export default function AdminPluginsPanel() {
       .finally(() => { setRetrusting(false); refresh() })
   }
 
+  // "Change version…" on an installed row: fetch the per-version list (with the server's
+  // compat verdicts) and open the picker. The fetch is keyed to the plugin so a stale
+  // response can't populate a picker that was reopened for another row.
+  const openVersionPicker = (p: PluginRow) => {
+    setMenu(null)
+    setVersionPicker({ plugin: p, versions: null, failed: false })
+    adminApi.pluginDetail(p.id)
+      .then((d: RegistryDetail) => setVersionPicker(cur => (cur && cur.plugin.id === p.id ? { ...cur, versions: d.versions ?? [] } : cur)))
+      .catch(() => setVersionPicker(cur => (cur && cur.plugin.id === p.id ? { ...cur, failed: true } : cur)))
+  }
+
+  // Switching DOWN keeps the plugin's data dir, which the older code may not understand —
+  // that asks for explicit consent first. Any other switch is the ordinary update path.
+  const pickVersion = (version: string) => {
+    if (!versionPicker) return
+    const p = versionPicker.plugin
+    setVersionPicker(null)
+    if (p.version && isNewer(p.version, version)) setConfirmDowngrade({ plugin: p, version })
+    else void runUpdate(p, version)
+  }
+
   // eslint-disable-next-line react-hooks/exhaustive-deps
   const updatable = useMemo(() => plugins.filter(updateAvailable), [plugins, latest])
 
@@ -739,7 +799,7 @@ export default function AdminPluginsPanel() {
         </div>
       )}
       {/* Click-away layer for any open dropdown (filters or a row's ⋯ menu). */}
-      {menu && <div className="fixed inset-0 z-20" onClick={() => setMenu(null)} />}
+      {menu && <div role="presentation" className="fixed inset-0 z-20" onClick={() => setMenu(null)} />}
       {/* Header */}
       <div className="px-4 sm:px-6 pt-5">
         <div className="flex items-start justify-between gap-4">
@@ -795,11 +855,11 @@ export default function AdminPluginsPanel() {
               <SegBtn active={view === 'discover'} onClick={openDiscover} label={t('admin.plugins.tabDiscover')} count={registry?.length} />
             </div>
             <div className="sm:hidden flex items-center gap-2 shrink-0">
-              <button onClick={pickUpload} title={t('admin.plugins.upload')}
+              <button type="button" onClick={pickUpload} title={t('admin.plugins.upload')}
                 className="h-[38px] w-[38px] grid place-items-center rounded-xl border border-edge bg-surface-card text-content-muted hover:text-content hover:border-content-faint transition-colors">
                 <UploadCloud size={15} />
               </button>
-              <button onClick={rescan} title={t('admin.plugins.rescan')}
+              <button type="button" onClick={rescan} title={t('admin.plugins.rescan')}
                 className="h-[38px] w-[38px] grid place-items-center rounded-xl border border-edge bg-surface-card text-content-muted hover:text-content hover:border-content-faint transition-colors">
                 <RefreshCw size={15} />
               </button>
@@ -842,11 +902,11 @@ export default function AdminPluginsPanel() {
               valueLabel={sortLabel(sort, t)}
               onPick={v => setSort(v as SortKey)} />
 
-            <button onClick={pickUpload} title={t('admin.plugins.upload')}
+            <button type="button" onClick={pickUpload} title={t('admin.plugins.upload')}
               className="hidden sm:grid h-[38px] w-[38px] place-items-center rounded-xl border border-edge bg-surface-card text-content-muted hover:text-content hover:border-content-faint transition-colors">
               <UploadCloud size={15} />
             </button>
-            <button onClick={rescan} title={t('admin.plugins.rescan')}
+            <button type="button" onClick={rescan} title={t('admin.plugins.rescan')}
               className="hidden sm:grid h-[38px] w-[38px] place-items-center rounded-xl border border-edge bg-surface-card text-content-muted hover:text-content hover:border-content-faint transition-colors">
               <RefreshCw size={15} />
             </button>
@@ -871,7 +931,7 @@ export default function AdminPluginsPanel() {
               <div className="mx-1.5 sm:mx-3 mb-2 mt-1 flex items-center gap-2.5 px-3.5 py-2.5 rounded-xl bg-warning-soft border border-warning/30">
                 <ArrowUpCircle size={16} className="text-warning shrink-0" />
                 <span className="text-xs text-content-secondary">{t('admin.plugins.updatesAvailable', { count: updatable.length })}</span>
-                <button onClick={() => void updateAll()}
+                <button type="button" onClick={() => void updateAll()}
                   className="ml-auto text-xs font-semibold px-3 py-1.5 rounded-lg bg-warning text-white hover:opacity-90 transition-opacity">
                   {t('admin.plugins.updateAll')}
                 </button>
@@ -885,9 +945,12 @@ export default function AdminPluginsPanel() {
             ) : shownInstalled.map(p => (
               <InstalledRow key={p.id} p={p} t={t} busy={busy} menu={menu} setMenu={setMenu}
                 hasUpdate={updateAvailable(p)} latestVer={latest[p.id]}
+                newerIncompatible={newerIncompatible(p)}
                 blocked={blockIsCurrent(p, latest[p.id])}
                 onToggle={() => toggle(p)}
                 onUpdate={() => runUpdate(p)} onRestart={() => restart(p.id)}
+                onChangeVersion={() => openVersionPicker(p)}
+                onResume={() => void resumeUpdates(p)}
                 onReviewBlock={() => setSignatureBlock({
                   subject: { id: p.id, name: p.name, keyFingerprint: p.keyFingerprint ?? null },
                   code: p.updateBlock!.code, detail: p.updateBlock!.detail,
@@ -909,11 +972,11 @@ export default function AdminPluginsPanel() {
 
       {/* Error-log modal */}
       {errorsFor && (
-        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={() => setErrorsFor(null)}>
-          <div className="bg-surface-card border border-edge rounded-2xl w-full max-w-2xl max-h-[70vh] flex flex-col shadow-modal" onClick={e => e.stopPropagation()}>
+        <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={() => setErrorsFor(null)}>
+          <div role="presentation" className="bg-surface-card border border-edge rounded-2xl w-full max-w-2xl max-h-[70vh] flex flex-col shadow-modal" onClick={e => e.stopPropagation()}>
             <div className="px-5 py-3.5 border-b border-edge-secondary flex items-center justify-between">
               <span className="text-sm font-semibold text-content flex items-center gap-2"><Bug size={15} /> {errorsFor.id} — {t('admin.plugins.errorLog')}</span>
-              <button onClick={() => setErrorsFor(null)} className="text-content-faint hover:text-content"><X size={16} /></button>
+              <button type="button" onClick={() => setErrorsFor(null)} className="text-content-faint hover:text-content"><X size={16} /></button>
             </div>
             <div className="p-4 overflow-y-auto text-xs font-mono">
               {errorsFor.rows.length === 0 ? <p className="text-content-faint py-4 text-center">{t('admin.plugins.noErrors')}</p> :
@@ -931,11 +994,11 @@ export default function AdminPluginsPanel() {
 
       {/* Operator-supplied egress hosts */}
       {egressFor && (
-        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={() => setEgressFor(null)}>
-          <div className="bg-surface-card border border-edge rounded-2xl w-full max-w-lg shadow-modal" onClick={e => e.stopPropagation()}>
+        <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={() => setEgressFor(null)}>
+          <div role="presentation" className="bg-surface-card border border-edge rounded-2xl w-full max-w-lg shadow-modal" onClick={e => e.stopPropagation()}>
             <div className="px-5 py-3.5 border-b border-edge-secondary flex items-center justify-between">
               <span className="text-sm font-semibold text-content flex items-center gap-2"><Globe size={15} /> {egressFor.id} — {t('admin.plugins.allowedHosts')}</span>
-              <button onClick={() => setEgressFor(null)} className="text-content-faint hover:text-content"><X size={16} /></button>
+              <button type="button" onClick={() => setEgressFor(null)} className="text-content-faint hover:text-content"><X size={16} /></button>
             </div>
             <div className="p-5 space-y-3">
               {!egressFor.supported ? (
@@ -949,7 +1012,7 @@ export default function AdminPluginsPanel() {
                   {egressFor.hosts.map(h => (
                     <div key={h} className="flex items-center justify-between gap-2 rounded-lg border border-edge-secondary px-3 py-2">
                       <span className="text-sm font-mono text-content break-all">{h}</span>
-                      <button
+                      <button type="button"
                         disabled={egressSaving}
                         onClick={() => saveEgress(egressFor.hosts.filter(x => x !== h))}
                         className="text-content-faint hover:text-danger disabled:opacity-50"
@@ -964,7 +1027,7 @@ export default function AdminPluginsPanel() {
                       placeholder="gotify.example.com"
                       className="flex-1 rounded-lg border border-edge bg-surface px-3 py-2 text-sm text-content"
                     />
-                    <button
+                    <button type="button"
                       disabled={egressSaving || !egressDraft.trim()}
                       onClick={() => saveEgress([...egressFor.hosts, egressDraft.trim()])}
                       className="rounded-lg bg-content px-3 py-2 text-sm text-surface disabled:opacity-50"
@@ -990,6 +1053,20 @@ export default function AdminPluginsPanel() {
         message={t('admin.plugins.uninstallBody')}
       />
 
+      {versionPicker && (
+        <VersionPickerDialog plugin={versionPicker.plugin} versions={versionPicker.versions} failed={versionPicker.failed}
+          busy={busy} t={t} locale={locale} onPick={pickVersion} onClose={() => setVersionPicker(null)} />
+      )}
+
+      <ConfirmDialog
+        isOpen={!!confirmDowngrade}
+        onClose={() => setConfirmDowngrade(null)}
+        onConfirm={() => { const d = confirmDowngrade!; setConfirmDowngrade(null); void runUpdate(d.plugin, d.version) }}
+        title={t('admin.plugins.downgradeTitle')}
+        message={t('admin.plugins.downgradeBody', { from: confirmDowngrade?.plugin.version ?? '', to: confirmDowngrade?.version ?? '' })}
+        confirmLabel={t('admin.plugins.downgradeConfirm')}
+      />
+
       {signatureBlock && (
         <SignatureBlockDialog
           data={signatureBlock} entry={regById[signatureBlock.subject.id]} busy={retrusting} t={t}
@@ -1043,7 +1120,7 @@ function sortLabel(s: SortKey, t: T): string {
 
 function SegBtn({ active, onClick, label, count }: { active: boolean; onClick: () => void; label: string; count?: number }) {
   return (
-    <button onClick={onClick} role="tab" aria-selected={active}
+    <button type="button" onClick={onClick} role="tab" aria-selected={active}
       className={`inline-flex items-center gap-2 text-[13px] font-medium px-3.5 py-1.5 rounded-lg transition-colors ${
         active ? 'bg-surface-card text-content shadow-card' : 'text-content-muted hover:text-content'}`}>
       {label}
@@ -1064,7 +1141,7 @@ function FilterMenu({ id, label, valueLabel, options, onPick, value, menu, setMe
   const active = value !== options[0]?.[0]
   return (
     <div className="relative">
-      <button onClick={() => setMenu(open ? null : id)} title={`${label}: ${valueLabel}`}
+      <button type="button" onClick={() => setMenu(open ? null : id)} title={`${label}: ${valueLabel}`}
         className={`relative h-[38px] w-[38px] sm:w-auto px-0 sm:px-3 inline-flex items-center justify-center sm:justify-start gap-1.5 rounded-xl border bg-surface-card text-[13px] text-content-secondary transition-colors whitespace-nowrap hover:border-content-faint ${
           active ? 'border-content-faint' : 'border-edge'}`}>
         {icon}
@@ -1076,7 +1153,7 @@ function FilterMenu({ id, label, valueLabel, options, onPick, value, menu, setMe
       {open && (
         <div className="absolute top-11 right-0 z-30 min-w-[180px] max-w-[calc(100vw-2rem)] p-1.5 rounded-xl border border-edge bg-surface-card shadow-elevated">
           {options.map(([v, lbl]) => (
-            <button key={v} onClick={() => { onPick(v); setMenu(null) }}
+            <button type="button" key={v} onClick={() => { onPick(v); setMenu(null) }}
               className={`w-full flex items-center gap-2.5 px-2.5 py-2 rounded-lg text-[13px] transition-colors hover:bg-surface-tertiary ${
                 value === v ? 'text-content font-semibold' : 'text-content-secondary'}`}>
               {lbl}<Check size={15} className={`ml-auto text-accent ${value === v ? 'opacity-100' : 'opacity-0'}`} />
@@ -1095,17 +1172,17 @@ function EmptyState({ t, onDiscover }: { t: T; onDiscover: () => void }) {
         <PackageOpen size={26} className="text-content-faint" />
       </div>
       <p className="text-sm font-medium text-content-muted">{t('admin.plugins.empty')}</p>
-      <button onClick={onDiscover} className="mt-4 inline-flex items-center gap-1.5 text-xs font-semibold px-4 py-2 rounded-lg bg-accent text-accent-text">
+      <button type="button" onClick={onDiscover} className="mt-4 inline-flex items-center gap-1.5 text-xs font-semibold px-4 py-2 rounded-lg bg-accent text-accent-text">
         <Download size={14} /> {t('admin.plugins.tabDiscover')}
       </button>
     </div>
   )
 }
 
-function InstalledRow({ p, t, busy, menu, setMenu, hasUpdate, latestVer, blocked, onToggle, onUpdate, onRestart, onReviewBlock, onErrors, onEgress, onUninstall }: {
+function InstalledRow({ p, t, busy, menu, setMenu, hasUpdate, latestVer, newerIncompatible, blocked, onToggle, onUpdate, onRestart, onChangeVersion, onResume, onReviewBlock, onErrors, onEgress, onUninstall }: {
   p: PluginRow; t: T; busy: string | null; menu: string | null; setMenu: (v: string | null) => void
-  hasUpdate: boolean; latestVer?: string; blocked: boolean
-  onToggle: () => void; onUpdate: () => void; onRestart: () => void; onReviewBlock: () => void
+  hasUpdate: boolean; latestVer?: string; newerIncompatible: { version: string; range: string } | null; blocked: boolean
+  onToggle: () => void; onUpdate: () => void; onRestart: () => void; onChangeVersion: () => void; onResume: () => void; onReviewBlock: () => void
   onErrors: () => void; onEgress: () => void; onUninstall: () => void
 }) {
   const caps = deriveCaps(parseJson<string[]>(p.permissions, []), parseJson<{ widget?: { slot?: string } }>(p.capabilities, {}), t)
@@ -1158,12 +1235,32 @@ function InstalledRow({ p, t, busy, menu, setMenu, hasUpdate, latestVer, blocked
           <div className="flex items-center gap-1.5 mt-1.5 text-[11.5px] text-warning">
             <ShieldAlert size={13} className="shrink-0" />
             <span className="truncate">{t('admin.plugins.updateBlocked', { reason: p.updateBlock.detail ?? p.updateBlock.code })}</span>
-            <button onClick={onReviewBlock}
+            <button type="button" onClick={onReviewBlock}
               className="shrink-0 font-semibold underline underline-offset-2 hover:opacity-80 transition-opacity">
               {t('admin.plugins.reviewBlock')}
             </button>
           </div>
         )}
+        {/* A newer version this TREK can't run — informational, never a button: the fix
+            is a TREK upgrade, so the row must not nag or offer a doomed install. */}
+        {newerIncompatible && (
+          <div className="flex items-center gap-1.5 mt-1.5 text-[11.5px] text-content-faint">
+            <Info size={13} className="shrink-0" />
+            <span className="truncate">{t('admin.plugins.newerNeedsTrek', { version: newerIncompatible.version, range: newerIncompatible.range })}</span>
+          </div>
+        )}
+        {/* Held: the admin deliberately installed a non-latest version, so updates are
+            paused rather than nagged — resuming is one click, right where the pause shows. */}
+        {p.updateHold && (
+          <div className="flex items-center gap-1.5 mt-1.5 text-[11.5px] text-content-faint">
+            <PauseCircle size={13} className="shrink-0" />
+            <span className="truncate">{t('admin.plugins.updatesHeld', { version: p.version ?? '' })}</span>
+            <button type="button" onClick={onResume} disabled={busy === p.id}
+              className="shrink-0 font-semibold underline underline-offset-2 hover:opacity-80 transition-opacity disabled:opacity-50">
+              {t('admin.plugins.resumeUpdates')}
+            </button>
+          </div>
+        )}
         {p.status === 'error' && p.last_error ? (
           <div className="flex items-center gap-1.5 mt-1.5 text-[11.5px] text-danger">
             <AlertTriangle size={13} className="shrink-0" /><span className="truncate">{p.last_error}</span>
@@ -1181,7 +1278,7 @@ function InstalledRow({ p, t, busy, menu, setMenu, hasUpdate, latestVer, blocked
                 Actionable, and warning-toned until at least one host exists, because
                 until then the plugin cannot reach anything and looks silently broken. */}
             {p.operatorEgress && (
-              <button
+              <button type="button"
                 onClick={onEgress}
                 title={t('admin.plugins.allowedHosts.hint')}
                 className={`inline-flex items-center gap-1.5 text-[11px] font-medium px-2 py-[3px] rounded-md border transition-colors ${
@@ -1211,7 +1308,7 @@ function InstalledRow({ p, t, busy, menu, setMenu, hasUpdate, latestVer, blocked
 
       <div className="flex items-center gap-1.5 sm:gap-2 shrink-0">
         {hasUpdate && (
-          <button onClick={onUpdate} disabled={busy === p.id} title={t('admin.plugins.updateTo', { version: latestVer })}
+          <button type="button" onClick={onUpdate} disabled={busy === p.id} title={t('admin.plugins.updateTo', { version: latestVer })}
             className="inline-flex items-center gap-1.5 text-[11.5px] font-semibold px-2 sm:px-2.5 py-1.5 rounded-full text-warning bg-warning-soft border border-warning/30 hover:opacity-90 transition-opacity disabled:opacity-50">
             <ArrowUpCircle size={13} /> <span className="hidden sm:inline">{t('admin.plugins.updateTo', { version: latestVer })}</span>
           </button>
@@ -1221,7 +1318,7 @@ function InstalledRow({ p, t, busy, menu, setMenu, hasUpdate, latestVer, blocked
         </span>
         <ToggleSwitch on={p.enabled === 1} label={t('admin.plugins.enabledToggle')} onToggle={onToggle} />
         <div className="relative">
-          <button ref={menuBtnRef} data-testid={`plugin-row-menu-btn-${p.id}`} onClick={() => setMenu(menuOpen ? null : `row:${p.id}`)}
+          <button type="button" ref={menuBtnRef} data-testid={`plugin-row-menu-btn-${p.id}`} onClick={() => setMenu(menuOpen ? null : `row:${p.id}`)}
             className="w-[34px] h-[34px] grid place-items-center rounded-lg text-content-faint hover:text-content hover:bg-surface-tertiary transition-colors">
             <MoreHorizontal size={17} />
           </button>
@@ -1233,6 +1330,10 @@ function InstalledRow({ p, t, busy, menu, setMenu, hasUpdate, latestVer, blocked
               )}
               <MenuItem icon={<Bug size={14} />} label={t('admin.plugins.viewErrors')} onClick={onErrors} />
               <MenuItem icon={<Globe size={14} />} label={t('admin.plugins.allowedHosts')} onClick={onEgress} />
+              {/* Registry plugins only — a sideload/dev-link has no registry versions to pick from. */}
+              {isRegistrySourced(p.source_repo) && (
+                <MenuItem icon={<History size={14} />} label={t('admin.plugins.changeVersion')} onClick={onChangeVersion} />
+              )}
               {p.source_repo && p.source_repo !== 'local:upload' && p.source_repo !== 'local:link' && (
                 <>
                   <a href={`https://github.com/${p.source_repo}`} target="_blank" rel="noreferrer" onClick={() => setMenu(null)}
@@ -1275,7 +1376,7 @@ function anchorMenu(trigger: HTMLElement | null): CSSProperties {
 
 function MenuItem({ icon, label, onClick, danger }: { icon: React.ReactNode; label: string; onClick: () => void; danger?: boolean }) {
   return (
-    <button onClick={onClick}
+    <button type="button" onClick={onClick}
       className={`w-full flex items-center gap-2.5 px-2.5 py-2 rounded-lg text-[13px] transition-colors ${
         danger ? 'text-danger hover:bg-danger-soft' : 'text-content-secondary hover:bg-surface-tertiary'}`}>
       {icon} {label}
@@ -1349,7 +1450,7 @@ function RegistryGrid({ items, onInstall, onOpenDetail, busy, t, installedIds, f
                     <Download size={11} /> {formatCompactCount(item.downloadCount)}
                   </span>
                 )}
-                <button onClick={e => { e.stopPropagation(); onInstall(item.id, offer.version) }}
+                <button type="button" onClick={e => { e.stopPropagation(); onInstall(item.id, offer.version) }}
                   disabled={busy === item.id || installed || offer.blocked}
                   title={installed ? undefined : offer.title}
                   className="ml-auto text-xs font-semibold px-3.5 py-1.5 rounded-lg bg-accent text-accent-text hover:bg-accent-hover disabled:opacity-50 disabled:bg-surface-tertiary disabled:text-content-faint transition-colors">
@@ -1407,12 +1508,12 @@ function PluginDetailModal({ item, installed, busy, onInstall, onClose, t, local
   const offer = installOffer(detail ?? item, t)
 
   return (
-    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={onClose}>
-      <div className="bg-surface-card border border-edge rounded-2xl w-full max-w-xl max-h-[88vh] overflow-auto shadow-modal" onClick={e => e.stopPropagation()}>
+    <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={onClose}>
+      <div role="presentation" className="bg-surface-card border border-edge rounded-2xl w-full max-w-xl max-h-[88vh] overflow-auto shadow-modal" onClick={e => e.stopPropagation()}>
         <div className="relative">
           <Screenshot url={item.screenshotUrl} className="w-full aspect-[16/9]" iconSize={36} />
           <div className="absolute inset-0 bg-gradient-to-t from-black/50 to-transparent" />
-          <button onClick={onClose} className="absolute top-3 right-3 w-8 h-8 grid place-items-center rounded-lg bg-black/40 text-white hover:bg-black/60 transition-colors"><X size={16} /></button>
+          <button type="button" onClick={onClose} className="absolute top-3 right-3 w-8 h-8 grid place-items-center rounded-lg bg-black/40 text-white hover:bg-black/60 transition-colors"><X size={16} /></button>
         </div>
 
         <div className="flex items-start gap-3 sm:gap-3.5 px-4 sm:px-5 -mt-7 relative z-[1]">
@@ -1426,7 +1527,7 @@ function PluginDetailModal({ item, installed, busy, onInstall, onClose, t, local
             </div>
             <p className="text-[12.5px] text-content-faint mt-0.5">{item.author}{item.latest ? ` · v${item.latest}` : ''}</p>
           </div>
-          <button onClick={() => onInstall(item.id, offer.version)}
+          <button type="button" onClick={() => onInstall(item.id, offer.version)}
             disabled={busy === item.id || installed || offer.blocked}
             title={installed ? undefined : offer.title}
             className="self-end text-[13px] font-semibold px-3 sm:px-4 py-2 rounded-lg bg-accent text-accent-text hover:bg-accent-hover disabled:opacity-50 disabled:bg-surface-tertiary disabled:text-content-faint transition-colors shrink-0">
@@ -1509,7 +1610,7 @@ function PluginDetailModal({ item, installed, busy, onInstall, onClose, t, local
             <h4 className="text-[11px] font-semibold uppercase tracking-wider text-content-muted">{t('admin.plugins.detailsTitle')}</h4>
             <div className="grid grid-cols-2 gap-x-6 gap-y-3 mt-2.5">
               {item.latest && <Meta k={t('admin.plugins.metaVersion')} v={`v${item.latest}`} />}
-              {sizeKb && <Meta k={t('admin.plugins.metaSize')} v={`${sizeKb} KB`} />}
+              {sizeKb !== null && <Meta k={t('admin.plugins.metaSize')} v={`${sizeKb} KB`} />}
               {/* The range, not just its lower bound: "TREK 3.2.0+" reads as "and anything
                   newer", which is exactly the claim a `<4.0.0` upper bound denies. */}
               {(item.trek || item.minTrekVersion) && (
@@ -1521,6 +1622,34 @@ function PluginDetailModal({ item, installed, busy, onInstall, onClose, t, local
               )}
             </div>
           </div>
+
+          {/* Every published version, installable individually. The compat verdict per
+              version is SERVER-computed — an incompatible one is explained, never offered. */}
+          {(detail?.versions?.length ?? 0) > 1 && (
+            <div className="mt-5">
+              <h4 className="text-[11px] font-semibold uppercase tracking-wider text-content-muted">{t('admin.plugins.versionsTitle')}</h4>
+              <div className="mt-2 space-y-0.5">
+                {detail!.versions!.map(v => (
+                  <div key={v.version} className="flex items-center gap-2.5 py-1">
+                    <span className={`text-[12.5px] font-medium tabular-nums ${v.compatible ? 'text-content' : 'text-content-faint'}`}>v{v.version}</span>
+                    {v.publishedAt && <span className="text-[11.5px] text-content-faint">{new Date(v.publishedAt).toLocaleDateString(locale)}</span>}
+                    {v.signed && <ShieldCheck size={13} className="text-success shrink-0" />}
+                    <span className="ml-auto" />
+                    {v.compatible ? (
+                      !installed && (
+                        <button type="button" onClick={() => onInstall(item.id, v.version)} disabled={busy === item.id}
+                          className="text-[11.5px] font-semibold px-2.5 py-1 rounded-full border border-edge bg-surface-card text-content-secondary hover:text-content hover:border-content-faint transition-colors disabled:opacity-50">
+                          {t('admin.plugins.installCompatible', { version: v.version })}
+                        </button>
+                      )
+                    ) : (
+                      <span className="text-[11.5px] text-content-faint">{t('admin.plugins.versionNeedsTrek', { range: v.trek ?? '' })}</span>
+                    )}
+                  </div>
+                ))}
+              </div>
+            </div>
+          )}
         </div>
 
         <div className="flex items-center gap-2 px-4 sm:px-5 py-3.5 border-t border-edge-secondary bg-surface-secondary">
@@ -1548,6 +1677,55 @@ function Meta({ k, v }: { k: string; v: string }) {
   return <div><div className="text-[12px] text-content-faint">{k}</div><div className="text-[12.5px] font-medium text-content mt-0.5">{v}</div></div>
 }
 
+/**
+ * "Change version…" for an INSTALLED plugin. Rows render the server's per-version compat
+ * verdict: the installed version is marked, a compatible one gets a Switch action (the
+ * caller routes a DOWNGRADE through the data-risk confirm), an incompatible one is
+ * explained and never offered.
+ */
+function VersionPickerDialog({ plugin, versions, failed, busy, t, locale, onPick, onClose }: {
+  plugin: PluginRow; versions: VersionInfo[] | null; failed: boolean; busy: string | null
+  t: T; locale: string; onPick: (version: string) => void; onClose: () => void
+}) {
+  return (
+    <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={onClose}>
+      <div role="presentation" className="bg-surface-card border border-edge rounded-2xl w-full max-w-md max-h-[80vh] overflow-auto shadow-modal" onClick={e => e.stopPropagation()}>
+        <div className="flex items-center justify-between px-4 py-3.5 border-b border-edge-secondary">
+          <h3 className="text-[15px] font-semibold text-content truncate">{t('admin.plugins.versionPickerTitle', { name: plugin.name })}</h3>
+          <button type="button" onClick={onClose} className="w-8 h-8 grid place-items-center rounded-lg text-content-faint hover:text-content hover:bg-surface-tertiary transition-colors shrink-0"><X size={16} /></button>
+        </div>
+        <div className="p-2">
+          {failed && <p className="text-xs text-danger px-2.5 py-2">{t('admin.plugins.detailError')}</p>}
+          {!failed && !versions && <p className="text-xs text-content-faint px-2.5 py-2">{t('common.loading')}</p>}
+          {versions?.length === 0 && <p className="text-xs text-content-faint px-2.5 py-2">{t('admin.plugins.noVersions')}</p>}
+          {versions?.map(v => {
+            const current = v.version === plugin.version
+            return (
+              <div key={v.version} data-testid={`version-row-${v.version}`}
+                className="flex items-center gap-2.5 px-2.5 py-2 rounded-xl hover:bg-surface-secondary transition-colors">
+                <span className={`text-[13px] font-medium tabular-nums ${v.compatible ? 'text-content' : 'text-content-faint'}`}>v{v.version}</span>
+                {v.publishedAt && <span className="text-[11.5px] text-content-faint">{new Date(v.publishedAt).toLocaleDateString(locale)}</span>}
+                {v.signed && <ShieldCheck size={13} className="text-success shrink-0" />}
+                <span className="ml-auto" />
+                {current ? (
+                  <span className="text-[11.5px] font-medium text-content-faint">{t('admin.plugins.installed')}</span>
+                ) : v.compatible ? (
+                  <button type="button" onClick={() => onPick(v.version)} disabled={busy === plugin.id}
+                    className="text-[11.5px] font-semibold px-2.5 py-1 rounded-full border border-edge bg-surface-card text-content-secondary hover:text-content hover:border-content-faint transition-colors disabled:opacity-50">
+                    {t('admin.plugins.versionSwitch', { version: v.version })}
+                  </button>
+                ) : (
+                  <span className="text-[11.5px] text-content-faint">{t('admin.plugins.versionNeedsTrek', { range: v.trek ?? '' })}</span>
+                )}
+              </div>
+            )
+          })}
+        </div>
+      </div>
+    </div>
+  )
+}
+
 /**
  * A signature check refused an install/update.
  *
@@ -1582,8 +1760,8 @@ function SignatureBlockDialog({ data, entry, busy, t, onRetrust, onClose }: {
     : 'admin.plugins.sig.invalidBody'
 
   return (
-    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={onClose}>
-      <div className="bg-surface-card border border-edge rounded-2xl w-full max-w-md shadow-modal overflow-hidden" onClick={e => e.stopPropagation()}>
+    <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={onClose}>
+      <div role="presentation" className="bg-surface-card border border-edge rounded-2xl w-full max-w-md shadow-modal overflow-hidden" onClick={e => e.stopPropagation()}>
         <div className="px-5 py-4 border-b border-edge-secondary flex items-start gap-3">
           <div className="w-9 h-9 rounded-lg bg-warning-soft grid place-items-center shrink-0"><ShieldAlert size={18} className="text-warning" /></div>
           <div>
@@ -1606,12 +1784,12 @@ function SignatureBlockDialog({ data, entry, busy, t, onRetrust, onClose }: {
           )}
         </div>
         <div className="px-5 py-3.5 border-t border-edge-secondary bg-surface-secondary flex items-center justify-end gap-2">
-          <button onClick={onClose}
+          <button type="button" onClick={onClose}
             className="text-xs font-medium px-3.5 py-2 rounded-lg border border-edge text-content-muted hover:text-content hover:bg-surface-tertiary transition-colors">
             {offerRetrust ? t('admin.plugins.sig.cancel') : t('common.close')}
           </button>
           {offerRetrust && (
-            <button onClick={() => onRetrust(version, newKey)} disabled={busy}
+            <button type="button" onClick={() => onRetrust(version, newKey)} disabled={busy}
               className="text-xs font-semibold px-4 py-2 rounded-lg bg-warning text-white hover:opacity-90 transition-opacity disabled:opacity-50">
               {t('admin.plugins.sig.retrustConfirm')}
             </button>
@@ -1646,8 +1824,8 @@ function UpdateConsentDialog({ data, unsigned, t, onApprove, onLater }: {
   t: T; onApprove: () => void; onLater: () => void
 }) {
   return (
-    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={onLater}>
-      <div className="bg-surface-card border border-edge rounded-2xl w-full max-w-md shadow-modal overflow-hidden" onClick={e => e.stopPropagation()}>
+    <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={onLater}>
+      <div role="presentation" className="bg-surface-card border border-edge rounded-2xl w-full max-w-md shadow-modal overflow-hidden" onClick={e => e.stopPropagation()}>
         <div className="px-5 py-4 border-b border-edge-secondary flex items-start gap-3">
           <div className="w-9 h-9 rounded-lg bg-warning-soft grid place-items-center shrink-0"><ShieldCheck size={18} className="text-warning" /></div>
           <div>
@@ -1685,8 +1863,8 @@ function UpdateConsentDialog({ data, unsigned, t, onApprove, onLater }: {
           )}
         </div>
         <div className="px-5 py-3.5 border-t border-edge-secondary bg-surface-secondary flex items-center justify-end gap-2">
-          <button onClick={onLater} className="text-xs font-medium px-3.5 py-2 rounded-lg border border-edge text-content-muted hover:text-content hover:bg-surface-tertiary transition-colors">{t('admin.plugins.updateLater')}</button>
-          <button onClick={onApprove} className="text-xs font-semibold px-4 py-2 rounded-lg bg-accent text-accent-text hover:bg-accent-hover transition-colors">{t('admin.plugins.updateApprove')}</button>
+          <button type="button" onClick={onLater} className="text-xs font-medium px-3.5 py-2 rounded-lg border border-edge text-content-muted hover:text-content hover:bg-surface-tertiary transition-colors">{t('admin.plugins.updateLater')}</button>
+          <button type="button" onClick={onApprove} className="text-xs font-semibold px-4 py-2 rounded-lg bg-accent text-accent-text hover:bg-accent-hover transition-colors">{t('admin.plugins.updateApprove')}</button>
         </div>
       </div>
     </div>
@@ -1706,8 +1884,8 @@ function DependencyResolveDialog({ data, t, busy, installedIds, onDownload, onCl
     ...data.versionMismatch.map(d => ({ id: d.id, constraint: d.wanted, installed: d.installed })),
   ]
   return (
-    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={onClose}>
-      <div className="bg-surface-card border border-edge rounded-2xl w-full max-w-md shadow-modal overflow-hidden" onClick={e => e.stopPropagation()}>
+    <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={onClose}>
+      <div role="presentation" className="bg-surface-card border border-edge rounded-2xl w-full max-w-md shadow-modal overflow-hidden" onClick={e => e.stopPropagation()}>
         <div className="px-5 py-4 border-b border-edge-secondary flex items-start gap-3">
           <div className="w-9 h-9 rounded-lg bg-warning-soft grid place-items-center shrink-0"><Puzzle size={18} className="text-warning" /></div>
           <div>
@@ -1726,7 +1904,7 @@ function DependencyResolveDialog({ data, t, busy, installedIds, onDownload, onCl
                     : t('admin.plugins.dep.requires', { version: r.constraint })}
                 </div>
               </div>
-              <button onClick={() => onDownload(r.id, r.constraint)} disabled={busy}
+              <button type="button" onClick={() => onDownload(r.id, r.constraint)} disabled={busy}
                 className="inline-flex items-center gap-1.5 text-[11.5px] font-semibold px-3 py-1.5 rounded-full bg-accent text-accent-text hover:bg-accent-hover transition-colors disabled:opacity-50 shrink-0">
                 <Download size={13} /> {r.installed ? t('admin.plugins.dep.update') : t('admin.plugins.dep.download')}
               </button>
@@ -1737,7 +1915,7 @@ function DependencyResolveDialog({ data, t, busy, installedIds, onDownload, onCl
           )}
         </div>
         <div className="px-5 py-3.5 border-t border-edge-secondary bg-surface-secondary flex items-center justify-end">
-          <button onClick={onClose} className="text-xs font-medium px-3.5 py-2 rounded-lg border border-edge text-content-muted hover:text-content hover:bg-surface-tertiary transition-colors">{t('common.cancel')}</button>
+          <button type="button" onClick={onClose} className="text-xs font-medium px-3.5 py-2 rounded-lg border border-edge text-content-muted hover:text-content hover:bg-surface-tertiary transition-colors">{t('common.cancel')}</button>
         </div>
       </div>
     </div>
@@ -1763,7 +1941,7 @@ function SecurityInfo({ t }: { t: T }) {
         <ShieldCheck size={14} className="text-content-faint shrink-0 mt-0.5" />
         <p className="text-xs text-content-muted">{t('admin.plugins.reviewedMeaning')}</p>
       </div>
-      <button onClick={() => setOpen(o => !o)}
+      <button type="button" onClick={() => setOpen(o => !o)}
         className="w-full px-4 sm:px-6 py-2.5 border-t border-edge-secondary flex items-center justify-between gap-2 text-xs font-medium text-content-secondary hover:text-content hover:bg-surface-tertiary transition-colors">
         <span className="flex items-center gap-2"><Lock size={13} className="shrink-0" /> <span className="text-left">{t('admin.plugins.security.title')}</span></span>
         <ChevronDown size={15} className={`shrink-0 transition-transform ${open ? 'rotate-180' : ''}`} />
diff --git a/client/src/components/Admin/BackupPanel.tsx b/client/src/components/Admin/BackupPanel.tsx
index e7d18f1a8..28ce06181 100644
--- a/client/src/components/Admin/BackupPanel.tsx
+++ b/client/src/components/Admin/BackupPanel.tsx
@@ -191,7 +191,7 @@ export default function BackupPanel() {
             </div>
           </div>
           <div className="flex items-center gap-2">
-            <button
+            <button type="button"
               onClick={loadBackups}
               disabled={isLoading}
               className="p-2 text-gray-500 hover:bg-gray-100 rounded-lg transition-colors"
@@ -208,7 +208,7 @@ export default function BackupPanel() {
               className="hidden"
               onChange={handleUploadRestore}
             />
-            <button
+            <button type="button"
               onClick={() => fileInputRef.current?.click()}
               disabled={isUploading}
               className="flex items-center gap-2 border border-gray-200 text-gray-700 px-3 py-2 rounded-lg hover:bg-gray-50 text-sm font-medium disabled:opacity-60"
@@ -222,7 +222,7 @@ export default function BackupPanel() {
               <span className="hidden sm:inline">{isUploading ? t('backup.uploading') : t('backup.upload')}</span>
             </button>
 
-            <button
+            <button type="button"
               onClick={handleCreate}
               disabled={isCreating}
               className="flex items-center gap-2 bg-slate-900 dark:bg-slate-100 text-white dark:text-slate-900 px-3 sm:px-4 py-2 rounded-lg hover:bg-slate-900 text-sm font-medium disabled:opacity-60"
@@ -247,7 +247,7 @@ export default function BackupPanel() {
           <div className="text-center py-12 text-gray-400">
             <HardDrive className="w-10 h-10 mb-3 mx-auto opacity-40" />
             <p className="text-sm">{t('backup.empty')}</p>
-            <button onClick={handleCreate} className="mt-4 text-slate-700 text-sm hover:underline">
+            <button type="button" onClick={handleCreate} className="mt-4 text-slate-700 text-sm hover:underline">
               {t('backup.createFirst')}
             </button>
           </div>
@@ -274,14 +274,14 @@ export default function BackupPanel() {
                   </div>
                 </div>
                 <div className="flex items-center gap-1.5 flex-shrink-0">
-                  <button
+                  <button type="button"
                     onClick={() => backupApi.download(backup.filename).catch(() => toast.error(t('backup.toast.downloadError')))}
                     className="flex items-center gap-1.5 px-3 py-1.5 text-xs text-slate-700 border border-slate-200 rounded-lg hover:bg-slate-50"
                   >
                     <Download className="w-3.5 h-3.5" />
                     {t('backup.download')}
                   </button>
-                  <button
+                  <button type="button"
                     onClick={() => handleRestore(backup.filename)}
                     disabled={restoringFile === backup.filename}
                     className="flex items-center gap-1.5 px-3 py-1.5 text-xs text-amber-700 border border-amber-200 rounded-lg hover:bg-amber-50 disabled:opacity-60"
@@ -292,7 +292,7 @@ export default function BackupPanel() {
                     }
                     {t('backup.restore')}
                   </button>
-                  <button
+                  <button type="button"
                     onClick={() => handleDelete(backup.filename)}
                     className="p-1.5 text-gray-400 hover:text-red-600 hover:bg-red-50 rounded-lg"
                   >
@@ -318,11 +318,11 @@ export default function BackupPanel() {
         <div className="flex flex-col gap-5">
           {/* Enable toggle */}
           <label className="flex items-center justify-between gap-4 cursor-pointer">
-            <div className="min-w-0">
-              <span className="text-sm font-medium text-gray-900">{t('backup.auto.enable')}</span>
-              <p className="text-xs text-gray-500 mt-0.5">{t('backup.auto.enableHint')}</p>
+            <div className="min-w-0 text-sm font-medium text-gray-900">
+              {t('backup.auto.enable')}
+              <p className="text-xs font-normal text-gray-500 mt-0.5">{t('backup.auto.enableHint')}</p>
             </div>
-            <button
+            <button type="button"
               onClick={() => handleAutoSettingsChange('enabled', !autoSettings.enabled)}
               className="relative shrink-0 inline-flex h-6 w-11 items-center rounded-full transition-colors"
               style={{ background: autoSettings.enabled ? 'var(--text-primary)' : 'var(--border-primary)' }}
@@ -339,7 +339,7 @@ export default function BackupPanel() {
                 <label className="block text-sm font-medium text-gray-700 mb-2">{t('backup.auto.interval')}</label>
                 <div className="flex flex-wrap gap-2">
                   {INTERVAL_OPTIONS.map(opt => (
-                    <button
+                    <button type="button"
                       key={opt.value}
                       onClick={() => handleAutoSettingsChange('interval', opt.value)}
                       className={`px-4 py-2 rounded-lg text-sm font-medium border transition-colors ${
@@ -360,7 +360,7 @@ export default function BackupPanel() {
                   <label className="block text-sm font-medium text-gray-700 mb-2">{t('backup.auto.hour')}</label>
                   <CustomSelect
                     value={String(autoSettings.hour)}
-                    onChange={v => handleAutoSettingsChange('hour', parseInt(String(v), 10))}
+                    onChange={v => handleAutoSettingsChange('hour', Number.parseInt(String(v), 10))}
                     size="sm"
                     options={HOURS.map(h => {
                       let label: string
@@ -386,7 +386,7 @@ export default function BackupPanel() {
                   <label className="block text-sm font-medium text-gray-700 mb-2">{t('backup.auto.dayOfWeek')}</label>
                   <div className="flex flex-wrap gap-2">
                     {DAYS_OF_WEEK.map(opt => (
-                      <button
+                      <button type="button"
                         key={opt.value}
                         onClick={() => handleAutoSettingsChange('day_of_week', opt.value)}
                         className={`px-3 py-2 rounded-lg text-sm font-medium border transition-colors ${
@@ -408,7 +408,7 @@ export default function BackupPanel() {
                   <label className="block text-sm font-medium text-gray-700 mb-2">{t('backup.auto.dayOfMonth')}</label>
                   <CustomSelect
                     value={String(autoSettings.day_of_month)}
-                    onChange={v => handleAutoSettingsChange('day_of_month', parseInt(String(v), 10))}
+                    onChange={v => handleAutoSettingsChange('day_of_month', Number.parseInt(String(v), 10))}
                     size="sm"
                     options={DAYS_OF_MONTH.map(d => ({ value: String(d), label: String(d) }))}
                   />
@@ -421,7 +421,7 @@ export default function BackupPanel() {
                 <label className="block text-sm font-medium text-gray-700 mb-2">{t('backup.auto.keepLabel')}</label>
                 <div className="flex flex-wrap gap-2">
                   {KEEP_OPTIONS.map(opt => (
-                    <button
+                    <button type="button"
                       key={opt.value}
                       onClick={() => handleAutoSettingsChange('keep_days', opt.value)}
                       className={`px-4 py-2 rounded-lg text-sm font-medium border transition-colors ${
@@ -440,7 +440,7 @@ export default function BackupPanel() {
 
           {/* Save button */}
           <div className="flex justify-end pt-2 border-t border-gray-100">
-            <button
+            <button type="button"
               onClick={handleSaveAutoSettings}
               disabled={autoSettingsSaving || !autoSettingsDirty}
               className="flex items-center gap-2 bg-slate-900 dark:bg-slate-100 text-white dark:text-slate-900 px-5 py-2 rounded-lg hover:bg-slate-900 text-sm font-medium disabled:opacity-50 transition-colors"
@@ -458,11 +458,15 @@ export default function BackupPanel() {
       {/* Restore Warning Modal */}
       {restoreConfirm && (
         <div
+          // Dismiss-on-backdrop is a mouse shortcut for the Cancel button below;
+          // the backdrop itself carries no semantics of its own.
+          role="presentation"
           className="bg-[rgba(0,0,0,0.5)]"
           style={{ position: 'fixed', inset: 0, zIndex: 9999, backdropFilter: 'blur(4px)', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
           onClick={() => setRestoreConfirm(null)}
         >
           <div
+            role="presentation"
             onClick={e => e.stopPropagation()}
             style={{ width: '100%', maxWidth: 440, borderRadius: 16, overflow: 'hidden' }}
             className="bg-white dark:bg-gray-800 border border-gray-200 dark:border-gray-700"
@@ -497,14 +501,14 @@ export default function BackupPanel() {
 
             {/* Footer */}
             <div style={{ padding: '0 24px 20px', display: 'flex', gap: 10, justifyContent: 'flex-end' }}>
-              <button
+              <button type="button"
                 onClick={() => setRestoreConfirm(null)}
                 className="text-gray-600 dark:text-gray-400 hover:bg-gray-100 dark:hover:bg-gray-700"
                 style={{ padding: '9px 20px', borderRadius: 10, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, border: 'none', cursor: 'pointer', fontFamily: 'inherit' }}
               >
                 {t('common.cancel')}
               </button>
-              <button
+              <button type="button"
                 onClick={executeRestore}
                 className="bg-[#dc2626] text-white"
                 style={{ padding: '9px 20px', borderRadius: 10, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, border: 'none', cursor: 'pointer', fontFamily: 'inherit' }}
diff --git a/client/src/components/Admin/CategoryManager.test.tsx b/client/src/components/Admin/CategoryManager.test.tsx
index d3e5173cb..945ea698d 100644
--- a/client/src/components/Admin/CategoryManager.test.tsx
+++ b/client/src/components/Admin/CategoryManager.test.tsx
@@ -27,17 +27,17 @@ describe('CategoryManager', () => {
 
   it('FE-COMP-CAT-002: shows Categories title', async () => {
     render(<CategoryManager />);
-    await screen.findByText('Categories');
+    expect(await screen.findByText('Categories')).toBeInTheDocument();
   });
 
   it('FE-COMP-CAT-003: shows empty state when no categories', async () => {
     render(<CategoryManager />);
-    await screen.findByText('No categories yet');
+    expect(await screen.findByText('No categories yet')).toBeInTheDocument();
   });
 
   it('FE-COMP-CAT-004: shows New Category button', async () => {
     render(<CategoryManager />);
-    await screen.findByText('New Category');
+    expect(await screen.findByText('New Category')).toBeInTheDocument();
   });
 
   it('FE-COMP-CAT-005: clicking New Category shows form', async () => {
@@ -129,7 +129,7 @@ describe('CategoryManager', () => {
 
   it('FE-COMP-CAT-010: shows subtitle text', async () => {
     render(<CategoryManager />);
-    await screen.findByText('Manage categories for places');
+    expect(await screen.findByText('Manage categories for places')).toBeInTheDocument();
   });
 
   it('FE-COMP-CAT-011: category count is shown', async () => {
diff --git a/client/src/components/Admin/CategoryManager.tsx b/client/src/components/Admin/CategoryManager.tsx
index 6c68f4bc0..b26af8629 100644
--- a/client/src/components/Admin/CategoryManager.tsx
+++ b/client/src/components/Admin/CategoryManager.tsx
@@ -194,7 +194,7 @@ export default function CategoryManager() {
           <h2 className="font-semibold text-content">{t('categories.title')}</h2>
           <p className="text-xs mt-1 text-content-muted">{t('categories.subtitle')}</p>
         </div>
-        <button onClick={handleStartCreate}
+        <button type="button" onClick={handleStartCreate}
           className="flex items-center gap-2 bg-slate-900 text-white px-3 sm:px-4 py-2 rounded-lg hover:bg-slate-700 text-sm font-medium">
           <Plus className="w-4 h-4" />
           <span className="hidden sm:inline">{t('categories.new')}</span>
@@ -235,11 +235,11 @@ export default function CategoryManager() {
                       </div>
                     </div>
                     <div className="flex items-center gap-1 opacity-0 group-hover:opacity-100 transition-opacity">
-                      <button onClick={() => handleStartEdit(cat)}
+                      <button type="button" onClick={() => handleStartEdit(cat)}
                         className="p-1.5 text-gray-400 hover:text-slate-700 hover:bg-slate-100 rounded-lg">
                         <Edit2 className="w-4 h-4" />
                       </button>
-                      <button onClick={() => handleDelete(cat.id)}
+                      <button type="button" onClick={() => handleDelete(cat.id)}
                         className="p-1.5 text-gray-400 hover:text-red-600 hover:bg-red-50 rounded-lg">
                         <Trash2 className="w-4 h-4" />
                       </button>
diff --git a/client/src/components/Admin/DefaultUserSettingsTab.tsx b/client/src/components/Admin/DefaultUserSettingsTab.tsx
index 365303efa..e73523c05 100644
--- a/client/src/components/Admin/DefaultUserSettingsTab.tsx
+++ b/client/src/components/Admin/DefaultUserSettingsTab.tsx
@@ -86,7 +86,7 @@ function OptionButton({
   children: React.ReactNode
 }) {
   return (
-    <button
+    <button type="button"
       onClick={onClick}
       style={{
         display: 'flex', alignItems: 'center', gap: 8,
@@ -154,7 +154,7 @@ export default function DefaultUserSettingsTab(): React.ReactElement {
 
   const ResetButton = ({ field }: { field: keyof Defaults }) =>
     isSet(field) ? (
-      <button
+      <button type="button"
         onClick={() => reset(field)}
         className="text-xs ml-2 text-content-faint underline"
         style={{ background: 'none', border: 'none', cursor: 'pointer' }}
@@ -185,7 +185,7 @@ export default function DefaultUserSettingsTab(): React.ReactElement {
     transport_mode: null,
     website: null,
     phone: null,
-    created_at: Date(),
+    created_at: String(new Date()),
   }], [])
 
   if (!loaded) {
diff --git a/client/src/components/Admin/DevNotificationsPanel.test.tsx b/client/src/components/Admin/DevNotificationsPanel.test.tsx
index 35932e52e..1e71becb5 100644
--- a/client/src/components/Admin/DevNotificationsPanel.test.tsx
+++ b/client/src/components/Admin/DevNotificationsPanel.test.tsx
@@ -87,7 +87,7 @@ describe('DevNotificationsPanel', () => {
     render(<><ToastContainer /><DevNotificationsPanel /></>);
     await screen.findByText('Type Testing');
     await user.click(screen.getByText('Simple → Me').closest('button')!);
-    await screen.findByText('Sent: simple-me');
+    expect(await screen.findByText('Sent: simple-me')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-DEVNOTIF-007: all buttons disabled while a send is in-flight', async () => {
@@ -101,8 +101,8 @@ describe('DevNotificationsPanel', () => {
     render(<><ToastContainer /><DevNotificationsPanel /></>);
     await screen.findByText('Type Testing');
 
-    // Fire the click but do not await — handler never resolves so sending stays true
-    void user.click(screen.getByText('Simple → Me').closest('button')!);
+    // The request handler never resolves, so sending stays true after the click settles
+    await user.click(screen.getByText('Simple → Me').closest('button')!);
 
     await waitFor(() => {
       const buttons = screen.getAllByRole('button');
@@ -120,7 +120,7 @@ describe('DevNotificationsPanel', () => {
     render(<><ToastContainer /><DevNotificationsPanel /></>);
     await screen.findByText('Type Testing');
     await user.click(screen.getByText('Simple → Me').closest('button')!);
-    await screen.findByText('No channel configured');
+    expect(await screen.findByText('No channel configured')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-DEVNOTIF-008b: a failure without an error field falls back to the generic text', async () => {
@@ -133,7 +133,7 @@ describe('DevNotificationsPanel', () => {
     render(<><ToastContainer /><DevNotificationsPanel /></>);
     await screen.findByText('Type Testing');
     await user.click(screen.getByText('Simple → Me').closest('button')!);
-    await screen.findByText('Failed');
+    expect(await screen.findByText('Failed')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-DEVNOTIF-009: changing trip selector updates payload targetId', async () => {
diff --git a/client/src/components/Admin/DevNotificationsPanel.tsx b/client/src/components/Admin/DevNotificationsPanel.tsx
index 7237b23ae..baf8d0396 100644
--- a/client/src/components/Admin/DevNotificationsPanel.tsx
+++ b/client/src/components/Admin/DevNotificationsPanel.tsx
@@ -66,7 +66,7 @@ export default function DevNotificationsPanel(): React.ReactElement {
   }: {
     id: string; label: string; sub: string; icon: React.ElementType; color: string; onClick: () => void
   }) => (
-    <button
+    <button type="button"
       onClick={onClick}
       disabled={sending !== null}
       className="flex items-center gap-3 px-4 py-3 rounded-lg border transition-colors text-left w-full border-edge bg-surface-card"
diff --git a/client/src/components/Admin/GitHubPanel.test.tsx b/client/src/components/Admin/GitHubPanel.test.tsx
index 57b6d1315..b369d200f 100644
--- a/client/src/components/Admin/GitHubPanel.test.tsx
+++ b/client/src/components/Admin/GitHubPanel.test.tsx
@@ -231,7 +231,7 @@ describe('GitHubPanel', () => {
     render(<GitHubPanel />);
     await screen.findByText('v1.7.0');
     await user.click(screen.getByText('Show details'));
-    await screen.findByText('This is a plain paragraph without any markdown syntax.');
+    expect(await screen.findByText('This is a plain paragraph without any markdown syntax.')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-GH-014: markdown link with safe href renders as anchor', async () => {
diff --git a/client/src/components/Admin/GitHubPanel.tsx b/client/src/components/Admin/GitHubPanel.tsx
index 26774989e..fb54eb708 100644
--- a/client/src/components/Admin/GitHubPanel.tsx
+++ b/client/src/components/Admin/GitHubPanel.tsx
@@ -461,7 +461,7 @@ export default function GitHubPanel({ isPrerelease = false }: { isPrerelease?: b
                         {/* Expandable body */}
                         {release.body && (
                           <div className="mt-2">
-                            <button
+                            <button type="button"
                               onClick={() => toggleExpand(release.id)}
                               className="flex items-center gap-1 text-[11px] font-medium text-content-muted transition-colors"
                             >
@@ -484,7 +484,7 @@ export default function GitHubPanel({ isPrerelease = false }: { isPrerelease?: b
             {/* Load more */}
             {hasMore && (
               <div className="pt-2 text-center">
-                <button
+                <button type="button"
                   onClick={handleLoadMore}
                   disabled={loadingMore}
                   className="inline-flex items-center gap-2 rounded-lg bg-surface-secondary px-4 py-2 text-xs font-medium text-content-muted transition-colors"
diff --git a/client/src/components/Admin/PackingTemplateManager.test.tsx b/client/src/components/Admin/PackingTemplateManager.test.tsx
index 8abb51cde..a315d6d74 100644
--- a/client/src/components/Admin/PackingTemplateManager.test.tsx
+++ b/client/src/components/Admin/PackingTemplateManager.test.tsx
@@ -18,7 +18,7 @@ beforeEach(() => {
   resetAllStores();
 });
 
-/** Template rows carry [chevron, edit, delete]; category headers [add item, edit, delete]. */
+/** Template rows carry [chevron, name, edit, delete]; category headers [add item, edit, delete]. */
 function rowButtons(name: string, selector: string): HTMLElement[] {
   const row = screen.getByText(name).closest(selector) as HTMLElement;
   return within(row).getAllByRole('button');
@@ -250,7 +250,7 @@ describe('PackingTemplateManager', () => {
     await user.click(screen.getByText('Add category'));
     const catInput = screen.getByPlaceholderText('Category name (e.g. Clothing)');
     await user.type(catInput, 'Electronics{Enter}');
-    await screen.findByText('Electronics');
+    expect(await screen.findByText('Electronics')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-PKG-012: adding an item to a category', async () => {
@@ -280,7 +280,7 @@ describe('PackingTemplateManager', () => {
     await user.type(itemInput, 'Sandals');
     // Submit via Enter key (the input's onKeyDown handler triggers handleAddItem)
     await user.type(itemInput, '{Enter}');
-    await screen.findByText('Sandals');
+    expect(await screen.findByText('Sandals')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-PKG-013: renaming a category inline updates its name', async () => {
@@ -312,7 +312,7 @@ describe('PackingTemplateManager', () => {
     const catInput = screen.getByDisplayValue('Clothing');
     await user.clear(catInput);
     await user.type(catInput, 'Shoes{Enter}');
-    await screen.findByText('Shoes');
+    expect(await screen.findByText('Shoes')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-PKG-014: deleting a category removes it and its items', async () => {
@@ -379,7 +379,7 @@ describe('PackingTemplateManager', () => {
     const input = screen.getByDisplayValue('T-shirt');
     await user.clear(input);
     await user.type(input, 'Tank Top{Enter}');
-    await screen.findByText('Tank Top');
+    expect(await screen.findByText('Tank Top')).toBeInTheDocument();
   });
 
   it('FE-ADMIN-PKG-016: deleting an item removes it from the list', async () => {
@@ -588,11 +588,11 @@ describe('PackingTemplateManager', () => {
     render(<><ToastContainer /><PackingTemplateManager /></>);
     await expandBeachTrip(user, 'Clothing');
 
-    await user.click(templateButtons('Beach Trip')[2]);
+    await user.click(templateButtons('Beach Trip')[3]);
     expect(await screen.findByText('Failed to delete template')).toBeInTheDocument();
     expect(screen.getByText('Clothing')).toBeInTheDocument();
 
-    await user.click(templateButtons('Beach Trip')[2]);
+    await user.click(templateButtons('Beach Trip')[3]);
     await screen.findByText('Template deleted');
     await waitFor(() => expect(screen.queryByText('Clothing')).not.toBeInTheDocument());
     expect(screen.getByText('No templates created yet')).toBeInTheDocument();
@@ -611,14 +611,14 @@ describe('PackingTemplateManager', () => {
     render(<><ToastContainer /><PackingTemplateManager /></>);
     await screen.findByText('Beach Trip');
 
-    await user.click(templateButtons('Beach Trip')[1]);
+    await user.click(templateButtons('Beach Trip')[2]);
     await user.clear(screen.getByDisplayValue('Beach Trip'));
     await user.type(screen.getByRole('textbox'), '{Enter}');
     await waitFor(() => expect(screen.getByText('Beach Trip')).toBeInTheDocument());
     expect(puts).toBe(0);
 
     // Blurring the field commits the pending name — here the request fails
-    await user.click(templateButtons('Beach Trip')[1]);
+    await user.click(templateButtons('Beach Trip')[2]);
     const input = screen.getByDisplayValue('Beach Trip');
     await user.clear(input);
     await user.type(input, 'Winter');
diff --git a/client/src/components/Admin/PackingTemplateManager.tsx b/client/src/components/Admin/PackingTemplateManager.tsx
index 9773b1999..546757b32 100644
--- a/client/src/components/Admin/PackingTemplateManager.tsx
+++ b/client/src/components/Admin/PackingTemplateManager.tsx
@@ -158,7 +158,7 @@ export default function PackingTemplateManager() {
           <h2 className="font-semibold text-slate-900">{t('admin.packingTemplates.title')}</h2>
           <p className="text-xs text-slate-400 mt-1">{t('admin.packingTemplates.subtitle')}</p>
         </div>
-        <button onClick={() => setShowCreate(true)}
+        <button type="button" onClick={() => setShowCreate(true)}
           className="flex items-center gap-1.5 px-3 py-1.5 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700 transition-colors">
           <Plus className="w-4 h-4" /> <span className="hidden sm:inline">{t('admin.packingTemplates.create')}</span>
         </button>
@@ -171,8 +171,8 @@ export default function PackingTemplateManager() {
           <input autoFocus value={createName} onChange={e => setCreateName(e.target.value)}
             onKeyDown={e => { if (e.key === 'Enter') handleCreateTemplate(); if (e.key === 'Escape') setShowCreate(false) }}
             placeholder={t('admin.packingTemplates.namePlaceholder')} className={inputStyle} />
-          <button onClick={handleCreateTemplate} className={`${btnIcon} text-slate-600 hover:text-slate-900`}><Check size={16} /></button>
-          <button onClick={() => setShowCreate(false)} className={`${btnIcon} text-slate-400 hover:text-slate-600`}><X size={16} /></button>
+          <button type="button" onClick={handleCreateTemplate} className={`${btnIcon} text-slate-600 hover:text-slate-900`}><Check size={16} /></button>
+          <button type="button" onClick={() => setShowCreate(false)} className={`${btnIcon} text-slate-400 hover:text-slate-600`}><X size={16} /></button>
         </div>
       )}
 
@@ -187,7 +187,7 @@ export default function PackingTemplateManager() {
             <div key={tmpl.id}>
               {/* Template row */}
               <div className="px-5 py-3 flex items-center gap-3 hover:bg-slate-50 transition-colors">
-                <button onClick={() => toggleExpand(tmpl.id)} className="text-slate-400 flex-shrink-0 p-0 bg-transparent border-none cursor-pointer">
+                <button type="button" onClick={() => toggleExpand(tmpl.id)} className="text-slate-400 flex-shrink-0 p-0 bg-transparent border-none cursor-pointer">
                   {expandedId === tmpl.id ? <ChevronDown size={15} /> : <ChevronRight size={15} />}
                 </button>
                 <Package size={16} className="text-slate-400 flex-shrink-0" />
@@ -197,14 +197,14 @@ export default function PackingTemplateManager() {
                     onKeyDown={e => { if (e.key === 'Enter') handleRenameTemplate(tmpl.id); if (e.key === 'Escape') setEditingTemplate(null) }}
                     className="flex-1 px-2 py-0.5 border border-slate-300 rounded text-sm" />
                 ) : (
-                  <span onClick={() => toggleExpand(tmpl.id)} className="flex-1 text-sm font-medium text-slate-700 cursor-pointer">{tmpl.name}</span>
+                  <button type="button" onClick={() => toggleExpand(tmpl.id)} className="flex-1 text-left bg-transparent border-0 p-0 text-sm font-medium text-slate-700 cursor-pointer">{tmpl.name}</button>
                 )}
                 <span className="text-xs text-slate-400 px-2 py-0.5 bg-slate-100 rounded-full">
                   {tmpl.category_count} {t('admin.packingTemplates.categories')} · {tmpl.item_count} {t('admin.packingTemplates.items')}
                 </span>
-                <button onClick={() => { setEditingTemplate(tmpl.id); setEditTemplateName(tmpl.name) }}
+                <button type="button" onClick={() => { setEditingTemplate(tmpl.id); setEditTemplateName(tmpl.name) }}
                   className={`${btnIcon} hover:bg-slate-100 text-slate-400 hover:text-slate-700`}><Edit2 size={14} /></button>
-                <button onClick={() => handleDeleteTemplate(tmpl.id)}
+                <button type="button" onClick={() => handleDeleteTemplate(tmpl.id)}
                   className={`${btnIcon} hover:bg-red-50 text-slate-400 hover:text-red-500`}><Trash2 size={14} /></button>
               </div>
 
@@ -228,11 +228,11 @@ export default function PackingTemplateManager() {
                             <span className="flex-1 text-xs font-bold text-slate-500 uppercase tracking-wider">{cat.name}</span>
                           )}
                           <span className="text-xs text-slate-400">{catItems.length}</span>
-                          <button onClick={() => { setAddingItemToCatId(addingItemToCatId === cat.id ? null : cat.id); setNewItemName(''); setTimeout(() => addItemRef.current?.focus(), 30) }}
+                          <button type="button" onClick={() => { setAddingItemToCatId(addingItemToCatId === cat.id ? null : cat.id); setNewItemName(''); setTimeout(() => addItemRef.current?.focus(), 30) }}
                             className={`${btnIcon} text-slate-400 hover:text-slate-700`}><Plus size={13} /></button>
-                          <button onClick={() => { setEditingCatId(cat.id); setEditCatName(cat.name) }}
+                          <button type="button" onClick={() => { setEditingCatId(cat.id); setEditCatName(cat.name) }}
                             className={`${btnIcon} text-slate-400 hover:text-slate-700`}><Edit2 size={13} /></button>
-                          <button onClick={() => handleDeleteCategory(cat.id)}
+                          <button type="button" onClick={() => handleDeleteCategory(cat.id)}
                             className={`${btnIcon} text-slate-400 hover:text-red-500`}><Trash2 size={13} /></button>
                         </div>
 
@@ -246,15 +246,15 @@ export default function PackingTemplateManager() {
                                     <input autoFocus value={editItemName} onChange={e => setEditItemName(e.target.value)}
                                       onKeyDown={e => { if (e.key === 'Enter') handleRenameItem(item.id); if (e.key === 'Escape') setEditingItemId(null) }}
                                       className="flex-1 px-2 py-1 border border-slate-200 rounded-lg text-sm" />
-                                    <button onClick={() => handleRenameItem(item.id)} className="p-1 text-slate-600 hover:text-slate-900"><Check size={13} /></button>
-                                    <button onClick={() => setEditingItemId(null)} className="p-1 text-slate-400"><X size={13} /></button>
+                                    <button type="button" onClick={() => handleRenameItem(item.id)} className="p-1 text-slate-600 hover:text-slate-900"><Check size={13} /></button>
+                                    <button type="button" onClick={() => setEditingItemId(null)} className="p-1 text-slate-400"><X size={13} /></button>
                                   </>
                                 ) : (
                                   <>
                                     <span className="flex-1 text-sm text-slate-700">{item.name}</span>
-                                    <button onClick={() => { setEditingItemId(item.id); setEditItemName(item.name) }}
+                                    <button type="button" onClick={() => { setEditingItemId(item.id); setEditItemName(item.name) }}
                                       className="p-1 rounded opacity-0 group-hover:opacity-100 text-slate-400 hover:text-slate-700 transition-all"><Edit2 size={12} /></button>
-                                    <button onClick={() => handleDeleteItem(item.id)}
+                                    <button type="button" onClick={() => handleDeleteItem(item.id)}
                                       className="p-1 rounded opacity-0 group-hover:opacity-100 text-slate-400 hover:text-red-500 transition-all"><Trash2 size={12} /></button>
                                   </>
                                 )}
@@ -268,9 +268,9 @@ export default function PackingTemplateManager() {
                                   onKeyDown={e => { if (e.key === 'Enter' && newItemName.trim()) handleAddItem(cat.id); if (e.key === 'Escape') { setAddingItemToCatId(null); setNewItemName('') } }}
                                   placeholder={t('admin.packingTemplates.itemName')}
                                   className="flex-1 px-2 py-1 border border-slate-200 rounded-lg text-sm" />
-                                <button onClick={() => handleAddItem(cat.id)} disabled={!newItemName.trim()}
+                                <button type="button" onClick={() => handleAddItem(cat.id)} disabled={!newItemName.trim()}
                                   className="p-1.5 rounded-lg bg-slate-900 text-white disabled:bg-slate-300 hover:bg-slate-700 transition-colors"><Plus size={13} /></button>
-                                <button onClick={() => { setAddingItemToCatId(null); setNewItemName('') }}
+                                <button type="button" onClick={() => { setAddingItemToCatId(null); setNewItemName('') }}
                                   className="p-1 text-slate-400 hover:text-slate-600"><X size={13} /></button>
                               </div>
                             )}
@@ -287,11 +287,11 @@ export default function PackingTemplateManager() {
                         onKeyDown={e => { if (e.key === 'Enter') handleAddCategory(); if (e.key === 'Escape') { setAddingCategory(false); setNewCatName('') } }}
                         placeholder={t('admin.packingTemplates.categoryName')}
                         className="flex-1 px-3 py-2 border border-slate-200 rounded-lg text-sm" />
-                      <button onClick={handleAddCategory} className={`${btnIcon} text-slate-600 hover:text-slate-900`}><Check size={15} /></button>
-                      <button onClick={() => { setAddingCategory(false); setNewCatName('') }} className={`${btnIcon} text-slate-400`}><X size={15} /></button>
+                      <button type="button" onClick={handleAddCategory} className={`${btnIcon} text-slate-600 hover:text-slate-900`}><Check size={15} /></button>
+                      <button type="button" onClick={() => { setAddingCategory(false); setNewCatName('') }} className={`${btnIcon} text-slate-400`}><X size={15} /></button>
                     </div>
                   ) : (
-                    <button onClick={() => setAddingCategory(true)}
+                    <button type="button" onClick={() => setAddingCategory(true)}
                       className="flex items-center gap-2 px-3 py-2.5 w-full text-sm text-slate-400 hover:text-slate-600 border border-dashed border-slate-200 rounded-lg hover:border-slate-400 transition-colors">
                       <FolderPlus size={14} /> {t('admin.packingTemplates.addCategory')}
                     </button>
diff --git a/client/src/components/Admin/PermissionsPanel.test.tsx b/client/src/components/Admin/PermissionsPanel.test.tsx
index fb7323ecf..d53ab7464 100644
--- a/client/src/components/Admin/PermissionsPanel.test.tsx
+++ b/client/src/components/Admin/PermissionsPanel.test.tsx
@@ -269,6 +269,6 @@ describe('PermissionsPanel', () => {
       ),
     );
     renderPanel();
-    await screen.findByText('Error');
+    expect(await screen.findByText('Error')).toBeInTheDocument();
   });
 });
diff --git a/client/src/components/Admin/PermissionsPanel.tsx b/client/src/components/Admin/PermissionsPanel.tsx
index acab4f0c6..6b2b149b7 100644
--- a/client/src/components/Admin/PermissionsPanel.tsx
+++ b/client/src/components/Admin/PermissionsPanel.tsx
@@ -104,7 +104,7 @@ export default function PermissionsPanel(): React.ReactElement {
             <p className="text-xs text-slate-400 mt-0.5">{t('perm.subtitle')}</p>
           </div>
           <div className="flex items-center gap-2">
-            <button
+            <button type="button"
               onClick={handleReset}
               disabled={saving}
               title={t('perm.resetDefaults')}
@@ -114,7 +114,7 @@ export default function PermissionsPanel(): React.ReactElement {
               <RotateCcw className="w-3.5 h-3.5" />
               <span className="hidden sm:inline">{t('perm.resetDefaults')}</span>
             </button>
-            <button
+            <button type="button"
               onClick={handleSave}
               disabled={saving || !dirty}
               className="flex items-center gap-1.5 px-3 py-1.5 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700 disabled:bg-slate-400 transition-colors"
diff --git a/client/src/components/Admin/storage/AdminStoragePanel.tsx b/client/src/components/Admin/storage/AdminStoragePanel.tsx
index d22abab2d..954ef6a2c 100644
--- a/client/src/components/Admin/storage/AdminStoragePanel.tsx
+++ b/client/src/components/Admin/storage/AdminStoragePanel.tsx
@@ -338,7 +338,7 @@ export default function AdminStoragePanel(): React.ReactElement {
             ? t('storage.usage.computed', { age: relativeTime(state.usage.computedAt, locale) })
             : t('storage.usage.never')}
           {' '}
-          <button className="text-xs underline text-content-secondary" style={LINK_BUTTON_STYLE} onClick={handleRefreshStats}>
+          <button type="button" className="text-xs underline text-content-secondary" style={LINK_BUTTON_STYLE} onClick={handleRefreshStats}>
             {state.usage ? t('storage.usage.refresh') : t('storage.usage.compute')}
           </button>
         </p>
@@ -364,7 +364,7 @@ export default function AdminStoragePanel(): React.ReactElement {
                     {t(`storage.source.${row.source}`)}
                   </span>
                   <span className="flex-1" />
-                  <button
+                  <button type="button"
                     className="text-xs underline text-content-secondary"
                     style={LINK_BUTTON_STYLE}
                     onClick={() =>
@@ -376,12 +376,12 @@ export default function AdminStoragePanel(): React.ReactElement {
                     {t('storage.actions.test')}
                   </button>
                   {row.source !== 'env' && (
-                    <button className="text-xs underline text-content-secondary" style={LINK_BUTTON_STYLE} onClick={() => startEdit(row)}>
+                    <button type="button" className="text-xs underline text-content-secondary" style={LINK_BUTTON_STYLE} onClick={() => startEdit(row)}>
                       {t('storage.actions.edit')}
                     </button>
                   )}
                   {row.source === 'settings' && (
-                    <button className="text-xs underline text-content-secondary" style={LINK_BUTTON_STYLE} onClick={() => setConfirmRemove({ name: row.name, degenerate: false })}>
+                    <button type="button" className="text-xs underline text-content-secondary" style={LINK_BUTTON_STYLE} onClick={() => setConfirmRemove({ name: row.name, degenerate: false })}>
                       {t('storage.actions.remove')}
                     </button>
                   )}
@@ -433,7 +433,7 @@ export default function AdminStoragePanel(): React.ReactElement {
                             failed: String(backfill.failed),
                           })}
                         </p>
-                        <button
+                        <button type="button"
                           className="text-xs underline text-content-secondary mt-1"
                           style={LINK_BUTTON_STYLE}
                           onClick={() => handleCancelBackfill(row)}
@@ -464,7 +464,7 @@ export default function AdminStoragePanel(): React.ReactElement {
                           </p>
                         )}
                         {syncPrompt !== row.name && (
-                          <button
+                          <button type="button"
                             className="text-xs underline text-content-secondary"
                             style={LINK_BUTTON_STYLE}
                             onClick={() => handleStartBackfill(row)}
@@ -480,14 +480,14 @@ export default function AdminStoragePanel(): React.ReactElement {
                   <div className="mt-2 rounded-lg border p-2 border-edge-secondary">
                     <p className="text-xs text-content">{t('storage.sync.prompt')}</p>
                     <div className="flex items-center gap-3 mt-1">
-                      <button
+                      <button type="button"
                         className="text-xs underline text-content-secondary"
                         style={LINK_BUTTON_STYLE}
                         onClick={() => handleStartBackfill(row)}
                       >
                         {t('storage.sync.now')}
                       </button>
-                      <button
+                      <button type="button"
                         className="text-xs underline text-content-secondary"
                         style={LINK_BUTTON_STYLE}
                         onClick={() => setSyncPrompt(null)}
@@ -512,10 +512,10 @@ export default function AdminStoragePanel(): React.ReactElement {
                     {t('storage.type.mirror')}
                   </span>
                   <span className="flex-1" />
-                  <button className="text-xs underline text-content-secondary" style={LINK_BUTTON_STYLE} onClick={() => admin.test(backend)}>
+                  <button type="button" className="text-xs underline text-content-secondary" style={LINK_BUTTON_STYLE} onClick={() => admin.test(backend)}>
                     {t('storage.actions.test')}
                   </button>
-                  <button className="text-xs underline text-content-secondary" style={LINK_BUTTON_STYLE} onClick={() => setConfirmRemove({ name: backend.name, degenerate: true })}>
+                  <button type="button" className="text-xs underline text-content-secondary" style={LINK_BUTTON_STYLE} onClick={() => setConfirmRemove({ name: backend.name, degenerate: true })}>
                     {t('storage.actions.remove')}
                   </button>
                 </div>
@@ -552,7 +552,7 @@ export default function AdminStoragePanel(): React.ReactElement {
                         total: String(m.total),
                       })}
                     </p>
-                    <button
+                    <button type="button"
                       className="text-xs underline text-content-secondary mt-1"
                       style={LINK_BUTTON_STYLE}
                       onClick={() => void handleCancelMigration(m)}
@@ -601,7 +601,7 @@ export default function AdminStoragePanel(): React.ReactElement {
             onCancel={() => setEditing(null)}
           />
         ) : (
-          <button
+          <button type="button"
             onClick={() =>
               setEditing({
                 initial: null,
@@ -675,7 +675,7 @@ export default function AdminStoragePanel(): React.ReactElement {
       </Section>
 
       <div className="flex items-center gap-3">
-        <button
+        <button type="button"
           onClick={save}
           disabled={!admin.dirty || admin.saving}
           style={{
@@ -715,21 +715,21 @@ export default function AdminStoragePanel(): React.ReactElement {
             </p>
           ))}
           <div className="flex items-center gap-3 mt-2">
-            <button
+            <button type="button"
               className="text-xs underline text-content-secondary"
               style={LINK_BUTTON_STYLE}
               onClick={() => void moveAndSave()}
             >
               {t('storage.migrate.move')}
             </button>
-            <button
+            <button type="button"
               className="text-xs underline text-content-secondary"
               style={LINK_BUTTON_STYLE}
               onClick={() => void routeOnlySave()}
             >
               {t('storage.migrate.routeOnly')}
             </button>
-            <button
+            <button type="button"
               className="text-xs underline text-content-secondary"
               style={LINK_BUTTON_STYLE}
               onClick={() => setMigratePromptOpen(false)}
@@ -746,7 +746,7 @@ export default function AdminStoragePanel(): React.ReactElement {
               past; "save again" can never clear it, so the banner offers the
               one action that can — see useStorageAdmin.discardDraft. */}
           {admin.saveConflict && (
-            <button
+            <button type="button"
               className="text-xs underline text-content-secondary mt-1"
               style={LINK_BUTTON_STYLE}
               onClick={() => void admin.discardDraft()}
diff --git a/client/src/components/Admin/storage/BackendForm.tsx b/client/src/components/Admin/storage/BackendForm.tsx
index c2293798c..1731a1623 100644
--- a/client/src/components/Admin/storage/BackendForm.tsx
+++ b/client/src/components/Admin/storage/BackendForm.tsx
@@ -236,7 +236,7 @@ export default function BackendForm({
       )}
 
       <div className="flex items-center gap-3">
-        <button
+        <button type="button"
           onClick={apply}
           disabled={!canApply}
           style={{
@@ -248,7 +248,7 @@ export default function BackendForm({
         >
           {t('storage.form.apply')}
         </button>
-        <button
+        <button type="button"
           onClick={onCancel}
           style={{
             padding: '8px 20px', borderRadius: 10, cursor: 'pointer', fontFamily: 'inherit',
diff --git a/client/src/components/BackgroundTasks/BackgroundTasksWidget.tsx b/client/src/components/BackgroundTasks/BackgroundTasksWidget.tsx
index 19c34b2a1..55ec57249 100644
--- a/client/src/components/BackgroundTasks/BackgroundTasksWidget.tsx
+++ b/client/src/components/BackgroundTasks/BackgroundTasksWidget.tsx
@@ -163,7 +163,7 @@ export default function BackgroundTasksWidget() {
                 <div style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', marginTop: 1 }}>{t('reservations.import.parsing')}</div>
               ) : task.items.length > 0 ? (
                 <div>
-                  <button
+                  <button type="button"
                     onClick={() => review(task)}
                     className="bg-accent text-accent-text"
                     style={{ marginTop: 4, border: 'none', borderRadius: 8, padding: '4px 12px', fontSize: 'calc(11.5px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}
@@ -192,7 +192,7 @@ export default function BackgroundTasksWidget() {
                     )}
                   </div>
                   {aiParsing && task.mode !== 'force-ai' && task.sourceFiles && task.sourceFiles.length > 0 && (
-                    <button
+                    <button type="button"
                       onClick={() => retryWithAi(task)}
                       disabled={retrying === task.id}
                       className="bg-surface-tertiary text-content"
@@ -211,7 +211,7 @@ export default function BackgroundTasksWidget() {
           </div>
 
           {task.status !== 'running' && (
-            <button
+            <button type="button"
               onClick={() => dismiss(task.id)}
               className="bg-transparent text-content-faint"
               style={{ flexShrink: 0, border: 'none', cursor: 'pointer', padding: 2, borderRadius: 6, display: 'flex', alignItems: 'center' }}
diff --git a/client/src/components/Budget/BudgetPanel.helpers.ts b/client/src/components/Budget/BudgetPanel.helpers.ts
index 987b4a18d..bdb2f00ae 100644
--- a/client/src/components/Budget/BudgetPanel.helpers.ts
+++ b/client/src/components/Budget/BudgetPanel.helpers.ts
@@ -48,12 +48,12 @@ export function hexLighten(hex: string, amount: number): string {
   const m = hex.replace('#', '').match(/.{2}/g)
   if (!m || m.length !== 3) return hex
   const mix = (c: number) => Math.min(255, Math.round(c + (255 - c) * amount))
-  const [r, g, b] = m.map(x => parseInt(x, 16))
+  const [r, g, b] = m.map(x => Number.parseInt(x, 16))
   return `#${[mix(r), mix(g), mix(b)].map(v => v.toString(16).padStart(2, '0')).join('')}`
 }
 
 export const fmtNum = (v: number | null | undefined, locale: string, cur: string) => {
-  if (v == null || isNaN(v)) return '-'
+  if (v == null || Number.isNaN(v)) return '-'
   const d = currencyDecimals(cur)
   return Number(v).toLocaleString(locale, { minimumFractionDigits: d, maximumFractionDigits: d }) + ' ' + (SYMBOLS[cur] || cur)
 }
@@ -75,7 +75,8 @@ export function splitColorFor(userId: number, order: number) {
 }
 
 export function colorForUserId(userId: number) {
-  return SPLIT_COLORS[((userId | 0) - 1 + SPLIT_COLORS.length * 1000) % SPLIT_COLORS.length]
+  const id = Number.isFinite(userId) ? Math.trunc(userId) : 0
+  return SPLIT_COLORS[(id - 1 + SPLIT_COLORS.length * 1000) % SPLIT_COLORS.length]
 }
 
 /**
diff --git a/client/src/components/Budget/BudgetPanel.test.tsx b/client/src/components/Budget/BudgetPanel.test.tsx
index fa8e496d9..dfe36963e 100644
--- a/client/src/components/Budget/BudgetPanel.test.tsx
+++ b/client/src/components/Budget/BudgetPanel.test.tsx
@@ -32,7 +32,7 @@ describe('BudgetPanel', () => {
       http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [] }))
     );
     render(<BudgetPanel tripId={1} />);
-    await screen.findByText('No budget created yet');
+    expect(await screen.findByText('No budget created yet')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-002: shows empty state text body', async () => {
@@ -40,7 +40,7 @@ describe('BudgetPanel', () => {
       http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [] }))
     );
     render(<BudgetPanel tripId={1} />);
-    await screen.findByText(/Create categories and entries/i);
+    expect(await screen.findByText(/Create categories and entries/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-003: shows category input in empty state when user can edit', async () => {
@@ -48,7 +48,7 @@ describe('BudgetPanel', () => {
       http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [] }))
     );
     render(<BudgetPanel tripId={1} />);
-    await screen.findByPlaceholderText('Enter category name...');
+    expect(await screen.findByPlaceholderText('Enter category name...')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-004: renders budget items from store after load', async () => {
@@ -57,7 +57,7 @@ describe('BudgetPanel', () => {
       http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [item] }))
     );
     render(<BudgetPanel tripId={1} />);
-    await screen.findByText('Hotel Paris');
+    expect(await screen.findByText('Hotel Paris')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-005: renders category section header', async () => {
@@ -87,7 +87,7 @@ describe('BudgetPanel', () => {
       http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [item] }))
     );
     render(<BudgetPanel tripId={1} />);
-    await screen.findByText('Budget');
+    expect(await screen.findByText('Budget')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-008: shows CSV export button', async () => {
@@ -96,7 +96,7 @@ describe('BudgetPanel', () => {
       http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [item] }))
     );
     render(<BudgetPanel tripId={1} />);
-    await screen.findByText('CSV');
+    expect(await screen.findByText('CSV')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-009: add item row visible in table', async () => {
@@ -105,7 +105,7 @@ describe('BudgetPanel', () => {
       http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [item] }))
     );
     render(<BudgetPanel tripId={1} />);
-    await screen.findByPlaceholderText('New Entry');
+    expect(await screen.findByPlaceholderText('New Entry')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-010: adding new item via form calls POST and shows item', async () => {
@@ -124,7 +124,7 @@ describe('BudgetPanel', () => {
     await user.type(nameInput, 'Restaurant Dinner');
     const addBtn = screen.getByTitle('Add Reservation');
     await user.click(addBtn);
-    await screen.findByText('Restaurant Dinner');
+    expect(await screen.findByText('Restaurant Dinner')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-011: delete button present for items when user can edit', async () => {
@@ -161,7 +161,7 @@ describe('BudgetPanel', () => {
     );
     render(<BudgetPanel tripId={1} />);
     await screen.findByText('Hotel A');
-    await screen.findByText('Hotel B');
+    expect(await screen.findByText('Hotel B')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-014: items from different categories render separate sections', async () => {
@@ -183,7 +183,7 @@ describe('BudgetPanel', () => {
     );
     render(<BudgetPanel tripId={1} />);
     // Component renders even in empty state
-    await screen.findByText('No budget created yet');
+    expect(await screen.findByText('No budget created yet')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-016: trip currency EUR is shown in header for item rows', async () => {
@@ -193,7 +193,7 @@ describe('BudgetPanel', () => {
       http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [item] }))
     );
     render(<BudgetPanel tripId={1} />);
-    await screen.findByText('Misc');
+    expect(await screen.findByText('Misc')).toBeInTheDocument();
     // Row exists - EUR formatting would appear in values
   });
 
@@ -233,7 +233,7 @@ describe('BudgetPanel', () => {
     render(<BudgetPanel tripId={1} />);
     const nameInput = await screen.findByPlaceholderText('New Entry');
     await user.type(nameInput, 'Pizza{Enter}');
-    await screen.findByText('Pizza');
+    expect(await screen.findByText('Pizza')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-020: component renders without crashing with empty tripMembers', async () => {
@@ -241,7 +241,7 @@ describe('BudgetPanel', () => {
       http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [] }))
     );
     render(<BudgetPanel tripId={1} tripMembers={[]} />);
-    await screen.findByText('No budget created yet');
+    expect(await screen.findByText('No budget created yet')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-021: inline edit name cell — clicking a name cell makes it editable', async () => {
@@ -342,7 +342,7 @@ describe('BudgetPanel', () => {
       http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [] }))
     );
     render(<BudgetPanel tripId={1} />);
-    await screen.findByPlaceholderText('Enter category name...');
+    expect(await screen.findByPlaceholderText('Enter category name...')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-028: creating a new category via input calls POST and adds a section', async () => {
@@ -356,7 +356,7 @@ describe('BudgetPanel', () => {
     render(<BudgetPanel tripId={1} />);
     const input = await screen.findByPlaceholderText('Enter category name...');
     await user.type(input, 'Souvenirs{Enter}');
-    await screen.findByText('Souvenirs');
+    expect(await screen.findByText('Souvenirs')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-029: settlement section renders flows with usernames', async () => {
@@ -371,7 +371,7 @@ describe('BudgetPanel', () => {
             { user_id: 2, username: 'bob', balance: 10, avatar_url: null },
           ],
           flows: [
-            { from: { username: 'alice', avatar_url: null }, to: { username: 'bob', avatar_url: null }, amount: 10 },
+            { from: { user_id: 1, username: 'alice', avatar_url: null }, to: { user_id: 2, username: 'bob', avatar_url: null }, amount: 10 },
           ],
         })
       )
@@ -387,7 +387,7 @@ describe('BudgetPanel', () => {
     await user.click(settlementBtn);
     // alice and bob should appear in balances section
     await screen.findByText('alice');
-    await screen.findByText('bob');
+    expect(await screen.findByText('bob')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-030: per-person summary renders usernames', async () => {
@@ -408,7 +408,7 @@ describe('BudgetPanel', () => {
     ];
     render(<BudgetPanel tripId={1} tripMembers={tripMembers} />);
     await screen.findByText('Shared Dinner');
-    await screen.findByText('testuser');
+    expect(await screen.findByText('testuser')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-032: grand total row shows sum across all categories', async () => {
@@ -451,7 +451,7 @@ describe('BudgetPanel', () => {
     render(<BudgetPanel tripId={1} />);
     await screen.findByText('Train');
     // expense_date is rendered as plain text in read-only mode
-    await screen.findByText('2025-06-15');
+    expect(await screen.findByText('2025-06-15')).toBeInTheDocument();
   });
 
   it('FE-COMP-BUDGET-035: settlement section with avatar renders user avatar image', async () => {
@@ -465,7 +465,7 @@ describe('BudgetPanel', () => {
             { user_id: 1, username: 'alice', avatar_url: '/uploads/avatars/alice.jpg', balance: -30 },
             { user_id: 2, username: 'bob', avatar_url: null, balance: 30 },
           ],
-          flows: [{ from: { username: 'alice', avatar_url: '/uploads/avatars/alice.jpg' }, to: { username: 'bob', avatar_url: null }, amount: 30 }]
+          flows: [{ from: { user_id: 1, username: 'alice', avatar_url: '/uploads/avatars/alice.jpg' }, to: { user_id: 2, username: 'bob', avatar_url: null }, amount: 30 }]
         })
       ),
       http.get('/api/trips/1/budget/per-person', () => HttpResponse.json({ summary: [] })),
diff --git a/client/src/components/Budget/BudgetPanel.tsx b/client/src/components/Budget/BudgetPanel.tsx
index 8876ad4eb..3fddf4e16 100644
--- a/client/src/components/Budget/BudgetPanel.tsx
+++ b/client/src/components/Budget/BudgetPanel.tsx
@@ -46,7 +46,7 @@ export default function BudgetPanel({ tripId, tripMembers = [] }: BudgetPanelPro
               onKeyDown={e => e.key === 'Enter' && handleAddCategory()}
               placeholder={t('budget.emptyPlaceholder')}
               style={{ flex: 1, padding: '9px 14px', borderRadius: 10, border: '1px solid var(--border-primary)', fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontFamily: 'inherit', outline: 'none', background: 'var(--bg-input)', color: 'var(--text-primary)', minWidth: 0 }} />
-            <button onClick={handleAddCategory} disabled={!newCategoryName.trim()}
+            <button type="button" onClick={handleAddCategory} disabled={!newCategoryName.trim()}
               style={{ background: 'var(--accent)', color: 'var(--accent-text)', border: 'none', borderRadius: 10, padding: '0 12px', cursor: 'pointer', display: 'flex', alignItems: 'center', opacity: newCategoryName.trim() ? 1 : 0.5, flexShrink: 0 }}>
               <Plus size={16} />
             </button>
@@ -87,7 +87,7 @@ export default function BudgetPanel({ tripId, tripMembers = [] }: BudgetPanelPro
                   placeholder={t('budget.categoryName')}
                   style={{ flex: 1, minWidth: 0, border: '1px solid var(--border-primary)', borderRadius: 10, padding: '9px 14px', fontSize: 'calc(13px * var(--fs-scale-body, 1))', outline: 'none', fontFamily: 'inherit', background: 'var(--bg-card)', color: 'var(--text-primary)' }}
                 />
-                <button onClick={handleAddCategory} disabled={!newCategoryName.trim()}
+                <button type="button" onClick={handleAddCategory} disabled={!newCategoryName.trim()}
                   title={t('budget.addCategory')}
                   style={{
                     appearance: 'none', border: 'none', cursor: newCategoryName.trim() ? 'pointer' : 'default', fontFamily: 'inherit',
@@ -101,7 +101,7 @@ export default function BudgetPanel({ tripId, tripMembers = [] }: BudgetPanelPro
                 </button>
               </div>
             )}
-            <button onClick={handleExportCsv} title={t('budget.exportCsv')}
+            <button type="button" onClick={handleExportCsv} title={t('budget.exportCsv')}
               style={{
                 appearance: 'none', border: 'none', cursor: 'pointer', fontFamily: 'inherit',
                 display: 'inline-flex', alignItems: 'center', gap: 6,
diff --git a/client/src/components/Budget/BudgetPanelAddItemRow.tsx b/client/src/components/Budget/BudgetPanelAddItemRow.tsx
index 5f9deb4fa..f19e438d2 100644
--- a/client/src/components/Budget/BudgetPanelAddItemRow.tsx
+++ b/client/src/components/Budget/BudgetPanelAddItemRow.tsx
@@ -19,7 +19,7 @@ export default function AddItemRow({ onAdd, t }: AddItemRowProps) {
 
   const handleAdd = () => {
     if (!name.trim()) return
-    onAdd({ name: name.trim(), total_price: parseFloat(String(price).replace(',', '.')) || 0, persons: parseInt(persons) || null, days: parseInt(days) || null, note: note.trim() || null, expense_date: expenseDate || null })
+    onAdd({ name: name.trim(), total_price: Number.parseFloat(String(price).replace(',', '.')) || 0, persons: Number.parseInt(persons) || null, days: Number.parseInt(days) || null, note: note.trim() || null, expense_date: expenseDate || null })
     setName(''); setPrice(''); setPersons(''); setDays(''); setNote(''); setExpenseDate('')
     setTimeout(() => nameRef.current?.focus(), 50)
   }
@@ -57,7 +57,7 @@ export default function AddItemRow({ onAdd, t }: AddItemRowProps) {
         <input value={note} onChange={e => setNote(e.target.value)} onKeyDown={e => e.key === 'Enter' && handleAdd()} placeholder={t('budget.table.note')} style={inp} />
       </td>
       <td style={{ padding: '4px 6px', textAlign: 'center' }}>
-        <button onClick={handleAdd} disabled={!name.trim()} title={t('reservations.add')}
+        <button type="button" onClick={handleAdd} disabled={!name.trim()} title={t('reservations.add')}
           style={{ background: name.trim() ? 'var(--text-primary)' : 'var(--border-primary)', border: 'none', borderRadius: 4, color: 'var(--bg-primary)',
             cursor: name.trim() ? 'pointer' : 'default', padding: '4px 8px', display: 'inline-flex', alignItems: 'center' }}>
           <Plus size={14} />
diff --git a/client/src/components/Budget/BudgetPanelCategoryTable.test.tsx b/client/src/components/Budget/BudgetPanelCategoryTable.test.tsx
index 70e2cb923..16179733e 100644
--- a/client/src/components/Budget/BudgetPanelCategoryTable.test.tsx
+++ b/client/src/components/Budget/BudgetPanelCategoryTable.test.tsx
@@ -586,7 +586,10 @@ describe('BudgetCategoryTable — member chips', () => {
   it('FE-W4BCT-052: picking a member from either chip dropdown sets the item members', () => {
     const { setBudgetItemMembers, container } = withMembers()
     // The mobile stack under the name and the persons column both carry an editor.
-    const editors = container.querySelectorAll('td button')
+    // Assigned chips are buttons of their own, so the editors are the two that
+    // carry the picker icon.
+    const editors = Array.from(container.querySelectorAll('td button'))
+      .filter(b => b.querySelector('.lucide-pencil, .lucide-users'))
 
     fireEvent.click(editors[0])
     fireEvent.click(screen.getByText('bob'))
diff --git a/client/src/components/Budget/BudgetPanelCategoryTable.tsx b/client/src/components/Budget/BudgetPanelCategoryTable.tsx
index cd172325d..e68346e48 100644
--- a/client/src/components/Budget/BudgetPanelCategoryTable.tsx
+++ b/client/src/components/Budget/BudgetPanelCategoryTable.tsx
@@ -111,7 +111,7 @@ export default function BudgetCategoryTable({ cat, grouped, categoryColor, canEd
                       <>
                         <span style={{ fontWeight: 600, fontSize: 'calc(13px * var(--fs-scale-body, 1))' }}>{cat}</span>
                         {canEdit && (
-                          <button onClick={() => setEditingCat({ name: cat, value: cat })}
+                          <button type="button" onClick={() => setEditingCat({ name: cat, value: cat })}
                             style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.4)', display: 'flex', padding: 1 }}
                             onMouseEnter={e => e.currentTarget.style.color = '#fff'} onMouseLeave={e => e.currentTarget.style.color = 'rgba(255,255,255,0.4)'}>
                             <Pencil size={10} />
@@ -123,7 +123,7 @@ export default function BudgetCategoryTable({ cat, grouped, categoryColor, canEd
                   <div style={{ display: 'flex', alignItems: 'center', gap: 10 }}>
                     <span style={{ fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 500, opacity: 0.9 }}>{fmt(subtotal, currency)}</span>
                     {canEdit && (
-                      <button onClick={() => handleDeleteCategory(cat)} title={t('budget.deleteCategory')}
+                      <button type="button" onClick={() => handleDeleteCategory(cat)} title={t('budget.deleteCategory')}
                         style={{ background: 'rgba(255,255,255,0.1)', border: 'none', borderRadius: 4, color: '#fff', cursor: 'pointer', padding: '3px 6px', display: 'flex', alignItems: 'center', opacity: 0.6 }}
                         onMouseEnter={e => e.currentTarget.style.opacity = '1'} onMouseLeave={e => e.currentTarget.style.opacity = '0.6'}>
                         <Trash2 size={13} />
@@ -225,11 +225,11 @@ export default function BudgetCategoryTable({ cat, grouped, categoryColor, canEd
                                   readOnly={!canEdit}
                                 />
                               ) : (
-                                <InlineEditCell value={item.persons} type="number" decimals={0} onSave={v => handleUpdateField(item.id, 'persons', v != null ? parseInt(v as string) || null : null)} style={{ textAlign: 'center' }} placeholder="-" locale={locale} editTooltip={t('budget.editTooltip')} readOnly={!canEdit} />
+                                <InlineEditCell value={item.persons} type="number" decimals={0} onSave={v => handleUpdateField(item.id, 'persons', v != null ? Number.parseInt(v as string) || null : null)} style={{ textAlign: 'center' }} placeholder="-" locale={locale} editTooltip={t('budget.editTooltip')} readOnly={!canEdit} />
                               )}
                             </td>
                             <td className="hidden sm:table-cell" style={{ ...td, textAlign: 'center' }}>
-                              <InlineEditCell value={item.days} type="number" decimals={0} onSave={v => handleUpdateField(item.id, 'days', v != null ? parseInt(v as string) || null : null)} style={{ textAlign: 'center' }} placeholder="-" locale={locale} editTooltip={t('budget.editTooltip')} readOnly={!canEdit} />
+                              <InlineEditCell value={item.days} type="number" decimals={0} onSave={v => handleUpdateField(item.id, 'days', v != null ? Number.parseInt(v as string) || null : null)} style={{ textAlign: 'center' }} placeholder="-" locale={locale} editTooltip={t('budget.editTooltip')} readOnly={!canEdit} />
                             </td>
                             <td className="hidden md:table-cell" style={{ ...td, textAlign: 'center', color: pp != null ? 'var(--text-secondary)' : 'var(--text-faint)' }}>{pp != null ? fmt(pp, currency) : '-'}</td>
                             <td className="hidden md:table-cell" style={{ ...td, textAlign: 'center', color: pd != null ? 'var(--text-secondary)' : 'var(--text-faint)' }}>{pd != null ? fmt(pd, currency) : '-'}</td>
@@ -246,7 +246,7 @@ export default function BudgetCategoryTable({ cat, grouped, categoryColor, canEd
                             <td className="hidden sm:table-cell" style={td}><InlineEditCell value={item.note} onSave={v => handleUpdateField(item.id, 'note', v)} placeholder={t('budget.table.note')} locale={locale} editTooltip={t('budget.editTooltip')} readOnly={!canEdit} /></td>
                             <td style={{ ...td, textAlign: 'center' }}>
                               {canEdit && (
-                              <button onClick={() => handleDeleteItem(item.id)} title={t('common.delete')}
+                              <button type="button" onClick={() => handleDeleteItem(item.id)} title={t('common.delete')}
                                 style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 4, color: 'var(--text-faint)', borderRadius: 4, display: 'inline-flex', transition: 'color 0.15s' }}
                                 onMouseEnter={e => e.currentTarget.style.color = '#ef4444'} onMouseLeave={e => e.currentTarget.style.color = '#d1d5db'}>
                                 <Trash2 size={14} />
diff --git a/client/src/components/Budget/BudgetPanelInlineEditCell.tsx b/client/src/components/Budget/BudgetPanelInlineEditCell.tsx
index 159bd500d..232936775 100644
--- a/client/src/components/Budget/BudgetPanelInlineEditCell.tsx
+++ b/client/src/components/Budget/BudgetPanelInlineEditCell.tsx
@@ -23,7 +23,7 @@ export default function InlineEditCell({ value, onSave, type = 'text', style = {
   const save = () => {
     setEditing(false)
     let v: string | number | null = editValue
-    if (type === 'number') { const p = parseFloat(String(editValue).replace(',', '.')); v = isNaN(p) ? null : p }
+    if (type === 'number') { const p = Number.parseFloat(String(editValue).replace(',', '.')); v = Number.isNaN(p) ? null : p }
     if (v !== value) onSave(v)
   }
 
@@ -45,14 +45,27 @@ export default function InlineEditCell({ value, onSave, type = 'text', style = {
     ? Number(value).toLocaleString(locale, { minimumFractionDigits: decimals, maximumFractionDigits: decimals })
     : (value || '')
 
+  // Editable cells are real buttons so they can be tabbed to and pressed. A
+  // read-only cell renders no control at all rather than a disabled one: it is
+  // plain text, and a disabled button would be announced as an unavailable
+  // control that never becomes available. Same split the member chips use.
+  const cellStyle: React.CSSProperties = {
+    padding: '2px 4px', borderRadius: 4, minHeight: 22, display: 'flex', alignItems: 'center',
+    justifyContent: style?.textAlign === 'center' ? 'center' : 'flex-start', transition: 'background 0.15s',
+    color: display ? 'var(--text-primary)' : 'var(--text-faint)', fontSize: 'calc(13px * var(--fs-scale-body, 1))',
+    width: '100%', textAlign: 'left', ...style,
+  }
+  const content = display || placeholder || '-'
+
+  if (readOnly) return <div style={{ ...cellStyle, cursor: 'default' }}>{content}</div>
+
   return (
-    <div onClick={() => { if (readOnly) return; setEditValue(value ?? ''); setEditing(true) }} title={readOnly ? undefined : editTooltip}
-      style={{ cursor: readOnly ? 'default' : 'pointer', padding: '2px 4px', borderRadius: 4, minHeight: 22, display: 'flex', alignItems: 'center',
-        justifyContent: style?.textAlign === 'center' ? 'center' : 'flex-start', transition: 'background 0.15s',
-        color: display ? 'var(--text-primary)' : 'var(--text-faint)', fontSize: 'calc(13px * var(--fs-scale-body, 1))', ...style }}
-      onMouseEnter={e => { if (!readOnly) e.currentTarget.style.background = 'var(--bg-hover)' }}
-      onMouseLeave={e => { if (!readOnly) e.currentTarget.style.background = 'transparent' }}>
-      {display || placeholder || '-'}
-    </div>
+    <button type="button"
+      onClick={() => { setEditValue(value ?? ''); setEditing(true) }} title={editTooltip}
+      style={{ ...cellStyle, cursor: 'pointer' }}
+      onMouseEnter={e => { e.currentTarget.style.background = 'var(--bg-hover)' }}
+      onMouseLeave={e => { e.currentTarget.style.background = 'transparent' }}>
+      {content}
+    </button>
   )
 }
diff --git a/client/src/components/Budget/BudgetPanelMemberChips.test.tsx b/client/src/components/Budget/BudgetPanelMemberChips.test.tsx
index 50c913999..3e7b4a04f 100644
--- a/client/src/components/Budget/BudgetPanelMemberChips.test.tsx
+++ b/client/src/components/Budget/BudgetPanelMemberChips.test.tsx
@@ -22,6 +22,16 @@ function setup(props: Partial<Parameters<typeof BudgetMemberChips>[0]> = {}) {
   return { onSetMembers, onTogglePaid, ...utils }
 }
 
+/**
+ * The member picker trigger. A chip that can be clicked is a real button too,
+ * so it is the icon that tells the trigger apart from the chips before it.
+ */
+function picker(): HTMLElement {
+  const trigger = screen.getAllByRole('button').find(b => b.querySelector('.lucide-pencil, .lucide-users'))
+  if (!trigger) throw new Error('no picker trigger rendered')
+  return trigger
+}
+
 describe('ChipWithTooltip', () => {
   it('FE-W4BMC-001: falls back to the uppercased initial', () => {
     const { container } = render(<ChipWithTooltip label="ada" avatarUrl={null} />)
@@ -76,7 +86,7 @@ describe('BudgetMemberChips', () => {
 
     expect(screen.getByText('A')).toBeInTheDocument()
     expect(screen.getByText('B')).toBeInTheDocument()
-    expect(screen.getByRole('button')).toBeInTheDocument()
+    expect(picker()).toBeInTheDocument()
   })
 
   it('FE-W4BMC-007: uses the people icon while nobody is assigned and the pencil afterwards', () => {
@@ -114,9 +124,9 @@ describe('BudgetMemberChips', () => {
 
   it('FE-W4BMC-011: the picker lists every trip member and marks the assigned ones', () => {
     setup()
-    fireEvent.click(screen.getByRole('button'))
+    fireEvent.click(picker())
 
-    const rows = screen.getAllByRole('button').slice(1)
+    const rows = screen.getAllByRole('button').slice(2)
     expect(rows).toHaveLength(2)
     expect(rows[0]).toHaveTextContent('ada')
     expect(rows[0].querySelector('.lucide-check')).not.toBeNull()
@@ -127,52 +137,52 @@ describe('BudgetMemberChips', () => {
 
   it('FE-W4BMC-012: picking an unassigned member adds them', () => {
     const { onSetMembers } = setup()
-    fireEvent.click(screen.getByRole('button'))
+    fireEvent.click(picker())
 
-    fireEvent.click(screen.getAllByRole('button')[2])
+    fireEvent.click(screen.getAllByRole('button')[3])
 
     expect(onSetMembers).toHaveBeenCalledWith([1, 2])
   })
 
   it('FE-W4BMC-013: picking an assigned member removes them', () => {
     const { onSetMembers } = setup()
-    fireEvent.click(screen.getByRole('button'))
+    fireEvent.click(picker())
 
-    fireEvent.click(screen.getAllByRole('button')[1])
+    fireEvent.click(screen.getAllByRole('button')[2])
 
     expect(onSetMembers).toHaveBeenCalledWith([])
   })
 
   it('FE-W4BMC-014: a mousedown outside closes the picker, inside keeps it', () => {
     setup()
-    const trigger = screen.getByRole('button')
+    const trigger = picker()
     fireEvent.click(trigger)
 
-    fireEvent.mouseDown(screen.getAllByRole('button')[1])
-    expect(screen.getAllByRole('button')).toHaveLength(3)
+    fireEvent.mouseDown(screen.getAllByRole('button')[2])
+    expect(screen.getAllByRole('button')).toHaveLength(4)
 
     fireEvent.mouseDown(trigger)
-    expect(screen.getAllByRole('button')).toHaveLength(3)
+    expect(screen.getAllByRole('button')).toHaveLength(4)
 
     fireEvent.mouseDown(document.body)
-    expect(screen.getAllByRole('button')).toHaveLength(1)
+    expect(screen.getAllByRole('button')).toHaveLength(2)
   })
 
   it('FE-W4BMC-015: the trigger toggles the picker closed again', () => {
     setup()
-    const trigger = screen.getByRole('button')
+    const trigger = picker()
 
     fireEvent.click(trigger)
-    expect(screen.getAllByRole('button')).toHaveLength(3)
+    expect(screen.getAllByRole('button')).toHaveLength(4)
 
     fireEvent.click(trigger)
-    expect(screen.getAllByRole('button')).toHaveLength(1)
+    expect(screen.getAllByRole('button')).toHaveLength(2)
   })
 
   it('FE-W4BMC-016: the non-compact variant renders larger chips', () => {
     setup({ compact: false })
 
     expect(screen.getByText('A')).toHaveStyle({ width: '30px' })
-    expect((screen.getByRole('button') as HTMLElement).style.width).toBe('28px')
+    expect(picker().style.width).toBe('28px')
   })
 })
diff --git a/client/src/components/Budget/BudgetPanelMemberChips.tsx b/client/src/components/Budget/BudgetPanelMemberChips.tsx
index 376464f12..b8bb8a244 100644
--- a/client/src/components/Budget/BudgetPanelMemberChips.tsx
+++ b/client/src/components/Budget/BudgetPanelMemberChips.tsx
@@ -22,7 +22,7 @@ interface ChipWithTooltipProps {
 export function ChipWithTooltip({ label, avatarUrl, size = 20, paid, onClick }: ChipWithTooltipProps) {
   const [hover, setHover] = useState(false)
   const [pos, setPos] = useState({ top: 0, left: 0 })
-  const ref = useRef<HTMLDivElement>(null)
+  const ref = useRef<HTMLElement | null>(null)
 
   const onEnter = () => {
     if (ref.current) {
@@ -35,22 +35,34 @@ export function ChipWithTooltip({ label, avatarUrl, size = 20, paid, onClick }:
   const borderColor = paid ? '#22c55e' : 'var(--border-primary)'
   const bg = paid ? 'rgba(34,197,94,0.15)' : 'var(--bg-tertiary)'
 
+  // Identical for both shells — a clickable chip is a real button so it can be
+  // tabbed to and pressed, a decorative one stays a plain div.
+  const chipStyle = {
+    width: size, height: size, borderRadius: '50%', border: `2px solid ${borderColor}`,
+    background: bg, display: 'flex', alignItems: 'center', justifyContent: 'center',
+    fontSize: size * 0.4, fontWeight: 700, color: paid ? '#16a34a' : 'var(--text-muted)',
+    overflow: 'hidden', flexShrink: 0, cursor: onClick ? 'pointer' : 'default',
+    transition: 'border-color 0.15s, background 0.15s',
+    padding: 0, fontFamily: 'inherit',
+  }
+  const inner = avatarUrl
+    ? <img src={avatarUrl} alt="" style={{ width: '100%', height: '100%', objectFit: 'cover' }} />
+    : label?.[0]?.toUpperCase()
+
   return (
     <>
-      <div ref={ref} onMouseEnter={onEnter} onMouseLeave={() => setHover(false)}
-        onClick={onClick}
-        style={{
-          width: size, height: size, borderRadius: '50%', border: `2px solid ${borderColor}`,
-          background: bg, display: 'flex', alignItems: 'center', justifyContent: 'center',
-          fontSize: size * 0.4, fontWeight: 700, color: paid ? '#16a34a' : 'var(--text-muted)',
-          overflow: 'hidden', flexShrink: 0, cursor: onClick ? 'pointer' : 'default',
-          transition: 'border-color 0.15s, background 0.15s',
-        }}>
-        {avatarUrl
-          ? <img src={avatarUrl} style={{ width: '100%', height: '100%', objectFit: 'cover' }} />
-          : label?.[0]?.toUpperCase()
-        }
-      </div>
+      {onClick ? (
+        <button type="button" ref={el => { ref.current = el }} aria-label={label}
+          onMouseEnter={onEnter} onMouseLeave={() => setHover(false)}
+          onClick={onClick} style={chipStyle}>
+          {inner}
+        </button>
+      ) : (
+        <div ref={el => { ref.current = el }} onMouseEnter={onEnter} onMouseLeave={() => setHover(false)}
+          style={chipStyle}>
+          {inner}
+        </div>
+      )}
       {hover && createPortal(
         <div style={{
           position: 'fixed', top: pos.top, left: pos.left, transform: 'translate(-50%, -100%)',
@@ -131,7 +143,7 @@ export default function BudgetMemberChips({ members = [], tripMembers = [], onSe
         />
       ))}
       {!readOnly && (
-        <button ref={btnRef} onClick={openDropdown}
+        <button type="button" ref={btnRef} onClick={openDropdown}
           style={{
             width: btnSize, height: btnSize, borderRadius: '50%', border: '1.5px dashed var(--border-primary)',
             background: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center', justifyContent: 'center',
@@ -149,7 +161,7 @@ export default function BudgetMemberChips({ members = [], tripMembers = [], onSe
           {tripMembers.map(tm => {
             const isActive = memberIds.includes(tm.id)
             return (
-              <button key={tm.id} onClick={() => toggleMember(tm.id)} style={{
+              <button type="button" key={tm.id} onClick={() => toggleMember(tm.id)} style={{
                 display: 'flex', alignItems: 'center', gap: 6, width: '100%', padding: '5px 8px',
                 borderRadius: 6, border: 'none', background: isActive ? 'var(--bg-hover)' : 'none', cursor: 'pointer',
                 fontFamily: 'inherit', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-primary)', textAlign: 'left',
@@ -163,7 +175,7 @@ export default function BudgetMemberChips({ members = [], tripMembers = [], onSe
                   color: 'var(--text-muted)', overflow: 'hidden', flexShrink: 0,
                 }}>
                   {tm.avatar_url
-                    ? <img src={tm.avatar_url} style={{ width: '100%', height: '100%', objectFit: 'cover' }} />
+                    ? <img src={tm.avatar_url} alt="" style={{ width: '100%', height: '100%', objectFit: 'cover' }} />
                     : tm.username?.[0]?.toUpperCase()
                   }
                 </div>
diff --git a/client/src/components/Budget/BudgetPanelRingAvatar.tsx b/client/src/components/Budget/BudgetPanelRingAvatar.tsx
index 585bfece8..3c116d049 100644
--- a/client/src/components/Budget/BudgetPanelRingAvatar.tsx
+++ b/client/src/components/Budget/BudgetPanelRingAvatar.tsx
@@ -15,7 +15,7 @@ export default function RingAvatar({ userId, username, avatarUrl, size = 34, inn
         overflow: 'hidden',
         fontSize: size < 28 ? 10 : 12, fontWeight: 600, color: textColor,
       }}>
-        {avatarUrl ? <img src={avatarUrl} style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : username?.[0]?.toUpperCase()}
+        {avatarUrl ? <img src={avatarUrl} alt={username || ''} style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : username?.[0]?.toUpperCase()}
       </div>
     </div>
   )
diff --git a/client/src/components/Budget/BudgetPanelSummary.tsx b/client/src/components/Budget/BudgetPanelSummary.tsx
index 70abfae18..0b9d77866 100644
--- a/client/src/components/Budget/BudgetPanelSummary.tsx
+++ b/client/src/components/Budget/BudgetPanelSummary.tsx
@@ -75,7 +75,7 @@ export default function BudgetSummary({ theme, currency, locale, grandTotal, has
             {/* Settlement dropdown inside the total card */}
             {hasMultipleMembers && settlement && settlement.flows.length > 0 && (
               <div style={{ marginTop: 16, borderTop: `1px solid ${theme.divider}`, paddingTop: 12 }}>
-                <button onClick={() => setSettlementOpen(v => !v)} style={{
+                <button type="button" onClick={() => setSettlementOpen(v => !v)} style={{
                   display: 'flex', alignItems: 'center', gap: 6, width: '100%',
                   background: 'none', border: 'none', cursor: 'pointer', padding: 0, fontFamily: 'inherit',
                   color: theme.sub, fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 600, letterSpacing: 0.5,
@@ -83,7 +83,12 @@ export default function BudgetSummary({ theme, currency, locale, grandTotal, has
                   {settlementOpen ? <ChevronDown size={13} /> : <ChevronRight size={13} />}
                   {t('budget.settlement')}
                   <span style={{ position: 'relative', display: 'inline-flex', marginLeft: 2 }}>
+                    {/* Decoration inside the settlement toggle: the hint hangs off
+                        hover, and the click only keeps the toggle from firing. A
+                        role of its own would give the toggle a second name and a
+                        nested control, so it declares itself presentational. */}
                     <span style={{ display: 'flex', cursor: 'help' }}
+                      role="presentation"
                       onMouseEnter={e => { const tip = e.currentTarget.nextElementSibling as HTMLElement; if (tip) tip.style.display = 'block' }}
                       onMouseLeave={e => { const tip = e.currentTarget.nextElementSibling as HTMLElement; if (tip) tip.style.display = 'none' }}
                       onClick={e => e.stopPropagation()}
diff --git a/client/src/components/Budget/CostsPanel.helpers.ts b/client/src/components/Budget/CostsPanel.helpers.ts
index 8bc566144..6226d289c 100644
--- a/client/src/components/Budget/CostsPanel.helpers.ts
+++ b/client/src/components/Budget/CostsPanel.helpers.ts
@@ -22,7 +22,7 @@ export function splitCents(amount: number, n: number): number[] {
 
 /** Sum the amounts of the selected payers. */
 export function payerSum(amounts: Record<number, string>, ids: Set<number>): number {
-  return [...ids].reduce((a, id) => a + (parseFloat(amounts[id]) || 0), 0)
+  return [...ids].reduce((a, id) => a + (Number.parseFloat(amounts[id]) || 0), 0)
 }
 
 /** True when the payer amounts add up to the expense total, to the cent. */
@@ -45,7 +45,7 @@ export function rebalancePayers(
   if (free.length === 0) return amounts
   const pinnedSum = all
     .filter(id => pinned.has(id))
-    .reduce((a, id) => a + (parseFloat(amounts[id]) || 0), 0)
+    .reduce((a, id) => a + (Number.parseFloat(amounts[id]) || 0), 0)
   const shares = splitCents(total - pinnedSum, free.length)
   const next = { ...amounts }
   free.forEach((id, i) => { next[id] = shares[i] ? shares[i].toFixed(2) : '' })
@@ -153,7 +153,7 @@ export function calculateTicketShares(items: TicketItem[]): { shares: Record<num
   const everyone = [...new Set(items.flatMap(i => [...i.participants]))].sort((a, b) => a - b)
 
   for (const item of items) {
-    const priceNum = parseFloat(item.price) || 0
+    const priceNum = Number.parseFloat(item.price) || 0
     const priceCents = Math.round(priceNum * 100)
     totalCents += priceCents
 
diff --git a/client/src/components/Budget/CostsPanel.tsx b/client/src/components/Budget/CostsPanel.tsx
index d1badfa7a..a4de9d132 100644
--- a/client/src/components/Budget/CostsPanel.tsx
+++ b/client/src/components/Budget/CostsPanel.tsx
@@ -348,12 +348,12 @@ export default function CostsPanel({ tripId, tripMembers = [] }: CostsPanelProps
         </div>
         {canEdit && (
           <div style={{ display: 'flex', gap: 10 }}>
-            <button onClick={settleAll} disabled={!(settlement?.flows || []).length}
+            <button type="button" onClick={settleAll} disabled={!(settlement?.flows || []).length}
               className="bg-surface-card border border-edge text-content disabled:opacity-40"
               style={{ display: 'inline-flex', alignItems: 'center', gap: 7, padding: '10px 16px', borderRadius: 12, fontSize: 'calc(14px * var(--fs-scale-body, 1))', fontWeight: 500, cursor: 'pointer', fontFamily: 'inherit' }}>
               <Check size={16} /> {t('costs.settleUp')}
             </button>
-            <button onClick={() => { setEditing(null); setModalOpen(true) }}
+            <button type="button" onClick={() => { setEditing(null); setModalOpen(true) }}
               className="bg-[var(--text-primary)] text-[var(--bg-primary)]"
               style={{ display: 'inline-flex', alignItems: 'center', gap: 7, padding: '10px 18px', borderRadius: 12, fontSize: 'calc(14px * var(--fs-scale-body, 1))', fontWeight: 600, border: 0, cursor: 'pointer', fontFamily: 'inherit' }}>
               <Plus size={16} /> {t('costs.addExpense')}
@@ -401,14 +401,14 @@ export default function CostsPanel({ tripId, tripMembers = [] }: CostsPanelProps
               {filterControls}
               <div className="bg-surface-secondary" style={{ display: 'flex', borderRadius: 9, padding: 3 }}>
                 {(['all', 'mine', 'owed'] as const).map(f => (
-                  <button key={f} onClick={() => setFilter(f)}
+                  <button type="button" key={f} onClick={() => setFilter(f)}
                     className={filter === f ? 'bg-surface-card text-content' : 'text-content-muted'}
                     style={{ padding: '6px 11px', fontSize: 'calc(12px * var(--fs-scale-body, 1))', borderRadius: 7, fontWeight: 500, border: 0, cursor: 'pointer', fontFamily: 'inherit' }}>
                     {t('costs.filter.' + f)}
                   </button>
                 ))}
               </div>
-              <button onClick={handleExportCsv} title={t('budget.exportCsv')} disabled={!budgetItems.length}
+              <button type="button" onClick={handleExportCsv} title={t('budget.exportCsv')} disabled={!budgetItems.length}
                 className="bg-surface-input border border-edge text-content-muted disabled:opacity-40"
                 style={{ display: 'inline-flex', alignItems: 'center', justifyContent: 'center', width: 34, height: 34, borderRadius: 10, cursor: 'pointer', fontFamily: 'inherit', flexShrink: 0 }}>
                 <Download size={15} />
@@ -451,7 +451,7 @@ export default function CostsPanel({ tripId, tripMembers = [] }: CostsPanelProps
             <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', marginBottom: 14 }}>
               <div className={labelCls}>{t('costs.settleUp')} · <span className="text-content">{(settlement?.flows || []).length}</span></div>
               {canEdit && (
-                <button onClick={() => setAddingPayment(true)}
+                <button type="button" onClick={() => setAddingPayment(true)}
                   className="text-content-muted bg-surface-secondary border border-edge"
                   style={{ display: 'inline-flex', alignItems: 'center', gap: 5, padding: '5px 9px', borderRadius: 8, fontSize: 'calc(11.5px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}>
                   <Plus size={13} /> {t('costs.addPayment')}
@@ -560,7 +560,7 @@ export default function CostsPanel({ tripId, tripMembers = [] }: CostsPanelProps
             </div>
             <div style={{ display: 'flex', alignItems: 'center', gap: 8, flexShrink: 0 }}>
               <span className="text-content" style={{ fontSize: 'calc(14px * var(--fs-scale-body, 1))', fontWeight: 700 }}>{fmt(f.amount)}</span>
-              {canEdit && <button onClick={() => settleFlow(f.from.user_id, f.to.user_id, f.amount)} className="bg-[var(--text-primary)] text-[var(--bg-primary)]" style={{ padding: '7px 12px', borderRadius: 9, fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, border: 0, cursor: 'pointer', fontFamily: 'inherit' }}>{t('costs.settle')}</button>}
+              {canEdit && <button type="button" onClick={() => settleFlow(f.from.user_id, f.to.user_id, f.amount)} className="bg-[var(--text-primary)] text-[var(--bg-primary)]" style={{ padding: '7px 12px', borderRadius: 9, fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, border: 0, cursor: 'pointer', fontFamily: 'inherit' }}>{t('costs.settle')}</button>}
             </div>
           </div>
         ))}
@@ -589,7 +589,7 @@ export default function CostsPanel({ tripId, tripMembers = [] }: CostsPanelProps
             <span>{t('costs.youPaid')} · <b style={{ color: '#fff', fontWeight: 600 }}>{fmt0(totals.myPaid)}</b></span>
           </div>
           {canEdit && (
-            <button onClick={() => { setEditing(null); setModalOpen(true) }} style={{ marginTop: 16, width: '100%', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 8, background: 'rgba(255,255,255,0.14)', border: '1px solid rgba(255,255,255,0.16)', color: '#fff', padding: 13, borderRadius: 14, fontSize: 'calc(14px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}>
+            <button type="button" onClick={() => { setEditing(null); setModalOpen(true) }} style={{ marginTop: 16, width: '100%', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 8, background: 'rgba(255,255,255,0.14)', border: '1px solid rgba(255,255,255,0.16)', color: '#fff', padding: 13, borderRadius: 14, fontSize: 'calc(14px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}>
               <Plus size={17} /> {t('costs.addExpense')}
             </button>
           )}
@@ -628,7 +628,7 @@ export default function CostsPanel({ tripId, tripMembers = [] }: CostsPanelProps
           <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', marginBottom: 14, gap: 8 }}>
             <div className="text-content" style={{ fontSize: 'calc(19px * var(--fs-scale-subtitle, 1))', fontWeight: 700, letterSpacing: '-0.02em', display: 'flex', alignItems: 'baseline', gap: 8 }}>{t('costs.settleUp')} <span className="text-content-faint" style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500 }}>{(settlement?.flows || []).length}</span></div>
             {canEdit && (
-              <button onClick={() => setAddingPayment(true)} className="text-content-muted bg-surface-card border border-edge" style={{ display: 'inline-flex', alignItems: 'center', gap: 5, padding: '6px 10px', borderRadius: 9, fontSize: 'calc(11.5px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}><Plus size={13} /> {t('costs.addPayment')}</button>
+              <button type="button" onClick={() => setAddingPayment(true)} className="text-content-muted bg-surface-card border border-edge" style={{ display: 'inline-flex', alignItems: 'center', gap: 5, padding: '6px 10px', borderRadius: 9, fontSize: 'calc(11.5px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}><Plus size={13} /> {t('costs.addPayment')}</button>
             )}
           </div>
           {SettleFlows()}
@@ -638,7 +638,7 @@ export default function CostsPanel({ tripId, tripMembers = [] }: CostsPanelProps
         <div style={{ display: 'flex', flexDirection: 'column', gap: 12 }}>
           <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 8 }}>
             <div className="text-content" style={{ fontSize: 'calc(19px * var(--fs-scale-subtitle, 1))', fontWeight: 700, letterSpacing: '-0.02em' }}>{t('costs.expenses')}</div>
-            <button onClick={handleExportCsv} title={t('budget.exportCsv')} disabled={!budgetItems.length}
+            <button type="button" onClick={handleExportCsv} title={t('budget.exportCsv')} disabled={!budgetItems.length}
               className="bg-surface-card border border-edge text-content-muted disabled:opacity-40"
               style={{ display: 'inline-flex', alignItems: 'center', justifyContent: 'center', width: 34, height: 34, borderRadius: 10, cursor: 'pointer', fontFamily: 'inherit', flexShrink: 0 }}>
               <Download size={15} />
@@ -650,7 +650,7 @@ export default function CostsPanel({ tripId, tripMembers = [] }: CostsPanelProps
           </div>
           <div className="bg-surface-secondary" style={{ display: 'flex', borderRadius: 11, padding: 3, gap: 2 }}>
             {(['all', 'mine', 'owed'] as const).map(f => (
-              <button key={f} onClick={() => setFilter(f)} className={filter === f ? 'bg-surface-card text-content' : 'text-content-muted'} style={{ flex: 1, padding: '8px 6px', fontSize: 'calc(12.5px * var(--fs-scale-body, 1))', fontWeight: 500, borderRadius: 8, border: 0, cursor: 'pointer', fontFamily: 'inherit', whiteSpace: 'nowrap' }}>{t('costs.filter.' + f)}</button>
+              <button type="button" key={f} onClick={() => setFilter(f)} className={filter === f ? 'bg-surface-card text-content' : 'text-content-muted'} style={{ flex: 1, padding: '8px 6px', fontSize: 'calc(12.5px * var(--fs-scale-body, 1))', fontWeight: 500, borderRadius: 8, border: 0, cursor: 'pointer', fontFamily: 'inherit', whiteSpace: 'nowrap' }}>{t('costs.filter.' + f)}</button>
             ))}
           </div>
           <div style={{ display: 'flex', gap: 8 }}>
@@ -705,8 +705,8 @@ export default function CostsPanel({ tripId, tripMembers = [] }: CostsPanelProps
     }
     return (
       <div className="exp-actions bg-surface-card border border-edge" style={{ display: 'flex', flexDirection: 'column', justifyContent: 'center', gap: 3, flexShrink: 0, borderRadius: 999, padding: 5 }}>
-        <button title={t('common.edit')} onClick={onEdit} className="text-content-muted transition-colors" style={btn}><Pencil size={13} /></button>
-        <button title={deleteLabel} onClick={onDelete} className="exp-action-danger transition-colors" style={{ ...btn, color: '#dc2626' }}><Trash2 size={13} /></button>
+        <button type="button" title={t('common.edit')} onClick={onEdit} className="text-content-muted transition-colors" style={btn}><Pencil size={13} /></button>
+        <button type="button" title={deleteLabel} onClick={onDelete} className="exp-action-danger transition-colors" style={{ ...btn, color: '#dc2626' }}><Trash2 size={13} /></button>
       </div>
     )
   }
@@ -839,8 +839,8 @@ export default function CostsPanel({ tripId, tripMembers = [] }: CostsPanelProps
       </div>
       {canEdit && (
         <div className="exp-actions bg-surface-card border border-edge" style={{ display: 'flex', flexDirection: 'column', justifyContent: 'center', gap: 3, flexShrink: 0, borderRadius: 999, padding: 5 }}>
-          <button title={t('common.edit')} onClick={() => setEditingSettlement(s)} className="text-content-muted transition-colors" style={{ display: 'inline-flex', alignItems: 'center', justifyContent: 'center', width: 30, height: 30, borderRadius: 999, border: 0, cursor: 'pointer', padding: 0 }}><Pencil size={13} /></button>
-          <button title={t('costs.undo')} onClick={() => undoSettlement(s.id)} className="exp-action-danger transition-colors" style={{ display: 'inline-flex', alignItems: 'center', justifyContent: 'center', width: 30, height: 30, borderRadius: 999, border: 0, cursor: 'pointer', padding: 0, color: '#dc2626' }}><RotateCcw size={13} /></button>
+          <button type="button" title={t('common.edit')} onClick={() => setEditingSettlement(s)} className="text-content-muted transition-colors" style={{ display: 'inline-flex', alignItems: 'center', justifyContent: 'center', width: 30, height: 30, borderRadius: 999, border: 0, cursor: 'pointer', padding: 0 }}><Pencil size={13} /></button>
+          <button type="button" title={t('costs.undo')} onClick={() => undoSettlement(s.id)} className="exp-action-danger transition-colors" style={{ display: 'inline-flex', alignItems: 'center', justifyContent: 'center', width: 30, height: 30, borderRadius: 999, border: 0, cursor: 'pointer', padding: 0, color: '#dc2626' }}><RotateCcw size={13} /></button>
         </div>
       )}
       </div>
@@ -970,7 +970,7 @@ function SettlementModal({ tripId, people, me, editing, currency, onClose, onSav
   const [cur, setCur] = useState<string>((editing?.currency || currency).toUpperCase())
   const [saving, setSaving] = useState(false)
 
-  const amt = parseFloat(amount) || 0
+  const amt = Number.parseFloat(amount) || 0
   const valid = amt > 0 && fromId !== toId
   const opts = people.map(p => ({ value: String(p.id), label: p.id === me ? t('costs.you') : p.username }))
 
@@ -991,8 +991,8 @@ function SettlementModal({ tripId, people, me, editing, currency, onClose, onSav
     <Modal isOpen onClose={onClose} title={editing ? t('costs.editPayment') : t('costs.addPayment')} size="md"
       footer={
         <div style={{ display: 'flex', justifyContent: 'flex-end', gap: 8 }}>
-          <button onClick={onClose} className="text-content-muted border border-edge" style={{ padding: '8px 16px', borderRadius: 10, background: 'none', fontSize: 'calc(13px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit' }}>{t('common.cancel')}</button>
-          <button onClick={save} disabled={!valid || saving} className="bg-[var(--text-primary)] text-[var(--bg-primary)]" style={{ padding: '8px 20px', borderRadius: 10, border: 0, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit', opacity: !valid || saving ? 0.5 : 1 }}>{editing ? t('common.save') : t('costs.addPayment')}</button>
+          <button type="button" onClick={onClose} className="text-content-muted border border-edge" style={{ padding: '8px 16px', borderRadius: 10, background: 'none', fontSize: 'calc(13px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit' }}>{t('common.cancel')}</button>
+          <button type="button" onClick={save} disabled={!valid || saving} className="bg-[var(--text-primary)] text-[var(--bg-primary)]" style={{ padding: '8px 20px', borderRadius: 10, border: 0, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit', opacity: !valid || saving ? 0.5 : 1 }}>{editing ? t('common.save') : t('costs.addPayment')}</button>
         </div>
       }>
       <div style={{ display: 'flex', flexDirection: 'column', gap: 14 }}>
@@ -1116,8 +1116,8 @@ export function ExpenseModal({ tripId, base, people, me, editing, prefill, onClo
     return calculateTicketShares(ticketItems)
   }, [ticketItems])
 
-  const totalNum = isTicketMode ? ticketInfo.total : (parseFloat(total) || 0)
-  const splitSum = [...participants].reduce((sum, id) => sum + (parseFloat(customAmounts[id]) || 0), 0)
+  const totalNum = isTicketMode ? ticketInfo.total : (Number.parseFloat(total) || 0)
+  const splitSum = [...participants].reduce((sum, id) => sum + (Number.parseFloat(customAmounts[id]) || 0), 0)
   const customBalanced = Math.round(splitSum * 100) === Math.round(totalNum * 100)
   const each = participants.size > 0 ? totalNum / participants.size : 0
   const equalShares = useMemo(() => {
@@ -1130,13 +1130,13 @@ export function ExpenseModal({ tripId, base, people, me, editing, prefill, onClo
 
     const enteredSum = [...participants]
       .filter(id => customAmounts[id])
-      .reduce((sum, id) => sum + (parseFloat(customAmounts[id]) || 0), 0)
+      .reduce((sum, id) => sum + (Number.parseFloat(customAmounts[id]) || 0), 0)
     const remaining = Math.max(0, totalNum - enteredSum)
 
     return splitEqualShares(remaining, emptyParts.map(id => ({ user_id: id })), editing?.id || 0)
   }, [totalNum, participants, customAmounts, editing])
   
-  const ticketValid = ticketItems.length > 0 && ticketItems.every(item => item.name.trim().length > 0 && (parseFloat(item.price) || 0) > 0 && item.participants.size > 0)
+  const ticketValid = ticketItems.length > 0 && ticketItems.every(item => item.name.trim().length > 0 && (Number.parseFloat(item.price) || 0) > 0 && item.participants.size > 0)
   const payersOk = !multiPayer || (payerIds.size > 0 && payersBalanced(payerAmounts, payerIds, totalNum))
   const valid = name.trim().length > 0 && payersOk && (
     isTicketMode
@@ -1263,7 +1263,7 @@ export function ExpenseModal({ tripId, base, people, me, editing, prefill, onClo
     // dropping the payer would store the entry with a total of 0.
     const payerList = multiPayer
       ? [...payerIds]
-          .map(id => ({ user_id: id, amount: parseFloat(payerAmounts[id]) || 0 }))
+          .map(id => ({ user_id: id, amount: Number.parseFloat(payerAmounts[id]) || 0 }))
           .filter(p => p.amount > 0)
       : payerId > 0 ? [{ user_id: payerId, amount: totalNum }] : []
     // A receipt line can name somebody who is not ticked as a participant. Sending
@@ -1275,7 +1275,7 @@ export function ExpenseModal({ tripId, base, people, me, editing, prefill, onClo
     const memberList = memberIds.map(id => ({
       user_id: id,
       amount: splitMode === 'custom'
-        ? (parseFloat(customAmounts[id]) || 0)
+        ? (Number.parseFloat(customAmounts[id]) || 0)
         : splitMode === 'ticket'
         ? (ticketInfo.shares[id] || 0)
         : null
@@ -1315,8 +1315,8 @@ export function ExpenseModal({ tripId, base, people, me, editing, prefill, onClo
     <Modal isOpen onClose={onClose} title={editing ? t('costs.editExpense') : t('costs.addExpense')} size={isMobile ? '2xl' : '5xl'}
       footer={
         <div style={{ display: 'flex', justifyContent: 'flex-end', gap: 8 }}>
-          <button onClick={onClose} className="text-content-muted border border-edge" style={{ padding: '8px 16px', borderRadius: 10, background: 'none', fontSize: 'calc(13px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit' }}>{t('common.cancel')}</button>
-          <button onClick={save} disabled={!valid || saving} className="bg-[var(--text-primary)] text-[var(--bg-primary)]" style={{ padding: '8px 20px', borderRadius: 10, border: 0, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit', opacity: !valid || saving ? 0.5 : 1 }}>{editing ? t('common.save') : t('costs.addExpense')}</button>
+          <button type="button" onClick={onClose} className="text-content-muted border border-edge" style={{ padding: '8px 16px', borderRadius: 10, background: 'none', fontSize: 'calc(13px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit' }}>{t('common.cancel')}</button>
+          <button type="button" onClick={save} disabled={!valid || saving} className="bg-[var(--text-primary)] text-[var(--bg-primary)]" style={{ padding: '8px 20px', borderRadius: 10, border: 0, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit', opacity: !valid || saving ? 0.5 : 1 }}>{editing ? t('common.save') : t('costs.addExpense')}</button>
         </div>
       }>
       {/* Two columns on desktop: what the expense was on the left, how it is
@@ -1370,7 +1370,7 @@ export function ExpenseModal({ tripId, base, people, me, editing, prefill, onClo
             {COST_CATEGORY_LIST.map(c => {
               const Icon = c.Icon; const on = cat === c.key
               return (
-                <button key={c.key} onClick={() => setCat(c.key)}
+                <button type="button" key={c.key} onClick={() => setCat(c.key)}
                   className={on ? 'bg-surface-card text-content border' : 'bg-surface-secondary text-content-muted border border-edge'}
                   style={{ display: 'inline-flex', alignItems: 'center', gap: 6, padding: '6px 11px 6px 7px', borderRadius: 999, fontSize: 'calc(12.5px * var(--fs-scale-body, 1))', fontWeight: 500, cursor: 'pointer', fontFamily: 'inherit', borderColor: on ? 'var(--text-primary)' : undefined }}>
                   <span style={{ width: 20, height: 20, borderRadius: 6, display: 'grid', placeItems: 'center', background: c.color + '22', color: c.color }}><Icon size={12} /></span>
diff --git a/client/src/components/Collab/CollabChat.test.tsx b/client/src/components/Collab/CollabChat.test.tsx
index 34f6339e6..2f818b142 100644
--- a/client/src/components/Collab/CollabChat.test.tsx
+++ b/client/src/components/Collab/CollabChat.test.tsx
@@ -53,7 +53,7 @@ describe('CollabChat', () => {
 
   it('FE-COMP-CHAT-002: shows empty state when no messages', async () => {
     render(<CollabChat {...defaultProps} />);
-    await screen.findByText('Start the conversation');
+    expect(await screen.findByText('Start the conversation')).toBeInTheDocument();
   });
 
   it('FE-COMP-CHAT-003: shows message input placeholder', async () => {
@@ -85,7 +85,7 @@ describe('CollabChat', () => {
       )
     );
     render(<CollabChat {...defaultProps} />);
-    await screen.findByText('Hello world!');
+    expect(await screen.findByText('Hello world!')).toBeInTheDocument();
   });
 
   it('FE-COMP-CHAT-006: typing in input updates text field', async () => {
@@ -599,7 +599,7 @@ describe('CollabChat', () => {
     await screen.findByText('New 100');
     const loadMoreBtn = screen.getByRole('button', { name: /load/i });
     await user.click(loadMoreBtn);
-    await screen.findByText('Older message');
+    expect(await screen.findByText('Older message')).toBeInTheDocument();
   });
 
   it('FE-COMP-CHAT-033: clicking delete on own message marks it as deleted', async () => {
diff --git a/client/src/components/Collab/CollabChat.tsx b/client/src/components/Collab/CollabChat.tsx
index 7d5f0101c..597b8b86f 100644
--- a/client/src/components/Collab/CollabChat.tsx
+++ b/client/src/components/Collab/CollabChat.tsx
@@ -39,7 +39,7 @@ export default function CollabChat({ tripId, currentUser }: CollabChatProps) {
             <span style={{ overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', flex: 1 }}>
               <strong>{replyTo.username}</strong>: {(replyTo.text || '').slice(0, 60)}
             </span>
-            <button onClick={() => setReplyTo(null)} style={{
+            <button type="button" onClick={() => setReplyTo(null)} style={{
               background: 'none', border: 'none', cursor: 'pointer', padding: 2, color: 'var(--text-faint)',
               display: 'flex', flexShrink: 0,
             }}>
@@ -51,7 +51,7 @@ export default function CollabChat({ tripId, currentUser }: CollabChatProps) {
         <div style={{ display: 'flex', alignItems: 'flex-end', gap: 6 }}>
           {/* Emoji button */}
           {canEdit && (
-            <button ref={emojiBtnRef} onClick={() => setShowEmoji(!showEmoji)} style={{
+            <button type="button" ref={emojiBtnRef} onClick={() => setShowEmoji(!showEmoji)} style={{
               width: 34, height: 34, borderRadius: '50%', border: 'none',
               background: showEmoji ? 'var(--bg-hover)' : 'transparent',
               color: 'var(--text-muted)', display: 'flex', alignItems: 'center', justifyContent: 'center',
@@ -80,7 +80,7 @@ export default function CollabChat({ tripId, currentUser }: CollabChatProps) {
 
           {/* Send */}
           {canEdit && (
-            <button onClick={handleSend} disabled={!text.trim() || sending} style={{
+            <button type="button" onClick={handleSend} disabled={!text.trim() || sending} style={{
               width: 34, height: 34, borderRadius: '50%', border: 'none',
               background: text.trim() ? '#007AFF' : 'var(--border-primary)',
               color: '#fff', display: 'flex', alignItems: 'center', justifyContent: 'center',
diff --git a/client/src/components/Collab/CollabChatEmojiPicker.tsx b/client/src/components/Collab/CollabChatEmojiPicker.tsx
index ec214351c..6561d1295 100644
--- a/client/src/components/Collab/CollabChatEmojiPicker.tsx
+++ b/client/src/components/Collab/CollabChatEmojiPicker.tsx
@@ -46,7 +46,7 @@ export function EmojiPicker({ onSelect, onClose, anchorRef, containerRef }: Emoj
       {/* Category tabs */}
       <div style={{ display: 'flex', borderBottom: '1px solid var(--border-faint)', padding: '6px 8px', gap: 2 }}>
         {Object.keys(EMOJI_CATEGORIES).map(c => (
-          <button key={c} onClick={() => setCat(c)} style={{
+          <button type="button" key={c} onClick={() => setCat(c)} style={{
             flex: 1, padding: '4px 0', borderRadius: 6, border: 'none', cursor: 'pointer',
             background: cat === c ? 'var(--bg-hover)' : 'transparent',
             color: 'var(--text-primary)', fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 600, fontFamily: 'inherit',
@@ -58,7 +58,7 @@ export function EmojiPicker({ onSelect, onClose, anchorRef, containerRef }: Emoj
       {/* Emoji grid */}
       <div style={{ display: 'grid', gridTemplateColumns: 'repeat(10, 1fr)', gap: 2, padding: 8 }}>
         {EMOJI_CATEGORIES[cat].map((emoji, i) => (
-          <button key={i} onClick={() => onSelect(emoji)} style={{
+          <button type="button" key={i} onClick={() => onSelect(emoji)} style={{
             width: 28, height: 28, display: 'flex', alignItems: 'center', justifyContent: 'center',
             background: 'none', border: 'none', cursor: 'pointer', borderRadius: 6,
             padding: 2, transition: 'transform 0.1s',
diff --git a/client/src/components/Collab/CollabChatMessages.tsx b/client/src/components/Collab/CollabChatMessages.tsx
index 9427bee4c..6f94bdfcd 100644
--- a/client/src/components/Collab/CollabChatMessages.tsx
+++ b/client/src/components/Collab/CollabChatMessages.tsx
@@ -24,7 +24,7 @@ export function ChatMessages(props: any) {
         }}>
           {hasMore && (
             <div style={{ display: 'flex', justifyContent: 'center', padding: '4px 0 10px' }}>
-              <button onClick={handleLoadMore} disabled={loadingMore} style={{
+              <button type="button" onClick={handleLoadMore} disabled={loadingMore} style={{
                 display: 'inline-flex', alignItems: 'center', gap: 4, fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 600,
                 color: 'var(--text-muted)', background: 'var(--bg-secondary)', border: '1px solid var(--border-faint)',
                 borderRadius: 99, padding: '5px 14px', cursor: 'pointer', fontFamily: 'inherit',
@@ -181,7 +181,7 @@ export function ChatMessages(props: any) {
                         transition: 'opacity .1s',
                         ...(own ? { left: -6 } : { right: -6 }),
                       }}>
-                        <button onClick={() => setReplyTo(msg)} title={t('collab.chat.reply')} style={{
+                        <button type="button" onClick={() => setReplyTo(msg)} title={t('collab.chat.reply')} style={{
                           width: 24, height: 24, borderRadius: '50%', border: 'none',
                           background: 'var(--accent)', display: 'flex', alignItems: 'center', justifyContent: 'center',
                           cursor: 'pointer', color: 'var(--accent-text)', padding: 0,
@@ -193,7 +193,7 @@ export function ChatMessages(props: any) {
                           <Reply size={11} />
                         </button>
                         {own && canEdit && (
-                          <button onClick={() => handleDelete(msg.id)} title={t('common.delete')} style={{
+                          <button type="button" onClick={() => handleDelete(msg.id)} title={t('common.delete')} style={{
                             width: 24, height: 24, borderRadius: '50%', border: 'none',
                             background: 'var(--accent)', display: 'flex', alignItems: 'center', justifyContent: 'center',
                             cursor: 'pointer', color: 'var(--accent-text)', padding: 0,
diff --git a/client/src/components/Collab/CollabChatReactionBadge.tsx b/client/src/components/Collab/CollabChatReactionBadge.tsx
index ba773e5ab..e58ac28ea 100644
--- a/client/src/components/Collab/CollabChatReactionBadge.tsx
+++ b/client/src/components/Collab/CollabChatReactionBadge.tsx
@@ -18,7 +18,7 @@ export function ReactionBadge({ reaction, currentUserId, onReact }: ReactionBadg
 
   return (
     <>
-      <button ref={ref} onClick={onReact}
+      <button type="button" ref={ref} onClick={onReact}
         onMouseEnter={() => {
           if (ref.current) {
             const rect = ref.current.getBoundingClientRect()
diff --git a/client/src/components/Collab/CollabChatReactionMenu.tsx b/client/src/components/Collab/CollabChatReactionMenu.tsx
index 57e74a1e1..664ae4526 100644
--- a/client/src/components/Collab/CollabChatReactionMenu.tsx
+++ b/client/src/components/Collab/CollabChatReactionMenu.tsx
@@ -31,7 +31,7 @@ export function ReactionMenu({ x, y, onReact, onClose }: ReactionMenuProps) {
       display: 'grid', gridTemplateColumns: 'repeat(4, 1fr)', gap: 2, width: menuWidth,
     }}>
       {QUICK_REACTIONS.map(emoji => (
-        <button key={emoji} onClick={() => onReact(emoji)} style={{
+        <button type="button" key={emoji} onClick={() => onReact(emoji)} style={{
           width: 30, height: 30, display: 'flex', alignItems: 'center', justifyContent: 'center',
           background: 'none', border: 'none', cursor: 'pointer', borderRadius: '50%',
           padding: 3, transition: 'transform 0.1s, background 0.1s',
diff --git a/client/src/components/Collab/CollabNotes.test.tsx b/client/src/components/Collab/CollabNotes.test.tsx
index dcd9f9bbd..1ac19112d 100644
--- a/client/src/components/Collab/CollabNotes.test.tsx
+++ b/client/src/components/Collab/CollabNotes.test.tsx
@@ -47,7 +47,7 @@ describe('CollabNotes', () => {
 
   it('FE-COMP-NOTES-002: shows empty state when no notes', async () => {
     render(<CollabNotes {...defaultProps} />);
-    await screen.findByText('No notes yet');
+    expect(await screen.findByText('No notes yet')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-003: shows New Note button', async () => {
@@ -70,7 +70,7 @@ describe('CollabNotes', () => {
       )
     );
     render(<CollabNotes {...defaultProps} />);
-    await screen.findByText('Packing Tips');
+    expect(await screen.findByText('Packing Tips')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-005: clicking New Note opens modal', async () => {
@@ -79,7 +79,7 @@ describe('CollabNotes', () => {
     await screen.findByText('No notes yet');
     await user.click(screen.getByText('New Note'));
     // Modal opens with a title input — placeholder is "Note title" (no ellipsis)
-    await screen.findByPlaceholderText('Note title');
+    expect(await screen.findByPlaceholderText('Note title')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-006: note title is shown in the grid', async () => {
@@ -96,7 +96,7 @@ describe('CollabNotes', () => {
       )
     );
     render(<CollabNotes {...defaultProps} />);
-    await screen.findByText('My Checklist');
+    expect(await screen.findByText('My Checklist')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-007: multiple notes all render', async () => {
@@ -117,8 +117,11 @@ describe('CollabNotes', () => {
 
   it('FE-COMP-NOTES-008: Notes title heading is shown', async () => {
     render(<CollabNotes {...defaultProps} />);
+    // The loading panel renders its own copy of the heading and swaps the whole
+    // node out once the fetch settles, so wait for the loaded state first.
+    await screen.findByText('No notes yet');
     // collab.notes.title = "Notes"
-    await screen.findByText('Notes');
+    expect(screen.getByText('Notes')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-009: create note calls POST API', async () => {
@@ -236,7 +239,7 @@ describe('CollabNotes', () => {
     render(<CollabNotes {...defaultProps} />);
     await screen.findByText('Editable Note');
     await user.click(screen.getByTitle('Edit'));
-    await screen.findByDisplayValue('Editable Note');
+    expect(await screen.findByDisplayValue('Editable Note')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-016: category filter hides notes from other categories', async () => {
@@ -280,7 +283,7 @@ describe('CollabNotes', () => {
         },
       });
     });
-    await screen.findByText('Live Note');
+    expect(await screen.findByText('Live Note')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-018: WebSocket collab:note:deleted event removes note', async () => {
@@ -403,7 +406,7 @@ describe('CollabNotes', () => {
     await screen.findByText('No notes yet');
     await user.click(screen.getByTitle('Manage Categories'));
     // The modal header renders "Category Settings" or similar
-    await screen.findByText('Manage Categories', { selector: 'h3' });
+    expect(await screen.findByText('Manage Categories', { selector: 'h3' })).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-025: CategorySettingsModal shows no categories message when empty', async () => {
@@ -411,7 +414,7 @@ describe('CollabNotes', () => {
     render(<CollabNotes {...defaultProps} />);
     await screen.findByText('No notes yet');
     await user.click(screen.getByTitle('Manage Categories'));
-    await screen.findByText('No categories yet');
+    expect(await screen.findByText('No categories yet')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-026: CategorySettingsModal add new category', async () => {
@@ -426,7 +429,7 @@ describe('CollabNotes', () => {
     const addBtn = newCatInput.nextElementSibling as HTMLElement;
     await user.click(addBtn);
     // "Transport" category appears in the modal
-    await screen.findByText('Transport');
+    expect(await screen.findByText('Transport')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-027: CategorySettingsModal close button dismisses it', async () => {
@@ -674,7 +677,7 @@ describe('CollabNotes', () => {
     // Click the PDF badge to open FilePreviewPortal
     await user.click(screen.getByText('PDF'));
     // FilePreviewPortal renders the file name in the header
-    await screen.findByText('document.pdf');
+    expect(await screen.findByText('document.pdf')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTES-037: note with website shows website thumbnail component', async () => {
@@ -855,7 +858,7 @@ describe('CollabNotes', () => {
     await user.click(screen.getByTitle('Manage Categories'));
     await screen.findByText('Manage Categories', { selector: 'h3' });
     // Find the "Transport" category name span and click to edit
-    const categoryNameSpan = screen.getAllByText('Transport').find(el => el.tagName === 'SPAN' && el.title === 'Click to rename');
+    const categoryNameSpan = screen.getAllByText('Transport').find(el => el.tagName === 'BUTTON' && el.title === 'Click to rename');
     if (categoryNameSpan) {
       await user.click(categoryNameSpan);
       // Now an input with value "Transport" should appear
@@ -977,7 +980,7 @@ describe('CollabNotes', () => {
     await screen.findByText('Manage Categories', { selector: 'h3' });
 
     // Find and click the "OldCat" category name span to enter edit mode
-    const oldCatSpan = screen.getAllByText('OldCat').find(el => el.tagName === 'SPAN' && el.title === 'Click to rename');
+    const oldCatSpan = screen.getAllByText('OldCat').find(el => el.tagName === 'BUTTON' && el.title === 'Click to rename');
     if (oldCatSpan) {
       await user.click(oldCatSpan);
       const editInput = screen.getByDisplayValue('OldCat');
@@ -1348,7 +1351,7 @@ describe('CollabNotes details', () => {
   it('FE-W5CNT-001: a corrupt category cache in localStorage is ignored', async () => {
     localStorage.setItem('collab-cats-1', '{not json');
     render(<CollabNotes {...defaultProps} />);
-    await screen.findByText('No notes yet');
+    expect(await screen.findByText('No notes yet')).toBeInTheDocument();
   });
 
   it('FE-W5CNT-002: a category without a stored colour falls back to the first palette entry', async () => {
@@ -1369,13 +1372,13 @@ describe('CollabNotes details', () => {
   it('FE-W5CNT-004: notes served as a bare array are rendered', async () => {
     serveNotes([buildNote({ title: 'Array note' })]);
     render(<CollabNotes {...defaultProps} />);
-    await screen.findByText('Array note');
+    expect(await screen.findByText('Array note')).toBeInTheDocument();
   });
 
   it('FE-W5CNT-005: an empty payload yields an empty list', async () => {
     serveNotes(null);
     render(<CollabNotes {...defaultProps} />);
-    await screen.findByText('No notes yet');
+    expect(await screen.findByText('No notes yet')).toBeInTheDocument();
   });
 
   it('FE-W5CNT-006: a failing load falls back to the empty state', async () => {
@@ -1383,7 +1386,7 @@ describe('CollabNotes details', () => {
       http.get('/api/trips/1/collab/notes', () => new HttpResponse(null, { status: 500 })),
     );
     render(<CollabNotes {...defaultProps} />);
-    await screen.findByText('No notes yet');
+    expect(await screen.findByText('No notes yet')).toBeInTheDocument();
   });
 
   it('FE-W5CNT-007: a WebSocket create for a note already in the list does not duplicate it', async () => {
@@ -1434,7 +1437,7 @@ describe('CollabNotes details', () => {
     await user.click(screen.getByText('New Note'));
     await user.type(await screen.findByPlaceholderText('Note title'), 'Fresh note');
     await user.click(screen.getByRole('button', { name: 'Create' }));
-    await screen.findByText('Fresh note');
+    expect(await screen.findByText('Fresh note')).toBeInTheDocument();
   });
 
   it('FE-W5CNT-011: an empty create response leaves the list untouched', async () => {
@@ -1764,10 +1767,13 @@ describe('CollabNotes details', () => {
       if (!img) throw new Error('image attachment not rendered yet');
       return img;
     });
-    fireEvent.mouseEnter(image);
-    expect(image.style.transform).toBe('scale(1.06)');
-    fireEvent.mouseLeave(image);
-    expect(image.style.transform).toBe('scale(1)');
+    // The clickable thumbnail is a real button wrapped around the image, so the
+    // hover transform lands on that button.
+    const imageTile = image.closest('button') as HTMLElement;
+    fireEvent.mouseEnter(imageTile);
+    expect(imageTile.style.transform).toBe('scale(1.06)');
+    fireEvent.mouseLeave(imageTile);
+    expect(imageTile.style.transform).toBe('scale(1)');
     fireEvent.click(image);
     await waitFor(() => expect(screen.queryByText('Download itinerary.zip')).not.toBeInTheDocument());
   });
@@ -1838,7 +1844,7 @@ describe('CollabNotes details', () => {
 
     await user.click(screen.getByTitle('Manage Categories'));
     await screen.findByText('Manage Categories', { selector: 'h3' });
-    const oldCat = screen.getAllByText('OldCat').find(el => el.tagName === 'SPAN' && el.title === 'Click to rename')!;
+    const oldCat = screen.getAllByText('OldCat').find(el => el.tagName === 'BUTTON' && el.title === 'Click to rename')!;
     await user.click(oldCat);
     const editInput = screen.getByDisplayValue('OldCat');
     await user.clear(editInput);
@@ -1891,7 +1897,7 @@ describe('CollabNotes details', () => {
     await user.click(screen.getByTitle('Manage Categories'));
     await screen.findByText('Manage Categories', { selector: 'h3' });
 
-    const oldCat = screen.getAllByText('OldCat').find(el => el.tagName === 'SPAN' && el.title === 'Click to rename')!;
+    const oldCat = screen.getAllByText('OldCat').find(el => el.tagName === 'BUTTON' && el.title === 'Click to rename')!;
     await user.click(oldCat);
     const editInput = screen.getByDisplayValue('OldCat');
     await user.clear(editInput);
diff --git a/client/src/components/Collab/CollabNotes.tsx b/client/src/components/Collab/CollabNotes.tsx
index db3a7b871..c46477bd7 100644
--- a/client/src/components/Collab/CollabNotes.tsx
+++ b/client/src/components/Collab/CollabNotes.tsx
@@ -303,13 +303,13 @@ function CollabNotesHeader({ t, canEdit, setShowSettings, setShowNewModal }: Not
         {t('collab.notes.title')}
       </h3>
       <div style={{ display: 'flex', gap: 4, alignItems: 'center' }}>
-        {canEdit && <button onClick={() => setShowSettings(true)} title={t('collab.notes.categorySettings')}
+        {canEdit && <button type="button" onClick={() => setShowSettings(true)} title={t('collab.notes.categorySettings')}
           style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', width: 28, height: 28, borderRadius: 8, border: 'none', background: 'transparent', cursor: 'pointer', color: 'var(--text-faint)', transition: 'color 0.12s' }}
           onMouseEnter={e => e.currentTarget.style.color = 'var(--text-primary)'}
           onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
           <Settings size={14} />
         </button>}
-        {canEdit && <button onClick={() => setShowNewModal(true)}
+        {canEdit && <button type="button" onClick={() => setShowNewModal(true)}
           style={{ display: 'inline-flex', alignItems: 'center', gap: 4, borderRadius: 99, padding: '6px 12px', background: 'var(--accent)', color: 'var(--accent-text)', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 600, fontFamily: FONT, border: 'none', cursor: 'pointer', whiteSpace: 'nowrap' }}>
           <Plus size={12} />
           {t('collab.notes.new')}
@@ -322,7 +322,7 @@ function CollabNotesHeader({ t, canEdit, setShowSettings, setShowNewModal }: Not
 function CollabCategoryPills({ categories, activeCategory, setActiveCategory, t }: NotesState) {
   return (
     <div style={{ display: 'flex', gap: 4, padding: '8px 12px 0', overflowX: 'auto', flexShrink: 0 }}>
-      <button
+      <button type="button"
         onClick={() => setActiveCategory(null)}
         style={{
           flexShrink: 0, borderRadius: 99, padding: '3px 10px', fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 600, fontFamily: FONT,
@@ -335,7 +335,7 @@ function CollabCategoryPills({ categories, activeCategory, setActiveCategory, t
         {t('collab.notes.all')}
       </button>
       {categories.map(cat => (
-        <button
+        <button type="button"
           key={cat}
           onClick={() => setActiveCategory(prev => prev === cat ? null : cat)}
           style={{
@@ -403,7 +403,8 @@ function ViewNoteModal(S: NotesState) {
         display: 'flex', alignItems: 'center', justifyContent: 'center',
         zIndex: 10000, padding: 16,
       }}
-      onClick={() => setViewingNote(null)}
+      role="presentation"
+      onClick={e => { if (e.target === e.currentTarget) setViewingNote(null) }}
     >
       <div
         style={{
@@ -412,7 +413,6 @@ function ViewNoteModal(S: NotesState) {
           width: 'min(700px, calc(100vw - 32px))', maxHeight: '80vh',
           overflow: 'hidden', display: 'flex', flexDirection: 'column',
         }}
-        onClick={e => e.stopPropagation()}
       >
         <div style={{
           padding: '16px 20px 12px', borderBottom: '1px solid var(--border-primary)',
@@ -430,13 +430,13 @@ function ViewNoteModal(S: NotesState) {
             )}
           </div>
           <div style={{ display: 'flex', gap: 4, flexShrink: 0 }}>
-            {canEdit && <button onClick={() => { setViewingNote(null); setEditingNote(viewingNote) }}
+            {canEdit && <button type="button" onClick={() => { setViewingNote(null); setEditingNote(viewingNote) }}
               style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex', borderRadius: 6 }}
               onMouseEnter={e => e.currentTarget.style.color = 'var(--text-primary)'}
               onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
               <Pencil size={16} />
             </button>}
-            <button onClick={() => setViewingNote(null)}
+            <button type="button" onClick={() => setViewingNote(null)}
               style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex', borderRadius: 6 }}
               onMouseEnter={e => e.currentTarget.style.color = 'var(--text-primary)'}
               onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
@@ -462,17 +462,18 @@ function ViewNoteModal(S: NotesState) {
                           onMouseEnter={e => { e.currentTarget.style.transform = 'scale(1.06)'; e.currentTarget.style.boxShadow = '0 2px 8px rgba(0,0,0,0.15)' }}
                           onMouseLeave={e => { e.currentTarget.style.transform = 'scale(1)'; e.currentTarget.style.boxShadow = 'none' }} />
                       ) : (
-                        <div title={a.original_name} onClick={() => setPreviewFile(a)}
+                        <button type="button" title={a.original_name} onClick={() => setPreviewFile(a)}
                           style={{
                             width: 64, height: 64, borderRadius: 8, cursor: 'pointer',
                             background: a.mime_type === 'application/pdf' ? '#ef44441a' : 'var(--bg-secondary)',
                             display: 'flex', flexDirection: 'column', alignItems: 'center', justifyContent: 'center', gap: 1,
                             transition: 'transform 0.12s, box-shadow 0.12s',
+                            border: 'none', padding: 0, fontFamily: 'inherit',
                           }}
                           onMouseEnter={e => { e.currentTarget.style.transform = 'scale(1.06)'; e.currentTarget.style.boxShadow = '0 2px 8px rgba(0,0,0,0.15)' }}
                           onMouseLeave={e => { e.currentTarget.style.transform = 'scale(1)'; e.currentTarget.style.boxShadow = 'none' }}>
                           <span style={{ fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 700, color: a.mime_type === 'application/pdf' ? '#ef4444' : 'var(--text-muted)', letterSpacing: 0.3 }}>{ext}</span>
-                        </div>
+                        </button>
                       )}
                       <span style={{ fontSize: 'calc(9px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', textAlign: 'center', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', width: '100%' }}>{a.original_name}</span>
                     </div>
diff --git a/client/src/components/Collab/CollabNotesAuthedImg.tsx b/client/src/components/Collab/CollabNotesAuthedImg.tsx
index c54cd6a49..799eb9820 100644
--- a/client/src/components/Collab/CollabNotesAuthedImg.tsx
+++ b/client/src/components/Collab/CollabNotesAuthedImg.tsx
@@ -1,10 +1,22 @@
 import { useState, useEffect } from 'react'
 import { getAuthUrl } from '../../api/authUrl'
 
-export function AuthedImg({ src, style, onClick, onMouseEnter, onMouseLeave, alt }: { src: string; style?: React.CSSProperties; onClick?: () => void; onMouseEnter?: React.MouseEventHandler<HTMLImageElement>; onMouseLeave?: React.MouseEventHandler<HTMLImageElement>; alt?: string }) {
+export function AuthedImg({ src, style, onClick, onMouseEnter, onMouseLeave, alt }: { src: string; style?: React.CSSProperties; onClick?: () => void; onMouseEnter?: React.MouseEventHandler<HTMLElement>; onMouseLeave?: React.MouseEventHandler<HTMLElement>; alt?: string }) {
   const [authSrc, setAuthSrc] = useState('')
   useEffect(() => {
     getAuthUrl(src, 'download').then(setAuthSrc)
   }, [src])
-  return authSrc ? <img src={authSrc} alt={alt} style={style} onClick={onClick} onMouseEnter={onMouseEnter} onMouseLeave={onMouseLeave} /> : null
+  if (!authSrc) return null
+  // A clickable thumbnail gets a real button around the image so it is
+  // reachable by keyboard. The caller's style stays on the outer box, so the
+  // hover transform/transition still animates the element that carries them.
+  if (onClick) {
+    return (
+      <button type="button" onClick={onClick} onMouseEnter={onMouseEnter} onMouseLeave={onMouseLeave}
+        style={{ ...style, padding: 0, border: 'none', background: 'none', display: 'block' }}>
+        <img src={authSrc} alt={alt} style={{ ...style, width: '100%', height: '100%', display: 'block' }} />
+      </button>
+    )
+  }
+  return <img src={authSrc} alt={alt} style={style} onMouseEnter={onMouseEnter} onMouseLeave={onMouseLeave} />
 }
diff --git a/client/src/components/Collab/CollabNotesCard.tsx b/client/src/components/Collab/CollabNotesCard.tsx
index e9fae8547..7eaa2ff11 100644
--- a/client/src/components/Collab/CollabNotesCard.tsx
+++ b/client/src/components/Collab/CollabNotesCard.tsx
@@ -80,26 +80,26 @@ export function NoteCard({ note, currentUser, canEdit, onUpdate, onDelete, onEdi
             display: 'flex', gap: 2,
           }}>
             {note.content && (
-              <button onClick={() => onView?.(note)} title={t('collab.notes.expand') || 'Expand'}
+              <button type="button" onClick={() => onView?.(note)} title={t('collab.notes.expand') || 'Expand'}
                 style={{ padding: 3, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex' }}
                 onMouseEnter={e => e.currentTarget.style.color = 'var(--text-primary)'}
                 onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
                 <Maximize2 size={10} />
               </button>
             )}
-            {canEdit && <button onClick={handleTogglePin} title={note.pinned ? t('collab.notes.unpin') : t('collab.notes.pin')}
+            {canEdit && <button type="button" onClick={handleTogglePin} title={note.pinned ? t('collab.notes.unpin') : t('collab.notes.pin')}
               style={{ padding: 3, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex' }}
               onMouseEnter={e => e.currentTarget.style.color = color}
               onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
               {note.pinned ? <PinOff size={10} /> : <Pin size={10} />}
             </button>}
-            {canEdit && <button onClick={() => onEdit?.(note)} title={t('collab.notes.edit')}
+            {canEdit && <button type="button" onClick={() => onEdit?.(note)} title={t('collab.notes.edit')}
               style={{ padding: 3, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex' }}
               onMouseEnter={e => e.currentTarget.style.color = 'var(--text-primary)'}
               onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
               <Pencil size={10} />
             </button>}
-            {canEdit && <button onClick={handleDelete} title={t('collab.notes.delete')}
+            {canEdit && <button type="button" onClick={handleDelete} title={t('collab.notes.delete')}
               style={{ padding: 3, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex' }}
               onMouseEnter={e => e.currentTarget.style.color = '#ef4444'}
               onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
@@ -171,17 +171,18 @@ export function NoteCard({ note, currentUser, canEdit, onUpdate, onDelete, onEdi
                         onMouseEnter={e => { e.currentTarget.style.transform = 'scale(1.08)'; e.currentTarget.style.boxShadow = '0 2px 8px rgba(0,0,0,0.15)' }}
                         onMouseLeave={e => { e.currentTarget.style.transform = 'scale(1)'; e.currentTarget.style.boxShadow = 'none' }} />
                     ) : (
-                      <div key={a.id} title={a.original_name} onClick={() => onPreviewFile?.(a)}
+                      <button type="button" key={a.id} title={a.original_name} aria-label={a.original_name} onClick={() => onPreviewFile?.(a)}
                         style={{
                           width: 48, height: 48, borderRadius: 8, cursor: 'pointer',
                           background: a.mime_type === 'application/pdf' ? '#ef44441a' : 'var(--bg-secondary)',
+                          border: 'none', padding: 0, fontFamily: 'inherit',
                           display: 'flex', flexDirection: 'column', alignItems: 'center', justifyContent: 'center', gap: 1,
                           transition: 'transform 0.12s, box-shadow 0.12s',
                         }}
                         onMouseEnter={e => { e.currentTarget.style.transform = 'scale(1.08)'; e.currentTarget.style.boxShadow = '0 2px 8px rgba(0,0,0,0.15)' }}
                         onMouseLeave={e => { e.currentTarget.style.transform = 'scale(1)'; e.currentTarget.style.boxShadow = 'none' }}>
                         <span style={{ fontSize: 'calc(9px * var(--fs-scale-caption, 1))', fontWeight: 700, color: a.mime_type === 'application/pdf' ? '#ef4444' : 'var(--text-muted)', letterSpacing: 0.3 }}>{ext}</span>
-                      </div>
+                      </button>
                     )
                   })}
                   {(note.attachments?.length || 0) > (note.website ? 1 : 2) && (
diff --git a/client/src/components/Collab/CollabNotesCategorySettingsModal.tsx b/client/src/components/Collab/CollabNotesCategorySettingsModal.tsx
index c54a79ff7..8e4482e16 100644
--- a/client/src/components/Collab/CollabNotesCategorySettingsModal.tsx
+++ b/client/src/components/Collab/CollabNotesCategorySettingsModal.tsx
@@ -69,17 +69,17 @@ export function CategorySettingsModal({ onClose, categories, categoryColors, onS
       position: 'fixed', inset: 0, background: 'var(--overlay-bg, rgba(0,0,0,0.35))',
       backdropFilter: 'blur(6px)', WebkitBackdropFilter: 'blur(6px)',
       display: 'flex', alignItems: 'center', justifyContent: 'center', zIndex: 9999, padding: 16, fontFamily: FONT,
-    }} onClick={onClose}>
+    }} role="presentation" onClick={onClose}>
       <div style={{
         background: 'var(--bg-card)', borderRadius: 16, width: '100%', maxWidth: 420,
         maxHeight: '80vh', overflow: 'auto', border: '1px solid var(--border-faint)',
-      }} onClick={e => e.stopPropagation()}>
+      }} role="presentation" onClick={e => e.stopPropagation()}>
         {/* Header */}
         <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '14px 16px 12px', borderBottom: '1px solid var(--border-faint)' }}>
           <h3 style={{ fontSize: 'calc(14px * var(--fs-scale-body, 1))', fontWeight: 700, color: 'var(--text-primary)', margin: 0 }}>
             {t('collab.notes.categorySettings') || 'Category Settings'}
           </h3>
-          <button onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 2, display: 'flex' }}>
+          <button type="button" onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 2, display: 'flex' }}>
             <X size={16} />
           </button>
         </div>
@@ -96,7 +96,7 @@ export function CategorySettingsModal({ onClose, categories, categoryColors, onS
               {/* Color swatches */}
               <div style={{ display: 'flex', gap: 4 }}>
                 {NOTE_COLORS.map(c => (
-                  <button key={c.value} onClick={() => handleColorChange(cat, c.value)} style={{
+                  <button type="button" key={c.value} onClick={() => handleColorChange(cat, c.value)} style={{
                     width: 20, height: 20, borderRadius: 6, background: c.value, border: 'none', cursor: 'pointer', padding: 0,
                     outline: (localColors[cat] || NOTE_COLORS[0].value) === c.value ? '2px solid var(--text-primary)' : '2px solid transparent',
                     outlineOffset: 1, transition: 'transform 0.1s',
@@ -107,7 +107,7 @@ export function CategorySettingsModal({ onClose, categories, categoryColors, onS
               {/* Category name — editable */}
               <EditableCatName name={cat} onRename={(newName) => handleRenameCategory(cat, newName)} />
               {/* Delete */}
-              <button onClick={() => handleRemoveCategory(cat)} style={{
+              <button type="button" onClick={() => handleRemoveCategory(cat)} style={{
                 background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 3, display: 'flex',
               }}
                 onMouseEnter={e => e.currentTarget.style.color = '#ef4444'}
@@ -126,7 +126,7 @@ export function CategorySettingsModal({ onClose, categories, categoryColors, onS
                 flex: 1, border: '1px solid var(--border-primary)', borderRadius: 10, padding: '8px 12px',
                 fontSize: 'calc(13px * var(--fs-scale-body, 1))', background: 'var(--bg-input)', color: 'var(--text-primary)', fontFamily: 'inherit', outline: 'none',
               }} />
-            <button onClick={handleAddCategory} disabled={!newCatName.trim()} style={{
+            <button type="button" onClick={handleAddCategory} disabled={!newCatName.trim()} style={{
               background: newCatName.trim() ? 'var(--accent)' : 'var(--border-primary)', color: 'var(--accent-text)',
               border: 'none', borderRadius: 10, padding: '8px 14px', cursor: newCatName.trim() ? 'pointer' : 'default',
               display: 'flex', alignItems: 'center', flexShrink: 0,
@@ -136,7 +136,7 @@ export function CategorySettingsModal({ onClose, categories, categoryColors, onS
           </div>
 
           {/* Save */}
-          <button onClick={handleSave} style={{
+          <button type="button" onClick={handleSave} style={{
             width: '100%', borderRadius: 99, padding: '9px 14px', background: 'var(--accent)', color: 'var(--accent-text)',
             fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, border: 'none', cursor: 'pointer', marginTop: 8,
           }}>
diff --git a/client/src/components/Collab/CollabNotesEditableCatName.tsx b/client/src/components/Collab/CollabNotesEditableCatName.tsx
index 35f542608..ac396073a 100644
--- a/client/src/components/Collab/CollabNotesEditableCatName.tsx
+++ b/client/src/components/Collab/CollabNotesEditableCatName.tsx
@@ -25,10 +25,10 @@ export function EditableCatName({ name, onRename }: EditableCatNameProps) {
   }
 
   return (
-    <span onClick={() => { setValue(name); setEditing(true) }}
-      style={{ flex: 1, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, color: 'var(--text-primary)', cursor: 'pointer', padding: '2px 0' }}
+    <button type="button" onClick={() => { setValue(name); setEditing(true) }}
+      style={{ flex: 1, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, color: 'var(--text-primary)', cursor: 'pointer', padding: '2px 0', background: 'none', border: 'none', textAlign: 'left', fontFamily: 'inherit' }}
       title="Click to rename">
       {name}
-    </span>
+    </button>
   )
 }
diff --git a/client/src/components/Collab/CollabNotesFilePreviewPortal.tsx b/client/src/components/Collab/CollabNotesFilePreviewPortal.tsx
index 78d2c9150..acf48e058 100644
--- a/client/src/components/Collab/CollabNotesFilePreviewPortal.tsx
+++ b/client/src/components/Collab/CollabNotesFilePreviewPortal.tsx
@@ -28,10 +28,10 @@ export function FilePreviewPortal({ file, onClose }: FilePreviewPortalProps) {
   const openInNewTab = () => openFile(rawUrl).catch(() => {})
 
   return createPortal(
-    <div style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.88)', zIndex: 10000, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }} onClick={onClose}>
+    <div style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.88)', zIndex: 10000, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }} role="presentation" onClick={onClose}>
       {isImage ? (
         /* Image lightbox — floating controls */
-        <div style={{ position: 'relative', maxWidth: '90vw', maxHeight: '90vh' }} onClick={e => e.stopPropagation()}>
+        <div style={{ position: 'relative', maxWidth: '90vw', maxHeight: '90vh' }} role="presentation" onClick={e => e.stopPropagation()}>
           {authUrl
             ? <img src={authUrl} alt={file.original_name} style={{ maxWidth: '90vw', maxHeight: '90vh', objectFit: 'contain', borderRadius: 8, display: 'block' }} />
             : <Loader2 size={32} className="animate-spin text-[rgba(255,255,255,0.5)]" />
@@ -39,30 +39,30 @@ export function FilePreviewPortal({ file, onClose }: FilePreviewPortalProps) {
           <div style={{ position: 'absolute', top: -36, left: 0, right: 0, display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '0 4px' }}>
             <span style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'rgba(255,255,255,0.7)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', maxWidth: '70%' }}>{file.original_name}</span>
             <div style={{ display: 'flex', gap: 8 }}>
-              <button onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.7)', display: 'flex', padding: 0 }}><ExternalLink size={15} /></button>
-              <button onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.7)', display: 'flex', padding: 0 }}><X size={17} /></button>
+              <button type="button" onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.7)', display: 'flex', padding: 0 }}><ExternalLink size={15} /></button>
+              <button type="button" onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.7)', display: 'flex', padding: 0 }}><X size={17} /></button>
             </div>
           </div>
         </div>
       ) : (
         /* Document viewer — card with header */
-        <div style={{ width: '100%', maxWidth: 950, height: '94vh', display: 'flex', flexDirection: 'column', background: 'var(--bg-card)', borderRadius: 12, overflow: 'hidden', boxShadow: '0 20px 60px rgba(0,0,0,0.3)' }} onClick={e => e.stopPropagation()}>
+        <div style={{ width: '100%', maxWidth: 950, height: '94vh', display: 'flex', flexDirection: 'column', background: 'var(--bg-card)', borderRadius: 12, overflow: 'hidden', boxShadow: '0 20px 60px rgba(0,0,0,0.3)' }} role="presentation" onClick={e => e.stopPropagation()}>
           <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '10px 16px', borderBottom: '1px solid var(--border-primary)', flexShrink: 0 }}>
             <span style={{ fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, color: 'var(--text-primary)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', flex: 1 }}>{file.original_name}</span>
             <div style={{ display: 'flex', gap: 8, flexShrink: 0 }}>
-              <button onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center', gap: 3, fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-muted)', padding: 0 }}><ExternalLink size={13} /></button>
-              <button onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex', padding: 2 }}><X size={18} /></button>
+              <button type="button" onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center', gap: 3, fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-muted)', padding: 0 }}><ExternalLink size={13} /></button>
+              <button type="button" onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex', padding: 2 }}><X size={18} /></button>
             </div>
           </div>
           {(isPdf || isTxt) ? (
             <object data={authUrl ? `${authUrl}#view=FitH` : ''} type={file.mime_type} style={{ flex: 1, width: '100%', border: 'none', background: '#fff' }} title={file.original_name}>
               <p style={{ padding: 24, textAlign: 'center', color: 'var(--text-muted)' }}>
-                <button onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-primary)', textDecoration: 'underline', fontSize: 'calc(14px * var(--fs-scale-body, 1))', padding: 0 }}>Download</button>
+                <button type="button" onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-primary)', textDecoration: 'underline', fontSize: 'calc(14px * var(--fs-scale-body, 1))', padding: 0 }}>Download</button>
               </p>
             </object>
           ) : (
             <div style={{ flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 40 }}>
-              <button onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-primary)', textDecoration: 'underline', fontSize: 'calc(14px * var(--fs-scale-body, 1))', padding: 0 }}>Download {file.original_name}</button>
+              <button type="button" onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-primary)', textDecoration: 'underline', fontSize: 'calc(14px * var(--fs-scale-body, 1))', padding: 0 }}>Download {file.original_name}</button>
             </div>
           )}
         </div>
diff --git a/client/src/components/Collab/CollabNotesFormModal.tsx b/client/src/components/Collab/CollabNotesFormModal.tsx
index e6b6cd2ac..289995c8e 100644
--- a/client/src/components/Collab/CollabNotesFormModal.tsx
+++ b/client/src/components/Collab/CollabNotesFormModal.tsx
@@ -84,6 +84,7 @@ export function NoteFormModal({ onClose, onSubmit, onDeleteFile, existingCategor
       }}
     >
       <form
+        role="presentation"
         style={{
           background: 'var(--bg-card)',
           borderRadius: 16,
diff --git a/client/src/components/Collab/CollabPanel.tsx b/client/src/components/Collab/CollabPanel.tsx
index e75f5e3f2..98100b01b 100644
--- a/client/src/components/Collab/CollabPanel.tsx
+++ b/client/src/components/Collab/CollabPanel.tsx
@@ -170,7 +170,7 @@ export default function CollabPanel({ tripId, tripMembers = [], collabFeatures }
         {tabs.map(tab => {
           const active = mobileTab === tab.id
           return (
-            <button key={tab.id} onClick={() => setMobileTab(tab.id)} style={{
+            <button type="button" key={tab.id} onClick={() => setMobileTab(tab.id)} style={{
               flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 6,
               padding: '8px 0', borderRadius: 10, border: 'none', cursor: 'pointer',
               background: active ? 'var(--accent)' : 'transparent',
diff --git a/client/src/components/Collab/CollabPolls.test.tsx b/client/src/components/Collab/CollabPolls.test.tsx
index 5840333aa..2981db8df 100644
--- a/client/src/components/Collab/CollabPolls.test.tsx
+++ b/client/src/components/Collab/CollabPolls.test.tsx
@@ -55,7 +55,7 @@ beforeEach(() => {
 describe('CollabPolls', () => {
   it('FE-COMP-POLLS-001: renders empty state when no polls exist', async () => {
     render(<CollabPolls {...defaultProps} />);
-    await screen.findByText(/no polls yet|collab\.polls\.empty/i);
+    expect(await screen.findByText(/no polls yet|collab\.polls\.empty/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-POLLS-002: shows loading spinner initially', async () => {
@@ -79,7 +79,7 @@ describe('CollabPolls', () => {
       ),
     );
     render(<CollabPolls {...defaultProps} />);
-    await screen.findByText('Best destination?');
+    expect(await screen.findByText('Best destination?')).toBeInTheDocument();
   });
 
   it('FE-COMP-POLLS-004: renders poll options', async () => {
@@ -108,7 +108,7 @@ describe('CollabPolls', () => {
     await screen.findByText(/no polls yet|collab\.polls\.empty/i);
     await user.click(screen.getByRole('button', { name: /new/i }));
     // Modal has a question placeholder input
-    await screen.findByPlaceholderText(/what should we do/i);
+    expect(await screen.findByPlaceholderText(/what should we do/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-POLLS-007: create modal requires question and at least 2 options to enable submit', async () => {
@@ -153,7 +153,7 @@ describe('CollabPolls', () => {
     await user.type(optionInputs[1], 'Japanese');
 
     await user.click(screen.getByRole('button', { name: /create|collab\.polls\.create/i }));
-    await screen.findByText('Where to eat?');
+    expect(await screen.findByText('Where to eat?')).toBeInTheDocument();
   });
 
   it('FE-COMP-POLLS-009: voting on an option calls POST vote API', async () => {
@@ -188,7 +188,7 @@ describe('CollabPolls', () => {
       ),
     );
     render(<CollabPolls {...defaultProps} />);
-    await screen.findByText(/closed/i);
+    expect(await screen.findByText(/closed/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-POLLS-011: closed poll options are disabled (cannot vote)', async () => {
@@ -236,7 +236,7 @@ describe('CollabPolls', () => {
     const listener = (addListener as ReturnType<typeof vi.fn>).mock.calls[0][0];
     listener({ tripId: 1, type: 'collab:poll:created', poll: buildPoll({ id: 77, question: 'Live poll?' }) });
 
-    await screen.findByText('Live poll?');
+    expect(await screen.findByText('Live poll?')).toBeInTheDocument();
   });
 
   it('FE-COMP-POLLS-014: WebSocket collab:poll:deleted event removes poll', async () => {
@@ -337,7 +337,7 @@ describe('CollabPolls details', () => {
   it('FE-W5CPL-005: a poll served as a bare array is rendered', async () => {
     servePolls([buildPoll({ question: 'Array shaped?' })]);
     render(<CollabPolls {...defaultProps} />);
-    await screen.findByText('Array shaped?');
+    expect(await screen.findByText('Array shaped?')).toBeInTheDocument();
   });
 
   it('FE-W5CPL-006: options without a voters array count as zero votes', async () => {
@@ -484,13 +484,13 @@ describe('CollabPolls details', () => {
       http.get('/api/trips/1/collab/polls', () => new HttpResponse(null, { status: 500 })),
     );
     render(<CollabPolls {...defaultProps} />);
-    await screen.findByText(/no polls yet|collab\.polls\.empty/i);
+    expect(await screen.findByText(/no polls yet|collab\.polls\.empty/i)).toBeInTheDocument();
   });
 
   it('FE-W5CPL-028: a payload without a polls key yields an empty list', async () => {
     servePolls({});
     render(<CollabPolls {...defaultProps} />);
-    await screen.findByText(/no polls yet|collab\.polls\.empty/i);
+    expect(await screen.findByText(/no polls yet|collab\.polls\.empty/i)).toBeInTheDocument();
   });
 
   it('FE-W5CPL-015: a failing close shows an error and leaves the poll open', async () => {
diff --git a/client/src/components/Collab/CollabPolls.tsx b/client/src/components/Collab/CollabPolls.tsx
index f2b181a59..969b7a1a6 100644
--- a/client/src/components/Collab/CollabPolls.tsx
+++ b/client/src/components/Collab/CollabPolls.tsx
@@ -88,8 +88,8 @@ function CreatePollModal({ onClose, onCreate, t }: CreatePollModalProps) {
   }
 
   return createPortal(
-    <div style={{ position: 'fixed', inset: 0, background: 'var(--overlay-bg, rgba(0,0,0,0.35))', backdropFilter: 'blur(6px)', WebkitBackdropFilter: 'blur(6px)', display: 'flex', alignItems: 'center', justifyContent: 'center', zIndex: 9999, padding: 16, fontFamily: FONT }} onClick={onClose}>
-      <form style={{ background: 'var(--bg-card)', borderRadius: 16, width: '100%', maxWidth: 400, maxHeight: '90vh', overflow: 'auto', border: '1px solid var(--border-faint)' }} onClick={e => e.stopPropagation()} onSubmit={handleSubmit}>
+    <div role="presentation" style={{ position: 'fixed', inset: 0, background: 'var(--overlay-bg, rgba(0,0,0,0.35))', backdropFilter: 'blur(6px)', WebkitBackdropFilter: 'blur(6px)', display: 'flex', alignItems: 'center', justifyContent: 'center', zIndex: 9999, padding: 16, fontFamily: FONT }} onClick={e => { if (e.target === e.currentTarget) onClose() }}>
+      <form style={{ background: 'var(--bg-card)', borderRadius: 16, width: '100%', maxWidth: 400, maxHeight: '90vh', overflow: 'auto', border: '1px solid var(--border-faint)' }} onSubmit={handleSubmit}>
         <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '14px 16px 12px', borderBottom: '1px solid var(--border-faint)' }}>
           <h3 style={{ fontSize: 'calc(14px * var(--fs-scale-body, 1))', fontWeight: 700, color: 'var(--text-primary)', margin: 0 }}>{t('collab.polls.new')}</h3>
           <button type="button" onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 2, display: 'flex' }}><X size={16} /></button>
@@ -122,13 +122,13 @@ function CreatePollModal({ onClose, onCreate, t }: CreatePollModalProps) {
 
           {/* Multi choice toggle */}
           <label style={{ display: 'flex', alignItems: 'center', gap: 8, cursor: 'pointer' }}>
-            <div onClick={() => setMultiChoice(!multiChoice)} style={{
-              width: 36, height: 20, borderRadius: 10, padding: 2, cursor: 'pointer',
+            <button type="button" role="switch" aria-checked={multiChoice} onClick={() => setMultiChoice(!multiChoice)} style={{
+              width: 36, height: 20, borderRadius: 10, padding: 2, cursor: 'pointer', border: 'none',
               background: multiChoice ? '#007AFF' : 'var(--border-primary)', transition: 'background 0.2s',
               display: 'flex', alignItems: 'center',
             }}>
               <div style={{ width: 16, height: 16, borderRadius: '50%', background: '#fff', transition: 'transform 0.2s', transform: multiChoice ? 'translateX(16px)' : 'translateX(0)' }} />
-            </div>
+            </button>
             <span style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-muted)', fontFamily: FONT }}>{t('collab.polls.multiChoice')}</span>
           </label>
 
@@ -174,7 +174,7 @@ function VoterChip({ voter, offset }: VoterChipProps) {
           fontSize: 'calc(7px * var(--fs-scale-caption, 1))', fontWeight: 700, color: 'var(--text-muted)', overflow: 'hidden',
           border: '1.5px solid var(--bg-card)', marginLeft: offset ? -5 : 0, flexShrink: 0,
         }}>
-        {voter.avatar_url ? <img src={voter.avatar_url} style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : (voter.username || '?')[0].toUpperCase()}
+        {voter.avatar_url ? <img src={voter.avatar_url} alt={voter.username || ''} style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : (voter.username || '?')[0].toUpperCase()}
       </div>
       {hover && createPortal(
         <div style={{
@@ -250,14 +250,14 @@ function PollCard({ poll, currentUser, canEdit, onVote, onClose, onDelete, t }:
         {canEdit && (
           <div style={{ display: 'flex', gap: 2, flexShrink: 0 }}>
             {!isClosed && (
-              <button onClick={() => onClose(poll.id)} title={t('collab.polls.close')}
+              <button type="button" onClick={() => onClose(poll.id)} title={t('collab.polls.close')}
                 style={{ padding: 4, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex', borderRadius: 6 }}
                 onMouseEnter={e => e.currentTarget.style.color = 'var(--text-primary)'}
                 onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
                 <Lock size={12} />
               </button>
             )}
-            <button onClick={() => onDelete(poll.id)} title={t('collab.polls.delete')}
+            <button type="button" onClick={() => onDelete(poll.id)} title={t('collab.polls.delete')}
               style={{ padding: 4, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex', borderRadius: 6 }}
               onMouseEnter={e => e.currentTarget.style.color = '#ef4444'}
               onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
@@ -278,7 +278,7 @@ function PollCard({ poll, currentUser, canEdit, onVote, onClose, onDelete, t }:
           return (
             // React dispatches no mouse events on a disabled control, so the
             // handlers below need no isClosed guard of their own.
-            <button key={idx} onClick={() => onVote(poll.id, idx)}
+            <button type="button" key={idx} onClick={() => onVote(poll.id, idx)}
               disabled={isClosed}
               style={{
                 position: 'relative', display: 'flex', alignItems: 'center', gap: 8,
@@ -465,7 +465,7 @@ export default function CollabPolls({ tripId, currentUser }: CollabPollsProps) {
           {t('collab.polls.title')}
         </h3>
         {canEdit && (
-          <button onClick={() => setShowForm(true)} style={{
+          <button type="button" onClick={() => setShowForm(true)} style={{
             display: 'inline-flex', alignItems: 'center', gap: 4, borderRadius: 99, padding: '6px 12px',
             background: 'var(--accent)', color: 'var(--accent-text)', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 600,
             fontFamily: FONT, border: 'none', cursor: 'pointer',
diff --git a/client/src/components/Collab/WhatsNextWidget.tsx b/client/src/components/Collab/WhatsNextWidget.tsx
index 2a3b08cfa..55745cd0e 100644
--- a/client/src/components/Collab/WhatsNextWidget.tsx
+++ b/client/src/components/Collab/WhatsNextWidget.tsx
@@ -179,7 +179,7 @@ export default function WhatsNextWidget({ tripMembers = [] }: WhatsNextWidgetPro
                                 overflow: 'hidden', flexShrink: 0,
                               }}>
                                 {p.avatar
-                                  ? <img src={avatarSrc(p.avatar)!} style={{ width: '100%', height: '100%', objectFit: 'cover' }} />
+                                  ? <img src={avatarSrc(p.avatar)!} alt="" style={{ width: '100%', height: '100%', objectFit: 'cover' }} />
                                   : p.username?.[0]?.toUpperCase()
                                 }
                               </div>
diff --git a/client/src/components/Collections/AddPlaceToCollectionModal.tsx b/client/src/components/Collections/AddPlaceToCollectionModal.tsx
index da2117dc8..fca0a8864 100644
--- a/client/src/components/Collections/AddPlaceToCollectionModal.tsx
+++ b/client/src/components/Collections/AddPlaceToCollectionModal.tsx
@@ -97,8 +97,8 @@ export default function AddPlaceToCollectionModal({ isOpen, collectionId, collec
     const cleanName = name.trim()
     if (!cleanName) return
     const cleanLinks = links.map(l => ({ label: l.label?.trim() || undefined, url: normalizeLinkUrl(l.url) })).filter(l => l.url)
-    const latNum = lat.trim() ? Number(lat) : NaN
-    const lngNum = lng.trim() ? Number(lng) : NaN
+    const latNum = lat.trim() ? Number(lat) : Number.NaN
+    const lngNum = lng.trim() ? Number(lng) : Number.NaN
     setSaving(true)
     try {
       const res = await collectionsApi.savePlace({
@@ -135,7 +135,10 @@ export default function AddPlaceToCollectionModal({ isOpen, collectionId, collec
 
   const coordPaste = (e: React.ClipboardEvent<HTMLInputElement>) => {
     const text = e.clipboardData.getData('text').trim()
-    const match = text.match(/^(-?\d+\.?\d*)\s*[,;\s]\s*(-?\d+\.?\d*)$/)
+    // Same pairs as before, written so no two quantifiers can claim the same
+    // character. In the old form `\d+\.?\d*` and `\s*[,;\s]\s*` were both ambiguous,
+    // which backtracks in O(n^4): a pasted 2 kB of digits and spaces froze the tab.
+    const match = text.match(/^(-?\d+(?:\.\d*)?)(?:\s*[,;]\s*|\s+)(-?\d+(?:\.\d*)?)$/)
     if (match) { e.preventDefault(); setLat(match[1]); setLng(match[2]) }
   }
   const coordInputClass = 'w-full px-3 py-2 rounded-lg border border-edge bg-surface-input text-content text-[14px] outline-none focus:border-accent'
diff --git a/client/src/components/Collections/CollectionPlaceDetail.tsx b/client/src/components/Collections/CollectionPlaceDetail.tsx
index 7a3166b50..e48da127c 100644
--- a/client/src/components/Collections/CollectionPlaceDetail.tsx
+++ b/client/src/components/Collections/CollectionPlaceDetail.tsx
@@ -152,15 +152,15 @@ export default function CollectionPlaceDetail({
   const resetForm = () => { setEditing(false); setName(place.name); setCategoryId(place.category_id ?? null); setDescription(place.description ?? ''); setLinks(place.links ?? []); setLabelIds(place.label_ids ?? []); setAddress(place.address ?? ''); setLat(place.lat != null ? String(place.lat) : ''); setLng(place.lng != null ? String(place.lng) : '') }
   const coordPaste = (e: React.ClipboardEvent<HTMLInputElement>) => {
     const text = e.clipboardData.getData('text').trim()
-    const match = text.match(/^(-?\d+\.?\d*)\s*[,;\s]\s*(-?\d+\.?\d*)$/)
+    const match = text.match(/^(-?\d+(?:\.\d*)?)(?:\s*[,;]\s*|\s+)(-?\d+(?:\.\d*)?)$/)
     if (match) { e.preventDefault(); setLat(match[1]); setLng(match[2]) }
   }
   const assignedLabels = labels.filter(l => (place.label_ids ?? []).includes(l.id))
 
   const save = async () => {
     const cleanLinks = links.map(l => ({ label: l.label?.trim() || undefined, url: normalizeLinkUrl(l.url) })).filter(l => l.url)
-    const latNum = lat.trim() ? Number(lat) : NaN
-    const lngNum = lng.trim() ? Number(lng) : NaN
+    const latNum = lat.trim() ? Number(lat) : Number.NaN
+    const lngNum = lng.trim() ? Number(lng) : Number.NaN
     setSaving(true)
     try {
       await onSave({ name: name.trim() || place.name, description: description.trim() || null, links: cleanLinks, category_id: categoryId, label_ids: labelIds, address: address.trim() || null, lat: Number.isFinite(latNum) ? latNum : null, lng: Number.isFinite(lngNum) ? lngNum : null })
@@ -176,7 +176,7 @@ export default function CollectionPlaceDetail({
   const CatIcon = getCategoryIcon(place.category?.icon)
 
   return (
-    <div className={`col-detail${anchorRect ? ' docked' : ''}`} style={dockStyle} onClick={e => e.stopPropagation()}>
+    <div className={`col-detail${anchorRect ? ' docked' : ''}`} style={dockStyle} role="presentation" onClick={e => e.stopPropagation()}>
       <div className="col-detail-cover" style={banner ? undefined : { backgroundImage: entityGradient(place.id) }}>
         {banner && <img src={banner} alt="" />}
         <div className="col-detail-cover-scrim" />
diff --git a/client/src/components/Collections/StatusBadge.tsx b/client/src/components/Collections/StatusBadge.tsx
index a118ce511..3b79bc72d 100644
--- a/client/src/components/Collections/StatusBadge.tsx
+++ b/client/src/components/Collections/StatusBadge.tsx
@@ -51,7 +51,7 @@ export default function StatusBadge({ status, onChange, showLabel = true, size =
     return <span className={className} title={label}>{content}</span>
   }
 
-  // Rendered as a role=button span (not a native <button>) on purpose: inside
+  // Rendered as a role=button span (not a native <button type="button">) on purpose: inside
   // the .trek-dash scope the global `.trek-dash button` reset would strip the
   // pill's background/border/padding, and the pill also has to sit inside the
   // grid card's own clickable element without nesting one button in another.
diff --git a/client/src/components/Dashboard/CollectionsWidget.tsx b/client/src/components/Dashboard/CollectionsWidget.tsx
index e71ce152a..ea8963c2f 100644
--- a/client/src/components/Dashboard/CollectionsWidget.tsx
+++ b/client/src/components/Dashboard/CollectionsWidget.tsx
@@ -38,7 +38,7 @@ export default function CollectionsWidget({ onOpen }: { onOpen: () => void }): R
     <div className="tool">
       <div className="tool-head">
         <div className="tool-title"><Bookmark size={14} /> {t('collections.widget.title')}</div>
-        <button className="tool-action" aria-label={t('collections.widget.title')} onClick={onOpen}>
+        <button type="button" className="tool-action" aria-label={t('collections.widget.title')} onClick={onOpen}>
           <ArrowRight size={14} />
         </button>
       </div>
@@ -47,7 +47,7 @@ export default function CollectionsWidget({ onOpen }: { onOpen: () => void }): R
       ) : (
         <div className="col-badges">
           {lists.slice(0, 6).map(list => (
-            <button
+            <button type="button"
               key={list.id}
               className="col-badge"
               style={{ ['--badge-color' as string]: list.color || '#6366f1' }}
diff --git a/client/src/components/Files/FileManager.test.tsx b/client/src/components/Files/FileManager.test.tsx
index 478caf79f..0ff151f32 100644
--- a/client/src/components/Files/FileManager.test.tsx
+++ b/client/src/components/Files/FileManager.test.tsx
@@ -176,7 +176,7 @@ describe('FileManager', () => {
     await user.click(trashBtn);
 
     // Trashed file should appear
-    await screen.findByText('old.pdf');
+    expect(await screen.findByText('old.pdf')).toBeInTheDocument();
   });
 
   it('FE-COMP-FILEMANAGER-007: restore button calls filesApi.restore', async () => {
@@ -407,7 +407,7 @@ describe('FileManager', () => {
     const assignBtn = screen.getByTitle(/assign/i);
     await user.click(assignBtn);
 
-    await screen.findByText('Eiffel Tower');
+    expect(await screen.findByText('Eiffel Tower')).toBeInTheDocument();
   });
 
   it('FE-COMP-FILEMANAGER-021: file description is shown when present', () => {
@@ -445,7 +445,7 @@ describe('FileManager', () => {
     const assignBtn = screen.getByTitle(/assign/i);
     await user.click(assignBtn);
 
-    await screen.findByText('Hotel Paris');
+    expect(await screen.findByText('Hotel Paris')).toBeInTheDocument();
   });
 
   it('FE-COMP-FILEMANAGER-024: clicking a place in assign modal calls filesApi.update', async () => {
@@ -492,7 +492,7 @@ describe('FileManager', () => {
 
     await user.click(screen.getByTitle(/assign/i));
     await screen.findByText('Notre Dame');
-    await screen.findByText('Airbnb');
+    expect(await screen.findByText('Airbnb')).toBeInTheDocument();
   });
 
   it('FE-COMP-FILEMANAGER-027: paste event uploads file when user can upload', async () => {
@@ -543,7 +543,7 @@ describe('FileManager', () => {
     const user = userEvent.setup();
 
     await user.click(screen.getByTitle(/assign/i));
-    await screen.findByText('Arc de Triomphe');
+    expect(await screen.findByText('Arc de Triomphe')).toBeInTheDocument();
   });
 
   it('FE-COMP-FILEMANAGER-030: file with linked place shows source badge', async () => {
@@ -554,7 +554,7 @@ describe('FileManager', () => {
     render(<FileManager {...defaultProps} files={[file]} places={[place]} />);
 
     // Source badge text includes place name
-    await screen.findByText(/Colosseum/);
+    expect(await screen.findByText(/Colosseum/)).toBeInTheDocument();
   });
 
   it('FE-COMP-FILEMANAGER-031: unlink place from assign modal calls filesApi.update', async () => {
diff --git a/client/src/components/Files/FileManagerAssignModal.tsx b/client/src/components/Files/FileManagerAssignModal.tsx
index c92ed629e..4e67cfc18 100644
--- a/client/src/components/Files/FileManagerAssignModal.tsx
+++ b/client/src/components/Files/FileManagerAssignModal.tsx
@@ -9,9 +9,9 @@ import { transportIcon } from './FileManager.helpers'
 export function AssignModal(S: FileManagerState) {
   const { files, assignFileId, setAssignFileId, t, days, assignments, places, reservations, tripId, handleAssign, refreshFiles } = S
   return createPortal(
-    <div style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.5)', zIndex: 5000, display: 'flex', alignItems: 'center', justifyContent: 'center' }}
+    <div role="presentation" style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.5)', zIndex: 5000, display: 'flex', alignItems: 'center', justifyContent: 'center' }}
       onClick={() => setAssignFileId(null)}>
-      <div style={{
+      <div role="presentation" style={{
         background: 'var(--bg-card)', borderRadius: 16, boxShadow: '0 20px 60px rgba(0,0,0,0.2)',
         width: 'min(600px, calc(100vw - 32px))', maxHeight: '70vh', overflow: 'hidden', display: 'flex', flexDirection: 'column',
       }} onClick={e => e.stopPropagation()}>
@@ -22,7 +22,7 @@ export function AssignModal(S: FileManagerState) {
               {files.find(f => f.id === assignFileId)?.original_name || ''}
             </div>
           </div>
-          <button onClick={() => setAssignFileId(null)} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 4, display: 'flex', flexShrink: 0 }}>
+          <button type="button" onClick={() => setAssignFileId(null)} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 4, display: 'flex', flexShrink: 0 }}>
             <X size={18} />
           </button>
         </div>
@@ -67,7 +67,7 @@ export function AssignModal(S: FileManagerState) {
             const placeBtn = (p: Place, idx: number) => {
               const isLinked = file.place_id === p.id || (file.linked_place_ids || []).includes(p.id)
               return (
-                <button key={`${p.id}-${idx}`} onClick={async () => {
+                <button type="button" key={`${p.id}-${idx}`} onClick={async () => {
                   if (isLinked) {
                     if (file.place_id === p.id) {
                       await handleAssign(file.id, { place_id: null })
@@ -123,13 +123,13 @@ export function AssignModal(S: FileManagerState) {
                         ) : null
                       })()}
                     </div>
-                    {dayPlaces.map(placeBtn)}
+                    {dayPlaces.map((p, i) => placeBtn(p, i))}
                   </div>
                 ))}
                 {unassigned.length > 0 && (
                   <div>
                     {dayGroups.length > 0 && <div style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 600, color: 'var(--text-muted)', padding: '8px 10px 2px' }}>{t('files.unassigned')}</div>}
-                    {unassigned.map(placeBtn)}
+                    {unassigned.map((p, i) => placeBtn(p, i))}
                   </div>
                 )}
               </div>
@@ -142,7 +142,7 @@ export function AssignModal(S: FileManagerState) {
               const isLinked = file.reservation_id === r.id || (file.linked_reservation_ids || []).includes(r.id)
               const Icon = TRANSPORT_TYPES.has(r.type) ? transportIcon(r.type) : Ticket
               return (
-                <button key={r.id} onClick={async () => {
+                <button type="button" key={r.id} onClick={async () => {
                   if (isLinked) {
                     if (file.reservation_id === r.id) {
                       await handleAssign(file.id, { reservation_id: null })
diff --git a/client/src/components/Files/FileManagerAvatarChip.tsx b/client/src/components/Files/FileManagerAvatarChip.tsx
index 1f0f8582e..b50643255 100644
--- a/client/src/components/Files/FileManagerAvatarChip.tsx
+++ b/client/src/components/Files/FileManagerAvatarChip.tsx
@@ -24,7 +24,7 @@ export function AvatarChip({ name, avatarUrl, size = 20 }: { name: string; avata
           cursor: 'default',
         }}>
         {avatarUrl
-          ? <img src={avatarUrl} style={{ width: '100%', height: '100%', objectFit: 'cover' }} />
+          ? <img src={avatarUrl} alt={name} style={{ width: '100%', height: '100%', objectFit: 'cover' }} />
           : name?.[0]?.toUpperCase()
         }
       </div>
diff --git a/client/src/components/Files/FileManagerFilesView.tsx b/client/src/components/Files/FileManagerFilesView.tsx
index 377db7102..20fbd26cf 100644
--- a/client/src/components/Files/FileManagerFilesView.tsx
+++ b/client/src/components/Files/FileManagerFilesView.tsx
@@ -51,7 +51,7 @@ export function FilesView(S: FileManagerState) {
           { id: 'doc', label: t('files.filterDocs') },
           ...(files.some(f => f.note_id) ? [{ id: 'collab', label: t('files.filterCollab') || 'Collab' }] : []),
         ].map(tab => (
-          <button key={tab.id} onClick={() => setFilterType(tab.id)} style={{
+          <button type="button" key={tab.id} onClick={() => setFilterType(tab.id)} style={{
             padding: '4px 12px', borderRadius: 99, border: 'none', cursor: 'pointer', fontSize: 'calc(12px * var(--fs-scale-body, 1))',
             fontFamily: 'inherit', transition: 'all 0.12s',
             background: filterType === tab.id ? 'var(--accent)' : 'transparent',
diff --git a/client/src/components/Files/FileManagerImageLightbox.tsx b/client/src/components/Files/FileManagerImageLightbox.tsx
index aa497850b..cb16d6ae6 100644
--- a/client/src/components/Files/FileManagerImageLightbox.tsx
+++ b/client/src/components/Files/FileManagerImageLightbox.tsx
@@ -53,7 +53,7 @@ export function ImageLightbox({ files, initialIndex, onClose }: ImageLightboxPro
   const hasPrev = index > 0
   const hasNext = index < files.length - 1
   const navBtn = (side: 'left' | 'right', onClick: () => void, show: boolean): React.ReactNode => show ? (
-    <button onClick={e => { e.stopPropagation(); onClick() }}
+    <button type="button" onClick={e => { e.stopPropagation(); onClick() }}
       style={{
         position: 'absolute', top: '50%', [side]: 12, transform: 'translateY(-50%)', zIndex: 10,
         background: 'rgba(0,0,0,0.5)', border: 'none', borderRadius: '50%', width: 40, height: 40,
@@ -68,8 +68,12 @@ export function ImageLightbox({ files, initialIndex, onClose }: ImageLightboxPro
 
   return (
     <div
+      // Backdrop only — Escape and the header's close button do the same job for
+      // the keyboard. Closing on the backdrop's own clicks (rather than letting
+      // every child stop the bubble) keeps the chrome free of click handlers.
+      role="presentation"
       style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.92)', zIndex: 2000, display: 'flex', flexDirection: 'column', paddingBottom: 'var(--bottom-nav-h)' }}
-      onClick={onClose}
+      onClick={e => { if (e.target === e.currentTarget) onClose() }}
       onTouchStart={e => setTouchStart(e.touches[0].clientX)}
       onTouchEnd={e => {
         if (touchStart === null) return
@@ -80,47 +84,47 @@ export function ImageLightbox({ files, initialIndex, onClose }: ImageLightboxPro
       }}
     >
       {/* Header */}
-      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '10px 16px', flexShrink: 0 }} onClick={e => e.stopPropagation()}>
+      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '10px 16px', flexShrink: 0 }}>
         <span style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'rgba(255,255,255,0.7)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', flex: 1 }}>
           {file.original_name}
           <span style={{ marginLeft: 8, color: 'rgba(255,255,255,0.4)' }}>{index + 1} / {files.length}</span>
         </span>
         <div style={{ display: 'flex', gap: 8, flexShrink: 0 }}>
-          <button
+          <button type="button"
             onClick={() => openFileUrl(file.url, file.original_name).catch(() => {})}
             style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.7)', display: 'flex', padding: 4 }}
             title={t('files.openTab')}>
             <ExternalLink size={16} />
           </button>
-          <button
+          <button type="button"
             onClick={() => triggerDownload(file.url, file.original_name)}
             style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.7)', display: 'flex', padding: 4 }}
             title={t('files.download') || 'Download'}>
             <Download size={16} />
           </button>
-          <button onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.7)', display: 'flex', padding: 4 }}>
+          <button type="button" onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.7)', display: 'flex', padding: 4 }}>
             <X size={18} />
           </button>
         </div>
       </div>
 
       {/* Main image + nav */}
-      <div style={{ flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', position: 'relative', minHeight: 0 }}
+      <div role="presentation" style={{ flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', position: 'relative', minHeight: 0 }}
         onClick={e => { if (e.target === e.currentTarget) onClose() }}>
         {navBtn('left', goPrev, hasPrev)}
         {fileIsVideo ? (
-          <div onClick={e => e.stopPropagation()}>
+          <div>
             <VideoPlayer src={file.url} style={{ maxWidth: '85vw', maxHeight: '80vh', borderRadius: 8 }} />
           </div>
         ) : (
-          imgSrc && <img src={imgSrc} alt={file.original_name} style={{ maxWidth: '85vw', maxHeight: '80vh', objectFit: 'contain', borderRadius: 8, display: 'block' }} onClick={e => e.stopPropagation()} />
+          imgSrc && <img src={imgSrc} alt={file.original_name} style={{ maxWidth: '85vw', maxHeight: '80vh', objectFit: 'contain', borderRadius: 8, display: 'block' }} />
         )}
         {navBtn('right', goNext, hasNext)}
       </div>
 
       {/* Thumbnail strip */}
       {files.length > 1 && (
-        <div style={{ display: 'flex', gap: 4, justifyContent: 'center', padding: '10px 16px', flexShrink: 0, overflowX: 'auto' }} onClick={e => e.stopPropagation()}>
+        <div style={{ display: 'flex', gap: 4, justifyContent: 'center', padding: '10px 16px', flexShrink: 0, overflowX: 'auto' }}>
           {files.map((f, i) => (
             <ThumbImg key={f.id} file={f} active={i === index} onClick={() => setIndex(i)} />
           ))}
@@ -156,7 +160,7 @@ function ThumbImg({ file, active, onClick }: { file: TripFile & { url: string };
   }, [file.url, fileIsVideo, visible])
 
   return (
-    <button ref={ref} onClick={onClick} style={{
+    <button type="button" ref={ref} onClick={onClick} style={{
       width: 48, height: 48, borderRadius: 6, overflow: 'hidden', border: active ? '2px solid #fff' : '2px solid transparent',
       opacity: active ? 1 : 0.5, cursor: 'pointer', padding: 0, background: '#111', flexShrink: 0, transition: 'opacity 0.15s',
       display: 'flex', alignItems: 'center', justifyContent: 'center', color: 'rgba(255,255,255,0.7)',
diff --git a/client/src/components/Files/FileManagerMarkdownPreviewModal.tsx b/client/src/components/Files/FileManagerMarkdownPreviewModal.tsx
index bfab94991..c5461fe0c 100644
--- a/client/src/components/Files/FileManagerMarkdownPreviewModal.tsx
+++ b/client/src/components/Files/FileManagerMarkdownPreviewModal.tsx
@@ -34,27 +34,29 @@ export function MarkdownPreviewModal(S: FileManagerState) {
 
   return createPortal(
     <div
+      role="presentation"
       style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.85)', zIndex: 10000, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
       onClick={() => setPreviewFile(null)}
     >
       <div
+        role="presentation"
         style={{ width: '100%', maxWidth: 820, height: '94vh', background: 'var(--bg-card)', borderRadius: 12, overflow: 'hidden', display: 'flex', flexDirection: 'column', boxShadow: '0 20px 60px rgba(0,0,0,0.3)' }}
         onClick={e => e.stopPropagation()}
       >
         <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '10px 16px', borderBottom: '1px solid var(--border-primary)', flexShrink: 0 }}>
           <span style={{ fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, color: 'var(--text-primary)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', flex: 1 }}>{previewFile.original_name}</span>
           <div style={{ display: 'flex', alignItems: 'center', gap: 8, flexShrink: 0 }}>
-            <button
+            <button type="button"
               onClick={() => openFileUrl(previewFile.url, previewFile.original_name).catch(() => toast.error(t('files.openError')))}
               style={{ display: 'flex', alignItems: 'center', gap: 4, fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-muted)', background: 'none', border: 'none', cursor: 'pointer', padding: '4px 8px', borderRadius: 6 }}>
               <ExternalLink size={13} /> {t('files.openTab')}
             </button>
-            <button
+            <button type="button"
               onClick={() => triggerDownload(previewFile.url, previewFile.original_name)}
               style={{ display: 'flex', alignItems: 'center', gap: 4, fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-muted)', background: 'none', border: 'none', cursor: 'pointer', padding: '4px 8px', borderRadius: 6 }}>
               <Download size={13} /> {t('files.download') || 'Download'}
             </button>
-            <button onClick={() => setPreviewFile(null)}
+            <button type="button" onClick={() => setPreviewFile(null)}
               style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex', padding: 4, borderRadius: 6 }}>
               <X size={18} />
             </button>
diff --git a/client/src/components/Files/FileManagerPdfPreviewModal.tsx b/client/src/components/Files/FileManagerPdfPreviewModal.tsx
index 9c3c97f54..77c208845 100644
--- a/client/src/components/Files/FileManagerPdfPreviewModal.tsx
+++ b/client/src/components/Files/FileManagerPdfPreviewModal.tsx
@@ -8,31 +8,33 @@ export function PdfPreviewModal(S: FileManagerState) {
   const { previewFile, setPreviewFile, previewFileUrl, toast, t } = S
   return createPortal(
     <div
+      role="presentation"
       style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.85)', zIndex: 10000, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
       onClick={() => setPreviewFile(null)}
     >
       <div
+        role="presentation"
         style={{ width: '100%', maxWidth: 950, height: '94vh', background: 'var(--bg-card)', borderRadius: 12, overflow: 'hidden', display: 'flex', flexDirection: 'column', boxShadow: '0 20px 60px rgba(0,0,0,0.3)' }}
         onClick={e => e.stopPropagation()}
       >
         <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '10px 16px', borderBottom: '1px solid var(--border-primary)', flexShrink: 0 }}>
           <span style={{ fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, color: 'var(--text-primary)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', flex: 1 }}>{previewFile.original_name}</span>
           <div style={{ display: 'flex', alignItems: 'center', gap: 8, flexShrink: 0 }}>
-            <button
+            <button type="button"
               onClick={() => openFileUrl(previewFile.url, previewFile.original_name).catch(() => toast.error(t('files.openError')))}
               style={{ display: 'flex', alignItems: 'center', gap: 4, fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-muted)', background: 'none', border: 'none', cursor: 'pointer', textDecoration: 'none', padding: '4px 8px', borderRadius: 6, transition: 'color 0.15s' }}
               onMouseEnter={e => (e.currentTarget as HTMLElement).style.color = 'var(--text-primary)'}
               onMouseLeave={e => (e.currentTarget as HTMLElement).style.color = 'var(--text-muted)'}>
               <ExternalLink size={13} /> {t('files.openTab')}
             </button>
-            <button
+            <button type="button"
               onClick={() => triggerDownload(previewFile.url, previewFile.original_name)}
               style={{ display: 'flex', alignItems: 'center', gap: 4, fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-muted)', background: 'none', border: 'none', cursor: 'pointer', textDecoration: 'none', padding: '4px 8px', borderRadius: 6, transition: 'color 0.15s' }}
               onMouseEnter={e => (e.currentTarget as HTMLElement).style.color = 'var(--text-primary)'}
               onMouseLeave={e => (e.currentTarget as HTMLElement).style.color = 'var(--text-muted)'}>
               <Download size={13} /> {t('files.download') || 'Download'}
             </button>
-            <button onClick={() => setPreviewFile(null)}
+            <button type="button" onClick={() => setPreviewFile(null)}
               style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex', padding: 4, borderRadius: 6, transition: 'color 0.15s' }}
               onMouseEnter={e => e.currentTarget.style.color = 'var(--text-primary)'}
               onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
@@ -47,7 +49,7 @@ export function PdfPreviewModal(S: FileManagerState) {
           title={previewFile.original_name}
         >
           <p style={{ padding: 24, textAlign: 'center', color: 'var(--text-muted)' }}>
-            <button onClick={() => openFileUrl(previewFile.url, previewFile.original_name).catch(() => toast.error(t('files.openError')))} style={{ color: 'var(--text-primary)', textDecoration: 'underline', background: 'none', border: 'none', cursor: 'pointer', font: 'inherit' }}>{t('files.downloadPdf')}</button>
+            <button type="button" onClick={() => openFileUrl(previewFile.url, previewFile.original_name).catch(() => toast.error(t('files.openError')))} style={{ color: 'var(--text-primary)', textDecoration: 'underline', background: 'none', border: 'none', cursor: 'pointer', font: 'inherit' }}>{t('files.downloadPdf')}</button>
           </p>
         </object>
       </div>
diff --git a/client/src/components/Files/FileManagerRow.tsx b/client/src/components/Files/FileManagerRow.tsx
index 79fda174d..632b332fb 100644
--- a/client/src/components/Files/FileManagerRow.tsx
+++ b/client/src/components/Files/FileManagerRow.tsx
@@ -34,10 +34,13 @@ export function FileRow(p: FileManagerState & { file: TripFile; isTrash?: boolea
       className="group"
     >
       {/* Icon or thumbnail */}
-      <div
+      <button
+        type="button"
+        disabled={isTrash}
+        aria-label={file.original_name}
         onClick={() => !isTrash && openFile(file)}
         style={{
-          flexShrink: 0, width: 36, height: 36, borderRadius: 8,
+          flexShrink: 0, width: 36, height: 36, borderRadius: 8, padding: 0,
           background: 'var(--bg-tertiary)', display: 'flex', alignItems: 'center', justifyContent: 'center',
           cursor: isTrash ? 'default' : 'pointer', overflow: 'hidden',
         }}
@@ -48,13 +51,13 @@ export function FileRow(p: FileManagerState & { file: TripFile; isTrash?: boolea
               const ext = (file.original_name || '').split('.').pop()?.toUpperCase() || '?'
               const isPdf = file.mime_type === 'application/pdf'
               return (
-                <div style={{ display: 'flex', flexDirection: 'column', alignItems: 'center', justifyContent: 'center', width: '100%', height: '100%', background: isPdf ? '#ef44441a' : 'var(--bg-tertiary)' }}>
+                <span style={{ display: 'flex', flexDirection: 'column', alignItems: 'center', justifyContent: 'center', width: '100%', height: '100%', background: isPdf ? '#ef44441a' : 'var(--bg-tertiary)' }}>
                   <span style={{ fontSize: 'calc(9px * var(--fs-scale-caption, 1))', fontWeight: 700, color: isPdf ? '#ef4444' : 'var(--text-muted)', letterSpacing: 0.3 }}>{ext}</span>
-                </div>
+                </span>
               )
             })()
         }
-      </div>
+      </button>
 
       {/* Info */}
       <div style={{ flex: 1, minWidth: 0 }}>
@@ -63,12 +66,14 @@ export function FileRow(p: FileManagerState & { file: TripFile; isTrash?: boolea
             <AvatarChip name={file.uploaded_by_name} avatarUrl={file.uploaded_by_avatar} size={20} />
           )}
           {!isTrash && file.starred ? <Star size={12} fill="#facc15" color="#facc15" style={{ flexShrink: 0 }} /> : null}
-          <span
+          <button
+            type="button"
+            disabled={isTrash}
             onClick={() => !isTrash && openFile(file)}
-            style={{ fontWeight: 500, fontSize: 'calc(13px * var(--fs-scale-body, 1))', color: 'var(--text-primary)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', cursor: isTrash ? 'default' : 'pointer' }}
+            style={{ fontWeight: 500, fontSize: 'calc(13px * var(--fs-scale-body, 1))', color: 'var(--text-primary)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', cursor: isTrash ? 'default' : 'pointer', textAlign: 'left', minWidth: 0 }}
           >
             {file.original_name}
-          </span>
+          </button>
         </div>
 
         {file.description && (
@@ -76,7 +81,7 @@ export function FileRow(p: FileManagerState & { file: TripFile; isTrash?: boolea
         )}
 
         <div style={{ display: 'flex', alignItems: 'center', flexWrap: 'wrap', gap: 6, marginTop: 4 }}>
-          {file.file_size && <span style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)' }}>{formatSize(file.file_size)}</span>}
+          {!!file.file_size && <span style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)' }}>{formatSize(file.file_size)}</span>}
           <span style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)' }}>{formatDateWithLocale(file.created_at, locale)}</span>
 
           {linkedPlaces.map(p => (
@@ -87,7 +92,7 @@ export function FileRow(p: FileManagerState & { file: TripFile; isTrash?: boolea
               ? <SourceBadge key={r.id} icon={transportIcon(r.type)} label={`${t('files.sourceTransport')} · ${r.title || t('files.sourceTransport')}`} />
               : <SourceBadge key={r.id} icon={Ticket} label={`${t('files.sourceBooking')} · ${r.title || t('files.sourceBooking')}`} />
           ))}
-          {file.note_id && (
+          {!!file.note_id && (
             <SourceBadge icon={StickyNote} label={t('files.sourceCollab') || 'Collab Notes'} />
           )}
         </div>
@@ -97,34 +102,34 @@ export function FileRow(p: FileManagerState & { file: TripFile; isTrash?: boolea
       <div className="file-actions" style={{ display: 'flex', gap: 2, flexShrink: 0 }}>
         {isTrash ? (
           <>
-            {can('file_delete', trip) && <button onClick={() => handleRestore(file.id)} title={t('files.restore') || 'Restore'} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
+            {can('file_delete', trip) && <button type="button" onClick={() => handleRestore(file.id)} title={t('files.restore') || 'Restore'} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
               onMouseEnter={e => e.currentTarget.style.color = '#22c55e'} onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
               <RotateCcw size={14} />
             </button>}
-            {can('file_delete', trip) && <button onClick={() => handlePermanentDelete(file.id)} title={t('common.delete')} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
+            {can('file_delete', trip) && <button type="button" onClick={() => handlePermanentDelete(file.id)} title={t('common.delete')} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
               onMouseEnter={e => e.currentTarget.style.color = '#ef4444'} onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
               <Trash2 size={14} />
             </button>}
           </>
         ) : (
           <>
-            <button onClick={() => handleStar(file.id)} title={file.starred ? t('files.unstar') || 'Unstar' : t('files.star') || 'Star'} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: file.starred ? '#facc15' : 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
+            <button type="button" onClick={() => handleStar(file.id)} title={file.starred ? t('files.unstar') || 'Unstar' : t('files.star') || 'Star'} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: file.starred ? '#facc15' : 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
               onMouseEnter={e => { if (!file.starred) e.currentTarget.style.color = '#facc15' }} onMouseLeave={e => { if (!file.starred) e.currentTarget.style.color = 'var(--text-faint)' }}>
               <Star size={14} fill={file.starred ? '#facc15' : 'none'} />
             </button>
-            {can('file_edit', trip) && <button onClick={() => setAssignFileId(file.id)} title={t('files.assign') || 'Assign'} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
+            {can('file_edit', trip) && <button type="button" onClick={() => setAssignFileId(file.id)} title={t('files.assign') || 'Assign'} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
               onMouseEnter={e => e.currentTarget.style.color = 'var(--text-primary)'} onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
               <Pencil size={14} />
             </button>}
-            <button onClick={() => openFile(file)} title={t('common.open')} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
+            <button type="button" onClick={() => openFile(file)} title={t('common.open')} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
               onMouseEnter={e => e.currentTarget.style.color = 'var(--text-primary)'} onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
               <ExternalLink size={14} />
             </button>
-            <button onClick={() => triggerDownload(file.url, file.original_name)} title={t('files.download') || 'Download'} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
+            <button type="button" onClick={() => triggerDownload(file.url, file.original_name)} title={t('files.download') || 'Download'} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
               onMouseEnter={e => e.currentTarget.style.color = 'var(--text-primary)'} onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
               <Download size={14} />
             </button>
-            {can('file_delete', trip) && <button onClick={() => handleDelete(file.id)} title={t('common.delete')} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
+            {can('file_delete', trip) && <button type="button" onClick={() => handleDelete(file.id)} title={t('common.delete')} style={{ padding: 6, background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', borderRadius: 6, display: 'flex' }}
               onMouseEnter={e => e.currentTarget.style.color = '#ef4444'} onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
               <Trash2 size={14} />
             </button>}
diff --git a/client/src/components/Files/FileManagerToolbar.tsx b/client/src/components/Files/FileManagerToolbar.tsx
index 085d7626f..2c77017e1 100644
--- a/client/src/components/Files/FileManagerToolbar.tsx
+++ b/client/src/components/Files/FileManagerToolbar.tsx
@@ -36,7 +36,7 @@ export function FileManagerToolbar(S: FileManagerState) {
                   : tab.id === 'collab' ? files.filter(f => f.note_id).length
                   : 0
                 return (
-                  <button key={tab.id} onClick={() => setFilterType(tab.id)}
+                  <button type="button" key={tab.id} onClick={() => setFilterType(tab.id)}
                     style={{
                       appearance: 'none', border: 'none', cursor: 'pointer', fontFamily: 'inherit',
                       display: 'inline-flex', alignItems: 'center', gap: 6,
@@ -63,7 +63,7 @@ export function FileManagerToolbar(S: FileManagerState) {
           </>
         )}
 
-        <button onClick={toggleTrash} style={{
+        <button type="button" onClick={toggleTrash} style={{
           appearance: 'none', border: 'none', cursor: 'pointer', fontFamily: 'inherit',
           display: 'inline-flex', alignItems: 'center', gap: 6,
           padding: '9px 14px', borderRadius: 10, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 500,
diff --git a/client/src/components/Files/FileManagerTrashView.tsx b/client/src/components/Files/FileManagerTrashView.tsx
index 79200768e..1c72a2217 100644
--- a/client/src/components/Files/FileManagerTrashView.tsx
+++ b/client/src/components/Files/FileManagerTrashView.tsx
@@ -8,7 +8,7 @@ export function TrashView(S: FileManagerState) {
     <div style={{ flex: 1, overflowY: 'auto', padding: '12px 16px 16px' }}>
       {trashFiles.length > 0 && can('file_delete', trip) && (
         <div style={{ display: 'flex', justifyContent: 'flex-end', marginBottom: 12 }}>
-          <button onClick={handleEmptyTrash} style={{
+          <button type="button" onClick={handleEmptyTrash} style={{
             padding: '5px 12px', borderRadius: 8, border: '1px solid #fecaca',
             background: '#fef2f2', color: '#dc2626', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500,
             cursor: 'pointer', fontFamily: 'inherit',
diff --git a/client/src/components/Journey/ContributorInviteDialog.tsx b/client/src/components/Journey/ContributorInviteDialog.tsx
index ff940ca0e..76b2145a0 100644
--- a/client/src/components/Journey/ContributorInviteDialog.tsx
+++ b/client/src/components/Journey/ContributorInviteDialog.tsx
@@ -49,7 +49,7 @@ export default function ContributorInviteDialog({ journeyId, existingUserIds, on
 
         <div className="flex items-center justify-between px-6 py-4 border-b border-zinc-200 dark:border-zinc-700">
           <h2 className="text-[16px] font-bold text-zinc-900 dark:text-white">{t('journey.contributors.invite')}</h2>
-          <button onClick={onClose} className="w-8 h-8 rounded-lg flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
+          <button type="button" onClick={onClose} className="w-8 h-8 rounded-lg flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
             <X size={16} />
           </button>
         </div>
@@ -72,10 +72,10 @@ export default function ContributorInviteDialog({ journeyId, existingUserIds, on
               <p className="text-[12px] text-zinc-400 text-center py-4">{t('journey.contributors.noUsers')}</p>
             )}
             {filtered.map(u => (
-              <div
+              <button type="button"
                 key={u.id}
                 onClick={() => setSelectedUserId(u.id)}
-                className={`flex items-center gap-2.5 p-2.5 rounded-lg cursor-pointer transition-all ${
+                className={`w-full text-left flex items-center gap-2.5 p-2.5 rounded-lg cursor-pointer transition-all ${
                   selectedUserId === u.id
                     ? 'bg-zinc-100 dark:bg-zinc-800 border border-zinc-900 dark:border-white'
                     : 'hover:bg-zinc-50 dark:hover:bg-zinc-800 border border-transparent'
@@ -93,7 +93,7 @@ export default function ContributorInviteDialog({ journeyId, existingUserIds, on
                     <Check size={12} />
                   </div>
                 )}
-              </div>
+              </button>
             ))}
           </div>
 
@@ -102,7 +102,7 @@ export default function ContributorInviteDialog({ journeyId, existingUserIds, on
             <label className="text-[10px] font-semibold tracking-[0.12em] uppercase text-zinc-500 block mb-2">{t('journey.invite.role')}</label>
             <div className="flex gap-2">
               {(['viewer', 'editor'] as const).map(r => (
-                <button
+                <button type="button"
                   key={r}
                   onClick={() => setRole(r)}
                   className={`flex-1 py-2 rounded-lg text-[12px] font-medium border transition-all ${
@@ -119,10 +119,10 @@ export default function ContributorInviteDialog({ journeyId, existingUserIds, on
         </div>
 
         <div className="flex items-center justify-end gap-2 px-6 py-4 border-t border-zinc-200 dark:border-zinc-700 bg-zinc-50 dark:bg-zinc-800/50">
-          <button onClick={onClose} className="px-3.5 py-2 rounded-lg border border-zinc-200 dark:border-zinc-600 text-[13px] font-medium text-zinc-700 dark:text-zinc-300 hover:bg-zinc-100 dark:hover:bg-zinc-700">
+          <button type="button" onClick={onClose} className="px-3.5 py-2 rounded-lg border border-zinc-200 dark:border-zinc-600 text-[13px] font-medium text-zinc-700 dark:text-zinc-300 hover:bg-zinc-100 dark:hover:bg-zinc-700">
             {t('common.cancel')}
           </button>
-          <button
+          <button type="button"
             onClick={handleInvite}
             disabled={!selectedUserId || sending}
             className="px-3.5 py-2 rounded-lg bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 text-[13px] font-medium hover:bg-zinc-800 dark:hover:bg-zinc-100 disabled:opacity-40 disabled:cursor-not-allowed"
diff --git a/client/src/components/Journey/JourneyDetailPageAddTripDialog.tsx b/client/src/components/Journey/JourneyDetailPageAddTripDialog.tsx
index 06db7f9b8..14f70c6b6 100644
--- a/client/src/components/Journey/JourneyDetailPageAddTripDialog.tsx
+++ b/client/src/components/Journey/JourneyDetailPageAddTripDialog.tsx
@@ -47,7 +47,7 @@ export function AddTripDialog({ journeyId, existingTripIds, onClose, onAdded }:
 
         <div className="flex items-center justify-between px-6 py-4 border-b border-zinc-200 dark:border-zinc-700">
           <h2 className="text-[16px] font-bold text-zinc-900 dark:text-white">{t('journey.trips.linkTrip')}</h2>
-          <button onClick={onClose} className="w-8 h-8 rounded-lg flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
+          <button type="button" onClick={onClose} className="w-8 h-8 rounded-lg flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
             <X size={16} />
           </button>
         </div>
@@ -81,7 +81,7 @@ export function AddTripDialog({ journeyId, existingTripIds, onClose, onAdded }:
                     </div>
                   )}
                 </div>
-                <button
+                <button type="button"
                   onClick={() => handleAdd(trip.id)}
                   disabled={adding === trip.id}
                   className="px-3 py-1.5 rounded-lg text-[11px] font-semibold bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 hover:bg-zinc-700 dark:hover:bg-zinc-200 disabled:opacity-50"
diff --git a/client/src/components/Journey/JourneyDetailPageDatePicker.tsx b/client/src/components/Journey/JourneyDetailPageDatePicker.tsx
index 4b35ef0be..2eaa993c6 100644
--- a/client/src/components/Journey/JourneyDetailPageDatePicker.tsx
+++ b/client/src/components/Journey/JourneyDetailPageDatePicker.tsx
@@ -1,4 +1,5 @@
 import { useState } from 'react'
+import { localIsoDate } from '../../utils/localDate'
 import { ArrowLeft, ChevronRight, Calendar } from 'lucide-react'
 import { useTranslation } from '../../i18n'
 
@@ -54,7 +55,9 @@ export function DatePicker({ value, onChange, tripDates }: {
 
       {open && (
         <>
-          <div className="fixed inset-0 z-[10]" onClick={() => setOpen(false)} />
+          {/* Click-away catcher — no semantics of its own; the trigger button
+              above closes the popover again from the keyboard. */}
+          <div role="presentation" className="fixed inset-0 z-[10]" onClick={() => setOpen(false)} />
           <div className="absolute top-full left-0 mt-1 z-[20] bg-white dark:bg-zinc-800 border border-zinc-200 dark:border-zinc-700 rounded-xl shadow-lg p-3 w-[280px]">
             {/* Month nav */}
             <div className="flex items-center justify-between mb-2">
@@ -81,7 +84,7 @@ export function DatePicker({ value, onChange, tripDates }: {
                 const dateStr = `${viewMonth.year}-${pad(viewMonth.month + 1)}-${pad(day)}`
                 const isSelected = dateStr === value
                 const isTrip = tripDates?.has(dateStr)
-                const isToday = dateStr === new Date().toISOString().split('T')[0]
+                const isToday = dateStr === localIsoDate()
 
                 return (
                   <button
diff --git a/client/src/components/Journey/JourneyDetailPageEntryCard.test.tsx b/client/src/components/Journey/JourneyDetailPageEntryCard.test.tsx
index 0094a2603..fad61473d 100644
--- a/client/src/components/Journey/JourneyDetailPageEntryCard.test.tsx
+++ b/client/src/components/Journey/JourneyDetailPageEntryCard.test.tsx
@@ -78,7 +78,8 @@ describe('EntryCard', () => {
     const user = userEvent.setup()
     const { container, onEdit } = mountCard(buildEntry({ photos: [buildPhoto(100)] }))
 
-    await user.click(container.querySelectorAll('button')[0])
+    // The photo itself is a button now, so pick the menu trigger by its own styling.
+    await user.click(container.querySelector('button[class*="bg-black/40"]') as HTMLElement)
     await user.click(screen.getByRole('button', { name: 'Edit' }))
 
     expect(onEdit).toHaveBeenCalledTimes(1)
@@ -110,7 +111,10 @@ describe('EntryCard', () => {
   it('FE-JRN-CARD-007: hides the menu entirely in read-only mode', () => {
     const { container } = mountCard(buildEntry({ photos: [buildPhoto(100)] }), true)
 
-    expect(container.querySelectorAll('button')).toHaveLength(0)
+    // Only the photo remains clickable; the menu trigger is gone.
+    const buttons = container.querySelectorAll('button')
+    expect(buttons).toHaveLength(1)
+    expect(buttons[0].querySelector('img')).toBeInTheDocument()
   })
 
   it('FE-JRN-CARD-008: renders mood, weather and tags in the meta row', () => {
diff --git a/client/src/components/Journey/JourneyDetailPageEntryCard.tsx b/client/src/components/Journey/JourneyDetailPageEntryCard.tsx
index 836ab4893..0bad18349 100644
--- a/client/src/components/Journey/JourneyDetailPageEntryCard.tsx
+++ b/client/src/components/Journey/JourneyDetailPageEntryCard.tsx
@@ -73,15 +73,15 @@ export function EntryCard({ entry, readOnly, onEdit, onDelete, onPhotoClick }: {
           {/* Menu top-right */}
           {!readOnly && (
             <div className="absolute top-2.5 right-3 z-[2]">
-              <button ref={menuBtnRef} onClick={() => setMenuOpen(!menuOpen)} className="w-8 h-8 rounded-[10px] bg-black/40 backdrop-blur-sm flex items-center justify-center text-white hover:bg-black/50">
+              <button type="button" ref={menuBtnRef} onClick={() => setMenuOpen(!menuOpen)} className="w-8 h-8 rounded-[10px] bg-black/40 backdrop-blur-sm flex items-center justify-center text-white hover:bg-black/50">
                 <MoreHorizontal size={14} />
               </button>
               {menuOpen && createPortal(
                 <>
-                  <div className="fixed inset-0 z-[99]" onClick={() => setMenuOpen(false)} />
+                  <div className="fixed inset-0 z-[99]" role="presentation" onClick={() => setMenuOpen(false)} />
                   <div className="fixed z-[100] bg-white dark:bg-zinc-800 border border-zinc-200 dark:border-zinc-700 rounded-lg shadow-lg py-1 min-w-[120px]" style={{ top: (menuBtnRef.current?.getBoundingClientRect().bottom || 0) + 4, right: window.innerWidth - (menuBtnRef.current?.getBoundingClientRect().right || 0) }}>
-                    <button onClick={() => { setMenuOpen(false); onEdit() }} className="w-full text-left px-3 py-1.5 text-[12px] text-zinc-700 dark:text-zinc-300 hover:bg-zinc-50 dark:hover:bg-zinc-700 flex items-center gap-2"><Pencil size={12} /> {t('common.edit')}</button>
-                    <button onClick={() => { setMenuOpen(false); onDelete() }} className="w-full text-left px-3 py-1.5 text-[12px] text-red-600 dark:text-red-400 hover:bg-red-50 dark:hover:bg-red-900/20 flex items-center gap-2"><Trash2 size={12} /> {t('common.delete')}</button>
+                    <button type="button" onClick={() => { setMenuOpen(false); onEdit() }} className="w-full text-left px-3 py-1.5 text-[12px] text-zinc-700 dark:text-zinc-300 hover:bg-zinc-50 dark:hover:bg-zinc-700 flex items-center gap-2"><Pencil size={12} /> {t('common.edit')}</button>
+                    <button type="button" onClick={() => { setMenuOpen(false); onDelete() }} className="w-full text-left px-3 py-1.5 text-[12px] text-red-600 dark:text-red-400 hover:bg-red-50 dark:hover:bg-red-900/20 flex items-center gap-2"><Trash2 size={12} /> {t('common.delete')}</button>
                   </div>
                 </>,
                 document.body,
@@ -113,15 +113,15 @@ export function EntryCard({ entry, readOnly, onEdit, onDelete, onPhotoClick }: {
           </div>
           {!readOnly && (
             <div className="relative">
-              <button ref={menuBtnRef} onClick={() => setMenuOpen(!menuOpen)} className="w-7 h-7 rounded-md flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
+              <button type="button" ref={menuBtnRef} onClick={() => setMenuOpen(!menuOpen)} className="w-7 h-7 rounded-md flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
                 <MoreHorizontal size={14} />
               </button>
               {menuOpen && createPortal(
                 <>
-                  <div className="fixed inset-0 z-[99]" onClick={() => setMenuOpen(false)} />
+                  <div className="fixed inset-0 z-[99]" role="presentation" onClick={() => setMenuOpen(false)} />
                   <div className="fixed z-[100] bg-white dark:bg-zinc-800 border border-zinc-200 dark:border-zinc-700 rounded-lg shadow-lg py-1 min-w-[120px]" style={{ top: (menuBtnRef.current?.getBoundingClientRect().bottom || 0) + 4, right: window.innerWidth - (menuBtnRef.current?.getBoundingClientRect().right || 0) }}>
-                    <button onClick={() => { setMenuOpen(false); onEdit() }} className="w-full text-left px-3 py-1.5 text-[12px] text-zinc-700 dark:text-zinc-300 hover:bg-zinc-50 dark:hover:bg-zinc-700 flex items-center gap-2"><Pencil size={12} /> {t('common.edit')}</button>
-                    <button onClick={() => { setMenuOpen(false); onDelete() }} className="w-full text-left px-3 py-1.5 text-[12px] text-red-600 dark:text-red-400 hover:bg-red-50 dark:hover:bg-red-900/20 flex items-center gap-2"><Trash2 size={12} /> {t('common.delete')}</button>
+                    <button type="button" onClick={() => { setMenuOpen(false); onEdit() }} className="w-full text-left px-3 py-1.5 text-[12px] text-zinc-700 dark:text-zinc-300 hover:bg-zinc-50 dark:hover:bg-zinc-700 flex items-center gap-2"><Pencil size={12} /> {t('common.edit')}</button>
+                    <button type="button" onClick={() => { setMenuOpen(false); onDelete() }} className="w-full text-left px-3 py-1.5 text-[12px] text-red-600 dark:text-red-400 hover:bg-red-50 dark:hover:bg-red-900/20 flex items-center gap-2"><Trash2 size={12} /> {t('common.delete')}</button>
                   </div>
                 </>,
                 document.body,
@@ -185,6 +185,9 @@ export function SkeletonCard({ entry, onClick }: { entry: JourneyEntry; onClick?
   return (
     <div
       onClick={onClick}
+      role={onClick ? 'button' : undefined}
+      tabIndex={onClick ? 0 : undefined}
+      onKeyDown={onClick ? e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); onClick() } } : undefined}
       className={`rounded-[18px] px-3.5 py-3 flex items-center gap-3 transition-transform duration-150 ease-[cubic-bezier(0.23,1,0.32,1)] ${onClick ? 'hover:-translate-y-0.5 cursor-pointer' : ''}`}
       style={{ border: '1.5px dashed var(--vg-line2)', background: 'var(--vg-surf2)' }}
     >
@@ -212,6 +215,9 @@ export function CheckinCard({ entry, onClick }: { entry: JourneyEntry; onClick?:
   return (
     <div
       onClick={onClick}
+      role={onClick ? 'button' : undefined}
+      tabIndex={onClick ? 0 : undefined}
+      onKeyDown={onClick ? e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); onClick() } } : undefined}
       className={`bg-white dark:bg-zinc-900 border border-zinc-200 dark:border-zinc-700 rounded-xl px-3.5 py-2.5 flex items-center gap-2.5 transition-colors duration-150 ease-[cubic-bezier(0.23,1,0.32,1)] ${onClick ? 'hover:border-zinc-400 dark:hover:border-zinc-500 cursor-pointer' : ''}`}
     >
       <div className="w-7 h-7 rounded-lg bg-indigo-50 dark:bg-indigo-900/30 text-indigo-600 dark:text-indigo-400 flex items-center justify-center flex-shrink-0">
diff --git a/client/src/components/Journey/JourneyDetailPageEntryEditor.test.tsx b/client/src/components/Journey/JourneyDetailPageEntryEditor.test.tsx
index cf51a6ba8..ad10e65fc 100644
--- a/client/src/components/Journey/JourneyDetailPageEntryEditor.test.tsx
+++ b/client/src/components/Journey/JourneyDetailPageEntryEditor.test.tsx
@@ -2,6 +2,7 @@
 
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
 import { http, HttpResponse, delay } from 'msw'
+import { localIsoDate } from '../../utils/localDate'
 import userEvent from '@testing-library/user-event'
 import { render, screen, waitFor, fireEvent } from '../../../tests/helpers/render'
 import { server } from '../../../tests/helpers/msw/server'
@@ -516,7 +517,7 @@ describe('EntryEditor', () => {
       entry_date: '', photos: undefined as unknown as JourneyPhoto[],
     }))
 
-    const today = new Date().toISOString().split('T')[0]
+    const today = localIsoDate() // local, matching the editor's default — not the UTC date
     const label = new Date(today + 'T00:00:00').toLocaleDateString(undefined, {
       month: 'short', day: 'numeric', year: 'numeric',
     })
diff --git a/client/src/components/Journey/JourneyDetailPageEntryEditor.tsx b/client/src/components/Journey/JourneyDetailPageEntryEditor.tsx
index 0608df282..2f6c33237 100644
--- a/client/src/components/Journey/JourneyDetailPageEntryEditor.tsx
+++ b/client/src/components/Journey/JourneyDetailPageEntryEditor.tsx
@@ -1,4 +1,5 @@
 import { useEffect, useMemo, useState, useRef } from 'react'
+import { localIsoDate } from '../../utils/localDate'
 import { X, Plus, Image, Minus, Check, MapPin, Locate, Camera } from 'lucide-react'
 import { normalizeImageFiles } from '../../utils/convertHeic'
 import { type ResilientResult, type UploadProgress } from '../../utils/uploadQueue'
@@ -33,7 +34,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
   const toast = useToast()
   const [title, setTitle] = useState(entry.title || '')
   const [story, setStory] = useState(entry.story || '')
-  const [entryDate, setEntryDate] = useState(entry.entry_date || new Date().toISOString().split('T')[0])
+  const [entryDate, setEntryDate] = useState(entry.entry_date || localIsoDate())
   const [entryTime, setEntryTime] = useState(entry.entry_time?.slice(0, 5) || '')
   const [locationName, setLocationName] = useState(entry.location_name || '')
   const [locationLat, setLocationLat] = useState<number | null>(entry.location_lat ?? null)
@@ -78,7 +79,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
   const isDirty = (
     title !== (entry.title || '') ||
     story !== (entry.story || '') ||
-    entryDate !== (entry.entry_date || new Date().toISOString().split('T')[0]) ||
+    entryDate !== (entry.entry_date || localIsoDate()) ||
     entryTime !== (entry.entry_time?.slice(0, 5) || '') ||
     locationName !== (entry.location_name || '') ||
     (locationLat ?? null) !== (entry.location_lat ?? null) ||
@@ -208,7 +209,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
     setPendingFiles(prev => [...prev, ...normalized])
   }
 
-  const contextLocation = isValidGeoPoint({ lat: locationLat ?? NaN, lng: locationLng ?? NaN })
+  const contextLocation = isValidGeoPoint({ lat: locationLat ?? Number.NaN, lng: locationLng ?? Number.NaN })
     ? { lat: locationLat!, lng: locationLng!, name: locationName || undefined }
     : null
 
@@ -255,7 +256,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
 
         <div className="flex items-center justify-between px-6 py-4 border-b border-zinc-200 dark:border-zinc-700">
           <h2 className="text-[16px] font-bold text-zinc-900 dark:text-white">{entry.id === 0 ? t('journey.detail.newEntry') : t('journey.detail.editEntry')}</h2>
-          <button onClick={handleClose} className="w-8 h-8 rounded-full flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
+          <button type="button" onClick={handleClose} className="w-8 h-8 rounded-full flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
             <X size={16} />
           </button>
         </div>
@@ -274,7 +275,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
             <input ref={fileRef} type="file" accept="image/*" multiple onChange={handleFileChange} onClick={e => { (e.target as HTMLInputElement).value = '' }} className="hidden" />
             <input ref={cameraRef} type="file" accept="image/*" capture="environment" onChange={handleFileChange} onClick={e => { (e.target as HTMLInputElement).value = '' }} className="hidden" />
             <div className="flex gap-2">
-              <button
+              <button type="button"
                 onClick={() => { setPhotoTab('upload'); setShowGalleryPick(false); fileRef.current?.click() }}
                 disabled={saving}
                 className="flex-1 border border-dashed border-zinc-200 dark:border-zinc-700 rounded-xl py-4 text-[12px] text-zinc-500 hover:border-zinc-400 dark:hover:border-zinc-500 hover:bg-zinc-50 dark:hover:bg-zinc-800 flex items-center justify-center gap-1.5 disabled:opacity-50"
@@ -286,7 +287,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                 )}
               </button>
               {galleryPhotos.length > 0 && (
-                <button
+                <button type="button"
                   onClick={() => { setPhotoTab('gallery'); setShowGalleryPick(!showGalleryPick) }}
                   className={`flex-1 border rounded-xl py-4 text-[12px] text-zinc-500 flex items-center justify-center gap-1.5 ${
                     showGalleryPick
@@ -297,7 +298,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                   <Image size={13} /> {t('journey.editor.fromGallery')}
                 </button>
               )}
-              <button
+              <button type="button"
                 onClick={() => { setPhotoTab('upload'); setShowGalleryPick(false); cameraRef.current?.click() }}
                 disabled={saving}
                 aria-label={t('journey.photo.add')}
@@ -306,7 +307,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
               >
                 <Camera size={14} />
               </button>
-              <button
+              <button type="button"
                 onClick={() => { setPhotoTab('external'); setShowGalleryPick(false) }}
                 disabled={saving}
                 className={`flex-1 border rounded-lg py-4 text-[12px] text-zinc-500 flex items-center justify-center gap-1.5 ${
@@ -327,8 +328,10 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
               <div className="mt-2 border border-zinc-200 dark:border-zinc-700 rounded-xl p-3 bg-zinc-50 dark:bg-zinc-800/50">
                 <div className="grid grid-cols-5 sm:grid-cols-6 gap-1.5 max-h-[160px] overflow-y-auto">
                   {availableGalleryPhotos.map(gp => (
-                    <div
+                    <button
+                      type="button"
                       key={gp.id}
+                      aria-label={t('journey.editor.fromGallery')}
                       onClick={async () => {
                         if (entry.id > 0) {
                           try {
@@ -340,11 +343,11 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                           setPhotos(prev => [...prev, gp])
                         }
                       }}
-                      className="relative w-full rounded-xl overflow-hidden cursor-pointer hover:ring-2 hover:ring-zinc-900 dark:hover:ring-white hover:ring-offset-1 dark:hover:ring-offset-zinc-900 transition-all"
+                      className="relative block w-full rounded-xl overflow-hidden border-0 p-0 bg-transparent cursor-pointer hover:ring-2 hover:ring-zinc-900 dark:hover:ring-white hover:ring-offset-1 dark:hover:ring-offset-zinc-900 transition-all"
                       style={{ paddingTop: '100%' }}
                     >
                       <img src={photoUrl(gp)} alt="" className="absolute inset-0 w-full h-full object-cover" loading="lazy" onError={e => { const img = e.currentTarget; const orig = photoUrl(gp, 'original'); if (!img.src.includes('/original')) img.src = orig }} />
-                    </div>
+                    </button>
                   ))}
                   {availableGalleryPhotos.length === 0 && (
                     <div className="col-span-full text-center py-3 text-[11px] text-zinc-400">{t('journey.editor.allPhotosAdded')}</div>
@@ -366,7 +369,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                     </p>
                   </div>
                   {pendingProviderGroups.length > 0 && (
-                    <button onClick={() => setPendingProviderGroups([])} className="text-[10px] text-zinc-500 hover:text-zinc-900 dark:hover:text-white whitespace-nowrap">
+                    <button type="button" onClick={() => setPendingProviderGroups([])} className="text-[10px] text-zinc-500 hover:text-zinc-900 dark:hover:text-white whitespace-nowrap">
                       {pendingProviderGroups.reduce((sum, group) => sum + group.assetIds.length, 0)} {t('journey.editor.externalPhotosQueued') || 'queued'} · {t('common.clear') || 'Clear'}
                     </button>
                   )}
@@ -379,7 +382,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                   <div className="h-full min-h-0 flex flex-col">
                     <div className="flex gap-1 px-3 py-2 border-b border-zinc-200 dark:border-zinc-700 overflow-x-auto">
                       {availableProviders.map(provider => (
-                        <button
+                        <button type="button"
                           key={provider.id}
                           data-testid={`journey-external-provider-${provider.id}`}
                           onClick={() => setExternalProvider(provider.id)}
@@ -441,7 +444,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                         <span className="absolute bottom-0.5 left-0.5 px-1 py-px rounded text-[8px] font-bold bg-zinc-900/70 text-white">{t('journey.editor.photoFirst')}</span>
                       )}
                       {idx > 0 && photos.length > 1 && (
-                        <button
+                        <button type="button"
                           onClick={e => {
                             e.stopPropagation()
                             const prevOrder = photos
@@ -469,7 +472,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                           {t('journey.editor.makeFirst')}
                         </button>
                       )}
-                      <button
+                      <button type="button"
                         onClick={async (e) => {
                           e.stopPropagation()
                           setPhotos(prev => prev.filter(x => x.id !== p.id))
@@ -489,7 +492,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                   {pendingFiles.map((f, i) => (
                     <div key={`pending-${i}`} className="w-20 h-20 rounded-xl overflow-hidden relative group">
                       <img src={pendingUrls[i]} className="w-full h-full object-cover" alt="" />
-                      <button
+                      <button type="button"
                         onClick={() => setPendingFiles(prev => prev.filter((_, j) => j !== i))}
                         className="absolute top-1 right-1 w-5 h-5 rounded-full bg-black/60 text-white flex items-center justify-center opacity-0 group-hover:opacity-100 transition-opacity"
                       >
@@ -543,13 +546,13 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                         className="flex-1 min-w-0 bg-transparent border-none outline-none text-[13px] text-zinc-900 dark:text-zinc-100 placeholder:text-green-400 dark:placeholder:text-green-600"
                       />
                       {pros.length > 1 && (
-                        <button onClick={() => setPros(pros.filter((_, j) => j !== i))} className="p-1 text-green-300 dark:text-green-700 hover:text-green-600 dark:hover:text-green-400 flex-shrink-0">
+                        <button type="button" onClick={() => setPros(pros.filter((_, j) => j !== i))} className="p-1 text-green-300 dark:text-green-700 hover:text-green-600 dark:hover:text-green-400 flex-shrink-0">
                           <X size={13} strokeWidth={2.5} />
                         </button>
                       )}
                     </div>
                   ))}
-                  <button
+                  <button type="button"
                     onClick={() => setPros([...pros, ''])}
                     className="flex items-center justify-center gap-1.5 h-9 w-full border border-dashed border-green-200 dark:border-green-800/40 rounded-[10px] text-[12px] font-medium text-green-700 dark:text-green-400 hover:border-green-300 dark:hover:border-green-700 transition-colors"
                   >
@@ -577,13 +580,13 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                         className="flex-1 min-w-0 bg-transparent border-none outline-none text-[13px] text-zinc-900 dark:text-zinc-100 placeholder:text-red-400 dark:placeholder:text-red-600"
                       />
                       {cons.length > 1 && (
-                        <button onClick={() => setCons(cons.filter((_, j) => j !== i))} className="p-1 text-red-300 dark:text-red-700 hover:text-red-600 dark:hover:text-red-400 flex-shrink-0">
+                        <button type="button" onClick={() => setCons(cons.filter((_, j) => j !== i))} className="p-1 text-red-300 dark:text-red-700 hover:text-red-600 dark:hover:text-red-400 flex-shrink-0">
                           <X size={13} strokeWidth={2.5} />
                         </button>
                       )}
                     </div>
                   ))}
-                  <button
+                  <button type="button"
                     onClick={() => setCons([...cons, ''])}
                     className="flex items-center justify-center gap-1.5 h-9 w-full border border-dashed border-red-200 dark:border-red-800/40 rounded-[10px] text-[12px] font-medium text-red-700 dark:text-red-400 hover:border-red-300 dark:hover:border-red-700 transition-colors"
                   >
@@ -657,10 +660,10 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
               </div>
               {showLocationResults && locationResults.length > 0 && (
                 <>
-                  <div className="fixed inset-0 z-[99]" onClick={() => setShowLocationResults(false)} />
+                  <div role="presentation" className="fixed inset-0 z-[99]" onClick={() => setShowLocationResults(false)} />
                   <div className="absolute left-0 right-0 top-full mt-1 z-[100] bg-white dark:bg-zinc-800 border border-zinc-200 dark:border-zinc-700 rounded-xl shadow-lg overflow-hidden max-h-[240px] overflow-y-auto">
                     {locationResults.map((r, i) => (
-                      <button
+                      <button type="button"
                         key={i}
                         onClick={() => {
                           setLocationName(r.name)
@@ -697,7 +700,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                 const Icon = config.icon
                 const active = mood === key
                 return (
-                  <button key={key} onClick={() => setMood(active ? '' : key)}
+                  <button type="button" key={key} onClick={() => setMood(active ? '' : key)}
                     className={`flex items-center gap-1.5 px-3 py-1.5 rounded-full text-[12px] font-semibold border transition-all ${
                       active ? '' : 'border-zinc-200 dark:border-zinc-700 text-zinc-500'
                     }`}
@@ -717,7 +720,7 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
                 const Icon = config.icon
                 const active = weather === key
                 return (
-                  <button key={key} onClick={() => setWeather(active ? '' : key)}
+                  <button type="button" key={key} onClick={() => setWeather(active ? '' : key)}
                     className={`flex items-center gap-1.5 px-3 py-1.5 rounded-full text-[12px] font-semibold border transition-all ${
                       active ? 'bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 border-zinc-900 dark:border-white' : 'border-zinc-200 dark:border-zinc-700 text-zinc-500 hover:border-zinc-400'
                     }`}>
@@ -734,8 +737,8 @@ export function EntryEditor({ entry, journeyId, tripDates, galleryPhotos, trips,
 
 
         <div className="flex items-center justify-end gap-2 px-6 py-4 border-t border-zinc-200 dark:border-zinc-700 bg-zinc-50 dark:bg-zinc-800/50" style={{ paddingBottom: 'max(16px, env(safe-area-inset-bottom, 16px))' }}>
-          <button onClick={handleClose} className="px-4 h-10 flex items-center rounded-full border border-zinc-200 dark:border-zinc-600 text-[13px] font-semibold text-zinc-700 dark:text-zinc-300 hover:bg-zinc-100 dark:hover:bg-zinc-700 transition-colors">{t('common.cancel')}</button>
-          <button onClick={handleSave} disabled={saving} className="px-5 h-10 flex items-center rounded-full bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 text-[13px] font-semibold hover:bg-zinc-800 dark:hover:bg-zinc-100 disabled:opacity-50 transition-colors">
+          <button type="button" onClick={handleClose} className="px-4 h-10 flex items-center rounded-full border border-zinc-200 dark:border-zinc-600 text-[13px] font-semibold text-zinc-700 dark:text-zinc-300 hover:bg-zinc-100 dark:hover:bg-zinc-700 transition-colors">{t('common.cancel')}</button>
+          <button type="button" onClick={handleSave} disabled={saving} className="px-5 h-10 flex items-center rounded-full bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 text-[13px] font-semibold hover:bg-zinc-800 dark:hover:bg-zinc-100 disabled:opacity-50 transition-colors">
             {saving ? t('common.saving') : t('common.save')}
           </button>
         </div>
diff --git a/client/src/components/Journey/JourneyDetailPageExpandableStory.tsx b/client/src/components/Journey/JourneyDetailPageExpandableStory.tsx
index d26b53733..26ca3d7f9 100644
--- a/client/src/components/Journey/JourneyDetailPageExpandableStory.tsx
+++ b/client/src/components/Journey/JourneyDetailPageExpandableStory.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useState, useRef } from 'react'
+import { useEffect, useState, useRef, type HTMLAttributes } from 'react'
 import { ChevronRight } from 'lucide-react'
 import { useTranslation } from '../../i18n'
 import JournalBody from './JournalBody'
@@ -23,11 +23,24 @@ export function ExpandableStory({ story }: { story: string }) {
     }
   })
 
+  // The text block toggles the same clamp as the Show more / Show less buttons
+  // below it. It only takes focus while there is something to toggle, so a
+  // short story stays plain text instead of an empty stop in the tab order.
+  const toggle: HTMLAttributes<HTMLDivElement> = clamped || expanded
+    ? {
+        role: 'button',
+        tabIndex: 0,
+        'aria-expanded': expanded,
+        onClick: () => setExpanded(e => !e),
+        onKeyDown: e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); setExpanded(v => !v) } },
+      }
+    : {}
+
   return (
     <div>
       <div
         ref={ref}
-        onClick={() => { if (clamped || expanded) setExpanded(e => !e) }}
+        {...toggle}
         className={`text-[13px] text-zinc-700 dark:text-zinc-300 leading-relaxed ${
           expanded ? '' : 'line-clamp-3 md:line-clamp-[9]'
         } ${clamped || expanded ? 'cursor-pointer' : ''}`}
@@ -35,7 +48,7 @@ export function ExpandableStory({ story }: { story: string }) {
         <JournalBody text={story} />
       </div>
       {clamped && !expanded && (
-        <button
+        <button type="button"
           onClick={() => setExpanded(true)}
           className="mt-2 inline-flex items-center gap-1 px-2.5 py-1 rounded-full bg-zinc-100 dark:bg-zinc-800 text-[10px] font-medium text-zinc-500 dark:text-zinc-400 hover:bg-zinc-200 dark:hover:bg-zinc-700 active:scale-95 transition-all"
         >
@@ -43,7 +56,7 @@ export function ExpandableStory({ story }: { story: string }) {
         </button>
       )}
       {expanded && (
-        <button
+        <button type="button"
           onClick={() => setExpanded(false)}
           className="mt-2 inline-flex items-center gap-1 px-2.5 py-1 rounded-full bg-zinc-100 dark:bg-zinc-800 text-[10px] font-medium text-zinc-500 dark:text-zinc-400 hover:bg-zinc-200 dark:hover:bg-zinc-700 active:scale-95 transition-all"
         >
diff --git a/client/src/components/Journey/JourneyDetailPageGalleryView.tsx b/client/src/components/Journey/JourneyDetailPageGalleryView.tsx
index f4bf2cc52..883bb442b 100644
--- a/client/src/components/Journey/JourneyDetailPageGalleryView.tsx
+++ b/client/src/components/Journey/JourneyDetailPageGalleryView.tsx
@@ -44,10 +44,10 @@ export function GalleryView({ entries, gallery, journeyId, userId, trips, onPhot
           try {
             const status = await memoriesApi.status(p.id)
             if (status.connected) connected.push({ id: p.id, name: p.name })
-          } catch {}
+          } catch { }
         }
         setAvailableProviders(connected)
-      } catch {}
+      } catch { }
     })()
   }, [])
 
@@ -133,7 +133,7 @@ export function GalleryView({ entries, gallery, journeyId, userId, trips, onPhot
         </span>
         <div className="flex items-center gap-2">
           {availableProviders.map(p => (
-            <button
+            <button type="button"
               key={p.id}
               onClick={() => browseProvider(p.id)}
               className="inline-flex items-center gap-1.5 px-2.5 py-1.5 rounded-lg border border-zinc-200 dark:border-zinc-700 text-[11px] font-medium text-zinc-600 dark:text-zinc-400 hover:bg-zinc-50 dark:hover:bg-zinc-800"
@@ -152,12 +152,16 @@ export function GalleryView({ entries, gallery, journeyId, userId, trips, onPhot
           {shownPhotos.map((photo, i) => (
             <div
               key={photo.id}
+              role="button"
+              tabIndex={0}
               className="relative aspect-square rounded-lg overflow-hidden cursor-pointer group"
               onClick={() => onPhotoClick(allPhotos, i)}
+              onKeyDown={e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); onPhotoClick(allPhotos, i) } }}
             >
-              {photo.media_type === 'video' && !photo.thumbnail_path ? (
-                // Poster-less video (capture failed / unsupported codec): show a
-                // neutral tile rather than a broken 404 thumbnail (#823).
+              {photo.media_type === 'video' &&
+                photo.provider === 'local' &&
+                !photo.thumbnail_path ? (
+                // Poster-less local video: show a neutral tile.
                 <div className="w-full h-full bg-zinc-200 dark:bg-zinc-800" />
               ) : (
                 <img
@@ -176,7 +180,7 @@ export function GalleryView({ entries, gallery, journeyId, userId, trips, onPhot
                 </div>
               )}
               {/* Delete button */}
-              <button
+              <button type="button"
                 onClick={(e) => { e.stopPropagation(); handleDeletePhoto(photo.id) }}
                 className="absolute top-1.5 right-1.5 w-6 h-6 rounded-full bg-black/60 backdrop-blur text-white flex items-center justify-center opacity-0 group-hover:opacity-100 transition-opacity z-10"
               >
diff --git a/client/src/components/Journey/JourneyDetailPageMapView.test.tsx b/client/src/components/Journey/JourneyDetailPageMapView.test.tsx
index 85a848e37..d9b6d88dd 100644
--- a/client/src/components/Journey/JourneyDetailPageMapView.test.tsx
+++ b/client/src/components/Journey/JourneyDetailPageMapView.test.tsx
@@ -125,7 +125,7 @@ describe('JourneyDetailPage MapView', () => {
 
   it('FE-COMP-JMAPVIEW-005: each row is numbered by its position across the whole journey', () => {
     renderMapView()
-    const berlin = screen.getByText('Museumsinsel').closest('div[class*="cursor-pointer"]')!
+    const berlin = screen.getByText('Museumsinsel').closest('button[class*="cursor-pointer"]')!
     expect(within(berlin as HTMLElement).getByText('3')).toBeInTheDocument()
   })
 
@@ -161,9 +161,9 @@ describe('JourneyDetailPage MapView', () => {
     renderMapView({ activeLocationId: '2' })
     expect(lastMapProps.current.activeMarkerId).toBe('2')
 
-    const row = screen.getByText('Sacré-Cœur').closest('div[class*="cursor-pointer"]') as HTMLElement
+    const row = screen.getByText('Sacré-Cœur').closest('button[class*="cursor-pointer"]') as HTMLElement
     expect(row.className).toContain('border-zinc-900')
-    const inactive = screen.getByText('Louvre').closest('div[class*="cursor-pointer"]') as HTMLElement
+    const inactive = screen.getByText('Louvre').closest('button[class*="cursor-pointer"]') as HTMLElement
     expect(inactive.className).toContain('border-zinc-200')
   })
 
diff --git a/client/src/components/Journey/JourneyDetailPageMapView.tsx b/client/src/components/Journey/JourneyDetailPageMapView.tsx
index a6baefb87..3577b1051 100644
--- a/client/src/components/Journey/JourneyDetailPageMapView.tsx
+++ b/client/src/components/Journey/JourneyDetailPageMapView.tsx
@@ -23,7 +23,7 @@ export function MapView({ entries, mapEntries, sortedDates, activeLocationId, fu
     if (!byDate.has(d)) byDate.set(d, [])
     byDate.get(d)!.push({ entry: e, globalIdx: i })
   })
-  const dates = [...byDate.keys()].sort()
+  const dates = [...byDate.keys()].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
 
   const mapItems = useMemo(() => mapEntries.map(e => ({
     id: String(e.id),
@@ -85,9 +85,10 @@ export function MapView({ entries, mapEntries, sortedDates, activeLocationId, fu
 
                   return (
                     <div key={e.id}>
-                      <div
+                      <button
+                        type="button"
                         onClick={() => onLocationClick(String(e.id))}
-                        className={`flex items-center gap-3 p-3 rounded-[14px] cursor-pointer transition-all ${
+                        className={`w-full text-left flex items-center gap-3 p-3 rounded-[14px] cursor-pointer transition-all ${
                           isActive
                             ? 'bg-zinc-100 dark:bg-zinc-800 border border-zinc-900 dark:border-zinc-100 translate-x-0.5'
                             : 'bg-white dark:bg-zinc-900 border border-zinc-200 dark:border-zinc-700 hover:border-zinc-400 dark:hover:border-zinc-500 hover:translate-x-0.5'
@@ -114,7 +115,7 @@ export function MapView({ entries, mapEntries, sortedDates, activeLocationId, fu
 
                         {/* Chevron */}
                         <ChevronRight size={14} className={`flex-shrink-0 ${isActive ? 'text-zinc-900 dark:text-white' : 'text-zinc-300 dark:text-zinc-600'}`} />
-                      </div>
+                      </button>
 
                       {/* Connector line */}
                       {showConnector && (
diff --git a/client/src/components/Journey/JourneyDetailPagePhotoGrid.tsx b/client/src/components/Journey/JourneyDetailPagePhotoGrid.tsx
index 25d8e4cd1..2123c209d 100644
--- a/client/src/components/Journey/JourneyDetailPagePhotoGrid.tsx
+++ b/client/src/components/Journey/JourneyDetailPagePhotoGrid.tsx
@@ -1,18 +1,31 @@
-import { Image } from 'lucide-react'
+import { Image, Play } from 'lucide-react'
 import type { JourneyPhoto } from '../../store/journeyStore'
 import { photoUrl } from '../../pages/journeyDetail/JourneyDetailPage.helpers'
 
-export function PhotoImg({ photo, className, style, onClick }: { photo: JourneyPhoto; className?: string; style?: React.CSSProperties; onClick?: () => void }) {
+export function PhotoImg({ photo, className, style }: { photo: JourneyPhoto; className?: string; style?: React.CSSProperties }) {
   const src = photoUrl(photo, 'thumbnail')
+  const isVideo = photo.media_type === 'video'
+
   return (
-    <img
-      src={src}
-      alt=""
-      className={className}
+    <div
+      className={`relative overflow-hidden ${isVideo ? 'bg-black' : ''} ${className || ''}`}
       style={style}
-      onClick={onClick}
-      loading="lazy"
-    />
+    >
+      <img
+        src={src}
+        alt=""
+        className={`w-full h-full ${isVideo ? 'object-contain' : 'object-cover'}`}
+        loading="lazy"
+      />
+
+      {isVideo && (
+        <div className="absolute inset-0 flex items-center justify-center pointer-events-none">
+          <span className="w-11 h-11 rounded-full bg-black/60 backdrop-blur-sm flex items-center justify-center text-white">
+            <Play size={20} className="ml-0.5" fill="currentColor" />
+          </span>
+        </div>
+      )}
+    </div>
   )
 }
 
@@ -22,9 +35,9 @@ export function PhotoGrid({ photos, onClick }: { photos: JourneyPhoto[]; onClick
 
   if (count === 1) {
     return (
-      <div className="overflow-hidden cursor-pointer" onClick={() => onClick(0)}>
+      <button type="button" className="block w-full overflow-hidden cursor-pointer" onClick={() => onClick(0)}>
         <PhotoImg photo={photos[0]} className="w-full h-72 object-cover" />
-      </div>
+      </button>
     )
   }
 
@@ -32,7 +45,9 @@ export function PhotoGrid({ photos, onClick }: { photos: JourneyPhoto[]; onClick
     return (
       <div className="grid grid-cols-2 gap-0.5 overflow-hidden">
         {photos.slice(0, 2).map((p, i) => (
-          <PhotoImg key={p.id} photo={p} className="w-full h-52 object-cover cursor-pointer" onClick={() => onClick(i)} />
+          <button key={p.id} type="button" className="block w-full h-52 overflow-hidden cursor-pointer" onClick={() => onClick(i)}>
+            <PhotoImg photo={p} className="w-full h-full object-cover" />
+          </button>
         ))}
       </div>
     )
@@ -40,14 +55,14 @@ export function PhotoGrid({ photos, onClick }: { photos: JourneyPhoto[]; onClick
 
   return (
     <div className="overflow-hidden flex" style={{ height: 300, gap: 2 }}>
-      <div className="flex-1 min-w-0 cursor-pointer" onClick={() => onClick(0)}>
+      <button type="button" className="flex-1 min-w-0 cursor-pointer" onClick={() => onClick(0)}>
         <PhotoImg photo={photos[0]} className="w-full h-full object-cover" />
-      </div>
+      </button>
       <div className="flex-1 min-w-0 flex flex-col" style={{ gap: 2 }}>
-        <div className="flex-1 min-h-0 cursor-pointer" onClick={() => onClick(1)}>
+        <button type="button" className="flex-1 min-h-0 cursor-pointer" onClick={() => onClick(1)}>
           <PhotoImg photo={photos[1]} className="w-full h-full object-cover" />
-        </div>
-        <div className="flex-1 min-h-0 relative cursor-pointer" onClick={() => onClick(2)}>
+        </button>
+        <button type="button" className="flex-1 min-h-0 relative cursor-pointer" onClick={() => onClick(2)}>
           <PhotoImg photo={photos[2]} className="w-full h-full object-cover" />
           {count > 3 && (
             <div className="absolute bottom-2 right-2 bg-black/60 backdrop-blur text-white rounded-full px-2 py-0.5 text-[10px] font-semibold flex items-center gap-1">
@@ -55,8 +70,8 @@ export function PhotoGrid({ photos, onClick }: { photos: JourneyPhoto[]; onClick
               +{count - 3}
             </div>
           )}
-        </div>
+        </button>
       </div>
     </div>
   )
-}
+}
\ No newline at end of file
diff --git a/client/src/components/Journey/JourneyDetailPageProviderPicker.tsx b/client/src/components/Journey/JourneyDetailPageProviderPicker.tsx
index 9e5c47ea0..c144541a5 100644
--- a/client/src/components/Journey/JourneyDetailPageProviderPicker.tsx
+++ b/client/src/components/Journey/JourneyDetailPageProviderPicker.tsx
@@ -144,6 +144,7 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
       className={embedded
         ? 'w-full h-full min-h-0 flex flex-col overflow-hidden'
         : 'fixed inset-0 z-[9999] flex items-end md:items-center justify-center md:p-5 overscroll-none bg-[rgba(9,9,11,0.75)]'}
+      role="presentation"
       onClick={embedded ? undefined : onClose}
       onTouchMove={e => { if (!embedded && e.target === e.currentTarget) e.preventDefault() }}
     >
@@ -152,6 +153,7 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
           ? 'bg-white dark:bg-zinc-900 w-full h-full flex flex-col overflow-hidden'
           : 'bg-white dark:bg-zinc-900 rounded-t-2xl md:rounded-2xl shadow-[0_20px_40px_rgba(0,0,0,0.2)] max-w-[720px] md:max-w-[960px] w-full max-h-[calc(100dvh-var(--bottom-nav-h)-20px)] md:max-h-[85vh] flex flex-col overflow-hidden'}
         style={{ paddingBottom: 'env(safe-area-inset-bottom, 0px)' }}
+        role="presentation"
         onClick={e => e.stopPropagation()}
       >
 
@@ -160,7 +162,7 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
           <h2 className="text-[16px] font-bold text-zinc-900 dark:text-white">
             {provider === 'immich' ? 'Immich' : provider === 'synologyphotos' ? 'Synology Photos' : provider}
           </h2>
-          <button onClick={onClose} className="w-8 h-8 rounded-lg flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
+          <button type="button" onClick={onClose} className="w-8 h-8 rounded-lg flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
             <X size={16} />
           </button>
         </div>}
@@ -176,7 +178,7 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
               { id: 'all' as const, label: t('journey.picker.allPhotos'), short: t('common.all') },
               { id: 'album' as const, label: t('journey.picker.albums') },
             ].map(f => (
-              <button
+              <button type="button"
                 key={f.id}
                 onClick={() => setFilter(f.id)}
                 className={`px-3 py-1.5 rounded-lg text-[12px] font-medium transition-colors ${
@@ -233,7 +235,7 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
                 <div className="flex-1"><DatePicker value={customFrom} onChange={setCustomFrom} /></div>
                 <span className="text-zinc-400 text-[12px]">&mdash;</span>
                 <div className="flex-1"><DatePicker value={customTo} onChange={setCustomTo} /></div>
-                <button onClick={handleCustomSearch}
+                <button type="button" onClick={handleCustomSearch}
                   className="px-3 py-1.5 rounded-lg bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 text-[12px] font-medium hover:bg-zinc-800 dark:hover:bg-zinc-100 flex-shrink-0">
                   {t('journey.picker.search')}
                 </button>
@@ -243,7 +245,7 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
             {filter === 'album' && (
               <div className="flex gap-2 overflow-x-auto flex-1">
                 {albums.map((a: any) => (
-                  <button
+                  <button type="button"
                     key={a.id}
                     onClick={() => { setSelectedAlbum(a.id); setSelectedAlbumPassphrase(a.passphrase); loadAlbumPhotos(a) }}
                     className={`px-2.5 py-1 rounded-lg text-[11px] font-medium whitespace-nowrap flex-shrink-0 border ${
@@ -265,7 +267,7 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
         {!embedded && <div className="px-6 py-2.5 border-b border-zinc-200 dark:border-zinc-700 bg-zinc-50 dark:bg-zinc-800/50 flex-shrink-0">
           <div className="relative flex items-center gap-2">
             <span className="text-[10px] font-semibold tracking-[0.12em] uppercase text-zinc-500">{t('journey.picker.addTo')}</span>
-            <button
+            <button type="button"
               onClick={() => setAddToOpen(!addToOpen)}
               className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg border border-zinc-200 dark:border-zinc-700 text-[12px] font-medium text-zinc-700 dark:text-zinc-300 hover:bg-zinc-50 dark:hover:bg-zinc-800"
             >
@@ -274,9 +276,9 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
             </button>
             {addToOpen && (
               <>
-                <div className="fixed inset-0 z-[9]" onClick={() => setAddToOpen(false)} />
+                <div className="fixed inset-0 z-[9]" role="presentation" onClick={() => setAddToOpen(false)} />
                 <div className="absolute left-12 top-full mt-1 z-10 bg-white dark:bg-zinc-800 border border-zinc-200 dark:border-zinc-700 rounded-xl shadow-lg py-1.5 min-w-[200px] max-h-[240px] overflow-y-auto">
-                  <button
+                  <button type="button"
                     onClick={() => { setTargetEntryId(null); setAddToOpen(false) }}
                     className={`w-full text-left px-3 py-2 text-[12px] flex items-center gap-2 ${
                       !targetEntryId
@@ -291,7 +293,7 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
                     <div className="h-px bg-zinc-200 dark:bg-zinc-700 my-1" />
                   )}
                   {entries.filter(e => e.type !== 'skeleton' && e.title !== 'Gallery' && e.title !== '[Trip Photos]').map(e => (
-                    <button
+                    <button type="button"
                       key={e.id}
                       onClick={() => { setTargetEntryId(e.id); setAddToOpen(false) }}
                       className={`w-full text-left px-3 py-2 text-[12px] truncate ${
@@ -316,7 +318,7 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
           if (selectable.length === 0) return null
           return (
             <div className="px-4 py-2 border-b border-zinc-200 dark:border-zinc-700 bg-white dark:bg-zinc-900 flex-shrink-0">
-              <button
+              <button type="button"
                 onClick={() => {
                   if (allSelected) {
                     setSelected(new Map())
@@ -365,10 +367,14 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
                       const isSelected = selected.has(asset.id)
                       const alreadyAdded = existingAssetIds.has(asset.id)
                       return (
-                        <div
+                        <button
+                          type="button"
                           key={asset.id}
+                          disabled={alreadyAdded}
+                          aria-pressed={isSelected}
+                          aria-label={asset.city || group.label}
                           onClick={() => !alreadyAdded && toggleAsset(asset.id)}
-                          className={`relative aspect-square rounded-lg overflow-hidden ${
+                          className={`relative block w-full aspect-square rounded-lg overflow-hidden ${
                             alreadyAdded
                               ? 'opacity-40 cursor-not-allowed'
                               : isSelected
@@ -402,7 +408,7 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
                               <p className="text-[8px] text-white truncate">{asset.city}</p>
                             </div>
                           )}
-                        </div>
+                        </button>
                       )
                     })}
                   </div>
@@ -421,10 +427,10 @@ export function ProviderPicker({ provider, userId, entries, trips, existingAsset
             <span className="leading-[18px]">{t('journey.picker.selected')}</span>
           </span>
           <div className="flex items-center gap-2">
-            <button onClick={onClose} className="px-3.5 py-2 rounded-lg border border-zinc-200 dark:border-zinc-600 text-[13px] font-medium text-zinc-700 dark:text-zinc-300 hover:bg-zinc-100 dark:hover:bg-zinc-700">
+            <button type="button" onClick={onClose} className="px-3.5 py-2 rounded-lg border border-zinc-200 dark:border-zinc-600 text-[13px] font-medium text-zinc-700 dark:text-zinc-300 hover:bg-zinc-100 dark:hover:bg-zinc-700">
               {t('common.cancel')}
             </button>
-            <button
+            <button type="button"
               onClick={() => {
                 const groupMap = new Map<string | undefined, { assetIds: string[]; mediaTypes: string[] }>()
                 for (const [assetId, { passphrase, mediaType }] of selected.entries()) {
diff --git a/client/src/components/Journey/JourneyDetailPageSettingsDialog.tsx b/client/src/components/Journey/JourneyDetailPageSettingsDialog.tsx
index c79772298..db206aac3 100644
--- a/client/src/components/Journey/JourneyDetailPageSettingsDialog.tsx
+++ b/client/src/components/Journey/JourneyDetailPageSettingsDialog.tsx
@@ -87,12 +87,12 @@ export function JourneySettingsDialog({ journey, onClose, onSaved, onOpenInvite,
   }
 
   return (
-    <div className="fixed inset-0 z-[200] flex items-end md:items-center justify-center md:p-5 overscroll-none bg-[rgba(9,9,11,0.75)]" onClick={handleClose} onTouchMove={e => { if (e.target === e.currentTarget) e.preventDefault() }}>
-      <div className="bg-white dark:bg-zinc-900 rounded-t-2xl md:rounded-[24px] shadow-[0_20px_40px_rgba(0,0,0,0.2)] max-w-[980px] w-full max-h-[85vh] md:max-h-[90vh] flex flex-col overflow-hidden" style={{ paddingBottom: 'env(safe-area-inset-bottom, 0px)' }} onClick={e => e.stopPropagation()}>
+    <div role="presentation" className="fixed inset-0 z-[200] flex items-end md:items-center justify-center md:p-5 overscroll-none bg-[rgba(9,9,11,0.75)]" onClick={handleClose} onTouchMove={e => { if (e.target === e.currentTarget) e.preventDefault() }}>
+      <div role="presentation" className="bg-white dark:bg-zinc-900 rounded-t-2xl md:rounded-[24px] shadow-[0_20px_40px_rgba(0,0,0,0.2)] max-w-[980px] w-full max-h-[85vh] md:max-h-[90vh] flex flex-col overflow-hidden" style={{ paddingBottom: 'env(safe-area-inset-bottom, 0px)' }} onClick={e => e.stopPropagation()}>
 
         <div className="flex items-center justify-between px-6 py-4 border-b border-zinc-200 dark:border-zinc-700">
           <h2 className="text-[16px] font-bold text-zinc-900 dark:text-white">{t('journey.settings.title')}</h2>
-          <button onClick={handleClose} className="w-8 h-8 rounded-xl flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
+          <button type="button" onClick={handleClose} className="w-8 h-8 rounded-xl flex items-center justify-center text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800">
             <X size={16} />
           </button>
         </div>
@@ -105,7 +105,7 @@ export function JourneySettingsDialog({ journey, onClose, onSaved, onOpenInvite,
           <div>
             <label className="text-[10px] font-semibold tracking-[0.12em] uppercase text-zinc-500 block mb-2">{t('journey.settings.coverImage')}</label>
             <input ref={coverRef} type="file" accept="image/*" onChange={handleCoverUpload} className="hidden" />
-            <button
+            <button type="button"
               onClick={() => coverRef.current?.click()}
               className="w-full h-28 rounded-xl border border-dashed border-zinc-200 dark:border-zinc-700 flex items-center justify-center gap-2 text-[12px] text-zinc-500 hover:border-zinc-400 dark:hover:border-zinc-500 hover:bg-zinc-50 dark:hover:bg-zinc-800 overflow-hidden relative"
             >
@@ -156,7 +156,7 @@ export function JourneySettingsDialog({ journey, onClose, onSaved, onOpenInvite,
                     <div className="text-[12px] font-medium text-zinc-900 dark:text-white">{trip.title}</div>
                     <div className="text-[10px] text-zinc-500">{trip.place_count || 0} {t('journey.synced.places')}</div>
                   </div>
-                  <button
+                  <button type="button"
                     onClick={() => setUnlinkTarget({ trip_id: trip.trip_id, title: trip.title })}
                     className="w-8 h-8 rounded-xl flex-shrink-0 flex items-center justify-center bg-red-500/10 text-red-500 hover:bg-red-500/20 dark:bg-red-500/15 dark:hover:bg-red-500/25 transition-colors"
                     title="Unlink trip"
@@ -166,7 +166,7 @@ export function JourneySettingsDialog({ journey, onClose, onSaved, onOpenInvite,
                 </div>
               ))}
               {journey.trips.length === 0 && <p className="text-[11px] text-zinc-400">{t('journey.trips.noTripsLinkedSettings')}</p>}
-              <button
+              <button type="button"
                 onClick={() => setShowAddTrip(true)}
                 className="w-full mt-1 flex items-center justify-center gap-1.5 py-2.5 rounded-xl border border-dashed border-zinc-300 dark:border-zinc-600 text-[12px] font-medium text-zinc-500 hover:border-zinc-400 hover:text-zinc-700 dark:hover:border-zinc-500 dark:hover:text-zinc-300 transition-colors"
               >
@@ -187,7 +187,7 @@ export function JourneySettingsDialog({ journey, onClose, onSaved, onOpenInvite,
                   <div className="flex-1 text-[12px] font-medium text-zinc-900 dark:text-white">{c.username}</div>
                   <span className="shrink-0 rounded-full font-semibold uppercase" style={{ fontSize: 8.5, letterSpacing: '0.05em', padding: '2px 7px', ...(c.role === 'owner' ? { background: 'var(--vg-ink)', color: 'var(--vg-bg)' } : { background: 'color-mix(in srgb, var(--vg-ink3) 14%, transparent)', color: 'var(--vg-ink2)' }) }}>{c.role}</span>
                   {c.role !== 'owner' && (
-                    <button
+                    <button type="button"
                       onClick={async () => {
                         if (!window.confirm(t('journey.contributors.removeConfirm', { username: c.username }))) return
                         try {
@@ -207,7 +207,7 @@ export function JourneySettingsDialog({ journey, onClose, onSaved, onOpenInvite,
                   )}
                 </div>
               ))}
-              <button
+              <button type="button"
                 onClick={onOpenInvite}
                 className="w-full mt-1 flex items-center justify-center gap-1.5 py-2.5 rounded-xl border border-dashed border-zinc-300 dark:border-zinc-600 text-[12px] font-medium text-zinc-500 hover:border-zinc-400 hover:text-zinc-700 dark:hover:border-zinc-500 dark:hover:text-zinc-300 transition-colors"
               >
@@ -228,7 +228,7 @@ export function JourneySettingsDialog({ journey, onClose, onSaved, onOpenInvite,
 
         {/* Footer */}
         <div className="flex items-center gap-1.5 px-4 md:px-6 py-4 pb-6 md:pb-4 border-t border-zinc-200 dark:border-zinc-700 bg-zinc-50 dark:bg-zinc-800/50">
-          <button
+          <button type="button"
             onClick={() => setShowDeleteConfirm(true)}
             aria-label={t('journey.settings.delete')}
             title={t('journey.settings.delete')}
@@ -237,7 +237,7 @@ export function JourneySettingsDialog({ journey, onClose, onSaved, onOpenInvite,
             <Trash2 size={14} />
             <span className="hidden md:inline">{t('journey.settings.delete')}</span>
           </button>
-          <button
+          <button type="button"
             onClick={handleArchiveToggle}
             disabled={archiving}
             aria-label={journey.status === 'archived' ? t('journey.settings.reopenJourney') : t('journey.settings.endJourney')}
@@ -247,8 +247,8 @@ export function JourneySettingsDialog({ journey, onClose, onSaved, onOpenInvite,
             {journey.status === 'archived' ? <ArchiveRestore size={14} /> : <Archive size={14} />}
             <span className="hidden md:inline">{journey.status === 'archived' ? t('journey.settings.reopenJourney') : t('journey.settings.endJourney')}</span>
           </button>
-          <button onClick={handleClose} className="h-10 px-4 rounded-full border border-zinc-200 dark:border-zinc-600 text-[13px] font-semibold text-zinc-700 dark:text-zinc-300 hover:bg-zinc-100 dark:hover:bg-zinc-700 transition-colors">{t('common.cancel')}</button>
-          <button onClick={handleSave} disabled={saving || !title.trim()} className="h-10 px-5 rounded-full bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 text-[13px] font-semibold hover:bg-zinc-800 dark:hover:bg-zinc-100 disabled:opacity-40 transition-colors">
+          <button type="button" onClick={handleClose} className="h-10 px-4 rounded-full border border-zinc-200 dark:border-zinc-600 text-[13px] font-semibold text-zinc-700 dark:text-zinc-300 hover:bg-zinc-100 dark:hover:bg-zinc-700 transition-colors">{t('common.cancel')}</button>
+          <button type="button" onClick={handleSave} disabled={saving || !title.trim()} className="h-10 px-5 rounded-full bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 text-[13px] font-semibold hover:bg-zinc-800 dark:hover:bg-zinc-100 disabled:opacity-40 transition-colors">
             {saving ? t('common.saving') : t('common.save')}
           </button>
         </div>
@@ -278,7 +278,7 @@ export function JourneySettingsDialog({ journey, onClose, onSaved, onOpenInvite,
       {/* Add Trip — sits inside the backdrop, so its clicks have to be kept
           from bubbling into the close/discard handler underneath */}
       {showAddTrip && (
-        <div onClick={e => e.stopPropagation()}>
+        <div role="presentation" onClick={e => e.stopPropagation()}>
           <AddTripDialog
             journeyId={journey.id}
             existingTripIds={journey.trips.map((t: any) => t.trip_id)}
diff --git a/client/src/components/Journey/JourneyDetailPageVerdictSection.tsx b/client/src/components/Journey/JourneyDetailPageVerdictSection.tsx
index 23fb3141b..f7ea2794a 100644
--- a/client/src/components/Journey/JourneyDetailPageVerdictSection.tsx
+++ b/client/src/components/Journey/JourneyDetailPageVerdictSection.tsx
@@ -9,7 +9,7 @@ export function VerdictSection({ pros, cons }: { pros: string[]; cons: string[]
   return (
     <div className="mt-5">
       {/* Header — clickable on mobile */}
-      <button
+      <button type="button"
         onClick={() => setOpen(o => !o)}
         className="md:pointer-events-none w-full flex items-center gap-2.5 mb-3.5 group"
       >
diff --git a/client/src/components/Journey/JourneyMap.tsx b/client/src/components/Journey/JourneyMap.tsx
index 0d0b421b4..5e5e3f89a 100644
--- a/client/src/components/Journey/JourneyMap.tsx
+++ b/client/src/components/Journey/JourneyMap.tsx
@@ -410,7 +410,7 @@ function JourneyMap(
         style={{ width: '100%', height: '100%' }}
       />
       <div style={{ position: 'absolute', bottom: 12, right: 12, zIndex: 400, display: 'flex', flexDirection: 'column', gap: 4 }}>
-        <button
+        <button type="button"
           onClick={zoomIn}
           style={{
             width: 32, height: 32, borderRadius: 8,
@@ -422,7 +422,7 @@ function JourneyMap(
             cursor: 'pointer', fontSize: 'calc(16px * var(--fs-scale-subtitle, 1))', fontWeight: 700, lineHeight: 1,
           }}
         >+</button>
-        <button
+        <button type="button"
           onClick={zoomOut}
           style={{
             width: 32, height: 32, borderRadius: 8,
diff --git a/client/src/components/Journey/JourneyShareSection.tsx b/client/src/components/Journey/JourneyShareSection.tsx
index d12ad9f2b..7d0a3e0a3 100644
--- a/client/src/components/Journey/JourneyShareSection.tsx
+++ b/client/src/components/Journey/JourneyShareSection.tsx
@@ -36,11 +36,12 @@ export default function JourneyShareSection({ journeyId }: { journeyId: number }
 
   const togglePerm = async (key: 'share_timeline' | 'share_gallery' | 'share_map') => {
     if (!link) return
+    const previous = link
     const updated = { ...link, [key]: !link[key] }
     setLink(updated)
     try {
       await journeyApi.createShareLink(journeyId, { share_timeline: updated.share_timeline, share_gallery: updated.share_gallery, share_map: updated.share_map })
-    } catch { setLink(link); toast.error(t('journey.share.updateFailed')) }
+    } catch { setLink(previous); toast.error(t('journey.share.updateFailed')) }
   }
 
   const deleteLink = async () => {
@@ -66,7 +67,7 @@ export default function JourneyShareSection({ journeyId }: { journeyId: number }
       <label className="text-[10px] font-semibold tracking-[0.12em] uppercase text-zinc-500 block mb-2">{t('journey.share.publicShare')}</label>
 
       {!link ? (
-        <button
+        <button type="button"
           onClick={createLink}
           className="w-full flex items-center justify-center gap-1.5 py-2.5 rounded-xl border border-dashed border-zinc-300 dark:border-zinc-600 text-[12px] font-medium text-zinc-500 hover:border-zinc-400 hover:text-zinc-700 dark:hover:border-zinc-500 dark:hover:text-zinc-300 transition-colors"
         >
@@ -78,13 +79,13 @@ export default function JourneyShareSection({ journeyId }: { journeyId: number }
           <div className="flex items-center gap-2 p-2 rounded-2xl bg-zinc-50 dark:bg-zinc-800 border border-zinc-200 dark:border-zinc-700">
             <Link size={13} className="text-zinc-400 flex-shrink-0 ml-1.5" />
             <span className="flex-1 text-[11px] text-zinc-600 dark:text-zinc-400 truncate">{shareUrl}</span>
-            <button
+            <button type="button"
               onClick={copyLink}
               className="flex-shrink-0 px-3 py-1.5 rounded-full bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 text-[11px] font-semibold hover:bg-zinc-700 dark:hover:bg-zinc-200 transition-colors"
             >
               {copied ? t('journey.share.copied') : t('journey.share.copy')}
             </button>
-            <button
+            <button type="button"
               onClick={deleteLink}
               className="flex-shrink-0 px-3 py-1.5 rounded-full text-[11px] font-semibold text-red-600 dark:text-red-400 hover:bg-red-50 dark:hover:bg-red-900/20 transition-colors"
             >
@@ -99,7 +100,7 @@ export default function JourneyShareSection({ journeyId }: { journeyId: number }
               { key: 'share_gallery' as const, label: t('journey.share.gallery'), icon: Grid },
               { key: 'share_map' as const, label: t('journey.share.map'), icon: MapPin },
             ].map(({ key, label, icon: Icon }) => (
-              <button
+              <button type="button"
                 key={key}
                 onClick={() => togglePerm(key)}
                 className={`flex items-center gap-2.5 px-3 py-2 rounded-xl border text-[12px] font-medium transition-all ${
diff --git a/client/src/components/Journey/MobileEntryCard.tsx b/client/src/components/Journey/MobileEntryCard.tsx
index 1146bad9f..da35d65de 100644
--- a/client/src/components/Journey/MobileEntryCard.tsx
+++ b/client/src/components/Journey/MobileEntryCard.tsx
@@ -72,7 +72,7 @@ export default function MobileEntryCard({ entry, dayLabel, dayColor, isActive, o
   const storyPreview = entry.story ? stripMarkdown(entry.story) : ''
 
   return (
-    <button
+    <button type="button"
       onClick={onClick}
       className={`flex-shrink-0 rounded-xl overflow-hidden text-left transition-all duration-100 ${
         isActive
diff --git a/client/src/components/Journey/MobileEntryView.tsx b/client/src/components/Journey/MobileEntryView.tsx
index 08c8dcdc7..e4ee45705 100644
--- a/client/src/components/Journey/MobileEntryView.tsx
+++ b/client/src/components/Journey/MobileEntryView.tsx
@@ -1,5 +1,5 @@
 import {
-  X, Pencil, Trash2, MapPin, Clock, Camera,
+  X, Pencil, Trash2, MapPin, Clock, Camera, Play,
   Laugh, Smile, Meh, Frown,
   Sun, CloudSun, Cloud, CloudRain, CloudLightning, Snowflake,
   ThumbsUp, ThumbsDown,
@@ -14,30 +14,37 @@ import type { JourneyEntry, JourneyPhoto } from '../../store/journeyStore'
 // local because the desktop variant carries raw hex values and no dark-mode
 // classes, so the two cannot share one table without changing how this looks.
 const MOOD_CONFIG: Record<string, { icon: typeof Smile; label: string; bg: string; text: string }> = {
-  amazing: { icon: Laugh,  label: 'journey.mood.amazing', bg: 'bg-pink-50 dark:bg-pink-900/20',    text: 'text-pink-600 dark:text-pink-400' },
-  good:    { icon: Smile,  label: 'journey.mood.good',    bg: 'bg-amber-50 dark:bg-amber-900/20',   text: 'text-amber-600 dark:text-amber-400' },
-  neutral: { icon: Meh,    label: 'journey.mood.neutral', bg: 'bg-zinc-100 dark:bg-zinc-800',        text: 'text-zinc-500 dark:text-zinc-400' },
-  rough:   { icon: Frown,  label: 'journey.mood.rough',   bg: 'bg-violet-50 dark:bg-violet-900/20',  text: 'text-violet-600 dark:text-violet-400' },
+  amazing: { icon: Laugh, label: 'journey.mood.amazing', bg: 'bg-pink-50 dark:bg-pink-900/20', text: 'text-pink-600 dark:text-pink-400' },
+  good: { icon: Smile, label: 'journey.mood.good', bg: 'bg-amber-50 dark:bg-amber-900/20', text: 'text-amber-600 dark:text-amber-400' },
+  neutral: { icon: Meh, label: 'journey.mood.neutral', bg: 'bg-zinc-100 dark:bg-zinc-800', text: 'text-zinc-500 dark:text-zinc-400' },
+  rough: { icon: Frown, label: 'journey.mood.rough', bg: 'bg-violet-50 dark:bg-violet-900/20', text: 'text-violet-600 dark:text-violet-400' },
 }
 
 const WEATHER_CONFIG: Record<string, { icon: typeof Sun; label: string }> = {
-  sunny:  { icon: Sun,            label: 'journey.weather.sunny' },
-  partly: { icon: CloudSun,      label: 'journey.weather.partly' },
-  cloudy: { icon: Cloud,          label: 'journey.weather.cloudy' },
-  rainy:  { icon: CloudRain,     label: 'journey.weather.rainy' },
+  sunny: { icon: Sun, label: 'journey.weather.sunny' },
+  partly: { icon: CloudSun, label: 'journey.weather.partly' },
+  cloudy: { icon: Cloud, label: 'journey.weather.cloudy' },
+  rainy: { icon: CloudRain, label: 'journey.weather.rainy' },
   stormy: { icon: CloudLightning, label: 'journey.weather.stormy' },
-  cold:   { icon: Snowflake,     label: 'journey.weather.cold' },
+  cold: { icon: Snowflake, label: 'journey.weather.cold' },
 }
 
-function photoUrl(p: JourneyPhoto, size: 'thumbnail' | 'original' = 'original', builder?: (id: number) => string): string {
-  if (builder) return builder(p.photo_id)
+function photoUrl(
+  p: JourneyPhoto,
+  size: 'thumbnail' | 'original' = 'original',
+  builder?: (id: number, size?: 'thumbnail' | 'original') => string
+): string {
+  if (builder) return builder(p.photo_id, size)
   return `/api/photos/${p.photo_id}/${size}`
 }
 
 interface Props {
   entry: JourneyEntry
   readOnly?: boolean
-  publicPhotoUrl?: (photoId: number) => string
+  publicPhotoUrl?: (
+    photoId: number,
+    size?: 'thumbnail' | 'original'
+  ) => string
   onClose: () => void
   onEdit: () => void
   onDelete: () => void
@@ -60,7 +67,7 @@ export default function MobileEntryView({ entry, readOnly, publicPhotoUrl, onClo
     <div className="fixed inset-0 z-[9999] bg-white dark:bg-zinc-950 flex flex-col overflow-hidden" style={{ height: '100dvh' }}>
       {/* Top bar */}
       <div className="flex items-center justify-between px-4 py-3 border-b border-zinc-100 dark:border-zinc-800 flex-shrink-0">
-        <button
+        <button type="button"
           onClick={onClose}
           className="w-9 h-9 rounded-lg flex items-center justify-center text-zinc-500 hover:bg-zinc-100 dark:hover:bg-zinc-800 transition-colors"
         >
@@ -68,14 +75,14 @@ export default function MobileEntryView({ entry, readOnly, publicPhotoUrl, onClo
         </button>
         {!readOnly && (
           <div className="flex items-center gap-1.5">
-            <button
+            <button type="button"
               onClick={() => { onClose(); onEdit(); }}
               className="h-8 px-3 rounded-lg bg-zinc-100 dark:bg-zinc-800 text-zinc-700 dark:text-zinc-300 text-[12px] font-medium flex items-center gap-1.5 hover:bg-zinc-200 dark:hover:bg-zinc-700 transition-colors"
             >
               <Pencil size={13} />
               {t('common.edit')}
             </button>
-            <button
+            <button type="button"
               onClick={() => { onClose(); onDelete(); }}
               className="w-8 h-8 rounded-lg flex items-center justify-center text-zinc-400 hover:bg-red-50 hover:text-red-500 dark:hover:bg-red-900/20 dark:hover:text-red-400 transition-colors"
             >
@@ -91,35 +98,70 @@ export default function MobileEntryView({ entry, readOnly, publicPhotoUrl, onClo
         {/* Hero photo(s) */}
         {photos.length > 0 && (
           <div className="relative">
-            <img
-              src={photoUrl(photos[0], 'original', publicPhotoUrl)}
-              alt=""
-              className="w-full max-h-[50vh] object-cover cursor-pointer"
+            <button
+              type="button"
+              aria-label={photos[0].caption || t('journey.photos')}
+              className={`relative block w-full max-h-[50vh] cursor-pointer border-0 p-0 ${photos[0].media_type === 'video' ? 'bg-black' : 'bg-transparent'
+                }`}
               onClick={() => onPhotoClick(photos, 0)}
-            />
+            >
+              <img
+                src={photoUrl(photos[0], 'original', publicPhotoUrl)}
+                alt=""
+                className={`w-full max-h-[50vh] ${photos[0].media_type === 'video' ? 'object-contain' : 'object-cover'
+                  }`}
+              />
+
+              {photos[0].media_type === 'video' && (
+                <div className="pointer-events-none absolute inset-0 flex items-center justify-center">
+                  <span className="flex h-12 w-12 items-center justify-center rounded-full bg-black/60 text-white backdrop-blur">
+                    <Play size={20} className="ml-0.5" fill="currentColor" />
+                  </span>
+                </div>
+              )}
+            </button>
+
             {photos.length > 1 && (
               <div className="absolute bottom-3 right-3 flex items-center gap-1 bg-black/60 backdrop-blur-sm text-white rounded-full px-2.5 py-1 text-[11px] font-medium">
                 <Camera size={12} />
                 {t('mobileJourney.photosCount', { count: photos.length })}
               </div>
             )}
+
             {/* Photo strip for multiple photos */}
             {photos.length > 1 && (
               <div className="flex gap-1 px-4 py-2 overflow-x-auto bg-zinc-50 dark:bg-zinc-900">
                 {photos.map((p, i) => (
-                  <img
+                  <button
                     key={p.id || i}
-                    src={photoUrl(p, 'thumbnail', publicPhotoUrl)}
-                    alt=""
-                    className="w-16 h-16 rounded-lg object-cover flex-shrink-0 cursor-pointer hover:ring-2 ring-zinc-900/30 dark:ring-white/30 transition-all"
+                    type="button"
+                    aria-label={p.caption || t('journey.photos')}
+                    className={`relative h-16 w-16 flex-shrink-0 cursor-pointer overflow-hidden rounded-lg border-0 p-0 hover:ring-2 ring-zinc-900/30 dark:ring-white/30 transition-all ${p.media_type === 'video' ? 'bg-black' : 'bg-transparent'
+                      }`}
                     onClick={() => onPhotoClick(photos, i)}
-                  />
+                  >
+                    <img
+                      src={photoUrl(p, 'thumbnail', publicPhotoUrl)}
+                      alt=""
+                      className={`h-full w-full ${p.media_type === 'video' ? 'object-contain' : 'object-cover'
+                        }`}
+                    />
+
+                    {p.media_type === 'video' && (
+                      <div className="pointer-events-none absolute inset-0 flex items-center justify-center">
+                        <Play
+                          size={16}
+                          className="text-white drop-shadow"
+                          fill="currentColor"
+                        />
+                      </div>
+                    )}
+                  </button>
                 ))}
               </div>
             )}
           </div>
         )}
-
         {/* Content */}
         <div className="px-5 py-5 pb-32">
 
@@ -224,6 +266,6 @@ export default function MobileEntryView({ entry, readOnly, publicPhotoUrl, onClo
           )}
         </div>
       </div>
-    </div>
+    </div >
   )
 }
diff --git a/client/src/components/Journey/MobileMapTimeline.tsx b/client/src/components/Journey/MobileMapTimeline.tsx
index d7d43378d..c118c97cf 100644
--- a/client/src/components/Journey/MobileMapTimeline.tsx
+++ b/client/src/components/Journey/MobileMapTimeline.tsx
@@ -46,7 +46,7 @@ export default function MobileMapTimeline({
   const [activeIndex, setActiveIndex] = useState(0)
 
   const entryDayMeta = useMemo(() => {
-    const uniqueDates = [...new Set(entries.map((e: any) => e.entry_date).sort())]
+    const uniqueDates = [...new Set(entries.map((e: any) => e.entry_date).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)))]
     const counters = new Map<string, number>()
     return entries.map((e: any) => {
       const dayIdx = uniqueDates.indexOf(e.entry_date)
@@ -171,7 +171,7 @@ export default function MobileMapTimeline({
         />
         {!readOnly && onAddEntry && (
           <div className="fixed right-4 z-30" style={{ bottom: 'calc(var(--bottom-nav-h, 84px) + 16px)' }}>
-            <button
+            <button type="button"
               onClick={onAddEntry}
               className="w-12 h-12 rounded-full bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 shadow-lg flex items-center justify-center hover:scale-105 active:scale-95 transition-transform"
             >
@@ -244,7 +244,7 @@ export default function MobileMapTimeline({
           className="fixed right-4 z-30"
           style={{ bottom: 'calc(var(--bottom-nav-h, 84px) + 168px)' }}
         >
-          <button
+          <button type="button"
             onClick={onAddEntry}
             className="w-12 h-12 rounded-full bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 shadow-lg flex items-center justify-center hover:scale-105 active:scale-95 transition-transform"
           >
diff --git a/client/src/components/Journey/PhotoLightbox.tsx b/client/src/components/Journey/PhotoLightbox.tsx
index 64f9202c6..f8919552d 100644
--- a/client/src/components/Journey/PhotoLightbox.tsx
+++ b/client/src/components/Journey/PhotoLightbox.tsx
@@ -86,7 +86,7 @@ export default function PhotoLightbox({ photos, startIndex = 0, onClose }: Props
           <span style={{ color: 'rgba(255,255,255,0.5)', fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 500 }}>
             {idx + 1} / {photos.length}
           </span>
-          <button onClick={onClose} style={{
+          <button type="button" onClick={onClose} style={{
             background: 'rgba(255,255,255,0.1)', border: 'none', borderRadius: '50%',
             width: 36, height: 36, display: 'flex', alignItems: 'center', justifyContent: 'center',
             color: '#fff', cursor: 'pointer',
@@ -97,7 +97,7 @@ export default function PhotoLightbox({ photos, startIndex = 0, onClose }: Props
 
         {/* Prev button — visible on hover (desktop), always visible (mobile) */}
         {hasPrev && (
-          <button onClick={prev} className="flex sm:opacity-0 sm:group-hover/lightbox:opacity-100 transition-opacity" style={{
+          <button type="button" onClick={prev} className="flex sm:opacity-0 sm:group-hover/lightbox:opacity-100 transition-opacity" style={{
             position: 'absolute', left: 16, zIndex: 5,
             width: 44, height: 44, borderRadius: '50%',
             background: 'rgba(0,0,0,0.4)', backdropFilter: 'blur(8px)',
@@ -127,7 +127,7 @@ export default function PhotoLightbox({ photos, startIndex = 0, onClose }: Props
 
         {/* Next button */}
         {hasNext && (
-          <button onClick={next} className="flex sm:opacity-0 sm:group-hover/lightbox:opacity-100 transition-opacity" style={{
+          <button type="button" onClick={next} className="flex sm:opacity-0 sm:group-hover/lightbox:opacity-100 transition-opacity" style={{
             position: 'absolute', right: 16, zIndex: 5,
             width: 44, height: 44, borderRadius: '50%',
             background: 'rgba(0,0,0,0.4)', backdropFilter: 'blur(8px)',
diff --git a/client/src/components/Journey/VideoPlayer.tsx b/client/src/components/Journey/VideoPlayer.tsx
index 98a643161..f5dc79e06 100644
--- a/client/src/components/Journey/VideoPlayer.tsx
+++ b/client/src/components/Journey/VideoPlayer.tsx
@@ -25,27 +25,67 @@ export default function VideoPlayer({
   useEffect(() => {
     const el = videoRef.current
     if (!el) return
+
     const player = new Plyr(el, {
-      controls: ['play-large', 'play', 'progress', 'current-time', 'mute', 'volume', 'fullscreen'],
+      controls: [
+        'play-large',
+        'play',
+        'progress',
+        'current-time',
+        'duration',
+        'mute',
+        'volume',
+        'fullscreen',
+      ],
       autoplay: autoPlay,
-      // Keep playback inline so the lightbox stays in control on mobile.
       clickToPlay: true,
+      hideControls: false,
     })
-    return () => { try { player.destroy() } catch { /* already torn down */ } }
+
+    return () => {
+      try {
+        player.destroy()
+      } catch {
+        /* already torn down */
+      }
+    }
   }, [src, autoPlay])
 
   return (
     <div
+      className="trek-video-player"
       style={{
         width: 'min(92vw, 1100px)',
-        maxHeight: '92vh',
+        height: 'min(88vh, 900px)',
+        display: 'flex',
+        alignItems: 'center',
+        justifyContent: 'center',
+        background: '#000',
         borderRadius: 4,
         overflow: 'hidden',
         animation: 'fadeIn 0.15s ease',
         ...style,
       }}
     >
-      <video ref={videoRef} src={src} poster={poster} playsInline controls preload="metadata" />
+      <video
+        ref={videoRef}
+        src={src}
+        poster={poster}
+        playsInline
+        controls
+        preload="metadata"
+        style={{
+          width: '100%',
+          height: '100%',
+          maxWidth: '100%',
+          maxHeight: '100%',
+          objectFit: 'contain',
+          background: '#000',
+        }}
+      >
+        {/* Gallery uploads carry no caption file; the empty track keeps the element valid. */}
+        <track kind="captions" />
+      </video>
     </div>
   )
-}
+}
\ No newline at end of file
diff --git a/client/src/components/Journey/stripMarkdown.ts b/client/src/components/Journey/stripMarkdown.ts
index f600a9b21..5cb9462a8 100644
--- a/client/src/components/Journey/stripMarkdown.ts
+++ b/client/src/components/Journey/stripMarkdown.ts
@@ -3,10 +3,13 @@
  * Handles: bold, italic, headings, links, images, blockquotes, code, lists, hr.
  */
 export function stripMarkdown(md: string): string {
-  return md
+  const withoutImages = md
     .replace(/^#{1,6}\s+/gm, '')           // headings
-    .replace(/!\[.*?\]\(.*?\)/g, '')        // images
-    .replace(/\[([^\]]*)\]\(.*?\)/g, '$1')  // links → text
+    // the alt text is a run that cannot contain "](", so it ends on the first one
+    // instead of being retried against every later "](". Same matches, no backtracking
+    .replace(/!\[(?:(?!\]\().)*\]\(.*?\)/g, '') // images
+
+  return stripLinks(withoutImages)          // links → text
     .replace(/(`{3}[\s\S]*?`{3})/g, '')     // code blocks
     .replace(/`([^`]+)`/g, '$1')            // inline code
     .replace(/\*\*(.+?)\*\*/g, '$1')        // bold **
@@ -22,3 +25,68 @@ export function stripMarkdown(md: string): string {
     .replace(/\n/g, ' ')                    // remaining newlines → spaces
     .trim()
 }
+
+/**
+ * `.` matches every character except a line terminator, which is exactly the set a link
+ * target could be built from back when this was `.*?`. Testing a single character against
+ * it spells that out without hand-listing \n, \r and the two Unicode separators.
+ */
+const notALineTerminator = /./
+
+/**
+ * Replace `[label](target)` with its label, exactly as `/\[([^\]]*)\]\(.*?\)/g` did.
+ *
+ * Written as a scan rather than a regex because that pattern backtracks: `[^\]]` matches
+ * `[` too, so on a run of `[` with no `]` after it the engine retries the whole
+ * label-and-target scan from every one of them and reads to the end each time. Measured
+ * on 32k of `[x`: 300ms, quadrupling with every doubling. The subject is a journal
+ * entry's story text, which any contributor to the journal can write and every reader's
+ * browser then renders a preview of.
+ *
+ * The semantics are the regex's, quirks included:
+ *  - the label runs to the FIRST `]` and may itself contain `[`, so `[a[b](c)` keeps
+ *    `a[b` — narrowing the label to `[^[\]]` would have been a behaviour change;
+ *  - the label may be empty, since `[^\]]*` is zero-or-more, so `[](c)` is a link;
+ *  - `(` has to sit directly after that `]`;
+ *  - the target ends at the first `)`, and `.` cannot cross a line terminator, so a `(`
+ *    whose first `)` only turns up on a later line is not a link at all.
+ */
+function stripLinks(input: string): string {
+  let out = ''
+  let cursor = 0 // everything before this has already been copied into `out`
+  let search = 0 // where the next `[` is looked for
+  // First `)`-or-line-terminator at or after the target we last examined. Targets are
+  // examined left to right, so this only ever moves forward — which is what stops a
+  // document full of `[a](` from being re-read once per candidate.
+  let stop = 0
+
+  for (;;) {
+    const open = input.indexOf('[', search)
+    if (open === -1) break
+
+    const close = input.indexOf(']', open + 1)
+    // No `]` left anywhere: neither this `[` nor any after it can match. Rediscovering
+    // that from every `[` in turn is what the regex spent quadratic time on.
+    if (close === -1) break
+
+    // Every `[` between `open` and `close` has that same first `]`, so the verdict on
+    // what follows it is the verdict for all of them — skip the lot when it fails.
+    if (input[close + 1] !== '(') {
+      search = close + 1
+      continue
+    }
+
+    if (stop < close + 2) stop = close + 2
+    while (stop < input.length && input[stop] !== ')' && notALineTerminator.test(input[stop])) stop++
+    if (input[stop] !== ')') {
+      search = close + 1
+      continue
+    }
+
+    out += input.slice(cursor, open) + input.slice(open + 1, close)
+    cursor = stop + 1
+    search = stop + 1
+  }
+
+  return out + input.slice(cursor)
+}
diff --git a/client/src/components/Layout/BottomNav.tsx b/client/src/components/Layout/BottomNav.tsx
index 67ed52736..2946d8cf3 100644
--- a/client/src/components/Layout/BottomNav.tsx
+++ b/client/src/components/Layout/BottomNav.tsx
@@ -84,7 +84,7 @@ export default function BottomNav() {
   const renderItem = ({ to, label, icon: Icon }: NavItem) => {
     const active = isActive(to)
     return (
-      <button
+      <button type="button"
         key={to}
         onClick={() => navigate(to)}
         className="flex flex-col items-center gap-1 py-1 px-1 min-w-0"
@@ -115,7 +115,7 @@ export default function BottomNav() {
     >
       <div className="flex flex-1 items-center justify-around min-w-0">{left.map(renderItem)}</div>
 
-      <button
+      <button type="button"
         onClick={create.run}
         aria-label={create.label}
         className="flex items-center justify-center flex-shrink-0 active:scale-95 transition-transform"
diff --git a/client/src/components/Layout/DemoBanner.tsx b/client/src/components/Layout/DemoBanner.tsx
index a43feb7d0..0bda3e682 100644
--- a/client/src/components/Layout/DemoBanner.tsx
+++ b/client/src/components/Layout/DemoBanner.tsx
@@ -304,9 +304,20 @@ export default function DemoBanner(): React.ReactElement | null {
         overflow: 'auto',
         fontFamily: 'var(--font-system)',
       }}
+      role="button"
+      tabIndex={0}
+      aria-label={t.close}
       onClick={() => setDismissed(true)}
+      onKeyDown={(e: React.KeyboardEvent<HTMLDivElement>) => {
+        if (e.target !== e.currentTarget) return;
+        if (e.key === 'Enter' || e.key === ' ') {
+          e.preventDefault();
+          setDismissed(true);
+        }
+      }}
     >
       <div
+        role="presentation"
         style={{
           background: 'white',
           borderRadius: 20,
@@ -547,7 +558,7 @@ export default function DemoBanner(): React.ReactElement | null {
               {t.selfHostLink}
             </a>
           </div>
-          <button
+          <button type="button"
             onClick={() => setDismissed(true)}
             style={{
               background: '#111827',
diff --git a/client/src/components/Layout/InAppNotificationBell.test.tsx b/client/src/components/Layout/InAppNotificationBell.test.tsx
index 45ccea8bc..b9fe381d7 100644
--- a/client/src/components/Layout/InAppNotificationBell.test.tsx
+++ b/client/src/components/Layout/InAppNotificationBell.test.tsx
@@ -62,7 +62,7 @@ describe('InAppNotificationBell', () => {
     const bell = screen.getAllByRole('button')[0];
     await user.click(bell);
     // Panel shows "Notifications" title
-    await screen.findByText('Notifications');
+    expect(await screen.findByText('Notifications')).toBeInTheDocument();
   });
 
   it('FE-COMP-BELL-004: notification panel shows empty state when no notifications', async () => {
@@ -76,7 +76,7 @@ describe('InAppNotificationBell', () => {
     render(<InAppNotificationBell />);
     const bell = screen.getAllByRole('button')[0];
     await user.click(bell);
-    await screen.findByText('No notifications');
+    expect(await screen.findByText('No notifications')).toBeInTheDocument();
   });
 
   it('FE-COMP-BELL-005: shows unread badge count when there are unread notifications', async () => {
@@ -98,7 +98,7 @@ describe('InAppNotificationBell', () => {
     render(<InAppNotificationBell />);
     const bell = screen.getAllByRole('button')[0];
     await user.click(bell);
-    await screen.findByTitle('Mark all read');
+    expect(await screen.findByTitle('Mark all read')).toBeInTheDocument();
   });
 
   it('FE-COMP-BELL-008: panel shows empty description when no notifications', async () => {
@@ -111,7 +111,7 @@ describe('InAppNotificationBell', () => {
     const user = userEvent.setup();
     render(<InAppNotificationBell />);
     await user.click(screen.getAllByRole('button')[0]);
-    await screen.findByText("You're all caught up!");
+    expect(await screen.findByText("You're all caught up!")).toBeInTheDocument();
   });
 
   it('FE-COMP-BELL-009: bell is accessible as a button', () => {
diff --git a/client/src/components/Layout/InAppNotificationBell.tsx b/client/src/components/Layout/InAppNotificationBell.tsx
index ffabc2057..18754f28e 100644
--- a/client/src/components/Layout/InAppNotificationBell.tsx
+++ b/client/src/components/Layout/InAppNotificationBell.tsx
@@ -42,7 +42,7 @@ export default function InAppNotificationBell(): React.ReactElement {
 
   return (
     <div className="relative flex-shrink-0">
-      <button
+      <button type="button"
         onClick={handleOpen}
         title={t('notifications.title')}
         className="relative p-2 rounded-lg transition-colors text-content-muted"
@@ -69,7 +69,8 @@ export default function InAppNotificationBell(): React.ReactElement {
 
       {open && createPortal(
         <>
-          <div style={{ position: 'fixed', inset: 0, zIndex: 9998 }} onClick={() => setOpen(false)} />
+          {/* Click-away catcher only — the bell button itself closes the panel again from the keyboard. */}
+          <div role="presentation" style={{ position: 'fixed', inset: 0, zIndex: 9998 }} onClick={() => setOpen(false)} />
           <div
             className="rounded-xl shadow-xl border overflow-hidden bg-surface-card border-edge"
             style={{
@@ -98,7 +99,7 @@ export default function InAppNotificationBell(): React.ReactElement {
               </span>
               <div className="flex items-center gap-1">
                 {unreadCount > 0 && (
-                  <button
+                  <button type="button"
                     onClick={markAllRead}
                     title={t('notifications.markAllRead')}
                     className="p-1.5 rounded-lg transition-colors text-content-muted"
@@ -109,7 +110,7 @@ export default function InAppNotificationBell(): React.ReactElement {
                   </button>
                 )}
                 {notifications.length > 0 && (
-                  <button
+                  <button type="button"
                     onClick={deleteAll}
                     title={t('notifications.deleteAll')}
                     className="p-1.5 rounded-lg transition-colors text-content-muted"
@@ -142,7 +143,7 @@ export default function InAppNotificationBell(): React.ReactElement {
             </div>
 
             {/* Footer */}
-            <button
+            <button type="button"
               onClick={handleShowAll}
               className="w-full py-2.5 text-xs font-medium transition-colors flex-shrink-0 border-t border-edge-secondary text-content"
               style={{
diff --git a/client/src/components/Layout/MobileTopBar.tsx b/client/src/components/Layout/MobileTopBar.tsx
index 4c8851974..c87825756 100644
--- a/client/src/components/Layout/MobileTopBar.tsx
+++ b/client/src/components/Layout/MobileTopBar.tsx
@@ -24,7 +24,7 @@ export default function MobileTopBar() {
         className="md:hidden flex items-center justify-end gap-2 px-4"
         style={{ paddingTop: 'calc(10px + env(safe-area-inset-top, 0px))', paddingBottom: 10 }}
       >
-        <button
+        <button type="button"
           onClick={() => navigate('/notifications')}
           aria-label={t('notifications.title')}
           className="relative grid place-items-center rounded-full active:scale-95 transition-transform"
@@ -35,7 +35,7 @@ export default function MobileTopBar() {
             <span style={{ position: 'absolute', top: 7, right: 7, width: 8, height: 8, borderRadius: '50%', background: 'oklch(0.7 0.17 38)', boxShadow: '0 0 0 2px var(--bg, #fff)' }} />
           )}
         </button>
-        <button
+        <button type="button"
           onClick={() => setShowProfile(true)}
           aria-label={t('nav.profile')}
           className="grid place-items-center rounded-full text-white font-semibold text-[12px] active:scale-95 transition-transform"
@@ -59,11 +59,12 @@ function ProfileSheet({ onClose }: { onClose: () => void }) {
   const handleLogout = () => { onClose(); logout(); navigate('/login') }
 
   return (
-    <div className="fixed inset-0 z-[300] md:hidden" onClick={onClose}>
+    <div className="fixed inset-0 z-[300] md:hidden" role="presentation" onClick={onClose}>
       <div className="absolute inset-0 bg-black/50 backdrop-blur-sm" />
       <div
         className="absolute bottom-0 left-0 right-0 bg-white dark:bg-zinc-900 rounded-t-2xl overflow-hidden"
         style={{ animation: 'slideUp 0.25s ease-out', paddingBottom: 'env(safe-area-inset-bottom, 0px)' }}
+        role="presentation"
         onClick={e => e.stopPropagation()}
       >
         <div className="flex justify-center pt-3 pb-2">
@@ -90,7 +91,7 @@ function ProfileSheet({ onClose }: { onClose: () => void }) {
         <div className="h-px bg-zinc-100 dark:bg-zinc-800 mx-4" />
 
         <div className="py-2 px-2">
-          <button
+          <button type="button"
             onClick={() => handleNav('/settings')}
             className="w-full flex items-center gap-3 px-4 py-3 rounded-xl text-left hover:bg-zinc-50 dark:hover:bg-zinc-800 active:bg-zinc-100 dark:active:bg-zinc-800 transition-colors"
           >
@@ -99,7 +100,7 @@ function ProfileSheet({ onClose }: { onClose: () => void }) {
           </button>
 
           {user?.role === 'admin' && (
-            <button
+            <button type="button"
               onClick={() => handleNav('/admin')}
               className="w-full flex items-center gap-3 px-4 py-3 rounded-xl text-left hover:bg-zinc-50 dark:hover:bg-zinc-800 active:bg-zinc-100 dark:active:bg-zinc-800 transition-colors"
             >
@@ -112,7 +113,7 @@ function ProfileSheet({ onClose }: { onClose: () => void }) {
         <div className="h-px bg-zinc-100 dark:bg-zinc-800 mx-4" />
 
         <div className="py-2 px-2">
-          <button
+          <button type="button"
             onClick={handleLogout}
             className="w-full flex items-center gap-3 px-4 py-3 rounded-xl text-left hover:bg-red-50 dark:hover:bg-red-900/20 active:bg-red-100 transition-colors"
           >
diff --git a/client/src/components/Layout/Navbar.tsx b/client/src/components/Layout/Navbar.tsx
index fffe57e90..cba250429 100644
--- a/client/src/components/Layout/Navbar.tsx
+++ b/client/src/components/Layout/Navbar.tsx
@@ -115,7 +115,7 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
           being centred on top of both (#1983). */}
       <div className="flex items-center gap-3 min-w-0 flex-1 basis-0">
         {showBack && (
-          <button onClick={onBack}
+          <button type="button" onClick={onBack}
             className="trek-back-btn p-1.5 rounded-lg transition-colors flex items-center gap-1.5 text-sm flex-shrink-0 text-content-muted"
             onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
             onMouseLeave={e => e.currentTarget.style.background = 'transparent'}>
@@ -215,7 +215,7 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
 
       {/* Share button */}
       {onShare && (
-        <button onClick={onShare}
+        <button type="button" onClick={onShare}
           className="flex items-center gap-1.5 py-1.5 px-3 rounded-lg border transition-colors text-sm font-medium flex-shrink-0 border-edge text-content-secondary bg-surface-card"
           onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
           onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}>
@@ -235,7 +235,7 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
       )}
 
       {/* Dark mode toggle (light ↔ dark, overrides auto) — hidden on mobile */}
-      <button onClick={toggleDarkMode} title={dark ? t('nav.lightMode') : t('nav.darkMode')}
+      <button type="button" onClick={toggleDarkMode} title={dark ? t('nav.lightMode') : t('nav.darkMode')}
         className="p-2 rounded-lg transition-colors flex-shrink-0 hidden sm:flex relative w-8 h-8 items-center justify-center text-content-muted"
         onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
         onMouseLeave={e => e.currentTarget.style.background = 'transparent'}>
@@ -252,7 +252,7 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
       {/* User menu */}
       {user && (
         <div className="relative">
-          <button onClick={() => setUserMenuOpen(!userMenuOpen)}
+          <button type="button" onClick={() => setUserMenuOpen(!userMenuOpen)}
             className="flex items-center gap-2 py-1.5 px-3 rounded-lg transition-colors"
             onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
             onMouseLeave={e => e.currentTarget.style.background = 'transparent'}>
@@ -272,7 +272,7 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
 
           {userMenuOpen && createPortal(
             <>
-              <div style={{ position: 'fixed', inset: 0, zIndex: 9998 }} onClick={() => setUserMenuOpen(false)} />
+              <div style={{ position: 'fixed', inset: 0, zIndex: 9998 }} role="presentation" onClick={() => setUserMenuOpen(false)} />
               <div className="trek-menu-enter w-52 rounded-xl shadow-xl border overflow-hidden bg-surface-card border-edge" style={{ position: 'fixed', top: 'var(--nav-h)', right: 8, zIndex: 9999 }}>
                 <div className="px-4 py-3 border-b border-edge-secondary">
                   <p className="text-sm font-medium text-content">{user.username}</p>
@@ -313,7 +313,7 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
                 </div>
 
                 <div className="py-1 border-t border-edge-secondary">
-                  <button onClick={handleLogout}
+                  <button type="button" onClick={handleLogout}
                     className="flex items-center gap-2 w-full px-4 py-2 text-sm text-red-500 hover:bg-red-500/10 transition-colors">
                     <LogOut className="w-4 h-4" />
                     {t('nav.logout')}
diff --git a/client/src/components/Layout/PageSidebar.tsx b/client/src/components/Layout/PageSidebar.tsx
index d0f06a3bc..a81203678 100644
--- a/client/src/components/Layout/PageSidebar.tsx
+++ b/client/src/components/Layout/PageSidebar.tsx
@@ -59,7 +59,7 @@ export default function PageSidebar({
       <div
         className="lg:hidden flex items-center justify-between px-4 py-3 border-b border-edge"
       >
-        <button
+        <button type="button"
           onClick={() => setMobileOpen(true)}
           className="w-9 h-9 rounded-lg flex items-center justify-center transition-colors hover:bg-[var(--bg-hover)] text-content"
           aria-label="Open navigation"
@@ -94,6 +94,7 @@ export default function PageSidebar({
         <>
           <div
             className="lg:hidden fixed inset-0 z-40 bg-[rgba(0,0,0,0.35)]"
+            role="presentation"
             onClick={() => setMobileOpen(false)}
           />
           <aside
@@ -110,7 +111,7 @@ export default function PageSidebar({
               >
                 {sidebarLabel}
               </span>
-              <button
+              <button type="button"
                 onClick={() => setMobileOpen(false)}
                 className="w-8 h-8 rounded-lg flex items-center justify-center transition-colors hover:bg-[var(--bg-hover)] text-content"
                 aria-label="Close navigation"
@@ -177,7 +178,7 @@ function SidebarInner({
                     {tab.group}
                   </div>
                 )}
-                <button
+                <button type="button"
                   onClick={() => onTabChange(tab.id)}
                   className={`flex items-center gap-2.5 px-3 py-2 rounded-lg text-sm text-left transition-colors ${active ? 'text-content font-semibold' : 'text-content-secondary font-medium'}`}
                   style={{
diff --git a/client/src/components/Map/MapView.tsx b/client/src/components/Map/MapView.tsx
index 5c8ca3deb..f1b507b54 100644
--- a/client/src/components/Map/MapView.tsx
+++ b/client/src/components/Map/MapView.tsx
@@ -16,7 +16,7 @@ import { useTransportRoutes } from '../../hooks/useTransportRoutes'
 import { visibleRouteReservations } from '../../utils/reservationRoutes'
 import { safeHexColor } from '../../utils/safeColor'
 import { escapeHtml } from '@trek/shared'
-import type { Reservation, RouteVia } from '../../types'
+import type { Day, Reservation, RouteVia } from '../../types'
 import { POI_CATEGORY_BY_KEY, type Poi } from './poiCategories'
 import { resolveTrackColor, hasManualTrackColor } from './trackColors'
 import { DEFAULT_MAP_CENTER, DEFAULT_MAP_ZOOM, SATELLITE_TILE_URL, SATELLITE_TILE_ATTRIBUTION, SATELLITE_TILE_MAXZOOM } from '../../constants/mapDefaults'
@@ -526,6 +526,8 @@ export const MapView = memo(function MapView({
   showReservationStats = false,
   visibleConnectionIds = [] as number[],
   showTransitRoutes = true,
+  days = [] as Day[],
+  selectedDayId = null,
   onReservationClick,
   pois = [] as Poi[],
   onPoiClick,
@@ -545,8 +547,8 @@ export const MapView = memo(function MapView({
     </Marker>
   )), [pois, onPoiClick])
   const visibleReservations = useMemo(() => (
-    visibleRouteReservations(reservations, { visibleConnectionIds, showTransitRoutes })
-  ), [reservations, visibleConnectionIds, showTransitRoutes])
+    visibleRouteReservations(reservations, { visibleConnectionIds, showTransitRoutes, selectedDayId, days })
+  ), [reservations, visibleConnectionIds, showTransitRoutes, selectedDayId, days])
   // Real road geometry for car/bus/taxi/bicycle bookings (straight line until it loads/if it fails).
   const transportRoutes = useTransportRoutes(visibleReservations)
   // Dynamic padding: account for sidebars + bottom inspector + day detail panel
diff --git a/client/src/components/Map/MapViewGL.tsx b/client/src/components/Map/MapViewGL.tsx
index a2f3ab69a..4b4cf6241 100644
--- a/client/src/components/Map/MapViewGL.tsx
+++ b/client/src/components/Map/MapViewGL.tsx
@@ -17,7 +17,7 @@ import { escapeHtml } from '@trek/shared'
 import { MAPBOX_DEFAULT_STYLE, styleForActiveProvider, basemapLanguage, type GlMapProvider } from './glProviders'
 import LocationButton from './LocationButton'
 import { useGeolocation } from '../../hooks/useGeolocation'
-import type { Place, Reservation, RouteVia } from '../../types'
+import type { Day, Place, Reservation, RouteVia } from '../../types'
 import { POI_CATEGORY_BY_KEY, type Poi } from './poiCategories'
 import { resolveTrackColor, hasManualTrackColor } from './trackColors'
 import { buildPoiPopupHtml } from './placePopup'
@@ -86,6 +86,7 @@ const NO_DAY_ORDER: Record<number, number[] | null> = {}
 const NO_RESERVATIONS: Reservation[] = []
 const NO_CONNECTION_IDS: number[] = []
 const NO_POIS: Poi[] = []
+const NO_DAYS: Day[] = []
 
 interface Props {
   places: Place[]
@@ -114,6 +115,8 @@ interface Props {
   reservations?: Reservation[]
   visibleConnectionIds?: number[]
   showTransitRoutes?: boolean
+  days?: Day[]
+  selectedDayId?: number | null
   showReservationStats?: boolean
   onReservationClick?: (reservationId: number) => void
   pois?: Poi[]
@@ -359,6 +362,8 @@ export function MapViewGL({
   reservations = NO_RESERVATIONS,
   visibleConnectionIds = NO_CONNECTION_IDS,
   showTransitRoutes = true,
+  days = NO_DAYS,
+  selectedDayId = null,
   showReservationStats = false,
   onReservationClick,
   pois = NO_POIS,
@@ -1270,8 +1275,8 @@ export function MapViewGL({
   // DayPlanSidebar — nothing is rendered until the user enables a
   // booking's route, matching the Leaflet MapView's behaviour.
   const visibleReservations = useMemo(() => (
-    visibleRouteReservations(reservations, { visibleConnectionIds, showTransitRoutes })
-  ), [reservations, visibleConnectionIds, showTransitRoutes])
+    visibleRouteReservations(reservations, { visibleConnectionIds, showTransitRoutes, selectedDayId, days })
+  ), [reservations, visibleConnectionIds, showTransitRoutes, selectedDayId, days])
   // Real road geometry for car/bus/taxi/bicycle bookings (straight line until it loads/if it fails).
   const transportRoutes = useTransportRoutes(visibleReservations)
 
diff --git a/client/src/components/Map/ReservationOverlay.tsx b/client/src/components/Map/ReservationOverlay.tsx
index ac9daeccf..22e380dd2 100644
--- a/client/src/components/Map/ReservationOverlay.tsx
+++ b/client/src/components/Map/ReservationOverlay.tsx
@@ -6,6 +6,7 @@ import { Plane, Train, Ship, Car, Bus, Sailboat, Bike, CarTaxiFront, Route, Tram
 import { escapeHtml } from '@trek/shared'
 import { getTransitMapSegments, type TransitMapSegment } from './transitGeometry'
 import { geodesicArcs } from './flightGeodesy'
+import { cleanEndpointName } from './reservationName'
 import { useSettingsStore } from '../../store/settingsStore'
 import type { Reservation, ReservationEndpoint } from '../../types'
 
@@ -64,10 +65,6 @@ function endpointIcon(type: TransportType, label: string | null): L.DivIcon {
 
 function toRad(d: number) { return d * Math.PI / 180 }
 
-function cleanName(name: string): string {
-  return name.replace(/\s*\([^)]*\)/g, '').trim()
-}
-
 function haversineKm(a: [number, number], b: [number, number]): number {
   const R = 6371
   const dLat = toRad(b[0] - a[0])
@@ -85,7 +82,7 @@ function parseInTz(isoLocal: string, tz: string): number {
   // minutes) makes Date.UTC NaN; bail before formatToParts, which throws on a
   // non-finite date and would blank the whole trip. computeDuration's finiteness
   // check then drops the duration cleanly.
-  if (!Number.isFinite(guess)) return NaN
+  if (!Number.isFinite(guess)) return Number.NaN
   const fmt = new Intl.DateTimeFormat('en-US', {
     timeZone: tz, hour12: false,
     year: 'numeric', month: '2-digit', day: '2-digit',
@@ -271,7 +268,7 @@ export default function ReservationOverlay({ reservations, showConnections, onEn
         <Marker
           key={`wp-${item.res.id}-${wi}`}
           position={[wp.lat, wp.lng]}
-          icon={endpointIcon(item.type, showEndpointLabels && labelVisibleIds.has(item.res.id) ? (wp.code || cleanName(wp.name)) : null)}
+          icon={endpointIcon(item.type, showEndpointLabels && labelVisibleIds.has(item.res.id) ? (wp.code || cleanEndpointName(wp.name)) : null)}
           pane={ENDPOINT_PANE}
           zIndexOffset={1000}
           eventHandlers={{ click: () => onEndpointClick?.(item.res.id) }}
diff --git a/client/src/components/Map/reservationName.test.ts b/client/src/components/Map/reservationName.test.ts
new file mode 100644
index 000000000..4b2933458
--- /dev/null
+++ b/client/src/components/Map/reservationName.test.ts
@@ -0,0 +1,53 @@
+import { describe, it, expect } from 'vitest'
+import { cleanEndpointName } from './reservationName'
+
+// The pattern this replaced. Kept here so the equivalence claim in the module
+// is a test rather than a comment.
+const LEGACY = /\s*\([^)]*\)/g
+
+describe('cleanEndpointName', () => {
+  it('drops the parenthetical a booking confirmation appends', () => {
+    expect(cleanEndpointName('Wien Hbf (Vienna)')).toBe('Wien Hbf')
+  })
+
+  it('leaves an unclosed bracket alone', () => {
+    expect(cleanEndpointName('Gare de Lyon (Paris')).toBe('Gare de Lyon (Paris')
+  })
+
+  it('takes the whitespace directly before the bracket with it', () => {
+    expect(cleanEndpointName('Zurich HB   (ZRH)   ')).toBe('Zurich HB')
+  })
+
+  it('handles several brackets and an empty one', () => {
+    expect(cleanEndpointName('A (b) C () D')).toBe('A C D')
+  })
+
+  it('returns a name without brackets untouched', () => {
+    expect(cleanEndpointName('Amsterdam Centraal')).toBe('Amsterdam Centraal')
+  })
+
+  it('does not hang on the input that made the regex quadratic', () => {
+    // 32k spaces with no "(" after them: the shape that froze the map for
+    // every member of a trip once one member had typed it.
+    const started = performance.now()
+    expect(cleanEndpointName(' '.repeat(32_000) + 'x')).toBe('x')
+    expect(performance.now() - started).toBeLessThan(100)
+  })
+
+  it('agrees with the regex on every generated name', () => {
+    const alphabet = [...'ab() \t']
+    let checked = 0
+    for (let len = 0; len <= 6; len++) {
+      const total = alphabet.length ** len
+      for (let n = 0; n < total; n++) {
+        let s = ''
+        for (let k = n, i = 0; i < len; i++, k = Math.floor(k / alphabet.length)) {
+          s += alphabet[k % alphabet.length]
+        }
+        expect(cleanEndpointName(s)).toBe(s.replace(LEGACY, '').trim())
+        checked++
+      }
+    }
+    expect(checked).toBe(55987)
+  })
+})
diff --git a/client/src/components/Map/reservationName.ts b/client/src/components/Map/reservationName.ts
new file mode 100644
index 000000000..a8719286a
--- /dev/null
+++ b/client/src/components/Map/reservationName.ts
@@ -0,0 +1,31 @@
+/**
+ * "Wien Hbf (Vienna)" → "Wien Hbf" — the endpoint name as a map label wants it,
+ * without the parenthetical a booking confirmation likes to append. Both map
+ * renderers go through here so an endpoint never reads one way on the Leaflet
+ * map and another on the GL one.
+ *
+ * Written as a scan rather than the /\s*\([^)]*\)/g it replaces. That pattern's
+ * leading \s* overlaps the engine's own restart-at-every-position scan, so a
+ * name that is a long run of spaces with no "(" after it backtracks
+ * quadratically (1.0s at 32k), and so does a run of "(" with no ")". An
+ * endpoint name is free text any trip member types and every other member's
+ * browser renders, so that is reachable across users.
+ *
+ * Matches the regex exactly: the whitespace directly before a "(" that has a
+ * ")" after it goes too, and an unclosed "(" is left alone.
+ */
+export function cleanEndpointName(name: string): string {
+  let out = ''
+  let cursor = 0
+  for (;;) {
+    const open = name.indexOf('(', cursor)
+    if (open === -1) break
+    const close = name.indexOf(')', open + 1)
+    if (close === -1) break
+    let start = open
+    while (start > cursor && /\s/.test(name[start - 1])) start--
+    out += name.slice(cursor, start)
+    cursor = close + 1
+  }
+  return (out + name.slice(cursor)).trim()
+}
diff --git a/client/src/components/Map/reservationsMapbox.ts b/client/src/components/Map/reservationsMapbox.ts
index 63af95c59..8b6e64a63 100644
--- a/client/src/components/Map/reservationsMapbox.ts
+++ b/client/src/components/Map/reservationsMapbox.ts
@@ -12,6 +12,7 @@ import type mapboxgl from 'mapbox-gl'
 import { Plane, Train, Ship, Car, Bus, Sailboat, Bike, CarTaxiFront, Route, TramFront } from 'lucide-react'
 import { getTransitMapSegments } from './transitGeometry'
 import { geodesicArcs } from './flightGeodesy'
+import { cleanEndpointName } from './reservationName'
 import { escapeHtml } from '@trek/shared'
 import type { Reservation, ReservationEndpoint } from '../../types'
 
@@ -57,7 +58,7 @@ function parseInTz(isoLocal: string, tz: string): number {
   // minutes) makes Date.UTC NaN; bail before formatToParts, which throws on a
   // non-finite date and would blank the whole trip. computeDuration's finiteness
   // check then drops the duration cleanly.
-  if (!Number.isFinite(guess)) return NaN
+  if (!Number.isFinite(guess)) return Number.NaN
   const fmt = new Intl.DateTimeFormat('en-US', {
     timeZone: tz, hour12: false,
     year: 'numeric', month: '2-digit', day: '2-digit',
@@ -94,8 +95,6 @@ function computeDuration(from: ReservationEndpoint, to: ReservationEndpoint, fal
   return h > 0 ? `${h}h ${m}m` : `${m}m`
 }
 
-const cleanName = (name: string) => name.replace(/\s*\([^)]*\)/g, '').trim()
-
 // ── item building ─────────────────────────────────────────────────────────
 interface TransportItem {
   res: Reservation
@@ -349,7 +348,7 @@ export class ReservationMapboxOverlay {
       for (const item of visibleItems) {
         const showLabel = this.opts.showEndpointLabels && labelVisibleIds.has(item.res.id)
         for (const ep of item.waypoints) {
-          const label = showLabel ? (ep.code || cleanName(ep.name)) : null
+          const label = showLabel ? (ep.code || cleanEndpointName(ep.name)) : null
           const el = document.createElement('div')
           el.innerHTML = endpointMarkerHtml(item.type, label)
           const inner = el.firstElementChild as HTMLElement | null
diff --git a/client/src/components/Map/transitGeometry.ts b/client/src/components/Map/transitGeometry.ts
index b12d76d42..0852c9006 100644
--- a/client/src/components/Map/transitGeometry.ts
+++ b/client/src/components/Map/transitGeometry.ts
@@ -27,7 +27,7 @@ export function decodePolyline(encoded: string, precision = 6): [number, number]
       let byte = 0x20
       while (byte >= 0x20) {
         if (index >= encoded.length) return coords
-        byte = encoded.charCodeAt(index++) - 63
+        byte = encoded.codePointAt(index++) - 63
         result |= (byte & 0x1f) << shift
         shift += 5
       }
diff --git a/client/src/components/Notifications/InAppNotificationItem.tsx b/client/src/components/Notifications/InAppNotificationItem.tsx
index 369af6cdc..6a501baec 100644
--- a/client/src/components/Notifications/InAppNotificationItem.tsx
+++ b/client/src/components/Notifications/InAppNotificationItem.tsx
@@ -92,7 +92,7 @@ export default function InAppNotificationItem({ notification, onClose }: Notific
                 {relativeTime(notification.created_at, locale)}
               </span>
               {!notification.is_read && (
-                <button
+                <button type="button"
                   onClick={() => markRead(notification.id)}
                   title={t('notifications.markRead')}
                   className="p-1 rounded transition-colors"
@@ -103,7 +103,7 @@ export default function InAppNotificationItem({ notification, onClose }: Notific
                   <CheckCheck className="w-3.5 h-3.5" />
                 </button>
               )}
-              <button
+              <button type="button"
                 onClick={() => deleteNotification(notification.id)}
                 title={t('notifications.delete')}
                 className="p-1 rounded transition-colors"
@@ -123,16 +123,14 @@ export default function InAppNotificationItem({ notification, onClose }: Notific
           {/* Boolean actions */}
           {notification.type === 'boolean' && notification.positive_text_key && notification.negative_text_key && (
             <div className="flex gap-2 mt-2">
-              <button
+              <button type="button"
                 onClick={() => handleRespond('positive')}
                 disabled={responding || notification.response !== null}
                 className="flex items-center gap-1 px-2.5 py-1 rounded-lg text-xs font-medium transition-colors"
                 style={{
                   background: notification.response === 'positive'
                     ? 'var(--text-primary)'
-                    : notification.response === 'negative'
-                      ? (dark ? '#27272a' : '#f1f5f9')
-                      : (dark ? '#27272a' : '#f1f5f9'),
+                    : (dark ? '#27272a' : '#f1f5f9'),
                   color: notification.response === 'positive'
                     ? '#fff'
                     : notification.response === 'negative'
@@ -145,16 +143,14 @@ export default function InAppNotificationItem({ notification, onClose }: Notific
                 <Check className="w-3 h-3" />
                 {t(notification.positive_text_key)}
               </button>
-              <button
+              <button type="button"
                 onClick={() => handleRespond('negative')}
                 disabled={responding || notification.response !== null}
                 className="flex items-center gap-1 px-2.5 py-1 rounded-lg text-xs font-medium transition-colors"
                 style={{
                   background: notification.response === 'negative'
                     ? '#ef4444'
-                    : notification.response === 'positive'
-                      ? (dark ? '#27272a' : '#f1f5f9')
-                      : (dark ? '#27272a' : '#f1f5f9'),
+                    : (dark ? '#27272a' : '#f1f5f9'),
                   color: notification.response === 'negative'
                     ? '#fff'
                     : notification.response === 'positive'
@@ -172,7 +168,7 @@ export default function InAppNotificationItem({ notification, onClose }: Notific
 
           {/* Navigate action */}
           {notification.type === 'navigate' && notification.navigate_text_key && notification.navigate_target && (
-            <button
+            <button type="button"
               onClick={handleNavigate}
               className="flex items-center gap-1 mt-2 px-2.5 py-1 rounded-lg text-xs font-medium transition-colors"
               style={{ background: dark ? '#27272a' : '#f1f5f9', color: 'var(--text-secondary)' }}
diff --git a/client/src/components/OAuth/ScopeGroupPicker.tsx b/client/src/components/OAuth/ScopeGroupPicker.tsx
index cd3183dad..c9c20d259 100644
--- a/client/src/components/OAuth/ScopeGroupPicker.tsx
+++ b/client/src/components/OAuth/ScopeGroupPicker.tsx
@@ -77,9 +77,9 @@ export default function ScopeGroupPicker({ selected, onChange }: Props): React.R
                         )}
                         className="mt-0.5 rounded flex-shrink-0"
                       />
-                      <div>
-                        <p className="text-xs font-medium text-content">{label}</p>
-                        <p className="text-xs" style={{ color: 'var(--text-tertiary)' }}>{description}</p>
+                      <div className="text-xs font-medium text-content">
+                        {label}
+                        <p className="text-xs font-normal" style={{ color: 'var(--text-tertiary)' }}>{description}</p>
                       </div>
                     </label>
                   ))}
diff --git a/client/src/components/PDF/TripPDF.tsx b/client/src/components/PDF/TripPDF.tsx
index 7e531f4d8..8a7c3c789 100644
--- a/client/src/components/PDF/TripPDF.tsx
+++ b/client/src/components/PDF/TripPDF.tsx
@@ -85,7 +85,7 @@ function escHtml(str) {
 // escHtml alone cannot stop a cover_image from closing the url() and appending its own
 // declaration. Percent-encoding is transparent to the fetch.
 function cssUrl(url) {
-  return String(url).replace(/["'()\\\s]/g, c => '%' + c.charCodeAt(0).toString(16).padStart(2, '0'))
+  return String(url).replace(/["'()\\\s]/g, c => '%' + c.codePointAt(0).toString(16).padStart(2, '0'))
 }
 
 function absUrl(url) {
@@ -132,7 +132,7 @@ function longDateRange(days, locale) {
 // unavailable (#1561).
 function dayCost(assignments, dayId, locale, tripCurrency, rates) {
   const entries: MoneyEntry[] = (assignments[String(dayId)] || []).map(a => ({
-    amount: parseFloat(a.place?.price) || 0,
+    amount: Number.parseFloat(a.place?.price) || 0,
     currency: a.place?.currency || tripCurrency,
   }))
   return formatMoneySum(entries, tripCurrency, locale || 'en', rates)
@@ -413,7 +413,7 @@ export async function downloadTripPDF({ trip, days, places, assignments = {}, ca
 
           const chips = [
             place.place_time ? `<span class="chip">${svgClock}${escHtml(place.place_time)}</span>` : '',
-            place.price && parseFloat(place.price) > 0 ? `<span class="chip chip-green">${svgMoney}${formatMoney(Number(place.price), place.currency || trip.currency, loc)}</span>` : '',
+            place.price && Number.parseFloat(place.price) > 0 ? `<span class="chip chip-green">${svgMoney}${formatMoney(Number(place.price), place.currency || trip.currency, loc)}</span>` : '',
           ].filter(Boolean).join('')
 
           return `
@@ -766,8 +766,8 @@ ${pluginSectionsHtml}
       <button id="pdf-daybreak-toggle" type="button" role="switch" aria-checked="${breaksPerDay}" aria-label="${escHtml(tr('pdf.pageBreakPerDay'))}" style="${TOGGLE_TRACK} background:${trackColour(breaksPerDay)}">
         <span style="${TOGGLE_KNOB} left:${knobOffset(breaksPerDay)}"></span>
       </button>
-      <button id="pdf-print-btn" style="display:flex;align-items:center;gap:5px;font-size:12px;font-weight:500;color:var(--text-muted);background:none;border:none;cursor:pointer;padding:4px 8px;border-radius:6px;font-family:inherit">${tr('pdf.saveAsPdf')}</button>
-      <button id="pdf-close-btn" style="background:none;border:none;cursor:pointer;color:var(--text-faint);display:flex;padding:4px;border-radius:6px">
+      <button type="button" id="pdf-print-btn" style="display:flex;align-items:center;gap:5px;font-size:12px;font-weight:500;color:var(--text-muted);background:none;border:none;cursor:pointer;padding:4px 8px;border-radius:6px;font-family:inherit">${tr('pdf.saveAsPdf')}</button>
+      <button type="button" id="pdf-close-btn" style="background:none;border:none;cursor:pointer;color:var(--text-faint);display:flex;padding:4px;border-radius:6px">
         <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
       </button>
     </div>
diff --git a/client/src/components/Packing/ApplyTemplateButton.tsx b/client/src/components/Packing/ApplyTemplateButton.tsx
index 7fa920f98..01de45335 100644
--- a/client/src/components/Packing/ApplyTemplateButton.tsx
+++ b/client/src/components/Packing/ApplyTemplateButton.tsx
@@ -59,7 +59,7 @@ export default function ApplyTemplateButton({ tripId, visibility, style, classNa
 
   return (
     <div ref={dropRef} style={{ position: 'relative' }}>
-      <button
+      <button type="button"
         onClick={() => setOpen(v => !v)}
         disabled={applying}
         className={className ?? 'hover:opacity-[0.88]'}
@@ -79,7 +79,7 @@ export default function ApplyTemplateButton({ tripId, visibility, style, classNa
           }}
         >
           {templates.map(tmpl => (
-            <button key={tmpl.id} onClick={() => handleApply(tmpl.id)}
+            <button type="button" key={tmpl.id} onClick={() => handleApply(tmpl.id)}
               style={{
                 display: 'flex', alignItems: 'center', gap: 8, width: '100%',
                 padding: '8px 12px', borderRadius: 8, border: 'none', cursor: 'pointer',
diff --git a/client/src/components/Packing/PackingListPanel.test.tsx b/client/src/components/Packing/PackingListPanel.test.tsx
index a86cb9d28..46b465052 100644
--- a/client/src/components/Packing/PackingListPanel.test.tsx
+++ b/client/src/components/Packing/PackingListPanel.test.tsx
@@ -1,6 +1,6 @@
 // FE-COMP-PACKING-001 to FE-COMP-PACKING-020
 import { vi } from 'vitest';
-import { render, screen, waitFor, fireEvent } from '../../../tests/helpers/render';
+import { render, screen, waitFor, fireEvent, within } from '../../../tests/helpers/render';
 import userEvent from '@testing-library/user-event';
 import { http, HttpResponse } from 'msw';
 import { server } from '../../../tests/helpers/msw/server';
@@ -171,7 +171,7 @@ describe('PackingListPanel', () => {
     const user = userEvent.setup();
     render(<PackingListPanel tripId={1} items={[]} />);
     await user.click(screen.getByText('Add list'));
-    await screen.findByPlaceholderText('List name (e.g. Clothing)');
+    expect(await screen.findByPlaceholderText('List name (e.g. Clothing)')).toBeInTheDocument();
   });
 
   it('FE-COMP-PACKING-016: delete item button exists and triggers API call', async () => {
@@ -392,7 +392,7 @@ describe('PackingListPanel', () => {
     render(<PackingListPanel tripId={1} items={[]} />);
 
     // "Apply template" button appears when templates are available
-    await screen.findByText('Apply template');
+    expect(await screen.findByText('Apply template')).toBeInTheDocument();
   });
 
   it('FE-COMP-PACKING-031: "Uncheck All" bulk action calls PUT to uncheck checked items', async () => {
@@ -899,9 +899,10 @@ describe('PackingListPanel', () => {
     const packageBtn = container.querySelector('svg.lucide-package')?.closest('button');
     fireEvent.click(packageBtn!);
 
-    // Picker is open - find "Trolley" button inside the dropdown
-    // The dropdown renders as an absolute positioned div inside the item row
-    const trolleyBtn = await screen.findByRole('button', { name: /Trolley/ });
+    // Picker is open - find "Trolley" button inside the dropdown. The bag
+    // sidebar carries the same name on its own button, so scope the query to
+    // the picker (the dropdown is a sibling of the package button).
+    const trolleyBtn = await within(packageBtn!.parentElement!).findByRole('button', { name: /Trolley/ });
     fireEvent.click(trolleyBtn);
 
     await waitFor(() => expect(putBody).toMatchObject({ bag_id: 7 }));
diff --git a/client/src/components/Packing/PackingListPanelBagCard.tsx b/client/src/components/Packing/PackingListPanelBagCard.tsx
index bd3f63a82..a8414a1dd 100644
--- a/client/src/components/Packing/PackingListPanelBagCard.tsx
+++ b/client/src/components/Packing/PackingListPanelBagCard.tsx
@@ -59,7 +59,8 @@ export function BagCard({ bag, bagItems, totalWeight, pct, tripId, tripMembers,
             onBlur={saveName} onKeyDown={e => { if (e.key === 'Enter') saveName(); if (e.key === 'Escape') { setEditingName(false); setNameVal(bag.name) } }}
             style={{ flex: 1, fontSize: sz.name, fontWeight: 600, padding: '1px 4px', borderRadius: 4, border: '1px solid var(--border-primary)', outline: 'none', fontFamily: 'inherit', color: 'var(--text-primary)', background: 'transparent' }} />
         ) : (
-          <span onClick={() => canEdit && setEditingName(true)} style={{ flex: 1, fontSize: sz.name, fontWeight: 600, color: compact ? 'var(--text-secondary)' : 'var(--text-primary)', cursor: canEdit ? 'text' : 'default' }}>{bag.name}</span>
+          <button type="button" disabled={!canEdit} onClick={() => setEditingName(true)}
+            style={{ flex: 1, fontSize: sz.name, fontWeight: 600, color: compact ? 'var(--text-secondary)' : 'var(--text-primary)', cursor: canEdit ? 'text' : 'default', background: 'none', border: 'none', padding: 0, textAlign: 'left', fontFamily: 'inherit' }}>{bag.name}</button>
         )}
         <span style={{ fontSize: sz.weight, color: 'var(--text-faint)', fontWeight: 500, display: 'inline-flex', alignItems: 'center', gap: 3 }}>
           {totalWeight >= 1000 ? `${(totalWeight / 1000).toFixed(1)} kg` : `${totalWeight} g`}
@@ -74,34 +75,39 @@ export function BagCard({ bag, bagItems, totalWeight, pct, tripId, tripMembers,
               <span>kg</span>
             </>
           ) : bag.weight_limit_grams ? (
-            <span onClick={() => canEdit && setEditingLimit(true)} title={t('packing.bagLimit')}
-              style={{ cursor: canEdit ? 'text' : 'default' }}>
+            <button type="button" disabled={!canEdit} onClick={() => setEditingLimit(true)} title={t('packing.bagLimit')}
+              style={{ cursor: canEdit ? 'text' : 'default', background: 'none', border: 'none', padding: 0, fontFamily: 'inherit', fontSize: 'inherit' }}>
               / {(bag.weight_limit_grams / 1000).toFixed(1)} kg
-            </span>
+            </button>
           ) : canEdit ? (
-            <button onClick={() => setEditingLimit(true)} title={t('packing.bagLimit')}
+            <button type="button" onClick={() => setEditingLimit(true)} title={t('packing.bagLimit')}
               style={{ background: 'none', border: 'none', padding: 0, cursor: 'pointer', color: 'var(--text-faint)', fontSize: sz.count, fontFamily: 'inherit', textDecoration: 'underline dotted' }}>
               {t('packing.setBagLimit')}
             </button>
           ) : null}
         </span>
-        {canEdit && <button onClick={onDelete} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 2, color: 'var(--text-faint)', display: 'flex' }}><X size={sz.icon} /></button>}
+        {canEdit && <button type="button" onClick={onDelete} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 2, color: 'var(--text-faint)', display: 'flex' }}><X size={sz.icon} /></button>}
       </div>
       {/* Members */}
       <div style={{ display: 'flex', alignItems: 'center', gap: 4, marginBottom: 4, flexWrap: 'wrap', position: 'relative' }}>
-        {(bag.members || []).map(m => (
-          <span key={m.user_id} title={m.username} onClick={() => canEdit && toggleMember(m.user_id)} style={{ cursor: canEdit ? 'pointer' : 'default', display: 'inline-flex' }}>
-            {m.avatar ? (
-              <img src={m.avatar} alt={m.username} style={{ width: sz.avatar, height: sz.avatar, borderRadius: '50%', objectFit: 'cover', border: `1.5px solid ${bag.color}`, boxSizing: 'border-box' }} />
-            ) : (
-              <span style={{ width: sz.avatar, height: sz.avatar, borderRadius: '50%', background: bag.color + '25', color: bag.color, fontSize: sz.avatar * 0.45, fontWeight: 700, display: 'inline-flex', alignItems: 'center', justifyContent: 'center', border: `1.5px solid ${bag.color}`, boxSizing: 'border-box' }}>
-                {m.username[0].toUpperCase()}
-              </span>
-            )}
-          </span>
-        ))}
+        {(bag.members || []).map(m => {
+          const face = m.avatar ? (
+            <img src={m.avatar} alt={m.username} style={{ width: sz.avatar, height: sz.avatar, borderRadius: '50%', objectFit: 'cover', border: `1.5px solid ${bag.color}`, boxSizing: 'border-box' }} />
+          ) : (
+            <span style={{ width: sz.avatar, height: sz.avatar, borderRadius: '50%', background: bag.color + '25', color: bag.color, fontSize: sz.avatar * 0.45, fontWeight: 700, display: 'inline-flex', alignItems: 'center', justifyContent: 'center', border: `1.5px solid ${bag.color}`, boxSizing: 'border-box' }}>
+              {m.username[0].toUpperCase()}
+            </span>
+          )
+          if (!canEdit) return <span key={m.user_id} title={m.username} style={{ display: 'inline-flex' }}>{face}</span>
+          return (
+            <button type="button" key={m.user_id} title={m.username} aria-label={m.username} onClick={() => toggleMember(m.user_id)}
+              style={{ cursor: 'pointer', display: 'inline-flex', background: 'none', border: 'none', padding: 0 }}>
+              {face}
+            </button>
+          )
+        })}
         {canEdit && (
-          <button onClick={() => setShowUserPicker(v => !v)} style={{ width: sz.avatar, height: sz.avatar, borderRadius: '50%', border: '1.5px dashed var(--border-primary)', background: 'none', color: 'var(--text-faint)', cursor: 'pointer', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 0, boxSizing: 'border-box' }}>
+          <button type="button" onClick={() => setShowUserPicker(v => !v)} style={{ width: sz.avatar, height: sz.avatar, borderRadius: '50%', border: '1.5px dashed var(--border-primary)', background: 'none', color: 'var(--text-faint)', cursor: 'pointer', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 0, boxSizing: 'border-box' }}>
             <Plus size={sz.avatar * 0.5} />
           </button>
         )}
@@ -110,7 +116,7 @@ export function BagCard({ bag, bagItems, totalWeight, pct, tripId, tripMembers,
             {tripMembers.map(m => {
               const isSelected = memberIds.includes(m.id)
               return (
-                <button key={m.id} onClick={() => { toggleMember(m.id); }}
+                <button type="button" key={m.id} onClick={() => { toggleMember(m.id); }}
                   style={{ display: 'flex', alignItems: 'center', gap: 8, width: '100%', padding: '6px 10px', borderRadius: 6, border: 'none', background: isSelected ? 'var(--bg-tertiary)' : 'transparent', cursor: 'pointer', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-primary)', fontFamily: 'inherit' }}
                   onMouseEnter={e => { if (!isSelected) e.currentTarget.style.background = 'var(--bg-secondary)' }}
                   onMouseLeave={e => { if (!isSelected) e.currentTarget.style.background = 'transparent' }}>
@@ -128,7 +134,7 @@ export function BagCard({ bag, bagItems, totalWeight, pct, tripId, tripMembers,
             })}
             {tripMembers.length === 0 && <div style={{ padding: '8px 10px', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)' }}>{t('packing.noMembers')}</div>}
             <div style={{ borderTop: '1px solid var(--border-secondary)', marginTop: 4, paddingTop: 4 }}>
-              <button onClick={() => setShowUserPicker(false)} style={{ width: '100%', padding: '6px 10px', borderRadius: 6, border: 'none', background: 'transparent', cursor: 'pointer', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', fontFamily: 'inherit', textAlign: 'center' }}>
+              <button type="button" onClick={() => setShowUserPicker(false)} style={{ width: '100%', padding: '6px 10px', borderRadius: 6, border: 'none', background: 'transparent', cursor: 'pointer', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', fontFamily: 'inherit', textAlign: 'center' }}>
                 {t('common.close')}
               </button>
             </div>
diff --git a/client/src/components/Packing/PackingListPanelBagModal.tsx b/client/src/components/Packing/PackingListPanelBagModal.tsx
index 650ce8632..8f43d2dbc 100644
--- a/client/src/components/Packing/PackingListPanelBagModal.tsx
+++ b/client/src/components/Packing/PackingListPanelBagModal.tsx
@@ -15,12 +15,17 @@ export function BagModal(S: PackingState) {
   const heaviestBagWeight = Math.max(...bags.map(b => myItems.filter(i => i.bag_id === b.id).reduce((s, i) => s + itemWeight(i), 0)), 1)
   return (
     <div style={{ position: 'fixed', inset: 0, zIndex: 100, background: 'rgba(0,0,0,0.3)', display: 'flex', alignItems: 'flex-start', justifyContent: 'center', padding: 20, paddingTop: 140, paddingBottom: 'calc(20px + var(--bottom-nav-h))', overflowY: 'auto' }}
-      onClick={() => setShowBagModal(false)}>
-      <div style={{ background: 'var(--bg-card)', borderRadius: 16, width: '100%', maxWidth: 360, maxHeight: 'calc(100vh - 80px)', overflow: 'auto', padding: 20, boxShadow: '0 16px 48px rgba(0,0,0,0.15)', flexShrink: 0 }}
+      role="button" tabIndex={0} aria-label={t('common.close')}
+      onClick={() => setShowBagModal(false)}
+      onKeyDown={e => {
+        if (e.target !== e.currentTarget) return
+        if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); setShowBagModal(false) }
+      }}>
+      <div role="presentation" style={{ background: 'var(--bg-card)', borderRadius: 16, width: '100%', maxWidth: 360, maxHeight: 'calc(100vh - 80px)', overflow: 'auto', padding: 20, boxShadow: '0 16px 48px rgba(0,0,0,0.15)', flexShrink: 0 }}
         onClick={e => e.stopPropagation()}>
         <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', marginBottom: 16 }}>
           <h3 style={{ margin: 0, fontSize: 'calc(16px * var(--fs-scale-subtitle, 1))', fontWeight: 700, color: 'var(--text-primary)' }}>{t('packing.bags')}</h3>
-          <button onClick={() => setShowBagModal(false)} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex' }}><X size={18} /></button>
+          <button type="button" onClick={() => setShowBagModal(false)} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex' }}><X size={18} /></button>
         </div>
 
         {bags.map(bag => {
@@ -66,13 +71,13 @@ export function BagModal(S: PackingState) {
               onKeyDown={e => { if (e.key === 'Enter') handleCreateBag(); if (e.key === 'Escape') { setShowAddBag(false); setNewBagName('') } }}
               placeholder={t('packing.bagName')}
               style={{ flex: 1, padding: '8px 12px', borderRadius: 10, border: '1px solid var(--border-primary)', fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontFamily: 'inherit', outline: 'none' }} />
-            <button onClick={handleCreateBag} disabled={!newBagName.trim()}
+            <button type="button" onClick={handleCreateBag} disabled={!newBagName.trim()}
               style={{ padding: '8px 12px', borderRadius: 10, border: 'none', background: newBagName.trim() ? 'var(--text-primary)' : 'var(--border-primary)', color: 'var(--bg-primary)', cursor: newBagName.trim() ? 'pointer' : 'default', display: 'flex', alignItems: 'center' }}>
               <Plus size={14} />
             </button>
           </div>
         ) : (
-          <button onClick={() => setShowAddBag(true)}
+          <button type="button" onClick={() => setShowAddBag(true)}
             style={{ display: 'flex', alignItems: 'center', gap: 6, marginTop: 14, padding: '9px 14px', borderRadius: 10, border: '1px dashed var(--border-primary)', background: 'none', cursor: 'pointer', fontSize: 'calc(13px * var(--fs-scale-body, 1))', color: 'var(--text-faint)', fontFamily: 'inherit', width: '100%', transition: 'all 0.15s' }}
             onMouseEnter={e => { e.currentTarget.style.borderColor = 'var(--text-muted)'; e.currentTarget.style.color = 'var(--text-secondary)' }}
             onMouseLeave={e => { e.currentTarget.style.borderColor = 'var(--border-primary)'; e.currentTarget.style.color = 'var(--text-faint)' }}>
diff --git a/client/src/components/Packing/PackingListPanelBagSidebar.tsx b/client/src/components/Packing/PackingListPanelBagSidebar.tsx
index f3c994021..eac5b044d 100644
--- a/client/src/components/Packing/PackingListPanelBagSidebar.tsx
+++ b/client/src/components/Packing/PackingListPanelBagSidebar.tsx
@@ -62,12 +62,12 @@ export function BagSidebar(S: PackingState) {
             onKeyDown={e => { if (e.key === 'Enter') handleCreateBag(); if (e.key === 'Escape') { setShowAddBag(false); setNewBagName('') } }}
             placeholder={t('packing.bagName')}
             style={{ flex: 1, padding: '5px 8px', borderRadius: 8, border: '1px solid var(--border-primary)', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontFamily: 'inherit', outline: 'none' }} />
-          <button onClick={handleCreateBag} style={{ padding: '4px 8px', borderRadius: 8, border: 'none', background: 'var(--text-primary)', color: 'var(--bg-primary)', cursor: 'pointer', display: 'flex', alignItems: 'center' }}>
+          <button type="button" onClick={handleCreateBag} style={{ padding: '4px 8px', borderRadius: 8, border: 'none', background: 'var(--text-primary)', color: 'var(--bg-primary)', cursor: 'pointer', display: 'flex', alignItems: 'center' }}>
             <Plus size={12} />
           </button>
         </div>
       ) : (
-        <button onClick={() => setShowAddBag(true)}
+        <button type="button" onClick={() => setShowAddBag(true)}
           style={{ display: 'flex', alignItems: 'center', gap: 4, marginTop: 12, padding: '5px 8px', borderRadius: 8, border: '1px dashed var(--border-primary)', background: 'none', cursor: 'pointer', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', fontFamily: 'inherit', width: '100%' }}>
           <Plus size={11} /> {t('packing.addBag')}
         </button>
diff --git a/client/src/components/Packing/PackingListPanelCategoryGroup.test.tsx b/client/src/components/Packing/PackingListPanelCategoryGroup.test.tsx
index dfe17fc3b..299d40849 100644
--- a/client/src/components/Packing/PackingListPanelCategoryGroup.test.tsx
+++ b/client/src/components/Packing/PackingListPanelCategoryGroup.test.tsx
@@ -377,7 +377,10 @@ describe('KategorieGruppe — assignees', () => {
     })
     fireEvent.click(container.querySelector('svg.lucide-user-plus')!.closest('button')!)
 
-    fireEvent.click(within(screen.getByRole('button', { name: /alice/ })).getByText('alice').closest('button')!)
+    // Scoped to the dropdown: an assigned member also has a chip button carrying
+    // their name, so an unscoped role query matches two elements.
+    const dropdown = within(container.querySelector('svg.lucide-user-plus')!.closest('div')!)
+    fireEvent.click(dropdown.getByRole('button', { name: /alice/ }))
 
     expect(onSetAssignees).toHaveBeenCalledWith('Gear', [1])
   })
@@ -388,8 +391,9 @@ describe('KategorieGruppe — assignees', () => {
       assignees: [{ user_id: 1, username: 'owner' }],
     })
     fireEvent.click(container.querySelector('svg.lucide-user-plus')!.closest('button')!)
-    const assigned = screen.getByRole('button', { name: /owner/ })
-    const free = screen.getByRole('button', { name: /alice/ })
+    const dropdown = within(container.querySelector('svg.lucide-user-plus')!.closest('div')!)
+    const assigned = dropdown.getByRole('button', { name: /owner/ })
+    const free = dropdown.getByRole('button', { name: /alice/ })
 
     fireEvent.mouseEnter(free)
     expect(free.style.background).toBe('var(--bg-tertiary)')
diff --git a/client/src/components/Packing/PackingListPanelCategoryGroup.tsx b/client/src/components/Packing/PackingListPanelCategoryGroup.tsx
index 8c2bad168..45570ad78 100644
--- a/client/src/components/Packing/PackingListPanelCategoryGroup.tsx
+++ b/client/src/components/Packing/PackingListPanelCategoryGroup.tsx
@@ -115,7 +115,7 @@ export function KategorieGruppe({ kategorie, items, tripId, allCategories, onRen
   return (
     <div style={{ marginBottom: 6, background: 'var(--bg-card)', borderRadius: 14, border: '1px solid var(--border-secondary)', overflow: 'visible' }}>
       <div style={{ display: 'flex', alignItems: 'center', gap: 8, padding: '10px 12px', borderBottom: offen ? '1px solid var(--border-secondary)' : 'none' }}>
-        <button onClick={() => setOffen(o => !o)} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 0, display: 'flex', color: 'var(--text-faint)', flexShrink: 0 }}>
+        <button type="button" onClick={() => setOffen(o => !o)} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 0, display: 'flex', color: 'var(--text-faint)', flexShrink: 0 }}>
           {offen ? <ChevronDown size={15} /> : <ChevronRight size={15} />}
         </button>
 
@@ -137,35 +137,46 @@ export function KategorieGruppe({ kategorie, items, tripId, allCategories, onRen
 
         {/* Assignee chips */}
         <div style={{ display: 'flex', alignItems: 'center', gap: 3, flex: 1, minWidth: 0, marginLeft: 4 }}>
-          {assignees.map(a => (
-            <div key={a.user_id} style={{ position: 'relative' }}
-              onClick={e => { e.stopPropagation(); if (canEdit) onSetAssignees(kategorie, assignees.filter(x => x.user_id !== a.user_id).map(x => x.user_id)) }}
-            >
-              <div className="assignee-chip"
-                style={{
-                  width: 22, height: 22, borderRadius: '50%', flexShrink: 0, cursor: canEdit ? 'pointer' : 'default',
-                  background: `hsl(${a.username.charCodeAt(0) * 37 % 360}, 55%, 55%)`,
-                  display: 'flex', alignItems: 'center', justifyContent: 'center',
-                  fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 700, color: 'white', textTransform: 'uppercase',
-                  border: '2px solid var(--bg-card)', transition: 'opacity 0.15s',
-                }}
+          {assignees.map(a => {
+            // The chip is only ever clickable for an editor, so read-only members
+            // get the plain div back rather than a focusable stop that does nothing.
+            const chip = (
+              <>
+                <div className="assignee-chip"
+                  style={{
+                    width: 22, height: 22, borderRadius: '50%', flexShrink: 0, cursor: canEdit ? 'pointer' : 'default',
+                    background: `hsl(${(a.username.codePointAt(0) ?? 0) * 37 % 360}, 55%, 55%)`,
+                    display: 'flex', alignItems: 'center', justifyContent: 'center',
+                    fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 700, color: 'white', textTransform: 'uppercase',
+                    border: '2px solid var(--bg-card)', transition: 'opacity 0.15s',
+                  }}
+                >
+                  {a.username[0]}
+                </div>
+                <div className="assignee-tooltip" style={{
+                  position: 'absolute', top: '100%', left: '50%', transform: 'translateX(-50%)',
+                  marginTop: 6, padding: '3px 8px', borderRadius: 6, zIndex: 60,
+                  background: 'var(--text-primary)', color: 'var(--bg-primary)',
+                  fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 600, whiteSpace: 'nowrap',
+                  pointerEvents: 'none', opacity: 0, transition: 'opacity 0.15s',
+                }}>
+                  {a.username}
+                </div>
+              </>
+            )
+            if (!canEdit) return <div key={a.user_id} style={{ position: 'relative' }}>{chip}</div>
+            return (
+              <button type="button" key={a.user_id}
+                style={{ position: 'relative', background: 'none', border: 'none', padding: 0, font: 'inherit', cursor: 'pointer' }}
+                onClick={e => { e.stopPropagation(); onSetAssignees(kategorie, assignees.filter(x => x.user_id !== a.user_id).map(x => x.user_id)) }}
               >
-                {a.username[0]}
-              </div>
-              <div className="assignee-tooltip" style={{
-                position: 'absolute', top: '100%', left: '50%', transform: 'translateX(-50%)',
-                marginTop: 6, padding: '3px 8px', borderRadius: 6, zIndex: 60,
-                background: 'var(--text-primary)', color: 'var(--bg-primary)',
-                fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 600, whiteSpace: 'nowrap',
-                pointerEvents: 'none', opacity: 0, transition: 'opacity 0.15s',
-              }}>
-                {a.username}
-              </div>
-            </div>
-          ))}
+                {chip}
+              </button>
+            )
+          })}
           {canEdit && (
           <div ref={assigneeDropdownRef} style={{ position: 'relative' }}>
-            <button onClick={e => { e.stopPropagation(); setShowAssigneeDropdown(v => !v) }}
+            <button type="button" onClick={e => { e.stopPropagation(); setShowAssigneeDropdown(v => !v) }}
               style={{
                 width: 20, height: 20, borderRadius: '50%', border: '1.5px dashed var(--border-primary)',
                 background: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center', justifyContent: 'center',
@@ -185,7 +196,7 @@ export function KategorieGruppe({ kategorie, items, tripId, allCategories, onRen
                 {tripMembers.map(m => {
                   const isAssigned = assignees.some(a => a.user_id === m.id)
                   return (
-                    <button key={m.id} onClick={e => {
+                    <button type="button" key={m.id} onClick={e => {
                       e.stopPropagation()
                       const newIds = isAssigned
                         ? assignees.filter(a => a.user_id !== m.id).map(a => a.user_id)
@@ -204,7 +215,7 @@ export function KategorieGruppe({ kategorie, items, tripId, allCategories, onRen
                     >
                       <div style={{
                         width: 20, height: 20, borderRadius: '50%', flexShrink: 0,
-                        background: `hsl(${m.username.charCodeAt(0) * 37 % 360}, 55%, 55%)`,
+                        background: `hsl(${(m.username.codePointAt(0) ?? 0) * 37 % 360}, 55%, 55%)`,
                         display: 'flex', alignItems: 'center', justifyContent: 'center',
                         fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 700, color: 'white', textTransform: 'uppercase',
                       }}>
@@ -236,7 +247,7 @@ export function KategorieGruppe({ kategorie, items, tripId, allCategories, onRen
         </span>
 
         <div style={{ position: 'relative' }}>
-          <button ref={menuBtnRef} onClick={() => setShowMenu(m => !m)} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '2px 4px', borderRadius: 6, display: 'flex', color: 'var(--text-faint)' }}
+          <button type="button" ref={menuBtnRef} onClick={() => setShowMenu(m => !m)} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '2px 4px', borderRadius: 6, display: 'flex', color: 'var(--text-faint)' }}
             onMouseEnter={e => e.currentTarget.style.color = 'var(--text-secondary)'} onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
             <MoreHorizontal size={15} />
           </button>
@@ -244,7 +255,7 @@ export function KategorieGruppe({ kategorie, items, tripId, allCategories, onRen
             const rect = menuBtnRef.current?.getBoundingClientRect();
             return (
             <>
-              <div style={{ position: 'fixed', inset: 0, zIndex: 99 }} onClick={() => setShowMenu(false)} />
+              <div role="presentation" style={{ position: 'fixed', inset: 0, zIndex: 99 }} onClick={() => setShowMenu(false)} />
               <div style={{ position: 'fixed', right: rect ? window.innerWidth - rect.right : 0, top: rect ? rect.bottom + 4 : 0, zIndex: 100, background: 'var(--bg-card)', border: '1px solid var(--border-primary)', borderRadius: 10, boxShadow: '0 4px 16px rgba(0,0,0,0.1)', padding: 4, minWidth: 170 }}>
                 {canEdit && <MenuItem icon={<Pencil size={13} />} label={t('packing.menuRename')} onClick={() => { setEditingName(true); setShowMenu(false) }} />}
                 <MenuItem icon={<CheckCheck size={13} />} label={t('packing.menuCheckAll')} onClick={() => { handleCheckAll(); setShowMenu(false) }} />
@@ -300,18 +311,18 @@ export function KategorieGruppe({ kategorie, items, tripId, allCategories, onRen
                 style={{ flex: 1, padding: '6px 10px', borderRadius: 8, border: '1px solid var(--border-primary)', fontSize: 'calc(12.5px * var(--fs-scale-body, 1))', fontFamily: 'inherit', outline: 'none', color: 'var(--text-primary)', background: 'var(--bg-input)' }}
               />
               {/* disabled while the field is empty, so no extra guard here */}
-              <button onClick={() => { onAddItem(kategorie, newItemName.trim()); setNewItemName(''); setTimeout(() => addItemRef.current?.focus(), 30) }}
+              <button type="button" onClick={() => { onAddItem(kategorie, newItemName.trim()); setNewItemName(''); setTimeout(() => addItemRef.current?.focus(), 30) }}
                 disabled={!newItemName.trim()}
                 style={{ padding: '5px 8px', borderRadius: 8, border: 'none', background: newItemName.trim() ? 'var(--text-primary)' : 'var(--border-primary)', color: 'var(--bg-primary)', cursor: newItemName.trim() ? 'pointer' : 'default', display: 'flex' }}>
                 <Plus size={14} />
               </button>
-              <button onClick={() => { setShowAddItem(false); setNewItemName('') }}
+              <button type="button" onClick={() => { setShowAddItem(false); setNewItemName('') }}
                 style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 2, display: 'flex', color: 'var(--text-faint)' }}>
                 <X size={14} />
               </button>
             </div>
           ) : (
-            <button onClick={() => { setShowAddItem(true); setTimeout(() => addItemRef.current?.focus(), 30) }}
+            <button type="button" onClick={() => { setShowAddItem(true); setTimeout(() => addItemRef.current?.focus(), 30) }}
               style={{ display: 'flex', alignItems: 'center', gap: 5, padding: '5px 10px', margin: '2px 4px', borderRadius: 8, border: 'none', background: 'none', cursor: 'pointer', fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-faint)', fontFamily: 'inherit' }}
               onMouseEnter={e => e.currentTarget.style.color = 'var(--text-secondary)'}
               onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
@@ -333,7 +344,7 @@ interface MenuItemProps {
 
 function MenuItem({ icon, label, onClick, danger = false }: MenuItemProps) {
   return (
-    <button onClick={onClick} style={{
+    <button type="button" onClick={onClick} style={{
       display: 'flex', alignItems: 'center', gap: 8, width: '100%',
       padding: '7px 10px', background: 'none', border: 'none', cursor: 'pointer',
       fontSize: 'calc(12.5px * var(--fs-scale-body, 1))', fontFamily: 'inherit', borderRadius: 7, textAlign: 'left',
diff --git a/client/src/components/Packing/PackingListPanelHeader.tsx b/client/src/components/Packing/PackingListPanelHeader.tsx
index 4e49baa36..3e6cc2085 100644
--- a/client/src/components/Packing/PackingListPanelHeader.tsx
+++ b/client/src/components/Packing/PackingListPanelHeader.tsx
@@ -36,12 +36,12 @@ export function PackingHeader(S: PackingState) {
                 placeholder={t('packing.templateName')}
                 style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', padding: '5px 10px', borderRadius: 99, border: '1px solid var(--border-primary)', outline: 'none', fontFamily: 'inherit', width: 140, background: 'var(--bg-card)', color: 'var(--text-primary)' }}
               />
-              <button onClick={handleSaveAsTemplate} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 2, color: '#10b981' }}><Check size={14} /></button>
-              <button onClick={() => { setShowSaveTemplate(false); setSaveTemplateName('') }} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 2, color: 'var(--text-faint)' }}><X size={14} /></button>
+              <button type="button" onClick={handleSaveAsTemplate} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 2, color: '#10b981' }}><Check size={14} /></button>
+              <button type="button" onClick={() => { setShowSaveTemplate(false); setSaveTemplateName('') }} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 2, color: 'var(--text-faint)' }}><X size={14} /></button>
             </div>
           )}
           {inlineHeader && canEdit && (
-            <button onClick={() => setShowImportModal(true)} style={{
+            <button type="button" onClick={() => setShowImportModal(true)} style={{
               display: 'flex', alignItems: 'center', gap: 5, padding: '5px 11px', borderRadius: 99,
               border: '1px solid var(--border-primary)', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500, cursor: 'pointer',
               fontFamily: 'inherit', background: 'var(--bg-card)', color: 'var(--text-muted)',
@@ -50,7 +50,7 @@ export function PackingHeader(S: PackingState) {
             </button>
           )}
           {inlineHeader && canEdit && abgehakt > 0 && (
-            <button onClick={handleClearChecked} style={{
+            <button type="button" onClick={handleClearChecked} style={{
               fontSize: 'calc(11.5px * var(--fs-scale-caption, 1))', padding: '5px 10px', borderRadius: 99, border: '1px solid rgba(239,68,68,0.3)',
               background: 'rgba(239,68,68,0.1)', color: '#ef4444', cursor: 'pointer', fontFamily: 'inherit',
             }}>
@@ -60,7 +60,7 @@ export function PackingHeader(S: PackingState) {
           )}
           {inlineHeader && canEdit && availableTemplates.length > 0 && (
             <div ref={templateDropdownRef} style={{ position: 'relative' }}>
-              <button onClick={() => setShowTemplateDropdown(v => !v)} disabled={applyingTemplate} style={{
+              <button type="button" onClick={() => setShowTemplateDropdown(v => !v)} disabled={applyingTemplate} style={{
                 display: 'flex', alignItems: 'center', gap: 5, padding: '5px 11px', borderRadius: 99,
                 border: '1px solid', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500, cursor: 'pointer', fontFamily: 'inherit',
                 background: showTemplateDropdown ? 'var(--text-primary)' : 'var(--bg-card)',
@@ -76,7 +76,7 @@ export function PackingHeader(S: PackingState) {
                   boxShadow: '0 4px 16px rgba(0,0,0,0.12)', padding: 4, minWidth: 200,
                 }}>
                   {availableTemplates.map(tmpl => (
-                    <button key={tmpl.id} onClick={() => handleApplyTemplate(tmpl.id)}
+                    <button type="button" key={tmpl.id} onClick={() => handleApplyTemplate(tmpl.id)}
                       style={{
                         display: 'flex', alignItems: 'center', gap: 8, width: '100%',
                         padding: '8px 12px', borderRadius: 8, border: 'none', cursor: 'pointer',
@@ -98,7 +98,7 @@ export function PackingHeader(S: PackingState) {
             </div>
           )}
           {inlineHeader && canEdit && isAdmin && items.length > 0 && !showSaveTemplate && (
-            <button onClick={() => setShowSaveTemplate(true)} style={{
+            <button type="button" onClick={() => setShowSaveTemplate(true)} style={{
               display: 'flex', alignItems: 'center', gap: 5, padding: '5px 11px', borderRadius: 99,
               border: '1px solid var(--border-primary)', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500, cursor: 'pointer', fontFamily: 'inherit',
               background: 'var(--bg-card)', color: 'var(--text-muted)',
@@ -107,7 +107,7 @@ export function PackingHeader(S: PackingState) {
             </button>
           )}
           {bagTrackingEnabled && (
-            <button onClick={() => setShowBagModal(true)} className="xl:!hidden"
+            <button type="button" onClick={() => setShowBagModal(true)} className="xl:!hidden"
               style={{
                 display: 'flex', alignItems: 'center', gap: 5, padding: '5px 11px', borderRadius: 99,
                 border: '1px solid', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500, cursor: 'pointer', fontFamily: 'inherit',
@@ -197,17 +197,17 @@ export function PackingHeader(S: PackingState) {
             placeholder={t('packing.newCategoryPlaceholder')}
             style={{ flex: 1, padding: '8px 12px', borderRadius: 10, border: '1px solid var(--border-primary)', fontSize: 'calc(13.5px * var(--fs-scale-body, 1))', fontFamily: 'inherit', outline: 'none', color: 'var(--text-primary)' }}
           />
-          <button onClick={handleAddNewCategory} disabled={!newCatName.trim()}
+          <button type="button" onClick={handleAddNewCategory} disabled={!newCatName.trim()}
             style={{ padding: '8px 12px', borderRadius: 10, border: 'none', background: newCatName.trim() ? 'var(--text-primary)' : 'var(--border-primary)', color: 'var(--bg-primary)', cursor: newCatName.trim() ? 'pointer' : 'default', display: 'flex', alignItems: 'center' }}>
             <Check size={16} />
           </button>
-          <button onClick={() => { setAddingCategory(false); setNewCatName('') }}
+          <button type="button" onClick={() => { setAddingCategory(false); setNewCatName('') }}
             style={{ padding: '8px 12px', borderRadius: 10, border: '1px solid var(--border-primary)', background: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center', color: 'var(--text-faint)' }}>
             <X size={16} />
           </button>
         </div>
       ) : (
-        <button onClick={() => setAddingCategory(true)}
+        <button type="button" onClick={() => setAddingCategory(true)}
           style={{ display: 'flex', alignItems: 'center', gap: 6, width: '100%', padding: '9px 14px', borderRadius: 10, border: '1px dashed var(--border-primary)', background: 'none', cursor: 'pointer', fontSize: 'calc(13px * var(--fs-scale-body, 1))', color: 'var(--text-faint)', fontFamily: 'inherit', transition: 'all 0.15s' }}
           onMouseEnter={e => { e.currentTarget.style.borderColor = 'var(--text-muted)'; e.currentTarget.style.color = 'var(--text-secondary)' }}
           onMouseLeave={e => { e.currentTarget.style.borderColor = 'var(--border-primary)'; e.currentTarget.style.color = 'var(--text-faint)' }}>
diff --git a/client/src/components/Packing/PackingListPanelImportModal.tsx b/client/src/components/Packing/PackingListPanelImportModal.tsx
index 05285acf5..a40e7f506 100644
--- a/client/src/components/Packing/PackingListPanelImportModal.tsx
+++ b/client/src/components/Packing/PackingListPanelImportModal.tsx
@@ -9,12 +9,12 @@ export function BulkImportModal(S: PackingState) {
       position: 'fixed', inset: 0, zIndex: 1000,
       display: 'flex', alignItems: 'center', justifyContent: 'center',
       background: 'rgba(0,0,0,0.3)', backdropFilter: 'blur(3px)',
-    }} onClick={() => setShowImportModal(false)}>
+    }} role="presentation" onClick={e => { if (e.target === e.currentTarget) setShowImportModal(false) }}>
       <div style={{
         width: 420, maxHeight: '80vh', background: 'var(--bg-card)', borderRadius: 16,
         boxShadow: '0 16px 48px rgba(0,0,0,0.22)', padding: '22px 22px 18px',
         display: 'flex', flexDirection: 'column', gap: 14,
-      }} onClick={e => e.stopPropagation()}>
+      }}>
         <div style={{ fontSize: 'calc(15px * var(--fs-scale-subtitle, 1))', fontWeight: 600, color: 'var(--text-primary)' }}>{t('packing.importTitle')}</div>
         <div style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-faint)', lineHeight: 1.5 }}>{t('packing.importHint')}</div>
         <div style={{ display: 'flex', border: '1px solid var(--border-primary)', borderRadius: 10, overflow: 'hidden', background: 'var(--bg-input)' }}>
@@ -43,7 +43,7 @@ export function BulkImportModal(S: PackingState) {
         <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
           <div>
             <input ref={csvInputRef} type="file" accept=".csv,.txt" style={{ display: 'none' }} onChange={handleCsvFile} />
-            <button onClick={() => csvInputRef.current?.click()} style={{
+            <button type="button" onClick={() => csvInputRef.current?.click()} style={{
               display: 'flex', alignItems: 'center', gap: 5, padding: '5px 10px',
               border: '1px dashed var(--border-primary)', borderRadius: 8, background: 'none',
               fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', cursor: 'pointer', fontFamily: 'inherit',
@@ -52,11 +52,11 @@ export function BulkImportModal(S: PackingState) {
             </button>
           </div>
           <div style={{ display: 'flex', gap: 8 }}>
-            <button onClick={() => setShowImportModal(false)} style={{
+            <button type="button" onClick={() => setShowImportModal(false)} style={{
               fontSize: 'calc(12px * var(--fs-scale-body, 1))', background: 'none', border: '1px solid var(--border-primary)',
               borderRadius: 8, padding: '6px 14px', cursor: 'pointer', color: 'var(--text-muted)', fontFamily: 'inherit',
             }}>{t('common.cancel')}</button>
-            <button onClick={handleBulkImport} disabled={!importText.trim()} style={{
+            <button type="button" onClick={handleBulkImport} disabled={!importText.trim()} style={{
               fontSize: 'calc(12px * var(--fs-scale-body, 1))', background: 'var(--accent)', color: 'var(--accent-text)',
               border: 'none', borderRadius: 8, padding: '6px 16px', cursor: 'pointer', fontWeight: 600,
               fontFamily: 'inherit', opacity: importText.trim() ? 1 : 0.5,
diff --git a/client/src/components/Packing/PackingListPanelItemRow.tsx b/client/src/components/Packing/PackingListPanelItemRow.tsx
index debeb1d42..2e9ed665e 100644
--- a/client/src/components/Packing/PackingListPanelItemRow.tsx
+++ b/client/src/components/Packing/PackingListPanelItemRow.tsx
@@ -1,4 +1,4 @@
-import { useRef, useState, type ReactNode } from 'react'
+import { useRef, useState, type CSSProperties, type ReactNode } from 'react'
 import { useTripStore } from '../../store/tripStore'
 import { useToast } from '../shared/Toast'
 import { useTranslation } from '../../i18n'
@@ -94,6 +94,17 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
   const canDrag = canEdit && !isPlaceholder && !!drag
   const selectedBag = bags.find(b => b.id === item.bag_id)
 
+  // Shared by both shells of the name: a renameable name is a real button so
+  // the rename can be reached with the keyboard, everything else is plain text.
+  const nameStyle: CSSProperties = {
+    flex: 1, minWidth: 0, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap',
+    fontSize: 'calc(13.5px * var(--fs-scale-body, 1))',
+    cursor: !canEdit || item.checked ? 'default' : 'text',
+    color: isPlaceholder ? 'var(--text-faint)' : (item.checked ? 'var(--text-faint)' : 'var(--text-primary)'),
+    transition: 'color 200ms cubic-bezier(0.23,1,0.32,1)',
+    textDecoration: item.checked ? 'line-through' : 'none',
+  }
+
   return (
     <div
       className="group packing-item-row"
@@ -122,7 +133,7 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
           <GripVertical size={13} />
         </div>
       )}
-      <button onClick={handleToggle} style={{
+      <button type="button" onClick={handleToggle} style={{
         flexShrink: 0, background: 'none', border: 'none', cursor: 'pointer', padding: 0, position: 'relative',
         width: 18, height: 18,
         color: item.checked ? '#10b981' : 'var(--text-faint)',
@@ -151,19 +162,17 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
           onKeyDown={e => { if (e.key === 'Enter') handleSaveName(); if (e.key === 'Escape') { setEditing(false); setEditName(isPlaceholder ? '' : item.name) } }}
           style={{ flex: 1, minWidth: 0, fontSize: 'calc(13.5px * var(--fs-scale-body, 1))', padding: '2px 8px', borderRadius: 6, border: '1px solid var(--border-primary)', outline: 'none', fontFamily: 'inherit' }}
         />
-      ) : (
-        <span
-          onClick={() => canEdit && !item.checked && setEditing(true)}
-          style={{
-            flex: 1, minWidth: 0, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap',
-            fontSize: 'calc(13.5px * var(--fs-scale-body, 1))',
-            cursor: !canEdit || item.checked ? 'default' : 'text',
-            color: isPlaceholder ? 'var(--text-faint)' : (item.checked ? 'var(--text-faint)' : 'var(--text-primary)'),
-            transition: 'color 200ms cubic-bezier(0.23,1,0.32,1)',
-            textDecoration: item.checked ? 'line-through' : 'none',
-          }}
+      ) : canEdit && !item.checked ? (
+        <button
+          type="button"
+          onClick={() => setEditing(true)}
+          style={{ ...nameStyle, border: 'none', background: 'none', padding: 0, textAlign: 'left', fontFamily: 'inherit' }}
         >
           {item.name}
+        </button>
+      ) : (
+        <span style={nameStyle}>
+          {item.name}
         </span>
       )}
 
@@ -200,7 +209,7 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
               readOnly={!canEdit}
               onValueChange={async raw => {
                 if (!canEdit) return
-                const v = raw === '' ? null : parseInt(raw)
+                const v = raw === '' ? null : Number.parseInt(raw)
                 try { await updatePackingItem(tripId, item.id, { weight_grams: v }) } catch { toast.error(t('packing.toast.saveError')) }
               }}
               placeholder="—"
@@ -209,7 +218,7 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
             <span style={{ fontSize: 'calc(10px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', userSelect: 'none' }}>g</span>
           </div>
           <div style={{ position: 'relative' }}>
-            <button
+            <button type="button"
               onClick={() => canEdit && setShowBagPicker(p => !p)}
               style={{
                 width: 22, height: 22, borderRadius: '50%', cursor: canEdit ? 'pointer' : 'default', padding: 0, display: 'flex', alignItems: 'center', justifyContent: 'center',
@@ -226,14 +235,14 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
                 boxShadow: '0 4px 16px rgba(0,0,0,0.12)', padding: 4, minWidth: 160,
               }}>
                 {item.bag_id && (
-                  <button onClick={async () => { setShowBagPicker(false); try { await updatePackingItem(tripId, item.id, { bag_id: null }) } catch { toast.error(t('packing.toast.saveError')) } }}
+                  <button type="button" onClick={async () => { setShowBagPicker(false); try { await updatePackingItem(tripId, item.id, { bag_id: null }) } catch { toast.error(t('packing.toast.saveError')) } }}
                     style={{ display: 'flex', alignItems: 'center', gap: 7, width: '100%', padding: '6px 10px', background: 'none', border: 'none', cursor: 'pointer', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontFamily: 'inherit', color: 'var(--text-faint)', borderRadius: 7 }}>
                     <span style={{ width: 10, height: 10, borderRadius: '50%', border: '2px dashed var(--border-primary)' }} />
                     {t('packing.noBag')}
                   </button>
                 )}
                 {bags.map(b => (
-                  <button key={b.id} onClick={async () => { setShowBagPicker(false); try { await updatePackingItem(tripId, item.id, { bag_id: b.id }) } catch { toast.error(t('packing.toast.saveError')) } }}
+                  <button type="button" key={b.id} onClick={async () => { setShowBagPicker(false); try { await updatePackingItem(tripId, item.id, { bag_id: b.id }) } catch { toast.error(t('packing.toast.saveError')) } }}
                     style={{
                       display: 'flex', alignItems: 'center', gap: 7, width: '100%', padding: '6px 10px',
                       background: item.bag_id === b.id ? 'var(--bg-tertiary)' : 'none',
@@ -260,7 +269,7 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
                         }}
                         placeholder={t('packing.bagName')}
                         style={{ flex: 1, padding: '4px 8px', borderRadius: 6, border: '1px solid var(--border-primary)', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontFamily: 'inherit', outline: 'none' }} />
-                      <button onClick={async () => {
+                      <button type="button" onClick={async () => {
                         if (bagInlineName.trim()) {
                           const newBag = await onCreateBag(bagInlineName.trim())
                           if (newBag) { try { await updatePackingItem(tripId, item.id, { bag_id: newBag.id }) } catch { toast.error(t('packing.toast.saveError')) } }
@@ -272,7 +281,7 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
                       </button>
                     </div>
                   ) : (
-                    <button onClick={() => setBagInlineCreate(true)}
+                    <button type="button" onClick={() => setBagInlineCreate(true)}
                       style={{ display: 'flex', alignItems: 'center', gap: 5, width: '100%', padding: '5px 6px', background: 'none', border: 'none', cursor: 'pointer', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontFamily: 'inherit', color: 'var(--text-faint)', borderRadius: 7 }}
                       onMouseEnter={e => e.currentTarget.style.color = 'var(--text-secondary)'}
                       onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
@@ -290,7 +299,7 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
       {canEdit && (
       <div className="packing-row-inline-actions" style={{ display: 'flex', gap: 2, alignItems: 'center', flexShrink: 0 }}>
         <div style={{ position: 'relative' }}>
-          <button
+          <button type="button"
             onClick={() => setShowCatPicker(p => !p)}
             title={t('packing.changeCategory')}
             style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '3px 5px', borderRadius: 6, display: 'flex', alignItems: 'center', color: 'var(--text-faint)', fontSize: 'calc(10px * var(--fs-scale-caption, 1))', gap: 2 }}
@@ -304,7 +313,7 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
               padding: 4, minWidth: 140,
             }}>
               {categories.map(cat => (
-                <button key={cat} onClick={() => handleCatChange(cat)} style={{
+                <button type="button" key={cat} onClick={() => handleCatChange(cat)} style={{
                   display: 'flex', alignItems: 'center', gap: 7, width: '100%',
                   padding: '6px 10px', background: cat === (item.category || t('packing.defaultCategory')) ? 'var(--bg-tertiary)' : 'none',
                   border: 'none', cursor: 'pointer', fontSize: 'calc(12.5px * var(--fs-scale-body, 1))', fontFamily: 'inherit',
@@ -330,12 +339,12 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
           />
         )}
 
-        <button onClick={() => setEditing(true)} title={t('common.rename')} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '3px 4px', borderRadius: 6, display: 'flex', color: 'var(--text-faint)' }}
+        <button type="button" onClick={() => setEditing(true)} title={t('common.rename')} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '3px 4px', borderRadius: 6, display: 'flex', color: 'var(--text-faint)' }}
           onMouseEnter={e => e.currentTarget.style.color = 'var(--text-secondary)'} onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
           <Pencil size={13} />
         </button>
 
-        <button onClick={handleDelete} title={t('common.delete')} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '3px 4px', borderRadius: 6, display: 'flex', color: 'var(--text-faint)' }}
+        <button type="button" onClick={handleDelete} title={t('common.delete')} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '3px 4px', borderRadius: 6, display: 'flex', color: 'var(--text-faint)' }}
           onMouseEnter={e => e.currentTarget.style.color = '#ef4444'} onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>
           <Trash2 size={13} />
         </button>
@@ -344,7 +353,7 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
 
       {canEdit && (
         <div className="packing-row-overflow" style={{ display: 'none', flexShrink: 0, position: 'relative' }}>
-          <button
+          <button type="button"
             ref={itemMenuBtnRef}
             onClick={() => setShowItemMenu(m => !m)}
             title={t('common.showMore')}
@@ -356,7 +365,7 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
             const rect = itemMenuBtnRef.current?.getBoundingClientRect()
             return (
               <>
-                <div style={{ position: 'fixed', inset: 0, zIndex: 1098 }} onClick={() => { setShowItemMenu(false); setShowMenuCategories(false) }} />
+                <div role="presentation" style={{ position: 'fixed', inset: 0, zIndex: 1098 }} onClick={() => { setShowItemMenu(false); setShowMenuCategories(false) }} />
                 <div className="trek-menu-enter" style={{
                   position: 'fixed',
                   right: rect ? Math.max(8, window.innerWidth - rect.right) : 8,
@@ -386,7 +395,7 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
                             value={item.weight_grams ?? ''}
                             readOnly={!canEdit}
                             onValueChange={async raw => {
-                              const v = raw === '' ? null : parseInt(raw)
+                              const v = raw === '' ? null : Number.parseInt(raw)
                               try { await updatePackingItem(tripId, item.id, { weight_grams: v }) } catch { toast.error(t('packing.toast.saveError')) }
                             }}
                             placeholder="—"
@@ -459,7 +468,7 @@ interface OverflowMenuItemProps {
 
 function OverflowMenuItem({ icon, label, onClick, active = false, danger = false }: OverflowMenuItemProps) {
   return (
-    <button
+    <button type="button"
       onClick={onClick}
       style={{
         display: 'flex', alignItems: 'center', gap: 8, width: '100%',
diff --git a/client/src/components/Packing/PackingListPanelViewTabs.tsx b/client/src/components/Packing/PackingListPanelViewTabs.tsx
index de93a59b1..27729158d 100644
--- a/client/src/components/Packing/PackingListPanelViewTabs.tsx
+++ b/client/src/components/Packing/PackingListPanelViewTabs.tsx
@@ -20,7 +20,7 @@ export function PackingViewTabs(S: PackingState) {
   const viewPill = (id: 'common' | 'personal', icon: React.ReactNode, label: string, count: number) => {
     const active = view === id
     return (
-      <button onClick={() => setView(id)} style={{
+      <button type="button" onClick={() => setView(id)} style={{
         ...pillBase,
         background: active ? 'var(--text-primary)' : 'transparent',
         borderColor: active ? 'var(--text-primary)' : 'var(--border-primary)',
@@ -39,7 +39,7 @@ export function PackingViewTabs(S: PackingState) {
   const filterPill = (id: string, label: string) => {
     const active = filter === id
     return (
-      <button key={id} onClick={() => setFilter(id)} style={{
+      <button type="button" key={id} onClick={() => setFilter(id)} style={{
         ...pillBase, gap: 0, border: '1px solid transparent', fontWeight: active ? 600 : 400,
         background: active ? 'var(--text-primary)' : 'transparent',
         color: active ? 'var(--bg-primary)' : 'var(--text-muted)',
diff --git a/client/src/components/Packing/PackingShareControl.tsx b/client/src/components/Packing/PackingShareControl.tsx
index ae65262ec..39ff7d11b 100644
--- a/client/src/components/Packing/PackingShareControl.tsx
+++ b/client/src/components/Packing/PackingShareControl.tsx
@@ -49,7 +49,7 @@ export default function PackingShareControl({ item, tripMembers, currentUserId,
   }
 
   const btn = (onClick: () => void, title: string, active: boolean, node: React.ReactNode) => (
-    <button onClick={onClick} title={title}
+    <button type="button" onClick={onClick} title={title}
       style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '3px 4px', borderRadius: 6, display: 'flex', color: active ? 'var(--accent)' : 'var(--text-faint)' }}
       onMouseEnter={e => { if (!active) e.currentTarget.style.color = 'var(--text-secondary)' }}
       onMouseLeave={e => { if (!active) e.currentTarget.style.color = 'var(--text-faint)' }}>
@@ -72,7 +72,7 @@ export default function PackingShareControl({ item, tripMembers, currentUserId,
 
   return (
     <div style={{ display: 'flex' }}>
-      <button ref={btnRef} onClick={toggle} title={t('packing.share')}
+      <button type="button" ref={btnRef} onClick={toggle} title={t('packing.share')}
         style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '3px 4px', borderRadius: 6, display: 'flex', color: visibility !== 'common' ? 'var(--accent)' : 'var(--text-faint)' }}
         onMouseEnter={e => { if (visibility === 'common') e.currentTarget.style.color = 'var(--text-secondary)' }}
         onMouseLeave={e => { if (visibility === 'common') e.currentTarget.style.color = 'var(--text-faint)' }}>
@@ -80,7 +80,7 @@ export default function PackingShareControl({ item, tripMembers, currentUserId,
       </button>
       {open && pos && createPortal(
         <>
-          <div style={{ position: 'fixed', inset: 0, zIndex: 1099 }} onClick={() => setOpen(false)} />
+          <div role="presentation" style={{ position: 'fixed', inset: 0, zIndex: 1099 }} onClick={() => setOpen(false)} />
           <div style={{
             position: 'fixed', top: pos.top, right: pos.right, zIndex: 1100,
             background: 'var(--bg-card)', border: '1px solid var(--border-primary)', borderRadius: 10,
@@ -97,11 +97,11 @@ export default function PackingShareControl({ item, tripMembers, currentUserId,
             ) : others.map(m => {
               const on = recipientIds.includes(m.id)
               return (
-                <button key={m.id} onClick={() => toggleRecipient(m.id)}
+                <button type="button" key={m.id} onClick={() => toggleRecipient(m.id)}
                   style={{ display: 'flex', alignItems: 'center', gap: 8, width: '100%', padding: '6px 10px', borderRadius: 7, border: 'none', cursor: 'pointer', background: 'none', fontFamily: 'inherit', fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-primary)' }}
                   onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-tertiary)'}
                   onMouseLeave={e => e.currentTarget.style.background = 'none'}>
-                  <span style={{ width: 18, height: 18, borderRadius: '50%', flexShrink: 0, background: `hsl(${m.username.charCodeAt(0) * 37 % 360}, 55%, 55%)`, display: 'flex', alignItems: 'center', justifyContent: 'center', fontSize: 'calc(9px * var(--fs-scale-caption, 1))', fontWeight: 700, color: 'white', textTransform: 'uppercase' }}>{m.username[0]}</span>
+                  <span style={{ width: 18, height: 18, borderRadius: '50%', flexShrink: 0, background: `hsl(${(m.username.codePointAt(0) ?? 0) * 37 % 360}, 55%, 55%)`, display: 'flex', alignItems: 'center', justifyContent: 'center', fontSize: 'calc(9px * var(--fs-scale-caption, 1))', fontWeight: 700, color: 'white', textTransform: 'uppercase' }}>{m.username[0]}</span>
                   <span style={{ flex: 1, textAlign: 'left', overflow: 'hidden', textOverflow: 'ellipsis' }}>{m.username}</span>
                   {on && <Check size={13} className="text-content-muted" />}
                 </button>
@@ -117,7 +117,7 @@ export default function PackingShareControl({ item, tripMembers, currentUserId,
 
 function Row({ icon, label, sub, active, onClick }: { icon: React.ReactNode; label: string; sub: string; active: boolean; onClick: () => void }) {
   return (
-    <button onClick={onClick}
+    <button type="button" onClick={onClick}
       style={{ display: 'flex', alignItems: 'flex-start', gap: 8, width: '100%', padding: '7px 10px', borderRadius: 7, border: 'none', cursor: 'pointer', background: active ? 'var(--bg-tertiary)' : 'none', fontFamily: 'inherit', textAlign: 'left' }}
       onMouseEnter={e => { if (!active) e.currentTarget.style.background = 'var(--bg-tertiary)' }}
       onMouseLeave={e => { if (!active) e.currentTarget.style.background = 'none' }}>
diff --git a/client/src/components/Packing/packingListPanel.helpers.ts b/client/src/components/Packing/packingListPanel.helpers.ts
index 80cdf59ca..659bf94f1 100644
--- a/client/src/components/Packing/packingListPanel.helpers.ts
+++ b/client/src/components/Packing/packingListPanel.helpers.ts
@@ -6,7 +6,7 @@ export function katColor(kat: string, allCategories?: string[]): string {
   if (idx >= 0) return KAT_COLORS[idx % KAT_COLORS.length]
   // Fallback: hash-based
   let h = 0
-  for (let i = 0; i < kat.length; i++) h = ((h << 5) - h + kat.charCodeAt(i)) | 0
+  for (let i = 0; i < kat.length; i++) h = ((h << 5) - h + (kat.codePointAt(i) ?? 0)) | 0
   return KAT_COLORS[Math.abs(h) % KAT_COLORS.length]
 }
 
diff --git a/client/src/components/Planner/AirTrailImportModal.tsx b/client/src/components/Planner/AirTrailImportModal.tsx
index 8de9f228b..3e7bb09cd 100644
--- a/client/src/components/Planner/AirTrailImportModal.tsx
+++ b/client/src/components/Planner/AirTrailImportModal.tsx
@@ -236,7 +236,7 @@ export default function AirTrailImportModal({ isOpen, onClose, tripId, pushUndo
     const isSelected = selected.has(f.id)
     const label = f.flightNumber ? `${f.airline ? `${f.airline} ` : ''}${f.flightNumber}` : `${f.fromCode ?? '?'} → ${f.toCode ?? '?'}`
     return (
-      <button
+      <button type="button"
         key={f.id}
         onClick={() => !already && toggle(f.id)}
         disabled={already}
@@ -279,7 +279,7 @@ export default function AirTrailImportModal({ isOpen, onClose, tripId, pushUndo
     return (
       <div key={chainKey(chain)} style={{ border: '1px solid var(--border-primary)', borderRadius: 12, padding: '8px 8px 0', marginBottom: 8 }}>
         {chain.map(renderFlight)}
-        <button
+        <button type="button"
           onClick={() => toggleJoin(chain)}
           className="bg-transparent"
           style={{
@@ -311,6 +311,7 @@ export default function AirTrailImportModal({ isOpen, onClose, tripId, pushUndo
     <div
       className="bg-[rgba(0,0,0,0.4)]"
       style={{ position: 'fixed', inset: 0, zIndex: 99999, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
+      role="presentation"
       onMouseDown={e => { mouseDownTarget.current = e.target }}
       onClick={e => {
         if (e.target === e.currentTarget && mouseDownTarget.current === e.currentTarget) handleClose()
@@ -318,6 +319,7 @@ export default function AirTrailImportModal({ isOpen, onClose, tripId, pushUndo
       }}
     >
       <div
+        role="presentation"
         onClick={e => e.stopPropagation()}
         className="bg-surface-card"
         style={{ borderRadius: 16, width: '100%', maxWidth: 540, padding: 24, boxShadow: '0 8px 32px rgba(0,0,0,0.2)', fontFamily: 'var(--font-system)', maxHeight: '90vh', display: 'flex', flexDirection: 'column' }}
@@ -327,7 +329,7 @@ export default function AirTrailImportModal({ isOpen, onClose, tripId, pushUndo
           <div style={{ flex: 1, fontSize: 'calc(15px * var(--fs-scale-subtitle, 1))', fontWeight: 700, color: 'var(--text-primary)' }}>
             {t('reservations.airtrail.title')}
           </div>
-          <button onClick={handleClose} className="bg-transparent text-content-faint" style={{ border: 'none', cursor: 'pointer', padding: 4, borderRadius: 6, display: 'flex', alignItems: 'center' }}>
+          <button type="button" onClick={handleClose} className="bg-transparent text-content-faint" style={{ border: 'none', cursor: 'pointer', padding: 4, borderRadius: 6, display: 'flex', alignItems: 'center' }}>
             <X size={16} />
           </button>
         </div>
@@ -371,13 +373,13 @@ export default function AirTrailImportModal({ isOpen, onClose, tripId, pushUndo
         </div>
 
         <div style={{ display: 'flex', gap: 8, justifyContent: 'flex-end', marginTop: 14, paddingTop: 14, borderTop: '1px solid var(--border-faint)' }}>
-          <button
+          <button type="button"
             onClick={handleClose}
             style={{ padding: '8px 16px', borderRadius: 10, border: '1px solid var(--border-primary)', background: 'none', color: 'var(--text-primary)', fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 500, cursor: 'pointer', fontFamily: 'inherit' }}
           >
             {t('common.cancel')}
           </button>
-          <button
+          <button type="button"
             onClick={handleImport}
             disabled={selectableCount === 0 || importing}
             className={selectableCount > 0 && !importing ? 'bg-accent text-accent-text' : 'bg-surface-tertiary text-content-faint'}
diff --git a/client/src/components/Planner/BookingImportModal.tsx b/client/src/components/Planner/BookingImportModal.tsx
index 1def5b3ae..ba10feacc 100644
--- a/client/src/components/Planner/BookingImportModal.tsx
+++ b/client/src/components/Planner/BookingImportModal.tsx
@@ -112,6 +112,7 @@ export default function BookingImportModal({ isOpen, onClose, tripId }: BookingI
 
   return createPortal(
     <div
+      role="presentation"
       className="bg-[rgba(0,0,0,0.4)]"
       style={{ position: 'fixed', inset: 0, zIndex: 99999, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
       onMouseDown={(e) => { mouseDownTarget.current = e.target }}
@@ -121,6 +122,7 @@ export default function BookingImportModal({ isOpen, onClose, tripId }: BookingI
       }}
     >
       <div
+        role="presentation"
         onClick={(e) => e.stopPropagation()}
         className="bg-surface-card"
         style={{ borderRadius: 16, width: '100%', maxWidth: 540, padding: 24, boxShadow: '0 8px 32px rgba(0,0,0,0.2)', fontFamily: 'var(--font-system)', maxHeight: '90vh', display: 'flex', flexDirection: 'column' }}
@@ -130,7 +132,7 @@ export default function BookingImportModal({ isOpen, onClose, tripId }: BookingI
           <div style={{ flex: 1, fontSize: 'calc(15px * var(--fs-scale-subtitle, 1))', fontWeight: 700, color: 'var(--text-primary)' }}>
             {t('reservations.import.title')}
           </div>
-          <button onClick={handleClose} className="bg-transparent text-content-faint" style={{ border: 'none', cursor: 'pointer', padding: 4, borderRadius: 6, display: 'flex', alignItems: 'center' }}>
+          <button type="button" onClick={handleClose} className="bg-transparent text-content-faint" style={{ border: 'none', cursor: 'pointer', padding: 4, borderRadius: 6, display: 'flex', alignItems: 'center' }}>
             <X size={16} />
           </button>
         </div>
@@ -149,7 +151,8 @@ export default function BookingImportModal({ isOpen, onClose, tripId }: BookingI
             onChange={handleInputChange}
           />
 
-          <div
+          <button
+            type="button"
             onClick={() => fileInputRef.current?.click()}
             onDragOver={handleDragOver}
             onDragEnter={handleDragOver}
@@ -173,7 +176,7 @@ export default function BookingImportModal({ isOpen, onClose, tripId }: BookingI
             ) : (
               <span style={{ color: 'var(--text-faint)', textAlign: 'center', pointerEvents: 'none' }}>{t('reservations.import.dropHere')}</span>
             )}
-          </div>
+          </button>
 
           {error && (
             <div className="bg-[rgba(239,68,68,0.08)] text-[#b91c1c]" style={{ border: '1px solid rgba(239,68,68,0.35)', borderRadius: 10, padding: '8px 10px', fontSize: 'calc(12px * var(--fs-scale-body, 1))', whiteSpace: 'pre-wrap', marginTop: 8 }}>
@@ -184,13 +187,13 @@ export default function BookingImportModal({ isOpen, onClose, tripId }: BookingI
 
         {/* Footer */}
         <div style={{ display: 'flex', gap: 8, justifyContent: 'flex-end', marginTop: 14, paddingTop: 14, borderTop: '1px solid var(--border-faint)' }}>
-          <button
+          <button type="button"
             onClick={handleClose}
             style={{ padding: '8px 16px', borderRadius: 10, border: '1px solid var(--border-primary)', background: 'none', color: 'var(--text-primary)', fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 500, cursor: 'pointer', fontFamily: 'inherit' }}
           >
             {t('common.cancel')}
           </button>
-          <button
+          <button type="button"
             onClick={handleParse}
             disabled={files.length === 0 || loading}
             className={files.length > 0 && !loading ? 'bg-accent text-accent-text' : 'bg-surface-tertiary text-content-faint'}
diff --git a/client/src/components/Planner/DayDetailPanel.test.tsx b/client/src/components/Planner/DayDetailPanel.test.tsx
index f8ee30de8..564ec67cc 100644
--- a/client/src/components/Planner/DayDetailPanel.test.tsx
+++ b/client/src/components/Planner/DayDetailPanel.test.tsx
@@ -158,7 +158,7 @@ describe('DayDetailPanel', () => {
       ),
     );
     render(<DayDetailPanel {...defaultProps} lat={48.8566} lng={2.3522} />);
-    await screen.findByText(/22°C/);
+    expect(await screen.findByText(/22°C/)).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-011: weather in Fahrenheit when setting is fahrenheit', async () => {
@@ -171,7 +171,7 @@ describe('DayDetailPanel', () => {
       ),
     );
     render(<DayDetailPanel {...defaultProps} lat={48.8566} lng={2.3522} />);
-    await screen.findByText(/32°F/);
+    expect(await screen.findByText(/32°F/)).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-012: no weather shows "No weather data" message', async () => {
@@ -179,7 +179,7 @@ describe('DayDetailPanel', () => {
       http.get('/api/weather/detailed', () => HttpResponse.json({ error: true })),
     );
     render(<DayDetailPanel {...defaultProps} lat={48.8566} lng={2.3522} />);
-    await screen.findByText(/No weather/i);
+    expect(await screen.findByText(/No weather/i)).toBeInTheDocument();
   });
 
   // ── Reservations ─────────────────────────────────────────────────────────────
@@ -197,7 +197,7 @@ describe('DayDetailPanel', () => {
       assignments={{ '1': [{ id: 50, place, place_id: place.id, day_id: 1, order_index: 0, notes: null }] }}
       reservations={[reservation]}
     />);
-    await screen.findByText('Museum Tour Ticket');
+    expect(await screen.findByText('Museum Tour Ticket')).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-014: reservations from OTHER days are not shown', async () => {
@@ -266,7 +266,7 @@ describe('DayDetailPanel', () => {
       ),
     );
     render(<DayDetailPanel {...defaultProps} />);
-    await screen.findByText('Grand Hotel');
+    expect(await screen.findByText('Grand Hotel')).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-018: check-in time shown for check-in day', async () => {
@@ -305,7 +305,7 @@ describe('DayDetailPanel', () => {
       day={checkOutDay}
       days={[day, checkOutDay]}
     />);
-    await screen.findByText('11:00');
+    expect(await screen.findByText('11:00')).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-020: confirmation code shown', async () => {
@@ -320,7 +320,7 @@ describe('DayDetailPanel', () => {
       ),
     );
     render(<DayDetailPanel {...defaultProps} />);
-    await screen.findByText('HOTEL99');
+    expect(await screen.findByText('HOTEL99')).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-021: accommodation edit/remove buttons shown when canEditDays=true', async () => {
@@ -396,7 +396,7 @@ describe('DayDetailPanel', () => {
   it('FE-PLANNER-DAYDETAIL-023: "Add accommodation" button visible when canEditDays=true and no accommodation', async () => {
     seedStore(useAuthStore, { user: buildAdmin(), isAuthenticated: true });
     render(<DayDetailPanel {...defaultProps} />);
-    await screen.findByText(/Add accommodation/i);
+    expect(await screen.findByText(/Add accommodation/i)).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-024: clicking add accommodation opens hotel picker', async () => {
@@ -466,7 +466,7 @@ describe('DayDetailPanel', () => {
     await screen.findByText('5.2 mm');
     await screen.findByText('30 km/h');
     await screen.findByText('06:30');
-    await screen.findByText('20:15');
+    expect(await screen.findByText('20:15')).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-027: weather chips show Fahrenheit wind speed', async () => {
@@ -487,7 +487,7 @@ describe('DayDetailPanel', () => {
     );
     render(<DayDetailPanel {...defaultProps} lat={48.8566} lng={2.3522} />);
     // 50 km/h * 0.621371 ≈ 31 mph
-    await screen.findByText('31 mph');
+    expect(await screen.findByText('31 mph')).toBeInTheDocument();
   });
 
   // ── Hotel picker interactions ─────────────────────────────────────────────────
@@ -516,7 +516,7 @@ describe('DayDetailPanel', () => {
     await userEvent.click(addButton);
     await screen.findByText('Hotel du Nord');
     await screen.findByText('Hotel du Sud');
-    await screen.findByText('102 Quai de Jemmapes');
+    expect(await screen.findByText('102 Quai de Jemmapes')).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-030: selecting a place in hotel picker enables save button', async () => {
@@ -691,7 +691,7 @@ describe('DayDetailPanel', () => {
       ),
     );
     render(<DayDetailPanel {...defaultProps} lat={48.8566} lng={2.3522} />);
-    await screen.findByText(/Ø/);
+    expect(await screen.findByText(/Ø/)).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-038: hotel picker with category filter renders category buttons', async () => {
@@ -722,7 +722,7 @@ describe('DayDetailPanel', () => {
     render(<DayDetailPanel {...defaultProps} />);
     await screen.findByText('Existing Hotel');
     // "Add accommodation" dashed button should also appear for adding more
-    await screen.findByText(/Add accommodation/i);
+    expect(await screen.findByText(/Add accommodation/i)).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-041: save new accommodation calls API and updates list', async () => {
@@ -838,7 +838,7 @@ describe('DayDetailPanel', () => {
     );
     render(<DayDetailPanel {...defaultProps} lat={48.8566} lng={2.3522} />);
     // Should show "No weather" after error (catch sets weather to null)
-    await screen.findByText(/No weather/i);
+    expect(await screen.findByText(/No weather/i)).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-046: save edited accommodation calls update API', async () => {
@@ -1251,7 +1251,7 @@ describe('DayDetailPanel', () => {
 
     // Intermediate day (id=1, position 9): old filter: 1>=17 → false. New: 9 in [0,15] → visible.
     render(<DayDetailPanel {...defaultProps} day={days[9]} days={days} />);
-    await screen.findByText('Full Trip Hotel');
+    expect(await screen.findByText('Full Trip Hotel')).toBeInTheDocument();
   });
 
   it('FE-PLANNER-DAYDETAIL-040: 12h time format renders reservation time with AM/PM', async () => {
diff --git a/client/src/components/Planner/DayDetailPanel.tsx b/client/src/components/Planner/DayDetailPanel.tsx
index 39eabef90..af74df7f3 100644
--- a/client/src/components/Planner/DayDetailPanel.tsx
+++ b/client/src/components/Planner/DayDetailPanel.tsx
@@ -144,8 +144,12 @@ export default function DayDetailPanel({ day, days, places, categories = [], tri
         boxShadow: '0 8px 40px rgba(0,0,0,0.14), 0 0 0 1px rgba(0,0,0,0.06)',
         overflow: 'hidden', maxHeight: collapsed ? 'none' : '60vh', display: 'flex', flexDirection: 'column',
       }}>
-        {/* Header */}
-        <div style={{ display: 'flex', alignItems: 'center', gap: 14, padding: collapsed ? '12px 16px 12px 20px' : '18px 16px 14px 20px', borderBottom: collapsed ? 'none' : '1px solid var(--border-faint)', cursor: 'pointer' }}
+        {/* Header. Clicking the bar collapses the panel, but that is a mouse
+            shortcut for the chevron button below, a real button with a title that
+            does the same thing. So the bar declares itself presentational instead
+            of becoming a second, unlabelled tab stop wrapped around the rename
+            input and the two icon buttons. */}
+        <div role="presentation" style={{ display: 'flex', alignItems: 'center', gap: 14, padding: collapsed ? '12px 16px 12px 20px' : '18px 16px 14px 20px', borderBottom: collapsed ? 'none' : '1px solid var(--border-faint)', cursor: 'pointer' }}
           onClick={() => toggleCollapse()}>
           <div className="bg-surface-secondary" style={{ width: collapsed ? 36 : 44, height: collapsed ? 36 : 44, borderRadius: 12, display: 'flex', alignItems: 'center', justifyContent: 'center', flexShrink: 0, transition: 'all 0.15s ease' }}>
             <Calendar size={collapsed ? 16 : 20} className="text-content" />
@@ -174,7 +178,7 @@ export default function DayDetailPanel({ day, days, places, categories = [], tri
                   {day.title || t('planner.dayN', { n: (days.indexOf(day) + 1) || '?' })}
                 </span>
                 {canEditDays && onUpdateDayTitle && (
-                  <button onClick={startRename} aria-label={t('common.edit')} title={t('common.edit')} className="text-content-faint" style={{ border: 'none', background: 'none', padding: 3, cursor: 'pointer', display: 'flex', flexShrink: 0 }}>
+                  <button type="button" onClick={startRename} aria-label={t('common.edit')} title={t('common.edit')} className="text-content-faint" style={{ border: 'none', background: 'none', padding: 3, cursor: 'pointer', display: 'flex', flexShrink: 0 }}>
                     <Pencil size={12} strokeWidth={1.8} />
                   </button>
                 )}
@@ -182,14 +186,14 @@ export default function DayDetailPanel({ day, days, places, categories = [], tri
             )}
             {!collapsed && formattedDate && <div className="text-content-muted" style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', marginTop: 1 }}>{formattedDate}</div>}
           </div>
-          <button onClick={(e) => { e.stopPropagation(); toggleCollapse() }} title={collapsed ? t('common.expand') : t('common.collapse')}
+          <button type="button" onClick={(e) => { e.stopPropagation(); toggleCollapse() }} title={collapsed ? t('common.expand') : t('common.collapse')}
             className="bg-surface-secondary"
             style={{ border: 'none', borderRadius: 10, width: 32, height: 32, display: 'flex', alignItems: 'center', justifyContent: 'center', cursor: 'pointer', flexShrink: 0, transition: 'all 0.15s ease' }}
             onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
             onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-secondary)'}>
             {collapsed ? <ChevronsUp size={14} className="text-content-muted" /> : <ChevronsDown size={14} className="text-content-muted" />}
           </button>
-          <button onClick={(e) => { e.stopPropagation(); onClose() }} className="bg-surface-secondary" style={{ border: 'none', borderRadius: 10, width: 32, height: 32, display: 'flex', alignItems: 'center', justifyContent: 'center', cursor: 'pointer', flexShrink: 0 }}
+          <button type="button" onClick={(e) => { e.stopPropagation(); onClose() }} className="bg-surface-secondary" style={{ border: 'none', borderRadius: 10, width: 32, height: 32, display: 'flex', alignItems: 'center', justifyContent: 'center', cursor: 'pointer', flexShrink: 0 }}
             onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
             onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-secondary)'}>
             <X size={14} className="text-content-muted" />
@@ -200,7 +204,7 @@ export default function DayDetailPanel({ day, days, places, categories = [], tri
         <div style={{ overflowY: 'auto', padding: '14px 20px 18px', display: collapsed ? 'none' : 'block' }}>
 
           {/* ── Weather ── */}
-          {day.date && lat && lng && (
+          {!!(day.date && lat && lng) && (
             loading ? (
               <div style={{ textAlign: 'center', padding: 16, color: 'var(--text-faint)', fontSize: 'calc(12px * var(--fs-scale-body, 1))' }}>
                 <div style={{ width: 18, height: 18, border: '2px solid var(--border-primary)', borderTopColor: 'var(--text-primary)', borderRadius: '50%', animation: 'spin 0.8s linear infinite', margin: '0 auto 6px' }} />
@@ -285,7 +289,7 @@ export default function DayDetailPanel({ day, days, places, categories = [], tri
             if (dayReservations.length === 0) return null
             return (
               <div style={{ marginBottom: 0 }}>
-                {day.date && lat && lng && <div style={{ height: 1, background: 'var(--border-faint)', margin: '12px 0' }} />}
+                {!!(day.date && lat && lng) && <div style={{ height: 1, background: 'var(--border-faint)', margin: '12px 0' }} />}
                 <div className="text-content-faint" style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 600, textTransform: 'uppercase', letterSpacing: '0.05em', marginBottom: 6 }}>{t('day.reservations')}</div>
                 <div style={{ display: 'flex', flexDirection: 'column', gap: 4 }}>
                   {dayReservations.map(r => {
@@ -400,7 +404,7 @@ function AccommodationList({ dayAccommodations, day, reservations, canEditDays,
                       <div style={{ display: 'flex', alignItems: 'center', gap: 10, padding: '8px 12px' }}>
                         <div style={{ width: 36, height: 36, borderRadius: 10, background: 'var(--bg-tertiary)', display: 'flex', alignItems: 'center', justifyContent: 'center', flexShrink: 0 }}>
                           {acc.place_image ? (
-                            <img src={acc.place_image} style={{ width: '100%', height: '100%', borderRadius: 10, objectFit: 'cover' }} />
+                            <img src={acc.place_image} alt="" style={{ width: '100%', height: '100%', borderRadius: 10, objectFit: 'cover' }} />
                           ) : (
                             <Hotel size={16} style={{ color: 'var(--text-muted)' }} />
                           )}
@@ -409,11 +413,11 @@ function AccommodationList({ dayAccommodations, day, reservations, canEditDays,
                           <div style={{ fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, color: 'var(--text-primary)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{acc.place_name}</div>
                           {acc.place_address && <div style={{ fontSize: 'calc(10px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{acc.place_address}</div>}
                         </div>
-                        {canEditDays && <button onClick={() => { setAccommodation(acc); setHotelForm({ check_in: acc.check_in || '', check_in_end: acc.check_in_end || '', check_out: acc.check_out || '', confirmation: acc.confirmation || '', place_id: acc.place_id }); setHotelDayRange({ start: acc.start_day_id, end: acc.end_day_id }); setShowHotelPicker('edit') }}
+                        {canEditDays && <button type="button" onClick={() => { setAccommodation(acc); setHotelForm({ check_in: acc.check_in || '', check_in_end: acc.check_in_end || '', check_out: acc.check_out || '', confirmation: acc.confirmation || '', place_id: acc.place_id }); setHotelDayRange({ start: acc.start_day_id, end: acc.end_day_id }); setShowHotelPicker('edit') }}
                           style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 3, flexShrink: 0 }}>
                           <Pencil size={12} style={{ color: 'var(--text-faint)' }} />
                         </button>}
-                        {canEditDays && <button onClick={() => { setAccommodation(acc); handleRemoveAccommodation() }} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 3, flexShrink: 0 }}>
+                        {canEditDays && <button type="button" onClick={() => { setAccommodation(acc); handleRemoveAccommodation() }} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 3, flexShrink: 0 }}>
                           <X size={12} style={{ color: 'var(--text-faint)' }} />
                         </button>}
                       </div>
@@ -454,12 +458,17 @@ function AccommodationList({ dayAccommodations, day, reservations, canEditDays,
                             <div style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 600, color: 'var(--text-primary)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{linked.title}</div>
                             <div style={{ fontSize: 'calc(9px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', display: 'flex', gap: 6, marginTop: 1 }}>
                               <span>{confirmed ? t('reservations.confirmed') : t('reservations.pending')}</span>
-                              {linked.confirmation_number && <span
+                              {/* Reveal toggle for a blurred code: a real button, so it can
+                                  be reached by keyboard. With blurring off there is nothing
+                                  to toggle, and it stays out of the tab order. */}
+                              {linked.confirmation_number && <button
+                                type="button"
+                                disabled={!blurCodes}
                                 onMouseEnter={e => { if (blurCodes) e.currentTarget.style.filter = 'none' }}
                                 onMouseLeave={e => { if (blurCodes) e.currentTarget.style.filter = 'blur(4px)' }}
                                 onClick={e => { if (blurCodes) { const el = e.currentTarget; el.style.filter = el.style.filter === 'none' ? 'blur(4px)' : 'none' } }}
-                                style={{ filter: blurCodes ? 'blur(4px)' : 'none', transition: 'filter 0.2s', cursor: blurCodes ? 'pointer' : 'default' }}
-                              >#{linked.confirmation_number}</span>}
+                                style={{ filter: blurCodes ? 'blur(4px)' : 'none', transition: 'filter 0.2s', cursor: blurCodes ? 'pointer' : 'default', background: 'none', border: 'none', padding: 0, font: 'inherit', color: 'inherit' }}
+                              >#{linked.confirmation_number}</button>}
                             </div>
                           </div>
                         </div>
@@ -468,7 +477,7 @@ function AccommodationList({ dayAccommodations, day, reservations, canEditDays,
                   )
                 })}
                 {/* Add another hotel */}
-                {canEditDays && <button onClick={() => setShowHotelPicker(true)} style={{
+                {canEditDays && <button type="button" onClick={() => setShowHotelPicker(true)} style={{
                   width: '100%', padding: 8, border: '1.5px dashed var(--border-primary)', borderRadius: 10,
                   background: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 5,
                   fontSize: 'calc(10px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', fontFamily: 'inherit',
@@ -477,7 +486,7 @@ function AccommodationList({ dayAccommodations, day, reservations, canEditDays,
                 </button>}
               </div>
             ) : (
-              canEditDays ? <button onClick={() => setShowHotelPicker(true)} style={{
+              canEditDays ? <button type="button" onClick={() => setShowHotelPicker(true)} style={{
                 width: '100%', padding: 10, border: '1.5px dashed var(--border-primary)', borderRadius: 10,
                 background: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 5,
                 fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: 'var(--text-faint)', fontFamily: 'inherit',
@@ -535,9 +544,12 @@ function HotelPickerModal({ showHotelPicker, setShowHotelPicker, font, t, hotelD
     <>
             {/* Hotel Picker Popup — portal to body to escape transform stacking context */}
             {showHotelPicker && createPortal(
-              <div style={{ position: 'fixed', inset: 0, zIndex: 99999, background: 'rgba(0,0,0,0.4)', backdropFilter: 'blur(4px)', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
+              // Click screen and the card that stops the click from reaching it:
+              // neither is a control, and the popup has its own X and Cancel
+              // buttons, so both stay presentational.
+              <div role="presentation" style={{ position: 'fixed', inset: 0, zIndex: 99999, background: 'rgba(0,0,0,0.4)', backdropFilter: 'blur(4px)', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
                 onClick={() => setShowHotelPicker(false)}>
-                <div onClick={e => e.stopPropagation()} style={{
+                <div role="presentation" onClick={e => e.stopPropagation()} style={{
                   width: '100%', maxWidth: 900, borderRadius: 16, overflow: 'hidden',
                   background: 'var(--bg-card)', boxShadow: '0 20px 60px rgba(0,0,0,0.2)',
                   ...font,
@@ -546,7 +558,7 @@ function HotelPickerModal({ showHotelPicker, setShowHotelPicker, font, t, hotelD
                   <div style={{ padding: '16px 18px 12px', borderBottom: '1px solid var(--border-faint)', display: 'flex', alignItems: 'center', gap: 10 }}>
                     <Hotel size={16} style={{ color: 'var(--text-primary)' }} />
                     <span style={{ fontSize: 'calc(14px * var(--fs-scale-body, 1))', fontWeight: 700, color: 'var(--text-primary)', flex: 1 }}>{showHotelPicker === 'edit' ? t('day.editAccommodation') : t('day.addAccommodation')}</span>
-                    <button onClick={() => setShowHotelPicker(false)} style={{ background: 'var(--bg-secondary)', border: 'none', borderRadius: 8, width: 28, height: 28, display: 'flex', alignItems: 'center', justifyContent: 'center', cursor: 'pointer' }}>
+                    <button type="button" onClick={() => setShowHotelPicker(false)} style={{ background: 'var(--bg-secondary)', border: 'none', borderRadius: 8, width: 28, height: 28, display: 'flex', alignItems: 'center', justifyContent: 'center', cursor: 'pointer' }}>
                       <X size={12} style={{ color: 'var(--text-muted)' }} />
                     </button>
                   </div>
@@ -584,7 +596,7 @@ function HotelPickerModal({ showHotelPicker, setShowHotelPicker, font, t, hotelD
                           size="sm"
                         />
                       </div>
-                      <button onClick={() => setHotelDayRange({ start: days[0]?.id, end: days[days.length - 1]?.id })} style={{
+                      <button type="button" onClick={() => setHotelDayRange({ start: days[0]?.id, end: days[days.length - 1]?.id })} style={{
                         padding: '6px 14px', borderRadius: 8, border: 'none', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: 'pointer', flexShrink: 0,
                         background: hotelDayRange.start === days[0]?.id && hotelDayRange.end === days[days.length - 1]?.id ? 'var(--text-primary)' : 'var(--bg-card)',
                         color: hotelDayRange.start === days[0]?.id && hotelDayRange.end === days[days.length - 1]?.id ? 'var(--bg-card)' : 'var(--text-muted)',
@@ -618,14 +630,14 @@ function HotelPickerModal({ showHotelPicker, setShowHotelPicker, font, t, hotelD
                   {/* Category Filter */}
                   {categories.length > 0 && (
                     <div style={{ padding: '8px 18px', borderBottom: '1px solid var(--border-faint)', display: 'flex', gap: 4, flexWrap: 'wrap' }}>
-                      <button onClick={() => setHotelCategoryFilter('')} style={{
+                      <button type="button" onClick={() => setHotelCategoryFilter('')} style={{
                         padding: '3px 10px', borderRadius: 6, border: 'none', fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: 'pointer',
                         background: !hotelCategoryFilter ? 'var(--text-primary)' : 'var(--bg-secondary)',
                         color: !hotelCategoryFilter ? 'var(--bg-card)' : 'var(--text-muted)',
                       }}>{t('day.allDays')}</button>
 
                       {categories.map(c => (
-                        <button key={c.id} onClick={() => setHotelCategoryFilter(c.id)} style={{
+                        <button type="button" key={c.id} onClick={() => setHotelCategoryFilter(c.id)} style={{
                           padding: '3px 10px', borderRadius: 6, border: 'none', fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: 'pointer',
                           background: hotelCategoryFilter === c.id ? c.color || 'var(--text-primary)' : 'var(--bg-secondary)',
                           color: hotelCategoryFilter === c.id ? '#fff' : 'var(--text-muted)',
@@ -641,7 +653,7 @@ function HotelPickerModal({ showHotelPicker, setShowHotelPicker, font, t, hotelD
                       return filtered.length === 0 ? (
                         <div style={{ padding: 20, textAlign: 'center', fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-faint)' }}>{t('day.noPlacesForHotel')}</div>
                       ) : filtered.map(p => (
-                      <button key={p.id} onClick={() => handleSelectPlace(p.id)} style={{
+                      <button type="button" key={p.id} onClick={() => handleSelectPlace(p.id)} style={{
                         display: 'flex', alignItems: 'center', gap: 10, width: '100%', padding: '10px 18px',
                         border: 'none', borderBottom: '1px solid var(--border-faint)',
                         background: hotelForm.place_id === p.id ? 'var(--bg-hover)' : 'none',
@@ -655,7 +667,7 @@ function HotelPickerModal({ showHotelPicker, setShowHotelPicker, font, t, hotelD
                       >
                         <div style={{ width: 32, height: 32, borderRadius: 8, background: 'var(--bg-secondary)', display: 'flex', alignItems: 'center', justifyContent: 'center', flexShrink: 0 }}>
                           {p.image_url ? (
-                            <img src={p.image_url} style={{ width: '100%', height: '100%', borderRadius: 8, objectFit: 'cover' }} />
+                            <img src={p.image_url} alt="" style={{ width: '100%', height: '100%', borderRadius: 8, objectFit: 'cover' }} />
                           ) : (
                             <MapPin size={13} style={{ color: 'var(--text-faint)' }} />
                           )}
@@ -671,10 +683,10 @@ function HotelPickerModal({ showHotelPicker, setShowHotelPicker, font, t, hotelD
 
                 {/* Save / Cancel */}
                 <div style={{ padding: '12px 18px', borderTop: '1px solid var(--border-faint)', display: 'flex', justifyContent: 'flex-end', gap: 8 }}>
-                  <button onClick={() => setShowHotelPicker(false)} style={{ padding: '7px 16px', borderRadius: 8, border: '1px solid var(--border-primary)', background: 'none', fontSize: 'calc(12px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit', color: 'var(--text-muted)' }}>
+                  <button type="button" onClick={() => setShowHotelPicker(false)} style={{ padding: '7px 16px', borderRadius: 8, border: '1px solid var(--border-primary)', background: 'none', fontSize: 'calc(12px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit', color: 'var(--text-muted)' }}>
                     {t('common.cancel')}
                   </button>
-                  <button onClick={() => { void saveHotelPicker() }} disabled={!hotelForm.place_id} style={{
+                  <button type="button" onClick={() => { void saveHotelPicker() }} disabled={!hotelForm.place_id} style={{
                     padding: '7px 20px', borderRadius: 8, border: 'none', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit',
                     background: hotelForm.place_id ? 'var(--text-primary)' : 'var(--bg-tertiary)',
                     color: hotelForm.place_id ? 'var(--bg-card)' : 'var(--text-faint)',
diff --git a/client/src/components/Planner/DayPlanSidebar.test.tsx b/client/src/components/Planner/DayPlanSidebar.test.tsx
index 782bb6d71..e6aba3be1 100644
--- a/client/src/components/Planner/DayPlanSidebar.test.tsx
+++ b/client/src/components/Planner/DayPlanSidebar.test.tsx
@@ -370,6 +370,17 @@ describe('DayPlanSidebar', () => {
     expect(onSelectDay).toHaveBeenCalledWith(10)
   })
 
+  it('FE-PLANNER-DAYPLAN-209: clicking the selected day header again deselects it', async () => {
+    const user = userEvent.setup()
+    const day = buildDay({ id: 10, date: '2025-06-01', title: 'My Day' })
+    const onSelectDay = vi.fn()
+    const onDayDetail = vi.fn()
+    render(<DayPlanSidebar {...makeDefaultProps({ days: [day], selectedDayId: 10, onSelectDay, onDayDetail })} />)
+    await user.click(screen.getByText('My Day'))
+    expect(onSelectDay).toHaveBeenCalledWith(null)
+    expect(onDayDetail).toHaveBeenCalledWith(null)
+  })
+
   it('FE-PLANNER-DAYPLAN-010: selectedDayId renders without error', () => {
     const day = buildDay({ id: 10, date: '2025-06-01', title: 'My Day' })
     render(<DayPlanSidebar {...makeDefaultProps({ days: [day], selectedDayId: 10 })} />)
diff --git a/client/src/components/Planner/DayPlanSidebar.tsx b/client/src/components/Planner/DayPlanSidebar.tsx
index 768af3397..91b410e08 100644
--- a/client/src/components/Planner/DayPlanSidebar.tsx
+++ b/client/src/components/Planner/DayPlanSidebar.tsx
@@ -65,7 +65,7 @@ interface DayPlanSidebarProps {
   selectedAssignmentId: number | null
   onSelectDay: (dayId: number | null, skipFit?: boolean) => void
   onPlaceClick: (placeId: number | null, assignmentId?: number | null) => void
-  onDayDetail: (day: Day) => void
+  onDayDetail: (day: Day | null) => void
   accommodations?: Accommodation[]
   onReorder: (dayId: number, orderedIds: number[]) => void
   onReorderDays?: (orderedIds: number[]) => void
@@ -306,7 +306,7 @@ function useDayPlanSidebar(props: DayPlanSidebarProps) {
         assignmentId: dragDataRef.current.assignmentId || '',
         noteId: dragDataRef.current.noteId || '',
         reservationId: dragDataRef.current.reservationId || '',
-        fromDayId: parseInt(dragDataRef.current.fromDayId) || 0,
+        fromDayId: Number.parseInt(dragDataRef.current.fromDayId) || 0,
         phase: (dragDataRef.current.phase || 'single') as 'single' | 'start' | 'middle' | 'end',
       }
     }
@@ -990,7 +990,7 @@ function useDayPlanSidebar(props: DayPlanSidebarProps) {
       setDraggingId(null); setDropTargetKey(null); dragDataRef.current = null; window.__dragData = null; return
     }
     if (placeId) {
-      onAssignToDay?.(parseInt(placeId), dayId)
+      onAssignToDay?.(Number.parseInt(placeId), dayId)
     } else if (assignmentId && fromDayId !== dayId) {
       const srcAssignment = (useTripStore.getState().assignments[String(fromDayId)] || []).find(a => a.id === Number(assignmentId))
       const capturedFromDayId = fromDayId
@@ -1466,6 +1466,20 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
       { label: t('dayplan.transportMode.useDefault'), icon: RotateCcw, onClick: () => setIncomingLegMode(assignmentId, dayId, null) },
     ])
   }
+
+  // Enter/Space on a route connector opens the same mode menu a click opens. A key
+  // event carries no pointer position, so the menu is anchored to the connector.
+  const openLegMenuByKey = (e: React.KeyboardEvent<HTMLDivElement>, open: (m: React.MouseEvent) => void) => {
+    if (e.key !== 'Enter' && e.key !== ' ') return
+    const rect = e.currentTarget.getBoundingClientRect()
+    open({
+      clientX: rect.left,
+      clientY: rect.bottom,
+      preventDefault: () => e.preventDefault(),
+      stopPropagation: () => e.stopPropagation(),
+    } as unknown as React.MouseEvent)
+  }
+
   return (
     <div data-touch-drag={dragDisabled ? undefined : ''} style={{ display: 'flex', flexDirection: 'column', height: '100%', position: 'relative', fontFamily: "var(--font-system)" }}>
       {/* Toolbar */}
@@ -1500,6 +1514,13 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
       <div className={`scroll-container${draggingId ? '' : ' trek-stagger'}`} style={{ flex: 1, overflowY: 'auto', minHeight: 0 }} ref={scrollContainerRef} onScroll={(e) => onScrollTopChange?.((e.currentTarget as HTMLElement).scrollTop)}>
         {days.map((day, index) => {
           const isSelected = selectedDayId === day.id
+          // Shared by the click and the key handler so the two can never drift
+          // apart — pressing Enter on the row has to toggle, not just select.
+          // Named for the selection, not the expand/collapse `toggleDay` above.
+          const toggleDaySelection = () => {
+            if (isSelected) { onSelectDay(null); if (onDayDetail) onDayDetail(null) }
+            else { onSelectDay(day.id); if (onDayDetail) onDayDetail(day) }
+          }
           const isExpanded = expandedDays.has(day.id)
           const da = getDayAssignments(day.id)
           const cost = dayTotalCost(day.id, assignments, costBase, currency, locale, fxRates)
@@ -1579,7 +1600,20 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
               <div
                 className="dp-day-header"
                 data-selected={isSelected}
-                onClick={() => { onSelectDay(day.id); if (onDayDetail) onDayDetail(day) }}
+                // Clicking the selected day again deselects it — same as the day panel's × (#2024).
+                // Selecting the day has no other trigger, so the row carries the
+                // button role itself. The badges inside it are buttons of their
+                // own, hence the key handler only answers for the row — and it
+                // toggles exactly like the click, rather than only selecting.
+                role="button"
+                tabIndex={0}
+                onClick={() => toggleDaySelection()}
+                onKeyDown={e => {
+                  if (e.target !== e.currentTarget) return
+                  if (e.key !== 'Enter' && e.key !== ' ') return
+                  e.preventDefault()
+                  toggleDaySelection()
+                }}
                 onDragOver={e => { e.preventDefault(); if (dragOverDayId !== day.id) setDragOverDayId(day.id) }}
                 onDragLeave={e => { if (!e.currentTarget.contains(e.relatedTarget as Node | null)) setDragOverDayId(null) }}
                 onDrop={e => handleDropOnDay(e, day.id)}
@@ -1685,10 +1719,10 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                         const isCheckOut = acc.end_day_id === day.id
                         const iconColor = isCheckOut && !isCheckIn ? '#ef4444' : isCheckIn ? '#22c55e' : 'var(--text-faint)'
                         return (
-                          <span key={acc.id} onClick={e => { e.stopPropagation(); if ((acc as any).place_id) onPlaceClick((acc as any).place_id) }} className="bg-surface-hover" style={{ display: 'inline-flex', alignItems: 'center', gap: 4, flexShrink: 1, minWidth: 0, cursor: (acc as any).place_id ? 'pointer' : 'default', borderRadius: 7, padding: '2px 7px 2px 6px' }}>
+                          <button type="button" key={acc.id} onClick={e => { e.stopPropagation(); if ((acc as any).place_id) onPlaceClick((acc as any).place_id) }} className="bg-surface-hover" style={{ display: 'inline-flex', alignItems: 'center', gap: 4, flexShrink: 1, minWidth: 0, cursor: (acc as any).place_id ? 'pointer' : 'default', borderRadius: 7, padding: '2px 7px 2px 6px', border: 'none', font: 'inherit', textAlign: 'left' }}>
                             <Hotel size={11} strokeWidth={1.8} style={{ color: iconColor, flexShrink: 0 }} />
                             <span className="text-content-muted" style={{ fontSize: 'calc(10.5px * var(--fs-scale-caption, 1))', fontWeight: 400, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{(acc as any).place_name || (acc as any).reservation_title}</span>
-                          </span>
+                          </button>
                         )
                       })
                     })()}
@@ -1697,10 +1731,10 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                       const activeRentals = getActiveRentalsForDay(day.id)
                       if (activeRentals.length === 0) return null
                       return activeRentals.map(r => (
-                        <span key={`rental-${r.id}`} onClick={e => { e.stopPropagation(); setTransportDetail(r) }} className="bg-surface-hover" style={{ display: 'inline-flex', alignItems: 'center', gap: 4, flexShrink: 1, minWidth: 0, cursor: 'pointer', borderRadius: 7, padding: '2px 7px 2px 6px' }}>
+                        <button type="button" key={`rental-${r.id}`} onClick={e => { e.stopPropagation(); setTransportDetail(r) }} className="bg-surface-hover" style={{ display: 'inline-flex', alignItems: 'center', gap: 4, flexShrink: 1, minWidth: 0, cursor: 'pointer', borderRadius: 7, padding: '2px 7px 2px 6px', border: 'none', font: 'inherit', textAlign: 'left' }}>
                           <Car size={11} strokeWidth={1.8} className="text-content-faint" style={{ flexShrink: 0 }} />
                           <span className="text-content-muted" style={{ fontSize: 'calc(10.5px * var(--fs-scale-caption, 1))', fontWeight: 400, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{r.title}</span>
-                        </span>
+                        </button>
                       ))
                     })()}
                   </div>
@@ -1720,26 +1754,26 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                         {/* Public transit search (#1065) — replaced the rename pencil,
                             which moved next to the day name in the day detail view. */}
                         {onPlanTransit ? (
-                          <button onClick={e => { e.stopPropagation(); onPlanTransit(day.id) }} title={t('transit.title')} aria-label={t('transit.title')} style={{ ...cell, border: 'none', borderRight: div, borderBottom: div }}>
+                          <button type="button" onClick={e => { e.stopPropagation(); onPlanTransit(day.id) }} title={t('transit.title')} aria-label={t('transit.title')} style={{ ...cell, border: 'none', borderRight: div, borderBottom: div }}>
                             <TramFront size={14} strokeWidth={1.8} />
                           </button>
                         ) : <div style={{ borderRight: div, borderBottom: div }} />}
                         {onAddTransport ? (
-                          <button onClick={e => { e.stopPropagation(); onAddTransport(day.id) }} title={t('transport.addTransport')} style={{ ...cell, border: 'none', borderBottom: div }}>
+                          <button type="button" onClick={e => { e.stopPropagation(); onAddTransport(day.id) }} title={t('transport.addTransport')} style={{ ...cell, border: 'none', borderBottom: div }}>
                             <Plus size={14} strokeWidth={1.8} />
                           </button>
                         ) : <div style={{ borderBottom: div }} />}
-                        <button onClick={e => openAddNote(day.id, e)} aria-label={t('dayplan.addNote')} style={{ ...cell, border: 'none', borderRight: div }}>
+                        <button type="button" onClick={e => openAddNote(day.id, e)} aria-label={t('dayplan.addNote')} style={{ ...cell, border: 'none', borderRight: div }}>
                           <FileText size={14} strokeWidth={1.8} />
                         </button>
-                        <button onClick={e => toggleDay(day.id, e)} title={isExpanded ? t('common.collapse') : t('common.expand')} style={{ ...cell, border: 'none' }}>
+                        <button type="button" onClick={e => toggleDay(day.id, e)} title={isExpanded ? t('common.collapse') : t('common.expand')} style={{ ...cell, border: 'none' }}>
                           {isExpanded ? <ChevronDown size={15} strokeWidth={1.8} /> : <ChevronRight size={15} strokeWidth={1.8} />}
                         </button>
                       </div>
                     )
                   })()
                 ) : (
-                  <button onClick={e => toggleDay(day.id, e)} className="text-content-faint" style={{ alignSelf: 'flex-start', flexShrink: 0, background: 'none', border: 'none', padding: 6, cursor: 'pointer', display: 'flex', alignItems: 'center' }}>
+                  <button type="button" onClick={e => toggleDay(day.id, e)} className="text-content-faint" style={{ alignSelf: 'flex-start', flexShrink: 0, background: 'none', border: 'none', padding: 6, cursor: 'pointer', display: 'flex', alignItems: 'center' }}>
                     {isExpanded ? <ChevronDown size={16} strokeWidth={1.8} /> : <ChevronRight size={16} strokeWidth={1.8} />}
                   </button>
                 )}
@@ -1765,7 +1799,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                       const toLegIndex = legPart ? Number(legPart.slice(3)) : null
 
                       if (placeId) {
-                        onAssignToDay?.(parseInt(placeId), day.id)
+                        onAssignToDay?.(Number.parseInt(placeId), day.id)
                       } else if (fromReservationId && fromDayId !== day.id) {
                         const r = reservations.find(x => x.id === Number(fromReservationId))
                         if (r) { const update = computeMultiDayMove(r, day.id, phase); tripActions.updateReservation(tripId, r.id, update).catch((err: unknown) => toast.error(err instanceof Error ? err.message : t('common.unknownError'))) }
@@ -1791,7 +1825,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                     }
                     if (!assignmentId && !noteId && !placeId) { dragDataRef.current = null; window.__dragData = null; return }
                     if (placeId) {
-                      onAssignToDay?.(parseInt(placeId), day.id)
+                      onAssignToDay?.(Number.parseInt(placeId), day.id)
                       setDropTargetKey(null); window.__dragData = null; return
                     }
                     if (assignmentId && fromDayId !== day.id) {
@@ -1815,7 +1849,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                     const targetId = hotelLegs[day.id]?.top?.targetId
                     const connector = <HotelRouteConnector seg={hotelLegs[day.id]!.top!.seg} name={hotelLegs[day.id]!.top!.name} profile={routeProfile} placement="top" />
                     return canEditDays && targetId != null ? (
-                      <div role="button" tabIndex={0} title={t('dayplan.transportMode.change')} onClick={e => openIncomingLegModeMenu(e, targetId, day.id, hotelLegs[day.id]!.top!.seg)} style={{ cursor: 'pointer' }}>
+                      <div role="button" tabIndex={0} title={t('dayplan.transportMode.change')} onClick={e => openIncomingLegModeMenu(e, targetId, day.id, hotelLegs[day.id]!.top!.seg)} onKeyDown={e => openLegMenuByKey(e, m => openIncomingLegModeMenu(m, targetId, day.id, hotelLegs[day.id]!.top!.seg))} style={{ cursor: 'pointer' }}>
                         {connector}
                       </div>
                     ) : connector
@@ -1889,11 +1923,18 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                         }
                         const moveUp = (e) => { e.stopPropagation(); arrowMove('up') }
                         const moveDown = (e) => { e.stopPropagation(); arrowMove('down') }
+                        const selectPlace = () => { onPlaceClick(isPlaceSelected ? null : place.id, isPlaceSelected ? null : assignment.id); if (!isPlaceSelected) onSelectDay(day.id, true) }
 
                         return (
                           <React.Fragment key={`place-${assignment.id}`}>
                           <div
                             className="dp-row"
+                            // Picking the place out of the day has no other trigger, so
+                            // the row is the control. Its grip, lock and arrows are
+                            // buttons in their own right, hence the key handler only
+                            // answers for the row itself.
+                            role="button"
+                            tabIndex={0}
                             draggable={canEditDays && !dragDisabled}
                             onDragStart={e => {
                               if (!canEditDays || dragDisabled) { e.preventDefault(); return }
@@ -1909,7 +1950,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                               const { placeId, assignmentId: fromAssignmentId, noteId, reservationId: fromReservationId, fromDayId, phase } = getDragData(e)
                               if (placeId) {
                                 const pos = placeItems.findIndex(i => i.data.id === assignment.id)
-                                onAssignToDay?.(parseInt(placeId), day.id, pos >= 0 ? pos : undefined)
+                                onAssignToDay?.(Number.parseInt(placeId), day.id, pos >= 0 ? pos : undefined)
                                 setDropTargetKey(null); window.__dragData = null
                               } else if (fromReservationId && fromDayId !== day.id) {
                                 const r = reservations.find(x => x.id === Number(fromReservationId))
@@ -1949,7 +1990,13 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                               }
                             }}
                             onDragEnd={() => { setDraggingId(null); setDragOverDayId(null); setDropTargetKey(null); dragDataRef.current = null }}
-                            onClick={() => { onPlaceClick(isPlaceSelected ? null : place.id, isPlaceSelected ? null : assignment.id); if (!isPlaceSelected) onSelectDay(day.id, true) }}
+                            onClick={selectPlace}
+                            onKeyDown={e => {
+                              if (e.target !== e.currentTarget) return
+                              if (e.key !== 'Enter' && e.key !== ' ') return
+                              e.preventDefault()
+                              selectPlace()
+                            }}
                             onContextMenu={e => {
                               // Flat entries, one per app: the menu has room to
                               // grow and a submenu would need a component that
@@ -1997,11 +2044,13 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                             {canEditDays && !dragDisabled && <div className="dp-grip" style={{ flexShrink: 0, color: 'var(--text-faint)', display: 'flex', alignItems: 'center', opacity: 0.3, transition: 'opacity 0.15s', cursor: 'grab' }}>
                               <GripVertical size={13} strokeWidth={1.8} />
                             </div>}
-                            <div
+                            <button
+                              type="button"
+                              aria-label={lockedIds.has(assignment.id) ? t('planner.clickToUnlock') : t('planner.keepPosition')}
                               onClick={e => { e.stopPropagation(); toggleLock(assignment.id) }}
                               onMouseEnter={e => { e.stopPropagation(); setLockHoverId(assignment.id) }}
                               onMouseLeave={() => setLockHoverId(null)}
-                              style={{ position: 'relative', flexShrink: 0, cursor: 'pointer' }}
+                              style={{ position: 'relative', flexShrink: 0, cursor: 'pointer', display: 'flex', background: 'none', border: 'none', padding: 0, font: 'inherit' }}
                             >
                               <PlaceAvatar place={place} category={cat} size={28} />
                               {/* Hover/locked overlay */}
@@ -2029,7 +2078,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                                     : t('planner.keepPosition')}
                                 </div>
                               )}
-                            </div>
+                            </button>
                             <div style={{ flex: 1, minWidth: 0 }}>
                               <div style={{ display: 'flex', alignItems: 'center', gap: 4, overflow: 'hidden' }}>
                                 {cat && (() => {
@@ -2144,7 +2193,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                                       marginLeft: pi > 0 ? -4 : 0, flexShrink: 0,
                                       overflow: 'hidden',
                                     }}>
-                                      {p.avatar ? <img src={avatarSrc(p.avatar)!} style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : p.username?.[0]?.toUpperCase()}
+                                      {p.avatar ? <img src={avatarSrc(p.avatar)!} alt={p.username ?? ''} style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : p.username?.[0]?.toUpperCase()}
                                     </div>
                                   ))}
                                   {assignment.participants.length > 5 && (
@@ -2154,15 +2203,15 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                               )}
                             </div>
                             {canEditDays && <div className="reorder-buttons" style={{ flexShrink: 0, display: 'flex', gap: 1, transition: 'opacity 0.15s' }}>
-                              <button onClick={moveUp} disabled={idx === 0} className={idx === 0 ? 'text-[var(--border-primary)]' : 'text-content-faint'} style={{ background: 'none', border: 'none', padding: '1px 2px', cursor: idx === 0 ? 'default' : 'pointer', display: 'flex', lineHeight: 1 }}>
+                              <button type="button" onClick={moveUp} disabled={idx === 0} className={idx === 0 ? 'text-[var(--border-primary)]' : 'text-content-faint'} style={{ background: 'none', border: 'none', padding: '1px 2px', cursor: idx === 0 ? 'default' : 'pointer', display: 'flex', lineHeight: 1 }}>
                                 <ChevronUp size={12} strokeWidth={2} />
                               </button>
-                              <button onClick={moveDown} disabled={idx === merged.length - 1} className={idx === merged.length - 1 ? 'text-[var(--border-primary)]' : 'text-content-faint'} style={{ background: 'none', border: 'none', padding: '1px 2px', cursor: idx === merged.length - 1 ? 'default' : 'pointer', display: 'flex', lineHeight: 1 }}>
+                              <button type="button" onClick={moveDown} disabled={idx === merged.length - 1} className={idx === merged.length - 1 ? 'text-[var(--border-primary)]' : 'text-content-faint'} style={{ background: 'none', border: 'none', padding: '1px 2px', cursor: idx === merged.length - 1 ? 'default' : 'pointer', display: 'flex', lineHeight: 1 }}>
                                 <ChevronDown size={12} strokeWidth={2} />
                               </button>
                             </div>}
                             {canEditDays && onAddBookingToAssignment && hoveredAssignmentId === assignment.id && (
-                              <button
+                              <button type="button"
                                 onClick={e => {
                                   e.stopPropagation()
                                   onAddBookingToAssignment(day.id, assignment.id)
@@ -2190,7 +2239,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                           </div>
                           {daySchedule.byAssignment[day.id]?.[assignment.id]?.map(si => <PluginDayScheduleRow key={`${si.pluginId}:${si.id}`} item={si} />)}
                           {routeLegs[day.id]?.[assignment.id] && (canEditDays ? (
-                            <div role="button" tabIndex={0} title={t('dayplan.transportMode.change')} onClick={e => openLegModeMenu(e, assignment.id, day.id, routeLegs[day.id]![assignment.id])} style={{ cursor: 'pointer' }}>
+                            <div role="button" tabIndex={0} title={t('dayplan.transportMode.change')} onClick={e => openLegModeMenu(e, assignment.id, day.id, routeLegs[day.id]![assignment.id])} onKeyDown={e => openLegMenuByKey(e, m => openLegModeMenu(m, assignment.id, day.id, routeLegs[day.id]![assignment.id]))} style={{ cursor: 'pointer' }}>
                               <RouteConnector seg={routeLegs[day.id]![assignment.id]} profile={routeProfile} />
                             </div>
                           ) : (
@@ -2246,22 +2295,34 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                         const displayTime = getDisplayTimeForDay(res, day.id)
                         const legKey = res.__leg ? `leg${res.__leg.index}` : 'x'
 
+                        const openTransportRow = () => {
+                          const target = reservations.find(x => x.id === res.id) ?? res
+                          // A transit journey opens its own journey view — the rich
+                          // stop-by-stop breakdown with its booking fields, never the
+                          // generic edit form (#1065).
+                          if (transitMeta) {
+                            if (onOpenTransit) onOpenTransit(target)
+                            else setTransportDetail(target)
+                            return
+                          }
+                          if (!canEditDays) return
+                          if (TRANSPORT_TYPES.has(res.type)) onEditTransport?.(target)
+                          else onEditReservation?.(target)
+                        }
+
                         return (
                           <React.Fragment key={`transport-${res.id}-${legKey}-${day.id}`}>
                           <div
-                            onClick={() => {
-                              const target = reservations.find(x => x.id === res.id) ?? res
-                              // A transit journey opens its own journey view — the rich
-                              // stop-by-stop breakdown with its booking fields, never the
-                              // generic edit form (#1065).
-                              if (transitMeta) {
-                                if (onOpenTransit) onOpenTransit(target)
-                                else setTransportDetail(target)
-                                return
-                              }
-                              if (!canEditDays) return
-                              if (TRANSPORT_TYPES.has(res.type)) onEditTransport?.(target)
-                              else onEditReservation?.(target)
+                            // Opening the booking has no other trigger, so the row is
+                            // the control; the buttons inside it answer for themselves.
+                            role="button"
+                            tabIndex={0}
+                            onClick={openTransportRow}
+                            onKeyDown={e => {
+                              if (e.target !== e.currentTarget) return
+                              if (e.key !== 'Enter' && e.key !== ' ') return
+                              e.preventDefault()
+                              openTransportRow()
                             }}
                             onDragOver={e => {
                               e.preventDefault(); e.stopPropagation()
@@ -2289,7 +2350,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                               const insertAfter = e.clientY > rect.top + rect.height / 2
                               const { placeId, assignmentId: fromAssignmentId, noteId, reservationId: fromReservationId, fromDayId, phase } = getDragData(e)
                               if (placeId) {
-                                onAssignToDay?.(parseInt(placeId), day.id)
+                                onAssignToDay?.(Number.parseInt(placeId), day.id)
                               } else if (fromReservationId && fromDayId !== day.id) {
                                 const r2 = reservations.find(x => x.id === Number(fromReservationId))
                                 if (r2) { const update = computeMultiDayMove(r2, day.id, phase); tripActions.updateReservation(tripId, r2.id, update).catch((err: unknown) => toast.error(err instanceof Error ? err.message : t('common.unknownError'))) }
@@ -2432,7 +2493,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                             const nextPlaceId = merged.slice(idx + 1).find(i => i.type === 'place' && i.data.place?.lat && i.data.place?.lng)?.data.id
                             const connector = <RouteConnector seg={routeLegs[day.id]![res.id]} profile={routeProfile} />
                             return canEditDays && nextPlaceId != null ? (
-                              <div role="button" tabIndex={0} title={t('dayplan.transportMode.change')} onClick={e => openIncomingLegModeMenu(e, Number(nextPlaceId), day.id, routeLegs[day.id]![res.id])} style={{ cursor: 'pointer' }}>
+                              <div role="button" tabIndex={0} title={t('dayplan.transportMode.change')} onClick={e => openIncomingLegModeMenu(e, Number(nextPlaceId), day.id, routeLegs[day.id]![res.id])} onKeyDown={e => openLegMenuByKey(e, m => openIncomingLegModeMenu(m, Number(nextPlaceId), day.id, routeLegs[day.id]![res.id]))} style={{ cursor: 'pointer' }}>
                                 {connector}
                               </div>
                             ) : connector
@@ -2464,7 +2525,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                               const tm = getMergedItems(day.id)
                               const noteIdx = tm.findIndex(i => i.type === 'note' && i.data.id === note.id)
                               const pos = tm.slice(0, noteIdx).filter(i => i.type === 'place').length
-                              onAssignToDay?.(parseInt(placeId), day.id, pos)
+                              onAssignToDay?.(Number.parseInt(placeId), day.id, pos)
                               setDropTargetKey(null); window.__dragData = null
                             } else if (fromReservationId && fromDayId !== day.id) {
                               const r = reservations.find(x => x.id === Number(fromReservationId))
@@ -2549,12 +2610,12 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                             every note a shorter line for the whole time you are
                             not hovering. */}
                         {canEditDays && <div className="note-edit-buttons bg-surface-card" style={{ position: 'absolute', right: 5, top: '50%', transform: 'translateY(-50%)', display: 'flex', flexDirection: 'column', justifyContent: 'center', gap: 3, padding: 4, borderRadius: 999, border: '1px solid var(--border-faint)', boxShadow: '0 4px 14px rgba(0,0,0,0.10)', opacity: 0, transition: 'opacity 0.15s' }}>
-                          <button onClick={e => openEditNote(day.id, note, e)} aria-label={t('dayplan.noteEdit')} title={t('dayplan.noteEdit')} className="text-content-faint note-edit-btn" style={{ background: 'none', border: 'none', width: 30, height: 30, borderRadius: 999, cursor: 'pointer', display: 'grid', placeItems: 'center', padding: 0 }}><Pencil size={15} /></button>
-                          <button onClick={e => { e.stopPropagation(); setPendingDeleteNote({ dayId: day.id, noteId: note.id }) }} aria-label={t('dayplan.noteDelete')} title={t('dayplan.noteDelete')} className="text-content-faint note-edit-btn note-edit-btn-danger" style={{ background: 'none', border: 'none', width: 30, height: 30, borderRadius: 999, cursor: 'pointer', display: 'grid', placeItems: 'center', padding: 0 }}><Trash2 size={15} /></button>
+                          <button type="button" onClick={e => openEditNote(day.id, note, e)} aria-label={t('dayplan.noteEdit')} title={t('dayplan.noteEdit')} className="text-content-faint note-edit-btn" style={{ background: 'none', border: 'none', width: 30, height: 30, borderRadius: 999, cursor: 'pointer', display: 'grid', placeItems: 'center', padding: 0 }}><Pencil size={15} /></button>
+                          <button type="button" onClick={e => { e.stopPropagation(); setPendingDeleteNote({ dayId: day.id, noteId: note.id }) }} aria-label={t('dayplan.noteDelete')} title={t('dayplan.noteDelete')} className="text-content-faint note-edit-btn note-edit-btn-danger" style={{ background: 'none', border: 'none', width: 30, height: 30, borderRadius: 999, cursor: 'pointer', display: 'grid', placeItems: 'center', padding: 0 }}><Trash2 size={15} /></button>
                         </div>}
                         {canEditDays && <div className="reorder-buttons" style={{ flexShrink: 0, display: 'flex', gap: 1, transition: 'opacity 0.15s' }}>
-                          <button onClick={e => { e.stopPropagation(); moveNote(day.id, note.id, 'up') }} disabled={noteIdx === 0} className={noteIdx === 0 ? 'text-[var(--border-primary)]' : 'text-content-faint'} style={{ background: 'none', border: 'none', padding: '1px 2px', cursor: noteIdx === 0 ? 'default' : 'pointer', display: 'flex', lineHeight: 1 }}><ChevronUp size={12} strokeWidth={2} /></button>
-                          <button onClick={e => { e.stopPropagation(); moveNote(day.id, note.id, 'down') }} disabled={noteIdx === merged.length - 1} className={noteIdx === merged.length - 1 ? 'text-[var(--border-primary)]' : 'text-content-faint'} style={{ background: 'none', border: 'none', padding: '1px 2px', cursor: noteIdx === merged.length - 1 ? 'default' : 'pointer', display: 'flex', lineHeight: 1 }}><ChevronDown size={12} strokeWidth={2} /></button>
+                          <button type="button" onClick={e => { e.stopPropagation(); moveNote(day.id, note.id, 'up') }} disabled={noteIdx === 0} className={noteIdx === 0 ? 'text-[var(--border-primary)]' : 'text-content-faint'} style={{ background: 'none', border: 'none', padding: '1px 2px', cursor: noteIdx === 0 ? 'default' : 'pointer', display: 'flex', lineHeight: 1 }}><ChevronUp size={12} strokeWidth={2} /></button>
+                          <button type="button" onClick={e => { e.stopPropagation(); moveNote(day.id, note.id, 'down') }} disabled={noteIdx === merged.length - 1} className={noteIdx === merged.length - 1 ? 'text-[var(--border-primary)]' : 'text-content-faint'} style={{ background: 'none', border: 'none', padding: '1px 2px', cursor: noteIdx === merged.length - 1 ? 'default' : 'pointer', display: 'flex', lineHeight: 1 }}><ChevronDown size={12} strokeWidth={2} /></button>
                         </div>}
                         </div>
                         </React.Fragment>
@@ -2566,7 +2627,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                     const targetId = hotelLegs[day.id]?.bottom?.targetId
                     const connector = <HotelRouteConnector seg={hotelLegs[day.id]!.bottom!.seg} name={hotelLegs[day.id]!.bottom!.name} profile={routeProfile} placement="bottom" />
                     return canEditDays && targetId != null ? (
-                      <div role="button" tabIndex={0} title={t('dayplan.transportMode.change')} onClick={e => openLegModeMenu(e, targetId, day.id, hotelLegs[day.id]!.bottom!.seg)} style={{ cursor: 'pointer' }}>
+                      <div role="button" tabIndex={0} title={t('dayplan.transportMode.change')} onClick={e => openLegModeMenu(e, targetId, day.id, hotelLegs[day.id]!.bottom!.seg)} onKeyDown={e => openLegMenuByKey(e, m => openLegModeMenu(m, targetId, day.id, hotelLegs[day.id]!.bottom!.seg))} style={{ cursor: 'pointer' }}>
                         {connector}
                       </div>
                     ) : connector
@@ -2580,7 +2641,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                       const { placeId, assignmentId, noteId, reservationId: fromReservationId, fromDayId, phase } = getDragData(e)
                       // Neuer Ort von der Orte-Liste
                       if (placeId) {
-                        onAssignToDay?.(parseInt(placeId), day.id)
+                        onAssignToDay?.(Number.parseInt(placeId), day.id)
                         setDropTargetKey(null); window.__dragData = null; return
                       }
                       if (fromReservationId && fromDayId !== day.id) {
@@ -2618,7 +2679,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                   {(isSelected || (showRouteToolsWhenExpanded && isExpanded)) && routeToolsRoutable && (
                     <div style={{ padding: '10px 16px 12px', borderTop: '1px solid var(--border-faint)', display: 'flex', flexDirection: 'column', gap: 7 }}>
                       <div style={{ display: 'flex', gap: 6, alignItems: 'stretch' }}>
-                        <button
+                        <button type="button"
                           onClick={() => {
                             if (showRouteToolsWhenExpanded) {
                               // Mobile: toggle this day's inline leg distances in place.
@@ -2647,7 +2708,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                           {t('dayplan.route')}
                         </button>
                         {/* Open the day's stops as a route in Google Maps (planned order). #1255 */}
-                        <button
+                        <button type="button"
                           onClick={() => {
                             const url = generateGoogleMapsUrl(dayExportStops())
                             if (url) window.open(url, '_blank', 'noopener,noreferrer')
@@ -2666,7 +2727,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                         {/* The same day, handed to CoMaps for offline navigation (#1904). The
                             day's own travel mode rides along, so the route it builds walks
                             when the plan walks. */}
-                        <button
+                        <button type="button"
                           onClick={() => {
                             const url = generateCoMapsUrl(dayExportStops(), day.default_transport_mode ?? routeProfile)
                             if (url) window.open(url, '_blank', 'noopener,noreferrer')
@@ -2688,7 +2749,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                             sat against both edges as soon as the row filled up, and
                             the row gained a button when CoMaps arrived. The label
                             stays as the accessible name and the tooltip. */}
-                        <button
+                        <button type="button"
                           onClick={() => handleOptimize(day.id)}
                           aria-label={t('dayplan.optimize')}
                           title={t('dayplan.optimize')}
@@ -2706,7 +2767,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar(props: DayPlanSidebarP
                             const ModeIcon = p.key === 'driving' ? Car : p.key === 'walking' ? Footprints : Zap
                             const active = (day.default_transport_mode ?? routeProfile) === p.key
                             return (
-                              <button
+                              <button type="button"
                                 key={p.key}
                                 onClick={() => setDayDefaultMode(day.id, p.key)}
                                 aria-label={p.label}
diff --git a/client/src/components/Planner/DayPlanSidebarMobileAddPlaceButton.tsx b/client/src/components/Planner/DayPlanSidebarMobileAddPlaceButton.tsx
index f1ebe50ae..96f942c22 100644
--- a/client/src/components/Planner/DayPlanSidebarMobileAddPlaceButton.tsx
+++ b/client/src/components/Planner/DayPlanSidebarMobileAddPlaceButton.tsx
@@ -24,7 +24,7 @@ export function MobileAddPlaceButton({ dayId, places, assignments, onAssign, onA
   return (
     <div className="md:hidden" style={{ padding: '8px 12px 12px' }}>
       {!open ? (
-        <button
+        <button type="button"
           onClick={e => { e.stopPropagation(); setOpen(true) }}
           style={{
             width: '100%', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 6,
@@ -47,7 +47,7 @@ export function MobileAddPlaceButton({ dayId, places, assignments, onAssign, onA
               placeholder={t('dayplan.mobile.searchPlaces')}
               style={{ flex: 1, border: 'none', outline: 'none', background: 'transparent', fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontFamily: 'inherit', color: 'var(--text-primary)' }}
             />
-            <button onClick={() => { setOpen(false); setSearch('') }} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 2, color: 'var(--text-faint)' }}>
+            <button type="button" onClick={() => { setOpen(false); setSearch('') }} style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 2, color: 'var(--text-faint)' }}>
               <X size={14} />
             </button>
           </div>
@@ -58,7 +58,7 @@ export function MobileAddPlaceButton({ dayId, places, assignments, onAssign, onA
               </div>
             )}
             {filtered.slice(0, 20).map(p => (
-              <button
+              <button type="button"
                 key={p.id}
                 onClick={() => {
                   onAssign?.(p.id, dayId)
@@ -77,7 +77,7 @@ export function MobileAddPlaceButton({ dayId, places, assignments, onAssign, onA
             ))}
           </div>
           {onAddNew && (
-            <button
+            <button type="button"
               onClick={() => { onAddNew(); setOpen(false); setSearch('') }}
               style={{
                 width: '100%', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 6,
diff --git a/client/src/components/Planner/DayPlanSidebarNoteModal.tsx b/client/src/components/Planner/DayPlanSidebarNoteModal.tsx
index 7a87b2a44..50a78e0f1 100644
--- a/client/src/components/Planner/DayPlanSidebarNoteModal.tsx
+++ b/client/src/components/Planner/DayPlanSidebarNoteModal.tsx
@@ -69,12 +69,12 @@ function NoteDialog({ dayId, ui, setNoteUi, noteInputRef, cancelNote, saveNote,
       position: 'fixed', inset: 0, zIndex: 10000,
       display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16,
       backdropFilter: 'blur(3px)',
-    }} onClick={() => cancelNote(Number(dayId))}>
+    }} role="presentation" onClick={() => cancelNote(Number(dayId))}>
       <div className="bg-surface-card note-modal" style={{
         width: '100%', maxWidth: 720, maxHeight: '90vh', overflowY: 'auto', borderRadius: 16,
         boxShadow: '0 16px 48px rgba(0,0,0,0.22)', padding: '22px 22px 18px',
         display: 'flex', flexDirection: 'column', gap: 16,
-      }} onClick={e => e.stopPropagation()}>
+      }} role="presentation" onClick={e => e.stopPropagation()}>
         <div className="text-content" style={{ fontSize: 'calc(15px * var(--fs-scale-subtitle, 1))', fontWeight: 600 }}>
           {ui.mode === 'add' ? t('dayplan.noteAdd') : t('dayplan.noteEdit')}
         </div>
diff --git a/client/src/components/Planner/DayPlanSidebarTimeConfirmModal.tsx b/client/src/components/Planner/DayPlanSidebarTimeConfirmModal.tsx
index 3c1bdf67c..ff5b0bf87 100644
--- a/client/src/components/Planner/DayPlanSidebarTimeConfirmModal.tsx
+++ b/client/src/components/Planner/DayPlanSidebarTimeConfirmModal.tsx
@@ -22,12 +22,12 @@ interface DayPlanSidebarTimeConfirmModalProps {
 export function DayPlanSidebarTimeConfirmModal({ timeConfirm, setTimeConfirm, confirmTimeRemoval, t }: DayPlanSidebarTimeConfirmModalProps) {
   if (!timeConfirm) return null
   return createPortal(
-    <div className="bg-[rgba(0,0,0,0.3)]" style={{
+    <div role="presentation" className="bg-[rgba(0,0,0,0.3)]" style={{
       position: 'fixed', inset: 0, zIndex: 1000,
       display: 'flex', alignItems: 'center', justifyContent: 'center',
       backdropFilter: 'blur(3px)',
     }} onClick={() => setTimeConfirm(null)}>
-      <div className="bg-surface-card" style={{
+      <div role="presentation" className="bg-surface-card" style={{
         width: 340, borderRadius: 16,
         boxShadow: '0 16px 48px rgba(0,0,0,0.22)', padding: '22px 22px 18px',
         display: 'flex', flexDirection: 'column', gap: 12,
@@ -47,11 +47,11 @@ export function DayPlanSidebarTimeConfirmModal({ timeConfirm, setTimeConfirm, co
           {t('dayplan.confirmRemoveTimeBody', { time: timeConfirm.time })}
         </div>
         <div style={{ display: 'flex', gap: 8, justifyContent: 'flex-end', marginTop: 4 }}>
-          <button onClick={() => setTimeConfirm(null)} className="text-content-muted" style={{
+          <button type="button" onClick={() => setTimeConfirm(null)} className="text-content-muted" style={{
             fontSize: 'calc(12px * var(--fs-scale-body, 1))', background: 'none', border: '1px solid var(--border-primary)',
             borderRadius: 8, padding: '6px 14px', cursor: 'pointer', fontFamily: 'inherit',
           }}>{t('common.cancel')}</button>
-          <button onClick={confirmTimeRemoval} className="bg-[#ef4444] text-white" style={{
+          <button type="button" onClick={confirmTimeRemoval} className="bg-[#ef4444] text-white" style={{
             fontSize: 'calc(12px * var(--fs-scale-body, 1))',
             border: 'none', borderRadius: 8, padding: '6px 16px', cursor: 'pointer', fontWeight: 600, fontFamily: 'inherit',
           }}>{t('common.confirm')}</button>
diff --git a/client/src/components/Planner/DayPlanSidebarToolbar.tsx b/client/src/components/Planner/DayPlanSidebarToolbar.tsx
index e41a20b0d..94a1833ef 100644
--- a/client/src/components/Planner/DayPlanSidebarToolbar.tsx
+++ b/client/src/components/Planner/DayPlanSidebarToolbar.tsx
@@ -94,7 +94,7 @@ export function DayPlanSidebarToolbar({
           const label = allExpanded ? t('dayplan.collapseAll') : t('dayplan.expandAll')
           return (
             <Tooltip label={label} placement="bottom">
-              <button
+              <button type="button"
                 onClick={() => {
                   const next = allExpanded ? new Set<number>() : new Set(days.map(d => d.id))
                   setExpandedDays(next)
@@ -138,7 +138,7 @@ export function DayPlanSidebarToolbar({
         })()}
         {onUndo && (
           <div style={{ position: 'relative', flexShrink: 0 }}>
-            <button
+            <button type="button"
               onClick={onUndo}
               disabled={!canUndo}
               aria-label={t('undo.button')}
@@ -172,7 +172,7 @@ export function DayPlanSidebarToolbar({
         {canEditDays && onReorderDays && onAddDay && days.length > 0 && (
           <div style={{ position: 'relative', flexShrink: 0 }}>
             <Tooltip label={t('dayplan.reorderDays')} placement="bottom">
-              <button
+              <button type="button"
                 onClick={() => setReorderOpen(v => !v)}
                 aria-label={t('dayplan.reorderDays')}
                 aria-pressed={reorderOpen}
diff --git a/client/src/components/Planner/DayPlanSidebarTransportDetailModal.tsx b/client/src/components/Planner/DayPlanSidebarTransportDetailModal.tsx
index 84d98f3ee..231e1e1ac 100644
--- a/client/src/components/Planner/DayPlanSidebarTransportDetailModal.tsx
+++ b/client/src/components/Planner/DayPlanSidebarTransportDetailModal.tsx
@@ -30,8 +30,14 @@ export function DayPlanSidebarTransportDetailModal({
       position: 'fixed', inset: 0, zIndex: 1000,
       display: 'flex', alignItems: 'center', justifyContent: 'center',
       backdropFilter: 'blur(3px)',
-    }} onClick={() => setTransportDetail(null)}>
-      <div className="bg-surface-card" style={{
+    }}
+      role="button" tabIndex={0} aria-label={t('common.cancel')}
+      onClick={() => setTransportDetail(null)}
+      onKeyDown={e => {
+        if (e.target !== e.currentTarget) return
+        if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); setTransportDetail(null) }
+      }}>
+      <div className="bg-surface-card" role="presentation" style={{
         width: 380, maxHeight: '80vh', overflowY: 'auto',
         borderRadius: 16,
         boxShadow: '0 16px 48px rgba(0,0,0,0.22)', padding: '22px 22px 18px',
@@ -109,21 +115,29 @@ export function DayPlanSidebarTransportDetailModal({
                 <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 8 }}>
                   {detailFields.map((f, i) => {
                     const shouldBlur = f.sensitive && useSettingsStore.getState().settings.blur_booking_codes
+                    const valueStyle = {
+                      fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500, wordBreak: 'break-word',
+                      filter: shouldBlur ? 'blur(5px)' : 'none', transition: 'filter 0.2s',
+                      cursor: shouldBlur ? 'pointer' : 'default',
+                      userSelect: shouldBlur ? 'none' : 'auto',
+                    } as const
                     return (
                       <div key={i} className="bg-surface-tertiary" style={{ padding: '8px 10px', borderRadius: 8 }}>
                         <div className="text-content-faint" style={{ fontSize: 'calc(9px * var(--fs-scale-caption, 1))', fontWeight: 600, textTransform: 'uppercase', letterSpacing: '0.03em', marginBottom: 3 }}>{f.label}</div>
-                        <div
-                          onMouseEnter={e => { if (shouldBlur) e.currentTarget.style.filter = 'none' }}
-                          onMouseLeave={e => { if (shouldBlur) e.currentTarget.style.filter = 'blur(5px)' }}
-                          onClick={e => { if (shouldBlur) { const el = e.currentTarget; el.style.filter = el.style.filter === 'none' ? 'blur(5px)' : 'none' } }}
-                          className="text-content"
-                          style={{
-                            fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500, wordBreak: 'break-word',
-                            filter: shouldBlur ? 'blur(5px)' : 'none', transition: 'filter 0.2s',
-                            cursor: shouldBlur ? 'pointer' : 'default',
-                            userSelect: shouldBlur ? 'none' : 'auto',
-                          }}
-                        >{f.value}</div>
+                        {/* A hidden booking code is a reveal toggle, so it has to be a real
+                            button; a plain value stays inert text and out of the tab order. */}
+                        {shouldBlur ? (
+                          <button
+                            type="button"
+                            onMouseEnter={e => { e.currentTarget.style.filter = 'none' }}
+                            onMouseLeave={e => { e.currentTarget.style.filter = 'blur(5px)' }}
+                            onClick={e => { const el = e.currentTarget; el.style.filter = el.style.filter === 'none' ? 'blur(5px)' : 'none' }}
+                            className="text-content"
+                            style={{ ...valueStyle, display: 'block', width: '100%', textAlign: 'left', background: 'none', border: 'none', padding: 0, fontFamily: 'inherit' }}
+                          >{f.value}</button>
+                        ) : (
+                          <div className="text-content" style={valueStyle}>{f.value}</div>
+                        )}
                       </div>
                     )
                   })}
@@ -215,12 +229,13 @@ export function DayPlanSidebarTransportDetailModal({
                     <div className="text-content-faint" style={{ fontSize: 'calc(9px * var(--fs-scale-caption, 1))', fontWeight: 600, textTransform: 'uppercase', letterSpacing: '0.03em', marginBottom: 6 }}>{t('files.title')}</div>
                     <div style={{ display: 'flex', flexDirection: 'column', gap: 4 }}>
                       {resFiles.map(f => (
-                        <div key={f.id}
+                        <button key={f.id}
+                          type="button"
                           onClick={() => { setTransportDetail(null); onNavigateToFiles?.() }}
                           className="bg-surface-tertiary"
                           style={{
                             display: 'flex', alignItems: 'center', gap: 8, padding: '6px 10px',
-                            borderRadius: 8, cursor: 'pointer',
+                            borderRadius: 8, cursor: 'pointer', border: 'none', textAlign: 'left', fontFamily: 'inherit',
                             transition: 'background 0.1s',
                           }}
                           onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
@@ -231,7 +246,7 @@ export function DayPlanSidebarTransportDetailModal({
                             {f.original_name}
                           </span>
                           <ExternalLink size={11} className="text-content-faint" style={{ flexShrink: 0 }} />
-                        </div>
+                        </button>
                       ))}
                     </div>
                   </div>
@@ -241,7 +256,7 @@ export function DayPlanSidebarTransportDetailModal({
               {/* Aktionen */}
               <div style={{ display: 'flex', justifyContent: 'flex-end', gap: 8 }}>
                 {onEdit && (
-                  <button onClick={() => onEdit(res)} className="bg-surface-tertiary text-content" style={{
+                  <button type="button" onClick={() => onEdit(res)} className="bg-surface-tertiary text-content" style={{
                     fontSize: 'calc(12px * var(--fs-scale-body, 1))',
                     border: 'none', borderRadius: 8, padding: '6px 14px', cursor: 'pointer', fontWeight: 600, fontFamily: 'inherit',
                     display: 'inline-flex', alignItems: 'center', gap: 5,
@@ -249,7 +264,7 @@ export function DayPlanSidebarTransportDetailModal({
                     <Pencil size={12} /> {t('common.edit')}
                   </button>
                 )}
-                <button onClick={() => setTransportDetail(null)} className="bg-accent text-accent-text" style={{
+                <button type="button" onClick={() => setTransportDetail(null)} className="bg-accent text-accent-text" style={{
                   fontSize: 'calc(12px * var(--fs-scale-body, 1))',
                   border: 'none', borderRadius: 8, padding: '6px 16px', cursor: 'pointer', fontWeight: 600, fontFamily: 'inherit',
                 }}>
diff --git a/client/src/components/Planner/DayReorderPopup.tsx b/client/src/components/Planner/DayReorderPopup.tsx
index d3a45b297..aadd121b6 100644
--- a/client/src/components/Planner/DayReorderPopup.tsx
+++ b/client/src/components/Planner/DayReorderPopup.tsx
@@ -56,7 +56,7 @@ export function DayReorderPopup({ isOpen, days, t, locale, onReorder, onAddDay,
       size="md"
       footer={
         <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 12 }}>
-          <button
+          <button type="button"
             onClick={onClose}
             style={{
               padding: '8px 16px', borderRadius: 8, fontSize: 13, fontWeight: 500,
@@ -66,7 +66,7 @@ export function DayReorderPopup({ isOpen, days, t, locale, onReorder, onAddDay,
           >
             {t('common.close')}
           </button>
-          <button
+          <button type="button"
             onClick={onAddDay}
             className="bg-accent text-accent-text"
             style={{
@@ -123,6 +123,7 @@ export function DayReorderPopup({ isOpen, days, t, locale, onReorder, onAddDay,
               {label(day, index)}
             </span>
             <button
+              type="button"
               onClick={() => move(index, index - 1)}
               disabled={index === 0}
               aria-label={t('dayplan.moveUp')}
@@ -131,6 +132,7 @@ export function DayReorderPopup({ isOpen, days, t, locale, onReorder, onAddDay,
               <ArrowUp size={14} strokeWidth={2} />
             </button>
             <button
+              type="button"
               onClick={() => move(index, index + 1)}
               disabled={index === ordered.length - 1}
               aria-label={t('dayplan.moveDown')}
diff --git a/client/src/components/Planner/FileImportModal.tsx b/client/src/components/Planner/FileImportModal.tsx
index a823468af..f65133bf2 100644
--- a/client/src/components/Planner/FileImportModal.tsx
+++ b/client/src/components/Planner/FileImportModal.tsx
@@ -217,11 +217,13 @@ export default function FileImportModal({ isOpen, onClose, tripId, pushUndo, ini
 
   return createPortal(
     <div
+      role="presentation"
       onClick={handleClose}
       className="bg-[rgba(0,0,0,0.4)]"
       style={{ position: 'fixed', inset: 0, zIndex: 99999, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
     >
       <div
+        role="presentation"
         onClick={e => e.stopPropagation()}
         className="bg-surface-card"
         style={{ borderRadius: 16, width: '100%', maxWidth: 520, padding: 24, boxShadow: '0 8px 32px rgba(0,0,0,0.2)', fontFamily: "var(--font-system)" }}
@@ -242,7 +244,8 @@ export default function FileImportModal({ isOpen, onClose, tripId, pushUndo, ini
           onChange={handleInputChange}
         />
 
-        <div
+        <button
+          type="button"
           onClick={() => fileInputRef.current?.click()}
           onDragOver={handleDragOver}
           onDragEnter={handleDragOver}
@@ -277,7 +280,7 @@ export default function FileImportModal({ isOpen, onClose, tripId, pushUndo, ini
           ) : (
             <span style={{ color: 'var(--text-faint)', textAlign: 'center', pointerEvents: 'none' }}>{t('places.importFileDropHere')}</span>
           )}
-        </div>
+        </button>
 
         {isGpx && (
           <div style={{ marginBottom: 12 }}>
@@ -285,7 +288,7 @@ export default function FileImportModal({ isOpen, onClose, tripId, pushUndo, ini
               {t('places.gpxImportTypes')}
             </div>
             {(['waypoints', 'routes', 'tracks'] as const).map(key => (
-              <label key={key} onClick={() => setGpxOpts(prev => ({ ...prev, [key]: !prev[key] }))} style={{ display: 'flex', alignItems: 'center', gap: 8, padding: '4px 0', cursor: 'pointer' }}>
+              <button type="button" key={key} role="checkbox" aria-checked={gpxOpts[key]} onClick={() => setGpxOpts(prev => ({ ...prev, [key]: !prev[key] }))} style={{ display: 'flex', alignItems: 'center', gap: 8, padding: '4px 0', cursor: 'pointer', width: '100%', border: 'none', background: 'transparent', fontFamily: 'inherit', textAlign: 'left' }}>
                 <div className={gpxOpts[key] ? 'bg-accent' : 'bg-transparent'} style={{
                   width: 16, height: 16, borderRadius: 4, flexShrink: 0,
                   border: gpxOpts[key] ? 'none' : '1.5px solid var(--border-primary)',
@@ -296,7 +299,7 @@ export default function FileImportModal({ isOpen, onClose, tripId, pushUndo, ini
                 <span style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-primary)', userSelect: 'none' }}>
                   {t(key === 'waypoints' ? 'places.gpxImportWaypoints' : key === 'routes' ? 'places.gpxImportRoutes' : 'places.gpxImportTracks')}
                 </span>
-              </label>
+              </button>
             ))}
             {gpxNoneSelected && (
               <div className="text-[#b45309]" style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', marginTop: 4 }}>{t('places.gpxImportNoneSelected')}</div>
@@ -310,7 +313,7 @@ export default function FileImportModal({ isOpen, onClose, tripId, pushUndo, ini
               {t('places.kmlImportTypes')}
             </div>
             {(['points', 'paths'] as const).map(key => (
-              <label key={key} onClick={() => setKmlOpts(prev => ({ ...prev, [key]: !prev[key] }))} style={{ display: 'flex', alignItems: 'center', gap: 8, padding: '4px 0', cursor: 'pointer' }}>
+              <button type="button" key={key} role="checkbox" aria-checked={kmlOpts[key]} onClick={() => setKmlOpts(prev => ({ ...prev, [key]: !prev[key] }))} style={{ display: 'flex', alignItems: 'center', gap: 8, padding: '4px 0', cursor: 'pointer', width: '100%', border: 'none', background: 'transparent', fontFamily: 'inherit', textAlign: 'left' }}>
                 <div className={kmlOpts[key] ? 'bg-accent' : 'bg-transparent'} style={{
                   width: 16, height: 16, borderRadius: 4, flexShrink: 0,
                   border: kmlOpts[key] ? 'none' : '1.5px solid var(--border-primary)',
@@ -321,7 +324,7 @@ export default function FileImportModal({ isOpen, onClose, tripId, pushUndo, ini
                 <span style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-primary)', userSelect: 'none' }}>
                   {t(key === 'points' ? 'places.kmlImportPoints' : 'places.kmlImportPaths')}
                 </span>
-              </label>
+              </button>
             ))}
             {kmlNoneSelected && (
               <div className="text-[#b45309]" style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', marginTop: 4 }}>{t('places.kmlImportNoneSelected')}</div>
@@ -360,7 +363,7 @@ export default function FileImportModal({ isOpen, onClose, tripId, pushUndo, ini
         )}
 
         <div style={{ display: 'flex', gap: 8, justifyContent: 'flex-end' }}>
-          <button
+          <button type="button"
             onClick={handleClose}
             style={{
               padding: '8px 16px', borderRadius: 10, border: '1px solid var(--border-primary)',
@@ -370,7 +373,7 @@ export default function FileImportModal({ isOpen, onClose, tripId, pushUndo, ini
           >
             {t('common.cancel')}
           </button>
-          <button
+          <button type="button"
             onClick={handleImport}
             disabled={!canImport}
             className={canImport ? 'bg-accent text-accent-text' : 'bg-surface-tertiary text-content-faint'}
diff --git a/client/src/components/Planner/IcsSubscribeModal.tsx b/client/src/components/Planner/IcsSubscribeModal.tsx
index dc66002f8..a5551408e 100644
--- a/client/src/components/Planner/IcsSubscribeModal.tsx
+++ b/client/src/components/Planner/IcsSubscribeModal.tsx
@@ -63,6 +63,7 @@ export function IcsSubscribeModal({ endpoint, title, description, onClose }: Ics
 
   return createPortal(
     <div
+      role="presentation"
       style={{
         position: 'fixed', inset: 0, zIndex: 9999,
         background: 'rgba(0,0,0,0.5)',
@@ -89,7 +90,7 @@ export function IcsSubscribeModal({ endpoint, title, description, onClose }: Ics
             <Calendar size={16} strokeWidth={2} style={{ color: 'var(--accent, #6366f1)' }} />
             <span style={{ fontWeight: 600, fontSize: 14 }}>{title}</span>
           </div>
-          <button
+          <button type="button"
             onClick={onClose}
             style={{
               background: 'none', border: 'none', cursor: 'pointer', padding: 4,
@@ -110,7 +111,7 @@ export function IcsSubscribeModal({ endpoint, title, description, onClose }: Ics
           </div>
         ) : !feedUrl ? (
           <>
-            <button
+            <button type="button"
               onClick={() => mutate('POST')}
               disabled={busy}
               style={{
@@ -133,7 +134,7 @@ export function IcsSubscribeModal({ endpoint, title, description, onClose }: Ics
             <SubscribeLinks httpsUrl={httpsUrl} webcalUrl={webcalUrl} />
 
             <div style={{ marginTop: 16, paddingTop: 12, borderTop: '1px solid var(--border-faint)', display: 'flex', gap: 8 }}>
-              <button
+              <button type="button"
                 onClick={() => mutate('PUT')}
                 disabled={busy}
                 style={{
@@ -148,7 +149,7 @@ export function IcsSubscribeModal({ endpoint, title, description, onClose }: Ics
                 <RefreshCw size={11} strokeWidth={2} style={{ animation: busy ? 'spin 0.8s linear infinite' : 'none' }} />
                 Regenerate
               </button>
-              <button
+              <button type="button"
                 onClick={() => mutate('DELETE')}
                 disabled={busy}
                 style={{
diff --git a/client/src/components/Planner/PlaceFormModal.test.tsx b/client/src/components/Planner/PlaceFormModal.test.tsx
index 063614aca..3d5d45265 100644
--- a/client/src/components/Planner/PlaceFormModal.test.tsx
+++ b/client/src/components/Planner/PlaceFormModal.test.tsx
@@ -183,7 +183,7 @@ describe('PlaceFormModal', () => {
     const searchBtn = within(searchRow).getByRole('button');
     await user.click(searchBtn);
 
-    await screen.findByText('Eiffel Tower');
+    expect(await screen.findByText('Eiffel Tower')).toBeInTheDocument();
   });
 
   it('FE-PLANNER-PLACEFORM-019: pressing Enter in search input triggers search', async () => {
@@ -201,7 +201,7 @@ describe('PlaceFormModal', () => {
     await user.type(searchInput, 'Eiffel Tower');
     await user.keyboard('{Enter}');
 
-    await screen.findByText('Eiffel Tower');
+    expect(await screen.findByText('Eiffel Tower')).toBeInTheDocument();
   });
 
   it('FE-PLANNER-PLACEFORM-020: clicking a maps result fills the form', async () => {
diff --git a/client/src/components/Planner/PlaceFormModal.tsx b/client/src/components/Planner/PlaceFormModal.tsx
index 50f615f58..9d1889d91 100644
--- a/client/src/components/Planner/PlaceFormModal.tsx
+++ b/client/src/components/Planner/PlaceFormModal.tsx
@@ -66,8 +66,8 @@ function findDuplicatePlace(
 ): { name?: string | null } | null {
   const name = (form.name || '').trim().toLowerCase()
   const gid = (form.google_place_id || '').trim()
-  const lat = form.lat ? parseFloat(form.lat) : null
-  const lng = form.lng ? parseFloat(form.lng) : null
+  const lat = form.lat ? Number.parseFloat(form.lat) : null
+  const lng = form.lng ? Number.parseFloat(form.lng) : null
   for (const p of places || []) {
     if (gid && p.google_place_id && p.google_place_id === gid) return p
     if (name && p.name && p.name.trim().toLowerCase() === name) return p
@@ -473,8 +473,8 @@ function usePlaceFormModal(props: PlaceFormModalProps) {
     try {
       const saved = await onSave({
         ...form,
-        lat: form.lat ? parseFloat(form.lat) : null,
-        lng: form.lng ? parseFloat(form.lng) : null,
+        lat: form.lat ? Number.parseFloat(form.lat) : null,
+        lng: form.lng ? Number.parseFloat(form.lng) : null,
         category_id: form.category_id || null,
         _pendingFiles: pendingFiles.length > 0 ? pendingFiles : undefined,
       })
@@ -838,7 +838,7 @@ export default function PlaceFormModal(props: PlaceFormModalProps) {
               onValueChange={v => handleChange('lat', v)}
               onPaste={e => {
                 const text = e.clipboardData.getData('text').trim()
-                const match = text.match(/^(-?\d+\.?\d*)\s*[,;\s]\s*(-?\d+\.?\d*)$/)
+                const match = text.match(/^(-?\d+(?:\.\d*)?)(?:\s*[,;]\s*|\s+)(-?\d+(?:\.\d*)?)$/)
                 if (match) {
                   e.preventDefault()
                   handleChange('lat', match[1])
@@ -913,7 +913,7 @@ export default function PlaceFormModal(props: PlaceFormModalProps) {
             context (itinerary edit, or a single-assignment pool edit). Hidden when
             creating, and for unassigned / multi-day pool edits where a single time
             is ambiguous and wouldn't persist. */}
-        {place && assignmentId && (
+        {!!(place && assignmentId) && (
           <TimeSection
             form={form}
             handleChange={handleChange}
diff --git a/client/src/components/Planner/PlaceInspector.test.tsx b/client/src/components/Planner/PlaceInspector.test.tsx
index 75fb0a8eb..da54804c1 100644
--- a/client/src/components/Planner/PlaceInspector.test.tsx
+++ b/client/src/components/Planner/PlaceInspector.test.tsx
@@ -335,7 +335,7 @@ describe('PlaceInspector', () => {
     } as any);
     const p = buildPlace({ id: 201, google_place_id: 'ChIJ002' });
     render(<PlaceInspector {...defaultProps} place={p} />);
-    await screen.findByText(/4\.5/);
+    expect(await screen.findByText(/4\.5/)).toBeInTheDocument();
   });
 
   it('FE-PLANNER-INSPECTOR-025: opening hours shown when available', async () => {
@@ -361,7 +361,7 @@ describe('PlaceInspector', () => {
     } as any);
     const p = buildPlace({ id: 203, google_place_id: 'ChIJ004' });
     render(<PlaceInspector {...defaultProps} place={p} />);
-    await screen.findByText(/open/i);
+    expect(await screen.findByText(/open/i)).toBeInTheDocument();
   });
 
   it('FE-PLANNER-INSPECTOR-027: mapsApi.details NOT called when place has no google_place_id or osm_id', async () => {
@@ -394,7 +394,7 @@ describe('PlaceInspector', () => {
     // Click the expand button (file count label button)
     if (filesBtn) {
       await user.click(filesBtn);
-      await screen.findByText('photo.jpg');
+      expect(await screen.findByText('photo.jpg')).toBeInTheDocument();
     } else {
       // Try clicking the last non-footer button
       const toggleButtons = allButtons.filter(btn => !btn.closest('footer'));
@@ -1291,7 +1291,7 @@ describe('PlaceInspector', () => {
 
   it('FE-PLANNER-INSPECTOR-093: participant chips and the add menu reset their hover styling', () => {
     render(<PlaceInspector {...defaultProps} {...participantProps([{ user_id: 1 }, { user_id: 2 }])} />);
-    const chip = screen.getByText('ada').closest('div') as HTMLElement;
+    const chip = screen.getByText('ada').closest('button') as HTMLElement;
     fireEvent.mouseEnter(chip);
     expect(chip.className).toContain('text-[#ef4444]');
     fireEvent.mouseLeave(chip);
diff --git a/client/src/components/Planner/PlaceInspector.tsx b/client/src/components/Planner/PlaceInspector.tsx
index 663e5a9db..b3768fafb 100644
--- a/client/src/components/Planner/PlaceInspector.tsx
+++ b/client/src/components/Planner/PlaceInspector.tsx
@@ -484,7 +484,7 @@ export default function PlaceInspector({
             <StatusBadge status={collectionStatus} onChange={onSetStatus} t={t} />
           )}
           {/* Trip mode — day assignment */}
-          {mode === 'trip' && selectedDayId && (
+          {mode === 'trip' && !!selectedDayId && (
             assignmentInDay ? (
               <ActionButton onClick={() => onRemoveAssignment?.(selectedDayId, assignmentInDay.id)} variant="ghost" icon={<Minus size={13} />}
                 label={<span className="hidden sm:inline">{t('inspector.removeFromDay')}</span>} />
@@ -580,7 +580,7 @@ export function ActionButton({ onClick, variant, icon, label, ref }: ActionButto
   }
   const s = base[variant] || base.ghost
   return (
-    <button
+    <button type="button"
       ref={ref}
       onClick={onClick}
       style={{
@@ -649,7 +649,7 @@ function ParticipantsBox({ tripMembers, participantIds, allJoined, onSetParticip
           const isHovered = hoveredId === member.id
           const canRemove = activeMembers.length > 1
           return (
-            <div key={member.id}
+            <button type="button" key={member.id} disabled={!canRemove}
               onMouseEnter={() => setHoveredId(member.id)}
               onMouseLeave={() => setHoveredId(null)}
               onClick={() => { if (canRemove) handleRemove(member.id) }}
@@ -661,22 +661,22 @@ function ParticipantsBox({ tripMembers, participantIds, allJoined, onSetParticip
                 cursor: canRemove ? 'pointer' : 'default',
                 transition: 'all 0.15s',
               }}>
-              <div className="bg-surface-tertiary text-content-muted" style={{
+              <span className="bg-surface-tertiary text-content-muted" style={{
                 width: 16, height: 16, borderRadius: '50%',
                 display: 'flex', alignItems: 'center', justifyContent: 'center', fontSize: 'calc(7px * var(--fs-scale-caption, 1))', fontWeight: 700,
                 overflow: 'hidden', flexShrink: 0,
               }}>
-                {(member.avatar_url || member.avatar) ? <img src={member.avatar_url || avatarSrc(member.avatar)!} style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : member.username?.[0]?.toUpperCase()}
-              </div>
+                {(member.avatar_url || member.avatar) ? <img src={member.avatar_url || avatarSrc(member.avatar)!} alt="" style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : member.username?.[0]?.toUpperCase()}
+              </span>
               <span style={{ textDecoration: isHovered && canRemove ? 'line-through' : 'none' }}>{member.username}</span>
-            </div>
+            </button>
           )
         })}
 
         {/* Add button */}
         {availableToAdd.length > 0 && (
           <div style={{ position: 'relative' }}>
-            <button onClick={() => setShowAdd(!showAdd)} className="text-content-faint" style={{
+            <button type="button" onClick={() => setShowAdd(!showAdd)} className="text-content-faint" style={{
               width: 22, height: 22, borderRadius: '50%', border: '1.5px dashed var(--border-primary)',
               background: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center', justifyContent: 'center',
               fontSize: 'calc(12px * var(--fs-scale-body, 1))', transition: 'all 0.12s',
@@ -692,7 +692,7 @@ function ParticipantsBox({ tripMembers, participantIds, allJoined, onSetParticip
                 boxShadow: '0 4px 16px rgba(0,0,0,0.12)', padding: 4, minWidth: 140,
               }}>
                 {availableToAdd.map(member => (
-                  <button key={member.id} onClick={() => handleAdd(member.id)} className="text-content" style={{
+                  <button type="button" key={member.id} onClick={() => handleAdd(member.id)} className="text-content" style={{
                     display: 'flex', alignItems: 'center', gap: 6, width: '100%', padding: '5px 8px',
                     borderRadius: 6, border: 'none', background: 'none', cursor: 'pointer',
                     fontFamily: 'inherit', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', textAlign: 'left',
@@ -706,7 +706,7 @@ function ParticipantsBox({ tripMembers, participantIds, allJoined, onSetParticip
                       display: 'flex', alignItems: 'center', justifyContent: 'center', fontSize: 'calc(8px * var(--fs-scale-caption, 1))', fontWeight: 700,
                       overflow: 'hidden', flexShrink: 0,
                     }}>
-                      {(member.avatar_url || member.avatar) ? <img src={member.avatar_url || avatarSrc(member.avatar)!} style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : member.username?.[0]?.toUpperCase()}
+                      {(member.avatar_url || member.avatar) ? <img src={member.avatar_url || avatarSrc(member.avatar)!} alt="" style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : member.username?.[0]?.toUpperCase()}
                     </div>
                     <span style={{ flex: 1, minWidth: 0, overflow: 'hidden', textOverflow: 'ellipsis' }}>{member.username}</span>
                     {member.is_guest && <GuestBadge size="xs" />}
@@ -807,7 +807,7 @@ function PlaceInspectorHeader({ openNow, place, category, t, editingName, nameIn
               </div>
             )}
           </div>
-          <button
+          <button type="button"
             onClick={onClose}
             className="bg-surface-hover"
             style={{ width: 28, height: 28, borderRadius: '50%', border: 'none', display: 'flex', alignItems: 'center', justifyContent: 'center', cursor: 'pointer', flexShrink: 0, alignSelf: 'flex-start', transition: 'background 0.15s' }}
@@ -940,7 +940,7 @@ function TrackColorRow({ place, trackColor, onUpdatePlace, t }: any) {
   const [open, setOpen] = useState(false)
   return (
     <div className="bg-surface-hover" style={{ borderRadius: 10, padding: '10px 12px', display: 'flex', flexDirection: 'column', gap: 8 }}>
-      <button
+      <button type="button"
         onClick={() => setOpen(o => !o)}
         aria-expanded={open}
         style={{
@@ -980,7 +980,7 @@ function PlaceExtras({ openingHours, weekdayIndex, hoursExpanded, setHoursExpand
           <div className={`grid grid-cols-1 ${openingHours?.length > 0 ? 'sm:grid-cols-2' : ''} gap-2`}>
           {openingHours && openingHours.length > 0 && (
             <div className="bg-surface-hover" style={{ borderRadius: 10, overflow: 'hidden' }}>
-              <button
+              <button type="button"
                 onClick={() => setHoursExpanded(h => !h)}
                 style={{
                   width: '100%', display: 'flex', alignItems: 'center', justifyContent: 'space-between',
@@ -1111,7 +1111,7 @@ function PlaceExtras({ openingHours, weekdayIndex, hoursExpanded, setHoursExpand
           {(placeFiles.length > 0 || onFileUpload) && (
             <div className="bg-surface-hover" style={{ borderRadius: 10, overflow: 'hidden' }}>
               <div style={{ display: 'flex', alignItems: 'center', padding: '8px 12px', gap: 6 }}>
-                <button
+                <button type="button"
                   onClick={() => setFilesExpanded(f => !f)}
                   style={{ flex: 1, display: 'flex', alignItems: 'center', gap: 6, background: 'none', border: 'none', cursor: 'pointer', padding: 0, fontFamily: 'inherit', textAlign: 'left' }}
                 >
@@ -1135,7 +1135,7 @@ function PlaceExtras({ openingHours, weekdayIndex, hoursExpanded, setHoursExpand
               {filesExpanded && placeFiles.length > 0 && (
                 <div style={{ padding: '0 12px 10px', display: 'flex', flexDirection: 'column', gap: 4 }}>
                   {placeFiles.map(f => (
-                    <button key={f.id} onClick={() => openFile(f.url).catch(() => {})} style={{ display: 'flex', alignItems: 'center', gap: 8, textDecoration: 'none', cursor: 'pointer', background: 'none', border: 'none', width: '100%', textAlign: 'left' }}>
+                    <button type="button" key={f.id} onClick={() => openFile(f.url).catch(() => {})} style={{ display: 'flex', alignItems: 'center', gap: 8, textDecoration: 'none', cursor: 'pointer', background: 'none', border: 'none', width: '100%', textAlign: 'left' }}>
                       {(f.mime_type || '').startsWith('image/') ? <FileImage size={12} color="#6b7280" /> : <File size={12} color="#6b7280" />}
                       <span className="text-content-secondary" style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', flex: 1, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{f.original_name}</span>
                       {f.file_size && <span className="text-content-faint" style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', flexShrink: 0 }}>{formatFileSize(f.file_size)}</span>}
diff --git a/client/src/components/Planner/PlacesBulkCategoryModal.tsx b/client/src/components/Planner/PlacesBulkCategoryModal.tsx
index 56165234e..facf531a2 100644
--- a/client/src/components/Planner/PlacesBulkCategoryModal.tsx
+++ b/client/src/components/Planner/PlacesBulkCategoryModal.tsx
@@ -28,6 +28,7 @@ export function PlacesBulkCategoryModal({ count, categories, onPick, onClose }:
   const { t } = useTranslation()
   return createPortal(
     <div
+      role="presentation"
       onClick={e => { if (e.target === e.currentTarget) onClose() }}
       style={{ position: 'fixed', inset: 0, zIndex: 9999, background: 'rgba(0,0,0,0.5)', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
     >
@@ -37,7 +38,7 @@ export function PlacesBulkCategoryModal({ count, categories, onPick, onClose }:
       }}>
         <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', marginBottom: 4 }}>
           <span style={{ fontWeight: 600, fontSize: 14 }}>{t('places.changeCategory')}</span>
-          <button onClick={onClose} aria-label={t('common.close')} className="text-content-muted" style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 4, display: 'flex' }}>
+          <button type="button" onClick={onClose} aria-label={t('common.close')} className="text-content-muted" style={{ background: 'none', border: 'none', cursor: 'pointer', padding: 4, display: 'flex' }}>
             <X size={15} strokeWidth={2} />
           </button>
         </div>
@@ -47,13 +48,13 @@ export function PlacesBulkCategoryModal({ count, categories, onPick, onClose }:
           {categories.map(c => {
             const CatIcon = getCategoryIcon(c.icon)
             return (
-              <button key={c.id} onClick={() => onPick(c.id)} className="text-content bg-transparent" style={rowStyle} onMouseEnter={hoverOn} onMouseLeave={hoverOff}>
+              <button type="button" key={c.id} onClick={() => onPick(c.id)} className="text-content bg-transparent" style={rowStyle} onMouseEnter={hoverOn} onMouseLeave={hoverOff}>
                 <CatIcon size={14} strokeWidth={2} color={c.color || 'var(--text-muted)'} />
                 <span style={{ flex: 1 }}>{c.name}</span>
               </button>
             )
           })}
-          <button onClick={() => onPick(null)} className="text-content-muted bg-transparent" style={{ ...rowStyle, borderTop: categories.length > 0 ? '1px solid var(--border-faint)' : 'none', marginTop: categories.length > 0 ? 2 : 0 }} onMouseEnter={hoverOn} onMouseLeave={hoverOff}>
+          <button type="button" onClick={() => onPick(null)} className="text-content-muted bg-transparent" style={{ ...rowStyle, borderTop: categories.length > 0 ? '1px solid var(--border-faint)' : 'none', marginTop: categories.length > 0 ? 2 : 0 }} onMouseEnter={hoverOn} onMouseLeave={hoverOff}>
             <MapPin size={14} strokeWidth={2} color="var(--text-faint)" />
             <span style={{ flex: 1 }}>{t('places.noCategory')}</span>
           </button>
diff --git a/client/src/components/Planner/PlacesSidebarHeader.tsx b/client/src/components/Planner/PlacesSidebarHeader.tsx
index c8a52e48d..a760588dc 100644
--- a/client/src/components/Planner/PlacesSidebarHeader.tsx
+++ b/client/src/components/Planner/PlacesSidebarHeader.tsx
@@ -30,7 +30,7 @@ export function PlacesHeader(S: SidebarState) {
   } = S
   return (
     <div className="border-b border-edge-faint" style={{ padding: '14px 16px 10px', flexShrink: 0 }}>
-      {canEditPlaces && <button
+      {canEditPlaces && <button type="button"
         onClick={onAddPlace}
         className="bg-accent text-accent-text"
         style={{
@@ -44,7 +44,7 @@ export function PlacesHeader(S: SidebarState) {
       </button>}
       {canEditPlaces && <>
       <div style={{ display: 'flex', gap: 6, marginBottom: 10 }}>
-        <button
+        <button type="button"
           onClick={() => setFileImportOpen(true)}
           className="border border-dashed border-edge text-content-faint"
           style={{
@@ -56,7 +56,7 @@ export function PlacesHeader(S: SidebarState) {
         >
           <FileDown size={11} strokeWidth={2} /> {t('places.importFile')}
         </button>
-        <button
+        <button type="button"
           onClick={() => setListImportOpen(true)}
           className="border border-dashed border-edge text-content-faint"
           style={{
@@ -101,7 +101,7 @@ export function PlacesHeader(S: SidebarState) {
             {tabs.map(f => {
               const active = filter === f.id
               return (
-                <button
+                <button type="button"
                   key={f.id}
                   onClick={() => { setFilter(f.id); setSelectedIds(new Set()) }}
                   className={active ? 'bg-accent text-accent-text' : 'bg-surface-card text-content'}
@@ -145,7 +145,7 @@ export function PlacesHeader(S: SidebarState) {
           }}
         />
         {search && (
-          <button onClick={() => setSearch('')} style={{ position: 'absolute', right: 8, top: '50%', transform: 'translateY(-50%)', background: 'none', border: 'none', cursor: 'pointer', padding: 0, display: 'flex' }}>
+          <button type="button" onClick={() => setSearch('')} style={{ position: 'absolute', right: 8, top: '50%', transform: 'translateY(-50%)', background: 'none', border: 'none', cursor: 'pointer', padding: 0, display: 'flex' }}>
             <X size={12} strokeWidth={2} color="var(--text-faint)" />
           </button>
         )}
@@ -162,7 +162,7 @@ export function PlacesHeader(S: SidebarState) {
             : `${categoryFilters.size} ${t('places.categoriesSelected')}`
         return (
           <div style={{ marginTop: 6, position: 'relative', display: 'flex', gap: 6, alignItems: 'stretch' }}>
-            {categories.length > 0 && <button onClick={() => setCatDropOpen(v => !v)} className="bg-surface-card text-content" style={{
+            {categories.length > 0 && <button type="button" onClick={() => setCatDropOpen(v => !v)} className="bg-surface-card text-content" style={{
               flex: 1, minWidth: 0, display: 'flex', alignItems: 'center', justifyContent: 'space-between',
               padding: '6px 10px', borderRadius: 8, border: '1px solid var(--border-primary)',
               fontSize: 'calc(12px * var(--fs-scale-body, 1))',
@@ -173,7 +173,7 @@ export function PlacesHeader(S: SidebarState) {
             </button>}
             {/* Minimum-stars filter (#1435), same floors as the collections bar. */}
             <Tooltip label={t('places.filterByRating')} placement="bottom">
-              <button
+              <button type="button"
                 onClick={() => { setStarDropOpen(v => !v); setCatDropOpen(false) }}
                 aria-label={t('places.filterByRating')}
                 aria-expanded={starDropOpen}
@@ -203,7 +203,7 @@ export function PlacesHeader(S: SidebarState) {
                 {(['all', 5, 4, 3, 2, 1] as const).map(opt => {
                   const active = ratingFilter === opt
                   return (
-                    <button
+                    <button type="button"
                       key={String(opt)}
                       onClick={() => { setRatingFilter(opt as number | 'all'); setStarDropOpen(false) }}
                       className={`text-content ${active ? 'bg-surface-hover' : 'bg-transparent'}`}
@@ -230,7 +230,7 @@ export function PlacesHeader(S: SidebarState) {
             )}
             {canEditPlaces && (
               <Tooltip label={t('common.select')} placement="bottom">
-              <button
+              <button type="button"
                 onClick={() => { setSelectMode(v => !v); setSelectedIds(new Set()) }}
                 aria-label={t('common.select')}
                 aria-pressed={selectMode}
@@ -273,7 +273,7 @@ export function PlacesHeader(S: SidebarState) {
                   const active = categoryFilters.has(String(c.id))
                   const CatIcon = getCategoryIcon(c.icon)
                   return (
-                    <button key={c.id} onClick={() => toggleCategoryFilter(String(c.id))} className={`text-content ${active ? 'bg-surface-hover' : 'bg-transparent'}`} style={{
+                    <button type="button" key={c.id} onClick={() => toggleCategoryFilter(String(c.id))} className={`text-content ${active ? 'bg-surface-hover' : 'bg-transparent'}`} style={{
                       display: 'flex', alignItems: 'center', gap: 8, width: '100%',
                       padding: '6px 10px', borderRadius: 6, border: 'none', cursor: 'pointer',
                       fontFamily: 'inherit', fontSize: 'calc(12px * var(--fs-scale-body, 1))',
@@ -295,7 +295,7 @@ export function PlacesHeader(S: SidebarState) {
                 {places.some(p => p.category_id == null) && (() => {
                   const active = categoryFilters.has('uncategorized')
                   return (
-                    <button onClick={() => toggleCategoryFilter('uncategorized')} className={`text-content-muted ${active ? 'bg-surface-hover' : 'bg-transparent'}`} style={{
+                    <button type="button" onClick={() => toggleCategoryFilter('uncategorized')} className={`text-content-muted ${active ? 'bg-surface-hover' : 'bg-transparent'}`} style={{
                       display: 'flex', alignItems: 'center', gap: 8, width: '100%',
                       padding: '6px 10px', borderRadius: 6, border: 'none', cursor: 'pointer',
                       fontFamily: 'inherit', fontSize: 'calc(12px * var(--fs-scale-body, 1))',
@@ -314,7 +314,7 @@ export function PlacesHeader(S: SidebarState) {
                   )
                 })()}
                 {categoryFilters.size > 0 && (
-                  <button onClick={() => setCategoryFilters(new Set())} className="bg-transparent text-content-faint" style={{
+                  <button type="button" onClick={() => setCategoryFilters(new Set())} className="bg-transparent text-content-faint" style={{
                     display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 4,
                     width: '100%', padding: '6px 10px', borderRadius: 6, border: 'none', cursor: 'pointer',
                     fontFamily: 'inherit', fontSize: 'calc(11px * var(--fs-scale-caption, 1))',
diff --git a/client/src/components/Planner/PlacesSidebarList.tsx b/client/src/components/Planner/PlacesSidebarList.tsx
index 9b2d75546..b5acc4d07 100644
--- a/client/src/components/Planner/PlacesSidebarList.tsx
+++ b/client/src/components/Planner/PlacesSidebarList.tsx
@@ -18,7 +18,7 @@ export function PlacesList(S: SidebarState) {
           <span className="text-content-faint" style={{ fontSize: 'calc(13px * var(--fs-scale-body, 1))' }}>
             {filter === 'unplanned' ? t('places.allPlanned') : t('places.noneFound')}
           </span>
-          {canEditPlaces && <button onClick={onAddPlace} className="text-content" style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', background: 'none', border: 'none', cursor: 'pointer', textDecoration: 'underline', fontFamily: 'inherit' }}>
+          {canEditPlaces && <button type="button" onClick={onAddPlace} className="text-content" style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', background: 'none', border: 'none', cursor: 'pointer', textDecoration: 'underline', fontFamily: 'inherit' }}>
             {t('places.addPlace')}
           </button>}
         </div>
diff --git a/client/src/components/Planner/PlacesSidebarListImportModal.tsx b/client/src/components/Planner/PlacesSidebarListImportModal.tsx
index dc0c613dd..9582ae162 100644
--- a/client/src/components/Planner/PlacesSidebarListImportModal.tsx
+++ b/client/src/components/Planner/PlacesSidebarListImportModal.tsx
@@ -10,11 +10,13 @@ export function ListImportModal(S: SidebarState) {
   } = S
   return createPortal(
     <div
+      role="presentation"
       onClick={() => { setListImportOpen(false); setListImportUrl('') }}
       className="bg-[rgba(0,0,0,0.4)]"
       style={{ position: 'fixed', inset: 0, zIndex: 99999, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
     >
       <div
+        role="presentation"
         onClick={e => e.stopPropagation()}
         className="bg-surface-card"
         style={{ borderRadius: 16, width: '100%', maxWidth: 440, padding: 24, boxShadow: '0 8px 32px rgba(0,0,0,0.2)' }}
@@ -25,7 +27,7 @@ export function ListImportModal(S: SidebarState) {
         {hasMultipleListImportProviders && (
           <div style={{ display: 'flex', gap: 6, marginBottom: 10 }}>
             {availableListImportProviders.map(provider => (
-              <button
+              <button type="button"
                 key={provider}
                 onClick={() => setListImportProvider(provider)}
                 className={listImportProvider === provider ? 'bg-accent text-accent-text' : 'bg-surface-tertiary text-content-muted'}
@@ -67,7 +69,7 @@ export function ListImportModal(S: SidebarState) {
           </div>
         )}
         <div style={{ display: 'flex', gap: 8, marginTop: 16, justifyContent: 'flex-end' }}>
-          <button
+          <button type="button"
             onClick={() => { setListImportOpen(false); setListImportUrl('') }}
             className="text-content"
             style={{
@@ -78,7 +80,7 @@ export function ListImportModal(S: SidebarState) {
           >
             {t('common.cancel')}
           </button>
-          <button
+          <button type="button"
             onClick={handleListImport}
             disabled={!listImportUrl.trim() || listImportLoading}
             className={!listImportUrl.trim() || listImportLoading ? 'bg-surface-tertiary text-content-faint' : 'bg-accent text-accent-text'}
diff --git a/client/src/components/Planner/PlacesSidebarMobileDayPicker.tsx b/client/src/components/Planner/PlacesSidebarMobileDayPicker.tsx
index d26d478b2..a63472617 100644
--- a/client/src/components/Planner/PlacesSidebarMobileDayPicker.tsx
+++ b/client/src/components/Planner/PlacesSidebarMobileDayPicker.tsx
@@ -9,10 +9,12 @@ export function MobileDayPickerSheet(S: SidebarState) {
   } = S
   return createPortal(
     <div
+      role="presentation"
       onClick={() => { setDayPickerPlace(null); setMobileShowDays(false) }}
       style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.4)', zIndex: 99999, display: 'flex', alignItems: 'flex-end', justifyContent: 'center' }}
     >
       <div
+        role="presentation"
         onClick={e => e.stopPropagation()}
         className="bg-surface-card"
         style={{ borderRadius: '20px 20px 0 0', width: '100%', maxWidth: 500, maxHeight: '70vh', display: 'flex', flexDirection: 'column', overflow: 'hidden', paddingBottom: 'var(--bottom-nav-h)' }}
@@ -23,7 +25,7 @@ export function MobileDayPickerSheet(S: SidebarState) {
         </div>
         <div style={{ overflowY: 'auto', padding: '8px 12px' }}>
           {/* View details */}
-          <button
+          <button type="button"
             onClick={() => { onPlaceClick(dayPickerPlace.id); setDayPickerPlace(null); setMobileShowDays(false) }}
             className="bg-transparent text-content"
             style={{ display: 'flex', alignItems: 'center', gap: 12, width: '100%', padding: '12px 14px', borderRadius: 12, border: 'none', cursor: 'pointer', fontFamily: 'inherit', textAlign: 'left', fontSize: 'calc(14px * var(--fs-scale-body, 1))' }}
@@ -32,7 +34,7 @@ export function MobileDayPickerSheet(S: SidebarState) {
           </button>
           {/* Edit */}
           {canEditPlaces && (
-            <button
+            <button type="button"
               onClick={() => { onEditPlace(dayPickerPlace); setDayPickerPlace(null); setMobileShowDays(false) }}
               className="bg-transparent text-content"
               style={{ display: 'flex', alignItems: 'center', gap: 12, width: '100%', padding: '12px 14px', borderRadius: 12, border: 'none', cursor: 'pointer', fontFamily: 'inherit', textAlign: 'left', fontSize: 'calc(14px * var(--fs-scale-body, 1))' }}
@@ -43,7 +45,7 @@ export function MobileDayPickerSheet(S: SidebarState) {
           {/* Assign to day */}
           {days?.length > 0 && (
             <>
-              <button
+              <button type="button"
                 onClick={() => setMobileShowDays(v => !v)}
                 className="bg-transparent text-content"
               style={{ display: 'flex', alignItems: 'center', gap: 12, width: '100%', padding: '12px 14px', borderRadius: 12, border: 'none', cursor: 'pointer', fontFamily: 'inherit', textAlign: 'left', fontSize: 'calc(14px * var(--fs-scale-body, 1))' }}
@@ -54,7 +56,7 @@ export function MobileDayPickerSheet(S: SidebarState) {
               {mobileShowDays && (
                 <div style={{ paddingLeft: 20 }}>
                   {days.map((day, i) => (
-                    <button
+                    <button type="button"
                       key={day.id}
                       onClick={() => { onAssignToDay(dayPickerPlace.id, day.id); setDayPickerPlace(null); setMobileShowDays(false) }}
                       style={{ display: 'flex', alignItems: 'center', gap: 10, width: '100%', padding: '10px 14px', borderRadius: 10, border: 'none', cursor: 'pointer', background: 'transparent', fontFamily: 'inherit', textAlign: 'left' }}
@@ -73,7 +75,7 @@ export function MobileDayPickerSheet(S: SidebarState) {
           )}
           {/* Delete */}
           {canEditPlaces && (
-            <button
+            <button type="button"
               onClick={() => { onDeletePlace(dayPickerPlace.id); setDayPickerPlace(null); setMobileShowDays(false) }}
               style={{ display: 'flex', alignItems: 'center', gap: 12, width: '100%', padding: '12px 14px', borderRadius: 12, border: 'none', cursor: 'pointer', background: 'transparent', fontFamily: 'inherit', textAlign: 'left', fontSize: 'calc(14px * var(--fs-scale-body, 1))', color: '#ef4444' }}
             >
diff --git a/client/src/components/Planner/PlacesSidebarRow.tsx b/client/src/components/Planner/PlacesSidebarRow.tsx
index 332fd3a19..2fbf6b278 100644
--- a/client/src/components/Planner/PlacesSidebarRow.tsx
+++ b/client/src/components/Planner/PlacesSidebarRow.tsx
@@ -35,10 +35,22 @@ export const MemoPlaceRow = React.memo(function MemoPlaceRow({
   const hasGeometry = Boolean(place.route_geometry)
   // Touch is reached through a long press instead of being locked out (#1616).
   const dragDisabled = isMobile
+  // One place for what a row does, so the keyboard path below cannot drift from the click.
+  const activate = () => {
+    if (selectMode) {
+      toggleSelected(place.id)
+    } else if (isMobile) {
+      setDayPickerPlace(place)
+    } else {
+      onPlaceClick(isSelected ? null : place.id)
+    }
+  }
   return (
     <div
       key={place.id}
       ref={element => registerPlaceRow(place.id, element)}
+      role="option"
+      tabIndex={0}
       aria-selected={isSelected}
       data-place-id={place.id}
       draggable={!selectMode && !dragDisabled}
@@ -48,14 +60,11 @@ export const MemoPlaceRow = React.memo(function MemoPlaceRow({
         e.dataTransfer.effectAllowed = 'copy'
         window.__dragData = { placeId: String(place.id) }
       }}
-      onClick={() => {
-        if (selectMode) {
-          toggleSelected(place.id)
-        } else if (isMobile) {
-          setDayPickerPlace(place)
-        } else {
-          onPlaceClick(isSelected ? null : place.id)
-        }
+      onClick={activate}
+      onKeyDown={e => {
+        // Only when the row itself has focus — the "+" button inside it keeps its own key handling.
+        if (e.target !== e.currentTarget) return
+        if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); activate() }
       }}
       onContextMenu={selectMode ? undefined : e => onContextMenu(e, place)}
       style={{
@@ -120,8 +129,8 @@ export const MemoPlaceRow = React.memo(function MemoPlaceRow({
         )}
       </div>
       <div style={{ flexShrink: 0, display: 'flex', alignItems: 'center' }}>
-        {!selectMode && !inDay && selectedDayId && (
-          <button
+        {!selectMode && !inDay && selectedDayId !== null && (
+          <button type="button"
             onClick={e => { e.stopPropagation(); onAssignToDay(place.id) }}
             className="bg-surface-hover text-content-faint"
             style={{
diff --git a/client/src/components/Planner/PlacesSidebarSelectionBar.tsx b/client/src/components/Planner/PlacesSidebarSelectionBar.tsx
index 0c2adbf24..c94f34855 100644
--- a/client/src/components/Planner/PlacesSidebarSelectionBar.tsx
+++ b/client/src/components/Planner/PlacesSidebarSelectionBar.tsx
@@ -14,7 +14,7 @@ export function PlacesSelectionBar(S: SidebarState) {
         {t('places.selectionCount', { count: selectedIds.size })}
       </span>
       <Tooltip label={selectedIds.size === filtered.length && filtered.length > 0 ? t('common.deselectAll') : t('common.selectAll')} placement="bottom">
-      <button
+      <button type="button"
         onClick={() => {
           if (selectedIds.size === filtered.length) setSelectedIds(new Set())
           else setSelectedIds(new Set(filtered.map(p => p.id)))
@@ -33,7 +33,7 @@ export function PlacesSelectionBar(S: SidebarState) {
       </button>
       </Tooltip>
       <Tooltip label={t('places.changeCategory')} placement="bottom">
-      <button
+      <button type="button"
         onClick={() => { if (selectedIds.size === 0) return; setCategoryPickerOpen(true) }}
         disabled={selectedIds.size === 0}
         aria-label={t('places.changeCategory')}
@@ -51,7 +51,7 @@ export function PlacesSelectionBar(S: SidebarState) {
       </Tooltip>
       {collectionsEnabled && (
         <Tooltip label={t('inspector.saveToCollection')} placement="bottom">
-        <button
+        <button type="button"
           onClick={() => { if (selectedIds.size === 0) return; setSaveToListOpen(true) }}
           disabled={selectedIds.size === 0}
           aria-label={t('inspector.saveToCollection')}
@@ -70,7 +70,7 @@ export function PlacesSelectionBar(S: SidebarState) {
       )}
       {collectionsEnabled && (
         <Tooltip label={t('collections.markVisitedSelection')} placement="bottom">
-        <button
+        <button type="button"
           onClick={() => { if (selectedIds.size === 0) return; void markSelectionVisited() }}
           disabled={selectedIds.size === 0 || markVisitedBusy}
           aria-label={t('collections.markVisitedSelection')}
@@ -88,7 +88,7 @@ export function PlacesSelectionBar(S: SidebarState) {
         </Tooltip>
       )}
       <Tooltip label={t('places.deleteSelected')} placement="bottom">
-      <button
+      <button type="button"
         onClick={() => {
           if (selectedIds.size === 0) return
           if (isMobile) setPendingDeleteIds(Array.from(selectedIds))
diff --git a/client/src/components/Planner/ReservationModal.test.tsx b/client/src/components/Planner/ReservationModal.test.tsx
index fc9a45dc1..dd7a549b8 100644
--- a/client/src/components/Planner/ReservationModal.test.tsx
+++ b/client/src/components/Planner/ReservationModal.test.tsx
@@ -677,7 +677,8 @@ describe('ReservationModal', () => {
 
     // Click the X to unlink
     const fileRow = screen.getByText('receipt.pdf').closest('div')!;
-    const unlinkBtn = fileRow.querySelector('button[type="button"]')!;
+    // Two buttons per row: [0] opens the file, [1] is the unlink X.
+    const unlinkBtn = fileRow.querySelectorAll('button[type="button"]')[1];
     await userEvent.click(unlinkBtn);
 
     // File removed from attached list and "Link existing file" button reappears
@@ -1317,7 +1318,7 @@ describe('ReservationModal', () => {
 
     render(<ReservationModal {...defaultProps} reservation={res} files={[attached]} />);
     const row = screen.getByText('voucher.pdf').closest('div') as HTMLElement;
-    await userEvent.click(within(row).getByRole('button'));
+    await userEvent.click(within(row).getAllByRole('button')[1]);
 
     await waitFor(() => expect(addToast).toHaveBeenCalledWith('Failed to update', 'error', undefined));
     delete window.__addToast;
@@ -1404,14 +1405,14 @@ describe('ReservationModal', () => {
     });
   });
 
-  it('FE-PLANNER-RESMODAL-086: the open-file link on an attached file does not throw', async () => {
+  it('FE-PLANNER-RESMODAL-086: the open-file button on an attached file does not throw', async () => {
     const res = buildReservation({ id: 16, type: 'other', title: 'Trip' });
     const attached = buildTripFile({ id: 80, original_name: 'ticket.pdf' });
     (attached as unknown as { reservation_id: number }).reservation_id = 16;
 
     render(<ReservationModal {...defaultProps} reservation={res} files={[attached]} />);
     const row = screen.getByText('ticket.pdf').closest('div') as HTMLElement;
-    await userEvent.click(within(row).getByRole('link'));
+    await userEvent.click(within(row).getAllByRole('button')[0]);
     // The download is best-effort; the row must survive a failed fetch.
     expect(screen.getByText('ticket.pdf')).toBeInTheDocument();
   });
diff --git a/client/src/components/Planner/ReservationModal.tsx b/client/src/components/Planner/ReservationModal.tsx
index 44d8c23c3..4b550e6e1 100644
--- a/client/src/components/Planner/ReservationModal.tsx
+++ b/client/src/components/Planner/ReservationModal.tsx
@@ -1,4 +1,5 @@
 import { useState, useEffect, useRef, useMemo } from 'react'
+import { localIsoDate } from '../../utils/localDate'
 import { useParams } from 'react-router'
 import apiClient from '../../api/client'
 import { useTripStore } from '../../store/tripStore'
@@ -117,7 +118,7 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
   // constrain to trip days via their day dropdowns. Falls back to no limit when
   // the trip has no dated days.
   const tripDateRange = useMemo(() => {
-    const dates = (days || []).map(d => d.date).filter((d): d is string => !!d).sort()
+    const dates = (days || []).map(d => d.date).filter((d): d is string => !!d).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
     return { min: dates[0], max: dates[dates.length - 1] }
   }, [days])
 
@@ -480,7 +481,7 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
                   onChange={tm => {
                     const [d] = (form.reservation_time || '').split('T')
                     const selectedDay = days.find(dy => dy.id === selectedDayId)
-                    const date = d || selectedDay?.date || new Date().toISOString().split('T')[0]
+                    const date = d || selectedDay?.date || localIsoDate()
                     set('reservation_time', tm ? `${date}T${tm}` : date)
                   }}
                 />
@@ -697,7 +698,7 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
               <div key={f.id} className="bg-surface-secondary" style={{ display: 'flex', alignItems: 'center', gap: 8, padding: '5px 10px', borderRadius: 8 }}>
                 <FileText size={12} className="text-content-muted" style={{ flexShrink: 0 }} />
                 <span className="text-content-secondary" style={{ flex: 1, fontSize: 'calc(12px * var(--fs-scale-body, 1))', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{f.original_name}</span>
-                <a href="#" onClick={(e) => { e.preventDefault(); openFile(f.url).catch(() => {}) }} className="text-content-faint" style={{ display: 'flex', flexShrink: 0, cursor: 'pointer' }}><ExternalLink size={11} /></a>
+                <button type="button" onClick={() => { openFile(f.url).catch(() => {}) }} className="text-content-faint" style={{ background: 'none', border: 'none', cursor: 'pointer', display: 'flex', padding: 0, flexShrink: 0 }}><ExternalLink size={11} /></button>
                 <button type="button" onClick={async () => {
                   if (f.reservation_id === reservation?.id) {
                     try { await apiClient.put(`/trips/${tripId}/files/${f.id}`, { reservation_id: null }) } catch { toast.error(t('reservations.toast.updateError')) }
diff --git a/client/src/components/Planner/ReservationsPanel.tsx b/client/src/components/Planner/ReservationsPanel.tsx
index 74d5eb2a6..edddd24ed 100644
--- a/client/src/components/Planner/ReservationsPanel.tsx
+++ b/client/src/components/Planner/ReservationsPanel.tsx
@@ -77,6 +77,35 @@ function buildAssignmentLookup(days, assignments) {
 const fieldLabelClass = 'text-[10px] font-semibold uppercase tracking-[0.08em] text-content-faint mb-[5px]'
 const fieldValueClass = 'text-[13px] font-medium text-content px-[10px] py-[8px] bg-surface-tertiary rounded-[10px]'
 
+// A booking code is only a control while the blur setting is on: then it lifts on
+// hover and toggles on click or Enter. With blurring off it is plain text, so it
+// stays a plain element instead of a button that can never do anything.
+function ConfirmationCode({ code, blurred, revealed, onReveal }: {
+  code: React.ReactNode
+  blurred: boolean
+  revealed: boolean
+  onReveal: (next: boolean | ((v: boolean) => boolean)) => void
+}) {
+  const codeStyle: CSSProperties = {
+    fontFamily: '"SF Mono", "JetBrains Mono", Menlo, monospace', fontSize: 'calc(12.5px * var(--fs-scale-body, 1))',
+    filter: blurred && !revealed ? 'blur(5px)' : 'none',
+    transition: 'filter 0.2s',
+  }
+  if (!blurred) return <div className={`${fieldValueClass} text-center`} style={{ ...codeStyle, cursor: 'default' }}>{code}</div>
+  return (
+    <button
+      type="button"
+      className={`${fieldValueClass} text-center`}
+      style={{ ...codeStyle, cursor: 'pointer', width: '100%' }}
+      onMouseEnter={() => onReveal(true)}
+      onMouseLeave={() => onReveal(false)}
+      onClick={() => onReveal(v => !v)}
+    >
+      {code}
+    </button>
+  )
+}
+
 interface ReservationCardProps {
   r: Reservation
   tripId: number
@@ -229,7 +258,7 @@ function ReservationCard({ r, tripId, onEdit, onDelete, files = [], onNavigateTo
             maxWidth: 140, whiteSpace: 'nowrap', overflow: 'hidden', textOverflow: 'ellipsis',
           }}>{r.title}</span>
           {canEdit && (
-            <button onClick={() => onEdit(r)} title={t('common.edit')} className="bg-transparent text-content-faint" style={{
+            <button type="button" onClick={() => onEdit(r)} title={t('common.edit')} className="bg-transparent text-content-faint" style={{
               appearance: 'none', border: 'none',
               width: 26, height: 26, borderRadius: 6, display: 'grid', placeItems: 'center',
               cursor: 'pointer', flexShrink: 0,
@@ -240,7 +269,7 @@ function ReservationCard({ r, tripId, onEdit, onDelete, files = [], onNavigateTo
             </button>
           )}
           {canEdit && (
-            <button onClick={() => setShowDeleteConfirm(true)} title={t('common.delete')} className="bg-transparent text-content-faint" style={{
+            <button type="button" onClick={() => setShowDeleteConfirm(true)} title={t('common.delete')} className="bg-transparent text-content-faint" style={{
               appearance: 'none', border: 'none',
               width: 26, height: 26, borderRadius: 6, display: 'grid', placeItems: 'center',
               cursor: 'pointer', flexShrink: 0,
@@ -298,20 +327,7 @@ function ReservationCard({ r, tripId, onEdit, onDelete, files = [], onNavigateTo
         {hasCode && (
           <div>
             <div className={fieldLabelClass}>{t('reservations.confirmationCode')}</div>
-            <div
-              onMouseEnter={() => blurCodes && setCodeRevealed(true)}
-              onMouseLeave={() => blurCodes && setCodeRevealed(false)}
-              onClick={() => blurCodes && setCodeRevealed(v => !v)}
-              className={`${fieldValueClass} text-center`}
-              style={{
-                fontFamily: '"SF Mono", "JetBrains Mono", Menlo, monospace', fontSize: 'calc(12.5px * var(--fs-scale-body, 1))',
-                filter: blurCodes && !codeRevealed ? 'blur(5px)' : 'none',
-                cursor: blurCodes ? 'pointer' : 'default',
-                transition: 'filter 0.2s',
-              }}
-            >
-              {r.confirmation_number}
-            </div>
+            <ConfirmationCode code={r.confirmation_number} blurred={!!blurCodes} revealed={codeRevealed} onReveal={setCodeRevealed} />
           </div>
         )}
 
@@ -350,20 +366,7 @@ function ReservationCard({ r, tripId, onEdit, onDelete, files = [], onNavigateTo
               {coded.map((l, i) => (
                 <div key={i}>
                   <div className={fieldLabelClass}>{[l.from, l.to].filter(Boolean).join(' → ') || t('reservations.confirmationCode')}</div>
-                  <div
-                    onMouseEnter={() => blurCodes && setCodeRevealed(true)}
-                    onMouseLeave={() => blurCodes && setCodeRevealed(false)}
-                    onClick={() => blurCodes && setCodeRevealed(v => !v)}
-                    className={`${fieldValueClass} text-center`}
-                    style={{
-                      fontFamily: '"SF Mono", "JetBrains Mono", Menlo, monospace', fontSize: 'calc(12.5px * var(--fs-scale-body, 1))',
-                      filter: blurCodes && !codeRevealed ? 'blur(5px)' : 'none',
-                      cursor: blurCodes ? 'pointer' : 'default',
-                      transition: 'filter 0.2s',
-                    }}
-                  >
-                    {l.confirmation_number}
-                  </div>
+                  <ConfirmationCode code={l.confirmation_number} blurred={!!blurCodes} revealed={codeRevealed} onReveal={setCodeRevealed} />
                 </div>
               ))}
             </div>
@@ -463,10 +466,10 @@ function ReservationCard({ r, tripId, onEdit, onDelete, files = [], onNavigateTo
             <div className={fieldLabelClass}>{t('files.title')}</div>
             <div className={fieldValueClass} style={{ display: 'flex', flexDirection: 'column', gap: 4, padding: '6px 10px' }}>
               {attachedFiles.map(f => (
-                <a key={f.id} href="#" onClick={(e) => { e.preventDefault(); openFile(f.url).catch(() => {}) }} style={{ display: 'flex', alignItems: 'center', gap: 5, textDecoration: 'none', cursor: 'pointer' }}>
+                <button key={f.id} type="button" onClick={() => { openFile(f.url).catch(() => {}) }} style={{ display: 'flex', alignItems: 'center', gap: 5, cursor: 'pointer', background: 'none', border: 'none', padding: 0, textAlign: 'left', fontFamily: 'inherit' }}>
                   <FileText size={11} className="text-content-faint" style={{ flexShrink: 0 }} />
                   <span style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-muted)', flex: 1, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{f.original_name}</span>
-                </a>
+                </button>
               ))}
             </div>
           </div>
@@ -497,12 +500,12 @@ function ReservationCard({ r, tripId, onEdit, onDelete, files = [], onNavigateTo
 
       {/* Delete confirmation */}
       {showDeleteConfirm && createPortal(
-        <div className="bg-[rgba(0,0,0,0.3)]" style={{
+        <div className="bg-[rgba(0,0,0,0.3)]" role="presentation" style={{
           position: 'fixed', inset: 0, zIndex: 1000,
           display: 'flex', alignItems: 'center', justifyContent: 'center',
           backdropFilter: 'blur(3px)',
         }} onClick={() => setShowDeleteConfirm(false)}>
-          <div className="bg-surface-card" style={{
+          <div className="bg-surface-card" role="presentation" style={{
             width: 340, borderRadius: 16,
             boxShadow: '0 16px 48px rgba(0,0,0,0.22)', padding: '22px 22px 18px',
             display: 'flex', flexDirection: 'column', gap: 12,
@@ -522,11 +525,11 @@ function ReservationCard({ r, tripId, onEdit, onDelete, files = [], onNavigateTo
               {t('reservations.confirm.deleteBody', { name: r.title })}
             </div>
             <div style={{ display: 'flex', gap: 8, justifyContent: 'flex-end', marginTop: 4 }}>
-              <button onClick={() => setShowDeleteConfirm(false)} className="text-content-muted" style={{
+              <button type="button" onClick={() => setShowDeleteConfirm(false)} className="text-content-muted" style={{
                 fontSize: 'calc(12px * var(--fs-scale-body, 1))', background: 'none', border: '1px solid var(--border-primary)',
                 borderRadius: 8, padding: '6px 14px', cursor: 'pointer', fontFamily: 'inherit',
               }}>{t('common.cancel')}</button>
-              <button onClick={handleDelete} className="bg-[#ef4444] text-white" style={{
+              <button type="button" onClick={handleDelete} className="bg-[#ef4444] text-white" style={{
                 fontSize: 'calc(12px * var(--fs-scale-body, 1))',
                 border: 'none', borderRadius: 8, padding: '6px 16px', cursor: 'pointer', fontWeight: 600, fontFamily: 'inherit',
               }}>{t('common.confirm')}</button>
@@ -561,7 +564,7 @@ function Section({ title, count, children, defaultOpen = true, accent, storageKe
   }, [open, storageKey])
   return (
     <div style={{ marginBottom: 28 }}>
-      <button onClick={() => setOpen(o => !o)} style={{
+      <button type="button" onClick={() => setOpen(o => !o)} style={{
         display: 'flex', alignItems: 'center', gap: 8, width: '100%',
         background: 'none', border: 'none', cursor: 'pointer', padding: '4px 0', marginBottom: 12, fontFamily: 'inherit',
         userSelect: 'none',
@@ -610,6 +613,9 @@ function TransitJourneyCard({ r, days, onOpen, onDelete, canEdit, tripId, contri
     <div
       className="bg-surface-card"
       onClick={() => onOpen(r)}
+      role="button"
+      tabIndex={0}
+      onKeyDown={e => { if (e.target === e.currentTarget && (e.key === 'Enter' || e.key === ' ')) { e.preventDefault(); onOpen(r) } }}
       style={{ borderRadius: 12, border: '1px solid rgba(124,58,237,0.22)', padding: '12px 14px', display: 'flex', flexDirection: 'column', gap: 9, cursor: 'pointer', transition: 'box-shadow 0.15s ease' }}
       onMouseEnter={e => e.currentTarget.style.boxShadow = '0 2px 12px rgba(0,0,0,0.06)'}
       onMouseLeave={e => e.currentTarget.style.boxShadow = 'none'}
@@ -632,7 +638,7 @@ function TransitJourneyCard({ r, days, onOpen, onDelete, canEdit, tripId, contri
           </div>
         </div>
         {canEdit && (
-          <button
+          <button type="button"
             onClick={e => { e.stopPropagation(); setConfirmOpen(true) }}
             title={t('common.delete')}
             className="bg-transparent text-content-faint"
@@ -658,7 +664,7 @@ function TransitJourneyCard({ r, days, onOpen, onDelete, canEdit, tripId, contri
         </div>
       )}
       {r.travelers && r.travelers.length > 0 && (
-        <div style={{ paddingLeft: 44 }} onClick={e => e.stopPropagation()}>
+        <div style={{ paddingLeft: 44 }} role="presentation" onClick={e => e.stopPropagation()}>
           <TravelerAvatarRow travelers={r.travelers} />
         </div>
       )}
@@ -666,7 +672,7 @@ function TransitJourneyCard({ r, days, onOpen, onDelete, canEdit, tripId, contri
       {/* Reservation-detail plugin slots: sandboxed, scoped to this journey. The
           card itself is clickable, so keep frame interactions from opening it. */}
       {detailPlugins.length > 0 && (
-        <div onClick={e => e.stopPropagation()} style={{ display: 'flex', flexDirection: 'column', gap: 8 }}>
+        <div role="presentation" onClick={e => e.stopPropagation()} style={{ display: 'flex', flexDirection: 'column', gap: 8 }}>
           {detailPlugins.map(p => (
             <div key={p.id} className="bg-surface-hover" style={{ borderRadius: 10, overflow: 'hidden' }}>
               <PluginFrame pluginId={p.id} tripId={String(tripId)} reservationId={String(r.id)} title={p.name} surface="detail-slot" />
@@ -675,13 +681,13 @@ function TransitJourneyCard({ r, days, onOpen, onDelete, canEdit, tripId, contri
         </div>
       )}
       {confirmOpen && createPortal(
-        <div className="bg-[rgba(0,0,0,0.35)]" style={{ position: 'fixed', inset: 0, zIndex: 3000, display: 'flex', alignItems: 'center', justifyContent: 'center' }} onClick={e => { e.stopPropagation(); setConfirmOpen(false) }}>
-          <div className="bg-surface-card" style={{ borderRadius: 14, padding: 20, width: 340, boxShadow: '0 16px 48px rgba(0,0,0,0.22)' }} onClick={e => e.stopPropagation()}>
+        <div className="bg-[rgba(0,0,0,0.35)]" role="presentation" style={{ position: 'fixed', inset: 0, zIndex: 3000, display: 'flex', alignItems: 'center', justifyContent: 'center' }} onClick={e => { e.stopPropagation(); setConfirmOpen(false) }}>
+          <div className="bg-surface-card" role="presentation" style={{ borderRadius: 14, padding: 20, width: 340, boxShadow: '0 16px 48px rgba(0,0,0,0.22)' }} onClick={e => e.stopPropagation()}>
             <div className="text-content" style={{ fontWeight: 600, fontSize: 'calc(14px * var(--fs-scale-body, 1))', marginBottom: 6 }}>{t('reservations.confirm.deleteTitle')}</div>
             <div className="text-content-muted" style={{ fontSize: 'calc(12.5px * var(--fs-scale-body, 1))', marginBottom: 14 }}>{t('reservations.confirm.deleteBody', { name: r.title })}</div>
             <div style={{ display: 'flex', justifyContent: 'flex-end', gap: 8 }}>
-              <button onClick={e => { e.stopPropagation(); setConfirmOpen(false) }} className="text-content-muted" style={{ padding: '7px 14px', borderRadius: 9, border: '1px solid var(--border-primary)', background: 'none', fontSize: 'calc(12px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit' }}>{t('common.cancel')}</button>
-              <button onClick={e => { e.stopPropagation(); setConfirmOpen(false); onDelete(r.id) }} style={{ padding: '7px 14px', borderRadius: 9, border: 'none', background: '#ef4444', color: '#fff', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}>{t('common.delete')}</button>
+              <button type="button" onClick={e => { e.stopPropagation(); setConfirmOpen(false) }} className="text-content-muted" style={{ padding: '7px 14px', borderRadius: 9, border: '1px solid var(--border-primary)', background: 'none', fontSize: 'calc(12px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit' }}>{t('common.cancel')}</button>
+              <button type="button" onClick={e => { e.stopPropagation(); setConfirmOpen(false); onDelete(r.id) }} style={{ padding: '7px 14px', borderRadius: 9, border: 'none', background: '#ef4444', color: '#fff', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}>{t('common.delete')}</button>
             </div>
           </div>
         </div>,
@@ -837,7 +843,7 @@ export default function ReservationsPanel({ tripId, reservations, days, assignme
             <>
               <div className="hidden md:block" style={{ width: 1, height: 22, background: 'var(--border-faint)', flexShrink: 0 }} />
               <div className="hidden md:inline-flex" style={{ gap: 4, flexWrap: 'wrap', flex: 1, minWidth: 0 }}>
-                <button
+                <button type="button"
                   onClick={() => { setTypeFilters(new Set()); sessionStorage.removeItem(storageKey) }}
                   className={typeFilters.size === 0 ? 'bg-surface-card text-content' : 'bg-transparent text-content-muted'}
                   style={{
@@ -859,7 +865,7 @@ export default function ReservationsPanel({ tripId, reservations, days, assignme
                   const active = typeFilters.has(opt.value)
                   const Icon = opt.Icon
                   return (
-                    <button
+                    <button type="button"
                       key={opt.value}
                       onClick={() => toggleTypeFilter(opt.value)}
                       className={active ? 'bg-surface-card text-content' : 'bg-transparent text-content-muted'}
@@ -896,7 +902,7 @@ export default function ReservationsPanel({ tripId, reservations, days, assignme
           {canEdit && (
             <div style={{ display: 'flex', gap: 6, marginLeft: 'auto', flexShrink: 0 }}>
               {onImport && bookingImportAvailable && (
-                <button onClick={onImport} className="bg-surface-card text-content" style={{
+                <button type="button" onClick={onImport} className="bg-surface-card text-content" style={{
                   appearance: 'none', border: '1px solid var(--border-primary)', cursor: 'pointer', fontFamily: 'inherit',
                   display: 'inline-flex', alignItems: 'center', gap: 6,
                   padding: '8px 13px', borderRadius: 10, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 500,
@@ -911,7 +917,7 @@ export default function ReservationsPanel({ tripId, reservations, days, assignme
                 </button>
               )}
               {onAirTrailImport && airTrailAvailable && (
-                <button onClick={onAirTrailImport} className="bg-surface-secondary text-content" style={{
+                <button type="button" onClick={onAirTrailImport} className="bg-surface-secondary text-content" style={{
                   appearance: 'none', border: '1px solid var(--border-primary)', cursor: 'pointer', fontFamily: 'inherit',
                   display: 'inline-flex', alignItems: 'center', gap: 6,
                   padding: '8px 14px', borderRadius: 10, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 500, boxSizing: 'border-box',
@@ -925,7 +931,7 @@ export default function ReservationsPanel({ tripId, reservations, days, assignme
                   <span className="hidden sm:inline">{t('reservations.airtrail.cta')}</span>
                 </button>
               )}
-              <button onClick={onAdd} className="bg-accent text-accent-text" style={{
+              <button type="button" onClick={onAdd} className="bg-accent text-accent-text" style={{
                 appearance: 'none', border: 'none', cursor: 'pointer', fontFamily: 'inherit',
                 display: 'inline-flex', alignItems: 'center', gap: 6,
                 padding: '9px 14px', borderRadius: 10, fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 500,
@@ -952,18 +958,18 @@ export default function ReservationsPanel({ tripId, reservations, days, assignme
             // page, so the import in particular went unnoticed (#2007).
             action={canEdit ? (
               <div style={{ display: 'flex', gap: 8, flexWrap: 'wrap', justifyContent: 'center' }}>
-                <button onClick={onAdd} className="bg-accent text-accent-text" style={CTA_STYLE}>
+                <button type="button" onClick={onAdd} className="bg-accent text-accent-text" style={CTA_STYLE}>
                   <Plus size={14} strokeWidth={2} />
                   {t(addManualKey)}
                 </button>
                 {onImport && bookingImportAvailable && (
-                  <button onClick={onImport} className="bg-surface-card text-content" style={{ ...CTA_STYLE, border: '1px solid var(--border-primary)' }}>
+                  <button type="button" onClick={onImport} className="bg-surface-card text-content" style={{ ...CTA_STYLE, border: '1px solid var(--border-primary)' }}>
                     <Download size={14} strokeWidth={2} />
                     {t('reservations.import.cta')}
                   </button>
                 )}
                 {onAirTrailImport && airTrailAvailable && (
-                  <button onClick={onAirTrailImport} className="bg-surface-secondary text-content" style={{ ...CTA_STYLE, border: '1px solid var(--border-primary)' }}>
+                  <button type="button" onClick={onAirTrailImport} className="bg-surface-secondary text-content" style={{ ...CTA_STYLE, border: '1px solid var(--border-primary)' }}>
                     <Plane size={14} strokeWidth={2} />
                     {t('reservations.airtrail.cta')}
                   </button>
diff --git a/client/src/components/Planner/SubscribeLinks.tsx b/client/src/components/Planner/SubscribeLinks.tsx
index e5eed99ab..38ae62c3d 100644
--- a/client/src/components/Planner/SubscribeLinks.tsx
+++ b/client/src/components/Planner/SubscribeLinks.tsx
@@ -114,7 +114,7 @@ function UrlRow({ label, hint, url, copied, onCopy }: {
         }}>
           {url}
         </div>
-        <button
+        <button type="button"
           onClick={onCopy}
           title="Copy"
           style={{
diff --git a/client/src/components/Planner/TransitJourneyModal.tsx b/client/src/components/Planner/TransitJourneyModal.tsx
index 2ea5d4fcf..37cda8949 100644
--- a/client/src/components/Planner/TransitJourneyModal.tsx
+++ b/client/src/components/Planner/TransitJourneyModal.tsx
@@ -142,7 +142,7 @@ export default function TransitJourneyModal({ reservation, onClose, onSave, onDe
       footer={
         <div style={{ display: 'flex', alignItems: 'center', gap: 8, flexWrap: 'wrap' }}>
           {canEdit && (
-            <button onClick={() => setConfirmDelete(true)} aria-label={t('common.delete')} title={t('common.delete')} style={{
+            <button type="button" onClick={() => setConfirmDelete(true)} aria-label={t('common.delete')} title={t('common.delete')} style={{
               display: 'inline-flex', alignItems: 'center', gap: 5, padding: isMobile ? '9px 11px' : '8px 14px', borderRadius: 10,
               border: '1px solid rgba(239,68,68,0.3)', background: 'rgba(239,68,68,0.06)', color: '#ef4444',
               fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500, cursor: 'pointer', fontFamily: 'inherit',
@@ -152,7 +152,7 @@ export default function TransitJourneyModal({ reservation, onClose, onSave, onDe
           )}
           <div style={{ flex: 1 }} />
           {canEdit && (
-            <button onClick={onChangeRoute} className="text-content-muted" style={{
+            <button type="button" onClick={onChangeRoute} className="text-content-muted" style={{
               display: 'inline-flex', alignItems: 'center', gap: 6, padding: '8px 16px', borderRadius: 10,
               border: '1px solid var(--border-primary)', background: 'none',
               fontSize: 'calc(12px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit',
@@ -161,7 +161,7 @@ export default function TransitJourneyModal({ reservation, onClose, onSave, onDe
             </button>
           )}
           {canEdit ? (
-            <button onClick={save} disabled={saving || !title.trim() || !dirty} className="bg-[var(--text-primary)] text-[var(--bg-primary)]" style={{
+            <button type="button" onClick={save} disabled={saving || !title.trim() || !dirty} className="bg-[var(--text-primary)] text-[var(--bg-primary)]" style={{
               padding: '8px 20px', borderRadius: 10, border: 'none',
               fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit',
               opacity: saving || !title.trim() || !dirty ? 0.5 : 1,
@@ -169,7 +169,7 @@ export default function TransitJourneyModal({ reservation, onClose, onSave, onDe
               {saving ? t('common.saving') : t('common.save')}
             </button>
           ) : (
-            <button onClick={onClose} className="bg-accent text-accent-text" style={{ padding: '8px 20px', borderRadius: 10, border: 'none', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}>
+            <button type="button" onClick={onClose} className="bg-accent text-accent-text" style={{ padding: '8px 20px', borderRadius: 10, border: 'none', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}>
               {t('common.close')}
             </button>
           )}
@@ -198,7 +198,7 @@ export default function TransitJourneyModal({ reservation, onClose, onSave, onDe
               <div className="text-content" style={{ display: 'flex', alignItems: 'center', gap: 7, fontSize: 'calc(17px * var(--fs-scale-subtitle, 1))', fontWeight: 700, letterSpacing: '-0.015em', minWidth: 0 }}>
                 <span style={{ minWidth: 0, overflow: 'hidden' }}><TransitTitle title={title} iconSize={15} /></span>
                 {canEdit && (
-                  <button onClick={() => setEditingTitle(true)} aria-label={t('common.edit')} title={t('common.edit')} className="text-content-faint" style={{ border: 'none', background: 'none', padding: 3, cursor: 'pointer', display: 'flex', flexShrink: 0 }}>
+                  <button type="button" onClick={() => setEditingTitle(true)} aria-label={t('common.edit')} title={t('common.edit')} className="text-content-faint" style={{ border: 'none', background: 'none', padding: 3, cursor: 'pointer', display: 'flex', flexShrink: 0 }}>
                     <Pencil size={13} strokeWidth={1.8} />
                   </button>
                 )}
diff --git a/client/src/components/Planner/TransitSearchPanel.tsx b/client/src/components/Planner/TransitSearchPanel.tsx
index dd8478b67..981a68f1d 100644
--- a/client/src/components/Planner/TransitSearchPanel.tsx
+++ b/client/src/components/Planner/TransitSearchPanel.tsx
@@ -149,7 +149,7 @@ function StopPicker({ label, value, onPick, quickPicks, near, placeholder }: {
         <div className="bg-surface-card border border-edge" style={{ position: 'absolute', top: '100%', left: 0, right: 0, marginTop: 4, borderRadius: 10, boxShadow: '0 8px 32px rgba(0,0,0,0.14)', zIndex: 30, overflow: 'hidden', maxHeight: 240, overflowY: 'auto' }}>
           {results.length > 0
             ? results.map((r, i) => (
-              <button key={i} onClick={() => { onPick({ name: r.name, lat: r.lat, lng: r.lng }); setText(''); setResults([]); setOpen(false) }}
+              <button type="button" key={i} onClick={() => { onPick({ name: r.name, lat: r.lat, lng: r.lng }); setText(''); setResults([]); setOpen(false) }}
                 className="text-content"
                 style={{ display: 'flex', alignItems: 'center', gap: 8, width: '100%', textAlign: 'left', padding: '8px 10px', border: 'none', background: 'none', cursor: 'pointer', fontFamily: 'inherit', fontSize: 'calc(13px * var(--fs-scale-body, 1))' }}
                 onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
@@ -162,7 +162,7 @@ function StopPicker({ label, value, onPick, quickPicks, near, placeholder }: {
               </button>
             ))
             : quickPicks.map((p, i) => (
-              <button key={i} onClick={() => { onPick(p); setText(''); setOpen(false) }}
+              <button type="button" key={i} onClick={() => { onPick(p); setText(''); setOpen(false) }}
                 className="text-content"
                 style={{ display: 'flex', alignItems: 'center', gap: 8, width: '100%', textAlign: 'left', padding: '8px 10px', border: 'none', background: 'none', cursor: 'pointer', fontFamily: 'inherit', fontSize: 'calc(13px * var(--fs-scale-body, 1))' }}
                 onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
@@ -206,7 +206,7 @@ function ItineraryCard({ it, tzFrom, tzTo, is12h, expanded, onToggle, onAdd, add
   const walkMins = Math.round(it.walkSeconds / 60)
   return (
     <div className="bg-surface-card border border-edge" style={{ borderRadius: 14, overflow: 'hidden' }}>
-      <button onClick={onToggle} style={{ display: 'block', width: '100%', textAlign: 'left', padding: '12px 14px', border: 'none', background: 'none', cursor: 'pointer', fontFamily: 'inherit' }}>
+      <button type="button" onClick={onToggle} style={{ display: 'block', width: '100%', textAlign: 'left', padding: '12px 14px', border: 'none', background: 'none', cursor: 'pointer', fontFamily: 'inherit' }}>
         <div style={{ display: 'flex', alignItems: 'baseline', gap: 10, flexWrap: 'wrap' }}>
           <span className="text-content" style={{ fontSize: 'calc(15px * var(--fs-scale-subtitle, 1))', fontWeight: 700, letterSpacing: '-0.01em' }}>
             {fmtTimeInTz(it.startTime, tzFrom, is12h)} – {fmtTimeInTz(it.endTime, tzTo, is12h)}
@@ -289,7 +289,7 @@ function ItineraryCard({ it, tzFrom, tzTo, is12h, expanded, onToggle, onAdd, add
               {[...new Set(transitLegs.map(l => l.agency).filter(Boolean))].join(' · ')}
             </div>
           )}
-          <button
+          <button type="button"
             onClick={onAdd}
             disabled={adding}
             className="bg-accent text-accent-text"
@@ -507,7 +507,7 @@ export default function TransitSearchPanel({ day, days, places, accommodations =
         <div style={{ display: 'flex', flexDirection: isMobile ? 'column' : 'row', gap: 8, alignItems: isMobile ? 'stretch' : 'flex-end' }}>
           <StopPicker label={t('transit.from')} value={from} onPick={setFrom} quickPicks={quickPicks} near={near} placeholder={t('transit.searchStop')} />
           {!isMobile && (
-            <button
+            <button type="button"
               onClick={() => { const f = from; setFrom(to); setTo(f) }}
               aria-label={t('transit.swap')}
               title={t('transit.swap')}
@@ -525,8 +525,8 @@ export default function TransitSearchPanel({ day, days, places, accommodations =
           <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 10, flexWrap: 'wrap' }}>
             <div style={{ display: 'flex', alignItems: 'center', gap: 8, flexWrap: 'wrap' }}>
               <div className="bg-surface-secondary" style={{ display: 'flex', borderRadius: 9, padding: 3 }}>
-                <button onClick={() => setArriveBy(false)} style={segBtn(!arriveBy)}>{t('transit.depart')}</button>
-                <button onClick={() => setArriveBy(true)} style={segBtn(arriveBy)}>{t('transit.arrive')}</button>
+                <button type="button" onClick={() => setArriveBy(false)} style={segBtn(!arriveBy)}>{t('transit.depart')}</button>
+                <button type="button" onClick={() => setArriveBy(true)} style={segBtn(arriveBy)}>{t('transit.arrive')}</button>
               </div>
               <div style={{ width: 110 }}>
                 <CustomTimePicker value={time} onChange={setTime} />
@@ -539,9 +539,9 @@ export default function TransitSearchPanel({ day, days, places, accommodations =
               )}
             </div>
             <div className="bg-surface-secondary" style={{ display: 'flex', borderRadius: 9, padding: 3, width: isMobile ? '100%' : undefined }}>
-              <button onClick={() => setPref('best')} style={{ ...segBtn(pref === 'best'), flex: isMobile ? 1 : undefined }}>{t('transit.pref.best')}</button>
-              <button onClick={() => setPref('transfers')} style={{ ...segBtn(pref === 'transfers'), flex: isMobile ? 1 : undefined }}>{t('transit.pref.transfers')}</button>
-              <button onClick={() => setPref('walking')} style={{ ...segBtn(pref === 'walking'), flex: isMobile ? 1 : undefined }}>{t('transit.pref.walking')}</button>
+              <button type="button" onClick={() => setPref('best')} style={{ ...segBtn(pref === 'best'), flex: isMobile ? 1 : undefined }}>{t('transit.pref.best')}</button>
+              <button type="button" onClick={() => setPref('transfers')} style={{ ...segBtn(pref === 'transfers'), flex: isMobile ? 1 : undefined }}>{t('transit.pref.transfers')}</button>
+              <button type="button" onClick={() => setPref('walking')} style={{ ...segBtn(pref === 'walking'), flex: isMobile ? 1 : undefined }}>{t('transit.pref.walking')}</button>
             </div>
           </div>
 
@@ -552,7 +552,7 @@ export default function TransitSearchPanel({ day, days, places, accommodations =
               {MODE_GROUPS.map(m => {
                 const active = activeModes.has(m.key)
                 return (
-                  <button key={m.key} onClick={() => toggleMode(m.key)}
+                  <button type="button" key={m.key} onClick={() => toggleMode(m.key)}
                     className={active ? 'bg-surface-card text-content' : 'text-content-faint'}
                     style={{
                       display: 'inline-flex', alignItems: 'center', gap: 5, padding: '5px 11px', borderRadius: 99,
@@ -569,7 +569,7 @@ export default function TransitSearchPanel({ day, days, places, accommodations =
                 )
               })}
             </div>
-            <button
+            <button type="button"
               onClick={search}
               disabled={!from || !to || loading}
               className="bg-accent text-accent-text"
diff --git a/client/src/components/Planner/TransportModal.test.tsx b/client/src/components/Planner/TransportModal.test.tsx
index 45c0b0500..99ee224b5 100644
--- a/client/src/components/Planner/TransportModal.test.tsx
+++ b/client/src/components/Planner/TransportModal.test.tsx
@@ -307,7 +307,8 @@ describe('TransportModal', () => {
     );
 
     const fileRow = screen.getByText('rental-agreement.pdf').closest('div')!;
-    const unlinkBtn = fileRow.querySelector('button[type="button"]')!;
+    // The row carries two buttons: [0] opens the file, [1] unlinks it.
+    const unlinkBtn = fileRow.querySelectorAll('button[type="button"]')[1];
     await userEvent.click(unlinkBtn);
 
     await waitFor(() => {
@@ -1080,7 +1081,7 @@ describe('TransportModal', () => {
 
     render(<TransportModal {...defaultProps} reservation={res} files={[attached]} />);
     const row = screen.getByText('boarding.pdf').closest('div') as HTMLElement;
-    await userEvent.click(within(row).getByRole('button'));
+    await userEvent.click(within(row).getAllByRole('button')[1]);
 
     await waitFor(() => expect(addToast).toHaveBeenCalledWith('Failed to update', 'error', undefined));
     delete window.__addToast;
@@ -1186,7 +1187,7 @@ describe('TransportModal', () => {
 
     render(<TransportModal {...defaultProps} reservation={res} files={[attached]} />);
     const row = screen.getByText('boarding.pdf').closest('div') as HTMLElement;
-    await userEvent.click(within(row).getByRole('link'));
+    await userEvent.click(within(row).getByRole('button', { name: /open/i }));
     expect(screen.getByText('boarding.pdf')).toBeInTheDocument();
   });
 
diff --git a/client/src/components/Planner/TransportModal.tsx b/client/src/components/Planner/TransportModal.tsx
index 9e0422185..3f349447f 100644
--- a/client/src/components/Planner/TransportModal.tsx
+++ b/client/src/components/Planner/TransportModal.tsx
@@ -55,11 +55,19 @@ function endpointFromLocation(l: LocationPoint, role: 'from' | 'to' | 'stop', se
   }
 }
 
+// "Paris Charles de Gaulle (CDG)" → "Paris Charles de Gaulle". Done as a trim
+// plus an anchored test instead of /\s*\([A-Z]{3}\)\s*$/, because the leading
+// \s* backtracks over every space in a long name for a quadratic worst case.
+function stripAirportCode(name: string): string {
+  const trimmed = name.trimEnd()
+  return /\([A-Z]{3}\)$/.test(trimmed) ? trimmed.slice(0, -5).trimEnd() : name
+}
+
 function airportFromEndpoint(e: ReservationEndpoint | undefined): Airport | null {
   if (!e || !e.code) return null
   return {
     iata: e.code, icao: null,
-    name: e.name, city: e.name.replace(/\s*\([A-Z]{3}\)\s*$/, ''),
+    name: e.name, city: stripAirportCode(e.name),
     country: '',
     lat: e.lat, lng: e.lng,
     tz: e.timezone || '',
@@ -1011,7 +1019,7 @@ export function TransportModal({ isOpen, onClose, onSave, reservation, days, sel
               <div key={f.id} className="bg-surface-secondary" style={{ display: 'flex', alignItems: 'center', gap: 8, padding: '5px 10px', borderRadius: 8 }}>
                 <FileText size={12} className="text-content-muted" style={{ flexShrink: 0 }} />
                 <span className="text-content-secondary" style={{ flex: 1, fontSize: 'calc(12px * var(--fs-scale-body, 1))', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{f.original_name}</span>
-                <a href="#" onClick={(e) => { e.preventDefault(); openFile(f.url).catch(() => {}) }} className="text-content-faint" style={{ display: 'flex', flexShrink: 0, cursor: 'pointer' }}><ExternalLink size={11} /></a>
+                <button type="button" onClick={() => { openFile(f.url).catch(() => {}) }} aria-label={t('common.open')} className="text-content-faint" style={{ background: 'none', border: 'none', padding: 0, display: 'flex', flexShrink: 0, cursor: 'pointer' }}><ExternalLink size={11} /></button>
                 <button type="button" onClick={async () => {
                   if (f.reservation_id === reservation?.id) {
                     try { await apiClient.put(`/trips/${tripId}/files/${f.id}`, { reservation_id: null }) } catch { toast.error(t('reservations.toast.updateError')) }
diff --git a/client/src/components/Planner/TravelerPicker.tsx b/client/src/components/Planner/TravelerPicker.tsx
index 68995c967..4ccb6b248 100644
--- a/client/src/components/Planner/TravelerPicker.tsx
+++ b/client/src/components/Planner/TravelerPicker.tsx
@@ -9,7 +9,7 @@ import { useTranslation } from '../../i18n'
 // picker, the card and the cost-split chips (mirrors BudgetPanel.helpers).
 function colorFor(userId: number) {
   const n = SPLIT_COLORS.length
-  return SPLIT_COLORS[((((userId | 0) - 1) % n) + n) % n]
+  return SPLIT_COLORS[(((Math.trunc(userId) - 1) % n) + n) % n]
 }
 
 function Avatar({ userId, username, avatarUrl, size = 22, dim = false }: {
diff --git a/client/src/components/Planner/placeHoursFormat.ts b/client/src/components/Planner/placeHoursFormat.ts
index 4413b0a01..02f08b8a6 100644
--- a/client/src/components/Planner/placeHoursFormat.ts
+++ b/client/src/components/Planner/placeHoursFormat.ts
@@ -15,10 +15,16 @@ export function convertHoursLine(line: string, timeFormat: string): string {
   const hasAmPm = /\d{1,2}:\d{2}\s*(AM|PM)/i.test(line)
 
   if (timeFormat === '12h' && !hasAmPm) {
-    // 24h → 12h: "10:00" → "10:00 AM", "21:00" → "9:00 PM", "Uhr" entfernen
-    return line.replace(/\s*Uhr/g, '').replace(/(\d{1,2}):(\d{2})/g, (match, h, m) => {
-      const hour = parseInt(h)
-      if (isNaN(hour)) return match
+    // 24h → 12h: "10:00" → "10:00 AM", "21:00" → "9:00 PM", "Uhr" entfernen.
+    // split/trimEnd rather than /\s*Uhr/g: that pattern walks the rest of the line
+    // from every space it passes, so a line with no "Uhr" in it costs a pass per
+    // space. Cutting on the word and trimming the piece in front of it is the
+    // same edit, once.
+    const parts = line.split('Uhr')
+    const withoutUhr = parts.map((part, i) => (i < parts.length - 1 ? part.trimEnd() : part)).join('')
+    return withoutUhr.replace(/(\d{1,2}):(\d{2})/g, (match, h, m) => {
+      const hour = Number.parseInt(h)
+      if (Number.isNaN(hour)) return match
       const period = hour >= 12 ? 'PM' : 'AM'
       const h12 = hour === 0 ? 12 : hour > 12 ? hour - 12 : hour
       return `${h12}:${m} ${period}`
@@ -27,7 +33,7 @@ export function convertHoursLine(line: string, timeFormat: string): string {
   if (timeFormat !== '12h' && hasAmPm) {
     // 12h → 24h: "10:00 AM" → "10:00", "9:00 PM" → "21:00"
     return line.replace(/(\d{1,2}):(\d{2})\s*(AM|PM)/gi, (_, h, m, p) => {
-      let hour = parseInt(h)
+      let hour = Number.parseInt(h)
       if (p.toUpperCase() === 'PM' && hour !== 12) hour += 12
       if (p.toUpperCase() === 'AM' && hour === 12) hour = 0
       return `${String(hour).padStart(2, '0')}:${m}`
diff --git a/client/src/components/Planner/placeOpenState.ts b/client/src/components/Planner/placeOpenState.ts
index 14ce51c76..764f624de 100644
--- a/client/src/components/Planner/placeOpenState.ts
+++ b/client/src/components/Planner/placeOpenState.ts
@@ -67,8 +67,8 @@ function localParts(now: Date, timeZone: string | null): { day: number; minutes:
     }).formatToParts(now)
     const value = (type: Intl.DateTimeFormatPartTypes) => parts.find(p => p.type === type)?.value ?? ''
     const day = WEEKDAY_NUMBER[value('weekday')]
-    const hour = parseInt(value('hour'), 10)
-    const minute = parseInt(value('minute'), 10)
+    const hour = Number.parseInt(value('hour'), 10)
+    const minute = Number.parseInt(value('minute'), 10)
     if (day === undefined || Number.isNaN(hour) || Number.isNaN(minute)) return null
     return {
       day,
diff --git a/client/src/components/Plugins/PluginContributions.tsx b/client/src/components/Plugins/PluginContributions.tsx
index 6972e1697..bbc9a1928 100644
--- a/client/src/components/Plugins/PluginContributions.tsx
+++ b/client/src/components/Plugins/PluginContributions.tsx
@@ -98,7 +98,7 @@ export function PluginActions({ items, tripId, className }: { items: ViewContrib
   return (
     <>
       {actions.map((a) => (
-        <button
+        <button type="button"
           key={a.pluginId + a.id}
           onClick={(e) => run(a, e)}
           title={a.label}
@@ -108,11 +108,11 @@ export function PluginActions({ items, tripId, className }: { items: ViewContrib
         </button>
       ))}
       {frame && (
-        <div className="fixed inset-0 z-[4000] flex items-center justify-center bg-black/50 p-4" onClick={() => setFrame(null)}>
-          <div className="bg-surface-card rounded-xl shadow-xl w-full max-w-lg h-[70vh] flex flex-col overflow-hidden" onClick={(e) => e.stopPropagation()}>
+        <div role="presentation" className="fixed inset-0 z-[4000] flex items-center justify-center bg-black/50 p-4" onClick={() => setFrame(null)}>
+          <div role="presentation" className="bg-surface-card rounded-xl shadow-xl w-full max-w-lg h-[70vh] flex flex-col overflow-hidden" onClick={(e) => e.stopPropagation()}>
             <div className="flex items-center justify-between px-4 py-2.5 border-b border-edge shrink-0">
               <span className="text-sm font-medium text-content truncate">{frame.label}</span>
-              <button onClick={() => setFrame(null)} className="text-content-muted hover:text-content"><X size={16} /></button>
+              <button type="button" onClick={() => setFrame(null)} className="text-content-muted hover:text-content"><X size={16} /></button>
             </div>
             <div className="flex-1 min-h-0">
               <PluginFrame pluginId={frame.pluginId} tripId={tripId != null ? String(tripId) : null} title={frame.label} fill surface="action-frame" />
diff --git a/client/src/components/Settings/AccountTab.test.tsx b/client/src/components/Settings/AccountTab.test.tsx
index 54a0abe2c..11bd84931 100644
--- a/client/src/components/Settings/AccountTab.test.tsx
+++ b/client/src/components/Settings/AccountTab.test.tsx
@@ -74,7 +74,7 @@ describe('AccountTab', () => {
     render(<><ToastContainer /><AccountTab /></>);
     await user.click(screen.getByText('Update password'));
     // Validation fires: first checks currentPassword — "Current password is required"
-    await screen.findByText(/Current password is required/i);
+    expect(await screen.findByText(/Current password is required/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-ACCOUNT-011: password mismatch shows error', async () => {
@@ -86,7 +86,7 @@ describe('AccountTab', () => {
     await user.type(passwordInputs[1], 'NewPassword1!');
     await user.type(passwordInputs[2], 'DifferentPass1!');
     await user.click(screen.getByText('Update password'));
-    await screen.findByText('Passwords do not match');
+    expect(await screen.findByText('Passwords do not match')).toBeInTheDocument();
   });
 
   it('FE-COMP-ACCOUNT-012: valid password change calls API', async () => {
@@ -140,7 +140,7 @@ describe('AccountTab – Profile', () => {
     seedStore(useAuthStore, { updateProfile: vi.fn().mockResolvedValue(undefined) });
     render(<><ToastContainer /><AccountTab /></>);
     await user.click(screen.getByRole('button', { name: /save profile/i }));
-    await screen.findByText('Profile saved');
+    expect(await screen.findByText('Profile saved')).toBeInTheDocument();
   });
 
   it('FE-COMP-ACCOUNT-016: failed save shows error toast with error message', async () => {
@@ -148,7 +148,7 @@ describe('AccountTab – Profile', () => {
     seedStore(useAuthStore, { updateProfile: vi.fn().mockRejectedValue(new Error('Server error')) });
     render(<><ToastContainer /><AccountTab /></>);
     await user.click(screen.getByRole('button', { name: /save profile/i }));
-    await screen.findByText('Server error');
+    expect(await screen.findByText('Server error')).toBeInTheDocument();
   });
 
   it('FE-COMP-ACCOUNT-017: Save button shows spinner while saving', async () => {
@@ -171,7 +171,7 @@ describe('AccountTab – Password change', () => {
     await user.type(passwordInputs[1], 'short');
     await user.type(passwordInputs[2], 'short');
     await user.click(screen.getByText('Update password'));
-    await screen.findByText(/at least 8 characters/i);
+    expect(await screen.findByText(/at least 8 characters/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-ACCOUNT-019: password change clears fields on success', async () => {
@@ -205,7 +205,7 @@ describe('AccountTab – Password change', () => {
     await user.type(passwordInputs[1], 'NewPassword1!');
     await user.type(passwordInputs[2], 'NewPassword1!');
     await user.click(screen.getByText('Update password'));
-    await screen.findByText('Wrong password');
+    expect(await screen.findByText('Wrong password')).toBeInTheDocument();
   });
 
   it('FE-COMP-ACCOUNT-021: password section hidden in OIDC-only mode', async () => {
@@ -376,7 +376,7 @@ describe('AccountTab – MFA', () => {
     const codeInput = screen.getByPlaceholderText('6-digit code');
     await user.type(codeInput, '123456');
     await user.click(screen.getByRole('button', { name: 'Disable 2FA' }));
-    await screen.findByText('Two-factor authentication disabled');
+    expect(await screen.findByText('Two-factor authentication disabled')).toBeInTheDocument();
   });
 
   it('FE-COMP-ACCOUNT-035: policy warning shown when MFA is required by policy', () => {
@@ -577,7 +577,7 @@ describe('AccountTab – Backup codes', () => {
 
     await user.click(await screen.findByRole('button', { name: 'Copy codes' }));
 
-    await screen.findByText('Error');
+    expect(await screen.findByText('Error')).toBeInTheDocument();
   });
 
   it('FE-COMP-ACCOUNT-052: Download TXT builds a blob, names the file and revokes the URL', async () => {
@@ -682,7 +682,7 @@ describe('AccountTab – Avatar upload', () => {
     const input = document.querySelector('input[type="file"]') as HTMLInputElement;
     await user.upload(input, new File(['avatar'], 'me.png', { type: 'image/png' }));
 
-    await screen.findByText('Upload failed');
+    expect(await screen.findByText('Upload failed')).toBeInTheDocument();
   });
 
   it('FE-COMP-ACCOUNT-058: a change event without a file uploads nothing', () => {
@@ -723,7 +723,7 @@ describe('AccountTab – Avatar upload', () => {
     const fileInput = document.querySelector('input[type="file"]') as HTMLInputElement;
     await user.click(fileInput.parentElement!.querySelectorAll('button')[1]);
 
-    await screen.findByText('Upload failed');
+    expect(await screen.findByText('Upload failed')).toBeInTheDocument();
   });
 });
 
diff --git a/client/src/components/Settings/AccountTab.tsx b/client/src/components/Settings/AccountTab.tsx
index e9a2488b6..126d296d6 100644
--- a/client/src/components/Settings/AccountTab.tsx
+++ b/client/src/components/Settings/AccountTab.tsx
@@ -13,6 +13,14 @@ import PasskeysSection from './PasskeysSection'
 
 const MFA_BACKUP_SESSION_KEY = 'trek_mfa_backup_codes_pending'
 
+// Drops every trailing slash, like the `/\/+$/` replace it stands in for — as a scan,
+// because that pattern re-walks the slash run from each start position.
+const stripTrailingSlashes = (value: string): string => {
+  let end = value.length
+  while (end > 0 && value[end - 1] === '/') end--
+  return value.slice(0, end)
+}
+
 export default function AccountTab(): React.ReactElement {
   const { user, updateProfile, uploadAvatar, deleteAvatar, logout, loadUser, demoMode, appRequireMfa } = useAuthStore()
   const [searchParams] = useSearchParams()
@@ -198,7 +206,7 @@ export default function AccountTab(): React.ReactElement {
                 placeholder={t('settings.confirmPassword')}
                 className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
               />
-              <button
+              <button type="button"
                 onClick={async () => {
                   if (!currentPassword) return toast.error(t('settings.currentPasswordRequired'))
                   if (!newPassword) return toast.error(t('settings.passwordRequired'))
@@ -415,7 +423,7 @@ export default function AccountTab(): React.ReactElement {
               </div>
             )}
             <input ref={avatarInputRef} type="file" accept="image/*" onChange={handleAvatarUpload} style={{ display: 'none' }} />
-            <button
+            <button type="button"
               onClick={() => avatarInputRef.current?.click()}
               style={{
                 position: 'absolute', bottom: -3, right: -3,
@@ -431,7 +439,7 @@ export default function AccountTab(): React.ReactElement {
               <Camera size={14} />
             </button>
             {user?.avatar_url && (
-              <button
+              <button type="button"
                 onClick={handleAvatarRemove}
                 className="bg-[#ef4444] text-white"
                 style={{
@@ -463,14 +471,14 @@ export default function AccountTab(): React.ReactElement {
             </div>
             {(user as UserWithOidc)?.oidc_issuer && (
               <p className="text-content-faint" style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', marginTop: -2 }}>
-                {t('settings.oidcLinked')} {(user as UserWithOidc).oidc_issuer!.replace('https://', '').replace(/\/+$/, '')}
+                {t('settings.oidcLinked')} {stripTrailingSlashes((user as UserWithOidc).oidc_issuer!.replace('https://', ''))}
               </p>
             )}
           </div>
         </div>
 
         <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginTop: 12 }}>
-          <button
+          <button type="button"
             onClick={saveProfile}
             disabled={saving}
             className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
@@ -479,7 +487,7 @@ export default function AccountTab(): React.ReactElement {
             <span className="hidden sm:inline">{t('settings.saveProfile')}</span>
             <span className="sm:hidden">{t('common.save')}</span>
           </button>
-          <button
+          <button type="button"
             onClick={async () => {
               if (user?.role === 'admin') {
                 try {
@@ -508,11 +516,11 @@ export default function AccountTab(): React.ReactElement {
           position: 'fixed', inset: 0, zIndex: 9999,
           backdropFilter: 'blur(4px)',
           display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 24,
-        }} onClick={() => setShowDeleteConfirm(false)}>
+        }} role="presentation" onClick={e => { if (e.target === e.currentTarget) setShowDeleteConfirm(false) }}>
           <div className="bg-surface-card" style={{
             borderRadius: 16, padding: '28px 24px',
             maxWidth: 400, width: '100%', boxShadow: '0 20px 60px rgba(0,0,0,0.3)',
-          }} onClick={e => e.stopPropagation()}>
+          }}>
             <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 16 }}>
               <div className="bg-[#fef3c7]" style={{ width: 36, height: 36, borderRadius: 10, display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
                 <Shield size={18} className="text-[#d97706]" />
@@ -523,7 +531,7 @@ export default function AccountTab(): React.ReactElement {
               {t('settings.deleteBlockedMessage')}
             </p>
             <div style={{ display: 'flex', justifyContent: 'flex-end' }}>
-              <button
+              <button type="button"
                 onClick={() => setShowDeleteConfirm(false)}
                 className="border border-edge bg-surface-card text-content-secondary"
                 style={{
@@ -544,11 +552,11 @@ export default function AccountTab(): React.ReactElement {
           position: 'fixed', inset: 0, zIndex: 9999,
           backdropFilter: 'blur(4px)',
           display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 24,
-        }} onClick={() => setShowDeleteConfirm(false)}>
+        }} role="presentation" onClick={e => { if (e.target === e.currentTarget) setShowDeleteConfirm(false) }}>
           <div className="bg-surface-card" style={{
             borderRadius: 16, padding: '28px 24px',
             maxWidth: 400, width: '100%', boxShadow: '0 20px 60px rgba(0,0,0,0.3)',
-          }} onClick={e => e.stopPropagation()}>
+          }}>
             <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 16 }}>
               <div className="bg-[#fef2f2]" style={{ width: 36, height: 36, borderRadius: 10, display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
                 <Trash2 size={18} className="text-[#ef4444]" />
@@ -559,7 +567,7 @@ export default function AccountTab(): React.ReactElement {
               {t('settings.deleteAccountWarning')}
             </p>
             <div style={{ display: 'flex', justifyContent: 'flex-end', gap: 8 }}>
-              <button
+              <button type="button"
                 onClick={() => setShowDeleteConfirm(false)}
                 className="border border-edge bg-surface-card text-content-secondary"
                 style={{
@@ -569,7 +577,7 @@ export default function AccountTab(): React.ReactElement {
               >
                 {t('common.cancel')}
               </button>
-              <button
+              <button type="button"
                 onClick={async () => {
                   try {
                     await authApi.deleteOwnAccount()
diff --git a/client/src/components/Settings/AirTrailConnectionSection.test.tsx b/client/src/components/Settings/AirTrailConnectionSection.test.tsx
index 753f7cf77..301d3ccbf 100644
--- a/client/src/components/Settings/AirTrailConnectionSection.test.tsx
+++ b/client/src/components/Settings/AirTrailConnectionSection.test.tsx
@@ -177,7 +177,7 @@ describe('AirTrailConnectionSection', () => {
     await screen.findByDisplayValue('https://air.example.com');
     await user.click(screen.getByRole('button', { name: /^Save$/ }));
 
-    await screen.findByText('Not connected');
+    expect(await screen.findByText('Not connected')).toBeInTheDocument();
   });
 
   it('FE-COMP-AIRTRAIL-010: a rejected save surfaces the server error message', async () => {
@@ -193,7 +193,7 @@ describe('AirTrailConnectionSection', () => {
     await screen.findByDisplayValue('https://air.example.com');
     await user.click(screen.getByRole('button', { name: /^Save$/ }));
 
-    await screen.findByText('Instance unreachable');
+    expect(await screen.findByText('Instance unreachable')).toBeInTheDocument();
   });
 
   it('FE-COMP-AIRTRAIL-011: a save failure without a server message falls back to the generic error', async () => {
@@ -207,7 +207,7 @@ describe('AirTrailConnectionSection', () => {
     await screen.findByDisplayValue('https://air.example.com');
     await user.click(screen.getByRole('button', { name: /^Save$/ }));
 
-    await screen.findByText('Could not save the connection');
+    expect(await screen.findByText('Could not save the connection')).toBeInTheDocument();
   });
 
   it('FE-COMP-AIRTRAIL-012: Save is locked while the request is in flight', async () => {
@@ -265,7 +265,7 @@ describe('AirTrailConnectionSection', () => {
     await screen.findByDisplayValue('https://air.example.com');
     await user.click(screen.getByRole('button', { name: /Test connection/ }));
 
-    await screen.findByText('Connected — 0 flight(s) found');
+    expect(await screen.findByText('Connected — 0 flight(s) found')).toBeInTheDocument();
   });
 
   it('FE-COMP-AIRTRAIL-015: a refused test shows the returned error and keeps the badge off', async () => {
diff --git a/client/src/components/Settings/AirTrailConnectionSection.tsx b/client/src/components/Settings/AirTrailConnectionSection.tsx
index d41d46948..1482217c7 100644
--- a/client/src/components/Settings/AirTrailConnectionSection.tsx
+++ b/client/src/components/Settings/AirTrailConnectionSection.tsx
@@ -118,14 +118,14 @@ export default function AirTrailConnectionSection(): React.ReactElement {
         </div>
 
         <div className="flex flex-wrap items-center gap-3">
-          <button
+          <button type="button"
             onClick={handleSave}
             disabled={saving || loading || !canSave}
             className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
           >
             <Save className="w-4 h-4" /> {t('common.save')}
           </button>
-          <button
+          <button type="button"
             onClick={handleTest}
             disabled={testing || loading || !url.trim()}
             className="flex items-center gap-2 px-4 py-2 border border-slate-200 rounded-lg text-sm hover:bg-slate-50"
diff --git a/client/src/components/Settings/AppearanceSettingsTab.test.tsx b/client/src/components/Settings/AppearanceSettingsTab.test.tsx
index 61ddaa6de..3317a818a 100644
--- a/client/src/components/Settings/AppearanceSettingsTab.test.tsx
+++ b/client/src/components/Settings/AppearanceSettingsTab.test.tsx
@@ -120,7 +120,7 @@ describe('AppearanceSettingsTab – custom accent and sliders', () => {
 
     await user.click(screen.getByText('Teal'));
 
-    await screen.findByText('Appearance rejected', undefined, PERSIST);
+    expect(await screen.findByText('Appearance rejected', undefined, PERSIST)).toBeInTheDocument();
   });
 
   it('FE-COMP-APPEARANCE-011: a failing colour-mode change surfaces the error toast', async () => {
@@ -130,7 +130,7 @@ describe('AppearanceSettingsTab – custom accent and sliders', () => {
 
     await user.click(screen.getByText('Dark'));
 
-    await screen.findByText('Mode rejected');
+    expect(await screen.findByText('Mode rejected')).toBeInTheDocument();
   });
 
   it('FE-COMP-APPEARANCE-012: picking Custom reveals the accent picker', async () => {
diff --git a/client/src/components/Settings/AppearanceSettingsTab.tsx b/client/src/components/Settings/AppearanceSettingsTab.tsx
index 46893a1e8..ca53525ba 100644
--- a/client/src/components/Settings/AppearanceSettingsTab.tsx
+++ b/client/src/components/Settings/AppearanceSettingsTab.tsx
@@ -22,9 +22,9 @@ function channelLum(v: number): number {
 function relLuminance(hex: string): number {
   const c = hex.replace('#', '')
   const full = c.length === 3 ? c.split('').map((x) => x + x).join('') : c
-  const r = channelLum(parseInt(full.slice(0, 2), 16) / 255)
-  const g = channelLum(parseInt(full.slice(2, 4), 16) / 255)
-  const b = channelLum(parseInt(full.slice(4, 6), 16) / 255)
+  const r = channelLum(Number.parseInt(full.slice(0, 2), 16) / 255)
+  const g = channelLum(Number.parseInt(full.slice(2, 4), 16) / 255)
+  const b = channelLum(Number.parseInt(full.slice(4, 6), 16) / 255)
   return 0.2126 * r + 0.7152 * g + 0.0722 * b
 }
 function contrastRatio(a: string, b: string): number {
@@ -139,7 +139,7 @@ export default function AppearanceSettingsTab(): React.ReactElement {
 
   const accentLight = cfg.accent?.light ?? '#4f46e5'
   const accentDark = cfg.accent?.dark ?? '#6366f1'
-  const customRatio = contrastRatio(isDark ? accentDark : accentLight, isDark ? '#ffffff' : '#ffffff')
+  const customRatio = contrastRatio(isDark ? accentDark : accentLight, '#ffffff')
 
   return (
     <>
@@ -162,7 +162,7 @@ export default function AppearanceSettingsTab(): React.ReactElement {
                 (opt.value === 'light' && cur === false) ||
                 (opt.value === 'dark' && cur === true)
               return (
-                <button key={opt.value} onClick={() => setMode(opt.value)} style={segStyle(active)}>
+                <button type="button" key={opt.value} onClick={() => setMode(opt.value)} style={segStyle(active)}>
                   <span className="hidden sm:inline-flex"><opt.icon size={16} /></span>
                   {opt.value === 'auto' ? (
                     <>
@@ -186,7 +186,7 @@ export default function AppearanceSettingsTab(): React.ReactElement {
               const active = cfg.schemeId === s.id
               const dot = isDark ? s.swatch.dark : s.swatch.light
               return (
-                <button
+                <button type="button"
                   key={s.id}
                   onClick={() => update({ schemeId: s.id })}
                   style={{
@@ -205,7 +205,7 @@ export default function AppearanceSettingsTab(): React.ReactElement {
               )
             })}
             {/* Custom */}
-            <button
+            <button type="button"
               onClick={() => update({ schemeId: 'custom', accent: cfg.accent ?? { light: accentLight, dark: accentDark } })}
               style={{
                 display: 'flex', alignItems: 'center', gap: 8, padding: '10px 12px', borderRadius: 10,
@@ -229,7 +229,7 @@ export default function AppearanceSettingsTab(): React.ReactElement {
             </label>
             <div className="flex flex-wrap gap-2 mb-3">
               {CUSTOM_ACCENT_PRESETS.map((c) => (
-                <button
+                <button type="button"
                   key={c}
                   aria-label={c}
                   onClick={() => update({ accent: { light: c, dark: c } })}
@@ -296,7 +296,7 @@ export default function AppearanceSettingsTab(): React.ReactElement {
               { value: 'comfortable', label: tr('settings.appearance.comfortable', 'Comfortable') },
               { value: 'compact', label: tr('settings.appearance.compact', 'Compact') },
             ].map((opt) => (
-              <button key={opt.value} onClick={() => update({ density: opt.value as AppearanceConfig['density'] })} style={segStyle(cfg.density === opt.value)}>
+              <button type="button" key={opt.value} onClick={() => update({ density: opt.value as AppearanceConfig['density'] })} style={segStyle(cfg.density === opt.value)}>
                 {opt.label}
               </button>
             ))}
@@ -413,7 +413,7 @@ export default function AppearanceSettingsTab(): React.ReactElement {
       </Section>
 
       <div className="flex justify-end mb-6">
-        <button
+        <button type="button"
           onClick={resetAll}
           className="flex items-center gap-2 text-sm font-medium text-content-muted hover:text-content"
           style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '6px 4px' }}
diff --git a/client/src/components/Settings/DisplaySettingsTab.test.tsx b/client/src/components/Settings/DisplaySettingsTab.test.tsx
index 66d565e87..54f22de99 100644
--- a/client/src/components/Settings/DisplaySettingsTab.test.tsx
+++ b/client/src/components/Settings/DisplaySettingsTab.test.tsx
@@ -165,7 +165,7 @@ describe('DisplaySettingsTab', () => {
     seedStore(useSettingsStore, { settings: buildSettings({ temperature_unit: 'celsius' }), updateSetting });
     render(<><ToastContainer /><DisplaySettingsTab /></>);
     await user.click(screen.getByText('°F Fahrenheit'));
-    await screen.findByText('Server error');
+    expect(await screen.findByText('Server error')).toBeInTheDocument();
   });
 
   it('FE-COMP-DISPLAY-027: temperature unit local state updates optimistically before API resolves', async () => {
@@ -214,7 +214,7 @@ describe('DisplaySettingsTab – Display currency', () => {
     await user.click(screen.getByRole('button', { name: /USD/ }));
     await user.click(await screen.findByText('Trip currency'));
 
-    await screen.findByText('Currency locked');
+    expect(await screen.findByText('Currency locked')).toBeInTheDocument();
   });
 });
 
@@ -261,7 +261,7 @@ describe('DisplaySettingsTab – Compact language picker', () => {
     await user.click(within(wrap).getByRole('button'));
     await user.click(within(wrap).getByText('Deutsch').closest('button')!);
 
-    await screen.findByText('Language locked');
+    expect(await screen.findByText('Language locked')).toBeInTheDocument();
   });
 
   it('FE-COMP-DISPLAY-048: a rejected pick from the desktop grid surfaces the error', async () => {
@@ -271,7 +271,7 @@ describe('DisplaySettingsTab – Compact language picker', () => {
 
     await user.click(screen.getByText('Deutsch'));
 
-    await screen.findByText('Language locked');
+    expect(await screen.findByText('Language locked')).toBeInTheDocument();
   });
 
   it('FE-COMP-DISPLAY-038: a mousedown outside the picker closes it', async () => {
@@ -320,7 +320,7 @@ describe('DisplaySettingsTab – Map and privacy toggles', () => {
 
     await user.click(within(optionBlock(/booking route labels/i)).getByText(/^On$/));
 
-    await screen.findByText('Labels locked');
+    expect(await screen.findByText('Labels locked')).toBeInTheDocument();
   });
 
   it('FE-COMP-DISPLAY-042: a rejected always-show-routes change surfaces the error', async () => {
@@ -330,7 +330,7 @@ describe('DisplaySettingsTab – Map and privacy toggles', () => {
 
     await user.click(within(optionBlock(/always show booking routes/i)).getByText(/^On$/));
 
-    await screen.findByText('Routes locked');
+    expect(await screen.findByText('Routes locked')).toBeInTheDocument();
   });
 
   it('FE-COMP-DISPLAY-043: the POI pill defaults to On and can be turned off', async () => {
@@ -353,7 +353,7 @@ describe('DisplaySettingsTab – Map and privacy toggles', () => {
 
     await user.click(within(optionBlock(/explore places on the map/i)).getByText(/^Off$/));
 
-    await screen.findByText('POI locked');
+    expect(await screen.findByText('POI locked')).toBeInTheDocument();
   });
 
   it('FE-COMP-DISPLAY-045: turning blur booking codes on persists true', async () => {
@@ -441,6 +441,6 @@ describe('DisplaySettingsTab – startup destination', () => {
 
     await user.click(within(optionBlock(/^Start page$/)).getByText('Active trip'));
 
-    await screen.findByText('Start locked');
+    expect(await screen.findByText('Start locked')).toBeInTheDocument();
   });
 });
diff --git a/client/src/components/Settings/DisplaySettingsTab.tsx b/client/src/components/Settings/DisplaySettingsTab.tsx
index 76bc6b91b..995c80517 100644
--- a/client/src/components/Settings/DisplaySettingsTab.tsx
+++ b/client/src/components/Settings/DisplaySettingsTab.tsx
@@ -50,7 +50,7 @@ export default function DisplaySettingsTab(): React.ReactElement {
             { value: 'dashboard', label: t('settings.startPageDashboard') },
             { value: 'active_trip', label: t('settings.startPageActiveTrip') },
           ] as const).map(opt => (
-            <button
+            <button type="button"
               key={opt.value}
               onClick={async () => {
                 try { await updateSetting('start_page', opt.value) }
@@ -117,7 +117,7 @@ export default function DisplaySettingsTab(): React.ReactElement {
         {/* Desktop: Button grid */}
         <div className="hidden sm:flex flex-wrap gap-3">
           {SUPPORTED_LANGUAGES.map(opt => (
-            <button
+            <button type="button"
               key={opt.value}
               onClick={async () => {
                 try { await updateSetting('language', opt.value) }
@@ -201,7 +201,7 @@ export default function DisplaySettingsTab(): React.ReactElement {
             { value: 'celsius', label: '°C Celsius' },
             { value: 'fahrenheit', label: '°F Fahrenheit' },
           ].map(opt => (
-            <button
+            <button type="button"
               key={opt.value}
               onClick={async () => {
                 setTempUnit(opt.value)
@@ -232,7 +232,7 @@ export default function DisplaySettingsTab(): React.ReactElement {
             { value: 'metric', label: 'km Metric' },
             { value: 'imperial', label: 'mi Imperial' },
           ] as const).map(opt => (
-            <button
+            <button type="button"
               key={opt.value}
               onClick={async () => {
                 setDistanceUnit(opt.value)
@@ -263,7 +263,7 @@ export default function DisplaySettingsTab(): React.ReactElement {
             { value: '24h', short: '24h', example: '14:30' },
             { value: '12h', short: '12h', example: '2:30 PM' },
           ].map(opt => (
-            <button
+            <button type="button"
               key={opt.value}
               onClick={async () => {
                 try { await updateSetting('time_format', opt.value) }
@@ -296,7 +296,7 @@ export default function DisplaySettingsTab(): React.ReactElement {
             { value: true, label: t('settings.on') || 'On' },
             { value: false, label: t('settings.off') || 'Off' },
           ].map(opt => (
-            <button
+            <button type="button"
               key={String(opt.value)}
               onClick={async () => {
                 try { await updateSetting('map_booking_labels', opt.value) }
@@ -327,7 +327,7 @@ export default function DisplaySettingsTab(): React.ReactElement {
             { value: true, label: t('settings.on') || 'On' },
             { value: false, label: t('settings.off') || 'Off' },
           ].map(opt => (
-            <button
+            <button type="button"
               key={String(opt.value)}
               onClick={async () => {
                 try { await updateSetting('map_always_show_routes', opt.value) }
@@ -358,7 +358,7 @@ export default function DisplaySettingsTab(): React.ReactElement {
             { value: true, label: t('settings.on') || 'On' },
             { value: false, label: t('settings.off') || 'Off' },
           ].map(opt => (
-            <button
+            <button type="button"
               key={String(opt.value)}
               onClick={async () => {
                 try { await updateSetting('map_poi_pill_enabled', opt.value) }
@@ -389,7 +389,7 @@ export default function DisplaySettingsTab(): React.ReactElement {
             { value: true, label: t('settings.on') || 'On' },
             { value: false, label: t('settings.off') || 'Off' },
           ].map(opt => (
-            <button
+            <button type="button"
               key={String(opt.value)}
               onClick={async () => {
                 try { await updateSetting('blur_booking_codes', opt.value) }
@@ -419,7 +419,7 @@ export default function DisplaySettingsTab(): React.ReactElement {
             { value: true, label: t('settings.on') || 'On' },
             { value: false, label: t('settings.off') || 'Off' },
           ].map(opt => (
-            <button
+            <button type="button"
               key={String(opt.value)}
               onClick={async () => {
                 try { await updateSetting('optimize_from_accommodation', opt.value) }
diff --git a/client/src/components/Settings/IntegrationsTab.test.tsx b/client/src/components/Settings/IntegrationsTab.test.tsx
index 47ec0e49d..b60726f98 100644
--- a/client/src/components/Settings/IntegrationsTab.test.tsx
+++ b/client/src/components/Settings/IntegrationsTab.test.tsx
@@ -60,7 +60,7 @@ describe('IntegrationsTab', () => {
   it('FE-COMP-INTEGRATIONS-003: MCP section is visible when mcp addon is enabled', async () => {
     enableMcp();
     render(<IntegrationsTab />);
-    await screen.findByText('MCP Configuration');
+    expect(await screen.findByText('MCP Configuration')).toBeInTheDocument();
   });
 
   it('FE-COMP-INTEGRATIONS-004: MCP endpoint URL is displayed', async () => {
@@ -92,7 +92,7 @@ describe('IntegrationsTab', () => {
     render(<IntegrationsTab />);
     await screen.findByText('MCP Configuration');
     await user.click(screen.getByRole('button', { name: /API Tokens/i }));
-    await screen.findByText('No tokens yet. Create one to connect MCP clients.');
+    expect(await screen.findByText('No tokens yet. Create one to connect MCP clients.')).toBeInTheDocument();
   });
 
   it('FE-COMP-INTEGRATIONS-007: token list renders when tokens exist', async () => {
@@ -112,7 +112,7 @@ describe('IntegrationsTab', () => {
     await screen.findByText('MCP Configuration');
     await user.click(screen.getByRole('button', { name: /API Tokens/i }));
     await screen.findByText('My Token');
-    await screen.findByText('Other Token');
+    expect(await screen.findByText('Other Token')).toBeInTheDocument();
   });
 
   it('FE-COMP-INTEGRATIONS-008: clicking "Create New Token" button opens the modal', async () => {
@@ -123,7 +123,7 @@ describe('IntegrationsTab', () => {
     await user.click(screen.getByRole('button', { name: /API Tokens/i }));
     const createBtn = screen.getByRole('button', { name: /Create New Token/i });
     await user.click(createBtn);
-    await screen.findByText('Create API Token');
+    expect(await screen.findByText('Create API Token')).toBeInTheDocument();
   });
 
   it('FE-COMP-INTEGRATIONS-009: Create button in modal is disabled when name is empty', async () => {
@@ -591,7 +591,7 @@ describe('IntegrationsTab', () => {
     // Confirm — button text is 'Rotate'
     const rotateBtns = screen.getAllByRole('button', { name: /^Rotate$/i });
     await user.click(rotateBtns[rotateBtns.length - 1]);
-    await screen.findByText(/new-rotated-secret/);
+    expect(await screen.findByText(/new-rotated-secret/)).toBeInTheDocument();
   });
 
   it('FE-COMP-INTEGRATIONS-030: revoke OAuth session removes it from list', async () => {
@@ -649,7 +649,7 @@ describe('IntegrationsTab', () => {
     await user.type(screen.getByPlaceholderText(/Claude Web, My MCP App/i), 'Fail Client');
     await user.type(screen.getByPlaceholderText(/https:\/\/your-app/i), 'http://localhost');
     await user.click(screen.getByRole('button', { name: /Register Client/i }));
-    await screen.findByText(/Failed to register/i);
+    expect(await screen.findByText(/Failed to register/i)).toBeInTheDocument();
   });
 });
 
@@ -893,7 +893,7 @@ describe('IntegrationsTab – failure toasts', () => {
     await user.type(screen.getByPlaceholderText(/Claude Desktop/i), 'Doomed');
     await user.click(screen.getByRole('button', { name: /^Create Token$/i }));
 
-    await screen.findByText('Failed to create token');
+    expect(await screen.findByText('Failed to create token')).toBeInTheDocument();
   });
 
   it('FE-COMP-INTEGRATIONS-045: a failing token deletion toasts and keeps the token', async () => {
@@ -934,7 +934,7 @@ describe('IntegrationsTab – failure toasts', () => {
     await user.click(screen.getByTitle('Rotate Secret'));
     const rotateBtns = await screen.findAllByRole('button', { name: /^Rotate$/i });
     await user.click(rotateBtns[rotateBtns.length - 1]);
-    await screen.findByText('Failed to rotate client secret');
+    expect(await screen.findByText('Failed to rotate client secret')).toBeInTheDocument();
   });
 
   it('FE-COMP-INTEGRATIONS-047: a failing session revoke toasts and keeps the session', async () => {
diff --git a/client/src/components/Settings/IntegrationsTab.tsx b/client/src/components/Settings/IntegrationsTab.tsx
index 8a4654404..b0aaaac38 100644
--- a/client/src/components/Settings/IntegrationsTab.tsx
+++ b/client/src/components/Settings/IntegrationsTab.tsx
@@ -320,7 +320,7 @@ function IntegrationsMcpSection(props: any) {
               <code className="flex-1 px-3 py-2 rounded-lg text-sm font-mono border bg-surface-secondary border-edge text-content">
                 {mcpEndpoint}
               </code>
-              <button onClick={() => handleCopy(mcpEndpoint, 'endpoint')}
+              <button type="button" onClick={() => handleCopy(mcpEndpoint, 'endpoint')}
                 className="p-2 rounded-lg border border-edge transition-colors hover:bg-slate-100 dark:hover:bg-slate-700"
                 title={t('settings.mcp.copy')}>
                 {copiedKey === 'endpoint' ? <Check className="w-4 h-4 text-green-500" /> : <Copy className="w-4 h-4 text-content-secondary" />}
@@ -330,14 +330,14 @@ function IntegrationsMcpSection(props: any) {
 
           {/* Sub-tab bar */}
           <div className="flex gap-1 rounded-lg p-1 border bg-surface-secondary border-edge">
-            <button
+            <button type="button"
               onClick={() => setActiveMcpTab('oauth')}
               className={`flex-1 px-3 py-1.5 text-sm font-medium rounded-md transition-colors ${
                 activeMcpTab === 'oauth' ? 'bg-slate-900 text-white' : 'text-slate-600 hover:text-slate-900 hover:bg-slate-50'
               }`}>
               {t('settings.oauth.clients')}
             </button>
-            <button
+            <button type="button"
               onClick={() => setActiveMcpTab('apitokens')}
               className={`flex-1 px-3 py-1.5 text-sm font-medium rounded-md transition-colors flex items-center justify-center gap-2 ${
                 activeMcpTab === 'apitokens' ? 'bg-slate-900 text-white' : 'text-slate-600 hover:text-slate-900 hover:bg-slate-50'
@@ -354,7 +354,7 @@ function IntegrationsMcpSection(props: any) {
             <>
               {/* JSON config — OAuth (collapsible) */}
               <div className="rounded-lg border overflow-hidden border-edge">
-                <button
+                <button type="button"
                   onClick={() => setConfigOpenOAuth(o => !o)}
                   className="w-full flex items-center justify-between px-3 py-2.5 transition-colors hover:bg-slate-50 dark:hover:bg-slate-800 bg-surface-secondary">
                   <span className="text-sm font-medium text-content-secondary">{t('settings.mcp.clientConfig')}</span>
@@ -363,7 +363,7 @@ function IntegrationsMcpSection(props: any) {
                 {configOpenOAuth && (
                   <div className="p-3 border-t border-edge">
                     <div className="flex justify-end mb-1.5">
-                      <button onClick={() => handleCopy(mcpJsonConfigOAuth, 'json-oauth')}
+                      <button type="button" onClick={() => handleCopy(mcpJsonConfigOAuth, 'json-oauth')}
                         className="flex items-center gap-1.5 px-2.5 py-1 rounded text-xs border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700 border-edge text-content-secondary">
                         {copiedKey === 'json-oauth' ? <Check className="w-3 h-3 text-green-500" /> : <Copy className="w-3 h-3" />}
                         {copiedKey === 'json-oauth' ? t('settings.mcp.copied') : t('settings.mcp.copy')}
@@ -381,7 +381,7 @@ function IntegrationsMcpSection(props: any) {
                 <p className="text-xs mb-3" style={{ color: 'var(--text-tertiary)' }}>{t('settings.oauth.clientsHint')}</p>
 
                 <div className="flex justify-end mb-2">
-                  <button onClick={() => { setOauthCreateOpen(true); setOauthCreatedClient(null); setOauthNewName(''); setOauthNewUris(''); setOauthNewScopes([]); setOauthIsMachine(false) }}
+                  <button type="button" onClick={() => { setOauthCreateOpen(true); setOauthCreatedClient(null); setOauthNewName(''); setOauthNewUris(''); setOauthNewScopes([]); setOauthIsMachine(false) }}
                     className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm font-medium transition-colors bg-slate-900 text-white hover:bg-slate-700">
                     <Plus className="w-3.5 h-3.5" /> {t('settings.oauth.createClient')}
                   </button>
@@ -416,6 +416,7 @@ function IntegrationsMcpSection(props: any) {
                               ))}
                               {client.allowed_scopes.length > 5 && (
                                 <button
+                                  type="button"
                                   onClick={() => setOauthScopesExpanded(prev => ({ ...prev, [client.id]: !prev[client.id] }))}
                                   className="px-1.5 py-0.5 rounded text-xs transition-colors hover:bg-slate-100 dark:hover:bg-slate-700 border border-edge"
                                   style={{ color: 'var(--text-tertiary)' }}>
@@ -424,12 +425,12 @@ function IntegrationsMcpSection(props: any) {
                               )}
                             </div>
                           </div>
-                          <button onClick={() => setOauthRotateId(client.id)}
+                          <button type="button" onClick={() => setOauthRotateId(client.id)}
                             className="p-1.5 rounded-lg transition-colors hover:bg-amber-50 hover:text-amber-600 dark:hover:bg-amber-900/20"
                             style={{ color: 'var(--text-tertiary)' }} title={t('settings.oauth.rotateSecret')}>
                             <RefreshCw className="w-4 h-4" />
                           </button>
-                          <button onClick={() => setOauthDeleteId(client.id)}
+                          <button type="button" onClick={() => setOauthDeleteId(client.id)}
                             className="p-1.5 rounded-lg transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
                             style={{ color: 'var(--text-tertiary)' }} title={t('settings.oauth.deleteClient')}>
                             <Trash2 className="w-4 h-4" />
@@ -455,7 +456,7 @@ function IntegrationsMcpSection(props: any) {
                             <span className="ml-3">{t('settings.oauth.sessionExpires')} {new Date(session.access_token_expires_at).toLocaleDateString(locale)}</span>
                           </p>
                         </div>
-                        <button onClick={() => setOauthRevokeId(session.id)}
+                        <button type="button" onClick={() => setOauthRevokeId(session.id)}
                           className="px-2.5 py-1 rounded text-xs border transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20 border-edge"
                           style={{ color: 'var(--text-tertiary)' }}>
                           {t('settings.oauth.revoke')}
@@ -478,7 +479,7 @@ function IntegrationsMcpSection(props: any) {
 
               {/* JSON config — API Token (collapsible) */}
               <div className="rounded-lg border overflow-hidden border-edge">
-                <button
+                <button type="button"
                   onClick={() => setConfigOpenToken(o => !o)}
                   className="w-full flex items-center justify-between px-3 py-2.5 transition-colors hover:bg-slate-50 dark:hover:bg-slate-800 bg-surface-secondary">
                   <span className="text-sm font-medium text-content-secondary">{t('settings.mcp.clientConfig')}</span>
@@ -487,7 +488,7 @@ function IntegrationsMcpSection(props: any) {
                 {configOpenToken && (
                   <div className="p-3 border-t border-edge">
                     <div className="flex justify-end mb-1.5">
-                      <button onClick={() => handleCopy(mcpJsonConfig, 'json-token')}
+                      <button type="button" onClick={() => handleCopy(mcpJsonConfig, 'json-token')}
                         className="flex items-center gap-1.5 px-2.5 py-1 rounded text-xs border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700 border-edge text-content-secondary">
                         {copiedKey === 'json-token' ? <Check className="w-3 h-3 text-green-500" /> : <Copy className="w-3 h-3" />}
                         {copiedKey === 'json-token' ? t('settings.mcp.copied') : t('settings.mcp.copy')}
@@ -502,7 +503,7 @@ function IntegrationsMcpSection(props: any) {
               </div>
 
               <div className="flex justify-end">
-                <button onClick={() => { setMcpModalOpen(true); setMcpCreatedToken(null); setMcpNewName('') }}
+                <button type="button" onClick={() => { setMcpModalOpen(true); setMcpCreatedToken(null); setMcpNewName('') }}
                   className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm font-medium transition-colors opacity-60 text-content-secondary bg-surface-tertiary">
                   <Plus className="w-3.5 h-3.5" /> {t('settings.mcp.createToken')}
                 </button>
@@ -526,7 +527,7 @@ function IntegrationsMcpSection(props: any) {
                           )}
                         </p>
                       </div>
-                      <button onClick={() => setMcpDeleteId(token.id)}
+                      <button type="button" onClick={() => setMcpDeleteId(token.id)}
                         className="p-1.5 rounded-lg transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
                         style={{ color: 'var(--text-tertiary)' }} title={t('settings.mcp.deleteTokenTitle')}>
                         <Trash2 className="w-4 h-4" />
@@ -549,7 +550,7 @@ function McpTokenModals(props: any) {
     <>
       {/* Create MCP Token modal */}
       {mcpModalOpen && (
-        <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
+        <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
           onClick={e => { if (e.target === e.currentTarget && !mcpCreatedToken) setMcpModalOpen(false) }}>
           <div className="rounded-xl shadow-xl w-full max-w-md p-6 space-y-4 bg-surface-card">
             {!mcpCreatedToken ? (
@@ -564,11 +565,11 @@ function McpTokenModals(props: any) {
                     autoFocus />
                 </div>
                 <div className="flex gap-2 justify-end pt-1">
-                  <button onClick={() => setMcpModalOpen(false)}
+                  <button type="button" onClick={() => setMcpModalOpen(false)}
                     className="px-4 py-2 rounded-lg text-sm border border-edge text-content-secondary">
                     {t('common.cancel')}
                   </button>
-                  <button onClick={handleCreateMcpToken} disabled={!mcpNewName.trim() || mcpCreating}
+                  <button type="button" onClick={handleCreateMcpToken} disabled={!mcpNewName.trim() || mcpCreating}
                     className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700 disabled:opacity-50">
                     {mcpCreating ? t('settings.mcp.modal.creating') : t('settings.mcp.modal.create')}
                   </button>
@@ -585,14 +586,14 @@ function McpTokenModals(props: any) {
                   <pre className="p-3 pr-10 rounded-lg text-xs font-mono break-all border whitespace-pre-wrap bg-surface-secondary border-edge text-content">
                     {mcpCreatedToken}
                   </pre>
-                  <button onClick={() => handleCopy(mcpCreatedToken, 'new-token')}
+                  <button type="button" onClick={() => handleCopy(mcpCreatedToken, 'new-token')}
                     className="absolute top-2 right-2 p-1.5 rounded transition-colors hover:bg-slate-200 dark:hover:bg-slate-600 text-content-secondary"
                     title={t('settings.mcp.copy')}>
                     {copiedKey === 'new-token' ? <Check className="w-4 h-4 text-green-500" /> : <Copy className="w-4 h-4" />}
                   </button>
                 </div>
                 <div className="flex justify-end">
-                  <button onClick={() => { setMcpModalOpen(false); setMcpCreatedToken(null) }}
+                  <button type="button" onClick={() => { setMcpModalOpen(false); setMcpCreatedToken(null) }}
                     className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700">
                     {t('settings.mcp.modal.done')}
                   </button>
@@ -605,17 +606,17 @@ function McpTokenModals(props: any) {
 
       {/* Delete MCP Token confirm */}
       {mcpDeleteId !== null && (
-        <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
+        <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
           onClick={e => { if (e.target === e.currentTarget) setMcpDeleteId(null) }}>
           <div className="rounded-xl shadow-xl w-full max-w-sm p-6 space-y-4 bg-surface-card">
             <h3 className="text-base font-semibold text-content">{t('settings.mcp.deleteTokenTitle')}</h3>
             <p className="text-sm text-content-secondary">{t('settings.mcp.deleteTokenMessage')}</p>
             <div className="flex gap-2 justify-end">
-              <button onClick={() => setMcpDeleteId(null)}
+              <button type="button" onClick={() => setMcpDeleteId(null)}
                 className="px-4 py-2 rounded-lg text-sm border border-edge text-content-secondary">
                 {t('common.cancel')}
               </button>
-              <button onClick={() => handleDeleteMcpToken(mcpDeleteId)}
+              <button type="button" onClick={() => handleDeleteMcpToken(mcpDeleteId)}
                 className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-red-600 hover:bg-red-700">
                 {t('settings.mcp.deleteTokenTitle')}
               </button>
@@ -636,7 +637,7 @@ function OAuthClientModals(props: any) {
     <>
       {/* Create OAuth Client modal */}
       {oauthCreateOpen && (
-        <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
+        <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
           onClick={e => { if (e.target === e.currentTarget && !oauthCreatedClient) setOauthCreateOpen(false) }}>
           <div className="rounded-xl shadow-xl w-full max-w-lg p-6 space-y-4 overflow-y-auto max-h-[90vh] bg-surface-card">
             {!oauthCreatedClient ? (
@@ -670,12 +671,12 @@ function OAuthClientModals(props: any) {
                     autoFocus />
                 </div>
 
-                <label className="flex items-start gap-2.5 cursor-pointer">
-                  <input type="checkbox" checked={oauthIsMachine} onChange={e => setOauthIsMachine(e.target.checked)}
+                <label htmlFor="oauth-machine-client" className="flex items-start gap-2.5 cursor-pointer">
+                  <input id="oauth-machine-client" type="checkbox" checked={oauthIsMachine} onChange={e => setOauthIsMachine(e.target.checked)}
                     className="mt-0.5 rounded border-slate-300 text-indigo-600 focus:ring-indigo-500" />
-                  <div>
-                    <span className="text-sm font-medium text-content-secondary">{t('settings.oauth.modal.machineClient')}</span>
-                    <p className="text-xs mt-0.5" style={{ color: 'var(--text-tertiary)' }}>{t('settings.oauth.modal.machineClientHint')}</p>
+                  <div className="text-sm font-medium text-content-secondary">
+                    {t('settings.oauth.modal.machineClient')}
+                    <p className="text-xs mt-0.5 font-normal" style={{ color: 'var(--text-tertiary)' }}>{t('settings.oauth.modal.machineClientHint')}</p>
                   </div>
                 </label>
 
@@ -697,11 +698,11 @@ function OAuthClientModals(props: any) {
                 </div>
 
                 <div className="flex gap-2 justify-end pt-1">
-                  <button onClick={() => setOauthCreateOpen(false)}
+                  <button type="button" onClick={() => setOauthCreateOpen(false)}
                     className="px-4 py-2 rounded-lg text-sm border border-edge text-content-secondary">
                     {t('common.cancel')}
                   </button>
-                  <button onClick={handleCreateOAuthClient}
+                  <button type="button" onClick={handleCreateOAuthClient}
                     disabled={!oauthNewName.trim() || (!oauthIsMachine && !oauthNewUris.trim()) || oauthCreating}
                     className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700 disabled:opacity-50">
                     {oauthCreating ? t('settings.oauth.modal.creating') : t('settings.oauth.modal.create')}
@@ -723,7 +724,7 @@ function OAuthClientModals(props: any) {
                       <code className="flex-1 px-3 py-2 rounded-lg text-xs font-mono border bg-surface-secondary border-edge text-content">
                         {oauthCreatedClient.client_id}
                       </code>
-                      <button onClick={() => handleCopy(oauthCreatedClient.client_id, 'new-client-id')}
+                      <button type="button" onClick={() => handleCopy(oauthCreatedClient.client_id, 'new-client-id')}
                         className="p-2 rounded-lg border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700 border-edge">
                         {copiedKey === 'new-client-id' ? <Check className="w-4 h-4 text-green-500" /> : <Copy className="w-4 h-4 text-content-secondary" />}
                       </button>
@@ -735,7 +736,7 @@ function OAuthClientModals(props: any) {
                       <code className="flex-1 px-3 py-2 rounded-lg text-xs font-mono border break-all bg-surface-secondary border-edge text-content">
                         {oauthCreatedClient.client_secret}
                       </code>
-                      <button onClick={() => handleCopy(oauthCreatedClient.client_secret!, 'new-client-secret')}
+                      <button type="button" onClick={() => handleCopy(oauthCreatedClient.client_secret!, 'new-client-secret')}
                         className="p-2 rounded-lg border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700 border-edge">
                         {copiedKey === 'new-client-secret' ? <Check className="w-4 h-4 text-green-500" /> : <Copy className="w-4 h-4 text-content-secondary" />}
                       </button>
@@ -750,7 +751,7 @@ function OAuthClientModals(props: any) {
                 )}
 
                 <div className="flex justify-end">
-                  <button onClick={() => { setOauthCreateOpen(false); setOauthCreatedClient(null) }}
+                  <button type="button" onClick={() => { setOauthCreateOpen(false); setOauthCreatedClient(null) }}
                     className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700">
                     {t('settings.mcp.modal.done')}
                   </button>
@@ -763,17 +764,17 @@ function OAuthClientModals(props: any) {
 
       {/* Delete OAuth Client confirm */}
       {oauthDeleteId !== null && (
-        <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
+        <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
           onClick={e => { if (e.target === e.currentTarget) setOauthDeleteId(null) }}>
           <div className="rounded-xl shadow-xl w-full max-w-sm p-6 space-y-4 bg-surface-card">
             <h3 className="text-base font-semibold text-content">{t('settings.oauth.deleteClient')}</h3>
             <p className="text-sm text-content-secondary">{t('settings.oauth.deleteClientMessage')}</p>
             <div className="flex gap-2 justify-end">
-              <button onClick={() => setOauthDeleteId(null)}
+              <button type="button" onClick={() => setOauthDeleteId(null)}
                 className="px-4 py-2 rounded-lg text-sm border border-edge text-content-secondary">
                 {t('common.cancel')}
               </button>
-              <button onClick={() => handleDeleteOAuthClient(oauthDeleteId)}
+              <button type="button" onClick={() => handleDeleteOAuthClient(oauthDeleteId)}
                 className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-red-600 hover:bg-red-700">
                 {t('settings.oauth.deleteClient')}
               </button>
@@ -784,17 +785,17 @@ function OAuthClientModals(props: any) {
 
       {/* Rotate OAuth Client Secret confirm */}
       {oauthRotateId !== null && (
-        <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
+        <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
           onClick={e => { if (e.target === e.currentTarget) setOauthRotateId(null) }}>
           <div className="rounded-xl shadow-xl w-full max-w-sm p-6 space-y-4 bg-surface-card">
             <h3 className="text-base font-semibold text-content">{t('settings.oauth.rotateSecret')}</h3>
             <p className="text-sm text-content-secondary">{t('settings.oauth.rotateSecretMessage')}</p>
             <div className="flex gap-2 justify-end">
-              <button onClick={() => setOauthRotateId(null)}
+              <button type="button" onClick={() => setOauthRotateId(null)}
                 className="px-4 py-2 rounded-lg text-sm border border-edge text-content-secondary">
                 {t('common.cancel')}
               </button>
-              <button onClick={() => handleRotateSecret(oauthRotateId)} disabled={oauthRotating}
+              <button type="button" onClick={() => handleRotateSecret(oauthRotateId)} disabled={oauthRotating}
                 className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700 disabled:opacity-50">
                 {oauthRotating ? t('settings.oauth.rotateSecretConfirming') : t('settings.oauth.rotateSecretConfirm')}
               </button>
@@ -818,14 +819,14 @@ function OAuthClientModals(props: any) {
                 <code className="flex-1 px-3 py-2 rounded-lg text-xs font-mono border break-all bg-surface-secondary border-edge text-content">
                   {oauthRotatedSecret}
                 </code>
-                <button onClick={() => handleCopy(oauthRotatedSecret, 'rotated-secret')}
+                <button type="button" onClick={() => handleCopy(oauthRotatedSecret, 'rotated-secret')}
                   className="p-2 rounded-lg border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700 border-edge">
                   {copiedKey === 'rotated-secret' ? <Check className="w-4 h-4 text-green-500" /> : <Copy className="w-4 h-4 text-content-secondary" />}
                 </button>
               </div>
             </div>
             <div className="flex justify-end">
-              <button onClick={() => setOauthRotatedSecret(null)}
+              <button type="button" onClick={() => setOauthRotatedSecret(null)}
                 className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700">
                 {t('settings.mcp.modal.done')}
               </button>
@@ -836,17 +837,17 @@ function OAuthClientModals(props: any) {
 
       {/* Revoke OAuth Session confirm */}
       {oauthRevokeId !== null && (
-        <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
+        <div role="presentation" className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-[rgba(0,0,0,0.5)]"
           onClick={e => { if (e.target === e.currentTarget) setOauthRevokeId(null) }}>
           <div className="rounded-xl shadow-xl w-full max-w-sm p-6 space-y-4 bg-surface-card">
             <h3 className="text-base font-semibold text-content">{t('settings.oauth.revokeSession')}</h3>
             <p className="text-sm text-content-secondary">{t('settings.oauth.revokeSessionMessage')}</p>
             <div className="flex gap-2 justify-end">
-              <button onClick={() => setOauthRevokeId(null)}
+              <button type="button" onClick={() => setOauthRevokeId(null)}
                 className="px-4 py-2 rounded-lg text-sm border border-edge text-content-secondary">
                 {t('common.cancel')}
               </button>
-              <button onClick={() => handleRevokeSession(oauthRevokeId)}
+              <button type="button" onClick={() => handleRevokeSession(oauthRevokeId)}
                 className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-red-600 hover:bg-red-700">
                 {t('settings.oauth.revoke')}
               </button>
diff --git a/client/src/components/Settings/LlmConnectionSection.tsx b/client/src/components/Settings/LlmConnectionSection.tsx
index 67e8bcf92..bd1841655 100644
--- a/client/src/components/Settings/LlmConnectionSection.tsx
+++ b/client/src/components/Settings/LlmConnectionSection.tsx
@@ -143,7 +143,7 @@ export default function LlmConnectionSection(): React.ReactElement {
           <p className="mt-1 text-xs text-content-faint">{t('settings.aiParsing.multimodalHint')}</p>
         </div>
 
-        <button
+        <button type="button"
           onClick={handleSave}
           disabled={saving || !isLoaded}
           className="flex items-center gap-2 px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700 disabled:opacity-50"
diff --git a/client/src/components/Settings/MapSettingsTab.test.tsx b/client/src/components/Settings/MapSettingsTab.test.tsx
index 706a45b13..867465fbf 100644
--- a/client/src/components/Settings/MapSettingsTab.test.tsx
+++ b/client/src/components/Settings/MapSettingsTab.test.tsx
@@ -134,7 +134,7 @@ describe('MapSettingsTab', () => {
     });
     render(<><ToastContainer /><MapSettingsTab /></>);
     await user.click(screen.getByText('Save Map'));
-    await screen.findByText('Save failed');
+    expect(await screen.findByText('Save failed')).toBeInTheDocument();
   });
 
   it('FE-COMP-MAP-016: preset dropdown is rendered', () => {
diff --git a/client/src/components/Settings/MapSettingsTab.tsx b/client/src/components/Settings/MapSettingsTab.tsx
index 131381bd2..1f489e1ea 100644
--- a/client/src/components/Settings/MapSettingsTab.tsx
+++ b/client/src/components/Settings/MapSettingsTab.tsx
@@ -196,7 +196,7 @@ export default function MapSettingsTab(): React.ReactElement {
     route_geometry: null,
     place_time: null,
     end_time: null,
-    created_at: Date(),
+    created_at: String(new Date()),
   }], [])
 
   const saveMapSettings = async (): Promise<void> => {
@@ -449,7 +449,7 @@ export default function MapSettingsTab(): React.ReactElement {
         </div>
       </div>
 
-      <button
+      <button type="button"
         onClick={saveMapSettings}
         disabled={saving}
         className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
diff --git a/client/src/components/Settings/NotificationsTab.test.tsx b/client/src/components/Settings/NotificationsTab.test.tsx
index b234b318a..78720dc35 100644
--- a/client/src/components/Settings/NotificationsTab.test.tsx
+++ b/client/src/components/Settings/NotificationsTab.test.tsx
@@ -1007,7 +1007,7 @@ describe('NotificationsTab — ntfy credentials', () => {
     await screen.findByDisplayValue('alerts');
     await user.click(screen.getByRole('button', { name: 'Save' }));
 
-    await screen.findByText('Error');
+    expect(await screen.findByText('Error')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTIFICATIONS-019: Clear wipes the stored token and hides the button', async () => {
@@ -1073,7 +1073,7 @@ describe('NotificationsTab — ntfy credentials', () => {
     await screen.findByDisplayValue('alerts');
     await user.click(screen.getByRole('button', { name: 'Test' }));
 
-    await screen.findByText('Topic not found');
+    expect(await screen.findByText('Topic not found')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTIFICATIONS-023: a network error during the test falls back to the generic message', async () => {
@@ -1087,7 +1087,7 @@ describe('NotificationsTab — ntfy credentials', () => {
     await screen.findByDisplayValue('alerts');
     await user.click(screen.getByRole('button', { name: 'Test' }));
 
-    await screen.findByText('Test ntfy notification failed');
+    expect(await screen.findByText('Test ntfy notification failed')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTIFICATIONS-024: without a topic the test button stays disabled', async () => {
@@ -1141,7 +1141,7 @@ describe('NotificationsTab — webhook and channel-test failures', () => {
     await screen.findByRole('textbox');
     await user.click(screen.getByRole('button', { name: 'Save' }));
 
-    await screen.findByText('Error');
+    expect(await screen.findByText('Error')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTIFICATIONS-027: a network error during the webhook test falls back to the generic message', async () => {
@@ -1154,7 +1154,7 @@ describe('NotificationsTab — webhook and channel-test failures', () => {
     await screen.findByRole('textbox');
     await user.click(screen.getByRole('button', { name: 'Test' }));
 
-    await screen.findByText('Test webhook failed');
+    expect(await screen.findByText('Test webhook failed')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTIFICATIONS-028: a refused plugin channel test reports the returned error', async () => {
@@ -1169,7 +1169,7 @@ describe('NotificationsTab — webhook and channel-test failures', () => {
 
     await user.click(await screen.findByRole('button', { name: /send test/i }));
 
-    await screen.findByText('Gotify rejected the token');
+    expect(await screen.findByText('Gotify rejected the token')).toBeInTheDocument();
   });
 
   it('FE-COMP-NOTIFICATIONS-029: a plugin channel test that errors out falls back to the generic message', async () => {
@@ -1182,6 +1182,6 @@ describe('NotificationsTab — webhook and channel-test failures', () => {
 
     await user.click(await screen.findByRole('button', { name: /send test/i }));
 
-    await screen.findByText('Test failed.');
+    expect(await screen.findByText('Test failed.')).toBeInTheDocument();
   });
 });
diff --git a/client/src/components/Settings/NotificationsTab.tsx b/client/src/components/Settings/NotificationsTab.tsx
index f59e60895..9a1fb2b71 100644
--- a/client/src/components/Settings/NotificationsTab.tsx
+++ b/client/src/components/Settings/NotificationsTab.tsx
@@ -243,14 +243,14 @@ export default function NotificationsTab(): React.ReactElement {
                 placeholder={webhookIsSet ? '••••••••' : t('settings.webhookUrl.placeholder')}
                 style={{ flex: 1, fontSize: 'calc(13px * var(--fs-scale-body, 1))', padding: '6px 10px', border: '1px solid var(--border-primary)', borderRadius: 6, background: 'var(--bg-primary)', color: 'var(--text-primary)' }}
               />
-              <button
+              <button type="button"
                 onClick={saveWebhookUrl}
                 disabled={webhookSaving}
                 style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', padding: '6px 12px', background: 'var(--text-primary)', color: 'var(--bg-primary)', border: 'none', borderRadius: 6, cursor: webhookSaving ? 'not-allowed' : 'pointer', opacity: webhookSaving ? 0.6 : 1 }}
               >
                 {t('common.save')}
               </button>
-              <button
+              <button type="button"
                 onClick={testWebhookUrl}
                 disabled={(!webhookUrl && !webhookIsSet) || webhookTesting}
                 style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', padding: '6px 12px', background: 'transparent', color: 'var(--text-secondary)', border: '1px solid var(--border-primary)', borderRadius: 6, cursor: ((!webhookUrl && !webhookIsSet) || webhookTesting) ? 'not-allowed' : 'pointer', opacity: ((!webhookUrl && !webhookIsSet) || webhookTesting) ? 0.5 : 1 }}
@@ -296,21 +296,21 @@ export default function NotificationsTab(): React.ReactElement {
                 style={{ flex: 1, fontSize: 'calc(13px * var(--fs-scale-body, 1))', padding: '6px 10px', border: '1px solid var(--border-primary)', borderRadius: 6, background: 'var(--bg-primary)', color: 'var(--text-primary)' }}
               />
               {ntfyTokenIsSet && (
-                <button
+                <button type="button"
                   onClick={clearNtfyToken}
                   style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', padding: '6px 12px', background: 'transparent', color: 'var(--color-danger, #e53e3e)', border: '1px solid var(--color-danger, #e53e3e)', borderRadius: 6, cursor: 'pointer' }}
                 >
                   {t('common.clear')}
                 </button>
               )}
-              <button
+              <button type="button"
                 onClick={saveNtfySettings}
                 disabled={ntfySaving}
                 style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', padding: '6px 12px', background: 'var(--text-primary)', color: 'var(--bg-primary)', border: 'none', borderRadius: 6, cursor: ntfySaving ? 'not-allowed' : 'pointer', opacity: ntfySaving ? 0.6 : 1 }}
               >
                 {t('common.save')}
               </button>
-              <button
+              <button type="button"
                 onClick={testNtfySettings}
                 disabled={!ntfyTopic || ntfyTesting}
                 style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', padding: '6px 12px', background: 'transparent', color: 'var(--text-secondary)', border: '1px solid var(--border-primary)', borderRadius: 6, cursor: (!ntfyTopic || ntfyTesting) ? 'not-allowed' : 'pointer', opacity: (!ntfyTopic || ntfyTesting) ? 0.5 : 1 }}
@@ -341,7 +341,7 @@ export default function NotificationsTab(): React.ReactElement {
                   {t('settings.notificationPreferences.configure')}
                 </Link>
               )}
-              <button
+              <button type="button"
                 onClick={() => testChannel(ch)}
                 disabled={!ch.configured || channelTesting === ch.id}
                 style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', padding: '6px 12px', background: 'transparent', color: 'var(--text-secondary)', border: '1px solid var(--border-primary)', borderRadius: 6, cursor: (!ch.configured || channelTesting === ch.id) ? 'not-allowed' : 'pointer', opacity: (!ch.configured || channelTesting === ch.id) ? 0.5 : 1 }}
diff --git a/client/src/components/Settings/OfflineTab.tsx b/client/src/components/Settings/OfflineTab.tsx
index 40cf63dba..5c950b234 100644
--- a/client/src/components/Settings/OfflineTab.tsx
+++ b/client/src/components/Settings/OfflineTab.tsx
@@ -202,7 +202,7 @@ export default function OfflineTab(): React.ReactElement {
               {t('settings.offline.prepare.hint')}
             </p>
             <div style={{ display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap' }}>
-              <button
+              <button type="button"
                 onClick={runPrepare}
                 disabled={preparing || offline}
                 className="border border-edge bg-surface-secondary text-content"
@@ -213,7 +213,7 @@ export default function OfflineTab(): React.ReactElement {
                   : <Download size={14} />}
                 {preparing ? t('settings.offline.prepare.running') : t('settings.offline.prepare.button')}
               </button>
-              <button
+              <button type="button"
                 onClick={handleResync}
                 disabled={syncing || offline}
                 className="border border-edge bg-surface-secondary text-content"
@@ -259,10 +259,10 @@ export default function OfflineTab(): React.ReactElement {
                   {t('settings.offline.conflicts.item', { name: conflictName(c) })}
                 </span>
                 <div style={{ display: 'flex', gap: 8 }}>
-                  <button onClick={() => resolveConflict(c.id, true)} className="border border-edge bg-surface-card text-content" style={smallBtnStyle()}>
+                  <button type="button" onClick={() => resolveConflict(c.id, true)} className="border border-edge bg-surface-card text-content" style={smallBtnStyle()}>
                     {t('settings.offline.conflicts.keepMine')}
                   </button>
-                  <button onClick={() => resolveConflict(c.id, false)} className="border border-edge bg-surface-card text-content" style={smallBtnStyle()}>
+                  <button type="button" onClick={() => resolveConflict(c.id, false)} className="border border-edge bg-surface-card text-content" style={smallBtnStyle()}>
                     {t('settings.offline.conflicts.keepServer')}
                   </button>
                 </div>
@@ -334,7 +334,7 @@ export default function OfflineTab(): React.ReactElement {
           </div>
 
           <div style={{ display: 'flex', gap: 8 }}>
-            <button
+            <button type="button"
               onClick={handleClear}
               disabled={clearing || rows.length === 0}
               className="border border-edge bg-surface-secondary text-[#ef4444]"
diff --git a/client/src/components/Settings/PasskeysSection.test.tsx b/client/src/components/Settings/PasskeysSection.test.tsx
index 634153438..a78f7e093 100644
--- a/client/src/components/Settings/PasskeysSection.test.tsx
+++ b/client/src/components/Settings/PasskeysSection.test.tsx
@@ -344,7 +344,7 @@ describe('PasskeysSection', () => {
     await user.type(screen.getByDisplayValue('MacBook'), '-x');
     await user.click(screen.getByRole('button', { name: 'Save' }));
 
-    await screen.findByText('Name taken');
+    expect(await screen.findByText('Name taken')).toBeInTheDocument();
   });
 
   it('FE-COMP-PASSKEYS-020: deleting asks for the password, calls the API and can be cancelled', async () => {
diff --git a/client/src/components/Settings/PhotoProvidersSection.test.tsx b/client/src/components/Settings/PhotoProvidersSection.test.tsx
index 67b32030f..2f4df8114 100644
--- a/client/src/components/Settings/PhotoProvidersSection.test.tsx
+++ b/client/src/components/Settings/PhotoProvidersSection.test.tsx
@@ -81,7 +81,7 @@ describe('PhotoProvidersSection', () => {
   it('FE-COMP-PHOTOPROVIDERS-003: renders a section card for each active provider', async () => {
     seedMemoriesEnabled();
     render(<PhotoProvidersSection />);
-    await screen.findByText('Immich');
+    expect(await screen.findByText('Immich')).toBeInTheDocument();
   });
 
   it('FE-COMP-PHOTOPROVIDERS-004: renders field inputs for each provider field', async () => {
@@ -95,7 +95,7 @@ describe('PhotoProvidersSection', () => {
   it('FE-COMP-PHOTOPROVIDERS-005: non-secret field is prefilled with value from settings API', async () => {
     seedMemoriesEnabled();
     render(<PhotoProvidersSection />);
-    await screen.findByDisplayValue('https://photos.example.com');
+    expect(await screen.findByDisplayValue('https://photos.example.com')).toBeInTheDocument();
   });
 
   it('FE-COMP-PHOTOPROVIDERS-006: secret field is NOT prefilled (blank value)', async () => {
@@ -240,7 +240,9 @@ describe('PhotoProvidersSection', () => {
     await screen.findByText('Immich');
     const testBtn = screen.getByRole('button', { name: /test connection/i });
     await user.click(testBtn);
-    await screen.findByText(/connected/i);
+    // Exact text on purpose: the badge always renders, and a loose /connected/i
+    // also matches the "Not connected" it starts out as.
+    expect(await screen.findByText('Connected')).toBeInTheDocument();
   });
 
   it('FE-COMP-PHOTOPROVIDERS-015: failed test shows error toast', async () => {
@@ -258,7 +260,7 @@ describe('PhotoProvidersSection', () => {
     await screen.findByText('Immich');
     const testBtn = screen.getByRole('button', { name: /test connection/i });
     await user.click(testBtn);
-    await screen.findByText(/Auth failed/i);
+    expect(await screen.findByText(/Auth failed/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-PHOTOPROVIDERS-016: Test button is disabled while test is in progress', async () => {
@@ -327,7 +329,7 @@ describe('PhotoProvidersSection', () => {
     seedMemoriesEnabled([fakeProvider, secondProvider]);
     render(<PhotoProvidersSection />);
     await screen.findByText('Immich');
-    await screen.findByText('Piwigo');
+    expect(await screen.findByText('Piwigo')).toBeInTheDocument();
   });
 });
 
@@ -433,7 +435,7 @@ describe('PhotoProvidersSection – checkbox fields and failures', () => {
     await screen.findByText('Immich');
     await user.click(screen.getByRole('button', { name: /test connection/i }));
 
-    await screen.findByText('Could not connect to Immich');
+    expect(await screen.findByText('Could not connect to Immich')).toBeInTheDocument();
   });
 
   it('FE-COMP-PHOTOPROVIDERS-024: a provider without a test POST route probes over GET instead', async () => {
diff --git a/client/src/components/Settings/PhotoProvidersSection.tsx b/client/src/components/Settings/PhotoProvidersSection.tsx
index c36fce449..139433dde 100644
--- a/client/src/components/Settings/PhotoProvidersSection.tsx
+++ b/client/src/components/Settings/PhotoProvidersSection.tsx
@@ -253,7 +253,7 @@ export default function PhotoProvidersSection(): React.ReactElement {
           {/* Wraps on mobile so the connection badge drops to its own row
               instead of clipping off the side of the card. */}
           <div className="flex flex-wrap items-center gap-3">
-            <button
+            <button type="button"
               onClick={() => handleSaveProvider(provider)}
               disabled={!canSave || !!saving[provider.id] || isProviderSaveDisabled(provider)}
               className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
@@ -261,7 +261,7 @@ export default function PhotoProvidersSection(): React.ReactElement {
             >
               <Save className="w-4 h-4" /> {t('common.save')}
             </button>
-            <button
+            <button type="button"
               onClick={() => handleTestProvider(provider)}
               disabled={!canTest || testing}
               className="flex items-center gap-2 px-4 py-2 border border-slate-200 rounded-lg text-sm hover:bg-slate-50"
diff --git a/client/src/components/Settings/PluginSettingsTab.tsx b/client/src/components/Settings/PluginSettingsTab.tsx
index 638054c1f..25d24499b 100644
--- a/client/src/components/Settings/PluginSettingsTab.tsx
+++ b/client/src/components/Settings/PluginSettingsTab.tsx
@@ -45,8 +45,8 @@ function PluginOAuthSection({ id, state, setState }: {
           : <>{t('settings.plugins.oauth.notConnected')}</>}
       </span>
       {state.connected
-        ? <button onClick={disconnect} disabled={busy} className="inline-flex items-center gap-1.5 rounded-lg border border-border px-3 py-1.5 text-sm font-semibold text-content disabled:opacity-60"><Unlink className="w-4 h-4" />{t('settings.plugins.oauth.disconnect')}</button>
-        : <button onClick={connect} disabled={busy} className="inline-flex items-center gap-1.5 rounded-lg bg-accent px-3 py-1.5 text-sm font-semibold text-white disabled:opacity-60">{busy ? <Loader2 className="w-4 h-4 animate-spin" /> : <Link2 className="w-4 h-4" />}{t('settings.plugins.oauth.connect')}</button>}
+        ? <button type="button" onClick={disconnect} disabled={busy} className="inline-flex items-center gap-1.5 rounded-lg border border-border px-3 py-1.5 text-sm font-semibold text-content disabled:opacity-60"><Unlink className="w-4 h-4" />{t('settings.plugins.oauth.disconnect')}</button>
+        : <button type="button" onClick={connect} disabled={busy} className="inline-flex items-center gap-1.5 rounded-lg bg-accent px-3 py-1.5 text-sm font-semibold text-white disabled:opacity-60">{busy ? <Loader2 className="w-4 h-4 animate-spin" /> : <Link2 className="w-4 h-4" />}{t('settings.plugins.oauth.connect')}</button>}
     </div>
   )
 }
@@ -176,7 +176,7 @@ function PluginSettingsForm({ id, name, icon }: { id: string; name: string; icon
         ))}
       </div>
       {hasFields && (
-        <button
+        <button type="button"
           onClick={save}
           disabled={saving}
           className="mt-4 inline-flex items-center gap-2 rounded-lg bg-accent px-4 py-2 text-sm font-semibold text-white disabled:opacity-60"
@@ -195,7 +195,7 @@ function PluginSettingsForm({ id, name, icon }: { id: string; name: string; icon
               const res = actionResult[a.key]
               return (
                 <div key={a.key} className="flex flex-wrap items-center gap-2">
-                  <button
+                  <button type="button"
                     onClick={() => runAction(a)}
                     disabled={running !== null}
                     className={`inline-flex items-center gap-2 rounded-lg border px-3 py-1.5 text-sm font-semibold disabled:opacity-60 ${
diff --git a/client/src/components/Studio/SaveIndicator.tsx b/client/src/components/Studio/SaveIndicator.tsx
index e0a9fe8a7..4f44c37ce 100644
--- a/client/src/components/Studio/SaveIndicator.tsx
+++ b/client/src/components/Studio/SaveIndicator.tsx
@@ -33,10 +33,10 @@ export function SaveIndicator({
           pretending otherwise would be worse than saying so: one of these
           documents is going to be the book.
         */}
-        <button onClick={() => onAcceptTheirs(state.current)}>
+        <button type="button" onClick={() => onAcceptTheirs(state.current)}>
           {t('journey.studio.saveTakeTheirs')}
         </button>
-        <button onClick={() => onKeepMine(state.current)}>
+        <button type="button" onClick={() => onKeepMine(state.current)}>
           {t('journey.studio.saveKeepMine')}
         </button>
       </div>
@@ -59,7 +59,7 @@ export function SaveIndicator({
 
   if (state.status === 'error') {
     return (
-      <button className="st-save is-error" onClick={onRetry} title={t('journey.studio.saveRetry')}>
+      <button type="button" className="st-save is-error" onClick={onRetry} title={t('journey.studio.saveRetry')}>
         <CloudOff size={13} />
         <span>{t('journey.studio.saveFailed')}</span>
       </button>
diff --git a/client/src/components/Studio/SpreadView.tsx b/client/src/components/Studio/SpreadView.tsx
index d5440e853..182e8957f 100644
--- a/client/src/components/Studio/SpreadView.tsx
+++ b/client/src/components/Studio/SpreadView.tsx
@@ -38,7 +38,7 @@ const round2 = (n: number) => Math.round(n * 100) / 100
 
 /** #rrggbb plus an alpha, for the fades a cover panel needs. */
 function hexToRgba(hex: string, alpha: number): string {
-  const n = parseInt(hex.slice(1), 16)
+  const n = Number.parseInt(hex.slice(1), 16)
   return `rgba(${(n >> 16) & 255}, ${(n >> 8) & 255}, ${n & 255}, ${alpha})`
 }
 
diff --git a/client/src/components/Studio/StudioCanvas.tsx b/client/src/components/Studio/StudioCanvas.tsx
index 518b09ce4..72b0aebcb 100644
--- a/client/src/components/Studio/StudioCanvas.tsx
+++ b/client/src/components/Studio/StudioCanvas.tsx
@@ -394,15 +394,15 @@ export function StudioCanvas({
               style={{ left: (x0 + x1) / 2, top: Math.max(6, y0 - 12) }}
               onPointerDown={e => e.stopPropagation()}
             >
-              <button onClick={() => duplicate(spreadIndex, selection)} title={t('journey.studio.duplicate')}>
+              <button type="button" onClick={() => duplicate(spreadIndex, selection)} title={t('journey.studio.duplicate')}>
                 <Copy size={14} />
               </button>
               {sel.length === 1 && (
                 <>
-                  <button onClick={() => raise(spreadIndex, sel[0].id, 'front')} title={t('journey.studio.toFront')}>
+                  <button type="button" onClick={() => raise(spreadIndex, sel[0].id, 'front')} title={t('journey.studio.toFront')}>
                     <ChevronsUp size={14} />
                   </button>
-                  <button onClick={() => raise(spreadIndex, sel[0].id, 'back')} title={t('journey.studio.toBack')}>
+                  <button type="button" onClick={() => raise(spreadIndex, sel[0].id, 'back')} title={t('journey.studio.toBack')}>
                     <ChevronsDown size={14} />
                   </button>
                 </>
@@ -417,13 +417,13 @@ export function StudioCanvas({
                 a rotation past the angle you wanted and back is a worse way to
                 arrive at either.
               */}
-              <button
+              <button type="button"
                 onClick={e => rotateBy(e.shiftKey ? -1 : -15)}
                 title={t('journey.studio.rotateLeft')}
               >
                 <RotateCcw size={14} />
               </button>
-              <button
+              <button type="button"
                 onClick={e => rotateBy(e.shiftKey ? 1 : 15)}
                 title={t('journey.studio.rotateRight')}
               >
@@ -431,6 +431,7 @@ export function StudioCanvas({
               </button>
               <span className="st-quickbar-sep" />
               <button
+                type="button"
                 onClick={() => commit(d => ({
                   ...d,
                   spreads: d.spreads.map((sp, i) => (i !== spreadIndex ? sp : {
@@ -443,7 +444,7 @@ export function StudioCanvas({
                 {locked ? <Unlock size={14} /> : <Lock size={14} />}
               </button>
               <span className="st-quickbar-sep" />
-              <button
+              <button type="button"
                 className="is-danger"
                 onClick={() => { const ids = deletable(spread, selection); if (ids.length) removeElements(spreadIndex, ids) }}
                 title={t('journey.studio.delete')}
diff --git a/client/src/components/Studio/StudioControls.tsx b/client/src/components/Studio/StudioControls.tsx
index 95ca427f4..468f8a8b2 100644
--- a/client/src/components/Studio/StudioControls.tsx
+++ b/client/src/components/Studio/StudioControls.tsx
@@ -46,7 +46,7 @@ export function Section({ label, children, defaultOpen = true, hint }: {
   const [open, setOpen] = useState(defaultOpen)
   return (
     <div className={`st-section is-fold ${open ? '' : 'is-folded'}`}>
-      <button className="st-section-head" onClick={() => setOpen(!open)} aria-expanded={open}>
+      <button type="button" className="st-section-head" onClick={() => setOpen(!open)} aria-expanded={open}>
         <span className="st-section-label">{label}</span>
         <ChevronDown size={13} className="st-section-caret" />
       </button>
@@ -85,7 +85,7 @@ export function Choice<T extends string | number>({ value, options, onPick, aria
   return (
     <div className="st-row" role="radiogroup" aria-label={ariaLabel}>
       {options.map(o => (
-        <button
+        <button type="button"
           key={String(o.value)}
           role="radio"
           aria-checked={o.value === value}
@@ -118,7 +118,7 @@ export function Picks<T extends string>({ value, options, onToggle }: {
       {options.map(o => {
         const on = value.includes(o.value)
         return (
-          <button
+          <button type="button"
             key={o.value}
             role="checkbox"
             aria-checked={on}
diff --git a/client/src/components/Studio/StudioElementsPanel.tsx b/client/src/components/Studio/StudioElementsPanel.tsx
index c74ba99f2..de5a868f3 100644
--- a/client/src/components/Studio/StudioElementsPanel.tsx
+++ b/client/src/components/Studio/StudioElementsPanel.tsx
@@ -81,7 +81,7 @@ function FrameStyleGlyph({ style }: { style: FrameStyle }) {
 function IconCell({ name, onPick }: { name: string; onPick: (name: string) => void }) {
   const Icon = iconComponent(name)
   return (
-    <button
+    <button type="button"
       className="st-shape-btn is-glyph"
       onClick={() => onPick(name)}
       aria-label={name}
@@ -216,16 +216,16 @@ export function StudioElementsPanel({ page, t }: { page: BookPageSetup; t: (k: s
       <PanelHead label={t('journey.studio.elements')} />
 
       <div className="st-tabs">
-        <button className={tab === 'shapes' ? 'is-on' : ''} onClick={() => setTab('shapes')}>
+        <button type="button" className={tab === 'shapes' ? 'is-on' : ''} onClick={() => setTab('shapes')}>
           {t('journey.studio.shapes')}
         </button>
-        <button className={tab === 'frames' ? 'is-on' : ''} onClick={() => setTab('frames')}>
+        <button type="button" className={tab === 'frames' ? 'is-on' : ''} onClick={() => setTab('frames')}>
           {t('journey.studio.frames')}
         </button>
-        <button className={tab === 'grids' ? 'is-on' : ''} onClick={() => setTab('grids')}>
+        <button type="button" className={tab === 'grids' ? 'is-on' : ''} onClick={() => setTab('grids')}>
           {t('journey.studio.grids')}
         </button>
-        <button className={tab === 'icons' ? 'is-on' : ''} onClick={() => setTab('icons')}>
+        <button type="button" className={tab === 'icons' ? 'is-on' : ''} onClick={() => setTab('icons')}>
           {t('journey.studio.icons')}
         </button>
       </div>
@@ -236,18 +236,18 @@ export function StudioElementsPanel({ page, t }: { page: BookPageSetup; t: (k: s
             <div className="st-section">
               <div className="st-section-label">{t('journey.studio.text')}</div>
               <div className="st-stack">
-                <button className="st-tile" onClick={() => addText(30, 700, t('journey.studio.sampleHeading'))}>
+                <button type="button" className="st-tile" onClick={() => addText(30, 700, t('journey.studio.sampleHeading'))}>
                   <span style={{ fontSize: 19, fontWeight: 700, letterSpacing: '-0.02em' }}>
                     {t('journey.studio.styleTitle')}
                   </span>
                 </button>
-                <button className="st-tile" onClick={() => addText(16, 600, t('journey.studio.sampleSubheading'))}>
+                <button type="button" className="st-tile" onClick={() => addText(16, 600, t('journey.studio.sampleSubheading'))}>
                   <span style={{ fontSize: 14, fontWeight: 600 }}>{t('journey.studio.styleSubtitle')}</span>
                 </button>
-                <button className="st-tile" onClick={() => addText(10, 400, t('journey.studio.sampleBody'))}>
+                <button type="button" className="st-tile" onClick={() => addText(10, 400, t('journey.studio.sampleBody'))}>
                   <span style={{ fontSize: 12.5 }}>{t('journey.studio.styleBody')}</span>
                 </button>
-                <button
+                <button type="button"
                   className="st-tile"
                   onClick={() => addText(7.5, 600, t('journey.studio.sampleCaption'), { tracking: 0.14, color: '#8a8578' })}
                 >
@@ -261,17 +261,17 @@ export function StudioElementsPanel({ page, t }: { page: BookPageSetup; t: (k: s
             <div className="st-section">
               <div className="st-section-label">{t('journey.studio.lines')}</div>
               <div className="st-shape-grid">
-                <button className="st-shape-btn" onClick={() => addShape('line')} title={t('journey.studio.shapeKind.line')}>
+                <button type="button" className="st-shape-btn" onClick={() => addShape('line')} title={t('journey.studio.shapeKind.line')}>
                   <Minus size={20} strokeWidth={2} />
                 </button>
-                <button
+                <button type="button"
                   className="st-shape-btn"
                   onClick={() => addShape('rect', { outline: true })}
                   title={t('journey.studio.shapeKind.outline')}
                 >
                   <Square size={20} strokeWidth={1.1} style={{ opacity: .5 }} />
                 </button>
-                <button
+                <button type="button"
                   className="st-shape-btn"
                   onClick={() => addText(46, 700, '“', { color: '#c9c2b4', leading: 0.9 })}
                   title={t('journey.studio.quoteMark')}
@@ -286,7 +286,7 @@ export function StudioElementsPanel({ page, t }: { page: BookPageSetup; t: (k: s
                 <div className="st-section-label">{t(`journey.studio.shapeGroup.${group.id}`)}</div>
                 <div className="st-shape-grid">
                   {group.shapes.map(shape => (
-                    <button
+                    <button type="button"
                       key={shape}
                       className="st-shape-btn is-glyph"
                       onClick={() => addShape(shape)}
@@ -314,7 +314,7 @@ export function StudioElementsPanel({ page, t }: { page: BookPageSetup; t: (k: s
                   ['film', 'filmFrame'],
                   ['tape', 'tapeFrame'],
                 ] as [FrameStyle, string][]).map(([style, key]) => (
-                  <button
+                  <button type="button"
                     key={style}
                     className="st-shape-btn is-frame"
                     onClick={() => addFrame(null, style)}
@@ -331,7 +331,7 @@ export function StudioElementsPanel({ page, t }: { page: BookPageSetup; t: (k: s
               <div className="st-section-label">{t('journey.studio.frameShapes')}</div>
               <div className="st-shape-grid">
                 {FRAME_SHAPES.map(shape => (
-                  <button
+                  <button type="button"
                     key={shape}
                     className="st-shape-btn is-glyph"
                     onClick={() => addFrame(shape === 'rect' ? null : shape)}
@@ -352,6 +352,7 @@ export function StudioElementsPanel({ page, t }: { page: BookPageSetup; t: (k: s
             <div className="st-grid-grid">
               {GRIDS.map(grid => (
                 <button
+                  type="button"
                   key={grid.id}
                   className="st-grid-btn"
                   onClick={() => {
@@ -408,7 +409,7 @@ export function StudioElementsPanel({ page, t }: { page: BookPageSetup; t: (k: s
                 spellCheck={false}
               />
               {iconQuery && (
-                <button onClick={() => { setIconQuery(''); setIconLimit(ICON_PAGE) }} aria-label={t('common.clear')}>
+                <button type="button" onClick={() => { setIconQuery(''); setIconLimit(ICON_PAGE) }} aria-label={t('common.clear')}>
                   <X size={13} />
                 </button>
               )}
diff --git a/client/src/components/Studio/StudioExport.tsx b/client/src/components/Studio/StudioExport.tsx
index e1c570ba2..c8d90798d 100644
--- a/client/src/components/Studio/StudioExport.tsx
+++ b/client/src/components/Studio/StudioExport.tsx
@@ -81,7 +81,7 @@ export function StudioExport({
       <div className="st-ex-card">
         <div className="st-ex-head">
           <span>{t('journey.studio.export')}</span>
-          <button className="st-ex-x" onClick={onClose} aria-label={t('common.close')}>
+          <button type="button" className="st-ex-x" onClick={onClose} aria-label={t('common.close')}>
             <X size={15} />
           </button>
         </div>
@@ -109,7 +109,7 @@ export function StudioExport({
 
           <div className="st-ex-field">
             <span className="st-ex-label">{t('journey.studio.exportFinishing')}</span>
-            <button
+            <button type="button"
               className={`st-ex-opt ${marks ? 'is-on' : ''}`}
               onClick={() => setMarks(!marks)}
               aria-pressed={marks}
@@ -134,8 +134,8 @@ export function StudioExport({
         </div>
 
         <div className="st-ex-foot">
-          <button className="st-ex-btn" onClick={onClose}>{t('common.cancel')}</button>
-          <button className="st-ex-btn is-primary" onClick={() => setBuilding(true)} disabled={building}>
+          <button type="button" className="st-ex-btn" onClick={onClose}>{t('common.cancel')}</button>
+          <button type="button" className="st-ex-btn is-primary" onClick={() => setBuilding(true)} disabled={building}>
             <Printer size={14} />
             <span>{t('journey.studio.exportOpen')}</span>
           </button>
@@ -176,7 +176,7 @@ function Choice<T extends string>({
     <div className="st-ex-field">
       <span className="st-ex-label">{label}</span>
       {options.map(opt => (
-        <button
+        <button type="button"
           key={opt.id}
           className={`st-ex-opt ${value === opt.id ? 'is-on' : ''}`}
           onClick={() => onPick(opt.id)}
diff --git a/client/src/components/Studio/StudioInspector.tsx b/client/src/components/Studio/StudioInspector.tsx
index 82d1f27d3..45f45539d 100644
--- a/client/src/components/Studio/StudioInspector.tsx
+++ b/client/src/components/Studio/StudioInspector.tsx
@@ -204,7 +204,7 @@ export function StudioInspector({
           {sel.length > 1 && <em>{sel.length}</em>}
         </span>
         <span className="st-head-acts">
-          <button
+          <button type="button"
             className="st-act"
             onClick={() => duplicate(spreadIndex, selection)}
             title={t('journey.studio.duplicate')}
@@ -212,7 +212,7 @@ export function StudioInspector({
           >
             <Copy size={14} />
           </button>
-          <button
+          <button type="button"
             className={`st-act ${el.locked ? 'is-on' : ''}`}
             onClick={() => set({ locked: !el.locked })}
             title={t(el.locked ? 'journey.studio.unlock' : 'journey.studio.lock')}
@@ -221,7 +221,7 @@ export function StudioInspector({
           >
             {el.locked ? <Lock size={14} /> : <Unlock size={14} />}
           </button>
-          <button
+          <button type="button"
             className="st-act is-danger"
             onClick={() => removeElements(spreadIndex, selection)}
             title={t('journey.studio.delete')}
@@ -285,7 +285,7 @@ export function StudioInspector({
                 {BOOK_FONT_ORDER.map(id => {
                   const font = BOOK_FONTS[id]
                   return (
-                    <button
+                    <button type="button"
                       key={id}
                       className={`st-font ${el.font === id ? 'is-on' : ''}`}
                       style={{ fontFamily: font.stack }}
@@ -319,7 +319,7 @@ export function StudioInspector({
                 <Line label={t('journey.studio.align')}>
                   <div className="st-row">
                     {([['left', AlignLeft], ['center', AlignCenter], ['right', AlignRight], ['justify', AlignJustify]] as const).map(([a, Icon]) => (
-                      <button
+                      <button type="button"
                         key={a}
                         className={`st-chip is-icon ${el.align === a ? 'is-on' : ''}`}
                         onClick={() => set({ align: a })}
@@ -331,7 +331,7 @@ export function StudioInspector({
                     {/* Italic sits with the alignment because both are things
                         you do to a line rather than to a typeface. It had no
                         control at all before, though the renderer drew it. */}
-                    <button
+                    <button type="button"
                       className={`st-chip is-icon ${el.italic ? 'is-on' : ''}`}
                       onClick={() => set({ italic: !el.italic })}
                       title={t('journey.studio.italic')}
@@ -450,7 +450,7 @@ export function StudioInspector({
 
             <Section label={t('journey.studio.mask')} defaultOpen={false}>
               <div className="st-mini-shapes">
-                <button
+                <button type="button"
                   className={`st-mini-shape ${el.mask ? '' : 'is-on'}`}
                   onClick={() => set({ mask: null })}
                   title={t('journey.studio.maskNone')}
@@ -458,7 +458,7 @@ export function StudioInspector({
                   <span className="st-mini-none" />
                 </button>
                 {FRAME_SHAPES.filter(sh => sh !== 'rect').map(sh => (
-                  <button
+                  <button type="button"
                     key={sh}
                     className={`st-mini-shape ${el.mask === sh ? 'is-on' : ''}`}
                     onClick={() => set({ mask: sh })}
@@ -480,7 +480,7 @@ export function StudioInspector({
                   deleting and re-adding would not. */}
               <div className="st-mini-shapes">
                 {SHAPE_GROUPS.flatMap(g => g.shapes).map((sh: BookShapeId) => (
-                  <button
+                  <button type="button"
                     key={sh}
                     className={`st-mini-shape ${el.shape === sh ? 'is-on' : ''}`}
                     onClick={() => set({ shape: sh })}
@@ -608,7 +608,7 @@ export function StudioInspector({
                 {iconChoices.map(name => {
                   const Glyph = iconComponent(name)
                   return (
-                    <button
+                    <button type="button"
                       key={name}
                       className={`st-mini-shape ${el.name === name ? 'is-on' : ''}`}
                       onClick={() => set({ name })}
@@ -683,16 +683,16 @@ export function StudioInspector({
 
         <Section label={t('journey.studio.arrange')} defaultOpen={false}>
           <div className="st-row">
-            <button className="st-chip is-icon" onClick={() => raise(spreadIndex, el.id, 'front')} title={t('journey.studio.toFront')}>
+            <button type="button" className="st-chip is-icon" onClick={() => raise(spreadIndex, el.id, 'front')} title={t('journey.studio.toFront')}>
               <ChevronsUp size={14} />
             </button>
-            <button className="st-chip is-icon" onClick={() => raise(spreadIndex, el.id, 'up')} title={t('journey.studio.forward')}>
+            <button type="button" className="st-chip is-icon" onClick={() => raise(spreadIndex, el.id, 'up')} title={t('journey.studio.forward')}>
               <ArrowUp size={14} />
             </button>
-            <button className="st-chip is-icon" onClick={() => raise(spreadIndex, el.id, 'down')} title={t('journey.studio.backward')}>
+            <button type="button" className="st-chip is-icon" onClick={() => raise(spreadIndex, el.id, 'down')} title={t('journey.studio.backward')}>
               <ArrowDown size={14} />
             </button>
-            <button className="st-chip is-icon" onClick={() => raise(spreadIndex, el.id, 'back')} title={t('journey.studio.toBack')}>
+            <button type="button" className="st-chip is-icon" onClick={() => raise(spreadIndex, el.id, 'back')} title={t('journey.studio.toBack')}>
               <ChevronsDown size={14} />
             </button>
           </div>
diff --git a/client/src/components/Studio/StudioShell.tsx b/client/src/components/Studio/StudioShell.tsx
index 383bb012e..3d5a93e0e 100644
--- a/client/src/components/Studio/StudioShell.tsx
+++ b/client/src/components/Studio/StudioShell.tsx
@@ -46,7 +46,7 @@ export default function StudioShell() {
         <div style={{ fontSize: 13.5, color: 'var(--ink-3)', maxWidth: 320, lineHeight: 1.55 }}>
           {s.t('journey.studio.desktopOnlyHint')}
         </div>
-        <button
+        <button type="button"
           onClick={() => navigate(s.backTo, { replace: true })}
           className="st-tool is-primary"
           style={{ marginTop: 6 }}
@@ -122,7 +122,7 @@ function StudioBar({
 }: { s: Studio; bookView: boolean; setBookView: (v: boolean) => void; onExport: () => void }) {
   return (
     <div className="st-bar">
-      <button onClick={s.close} className="st-back" title={s.t('journey.studio.backToJourney')}>
+      <button type="button" onClick={s.close} className="st-back" title={s.t('journey.studio.backToJourney')}>
         <ArrowLeft size={16} />
         {s.coverUrl
           ? <img src={s.coverUrl} alt="" className="st-cover" />
@@ -154,7 +154,7 @@ function StudioBar({
       />
 
       <div className="st-bar-group">
-        <button
+        <button type="button"
           className={`st-tool ${bookView ? 'is-on' : ''}`}
           onClick={() => setBookView(!bookView)}
           title={s.t('journey.studio.bookView')}
@@ -169,7 +169,7 @@ function StudioBar({
 
         <div className="st-sep" />
 
-        <button
+        <button type="button"
           className="st-tool is-icon"
           disabled={!s.canUndo}
           onClick={s.undo}
@@ -178,7 +178,7 @@ function StudioBar({
         >
           <Undo2 size={15} />
         </button>
-        <button
+        <button type="button"
           className="st-tool is-icon"
           disabled={!s.canRedo}
           onClick={s.redo}
@@ -191,7 +191,7 @@ function StudioBar({
         <div className="st-sep" />
 
         <AutoLayoutButton s={s} />
-        <button
+        <button type="button"
           className="st-tool is-primary"
           onClick={onExport}
           disabled={!s.doc}
@@ -235,7 +235,7 @@ function AutoLayoutButton({ s }: { s: Studio }) {
 
   return (
     <div className="st-picker" ref={box}>
-      <button
+      <button type="button"
         className="st-tool"
         onClick={() => setOpen(o => !o)}
         aria-haspopup="menu"
@@ -249,7 +249,7 @@ function AutoLayoutButton({ s }: { s: Studio }) {
 
       {open && (
         <div className="st-menu" role="menu">
-          <button
+          <button type="button"
             className="st-menu-item"
             role="menuitem"
             disabled={!s.canRelayoutSpread}
@@ -262,7 +262,7 @@ function AutoLayoutButton({ s }: { s: Studio }) {
               </span>
             </span>
           </button>
-          <button
+          <button type="button"
             className="st-menu-item"
             role="menuitem"
             onClick={() => { s.relayoutBook(); setOpen(false) }}
@@ -312,7 +312,7 @@ function FormatPicker({ s }: { s: Studio }) {
 
   return (
     <div className="st-picker" ref={box}>
-      <button
+      <button type="button"
         className="st-tool"
         onClick={() => setOpen(o => !o)}
         aria-haspopup="listbox"
@@ -333,7 +333,7 @@ function FormatPicker({ s }: { s: Studio }) {
             const p = PAGE_PRESETS[id]
             const on = id === s.preset
             return (
-              <button
+              <button type="button"
                 key={id}
                 role="option"
                 aria-selected={on}
@@ -434,14 +434,14 @@ function Workbench({ s, bookView }: { s: Studio; bookView: boolean }) {
       </div>
 
       <div className="st-zoom">
-        <button onClick={() => s.stepZoom(-1)} disabled={!s.canZoomOut} aria-label={s.t('journey.studio.zoomOut')}>
+        <button type="button" onClick={() => s.stepZoom(-1)} disabled={!s.canZoomOut} aria-label={s.t('journey.studio.zoomOut')}>
           <Minus size={15} />
         </button>
         <span className="st-zoom-value">{s.zoomPercent}%</span>
-        <button onClick={() => s.stepZoom(1)} disabled={!s.canZoomIn} aria-label={s.t('journey.studio.zoomIn')}>
+        <button type="button" onClick={() => s.stepZoom(1)} disabled={!s.canZoomIn} aria-label={s.t('journey.studio.zoomIn')}>
           <Plus size={15} />
         </button>
-        <button onClick={s.zoomToFit} aria-label={s.t('journey.studio.zoomFit')} title={s.t('journey.studio.zoomFit')}>
+        <button type="button" onClick={s.zoomToFit} aria-label={s.t('journey.studio.zoomFit')} title={s.t('journey.studio.zoomFit')}>
           <Maximize2 size={14} />
         </button>
         {/*
@@ -453,7 +453,7 @@ function Workbench({ s, bookView }: { s: Studio; bookView: boolean }) {
           photographs, which is the thing worth passing on.
         */}
         <span className="st-zoom-sep" />
-        <button
+        <button type="button"
           onClick={() => s.spread && downloadSpread(s.spread, s.page, s.journey?.title || 'spread')}
           disabled={!s.spread}
           aria-label={s.t('journey.studio.downloadSpread')}
diff --git a/client/src/components/Studio/StudioSidebar.tsx b/client/src/components/Studio/StudioSidebar.tsx
index 84cc1cad0..f852046b1 100644
--- a/client/src/components/Studio/StudioSidebar.tsx
+++ b/client/src/components/Studio/StudioSidebar.tsx
@@ -98,7 +98,7 @@ export function StudioSidebar({
     <>
       <nav className="st-rail" aria-label={t('journey.studio.sections')}>
         {SECTIONS.map(sec => (
-          <button
+          <button type="button"
             key={sec.id}
             className={`st-rail-btn ${section === sec.id ? 'is-on' : ''}`}
             onClick={() => setSection(sec.id)}
@@ -157,7 +157,7 @@ function PagesPanel({
             const editable = canEditSpread(i)
             return (
               <div className="st-thumb-row" key={sp.id}>
-                <button
+                <button type="button"
                   className={`st-thumb ${i === active ? 'is-active' : ''}`}
                   onClick={() => setActive(i)}
                 >
@@ -190,7 +190,7 @@ function PagesPanel({
                 */}
                 {editable && (
                   <div className="st-thumb-actions">
-                    <button
+                    <button type="button"
                       onClick={() => moveSpread(i, -1)}
                       disabled={!canEditSpread(i - 1)}
                       title={t('journey.studio.movePageUp')}
@@ -198,7 +198,7 @@ function PagesPanel({
                     >
                       <ChevronUp size={13} />
                     </button>
-                    <button
+                    <button type="button"
                       onClick={() => moveSpread(i, 1)}
                       disabled={!canEditSpread(i + 1)}
                       title={t('journey.studio.movePageDown')}
@@ -206,14 +206,14 @@ function PagesPanel({
                     >
                       <ChevronDown size={13} />
                     </button>
-                    <button
+                    <button type="button"
                       onClick={() => duplicateSpread(i)}
                       title={t('journey.studio.duplicatePage')}
                       aria-label={t('journey.studio.duplicatePage')}
                     >
                       <Copy size={12} />
                     </button>
-                    <button
+                    <button type="button"
                       className="is-danger"
                       onClick={() => removeSpread(i)}
                       title={t('journey.studio.deletePage')}
@@ -227,7 +227,7 @@ function PagesPanel({
                 {/* Insert between two spreads, where the new one will go — a
                     single "add" at the end cannot express "another page here". */}
                 {editable && (
-                  <button
+                  <button type="button"
                     className="st-thumb-insert"
                     onClick={() => addSpread(i)}
                     title={t('journey.studio.addPageAfter')}
@@ -247,11 +247,11 @@ function PagesPanel({
           not a setting buried in a menu, it is the other half of "add".
         */}
         <div className="st-add-row">
-          <button className="st-add-page" onClick={() => addSpread(lastInner)}>
+          <button type="button" className="st-add-page" onClick={() => addSpread(lastInner)}>
             <Plus size={14} />
             {t('journey.studio.addPage')}
           </button>
-          <button
+          <button type="button"
             className="st-add-page is-import"
             onClick={() => fileInput.current?.click()}
             title={t('journey.studio.importSpreadHint')}
@@ -429,17 +429,17 @@ function ContentPanel({
           spellCheck={false}
         />
         {query && (
-          <button onClick={() => setQuery('')} aria-label={t('common.clear')}>
+          <button type="button" onClick={() => setQuery('')} aria-label={t('common.clear')}>
             <X size={13} />
           </button>
         )}
       </div>
 
       <div className="st-tabs">
-        <button className={tab === 'photos' ? 'is-on' : ''} onClick={() => setTab('photos')}>
+        <button type="button" className={tab === 'photos' ? 'is-on' : ''} onClick={() => setTab('photos')}>
           {t('journey.studio.photos')} <em>{photos.length}</em>
         </button>
-        <button className={tab === 'text' ? 'is-on' : ''} onClick={() => setTab('text')}>
+        <button type="button" className={tab === 'text' ? 'is-on' : ''} onClick={() => setTab('text')}>
           {t('journey.studio.entries')} <em>{entries.length}</em>
         </button>
       </div>
@@ -448,7 +448,7 @@ function ContentPanel({
         {tab === 'photos' ? (
           <div className="st-photo-grid">
             {photos.map(p => (
-              <button
+              <button type="button"
                 key={p.photoId}
                 className="st-photo-cell"
                 onClick={() => dropPhoto(p.photoId)}
@@ -488,17 +488,17 @@ function ContentPanel({
                 )}
                 <div className="st-row" style={{ marginTop: 7 }}>
                   {e.title && (
-                    <button className="st-chip" onClick={() => dropText(e.title!, 22, 700, e.id, 'entry.title')}>
+                    <button type="button" className="st-chip" onClick={() => dropText(e.title!, 22, 700, e.id, 'entry.title')}>
                       {t('journey.studio.addTitle')}
                     </button>
                   )}
                   {e.story && (
-                    <button className="st-chip" onClick={() => dropText(e.story!, 10, 400, e.id, 'entry.story')}>
+                    <button type="button" className="st-chip" onClick={() => dropText(e.story!, 10, 400, e.id, 'entry.story')}>
                       {t('journey.studio.addStory')}
                     </button>
                   )}
                   {e.location && (
-                    <button className="st-chip" onClick={() => dropText(e.location!, 8, 700, e.id, 'entry.location')}>
+                    <button type="button" className="st-chip" onClick={() => dropText(e.location!, 8, 700, e.id, 'entry.location')}>
                       {t('journey.studio.addPlace')}
                     </button>
                   )}
@@ -508,7 +508,7 @@ function ContentPanel({
                     mark placed here and one the auto layout placed read alike.
                   */}
                   {e.date && (
-                    <button
+                    <button type="button"
                       className="st-chip"
                       onClick={() => dropText(
                         formatBookDate(e.date!, locale), 8, 700, e.id, 'entry.date',
@@ -519,7 +519,7 @@ function ContentPanel({
                     </button>
                   )}
                   {e.lat != null && e.lng != null && (
-                    <button
+                    <button type="button"
                       className="st-chip"
                       onClick={() => dropText(
                         formatBookCoords(e.lat!, e.lng!, 'dms'), 8, 700, e.id, 'entry.location',
@@ -535,7 +535,7 @@ function ContentPanel({
                     what you are about to place; "Weather" does not.
                   */}
                   {e.mood && MOOD_CONFIG[e.mood] && (
-                    <button
+                    <button type="button"
                       className="st-chip"
                       onClick={() => dropMark('mood', e.mood!, t(MOOD_CONFIG[e.mood!].label))}
                     >
@@ -543,7 +543,7 @@ function ContentPanel({
                     </button>
                   )}
                   {e.weather && WEATHER_CONFIG[e.weather] && (
-                    <button
+                    <button type="button"
                       className="st-chip"
                       onClick={() => dropMark('weather', e.weather!, t(WEATHER_CONFIG[e.weather!].label))}
                     >
@@ -551,7 +551,7 @@ function ContentPanel({
                     </button>
                   )}
                   {(e.pros.length > 0 || e.cons.length > 0) && (
-                    <button className="st-chip" onClick={() => dropProsCons(e.pros, e.cons)}>
+                    <button type="button" className="st-chip" onClick={() => dropProsCons(e.pros, e.cons)}>
                       {t('journey.studio.addProsCons')}
                       <em>{e.pros.length + e.cons.length}</em>
                     </button>
@@ -612,6 +612,7 @@ function TemplatesPanel({
               const slots = tpl.build(page)
               return (
                 <button
+                  type="button"
                   key={tpl.id}
                   className="st-thumb"
                   onClick={() => {
diff --git a/client/src/components/Studio/StudioSwatches.tsx b/client/src/components/Studio/StudioSwatches.tsx
index d3fbb0ccd..9be276802 100644
--- a/client/src/components/Studio/StudioSwatches.tsx
+++ b/client/src/components/Studio/StudioSwatches.tsx
@@ -20,7 +20,7 @@ export function Swatches({ value, onPick }: { value: string; onPick: (c: string)
   return (
     <div className="st-swatches">
       {SWATCHES.map(c => (
-        <button
+        <button type="button"
           key={c}
           className={`st-swatch ${value.toLowerCase() === c ? 'is-on' : ''}`}
           style={{ background: c }} // theme-lint-disable — a colour picker shows the colours themselves
@@ -30,7 +30,8 @@ export function Swatches({ value, onPick }: { value: string; onPick: (c: string)
       ))}
       {/* Anything at all, for a book that has to match a cover or a brand. */}
       <label className="st-swatch st-swatch-custom">
-        <input type="color" value={value} onChange={e => onPick(e.target.value)} />
+        {/* Named by the colour it holds, the way the preset swatches above are. */}
+        <input type="color" aria-label={value} value={value} onChange={e => onPick(e.target.value)} />
       </label>
     </div>
   )
diff --git a/client/src/components/Studio/StudioTravelInspector.tsx b/client/src/components/Studio/StudioTravelInspector.tsx
index b848fbc3b..09be1556f 100644
--- a/client/src/components/Studio/StudioTravelInspector.tsx
+++ b/client/src/components/Studio/StudioTravelInspector.tsx
@@ -52,7 +52,7 @@ export function TravelInspector({ el, stats, set, t }: TravelInspectorProps) {
       {stale && (
         <div className="st-section">
           <p className="st-stale">{t('journey.studio.staleHint')}</p>
-          <button
+          <button type="button"
             className="st-chip"
             onClick={() => {
               if (!stats) return
@@ -85,7 +85,7 @@ export function TravelInspector({ el, stats, set, t }: TravelInspectorProps) {
           {BOOK_FONT_ORDER.map(id => {
             const font = BOOK_FONTS[id]
             return (
-              <button
+              <button type="button"
                 key={id}
                 className={`st-font ${el.font === id ? 'is-on' : ''}`}
                 style={{ fontFamily: font.stack }}
@@ -480,7 +480,7 @@ function MapProps({ el, set, t, stats }: Props<BookMapElement> & { stats: Journe
           </Line>
           {hasRoads && roadState !== 'busy' && (
             <div className="st-row" style={{ marginTop: 8 }}>
-              <button className="st-chip" onClick={() => void loadRoads()}>
+              <button type="button" className="st-chip" onClick={() => void loadRoads()}>
                 {t('journey.studio.roadsAgain')}
               </button>
             </div>
diff --git a/client/src/components/Studio/StudioTravelPanel.tsx b/client/src/components/Studio/StudioTravelPanel.tsx
index e3a4c61c2..d0cbf9a64 100644
--- a/client/src/components/Studio/StudioTravelPanel.tsx
+++ b/client/src/components/Studio/StudioTravelPanel.tsx
@@ -68,7 +68,7 @@ function Card({ label, onClick, children, recommended = false, title }: {
   children: React.ReactNode
 }) {
   return (
-    <button
+    <button type="button"
       className={`st-travel-card ${recommended ? 'is-recommended' : ''}`}
       onClick={onClick}
       title={title ? `${label} — ${title}` : label}
diff --git a/client/src/components/Studio/TravelElements.test.tsx b/client/src/components/Studio/TravelElements.test.tsx
new file mode 100644
index 000000000..715e4ed7c
--- /dev/null
+++ b/client/src/components/Studio/TravelElements.test.tsx
@@ -0,0 +1,116 @@
+import { render } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+import { bookMapElementSchema } from '@trek/shared'
+import { TravelElementView } from './TravelElements'
+import { COUNTRY_SHAPES, countryParts } from './countryShapes'
+
+/*
+ * The maps are measured, not snapshotted: what went wrong in #2021 is a number
+ * — how far apart the stops end up on the paper — and a snapshot of a country
+ * outline says nothing about whether the route inside it is legible.
+ */
+
+const FRAME = { x: 0, y: 0, w: 100, h: 100 }
+
+const PARIS = { lat: 48.86, lng: 2.35 }
+const LYON = { lat: 45.76, lng: 4.84 }
+const NICE = { lat: 43.7, lng: 7.27 }
+
+function mapEl(over: Record<string, unknown>) {
+  return bookMapElementSchema.parse({ id: 'm1', kind: 'map', frame: FRAME, ...over })
+}
+
+/** How wide the stops sit on the page, in millimetres of a 100mm frame. */
+function pinSpan(over: Record<string, unknown>): number {
+  const { container } = render(
+    <TravelElementView el={mapEl(over)} frameStyle={{ width: '100mm', height: '100mm' }} />,
+  )
+  const xs = [...container.querySelectorAll('circle')].map(c => Number(c.getAttribute('cx')))
+  expect(xs.length).toBeGreaterThan(0)
+  return Math.max(...xs) - Math.min(...xs)
+}
+
+describe('MapView fit', () => {
+  it('frames a French route without the overseas territories', () => {
+    expect(pinSpan({ countries: ['FR'], points: [PARIS, LYON, NICE] })).toBeGreaterThan(20)
+  })
+
+  it('frames a British route without South Georgia', () => {
+    const span = pinSpan({
+      countries: ['GB'],
+      points: [{ lat: 51.51, lng: -0.13 }, { lat: 55.95, lng: -3.19 }],
+    })
+    // Smaller than the French case because Britain really is drawn whole here,
+    // which is what the setting asks for. The South Atlantic is not.
+    expect(span).toBeGreaterThan(10)
+  })
+
+  it('frames the route when imagery is cut to the country outline', () => {
+    const span = pinSpan({
+      source: 'tiles', clip: 'country', countries: ['FR'], points: [PARIS, LYON, NICE],
+    })
+    expect(span).toBeGreaterThan(20)
+  })
+
+  it('still draws the whole of a compact country around the route', () => {
+    const span = pinSpan({
+      countries: ['NL'],
+      points: [{ lat: 52.37, lng: 4.9 }, { lat: 51.92, lng: 4.48 }],
+    })
+    // The Netherlands is small enough that "whole country" is still a useful
+    // picture, so this one must NOT grow: the fix is about which rings count,
+    // not about abandoning the fit.
+    expect(span).toBeLessThan(10)
+  })
+
+  it('frames the overseas ring when that is where the trip was', () => {
+    // Cayenne and Kourou. The right answer is French Guiana, not metropolitan
+    // France, so picking the nearest rings has to work in both directions.
+    const span = pinSpan({
+      countries: ['FR'],
+      points: [{ lat: 4.92, lng: -52.33 }, { lat: 5.16, lng: -52.65 }],
+    })
+    expect(span).toBeGreaterThan(5)
+  })
+
+  it('falls back to the whole country when there is no route yet', () => {
+    // An empty map element still has to draw something, and the something is
+    // the country — every ring of it, since nothing says which one matters.
+    const { container } = render(
+      <TravelElementView
+        el={mapEl({ countries: ['FR'], points: [], path: [] })}
+        frameStyle={{ width: '100mm', height: '100mm' }}
+      />,
+    )
+    expect(container.querySelector('path[d]')).not.toBeNull()
+  })
+
+  it('leaves Satellite alone', () => {
+    const span = pinSpan({ source: 'tiles', countries: ['FR'], points: [PARIS, LYON, NICE] })
+    expect(span).toBeGreaterThan(20)
+  })
+})
+
+describe('countryParts', () => {
+  it('splits France into its five landmasses', () => {
+    const lng = countryParts(COUNTRY_SHAPES.FR)
+      .map(p => [Math.round(p[0] * 100) / 100, Math.round(p[2] * 100) / 100])
+      .sort((a, b) => a[0] - b[0])
+    expect(lng).toEqual([
+      [-54.55, -51.67], // French Guiana
+      [-4.69, 8.16],    // metropolitan France
+      [8.6, 9.49],      // Corsica
+      [68.87, 70.42],   // Kerguelen
+      [163.93, 167.03], // New Caledonia
+    ])
+    // The aggregate the outlines are still drawn from is untouched.
+    expect(COUNTRY_SHAPES.FR.b).toEqual([-54.55, -59.62, 167.03, 57.49])
+  })
+
+  it('gives a country with one landmass a single box matching its bounds', () => {
+    const parts = countryParts(COUNTRY_SHAPES.CH)
+    expect(parts).toHaveLength(1)
+    expect(parts[0][0]).toBeCloseTo(COUNTRY_SHAPES.CH.b[0], 1)
+    expect(parts[0][2]).toBeCloseTo(COUNTRY_SHAPES.CH.b[2], 1)
+  })
+})
diff --git a/client/src/components/Studio/TravelElements.tsx b/client/src/components/Studio/TravelElements.tsx
index 07e09d933..4684fbb4c 100644
--- a/client/src/components/Studio/TravelElements.tsx
+++ b/client/src/components/Studio/TravelElements.tsx
@@ -9,7 +9,7 @@ import {
 } from 'lucide-react'
 import { fontStack } from './bookFonts'
 import { brightness } from './folioColour'
-import { COUNTRY_SHAPES, countryWorldPath, projectMercator, unprojectMercator } from './countryShapes'
+import { COUNTRY_SHAPES, countryParts, countryWorldPath, projectMercator, unprojectMercator } from './countryShapes'
 import { projectOntoTiles, tileView, usableStaticUrl } from './mapTiles'
 import { FLAG_H, FLAG_W, flagBands, flagDisc, flagSpec } from './flags'
 import { MOOD_CONFIG, WEATHER_CONFIG } from '../../pages/journeyDetail/JourneyDetailPage.constants'
@@ -100,7 +100,7 @@ const tileOverlapMm = (size: number) => Math.max(0.8, size * 0.04)
 
 /** #rrggbb plus an alpha. */
 function rgba(hex: string, alpha: number): string {
-  const n = parseInt(hex.slice(1), 16)
+  const n = Number.parseInt(hex.slice(1), 16)
   return `rgba(${(n >> 16) & 255}, ${(n >> 8) & 255}, ${n & 255}, ${alpha})`
 }
 
@@ -270,12 +270,6 @@ function MapView({ el, frameStyle, big = false }: {
    */
   const cutToLand = el.clip === 'country' && shapes.length > 0
   const fitToLand = el.fitToCountries || cutToLand || (points.length === 0 && trail.length === 0)
-  if (fitToLand) {
-    for (const s of shapes) {
-      minX = Math.min(minX, s.b[0]); minY = Math.min(minY, s.b[1])
-      maxX = Math.max(maxX, s.b[2]); maxY = Math.max(maxY, s.b[3])
-    }
-  }
   for (const p of points) {
     minX = Math.min(minX, p.x); minY = Math.min(minY, p.y)
     maxX = Math.max(maxX, p.x); maxY = Math.max(maxY, p.y)
@@ -300,6 +294,45 @@ function MapView({ el, frameStyle, big = false }: {
     }
   }
 
+  /*
+   * The country fit comes last, because it needs to know where the journey is.
+   *
+   * A country is one path but not one landmass. France's is five rings, three
+   * of them Kerguelen, French Guiana and New Caledonia, so unioning its whole
+   * bounding box fitted a Paris-Lyon-Nice route to 221 degrees of longitude and
+   * printed the three stops as a single dot. Britain does the same through
+   * South Georgia, Norway through Svalbard, Ecuador through the Galapagos.
+   *
+   * So only the rings the journey is near are fitted to. The margin is the
+   * route's own size, floored at two degrees, and that floor is the whole of
+   * the judgement: at two degrees a Paris-Nice route still pulls in Corsica,
+   * which is the picture that trip wants, while Kerguelen at 68 degrees east
+   * stays out. Raise it far and the territories come back; drop it to zero and
+   * a coastal route sitting just off a simplified coastline stops matching the
+   * country it is in.
+   *
+   * The whole shape is still the fallback — with no route there is nothing to
+   * measure against, and a country none of whose rings match is better drawn
+   * whole than not at all. The outlines themselves are unchanged either way:
+   * the overseas rings are still painted, they just run off the frame the way
+   * a coastline does.
+   */
+  if (fitToLand) {
+    const routed = Number.isFinite(minX)
+    const margin = Math.max(maxX - minX, maxY - minY, 2)
+    const nearX0 = minX - margin, nearY0 = minY - margin
+    const nearX1 = maxX + margin, nearY1 = maxY + margin
+    for (const s of shapes) {
+      const near = routed
+        ? countryParts(s).filter(p => p[0] <= nearX1 && p[2] >= nearX0 && p[1] <= nearY1 && p[3] >= nearY0)
+        : []
+      for (const b of near.length > 0 ? near : [s.b]) {
+        minX = Math.min(minX, b[0]); minY = Math.min(minY, b[1])
+        maxX = Math.max(maxX, b[2]); maxY = Math.max(maxY, b[3])
+      }
+    }
+  }
+
   /*
    * ── The bow ───────────────────────────────────────────────────────────
    *
diff --git a/client/src/components/Studio/autoLayout.ts b/client/src/components/Studio/autoLayout.ts
index 15c45fc84..6c0214d98 100644
--- a/client/src/components/Studio/autoLayout.ts
+++ b/client/src/components/Studio/autoLayout.ts
@@ -1450,7 +1450,7 @@ function backSpread(input: AutoInput): BookSpread {
   const dates = input.entries
     .map(e => e.date)
     .filter((d): d is string => !!d)
-    .sort()
+    .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
   const span = dates.length
     ? [formatBookDate(dates[0], input.locale), formatBookDate(dates[dates.length - 1], input.locale)].filter(Boolean).join(' — ')
     : ''
diff --git a/client/src/components/Studio/countryShapes.ts b/client/src/components/Studio/countryShapes.ts
index 454bc36cf..d1211aef8 100644
--- a/client/src/components/Studio/countryShapes.ts
+++ b/client/src/components/Studio/countryShapes.ts
@@ -59,6 +59,44 @@ export function countryWorldPath(shape: CountryShape): string {
   })
 }
 
+/*
+ * One box per ring of the outline, in the same world coordinates.
+ *
+ * A country is a single path but not a single landmass. France's is five
+ * subpaths, three of which are Kerguelen, French Guiana and New Caledonia, so
+ * its `b` covers 221 degrees of longitude and describes nowhere anybody stood.
+ * Anything fitting a view to a country needs the pieces, not the aggregate.
+ *
+ * Cached against the shape object: the boxes are a property of the generated
+ * data, and the data does not change while the page is open.
+ */
+const PARTS = new WeakMap<CountryShape, [number, number, number, number][]>()
+
+export function countryParts(shape: CountryShape): [number, number, number, number][] {
+  const cached = PARTS.get(shape)
+  if (cached) return cached
+  // The same placement `countryWorldPath` does, applied to the numbers rather
+  // than to the string.
+  const span = Math.max(shape.b[2] - shape.b[0], shape.b[3] - shape.b[1]) / 100
+  const parts: [number, number, number, number][] = []
+  for (const sub of shape.d.split('M')) {
+    const nums = sub.match(/-?\d*\.?\d+/g)
+    if (!nums || nums.length < 2) continue
+    let minX = Infinity, minY = Infinity, maxX = -Infinity, maxY = -Infinity
+    for (let i = 0; i + 1 < nums.length; i += 2) {
+      const x = Number(nums[i]) * span + shape.b[0]
+      const y = Number(nums[i + 1]) * span + shape.b[1]
+      if (x < minX) minX = x
+      if (x > maxX) maxX = x
+      if (y < minY) minY = y
+      if (y > maxY) maxY = y
+    }
+    parts.push([minX, minY, maxX, maxY])
+  }
+  PARTS.set(shape, parts)
+  return parts
+}
+
 export const COUNTRY_SHAPES: Record<string, CountryShape> = {
   AD: { d: 'M84.2 57.2L84.2 50L81.6 50L84.2 46.5L84.2 42.9L86.8 42.9L86.8 35.8L92.1 35.8L92.1 32.2L92.1 35.8L94.7 32.2L94.7 35.8L94.7 32.2L100 32.2L97.4 28.6L89.5 28.6L86.8 25L84.2 25L84.2 17.9L86.8 17.9L86.8 14.3L84.2 14.3L84.2 17.9L84.2 14.3L81.6 14.3L78.9 17.9L78.9 14.3L65.8 14.3L63.2 10.7L44.7 10.7L44.7 3.6L36.8 3.6L36.8 0L34.2 3.6L18.4 3.6L18.4 7.2L15.8 7.2L15.8 14.3L18.4 14.3L18.4 17.9L13.2 17.9L13.2 21.5L7.9 21.5L7.9 25L5.3 25L5.3 28.6L7.9 32.2L7.9 35.8L2.6 35.8L2.6 42.9L0 42.9L10.5 42.9L10.5 46.5L13.2 46.5L13.2 50L15.8 53.6L13.2 53.6L13.2 57.2L7.9 57.2L5.3 60.8L2.6 60.8L2.6 64.3L7.9 64.3L7.9 71.5L10.5 71.5L7.9 71.5L7.9 75L10.5 75L10.5 78.6L7.9 78.6L18.4 78.6L18.4 82.2L36.8 82.2L36.8 78.6L39.5 75L39.5 71.5L42.1 71.5L42.1 75L44.7 75L44.7 71.5L47.4 71.5L50 67.9L52.6 71.5L52.6 67.9L55.3 67.9L57.9 71.5L57.9 67.9L65.8 67.9L65.8 60.8L68.4 57.2L71.1 57.2L71.1 60.8L73.7 57.2L73.7 60.8L78.9 60.8L84.2 57.2Z', w: 100, h: 82.2, b: [1.41, -47.25, 1.79, -46.94] },
   AE: { d: 'M99.8 25.1L99.6 11.1L95.6 9.9L95 5.5L96 2.1L95 0L93.8 0.5L92.3 4.2L93.1 3.2L93.3 3.9L91.1 5.8L91.3 6.9L91.1 6L89.4 8.1L87.5 7.9L87.7 8.8L86.9 9.5L86.7 8.6L86.7 9.9L84.4 12.5L83 12.5L83.4 10.6L81.5 13.6L82.1 13.9L80.5 14.8L81.3 14.5L81.1 15.5L80.5 14.8L79.4 17.1L79 16.2L78.8 17.8L77.3 16.4L78.2 20.3L78.2 18.9L76.7 18.2L77.1 18.9L76.5 18.5L76.9 19.1L74.4 22.8L72.1 24.2L72.6 25.3L71.3 23.7L71.7 25.1L71.3 24L70.7 25.1L70.9 23.7L70.3 25.1L71.1 25.3L69.6 26.3L69.2 25.6L69.6 26.5L68.2 26.9L69.2 28.1L68 26.9L66.3 27.9L66.9 29.2L66.1 29.9L66.3 27.6L65.3 28.8L66.1 29.2L64.9 29L64.7 30.6L63.6 31.1L64.9 32.4L63 35.4L63.8 36.3L60.7 37.7L61.3 38.8L60.1 39.3L59.9 40.2L61.1 40.4L55.5 42.3L53.2 40L52.4 41.6L53.4 42.5L50.9 43.2L52 43.9L53.2 42.5L54.1 42.9L52.6 44.5L52 43.9L52 44.8L48.6 44.8L48.9 45.9L42 46.6L39.1 44.5L36.2 44.8L36.2 45.5L35.3 44.3L35.6 45.2L34.1 44.5L34.5 45.9L32.8 46.1L32 43.9L31.2 44.8L30.4 44.5L31 43.9L24.5 44.5L23.7 43.4L22.9 44.5L21.2 42.5L20.8 44.5L18.7 45.5L17.9 44.8L18.1 46.1L14.8 48L10.8 48.9L7.9 47.5L7.5 48.6L4.4 46.8L4.4 41.4L3.5 40.9L2.5 42.7L1.7 40L2.1 42.3L1.2 42.9L1.5 40.2L0 38.6L0.4 44.5L21 71.5L74.2 78.5L76.1 75.1L76.1 67.7L83.2 56.4L82.5 51.1L81.3 48.9L86.5 46.1L88.6 47.3L92.5 45.9L91.3 42.5L86.9 42.3L88.6 40.2L88.6 37.9L87.3 35.9L88.4 33.4L87.7 32.9L88.8 32.2L88.1 26.7L91.3 24.4L93.1 25.3L93.3 27.6L91.7 27.6L94.4 30.6L96.3 29.7L96.5 28.1L98.5 27.4L99.4 26.3L98.8 25.3L99.8 25.1Z', w: 100, h: 78.5, b: [51.57, -27.02, 56.38, -23.24] },
diff --git a/client/src/components/Studio/folioColour.ts b/client/src/components/Studio/folioColour.ts
index 64afe72a1..965bae73a 100644
--- a/client/src/components/Studio/folioColour.ts
+++ b/client/src/components/Studio/folioColour.ts
@@ -49,7 +49,7 @@ export interface FolioInk {
 export function brightness(hex: string): number {
   const clean = hex.replace('#', '')
   const full = clean.length === 3 ? clean.split('').map(c => c + c).join('') : clean
-  const n = parseInt(full.slice(0, 6), 16)
+  const n = Number.parseInt(full.slice(0, 6), 16)
   if (!Number.isFinite(n)) return 1
   const r = (n >> 16) & 255
   const g = (n >> 8) & 255
diff --git a/client/src/components/SystemNotices/ReleaseNoticeModal.tsx b/client/src/components/SystemNotices/ReleaseNoticeModal.tsx
index 98dac19f8..c87074c4b 100644
--- a/client/src/components/SystemNotices/ReleaseNoticeModal.tsx
+++ b/client/src/components/SystemNotices/ReleaseNoticeModal.tsx
@@ -41,7 +41,7 @@ export function ReleaseNoticeModal({ notice, visible, onDismiss, onCTA, onSecond
       className="rn-overlay"
       role="presentation"
       style={{ opacity: visible ? 1 : 0, transition: 'opacity 260ms ease' }}
-      onClick={notice.dismissible ? onDismiss : undefined}
+      onClick={notice.dismissible ? e => { if (e.target === e.currentTarget) onDismiss() } : undefined}
     >
       <div
         role="dialog"
@@ -49,7 +49,6 @@ export function ReleaseNoticeModal({ notice, visible, onDismiss, onCTA, onSecond
         aria-labelledby={titleId}
         aria-describedby={bodyId}
         className="rn-panel"
-        onClick={e => e.stopPropagation()}
       >
         {/* ── Left: the release ─────────────────────────────────────────── */}
         <div className="rn-release">
@@ -130,7 +129,7 @@ export function ReleaseNoticeModal({ notice, visible, onDismiss, onCTA, onSecond
         {/* ── Right: the note ───────────────────────────────────────────── */}
         <div className="rn-note">
           {notice.dismissible && (
-            <button className="rn-close" onClick={onDismiss} aria-label={t('common.close')}>
+            <button type="button" className="rn-close" onClick={onDismiss} aria-label={t('common.close')}>
               <X size={18} strokeWidth={2} />
             </button>
           )}
@@ -161,7 +160,7 @@ export function ReleaseNoticeModal({ notice, visible, onDismiss, onCTA, onSecond
             <div className="rn-support-text">{t(release.supportTextKey)}</div>
             <div className="rn-support-buttons">
               {notice.cta && (
-                <button
+                <button type="button"
                   id={`notice-cta-${notice.id}`}
                   className="rn-support-btn rn-support-bmc"
                   onClick={onCTA}
@@ -171,7 +170,7 @@ export function ReleaseNoticeModal({ notice, visible, onDismiss, onCTA, onSecond
                 </button>
               )}
               {notice.secondaryCta && (
-                <button
+                <button type="button"
                   id={`notice-cta2-${notice.id}`}
                   className="rn-support-btn rn-support-kofi"
                   onClick={onSecondaryCTA}
diff --git a/client/src/components/SystemNotices/SystemNoticeBanner.tsx b/client/src/components/SystemNotices/SystemNoticeBanner.tsx
index 98551f57f..5ef0521b6 100644
--- a/client/src/components/SystemNotices/SystemNoticeBanner.tsx
+++ b/client/src/components/SystemNotices/SystemNoticeBanner.tsx
@@ -82,7 +82,7 @@ function CTALink({
   }
 
   return (
-    <button
+    <button type="button"
       onClick={handleClick}
       className="underline hover:no-underline font-medium ml-3 shrink-0"
     >
@@ -122,7 +122,7 @@ function BannerItem({ notice, onDismiss }: BannerItemProps) {
         )}
       </div>
       {notice.dismissible && (
-        <button
+        <button type="button"
           onClick={onDismiss}
           className="shrink-0 p-2 -mr-2 rounded hover:bg-black/5 dark:hover:bg-white/10 transition"
           aria-label={`Dismiss: ${title}`}
diff --git a/client/src/components/SystemNotices/SystemNoticeModal.test.tsx b/client/src/components/SystemNotices/SystemNoticeModal.test.tsx
index 63822b13d..05a68b6fa 100644
--- a/client/src/components/SystemNotices/SystemNoticeModal.test.tsx
+++ b/client/src/components/SystemNotices/SystemNoticeModal.test.tsx
@@ -1084,7 +1084,7 @@ describe('ModalRenderer', () => {
     render(<ModalRenderer notices={[noticeA, noticeB]} />);
     await flushGraceDelay();
 
-    const backdrop = screen.getByRole('presentation').children[1] as HTMLElement;
+    const backdrop = screen.getAllByRole('presentation')[1] as HTMLElement;
     await act(async () => {
       fireEvent.click(backdrop);
     });
@@ -1113,7 +1113,7 @@ describe('ModalRenderer', () => {
     expect(screen.getByRole('dialog').className).toContain('opacity-100');
 
     await act(async () => {
-      fireEvent.click(screen.getByRole('presentation').children[1] as HTMLElement);
+      fireEvent.click(screen.getAllByRole('presentation')[1] as HTMLElement);
     });
 
     expect(dismissSpy).toHaveBeenCalledWith('n-a');
@@ -1326,7 +1326,7 @@ describe('ModalRenderer', () => {
     await flushGraceDelay();
 
     await act(async () => {
-      fireEvent.click(screen.getByRole('presentation').children[1] as HTMLElement);
+      fireEvent.click(screen.getAllByRole('presentation')[1] as HTMLElement);
     });
     expect(dismissSpy).not.toHaveBeenCalled();
 
diff --git a/client/src/components/SystemNotices/SystemNoticeModal.tsx b/client/src/components/SystemNotices/SystemNoticeModal.tsx
index 74bd3d98b..7565b62d6 100644
--- a/client/src/components/SystemNotices/SystemNoticeModal.tsx
+++ b/client/src/components/SystemNotices/SystemNoticeModal.tsx
@@ -108,7 +108,7 @@ function NoticeContent({ notice, title, body, ctaLabel, secondaryCtaLabel, title
     <div className="flex flex-col relative" style={{ flex: '1 1 0', minHeight: '100%' }}>
       {/* Dismiss X button — only on last page so users read all notices */}
       {notice.dismissible && isLastPage && (
-        <button
+        <button type="button"
           onClick={onDismissAll}
           className="absolute top-4 right-4 z-10 p-2 rounded-lg text-slate-400 hover:text-slate-600 dark:hover:text-slate-300 hover:bg-slate-100 dark:hover:bg-slate-800 transition-colors"
           aria-label="Dismiss"
@@ -257,7 +257,7 @@ function NoticeContent({ notice, title, body, ctaLabel, secondaryCtaLabel, title
         {total > 1 && (
           <div className="flex flex-col items-center gap-1">
             <div className="flex items-center gap-2">
-              <button
+              <button type="button"
                 onClick={onPrev}
                 disabled={!canPage || currentPage === 0}
                 aria-label={t('system_notice.pager.prev')}
@@ -267,7 +267,7 @@ function NoticeContent({ notice, title, body, ctaLabel, secondaryCtaLabel, title
               </button>
 
               {Array.from({ length: total }, (_, i) => (
-                <button
+                <button type="button"
                   key={i}
                   onClick={() => { if (canPage) onGoto(i); }}
                   aria-label={t('system_notice.pager.goto').replace('{n}', String(i + 1))}
@@ -281,7 +281,7 @@ function NoticeContent({ notice, title, body, ctaLabel, secondaryCtaLabel, title
                 />
               ))}
 
-              <button
+              <button type="button"
                 onClick={onNext}
                 disabled={!canPage || currentPage === total - 1}
                 aria-label={t('system_notice.pager.next')}
@@ -303,7 +303,7 @@ function NoticeContent({ notice, title, body, ctaLabel, secondaryCtaLabel, title
         <div className="flex flex-col items-center gap-3">
           {ctaLabel && isLastPage ? (
             <div className="flex w-full flex-col sm:flex-row gap-2.5">
-              <button
+              <button type="button"
                 id={`notice-cta-${notice.id}`}
                 onClick={onCTA}
                 className={`flex-1 h-11 inline-flex items-center justify-center gap-2 rounded-lg font-semibold shadow-sm transition active:scale-[0.98] ${
@@ -316,7 +316,7 @@ function NoticeContent({ notice, title, body, ctaLabel, secondaryCtaLabel, title
                 {ctaLabel}
               </button>
               {secondaryCtaLabel && (
-                <button
+                <button type="button"
                   id={`notice-cta2-${notice.id}`}
                   onClick={onSecondaryCTA}
                   className={`flex-1 h-11 inline-flex items-center justify-center gap-2 rounded-lg font-semibold shadow-sm transition active:scale-[0.98] ${
@@ -331,7 +331,7 @@ function NoticeContent({ notice, title, body, ctaLabel, secondaryCtaLabel, title
               )}
             </div>
           ) : (notice.dismissible || isLastPage) && (
-            <button
+            <button type="button"
               id={`notice-cta-${notice.id}`}
               onClick={isLastPage ? onDismissAll : onNext}
               className="w-full h-11 rounded-lg bg-blue-600 hover:bg-blue-700 text-white font-medium transition-colors"
@@ -676,6 +676,7 @@ function MobileNoticeSheet(S: NoticeState) {
       {/* Backdrop */}
       <div
         className={`absolute inset-0 bg-slate-950/40 backdrop-blur-[2px] transition-opacity ${dur} ${ease} ${visible ? 'opacity-100' : 'opacity-0'}`}
+        role="presentation"
         onClick={notice.dismissible ? animatedDismissAll : undefined}
       />
       {/* Bottom sheet */}
@@ -843,18 +844,22 @@ function DesktopNoticeModal(S: NoticeState) {
     <div
       className={`fixed inset-0 z-50 bg-slate-950/40 backdrop-blur-[2px] transition-opacity ${dur} ${ease} ${visible ? 'opacity-100' : 'opacity-0'}`}
       role="presentation"
-      onClick={notice.dismissible && isLastPage ? handleDismissAll : undefined}
     >
       {/* Screen-reader page announcements */}
       <span className="sr-only" role="status" aria-live="polite" aria-atomic="true">{pageAnnouncement}</span>
-      <div className="absolute inset-0 flex items-center justify-center p-4">
+      {/* The dismiss lives on this layer: it covers the backdrop, and the
+          target check keeps a click inside the panel from closing the notice. */}
+      <div
+        className="absolute inset-0 flex items-center justify-center p-4"
+        role="presentation"
+        onClick={notice.dismissible && isLastPage ? (e => { if (e.target === e.currentTarget) handleDismissAll() }) : undefined}
+      >
         <div
           role="dialog"
           aria-modal="true"
           aria-labelledby={titleId}
           aria-describedby={bodyId}
           className={`w-full ${maxWidth} rounded-2xl overflow-hidden overflow-y-auto max-h-[90vh] shadow-xl border border-slate-200 dark:border-slate-800 bg-white dark:bg-slate-900 transition-all ${dur} ${ease} ${desktopMotion}`}
-          onClick={e => e.stopPropagation()}
         >
           <div ref={contentWrapperRef}>
             <NoticeContent {...makeContentProps(S, notice, idx)} />
diff --git a/client/src/components/Todo/TodoListPanel.test.tsx b/client/src/components/Todo/TodoListPanel.test.tsx
index 592d56d6e..06bf2aa7b 100644
--- a/client/src/components/Todo/TodoListPanel.test.tsx
+++ b/client/src/components/Todo/TodoListPanel.test.tsx
@@ -42,7 +42,7 @@ describe('TodoListPanel', () => {
   it('FE-COMP-TODO-002: raising addItemSignal opens the new task form', async () => {
     const { rerender } = render(<TodoListPanel tripId={1} items={[]} addItemSignal={0} />);
     rerender(<TodoListPanel tripId={1} items={[]} addItemSignal={1} />);
-    await screen.findByText('Create task');
+    expect(await screen.findByText('Create task')).toBeInTheDocument();
   });
 
   it('FE-COMP-TODO-003: sidebar filter buttons are rendered', () => {
@@ -125,31 +125,27 @@ describe('TodoListPanel', () => {
   it('FE-COMP-TODO-011: raising addItemSignal opens detail form with Create task button', async () => {
     const { rerender } = render(<TodoListPanel tripId={1} items={[]} addItemSignal={0} />);
     rerender(<TodoListPanel tripId={1} items={[]} addItemSignal={1} />);
-    await screen.findByText('Create task');
+    expect(await screen.findByText('Create task')).toBeInTheDocument();
   });
 
   it('FE-COMP-TODO-012: toggling item calls toggleTodoItem action', async () => {
     const user = userEvent.setup();
     let putCalled = false;
     server.use(
-      http.put('/api/trips/1/todo/:id/toggle', () => {
+      http.put('/api/trips/1/todo/:id', () => {
         putCalled = true;
         return HttpResponse.json({ success: true });
       })
     );
     const items = [buildTodoItem({ id: 5, name: 'Toggle Me', checked: 0 })];
     render(<TodoListPanel tripId={1} items={items} />);
-    // Click the checkbox button (Square icon)
-    const checkboxes = screen.getAllByRole('button');
-    // Find the checkbox button near the item
-    const checkboxBtn = checkboxes.find(btn => {
-      const parent = btn.closest('[style*="cursor: pointer"]');
-      return parent && parent.textContent?.includes('Toggle Me');
-    });
-    if (checkboxBtn) {
-      await user.click(checkboxBtn);
-      await waitFor(() => expect(putCalled).toBe(true));
-    }
+    // The checkbox is the row's own <button>; the row around it is a button role.
+    const row = screen.getByText('Toggle Me').closest('[role="button"]') as HTMLElement;
+    const checkboxBtn = row.querySelector('button') as HTMLElement;
+
+    await user.click(checkboxBtn);
+
+    await waitFor(() => expect(putCalled).toBe(true));
   });
 
   it('FE-COMP-TODO-013: clicking a task row opens its detail pane', async () => {
@@ -158,7 +154,7 @@ describe('TodoListPanel', () => {
     render(<TodoListPanel tripId={1} items={items} />);
     await user.click(screen.getByText('Click Me'));
     // Detail pane should open showing the task title
-    await screen.findByText('Task');
+    expect(await screen.findByText('Task')).toBeInTheDocument();
   });
 
   it('FE-COMP-TODO-014: category filter appears in sidebar for items with categories', () => {
@@ -180,7 +176,7 @@ describe('TodoListPanel', () => {
     expect(screen.getByText('JobTask')).toBeInTheDocument();
     expect(screen.getByText('HomeTask')).toBeInTheDocument();
     // Category buttons exist in sidebar (by accessible name or text)
-    const catBtn = screen.getByRole('button', { name: /JobCat/ });
+    const catBtn = sidebarButton(/JobCat/);
     expect(catBtn).toBeInTheDocument();
     // Clicking the category button should work without throwing
     await user.click(catBtn);
@@ -467,9 +463,19 @@ function pickOption(label: string | RegExp) {
  * The sidebar filters are an inline component, so every re-render (the members
  * fetch resolving, for one) swaps the button element. userEvent's async steps can
  * land on the detached node — fireEvent stays atomic.
+ *
+ * A task row is a button too (it is what selects the task), and its name is built
+ * from everything it shows, category chip included. So the sidebar entry is picked
+ * by being an actual <button>.
  */
+function sidebarButton(name: RegExp | string): HTMLElement {
+  const [button] = screen.getAllByRole('button', { name }).filter(el => el.tagName === 'BUTTON');
+  expect(button).toBeDefined();
+  return button;
+}
+
 function clickFilter(name: RegExp | string) {
-  fireEvent.click(screen.getByRole('button', { name }));
+  fireEvent.click(sidebarButton(name));
 }
 
 describe('TodoListPanel — sidebar', () => {
diff --git a/client/src/components/Todo/TodoListPanel.tsx b/client/src/components/Todo/TodoListPanel.tsx
index 4c8254210..5a4e04301 100644
--- a/client/src/components/Todo/TodoListPanel.tsx
+++ b/client/src/components/Todo/TodoListPanel.tsx
@@ -36,7 +36,7 @@ function SidebarItem({ id, icon: Icon, label, count, color, active, compact, onS
   onSelect: (id: string) => void
 }) {
   return (
-    <button onClick={() => onSelect(id)}
+    <button type="button" onClick={() => onSelect(id)}
       title={compact ? label : undefined}
       style={{
         display: 'flex', alignItems: 'center', justifyContent: compact ? 'center' : 'flex-start',
@@ -162,7 +162,7 @@ export default function TodoListPanel({ tripId, items, addItemSignal = 0 }: { tr
         {!isMobile && <div style={{ fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 600, color: 'var(--text-faint)', padding: '16px 12px 4px', textTransform: 'uppercase', letterSpacing: '0.05em' }}>
           {t('todo.sidebar.sortBy')}
         </div>}
-        <button onClick={() => setSortByPrio(v => !v)}
+        <button type="button" onClick={() => setSortByPrio(v => !v)}
           title={isMobile ? t('todo.priority') : undefined}
           style={{
             display: 'flex', alignItems: 'center', justifyContent: isMobile ? 'center' : 'flex-start',
@@ -194,10 +194,10 @@ export default function TodoListPanel({ tripId, items, addItemSignal = 0 }: { tr
                 onKeyDown={e => { if (e.key === 'Enter') addCategory(); if (e.key === 'Escape') { setAddingCategory(false); setNewCategoryName('') } }}
                 placeholder={t('todo.newCategory')}
                 style={{ flex: 1, fontSize: 'calc(12px * var(--fs-scale-body, 1))', padding: '4px 6px', border: '1px solid var(--border-primary)', borderRadius: 5, background: 'var(--bg-hover)', color: 'var(--text-primary)', fontFamily: 'inherit', minWidth: 0 }} />
-              <button onClick={addCategory} style={{ background: 'none', border: 'none', cursor: 'pointer', color: '#22c55e', padding: 2 }}><Check size={13} /></button>
+              <button type="button" onClick={addCategory} style={{ background: 'none', border: 'none', cursor: 'pointer', color: '#22c55e', padding: 2 }}><Check size={13} /></button>
             </div>
           ) : (
-            <button onClick={() => setAddingCategory(true)}
+            <button type="button" onClick={() => setAddingCategory(true)}
               title={isMobile ? t('todo.addCategory') : undefined}
               style={{ display: 'flex', alignItems: 'center', justifyContent: isMobile ? 'center' : 'flex-start', gap: isMobile ? 0 : 6, padding: isMobile ? '8px 0' : '7px 12px', fontSize: 'calc(12px * var(--fs-scale-body, 1))', color: 'var(--text-faint)', background: 'none', border: 'none', cursor: 'pointer', fontFamily: 'inherit', width: '100%', textAlign: 'left' }}>
               <Plus size={isMobile ? 18 : 13} /> {!isMobile && t('todo.addCategory')}
@@ -267,7 +267,7 @@ export default function TodoListPanel({ tripId, items, addItemSignal = 0 }: { tr
         />
       )}
       {selectedItem && !isAddingNew && isMobile && (
-        <div onClick={e => { if (e.target === e.currentTarget) setSelectedId(null) }}
+        <div role="presentation" onClick={e => { if (e.target === e.currentTarget) setSelectedId(null) }}
           style={{ position: 'fixed', inset: 0, zIndex: 1000, background: 'rgba(0,0,0,0.4)', display: 'flex', justifyContent: 'center', alignItems: 'flex-end', paddingBottom: 'var(--bottom-nav-h)' }}>
           <div style={{ width: '100%', maxHeight: '85vh', borderRadius: '16px 16px 0 0', overflow: 'auto' }}
             ref={el => { if (el) { const child = el.firstElementChild as HTMLElement; if (child) { child.style.width = '100%'; child.style.borderLeft = 'none'; child.style.borderRadius = '16px 16px 0 0' } } }}>
@@ -282,7 +282,7 @@ export default function TodoListPanel({ tripId, items, addItemSignal = 0 }: { tr
         </div>
       )}
       {isAddingNew && !selectedItem && !isMobile && createPortal(
-        <div onClick={e => { if (e.target === e.currentTarget) setIsAddingNew(false) }}
+        <div role="presentation" onClick={e => { if (e.target === e.currentTarget) setIsAddingNew(false) }}
           className="trek-modal-backdrop"
           style={{ position: 'fixed', inset: 0, zIndex: 1000, background: 'rgba(15,23,42,0.5)', display: 'flex', justifyContent: 'center', alignItems: 'flex-start', paddingTop: 'calc(var(--nav-h) + 60px)', paddingBottom: 40 }}>
           <div style={{ width: 'min(520px, 92vw)', maxHeight: 'calc(100vh - var(--nav-h) - 120px)', overflow: 'auto', borderRadius: 16, boxShadow: '0 20px 60px rgba(0,0,0,0.25)' }}
@@ -300,7 +300,7 @@ export default function TodoListPanel({ tripId, items, addItemSignal = 0 }: { tr
         document.body
       )}
       {isAddingNew && !selectedItem && isMobile && createPortal(
-        <div onClick={e => { if (e.target === e.currentTarget) setIsAddingNew(false) }}
+        <div role="presentation" onClick={e => { if (e.target === e.currentTarget) setIsAddingNew(false) }}
           className="trek-modal-backdrop"
           style={{ position: 'fixed', inset: 0, zIndex: 1000, background: 'rgba(0,0,0,0.4)', display: 'flex', justifyContent: 'center', alignItems: 'flex-end', paddingBottom: 'var(--bottom-nav-h)' }}>
           <div style={{ width: '100%', maxHeight: '85vh', borderRadius: '16px 16px 0 0', overflow: 'auto' }}
@@ -391,7 +391,7 @@ function DetailPane({ item, tripId, categories, members, onClose }: {
       {/* Header */}
       <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '16px 20px 12px', borderBottom: '1px solid var(--border-faint)' }}>
         <span style={{ fontSize: 'calc(14px * var(--fs-scale-body, 1))', fontWeight: 700, color: 'var(--text-primary)' }}>{t('todo.detail.title')}</span>
-        <button onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 4 }}>
+        <button type="button" onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 4 }}>
           <X size={16} />
         </button>
       </div>
@@ -421,7 +421,7 @@ function DetailPane({ item, tripId, categories, members, onClose }: {
               const cfg = PRIO_CONFIG[p]
               const isActive = priority === p
               return (
-                <button key={p} onClick={() => canEdit && setPriority(p)}
+                <button type="button" key={p} onClick={() => canEdit && setPriority(p)}
                   style={{
                     flex: 1, padding: '6px 0', borderRadius: 6, fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: canEdit ? 'pointer' : 'default',
                     fontFamily: 'inherit', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 4,
@@ -527,7 +527,7 @@ function DetailPane({ item, tripId, categories, members, onClose }: {
       {/* Footer actions */}
       {canEdit && (
         <div style={{ padding: '12px 20px', borderTop: '1px solid var(--border-faint)', display: 'flex', gap: 8 }}>
-          <button onClick={handleDelete}
+          <button type="button" onClick={handleDelete}
             style={{
               flex: 1, padding: '9px 16px', borderRadius: 8, fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit',
               border: '1px solid var(--border-primary)', background: 'transparent', color: 'var(--text-secondary)',
@@ -536,7 +536,7 @@ function DetailPane({ item, tripId, categories, members, onClose }: {
             <Trash2 size={13} />
             {t('todo.detail.delete')}
           </button>
-          <button onClick={save} disabled={!hasChanges || saving}
+          <button type="button" onClick={save} disabled={!hasChanges || saving}
             style={{
               flex: 1, padding: '9px 16px', borderRadius: 8, fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: hasChanges ? 'pointer' : 'default', fontFamily: 'inherit',
               border: 'none', background: hasChanges ? 'var(--text-primary)' : 'var(--border-faint)',
@@ -594,7 +594,7 @@ function NewTaskPane({ tripId, categories, members, defaultCategory, onCreated,
     }}>
       <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '16px 20px 12px', borderBottom: '1px solid var(--border-faint)' }}>
         <span style={{ fontSize: 'calc(14px * var(--fs-scale-body, 1))', fontWeight: 700, color: 'var(--text-primary)' }}>{t('todo.newItem')}</span>
-        <button onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 4 }}>
+        <button type="button" onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 4 }}>
           <X size={16} />
         </button>
       </div>
@@ -668,7 +668,7 @@ function NewTaskPane({ tripId, categories, members, defaultCategory, onCreated,
               const cfg = PRIO_CONFIG[p]
               const isActive = priority === p
               return (
-                <button key={p} onClick={() => setPriority(p)}
+                <button type="button" key={p} onClick={() => setPriority(p)}
                   style={{
                     flex: 1, padding: '6px 0', borderRadius: 6, fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: 'pointer',
                     fontFamily: 'inherit', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 4,
@@ -714,7 +714,7 @@ function NewTaskPane({ tripId, categories, members, defaultCategory, onCreated,
       </div>
 
       <div style={{ padding: '12px 20px', borderTop: '1px solid var(--border-faint)' }}>
-        <button onClick={create} disabled={!name.trim() || saving}
+        <button type="button" onClick={create} disabled={!name.trim() || saving}
           style={{
             width: '100%', padding: '9px 16px', borderRadius: 8, fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: name.trim() ? 'pointer' : 'default', fontFamily: 'inherit',
             border: 'none', background: name.trim() ? 'var(--text-primary)' : 'var(--border-faint)',
diff --git a/client/src/components/Todo/TodoRow.test.tsx b/client/src/components/Todo/TodoRow.test.tsx
index f1d9501a1..ab686c882 100644
--- a/client/src/components/Todo/TodoRow.test.tsx
+++ b/client/src/components/Todo/TodoRow.test.tsx
@@ -73,26 +73,26 @@ describe('TodoRow', () => {
   })
 
   it('FE-W4TDR-004: the checkbox toggles the task without selecting the row', () => {
-    const { onToggle, onSelect } = setup(todo())
+    const { onToggle, onSelect, container } = setup(todo())
 
-    fireEvent.click(screen.getAllByRole('button')[0])
+    fireEvent.click(container.querySelector('button')!)
 
     expect(onToggle).toHaveBeenCalledWith(10, true)
     expect(onSelect).not.toHaveBeenCalled()
   })
 
   it('FE-W4TDR-005: a done task strikes through and unchecks on click', () => {
-    const { onToggle } = setup(todo({ checked: 1 } as Partial<TodoItem>))
+    const { onToggle, container } = setup(todo({ checked: 1 } as Partial<TodoItem>))
 
     expect(screen.getByText('Book ferry')).toHaveStyle({ textDecoration: 'line-through' })
-    fireEvent.click(screen.getAllByRole('button')[0])
+    fireEvent.click(container.querySelector('button')!)
     expect(onToggle).toHaveBeenCalledWith(10, false)
   })
 
   it('FE-W4TDR-006: a read-only row swallows the toggle', () => {
-    const { onToggle } = setup(todo(), { canEdit: false })
+    const { onToggle, container } = setup(todo(), { canEdit: false })
 
-    fireEvent.click(screen.getAllByRole('button')[0])
+    fireEvent.click(container.querySelector('button')!)
 
     expect(onToggle).not.toHaveBeenCalled()
   })
diff --git a/client/src/components/Todo/TodoRow.tsx b/client/src/components/Todo/TodoRow.tsx
index f49941b9d..f300eec9b 100644
--- a/client/src/components/Todo/TodoRow.tsx
+++ b/client/src/components/Todo/TodoRow.tsx
@@ -33,7 +33,18 @@ export default function TodoRow({ item, members, categories, today, isSelected,
 
   return (
     <div key={item.id}
+      // Selecting the task has no other trigger, so the row is the control. Its
+      // checkbox and its drag handle answer for themselves, hence the key handler
+      // only fires when the row itself has focus.
+      role="button"
+      tabIndex={0}
       onClick={() => onSelect(isSelected ? null : item.id)}
+      onKeyDown={e => {
+        if (e.target !== e.currentTarget) return
+        if (e.key !== 'Enter' && e.key !== ' ') return
+        e.preventDefault()
+        onSelect(isSelected ? null : item.id)
+      }}
       onDragOver={canDrag ? (e => { e.preventDefault(); e.dataTransfer.dropEffect = 'move'; drag!.onOver(item.id) }) : undefined}
       onDragLeave={canDrag ? (e => { if (!e.currentTarget.contains(e.relatedTarget as Node)) drag!.onOver(-1) }) : undefined}
       onDrop={canDrag ? (e => { e.preventDefault(); e.stopPropagation(); drag!.onDrop(item.id) }) : undefined}
@@ -50,6 +61,9 @@ export default function TodoRow({ item, members, categories, today, isSelected,
 
       {canDrag && (
         <div
+          // Dragging is the handle's whole job; the click only keeps the row from
+          // selecting, so the handle stays presentational.
+          role="presentation"
           draggable
           onClick={e => e.stopPropagation()}
           onDragStart={e => { e.stopPropagation(); e.dataTransfer.effectAllowed = 'move'; drag!.onStart(item.id) }}
@@ -61,7 +75,7 @@ export default function TodoRow({ item, members, categories, today, isSelected,
       )}
 
       {/* Checkbox */}
-      <button onClick={e => { e.stopPropagation(); if (canEdit) onToggle(item.id, !done) }}
+      <button type="button" onClick={e => { e.stopPropagation(); if (canEdit) onToggle(item.id, !done) }}
         style={{ background: 'none', border: 'none', cursor: canEdit ? 'pointer' : 'default', padding: 0, flexShrink: 0,
           color: done ? '#22c55e' : 'var(--border-primary)' }}>
         {done ? <CheckSquare size={18} /> : <Square size={18} />}
@@ -83,7 +97,7 @@ export default function TodoRow({ item, members, categories, today, isSelected,
           </div>
         )}
         {/* Inline badges */}
-        {(item.priority || item.due_date || catColor || assignedUser) && (
+        {!!(item.priority || item.due_date || catColor || assignedUser) && (
         <div style={{ display: 'flex', gap: 5, marginTop: 5, flexWrap: 'wrap' }}>
           {item.priority > 0 && PRIO_CONFIG[item.priority] && (
             <span style={{
diff --git a/client/src/components/Todo/todoListModel.ts b/client/src/components/Todo/todoListModel.ts
index 3961fa180..702789915 100644
--- a/client/src/components/Todo/todoListModel.ts
+++ b/client/src/components/Todo/todoListModel.ts
@@ -15,7 +15,7 @@ export function katColor(kat: string, allCategories: string[]) {
   const idx = allCategories.indexOf(kat)
   if (idx >= 0) return KAT_COLORS[idx % KAT_COLORS.length]
   let h = 0
-  for (let i = 0; i < kat.length; i++) h = ((h << 5) - h + kat.charCodeAt(i)) | 0
+  for (let i = 0; i < kat.length; i++) h = ((h << 5) - h + kat.codePointAt(i)) | 0
   return KAT_COLORS[Math.abs(h) % KAT_COLORS.length]
 }
 
diff --git a/client/src/components/Todo/useTodoList.ts b/client/src/components/Todo/useTodoList.ts
index 79bd22739..fea2b5392 100644
--- a/client/src/components/Todo/useTodoList.ts
+++ b/client/src/components/Todo/useTodoList.ts
@@ -63,7 +63,10 @@ export function useTodoList(tripId: number, items: TodoItem[], addItemSignal: nu
   const categories = useMemo(() => {
     const cats = new Set<string>()
     items.forEach(i => { if (i.category) cats.add(i.category) })
-    return Array.from(cats).sort()
+    // Category names are free text the user types, and TREK ships 23 locales — a
+    // bare .sort() is byte order, which files every accented name behind the whole
+    // ASCII range ("Übernachtung" after "Zelt").
+    return Array.from(cats).sort((a, b) => a.localeCompare(b))
   }, [items])
 
   // due_date is a bare calendar date, so "today" has to be the user's calendar
diff --git a/client/src/components/Trips/TripFormModal.test.tsx b/client/src/components/Trips/TripFormModal.test.tsx
index 75982b6cd..a75f301fc 100644
--- a/client/src/components/Trips/TripFormModal.test.tsx
+++ b/client/src/components/Trips/TripFormModal.test.tsx
@@ -1,6 +1,6 @@
 // FE-COMP-TRIPFORM-001 to FE-COMP-TRIPFORM-084
 import type { Mock } from 'vitest';
-import { render, screen, waitFor, fireEvent } from '../../../tests/helpers/render';
+import { render, screen, waitFor, fireEvent, within } from '../../../tests/helpers/render';
 import userEvent from '@testing-library/user-event';
 import { delay, http, HttpResponse } from 'msw';
 import { useAuthStore } from '../../store/authStore';
@@ -112,7 +112,7 @@ describe('TripFormModal', () => {
       await user.click(submitBtn.closest('button') || submitBtn);
     }
     // Error: "Title is required"
-    await screen.findByText('Title is required');
+    expect(await screen.findByText('Title is required')).toBeInTheDocument();
   });
 
   it('FE-COMP-TRIPFORM-010: typing title and submitting calls onSave', async () => {
@@ -229,7 +229,7 @@ describe('TripFormModal', () => {
       )
     );
     render(<TripFormModal {...defaultProps} trip={null} />);
-    await screen.findByText('Travel buddies');
+    expect(await screen.findByText('Travel buddies')).toBeInTheDocument();
   });
 
   it('FE-COMP-TRIPFORM-024: selecting a member adds a chip', async () => {
@@ -272,7 +272,7 @@ describe('TripFormModal', () => {
     const aliceChip = screen.getByText('alice');
     expect(aliceChip).toBeInTheDocument();
     // Click the chip to remove alice
-    await user.click(aliceChip.closest('span')!);
+    await user.click(aliceChip.closest('button')!);
     // alice chip should be gone
     await waitFor(() => expect(screen.queryByText('alice')).not.toBeInTheDocument());
   });
@@ -305,7 +305,7 @@ describe('TripFormModal', () => {
     const submitBtns = screen.getAllByText('Create New Trip');
     const submitBtn = submitBtns.find(el => el.closest('button'))!;
     await user.click(submitBtn.closest('button')!);
-    await screen.findByText('Server error');
+    expect(await screen.findByText('Server error')).toBeInTheDocument();
   });
 
   it('FE-COMP-TRIPFORM-028: loading spinner shown while submitting', async () => {
@@ -720,7 +720,7 @@ describe('TripFormModal', () => {
     await user.type(screen.getByPlaceholderText('Search destination photos'), 'nowhere');
     await user.click(screen.getByRole('button', { name: /Search Unsplash/i }));
 
-    await screen.findByText('No images found');
+    expect(await screen.findByText('No images found')).toBeInTheDocument();
   });
 
   it('FE-COMP-TRIPFORM-054: a failing search shows the server error', async () => {
@@ -735,7 +735,7 @@ describe('TripFormModal', () => {
     await user.type(screen.getByPlaceholderText('Search destination photos'), 'alps');
     await user.click(screen.getByRole('button', { name: /Search Unsplash/i }));
 
-    await screen.findByText('Unsplash key missing');
+    expect(await screen.findByText('Unsplash key missing')).toBeInTheDocument();
   });
 
   it('FE-COMP-TRIPFORM-055: a photo without a photographer falls back in the label and drops the credit', async () => {
@@ -1071,9 +1071,11 @@ describe('TripFormModal', () => {
 
     await screen.findByText('alice');
     await user.click(screen.getByText('Add member').closest('button')!);
-    // alice is already a member, so only bob is offered.
-    expect(screen.queryAllByRole('button', { name: 'alice' })).toHaveLength(0);
-    await user.click(await screen.findByRole('button', { name: 'bob' }));
+    // alice is already a member, so the option list offers only bob (her chip
+    // outside the list is a button of its own — that is what removes her).
+    const bobOption = await screen.findByRole('button', { name: 'bob' });
+    expect(within(bobOption.parentElement!).queryByRole('button', { name: 'alice' })).toBeNull();
+    await user.click(bobOption);
 
     await waitFor(() => expect(identifier).toBe('bob'));
     expect(addToast).toHaveBeenCalledWith('bob added', 'success', undefined);
@@ -1104,7 +1106,7 @@ describe('TripFormModal', () => {
     await user.type(screen.getByPlaceholderText(/Summer in Japan/i), 'Broken');
     await submitNewTrip(user);
 
-    await screen.findByText('Failed to save');
+    expect(await screen.findByText('Failed to save')).toBeInTheDocument();
   });
 
   it('FE-COMP-TRIPFORM-077: a save error from the date-shift step is shown on that step', async () => {
diff --git a/client/src/components/Trips/TripFormModal.tsx b/client/src/components/Trips/TripFormModal.tsx
index e253fda38..228e97d76 100644
--- a/client/src/components/Trips/TripFormModal.tsx
+++ b/client/src/components/Trips/TripFormModal.tsx
@@ -384,7 +384,7 @@ export default function TripFormModal({ isOpen, onClose, onSave, trip, onCoverUp
               <button type="button" onClick={() => setPendingDateShift(null)} disabled={isLoading} className={ghostBtnCls}>
                 {t('common.back')}
               </button>
-              <button onClick={() => performSave({ ...pendingDateShift, date_shift_mode: dateShiftMode })} disabled={isLoading}
+              <button type="button" onClick={() => performSave({ ...pendingDateShift, date_shift_mode: dateShiftMode })} disabled={isLoading}
                 className={primaryBtnCls}>
                 {isLoading
                   ? <><div className="w-4 h-4 border-2 border-accent-text/30 border-t-accent-text rounded-full animate-spin" />{t('common.saving')}</>
@@ -396,7 +396,7 @@ export default function TripFormModal({ isOpen, onClose, onSave, trip, onCoverUp
               <button type="button" onClick={onClose} className={ghostBtnCls}>
                 {t('common.cancel')}
               </button>
-              <button onClick={handleSubmit} disabled={isLoading} className={primaryBtnCls}>
+              <button type="button" onClick={handleSubmit} disabled={isLoading} className={primaryBtnCls}>
                 {isLoading
                   ? <><div className="w-4 h-4 border-2 border-accent-text/30 border-t-accent-text rounded-full animate-spin" />{t('common.saving')}</>
                   : isEditing ? t('common.update') : t('dashboard.createTrip')}
@@ -420,9 +420,9 @@ export default function TripFormModal({ isOpen, onClose, onSave, trip, onCoverUp
               className={`flex items-start gap-3 p-3 border rounded-xl cursor-pointer transition-colors ${dateShiftMode === mode ? 'border-accent bg-surface-selected' : 'border-edge hover:bg-surface-hover'}`}>
               <input type="radio" name="date_shift_mode" value={mode} checked={dateShiftMode === mode}
                 onChange={() => setDateShiftMode(mode)} className="mt-1 accent-[var(--accent)]" />
-              <span>
-                <span className="block text-body font-medium text-content">{label}</span>
-                <span className="block text-body text-content-muted mt-0.5">{desc}</span>
+              <span className="block text-body font-medium text-content">
+                {label}
+                <span className="block text-body font-normal text-content-muted mt-0.5">{desc}</span>
               </span>
             </label>
           ))}
@@ -633,13 +633,13 @@ export default function TripFormModal({ isOpen, onClose, onSave, trip, onCoverUp
         {allUsers.filter(u => u.id !== currentUser?.id).length > 0 && (
           <div>
             <label className={labelCls}>
-              <UserPlus className="w-3.5 h-3.5" />{isEditing ? t('dashboard.addMembers') : t('dashboard.addMembers')}
+              <UserPlus className="w-3.5 h-3.5" />{t('dashboard.addMembers')}
             </label>
             {/* Existing members (editing mode) */}
             {isEditing && existingMembers.length > 0 && (
               <div className="flex flex-wrap gap-1.5 mb-2">
                 {existingMembers.map(m => (
-                  <span key={m.id}
+                  <button type="button" key={m.id} disabled={m.id === currentUser?.id}
                     className="flex items-center gap-1.5 px-2.5 py-1 rounded-full text-body font-medium bg-surface text-content border border-edge"
                     onClick={async () => {
                       if (m.id === currentUser?.id) return
@@ -652,7 +652,7 @@ export default function TripFormModal({ isOpen, onClose, onSave, trip, onCoverUp
                     style={{ cursor: m.id === currentUser?.id ? 'default' : 'pointer' }}>
                     {m.username}
                     {m.id !== currentUser?.id && <X size={11} className="text-content-faint" />}
-                  </span>
+                  </button>
                 ))}
               </div>
             )}
@@ -662,11 +662,11 @@ export default function TripFormModal({ isOpen, onClose, onSave, trip, onCoverUp
                 {selectedMembers.map(uid => {
                   const user = allUsers.find(u => u.id === uid)!
                   return (
-                    <span key={uid} onClick={() => setSelectedMembers(prev => prev.filter(id => id !== uid))}
+                    <button type="button" key={uid} onClick={() => setSelectedMembers(prev => prev.filter(id => id !== uid))}
                       className="flex items-center gap-1.5 px-2.5 py-1 rounded-full text-body font-medium bg-surface text-content border border-edge cursor-pointer">
                       {user.username}
                       <X size={11} className="text-content-faint" />
-                    </span>
+                    </button>
                   )
                 })}
               </div>
diff --git a/client/src/components/Trips/TripMembersModal.test.tsx b/client/src/components/Trips/TripMembersModal.test.tsx
index cff2f05a6..d0dfb2e97 100644
--- a/client/src/components/Trips/TripMembersModal.test.tsx
+++ b/client/src/components/Trips/TripMembersModal.test.tsx
@@ -99,18 +99,18 @@ describe('TripMembersModal', () => {
 
   it('FE-COMP-MEMBERS-003: shows owner username after load', async () => {
     render(<TripMembersModal {...defaultProps} />);
-    await screen.findByText('owner');
+    expect(await screen.findByText('owner')).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-004: shows Owner label', async () => {
     render(<TripMembersModal {...defaultProps} />);
-    await screen.findByText('Owner');
+    expect(await screen.findByText('Owner')).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-005: shows Access section heading', async () => {
     render(<TripMembersModal {...defaultProps} />);
     // Text is "Access (1 person)" so use regex
-    await screen.findByText(/Access/i);
+    expect(await screen.findByText(/Access/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-006: shows member when members are loaded', async () => {
@@ -124,17 +124,17 @@ describe('TripMembersModal', () => {
       )
     );
     render(<TripMembersModal {...defaultProps} />);
-    await screen.findByText('alice');
+    expect(await screen.findByText('alice')).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-007: shows Invite User section', async () => {
     render(<TripMembersModal {...defaultProps} />);
-    await screen.findByText('Invite User');
+    expect(await screen.findByText('Invite User')).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-008: shows Invite button', async () => {
     render(<TripMembersModal {...defaultProps} />);
-    await screen.findByRole('button', { name: /Invite/i });
+    expect(await screen.findByRole('button', { name: /Invite/i })).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-009: Cancel/close button is present', () => {
@@ -148,7 +148,7 @@ describe('TripMembersModal', () => {
   it('FE-COMP-MEMBERS-010: shows member count of 1 with owner', async () => {
     render(<TripMembersModal {...defaultProps} />);
     // 1 person (just owner)
-    await screen.findByText(/1 person/i);
+    expect(await screen.findByText(/1 person/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-011: members count increases when member is added', async () => {
@@ -162,13 +162,13 @@ describe('TripMembersModal', () => {
       )
     );
     render(<TripMembersModal {...defaultProps} />);
-    await screen.findByText(/2 persons/i);
+    expect(await screen.findByText(/2 persons/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-012: shows "you" label next to current user', async () => {
     render(<TripMembersModal {...defaultProps} />);
     // Rendered as "(you)" — use regex to find it
-    await screen.findByText(/\(you\)/i);
+    expect(await screen.findByText(/\(you\)/i)).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-013: shows remove access button for members (not owner)', async () => {
@@ -237,7 +237,7 @@ describe('TripMembersModal', () => {
     seedStore(useTripStore, { trip: buildTrip({ id: 1, user_id: ownerUser.id }) });
 
     render(<TripMembersModal {...defaultProps} />);
-    await screen.findByText('Public Link');
+    expect(await screen.findByText('Public Link')).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-018: create share link shows URL after clicking create', async () => {
@@ -462,7 +462,7 @@ describe('TripMembersModal', () => {
     );
 
     render(<TripMembersModal {...defaultProps} />);
-    await screen.findByText('All users already have access.');
+    expect(await screen.findByText('All users already have access.')).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-026: owner sees the guests section and can add a guest (#1362)', async () => {
@@ -519,7 +519,7 @@ describe('TripMembersModal', () => {
     mockRoster([], { id: ownerUser.id, username: '', avatar_url: null });
     render(<TripMembersModal {...defaultProps} />);
 
-    await screen.findByText('?');
+    expect(await screen.findByText('?')).toBeInTheDocument();
   });
 
   it('FE-COMP-MEMBERS-030: a failing roster load shows an error toast and an empty list', async () => {
diff --git a/client/src/components/Trips/TripMembersModal.tsx b/client/src/components/Trips/TripMembersModal.tsx
index 787e9ad36..dcc768c19 100644
--- a/client/src/components/Trips/TripMembersModal.tsx
+++ b/client/src/components/Trips/TripMembersModal.tsx
@@ -23,7 +23,7 @@ function Avatar({ username, avatarUrl, size = 32 }: AvatarProps) {
   }
   const letter = (username || '?')[0].toUpperCase()
   const colors = ['#3b82f6', '#8b5cf6', '#ec4899', '#10b981', '#f59e0b', '#ef4444', '#06b6d4']
-  const color = colors[letter.charCodeAt(0) % colors.length]
+  const color = colors[(letter.codePointAt(0) ?? 0) % colors.length]
   return (
     <div style={{
       width: size, height: size, borderRadius: '50%', background: color,
@@ -106,7 +106,7 @@ function ShareLinkSection({ tripId, t }: { tripId: number; t: (key: string, para
           { key: 'share_budget', label: t('share.permBudget') },
           { key: 'share_collab', label: t('share.permCollab') },
         ].map(opt => (
-          <button key={opt.key} onClick={() => !opt.always && handleUpdatePerms(opt.key, !perms[opt.key])}
+          <button type="button" key={opt.key} onClick={() => !opt.always && handleUpdatePerms(opt.key, !perms[opt.key])}
             style={{
               display: 'flex', alignItems: 'center', gap: 5, padding: '4px 10px', borderRadius: 20,
               border: '1.5px solid', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 500, cursor: opt.always ? 'default' : 'pointer',
@@ -132,7 +132,7 @@ function ShareLinkSection({ tripId, t }: { tripId: number; t: (key: string, para
               flex: 1, border: 'none', background: 'none', fontSize: 'calc(11px * var(--fs-scale-caption, 1))',
               outline: 'none', fontFamily: 'monospace',
             }} />
-            <button onClick={handleCopy} style={{
+            <button type="button" onClick={handleCopy} style={{
               display: 'flex', alignItems: 'center', gap: 4, padding: '4px 8px', borderRadius: 6,
               border: 'none', background: copied ? '#16a34a' : 'var(--accent)', color: copied ? 'white' : 'var(--accent-text)',
               fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit', transition: 'background 0.2s',
@@ -140,7 +140,7 @@ function ShareLinkSection({ tripId, t }: { tripId: number; t: (key: string, para
               {copied ? <><Check size={10} /> {t('common.copied')}</> : <><Copy size={10} /> {t('common.copy')}</>}
             </button>
           </div>
-          <button onClick={handleDelete} style={{
+          <button type="button" onClick={handleDelete} style={{
             display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 5,
             padding: '6px 0', borderRadius: 8, border: '1px solid rgba(239,68,68,0.3)',
             background: 'rgba(239,68,68,0.06)', color: '#ef4444', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 500,
@@ -150,7 +150,7 @@ function ShareLinkSection({ tripId, t }: { tripId: number; t: (key: string, para
           </button>
         </div>
       ) : (
-        <button onClick={handleCreate} className="border border-dashed border-edge text-content-muted" style={{
+        <button type="button" onClick={handleCreate} className="border border-dashed border-edge text-content-muted" style={{
           display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 6,
           width: '100%', padding: '8px 0', borderRadius: 8,
           background: 'none', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500,
@@ -222,7 +222,7 @@ function TripInviteLinkSection({ tripId, t }: { tripId: number; t: (key: string,
         <div style={{ display: 'flex', flexDirection: 'column', gap: 8 }}>
           <div className="bg-surface-tertiary border border-edge-faint" style={{ display: 'flex', alignItems: 'center', gap: 6, padding: '8px 10px', borderRadius: 8 }}>
             <input type="text" value={inviteUrl} readOnly className="text-content" style={{ flex: 1, border: 'none', background: 'none', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', outline: 'none', fontFamily: 'monospace' }} />
-            <button onClick={copy} style={{
+            <button type="button" onClick={copy} style={{
               display: 'flex', alignItems: 'center', gap: 4, padding: '4px 8px', borderRadius: 6,
               border: 'none', background: copied ? '#16a34a' : 'var(--accent)', color: copied ? 'white' : 'var(--accent-text)',
               fontSize: 'calc(10px * var(--fs-scale-caption, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit', transition: 'background 0.2s',
@@ -231,14 +231,14 @@ function TripInviteLinkSection({ tripId, t }: { tripId: number; t: (key: string,
             </button>
           </div>
           <div style={{ display: 'flex', gap: 8 }}>
-            <button onClick={create} disabled={busy} className="border border-edge text-content-muted" style={{
+            <button type="button" onClick={create} disabled={busy} className="border border-edge text-content-muted" style={{
               flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 5,
               padding: '6px 0', borderRadius: 8, background: 'none', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 500,
               cursor: busy ? 'default' : 'pointer', fontFamily: 'inherit',
             }}>
               <Link2 size={11} /> {t('trip.invite.regenerate')}
             </button>
-            <button onClick={remove} disabled={busy} style={{
+            <button type="button" onClick={remove} disabled={busy} style={{
               flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 5,
               padding: '6px 0', borderRadius: 8, border: '1px solid rgba(239,68,68,0.3)',
               background: 'rgba(239,68,68,0.06)', color: '#ef4444', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', fontWeight: 500,
@@ -249,7 +249,7 @@ function TripInviteLinkSection({ tripId, t }: { tripId: number; t: (key: string,
           </div>
         </div>
       ) : (
-        <button onClick={create} disabled={busy} className="border border-dashed border-edge text-content-muted" style={{
+        <button type="button" onClick={create} disabled={busy} className="border border-dashed border-edge text-content-muted" style={{
           display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 6,
           width: '100%', padding: '8px 0', borderRadius: 8,
           background: 'none', fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500,
@@ -470,7 +470,7 @@ export default function TripMembersModal({ isOpen, onClose, tripId, tripTitle, o
               style={{ flex: 1 }}
               size="sm"
             />
-            <button
+            <button type="button"
               onClick={handleAdd}
               disabled={adding || !selectedUserId}
               style={{
@@ -526,7 +526,7 @@ export default function TripMembersModal({ isOpen, onClose, tripId, tripTitle, o
                       </div>
                     </div>
                     {isCurrentOwner && member.role !== 'owner' && (
-                      <button
+                      <button type="button"
                         onClick={() => handleTransfer(member.id, member.username)}
                         disabled={transferringId === member.id}
                         title={t('members.makeOwner')}
@@ -538,7 +538,7 @@ export default function TripMembersModal({ isOpen, onClose, tripId, tripTitle, o
                       </button>
                     )}
                     {canRemove && (
-                      <button
+                      <button type="button"
                         onClick={() => handleRemove(member.id, isSelf)}
                         disabled={removingId === member.id}
                         title={isSelf ? t('members.leaveTrip') : t('members.removeAccess')}
@@ -594,7 +594,7 @@ export default function TripMembersModal({ isOpen, onClose, tripId, tripTitle, o
                 )}
                 {isCurrentOwner && renamingGuestId !== g.id && (
                   <>
-                    <button
+                    <button type="button"
                       onClick={() => { renameCommittedRef.current = false; setRenamingGuestId(g.id); setRenameValue(g.username) }}
                       title={t('common.rename')}
                       style={{ background: 'none', border: 'none', cursor: 'pointer', padding: '4px', borderRadius: 6, display: 'flex', color: 'var(--text-faint)' }}
@@ -603,7 +603,7 @@ export default function TripMembersModal({ isOpen, onClose, tripId, tripTitle, o
                     >
                       <Pencil size={13} />
                     </button>
-                    <button
+                    <button type="button"
                       onClick={() => handleDeleteGuest(g.id)}
                       disabled={removingId === g.id}
                       title={t('members.removeAccess')}
@@ -630,7 +630,7 @@ export default function TripMembersModal({ isOpen, onClose, tripId, tripTitle, o
                 className="bg-surface border border-edge text-content"
                 style={{ flex: 1, minWidth: 0, fontSize: 'calc(13px * var(--fs-scale-body, 1))', padding: '8px 10px', borderRadius: 10, outline: 'none', fontFamily: 'inherit' }}
               />
-              <button
+              <button type="button"
                 onClick={handleAddGuest}
                 disabled={addingGuest || !newGuestName.trim()}
                 style={{
diff --git a/client/src/components/Vacay/VacayCalendar.tsx b/client/src/components/Vacay/VacayCalendar.tsx
index 7707115c4..08a844236 100644
--- a/client/src/components/Vacay/VacayCalendar.tsx
+++ b/client/src/components/Vacay/VacayCalendar.tsx
@@ -218,7 +218,7 @@ export default function VacayCalendar() {
       {/* Floating toolbar — lift above the mobile bottom nav (z-60). On desktop --bottom-nav-h is 0px. */}
       <div className="sticky mt-3 sm:mt-4 flex items-center justify-center px-2" style={{ bottom: 'calc(var(--bottom-nav-h, 0px) + 12px)', zIndex: 61 }}>
         <div className="vg-card flex items-center gap-1.5 sm:gap-2 px-2 sm:px-3 py-1.5 sm:py-2 rounded-full">
-          <button
+          <button type="button"
             onClick={() => setMode('vacation')}
             className="flex items-center gap-1 sm:gap-1.5 px-2 sm:px-3 py-1.5 rounded-full text-[11px] sm:text-xs font-semibold transition-[background-color,color] duration-150 ease-[cubic-bezier(0.23,1,0.32,1)]"
             style={mode === 'vacation'
@@ -229,7 +229,7 @@ export default function VacayCalendar() {
             {selectedUser ? selectedUser.username : t('vacay.modeVacation')}
           </button>
           {companyHolidaysEnabled && (
-            <button
+            <button type="button"
               onClick={() => setMode('company')}
               className="flex items-center gap-1 sm:gap-1.5 px-2 sm:px-3 py-1.5 rounded-full text-[11px] sm:text-xs font-semibold transition-[background-color,color] duration-150 ease-[cubic-bezier(0.23,1,0.32,1)]"
               style={companyMode
@@ -243,7 +243,7 @@ export default function VacayCalendar() {
           {/* Divider — comp/flex and half-day are modifiers, not modes. */}
           <span className="w-px self-stretch my-0.5" style={{ background: 'var(--vg-line)' }} aria-hidden />
 
-          <button
+          <button type="button"
             onClick={() => setCompDay(v => !v)}
             title={t('vacay.modeCompHint')}
             aria-pressed={compDay}
@@ -262,7 +262,7 @@ export default function VacayCalendar() {
             {t('vacay.modeComp')}
           </button>
 
-          <button
+          <button type="button"
             onClick={() => setHalfDay(v => !v)}
             title={t('vacay.modeHalfHint')}
             aria-pressed={halfDay}
diff --git a/client/src/components/Vacay/VacayMonthCard.tsx b/client/src/components/Vacay/VacayMonthCard.tsx
index 6b80eeddf..7dc1d0d44 100644
--- a/client/src/components/Vacay/VacayMonthCard.tsx
+++ b/client/src/components/Vacay/VacayMonthCard.tsx
@@ -161,6 +161,10 @@ export default function VacayMonthCard({
             <div
               key={di}
               title={publicHoliday ? (publicHoliday.label ? `${publicHoliday.label}: ${publicHoliday.localName}` : publicHoliday.localName) : undefined}
+              // Stays a div: the cell is a grid item that stacks the segment,
+              // ring and marker overlays on top of itself.
+              role="button"
+              tabIndex={0}
               className="relative flex items-center justify-center transition-colors"
               style={{
                 height: 28,
@@ -170,6 +174,7 @@ export default function VacayMonthCard({
                 cursor: isBlocked ? 'default' : 'pointer',
               }}
               onClick={() => onCellClick(dateStr)}
+              onKeyDown={e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); onCellClick(dateStr) } }}
               onMouseEnter={e => {
                 if (!isBlocked && plain) e.currentTarget.style.background = 'var(--vg-surf2)'
                 if (hasEntries || sharedColors.length > 0 || schoolHolidayMarkers.length > 0) onCellHover?.(dateStr, e.currentTarget)
diff --git a/client/src/components/Vacay/VacayPersons.tsx b/client/src/components/Vacay/VacayPersons.tsx
index 43bb30e48..080452aac 100644
--- a/client/src/components/Vacay/VacayPersons.tsx
+++ b/client/src/components/Vacay/VacayPersons.tsx
@@ -1,5 +1,5 @@
 import { createPortal } from 'react-dom'
-import { useState, useEffect } from 'react'
+import { useState, useEffect, type HTMLAttributes } from 'react'
 import { UserPlus, Check, Loader2, Clock, X } from 'lucide-react'
 import { useVacayStore } from '../../store/vacayStore'
 import { useAuthStore } from '../../store/authStore'
@@ -67,7 +67,7 @@ export default function VacayPersons() {
     <div className="vg-card rounded-[22px]" style={{ padding: '14px 18px' }}>
       <div className="flex items-center justify-between mb-2">
         <span style={{ fontSize: 11, fontWeight: 600, textTransform: 'uppercase', letterSpacing: '0.14em', color: 'var(--vg-ink3)' }}>{t('vacay.persons')}</span>
-        <button onClick={() => { setShowInvite(true); loadAvailable() }}
+        <button type="button" onClick={() => { setShowInvite(true); loadAvailable() }}
           className="w-7 h-7 rounded-lg flex items-center justify-center transition-colors"
           style={{ color: 'var(--vg-ink3)' }}>
           <UserPlus size={15} />
@@ -77,9 +77,20 @@ export default function VacayPersons() {
       <div className="flex flex-col gap-1">
         {users.map(u => {
           const isSelected = selectedUserId === u.id
+          // Only a fused plan lets you pick whose leave you are looking at, so the
+          // row takes focus and keys only then — it stays a div because the colour
+          // dot inside it is a button of its own.
+          const select: HTMLAttributes<HTMLDivElement> = isFused
+            ? {
+                role: 'button',
+                tabIndex: 0,
+                onClick: () => setSelectedUserId(u.id),
+                onKeyDown: e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); setSelectedUserId(u.id) } },
+              }
+            : {}
           return (
             <div key={u.id}
-              onClick={() => { if (isFused) setSelectedUserId(u.id) }}
+              {...select}
               className="flex items-center gap-2.5 group transition-colors"
               style={{
                 padding: '7px 10px',
@@ -88,7 +99,7 @@ export default function VacayPersons() {
                 background: isSelected ? 'var(--vg-surf2)' : 'transparent',
                 border: `1px solid ${isSelected ? 'var(--vg-line)' : 'transparent'}`,
               }}>
-              <button
+              <button type="button"
                 onClick={(e) => { e.stopPropagation(); setColorEditUserId(u.id); setShowColorPicker(true) }}
                 className="w-3 h-3 rounded-full shrink-0 transition-transform hover:scale-125"
                 style={{ backgroundColor: u.color, cursor: 'pointer' }}
@@ -114,7 +125,7 @@ export default function VacayPersons() {
               {inv.username}
             </span>
             <VacayBadge label={t('vacay.pending')} tone="amber" />
-            <button onClick={() => cancelInvite(inv.user_id)}
+            <button type="button" onClick={() => cancelInvite(inv.user_id)}
               className="ml-auto opacity-0 group-hover:opacity-100 text-[10px] px-1.5 py-0.5 rounded transition-all"
               style={{ color: 'var(--vg-ink3)' }}>
               {t('common.cancel')}
@@ -126,12 +137,12 @@ export default function VacayPersons() {
       {/* Invite Modal — Portal to body to avoid z-index issues */}
       {showInvite && createPortal(
         <div className="fixed inset-0 flex items-center justify-center px-4 trek-backdrop-enter bg-[rgba(15,23,42,0.5)]" style={{ zIndex: 99990, paddingTop: 70 }}
-          onClick={() => setShowInvite(false)}>
-          <div className="trek-modal-enter rounded-2xl shadow-2xl w-full max-w-sm bg-surface-card"
-            onClick={e => e.stopPropagation()}>
+          role="presentation"
+          onClick={e => { if (e.target === e.currentTarget) setShowInvite(false) }}>
+          <div className="trek-modal-enter rounded-2xl shadow-2xl w-full max-w-sm bg-surface-card">
             <div className="flex items-center justify-between p-5 border-b border-edge-secondary">
               <h2 className="text-base font-semibold text-content">{t('vacay.inviteUser')}</h2>
-              <button onClick={() => setShowInvite(false)} className="p-1.5 rounded-lg transition-colors text-content-faint">
+              <button type="button" onClick={() => setShowInvite(false)} className="p-1.5 rounded-lg transition-colors text-content-faint">
                 <X size={16} />
               </button>
             </div>
@@ -149,10 +160,10 @@ export default function VacayPersons() {
                 />
               )}
               <div className="flex gap-3 justify-end pt-2">
-                <button onClick={() => setShowInvite(false)} className="px-4 py-2 text-sm rounded-lg text-content-muted border border-edge">
+                <button type="button" onClick={() => setShowInvite(false)} className="px-4 py-2 text-sm rounded-lg text-content-muted border border-edge">
                   {t('common.cancel')}
                 </button>
-                <button onClick={handleInvite} disabled={!selectedInviteUser || inviting}
+                <button type="button" onClick={handleInvite} disabled={!selectedInviteUser || inviting}
                   className="px-4 py-2 text-sm rounded-lg transition-colors flex items-center gap-1.5 disabled:opacity-40 bg-content text-surface-card">
                   {inviting && <Loader2 size={13} className="animate-spin" />}
                   {t('vacay.sendInvite')}
@@ -167,19 +178,19 @@ export default function VacayPersons() {
       {/* Color Picker Modal — Portal to body */}
       {showColorPicker && createPortal(
         <div className="fixed inset-0 flex items-center justify-center px-4 trek-backdrop-enter bg-[rgba(15,23,42,0.5)]" style={{ zIndex: 99990, paddingTop: 70 }}
-          onClick={() => { setShowColorPicker(false); setColorEditUserId(null) }}>
-          <div className="trek-modal-enter rounded-2xl shadow-2xl w-full max-w-xs bg-surface-card"
-            onClick={e => e.stopPropagation()}>
+          role="presentation"
+          onClick={e => { if (e.target !== e.currentTarget) return; setShowColorPicker(false); setColorEditUserId(null) }}>
+          <div className="trek-modal-enter rounded-2xl shadow-2xl w-full max-w-xs bg-surface-card">
             <div className="flex items-center justify-between p-5 border-b border-edge-secondary">
               <h2 className="text-base font-semibold text-content">{t('vacay.changeColor')}</h2>
-              <button onClick={() => { setShowColorPicker(false); setColorEditUserId(null) }} className="p-1.5 rounded-lg transition-colors text-content-faint">
+              <button type="button" onClick={() => { setShowColorPicker(false); setColorEditUserId(null) }} className="p-1.5 rounded-lg transition-colors text-content-faint">
                 <X size={16} />
               </button>
             </div>
             <div className="p-5">
               <div className="flex flex-wrap gap-2 justify-center">
                 {PRESET_COLORS.map(c => (
-                  <button key={c} onClick={() => handleColorChange(c)}
+                  <button type="button" key={c} onClick={() => handleColorChange(c)}
                     className={`w-8 h-8 rounded-full transition-transform duration-150 ease-[cubic-bezier(0.23,1,0.32,1)] ${editingUserColor === c ? 'ring-2 ring-offset-2 scale-110' : 'hover:scale-110'}`}
                     style={{ backgroundColor: c }} />
                 ))}
diff --git a/client/src/components/Vacay/VacaySettings.tsx b/client/src/components/Vacay/VacaySettings.tsx
index caba93a19..62cda3490 100644
--- a/client/src/components/Vacay/VacaySettings.tsx
+++ b/client/src/components/Vacay/VacaySettings.tsx
@@ -76,7 +76,7 @@ export default function VacaySettings({ onClose }: VacaySettingsProps) {
               const current: number[] = plan.weekend_days ? String(plan.weekend_days).split(',').map(Number) : [0, 6]
               const active = current.includes(day)
               return (
-                <button key={day} onClick={() => {
+                <button type="button" key={day} onClick={() => {
                   const next = active ? current.filter(d => d !== day) : [...current, day]
                   updatePlan({ weekend_days: next.join(',') })
                 }}
@@ -111,7 +111,7 @@ export default function VacaySettings({ onClose }: VacaySettingsProps) {
           ].map(({ value, label }) => {
             const active = (plan.week_start ?? 1) === value
             return (
-              <button key={value} onClick={() => updatePlan({ week_start: value })}
+              <button type="button" key={value} onClick={() => updatePlan({ week_start: value })}
                 style={{
                   padding: '4px 10px', borderRadius: 8, fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer',
                   fontFamily: 'inherit', border: '1px solid', transition: 'all 0.12s',
@@ -194,7 +194,7 @@ export default function VacaySettings({ onClose }: VacaySettingsProps) {
                 onCancel={() => setShowAddForm(false)}
               />
             ) : (
-              <button
+              <button type="button"
                 onClick={() => setShowAddForm(true)}
                 className="w-full flex items-center justify-center gap-1.5 text-xs font-medium py-2.5 rounded-xl border border-dashed transition-colors"
                 style={{ borderColor: 'var(--vg-line2)', background: 'var(--vg-surf)', color: 'var(--vg-ink2)' }}
@@ -242,7 +242,7 @@ export default function VacaySettings({ onClose }: VacaySettingsProps) {
                 onCancel={() => setShowAddSchoolForm(false)}
               />
             ) : (
-              <button
+              <button type="button"
                 onClick={() => setShowAddSchoolForm(true)}
                 className="flex items-center gap-1.5 text-xs px-2 py-1.5 rounded-md transition-colors text-content-muted bg-surface-secondary"
               >
@@ -278,7 +278,7 @@ export default function VacaySettings({ onClose }: VacaySettingsProps) {
               ))}
             </div>
             <div className="px-4 py-3 border-t border-t-[rgba(239,68,68,0.1)]">
-              <button
+              <button type="button"
                 onClick={async () => {
                   await dissolve()
                   toast.success(t('vacay.dissolved'))
@@ -345,7 +345,7 @@ function YearTypePicker() {
           { value: 'fiscal', label: t('vacay.yearTypeFiscal') },
           { value: 'anniversary', label: t('vacay.yearTypeAnniversary') },
         ] as const).map(({ value, label }) => (
-          <button key={value} onClick={() => save({ year_type: value })}
+          <button type="button" key={value} onClick={() => save({ year_type: value })}
             style={{
               padding: '4px 10px', borderRadius: 8, fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer',
               fontFamily: 'inherit', border: '1px solid', transition: 'all 0.12s',
@@ -363,7 +363,7 @@ function YearTypePicker() {
           <div className="flex-1 min-w-0">
             <CustomSelect
               value={String(yearSettings.year_start_month)}
-              onChange={v => save({ year_start_month: parseInt(String(v), 10) })}
+              onChange={v => save({ year_start_month: Number.parseInt(String(v), 10) })}
               options={monthNames.map((label, i) => ({ value: String(i + 1), label }))}
               placeholder={t('vacay.yearStartMonth')}
             />
@@ -371,7 +371,7 @@ function YearTypePicker() {
           <div className="w-[92px] shrink-0">
             <CustomSelect
               value={String(yearSettings.year_start_day)}
-              onChange={v => save({ year_start_day: parseInt(String(v), 10) })}
+              onChange={v => save({ year_start_day: Number.parseInt(String(v), 10) })}
               options={Array.from({ length: maxDay }, (_, i) => ({ value: String(i + 1), label: String(i + 1) }))}
               placeholder={t('vacay.yearStartDay')}
             />
@@ -425,7 +425,7 @@ function SettingToggle({ icon: Icon, label, hint, value, onChange }: SettingTogg
           <p className="text-[11px] text-content-faint">{hint}</p>
         </div>
       </div>
-      <button onClick={onChange}
+      <button type="button" onClick={onChange}
         className={`relative shrink-0 inline-flex h-6 w-11 items-center rounded-full transition-colors ${value ? 'bg-content' : 'bg-edge'}`}>
         <span className="absolute left-1 h-4 w-4 rounded-full transition-transform duration-200 bg-surface-card"
           style={{ transform: value ? 'translateX(20px)' : 'translateX(0)' }} />
@@ -485,7 +485,7 @@ function CalendarRow({ cal, countries, calendarType, onUpdate, onDelete }: {
   return (
     <div className="flex gap-3 items-start p-3 rounded-xl" style={{ background: 'var(--vg-surf)', border: '1px solid var(--vg-line)' }}>
       <div style={{ position: 'relative', flexShrink: 0 }}>
-        <button
+        <button type="button"
           onClick={() => setShowColorPicker(!showColorPicker)}
           style={{ width: 28, height: 28, borderRadius: 8, background: localColor, border: '2px solid var(--border-primary)', cursor: 'pointer' }}
           title={t('vacay.calendarColor')}
@@ -493,7 +493,7 @@ function CalendarRow({ cal, countries, calendarType, onUpdate, onDelete }: {
         {showColorPicker && (
           <div style={{ position: 'absolute', top: 34, left: 0, zIndex: 50, background: 'var(--bg-card)', border: '1px solid var(--border-primary)', borderRadius: 12, padding: 8, boxShadow: '0 8px 24px rgba(0,0,0,0.12)', display: 'grid', gridTemplateColumns: 'repeat(4, 1fr)', gap: 4, width: 120 }}>
             {PRESET_COLORS.map(c => (
-              <button key={c} onClick={() => { setLocalColor(c); setShowColorPicker(false); if (c !== cal.color) onUpdate({ color: c }) }}
+              <button type="button" key={c} onClick={() => { setLocalColor(c); setShowColorPicker(false); if (c !== cal.color) onUpdate({ color: c }) }}
                 style={{ width: 24, height: 24, borderRadius: 6, background: c, border: localColor === c ? '2px solid var(--text-primary)' : '2px solid transparent', cursor: 'pointer' }} />
             ))}
           </div>
@@ -526,7 +526,7 @@ function CalendarRow({ cal, countries, calendarType, onUpdate, onDelete }: {
           />
         )}
       </div>
-      <button
+      <button type="button"
         onClick={onDelete}
         className="shrink-0 p-1.5 rounded-md transition-colors text-content-faint"
         onMouseEnter={e => { (e.currentTarget as HTMLButtonElement).style.background = 'rgba(239,68,68,0.1)' }}
@@ -568,7 +568,7 @@ function AddCalendarForm({ countries, calendarType, onAdd, onCancel, defaultColo
   return (
     <div className="flex gap-3 items-start p-3 rounded-xl border border-dashed" style={{ borderColor: 'var(--vg-line2)', background: 'var(--vg-surf)' }}>
       <div style={{ position: 'relative', flexShrink: 0 }}>
-        <button
+        <button type="button"
           onClick={() => setShowColorPicker(!showColorPicker)}
           style={{ width: 28, height: 28, borderRadius: 8, background: color, border: '2px solid var(--border-primary)', cursor: 'pointer' }}
           title={t('vacay.calendarColor')}
@@ -576,7 +576,7 @@ function AddCalendarForm({ countries, calendarType, onAdd, onCancel, defaultColo
         {showColorPicker && (
           <div style={{ position: 'absolute', top: 34, left: 0, zIndex: 50, background: 'var(--bg-card)', border: '1px solid var(--border-primary)', borderRadius: 12, padding: 8, boxShadow: '0 8px 24px rgba(0,0,0,0.12)', display: 'grid', gridTemplateColumns: 'repeat(4, 1fr)', gap: 4, width: 120 }}>
             {PRESET_COLORS.map(c => (
-              <button key={c} onClick={() => { setColor(c); setShowColorPicker(false) }}
+              <button type="button" key={c} onClick={() => { setColor(c); setShowColorPicker(false) }}
                 style={{ width: 24, height: 24, borderRadius: 6, background: c, border: color === c ? '2px solid var(--text-primary)' : '2px solid transparent', cursor: 'pointer' }} />
             ))}
           </div>
@@ -607,7 +607,7 @@ function AddCalendarForm({ countries, calendarType, onAdd, onCancel, defaultColo
           />
         )}
         <div className="flex gap-1.5 pt-0.5">
-          <button
+          <button type="button"
             disabled={!canAdd}
             aria-busy={loadingRegions}
             onClick={() => onAdd({ region: region || selectedCountry, color, label: label.trim() || null })}
@@ -616,7 +616,7 @@ function AddCalendarForm({ countries, calendarType, onAdd, onCancel, defaultColo
             {loadingRegions && <Loader2 size={12} className="animate-spin" />}
             {t('vacay.add')}
           </button>
-          <button
+          <button type="button"
             onClick={onCancel}
             className="text-xs px-2 py-1.5 rounded-md transition-colors bg-surface-secondary text-content-muted"
           >
diff --git a/client/src/components/Vacay/VacaySharedCalendars.tsx b/client/src/components/Vacay/VacaySharedCalendars.tsx
index 060c7e3e8..2a2dfa059 100644
--- a/client/src/components/Vacay/VacaySharedCalendars.tsx
+++ b/client/src/components/Vacay/VacaySharedCalendars.tsx
@@ -61,7 +61,7 @@ export default function VacaySharedCalendars() {
     <div className="vg-card rounded-[22px]" style={{ padding: '14px 18px' }}>
       <div className="flex items-center justify-between mb-2">
         <span style={{ fontSize: 11, fontWeight: 600, textTransform: 'uppercase', letterSpacing: '0.14em', color: 'var(--vg-ink3)' }}>{t('vacay.sharedCalendars')}</span>
-        <button onClick={() => { setShowShare(true); loadAvailable() }}
+        <button type="button" onClick={() => { setShowShare(true); loadAvailable() }}
           className="w-7 h-7 rounded-lg flex items-center justify-center transition-colors"
           style={{ color: 'var(--vg-ink3)' }}
           title={t('vacay.shareCalendar')}>
@@ -77,7 +77,10 @@ export default function VacaySharedCalendars() {
         <div className="flex flex-col gap-1">
           {incomingShares.map(s => (
             <div key={s.id}
+              role="button"
+              tabIndex={0}
               onClick={() => handleToggleHidden(s.id, !s.hidden)}
+              onKeyDown={e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); handleToggleHidden(s.id, !s.hidden) } }}
               className="flex items-center gap-2.5 group transition-colors cursor-pointer"
               style={{ padding: '7px 10px', borderRadius: 12, opacity: s.hidden ? 0.55 : 1 }}
               title={s.hidden ? t('vacay.showInCalendar') : t('vacay.hideFromCalendar')}>
@@ -88,7 +91,7 @@ export default function VacaySharedCalendars() {
               </span>
               <VacayBadge label={t('vacay.viewOnly')} />
               <span className="ml-auto flex items-center gap-1">
-                <button onClick={e => { e.stopPropagation(); handleRemove(s.id) }}
+                <button type="button" onClick={e => { e.stopPropagation(); handleRemove(s.id) }}
                   className="opacity-0 group-hover:opacity-100 w-5 h-5 rounded flex items-center justify-center transition-all"
                   style={{ color: 'var(--vg-ink3)' }}
                   title={t('vacay.remove')}>
@@ -115,7 +118,7 @@ export default function VacaySharedCalendars() {
               <span className="truncate min-w-0" style={{ fontSize: 13, color: 'var(--vg-ink2)' }}>
                 {s.username}
               </span>
-              <button onClick={() => handleRemove(s.id)}
+              <button type="button" onClick={() => handleRemove(s.id)}
                 className="ml-auto opacity-0 group-hover:opacity-100 text-[10px] px-1.5 py-0.5 rounded transition-all"
                 style={{ color: 'var(--vg-ink3)' }}>
                 {t('vacay.stopSharing')}
@@ -128,12 +131,14 @@ export default function VacaySharedCalendars() {
       {/* Share Modal — Portal to body to avoid z-index issues */}
       {showShare && createPortal(
         <div className="fixed inset-0 flex items-center justify-center px-4 trek-backdrop-enter bg-[rgba(15,23,42,0.5)]" style={{ zIndex: 99990, paddingTop: 70 }}
+          role="presentation"
           onClick={() => setShowShare(false)}>
           <div className="trek-modal-enter rounded-2xl shadow-2xl w-full max-w-sm bg-surface-card"
+            role="presentation"
             onClick={e => e.stopPropagation()}>
             <div className="flex items-center justify-between p-5 border-b border-edge-secondary">
               <h2 className="text-base font-semibold text-content">{t('vacay.shareCalendar')}</h2>
-              <button onClick={() => setShowShare(false)} className="p-1.5 rounded-lg transition-colors text-content-faint">
+              <button type="button" onClick={() => setShowShare(false)} className="p-1.5 rounded-lg transition-colors text-content-faint">
                 <X size={16} />
               </button>
             </div>
@@ -151,10 +156,10 @@ export default function VacaySharedCalendars() {
                 />
               )}
               <div className="flex gap-3 justify-end pt-2">
-                <button onClick={() => setShowShare(false)} className="px-4 py-2 text-sm rounded-lg text-content-muted border border-edge">
+                <button type="button" onClick={() => setShowShare(false)} className="px-4 py-2 text-sm rounded-lg text-content-muted border border-edge">
                   {t('common.cancel')}
                 </button>
-                <button onClick={handleShare} disabled={!selectedUser || sharing}
+                <button type="button" onClick={handleShare} disabled={!selectedUser || sharing}
                   className="px-4 py-2 text-sm rounded-lg transition-colors flex items-center gap-1.5 disabled:opacity-40 bg-content text-surface-card">
                   {sharing && <Loader2 size={13} className="animate-spin" />}
                   {t('vacay.share')}
diff --git a/client/src/components/Vacay/VacayStats.tsx b/client/src/components/Vacay/VacayStats.tsx
index 0e32961eb..7a6c51a0b 100644
--- a/client/src/components/Vacay/VacayStats.tsx
+++ b/client/src/components/Vacay/VacayStats.tsx
@@ -49,7 +49,7 @@ export default function VacayStats() {
     <div className="vg-card rounded-[22px]" style={{ padding: '14px 18px' }}>
       {/* The whole header is the fold handle — the sidebar gets long once several
           people are fused in, and this card is the one you stop needing. */}
-      <button
+      <button type="button"
         onClick={toggleCollapsed}
         aria-expanded={!collapsed}
         className={`w-full flex items-start gap-2 text-left ${collapsed ? '' : 'mb-2.5'}`}
@@ -116,8 +116,8 @@ function StatCard({ stat: s, isMe, canEdit, selectedYear, isShiftedYear, onSave,
 
   const handleSave = () => {
     setEditing(false)
-    const days = parseInt(String(localDays))
-    if (!isNaN(days) && days >= 0 && days <= 365 && days !== s.vacation_days) {
+    const days = Number.parseInt(String(localDays))
+    if (!Number.isNaN(days) && days >= 0 && days <= 365 && days !== s.vacation_days) {
       onSave(selectedYear, days, s.user_id)
     }
   }
@@ -159,6 +159,9 @@ function StatCard({ stat: s, isMe, canEdit, selectedYear, isShiftedYear, onSave,
           className="group/days"
           style={{ padding: '6px 9px', borderRadius: 10, background: 'var(--vg-surf2)', cursor: canEdit ? 'pointer' : 'default' }}
           onClick={() => { if (canEdit && !editing) setEditing(true) }}
+          role={canEdit && !editing ? 'button' : undefined}
+          tabIndex={canEdit && !editing ? 0 : undefined}
+          onKeyDown={canEdit && !editing ? e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); setEditing(true) } } : undefined}
         >
           <div style={{ fontSize: 10, marginBottom: 2, color: 'var(--vg-ink3)', height: 13, lineHeight: '13px' }}>
             {t('vacay.entitlementDays')} {canEdit && !editing && <Pencil size={9} className="inline opacity-0 group-hover/days:opacity-100 transition-opacity" style={{ verticalAlign: 'middle', color: 'var(--vg-ink3)' }} />}
diff --git a/client/src/components/shared/ConfirmDialog.tsx b/client/src/components/shared/ConfirmDialog.tsx
index d0feab2ba..472ca5cf9 100644
--- a/client/src/components/shared/ConfirmDialog.tsx
+++ b/client/src/components/shared/ConfirmDialog.tsx
@@ -51,11 +51,15 @@ export default function ConfirmDialog({
 
   return createPortal(
     <div
+      // Backdrop only — Escape (above) and the Cancel button below are the
+      // keyboard routes out of the dialog.
+      role="presentation"
       className="fixed inset-0 z-[10000] flex items-center justify-center px-4 trek-backdrop-enter bg-[rgba(15,23,42,0.5)]"
       style={{ paddingBottom: 'var(--bottom-nav-h)' }}
       onClick={onClose}
     >
       <div
+        role="presentation"
         className="trek-modal-enter rounded-2xl shadow-2xl w-full max-w-sm p-6 bg-surface-card"
         onClick={e => e.stopPropagation()}
       >
@@ -76,13 +80,13 @@ export default function ConfirmDialog({
         </div>
 
         <div className="flex justify-end gap-3 mt-6">
-          <button
+          <button type="button"
             onClick={onClose}
             className="px-4 py-2 text-sm font-medium rounded-lg transition-colors text-content-secondary border border-edge-secondary"
           >
             {cancelLabel || t('common.cancel')}
           </button>
-          <button
+          <button type="button"
             onClick={() => { runConfirm(onConfirm); onClose() }}
             className={`px-4 py-2 text-sm font-medium rounded-lg transition-colors text-white ${
               danger ? 'bg-red-600 hover:bg-red-700' : 'bg-blue-600 hover:bg-blue-700'
diff --git a/client/src/components/shared/ContextMenu.tsx b/client/src/components/shared/ContextMenu.tsx
index f98965c16..b6c4c9ec6 100644
--- a/client/src/components/shared/ContextMenu.tsx
+++ b/client/src/components/shared/ContextMenu.tsx
@@ -79,7 +79,7 @@ export function ContextMenu({ menu, onClose }: ContextMenuProps) {
         if (item.divider) return <div key={i} style={{ height: 1, background: 'var(--border-faint)', margin: '3px 6px' }} />
         const Icon = item.icon
         return (
-          <button key={i} onClick={() => { item.onClick?.(); onClose() }} style={{
+          <button type="button" key={i} onClick={() => { item.onClick?.(); onClose() }} style={{
             display: 'flex', alignItems: 'center', gap: 8, width: '100%',
             padding: '7px 10px', borderRadius: 7, border: 'none',
             background: 'none', cursor: 'pointer', fontFamily: 'inherit',
diff --git a/client/src/components/shared/CopyTripDialog.tsx b/client/src/components/shared/CopyTripDialog.tsx
index 5c79324f5..d22343c93 100644
--- a/client/src/components/shared/CopyTripDialog.tsx
+++ b/client/src/components/shared/CopyTripDialog.tsx
@@ -44,9 +44,17 @@ export default function CopyTripDialog({ isOpen, tripTitle, onClose, onConfirm }
     <div
       className="fixed inset-0 z-[10000] flex items-center justify-center px-4 trek-backdrop-enter bg-[rgba(15,23,42,0.5)]"
       style={{ paddingBottom: 'var(--bottom-nav-h)' }}
+      role="button"
+      tabIndex={0}
+      aria-label={t('common.close')}
       onClick={onClose}
+      onKeyDown={e => {
+        if (e.target !== e.currentTarget) return
+        if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); onClose() }
+      }}
     >
       <div
+        role="presentation"
         className="trek-modal-enter rounded-2xl shadow-2xl w-full max-w-md p-6 bg-surface-card"
         onClick={e => e.stopPropagation()}
       >
@@ -88,13 +96,13 @@ export default function CopyTripDialog({ isOpen, tripTitle, onClose, onConfirm }
         </div>
 
         <div className="flex justify-end gap-3 mt-5">
-          <button
+          <button type="button"
             onClick={onClose}
             className="px-4 py-2 text-sm font-medium rounded-lg transition-colors text-content-secondary border border-edge-secondary"
           >
             {t('common.cancel')}
           </button>
-          <button
+          <button type="button"
             onClick={() => { onConfirm(); onClose() }}
             className="px-4 py-2 text-sm font-medium rounded-lg transition-opacity hover:opacity-90 bg-content text-surface-card"
           >
diff --git a/client/src/components/shared/CustomDateTimePicker.test.tsx b/client/src/components/shared/CustomDateTimePicker.test.tsx
index fa72bc7ed..986e2419e 100644
--- a/client/src/components/shared/CustomDateTimePicker.test.tsx
+++ b/client/src/components/shared/CustomDateTimePicker.test.tsx
@@ -1,4 +1,5 @@
 import userEvent from '@testing-library/user-event';
+import { localIsoDate } from '../../utils/localDate';
 import { act, fireEvent, render, screen } from '../../../tests/helpers/render';
 import { useSettingsStore } from '../../store/settingsStore';
 import { CustomDatePicker, CustomDateTimePicker } from './CustomDateTimePicker';
@@ -722,7 +723,7 @@ describe('CustomDateTimePicker branches', () => {
     const steppers = screen.getAllByRole('button').filter((b) => b.textContent?.trim() === '');
     fireEvent.click(steppers[steppers.length - 4]);
 
-    const today = new Date().toISOString().split('T')[0];
+    const today = localIsoDate(); // the picker falls back to the LOCAL date, not the UTC one
     expect(onChange).toHaveBeenCalledWith(`${today}T01:00`);
   });
 
diff --git a/client/src/components/shared/CustomDateTimePicker.tsx b/client/src/components/shared/CustomDateTimePicker.tsx
index d30227acf..e0497fbe5 100644
--- a/client/src/components/shared/CustomDateTimePicker.tsx
+++ b/client/src/components/shared/CustomDateTimePicker.tsx
@@ -1,4 +1,5 @@
 import { Calendar, ChevronLeft, ChevronRight, Keyboard } from 'lucide-react';
+import { localIsoDate } from '../../utils/localDate';
 import React, { useEffect, useRef, useState } from 'react';
 import { createPortal } from 'react-dom';
 import { useTranslation } from '../../i18n';
@@ -226,11 +227,11 @@ export function CustomDatePicker({
     if (nums.length !== 3) return;
 
     // nachher:
-    const get = (field: 'day' | 'month' | 'year') => parseInt(nums[order.indexOf(field)]);
+    const get = (field: 'day' | 'month' | 'year') => Number.parseInt(nums[order.indexOf(field)]);
     let d = get('day'),
       m = get('month');
     const y = get('year');
-    if (isNaN(d) || isNaN(m) || isNaN(y)) return;
+    if (Number.isNaN(d) || Number.isNaN(m) || Number.isNaN(y)) return;
 
     // If locale order gives impossible month but valid swap, correct it
     if (m > 12 && d <= 12) {
@@ -688,7 +689,7 @@ export function CustomDateTimePicker({ value, onChange, placeholder, style = {}
     onChange(d ? `${d}T${timePart || '12:00'}` : '');
   };
   const handleTimeChange = (t: string) => {
-    const d = datePart || new Date().toISOString().split('T')[0];
+    const d = datePart || localIsoDate();
     onChange(t ? `${d}T${t}` : d);
   };
 
diff --git a/client/src/components/shared/CustomTimePicker.tsx b/client/src/components/shared/CustomTimePicker.tsx
index 2c8c0932a..cebfbd58d 100644
--- a/client/src/components/shared/CustomTimePicker.tsx
+++ b/client/src/components/shared/CustomTimePicker.tsx
@@ -21,9 +21,11 @@ export default function CustomTimePicker({ value, onChange, placeholder = '00:00
   // The spinner is short, and it has to keep up with a scrolling sheet (#1999).
   const anchored = useAnchoredPosition(ref, open, { estimatedHeight: 120, matchWidth: false })
 
-  const [h, m] = (parseMeridiemTime(value) ?? value ?? '').split(':').map(Number)
-  const hour = isNaN(h) ? null : h
-  const minute = isNaN(m) ? null : m
+  // `m` falls back to NaN because a value with no colon ('' while the field is
+  // empty) splits into a single part, and an absent minute has to read as unset.
+  const [h, m = Number.NaN] = (parseMeridiemTime(value) ?? value ?? '').split(':').map(Number)
+  const hour = Number.isNaN(h) ? null : h
+  const minute = Number.isNaN(m) ? null : m
 
   useEffect(() => {
     const handler = (e: MouseEvent) => {
@@ -101,16 +103,16 @@ export default function CustomTimePicker({ value, onChange, placeholder = '00:00
     const clean = raw.replace(/[^0-9:]/g, '')
     if (/^\d{1,2}:\d{2}$/.test(clean)) {
       const [hh, mm] = clean.split(':')
-      const h = Math.min(23, Math.max(0, parseInt(hh)))
-      const m = Math.min(59, Math.max(0, parseInt(mm)))
+      const h = Math.min(23, Math.max(0, Number.parseInt(hh)))
+      const m = Math.min(59, Math.max(0, Number.parseInt(mm)))
       onChange(String(h).padStart(2, '0') + ':' + String(m).padStart(2, '0'))
     } else if (/^\d{3,4}$/.test(clean)) {
       const s = clean.padStart(4, '0')
-      const h = Math.min(23, Math.max(0, parseInt(s.slice(0, 2))))
-      const m = Math.min(59, Math.max(0, parseInt(s.slice(2))))
+      const h = Math.min(23, Math.max(0, Number.parseInt(s.slice(0, 2))))
+      const m = Math.min(59, Math.max(0, Number.parseInt(s.slice(2))))
       onChange(String(h).padStart(2, '0') + ':' + String(m).padStart(2, '0'))
     } else if (/^\d{1,2}$/.test(clean)) {
-      const h = Math.min(23, Math.max(0, parseInt(clean)))
+      const h = Math.min(23, Math.max(0, Number.parseInt(clean)))
       onChange(String(h).padStart(2, '0') + ':00')
     }
   }
diff --git a/client/src/components/shared/Modal.tsx b/client/src/components/shared/Modal.tsx
index a33dd7ed6..9a26a19cc 100644
--- a/client/src/components/shared/Modal.tsx
+++ b/client/src/components/shared/Modal.tsx
@@ -59,6 +59,10 @@ export default function Modal({
 
   return createPortal(
     <div
+      // Backdrop and panel are plain boxes: the backdrop only catches the
+      // click-away, the panel only keeps that click from reaching it. Escape
+      // and the header's close button are the keyboard route out.
+      role="presentation"
       className="fixed inset-0 z-[10000] flex items-start sm:items-center justify-center px-4 trek-modal-backdrop trek-backdrop-enter bg-[rgba(15,23,42,0.5)]"
       style={{ paddingTop: 70, paddingBottom: 'calc(20px + var(--bottom-nav-h))', overflow: 'hidden' }}
       onMouseDown={e => { mouseDownTarget.current = e.target }}
@@ -68,6 +72,7 @@ export default function Modal({
       }}
     >
       <div
+        role="presentation"
         className={`
           trek-modal-enter
           rounded-2xl overflow-hidden shadow-2xl w-full ${sizeClasses[size] || sizeClasses.md}
@@ -81,7 +86,7 @@ export default function Modal({
         <div className="flex items-center justify-between p-6 flex-shrink-0 border-b border-edge-secondary">
           <h2 className="text-lg font-semibold text-content">{title}</h2>
           {!hideCloseButton && (
-            <button
+            <button type="button"
               onClick={onClose}
               className="p-2 rounded-lg text-slate-400 hover:text-slate-600 hover:bg-slate-100 transition-colors"
             >
diff --git a/client/src/components/shared/NavigationMenu.tsx b/client/src/components/shared/NavigationMenu.tsx
index 02341a93b..b983bf120 100644
--- a/client/src/components/shared/NavigationMenu.tsx
+++ b/client/src/components/shared/NavigationMenu.tsx
@@ -106,7 +106,7 @@ export function NavigationMenu({ targets, anchor, onClose, title }: NavigationMe
         </div>
       )}
       {targets.map(target => (
-        <button
+        <button type="button"
           key={target.id}
           role="menuitem"
           onClick={() => { openNavigationTarget(target); onClose() }}
diff --git a/client/src/components/shared/SlidingTabs.tsx b/client/src/components/shared/SlidingTabs.tsx
index b6f41d114..860d229b8 100644
--- a/client/src/components/shared/SlidingTabs.tsx
+++ b/client/src/components/shared/SlidingTabs.tsx
@@ -125,7 +125,7 @@ export function SlidingTabs<T extends string>({
           whiteSpace: 'nowrap',
         }
         return (
-          <button
+          <button type="button"
             key={tab.id}
             ref={el => { tabRefs.current.set(tab.id, el) }}
             onClick={() => onChange(tab.id)}
diff --git a/client/src/components/shared/StarRating.tsx b/client/src/components/shared/StarRating.tsx
index d66e9b56b..dc59e31ea 100644
--- a/client/src/components/shared/StarRating.tsx
+++ b/client/src/components/shared/StarRating.tsx
@@ -119,7 +119,7 @@ export default function PlaceRating({ ratings, ratingAvg, onRate, size = 16, com
               fontSize: 'calc(8px * var(--fs-scale-caption, 1))', fontWeight: 700,
               marginLeft: i ? -5 : 0, border: '1.5px solid var(--bg-elevated, #fff)',
             }}>
-              {r.avatar ? <img src={avatarSrc(r.avatar)!} style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : r.username?.[0]?.toUpperCase()}
+              {r.avatar ? <img src={avatarSrc(r.avatar)!} alt={r.username || ''} style={{ width: '100%', height: '100%', objectFit: 'cover' }} /> : r.username?.[0]?.toUpperCase()}
             </span>
           ))}
         </span>
diff --git a/client/src/components/shared/Toast.tsx b/client/src/components/shared/Toast.tsx
index 51284395b..9279a1e69 100644
--- a/client/src/components/shared/Toast.tsx
+++ b/client/src/components/shared/Toast.tsx
@@ -129,7 +129,7 @@ export function ToastContainer() {
             }}>
               {toast.message}
             </span>
-            <button
+            <button type="button"
               onClick={() => removeToast(toast.id)}
               className="nomad-toast-close"
               style={{
diff --git a/client/src/hooks/useGeolocation.ts b/client/src/hooks/useGeolocation.ts
index 671a1f404..54ee184ea 100644
--- a/client/src/hooks/useGeolocation.ts
+++ b/client/src/hooks/useGeolocation.ts
@@ -56,8 +56,10 @@ export class GeoOnceError extends Error {
 // Unlike the watch below, a cached fix up to a minute old is fine here —
 // the user is standing where they're journaling — so maximumAge is
 // generous to make the button feel instant when the OS already has a fix.
+const ONCE_OPTIONS: PositionOptions = { enableHighAccuracy: true, timeout: 15000, maximumAge: 60000 }
+
 export function getCurrentPositionOnce(
-  options: PositionOptions = { enableHighAccuracy: true, timeout: 15000, maximumAge: 60000 },
+  options: PositionOptions = ONCE_OPTIONS,
 ): Promise<GeoPosition> {
   return new Promise((resolve, reject) => {
     if (!('geolocation' in navigator)) {
diff --git a/client/src/hooks/useResizablePanels.ts b/client/src/hooks/useResizablePanels.ts
index 943d9f796..ba53a2b6c 100644
--- a/client/src/hooks/useResizablePanels.ts
+++ b/client/src/hooks/useResizablePanels.ts
@@ -4,8 +4,8 @@ const MIN_SIDEBAR = 200
 const MAX_SIDEBAR = 520
 
 export function useResizablePanels() {
-  const [leftWidth, setLeftWidth] = useState<number>(() => parseInt(localStorage.getItem('sidebarLeftWidth') || '') || 340)
-  const [rightWidth, setRightWidth] = useState<number>(() => parseInt(localStorage.getItem('sidebarRightWidth') || '') || 300)
+  const [leftWidth, setLeftWidth] = useState<number>(() => Number.parseInt(localStorage.getItem('sidebarLeftWidth') || '') || 340)
+  const [rightWidth, setRightWidth] = useState<number>(() => Number.parseInt(localStorage.getItem('sidebarRightWidth') || '') || 300)
   const [leftCollapsed, setLeftCollapsed] = useState(false)
   const [rightCollapsed, setRightCollapsed] = useState(false)
   const isResizingLeft = useRef(false)
diff --git a/client/src/hooks/useRouteCalculation.ts b/client/src/hooks/useRouteCalculation.ts
index 55c32438b..f66df2349 100644
--- a/client/src/hooks/useRouteCalculation.ts
+++ b/client/src/hooks/useRouteCalculation.ts
@@ -249,7 +249,7 @@ export function useRouteCalculation(tripStore: TripStoreState, selectedDayId: nu
         const eps = (r.endpoints || []).map(e => `${e.role}@${e.lat ?? ''},${e.lng ?? ''}`).join(';')
         return `${r.id}:${r.day_id ?? ''}:${r.end_day_id ?? ''}:${r.reservation_time ?? ''}:${pos ?? ''}:${eps}`
       })
-      .sort()
+      .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
       .join('|')
   }, [reservationsForSignature, selectedDayId])
 
diff --git a/client/src/index.css b/client/src/index.css
index 2111be73a..a0416cc5c 100644
--- a/client/src/index.css
+++ b/client/src/index.css
@@ -35,6 +35,28 @@ body { height: 100%; overflow: auto; overscroll-behavior: none; -webkit-overflow
 .journey-feed-scroll { scrollbar-width: none; -ms-overflow-style: none; }
 .journey-feed-scroll::-webkit-scrollbar { display: none; }
 
+/* Journey video: let the player fill the box the lightbox gives it.
+ *
+ * Plyr sizes its wrapper from the video's intrinsic aspect ratio via a
+ * padding-bottom hack, which fights a fixed-height container — a portrait clip
+ * then overflowed and pushed its own controls out of reach (#2041). Pinning the
+ * wrapper to the box and letting the video letterbox inside it keeps any aspect
+ * ratio whole and the control bar on screen. */
+.trek-video-player .plyr,
+.trek-video-player .plyr__video-wrapper {
+  width: 100%;
+  height: 100%;
+  background: #000;
+}
+.trek-video-player .plyr__video-wrapper {
+  padding-bottom: 0 !important;
+}
+.trek-video-player video {
+  width: 100% !important;
+  height: 100% !important;
+  object-fit: contain !important;
+}
+
 /* Leaflet Popups — Enter-Animation vom Anchor-Tip */
 .leaflet-popup {
   animation: trek-popover-enter 220ms cubic-bezier(0.23, 1, 0.32, 1);
diff --git a/client/src/mobile/components/MBottomNav.tsx b/client/src/mobile/components/MBottomNav.tsx
index 48e96c86f..43da5b782 100644
--- a/client/src/mobile/components/MBottomNav.tsx
+++ b/client/src/mobile/components/MBottomNav.tsx
@@ -136,9 +136,10 @@ export default function MBottomNav() {
     <>
       {moreOpen && (
         // Invisible scrim (the popover sits on the UI without dimming it).
-        <div className="fixed inset-0 z-[60]" onClick={() => setMoreOpen(false)}>
+        <div className="fixed inset-0 z-[60]" role="presentation" onClick={() => setMoreOpen(false)}>
           <div
             className="absolute left-4 right-4 flex flex-col gap-2 rounded-[26px] border border-[color:var(--m-gbr)] bg-[color:var(--m-glass)] p-[10px] shadow-[0_-8px_40px_-14px_rgba(0,0,0,.45)] backdrop-blur-[30px] backdrop-saturate-[1.8] bottom-[calc(env(safe-area-inset-bottom,0px)+86px)]"
+            role="presentation"
             onClick={e => e.stopPropagation()}
           >
             {moreItems.map(({ to, label, icon: Icon }) => (
diff --git a/client/src/mobile/components/MDropdownPanel.tsx b/client/src/mobile/components/MDropdownPanel.tsx
index 8adb8a44b..5987c0843 100644
--- a/client/src/mobile/components/MDropdownPanel.tsx
+++ b/client/src/mobile/components/MDropdownPanel.tsx
@@ -19,7 +19,9 @@ export default function MDropdownPanel({ open, onClose, className = '', children
 
   return (
     <>
-      <div className="fixed inset-0 z-[35]" onClick={onClose} />
+      {/* Invisible dismiss layer — decoration to a reader, which is why it carries
+          no role of its own; the panel's own controls are the keyboard path. */}
+      <div className="fixed inset-0 z-[35]" role="presentation" onClick={onClose} />
       <div
         className={`m-pop-in fixed z-[36] w-[228px] rounded-[20px] border border-[color:var(--m-gbr)] bg-[color:var(--m-glass)] p-[6px] text-m-ink shadow-[0_24px_60px_-20px_rgba(0,0,0,.5)] backdrop-blur-[30px] backdrop-saturate-[1.8] ${className}`}
       >
diff --git a/client/src/mobile/components/MSheet.tsx b/client/src/mobile/components/MSheet.tsx
index 915601ff2..08d575756 100644
--- a/client/src/mobile/components/MSheet.tsx
+++ b/client/src/mobile/components/MSheet.tsx
@@ -181,6 +181,7 @@ export default function MSheet({
     // backdrop-blur (the "liquid glass" frost). The sheet still slides via m-sheet-in.
     <div
       className={`m-root fixed inset-0 z-[60] ${dimTransparent ? 'bg-transparent' : `bg-[color:var(--m-dim)] ${open ? 'm-fade-in' : 'm-fade-out'}`}`}
+      role="presentation"
       onClick={(e) => {
         if (e.target === e.currentTarget) onClose()
       }}
diff --git a/client/src/mobile/components/MToastHost.tsx b/client/src/mobile/components/MToastHost.tsx
index 231ed6931..4992f8ba3 100644
--- a/client/src/mobile/components/MToastHost.tsx
+++ b/client/src/mobile/components/MToastHost.tsx
@@ -77,7 +77,10 @@ export default function MToastHost() {
         return (
           <div
             key={toast.id}
+            role={toast.sticky ? 'button' : undefined}
+            tabIndex={toast.sticky ? 0 : undefined}
             onClick={toast.sticky ? () => dismissToast(toast.id) : undefined}
+            onKeyDown={toast.sticky ? (e) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); dismissToast(toast.id) } } : undefined}
             className={`flex max-w-full items-center gap-2 rounded-full bg-m-act px-4 py-2 text-[0.75rem] font-semibold text-m-actfg shadow-[0_10px_30px_-8px_rgba(0,0,0,.5)] ${
               toast.sticky ? 'pointer-events-auto cursor-pointer' : ''
             } ${toast.removing ? 'm-toast-out' : 'm-toast-in'}`}
diff --git a/client/src/mobile/mobile.css b/client/src/mobile/mobile.css
index 4b2dcf9ae..6f6049769 100644
--- a/client/src/mobile/mobile.css
+++ b/client/src/mobile/mobile.css
@@ -327,3 +327,39 @@
   /* Zzz would sit invisible at opacity 0 without their animation — pin them visible */
   .trek-z { opacity: 1; }
 }
+
+/* Map attribution clears the dock.
+ *
+ * Both engines park their attribution at the bottom of the map, and on a phone
+ * the map is the whole screen — so the credit line lands under the floating nav
+ * and reads as a broken bar (#2022's screenshots show it over the dock). Lift it
+ * by the same variable everything else clears the dock with. Leaflet and
+ * MapLibre both, because a phone meets either depending on the screen. */
+.m-root .leaflet-control-attribution,
+.m-root .maplibregl-ctrl-bottom-left,
+.m-root .maplibregl-ctrl-bottom-right {
+  bottom: var(--bottom-nav-h);
+}
+
+/* Text fields carry the row's background, not their own.
+ *
+ * iOS paints its own background inside a text control, and under
+ * `color-scheme: dark` that fill is darker than the card the field sits on —
+ * so every field showed as a dark rectangle inside a lighter row (#2028). The
+ * mobile fields are deliberately `bg-transparent` because the row around them
+ * supplies the surface, which is exactly why the native fill has nothing
+ * covering it here and shows through; a desktop field hides it behind its own
+ * background. Dropping the native appearance is what actually removes it.
+ *
+ * Only text entry. `file`, `color`, `range` and the date/time pickers need
+ * their native chrome to stay usable, and `select` keeps its own arrow. */
+.m-root input:not([type]),
+.m-root input[type="text"],
+.m-root input[type="password"],
+.m-root input[type="email"],
+.m-root input[type="url"],
+.m-root input[type="search"],
+.m-root textarea {
+  -webkit-appearance: none;
+  appearance: none;
+}
diff --git a/client/src/mobile/screens/admin/MAdminBackupPanel.tsx b/client/src/mobile/screens/admin/MAdminBackupPanel.tsx
index e45493c26..ce2478f44 100644
--- a/client/src/mobile/screens/admin/MAdminBackupPanel.tsx
+++ b/client/src/mobile/screens/admin/MAdminBackupPanel.tsx
@@ -386,7 +386,7 @@ export default function MAdminBackupPanel() {
                 >
                   <select
                     value={String(autoSettings.hour)}
-                    onChange={e => handleAutoSettingsChange('hour', parseInt(e.target.value, 10))}
+                    onChange={e => handleAutoSettingsChange('hour', Number.parseInt(e.target.value, 10))}
                     className={SELECT_CLASS}
                   >
                     {HOURS.map(h => {
@@ -426,7 +426,7 @@ export default function MAdminBackupPanel() {
                 <MAdminField label={t('backup.auto.dayOfMonth')} hint={t('backup.auto.dayOfMonthHint')}>
                   <select
                     value={String(autoSettings.day_of_month)}
-                    onChange={e => handleAutoSettingsChange('day_of_month', parseInt(e.target.value, 10))}
+                    onChange={e => handleAutoSettingsChange('day_of_month', Number.parseInt(e.target.value, 10))}
                     className={SELECT_CLASS}
                   >
                     {DAYS_OF_MONTH.map(d => (
diff --git a/client/src/mobile/screens/admin/MAdminGitHubPanel.tsx b/client/src/mobile/screens/admin/MAdminGitHubPanel.tsx
index 034c0565d..3c9e2d0ee 100644
--- a/client/src/mobile/screens/admin/MAdminGitHubPanel.tsx
+++ b/client/src/mobile/screens/admin/MAdminGitHubPanel.tsx
@@ -119,14 +119,47 @@ export default function MAdminGitHubPanel({ isPrerelease = false }: { isPrerelea
     }
 
     const escapeHtml = (str: string) => str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;')
+    // `[label](url)` → anchor, exactly as /\[([^\]]+)\]\(([^)]+)\)/g did. Written as a
+    // scan because that pattern backtracks from both ends: `[^\]]` matches `[` and
+    // `[^)]` matches `(`, so a run of either made the engine retry the whole match from
+    // every one of them, reading to the end each time. Release bodies come off the
+    // GitHub API. Both parts are one-or-more, so `[](url)` and `[label]()` stay plain
+    // text; the label ends at the first `]`, the url at the first `)`.
+    const linkify = (text: string) => {
+      let out = ''
+      let cursor = 0
+      let search = 0
+      for (;;) {
+        const open = text.indexOf('[', search)
+        if (open === -1) break
+        const close = text.indexOf(']', open + 1)
+        if (close === -1) break // no `]` left: no later `[` can match either
+        // Every `[` up to `close` shares that first `]`, so they fail together.
+        if (close === open + 1 || text[close + 1] !== '(') {
+          search = close + 1
+          continue
+        }
+        const end = text.indexOf(')', close + 2)
+        if (end === -1) break // no `)` left: no later `(` can close either
+        if (end === close + 2) {
+          search = close + 1
+          continue
+        }
+        const label = text.slice(open + 1, close)
+        const url = text.slice(close + 2, end)
+        const safeUrl = url.startsWith('http://') || url.startsWith('https://') ? url : '#'
+        out += `${text.slice(cursor, open)}<a href="${escapeHtml(safeUrl)}" target="_blank" rel="noopener noreferrer" style="color:var(--m-st-info);text-decoration:underline">${label}</a>`
+        cursor = end + 1
+        search = end + 1
+      }
+      return out + text.slice(cursor)
+    }
     const inlineFormat = (text: string) => {
-      return escapeHtml(text)
-        .replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
-        .replace(/`(.+?)`/g, '<code style="font-size:11px;padding:1px 4px;border-radius:4px;background:var(--m-ic)">$1</code>')
-        .replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, label, url) => {
-          const safeUrl = url.startsWith('http://') || url.startsWith('https://') ? url : '#'
-          return `<a href="${escapeHtml(safeUrl)}" target="_blank" rel="noopener noreferrer" style="color:var(--m-st-info);text-decoration:underline">${label}</a>`
-        })
+      return linkify(
+        escapeHtml(text)
+          .replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
+          .replace(/`(.+?)`/g, '<code style="font-size:11px;padding:1px 4px;border-radius:4px;background:var(--m-ic)">$1</code>')
+      )
     }
 
     for (const line of lines) {
diff --git a/client/src/mobile/screens/admin/MAdminPackingTemplateManager.tsx b/client/src/mobile/screens/admin/MAdminPackingTemplateManager.tsx
index 6b352827c..406f26da7 100644
--- a/client/src/mobile/screens/admin/MAdminPackingTemplateManager.tsx
+++ b/client/src/mobile/screens/admin/MAdminPackingTemplateManager.tsx
@@ -258,12 +258,12 @@ export default function MAdminPackingTemplateManager() {
                     />
                   </div>
                 ) : (
-                  <div className="min-w-0 flex-1" onClick={() => toggleExpand(tmpl.id)}>
+                  <button type="button" className="min-w-0 flex-1 text-left" onClick={() => toggleExpand(tmpl.id)}>
                     <div className="truncate text-[0.8125rem] font-bold text-m-ink">{tmpl.name}</div>
                     <div className="mt-[1px] font-geist text-[0.59375rem] text-m-faint">
                       {tmpl.category_count} {t('admin.packingTemplates.categories')} · {tmpl.item_count} {t('admin.packingTemplates.items')}
                     </div>
-                  </div>
+                  </button>
                 )}
                 <PkIconBtn
                   ariaLabel={t('common.edit')}
diff --git a/client/src/mobile/screens/admin/MAdminPluginsPanel.tsx b/client/src/mobile/screens/admin/MAdminPluginsPanel.tsx
index f1cd670d9..7b9a4aaea 100644
--- a/client/src/mobile/screens/admin/MAdminPluginsPanel.tsx
+++ b/client/src/mobile/screens/admin/MAdminPluginsPanel.tsx
@@ -4,7 +4,7 @@ import {
   Blocks, AlertTriangle, PackageOpen, RefreshCw, Trash2, Download, Bug, X, ShieldCheck, UploadCloud,
   ArrowUpCircle, Github, ExternalLink, ChevronDown, Check, Lock, Search, Link2, KeyRound, ShieldAlert,
   SlidersHorizontal, ArrowUpDown, CircleDot, MoreHorizontal, RotateCw, ArrowRight, Database, Users, LayoutDashboard,
-  Radio, Luggage, Globe, Image, CalendarDays, Bell,
+  Radio, Luggage, Globe, Image, CalendarDays, Bell, Info, History, PauseCircle,
   Wallet, Puzzle, MapPin, ListChecks, Pencil, Tag, FileText, Route, Navigation, Clock, LocateFixed, Palette,
 } from 'lucide-react'
 import PluginIcon from '../../../components/shared/PluginIcon'
@@ -65,6 +65,8 @@ interface PluginRow {
   keyFingerprint?: string | null
   /** Why an update was refused, if one was. `version` is the version that was refused. */
   updateBlock?: { code: string; detail: string | null; version: string | null } | null
+  /** A deliberate non-latest install paused updates: out of the banner/Update all until resumed. */
+  updateHold?: boolean
 }
 interface RegistryItem {
   id: string
@@ -95,9 +97,21 @@ interface RegistryItem {
   /** The full key — public, and carried in full because re-trust compares it exactly. */
   authorPublicKey?: string | null
 }
+/** One published version, with its SERVER-computed compat verdict (the client has no semver). */
+interface VersionInfo {
+  version: string
+  publishedAt: string | null
+  size: number | null
+  signed: boolean
+  /** The declared TREK requirement, or null when the entry carries no bounds at all. */
+  trek: string | null
+  compatible: boolean
+}
 interface RegistryDetail extends RegistryItem {
   size: number | null
   publishedAt: string | null
+  /** Every published version, newest first — the version picker's data. */
+  versions?: VersionInfo[]
   manifest: {
     permissions: string[]
     egress: string[]
@@ -187,7 +201,7 @@ const PERM_KEYS = PLUGIN_PERMISSIONS
 const KNOWN_TYPES = ['widget', 'page', 'integration', 'trip-page']
 
 function isNewer(a: string, b: string): boolean {
-  const nums = (v: string) => v.split('-')[0].split('.').map(n => parseInt(n, 10) || 0)
+  const nums = (v: string) => v.split('-')[0].split('.').map(n => Number.parseInt(n, 10) || 0)
   const pa = nums(a), pb = nums(b)
   for (let i = 0; i < 3; i++) {
     const x = pa[i] || 0, y = pb[i] || 0
@@ -399,6 +413,12 @@ export default function MAdminPluginsPanel() {
   const [egressSaving, setEgressSaving] = useState(false)
   const [egressError, setEgressError] = useState('')
   const [confirmUninstall, setConfirmUninstall] = useState<PluginRow | null>(null)
+  // The version picker for an INSTALLED plugin ("Change version…"); versions land async
+  // from the registry detail endpoint, which computes each version's compat verdict.
+  const [versionPicker, setVersionPicker] = useState<{ plugin: PluginRow; versions: VersionInfo[] | null; failed: boolean } | null>(null)
+  // A picked version OLDER than the installed one — held here until the admin consents
+  // to the data risk (the plugin's data dir stays; older code may not understand it).
+  const [confirmDowngrade, setConfirmDowngrade] = useState<{ plugin: PluginRow; version: string } | null>(null)
   // A QUEUE, not one slot: "Update All" can produce several re-consent prompts —
   // each must be shown, not silently overwritten by the last one.
   const [consentQueue, setConsentQueue] = useState<Array<{ plugin: PluginRow; version: string; newPermissions: string[]; newEgress: string[] }>>([])
@@ -427,10 +447,13 @@ export default function MAdminPluginsPanel() {
 
   // Index the registry once per fetch: the version map the update badges read, plus the
   // whole entry (author key + signed flag) the trust badges and re-trust dialog need.
+  // The map holds latestCompatible — the newest version THIS TREK can install (computed
+  // server-side) — not the absolute latest, so the banner never counts an update the
+  // update endpoint would refuse.
   const indexRegistry = (items: RegistryItem[]) => {
     const vers: Record<string, string> = {}
     const byId: Record<string, RegistryItem> = {}
-    items.forEach((i) => { byId[i.id] = i; if (i.latest) vers[i.id] = i.latest })
+    items.forEach((i) => { byId[i.id] = i; if (i.latestCompatible) vers[i.id] = i.latestCompatible })
     setLatest(vers)
     setRegById(byId)
   }
@@ -563,7 +586,21 @@ export default function MAdminPluginsPanel() {
       .catch(() => setErrorsFor({ id, rows: [] }))
   }
 
-  const updateAvailable = (p: PluginRow) => !!(p.version && latest[p.id] && isNewer(latest[p.id], p.version))
+  // A held plugin (deliberate non-latest install) is deliberately NOT an update candidate:
+  // the admin just rolled it back, and the banner nagging them straight back would make
+  // the rollback fight the UI. The row carries its own "paused" marker + resume instead.
+  const updateAvailable = (p: PluginRow) => !!(p.version && !p.updateHold && latest[p.id] && isNewer(latest[p.id], p.version))
+  const resumeUpdates = (p: PluginRow) => act(p.id, () => adminApi.pluginResumeUpdates(p.id), t('admin.plugins.updatesResumed'))
+  // A newer version exists but this TREK can't install it (and it isn't the one on offer):
+  // said passively on the row, so the admin learns a TREK upgrade unlocks it instead of
+  // wondering why no update shows. Null when the registry gives no range to point at.
+  const newerIncompatible = (p: PluginRow): { version: string; range: string } | null => {
+    const reg = regById[p.id]
+    if (!reg?.latest || !p.version || !isNewer(reg.latest, p.version)) return null
+    if (latest[p.id] === reg.latest) return null
+    const range = reg.trek ?? (reg.minTrekVersion ? `>=${reg.minTrekVersion}` : null)
+    return range ? { version: reg.latest, range } : null
+  }
   const install = (id: string, version?: string) => act(id, () => adminApi.pluginInstall(id, version ? { version } : undefined), t('admin.plugins.installed'))
   const restart = (id: string) => act(id, async () => { await adminApi.pluginDeactivate(id); await adminApi.pluginActivate(id) }, t('admin.plugins.restarted'))
   // Dev-link: register a plugin from a local built directory (dev only). Reuses the
@@ -651,9 +688,11 @@ export default function MAdminPluginsPanel() {
       .finally(() => { setBusy(null); refresh() })
   }
 
-  const runUpdate = (p: PluginRow) => {
+  // `version` pins the exact version to install (rollback / explicit switch); omitted,
+  // the server resolves the newest TREK-compatible version itself.
+  const runUpdate = (p: PluginRow, version?: string) => {
     setBusy(p.id); setMenu(null)
-    adminApi.pluginUpdate(p.id)
+    adminApi.pluginUpdate(p.id, version)
       .then((r: { version: string; activated: boolean; newPermissions: string[]; newEgress: string[] }) => {
         if (r.activated || (r.newPermissions.length === 0 && r.newEgress.length === 0)) toast.success(t('admin.plugins.updated'))
         else setConsentQueue(qq => [...qq, { plugin: p, version: r.version, newPermissions: r.newPermissions, newEgress: r.newEgress }])
@@ -685,6 +724,27 @@ export default function MAdminPluginsPanel() {
       .finally(() => { setRetrusting(false); refresh() })
   }
 
+  // "Change version…" on an installed row: fetch the per-version list (with the server's
+  // compat verdicts) and open the picker. The fetch is keyed to the plugin so a stale
+  // response can't populate a picker that was reopened for another row.
+  const openVersionPicker = (p: PluginRow) => {
+    setMenu(null)
+    setVersionPicker({ plugin: p, versions: null, failed: false })
+    adminApi.pluginDetail(p.id)
+      .then((d: RegistryDetail) => setVersionPicker(cur => (cur && cur.plugin.id === p.id ? { ...cur, versions: d.versions ?? [] } : cur)))
+      .catch(() => setVersionPicker(cur => (cur && cur.plugin.id === p.id ? { ...cur, failed: true } : cur)))
+  }
+
+  // Switching DOWN keeps the plugin's data dir, which the older code may not understand —
+  // that asks for explicit consent first. Any other switch is the ordinary update path.
+  const pickVersion = (version: string) => {
+    if (!versionPicker) return
+    const p = versionPicker.plugin
+    setVersionPicker(null)
+    if (p.version && isNewer(p.version, version)) setConfirmDowngrade({ plugin: p, version })
+    else runUpdate(p, version)
+  }
+
   // eslint-disable-next-line react-hooks/exhaustive-deps
   const updatable = useMemo(() => plugins.filter(updateAvailable), [plugins, latest])
 
@@ -850,7 +910,9 @@ export default function MAdminPluginsPanel() {
             <div className={`flex items-center gap-2.5 rounded-[18px] border px-3.5 py-2.5 ${PENDING_CARD}`}>
               <ArrowUpCircle size={16} className="shrink-0 text-[color:var(--m-st-pending)]" />
               <span className="text-[0.6875rem] text-m-muted">{t('admin.plugins.updatesAvailable', { count: updatable.length })}</span>
-              <button onClick={() => updatable.forEach(runUpdate)}
+              {/* p => runUpdate(p), NOT forEach(runUpdate): forEach's index would land in
+                  runUpdate's `version` parameter and pin the update to a number. */}
+              <button type="button" onClick={() => updatable.forEach(p => runUpdate(p))}
                 className="ml-auto rounded-full bg-[color:var(--m-st-pending)] px-3 py-1.5 text-[0.6875rem] font-bold text-white">
                 {t('admin.plugins.updateAll')}
               </button>
@@ -864,9 +926,11 @@ export default function MAdminPluginsPanel() {
           ) : shownInstalled.map(p => (
             <InstalledRow key={p.id} p={p} t={t} busy={busy}
               hasUpdate={updateAvailable(p)} latestVer={latest[p.id]}
+              newerIncompatible={newerIncompatible(p)}
               blocked={blockIsCurrent(p, latest[p.id])}
               onToggle={() => toggle(p)}
               onUpdate={() => runUpdate(p)}
+              onResume={() => void resumeUpdates(p)}
               onReviewBlock={() => setSignatureBlock({
                 subject: { id: p.id, name: p.name, keyFingerprint: p.keyFingerprint ?? null },
                 code: p.updateBlock!.code, detail: p.updateBlock!.detail,
@@ -891,9 +955,28 @@ export default function MAdminPluginsPanel() {
           onRestart={() => restart(rowMenuPlugin.id)}
           onErrors={() => openErrors(rowMenuPlugin.id)}
           onEgress={() => openEgress(rowMenuPlugin.id)}
+          onChangeVersion={() => openVersionPicker(rowMenuPlugin)}
           onUninstall={() => { setMenu(null); setConfirmUninstall(rowMenuPlugin) }} />
       )}
 
+      {/* Version picker sheet */}
+      {versionPicker && (
+        <VersionPickerSheet plugin={versionPicker.plugin} versions={versionPicker.versions} failed={versionPicker.failed}
+          busy={busy} t={t} locale={locale} onPick={pickVersion} onClose={() => setVersionPicker(null)} />
+      )}
+
+      {/* Downgrade confirm */}
+      <MConfirmSheet
+        open={!!confirmDowngrade}
+        onClose={() => setConfirmDowngrade(null)}
+        onConfirm={() => { const d = confirmDowngrade!; setConfirmDowngrade(null); runUpdate(d.plugin, d.version) }}
+        title={t('admin.plugins.downgradeTitle')}
+        message={t('admin.plugins.downgradeBody', { from: confirmDowngrade?.plugin.version ?? '', to: confirmDowngrade?.version ?? '' })}
+        confirmLabel={t('admin.plugins.downgradeConfirm')}
+        cancelLabel={t('common.cancel')}
+        danger
+      />
+
       {/* Filter picker sheets */}
       <PickerSheet
         open={menu === 'type'} onClose={() => setMenu(null)} title={t('admin.plugins.filterType')} value={typeFilter}
@@ -956,7 +1039,7 @@ export default function MAdminPluginsPanel() {
                 {egressFor.hosts.map(h => (
                   <div key={h} className="flex items-center justify-between gap-2 rounded-xl border border-[color:var(--m-rowbr)] px-3 py-2">
                     <span className="break-all font-mono text-sm text-m-ink">{h}</span>
-                    <button
+                    <button type="button"
                       disabled={egressSaving}
                       onClick={() => saveEgress(egressFor.hosts.filter(x => x !== h))}
                       className="text-m-faint disabled:opacity-50"
@@ -1113,10 +1196,10 @@ function PickerSheet({ open, onClose, title, options, value, onPick }: {
 
 // ── Installed row ──────────────────────────────────────────────────────────
 
-function InstalledRow({ p, t, busy, hasUpdate, latestVer, blocked, onToggle, onUpdate, onReviewBlock, onEgress, onMenu }: {
+function InstalledRow({ p, t, busy, hasUpdate, latestVer, newerIncompatible, blocked, onToggle, onUpdate, onResume, onReviewBlock, onEgress, onMenu }: {
   p: PluginRow; t: T; busy: string | null
-  hasUpdate: boolean; latestVer?: string; blocked: boolean
-  onToggle: () => void; onUpdate: () => void; onReviewBlock: () => void
+  hasUpdate: boolean; latestVer?: string; newerIncompatible: { version: string; range: string } | null; blocked: boolean
+  onToggle: () => void; onUpdate: () => void; onResume: () => void; onReviewBlock: () => void
   onEgress: () => void; onMenu: () => void
 }) {
   const caps = deriveCaps(parseJson<string[]>(p.permissions, []), parseJson<{ widget?: { slot?: string } }>(p.capabilities, {}), t)
@@ -1163,13 +1246,35 @@ function InstalledRow({ p, t, busy, hasUpdate, latestVer, blocked, onToggle, onU
         <div className="mt-2 flex items-center gap-1.5 text-[11.5px] text-[color:var(--m-st-pending)]">
           <ShieldAlert size={13} className="shrink-0" />
           <span className="truncate">{t('admin.plugins.updateBlocked', { reason: p.updateBlock.detail ?? p.updateBlock.code })}</span>
-          <button onClick={onReviewBlock}
+          <button type="button" onClick={onReviewBlock}
             className="shrink-0 font-semibold underline underline-offset-2">
             {t('admin.plugins.reviewBlock')}
           </button>
         </div>
       )}
 
+      {/* A newer version this TREK can't run — informational, never a button: the fix
+          is a TREK upgrade, so the row must not nag or offer a doomed install. */}
+      {newerIncompatible && (
+        <div className="mt-2 flex items-center gap-1.5 text-[11.5px] text-m-faint">
+          <Info size={13} className="shrink-0" />
+          <span className="truncate">{t('admin.plugins.newerNeedsTrek', { version: newerIncompatible.version, range: newerIncompatible.range })}</span>
+        </div>
+      )}
+
+      {/* Held: the admin deliberately installed a non-latest version, so updates are
+          paused rather than nagged — resuming is one click, right where the pause shows. */}
+      {p.updateHold && (
+        <div className="mt-2 flex items-center gap-1.5 text-[11.5px] text-m-faint">
+          <PauseCircle size={13} className="shrink-0" />
+          <span className="truncate">{t('admin.plugins.updatesHeld', { version: p.version ?? '' })}</span>
+          <button type="button" onClick={onResume} disabled={busy === p.id}
+            className="shrink-0 font-semibold underline underline-offset-2 disabled:opacity-50">
+            {t('admin.plugins.resumeUpdates')}
+          </button>
+        </div>
+      )}
+
       {p.status === 'error' && p.last_error ? (
         <div className="mt-2 flex items-center gap-1.5 text-[11.5px] text-[color:var(--m-st-danger)]">
           <AlertTriangle size={13} className="shrink-0" /><span className="truncate">{p.last_error}</span>
@@ -1186,7 +1291,7 @@ function InstalledRow({ p, t, busy, hasUpdate, latestVer, blocked, onToggle, onU
               Actionable, and warning-toned until at least one host exists, because
               until then the plugin cannot reach anything and looks silently broken. */}
           {p.operatorEgress && (
-            <button
+            <button type="button"
               onClick={onEgress}
               title={t('admin.plugins.allowedHosts.hint')}
               className={`inline-flex items-center gap-1.5 rounded-md border px-2 py-[3px] text-[11px] font-medium ${p.egressHostCount > 0 ? CHIP_INFO : CHIP_PENDING}`}
@@ -1212,7 +1317,7 @@ function InstalledRow({ p, t, busy, hasUpdate, latestVer, blocked, onToggle, onU
 
       {hasUpdate && (
         <div className="mt-2.5 border-t border-[color:var(--m-rowbr)] pt-2.5">
-          <button onClick={onUpdate} disabled={busy === p.id} title={t('admin.plugins.updateTo', { version: latestVer })}
+          <button type="button" onClick={onUpdate} disabled={busy === p.id} title={t('admin.plugins.updateTo', { version: latestVer })}
             className={`inline-flex items-center gap-1.5 rounded-full border px-3 py-1.5 text-[11.5px] font-bold disabled:opacity-50 ${CHIP_PENDING}`}>
             <ArrowUpCircle size={13} /> {t('admin.plugins.updateTo', { version: latestVer })}
           </button>
@@ -1223,9 +1328,9 @@ function InstalledRow({ p, t, busy, hasUpdate, latestVer, blocked, onToggle, onU
 }
 
 // Row ⋯ action sheet — the desktop portal menu re-expressed as a bottom sheet.
-function RowActionsSheet({ p, t, onClose, onRestart, onErrors, onEgress, onUninstall }: {
+function RowActionsSheet({ p, t, onClose, onRestart, onErrors, onEgress, onChangeVersion, onUninstall }: {
   p: PluginRow; t: T; onClose: () => void
-  onRestart: () => void; onErrors: () => void; onEgress: () => void; onUninstall: () => void
+  onRestart: () => void; onErrors: () => void; onEgress: () => void; onChangeVersion: () => void; onUninstall: () => void
 }) {
   const linkable = p.source_repo && p.source_repo !== 'local:upload' && p.source_repo !== 'local:link'
   const rowClass = 'flex w-full items-center gap-2.5 rounded-xl px-3 py-3 text-left text-[0.8125rem] font-semibold text-m-ink'
@@ -1238,6 +1343,10 @@ function RowActionsSheet({ p, t, onClose, onRestart, onErrors, onEgress, onUnins
           )}
           <button type="button" className={rowClass} onClick={onErrors}><Bug size={16} /> {t('admin.plugins.viewErrors')}</button>
           <button type="button" className={rowClass} onClick={onEgress}><Globe size={16} /> {t('admin.plugins.allowedHosts')}</button>
+          {/* Registry plugins only — a sideload/dev-link has no registry versions to pick from. */}
+          {isRegistrySourced(p.source_repo) && (
+            <button type="button" className={rowClass} onClick={onChangeVersion}><History size={16} /> {t('admin.plugins.changeVersion')}</button>
+          )}
           {linkable && (
             <>
               <a href={`https://github.com/${p.source_repo}`} target="_blank" rel="noreferrer" onClick={onClose} className={rowClass}>
@@ -1258,6 +1367,51 @@ function RowActionsSheet({ p, t, onClose, onRestart, onErrors, onEgress, onUnins
   )
 }
 
+/**
+ * "Change version…" for an INSTALLED plugin. Rows render the server's per-version compat
+ * verdict: the installed version is marked, a compatible one gets a Switch action (the
+ * caller routes a DOWNGRADE through the data-risk confirm), an incompatible one is
+ * explained and never offered.
+ */
+function VersionPickerSheet({ plugin, versions, failed, busy, t, locale, onPick, onClose }: {
+  plugin: PluginRow; versions: VersionInfo[] | null; failed: boolean; busy: string | null
+  t: T; locale: string; onPick: (version: string) => void; onClose: () => void
+}) {
+  return (
+    <MSheet open onClose={onClose} variant="bottom" material="opaque" ariaLabel={t('admin.plugins.versionPickerTitle', { name: plugin.name })}>
+      <MAdminSheetFrame title={t('admin.plugins.versionPickerTitle', { name: plugin.name })} onClose={onClose}>
+        <div className="space-y-0.5">
+          {failed && <p className="px-2.5 py-2 text-xs text-[color:var(--m-st-danger)]">{t('admin.plugins.detailError')}</p>}
+          {!failed && !versions && <p className="px-2.5 py-2 text-xs text-m-faint">{t('common.loading')}</p>}
+          {versions?.length === 0 && <p className="px-2.5 py-2 text-xs text-m-faint">{t('admin.plugins.noVersions')}</p>}
+          {versions?.map(v => {
+            const current = v.version === plugin.version
+            return (
+              <div key={v.version} data-testid={`version-row-${v.version}`}
+                className="flex items-center gap-2.5 rounded-xl px-2.5 py-2.5">
+                <span className={`text-[13px] font-semibold tabular-nums ${v.compatible ? 'text-m-ink' : 'text-m-faint'}`}>v{v.version}</span>
+                {v.publishedAt && <span className="text-[11.5px] text-m-faint">{new Date(v.publishedAt).toLocaleDateString(locale)}</span>}
+                {v.signed && <ShieldCheck size={13} className="shrink-0 text-[color:var(--m-st-confirmed)]" />}
+                <span className="ml-auto" />
+                {current ? (
+                  <span className="text-[11.5px] font-medium text-m-faint">{t('admin.plugins.installed')}</span>
+                ) : v.compatible ? (
+                  <button type="button" onClick={() => onPick(v.version)} disabled={busy === plugin.id}
+                    className="rounded-full border border-[color:var(--m-rowbr)] px-2.5 py-1 text-[11.5px] font-bold text-m-muted disabled:opacity-50">
+                    {t('admin.plugins.versionSwitch', { version: v.version })}
+                  </button>
+                ) : (
+                  <span className="text-[11.5px] text-m-faint">{t('admin.plugins.versionNeedsTrek', { range: v.trek ?? '' })}</span>
+                )}
+              </div>
+            )
+          })}
+        </div>
+      </MAdminSheetFrame>
+    </MSheet>
+  )
+}
+
 // ── Registry (Discover) ────────────────────────────────────────────────────
 
 function EmptyState({ t, onDiscover }: { t: T; onDiscover: () => void }) {
@@ -1267,7 +1421,7 @@ function EmptyState({ t, onDiscover }: { t: T; onDiscover: () => void }) {
         <PackageOpen size={26} className="text-m-faint" />
       </div>
       <p className="text-sm font-medium text-m-muted">{t('admin.plugins.empty')}</p>
-      <button onClick={onDiscover} className={`mt-4 ${ACT_PILL}`}>
+      <button type="button" onClick={onDiscover} className={`mt-4 ${ACT_PILL}`}>
         <Download size={14} /> {t('admin.plugins.tabDiscover')}
       </button>
     </div>
@@ -1340,7 +1494,7 @@ function RegistryList({ items, onInstall, onOpenDetail, busy, t, installedIds, f
                     <Download size={11} /> {formatCompactCount(item.downloadCount)}
                   </span>
                 )}
-                <button onClick={e => { e.stopPropagation(); onInstall(item.id, offer.version) }}
+                <button type="button" onClick={e => { e.stopPropagation(); onInstall(item.id, offer.version) }}
                   disabled={busy === item.id || installed || offer.blocked}
                   title={installed ? undefined : offer.title}
                   className={`ml-auto ${ACT_PILL}`}>
@@ -1401,7 +1555,7 @@ function PluginDetailSheet({ item, installed, busy, onInstall, onClose, t, local
       <div className="relative flex-none">
         <Screenshot url={item.screenshotUrl} className="aspect-[16/9] w-full" iconSize={36} />
         <div className="absolute inset-0 bg-gradient-to-t from-black/50 to-transparent" />
-        <button onClick={onClose} aria-label={t('common.close')} className="absolute right-3 top-3 grid h-8 w-8 place-items-center rounded-lg bg-black/40 text-white"><X size={16} /></button>
+        <button type="button" onClick={onClose} aria-label={t('common.close')} className="absolute right-3 top-3 grid h-8 w-8 place-items-center rounded-lg bg-black/40 text-white"><X size={16} /></button>
       </div>
 
       <div className="min-h-0 flex-1 overflow-y-auto">
@@ -1416,7 +1570,7 @@ function PluginDetailSheet({ item, installed, busy, onInstall, onClose, t, local
             </div>
             <p className="mt-0.5 text-[12.5px] text-m-faint">{item.author}{item.latest ? ` · v${item.latest}` : ''}</p>
           </div>
-          <button onClick={() => onInstall(item.id, offer.version)}
+          <button type="button" onClick={() => onInstall(item.id, offer.version)}
             disabled={busy === item.id || installed || offer.blocked}
             title={installed ? undefined : offer.title}
             className={`${ACT_PILL} self-end`}>
@@ -1499,7 +1653,7 @@ function PluginDetailSheet({ item, installed, busy, onInstall, onClose, t, local
             <h4 className={sectionH}>{t('admin.plugins.detailsTitle')}</h4>
             <div className="mt-2.5 grid grid-cols-2 gap-x-6 gap-y-3">
               {item.latest && <Meta k={t('admin.plugins.metaVersion')} v={`v${item.latest}`} />}
-              {sizeKb && <Meta k={t('admin.plugins.metaSize')} v={`${sizeKb} KB`} />}
+              {sizeKb !== null && <Meta k={t('admin.plugins.metaSize')} v={`${sizeKb} KB`} />}
               {/* The range, not just its lower bound: "TREK 3.2.0+" reads as "and anything
                   newer", which is exactly the claim a `<4.0.0` upper bound denies. */}
               {(item.trek || item.minTrekVersion) && (
@@ -1511,6 +1665,34 @@ function PluginDetailSheet({ item, installed, busy, onInstall, onClose, t, local
               )}
             </div>
           </div>
+
+          {/* Every published version, installable individually. The compat verdict per
+              version is SERVER-computed — an incompatible one is explained, never offered. */}
+          {(detail?.versions?.length ?? 0) > 1 && (
+            <div className="mt-5">
+              <h4 className={sectionH}>{t('admin.plugins.versionsTitle')}</h4>
+              <div className="mt-2 space-y-0.5">
+                {detail!.versions!.map(v => (
+                  <div key={v.version} className="flex items-center gap-2.5 py-1">
+                    <span className={`text-[12.5px] font-medium tabular-nums ${v.compatible ? 'text-m-ink' : 'text-m-faint'}`}>v{v.version}</span>
+                    {v.publishedAt && <span className="text-[11.5px] text-m-faint">{new Date(v.publishedAt).toLocaleDateString(locale)}</span>}
+                    {v.signed && <ShieldCheck size={13} className="shrink-0 text-[color:var(--m-st-confirmed)]" />}
+                    <span className="ml-auto" />
+                    {v.compatible ? (
+                      !installed && (
+                        <button type="button" onClick={() => onInstall(item.id, v.version)} disabled={busy === item.id}
+                          className="rounded-full border border-[color:var(--m-rowbr)] px-2.5 py-1 text-[11.5px] font-bold text-m-muted disabled:opacity-50">
+                          {t('admin.plugins.installCompatible', { version: v.version })}
+                        </button>
+                      )
+                    ) : (
+                      <span className="text-[11.5px] text-m-faint">{t('admin.plugins.versionNeedsTrek', { range: v.trek ?? '' })}</span>
+                    )}
+                  </div>
+                ))}
+              </div>
+            </div>
+          )}
         </div>
       </div>
 
@@ -1711,7 +1893,7 @@ function DependencyResolveSheet({ data, t, busy, installedIds, onDownload, onClo
                     : t('admin.plugins.dep.requires', { version: r.constraint })}
                 </div>
               </div>
-              <button onClick={() => onDownload(r.id, r.constraint)} disabled={busy}
+              <button type="button" onClick={() => onDownload(r.id, r.constraint)} disabled={busy}
                 className={`shrink-0 ${ACT_PILL}`}>
                 <Download size={13} /> {r.installed ? t('admin.plugins.dep.update') : t('admin.plugins.dep.download')}
               </button>
@@ -1748,7 +1930,7 @@ function SecurityInfo({ t }: { t: T }) {
         <ShieldCheck size={14} className="mt-0.5 shrink-0 text-m-faint" />
         <p className="text-xs text-m-muted">{t('admin.plugins.reviewedMeaning')}</p>
       </div>
-      <button onClick={() => setOpen(o => !o)}
+      <button type="button" onClick={() => setOpen(o => !o)}
         className="flex w-full items-center justify-between gap-2 border-t border-[color:var(--m-rowbr)] px-4 py-3 text-xs font-medium text-m-muted">
         <span className="flex items-center gap-2"><Lock size={13} className="shrink-0" /> <span className="text-left">{t('admin.plugins.security.title')}</span></span>
         <ChevronDown size={15} className={`shrink-0 transition-transform ${open ? 'rotate-180' : ''}`} />
diff --git a/client/src/mobile/screens/atlas/MAtlasSearch.tsx b/client/src/mobile/screens/atlas/MAtlasSearch.tsx
index 703e7700c..34bfc0a49 100644
--- a/client/src/mobile/screens/atlas/MAtlasSearch.tsx
+++ b/client/src/mobile/screens/atlas/MAtlasSearch.tsx
@@ -53,8 +53,18 @@ export default function MAtlasSearch({
   const scrimCls = 'm-fade-in fixed inset-0 z-[70] flex flex-col bg-[rgba(16,16,19,.28)] px-[18px] pt-[calc(var(--m-safe-top,12px)+12px)] backdrop-blur-[22px] backdrop-saturate-[1.6]' // theme-lint-disable — fixed scrim value from the design
 
   return (
-    <div className={scrimCls} onClick={onClose}>
-      <div className="flex items-center gap-[10px]" onClick={(e) => e.stopPropagation()}>
+    <div
+      className={scrimCls}
+      // presentation, not role="button": the scrim wraps the whole search
+      // overlay, so making it a button puts a full-screen tab stop around its
+      // own contents — and screen readers would read the entire panel as the
+      // button's label. Clicking it is a mouse shortcut for the Cancel control
+      // inside, which is already in the tab order. Same treatment as the other
+      // backdrops in this sweep.
+      role="presentation"
+      onClick={onClose}
+    >
+      <div className="flex items-center gap-[10px]" role="presentation" onClick={(e) => e.stopPropagation()}>
         <label className="flex min-w-0 flex-1 items-center gap-[10px] rounded-[18px] border border-[color:var(--m-gbr)] bg-[color:var(--m-sheetop)] px-4 py-[14px] shadow-[0_12px_30px_-14px_rgba(0,0,0,.4)]">
           <Search size={18} strokeWidth={2.2} className="flex-none text-m-muted" />
           <input
@@ -77,6 +87,7 @@ export default function MAtlasSearch({
       {rows.length > 0 && (
         <div
           className="m-pop-in mt-[14px] divide-y divide-[color:var(--m-rowbr)] overflow-hidden rounded-[20px] border border-[color:var(--m-gbr)] bg-[color:var(--m-sheetop)] shadow-[0_20px_44px_-18px_rgba(0,0,0,.4)]"
+          role="presentation"
           onClick={(e) => e.stopPropagation()}
         >
           {rows.map((r) => (
diff --git a/client/src/mobile/screens/collections/MCollLabelsSheet.tsx b/client/src/mobile/screens/collections/MCollLabelsSheet.tsx
index ecb94e73c..9be1bbc84 100644
--- a/client/src/mobile/screens/collections/MCollLabelsSheet.tsx
+++ b/client/src/mobile/screens/collections/MCollLabelsSheet.tsx
@@ -152,7 +152,14 @@ export default function MCollLabelsSheet({
                   className={`mb-1 flex items-center gap-[10px] rounded-[13px] px-3 py-[10px] ${editingId === label.id || on ? 'bg-[color:var(--m-ic)]' : ''}`}
                   style={on ? { boxShadow: `inset 0 0 0 1.5px ${col}` } : undefined}
                   onClick={mode === 'assign' ? () => toggleChecked(label.id) : undefined}
+                  onKeyDown={mode === 'assign'
+                    ? (e) => {
+                      if (e.target !== e.currentTarget) return
+                      if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); toggleChecked(label.id) }
+                    }
+                    : undefined}
                   role={mode === 'assign' ? 'checkbox' : undefined}
+                  tabIndex={mode === 'assign' ? 0 : undefined}
                   aria-checked={mode === 'assign' ? on : undefined}
                 >
                   <span className="h-[9px] w-[9px] flex-none rounded-full" style={{ background: col }} />
diff --git a/client/src/mobile/screens/dashboard/MDashWidgets.tsx b/client/src/mobile/screens/dashboard/MDashWidgets.tsx
index 1dd35ecad..b45513e37 100644
--- a/client/src/mobile/screens/dashboard/MDashWidgets.tsx
+++ b/client/src/mobile/screens/dashboard/MDashWidgets.tsx
@@ -151,9 +151,9 @@ function MCurrencyWidget(): React.ReactElement {
     }).catch(() => { /* keep localStorage; retry on next load */ })
   }, [isLoaded, updateSetting])
 
-  const currencies = rates ? Object.keys(rates).sort() : [...CURRENCIES]
+  const currencies = rates ? Object.keys(rates).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)) : [...CURRENCIES]
   const rate = rates?.[to] ?? null
-  const converted = rate != null ? (parseFloat(amount.replace(',', '.')) || 0) * rate : null
+  const converted = rate != null ? (Number.parseFloat(amount.replace(',', '.')) || 0) * rate : null
   const swap = () => { setFrom(to); setTo(from) }
 
   return (
@@ -405,7 +405,7 @@ function MUpcomingWidget({ items }: { items: UpcomingReservation[] }): React.Rea
     const parsed = splitReservationDateTime(r.reservation_time)
     const datePart = parsed.date || r.day_date || null
     const date = datePart ? new Date(datePart + 'T00:00:00Z') : null
-    const dateStr = date && !isNaN(date.getTime())
+    const dateStr = date && !Number.isNaN(date.getTime())
       ? date.toLocaleDateString(locale, { day: 'numeric', month: 'short', timeZone: 'UTC' })
       : null
     const timeStr = parsed.time ? formatTime(parsed.time, locale, timeFormat) : null
diff --git a/client/src/mobile/screens/dashboard/MDashboard.tsx b/client/src/mobile/screens/dashboard/MDashboard.tsx
index 1fa2c3a2b..d30cad247 100644
--- a/client/src/mobile/screens/dashboard/MDashboard.tsx
+++ b/client/src/mobile/screens/dashboard/MDashboard.tsx
@@ -32,7 +32,7 @@ import type { MobileDashToken } from '@trek/shared'
 function fullDate(dateStr: string | null | undefined, locale: string): string | null {
   if (!dateStr) return null
   const date = new Date(dateStr + 'T00:00:00Z')
-  if (isNaN(date.getTime())) return null
+  if (Number.isNaN(date.getTime())) return null
   const opts: Intl.DateTimeFormatOptions = { day: 'numeric', month: 'short', timeZone: 'UTC' }
   if (date.getUTCFullYear() !== new Date().getUTCFullYear()) opts.year = 'numeric'
   return date.toLocaleDateString(locale, opts)
diff --git a/client/src/mobile/screens/journey/MJourneyEntryCard.test.tsx b/client/src/mobile/screens/journey/MJourneyEntryCard.test.tsx
new file mode 100644
index 000000000..1a2426172
--- /dev/null
+++ b/client/src/mobile/screens/journey/MJourneyEntryCard.test.tsx
@@ -0,0 +1,56 @@
+// FE-COMP-MJOURNEYCARD-001 to FE-COMP-MJOURNEYCARD-003
+import { describe, it, expect, vi } from 'vitest'
+import { render, screen } from '../../../../tests/helpers/render'
+import MJourneyEntryCard from './MJourneyEntryCard'
+import type { JourneyEntry } from '../../../store/journeyStore'
+
+// #2022: a long entry comment grew the card, and with it the bottom-anchored
+// carousel, until the timeline covered the map. jsdom does no layout, so these
+// assert the class contract the browser cascade depends on, not pixel heights.
+const LONG_STORY = Array.from({ length: 400 }, (_, i) => `wort${i % 7}`).join(' ')
+
+// Tailwind emits the display plugin AFTER lineClamp, so any display utility on
+// the same element overrides `line-clamp-*`'s own `-webkit-box` and the clamp
+// silently stops working.
+const DISPLAY_UTILITIES = ['block', 'inline-block', 'flex', 'inline-flex', 'grid', 'inline-grid', 'flow-root', 'contents', 'inline']
+
+const buildEntry = (overrides: Partial<JourneyEntry> = {}): JourneyEntry => ({
+  id: 1,
+  journey_id: 7,
+  author_id: 1,
+  type: 'entry',
+  title: 'Erster Tag',
+  story: LONG_STORY,
+  entry_date: '2026-03-03',
+  visibility: 'private',
+  sort_order: 0,
+  photos: [],
+  created_at: 0,
+  updated_at: 0,
+  ...overrides,
+})
+
+describe('MJourneyEntryCard', () => {
+  it('FE-COMP-MJOURNEYCARD-001: keeps the story preview clamp free of a competing display utility', () => {
+    render(<MJourneyEntryCard entry={buildEntry()} number={1} onClick={vi.fn()} />)
+
+    const classes = screen.getByText(LONG_STORY).className.split(/\s+/)
+    expect(classes).toContain('line-clamp-2')
+    DISPLAY_UTILITIES.forEach(utility => expect(classes).not.toContain(utility))
+  })
+
+  it('FE-COMP-MJOURNEYCARD-002: caps the card height so the timeline cannot grow over the map', () => {
+    render(<MJourneyEntryCard entry={buildEntry()} number={1} onClick={vi.fn()} />)
+
+    const classes = screen.getByRole('button').className.split(/\s+/)
+    expect(classes.some(c => /^max-h-\[\d+px\]$/.test(c))).toBe(true)
+    expect(classes).toContain('overflow-hidden')
+  })
+
+  it('FE-COMP-MJOURNEYCARD-003: renders no preview for an entry without a story', () => {
+    render(<MJourneyEntryCard entry={buildEntry({ story: null })} number={2} onClick={vi.fn()} />)
+
+    expect(screen.queryByText(LONG_STORY)).not.toBeInTheDocument()
+    expect(screen.getByText('Erster Tag')).toBeInTheDocument()
+  })
+})
diff --git a/client/src/mobile/screens/journey/MJourneyEntryCard.tsx b/client/src/mobile/screens/journey/MJourneyEntryCard.tsx
index 6635507b0..e12ac6e61 100644
--- a/client/src/mobile/screens/journey/MJourneyEntryCard.tsx
+++ b/client/src/mobile/screens/journey/MJourneyEntryCard.tsx
@@ -26,11 +26,14 @@ export default function MJourneyEntryCard({ entry, number, onClick }: MJourneyEn
   const storyPreview = entry.story ? stripMarkdown(entry.story) : ''
   const title = entry.title || (entry.type === 'checkin' ? t('journey.detail.journeyTab') : t('journey.editor.titlePlaceholder'))
 
+  // The timeline this card sits in is bottom-anchored with no height of its own, so a card
+  // that grows with its story climbs over the map and swallows its touches (#2022). Cap the
+  // card at the height the old journey timeline pins its active card to.
   return (
     <button
       type="button"
       onClick={onClick}
-      className="flex w-[280px] flex-none gap-[11px] rounded-[20px] bg-[color:var(--m-sheet)] p-[11px] text-left shadow-[0_16px_40px_-18px_rgba(0,0,0,.5)]"
+      className="flex max-h-[140px] w-[280px] flex-none gap-[11px] overflow-hidden rounded-[20px] bg-[color:var(--m-sheet)] p-[11px] text-left shadow-[0_16px_40px_-18px_rgba(0,0,0,.5)]"
     >
       {firstPhoto && (
         <span className="flex w-16 flex-none flex-col gap-[5px]">
@@ -73,8 +76,9 @@ export default function MJourneyEntryCard({ entry, number, onClick }: MJourneyEn
           </span>
         </span>
         <span className="mt-1 block truncate text-[0.875rem] font-extrabold">{title}</span>
+        {/* No display utility on the preview: Tailwind emits it after line-clamp-2 and would kill the clamp. */}
         {storyPreview && (
-          <span className="mt-[2px] block font-geist text-[0.65625rem] leading-[1.4] text-m-muted line-clamp-2">
+          <span className="mt-[2px] font-geist text-[0.65625rem] leading-[1.4] text-m-muted line-clamp-2">
             {storyPreview}
           </span>
         )}
diff --git a/client/src/mobile/screens/journey/MJourneyEntrySheet.tsx b/client/src/mobile/screens/journey/MJourneyEntrySheet.tsx
index 9a049ef48..a850f30f4 100644
--- a/client/src/mobile/screens/journey/MJourneyEntrySheet.tsx
+++ b/client/src/mobile/screens/journey/MJourneyEntrySheet.tsx
@@ -1,4 +1,5 @@
 import { useEffect, useMemo, useRef, useState } from 'react'
+import { localIsoDate } from '../../../utils/localDate'
 import { Camera, Plus, Image, Images, X, MapPin, Locate, Trash2, CheckCircle2, MinusCircle } from 'lucide-react'
 import MSheet from '../../components/MSheet'
 import MIconBtn from '../../components/MIconBtn'
@@ -57,7 +58,7 @@ export default function MJourneyEntrySheet({
 
   const [title, setTitle] = useState(entry.title || '')
   const [story, setStory] = useState(entry.story || '')
-  const [entryDate, setEntryDate] = useState(entry.entry_date || new Date().toISOString().split('T')[0])
+  const [entryDate, setEntryDate] = useState(entry.entry_date || localIsoDate())
   const [entryTime, setEntryTime] = useState(entry.entry_time?.slice(0, 5) || '')
   const [locationName, setLocationName] = useState(entry.location_name || '')
   const [locationLat, setLocationLat] = useState<number | null>(entry.location_lat ?? null)
@@ -138,7 +139,7 @@ export default function MJourneyEntrySheet({
       if (group.provider === activeProvider) group.assetIds.forEach(assetId => providerExistingAssetIds.add(assetId))
     })
   }
-  const contextLocation = isValidGeoPoint({ lat: locationLat ?? NaN, lng: locationLng ?? NaN })
+  const contextLocation = isValidGeoPoint({ lat: locationLat ?? Number.NaN, lng: locationLng ?? Number.NaN })
     ? { lat: locationLat!, lng: locationLng!, name: locationName || undefined }
     : null
 
@@ -177,7 +178,7 @@ export default function MJourneyEntrySheet({
   const isDirty =
     title !== (entry.title || '') ||
     story !== (entry.story || '') ||
-    entryDate !== (entry.entry_date || new Date().toISOString().split('T')[0]) ||
+    entryDate !== (entry.entry_date || localIsoDate()) ||
     entryTime !== (entry.entry_time?.slice(0, 5) || '') ||
     locationName !== (entry.location_name || '') ||
     mood !== (entry.mood || '') ||
@@ -314,7 +315,12 @@ export default function MJourneyEntrySheet({
   }
 
   const addTag = () => {
-    const value = tagInput.trim().replace(/,+$/, '')
+    // Trailing commas dropped by a scan, not /,+$/: an unanchored ,+ before $ has to
+    // retry from every comma in the run, so a pasted string of them freezes the tab.
+    const trimmed = tagInput.trim()
+    let end = trimmed.length
+    while (end > 0 && trimmed[end - 1] === ',') end--
+    const value = trimmed.slice(0, end)
     if (!value) return
     if (!tags.includes(value)) setTags(prev => [...prev, value])
     setTagInput('')
diff --git a/client/src/mobile/screens/journey/MJourneySettingsSheet.tsx b/client/src/mobile/screens/journey/MJourneySettingsSheet.tsx
index f68398743..5d0ba1279 100644
--- a/client/src/mobile/screens/journey/MJourneySettingsSheet.tsx
+++ b/client/src/mobile/screens/journey/MJourneySettingsSheet.tsx
@@ -140,7 +140,8 @@ export default function MJourneySettingsSheet({
 
   const toggleSharePerm = async (key: 'share_timeline' | 'share_gallery' | 'share_map') => {
     if (!shareLink) return
-    const updated = { ...shareLink, [key]: !shareLink[key] }
+    const previous = shareLink
+    const updated = { ...previous, [key]: !previous[key] }
     setShareLink(updated)
     try {
       await journeyApi.createShareLink(journey.id, {
@@ -149,7 +150,7 @@ export default function MJourneySettingsSheet({
         share_map: updated.share_map,
       })
     } catch {
-      setShareLink(shareLink)
+      setShareLink(previous)
       toast.error(t('journey.share.updateFailed'))
     }
   }
diff --git a/client/src/mobile/screens/notifications/MNotificationRow.tsx b/client/src/mobile/screens/notifications/MNotificationRow.tsx
index edb573ce1..41e4a13ec 100644
--- a/client/src/mobile/screens/notifications/MNotificationRow.tsx
+++ b/client/src/mobile/screens/notifications/MNotificationRow.tsx
@@ -1,4 +1,4 @@
-import { useState } from 'react'
+import { useState, type HTMLAttributes } from 'react'
 import { useNavigate } from 'react-router'
 import { ArrowRight, Bell, Check, Trash2, X } from 'lucide-react'
 import { useTranslation } from '../../../i18n'
@@ -45,10 +45,22 @@ export default function MNotificationRow({ notification }: MNotificationRowProps
     if (notification.navigate_target) navigate(notification.navigate_target)
   }
 
+  // Tapping an unread row marks it read; a row that is already read carries no
+  // action, so it neither takes focus nor claims a role. It stays a div because
+  // the chips and the delete button inside it are buttons of their own.
+  const markReadOnRow: HTMLAttributes<HTMLDivElement> = notification.is_read
+    ? {}
+    : {
+        role: 'button',
+        tabIndex: 0,
+        onClick: () => markRead(notification.id),
+        onKeyDown: e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); markRead(notification.id) } },
+      }
+
   return (
     <div
       className="flex items-start gap-[11px] border-b border-[color:var(--m-rowbr)] py-3 last:border-b-0"
-      onClick={() => { if (!notification.is_read) markRead(notification.id) }}
+      {...markReadOnRow}
     >
       {notification.sender_avatar ? (
         <img src={notification.sender_avatar} alt="" className="h-8 w-8 flex-none rounded-full object-cover" />
@@ -65,7 +77,7 @@ export default function MNotificationRow({ notification }: MNotificationRowProps
         <p className="mt-[2px] font-geist text-[0.65625rem] leading-relaxed text-m-muted">{body}</p>
 
         {notification.type === 'boolean' && notification.positive_text_key && notification.negative_text_key && (
-          <div className="mt-2 flex gap-[6px]" onClick={e => e.stopPropagation()}>
+          <div className="mt-2 flex gap-[6px]" role="presentation" onClick={e => e.stopPropagation()}>
             <MChip
               active={notification.response === 'positive'}
               onClick={() => handleRespond('positive')}
@@ -86,7 +98,7 @@ export default function MNotificationRow({ notification }: MNotificationRowProps
         )}
 
         {notification.type === 'navigate' && notification.navigate_text_key && notification.navigate_target && (
-          <div className="mt-2" onClick={e => e.stopPropagation()}>
+          <div className="mt-2" role="presentation" onClick={e => e.stopPropagation()}>
             <MChip onClick={handleNavigate}>
               <ArrowRight size={12} strokeWidth={2.2} />
               {t(notification.navigate_text_key)}
diff --git a/client/src/mobile/screens/settings/MSettingsAccount.tsx b/client/src/mobile/screens/settings/MSettingsAccount.tsx
index f1137a268..caa559e66 100644
--- a/client/src/mobile/screens/settings/MSettingsAccount.tsx
+++ b/client/src/mobile/screens/settings/MSettingsAccount.tsx
@@ -44,6 +44,13 @@ function isWebauthnAbort(err: unknown): boolean {
   return name === 'NotAllowedError' || name === 'AbortError'
 }
 
+/** Drop trailing slashes for display, as a scan: without it /\/+$/ backtracks quadratically. */
+function trimTrailingSlashes(value: string): string {
+  let end = value.length
+  while (end > 0 && value[end - 1] === '/') end--
+  return value.slice(0, end)
+}
+
 /**
  * "Account" section — AccountTab parity: profile + avatar, password change,
  * TOTP 2FA (setup, backup codes, disable), passkeys and account deletion.
@@ -323,7 +330,7 @@ export default function MSettingsAccount() {
             </div>
             {oidcIssuer && (
               <div className="mt-[2px] font-geist text-[0.625rem] text-m-faint">
-                {t('settings.oidcLinked')} {oidcIssuer.replace('https://', '').replace(/\/+$/, '')}
+                {t('settings.oidcLinked')} {trimTrailingSlashes(oidcIssuer.replace('https://', ''))}
               </div>
             )}
           </div>
diff --git a/client/src/mobile/screens/settings/MSettingsAppearance.tsx b/client/src/mobile/screens/settings/MSettingsAppearance.tsx
index 609030d77..79eb81fed 100644
--- a/client/src/mobile/screens/settings/MSettingsAppearance.tsx
+++ b/client/src/mobile/screens/settings/MSettingsAppearance.tsx
@@ -24,9 +24,9 @@ function channelLum(v: number): number {
 function relLuminance(hex: string): number {
   const c = hex.replace('#', '')
   const full = c.length === 3 ? c.split('').map((x) => x + x).join('') : c
-  const r = channelLum(parseInt(full.slice(0, 2), 16) / 255)
-  const g = channelLum(parseInt(full.slice(2, 4), 16) / 255)
-  const b = channelLum(parseInt(full.slice(4, 6), 16) / 255)
+  const r = channelLum(Number.parseInt(full.slice(0, 2), 16) / 255)
+  const g = channelLum(Number.parseInt(full.slice(2, 4), 16) / 255)
+  const b = channelLum(Number.parseInt(full.slice(4, 6), 16) / 255)
   return 0.2126 * r + 0.7152 * g + 0.0722 * b
 }
 function contrastRatio(a: string, b: string): number {
diff --git a/client/src/mobile/screens/settings/MSettingsMap.tsx b/client/src/mobile/screens/settings/MSettingsMap.tsx
index 0a8682056..ad918188e 100644
--- a/client/src/mobile/screens/settings/MSettingsMap.tsx
+++ b/client/src/mobile/screens/settings/MSettingsMap.tsx
@@ -102,7 +102,7 @@ export default function MSettingsMap() {
         route_geometry: null,
         place_time: null,
         end_time: null,
-        created_at: Date(),
+        created_at: String(new Date()),
       },
     ],
     [],
diff --git a/client/src/mobile/screens/trip/map/MMapArea.tsx b/client/src/mobile/screens/trip/map/MMapArea.tsx
index 91636b0c7..86cd2253b 100644
--- a/client/src/mobile/screens/trip/map/MMapArea.tsx
+++ b/client/src/mobile/screens/trip/map/MMapArea.tsx
@@ -45,6 +45,10 @@ export default function MMapArea({ planner, shell }: MMapAreaProps) {
         route={planner.route}
         routeVias={planner.routeVias}
         showTransitRoutes={planner.routeShown}
+        // The route toggle belongs to one day, so the map needs that day to know
+        // which automated transports may ride it (#2019).
+        days={planner.days}
+        selectedDayId={planner.selectedDayId}
         routeSegments={planner.routeSegments}
         selectedPlaceId={planner.selectedPlaceId}
         onMarkerClick={planner.handleMarkerClick}
diff --git a/client/src/mobile/screens/trip/plan/MPlanTimeline.tsx b/client/src/mobile/screens/trip/plan/MPlanTimeline.tsx
index dc053838b..4f026ea70 100644
--- a/client/src/mobile/screens/trip/plan/MPlanTimeline.tsx
+++ b/client/src/mobile/screens/trip/plan/MPlanTimeline.tsx
@@ -250,9 +250,10 @@ function UpNextCard({ tl, t, onOpen }: {
   const sub = place?.address || place?.description || ''
 
   return (
-    <div
+    <button
+      type="button"
       onClick={() => onOpen(upNext.assignment)}
-      className="absolute left-4 right-4 cursor-pointer rounded-[22px] border border-[color:var(--m-inbr)] bg-[color:var(--m-inner)] px-4 py-3.5 shadow-[0_18px_44px_-18px_rgba(0,0,0,.3)] backdrop-blur-[28px] backdrop-saturate-[1.8] top-[calc(var(--m-safe-top,12px)+102px)]"
+      className="absolute left-4 right-4 cursor-pointer rounded-[22px] border border-[color:var(--m-inbr)] bg-[color:var(--m-inner)] px-4 py-3.5 text-left shadow-[0_18px_44px_-18px_rgba(0,0,0,.3)] backdrop-blur-[28px] backdrop-saturate-[1.8] top-[calc(var(--m-safe-top,12px)+102px)]"
     >
       <div className="flex items-center justify-between">
         <span className="whitespace-nowrap font-geist text-[0.65625rem] font-bold uppercase tracking-[.08em] text-m-muted">
@@ -280,7 +281,7 @@ function UpNextCard({ tl, t, onOpen }: {
           <ChevronRight size={16} strokeWidth={2.4} />
         </span>
       </div>
-    </div>
+    </button>
   )
 }
 
diff --git a/client/src/mobile/screens/trip/plan/MPlanTimelineRows.tsx b/client/src/mobile/screens/trip/plan/MPlanTimelineRows.tsx
index 2dd33cc3e..180c7046b 100644
--- a/client/src/mobile/screens/trip/plan/MPlanTimelineRows.tsx
+++ b/client/src/mobile/screens/trip/plan/MPlanTimelineRows.tsx
@@ -142,7 +142,18 @@ export function PlaceRow({ assignment, fullPlace, linkedRes, chrome, reorder, dr
     : place?.address || place?.description || ''
 
   return (
-    <div {...dragProps(drag)} onClick={onOpen} className={`flex cursor-pointer items-center gap-2.5 py-1.5 ${dragClass(drag)}`}>
+    // Stays a div: in editing mode the row carries its own action circles and
+    // reorder controls, which may not be nested inside a <button>. The key
+    // handler is guarded on currentTarget so Enter/Space on one of those
+    // controls does not also open the row — a mouse click would not either.
+    <div
+      {...dragProps(drag)}
+      role="button"
+      tabIndex={0}
+      onClick={onOpen}
+      onKeyDown={e => { if (e.target === e.currentTarget && (e.key === 'Enter' || e.key === ' ')) { e.preventDefault(); onOpen() } }}
+      className={`flex cursor-pointer items-center gap-2.5 py-1.5 ${dragClass(drag)}`}
+    >
       {!chrome.editing && (
         <AvatarRing className="shadow-[0_3px_8px_-3px_rgba(0,0,0,.4)]">
           <PlaceAvatar
@@ -213,7 +224,14 @@ export function TransportRow({ res, dayId, chrome, reorder, drag, onOpen }: {
   const sub = transportSubtitle(res)
 
   return (
-    <div {...dragProps(drag)} onClick={onOpen} className={`mt-1.5 flex cursor-pointer items-center gap-2.5 ${dragClass(drag)}`}>
+    <div
+      {...dragProps(drag)}
+      role="button"
+      tabIndex={0}
+      onClick={onOpen}
+      onKeyDown={e => { if (e.target === e.currentTarget && (e.key === 'Enter' || e.key === ' ')) { e.preventDefault(); onOpen() } }}
+      className={`mt-1.5 flex cursor-pointer items-center gap-2.5 ${dragClass(drag)}`}
+    >
       {!chrome.editing && (
         <AvatarRing>
           <Icon size={14} strokeWidth={2} />
@@ -360,7 +378,14 @@ export function TransitRow({ res, transit, dayId, open, chrome, reorder, drag, o
         </AvatarRing>
       )}
       <div className="min-w-0 flex-1 overflow-hidden rounded-[14px] border border-[color:var(--m-rowbr)] bg-[color:var(--m-ic)]">
-        <div onClick={onToggle} className="cursor-pointer px-3 py-[9px]">
+        <div
+          role="button"
+          tabIndex={0}
+          aria-expanded={open}
+          onClick={onToggle}
+          onKeyDown={e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); onToggle() } }}
+          className="cursor-pointer px-3 py-[9px]"
+        >
           <div className="flex items-center gap-[7px]">
             <span className="min-w-0 truncate text-[0.84375rem] font-bold">
               {to ? `${from} → ${to}` : res.title}
@@ -498,7 +523,10 @@ export function NoteRow({ note, chrome, reorder, drag, onEdit }: {
   return (
     <div
       {...dragProps(drag)}
+      role={chrome.editing ? 'button' : undefined}
+      tabIndex={chrome.editing ? 0 : undefined}
       onClick={chrome.editing ? onEdit : undefined}
+      onKeyDown={chrome.editing ? (e => { if (e.target === e.currentTarget && (e.key === 'Enter' || e.key === ' ')) { e.preventDefault(); onEdit() } }) : undefined}
       className={`my-[2px] flex items-center gap-2.5 ${chrome.editing ? 'cursor-pointer' : ''} ${dragClass(drag)}`}
     >
       {!chrome.editing && (
diff --git a/client/src/mobile/screens/trip/sheets/MCostSheet.tsx b/client/src/mobile/screens/trip/sheets/MCostSheet.tsx
index 70262ed0e..5bf4cdfca 100644
--- a/client/src/mobile/screens/trip/sheets/MCostSheet.tsx
+++ b/client/src/mobile/screens/trip/sheets/MCostSheet.tsx
@@ -125,8 +125,8 @@ export default function MCostSheet({ tripId, base, people, me, editing, prefill,
   const isTicketMode = splitMode === 'ticket'
   const ticketInfo = useMemo(() => calculateTicketShares(ticketItems), [ticketItems])
 
-  const totalNum = isTicketMode ? ticketInfo.total : (parseFloat(total) || 0)
-  const splitSum = [...participants].reduce((sum, id) => sum + (parseFloat(customAmounts[id]) || 0), 0)
+  const totalNum = isTicketMode ? ticketInfo.total : (Number.parseFloat(total) || 0)
+  const splitSum = [...participants].reduce((sum, id) => sum + (Number.parseFloat(customAmounts[id]) || 0), 0)
   const customBalanced = Math.round(splitSum * 100) === Math.round(totalNum * 100)
   const each = participants.size > 0 ? totalNum / participants.size : 0
   const equalShares = useMemo(
@@ -139,12 +139,12 @@ export default function MCostSheet({ tripId, base, people, me, editing, prefill,
     if (emptyParts.length === 0) return {}
     const enteredSum = [...participants]
       .filter(id => customAmounts[id])
-      .reduce((sum, id) => sum + (parseFloat(customAmounts[id]) || 0), 0)
+      .reduce((sum, id) => sum + (Number.parseFloat(customAmounts[id]) || 0), 0)
     const remaining = Math.max(0, totalNum - enteredSum)
     return splitEqualShares(remaining, emptyParts.map(id => ({ user_id: id })), editing?.id || 0)
   }, [totalNum, participants, customAmounts, editing])
 
-  const ticketValid = ticketItems.length > 0 && ticketItems.every(item => item.name.trim().length > 0 && (parseFloat(item.price) || 0) > 0 && item.participants.size > 0)
+  const ticketValid = ticketItems.length > 0 && ticketItems.every(item => item.name.trim().length > 0 && (Number.parseFloat(item.price) || 0) > 0 && item.participants.size > 0)
   const payersOk = !multiPayer || (payerIds.size > 0 && payersBalanced(payerAmounts, payerIds, totalNum))
   const valid = name.trim().length > 0 && payersOk && (
     isTicketMode
@@ -237,12 +237,12 @@ export default function MCostSheet({ tripId, base, people, me, editing, prefill,
     // server re-derives total_price from the payer sum (CostsPanel.helpers), so
     // dropping the payer would store the entry with a total of 0.
     const payerList = multiPayer
-      ? [...payerIds].map(id => ({ user_id: id, amount: parseFloat(payerAmounts[id]) || 0 })).filter(p => p.amount > 0)
+      ? [...payerIds].map(id => ({ user_id: id, amount: Number.parseFloat(payerAmounts[id]) || 0 })).filter(p => p.amount > 0)
       : payerId > 0 ? [{ user_id: payerId, amount: totalNum }] : []
     const memberList = [...participants].map(id => ({
       user_id: id,
       amount: splitMode === 'custom'
-        ? (parseFloat(customAmounts[id]) || 0)
+        ? (Number.parseFloat(customAmounts[id]) || 0)
         : splitMode === 'ticket'
           ? (ticketInfo.shares[id] || 0)
           : null,
diff --git a/client/src/mobile/screens/trip/sheets/MPlaceEditSheet.tsx b/client/src/mobile/screens/trip/sheets/MPlaceEditSheet.tsx
index 299ed7e28..bc549e7f4 100644
--- a/client/src/mobile/screens/trip/sheets/MPlaceEditSheet.tsx
+++ b/client/src/mobile/screens/trip/sheets/MPlaceEditSheet.tsx
@@ -33,8 +33,8 @@ function findDuplicateName(
 ): string | null {
   const name = form.name.trim().toLowerCase()
   const gid = (form.google_place_id || '').trim()
-  const lat = form.lat ? parseFloat(form.lat) : null
-  const lng = form.lng ? parseFloat(form.lng) : null
+  const lat = form.lat ? Number.parseFloat(form.lat) : null
+  const lng = form.lng ? Number.parseFloat(form.lng) : null
   for (const p of places || []) {
     if (gid && p.google_place_id && p.google_place_id === gid) return p.name || form.name
     if (name && p.name && p.name.trim().toLowerCase() === name) return p.name
@@ -187,7 +187,10 @@ export default function MPlaceEditSheet({ planner, onOpenExpense }: MPlaceEditSh
 
   const handleCoordPaste = (e: ClipboardEvent<HTMLInputElement>) => {
     const text = e.clipboardData.getData('text').trim()
-    const match = text.match(/^(-?\d+\.?\d*)\s*[,;\s]\s*(-?\d+\.?\d*)$/)
+    // Same grammar as before, spelled without the overlapping quantifiers pasted text
+    // could make backtrack: the separator is either a comma/semicolon with optional
+    // padding or pure whitespace, and a decimal is digits with an optional ".digits".
+    const match = text.match(/^(-?\d+(?:\.\d*)?)(?:\s*[,;]\s*|\s+)(-?\d+(?:\.\d*)?)$/)
     if (match) {
       e.preventDefault()
       setForm(prev => ({ ...prev, lat: match[1], lng: match[2] }))
@@ -236,8 +239,8 @@ export default function MPlaceEditSheet({ planner, onOpenExpense }: MPlaceEditSh
     try {
       const saved = await handleSavePlace({
         ...form,
-        lat: form.lat ? parseFloat(form.lat) : null,
-        lng: form.lng ? parseFloat(form.lng) : null,
+        lat: form.lat ? Number.parseFloat(form.lat) : null,
+        lng: form.lng ? Number.parseFloat(form.lng) : null,
         category_id: form.category_id || null,
         _pendingFiles: pendingFiles.length > 0 ? pendingFiles : undefined,
       })
diff --git a/client/src/mobile/screens/trip/sheets/MPlaceSheet.tsx b/client/src/mobile/screens/trip/sheets/MPlaceSheet.tsx
index f42764967..264851027 100644
--- a/client/src/mobile/screens/trip/sheets/MPlaceSheet.tsx
+++ b/client/src/mobile/screens/trip/sheets/MPlaceSheet.tsx
@@ -513,8 +513,14 @@ export default function MPlaceSheet({ planner, shell }: MTripSheetsProps) {
             {/* ── Files ── */}
             <div className={`mt-3 rounded-[13px] px-3 py-[9px] ${INNER_CLS}`}>
               <div
+                // Stays a div: the row carries the upload button, which may not
+                // nest inside another button.
+                role="button"
+                tabIndex={0}
+                aria-expanded={filesExpanded}
                 className="flex items-center gap-2"
                 onClick={() => { if (placeFiles.length > 0) setFilesExpanded(v => !v) }}
+                onKeyDown={e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); if (placeFiles.length > 0) setFilesExpanded(v => !v) } }}
               >
                 <Paperclip size={14} strokeWidth={2} className="flex-none text-m-muted" />
                 <span className="min-w-0 flex-1 truncate text-[0.78125rem] font-semibold">
diff --git a/client/src/mobile/screens/trip/sheets/MReservationSheet.tsx b/client/src/mobile/screens/trip/sheets/MReservationSheet.tsx
index 90a85de11..81b037b88 100644
--- a/client/src/mobile/screens/trip/sheets/MReservationSheet.tsx
+++ b/client/src/mobile/screens/trip/sheets/MReservationSheet.tsx
@@ -196,7 +196,7 @@ export default function MReservationSheet({ planner, onOpenExpense }: MReservati
 
   // Restrict non-hotel booking dates to the trip's span (#1662); hotels already
   // constrain to trip days via their day dropdowns.
-  const tripDates = days.map(d => d.date).filter((d): d is string => !!d).sort()
+  const tripDates = days.map(d => d.date).filter((d): d is string => !!d).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
   const tripMinDate = tripDates[0]
   const tripMaxDate = tripDates[tripDates.length - 1]
 
diff --git a/client/src/mobile/screens/trip/sheets/MTransportFormSheet.tsx b/client/src/mobile/screens/trip/sheets/MTransportFormSheet.tsx
index c81ba3425..f96886d85 100644
--- a/client/src/mobile/screens/trip/sheets/MTransportFormSheet.tsx
+++ b/client/src/mobile/screens/trip/sheets/MTransportFormSheet.tsx
@@ -54,9 +54,16 @@ function endpointFromAirport(a: Airport, role: 'from' | 'to' | 'stop', sequence:
 function endpointFromLocation(l: LocationPoint, role: 'from' | 'to' | 'stop', sequence: number, date: string | null, time: string | null): Omit<ReservationEndpoint, 'id' | 'reservation_id'> {
   return { role, sequence, name: l.name, code: null, lat: l.lat, lng: l.lng, timezone: null, local_date: date, local_time: time }
 }
+// "Paris Charles de Gaulle (CDG)" → "Paris Charles de Gaulle", the same trim-plus-
+// anchored-test the desktop TransportModal uses instead of /\s*\([A-Z]{3}\)\s*$/,
+// because that leading \s* backtracks over every space in a long name.
+function stripAirportCode(name: string): string {
+  const trimmed = name.trimEnd()
+  return /\([A-Z]{3}\)$/.test(trimmed) ? trimmed.slice(0, -5).trimEnd() : name
+}
 function airportFromEndpoint(e: ReservationEndpoint | undefined): Airport | null {
   if (!e || !e.code) return null
-  return { iata: e.code, icao: null, name: e.name, city: e.name.replace(/\s*\([A-Z]{3}\)\s*$/, ''), country: '', lat: e.lat, lng: e.lng, tz: e.timezone || '' }
+  return { iata: e.code, icao: null, name: e.name, city: stripAirportCode(e.name), country: '', lat: e.lat, lng: e.lng, tz: e.timezone || '' }
 }
 function locationFromEndpoint(e: ReservationEndpoint | undefined): LocationPoint | null {
   if (!e) return null
diff --git a/client/src/mobile/screens/trip/sheets/MTransportSheet.tsx b/client/src/mobile/screens/trip/sheets/MTransportSheet.tsx
index dc3665ffd..4f0526a46 100644
--- a/client/src/mobile/screens/trip/sheets/MTransportSheet.tsx
+++ b/client/src/mobile/screens/trip/sheets/MTransportSheet.tsx
@@ -218,12 +218,13 @@ export default function MTransportSheet({ planner, shell }: MTripSheetsProps) {
             {confirmed ? t('reservations.confirmed') : t('reservations.pending')}
           </span>
           {res.confirmation_number && (
-            <span
+            <button
+              type="button"
               onClick={() => { if (blurCodes) setCodeRevealed(v => !v) }}
               className={`flex-none font-geist text-[0.71875rem] tabular-nums text-m-muted ${codeBlurred ? 'blur-[4px] select-none' : ''}`}
             >
               #{res.confirmation_number}
-            </span>
+            </button>
           )}
         </div>
 
@@ -235,12 +236,13 @@ export default function MTransportSheet({ planner, shell }: MTripSheetsProps) {
                 <span className="min-w-0 flex-1 truncate text-[0.71875rem] font-medium">
                   {[leg.from, leg.to].filter(Boolean).join(' → ') || t('reservations.confirmationCode')}
                 </span>
-                <span
+                <button
+                  type="button"
                   onClick={() => { if (blurCodes) setCodeRevealed(v => !v) }}
                   className={`flex-none font-geist text-[0.71875rem] tabular-nums text-m-muted ${codeBlurred ? 'blur-[4px] select-none' : ''}`}
                 >
                   #{leg.confirmation_number}
-                </span>
+                </button>
               </div>
             ))}
           </div>
diff --git a/client/src/mobile/screens/trip/sheets/MTripSheetUi.tsx b/client/src/mobile/screens/trip/sheets/MTripSheetUi.tsx
index 6ce637da2..6a6313899 100644
--- a/client/src/mobile/screens/trip/sheets/MTripSheetUi.tsx
+++ b/client/src/mobile/screens/trip/sheets/MTripSheetUi.tsx
@@ -66,18 +66,24 @@ interface StatBoxProps {
 
 /** Small stat box (check-in / times / code): value 700 tabular over a faint Geist label. */
 export function StatBox({ value, label, blurred = false, onClick }: StatBoxProps) {
-  return (
-    <div
-      onClick={onClick}
-      className="min-w-0 flex-1 rounded-[10px] bg-[color:var(--m-ic)] px-[9px] py-[7px] text-center"
-    >
+  const box = 'min-w-0 flex-1 rounded-[10px] bg-[color:var(--m-ic)] px-[9px] py-[7px] text-center'
+  const inner = (
+    <>
       <div
         className={`truncate text-[0.8125rem] font-bold tabular-nums leading-tight ${blurred ? 'blur-[4px] select-none' : ''}`}
       >
         {value}
       </div>
       <div className="truncate font-geist text-[0.5625rem] text-m-faint">{label}</div>
-    </div>
+    </>
+  )
+  // A tappable stat is a real button — value and label give it its name. Without
+  // a handler it stays a plain box rather than an empty stop in the tab order.
+  if (!onClick) return <div className={box}>{inner}</div>
+  return (
+    <button type="button" onClick={onClick} className={`${box} block border-0`}>
+      {inner}
+    </button>
   )
 }
 
diff --git a/client/src/mobile/screens/trip/sheets/PlPlaceSearch.tsx b/client/src/mobile/screens/trip/sheets/PlPlaceSearch.tsx
index 2467e987f..28da858a4 100644
--- a/client/src/mobile/screens/trip/sheets/PlPlaceSearch.tsx
+++ b/client/src/mobile/screens/trip/sheets/PlPlaceSearch.tsx
@@ -38,7 +38,7 @@ interface PlPlaceSearchProps {
 }
 
 /** "48.8566, 2.3522" (also ; or whitespace separated) → direct coordinates. */
-const COORD_RE = /^(-?\d+\.?\d*)\s*[,;\s]\s*(-?\d+\.?\d*)$/
+const COORD_RE = /^(-?\d+(?:\.\d*)?)(?:\s*[,;]\s*|\s+)(-?\d+(?:\.\d*)?)$/
 
 function placeToPick(place: MapsPlace): PlSearchPick {
   const s = (v: unknown) => (v == null ? undefined : String(v))
diff --git a/client/src/mobile/screens/trip/tabs/MBookingsTab.tsx b/client/src/mobile/screens/trip/tabs/MBookingsTab.tsx
index c71856d00..ff2a2617c 100644
--- a/client/src/mobile/screens/trip/tabs/MBookingsTab.tsx
+++ b/client/src/mobile/screens/trip/tabs/MBookingsTab.tsx
@@ -240,10 +240,15 @@ function BookingCard({ res, planner, canEdit, compact }: {
                   {t('files.title')}
                 </div>
                 <div className="flex flex-col gap-1">
+                  {/* A span with a button role, not a <button>: the whole card body
+                      is already one, and buttons cannot nest. */}
                   {files.map(f => (
                     <span
                       key={f.id}
+                      role="button"
+                      tabIndex={0}
                       onClick={e => { e.stopPropagation(); openFile(f.url, f.original_name) }}
+                      onKeyDown={e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); e.stopPropagation(); openFile(f.url, f.original_name) } }}
                       className="flex items-center gap-[6px] rounded-[10px] border border-[color:var(--m-rowbr)] bg-m-card px-[10px] py-[7px]"
                     >
                       <FileText size={12} strokeWidth={2} className="flex-none text-m-muted" />
diff --git a/client/src/mobile/screens/trip/tabs/MCostsTab.tsx b/client/src/mobile/screens/trip/tabs/MCostsTab.tsx
index 6c7dff27d..6772ca0ef 100644
--- a/client/src/mobile/screens/trip/tabs/MCostsTab.tsx
+++ b/client/src/mobile/screens/trip/tabs/MCostsTab.tsx
@@ -685,7 +685,7 @@ function AddPaymentSheet({ open, onClose, tripId, base, people, me, toast, t, on
     setSaving(false)
   }, [open, me, people])
 
-  const amt = parseFloat(amount.replace(',', '.')) || 0
+  const amt = Number.parseFloat(amount.replace(',', '.')) || 0
   const valid = amt > 0 && fromId !== toId
 
   const save = async () => {
diff --git a/client/src/mobile/screens/trip/tabs/MFileLightbox.tsx b/client/src/mobile/screens/trip/tabs/MFileLightbox.tsx
index 79b458f5a..ef27fd758 100644
--- a/client/src/mobile/screens/trip/tabs/MFileLightbox.tsx
+++ b/client/src/mobile/screens/trip/tabs/MFileLightbox.tsx
@@ -69,6 +69,10 @@ export default function MFileLightbox({ files, index, onIndexChange, onClose, t
 
   return createPortal(
     <div
+      // Backdrop, header bar and media pane are plain boxes: they only route the
+      // tap-to-dismiss. Escape / arrow keys and the header buttons are the
+      // keyboard equivalents, wired up in the effect above.
+      role="presentation"
       className="m-root fixed inset-0 z-[65] flex flex-col bg-black/[.92]"
       onClick={onClose}
       onTouchStart={e => { touchStartRef.current = e.touches[0].clientX }}
@@ -82,7 +86,7 @@ export default function MFileLightbox({ files, index, onIndexChange, onClose, t
       }}
     >
       {/* Header */}
-      <div className="flex flex-none items-center justify-between px-4 py-[10px]" onClick={e => e.stopPropagation()}>
+      <div role="presentation" className="flex flex-none items-center justify-between px-4 py-[10px]" onClick={e => e.stopPropagation()}>
         <span className="min-w-0 flex-1 truncate font-geist text-[0.75rem] text-white/70">
           {file.original_name}
           <span className="ml-2 text-white/40">{index + 1} / {files.length}</span>
@@ -112,6 +116,7 @@ export default function MFileLightbox({ files, index, onIndexChange, onClose, t
 
       {/* Media + nav */}
       <div
+        role="presentation"
         className="relative flex min-h-0 flex-1 items-center justify-center"
         onClick={e => {
           if (e.target !== e.currentTarget) return
@@ -131,17 +136,20 @@ export default function MFileLightbox({ files, index, onIndexChange, onClose, t
           </button>
         )}
         {fileIsVideo ? (
-          <div onClick={e => e.stopPropagation()}>
+          <div role="presentation" onClick={e => e.stopPropagation()}>
             <VideoPlayer src={file.url} style={{ maxWidth: '92vw', maxHeight: '78vh', borderRadius: 8 }} />
           </div>
         ) : (
           imgSrc && (
-            <img
-              src={imgSrc}
-              alt={file.original_name}
-              onClick={e => e.stopPropagation()}
-              className="block max-h-[78vh] max-w-[92vw] rounded-lg object-contain"
-            />
+            // The stop sits on a wrapper rather than on the <img>: a picture is
+            // not something you activate, and this keeps its alt text intact.
+            <div role="presentation" onClick={e => e.stopPropagation()}>
+              <img
+                src={imgSrc}
+                alt={file.original_name}
+                className="block max-h-[78vh] max-w-[92vw] rounded-lg object-contain"
+              />
+            </div>
           )
         )}
         {hasNext && (
diff --git a/client/src/mobile/screens/trip/tabs/MPackItemSheet.tsx b/client/src/mobile/screens/trip/tabs/MPackItemSheet.tsx
index 820b495bf..930180fdf 100644
--- a/client/src/mobile/screens/trip/tabs/MPackItemSheet.tsx
+++ b/client/src/mobile/screens/trip/tabs/MPackItemSheet.tsx
@@ -87,8 +87,8 @@ export default function MPackItemSheet({
     const trimmedName = name.trim()
     setSaving(true)
     try {
-      const qty = Math.max(1, Math.min(999, parseInt(quantity, 10) || 1))
-      const weightVal = weight.trim() === '' ? null : Math.max(0, parseInt(weight, 10) || 0)
+      const qty = Math.max(1, Math.min(999, Number.parseInt(quantity, 10) || 1))
+      const weightVal = weight.trim() === '' ? null : Math.max(0, Number.parseInt(weight, 10) || 0)
       await tripActions.updatePackingItem(tripId, item.id, {
         name: trimmedName,
         quantity: qty,
diff --git a/client/src/mobile/screens/trip/tabs/MPackingListTab.tsx b/client/src/mobile/screens/trip/tabs/MPackingListTab.tsx
index 65be985a3..aa190c619 100644
--- a/client/src/mobile/screens/trip/tabs/MPackingListTab.tsx
+++ b/client/src/mobile/screens/trip/tabs/MPackingListTab.tsx
@@ -598,8 +598,8 @@ function PackingCategoryCard({
 
   return (
     <div className="mt-[10px] overflow-hidden rounded-2xl border border-[color:var(--m-rowbr)] bg-m-sheetop">
-      {/* A <div role="button"> rather than a real <button> — the rename input and
-          the assign/menu triggers below are interactive elements a <button> may
+      {/* A <div role="button"> rather than a real <button type="button"> — the rename input and
+          the assign/menu triggers below are interactive elements a <button type="button"> may
           not contain (invalid HTML); this stays keyboard-operable via onKeyDown. */}
       <div
         role="button"
diff --git a/client/src/mobile/screens/trip/tabs/MTransportsTab.tsx b/client/src/mobile/screens/trip/tabs/MTransportsTab.tsx
index 56b16be5a..1a47bedcf 100644
--- a/client/src/mobile/screens/trip/tabs/MTransportsTab.tsx
+++ b/client/src/mobile/screens/trip/tabs/MTransportsTab.tsx
@@ -263,7 +263,10 @@ function TransportCard({ res, planner, shell, canEdit, compact }: {
                   {files.map(f => (
                     <span
                       key={f.id}
+                      role="button"
+                      tabIndex={0}
                       onClick={e => { e.stopPropagation(); openFile(f.url, f.original_name) }}
+                      onKeyDown={e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); e.stopPropagation(); openFile(f.url, f.original_name) } }}
                       className="flex items-center gap-[6px] rounded-[10px] border border-[color:var(--m-rowbr)] bg-m-card px-[10px] py-[7px]"
                     >
                       <FileText size={12} strokeWidth={2} className="flex-none text-m-muted" />
diff --git a/client/src/mobile/screens/trip/tabs/costsModel.ts b/client/src/mobile/screens/trip/tabs/costsModel.ts
index 03a13528c..181bf8d01 100644
--- a/client/src/mobile/screens/trip/tabs/costsModel.ts
+++ b/client/src/mobile/screens/trip/tabs/costsModel.ts
@@ -196,9 +196,9 @@ export function categoryBreakdown(items: BudgetItem[], ctx: CostsCtx): CostsCate
 /** Category colour at a fixed alpha — the expense card's border tint (spec §3.10: "brC"). */
 export function tint(hex: string, alpha: number): string {
   const clean = hex.replace('#', '')
-  const r = parseInt(clean.slice(0, 2), 16)
-  const g = parseInt(clean.slice(2, 4), 16)
-  const b = parseInt(clean.slice(4, 6), 16)
+  const r = Number.parseInt(clean.slice(0, 2), 16)
+  const g = Number.parseInt(clean.slice(2, 4), 16)
+  const b = Number.parseInt(clean.slice(4, 6), 16)
   return `rgba(${r}, ${g}, ${b}, ${alpha})`
 }
 
diff --git a/client/src/mobile/screens/trip/tabs/listsModel.ts b/client/src/mobile/screens/trip/tabs/listsModel.ts
index 7b54975cc..2ab90a472 100644
--- a/client/src/mobile/screens/trip/tabs/listsModel.ts
+++ b/client/src/mobile/screens/trip/tabs/listsModel.ts
@@ -154,7 +154,9 @@ export function sortTodoRows(items: TodoItem[], sortByPriority: boolean, today:
 export function todoCategories(items: TodoItem[]): string[] {
   const cats = new Set<string>()
   items.forEach(i => { if (i.category) cats.add(i.category) })
-  return Array.from(cats).sort()
+  // Same locale collation as the desktop hook (useTodoList) — a bare .sort() is
+  // byte order and files every accented name behind the whole ASCII range.
+  return Array.from(cats).sort((a, b) => a.localeCompare(b))
 }
 
 /** Open (non-done) item count for a given category — matches the desktop sidebar badge. */
diff --git a/client/src/mobile/screens/vacay/MVacaySettingsSheet.tsx b/client/src/mobile/screens/vacay/MVacaySettingsSheet.tsx
index e5c707dab..32390b574 100644
--- a/client/src/mobile/screens/vacay/MVacaySettingsSheet.tsx
+++ b/client/src/mobile/screens/vacay/MVacaySettingsSheet.tsx
@@ -348,7 +348,7 @@ function YearTypeRows() {
               value={String(yearSettings.year_start_month)}
               placeholder={t('vacay.yearStartMonth')}
               options={monthOptions}
-              onChange={v => save({ year_start_month: parseInt(v, 10) })}
+              onChange={v => save({ year_start_month: Number.parseInt(v, 10) })}
             />
           </span>
           <span className="w-[86px] flex-none">
@@ -356,7 +356,7 @@ function YearTypeRows() {
               value={String(yearSettings.year_start_day)}
               placeholder={t('vacay.yearStartDay')}
               options={Array.from({ length: monthDayCap(yearSettings.year_start_month) }, (_, i) => ({ value: String(i + 1), label: String(i + 1) }))}
-              onChange={v => save({ year_start_day: parseInt(v, 10) })}
+              onChange={v => save({ year_start_day: Number.parseInt(v, 10) })}
             />
           </span>
         </div>
diff --git a/client/src/mobile/screens/vacay/vacayDayModel.ts b/client/src/mobile/screens/vacay/vacayDayModel.ts
index 1f70e45c8..2db106b4d 100644
--- a/client/src/mobile/screens/vacay/vacayDayModel.ts
+++ b/client/src/mobile/screens/vacay/vacayDayModel.ts
@@ -38,7 +38,7 @@ export interface DayVisualContext {
 function hexToHsl(hex: string): { h: number; s: number; l: number } | null {
   const m = /^#([0-9a-f]{6})$/i.exec(hex.trim())
   if (!m) return null
-  const n = parseInt(m[1], 16)
+  const n = Number.parseInt(m[1], 16)
   const r = ((n >> 16) & 255) / 255
   const g = ((n >> 8) & 255) / 255
   const b = (n & 255) / 255
diff --git a/client/src/pages/AdminPage.tsx b/client/src/pages/AdminPage.tsx
index 60f511300..5093ae9fc 100644
--- a/client/src/pages/AdminPage.tsx
+++ b/client/src/pages/AdminPage.tsx
@@ -104,7 +104,7 @@ function AdminPageDesktop(): React.ReactElement {
                 <p className="text-sm font-semibold text-amber-900">Demo Baseline</p>
                 <p className="text-xs text-amber-700">Save current state as the hourly reset point. All admin trips and settings will be preserved.</p>
               </div>
-              <button
+              <button type="button"
                 onClick={async () => {
                   try {
                     await adminApi.saveDemoBaseline()
diff --git a/client/src/pages/AtlasPage.tsx b/client/src/pages/AtlasPage.tsx
index ca123e61f..8693385a8 100644
--- a/client/src/pages/AtlasPage.tsx
+++ b/client/src/pages/AtlasPage.tsx
@@ -170,9 +170,9 @@ function AtlasPageDesktop(): React.ReactElement {
 
       {/* Country action popup */}
       {confirmAction && (
-        <div className="bg-[rgba(0,0,0,0.4)]" style={{ position: 'fixed', inset: 0, zIndex: 1000, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 20 }}
+        <div role="presentation" className="bg-[rgba(0,0,0,0.4)]" style={{ position: 'fixed', inset: 0, zIndex: 1000, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 20 }}
           onClick={() => setConfirmAction(null)}>
-          <div className="bg-surface-card" style={{ borderRadius: 16, padding: 24, maxWidth: 340, width: '100%', boxShadow: '0 16px 48px rgba(0,0,0,0.2)', textAlign: 'center' }}
+          <div role="presentation" className="bg-surface-card" style={{ borderRadius: 16, padding: 24, maxWidth: 340, width: '100%', boxShadow: '0 16px 48px rgba(0,0,0,0.2)', textAlign: 'center' }}
             onClick={e => e.stopPropagation()}>
             {confirmAction.code.length === 2 ? (
               <img src={`https://flagcdn.com/w80/${confirmAction.code.toLowerCase()}.png`} alt={confirmAction.code} style={{ width: 48, height: 34, borderRadius: 6, objectFit: 'cover', marginBottom: 12, display: 'inline-block' }} />
@@ -183,7 +183,7 @@ function AtlasPageDesktop(): React.ReactElement {
 
             {confirmAction.type === 'choose' && (
               <div style={{ display: 'flex', flexDirection: 'column', gap: 8 }}>
-                <button onClick={async () => {
+                <button type="button" onClick={async () => {
                   try {
                     await apiClient.post(`/addons/atlas/country/${confirmAction.code}/mark`)
                     setData(prev => (prev ? withCountryMarkedVisited(prev, confirmAction.code) : prev))
@@ -202,7 +202,7 @@ function AtlasPageDesktop(): React.ReactElement {
                     <div className="text-content-muted" style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', marginTop: 1 }}>{t('atlas.markVisitedHint')}</div>
                   </div>
                 </button>
-                <button onClick={() => setConfirmAction({ ...confirmAction, type: 'bucket' as any })}
+                <button type="button" onClick={() => setConfirmAction({ ...confirmAction, type: 'bucket' as any })}
                   className="border border-edge"
                   style={{ display: 'flex', alignItems: 'center', gap: 10, width: '100%', padding: '12px 16px', borderRadius: 12, background: 'none', cursor: 'pointer', fontFamily: 'inherit', textAlign: 'left', transition: 'background 0.12s' }}
                   onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-secondary)'}
@@ -217,7 +217,7 @@ function AtlasPageDesktop(): React.ReactElement {
                   const wishlistItems = bucketList.filter(b => b.country_code === confirmAction.code)
                   if (wishlistItems.length === 0) return null
                   return (
-                    <button onClick={async () => {
+                    <button type="button" onClick={async () => {
                       await Promise.all(wishlistItems.map(item => handleDeleteBucketItem(item.id)))
                       setConfirmAction(null)
                     }}
@@ -241,7 +241,7 @@ function AtlasPageDesktop(): React.ReactElement {
                 {confirmAction.countryName && (
                   <p className="text-content-muted" style={{ margin: '-8px 0 8px', fontSize: 'calc(12px * var(--fs-scale-body, 1))' }}>{confirmAction.countryName}</p>
                 )}
-                <button onClick={async () => {
+                <button type="button" onClick={async () => {
                   const { code: countryCode, name: rName, regionCode: rCode } = confirmAction
                   if (!rCode) return
                   try {
@@ -267,7 +267,7 @@ function AtlasPageDesktop(): React.ReactElement {
                     <div className="text-content-muted" style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', marginTop: 1 }}>{t('atlas.markRegionVisitedHint')}</div>
                   </div>
                 </button>
-                <button onClick={() => setConfirmAction({ ...confirmAction, type: 'bucket' })}
+                <button type="button" onClick={() => setConfirmAction({ ...confirmAction, type: 'bucket' })}
                   className="border border-edge"
                   style={{ display: 'flex', alignItems: 'center', gap: 10, width: '100%', padding: '12px 16px', borderRadius: 12, background: 'none', cursor: 'pointer', fontFamily: 'inherit', textAlign: 'left', transition: 'background 0.12s' }}
                   onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-secondary)'}
@@ -285,12 +285,12 @@ function AtlasPageDesktop(): React.ReactElement {
               <>
                 <p className="text-content-muted" style={{ margin: '0 0 20px', fontSize: 'calc(13px * var(--fs-scale-body, 1))' }}>{t('atlas.confirmUnmark')}</p>
                 <div style={{ display: 'flex', gap: 8, justifyContent: 'center' }}>
-                  <button onClick={() => setConfirmAction(null)}
+                  <button type="button" onClick={() => setConfirmAction(null)}
                     className="border border-edge text-content-muted"
                     style={{ padding: '8px 20px', borderRadius: 10, background: 'none', fontSize: 'calc(13px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit' }}>
                     {t('common.cancel')}
                   </button>
-                  <button onClick={executeConfirmAction}
+                  <button type="button" onClick={executeConfirmAction}
                     className="bg-[#ef4444] text-white"
                     style={{ padding: '8px 20px', borderRadius: 10, border: 'none', fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}>
                     {t('atlas.unmark')}
@@ -306,12 +306,12 @@ function AtlasPageDesktop(): React.ReactElement {
                 )}
                 <p className="text-content-muted" style={{ margin: '0 0 20px', fontSize: 'calc(13px * var(--fs-scale-body, 1))' }}>{t('atlas.confirmUnmarkRegion')}</p>
                 <div style={{ display: 'flex', gap: 8, justifyContent: 'center' }}>
-                  <button onClick={() => setConfirmAction(null)}
+                  <button type="button" onClick={() => setConfirmAction(null)}
                     className="border border-edge text-content-muted"
                     style={{ padding: '8px 20px', borderRadius: 10, background: 'none', fontSize: 'calc(13px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit' }}>
                     {t('common.cancel')}
                   </button>
-                  <button onClick={async () => {
+                  <button type="button" onClick={async () => {
                     const { code: countryCode, regionCode: rCode } = confirmAction
                     if (!rCode) return
                     try {
@@ -386,12 +386,12 @@ function AtlasPageDesktop(): React.ReactElement {
                   </div>
                 </div>
                 <div style={{ display: 'flex', gap: 8, justifyContent: 'center', flexWrap: 'wrap' }}>
-                  <button onClick={() => setConfirmAction({ ...confirmAction, type: confirmAction.regionCode ? 'choose-region' : 'choose' })}
+                  <button type="button" onClick={() => setConfirmAction({ ...confirmAction, type: confirmAction.regionCode ? 'choose-region' : 'choose' })}
                     className="border border-edge text-content-muted"
                     style={{ padding: '8px 20px', borderRadius: 10, background: 'none', fontSize: 'calc(13px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit' }}>
                     {t('common.back')}
                   </button>
-                  <button onClick={async () => {
+                  <button type="button" onClick={async () => {
                     const targetDate = bucketMonth > 0 && bucketYear > 0 ? `${bucketYear}-${String(bucketMonth).padStart(2, '0')}` : null
                     // #1898: one entry per target date. The dialog stays open on a
                     // duplicate so another month can be picked right away.
@@ -424,12 +424,12 @@ function AtlasPageDesktop(): React.ReactElement {
               <>
                 <p className="text-content-muted" style={{ margin: '0 0 20px', fontSize: 'calc(13px * var(--fs-scale-body, 1))' }}>{t('atlas.confirmMark')}</p>
                 <div style={{ display: 'flex', gap: 8, justifyContent: 'center' }}>
-                  <button onClick={() => setConfirmAction(null)}
+                  <button type="button" onClick={() => setConfirmAction(null)}
                     className="border border-edge text-content-muted"
                     style={{ padding: '8px 20px', borderRadius: 10, background: 'none', fontSize: 'calc(13px * var(--fs-scale-body, 1))', cursor: 'pointer', fontFamily: 'inherit' }}>
                     {t('common.cancel')}
                   </button>
-                  <button onClick={executeConfirmAction}
+                  <button type="button" onClick={executeConfirmAction}
                     className="bg-content text-white"
                     style={{ padding: '8px 20px', borderRadius: 10, border: 'none', fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}>
                     {t('atlas.markVisited')}
@@ -506,7 +506,7 @@ function SidebarContent({ data, stats, countries, selectedCountry, countryDetail
   const tabBar = (
     <div style={{ display: 'flex', gap: 4, padding: '12px 16px 0', marginBottom: 4 }}>
       {[{ id: 'stats', label: t('atlas.statsTab'), icon: Globe }, { id: 'bucket', label: t('atlas.bucketTab'), icon: Star }].map(tab => (
-        <button key={tab.id} onClick={() => setBucketTab(tab.id as any)}
+        <button type="button" key={tab.id} onClick={() => setBucketTab(tab.id as any)}
           style={{
             flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 5,
             padding: '7px 0', borderRadius: 10, border: 'none', cursor: 'pointer', fontFamily: 'inherit',
@@ -552,7 +552,7 @@ function SidebarContent({ data, stats, countries, selectedCountry, countryDetail
             return <span className="text-[9px] mt-0.5 text-center" style={{ color: tf }}>{label}</span>
           })()}
           {!item.target_date && item.notes && <span className="text-[9px] mt-0.5 text-center" style={{ color: tf, maxWidth: 90, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{item.notes}</span>}
-          <button onClick={() => onDeleteBucket(item.id)}
+          <button type="button" onClick={() => onDeleteBucket(item.id)}
             className="opacity-0 group-hover:opacity-100"
             style={{ position: 'absolute', top: 4, right: 4, background: 'none', border: 'none', cursor: 'pointer', padding: 2, color: tf, display: 'flex', transition: 'opacity 0.15s' }}>
             <X size={10} />
@@ -579,14 +579,14 @@ function SidebarContent({ data, stats, countries, selectedCountry, countryDetail
               style={{ flex: 1, padding: '6px 10px', borderRadius: 8, fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontFamily: 'inherit', outline: 'none', boxSizing: 'border-box' }}
             />
             {!bucketForm.name && (
-              <button onClick={onSearchBucket} disabled={bucketSearching}
+              <button type="button" onClick={onSearchBucket} disabled={bucketSearching}
                 className="bg-accent text-accent-text"
                 style={{ padding: '6px 10px', borderRadius: 8, border: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center' }}>
                 <Search size={12} />
               </button>
             )}
             {bucketForm.name && (
-              <button onClick={() => { setBucketForm({ ...bucketForm, name: '', lat: '', lng: '' }); setBucketSearch('') }}
+              <button type="button" onClick={() => { setBucketForm({ ...bucketForm, name: '', lat: '', lng: '' }); setBucketSearch('') }}
                 className="border border-edge text-content-faint"
                 style={{ padding: '6px 8px', borderRadius: 8, background: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center' }}>
                 <X size={12} />
@@ -616,7 +616,7 @@ function SidebarContent({ data, stats, countries, selectedCountry, countryDetail
               zIndex: 99999, borderRadius: 8, boxShadow: '0 4px 12px rgba(0,0,0,0.12)', overflowY: 'auto',
             }}>
               {bucketSearchResults.slice(0, 6).map((r, i) => (
-                <button key={i} onClick={() => onSelectBucketPoi(r)} className="border-b border-edge-faint" style={{ display: 'flex', flexDirection: 'column', gap: 1, width: '100%', padding: '6px 10px', borderTop: 'none', borderLeft: 'none', borderRight: 'none', background: 'none', cursor: 'pointer', textAlign: 'left', fontFamily: 'inherit' }}>
+                <button type="button" key={i} onClick={() => onSelectBucketPoi(r)} className="border-b border-edge-faint" style={{ display: 'flex', flexDirection: 'column', gap: 1, width: '100%', padding: '6px 10px', borderTop: 'none', borderLeft: 'none', borderRight: 'none', background: 'none', cursor: 'pointer', textAlign: 'left', fontFamily: 'inherit' }}>
                   <span className="text-content" style={{ fontSize: 'calc(12px * var(--fs-scale-body, 1))', fontWeight: 500 }}>{r.name}</span>
                   {r.address && <span className="text-content-faint" style={{ fontSize: 'calc(10px * var(--fs-scale-caption, 1))' }}>{r.address}</span>}
                 </button>
@@ -643,12 +643,12 @@ function SidebarContent({ data, stats, countries, selectedCountry, countryDetail
           </div>
         </div>
         <div style={{ display: 'flex', gap: 6, justifyContent: 'flex-end' }}>
-          <button onClick={() => { setShowBucketAdd(false); setBucketForm({ name: '', notes: '', lat: '', lng: '', target_date: '' }); setBucketSearch(''); setBucketSearchResults([]); setBucketPoiMonth(0); setBucketPoiYear(0) }}
+          <button type="button" onClick={() => { setShowBucketAdd(false); setBucketForm({ name: '', notes: '', lat: '', lng: '', target_date: '' }); setBucketSearch(''); setBucketSearchResults([]); setBucketPoiMonth(0); setBucketPoiYear(0) }}
             className="border border-edge text-content-muted"
             style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', padding: '4px 10px', borderRadius: 6, background: 'none', cursor: 'pointer', fontFamily: 'inherit' }}>
             {t('common.cancel')}
           </button>
-          <button onClick={onAddBucket} disabled={!bucketForm.name.trim()}
+          <button type="button" onClick={onAddBucket} disabled={!bucketForm.name.trim()}
             className="bg-[#fbbf24] text-[#1a1a1a]"
             style={{ fontSize: 'calc(11px * var(--fs-scale-caption, 1))', padding: '4px 12px', borderRadius: 6, border: 'none', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit', opacity: bucketForm.name.trim() ? 1 : 0.5 }}>
             {t('common.add')}
@@ -657,7 +657,7 @@ function SidebarContent({ data, stats, countries, selectedCountry, countryDetail
       </div>
     ) : (
       <div style={{ padding: '4px 16px 8px' }}>
-        <button onClick={() => setShowBucketAdd(true)}
+        <button type="button" onClick={() => setShowBucketAdd(true)}
           className="border border-dashed border-edge"
           style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 4, width: '100%', padding: '5px 0', borderRadius: 8, background: 'none', fontSize: 'calc(11px * var(--fs-scale-caption, 1))', color: tf, cursor: 'pointer', fontFamily: 'inherit' }}>
           <Plus size={11} /> {t('atlas.addPoi')}
@@ -756,7 +756,7 @@ function SidebarContent({ data, stats, countries, selectedCountry, countryDetail
               <p className="text-[10px] mb-1" style={{ color: tf }}>{countryDetail.places.length} {t('atlas.places')} · {countryDetail.trips.length} {t('atlas.tripPlural')}</p>
               <div className="flex flex-wrap gap-1">
                 {countryDetail.trips.slice(0, 3).map(trip => (
-                  <button key={trip.id} onClick={() => onTripClick(trip.id)}
+                  <button type="button" key={trip.id} onClick={() => onTripClick(trip.id)}
                     className="flex items-center gap-1 px-2 py-0.5 rounded text-[10px] font-semibold transition-opacity hover:opacity-75"
                     style={{ background: bg(0.08), color: tp }}>
                     <Briefcase size={9} style={{ color: tm }} />
@@ -764,7 +764,7 @@ function SidebarContent({ data, stats, countries, selectedCountry, countryDetail
                   </button>
                 ))}
                 {countryDetail.manually_marked && onUnmarkCountry && (
-                  <button onClick={() => onUnmarkCountry(selectedCountry!)}
+                  <button type="button" onClick={() => onUnmarkCountry(selectedCountry!)}
                     className="flex items-center gap-1 px-2 py-0.5 rounded text-[10px] font-semibold transition-opacity hover:opacity-75 bg-[rgba(239,68,68,0.1)] text-[#ef4444]">
                     <X size={9} />
                     {t('atlas.unmark')}
diff --git a/client/src/pages/CollectionsPage.tsx b/client/src/pages/CollectionsPage.tsx
index 89b3cc1b4..8efb2588d 100644
--- a/client/src/pages/CollectionsPage.tsx
+++ b/client/src/pages/CollectionsPage.tsx
@@ -294,7 +294,7 @@ function CollectionsPageDesktop(): React.ReactElement {
         {/* Mobile rail drawer */}
         {c.mobileRailOpen && (
           <>
-            <div className="col-drawer-backdrop" onClick={() => c.setMobileRailOpen(false)} />
+            <div role="presentation" className="col-drawer-backdrop" onClick={() => c.setMobileRailOpen(false)} />
             <div className="col-drawer">
               <div className="col-drawer-head">
                 <button type="button" onClick={() => c.setMobileRailOpen(false)} aria-label={t('common.close')}><X size={18} /></button>
diff --git a/client/src/pages/DashboardPage.test.tsx b/client/src/pages/DashboardPage.test.tsx
index cb838d62a..c81ba427f 100644
--- a/client/src/pages/DashboardPage.test.tsx
+++ b/client/src/pages/DashboardPage.test.tsx
@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { localIsoDate } from '../utils/localDate';
 import { render, screen, waitFor, within } from '../../tests/helpers/render';
 import userEvent from '@testing-library/user-event';
 import { http, HttpResponse } from 'msw';
@@ -535,9 +536,9 @@ describe('DashboardPage', () => {
 
   describe('FE-PAGE-DASH-023: SpotlightCard shows progress bar for ongoing trip', () => {
     it('renders progress bar and live badge when trip is currently ongoing', async () => {
-      const today = new Date().toISOString().split('T')[0];
-      const yesterday = new Date(Date.now() - 86400000).toISOString().split('T')[0];
-      const nextWeek = new Date(Date.now() + 7 * 86400000).toISOString().split('T')[0];
+      const today = localIsoDate();
+      const yesterday = localIsoDate(new Date(Date.now() - 86400000));
+      const nextWeek = localIsoDate(new Date(Date.now() + 7 * 86400000));
 
       const ongoingTrip = buildTrip({
         title: 'Current Voyage',
diff --git a/client/src/pages/DashboardPage.tsx b/client/src/pages/DashboardPage.tsx
index dad6a303c..812a49c35 100644
--- a/client/src/pages/DashboardPage.tsx
+++ b/client/src/pages/DashboardPage.tsx
@@ -52,7 +52,7 @@ function tripGradient(id: number): string { return GRADIENTS[id % GRADIENTS.leng
 function splitDate(dateStr: string | null | undefined, locale: string): { d: string; m: string; y: string } | null {
   if (!dateStr) return null
   const date = new Date(dateStr + 'T00:00:00Z')
-  if (isNaN(date.getTime())) return null // malformed date — render a dash, never crash
+  if (Number.isNaN(date.getTime())) return null // malformed date — render a dash, never crash
   const otherYear = date.getUTCFullYear() !== new Date().getUTCFullYear()
   return {
     d: date.toLocaleDateString(locale, { day: 'numeric', timeZone: 'UTC' }),
@@ -67,7 +67,7 @@ function splitDate(dateStr: string | null | undefined, locale: string): { d: str
 function fullDate(dateStr: string | null | undefined, locale: string): string | null {
   if (!dateStr) return null
   const date = new Date(dateStr + 'T00:00:00Z')
-  if (isNaN(date.getTime())) return null
+  if (Number.isNaN(date.getTime())) return null
   const opts: Intl.DateTimeFormatOptions = { day: 'numeric', month: 'short', timeZone: 'UTC' }
   if (date.getUTCFullYear() !== new Date().getUTCFullYear()) opts.year = 'numeric'
   return date.toLocaleDateString(locale, opts)
@@ -151,7 +151,7 @@ function DashboardPageDesktop(): React.ReactElement {
             {loadError && (
               <div className="dash-error" role="alert">
                 <span className="dash-error-txt">{t('dashboard.loadErrorBanner')}</span>
-                <button className="dash-error-retry" onClick={retryLoad}>
+                <button type="button" className="dash-error-retry" onClick={retryLoad}>
                   <RefreshCw size={15} />
                   {t('dashboard.retry')}
                 </button>
@@ -177,11 +177,11 @@ function DashboardPageDesktop(): React.ReactElement {
                 <h3 className="sec-title">{t('dashboard.title')}</h3>
                 <div className="sec-tools">
                   <div className="seg">
-                    <button className={tripFilter === 'planned' ? 'on' : ''} onClick={() => setTripFilter('planned')}>{t('dashboard.filter.planned')}</button>
-                    <button className={tripFilter === 'archive' ? 'on' : ''} onClick={() => setTripFilter('archive')}>{t('dashboard.archived')}</button>
-                    <button className={tripFilter === 'completed' ? 'on' : ''} onClick={() => setTripFilter('completed')}>{t('dashboard.mobile.completed')}</button>
+                    <button type="button" className={tripFilter === 'planned' ? 'on' : ''} onClick={() => setTripFilter('planned')}>{t('dashboard.filter.planned')}</button>
+                    <button type="button" className={tripFilter === 'archive' ? 'on' : ''} onClick={() => setTripFilter('archive')}>{t('dashboard.archived')}</button>
+                    <button type="button" className={tripFilter === 'completed' ? 'on' : ''} onClick={() => setTripFilter('completed')}>{t('dashboard.mobile.completed')}</button>
                   </div>
-                  <button
+                  <button type="button"
                     className="tool-action"
                     aria-label="Subscribe to all trips calendar"
                     title="Subscribe to all trips"
@@ -190,7 +190,7 @@ function DashboardPageDesktop(): React.ReactElement {
                   >
                     <CalendarPlus size={17} />
                   </button>
-                  <button className="tool-action" aria-label={t('dashboard.aria.toggleView')} onClick={toggleViewMode} style={{ width: 38, height: 38, borderRadius: 11 }}>
+                  <button type="button" className="tool-action" aria-label={t('dashboard.aria.toggleView')} onClick={toggleViewMode} style={{ width: 38, height: 38, borderRadius: 11 }}>
                     {viewMode === 'grid' ? <List size={17} /> : <LayoutGrid size={17} />}
                   </button>
                 </div>
@@ -228,7 +228,7 @@ function DashboardPageDesktop(): React.ReactElement {
                   />
                 ))}
                 {tripFilter === 'planned' && !isLoading && (
-                  <button className="add-trip-card" onClick={() => { setEditingTrip(null); setShowForm(true) }}>
+                  <button type="button" className="add-trip-card" onClick={() => { setEditingTrip(null); setShowForm(true) }}>
                     <div>
                       <div className="circ"><Plus size={20} /></div>
                       <div className="ttl">{t('dashboard.newTrip')}</div>
@@ -252,7 +252,7 @@ function DashboardPageDesktop(): React.ReactElement {
         </main>
       </div>
 
-      <button
+      <button type="button"
         className="fab-new-trip"
         onClick={() => { setEditingTrip(null); setShowForm(true) }}
         aria-label={t('dashboard.newTrip')}
@@ -393,7 +393,13 @@ function BoardingPassHero({ trip, bundle, locale, onOpen, onEdit, onCopy, onArch
   )
 
   return (
-    <section className="hero-trip" onClick={onOpen}>
+    <div
+      className="hero-trip"
+      onClick={onOpen}
+      role="button"
+      tabIndex={0}
+      onKeyDown={(e) => { if (e.target === e.currentTarget && (e.key === 'Enter' || e.key === ' ')) { e.preventDefault(); onOpen() } }}
+    >
       {trip.cover_image
         ? <img className="bg" src={trip.cover_image} alt={trip.title} />
         : <div className="bg" style={{ background: tripGradient(trip.id) }} />}
@@ -405,10 +411,10 @@ function BoardingPassHero({ trip, bundle, locale, onOpen, onEdit, onCopy, onArch
             {badge}
           </div>
           <div className="hero-tools">
-            <button className="hero-tool" aria-label={t('common.edit')} title={t('common.edit')} onClick={(e) => stop(e, onEdit)}><Edit2 size={17} strokeWidth={2.2} /></button>
-            <button className="hero-tool" aria-label={t('dashboard.aria.duplicate')} title={t('dashboard.aria.duplicate')} onClick={(e) => stop(e, onCopy)}><Copy size={17} strokeWidth={2.2} /></button>
-            <button className="hero-tool" aria-label={archiveLabel} title={archiveLabel} onClick={(e) => stop(e, onArchive)}>{trip.is_archived ? <ArchiveRestore size={17} strokeWidth={2.2} /> : <Archive size={17} strokeWidth={2.2} />}</button>
-            <button className="hero-tool" aria-label={t('common.delete')} title={t('common.delete')} onClick={(e) => stop(e, onDelete)}><Trash2 size={17} strokeWidth={2.2} /></button>
+            <button type="button" className="hero-tool" aria-label={t('common.edit')} title={t('common.edit')} onClick={(e) => stop(e, onEdit)}><Edit2 size={17} strokeWidth={2.2} /></button>
+            <button type="button" className="hero-tool" aria-label={t('dashboard.aria.duplicate')} title={t('dashboard.aria.duplicate')} onClick={(e) => stop(e, onCopy)}><Copy size={17} strokeWidth={2.2} /></button>
+            <button type="button" className="hero-tool" aria-label={archiveLabel} title={archiveLabel} onClick={(e) => stop(e, onArchive)}>{trip.is_archived ? <ArchiveRestore size={17} strokeWidth={2.2} /> : <Archive size={17} strokeWidth={2.2} />}</button>
+            <button type="button" className="hero-tool" aria-label={t('common.delete')} title={t('common.delete')} onClick={(e) => stop(e, onDelete)}><Trash2 size={17} strokeWidth={2.2} /></button>
           </div>
         </div>
 
@@ -424,12 +430,12 @@ function BoardingPassHero({ trip, bundle, locale, onOpen, onEdit, onCopy, onArch
               ))}
             </div>
           )}
-          <div className="hero-pass" onClick={(e) => { e.stopPropagation(); onOpen() }}>
+          <div className="hero-pass" role="presentation" onClick={(e) => { e.stopPropagation(); onOpen() }}>
             <div className="hero-pass-inner">{passCells}</div>
           </div>
         </div>
       </div>
-    </section>
+    </div>
   )
 }
 
@@ -552,17 +558,23 @@ function TripCard({ trip, locale, badges, onOpen, onEdit, onCopy, onArchive, onD
   const stop = (e: React.MouseEvent, fn: () => void) => { e.stopPropagation(); fn() }
 
   return (
-    <article className="trip-card" onClick={onOpen}>
+    <div
+      className="trip-card"
+      onClick={onOpen}
+      role="button"
+      tabIndex={0}
+      onKeyDown={(e) => { if (e.target === e.currentTarget && (e.key === 'Enter' || e.key === ' ')) { e.preventDefault(); onOpen() } }}
+    >
       <div className="trip-cover">
         {trip.cover_image
           ? <img src={trip.cover_image} alt={trip.title} />
           : <div style={{ width: '100%', height: '100%', background: tripGradient(trip.id) }} />}
         <div className={`trip-status ${statusClass}`}><span className="indicator" /> {statusLabel}</div>
         <div className="trip-actions">
-          <button className="trip-action-btn" aria-label={t('common.edit')} title={t('common.edit')} onClick={(e) => stop(e, onEdit)}><Edit2 size={17} strokeWidth={2.2} /></button>
-          <button className="trip-action-btn" aria-label={t('dashboard.aria.duplicate')} title={t('dashboard.aria.duplicate')} onClick={(e) => stop(e, onCopy)}><Copy size={17} strokeWidth={2.2} /></button>
-          <button className="trip-action-btn" aria-label={archiveLabel} title={archiveLabel} onClick={(e) => stop(e, onArchive)}>{trip.is_archived ? <ArchiveRestore size={17} strokeWidth={2.2} /> : <Archive size={17} strokeWidth={2.2} />}</button>
-          <button className="trip-action-btn" aria-label={t('common.delete')} title={t('common.delete')} onClick={(e) => stop(e, onDelete)}><Trash2 size={17} strokeWidth={2.2} /></button>
+          <button type="button" className="trip-action-btn" aria-label={t('common.edit')} title={t('common.edit')} onClick={(e) => stop(e, onEdit)}><Edit2 size={17} strokeWidth={2.2} /></button>
+          <button type="button" className="trip-action-btn" aria-label={t('dashboard.aria.duplicate')} title={t('dashboard.aria.duplicate')} onClick={(e) => stop(e, onCopy)}><Copy size={17} strokeWidth={2.2} /></button>
+          <button type="button" className="trip-action-btn" aria-label={archiveLabel} title={archiveLabel} onClick={(e) => stop(e, onArchive)}>{trip.is_archived ? <ArchiveRestore size={17} strokeWidth={2.2} /> : <Archive size={17} strokeWidth={2.2} />}</button>
+          <button type="button" className="trip-action-btn" aria-label={t('common.delete')} title={t('common.delete')} onClick={(e) => stop(e, onDelete)}><Trash2 size={17} strokeWidth={2.2} /></button>
         </div>
         <div className="trip-cover-content">
           <h3 className="trip-name">{trip.title}</h3>
@@ -585,7 +597,7 @@ function TripCard({ trip, locale, badges, onOpen, onEdit, onCopy, onArchive, onD
         </div>
         <TripCardBadges items={badges ?? []} />
       </div>
-    </article>
+    </div>
   )
 }
 
@@ -633,10 +645,10 @@ function CurrencyTool(): React.ReactElement {
     }).catch(() => { /* keep localStorage; retry on next load */ })
   }, [isLoaded, updateSetting])
 
-  const currencies = rates ? Object.keys(rates).sort() : CURRENCIES
+  const currencies = rates ? Object.keys(rates).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)) : CURRENCIES
   const ccyOptions = currencies.map(c => ({ value: c, label: c }))
   const rate = rates?.[to] ?? null
-  const converted = rate != null ? (parseFloat(amount.replace(',', '.')) || 0) * rate : null
+  const converted = rate != null ? (Number.parseFloat(amount.replace(',', '.')) || 0) * rate : null
 
   const swap = () => { setFrom(to); setTo(from) }
 
@@ -644,7 +656,7 @@ function CurrencyTool(): React.ReactElement {
     <div className="tool">
       <div className="tool-head">
         <div className="tool-title"><RefreshCw size={14} /> {t('dashboard.currency')}</div>
-        <button className="tool-action" aria-label={t('dashboard.aria.refreshRates')} onClick={fetchRate}><RefreshCw size={14} /></button>
+        <button type="button" className="tool-action" aria-label={t('dashboard.aria.refreshRates')} onClick={fetchRate}><RefreshCw size={14} /></button>
       </div>
       <div className="fx-input">
         <div className="fx-field">
@@ -652,7 +664,7 @@ function CurrencyTool(): React.ReactElement {
           <input className="amt mono" value={amount} onChange={e => setAmount(e.target.value)} inputMode="decimal" />
           <CustomSelect value={from} onChange={v => setFrom(String(v))} options={ccyOptions} searchable size="sm" style={{ marginTop: 6 }} />
         </div>
-        <button className="fx-swap" aria-label={t('dashboard.aria.swapCurrencies')} onClick={swap}><ArrowRightLeft size={14} /></button>
+        <button type="button" className="fx-swap" aria-label={t('dashboard.aria.swapCurrencies')} onClick={swap}><ArrowRightLeft size={14} /></button>
         <div className="fx-field">
           <div className="lbl">{t('dashboard.fx.to')}</div>
           <input className="amt mono" value={converted != null ? converted.toFixed(2) : '—'} readOnly />
@@ -739,7 +751,7 @@ function TimezoneTool({ locale }: { locale: string }): React.ReactElement {
     <div className="tool">
       <div className="tool-head">
         <div className="tool-title"><Clock size={14} /> {t('dashboard.timezone')}</div>
-        <button className="tool-action" aria-label={t('dashboard.aria.addTimezone')} onClick={() => setAdding(a => !a)}>
+        <button type="button" className="tool-action" aria-label={t('dashboard.aria.addTimezone')} onClick={() => setAdding(a => !a)}>
           {adding ? <X size={14} /> : <Plus size={14} />}
         </button>
       </div>
@@ -757,7 +769,7 @@ function TimezoneTool({ locale }: { locale: string }): React.ReactElement {
               <div className="tz-sub">{offsetLabel(tz)}</div>
             </div>
             <div className="tz-time mono">{timeIn(tz)}</div>
-            <button className="tz-del" aria-label={t('dashboard.aria.removeTimezone', { city: shortZone(tz) })} onClick={() => removeZone(tz)}><X size={13} /></button>
+            <button type="button" className="tz-del" aria-label={t('dashboard.aria.removeTimezone', { city: shortZone(tz) })} onClick={() => removeZone(tz)}><X size={13} /></button>
           </div>
         ))}
         {zones.length === 0 && (
@@ -793,7 +805,9 @@ function UpcomingTool({ items, locale, onOpen }: {
             const timeStr = parsed.time ? formatTime(parsed.time, locale, timeFormat) : null
             const typeClass = RES_TYPE_CLASS[r.type] || 'other'
             return (
-              <div className="upc-item" key={r.id} onClick={() => onOpen(r.trip_id)}>
+              <div className="upc-item" key={r.id} onClick={() => onOpen(r.trip_id)}
+                role="button" tabIndex={0}
+                onKeyDown={(e) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); onOpen(r.trip_id) } }}>
                 <div className="upc-date"><div className="d mono">{dateStr?.d ?? '–'}</div><div className="m">{dateStr?.m ?? ''}</div></div>
                 <div className="upc-info">
                   <div className="t">{r.title}</div>
diff --git a/client/src/pages/HelpPage.tsx b/client/src/pages/HelpPage.tsx
index 12018ebab..1e9d37fc5 100644
--- a/client/src/pages/HelpPage.tsx
+++ b/client/src/pages/HelpPage.tsx
@@ -72,7 +72,7 @@ export default function HelpPage() {
         {/* Content */}
         <main className="flex-1 min-w-0" ref={contentRef}>
           {/* Mobile nav toggle */}
-          <button
+          <button type="button"
             onClick={() => setNavOpen(true)}
             className="lg:hidden inline-flex items-center gap-2 mb-4 px-3 py-2 rounded-lg bg-surface-card border border-edge text-[13px] font-medium text-content"
           >
@@ -99,17 +99,18 @@ export default function HelpPage() {
 
       {/* Mobile sidebar drawer */}
       {navOpen && (
-        <div className="lg:hidden fixed inset-0 z-[120]" onClick={() => setNavOpen(false)}>
+        <div className="lg:hidden fixed inset-0 z-[120]" role="presentation" onClick={() => setNavOpen(false)}>
           <div className="absolute inset-0 bg-black/40" />
           <div
             className="absolute left-0 top-0 bottom-0 w-[280px] bg-surface-card p-5 overflow-y-auto shadow-xl"
+            role="presentation"
             onClick={(e) => e.stopPropagation()}
           >
             <div className="flex items-center justify-between mb-4">
               <span className="text-[14px] font-bold text-content flex items-center gap-2">
                 <BookOpen size={16} className="text-accent" /> {t('help.title')}
               </span>
-              <button onClick={() => setNavOpen(false)} className="text-content-faint">
+              <button type="button" onClick={() => setNavOpen(false)} className="text-content-faint">
                 <X size={18} />
               </button>
             </div>
diff --git a/client/src/pages/InAppNotificationsPage.tsx b/client/src/pages/InAppNotificationsPage.tsx
index ea66e3886..a34c3a706 100644
--- a/client/src/pages/InAppNotificationsPage.tsx
+++ b/client/src/pages/InAppNotificationsPage.tsx
@@ -44,7 +44,7 @@ function InAppNotificationsPageDesktop(): React.ReactElement {
             {/* Bulk actions */}
             <div className="flex items-center gap-2">
               {unreadCount > 0 && (
-                <button
+                <button type="button"
                   onClick={markAllRead}
                   className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm transition-colors text-content-secondary bg-surface-hover"
                   onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-tertiary)'}
@@ -55,7 +55,7 @@ function InAppNotificationsPageDesktop(): React.ReactElement {
                 </button>
               )}
               {notifications.length > 0 && (
-                <button
+                <button type="button"
                   onClick={deleteAll}
                   className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm transition-colors text-red-500 hover:bg-red-500/10"
                 >
@@ -68,13 +68,13 @@ function InAppNotificationsPageDesktop(): React.ReactElement {
 
           {/* Filter toggle */}
           <div className="flex gap-2 mb-4">
-            <button
+            <button type="button"
               onClick={() => setUnreadOnly(false)}
               className={`px-3 py-1.5 rounded-lg text-sm font-medium transition-colors ${!unreadOnly ? 'bg-content text-surface' : 'bg-surface-hover text-content-secondary'}`}
             >
               {t('notifications.all')}
             </button>
-            <button
+            <button type="button"
               onClick={() => setUnreadOnly(true)}
               className={`px-3 py-1.5 rounded-lg text-sm font-medium transition-colors ${unreadOnly ? 'bg-content text-surface' : 'bg-surface-hover text-content-secondary'}`}
             >
diff --git a/client/src/pages/JoinTripPage.tsx b/client/src/pages/JoinTripPage.tsx
index eeb2d50a6..ee06f4a25 100644
--- a/client/src/pages/JoinTripPage.tsx
+++ b/client/src/pages/JoinTripPage.tsx
@@ -34,7 +34,7 @@ export default function JoinTripPage() {
           <>
             <h1 style={{ fontSize: 18, fontWeight: 700, marginBottom: 8 }}>{t('trip.invite.invalidTitle')}</h1>
             <p className="text-content-secondary" style={{ fontSize: 14, marginBottom: 20 }}>{t('trip.invite.invalid')}</p>
-            <button
+            <button type="button"
               onClick={goToDashboard}
               className="bg-surface-hover text-content"
               style={{ border: 'none', borderRadius: 10, padding: '10px 18px', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}
@@ -49,14 +49,14 @@ export default function JoinTripPage() {
               {state === 'loading' ? t('common.loading') : t('trip.invite.joinPrompt', { title })}
             </p>
             <div style={{ display: 'flex', gap: 10, justifyContent: 'center' }}>
-              <button
+              <button type="button"
                 onClick={goToDashboard}
                 className="bg-surface-hover text-content"
                 style={{ border: 'none', borderRadius: 10, padding: '10px 18px', fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit' }}
               >
                 {t('common.cancel')}
               </button>
-              <button
+              <button type="button"
                 onClick={accept}
                 disabled={state !== 'ready'}
                 className="bg-accent text-accent-text"
diff --git a/client/src/pages/JourneyDetailPage.test.tsx b/client/src/pages/JourneyDetailPage.test.tsx
index 3c116a745..d51da214a 100644
--- a/client/src/pages/JourneyDetailPage.test.tsx
+++ b/client/src/pages/JourneyDetailPage.test.tsx
@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { localIsoDate } from '../utils/localDate';
 import { render, screen, waitFor, cleanup } from '../../tests/helpers/render';
 import userEvent from '@testing-library/user-event';
 import { http, HttpResponse } from 'msw';
@@ -840,7 +841,7 @@ describe('JourneyDetailPage', () => {
     });
   });
 
-  // ── Helper: open entry editor ────────────────────────��─────────────────
+  // ── Helper: open entry editor ───────────────────────────────────────────
   async function openEntryEditor(user: ReturnType<typeof userEvent.setup>) {
     // The + button is inside the view controls row, after the tab group
     // Structure: div.justify-between > [div(tabs), button(+)]
@@ -1317,7 +1318,7 @@ describe('JourneyDetailPage', () => {
         http.post('/api/journeys/1/entries', () => {
           return HttpResponse.json({
             id: 99, journey_id: 1, author_id: 1, type: 'entry',
-            entry_date: new Date().toISOString().split('T')[0],
+            entry_date: localIsoDate(),
             title: 'Test Entry', story: null, location_name: null,
             location_lat: null, location_lng: null, mood: null, weather: null,
             tags: [], pros_cons: null, visibility: 'private', sort_order: 0,
diff --git a/client/src/pages/JourneyDetailPage.tsx b/client/src/pages/JourneyDetailPage.tsx
index 2feea2258..14a0d1a0c 100644
--- a/client/src/pages/JourneyDetailPage.tsx
+++ b/client/src/pages/JourneyDetailPage.tsx
@@ -63,7 +63,7 @@ function JourneyDetailPageDesktop() {
 
   const timelineEntries = current.entries.filter(e => (!hideSkeletons || e.type !== 'skeleton'))
   const dayGroups = groupByDate(timelineEntries)
-  const sortedDates = [...dayGroups.keys()].sort()
+  const sortedDates = [...dayGroups.keys()].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
 
   const tripDateMin = current.trips.length
     ? current.trips.reduce((min: string, t: any) => t.start_date && (!min || t.start_date < min) ? t.start_date : min, '')
@@ -126,7 +126,7 @@ function JourneyDetailPageDesktop() {
           className="fixed left-0 right-0 z-30 flex items-start justify-between gap-2 px-4"
           style={{ top: 'calc(var(--nav-h, 56px) + 12px)' }}
         >
-          <button
+          <button type="button"
             onClick={() => navigate('/journey')}
             aria-label={t('journey.detail.backToJourney')}
             className={barButton}
@@ -136,7 +136,7 @@ function JourneyDetailPageDesktop() {
 
           <div className="flex-1 min-w-0 flex justify-center">
             <div className="flex bg-surface-elevated backdrop-blur-lg border border-edge rounded-lg overflow-hidden shadow-lg">
-              <button
+              <button type="button"
                 onClick={() => setView('timeline')}
                 className={`flex items-center gap-1.5 px-3 py-[7px] text-[12px] font-medium ${
                   view === 'timeline'
@@ -147,7 +147,7 @@ function JourneyDetailPageDesktop() {
                 <MapPin size={13} />
                 {t('journey.detail.journeyTab') || 'Journey'}
               </button>
-              <button
+              <button type="button"
                 onClick={() => setView('gallery')}
                 className={`flex items-center gap-1.5 px-3 py-[7px] text-[12px] font-medium ${
                   view === 'gallery'
@@ -162,7 +162,7 @@ function JourneyDetailPageDesktop() {
           </div>
 
           <div className="flex items-center gap-1.5">
-            <button
+            <button type="button"
               onClick={openStudio}
               onMouseEnter={prefetchStudio}
               aria-label={t('journey.studio.openAria')}
@@ -170,7 +170,7 @@ function JourneyDetailPageDesktop() {
             >
               <BookOpen size={16} />
             </button>
-            <button
+            <button type="button"
               onClick={toggleSkeletons}
               aria-label={skeletonLabel}
               className={`${barButton} ${hideSkeletons ? 'bg-surface-selected' : ''}`}
@@ -178,7 +178,7 @@ function JourneyDetailPageDesktop() {
               {hideSkeletons ? <EyeOff size={16} /> : <Eye size={16} />}
             </button>
             {canEditJourney && (
-              <button
+              <button type="button"
                 onClick={() => setShowSettings(true)}
                 aria-label={t('journey.settings.title')}
                 className={barButton}
@@ -230,7 +230,7 @@ function JourneyDetailPageDesktop() {
 
                 <div className="relative z-[3] flex items-center justify-between mb-5">
                   <div className="flex items-center gap-2">
-                    <button
+                    <button type="button"
                       onClick={() => navigate('/journey')}
                       aria-label={t('journey.detail.backToJourney')}
                       className="w-[34px] h-[34px] rounded-full bg-white/15 backdrop-blur flex items-center justify-center hover:bg-white/25"
@@ -252,7 +252,7 @@ function JourneyDetailPageDesktop() {
                     </div>
                   </div>
                   <div className="flex items-center gap-1.5">
-                    <button
+                    <button type="button"
                       onClick={openStudio}
                       onMouseEnter={prefetchStudio}
                       className="inline-flex h-[34px] items-center gap-1.5 px-3.5 rounded-full bg-white/15 backdrop-blur border border-white/15 text-[12px] font-semibold hover:bg-white/25"
@@ -261,7 +261,7 @@ function JourneyDetailPageDesktop() {
                       {t('journey.studio.open')}
                     </button>
                     <div className="relative group">
-                      <button
+                      <button type="button"
                         onClick={toggleSkeletons}
                         aria-label={skeletonLabel}
                         className={`w-[34px] h-[34px] rounded-full backdrop-blur flex items-center justify-center ${hideSkeletons ? 'bg-white/30' : 'bg-white/15 hover:bg-white/25'}`}
@@ -273,7 +273,7 @@ function JourneyDetailPageDesktop() {
                       </span>
                     </div>
                     {canEditJourney && (
-                      <button onClick={() => setShowSettings(true)} aria-label={t('journey.settings.title')} className="w-[34px] h-[34px] rounded-full bg-white/15 backdrop-blur flex items-center justify-center hover:bg-white/25"><MoreHorizontal size={14} /></button>
+                      <button type="button" onClick={() => setShowSettings(true)} aria-label={t('journey.settings.title')} className="w-[34px] h-[34px] rounded-full bg-white/15 backdrop-blur flex items-center justify-center hover:bg-white/25"><MoreHorizontal size={14} /></button>
                     )}
                   </div>
                 </div>
@@ -320,7 +320,7 @@ function JourneyDetailPageDesktop() {
                         { id: 'gallery' as const, icon: Grid, label: t('journey.share.gallery') },
                       ]
                   ).map(v => (
-                    <button
+                    <button type="button"
                       key={v.id}
                       onClick={() => setView(v.id)}
                       className="flex items-center gap-1.5 px-3.5 py-[6px] text-[12px] font-semibold rounded-full transition-colors"
@@ -334,7 +334,7 @@ function JourneyDetailPageDesktop() {
                   ))}
                 </div>
                 {canEditEntries && view === 'timeline' && (
-                  <button
+                  <button type="button"
                     onClick={() => {
                       setEditingEntry(createDraftJourneyEntry(current.id))
                     }}
@@ -346,7 +346,7 @@ function JourneyDetailPageDesktop() {
                   </button>
                 )}
                 {canEditEntries && view === 'gallery' && (
-                  <button
+                  <button type="button"
                     onClick={() => galleryUploadRef.current?.()}
                     className="inline-flex items-center gap-1.5 h-9 px-4 rounded-full text-[13px] font-semibold transition-transform hover:-translate-y-0.5"
                     style={{ background: 'var(--vg-ink)', color: 'var(--vg-bg)' }}
@@ -472,7 +472,7 @@ function JourneyDetailPageDesktop() {
                 <div className="sticky bottom-0 z-20 h-0 pointer-events-none">
                   <div className="absolute bottom-6 left-1/2 -translate-x-1/2 flex gap-1.5 pointer-events-auto">
                     {!feedEdge.atTop && (
-                      <button
+                      <button type="button"
                         onClick={() => scrollFeedTo('top')}
                         aria-label={t('journey.detail.jumpToTop')}
                         title={t('journey.detail.jumpToTop')}
@@ -483,7 +483,7 @@ function JourneyDetailPageDesktop() {
                       </button>
                     )}
                     {!feedEdge.atBottom && (
-                      <button
+                      <button type="button"
                         onClick={() => scrollFeedTo('bottom')}
                         aria-label={t('journey.detail.jumpToLast')}
                         title={t('journey.detail.jumpToLast')}
diff --git a/client/src/pages/JourneyPage.tsx b/client/src/pages/JourneyPage.tsx
index 2839ed81d..c2bd784aa 100644
--- a/client/src/pages/JourneyPage.tsx
+++ b/client/src/pages/JourneyPage.tsx
@@ -1,4 +1,5 @@
 import PageShell from '../components/Layout/PageShell'
+import { localIsoDate } from '../utils/localDate'
 import { useTranslation, TransHtml } from '../i18n'
 import {
   Plus, Search, Sparkles, Calendar, MapPin,
@@ -47,7 +48,7 @@ function JourneyPageDesktop() {
           {/* Header — mobile */}
           <div className="md:hidden px-5 pt-5 pb-4 flex flex-col gap-2">
             <div className="flex items-center gap-2">
-              <button
+              <button type="button"
                 onClick={() => {
                   if (searchOpen) {
                     setSearchOpen(false)
@@ -61,7 +62,7 @@ function JourneyPageDesktop() {
               >
                 {searchOpen ? <X size={15} /> : <Search size={15} />}
               </button>
-              <button
+              <button type="button"
                 onClick={() => openCreateModal()}
                 className="flex-1 flex items-center justify-center gap-2 py-2.5 rounded-xl bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 text-[14px] font-semibold active:scale-[0.98] transition-transform"
               >
@@ -101,13 +102,13 @@ function JourneyPageDesktop() {
                     </div>
                   </div>
                   <div className="flex items-center gap-2 flex-shrink-0">
-                    <button
+                    <button type="button"
                       onClick={() => setDismissedSuggestions(prev => new Set([...prev, activeSuggestion.id]))}
                       className="px-3 py-1.5 rounded-lg bg-white/10 border border-white/20 text-[12px] font-medium text-white hover:bg-white/20"
                     >
                       {t('journey.frontpage.dismiss')}
                     </button>
-                    <button
+                    <button type="button"
                       onClick={() => openCreateModal(activeSuggestion.id)}
                       className="px-3 py-1.5 rounded-lg !bg-white !text-zinc-900 text-[12px] font-medium hover:!bg-zinc-100"
                     >
@@ -121,9 +122,10 @@ function JourneyPageDesktop() {
             {/* Active Journey Hero */}
             {activeJourney && (
               <div className="mb-10">
-                <div
+                <button
+                  type="button"
                   onClick={() => navigate(`/journey/${activeJourney.id}`)}
-                  className="relative rounded-[28px] overflow-hidden cursor-pointer h-[250px] md:h-[280px] transition-transform duration-300 ease-[cubic-bezier(0.23,1,0.32,1)] hover:-translate-y-1 shadow-[0_2px_4px_rgba(0,0,0,0.06),0_20px_48px_-18px_rgba(0,0,0,0.32)]"
+                  className="block w-full text-left relative rounded-[28px] overflow-hidden cursor-pointer h-[250px] md:h-[280px] transition-transform duration-300 ease-[cubic-bezier(0.23,1,0.32,1)] hover:-translate-y-1 shadow-[0_2px_4px_rgba(0,0,0,0.06),0_20px_48px_-18px_rgba(0,0,0,0.32)]"
                   style={{
                     background: activeJourney.cover_image
                       ? `linear-gradient(120deg, rgba(0,0,0,0.55) 0%, rgba(0,0,0,0.15) 45%, rgba(0,0,0,0.05) 100%), url(/uploads/${activeJourney.cover_image}) center/cover`
@@ -187,7 +189,7 @@ function JourneyPageDesktop() {
                       </div>
                     </div>
                   </div>
-                </div>
+                </button>
               </div>
             )}
 
@@ -220,7 +222,7 @@ function JourneyPageDesktop() {
                 ))}
 
                 {/* Create card */}
-                <button
+                <button type="button"
                   onClick={() => openCreateModal()}
                   className="group min-h-[200px] rounded-[24px] flex flex-col items-center justify-center gap-3 transition-transform duration-200 ease-[cubic-bezier(0.23,1,0.32,1)] cursor-pointer hover:-translate-y-1"
                   style={{ border: '1.5px dashed var(--vg-line2)', background: 'var(--vg-surf2)' }}
@@ -271,9 +273,9 @@ function JourneyPageDesktop() {
               <div className="flex flex-col gap-2 max-h-[320px] overflow-y-auto">
                 {availableTrips.map(trip => {
                   const selected = selectedTripIds.has(trip.id)
-                  const status = trip.end_date && trip.end_date < new Date().toISOString().split('T')[0]
+                  const status = trip.end_date && trip.end_date < localIsoDate()
                     ? 'completed'
-                    : trip.start_date && trip.start_date <= new Date().toISOString().split('T')[0]
+                    : trip.start_date && trip.start_date <= localIsoDate()
                       ? 'active'
                       : 'upcoming'
                   const statusColors: Record<string, string> = {
@@ -282,16 +284,24 @@ function JourneyPageDesktop() {
                     upcoming: 'bg-amber-100 text-amber-800 dark:bg-amber-900/30 dark:text-amber-400',
                   }
 
+                  const toggleTrip = () => {
+                    setSelectedTripIds(prev => {
+                      const next = new Set(prev)
+                      if (next.has(trip.id)) next.delete(trip.id)
+                      else next.add(trip.id)
+                      return next
+                    })
+                  }
+
                   return (
                     <div
                       key={trip.id}
-                      onClick={() => {
-                        setSelectedTripIds(prev => {
-                          const next = new Set(prev)
-                          if (next.has(trip.id)) next.delete(trip.id)
-                          else next.add(trip.id)
-                          return next
-                        })
+                      role="checkbox"
+                      aria-checked={selected}
+                      tabIndex={0}
+                      onClick={toggleTrip}
+                      onKeyDown={e => {
+                        if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); toggleTrip() }
                       }}
                       className={`flex items-center gap-3 p-3 rounded-xl border cursor-pointer transition-[border-color,background-color] duration-150 ease-[cubic-bezier(0.23,1,0.32,1)] ${
                         selected
@@ -334,13 +344,13 @@ function JourneyPageDesktop() {
                 {selectedTripIds.size > 0 && <> · <strong className="text-zinc-900 dark:text-white">{totalPlaces}</strong> <span className="hidden md:inline">{t('journey.frontpage.placesImported')}</span><span className="md:hidden">{t('journey.frontpage.places')}</span></>}
               </div>
               <div className="flex items-center gap-2">
-                <button
+                <button type="button"
                   onClick={() => setShowCreate(false)}
                   className="px-3.5 py-2 rounded-lg border border-zinc-200 dark:border-zinc-600 text-[13px] font-medium text-zinc-700 dark:text-zinc-300 hover:bg-zinc-100 dark:hover:bg-zinc-700"
                 >
                   {t('common.cancel')}
                 </button>
-                <button
+                <button type="button"
                   onClick={handleCreate}
                   disabled={!newTitle.trim()}
                   className="px-3.5 py-2 rounded-lg bg-zinc-900 dark:bg-white text-white dark:text-zinc-900 text-[13px] font-medium hover:bg-zinc-800 dark:hover:bg-zinc-100 disabled:opacity-40 disabled:cursor-not-allowed"
@@ -365,9 +375,10 @@ function JourneyCard({ journey, onClick }: { journey: Journey & { entry_count?:
   const lifecycle = computeJourneyLifecycle(j.status, j.trip_date_min, j.trip_date_max)
 
   return (
-    <div
+    <button
+      type="button"
       onClick={onClick}
-      className="vg-card rounded-[24px] overflow-hidden cursor-pointer transition-[transform,box-shadow] duration-300 ease-[cubic-bezier(0.23,1,0.32,1)] hover:-translate-y-1 flex flex-col"
+      className="vg-card w-full text-left rounded-[24px] overflow-hidden cursor-pointer transition-[transform,box-shadow] duration-300 ease-[cubic-bezier(0.23,1,0.32,1)] hover:-translate-y-1 flex flex-col"
     >
       {/* Cover with title overlay */}
       <div className="relative h-[200px] overflow-hidden" style={{ background: pickGradient(j.id) }}>
@@ -414,6 +425,6 @@ function JourneyCard({ journey, onClick }: { journey: Journey & { entry_count?:
           ))}
         </div>
       </div>
-    </div>
+    </button>
   )
 }
diff --git a/client/src/pages/JourneyPage.wiring.test.tsx b/client/src/pages/JourneyPage.wiring.test.tsx
index 14aa14453..cb59435a7 100644
--- a/client/src/pages/JourneyPage.wiring.test.tsx
+++ b/client/src/pages/JourneyPage.wiring.test.tsx
@@ -1,5 +1,6 @@
 // FE-JRN-LISTWIRE-001 to FE-JRN-LISTWIRE-014
 import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { localIsoDate } from '../utils/localDate';
 import { render, screen, fireEvent } from '../../tests/helpers/render';
 import type { Journey } from '../store/journeyStore';
 import JourneyPage from './JourneyPage';
@@ -182,7 +183,7 @@ describe('JourneyPage wiring', () => {
   });
 
   it('FE-JRN-LISTWIRE-014: modal trips render their status and toggle their selection', () => {
-    const today = new Date().toISOString().split('T')[0];
+    const today = localIsoDate(); // local — the status chips classify against the wall clock
     const availableTrips = [
       { id: 1, title: 'Past trip', start_date: '2020-01-01', end_date: '2020-01-05', place_count: 3, cover_image: '/uploads/t.jpg' },
       { id: 2, title: 'Running trip', start_date: today, end_date: '2099-01-01', place_count: 1 },
diff --git a/client/src/pages/JourneyPublicPage.tsx b/client/src/pages/JourneyPublicPage.tsx
index e75a976ec..0f9a4aa2a 100644
--- a/client/src/pages/JourneyPublicPage.tsx
+++ b/client/src/pages/JourneyPublicPage.tsx
@@ -145,19 +145,19 @@ export default function JourneyPublicPage() {
     perms.share_timeline && { id: 'timeline' as const, icon: List, label: t('journey.share.timeline') },
     perms.share_gallery && { id: 'gallery' as const, icon: Grid, label: t('journey.share.gallery') },
     !desktopTwoColumn &&
-      !isMobile &&
-      perms.share_map && { id: 'map' as const, icon: MapPin, label: t('journey.share.map') },
+    !isMobile &&
+    perms.share_map && { id: 'map' as const, icon: MapPin, label: t('journey.share.map') },
   ].filter(Boolean) as { id: 'timeline' | 'gallery' | 'map'; icon: any; label: string }[];
 
   // The hook cannot build these: the thumbnail URL needs the share token, which is
   // the credential for the byte proxy.
   const photoLayer = token
     ? mapPhotos.map((p: { id: string; lat: number; lng: number; photoId: number }) => ({
-        id: p.id,
-        lat: p.lat,
-        lng: p.lng,
-        thumbUrl: photoUrl({ photo_id: p.photoId }, token, 'thumbnail'),
-      }))
+      id: p.id,
+      lat: p.lat,
+      lng: p.lng,
+      thumbUrl: photoUrl({ photo_id: p.photoId }, token, 'thumbnail'),
+    }))
     : [];
 
   // Shared timeline renderer used in both layout modes
@@ -219,7 +219,7 @@ export default function JourneyPublicPage() {
                   id: String(p.id),
                   src: photoUrl(p, token!, 'original'),
                   caption: p.caption,
-                  mediaType: (p as any).media_type,
+                  mediaType: p.media_type,
                 }));
 
                 const isActive = activeEntryId === String(entry.id);
@@ -241,11 +241,27 @@ export default function JourneyPublicPage() {
                   >
                     {/* Photo area */}
                     {photos.length === 1 && (
-                      <div
-                        className="relative cursor-pointer"
+                      <button
+                        type="button"
+                        className="relative block w-full cursor-pointer text-left"
                         onClick={() => setLightbox({ photos: lightboxPhotos, index: 0 })}
                       >
-                        <img src={photoUrl(photos[0], token!)} className="h-64 w-full object-cover" alt="" />
+                        <div className={`relative h-64 w-full ${photos[0].media_type === 'video' ? 'bg-black' : ''}`}>
+                          <img
+                            src={photoUrl(photos[0], token!, photos[0].media_type === 'video' ? 'thumbnail' : 'original')}
+                            className={`h-full w-full ${photos[0].media_type === 'video' ? 'object-contain' : 'object-cover'
+                              }`}
+                            alt=""
+                          />
+
+                          {photos[0].media_type === 'video' && (
+                            <div className="pointer-events-none absolute inset-0 flex items-center justify-center">
+                              <span className="flex h-12 w-12 items-center justify-center rounded-full bg-black/60 text-white backdrop-blur">
+                                <Play size={20} className="ml-0.5" fill="currentColor" />
+                              </span>
+                            </div>
+                          )}
+                        </div>
                         <div
                           className="pointer-events-none absolute inset-x-0 bottom-0"
                           style={{
@@ -269,54 +285,74 @@ export default function JourneyPublicPage() {
                             </h3>
                           </div>
                         )}
-                      </div>
+                      </button>
                     )}
-
                     {photos.length === 2 && (
                       <div className="grid grid-cols-2 gap-0.5 overflow-hidden">
                         {photos.slice(0, 2).map((p, i) => (
-                          <img
+                          <button
                             key={p.id}
-                            src={photoUrl(p, token!, 'thumbnail')}
-                            alt=""
-                            className="h-52 w-full cursor-pointer object-cover"
+                            type="button"
+                            className={`relative block h-52 w-full cursor-pointer overflow-hidden ${p.media_type === 'video' ? 'bg-black' : ''
+                              }`}
                             onClick={() => setLightbox({ photos: lightboxPhotos, index: i })}
-                          />
+                          >
+                            <img
+                              src={photoUrl(p, token!, 'thumbnail')}
+                              alt=""
+                              className={`h-full w-full ${p.media_type === 'video' ? 'object-contain' : 'object-cover'
+                                }`}
+                            />
+
+                            {p.media_type === 'video' && (
+                              <div className="pointer-events-none absolute inset-0 flex items-center justify-center">
+                                <span className="flex h-10 w-10 items-center justify-center rounded-full bg-black/60 text-white backdrop-blur">
+                                  <Play size={17} className="ml-0.5" fill="currentColor" />
+                                </span>
+                              </div>
+                            )}
+                          </button>
                         ))}
                       </div>
                     )}
 
                     {photos.length >= 3 && (
                       <div className="flex overflow-hidden" style={{ height: 280, gap: 2 }}>
-                        <div
+                        <button
+                          type="button"
                           className="min-w-0 flex-1 cursor-pointer"
                           onClick={() => setLightbox({ photos: lightboxPhotos, index: 0 })}
                         >
                           <img
                             src={photoUrl(photos[0], token!, 'thumbnail')}
                             alt=""
-                            className="h-full w-full object-cover"
+                            className={`h-full w-full ${photos[0].media_type === 'video' ? 'object-contain bg-black' : 'object-cover'
+                              }`}
                           />
-                        </div>
+                        </button>
                         <div className="flex min-w-0 flex-1 flex-col" style={{ gap: 2 }}>
-                          <div
+                          <button
+                            type="button"
                             className="min-h-0 flex-1 cursor-pointer"
                             onClick={() => setLightbox({ photos: lightboxPhotos, index: 1 })}
                           >
                             <img
                               src={photoUrl(photos[1], token!, 'thumbnail')}
                               alt=""
-                              className="h-full w-full object-cover"
+                              className={`h-full w-full ${photos[1].media_type === 'video' ? 'object-contain bg-black' : 'object-cover'
+                                }`}
                             />
-                          </div>
-                          <div
+                          </button>
+                          <button
+                            type="button"
                             className="relative min-h-0 flex-1 cursor-pointer"
                             onClick={() => setLightbox({ photos: lightboxPhotos, index: 2 })}
                           >
                             <img
                               src={photoUrl(photos[2], token!, 'thumbnail')}
                               alt=""
-                              className="h-full w-full object-cover"
+                              className={`h-full w-full ${photos[2].media_type === 'video' ? 'object-contain bg-black' : 'object-cover'
+                                }`}
                             />
                             {photos.length > 3 && (
                               <div className="absolute inset-0 flex items-center justify-center bg-black/40">
@@ -325,13 +361,28 @@ export default function JourneyPublicPage() {
                                 </span>
                               </div>
                             )}
-                          </div>
+                          </button>
                         </div>
                       </div>
-                    )}
+                    )
+                    }
 
                     {/* Content */}
-                    <div className="cursor-pointer px-5 pb-5 pt-4" onClick={() => setViewingEntry(entry)}>
+                    {/* Stays a div: the story renders user markdown, links included,
+                        and a link may not sit inside a <button>. */}
+                    <div
+                      role="button"
+                      tabIndex={0}
+                      className="cursor-pointer px-5 pb-5 pt-4"
+                      onClick={() => setViewingEntry(entry)}
+                      onKeyDown={(e) => {
+                        if (e.target !== e.currentTarget) return;
+                        if (e.key === 'Enter' || e.key === ' ') {
+                          e.preventDefault();
+                          setViewingEntry(entry);
+                        }
+                      }}
+                    >
                       {/* Title (only when no single photo — photo has it in overlay) */}
                       {photos.length !== 1 && entry.title && (
                         <h3 className="mb-2 text-[16px] font-semibold leading-snug tracking-tight text-zinc-900 dark:text-white">
@@ -448,26 +499,27 @@ export default function JourneyPublicPage() {
                 );
               })}
             </div>
-          </div>
+          </div >
         );
       })}
-    </div>
+    </div >
   );
 
   // Shared gallery renderer
   const renderGallery = () => (
     <div className="grid grid-cols-2 gap-1.5 sm:grid-cols-3 md:grid-cols-4">
       {allPhotos.map((photo, idx) => (
-        <div
+        <button
           key={photo.id}
-          className="relative aspect-square cursor-pointer overflow-hidden rounded-lg"
+          type="button"
+          className="relative block aspect-square w-full cursor-pointer overflow-hidden rounded-lg"
           onClick={() =>
             setLightbox({
               photos: allPhotos.map((p) => ({
                 id: String(p.id),
                 src: photoUrl(p, token!, 'original'),
                 caption: p.caption,
-                mediaType: (p as any).media_type,
+                mediaType: p.media_type,
               })),
               index: idx,
             })
@@ -475,18 +527,21 @@ export default function JourneyPublicPage() {
         >
           <img
             src={photoUrl(photo, token!, 'thumbnail')}
-            className="h-full w-full object-cover transition-transform hover:scale-105"
+            className={`h-full w-full transition-transform hover:scale-105 ${photo.media_type === 'video'
+              ? 'object-contain bg-black'
+              : 'object-cover'
+              }`}
             alt=""
             loading="lazy"
           />
-          {(photo as any).media_type === 'video' && (
+          {photo.media_type === 'video' && (
             <div className="pointer-events-none absolute inset-0 flex items-center justify-center">
               <span className="flex h-9 w-9 items-center justify-center rounded-full bg-black/55 text-white backdrop-blur">
                 <Play size={16} className="ml-0.5" fill="currentColor" />
               </span>
             </div>
           )}
-        </div>
+        </button>
       ))}
     </div>
   );
@@ -496,14 +551,13 @@ export default function JourneyPublicPage() {
     views.length > 1 && (
       <div className="mb-6 flex w-fit overflow-hidden rounded-lg border border-zinc-200 bg-white dark:border-zinc-700 dark:bg-zinc-800">
         {views.map((v) => (
-          <button
+          <button type="button"
             key={v.id}
             onClick={() => setView(v.id)}
-            className={`flex items-center gap-1.5 px-3 py-[7px] text-[12px] font-medium ${
-              view === v.id
-                ? 'bg-zinc-900 text-white dark:bg-white dark:text-zinc-900'
-                : 'text-zinc-500 hover:text-zinc-700 dark:hover:text-zinc-300'
-            }`}
+            className={`flex items-center gap-1.5 px-3 py-[7px] text-[12px] font-medium ${view === v.id
+              ? 'bg-zinc-900 text-white dark:bg-white dark:text-zinc-900'
+              : 'text-zinc-500 hover:text-zinc-700 dark:hover:text-zinc-300'
+              }`}
           >
             <v.icon size={13} />
             {v.label}
@@ -560,7 +614,7 @@ export default function JourneyPublicPage() {
 
         {/* Language picker */}
         <div style={{ position: 'absolute', top: 12, right: 12, zIndex: 10 }}>
-          <button
+          <button type="button"
             onClick={() => setShowLangPicker((v) => !v)}
             style={{
               padding: '5px 12px',
@@ -594,6 +648,7 @@ export default function JourneyPublicPage() {
             >
               {SUPPORTED_LANGUAGES.map((lang) => (
                 <button
+                  type="button"
                   key={lang.value}
                   onClick={() => {
                     useSettingsStore.setState((s) => ({ settings: { ...s.settings, language: lang.value } }));
@@ -802,14 +857,13 @@ export default function JourneyPublicPage() {
             >
               <div className="flex overflow-hidden rounded-lg border border-zinc-200 bg-white/90 shadow-lg backdrop-blur-lg dark:border-zinc-700 dark:bg-zinc-800/90">
                 {availableViews.map((v) => (
-                  <button
+                  <button type="button"
                     key={v.id}
                     onClick={() => setView(v.id)}
-                    className={`flex items-center gap-1.5 px-3 py-[7px] text-[12px] font-medium ${
-                      view === v.id
-                        ? 'bg-zinc-900 text-white dark:bg-white dark:text-zinc-900'
-                        : 'text-zinc-500 hover:text-zinc-700 dark:hover:text-zinc-300'
-                    }`}
+                    className={`flex items-center gap-1.5 px-3 py-[7px] text-[12px] font-medium ${view === v.id
+                      ? 'bg-zinc-900 text-white dark:bg-white dark:text-zinc-900'
+                      : 'text-zinc-500 hover:text-zinc-700 dark:hover:text-zinc-300'
+                      }`}
                   >
                     <v.icon size={13} />
                     {v.label}
@@ -886,17 +940,19 @@ export default function JourneyPublicPage() {
         <MobileEntryView
           entry={viewingEntry as any}
           readOnly
-          publicPhotoUrl={(photoId) => `/api/public/journey/${token}/photos/${photoId}/original`}
+          publicPhotoUrl={(photoId, size = 'original') =>
+            `/api/public/journey/${token}/photos/${photoId}/${size}`
+          }
           onClose={() => setViewingEntry(null)}
-          onEdit={() => {}}
-          onDelete={() => {}}
+          onEdit={() => { }}
+          onDelete={() => { }}
           onPhotoClick={(photos, idx) =>
             setLightbox({
               photos: photos.map((p) => ({
                 id: String(p.id),
                 src: photoUrl(p as any, token!, 'original'),
                 caption: (p as any).caption ?? null,
-                mediaType: (p as any).media_type,
+                mediaType: p.media_type,
               })),
               index: idx,
             })
diff --git a/client/src/pages/LoginPage.tsx b/client/src/pages/LoginPage.tsx
index 453f8f1b5..1ac70517d 100644
--- a/client/src/pages/LoginPage.tsx
+++ b/client/src/pages/LoginPage.tsx
@@ -223,7 +223,7 @@ export default function LoginPage(): React.ReactElement {
     <div style={{ minHeight: '100vh', display: 'flex', fontFamily: 'var(--font-system)', position: 'relative' }}>
       {/* Language dropdown */}
       <div style={{ position: 'absolute', top: 16, right: 16, zIndex: 10 }}>
-        <button
+        <button type="button"
           onClick={(e) => {
             e.stopPropagation();
             setLangDropdownOpen((o) => !o);
@@ -265,7 +265,12 @@ export default function LoginPage(): React.ReactElement {
           <div
             role="listbox"
             aria-label="Select language"
+            tabIndex={-1}
+            /* Both handlers do the one job: keep the event from reaching the
+               document listener that closes the dropdown. The options below are
+               real buttons and carry the keyboard interaction themselves. */
             onClick={(e) => e.stopPropagation()}
+            onKeyDown={(e) => e.stopPropagation()}
             style={{
               position: 'absolute',
               top: '100%',
@@ -281,7 +286,7 @@ export default function LoginPage(): React.ReactElement {
             }}
           >
             {SUPPORTED_LANGUAGES.map(({ value, label }) => (
-              <button
+              <button type="button"
                 key={value}
                 role="option"
                 aria-selected={value === language}
@@ -934,7 +939,13 @@ export default function LoginPage(): React.ReactElement {
                               onToggle={() => setRememberMe(!rememberMe)}
                               label={t('login.rememberMe')}
                             />
+                            {/* The visible caption repeats the switch's own aria-label and
+                                clicking it is a mouse shortcut for hitting the switch.
+                                Hidden from assistive tech so it does not read out as a
+                                second "Remember me" control: the switch above is the one
+                                that carries the name, the focus and the keyboard. */}
                             <span
+                              aria-hidden="true"
                               onClick={() => setRememberMe(!rememberMe)}
                               style={{
                                 cursor: 'pointer',
@@ -1049,7 +1060,7 @@ export default function LoginPage(): React.ReactElement {
                     }}
                   >
                     {mode === 'login' ? t('login.noAccount') + ' ' : t('login.hasAccount') + ' '}
-                    <button
+                    <button type="button"
                       onClick={() => {
                         setMode((m) => (m === 'login' ? 'register' : 'login'));
                         setError('');
@@ -1185,7 +1196,7 @@ export default function LoginPage(): React.ReactElement {
 
           {/* Demo login button */}
           {appConfig?.demo_mode && (
-            <button
+            <button type="button"
               onClick={handleDemoLogin}
               disabled={isLoading}
               style={{
diff --git a/client/src/pages/OAuthAuthorizePage.tsx b/client/src/pages/OAuthAuthorizePage.tsx
index 9f4e7a133..158bba85c 100644
--- a/client/src/pages/OAuthAuthorizePage.tsx
+++ b/client/src/pages/OAuthAuthorizePage.tsx
@@ -50,7 +50,7 @@ export default function OAuthAuthorizePage(): React.ReactElement {
                 {t('oauth.authorize.loginDescription', { client: validation?.client?.name || clientId })}
               </p>
             </div>
-            <button
+            <button type="button"
                 onClick={handleLoginRedirect}
                 className="w-full flex items-center justify-center gap-2 px-4 py-2.5 rounded-lg text-sm font-medium text-white"
                 style={{ background: 'var(--accent-primary, #4f46e5)' }}>
@@ -88,7 +88,7 @@ export default function OAuthAuthorizePage(): React.ReactElement {
               <p className="text-xs mb-3" style={{ color: 'var(--text-tertiary)' }}>
                 {t('oauth.authorize.trustNote')}
               </p>
-              <button
+              <button type="button"
                   onClick={() => submitConsent(true)}
                   disabled={submitting || (validation?.scopeSelectable === true && selectedScopes.length === 0)}
                   className="w-full px-4 py-2.5 rounded-lg text-sm font-medium text-white disabled:opacity-60 transition-opacity"
@@ -106,7 +106,7 @@ export default function OAuthAuthorizePage(): React.ReactElement {
                             )
                             : t('oauth.authorize.approveAccess')}
               </button>
-              <button
+              <button type="button"
                   onClick={() => submitConsent(false)}
                   disabled={submitting}
                   className="w-full px-4 py-2.5 rounded-lg text-sm font-medium border transition-colors hover:bg-slate-50 dark:hover:bg-slate-800 disabled:opacity-60"
diff --git a/client/src/pages/SharedTripPage.test.tsx b/client/src/pages/SharedTripPage.test.tsx
index 5fd60f6f7..7e710eaa6 100644
--- a/client/src/pages/SharedTripPage.test.tsx
+++ b/client/src/pages/SharedTripPage.test.tsx
@@ -506,7 +506,9 @@ describe('SharedTripPage', () => {
       // the day picker above the map was added (#1962): once as a chip, once on the card.
       await waitFor(() => expect(screen.getAllByText('Tag 1')).toHaveLength(2));
       const labels = screen.getAllByText('Tag 1');
-      expect(labels.filter((el) => el.closest('button'))).toHaveLength(1);
+      // One of each: the picker chip carries aria-pressed, the day card's header aria-expanded.
+      expect(labels.filter((el) => el.closest('[aria-pressed]'))).toHaveLength(1);
+      expect(labels.filter((el) => el.closest('[aria-expanded]'))).toHaveLength(1);
     });
   });
 
@@ -709,7 +711,9 @@ describe('SharedTripPage', () => {
       // Twice since the day picker landed (#1962): the chip above the map and the card.
       const dayLabels = screen.getAllByText('Day 1');
       expect(dayLabels).toHaveLength(2);
-      expect(dayLabels.filter((el) => el.closest('button'))).toHaveLength(1);
+      // One of each: the picker chip carries aria-pressed, the day card's header aria-expanded.
+      expect(dayLabels.filter((el) => el.closest('[aria-pressed]'))).toHaveLength(1);
+      expect(dayLabels.filter((el) => el.closest('[aria-expanded]'))).toHaveLength(1);
       expect(screen.getByText('Hotel Lutetia')).toBeInTheDocument();
       expect(screen.getByText('0 places')).toBeInTheDocument();
       // No date row for an undated day.
diff --git a/client/src/pages/SharedTripPage.tsx b/client/src/pages/SharedTripPage.tsx
index 6c8cbf235..19fbf87b3 100644
--- a/client/src/pages/SharedTripPage.tsx
+++ b/client/src/pages/SharedTripPage.tsx
@@ -327,7 +327,7 @@ export default function SharedTripPage() {
 
         {/* Language picker - top right */}
         <div style={{ position: 'absolute', top: 12, right: 12, zIndex: 10 }}>
-          <button
+          <button type="button"
             onClick={() => setShowLangPicker((v) => !v)}
             className="bg-[rgba(255,255,255,0.1)] text-[rgba(255,255,255,0.7)]"
             style={{
@@ -360,6 +360,7 @@ export default function SharedTripPage() {
             >
               {SUPPORTED_LANGUAGES.map((lang) => (
                 <button
+                  type="button"
                   key={lang.value}
                   onClick={() => {
                     // Set language locally without API call (shared page has no auth)
@@ -400,7 +401,7 @@ export default function SharedTripPage() {
             ...(permissions?.share_budget ? [{ id: 'budget', label: t('shared.tabBudget'), Icon: Wallet }] : []),
             ...(permissions?.share_collab ? [{ id: 'collab', label: t('shared.tabChat'), Icon: MessageCircle }] : []),
           ].map((tab) => (
-            <button
+            <button type="button"
               key={tab.id}
               onClick={() => setActiveTab(tab.id)}
               className={activeTab === tab.id ? 'bg-[#111827] text-white' : 'bg-surface-card text-[#6b7280]'}
@@ -540,14 +541,21 @@ export default function SharedTripPage() {
                     className="border border-edge-faint bg-surface-card"
                     style={{ borderRadius: 14, overflow: 'hidden' }}
                   >
-                    <div
+                    <button
+                      type="button"
                       onClick={() => setSelectedDay(selectedDay === day.id ? null : day.id)}
+                      aria-expanded={selectedDay === day.id}
                       style={{
                         padding: '12px 16px',
                         cursor: 'pointer',
                         display: 'flex',
                         alignItems: 'center',
                         gap: 10,
+                        width: '100%',
+                        background: 'none',
+                        border: 'none',
+                        textAlign: 'left',
+                        fontFamily: 'inherit',
                       }}
                     >
                       <div
@@ -632,7 +640,7 @@ export default function SharedTripPage() {
                       >
                         {dayPlaceCount} {t('shared.places')}
                       </span>
-                    </div>
+                    </button>
 
                     {selectedDay === day.id && merged.length > 0 && (
                       <div style={{ padding: '0 16px 12px', display: 'flex', flexDirection: 'column', gap: 6 }}>
@@ -796,6 +804,7 @@ export default function SharedTripPage() {
                                 {place.image_url ? (
                                   <img
                                     src={place.image_url}
+                                    alt=""
                                     style={{ width: 28, height: 28, borderRadius: '50%', objectFit: 'cover' }}
                                   />
                                 ) : (
@@ -1022,7 +1031,7 @@ export default function SharedTripPage() {
               return g;
             }, {});
             const sumIn = (items: any[]) =>
-              items.reduce((s: number, i: any) => s + convert(parseFloat(i.total_price) || 0, curOf(i)), 0);
+              items.reduce((s: number, i: any) => s + convert(Number.parseFloat(i.total_price) || 0, curOf(i)), 0);
             const total = sumIn(budget || []);
             return (
               <div style={{ display: 'flex', flexDirection: 'column', gap: 12 }}>
@@ -1099,7 +1108,7 @@ export default function SharedTripPage() {
                           style={{ fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 600 }}
                         >
                           {item.total_price
-                            ? `${convert(parseFloat(item.total_price) || 0, curOf(item)).toLocaleString(locale, { minimumFractionDigits: 2 })} ${base}`
+                            ? `${convert(Number.parseFloat(item.total_price) || 0, curOf(item)).toLocaleString(locale, { minimumFractionDigits: 2 })} ${base}`
                             : '—'}
                         </span>
                       </div>
@@ -1183,6 +1192,7 @@ export default function SharedTripPage() {
                         {msg.avatar ? (
                           <img
                             src={avatarSrc(msg.avatar)!}
+                            alt=""
                             style={{ width: '100%', height: '100%', objectFit: 'cover' }}
                           />
                         ) : (
diff --git a/client/src/pages/TripPlannerPage.tsx b/client/src/pages/TripPlannerPage.tsx
index e0859d5ed..6f7c99375 100644
--- a/client/src/pages/TripPlannerPage.tsx
+++ b/client/src/pages/TripPlannerPage.tsx
@@ -130,7 +130,7 @@ function ListsContainer({ tripId, packingItems, todoItems }: { tripId: number; p
               const active = subTab === tab.id
               const Icon = tab.icon
               return (
-                <button key={tab.id} onClick={() => setSubTabPersist(tab.id)}
+                <button type="button" key={tab.id} onClick={() => setSubTabPersist(tab.id)}
                   className={active ? 'bg-surface-card text-content' : 'bg-transparent text-content-muted'}
                   style={{
                     appearance: 'none', border: 'none', cursor: 'pointer', fontFamily: 'inherit',
@@ -162,7 +162,7 @@ function ListsContainer({ tripId, packingItems, todoItems }: { tripId: number; p
             return (
               <div style={{ display: 'flex', gap: 6, flexShrink: 0, marginLeft: 'auto', flexWrap: 'wrap' }}>
                 {packingAbgehakt > 0 && (
-                  <button onClick={() => setClearCheckedSignal(s => s + 1)}
+                  <button type="button" onClick={() => setClearCheckedSignal(s => s + 1)}
                     className={`hidden sm:inline-flex items-center gap-1.5 px-[14px] py-[9px] hover:opacity-[0.88] bg-[rgba(239,68,68,0.14)] text-[#ef4444]`}
                     style={sharedBtnStyle}
                   >
@@ -177,7 +177,7 @@ function ListsContainer({ tripId, packingItems, todoItems }: { tripId: number; p
                   style={sharedBtnStyle}
                 />
                 {isAdmin && packingItems.length > 0 && (
-                  <button onClick={() => setSaveTemplateSignal(s => s + 1)}
+                  <button type="button" onClick={() => setSaveTemplateSignal(s => s + 1)}
                     className={`${sharedBtnClass} bg-accent text-accent-text`}
                     style={sharedBtnStyle}
                   >
@@ -185,7 +185,7 @@ function ListsContainer({ tripId, packingItems, todoItems }: { tripId: number; p
                     <span className="hidden sm:inline">{t('packing.saveAsTemplate')}</span>
                   </button>
                 )}
-                <button onClick={() => setImportPackingSignal(s => s + 1)}
+                <button type="button" onClick={() => setImportPackingSignal(s => s + 1)}
                   className={`${sharedBtnClass} bg-accent text-accent-text`}
                   style={sharedBtnStyle}
                 >
@@ -196,7 +196,7 @@ function ListsContainer({ tripId, packingItems, todoItems }: { tripId: number; p
             )
           })()}
           {subTab === 'todo' && (
-            <button onClick={() => setAddTodoSignal(s => s + 1)}
+            <button type="button" onClick={() => setAddTodoSignal(s => s + 1)}
               className="hover:opacity-[0.88] bg-accent text-accent-text"
               style={{
                 appearance: 'none', border: 'none', cursor: 'pointer', fontFamily: 'inherit',
@@ -366,6 +366,10 @@ function TripPlannerPageDesktop(): React.ReactElement | null {
               route={route}
               routeVias={routeVias}
               showTransitRoutes={routeShown}
+              // The route toggle belongs to one day, so the map needs that day to
+              // know which automated transports may ride it (#2019).
+              days={days}
+              selectedDayId={selectedDayId}
               routeSegments={routeSegments}
               selectedPlaceId={selectedPlaceId}
               onMarkerClick={handleMarkerClick}
@@ -420,7 +424,7 @@ function TripPlannerPageDesktop(): React.ReactElement | null {
             )}
 
             <div className="hidden md:block" style={{ position: 'absolute', left: 10, top: 10, bottom: 10, zIndex: 20 }}>
-              <button onClick={() => setLeftCollapsed(c => !c)}
+              <button type="button" onClick={() => setLeftCollapsed(c => !c)}
                 style={{
                   position: leftCollapsed ? 'fixed' : 'absolute', top: leftCollapsed ? 'calc(var(--nav-h) + 44px + 14px)' : 14, left: leftCollapsed ? 10 : undefined, right: leftCollapsed ? undefined : -28, zIndex: -1,
                   width: 36, height: 36, borderRadius: leftCollapsed ? 10 : '0 10px 10px 0',
@@ -498,6 +502,7 @@ function TripPlannerPageDesktop(): React.ReactElement | null {
                 />
                 {!leftCollapsed && (
                   <div
+                    role="presentation"
                     onMouseDown={startResizeLeft}
                     style={{ position: 'absolute', right: 0, top: 0, bottom: 0, width: 4, cursor: 'col-resize', background: 'transparent' }}
                     onMouseEnter={e => e.currentTarget.style.background = 'rgba(0,0,0,0.08)'}
@@ -508,7 +513,7 @@ function TripPlannerPageDesktop(): React.ReactElement | null {
             </div>
 
             <div className="hidden md:block" style={{ position: 'absolute', right: 10, top: 10, bottom: 10, zIndex: 20 }}>
-              <button onClick={() => setRightCollapsed(c => !c)}
+              <button type="button" onClick={() => setRightCollapsed(c => !c)}
                 style={{
                   position: rightCollapsed ? 'fixed' : 'absolute', top: rightCollapsed ? 'calc(var(--nav-h) + 44px + 14px)' : 14, right: rightCollapsed ? 10 : undefined, left: rightCollapsed ? undefined : -28, zIndex: -1,
                   width: 36, height: 36, borderRadius: rightCollapsed ? 10 : '10px 0 0 10px',
@@ -535,6 +540,7 @@ function TripPlannerPageDesktop(): React.ReactElement | null {
               }}>
                 {!rightCollapsed && (
                   <div
+                    role="presentation"
                     onMouseDown={startResizeRight}
                     style={{ position: 'absolute', left: 0, top: 0, bottom: 0, width: 4, cursor: 'col-resize', background: 'transparent' }}
                     onMouseEnter={e => e.currentTarget.style.background = 'rgba(0,0,0,0.08)'}
@@ -567,12 +573,12 @@ function TripPlannerPageDesktop(): React.ReactElement | null {
             {/* Mobile sidebar buttons — portal to body to escape Leaflet touch handling */}
             {activeTab === 'plan' && !mobileSidebarOpen && !showPlaceForm && !showMembersModal && !showReservationModal && createPortal(
               <div className="flex md:hidden" style={{ position: 'fixed', top: 'calc(var(--nav-h) + 44px + 12px)', left: 12, right: 12, justifyContent: 'space-between', zIndex: 100, pointerEvents: 'none' }}>
-                <button onClick={() => setMobileSidebarOpen('left')}
+                <button type="button" onClick={() => setMobileSidebarOpen('left')}
                   className="bg-surface-card text-content border border-edge"
                   style={{ pointerEvents: 'auto', backdropFilter: 'blur(12px)', borderRadius: 24, padding: '11px 24px', fontSize: 'calc(15px * var(--fs-scale-subtitle, 1))', fontWeight: 600, cursor: 'pointer', boxShadow: '0 2px 12px rgba(0,0,0,0.15)', minHeight: 44, fontFamily: 'inherit', touchAction: 'manipulation' }}>
                   {t('trip.mobilePlan')}
                 </button>
-                <button onClick={() => setMobileSidebarOpen('right')}
+                <button type="button" onClick={() => setMobileSidebarOpen('right')}
                   className="bg-surface-card text-content border border-edge"
                   style={{ pointerEvents: 'auto', backdropFilter: 'blur(12px)', borderRadius: 24, padding: '11px 24px', fontSize: 'calc(15px * var(--fs-scale-subtitle, 1))', fontWeight: 600, cursor: 'pointer', boxShadow: '0 2px 12px rgba(0,0,0,0.15)', minHeight: 44, fontFamily: 'inherit', touchAction: 'manipulation' }}>
                   {t('trip.mobilePlaces')}
@@ -649,8 +655,8 @@ function TripPlannerPageDesktop(): React.ReactElement | null {
             )}
 
             {selectedPlace && isMobile && createPortal(
-              <div className="bg-[rgba(0,0,0,0.3)]" style={{ position: 'fixed', inset: 0, zIndex: 9999, display: 'flex', alignItems: 'flex-end', justifyContent: 'center', paddingBottom: 'var(--bottom-nav-h)' }} onClick={() => setSelectedPlaceId(null)}>
-                <div style={{ width: '100%', maxHeight: '85vh' }} onClick={e => e.stopPropagation()}>
+              <div className="bg-[rgba(0,0,0,0.3)]" style={{ position: 'fixed', inset: 0, zIndex: 9999, display: 'flex', alignItems: 'flex-end', justifyContent: 'center', paddingBottom: 'var(--bottom-nav-h)' }} role="presentation" onClick={() => setSelectedPlaceId(null)}>
+                <div style={{ width: '100%', maxHeight: '85vh' }} role="presentation" onClick={e => e.stopPropagation()}>
                   <PlaceInspector
                     onEditTransport={openLinkedTransport}
                     onEditReservation={openLinkedReservation}
@@ -694,11 +700,11 @@ function TripPlannerPageDesktop(): React.ReactElement | null {
             )}
 
             {mobileSidebarOpen && createPortal(
-              <div className="bg-[rgba(0,0,0,0.3)]" style={{ position: 'fixed', inset: 0, zIndex: 9999 }} onClick={() => setMobileSidebarOpen(null)}>
-                <div className="bg-surface-card" style={{ position: 'absolute', top: 'var(--nav-h)', left: 0, right: 0, bottom: 0, display: 'flex', flexDirection: 'column', overflow: 'hidden' }} onClick={e => e.stopPropagation()}>
+              <div className="bg-[rgba(0,0,0,0.3)]" style={{ position: 'fixed', inset: 0, zIndex: 9999 }} role="presentation" onClick={() => setMobileSidebarOpen(null)}>
+                <div className="bg-surface-card" style={{ position: 'absolute', top: 'var(--nav-h)', left: 0, right: 0, bottom: 0, display: 'flex', flexDirection: 'column', overflow: 'hidden' }} role="presentation" onClick={e => e.stopPropagation()}>
                   <div className="border-b border-edge-secondary" style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '14px 16px' }}>
                     <span className="text-content" style={{ fontWeight: 600, fontSize: 'calc(14px * var(--fs-scale-body, 1))' }}>{mobileSidebarOpen === 'left' ? t('trip.mobilePlan') : t('trip.mobilePlaces')}</span>
-                    <button onClick={() => setMobileSidebarOpen(null)} className="bg-surface-tertiary text-content" style={{ border: 'none', borderRadius: '50%', width: 28, height: 28, cursor: 'pointer', display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
+                    <button type="button" onClick={() => setMobileSidebarOpen(null)} className="bg-surface-tertiary text-content" style={{ border: 'none', borderRadius: '50%', width: 28, height: 28, cursor: 'pointer', display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
                       <X size={14} />
                     </button>
                   </div>
diff --git a/client/src/pages/TripPlannerPage.wiring.test.tsx b/client/src/pages/TripPlannerPage.wiring.test.tsx
index f4a51c4b3..4ab76513e 100644
--- a/client/src/pages/TripPlannerPage.wiring.test.tsx
+++ b/client/src/pages/TripPlannerPage.wiring.test.tsx
@@ -351,13 +351,17 @@ describe('TripPlannerPage — shell', () => {
 })
 
 describe('TripPlannerPage — plan tab', () => {
-  it('FE-PAGE-TPW-008: the map receives the filtered markers, the tile url and the panel widths', () => {
+  it('FE-PAGE-TPW-008: the map receives the filtered markers, the tile url, the panel widths and the selected day', () => {
     renderPage()
 
     expect(props('map').places).toEqual([place])
     expect(props('map').tileUrl).toBe('https://tiles/{z}/{x}/{y}.png')
     expect(props('map').leftWidth).toBe(320)
     expect(props('map').center).toBeUndefined()
+    // Without the day the route toggle belongs to, the map draws every automated
+    // transport in the trip as soon as any day's route is on (#2019).
+    expect(props('map').days).toEqual([day])
+    expect(props('map').selectedDayId).toBe(7)
   })
 
   it('FE-PAGE-TPW-009: collapsed panels report a zero width to the map', () => {
diff --git a/client/src/pages/VacayPage.tsx b/client/src/pages/VacayPage.tsx
index 420d266ed..56e4728c1 100644
--- a/client/src/pages/VacayPage.tsx
+++ b/client/src/pages/VacayPage.tsx
@@ -48,26 +48,27 @@ function VacayPageDesktop(): React.ReactElement {
         </div>
         <div className="flex items-center justify-between mb-3">
           <div className="flex items-center gap-0.5">
-            <button onClick={handleAddPrevYear} className="w-7 h-7 rounded-lg flex items-center justify-center transition-colors" style={{ color: 'var(--vg-ink3)' }} title={t('vacay.addPrevYear')}>
+            <button type="button" onClick={handleAddPrevYear} className="w-7 h-7 rounded-lg flex items-center justify-center transition-colors" style={{ color: 'var(--vg-ink3)' }} title={t('vacay.addPrevYear')}>
               <Plus size={14} />
             </button>
-            <button onClick={() => { const idx = years.indexOf(selectedYear); if (idx > 0) setSelectedYear(years[idx - 1]) }} disabled={years.indexOf(selectedYear) <= 0} className="w-7 h-7 rounded-lg flex items-center justify-center disabled:opacity-20 transition-colors" style={{ color: 'var(--vg-ink3)' }}>
+            <button type="button" onClick={() => { const idx = years.indexOf(selectedYear); if (idx > 0) setSelectedYear(years[idx - 1]) }} disabled={years.indexOf(selectedYear) <= 0} className="w-7 h-7 rounded-lg flex items-center justify-center disabled:opacity-20 transition-colors" style={{ color: 'var(--vg-ink3)' }}>
               <ChevronLeft size={16} />
             </button>
           </div>
           <span className="tabular-nums" style={{ fontSize: 22, fontWeight: 700, color: 'var(--vg-ink)' }}>{selectedYear}</span>
           <div className="flex items-center gap-0.5">
-            <button onClick={() => { const idx = years.indexOf(selectedYear); if (idx < years.length - 1) setSelectedYear(years[idx + 1]) }} disabled={years.indexOf(selectedYear) >= years.length - 1} className="w-7 h-7 rounded-lg flex items-center justify-center disabled:opacity-20 transition-colors" style={{ color: 'var(--vg-ink3)' }}>
+            <button type="button" onClick={() => { const idx = years.indexOf(selectedYear); if (idx < years.length - 1) setSelectedYear(years[idx + 1]) }} disabled={years.indexOf(selectedYear) >= years.length - 1} className="w-7 h-7 rounded-lg flex items-center justify-center disabled:opacity-20 transition-colors" style={{ color: 'var(--vg-ink3)' }}>
               <ChevronRight size={16} />
             </button>
-            <button onClick={handleAddNextYear} className="w-7 h-7 rounded-lg flex items-center justify-center transition-colors" style={{ color: 'var(--vg-ink3)' }} title={t('vacay.addYear')}>
+            <button type="button" onClick={handleAddNextYear} className="w-7 h-7 rounded-lg flex items-center justify-center transition-colors" style={{ color: 'var(--vg-ink3)' }} title={t('vacay.addYear')}>
               <Plus size={14} />
             </button>
           </div>
         </div>
         <div className="grid grid-cols-4 gap-1.5">
           {years.map(y => (
-            <div key={y} onClick={() => setSelectedYear(y)}
+            <div key={y} role="button" tabIndex={0} onClick={() => setSelectedYear(y)}
+              onKeyDown={e => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); setSelectedYear(y) } }}
               className="group relative rounded-[9px] text-center cursor-pointer transition-[background-color,color] duration-150 ease-[cubic-bezier(0.23,1,0.32,1)]"
               style={{
                 padding: '7px 0',
@@ -78,10 +79,11 @@ function VacayPageDesktop(): React.ReactElement {
               }}>
               {y}
               {years.length > 1 && (
-                <span onClick={e => { e.stopPropagation(); setDeleteYear(y); setShowMobileSidebar(false) }}
+                <button type="button" aria-label={t('vacay.removeYear')}
+                  onClick={e => { e.stopPropagation(); setDeleteYear(y); setShowMobileSidebar(false) }}
                   className="absolute -top-1 -right-1 w-3.5 h-3.5 rounded-full bg-red-500 text-white text-[7px] flex items-center justify-center opacity-0 group-hover:opacity-100 transition-opacity cursor-pointer">
                   <Minus size={7} />
-                </span>
+                </button>
               )}
             </div>
           ))}
@@ -129,13 +131,13 @@ function VacayPageDesktop(): React.ReactElement {
               <h1 className="text-lg font-bold text-content">{t('admin.addons.catalog.vacay.name')}</h1>
             </div>
             <div className="flex items-center gap-2">
-              <button
+              <button type="button"
                 onClick={() => setShowMobileSidebar(true)}
                 className="lg:hidden flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm transition-colors bg-surface-secondary text-content-muted"
               >
                 <SlidersHorizontal size={14} />
               </button>
-              <button
+              <button type="button"
                 onClick={() => setShowSettings(true)}
                 className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm transition-colors bg-surface-secondary text-content-muted"
               >
@@ -149,7 +151,7 @@ function VacayPageDesktop(): React.ReactElement {
             {/* Desktop Sidebar */}
             <div className="hidden lg:flex w-[300px] shrink-0 flex-col gap-[12px] sticky top-[84px]">
               {sidebarContent}
-              <button
+              <button type="button"
                 onClick={() => setShowSettings(true)}
                 className="vg-card flex items-center justify-center gap-2.5 rounded-[18px] transition-transform hover:-translate-y-px"
                 style={{ padding: '13px 16px', fontSize: 14, fontWeight: 600, color: 'var(--vg-ink)', cursor: 'pointer' }}
@@ -168,7 +170,7 @@ function VacayPageDesktop(): React.ReactElement {
       {/* Mobile Sidebar Drawer */}
       {showMobileSidebar && createPortal(
         <div className="fixed inset-0 lg:hidden" style={{ zIndex: 99980 }}>
-          <div className="absolute inset-0 bg-[rgba(0,0,0,0.4)]" onClick={() => setShowMobileSidebar(false)} />
+          <div className="absolute inset-0 bg-[rgba(0,0,0,0.4)]" role="presentation" onClick={() => setShowMobileSidebar(false)} />
           <div className="absolute left-0 top-0 bottom-0 w-[280px] overflow-y-auto p-3 flex flex-col gap-3 bg-surface"
             style={{ boxShadow: '4px 0 24px rgba(0,0,0,0.15)', animation: 'slideInLeft 0.2s ease-out' }}>
             {sidebarContent}
@@ -197,10 +199,10 @@ function VacayPageDesktop(): React.ReactElement {
             </div>
           </div>
           <div className="flex gap-3 justify-end">
-            <button onClick={() => setDeleteYear(null)} className="px-4 py-2 text-sm rounded-lg transition-colors border text-content-muted border-edge">
+            <button type="button" onClick={() => setDeleteYear(null)} className="px-4 py-2 text-sm rounded-lg transition-colors border text-content-muted border-edge">
               {t('common.cancel')}
             </button>
-            <button onClick={async () => { await removeYear(deleteYear); setDeleteYear(null) }} className="px-4 py-2 text-sm bg-red-500 hover:bg-red-600 text-white rounded-lg transition-colors">
+            <button type="button" onClick={async () => { await removeYear(deleteYear); setDeleteYear(null) }} className="px-4 py-2 text-sm bg-red-500 hover:bg-red-600 text-white rounded-lg transition-colors">
               {t('vacay.remove')}
             </button>
           </div>
@@ -232,11 +234,11 @@ function VacayPageDesktop(): React.ReactElement {
                 <InfoItem icon={Unlink} text={t('vacay.fuseInfo5')} />
               </div>
               <div className="px-6 pb-6 flex gap-3">
-                <button onClick={() => declineInvite(inv.plan_id)}
+                <button type="button" onClick={() => declineInvite(inv.plan_id)}
                   className="flex-1 px-4 py-2.5 text-sm font-medium rounded-xl transition-colors border text-content-muted border-edge">
                   {t('vacay.decline')}
                 </button>
-                <button onClick={() => acceptInvite(inv.plan_id)}
+                <button type="button" onClick={() => acceptInvite(inv.plan_id)}
                   className="flex-1 px-4 py-2.5 text-sm font-medium rounded-xl transition-colors bg-content text-surface-card">
                   {t('vacay.acceptFusion')}
                 </button>
diff --git a/client/src/pages/admin/AdminNotificationsPanel.tsx b/client/src/pages/admin/AdminNotificationsPanel.tsx
index d9173075f..a62072acd 100644
--- a/client/src/pages/admin/AdminNotificationsPanel.tsx
+++ b/client/src/pages/admin/AdminNotificationsPanel.tsx
@@ -93,7 +93,7 @@ export default function AdminNotificationsPanel({ t, toast }: { t: (k: string) =
                   const isOn = matrix.preferences[eventType]?.[ch] ?? true
                   return (
                     <div key={ch} style={{ display: 'flex', justifyContent: 'center' }}>
-                      <button
+                      <button type="button"
                         onClick={() => toggle(eventType, ch)}
                         className={`relative inline-flex h-5 w-9 items-center rounded-full transition-colors flex-shrink-0 ${isOn ? 'bg-content' : 'bg-edge'}`}
                       >
diff --git a/client/src/pages/admin/AdminNotificationsTab.tsx b/client/src/pages/admin/AdminNotificationsTab.tsx
index 370cf6cfd..1e33620e8 100644
--- a/client/src/pages/admin/AdminNotificationsTab.tsx
+++ b/client/src/pages/admin/AdminNotificationsTab.tsx
@@ -69,7 +69,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             <h2 className="font-semibold text-slate-900">{t('admin.notifications.emailPanel.title')}</h2>
             <p className="text-xs text-slate-400 mt-1">{t('admin.smtp.hint')}</p>
           </div>
-          <button
+          <button type="button"
             onClick={() => setChannels(!emailActive, webhookActive, ntfyActive)}
             className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors flex-shrink-0 ${emailActive ? 'bg-content' : 'bg-edge'}`}
           >
@@ -101,7 +101,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
               <span className="text-xs font-medium text-slate-500">Skip TLS certificate check</span>
               <p className="text-[10px] text-slate-400 mt-0.5">Enable for self-signed certificates on local mail servers</p>
             </div>
-            <button onClick={() => {
+            <button type="button" onClick={() => {
               const newVal = smtpValues.smtp_skip_tls_verify === 'true' ? 'false' : 'true'
               setSmtpValues(prev => ({ ...prev, smtp_skip_tls_verify: newVal }))
             }}
@@ -112,11 +112,11 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
           </div>
         </div>
         <div className="px-6 pb-4 flex items-center gap-2 border-t border-slate-100 pt-4">
-          <button onClick={saveNotifications}
+          <button type="button" onClick={saveNotifications}
             className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm font-medium hover:bg-slate-800 transition-colors">
             <Save className="w-4 h-4" />{t('common.save')}
           </button>
-          <button
+          <button type="button"
             onClick={async () => {
               const smtpKeys = ['smtp_host', 'smtp_port', 'smtp_user', 'smtp_pass', 'smtp_from', 'smtp_skip_tls_verify']
               const payload: Record<string, string> = {}
@@ -144,7 +144,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             <h2 className="font-semibold text-slate-900">{t('admin.notifications.webhookPanel.title')}</h2>
             <p className="text-xs text-slate-400 mt-1">{t('admin.webhook.hint')}</p>
           </div>
-          <button
+          <button type="button"
             onClick={() => setChannels(emailActive, !webhookActive, ntfyActive)}
             className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors flex-shrink-0 ${webhookActive ? 'bg-content' : 'bg-edge'}`}
           >
@@ -161,7 +161,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             <h2 className="font-semibold text-slate-900">{t('admin.notifications.ntfy')}</h2>
             <p className="text-xs text-slate-400 mt-1">{t('admin.ntfy.hint') || 'Allow users to configure their own ntfy topics for push notifications.'}</p>
           </div>
-          <button
+          <button type="button"
             onClick={() => setChannels(emailActive, webhookActive, !ntfyActive)}
             className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors flex-shrink-0 ${ntfyActive ? 'bg-content' : 'bg-edge'}`}
           >
@@ -193,7 +193,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             <h2 className="font-semibold text-slate-900">{t('admin.notifications.tripReminders.title')}</h2>
             <p className="text-xs text-slate-400 mt-1">{t('admin.notifications.tripReminders.hint')}</p>
           </div>
-          <button
+          <button type="button"
             onClick={async () => {
               const next = !tripRemindersActive
               setSmtpValues(prev => ({ ...prev, notify_trip_reminder: next ? 'true' : 'false' }))
@@ -240,7 +240,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
           )}
         </div>
         <div className="px-6 pb-4 flex items-center gap-2 border-t border-slate-100 pt-4">
-          <button
+          <button type="button"
             onClick={async () => {
               try {
                 await authApi.updateAppSettings({ admin_webhook_url: smtpValues.admin_webhook_url || '' })
@@ -250,7 +250,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm font-medium hover:bg-slate-800 transition-colors">
             <Save className="w-4 h-4" />{t('common.save')}
           </button>
-          <button
+          <button type="button"
             onClick={async () => {
               // A masked value means the URL only lives on the server — send no url and let
               // the server test the stored one instead of pre-saving the mask.
@@ -312,7 +312,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
                     className="flex-1 px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
                   />
                   {smtpValues.admin_ntfy_token === '••••••••' && (
-                    <button
+                    <button type="button"
                       onClick={async () => {
                         try {
                           await authApi.updateAppSettings({ admin_ntfy_token: '' })
@@ -331,7 +331,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
           )}
         </div>
         <div className="px-6 pb-4 flex items-center gap-2 border-t border-slate-100 pt-4">
-          <button
+          <button type="button"
             onClick={async () => {
               try {
                 await authApi.updateAppSettings({
@@ -347,7 +347,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm font-medium hover:bg-slate-800 transition-colors">
             <Save className="w-4 h-4" />{t('common.save')}
           </button>
-          <button
+          <button type="button"
             onClick={async () => {
               const topic = smtpValues.admin_ntfy_topic?.trim()
               if (!topic) return
diff --git a/client/src/pages/admin/AdminSettingsTab.tsx b/client/src/pages/admin/AdminSettingsTab.tsx
index b329881f9..fa164d6f3 100644
--- a/client/src/pages/admin/AdminSettingsTab.tsx
+++ b/client/src/pages/admin/AdminSettingsTab.tsx
@@ -54,7 +54,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
               <p className="text-sm font-medium text-slate-700">{t('admin.passwordLogin')}</p>
               <p className="text-xs text-slate-400 mt-0.5">{t('admin.passwordLoginHint')}</p>
             </div>
-            <button
+            <button type="button"
               disabled={envOverrideOidcOnly || (!passwordLogin && !oidcLogin)}
               onClick={() => handleToggleAuthSetting('password_login', !passwordLogin, setPasswordLogin)}
               title={!passwordLogin && !oidcLogin ? t('admin.lockoutWarning') : undefined}
@@ -72,7 +72,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
               <p className="text-sm font-medium text-slate-700">{t('admin.passwordRegistration')}</p>
               <p className="text-xs text-slate-400 mt-0.5">{t('admin.passwordRegistrationHint')}</p>
             </div>
-            <button
+            <button type="button"
               disabled={envOverrideOidcOnly}
               onClick={() => handleToggleAuthSetting('password_registration', !passwordRegistration, setPasswordRegistration)}
               className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors disabled:opacity-50 ${passwordRegistration ? 'bg-content' : 'bg-edge'}`}
@@ -90,7 +90,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
                 <p className="text-sm font-medium text-slate-700">{t('admin.oidcLogin')}</p>
                 <p className="text-xs text-slate-400 mt-0.5">{t('admin.oidcLoginHint')}</p>
               </div>
-              <button
+              <button type="button"
                 disabled={!passwordLogin && oidcLogin}
                 onClick={() => handleToggleAuthSetting('oidc_login', !oidcLogin, setOidcLogin)}
                 title={!passwordLogin && oidcLogin ? t('admin.lockoutWarning') : undefined}
@@ -110,7 +110,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
                 <p className="text-sm font-medium text-slate-700">{t('admin.oidcRegistration')}</p>
                 <p className="text-xs text-slate-400 mt-0.5">{t('admin.oidcRegistrationHint')}</p>
               </div>
-              <button
+              <button type="button"
                 onClick={() => handleToggleAuthSetting('oidc_registration', !oidcRegistration, setOidcRegistration)}
                 className={`relative inline-flex h-6 w-11 flex-shrink-0 items-center rounded-full transition-colors ${oidcRegistration ? 'bg-content' : 'bg-edge'}`}
               >
@@ -237,7 +237,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
             className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
           />
           <p className="text-xs text-slate-400 mt-2">{t('admin.fileTypesFormat')}</p>
-          <button
+          <button type="button"
             onClick={async () => {
               setSavingFileTypes(true)
               try {
@@ -293,7 +293,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
                   {showKeys.maps ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
                 </button>
               </div>
-              <button
+              <button type="button"
                 onClick={() => handleValidateKey('maps')}
                 disabled={!mapsKey || validating.maps}
                 className="px-3 py-2 text-sm border border-slate-300 rounded-lg hover:bg-slate-50 disabled:opacity-40 disabled:cursor-not-allowed flex items-center gap-1.5"
@@ -451,7 +451,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
             </div>
           </div>
 
-          <button
+          <button type="button"
             onClick={handleSaveApiKeys}
             disabled={savingKeys}
             className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
@@ -496,8 +496,9 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
             <p className="text-xs text-slate-400 mt-1">{t('admin.oidcIssuerHint')}</p>
           </div>
           <div>
-            <label className="block text-sm font-medium text-slate-700 mb-1.5">Discovery URL <span className="text-slate-400 font-normal">(optional)</span></label>
+            <label htmlFor="oidc-discovery-url" className="block text-sm font-medium text-slate-700 mb-1.5">Discovery URL <span className="text-slate-400 font-normal">(optional)</span></label>
             <input
+              id="oidc-discovery-url"
               type="url"
               value={oidcConfig.discovery_url}
               onChange={e => setOidcConfig(c => ({ ...c, discovery_url: e.target.value }))}
@@ -507,8 +508,9 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
             <p className="text-xs text-slate-400 mt-1">Override the auto-constructed discovery URL. Required for providers like Authentik where the endpoint is not at <code className="bg-slate-100 px-1 rounded">{'<issuer>/.well-known/openid-configuration'}</code>.</p>
           </div>
           <div>
-            <label className="block text-sm font-medium text-slate-700 mb-1.5">Client ID</label>
+            <label htmlFor="oidc-client-id" className="block text-sm font-medium text-slate-700 mb-1.5">Client ID</label>
             <input
+              id="oidc-client-id"
               type="text"
               value={oidcConfig.client_id}
               onChange={e => setOidcConfig(c => ({ ...c, client_id: e.target.value }))}
@@ -516,8 +518,9 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
             />
           </div>
           <div>
-            <label className="block text-sm font-medium text-slate-700 mb-1.5">Client Secret</label>
+            <label htmlFor="oidc-client-secret" className="block text-sm font-medium text-slate-700 mb-1.5">Client Secret</label>
             <input
+              id="oidc-client-secret"
               type="password"
               value={oidcConfig.client_secret}
               onChange={e => setOidcConfig(c => ({ ...c, client_secret: e.target.value }))}
@@ -525,7 +528,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
               className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
             />
           </div>
-          <button
+          <button type="button"
             onClick={async () => {
               setSavingOidc(true)
               try {
@@ -565,7 +568,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
               <p className="text-sm font-medium text-slate-700">Rotate JWT Secret</p>
               <p className="text-xs text-slate-400 mt-0.5">Generate a new JWT signing secret. All active sessions will be invalidated immediately.</p>
             </div>
-            <button
+            <button type="button"
               onClick={() => setShowRotateJwtModal(true)}
               className="flex items-center gap-2 px-4 py-2 bg-red-600 hover:bg-red-700 text-white rounded-lg text-sm font-medium transition-colors"
             >
diff --git a/client/src/pages/admin/AdminUpdateBanner.tsx b/client/src/pages/admin/AdminUpdateBanner.tsx
index 3ff022a1b..79c042d2c 100644
--- a/client/src/pages/admin/AdminUpdateBanner.tsx
+++ b/client/src/pages/admin/AdminUpdateBanner.tsx
@@ -37,7 +37,7 @@ export default function AdminUpdateBanner({ updateInfo, t, onHowTo }: AdminUpdat
             {t('admin.update.button')}
           </a>
         )}
-        <button
+        <button type="button"
           onClick={onHowTo}
           className="flex items-center gap-1.5 px-4 py-2 rounded-lg text-sm font-semibold transition-colors bg-slate-900 dark:bg-white text-white dark:text-slate-900 hover:bg-slate-700 dark:hover:bg-gray-200"
         >
diff --git a/client/src/pages/admin/AdminUserModals.tsx b/client/src/pages/admin/AdminUserModals.tsx
index d74b4bea1..706d6dd65 100644
--- a/client/src/pages/admin/AdminUserModals.tsx
+++ b/client/src/pages/admin/AdminUserModals.tsx
@@ -58,13 +58,13 @@ export default function AdminUserModals({ admin, t }: AdminUserModalsProps): Rea
         size="sm"
         footer={
           <div className="flex justify-end gap-3">
-            <button
+            <button type="button"
               onClick={() => setShowCreateUser(false)}
               className="rounded-lg border border-slate-200 px-4 py-2 text-sm text-slate-600 hover:bg-slate-50"
             >
               {t('common.cancel')}
             </button>
-            <button
+            <button type="button"
               onClick={handleCreateUser}
               className="rounded-lg bg-slate-900 px-4 py-2 text-sm text-white hover:bg-slate-700"
             >
@@ -137,13 +137,13 @@ export default function AdminUserModals({ admin, t }: AdminUserModalsProps): Rea
         size="sm"
         footer={
           <div className="flex justify-end gap-3">
-            <button
+            <button type="button"
               onClick={() => setEditingUser(null)}
               className="rounded-lg border border-slate-200 px-4 py-2 text-sm text-slate-600 hover:bg-slate-50"
             >
               {t('common.cancel')}
             </button>
-            <button
+            <button type="button"
               onClick={handleSaveUser}
               className="rounded-lg bg-slate-900 px-4 py-2 text-sm text-white hover:bg-slate-700"
             >
@@ -244,9 +244,11 @@ export default function AdminUserModals({ admin, t }: AdminUserModalsProps): Rea
             justifyContent: 'center',
             padding: 16,
           }}
+          role="presentation"
           onClick={() => setShowUpdateModal(false)}
         >
           <div
+            role="presentation"
             onClick={(e) => e.stopPropagation()}
             style={{ width: '100%', maxWidth: 440, borderRadius: 16, overflow: 'hidden' }}
             className="border border-gray-200 bg-white dark:border-gray-700 dark:bg-gray-800"
@@ -392,7 +394,7 @@ docker run -d --name trek \\
             </div>
 
             <div style={{ padding: '0 24px 20px', display: 'flex', justifyContent: 'flex-end' }}>
-              <button
+              <button type="button"
                 onClick={() => setShowUpdateModal(false)}
                 className="bg-slate-900 text-white hover:bg-slate-700 dark:bg-white dark:text-slate-900 dark:hover:bg-gray-200"
                 style={{
@@ -420,14 +422,14 @@ docker run -d --name trek \\
         size="sm"
         footer={
           <div className="flex justify-end gap-3">
-            <button
+            <button type="button"
               onClick={() => setShowRotateJwtModal(false)}
               disabled={rotatingJwt}
               className="rounded-lg border border-slate-200 px-4 py-2 text-sm text-slate-600 hover:bg-slate-50 disabled:opacity-50"
             >
               {t('common.cancel')}
             </button>
-            <button
+            <button type="button"
               onClick={async () => {
                 setRotatingJwt(true);
                 try {
diff --git a/client/src/pages/admin/AdminUsersTab.tsx b/client/src/pages/admin/AdminUsersTab.tsx
index 1a81105a5..4e87419ae 100644
--- a/client/src/pages/admin/AdminUsersTab.tsx
+++ b/client/src/pages/admin/AdminUsersTab.tsx
@@ -32,7 +32,7 @@ export default function AdminUsersTab({ admin, t, locale }: AdminUsersTabProps):
             <h2 className="font-semibold text-slate-900">{t('admin.tabs.users')}</h2>
             <p className="text-xs text-slate-400 mt-1">{users.length} {t('admin.stats.users')}</p>
           </div>
-          <button
+          <button type="button"
             onClick={() => setShowCreateUser(true)}
             className="flex items-center gap-1.5 px-3 py-1.5 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700 transition-colors"
           >
@@ -100,14 +100,14 @@ export default function AdminUsersTab({ admin, t, locale }: AdminUsersTabProps):
                     </td>
                     <td className="px-5 py-3">
                       <div className="flex items-center gap-2 justify-end">
-                        <button
+                        <button type="button"
                           onClick={() => handleEditUser(u)}
                           className="p-1.5 text-slate-400 hover:text-slate-900 hover:bg-slate-100 rounded-lg transition-colors"
                           title={t('admin.editUser')}
                         >
                           <Edit2 className="w-4 h-4" />
                         </button>
-                        <button
+                        <button type="button"
                           onClick={() => handleDeleteUser(u)}
                           disabled={u.id === currentUser?.id}
                           className="p-1.5 text-slate-400 hover:text-red-600 hover:bg-red-50 rounded-lg transition-colors disabled:opacity-30 disabled:cursor-not-allowed"
@@ -132,7 +132,7 @@ export default function AdminUsersTab({ admin, t, locale }: AdminUsersTabProps):
             <h2 className="font-semibold text-slate-900">{t('admin.invite.title')}</h2>
             <p className="text-xs text-slate-400 mt-1">{t('admin.invite.subtitle')}</p>
           </div>
-          <button
+          <button type="button"
             onClick={() => setShowCreateInvite(true)}
             className="flex items-center gap-1.5 px-3 py-1.5 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700 transition-colors"
           >
@@ -169,12 +169,12 @@ export default function AdminUsersTab({ admin, t, locale }: AdminUsersTabProps):
                     </div>
                   </div>
                   {isActive && (
-                    <button onClick={() => copyInviteLink(inv.token)} title={t('admin.invite.copyLink')}
+                    <button type="button" onClick={() => copyInviteLink(inv.token)} title={t('admin.invite.copyLink')}
                       className="p-1.5 rounded-lg hover:bg-slate-100 text-slate-400 hover:text-slate-700 transition-colors">
                       <Copy className="w-3.5 h-3.5" />
                     </button>
                   )}
-                  <button onClick={() => handleDeleteInvite(inv.id)} title={t('common.delete')}
+                  <button type="button" onClick={() => handleDeleteInvite(inv.id)} title={t('common.delete')}
                     className="p-1.5 rounded-lg hover:bg-red-50 text-slate-400 hover:text-red-500 transition-colors">
                     <Trash2 className="w-3.5 h-3.5" />
                   </button>
@@ -239,8 +239,8 @@ export default function AdminUsersTab({ admin, t, locale }: AdminUsersTabProps):
             </div>
           )}
           <div className="flex justify-end gap-2 pt-2 border-t border-slate-100">
-            <button onClick={() => setShowCreateInvite(false)} className="px-4 py-2 text-sm text-slate-500 hover:text-slate-700">{t('common.cancel')}</button>
-            <button onClick={handleCreateInvite} className="px-4 py-2 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700">{t('admin.invite.createAndCopy')}</button>
+            <button type="button" onClick={() => setShowCreateInvite(false)} className="px-4 py-2 text-sm text-slate-500 hover:text-slate-700">{t('common.cancel')}</button>
+            <button type="button" onClick={handleCreateInvite} className="px-4 py-2 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700">{t('admin.invite.createAndCopy')}</button>
           </div>
         </div>
       </Modal>
diff --git a/client/src/pages/atlas/AtlasCountrySearch.tsx b/client/src/pages/atlas/AtlasCountrySearch.tsx
index 800a50bf4..4c7bd0855 100644
--- a/client/src/pages/atlas/AtlasCountrySearch.tsx
+++ b/client/src/pages/atlas/AtlasCountrySearch.tsx
@@ -113,7 +113,7 @@ export default function AtlasCountrySearch({
             }}
           />
           {search.trim() && (
-            <button
+            <button type="button"
               onClick={() => {
                 setSearch('')
                 setResults([])
@@ -142,7 +142,7 @@ export default function AtlasCountrySearch({
             }}
           >
             {results.map((r) => (
-              <button
+              <button type="button"
                 key={r.code}
                 onClick={() => onSelect(r.code)}
                 style={{
@@ -187,7 +187,7 @@ export default function AtlasCountrySearch({
               </div>
             )}
             {placeResults.map((p) => (
-              <button
+              <button type="button"
                 key={`${p.lat},${p.lng},${p.name}`}
                 onClick={() => onSelectPlace(p)}
                 style={{
diff --git a/client/src/pages/atlas/atlasModel.ts b/client/src/pages/atlas/atlasModel.ts
index a806b29c6..632d21888 100644
--- a/client/src/pages/atlas/atlasModel.ts
+++ b/client/src/pages/atlas/atlasModel.ts
@@ -116,7 +116,9 @@ export function normalizeRegionName(name: string): string {
   return name
     .normalize('NFD').replace(/[̀-ͯ]/g, '') // strip combining diacritics
     .replace(/[‐-―]/g, '-') // fold hyphen/dash variants to "-"
-    .replace(/\s*-\s*/g, '-') // collapse spaced dashes ("A – B" vs "A-B")
+    // Collapse spaced dashes ("A – B" vs "A-B"). split/trim, not /\s*-\s*/g:
+    // that pattern backtracks over every space in a dash-less name (quadratic).
+    .split('-').map(part => part.trim()).join('-')
     .toLowerCase()
     .trim()
 }
@@ -180,7 +182,7 @@ export const COUNTRY_COLORS = ['#6366f1', '#ec4899', '#14b8a6', '#f97316', '#8b5
 // every other country's color each time one more was marked or added.
 export function countryColor(a3: string): string {
   let hash = 0
-  for (let i = 0; i < a3.length; i++) hash = (hash * 31 + a3.charCodeAt(i)) >>> 0
+  for (let i = 0; i < a3.length; i++) hash = (hash * 31 + a3.codePointAt(i)) >>> 0
   return COUNTRY_COLORS[hash % COUNTRY_COLORS.length]
 }
 
@@ -214,7 +216,7 @@ export function regionCacheEvictions(order: string[], keep: Set<string>, max: nu
 // Convert country code to flag emoji
 export function countryCodeToFlag(code: string): string {
   if (!code || code.length !== 2) return ''
-  return String.fromCodePoint(...[...code.toUpperCase()].map(c => 0x1F1E6 + c.charCodeAt(0) - 65))
+  return String.fromCodePoint(...[...code.toUpperCase()].map(c => 0x1F1E6 + c.codePointAt(0) - 65))
 }
 
 // ISO-3166-1 alpha-2 → alpha-3 mapping. Two sources feed this table:
diff --git a/client/src/pages/atlas/useAtlas.ts b/client/src/pages/atlas/useAtlas.ts
index d67ac283b..937b2f1e8 100644
--- a/client/src/pages/atlas/useAtlas.ts
+++ b/client/src/pages/atlas/useAtlas.ts
@@ -14,9 +14,9 @@ const PLANNED_KEY = 'trek_atlas_show_planned'
 
 function hexToRgba(hex: string, alpha: number): string {
   const clean = hex.replace('#', '')
-  const r = parseInt(clean.substring(0, 2), 16)
-  const g = parseInt(clean.substring(2, 4), 16)
-  const b = parseInt(clean.substring(4, 6), 16)
+  const r = Number.parseInt(clean.substring(0, 2), 16)
+  const g = Number.parseInt(clean.substring(2, 4), 16)
+  const b = Number.parseInt(clean.substring(4, 6), 16)
   return `rgba(${r},${g},${b},${alpha})`
 }
 
@@ -649,7 +649,7 @@ export function useAtlas() {
     // layer meant a continent's worth of admin-1 polygons stayed in the DOM, and every
     // newly loaded country tore the whole thing down and built it again (#1950).
     const bounds = viewportBounds()
-    const inViewCodes = Object.keys(regionGeoCache.current).filter(code => countryInView(code, bounds)).sort()
+    const inViewCodes = Object.keys(regionGeoCache.current).filter(code => countryInView(code, bounds)).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
     const sig = inViewCodes.join('|')
     if (!force && sig === renderedRegionSigRef.current) return
 
@@ -988,8 +988,8 @@ export function useAtlas() {
   const handleAddBucketItem = async (): Promise<void> => {
     if (!bucketForm.name.trim()) return
     const hasCoords = !!(bucketForm.lat && bucketForm.lng)
-    const lat = hasCoords ? parseFloat(bucketForm.lat) : null
-    const lng = hasCoords ? parseFloat(bucketForm.lng) : null
+    const lat = hasCoords ? Number.parseFloat(bucketForm.lat) : null
+    const lng = hasCoords ? Number.parseFloat(bucketForm.lng) : null
     const targetDate = bucketForm.target_date || (bucketPoiMonth > 0 && bucketPoiYear > 0 ? `${bucketPoiYear}-${String(bucketPoiMonth).padStart(2, '0')}` : null)
     // #1898: this form never sends a country code, so the entry it would create
     // is identified by name, date and coordinates alone. Keep the form filled so
diff --git a/client/src/pages/dashboard/dashboardModel.test.ts b/client/src/pages/dashboard/dashboardModel.test.ts
index c3c18f937..c18bb5da2 100644
--- a/client/src/pages/dashboard/dashboardModel.test.ts
+++ b/client/src/pages/dashboard/dashboardModel.test.ts
@@ -1,97 +1,51 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import { daysUntil, getTripStatus, sortTrips, MS_PER_DAY, type DashboardTrip } from './dashboardModel';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+import { daysUntil, getTripStatus, sortTrips, localIsoToday } from './dashboardModel'
 
-// FE-HOOK-DASHMODEL-001 onwards
+/**
+ * The dashboard classifies trips against the user's WALL CLOCK — `daysUntil`
+ * always did (it parses dates as local midnight). But the "ongoing" check and
+ * the sort ranking derived "today" from `toISOString()`, which is UTC — so in
+ * any non-UTC timezone, between local midnight and the UTC rollover, a trip
+ * that ended yesterday still ranked as "running" and a trip starting today
+ * wasn't "ongoing". These tests pin the clock inside that window (00:30 local).
+ * On a UTC machine local == UTC and the old bug is unobservable, so the
+ * regression cases below are vacuous there — they bite on any offset TZ.
+ */
+describe('dashboardModel — "today" is the user\'s local date', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    // Local 2026-08-25 00:30 — for any TZ ahead of UTC, the UTC date is still 08-24.
+    vi.setSystemTime(new Date(2026, 7, 25, 0, 30))
+  })
+  afterEach(() => {
+    vi.useRealTimers()
+  })
 
-const trip = (over: Partial<DashboardTrip>): DashboardTrip =>
-  ({ id: 1, title: 't', ...over }) as unknown as DashboardTrip;
+  it('localIsoToday() is the local calendar date, not the UTC one', () => {
+    expect(localIsoToday()).toBe('2026-08-25')
+  })
 
-const offset = (days: number): string => {
-  const d = new Date('2026-07-15T12:00:00Z');
-  d.setUTCDate(d.getUTCDate() + days);
-  return d.toISOString().split('T')[0];
-};
+  it('daysUntil counts from local midnight', () => {
+    expect(daysUntil('2026-08-25')).toBe(0)
+    expect(daysUntil('2026-08-26')).toBe(1)
+    expect(daysUntil('2026-08-24')).toBe(-1)
+    expect(daysUntil(null)).toBeNull()
+  })
 
-beforeEach(() => {
-  vi.useFakeTimers();
-  vi.setSystemTime(new Date('2026-07-15T12:00:00Z'));
-});
+  it('a trip spanning the local today is ongoing', () => {
+    expect(getTripStatus({ start_date: '2026-08-25', end_date: '2026-08-26' } as never)).toBe('ongoing')
+  })
 
-afterEach(() => {
-  vi.useRealTimers();
-});
+  it('a trip starting on the local today (no end) is "today"', () => {
+    expect(getTripStatus({ start_date: '2026-08-25', end_date: null } as never)).toBe('today')
+  })
 
-describe('daysUntil', () => {
-  it('FE-HOOK-DASHMODEL-001: has no answer without a date', () => {
-    expect(daysUntil(null)).toBeNull();
-    expect(daysUntil(undefined)).toBeNull();
-  });
+  it('a trip that ended yesterday (local) is past — and sorts after one starting today', () => {
+    expect(getTripStatus({ start_date: '2026-08-20', end_date: '2026-08-24' } as never)).toBe('past')
 
-  it('FE-HOOK-DASHMODEL-002: counts forwards and backwards from today', () => {
-    expect(daysUntil(offset(0))).toBe(0);
-    expect(daysUntil(offset(5))).toBe(5);
-    expect(daysUntil(offset(-3))).toBe(-3);
-  });
-});
-
-describe('getTripStatus', () => {
-  it('FE-HOOK-DASHMODEL-003: a date range around today is ongoing', () => {
-    expect(getTripStatus(trip({ start_date: offset(-2), end_date: offset(2) }))).toBe('ongoing');
-  });
-
-  it('FE-HOOK-DASHMODEL-004: a trip without a start date has no status', () => {
-    expect(getTripStatus(trip({ start_date: null, end_date: null }))).toBeNull();
-  });
-
-  it.each([
-    [0, 'today'],
-    [1, 'tomorrow'],
-    [9, 'future'],
-    [-9, 'past'],
-  ] as Array<[number, string]>)('FE-HOOK-DASHMODEL-005: a start in %s days is %s', (days, status) => {
-    // No end date, so the "ongoing" rule cannot swallow the start-relative states.
-    expect(getTripStatus(trip({ start_date: offset(days), end_date: null }))).toBe(status);
-  });
-
-  it('FE-HOOK-DASHMODEL-010: a finished date range is past', () => {
-    expect(getTripStatus(trip({ start_date: offset(-9), end_date: offset(-8) }))).toBe('past');
-  });
-});
-
-describe('sortTrips', () => {
-  it('FE-HOOK-DASHMODEL-006: running first, then upcoming ascending, then finished descending', () => {
-    const sorted = sortTrips([
-      trip({ id: 1, start_date: offset(-40), end_date: offset(-30) }),
-      trip({ id: 2, start_date: offset(20), end_date: offset(25) }),
-      trip({ id: 3, start_date: offset(-1), end_date: offset(3) }),
-      trip({ id: 4, start_date: offset(5), end_date: offset(8) }),
-      trip({ id: 5, start_date: offset(-10), end_date: offset(-8) }),
-    ]);
-
-    expect(sorted.map(t => t.id)).toEqual([3, 4, 2, 5, 1]);
-  });
-
-  it('FE-HOOK-DASHMODEL-007: leaves the input array untouched', () => {
-    const input = [trip({ id: 1, start_date: offset(10) }), trip({ id: 2, start_date: offset(1) })];
-
-    const sorted = sortTrips(input);
-
-    expect(input.map(t => t.id)).toEqual([1, 2]);
-    expect(sorted.map(t => t.id)).toEqual([2, 1]);
-  });
-
-  it('FE-HOOK-DASHMODEL-008: dateless trips rank last', () => {
-    const sorted = sortTrips([
-      trip({ id: 1, start_date: null, end_date: null }),
-      trip({ id: 2, start_date: offset(4), end_date: offset(6) }),
-    ]);
-
-    expect(sorted.map(t => t.id)).toEqual([2, 1]);
-  });
-});
-
-describe('MS_PER_DAY', () => {
-  it('FE-HOOK-DASHMODEL-009: is one day in milliseconds', () => {
-    expect(MS_PER_DAY).toBe(24 * 60 * 60 * 1000);
-  });
-});
+    const endedYesterday = { id: 1, start_date: '2026-08-20', end_date: '2026-08-24' }
+    const startsToday = { id: 2, start_date: '2026-08-25', end_date: '2026-08-26' }
+    const sorted = sortTrips([endedYesterday, startsToday] as never[])
+    expect(sorted.map((t: { id: number }) => t.id)).toEqual([2, 1])
+  })
+})
diff --git a/client/src/pages/dashboard/dashboardModel.ts b/client/src/pages/dashboard/dashboardModel.ts
index 4aa85cd74..7cea64dbb 100644
--- a/client/src/pages/dashboard/dashboardModel.ts
+++ b/client/src/pages/dashboard/dashboardModel.ts
@@ -6,6 +6,7 @@
  */
 
 import type { Trip } from '../../types'
+import { localIsoDate } from '../../utils/localDate'
 
 // The dashboard works with the canonical Trip shape returned by the list/get
 // endpoints (it already carries the computed day_count/place_count/is_owner/
@@ -29,6 +30,15 @@ export interface UpcomingReservation {
 
 export const MS_PER_DAY = 86400000
 
+/**
+ * Today as a local-calendar 'YYYY-MM-DD' — see utils/localDate for why this
+ * must never come from toISOString(). Trip dates are wall-clock dates
+ * (daysUntil below parses them as local midnight).
+ */
+export function localIsoToday(): string {
+  return localIsoDate()
+}
+
 export function daysUntil(dateStr: string | null | undefined): number | null {
   if (!dateStr) return null
   const today = new Date(); today.setHours(0, 0, 0, 0)
@@ -37,7 +47,7 @@ export function daysUntil(dateStr: string | null | undefined): number | null {
 }
 
 export function getTripStatus(trip: DashboardTrip): 'ongoing' | 'today' | 'tomorrow' | 'future' | 'past' | null {
-  const today = new Date().toISOString().split('T')[0]
+  const today = localIsoToday()
   if (trip.start_date && trip.end_date && trip.start_date <= today && trip.end_date >= today) return 'ongoing'
   const until = daysUntil(trip.start_date)
   if (until === null) return null
@@ -48,7 +58,7 @@ export function getTripStatus(trip: DashboardTrip): 'ongoing' | 'today' | 'tomor
 }
 
 export function sortTrips(trips: DashboardTrip[]): DashboardTrip[] {
-  const today = new Date().toISOString().split('T')[0]
+  const today = localIsoToday()
   const rank = (t: DashboardTrip) => {
     if (t.start_date && t.end_date && t.start_date <= today && t.end_date >= today) return 0
     if (t.start_date && t.start_date >= today) return 1
diff --git a/client/src/pages/dashboard/useDashboard.ts b/client/src/pages/dashboard/useDashboard.ts
index 53d991e25..57bd1915c 100644
--- a/client/src/pages/dashboard/useDashboard.ts
+++ b/client/src/pages/dashboard/useDashboard.ts
@@ -6,6 +6,7 @@ import { useAuthStore } from '../../store/authStore'
 import { useTranslation } from '../../i18n'
 import { useToast } from '../../components/shared/Toast'
 import { getApiErrorMessage } from '../../types'
+import { localIsoToday } from './dashboardModel'
 import type { TripCreateRequest } from '@trek/shared'
 import {
   type DashboardTrip,
@@ -92,7 +93,7 @@ export function useDashboard() {
     loadTrips()
   }
 
-  const today = new Date().toISOString().split('T')[0]
+  const today = localIsoToday()
   // A trip the hero features on its own merit: one that is running, else the next
   // one coming up. Only that one is taken out of the grid below, so the same trip
   // isn't shown twice.
diff --git a/client/src/pages/journeyDetail/JourneyDetailPage.helpers.ts b/client/src/pages/journeyDetail/JourneyDetailPage.helpers.ts
index a58e6463d..16ea5199e 100644
--- a/client/src/pages/journeyDetail/JourneyDetailPage.helpers.ts
+++ b/client/src/pages/journeyDetail/JourneyDetailPage.helpers.ts
@@ -126,7 +126,7 @@ export function sortProviderPhotos<T extends ProviderPhotoAsset>(photos: T[], lo
     .map((photo, index) => ({
       photo,
       index,
-      distance: isValidGeoPoint({ lat: photo.lat ?? NaN, lng: photo.lng ?? NaN })
+      distance: isValidGeoPoint({ lat: photo.lat ?? Number.NaN, lng: photo.lng ?? Number.NaN })
         ? distanceBetweenGeoPoints(location, { lat: photo.lat!, lng: photo.lng! })
         : null,
     }))
diff --git a/client/src/pages/journeyDetail/useJourneyDetail.ts b/client/src/pages/journeyDetail/useJourneyDetail.ts
index d8c9edef9..a41d0f6c4 100644
--- a/client/src/pages/journeyDetail/useJourneyDetail.ts
+++ b/client/src/pages/journeyDetail/useJourneyDetail.ts
@@ -300,7 +300,7 @@ export function useJourneyDetail() {
       (current?.entries || [])
         .filter(e => e.title !== 'Gallery' && e.title !== '[Trip Photos]')
         .map(e => e.entry_date)
-        .sort()
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
     )]
     const sorted = [...mapEntries].sort((a, b) => a.entry_date.localeCompare(b.entry_date))
     const dayCounters = new Map<string, number>()
diff --git a/client/src/pages/journeyPublic/journeyPublicModel.ts b/client/src/pages/journeyPublic/journeyPublicModel.ts
index 7cecf9698..57dbf3359 100644
--- a/client/src/pages/journeyPublic/journeyPublicModel.ts
+++ b/client/src/pages/journeyPublic/journeyPublicModel.ts
@@ -28,6 +28,9 @@ export interface PublicPhoto {
   owner_id?: number | null
   file_path?: string | null
   caption?: string | null
+  // 'image' (default) or 'video' (#823)
+  media_type?: string | null
+  duration_ms?: number | null
 }
 
 export interface PublicGalleryPhoto {
@@ -39,6 +42,9 @@ export interface PublicGalleryPhoto {
   owner_id?: number | null
   file_path?: string | null
   caption?: string | null
+  // 'image' (default) or 'video' (#823)
+  media_type?: string | null
+  duration_ms?: number | null
   /** Where and when the picture was taken (#1614). Absent for most photos, and the
    *  coordinates are withheld entirely unless the owner shared the map. */
   taken_at?: string | null
diff --git a/client/src/pages/journeyPublic/useJourneyPublic.ts b/client/src/pages/journeyPublic/useJourneyPublic.ts
index d4ae76fe8..91e7a07a7 100644
--- a/client/src/pages/journeyPublic/useJourneyPublic.ts
+++ b/client/src/pages/journeyPublic/useJourneyPublic.ts
@@ -55,7 +55,7 @@ export function useJourneyPublic() {
   const groupedEntries = useMemo(() => groupByDate(timelineEntries), [timelineEntries])
   // Chronological throughout: this is what the day colours and the stop numbers are
   // derived from, so flipping the reading order must not renumber the trip.
-  const sortedDates = useMemo(() => [...groupedEntries.keys()].sort(), [groupedEntries])
+  const sortedDates = useMemo(() => [...groupedEntries.keys()].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)), [groupedEntries])
   const mapEntries = useMemo(
     () => timelineEntries.filter(e => e.location_lat && e.location_lng),
     [timelineEntries],
diff --git a/client/src/pages/journeyStudio/useJourneyStudio.ts b/client/src/pages/journeyStudio/useJourneyStudio.ts
index 38ddd841a..fe560577a 100644
--- a/client/src/pages/journeyStudio/useJourneyStudio.ts
+++ b/client/src/pages/journeyStudio/useJourneyStudio.ts
@@ -295,11 +295,11 @@ export function useJourneyStudio() {
      */
     const points = stats?.points ?? []
     const dayCount = stats?.days ?? null
-    const first = stats?.start ? Date.parse(`${stats.start}T00:00:00`) : NaN
+    const first = stats?.start ? Date.parse(`${stats.start}T00:00:00`) : Number.NaN
     const placed = withPhotos.map(entry => {
       const point = points.find(p => p.date && entry.date && p.date === entry.date)
         ?? points.find(p => p.label && entry.location && p.label === entry.location)
-      const at = entry.date ? Date.parse(`${entry.date}T00:00:00`) : NaN
+      const at = entry.date ? Date.parse(`${entry.date}T00:00:00`) : Number.NaN
       const dayNumber = Number.isFinite(at) && Number.isFinite(first)
         ? Math.floor((at - first) / 86_400_000) + 1
         : null
diff --git a/client/src/pages/login/worldDots.ts b/client/src/pages/login/worldDots.ts
index 4e542e7d7..1d9eaf844 100644
--- a/client/src/pages/login/worldDots.ts
+++ b/client/src/pages/login/worldDots.ts
@@ -16,7 +16,7 @@ export function worldDots(): { x: number; y: number }[] {
   const out: { x: number; y: number }[] = [];
   let cursor = 0;
   for (const part of PACKED.split('.')) {
-    cursor += parseInt(part, 36);
+    cursor += Number.parseInt(part, 36);
     out.push({ x: cursor % WORLD_GRID_W, y: Math.floor(cursor / WORLD_GRID_W) });
   }
   return out;
diff --git a/client/src/pages/tripPlanner/useTripPlanner.test.tsx b/client/src/pages/tripPlanner/useTripPlanner.test.tsx
index 691ac88e0..638c6878f 100644
--- a/client/src/pages/tripPlanner/useTripPlanner.test.tsx
+++ b/client/src/pages/tripPlanner/useTripPlanner.test.tsx
@@ -680,6 +680,28 @@ describe('useTripPlanner — map derivations', () => {
     expect(result.current.mapPlaces.map(p => p.id)).toEqual([1])
   })
 
+  it('FE-TP-HOOK-111: the planned filter follows the selected day when one is selected', async () => {
+    const onDay7 = geo(1)
+    const onDay8 = geo(2)
+    seedTrip({
+      places: [onDay7, onDay8, geo(3)],
+      assignments: {
+        '7': [buildAssignment({ id: 10, day_id: 7, place: onDay7 })],
+        '8': [buildAssignment({ id: 11, day_id: 8, place: onDay8 })],
+      },
+      placesFilter: 'planned',
+      selectedDayId: 7,
+    })
+
+    const { result } = await renderPlanner()
+
+    expect(result.current.mapPlaces.map(p => p.id)).toEqual([1])
+
+    // No day selected → back to the whole plan
+    act(() => { useTripStore.setState({ selectedDayId: null }) })
+    expect(result.current.mapPlaces.map(p => p.id)).toEqual([1, 2])
+  })
+
   it('FE-TP-HOOK-030: collapsing a day hides its stops unless another expanded day shows them', async () => {
     const shared = geo(1)
     seedTrip({
diff --git a/client/src/pages/tripPlanner/useTripPlanner.ts b/client/src/pages/tripPlanner/useTripPlanner.ts
index a3e37be74..723eaca77 100644
--- a/client/src/pages/tripPlanner/useTripPlanner.ts
+++ b/client/src/pages/tripPlanner/useTripPlanner.ts
@@ -48,7 +48,7 @@ export function useTripPlanner() {
   // The route param is a string; convert once here so every downstream component
   // prop and store call gets a real number. An absent/invalid id becomes NaN,
   // which stays falsy in the `if (tripId)` guards below.
-  const tripId = id ? Number(id) : NaN
+  const tripId = id ? Number(id) : Number.NaN
   const navigate = useNavigate()
   const toast = useToast()
   const { t, language } = useTranslation()
@@ -439,9 +439,15 @@ export function useTripPlanner() {
     }
 
     // Planned place IDs — needed by both the 'unplanned' filter (exclude them) and
-    // the new 'planned' filter (keep only them).
+    // the new 'planned' filter (keep only them). With a day selected, 'planned'
+    // follows it like the other filters do; with no day selected it keeps showing
+    // the whole plan (#2024). 'unplanned' always uses the whole-trip set — a place
+    // assigned to any day is not unplanned.
     const plannedIds = placesFilter === 'unplanned' || placesFilter === 'planned'
-      ? new Set(Object.values(assignments).flatMap(da => da.map(a => a.place?.id).filter(Boolean)))
+      ? new Set((placesFilter === 'planned' && selectedDayId
+        ? (assignments[String(selectedDayId)] || [])
+        : Object.values(assignments).flat()
+      ).map(a => a.place?.id).filter(Boolean))
       : null
 
     return places.filter(p => {
@@ -460,7 +466,7 @@ export function useTripPlanner() {
       if (placesFilter === 'planned' && plannedIds && !plannedIds.has(p.id)) return false
       return true
     })
-  }, [places, placesCategoryFilter, placesFilter, assignments, expandedDayIds])
+  }, [places, placesCategoryFilter, placesFilter, assignments, expandedDayIds, selectedDayId])
 
   const { route, routeSegments, routeVias, routeInfo, setRoute, setRouteInfo, updateRouteForDay } = useRouteCalculation({ assignments } as any, selectedDayId, routeShown, routeProfile, tripAccommodations)
 
diff --git a/client/src/store/settingsStore.ts b/client/src/store/settingsStore.ts
index 2d9548f90..9ec2a5400 100644
--- a/client/src/store/settingsStore.ts
+++ b/client/src/store/settingsStore.ts
@@ -76,7 +76,7 @@ export const useSettingsStore = create<SettingsState>((set, get) => ({
   isLoaded: false,
 
   loadSettings: async () => {
-    if (_loadInFlight) return _loadInFlight
+    if (_loadInFlight !== null) return _loadInFlight
     _loadInFlight = (async () => {
       try {
         const data = await settingsApi.get()
diff --git a/client/src/store/slices/assignmentsSlice.ts b/client/src/store/slices/assignmentsSlice.ts
index cc551af51..8411a0724 100644
--- a/client/src/store/slices/assignmentsSlice.ts
+++ b/client/src/store/slices/assignmentsSlice.ts
@@ -18,7 +18,7 @@ export interface AssignmentsSlice {
 export const createAssignmentsSlice = (set: SetState, get: GetState): AssignmentsSlice => ({
   assignPlaceToDay: async (tripId, dayId, placeId, position) => {
     const state = get()
-    const place = state.places.find(p => p.id === parseInt(String(placeId)))
+    const place = state.places.find(p => p.id === Number.parseInt(String(placeId)))
     if (!place) return
 
     const tempId = Date.now() * -1
@@ -26,7 +26,7 @@ export const createAssignmentsSlice = (set: SetState, get: GetState): Assignment
     const insertIdx = position != null ? position : current.length
     const tempAssignment: Assignment = {
       id: tempId,
-      day_id: parseInt(String(dayId)),
+      day_id: Number.parseInt(String(dayId)),
       place_id: place.id,
       order_index: insertIdx,
       notes: null,
@@ -141,7 +141,7 @@ export const createAssignmentsSlice = (set: SetState, get: GetState): Assignment
     const insertAt = toOrderIndex !== null ? toOrderIndex : toItems.length
 
     const newToItems = [...toItems]
-    newToItems.splice(insertAt, 0, { ...assignment, day_id: parseInt(String(toDayId)) })
+    newToItems.splice(insertAt, 0, { ...assignment, day_id: Number.parseInt(String(toDayId)) })
     newToItems.forEach((a, i) => { a.order_index = i })
 
     set(s => ({
diff --git a/client/src/store/slices/budgetSlice.test.ts b/client/src/store/slices/budgetSlice.test.ts
index c30a6cc7d..a3eade30b 100644
--- a/client/src/store/slices/budgetSlice.test.ts
+++ b/client/src/store/slices/budgetSlice.test.ts
@@ -144,7 +144,7 @@ describe('budgetSlice', () => {
     );
     await useTripStore.getState().toggleBudgetMemberPaid(1, 8, 3, true);
     const stored = useTripStore.getState().budgetItems.find(i => i.id === 8);
-    expect(stored?.members?.[0]?.paid).toBe(true);
+    expect(stored?.members?.[0]?.paid).toBe(1);
   });
 
   it('FE-STORE-BUDGET-010: reorderBudgetItems reorders optimistically and reloads on error', async () => {
diff --git a/client/src/store/slices/budgetSlice.ts b/client/src/store/slices/budgetSlice.ts
index dac827ddb..dd237ac66 100644
--- a/client/src/store/slices/budgetSlice.ts
+++ b/client/src/store/slices/budgetSlice.ts
@@ -82,10 +82,10 @@ export const createBudgetSlice = (set: SetState, get: GetState): BudgetSlice =>
     set(state => ({
       budgetItems: state.budgetItems.map(item =>
         item.id === itemId
-          // The server persists `paid` as 0/1; the optimistic update stores the
-          // boolean toggle value (truthy-compatible) — narrow it to the member's
-          // numeric type without changing the stored runtime value.
-          ? { ...item, members: (item.members || []).map(m => m.user_id === userId ? { ...m, paid: paid as unknown as number } : m) }
+          // The server persists `paid` as 0/1 and broadcasts the same 0/1 over
+          // WebSocket, so the optimistic write normalises the boolean toggle to
+          // that numeric contract instead of parking a boolean under a cast.
+          ? { ...item, members: (item.members || []).map(m => m.user_id === userId ? { ...m, paid: paid ? 1 : 0 } : m) }
           : item
       )
     }));
diff --git a/client/src/store/slices/dayNotesSlice.ts b/client/src/store/slices/dayNotesSlice.ts
index 7d795acc3..1d0eddb40 100644
--- a/client/src/store/slices/dayNotesSlice.ts
+++ b/client/src/store/slices/dayNotesSlice.ts
@@ -21,7 +21,7 @@ export const createDayNotesSlice = (set: SetState, get: GetState): DayNotesSlice
     try {
       await daysApi.update(tripId, dayId, { notes })
       set(state => ({
-        days: state.days.map(d => d.id === parseInt(String(dayId)) ? { ...d, notes } : d)
+        days: state.days.map(d => d.id === Number.parseInt(String(dayId)) ? { ...d, notes } : d)
       }))
     } catch (err: unknown) {
       throw new Error(getApiErrorMessage(err, 'Error updating notes'))
@@ -32,7 +32,7 @@ export const createDayNotesSlice = (set: SetState, get: GetState): DayNotesSlice
     try {
       await daysApi.update(tripId, dayId, { title })
       set(state => ({
-        days: state.days.map(d => d.id === parseInt(String(dayId)) ? { ...d, title } : d)
+        days: state.days.map(d => d.id === Number.parseInt(String(dayId)) ? { ...d, title } : d)
       }))
     } catch (err: unknown) {
       throw new Error(getApiErrorMessage(err, 'Error updating day name'))
diff --git a/client/src/store/slices/daysSlice.ts b/client/src/store/slices/daysSlice.ts
index 8d67dd3ef..48cd5e205 100644
--- a/client/src/store/slices/daysSlice.ts
+++ b/client/src/store/slices/daysSlice.ts
@@ -20,7 +20,7 @@ export const createDaysSlice = (set: SetState, get: GetState): DaysSlice => ({
   reorderDays: async (tripId, orderedIds) => {
     const prevDays = get().days
     const byId = new Map(prevDays.map(d => [d.id, d]))
-    const sortedDates = prevDays.map(d => d.date).filter((d): d is string => !!d).sort()
+    const sortedDates = prevDays.map(d => d.date).filter((d): d is string => !!d).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
     const optimistic = orderedIds
       .map((id, i) => {
         const d = byId.get(id)
diff --git a/client/src/styles/studio.css b/client/src/styles/studio.css
index ff2561e26..5159bead9 100644
--- a/client/src/styles/studio.css
+++ b/client/src/styles/studio.css
@@ -889,7 +889,6 @@
   box-shadow: var(--glass-shadow), var(--glass-highlight);
   backdrop-filter: blur(30px) saturate(1.8);
   -webkit-backdrop-filter: blur(30px) saturate(1.8);
-  z-index: 2;
 }
 .trek-dash .st-zoom button {
   width: 32px;
diff --git a/client/src/sync/mutationQueue.ts b/client/src/sync/mutationQueue.ts
index 1c21ab487..0eff392d1 100644
--- a/client/src/sync/mutationQueue.ts
+++ b/client/src/sync/mutationQueue.ts
@@ -10,6 +10,7 @@ import { apiClient } from '../api/client'
 import { isAuthed } from './authGate'
 import { isEffectivelyOffline } from './networkMode'
 import { getOfflinePrefs } from './offlinePrefs'
+import { randomId } from '../utils/randomId'
 import type { QueuedMutation } from '../db/offlineDb'
 import type { Table } from 'dexie'
 
@@ -26,16 +27,15 @@ function getTable(resource: string): Table | undefined {
   return map[resource]
 }
 
-/** Generate a v4-style UUID using the platform crypto API. */
+/**
+ * Generate a v4-style UUID using the platform crypto API.
+ *
+ * The implementation moved to utils/randomId so the axios interceptor, which
+ * mints the same header for online writes, cannot drift away from it — this
+ * value becomes the X-Idempotency-Key and a duplicate silently drops a write.
+ */
 export function generateUUID(): string {
-  if (typeof crypto !== 'undefined' && crypto.randomUUID) {
-    return crypto.randomUUID()
-  }
-  // Fallback for environments without crypto.randomUUID (e.g. old Node)
-  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
-    const r = (Math.random() * 16) | 0
-    return (c === 'x' ? r : (r & 0x3) | 0x8).toString(16)
-  })
+  return randomId()
 }
 
 let _flushing = false
diff --git a/client/src/theme/applyAppearance.ts b/client/src/theme/applyAppearance.ts
index f5c583c22..b7a718394 100644
--- a/client/src/theme/applyAppearance.ts
+++ b/client/src/theme/applyAppearance.ts
@@ -59,9 +59,9 @@ function accentTextFor(hex: string): string {
   const c = hex.replace('#', '')
   const full = c.length === 3 ? c.split('').map((x) => x + x).join('') : c
   const toLin = (v: number) => (v <= 0.03928 ? v / 12.92 : Math.pow((v + 0.055) / 1.055, 2.4))
-  const r = toLin(parseInt(full.slice(0, 2), 16) / 255)
-  const g = toLin(parseInt(full.slice(2, 4), 16) / 255)
-  const b = toLin(parseInt(full.slice(4, 6), 16) / 255)
+  const r = toLin(Number.parseInt(full.slice(0, 2), 16) / 255)
+  const g = toLin(Number.parseInt(full.slice(2, 4), 16) / 255)
+  const b = toLin(Number.parseInt(full.slice(4, 6), 16) / 255)
   const luminance = 0.2126 * r + 0.7152 * g + 0.0722 * b
   return luminance > 0.45 ? '#111827' : '#ffffff'
 }
diff --git a/client/src/utils/dayMerge.ts b/client/src/utils/dayMerge.ts
index 871668a2c..302925694 100644
--- a/client/src/utils/dayMerge.ts
+++ b/client/src/utils/dayMerge.ts
@@ -13,7 +13,7 @@ export function parseTimeToMinutes(time?: string | null): number | null {
     return h * 60 + m
   }
   const parts = time.split(':').map(Number)
-  if (parts.length >= 2 && !isNaN(parts[0]) && !isNaN(parts[1])) return parts[0] * 60 + parts[1]
+  if (parts.length >= 2 && !Number.isNaN(parts[0]) && !Number.isNaN(parts[1])) return parts[0] * 60 + parts[1]
   return null
 }
 
diff --git a/client/src/utils/formatters.ts b/client/src/utils/formatters.ts
index 75c51f1f2..047b83be5 100644
--- a/client/src/utils/formatters.ts
+++ b/client/src/utils/formatters.ts
@@ -163,8 +163,8 @@ export function formatDate(dateStr: string | null | undefined, locale: string, t
 export function parseMeridiemTime(value: string | null | undefined): string | null {
   const match = (value || '').trim().match(/^(\d{1,2}):?(\d{2})?\s*(am|pm)$/i)
   if (!match) return null
-  let h = parseInt(match[1])
-  const m = match[2] ? parseInt(match[2]) : 0
+  let h = Number.parseInt(match[1])
+  const m = match[2] ? Number.parseInt(match[2]) : 0
   const isPm = match[3].toLowerCase() === 'pm'
   if (h === 12) h = isPm ? 12 : 0
   else if (isPm) h += 12
@@ -183,7 +183,7 @@ export function formatTime(timeStr: string | null | undefined, locale: string, t
     const parts = (parseMeridiemTime(timeStr) ?? timeStr).split(':')
     const h = Number(parts[0]) || 0
     const m = Number(parts[1]) || 0
-    if (isNaN(h)) return timeStr
+    if (Number.isNaN(h)) return timeStr
     if (timeFormat === '12h') return to12h(h, m)
     const str = `${String(h).padStart(2, '0')}:${String(m).padStart(2, '0')}`
     return locale?.startsWith('de') ? `${str} Uhr` : str
@@ -200,7 +200,7 @@ export function formatClockTime(value: string | null | undefined, is12h: boolean
   if (!value) return ''
   const norm = parseMeridiemTime(value) ?? value
   const [h, m] = norm.split(':').map(Number)
-  if (isNaN(h) || isNaN(m)) return value
+  if (!Number.isFinite(h) || !Number.isFinite(m)) return value
   return is12h ? to12h(h, m) : norm
 }
 
@@ -285,7 +285,7 @@ export function formatMoneySum(
   // Breakdown: base first, then the rest in stable code order.
   const parts = [
     ...(groups.has(baseCur) ? [baseCur] : []),
-    ...foreign.sort(),
+    ...foreign.sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)),
   ]
   return parts.map(cur => formatMoney(groups.get(cur)!, cur, locale, opts)).join(' + ')
 }
@@ -300,7 +300,7 @@ export function dayTotalCost(
 ): string | null {
   const da = assignments[String(dayId)] || []
   const entries = da.map(a => ({
-    amount: parseFloat(String(a.place?.price ?? '')) || 0,
+    amount: Number.parseFloat(String(a.place?.price ?? '')) || 0,
     currency: a.place?.currency || tripCurrency,
   }))
   return formatMoneySum(entries, base, locale, rates, { decimals: 0 })
diff --git a/client/src/utils/journeyLifecycle.test.ts b/client/src/utils/journeyLifecycle.test.ts
index 1a420cea6..83d707b3f 100644
--- a/client/src/utils/journeyLifecycle.test.ts
+++ b/client/src/utils/journeyLifecycle.test.ts
@@ -59,3 +59,33 @@ describe('computeJourneyLifecycle', () => {
     expect(computeJourneyLifecycle('published', null, TODAY)).toBe('live')
   })
 })
+
+/**
+ * The midnight-window regression: "today" must be the LOCAL calendar date.
+ * The old code derived it from toISOString() (the UTC date), so between local
+ * midnight and the UTC rollover a journey running through yesterday still
+ * showed 'live' and one starting today showed 'upcoming'. Pinned at 00:30
+ * local — vacuous on a UTC machine, biting on any TZ ahead of UTC.
+ */
+describe('computeJourneyLifecycle — local today at the midnight window', () => {
+  beforeAll(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date(2026, 7, 25, 0, 30)) // local 2026-08-25 00:30
+  })
+  afterAll(() => {
+    vi.useRealTimers()
+  })
+
+  it('a journey spanning the local today is live', () => {
+    expect(computeJourneyLifecycle('active', '2026-08-25', '2026-08-26')).toBe('live')
+  })
+
+  it('a journey that ended yesterday (local) is completed', () => {
+    expect(computeJourneyLifecycle('active', '2026-08-20', '2026-08-24')).toBe('completed')
+  })
+
+  it('single boundaries follow the local date too', () => {
+    expect(computeJourneyLifecycle('active', '2026-08-25', null)).toBe('live')      // starts today → live
+    expect(computeJourneyLifecycle('active', null, '2026-08-24')).toBe('completed') // ended yesterday
+  })
+})
diff --git a/client/src/utils/journeyLifecycle.ts b/client/src/utils/journeyLifecycle.ts
index e27dd6acf..bdb4f2b56 100644
--- a/client/src/utils/journeyLifecycle.ts
+++ b/client/src/utils/journeyLifecycle.ts
@@ -1,3 +1,5 @@
+import { localIsoDate } from './localDate'
+
 export type JourneyLifecycle = 'archived' | 'live' | 'upcoming' | 'completed' | 'draft'
 
 export function computeJourneyLifecycle(
@@ -8,7 +10,7 @@ export function computeJourneyLifecycle(
   if (status === 'archived') return 'archived'
 
   if (tripDateMin && tripDateMax) {
-    const today = new Date().toISOString().split('T')[0]
+    const today = localIsoDate()
     if (tripDateMin <= today && today <= tripDateMax) return 'live'
     if (tripDateMin > today) return 'upcoming'
     return 'completed'
@@ -20,11 +22,11 @@ export function computeJourneyLifecycle(
 
   // Single boundary: only start or only end
   if (tripDateMin && !tripDateMax) {
-    const today = new Date().toISOString().split('T')[0]
+    const today = localIsoDate()
     return tripDateMin > today ? 'upcoming' : 'live'
   }
   if (!tripDateMin && tripDateMax) {
-    const today = new Date().toISOString().split('T')[0]
+    const today = localIsoDate()
     return tripDateMax < today ? 'completed' : 'live'
   }
 
diff --git a/client/src/utils/localDate.test.ts b/client/src/utils/localDate.test.ts
new file mode 100644
index 000000000..84cd314e6
--- /dev/null
+++ b/client/src/utils/localDate.test.ts
@@ -0,0 +1,28 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+import { localIsoDate } from './localDate'
+
+/**
+ * "Today" must be the user's local calendar date. `toISOString()` is the UTC
+ * date — between local midnight and the UTC rollover it is YESTERDAY for any
+ * TZ ahead of UTC, which misclassified trips/journeys in that window. On a UTC
+ * machine local == UTC, so the distinction is vacuous there; these tests pin
+ * the clock at 00:30 local, where any positive offset separates the two.
+ */
+describe('localIsoDate', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date(2026, 7, 25, 0, 30)) // local 2026-08-25 00:30
+  })
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('formats the local calendar date, zero-padded', () => {
+    expect(localIsoDate()).toBe('2026-08-25')
+    expect(localIsoDate(new Date(2026, 0, 3, 12))).toBe('2026-01-03')
+  })
+
+  it('defaults to now', () => {
+    expect(localIsoDate()).toBe(localIsoDate(new Date()))
+  })
+})
diff --git a/client/src/utils/localDate.ts b/client/src/utils/localDate.ts
new file mode 100644
index 000000000..fbac8e539
--- /dev/null
+++ b/client/src/utils/localDate.ts
@@ -0,0 +1,16 @@
+/**
+ * The user's LOCAL calendar date as 'YYYY-MM-DD'.
+ *
+ * Never derive "today" from `toISOString().split('T')[0]` — that is the UTC
+ * date, which disagrees with the wall clock between local midnight and the UTC
+ * rollover (for a UTC+2 user, from 00:00 to 02:00 every night). Trip and
+ * journey dates are wall-clock dates, so every "is this today/past/upcoming"
+ * comparison must use this instead.
+ *
+ * (Converting a Date you deliberately built in UTC — `new Date(s + 'T00:00:00Z')`
+ * round-tripped through date arithmetic — is a different, self-consistent
+ * pattern and fine as it is.)
+ */
+export function localIsoDate(d: Date = new Date()): string {
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`
+}
diff --git a/client/src/utils/randomId.ts b/client/src/utils/randomId.ts
new file mode 100644
index 000000000..b17e3f65b
--- /dev/null
+++ b/client/src/utils/randomId.ts
@@ -0,0 +1,40 @@
+/**
+ * The one place idempotency keys are minted.
+ *
+ * Every producer — the offline queue's mutation id, the axios interceptor's
+ * per-request key and the upload queue's per-file key — ends up in the same
+ * `X-Idempotency-Key` header, which the
+ * server caches on (key, user_id, method, path). Two writes that share a key
+ * therefore collapse into one: the second gets the first one's cached response
+ * instead of being applied, and the user loses an edit with no error anywhere.
+ *
+ * `crypto.randomUUID` needs a secure context, and TREK's own quickstart is plain
+ * http://localhost:3000 with LAN installs on http://192.168.x.x — so on the
+ * deployments the README documents, randomUUID is undefined and the fallback is
+ * what actually runs. It has to be a real one. `getRandomValues` has no
+ * secure-context requirement and covers that gap; the Math.random rung below it
+ * exists only for a runtime with no Web Crypto at all.
+ *
+ * Lives in its own module rather than next to either caller because
+ * sync/mutationQueue imports api/client, so the dependency can only go one way.
+ */
+export function randomId(): string {
+  const c = globalThis.crypto
+  if (c && typeof c.randomUUID === 'function') return c.randomUUID()
+
+  if (c && typeof c.getRandomValues === 'function') {
+    const bytes = new Uint8Array(16)
+    c.getRandomValues(bytes)
+    // RFC 4122 version + variant bits, so the value still reads as a v4 UUID.
+    bytes[6] = (bytes[6] & 0x0f) | 0x40
+    bytes[8] = (bytes[8] & 0x3f) | 0x80
+    const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('')
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
+  }
+
+  // Padded on purpose: `Math.random().toString(36).slice(2)` is not
+  // length-stable — 0.5 yields a single character and 0 yields the empty
+  // string, which the server reads as "no key" and skips deduplication for.
+  const rand = () => Math.random().toString(36).slice(2).padStart(10, '0').slice(0, 10)
+  return `${Date.now().toString(36)}-${rand()}-${rand()}`
+}
diff --git a/client/src/utils/reservationRoutes.test.ts b/client/src/utils/reservationRoutes.test.ts
index d708411a9..1f0be69ec 100644
--- a/client/src/utils/reservationRoutes.test.ts
+++ b/client/src/utils/reservationRoutes.test.ts
@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest'
 import { isRoutableReservation, visibleRouteReservations } from './reservationRoutes'
-import type { Reservation, ReservationEndpoint } from '../types'
+import type { Day, Reservation, ReservationEndpoint } from '../types'
 
 function endpoint(role: 'from' | 'to', lat: number, lng: number): ReservationEndpoint {
   return { role, sequence: role === 'from' ? 0 : 1, name: role, code: null, lat, lng, timezone: null, local_time: null, local_date: null }
@@ -54,3 +54,65 @@ describe('visibleRouteReservations', () => {
     expect(result).toEqual([r])
   })
 })
+
+describe('visibleRouteReservations with a selected day', () => {
+  const twoStop = [endpoint('from', 1, 2), endpoint('to', 3, 4)]
+  const days = [
+    { id: 10, trip_id: 1, day_number: 1 },
+    { id: 11, trip_id: 1, day_number: 2 },
+    { id: 20, trip_id: 1, day_number: 3 },
+  ] as Day[]
+
+  function transit(overrides: Partial<Reservation>): Reservation {
+    return reservation({ type: 'transit', endpoints: twoStop, ...overrides })
+  }
+
+  it('excludes a transit journey that runs on another day', () => {
+    const r = transit({ id: 1, day_id: 20, end_day_id: 20 })
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [], showTransitRoutes: true, selectedDayId: 10, days })).toEqual([])
+  })
+
+  it('includes a transit journey that runs on the selected day', () => {
+    const r = transit({ id: 1, day_id: 10, end_day_id: 10 })
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [], showTransitRoutes: true, selectedDayId: 10, days })).toEqual([r])
+  })
+
+  it('keeps an overnight journey on both its departure and its arrival day', () => {
+    const r = transit({ id: 1, day_id: 10, end_day_id: 11 })
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [], showTransitRoutes: true, selectedDayId: 10, days })).toEqual([r])
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [], showTransitRoutes: true, selectedDayId: 11, days })).toEqual([r])
+  })
+
+  it('keeps a multi-day journey on the days in between', () => {
+    const r = transit({ id: 1, day_id: 10, end_day_id: 20 })
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [], showTransitRoutes: true, selectedDayId: 11, days })).toEqual([r])
+  })
+
+  it('goes by day order, not by day id', () => {
+    // Days dragged into a new order: id 20 is now the first day, id 10 the last.
+    const reordered = [
+      { id: 20, trip_id: 1, day_number: 1 },
+      { id: 11, trip_id: 1, day_number: 2 },
+      { id: 10, trip_id: 1, day_number: 3 },
+    ] as Day[]
+    const r = transit({ id: 1, day_id: 20, end_day_id: 11 })
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [], showTransitRoutes: true, selectedDayId: 11, days: reordered })).toEqual([r])
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [], showTransitRoutes: true, selectedDayId: 10, days: reordered })).toEqual([])
+  })
+
+  it('keeps a transit journey that is bound to no day', () => {
+    const r = transit({ id: 1, day_id: null, end_day_id: null })
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [], showTransitRoutes: true, selectedDayId: 10, days })).toEqual([r])
+  })
+
+  it('leaves the per-item route toggle day-agnostic', () => {
+    const r = reservation({ id: 5, type: 'train', endpoints: twoStop, day_id: 20, end_day_id: 20 })
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [5], showTransitRoutes: false, selectedDayId: 10, days })).toEqual([r])
+  })
+
+  it('does not scope transit without a selected day', () => {
+    const r = transit({ id: 1, day_id: 20, end_day_id: 20 })
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [], showTransitRoutes: true, days })).toEqual([r])
+    expect(visibleRouteReservations([r], { visibleConnectionIds: [], showTransitRoutes: true, selectedDayId: null, days })).toEqual([r])
+  })
+})
diff --git a/client/src/utils/reservationRoutes.ts b/client/src/utils/reservationRoutes.ts
index 312e0c12f..3f5cc5f2f 100644
--- a/client/src/utils/reservationRoutes.ts
+++ b/client/src/utils/reservationRoutes.ts
@@ -1,4 +1,5 @@
-import type { Reservation } from '../types'
+import { isDayInAccommodationRange } from './dayOrder'
+import type { Day, Reservation } from '../types'
 
 /**
  * A reservation is routable on the map once it has at least two ordered
@@ -17,14 +18,37 @@ export interface RouteVisibilityOptions {
   visibleConnectionIds: number[]
   /** The separate manual day-route-calculator toggle — 'transit' reservations ride it (#1065). */
   showTransitRoutes: boolean
+  /** The day that toggle belongs to. Optional: a map without a day context (collections) keeps drawing every transit, as before. */
+  selectedDayId?: number | null
+  /** The trip's days, needed to order them — day ids are not monotonic once days have been reordered. */
+  days?: Day[]
+}
+
+/**
+ * Does this transit journey actually run on the selected day? `showTransitRoutes` is one
+ * day's toggle but the reservation list is trip-wide, so without this every automated
+ * transport in the trip drew its geometry as soon as any day's route was switched on (#2019).
+ *
+ * The span, not the departure day: an overnight journey carries end_day_id and has to stay
+ * on both of its days — same rule getTransportForDay applies to the sidebar timeline.
+ * A journey bound to no day keeps drawing; hiding something that legitimately belongs
+ * to today is the worse failure.
+ */
+function transitRunsOnDay(r: Reservation, selectedDayId: number | null | undefined, days: Day[]): boolean {
+  if (selectedDayId == null) return true
+  const startDayId = r.day_id ?? r.end_day_id
+  if (startDayId == null) return true
+  const day = days.find(d => d.id === selectedDayId)
+  if (!day) return true
+  return isDayInAccommodationRange(day, startDayId, r.end_day_id ?? startDayId, days)
 }
 
 /** Which reservations should draw a route on the map, combining the two independent toggles above. */
 export function visibleRouteReservations(reservations: Reservation[], options: RouteVisibilityOptions): Reservation[] {
-  const { visibleConnectionIds, showTransitRoutes } = options
+  const { visibleConnectionIds, showTransitRoutes, selectedDayId, days } = options
   const set = new Set(visibleConnectionIds || [])
   return reservations.filter(r =>
-    (r.type === 'transit' && showTransitRoutes) ||
+    (r.type === 'transit' && showTransitRoutes && transitRunsOnDay(r, selectedDayId, days || [])) ||
     set.has(r.id)
   )
 }
diff --git a/client/src/utils/uploadQueue.ts b/client/src/utils/uploadQueue.ts
index 721cc2d77..fa7bdb298 100644
--- a/client/src/utils/uploadQueue.ts
+++ b/client/src/utils/uploadQueue.ts
@@ -1,4 +1,5 @@
 import type { AxiosProgressEvent } from 'axios'
+import { randomId } from './randomId'
 
 export interface UploadProgress {
   done: number
@@ -66,7 +67,7 @@ export async function uploadFilesResilient<T>(
       const i = idx++
       if (i >= files.length) break
       const file = files[i]
-      const idempotencyKey = crypto.randomUUID()
+      const idempotencyKey = randomId()
       loadedMap.set(i, 0)
 
       let items: T[] | null = null
diff --git a/client/src/vacay/yearWindow.ts b/client/src/vacay/yearWindow.ts
index e83a00319..5d4bf770a 100644
--- a/client/src/vacay/yearWindow.ts
+++ b/client/src/vacay/yearWindow.ts
@@ -38,8 +38,8 @@ function startMonthDay(s: VacayYearSettings): { month: number; day: number } {
   if (s.year_type === 'anniversary') {
     if (!s.hire_date) return { month: 1, day: 1 }
     const parts = s.hire_date.split('-')
-    month = parseInt(parts[1], 10) || 1
-    day = parseInt(parts[2], 10) || 1
+    month = Number.parseInt(parts[1], 10) || 1
+    day = Number.parseInt(parts[2], 10) || 1
   }
   month = Math.min(12, Math.max(1, month))
   return { month, day: Math.min(day, daysAlwaysInMonth(month)) }
diff --git a/client/tests/unit/mobile/admin/MAdminPackingTemplateManager.test.tsx b/client/tests/unit/mobile/admin/MAdminPackingTemplateManager.test.tsx
index eb808e101..a73c6deb7 100644
--- a/client/tests/unit/mobile/admin/MAdminPackingTemplateManager.test.tsx
+++ b/client/tests/unit/mobile/admin/MAdminPackingTemplateManager.test.tsx
@@ -136,7 +136,7 @@ describe('MAdminPackingTemplateManager', () => {
     await user.click(screen.getByRole('button', { name: 'New Template' }));
     await user.type(screen.getByPlaceholderText('Template name (e.g. Beach Holiday)'), 'Boom{Enter}');
 
-    await screen.findByText('Failed to create template');
+    expect(await screen.findByText('Failed to create template')).toBeInTheDocument();
   });
 
   it('FE-MOB-APKG-007: Escape and the cancel button both close the create field', async () => {
@@ -369,7 +369,7 @@ describe('MAdminPackingTemplateManager', () => {
     await user.click(await screen.findByRole('button', { name: 'Add category' }));
     await user.type(screen.getByPlaceholderText('Category name (e.g. Clothing)'), 'Electronics{Enter}');
 
-    await screen.findByText('Failed to save');
+    expect(await screen.findByText('Failed to save')).toBeInTheDocument();
   });
 
   it('FE-MOB-APKG-018: renaming a category updates its header', async () => {
@@ -586,7 +586,7 @@ describe('MAdminPackingTemplateManager', () => {
     await user.click(within(categoryHeader('Clothing')).getByRole('button', { name: 'Item name' }));
     await user.type(screen.getByPlaceholderText('Item name'), 'Sandals{Enter}');
 
-    await screen.findByText('Failed to save');
+    expect(await screen.findByText('Failed to save')).toBeInTheDocument();
   });
 
   it('FE-MOB-APKG-026: renaming an item persists via the save button', async () => {
diff --git a/client/tests/unit/mobile/admin/MAdminPluginsPanel.test.tsx b/client/tests/unit/mobile/admin/MAdminPluginsPanel.test.tsx
index cf3fa5356..1ab15b531 100644
--- a/client/tests/unit/mobile/admin/MAdminPluginsPanel.test.tsx
+++ b/client/tests/unit/mobile/admin/MAdminPluginsPanel.test.tsx
@@ -40,6 +40,9 @@ function registryEntry(over: Row = {}): Row {
     repo: 'acme/gotify',
     type: 'integration',
     latest: '2.0.0',
+    // The real browse response always carries latestCompatible (server-side hostCompat);
+    // mirror `latest` by default, exactly like a fully-compatible entry.
+    latestCompatible: (over.latest as string | undefined) ?? '2.0.0',
     minTrekVersion: null,
     reviewedAt: null,
     screenshotUrl: null,
@@ -742,6 +745,124 @@ describe('MAdminPluginsPanel — updates and consent', () => {
     await waitFor(() => expect(toastMessages()).toContain('Plugin updated'));
   });
 
+  it('FE-MOB-PLUGP-046a: an update this TREK cannot install is neither offered nor counted', async () => {
+    mockPanel(
+      [plugin({ source_repo: 'acme/gotify', version: '1.0.0' })],
+      [registryEntry({ latest: '2.0.0', latestCompatible: null, trek: '>=4.0.0', hostVersion: '3.3.0' })],
+    );
+    render(<MAdminPluginsPanel />);
+    await screen.findByText('Gotify');
+
+    expect(screen.queryByText(/updates available for your plugins/i)).not.toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: /update → v2\.0\.0/i })).not.toBeInTheDocument();
+  });
+
+  it('FE-MOB-PLUGP-046b: a newer version needing a newer TREK leaves a passive hint on the row', async () => {
+    mockPanel(
+      [plugin({ source_repo: 'acme/gotify', version: '1.0.0' })],
+      [registryEntry({ latest: '2.0.0', latestCompatible: null, trek: '>=4.0.0', hostVersion: '3.3.0' })],
+    );
+    render(<MAdminPluginsPanel />);
+
+    expect(await screen.findByText('v2.0.0 available — needs TREK >=4.0.0')).toBeInTheDocument();
+  });
+
+  it('FE-MOB-PLUGP-046f: a held plugin leaves the banner and offers Resume updates instead', async () => {
+    let resumed = false;
+    mockPanel(
+      [plugin({ source_repo: 'acme/gotify', version: '1.0.0', updateHold: true })],
+      [registryEntry({ latest: '2.0.0' })],
+    );
+    server.use(http.post('*/api/admin/plugins/trek-gotify/resume-updates', () => {
+      resumed = true;
+      return HttpResponse.json({ updateHold: false });
+    }));
+    render(<MAdminPluginsPanel />);
+    await screen.findByText('Gotify');
+
+    expect(screen.queryByText(/updates available for your plugins/i)).not.toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: /update → v2\.0\.0/i })).not.toBeInTheDocument();
+    expect(screen.getByText('Updates paused at v1.0.0')).toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole('button', { name: /resume updates/i }));
+    await waitFor(() => expect(resumed).toBe(true));
+  });
+
+  it('FE-MOB-PLUGP-046d: the detail sheet lists every version and installs the picked one', async () => {
+    const bodies: unknown[] = [];
+    mockPanel([], [registryEntry({ latest: '3.0.0', latestCompatible: '2.0.0', trek: '>=4.0.0', hostVersion: '3.3.0', compatible: false })]);
+    server.use(
+      http.get('*/api/admin/plugins/registry/trek-gotify', () => HttpResponse.json({
+        ...registryEntry({ latest: '3.0.0', latestCompatible: '2.0.0', trek: '>=4.0.0', hostVersion: '3.3.0', compatible: false }),
+        size: 1024, publishedAt: null, manifest: null,
+        versions: [
+          { version: '3.0.0', publishedAt: '2026-08-01', size: 2048, signed: true, trek: '>=4.0.0', compatible: false },
+          { version: '2.0.0', publishedAt: '2026-07-01', size: 1024, signed: true, trek: '>=3.0.0 <4.0.0', compatible: true },
+          { version: '1.5.0', publishedAt: '2026-06-01', size: 1000, signed: true, trek: '>=3.0.0 <4.0.0', compatible: true },
+        ],
+      })),
+      http.post('*/api/admin/plugins/install', async ({ request }) => {
+        bodies.push(await request.json());
+        return HttpResponse.json({ id: 'trek-gotify', version: '1.5.0' });
+      }),
+    );
+    render(<MAdminPluginsPanel />);
+    fireEvent.click(await screen.findByRole('tab', { name: /Discover/ }));
+    fireEvent.click(await screen.findByText('Acme'));
+
+    // The incompatible latest is explained, never offered.
+    expect(await screen.findByText(/^needs TREK >=4\.0\.0$/i)).toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: /^install 3\.0\.0$/i })).not.toBeInTheDocument();
+
+    fireEvent.click(await screen.findByRole('button', { name: /^install 1\.5\.0$/i }));
+    await waitFor(() => expect(bodies).toEqual([{ id: 'trek-gotify', version: '1.5.0' }]));
+  });
+
+  it('FE-MOB-PLUGP-046e: Change version rolls back through update, after an explicit data warning', async () => {
+    let body: unknown = null;
+    mockPanel(
+      [plugin({ source_repo: 'acme/gotify', version: '2.0.0' })],
+      [registryEntry()],
+    );
+    server.use(
+      http.get('*/api/admin/plugins/registry/trek-gotify', () => HttpResponse.json({
+        ...registryEntry(), size: 1024, publishedAt: null, manifest: null,
+        versions: [
+          { version: '2.0.0', publishedAt: '2026-07-01', size: 1024, signed: true, trek: '>=3.0.0 <4.0.0', compatible: true },
+          { version: '1.5.0', publishedAt: '2026-06-01', size: 1000, signed: true, trek: '>=3.0.0 <4.0.0', compatible: true },
+        ],
+      })),
+      http.post('*/api/admin/plugins/trek-gotify/update', async ({ request }) => {
+        body = await request.json();
+        return HttpResponse.json({ version: '1.5.0', activated: true, newPermissions: [], newEgress: [] });
+      }),
+    );
+    render(<MAdminPluginsPanel />);
+    fireEvent.click(await screen.findByTestId('plugin-row-menu-btn-trek-gotify'));
+    fireEvent.click(await screen.findByRole('button', { name: /change version/i }));
+
+    // The installed version is marked, not switchable.
+    const current = await screen.findByTestId('version-row-2.0.0');
+    expect(within(current).getByText('Installed')).toBeInTheDocument();
+
+    fireEvent.click(await screen.findByRole('button', { name: /^switch to 1\.5\.0$/i }));
+    expect(await screen.findByText(/data written by the newer version stays in place/i)).toBeInTheDocument();
+    fireEvent.click(screen.getByRole('button', { name: /roll back/i }));
+
+    await waitFor(() => expect(body).toEqual({ version: '1.5.0' }));
+  });
+
+  it('FE-MOB-PLUGP-046c: the update offer is the newest compatible version, not the absolute latest', async () => {
+    mockPanel(
+      [plugin({ source_repo: 'acme/gotify', version: '1.0.0' })],
+      [registryEntry({ latest: '3.0.0', latestCompatible: '2.0.0', trek: '>=4.0.0', hostVersion: '3.3.0' })],
+    );
+    render(<MAdminPluginsPanel />);
+
+    expect(await screen.findByText('1 updates available for your plugins.')).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: /update → v2\.0\.0/i })).toBeInTheDocument();
+  });
+
   it('FE-MOB-PLUGP-047: a per-row update that widens rights opens the consent sheet and approving activates with consent', async () => {
     let consentBody: unknown = null;
     mockPanel([plugin({ source_repo: 'acme/gotify', signed: true, version: '1.0.0' })], [registryEntry()]);
diff --git a/client/tests/unit/mobile/admin/MAdminStoragePanel.test.tsx b/client/tests/unit/mobile/admin/MAdminStoragePanel.test.tsx
index 12ffcda04..bc2b05dcb 100644
--- a/client/tests/unit/mobile/admin/MAdminStoragePanel.test.tsx
+++ b/client/tests/unit/mobile/admin/MAdminStoragePanel.test.tsx
@@ -329,8 +329,16 @@ describe('MAdminStoragePanel', () => {
     server.use(
       http.put('/api/admin/storage', () => HttpResponse.json(savedState)),
       http.post('/api/admin/storage/migrations', async ({ request }) => {
-        postCount += 1;
+        // Parse BEFORE counting, so postCount and migrationPosts move together.
+        // With the increment first, the await left a window where postCount was
+        // already 1 while migrationPosts was still empty — and the GET handler
+        // below reports `migrations: []` for an empty migrationPosts, i.e. "no
+        // migration running". A poll landing in that window told the queue it was
+        // free to dequeue the second candidate, and the `waitFor(postCount === 1)`
+        // further down could resolve inside it too. Rare locally, reliable under
+        // CI load, where the microtask gap is wider than the 50ms test poll.
         const body = (await request.json()) as { category: StorageCategory; to: string };
+        postCount += 1;
         migrationPosts.push(body);
         // Pins the single-flight fix: the second POST must never arrive
         // before the first migration is server-confirmed terminal — a
diff --git a/client/tests/unit/mobile/dashboard/MDashboard.test.tsx b/client/tests/unit/mobile/dashboard/MDashboard.test.tsx
index c5aced04f..d9f92cd18 100644
--- a/client/tests/unit/mobile/dashboard/MDashboard.test.tsx
+++ b/client/tests/unit/mobile/dashboard/MDashboard.test.tsx
@@ -25,10 +25,13 @@ vi.mock('../../../../src/components/Plugins/TripCardBadges', () => ({
   useTripCardBadges: () => (tripId: number) => mocks.badges[tripId] ?? [],
 }));
 
+// Local-calendar date string — NOT toISOString(), which is the UTC date and
+// disagrees with the badge logic's wall-clock classification between local
+// midnight and the UTC rollover (these tests flaked in exactly that window).
 const iso = (offsetDays: number): string => {
   const d = new Date();
   d.setDate(d.getDate() + offsetDays);
-  return d.toISOString().split('T')[0];
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
 };
 
 function buildTrip(over: Partial<DashboardTrip> = {}): DashboardTrip {
diff --git a/client/tests/unit/mobile/journey/MJourneyEntrySheet.test.tsx b/client/tests/unit/mobile/journey/MJourneyEntrySheet.test.tsx
index 361fde069..df2e18dd7 100644
--- a/client/tests/unit/mobile/journey/MJourneyEntrySheet.test.tsx
+++ b/client/tests/unit/mobile/journey/MJourneyEntrySheet.test.tsx
@@ -1,6 +1,7 @@
 import { StrictMode } from 'react';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { http, HttpResponse } from 'msw';
+import { localIsoDate } from '../../../../src/utils/localDate';
 import userEvent from '@testing-library/user-event';
 import { mapsApi, weatherApi } from '../../../../src/api/client';
 import { useAddonStore } from '../../../../src/store/addonStore';
@@ -326,8 +327,8 @@ describe('MJourneyEntrySheet full editor', () => {
     expect(screen.getByText('Mood')).toBeInTheDocument();
     expect(screen.getByText('Weather')).toBeInTheDocument();
     expect(screen.getByText('Tags')).toBeInTheDocument();
-    // An empty entry_date falls back to today, an empty gallery locks the picker.
-    expect(dateField().value).toBe(new Date().toISOString().split('T')[0]);
+    // An empty entry_date falls back to today (the LOCAL date), an empty gallery locks the picker.
+    expect(dateField().value).toBe(localIsoDate());
     expect(timeField()).toHaveValue('');
     expect(screen.getByRole('button', { name: 'From Gallery' })).toBeDisabled();
     expect(screen.getByRole('button', { name: 'Upload photos' })).toBeEnabled();
diff --git a/client/tests/unit/mobile/settings/MAirTrailConnectionSection.test.tsx b/client/tests/unit/mobile/settings/MAirTrailConnectionSection.test.tsx
index cd38dfb23..ef1d605a4 100644
--- a/client/tests/unit/mobile/settings/MAirTrailConnectionSection.test.tsx
+++ b/client/tests/unit/mobile/settings/MAirTrailConnectionSection.test.tsx
@@ -162,7 +162,7 @@ describe('MAirTrailConnectionSection', () => {
     renderSection();
 
     await user.click(await screen.findByRole('button', { name: /Save/ }));
-    await screen.findByText('Not connected');
+    expect(await screen.findByText('Not connected')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETAIR-010: a rejected save surfaces the server error message', async () => {
@@ -176,7 +176,7 @@ describe('MAirTrailConnectionSection', () => {
     renderSection();
 
     await user.click(await screen.findByRole('button', { name: /Save/ }));
-    await screen.findByText('Instance unreachable');
+    expect(await screen.findByText('Instance unreachable')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETAIR-011: a successful test reports the flight count and flips the badge', async () => {
@@ -214,6 +214,6 @@ describe('MAirTrailConnectionSection', () => {
     renderSection();
 
     await user.click(await screen.findByRole('button', { name: /Test connection/ }));
-    await screen.findByText('Connection failed');
+    expect(await screen.findByText('Connection failed')).toBeInTheDocument();
   });
 });
diff --git a/client/tests/unit/mobile/settings/MLlmConnectionSection.test.tsx b/client/tests/unit/mobile/settings/MLlmConnectionSection.test.tsx
index 056891da2..7a868666d 100644
--- a/client/tests/unit/mobile/settings/MLlmConnectionSection.test.tsx
+++ b/client/tests/unit/mobile/settings/MLlmConnectionSection.test.tsx
@@ -170,7 +170,7 @@ describe('MLlmConnectionSection', () => {
     renderSection();
 
     await user.click(screen.getByRole('button', { name: /Save/ }));
-    await screen.findByText('Could not save AI settings');
+    expect(await screen.findByText('Could not save AI settings')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETLLM-013: a stored local provider falls back to OpenAI without saving anything', () => {
diff --git a/client/tests/unit/mobile/settings/MSettingsAccount.test.tsx b/client/tests/unit/mobile/settings/MSettingsAccount.test.tsx
index 050bb281c..850e8400a 100644
--- a/client/tests/unit/mobile/settings/MSettingsAccount.test.tsx
+++ b/client/tests/unit/mobile/settings/MSettingsAccount.test.tsx
@@ -153,7 +153,7 @@ describe('MSettingsAccount – profile', () => {
 
     fireEvent.change(fileInput(), { target: { files: [new File(['x'], 'a.png', { type: 'image/png' })] } });
 
-    await screen.findByText('Upload failed');
+    expect(await screen.findByText('Upload failed')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-009: a change event without a file is ignored', () => {
@@ -191,7 +191,7 @@ describe('MSettingsAccount – profile', () => {
 
     await user.click(screen.getByRole('button', { name: 'Remove Profile Picture' }));
 
-    await screen.findByText('Removal failed');
+    expect(await screen.findByText('Removal failed')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-012: Save sends the edited fields through updateProfile', async () => {
@@ -230,7 +230,7 @@ describe('MSettingsAccount – profile', () => {
 
     await user.click(screen.getByRole('button', { name: 'Save' }));
 
-    await screen.findByText('Error');
+    expect(await screen.findByText('Error')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-013c: without a signed-in user both profile fields start empty', () => {
@@ -251,7 +251,7 @@ describe('MSettingsAccount – profile', () => {
 
     await user.click(screen.getByRole('button', { name: 'Save' }));
 
-    await screen.findByText('Email already taken');
+    expect(await screen.findByText('Email already taken')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-014: Save is disabled while the request is in flight', async () => {
@@ -291,7 +291,7 @@ describe('MSettingsAccount – password', () => {
 
     await user.click(screen.getByRole('button', { name: 'Update password' }));
 
-    await screen.findByText('Current password is required');
+    expect(await screen.findByText('Current password is required')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-018: an empty new password is rejected', async () => {
@@ -301,7 +301,7 @@ describe('MSettingsAccount – password', () => {
     await user.type(screen.getByPlaceholderText('Current password'), 'old-secret');
     await user.click(screen.getByRole('button', { name: 'Update password' }));
 
-    await screen.findByText('Please enter current and new password');
+    expect(await screen.findByText('Please enter current and new password')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-019: a new password below eight characters is rejected', async () => {
@@ -313,7 +313,7 @@ describe('MSettingsAccount – password', () => {
     await user.type(screen.getByPlaceholderText('Confirm new password'), 'short');
     await user.click(screen.getByRole('button', { name: 'Update password' }));
 
-    await screen.findByText('Password must be at least 8 characters');
+    expect(await screen.findByText('Password must be at least 8 characters')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-020: a mismatching confirmation is rejected', async () => {
@@ -325,7 +325,7 @@ describe('MSettingsAccount – password', () => {
     await user.type(screen.getByPlaceholderText('Confirm new password'), 'NewPassword2!');
     await user.click(screen.getByRole('button', { name: 'Update password' }));
 
-    await screen.findByText('Passwords do not match');
+    expect(await screen.findByText('Passwords do not match')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-021: a valid change hits the API and clears the three fields', async () => {
@@ -361,7 +361,7 @@ describe('MSettingsAccount – password', () => {
     await user.type(screen.getByPlaceholderText('Confirm new password'), 'NewPassword1!');
     await user.click(screen.getByRole('button', { name: 'Update password' }));
 
-    await screen.findByText('Wrong password');
+    expect(await screen.findByText('Wrong password')).toBeInTheDocument();
   });
 });
 
@@ -453,7 +453,7 @@ describe('MSettingsAccount – MFA', () => {
 
     await user.click(screen.getByRole('button', { name: 'Set up authenticator' }));
 
-    await screen.findByText('MFA is off');
+    expect(await screen.findByText('MFA is off')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-032: enabling stores the backup codes and renders them', async () => {
@@ -493,7 +493,7 @@ describe('MSettingsAccount – MFA', () => {
     await user.type(screen.getByPlaceholderText('6-digit code'), '123456');
     await user.click(screen.getByRole('button', { name: 'Enable 2FA' }));
 
-    await screen.findByText('Invalid code');
+    expect(await screen.findByText('Invalid code')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-035: the disable form needs both a password and a six-digit code', async () => {
@@ -547,7 +547,7 @@ describe('MSettingsAccount – MFA', () => {
     await user.type(screen.getByPlaceholderText('6-digit code'), '123456');
     await user.click(screen.getByRole('button', { name: 'Disable 2FA' }));
 
-    await screen.findByText('Code expired');
+    expect(await screen.findByText('Code expired')).toBeInTheDocument();
   });
 });
 
@@ -614,7 +614,7 @@ describe('MSettingsAccount – backup codes', () => {
 
     await user.click(await screen.findByRole('button', { name: 'Copy codes' }));
 
-    await screen.findByText('Error');
+    expect(await screen.findByText('Error')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-044: Download TXT builds a blob and revokes the object URL', async () => {
@@ -1020,7 +1020,7 @@ describe('MSettingsAccount – passkeys', () => {
     await user.type(within(row).getByDisplayValue('iPhone'), '2');
     await user.click(within(row).getByRole('button', { name: 'Save' }));
 
-    await screen.findByText('Name taken');
+    expect(await screen.findByText('Name taken')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-068: deleting asks for the password and removes the credential', async () => {
@@ -1068,7 +1068,7 @@ describe('MSettingsAccount – passkeys', () => {
     await user.type(within(box).getByPlaceholderText('Current password'), 'nope');
     await user.click(within(box).getByRole('button', { name: 'Delete' }));
 
-    await screen.findByText('Wrong password');
+    expect(await screen.findByText('Wrong password')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-070: cancelling the delete step-up closes the box', async () => {
@@ -1151,7 +1151,7 @@ describe('MSettingsAccount – passkeys', () => {
     await user.type(within(form).getByPlaceholderText('Current password'), 'my-password');
     await user.click(within(form).getByRole('button', { name: 'Add a passkey' }));
 
-    await screen.findByText('Passkey setup cancelled');
+    expect(await screen.findByText('Passkey setup cancelled')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETACC-073: a rejected password step-up shows the server message', async () => {
diff --git a/client/tests/unit/mobile/settings/MSettingsAppearance.test.tsx b/client/tests/unit/mobile/settings/MSettingsAppearance.test.tsx
index bb39734d0..add74896b 100644
--- a/client/tests/unit/mobile/settings/MSettingsAppearance.test.tsx
+++ b/client/tests/unit/mobile/settings/MSettingsAppearance.test.tsx
@@ -110,7 +110,7 @@ describe('MSettingsAppearance', () => {
     renderAppearance();
 
     await user.click(screen.getByRole('button', { name: 'Dark' }));
-    await screen.findByText('Server down');
+    expect(await screen.findByText('Server down')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETAPP-006: choosing a scheme applies it to the DOM and persists it debounced', async () => {
@@ -146,7 +146,7 @@ describe('MSettingsAppearance', () => {
     renderAppearance();
 
     await user.click(screen.getByRole('button', { name: 'Amber' }));
-    await screen.findByText('Blob too large');
+    expect(await screen.findByText('Blob too large')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETAPP-009: the custom scheme reveals the accent presets and the contrast badge', async () => {
diff --git a/client/tests/unit/mobile/settings/MSettingsGeneral.test.tsx b/client/tests/unit/mobile/settings/MSettingsGeneral.test.tsx
index d7fed651b..d1a7a99ed 100644
--- a/client/tests/unit/mobile/settings/MSettingsGeneral.test.tsx
+++ b/client/tests/unit/mobile/settings/MSettingsGeneral.test.tsx
@@ -142,7 +142,7 @@ describe('MSettingsGeneral', () => {
     render(<><ToastContainer /><MSettingsGeneral /></>);
 
     await user.click(screen.getByRole('button', { name: '°F Fahrenheit' }));
-    await screen.findByText('Error saving setting');
+    expect(await screen.findByText('Error saving setting')).toBeInTheDocument();
   });
 
   it('FE-MOB-SET-011: a non-Error rejection falls back to the generic message', async () => {
@@ -154,7 +154,7 @@ describe('MSettingsGeneral', () => {
     render(<><ToastContainer /><MSettingsGeneral /></>);
 
     await user.click(screen.getByRole('button', { name: '°F Fahrenheit' }));
-    await screen.findByText('Error');
+    expect(await screen.findByText('Error')).toBeInTheDocument();
   });
 
   it('FE-MOB-SET-012: the startup card defaults to the dashboard and hides the tab row', () => {
diff --git a/client/tests/unit/mobile/settings/MSettingsPlugins.test.tsx b/client/tests/unit/mobile/settings/MSettingsPlugins.test.tsx
index b58f62d2c..c1e871d79 100644
--- a/client/tests/unit/mobile/settings/MSettingsPlugins.test.tsx
+++ b/client/tests/unit/mobile/settings/MSettingsPlugins.test.tsx
@@ -123,7 +123,7 @@ describe('MSettingsPlugins', () => {
     server.use(http.get('/api/plugin-activity', () => HttpResponse.json({}, { status: 500 })));
     renderScreen();
 
-    await screen.findByText('No plugin activity yet.');
+    expect(await screen.findByText('No plugin activity yet.')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETPLG-005: declared user fields render as the matching mobile controls', async () => {
@@ -296,7 +296,7 @@ describe('MSettingsPlugins', () => {
     await screen.findByText('Success');
 
     await user.click(screen.getByRole('button', { name: 'Probe' }));
-    await screen.findByText('Error');
+    expect(await screen.findByText('Error')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETPLG-014: unlabelled fields fall back to their key, hints render below', async () => {
@@ -335,7 +335,7 @@ describe('MSettingsPlugins', () => {
 
     await screen.findByText('Actions');
     await user.click(screen.getByRole('button', { name: 'Test connection' }));
-    await screen.findByText('Error');
+    expect(await screen.findByText('Error')).toBeInTheDocument();
   });
 
   it('FE-MOB-SETPLG-016: a danger action asks for confirmation before it runs', async () => {
diff --git a/client/tests/unit/mobile/trip/MFileLightbox.test.tsx b/client/tests/unit/mobile/trip/MFileLightbox.test.tsx
index 35a000fb3..654c0ba50 100644
--- a/client/tests/unit/mobile/trip/MFileLightbox.test.tsx
+++ b/client/tests/unit/mobile/trip/MFileLightbox.test.tsx
@@ -151,7 +151,9 @@ describe('MFileLightbox', () => {
     const img = await screen.findByAltText('beach.jpg')
     fireEvent.click(img)
     expect(onClose).not.toHaveBeenCalled()
-    fireEvent.click(img.parentElement as HTMLElement)
+    // The picture now sits in a wrapper that swallows the tap for it — the
+    // <img> itself carries no handler — so the empty area is one level up.
+    fireEvent.click(img.parentElement?.parentElement as HTMLElement)
     expect(onClose).toHaveBeenCalledTimes(1)
   })
 
diff --git a/client/tests/unit/mobile/trip/MPlaceSheet.test.tsx b/client/tests/unit/mobile/trip/MPlaceSheet.test.tsx
index 37e736525..f230f504c 100644
--- a/client/tests/unit/mobile/trip/MPlaceSheet.test.tsx
+++ b/client/tests/unit/mobile/trip/MPlaceSheet.test.tsx
@@ -297,7 +297,9 @@ describe('MPlaceSheet', () => {
     const planner = makePlanner({ files: [] })
     renderSheet(planner)
     expect(screen.getByText('Files')).toBeInTheDocument()
-    fireEvent.click(screen.getByRole('button', { name: /Upload/ }))
+    // The files row itself is a button now (it expands the list), so match the
+    // upload control by its exact name rather than a substring.
+    fireEvent.click(screen.getByRole('button', { name: 'Upload' }))
 
     const input = document.querySelector('input[type="file"][multiple]') as HTMLInputElement
     selectFiles(input, [new File(['a'], 'a.pdf'), new File(['b'], 'b.pdf')])
diff --git a/client/tests/unit/remoteEventHandler/budget.test.ts b/client/tests/unit/remoteEventHandler/budget.test.ts
index d1aa1ebbf..c6a2b965a 100644
--- a/client/tests/unit/remoteEventHandler/budget.test.ts
+++ b/client/tests/unit/remoteEventHandler/budget.test.ts
@@ -80,12 +80,15 @@ describe('remoteEventHandler > budget', () => {
       type: 'budget:member-paid-updated',
       itemId: 1,
       userId: 5,
-      paid: true,
+      // 1, not true: both emitters send `paid: body.paid ? 1 : 0`, and the handler
+      // stores the value verbatim. Asserting on `true` tested a payload the server
+      // never sends — the seeded value on the line below is a number for the same reason.
+      paid: 1,
     });
     const { budgetItems } = useTripStore.getState();
     const item = budgetItems.find(i => i.id === 1);
     const m = item?.members?.find(m => m.user_id === 5);
-    expect(m?.paid).toBe(true);
+    expect(m?.paid).toBe(1);
     // Other item members unchanged (member2 keeps its seeded paid value)
     const item2 = budgetItems.find(i => i.id === 2);
     expect(item2?.members?.[0].paid).toBe(1);
diff --git a/client/tests/unit/slices/budgetSlice.test.ts b/client/tests/unit/slices/budgetSlice.test.ts
index 3b428d1b4..2b1a7d2cb 100644
--- a/client/tests/unit/slices/budgetSlice.test.ts
+++ b/client/tests/unit/slices/budgetSlice.test.ts
@@ -170,7 +170,7 @@ describe('budgetSlice', () => {
 
       const updatedItem = useTripStore.getState().budgetItems.find(i => i.id === 10);
       const updatedMember = updatedItem?.members.find(m => m.user_id === 5);
-      expect(updatedMember?.paid).toBe(true);
+      expect(updatedMember?.paid).toBe(1);
     });
   });
 });
diff --git a/client/tests/unit/slices/filesSlice.test.ts b/client/tests/unit/slices/filesSlice.test.ts
index 7f5adc8c5..dce431680 100644
--- a/client/tests/unit/slices/filesSlice.test.ts
+++ b/client/tests/unit/slices/filesSlice.test.ts
@@ -41,14 +41,21 @@ describe('filesSlice', () => {
     });
 
     it('FE-FILES-002: loadFiles silently catches errors', async () => {
+      const existing = buildTripFile({ trip_id: 1, filename: 'existing.pdf' });
+      seedStore(useTripStore, { files: [existing] });
+
       server.use(
         http.get('/api/trips/1/files', () =>
           HttpResponse.json({ message: 'Error' }, { status: 500 })
         ),
       );
 
-      // Should not throw
-      await useTripStore.getState().loadFiles(1);
+      // Swallows the failure instead of rejecting, and leaves the list alone
+      await expect(useTripStore.getState().loadFiles(1)).resolves.toBeUndefined();
+
+      const files = useTripStore.getState().files;
+      expect(files).toHaveLength(1);
+      expect(files[0].filename).toBe('existing.pdf');
     });
   });
 
diff --git a/client/vitest.config.ts b/client/vitest.config.ts
index ff51c5f5e..8c9dc4ae6 100644
--- a/client/vitest.config.ts
+++ b/client/vitest.config.ts
@@ -22,7 +22,11 @@ export default defineConfig({
       reporter: ['lcov', 'text'],
       reportsDirectory: './coverage',
       include: ['src/**/*.{ts,tsx}'],
-      exclude: ['src/main.tsx', 'src/vite-env.d.ts'],
+      // All .d.ts, not just vite-env: declaration files carry no executable
+      // code, and their lcov entries can't resolve on the Sonar side (its
+      // **/*.d.ts exclusion removes them from analysis), which surfaced as
+      // "Could not resolve 2 file paths" warnings in every scan.
+      exclude: ['src/main.tsx', 'src/**/*.d.ts'],
       // Without these the Client Tests job produced a report, uploaded it and
       // passed no matter what the number was — which is how coverage drifted
       // down to ~48% unnoticed. 85 across the board is the floor we do not want
diff --git a/docker-compose.yml b/docker-compose.yml
index 1e5ee4d53..4b414c180 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -53,7 +53,7 @@ services:
     volumes:
       - ./data:/app/data
       - ./uploads:/app/uploads
-#      - ./storage-config.json:/app/data/storage-config.json:ro # optional seed-once storage provisioning (README → Storage)
+#      - ./storage-config.json:/app/data/storage-config.json:ro # optional seed-once storage provisioning (wiki: Admin-Storage)
     restart: unless-stopped
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
diff --git a/package-lock.json b/package-lock.json
index bd22295da..5613dc550 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -23160,6 +23160,7 @@
       "devDependencies": {
         "@eslint/js": "^10.0.1",
         "@trivago/prettier-plugin-sort-imports": "^6.0.2",
+        "@vitest/coverage-v8": "^4.1.9",
         "eslint": "^10.3.0",
         "eslint-config-flat-gitignore": "^2.3.0",
         "eslint-config-prettier": "^10.1.8",
diff --git a/package.json b/package.json
index 2ec6b820e..6edfff3c9 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,7 @@
     "dev": "npm run build --workspace=shared && concurrently --names shared,server,client \"npm run build:watch --workspace=shared\" \"npm run dev --workspace=server\" \"npm run dev --workspace=client\"",
     "build": "npm run build --workspace=shared && npm run build --workspace=server && npm run build --workspace=client",
     "test": "npm run test --workspace=shared && npm run test --workspace=server && npm run test --workspace=client",
-    "test:cov": "npm run test:coverage --workspace=server && npm run test:coverage --workspace=client",
+    "test:cov": "npm run test:coverage --workspace=shared && npm run test:coverage --workspace=server && npm run test:coverage --workspace=client && npm run test:coverage --prefix plugin-sdk",
     "test:e2e": "npm run test:e2e --workspace=server",
     "lint": "npm run lint --workspace=shared && npm run lint --workspace=server && npm run lint --workspace=client",
     "format": "npm run format --workspace=shared && npm run format --workspace=server && npm run format --workspace=client",
diff --git a/plugin-sdk/CLAUDE.md b/plugin-sdk/CLAUDE.md
new file mode 100644
index 000000000..257c2599d
--- /dev/null
+++ b/plugin-sdk/CLAUDE.md
@@ -0,0 +1,59 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this package is
+
+`trek-plugin-sdk` — the author-facing SDK and CLI for building TREK plugins. It lives inside the TREK monorepo but is **not one of the root npm workspaces**: it has its own `package-lock.json`, is versioned and published to npm independently, and must ship standalone (a published copy has no access to the rest of the repo). Run all commands from `plugin-sdk/`, not the repo root. The repo root's CLAUDE.md covers the main app; its conventions (target `dev` branch, conventional commits) still apply.
+
+It ships three bins from one codebase: `trek-plugin-sdk` / `trek-plugin` (same entry, `src/cli/trek-plugin.ts`) and `create-trek-plugin` (`src/cli/create.ts`).
+
+## Commands
+
+```bash
+npm install
+npm run build        # tsc ESM build + tsc CJS build + scripts/finish-cjs.mjs
+npm run typecheck    # tsc --noEmit
+npm test             # vitest run
+npx vitest run test/sdk.test.ts        # single test file
+npx vitest run -t "name of the test"   # by test-name pattern
+node scripts/gen-lucide-icon-names.mjs # regenerate src/lucide-icon-names.ts (uses repo-root lucide-react)
+```
+
+Node >= 18. The package is `"type": "module"`; the dual build emits ESM to `dist/` and CJS to `dist/cjs/` (finish-cjs.mjs writes the `{"type":"commonjs"}` scope marker there — without it Node parses the CJS output as ESM).
+
+## The load-bearing principle: mirrored host code + parity tests
+
+The SDK's core promise is that local results equal host/registry results: `dev` enforces what a real TREK enforces, and `validate` passes iff the TREK-Plugins registry CI passes. A drift in the lenient direction is the worst bug in this package — a **false green** lets an author cut an effectively immutable GitHub release (the registry pins its sha256) that the registry then rejects.
+
+Because the package ships standalone, it cannot import server code, so several files are deliberate **copies** of host sources, each guarded by a parity test that reads the original source directly. These tests skip outside the monorepo, but in this checkout they run — keep the pairs in sync when touching either side:
+
+| SDK copy | Source of truth | Parity test |
+|---|---|---|
+| `src/permissions.ts` (`HOOK_PERMISSION`) | `server/src/nest/plugins/protocol/envelope.ts` via `server/scripts/gen-plugin-facts.ts` | `test/permissions-parity.test.ts` |
+| `src/egress-policy.ts` (pure helpers, kept **byte-identical**) | `server/src/nest/plugins/runtime/egress-policy.ts` | `test/permissions-parity.test.ts` |
+| `src/manifest.ts` (validation rules, `KNOWN_ADDONS`) | server plugin loader / `server/src/addons.ts` | — kept in sync by hand |
+| `src/cli/checks/*` (registry gates) | TREK-Plugins registry repo (`scripts/validate-entry.mjs`, `check-readme.mjs`) | `test/checks-parity.test.ts` (runs the registry's real script; set `TREK_PLUGINS_REPO` to point at a checkout) |
+| `src/zip.ts` (ZIP writer) | server `safe-extract.ts` reader | format is frozen against the reader |
+
+`src/permissions.ts` also documents a subtlety worth preserving: ctx methods fail loudly at call time, but hooks/events/jobs are gated *before* the plugin is reached and fail **silently** in production — so the dev server and mock host deliberately make those failures loud (an ungranted `run(def).hook(...)` throws).
+
+**Direction: single-source the contract.** The protocol core — permissions, RPC methods, hooks, the event catalog — is already single-sourced: `src/generated/host-facts.ts` is **machine-written** by `server/scripts/gen-plugin-facts.ts` from `server/src/nest/plugins/protocol/envelope.ts` (never hand-edit it; the server's `check:plugin-facts` CI gate catches drift). The remaining hand-kept copies (egress-policy, manifest rules, registry gates, the ZIP writer) are the residual risk, and the `skipIf(!inMonorepo)` escape hatch means the published SDK's own CI can green-light drift in those — so keep moving copies into the generated/parity-tested set, never away from it. Until then: changing an egress rule, manifest rule, or registry gate means touching **every** copy in one change; parity gates fail closed, never leniently; and version/compat checks fail **closed** on unknown host versions rather than assuming compatibility.
+
+## Architecture
+
+- **`src/index.ts`** — the plugin API surface: all types, `definePlugin`, `PLUGIN_API_VERSION` (bump on any breaking API change). Pure and dependency-free; it mirrors exactly what TREK's isolated plugin runtime injects. Runtime deps for the whole package are only `@clack/prompts`, `semver`, `update-notifier` — keep it that way (e.g. Playwright for `shot` is intentionally the author's devDependency, and the ZIP writer is in-tree instead of a dependency).
+- **Two package exports**: `.` (the SDK) and `./testing` (`src/mock-host.ts`) — a mock `PluginContext` + driver enforcing the same permission model against configured fixtures.
+- **`src/cli/`** — one file per command, dispatched by `trek-plugin.ts`; `menu.ts` is the no-command guided menu. Interactive TTY sessions get prompts; non-TTY (CI, pipes) stays flag-driven — machine output (`entry` JSON, `pack --json`, PR URLs) goes to stdout, notices to stderr.
+- **`src/cli/checks/`** — one check registry, two depths: `runOffline` (synchronous on purpose, so `packPluginDir` can validate before zipping without going async) and `runAll` (adds the GitHub-dependent gates used by `preflight`/`publish`). Printing lives in `report.ts`: `status` renders the checklist and never exits non-zero; `validate` is the same checks with an exit code.
+- **`src/ui/kit.ts`** — the design kit (`TREK_UI_CSS`, `TREK_THEME_JS`) as plain strings, inlined into a plugin's `client/index.html` where the `<!-- trek:ui -->` marker sits (`dev`/`pack` expand it; the opaque-origin iframe CSP forbids external link/script). Not a security boundary.
+- **`src/lucide-icon-names.ts`** — generated snapshot (see command above); an unknown icon is a validate **warning**, never an error.
+- **`test/helpers.ts`** — `makePublishable(dir)` turns a fresh scaffold into a registry-passing plugin (README with per-permission lines, ≥400 prose chars, screenshot); the scaffold deliberately fails publish gates, so tests choose "fresh" vs "publishable" explicitly.
+- **`examples/`** — complete example plugins (`trip-doctor`, `koffi`).
+
+## Behavioral contracts to not break
+
+- `status` never exits non-zero; `validate` is the enforcing form.
+- `publish` order is check → pack → release → preflight → submit, and a check failure must stop anything from being tagged/released (releases are immutable in practice).
+- Signed → unsigned is refused forever; unsigned → signed is always allowed.
+- Update notices (update-notifier) print to stderr only and are silent in CI/`NODE_ENV=test`/non-TTY, so JSON output stays pipeable.
diff --git a/plugin-sdk/README.md b/plugin-sdk/README.md
index 222cd163c..cefa007e4 100644
--- a/plugin-sdk/README.md
+++ b/plugin-sdk/README.md
@@ -140,6 +140,54 @@ const { ctx, broadcasts } = createMockHost({
 // degrades gracefully when a permission is missing.
 ```
 
+## Runtime limits
+
+The host enforces these limits on every ctx call and hook invocation. They are generous
+for a legitimate plugin and only bite a runaway or abusive one — build against them so
+`dev`/`mock-host` behavior matches production.
+
+| Area | Limit |
+|---|---|
+| `ctx.ai` | 200 calls/day per plugin (UTC midnight rollover); past it throws `"daily AI budget exhausted (resets at UTC midnight)"` |
+| `ctx.notify` | 100 calls/day per plugin (UTC midnight rollover); past it throws `"daily notification budget exhausted (resets at UTC midnight)"` |
+| RPC (every `ctx.*` call) | burst 60, sustained 20/s, 16 in-flight per plugin; a throttled call is refused with `HOST_ERROR: rate limit exceeded — slow down ctx.* calls` |
+| `ctx.db` (your own sqlite) | 256 MB per plugin |
+| `ctx.meta` | 64 KB per value, 256 chars per key, 100 keys per (plugin, entity) |
+| Plugin process | 300 MB RSS ceiling; auto-disabled after 5 crashes in 5 minutes |
+| Event redelivery buffer | 200 events held per plugin, dropped unreplayed after 15 minutes |
+
+Hook contribution caps (declarative content the host renders — a slow/failing call is
+skipped, never fatal):
+
+| Hook | Cap |
+|---|---|
+| `pdfSectionProvider` | ≤5 sections per provider |
+| `atlasLayerProvider` | ≤3 layers per provider |
+| `mapMarkerProvider` | ≤200 markers per provider |
+| `warningProvider` | ≤20 warnings per provider, each message ≤300 chars |
+| `placeDetailProvider` | ≤12 items per provider |
+| `photoProvider` | ≤60 photos per page |
+| `calendarSource` | ≤500 events per source per request |
+| `tableContributor` | ≤20 columns / ≤10 actions per entity |
+| `tripCardProvider` | ≤4 badges per trip, ≤240 total per provider |
+
+## OAuth broker
+
+`ctx.oauth.getAccessToken()` is host-brokered outbound OAuth: the plugin never becomes a
+direct OAuth client. The host runs the whole flow (authorize → callback → token exchange
+→ refresh) with PKCE and a 10-minute state TTL, and holds the refresh token + client
+secret — a plugin only ever sees a short-lived access token for the ACTING USER, or
+`null` when they haven't connected (or in a userless context).
+
+Provider config is the plugin's admin-owned INSTANCE settings — declare `scope:'instance'`
+manifest fields named `oauth_authorize_url`, `oauth_token_url`, `oauth_scopes` (optional),
+`oauth_client_id`, `oauth_client_secret`, and the admin fills them in from Settings →
+Plugins → Connect. Both endpoint URLs must be `https` and may not point at loopback,
+`.local`/`.internal` names, or private/metadata addresses — the host refuses to start a
+flow against them. The host exposes
+`/api/plugin-oauth/:id/status|connect|callback|disconnect` to drive the connect UI;
+plugin code itself only ever calls `getAccessToken()`.
+
 ## Capture the screenshot
 
 The registry requires a screenshot that resolves to a real image, and the store card
@@ -180,7 +228,28 @@ Needs `git` and an authenticated `gh`. It prints the PR URL at the end.
 
 **Updating** a listed plugin: bump `version` in the manifest, commit, and run
 `publish` again with the new tag — it detects the existing entry and prepends the
-new version, newest-first.
+new version, newest-first. Your TREK-Plugins fork is fast-forwarded automatically
+before the PR branch is cut, so a fork left behind doesn't break the submit (a
+*diverged* fork gets a warning and the `gh repo sync --force` command to fix it).
+
+### When a publish fails
+
+A failure **after** the release is cut (a preflight or PR problem) rolls back
+exactly what that run created — the GitHub release, the pushed tag, the local
+tag — so the same tag is free to re-run against once you've fixed the problem.
+Nothing that existed before the run is ever touched. Pass `--keep-release` to
+keep the release instead; the error then prints the manual cleanup commands.
+
+Two related conveniences:
+
+- A leftover tag from an earlier failed run (it has no release and doesn't point
+  at `HEAD`) is recognised as debris and **moved to your current commit** instead
+  of silently releasing the stale one.
+- `trek-plugin unrelease <vX.Y.Z> --repo you/repo` deletes a stranded release +
+  remote tag + local tag in one go. It checks the published registry index first
+  and **refuses to touch a version that is actually published** — those artifacts
+  are immutable (the registry pins their sha256), so the only way forward there is
+  a new version.
 
 Prefer to drive the steps yourself? They still exist individually — `pack`,
 `release` (pack → GitHub release → entry), `preflight`, `submit` (opens the PR),
@@ -199,7 +268,10 @@ It is a one-way door you may walk through **late**:
 
 - Unsigned throughout is fine — the sha256 pin is the only guarantee, and TREK accepts it.
 - **Unsigned → signed later breaks nobody.** Nothing is pinned until a signed version
-  installs, so adding a key at v1.4.0 is a real option, not a lost cause.
+  installs, so adding a key at v1.4.0 is a real option, not a lost cause. The registry
+  does require every version signed once your key appears in the entry — your first
+  signed update **retro-signs the older versions for you** (each pinned artifact is
+  downloaded, verified against its sha256, and signed with the same key).
 - **Signed → unsigned is refused forever**, on every instance that already has the plugin.
   `publish` refuses that at step 1, before anything is tagged or released.
 
@@ -242,6 +314,7 @@ bin if you install the package). `trek-plugin help <command>` — or
 - `preflight [dir] --repo o/n --tag vX [--entry f] [--all]` — the registry checks that need the network: the tag resolves to the pinned commit, the released artifact downloads and hashes, the id is not bound to another owner, and an update does not drop or rotate a published signing key.
 - `submit [dir] --repo o/n --tag vX [--registry o/n] [--draft]` — open the registry PR for you.
 - `release [dir] --repo o/n --tag vX [--sign [key]] [--merge f]` — pack → GitHub release → entry, without opening the PR.
+- `unrelease <vX.Y.Z> [dir] --repo o/n [--yes]` — delete a stranded release + remote tag + local tag. Refuses a version that is published in the registry (immutable); `--yes` consents when the registry index can't be checked.
 
 ## Update notice
 
diff --git a/plugin-sdk/package-lock.json b/plugin-sdk/package-lock.json
index d9aac5e6f..5642370e9 100644
--- a/plugin-sdk/package-lock.json
+++ b/plugin-sdk/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "trek-plugin-sdk",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "trek-plugin-sdk",
-      "version": "1.5.0",
+      "version": "1.6.0",
       "license": "MIT",
       "dependencies": {
         "@clack/prompts": "^1.7.0",
@@ -22,6 +22,7 @@
         "@types/node": "^22.20.0",
         "@types/semver": "^7.7.1",
         "@types/update-notifier": "^6.0.8",
+        "@vitest/coverage-v8": "^4.1.9",
         "typescript": "^5.9.3",
         "vitest": "^4.1.9"
       },
@@ -29,6 +30,66 @@
         "node": ">=18"
       }
     },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
+      "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.29.8"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@bcoe/v8-coverage": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-1.0.2.tgz",
+      "integrity": "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@clack/core": {
       "version": "1.4.3",
       "resolved": "https://registry.npmjs.org/@clack/core/-/core-1.4.3.tgz",
@@ -57,38 +118,14 @@
         "node": ">= 20.12.0"
       }
     },
-    "node_modules/@emnapi/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/wasi-threads": "1.2.2",
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@emnapi/runtime": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
-      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
-      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/@jridgewell/sourcemap-codec": {
@@ -98,29 +135,21 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz",
-      "integrity": "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==",
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "@tybys/wasm-util": "^0.10.3"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
-      },
-      "peerDependencies": {
-        "@emnapi/core": "^1.7.1",
-        "@emnapi/runtime": "^1.7.1"
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
     "node_modules/@oxc-project/types": {
-      "version": "0.138.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.138.0.tgz",
-      "integrity": "sha512-1a7ZKmrRTCoN1XMZ4L0PyyqrMnrNlLyPuOkdSX2MZg7IiIGRUyurNhAm73ptDOraoBcIordsIGKNPKUzy3ZmfA==",
+      "version": "0.146.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.146.0.tgz",
+      "integrity": "sha512-XC0QsnnhVe7sLIWmYmdPw7x5P0h4W8vUU3Nv1ySgWXtvCz8NizoAEpGXA0sOYoJQV2Rl13LgURAHQ5cI5ILCSA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -168,10 +197,27 @@
         "node": ">=12"
       }
     },
+    "node_modules/@rolldown/binding-android-arm-eabi": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.5.tgz",
+      "integrity": "sha512-DLe/i+l8ynIBY7XEQ191TeZvCoowIGa18R+dIV30GW7DiOtp74i/xX8hs8GUjW5ARV7VZuie3d6AumSmCwbeRA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.4.tgz",
-      "integrity": "sha512-EZLpf/8y7GXkkra90ML47kzik/GMP3EMcE9bPyHmRfxLC6z9+aW5A8poCsoxjrT5GfEcNAAvWwUHjvP1pUQkfw==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.5.tgz",
+      "integrity": "sha512-zXcwKlQApYAOELHd8PwKDFkagYF9Wy4e0RJ+0qnzl9Pjnpj75TEG8ufv40p2J7kCEfwZAsNiuzRIyNNMWT38ig==",
       "cpu": [
         "arm64"
       ],
@@ -186,9 +232,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.4.tgz",
-      "integrity": "sha512-aUi+HBvmYb7j8krl1+qJgkG8C17fO79gk3c+jPw4S8glRFc1DTija9S3EyaTSQUm5GJXYKDAsugBEhFHH2vYiQ==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.5.tgz",
+      "integrity": "sha512-dK4QakI42nzWgJT5sm4y4y/O//D4OxM75/cH28RLV+nzIN9AY+YsbuUVrUTjlLjXR6vpyxFbSsbmNuJ6BP9sww==",
       "cpu": [
         "arm64"
       ],
@@ -203,9 +249,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.4.tgz",
-      "integrity": "sha512-F7hHC3gwY11+vByKPRWqwGbeXWVgKmL+pTGCinaEhdihzBV2aQ0fvZOch9cXYUOKuKKq429HeYXOqQLc7wFCEg==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.5.tgz",
+      "integrity": "sha512-fqSALaUu1Wjd1nK2uW2kJDWdLCc8lx1IcY+MTY26Aurfdx19anlzhqXOgCFbBFQnlFDTn4TC1/7Nz4Bl2mLP3A==",
       "cpu": [
         "x64"
       ],
@@ -220,9 +266,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.4.tgz",
-      "integrity": "sha512-sI5yw+7s92SK6odiEhD5lKCBlWcpjHS5qyqpVQbZAJ0fIzEUXrmbl3DH2ybR3PZogulNJF+COLtmA8hUfvkCCQ==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.5.tgz",
+      "integrity": "sha512-/vCnNxlkxs9tKxNDcyWUePpJ/PgTzxIaVhoM5SmG8UV+GR/IcPam4VYxi7GIMo7PSDuNqlJqvprqii9NqqVCMw==",
       "cpu": [
         "x64"
       ],
@@ -237,9 +283,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.4.tgz",
-      "integrity": "sha512-mCi0OKgEieFircrtVYmQAFGszRtMnZ6fpZAXrxanXAu7lqZcsK1E1RAaZNG0uKAnxox3B1f4EyQNnoyMfN1vAA==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.5.tgz",
+      "integrity": "sha512-abk0NLA519LxRCszmbE0jYKuQ9YPocOXTiOXOo6Yr+YAT95VH+PtqYAjOJvGKt3viEd/x4qzabAlwd5bHOOARg==",
       "cpu": [
         "arm"
       ],
@@ -254,13 +300,16 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.4.tgz",
-      "integrity": "sha512-B9Ial3Kv5sh0SHnB1g/QWcUQCEvCF6QKGAl4zXypYj65mVI+B4AhFBwPtSN7pDrJeIx8Z7zdy4ntx+wQABom7w==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.5.tgz",
+      "integrity": "sha512-Y7eALiJ8lr0M2HH103Js+g7V34wf6snlpZLAsHI90uLhr3PVlNsbFVAXJC9d/V6BnPyKtpSwI+NcB/RLxsQxuA==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -271,13 +320,16 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.4.tgz",
-      "integrity": "sha512-lZVym0PuHE1KZ22gmFTC15lAkrg9iTszR617oYRB/iPY1A56ywoJzVKOJBKaot5RiikCObmur6pogpse3gRcng==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.5.tgz",
+      "integrity": "sha512-xMvZgnbZg4YVnR/AX2b3oOPDTFYJvUVaJg5FedA/LuvexAtXibZQej4cnTkw3rjsJ/ggUROB64TdtETiim+FYA==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -288,13 +340,16 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.4.tgz",
-      "integrity": "sha512-t2DNiLJWNTbnEHyUzTumldML6ET4/g16467LZoDDJ3tSxGvguL5/NyC2lCsNKuyRycg9XeDQF5SSv+TNOhQEXg==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.5.tgz",
+      "integrity": "sha512-GRjeqTUDHTo5GwntsLaAMcBahG3nlpjftXWZLN73HiYQlhwEowvarFgQnRnQZtIp4keXX7quXFbG38uPZBa2EA==",
       "cpu": [
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -305,13 +360,16 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.4.tgz",
-      "integrity": "sha512-0WIRnL1Uw4BvTZRLQt+PVgo6ZKTJadlC2btP+/EOXv2f/DWbY0rEgl+y834mIVwP1FkTlWVTrGGJXf12lru7EQ==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.5.tgz",
+      "integrity": "sha512-vLNTR45F2Uwc8AufkNXPmB4VliaXs+FvcheEogIzOXzO4l+LzieXF5A/TWxLy5HtqpsRCHUfd0lPVrrdgXdLHQ==",
       "cpu": [
         "s390x"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -322,13 +380,16 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.4.tgz",
-      "integrity": "sha512-JWtGshGfX+oENAKonoNkqEJX+7hC8yfhi9GUyPX1VX4mdh1y5r+ZiJLR5XzAB0aoP6s/PcILsGjKq8O0mm24bw==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.5.tgz",
+      "integrity": "sha512-Mgj59/HTuYeK9Gz2MA+mBWKnHsAgkBSec15ZMb1st3oIfFbX7gCjOae7GydHhzcyQi9Z/7M1QuN9bR3oFqF0jQ==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -339,13 +400,16 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.4.tgz",
-      "integrity": "sha512-rT6yQcxUuXs4CnbofqwHRRV0iem349rLMYpTjkgQGLjrY4ado/eDzwPZPTCgTOlF6Nkp8NEv70yLMTn6qkWxsQ==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.5.tgz",
+      "integrity": "sha512-mY8AP0/ichsbhAxGnLa3d3+MwV0EfgrPND2bplI3Ym8T6R2pJ0N87bvrKVwNXmdy3jnr6eQBecdqx/HMknBmpA==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -356,9 +420,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.4.tgz",
-      "integrity": "sha512-KXMGoboq5cyaCQjDA4GLuRiOwBQ0EyFnJoVViLeZ45/3rFItRODEr+NdsBcVpll40hhNArlm/speWGRvj08LzA==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.5.tgz",
+      "integrity": "sha512-8SLssA2oweAxyRgDp789ACfRb/3P+zNRJpzZxSizxF9m8NUDQ4+3xjo8ttjhVGGw6Qxb70oZiEtIjaKikCO7Yw==",
       "cpu": [
         "arm64"
       ],
@@ -372,29 +436,10 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.4.tgz",
-      "integrity": "sha512-5K83rb36oJiY7BCyE9zLZtGcPV4g5wvq+xwdO0XPIwDVZI8cyB/AUjkNXGb92/rnmezEkjMOpgY61rtwjQtFwg==",
-      "cpu": [
-        "wasm32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/core": "1.11.1",
-        "@emnapi/runtime": "1.11.1",
-        "@napi-rs/wasm-runtime": "^1.1.6"
-      },
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
-      "integrity": "sha512-PnWBtw3TV5KOg69HQQDR0mnQuyCmSGR2pAB4DC1rPF808fgKeTUMj2EOEyKATpgiuxuR5APQmiDO7PDgEjTFSA==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.5.tgz",
+      "integrity": "sha512-vGbruD5zquhoc8D9SViXgN2FBJtNdTyQ4DtG+SWiEGlJiAzoKcZ2xp+xuXCffhubVdt0NJlTZqkeRuERy7g8Cw==",
       "cpu": [
         "arm64"
       ],
@@ -409,9 +454,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.4.tgz",
-      "integrity": "sha512-M1lpniBePobTfsa7Ks9a199e1akxsXn+GYBUKsEzv3YFzOm1HJAMNwKI3qr0Zq+mxwx9gOZoTdP1yXRYsZUocQ==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.5.tgz",
+      "integrity": "sha512-e/SXpgISz+IoqVcSSI0rx/d/he8zqLex+/rCWpnHpmVfmPIUjag9H6P7zotf0gJHwPUhQxZ/mF8tr6acebT9yw==",
       "cpu": [
         "x64"
       ],
@@ -439,17 +484,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@tybys/wasm-util": {
-      "version": "0.10.3",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
-      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
     "node_modules/@types/chai": {
       "version": "5.2.3",
       "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
@@ -618,17 +652,48 @@
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
       }
     },
+    "node_modules/@vitest/coverage-v8": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.11.tgz",
+      "integrity": "sha512-8MVGEFnJIcdGjcbfKmeq8z0pZHH0JlVtoVZH9Q/qwUp6wyFnEJUBMrw9DCaj+ra3vShGmhavjalMIhPNxZAUcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@bcoe/v8-coverage": "^1.0.2",
+        "@vitest/utils": "4.1.11",
+        "ast-v8-to-istanbul": "^1.0.0",
+        "istanbul-lib-coverage": "^3.2.2",
+        "istanbul-lib-report": "^3.0.1",
+        "istanbul-reports": "^3.2.0",
+        "magicast": "^0.5.2",
+        "obug": "^2.1.1",
+        "std-env": "^4.0.0-rc.1",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@vitest/browser": "4.1.11",
+        "vitest": "4.1.11"
+      },
+      "peerDependenciesMeta": {
+        "@vitest/browser": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@vitest/expect": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz",
-      "integrity": "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz",
+      "integrity": "sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.9",
-        "@vitest/utils": "4.1.9",
+        "@vitest/spy": "4.1.11",
+        "@vitest/utils": "4.1.11",
         "chai": "^6.2.2",
         "tinyrainbow": "^3.1.0"
       },
@@ -637,13 +702,13 @@
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.9.tgz",
-      "integrity": "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz",
+      "integrity": "sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.1.9",
+        "@vitest/spy": "4.1.11",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -664,9 +729,9 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
-      "integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz",
+      "integrity": "sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -677,13 +742,13 @@
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.9.tgz",
-      "integrity": "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz",
+      "integrity": "sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.1.9",
+        "@vitest/utils": "4.1.11",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -691,14 +756,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.9.tgz",
-      "integrity": "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz",
+      "integrity": "sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.9",
-        "@vitest/utils": "4.1.9",
+        "@vitest/pretty-format": "4.1.11",
+        "@vitest/utils": "4.1.11",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -707,9 +772,9 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz",
-      "integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz",
+      "integrity": "sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -717,13 +782,13 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
-      "integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz",
+      "integrity": "sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.9",
+        "@vitest/pretty-format": "4.1.11",
         "convert-source-map": "^2.0.0",
         "tinyrainbow": "^3.1.0"
       },
@@ -815,6 +880,18 @@
         "node": ">=12"
       }
     },
+    "node_modules/ast-v8-to-istanbul": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-1.0.5.tgz",
+      "integrity": "sha512-UPAgKJFSEGMWSDr3LX4tqnAb4f7KGT8O40Tyx8wbYmmZ/yn58lNCm8h3svs3eXgiGd5AXxz8NDOvXWvicq+rJA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.31",
+        "estree-walker": "^3.0.3",
+        "js-tokens": "^10.0.0"
+      }
+    },
     "node_modules/atomically": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/atomically/-/atomically-2.1.1.tgz",
@@ -1110,6 +1187,23 @@
       "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
       "license": "ISC"
     },
+    "node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/html-escaper": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/ini": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/ini/-/ini-4.1.1.tgz",
@@ -1183,6 +1277,52 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/istanbul-lib-coverage": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
+      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-report": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
+      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "istanbul-lib-coverage": "^3.0.0",
+        "make-dir": "^4.0.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-reports": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
+      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "html-escaper": "^2.0.0",
+        "istanbul-lib-report": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/js-tokens": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-10.0.0.tgz",
+      "integrity": "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/ky": {
       "version": "1.14.3",
       "resolved": "https://registry.npmjs.org/ky/-/ky-1.14.3.tgz",
@@ -1211,9 +1351,9 @@
       }
     },
     "node_modules/lightningcss": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
-      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
+      "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
       "dev": true,
       "license": "MPL-2.0",
       "dependencies": {
@@ -1227,23 +1367,23 @@
         "url": "https://opencollective.com/parcel"
       },
       "optionalDependencies": {
-        "lightningcss-android-arm64": "1.32.0",
-        "lightningcss-darwin-arm64": "1.32.0",
-        "lightningcss-darwin-x64": "1.32.0",
-        "lightningcss-freebsd-x64": "1.32.0",
-        "lightningcss-linux-arm-gnueabihf": "1.32.0",
-        "lightningcss-linux-arm64-gnu": "1.32.0",
-        "lightningcss-linux-arm64-musl": "1.32.0",
-        "lightningcss-linux-x64-gnu": "1.32.0",
-        "lightningcss-linux-x64-musl": "1.32.0",
-        "lightningcss-win32-arm64-msvc": "1.32.0",
-        "lightningcss-win32-x64-msvc": "1.32.0"
+        "lightningcss-android-arm64": "1.33.0",
+        "lightningcss-darwin-arm64": "1.33.0",
+        "lightningcss-darwin-x64": "1.33.0",
+        "lightningcss-freebsd-x64": "1.33.0",
+        "lightningcss-linux-arm-gnueabihf": "1.33.0",
+        "lightningcss-linux-arm64-gnu": "1.33.0",
+        "lightningcss-linux-arm64-musl": "1.33.0",
+        "lightningcss-linux-x64-gnu": "1.33.0",
+        "lightningcss-linux-x64-musl": "1.33.0",
+        "lightningcss-win32-arm64-msvc": "1.33.0",
+        "lightningcss-win32-x64-msvc": "1.33.0"
       }
     },
     "node_modules/lightningcss-android-arm64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
-      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
+      "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
       "cpu": [
         "arm64"
       ],
@@ -1262,9 +1402,9 @@
       }
     },
     "node_modules/lightningcss-darwin-arm64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
-      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
+      "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
       "cpu": [
         "arm64"
       ],
@@ -1283,9 +1423,9 @@
       }
     },
     "node_modules/lightningcss-darwin-x64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
-      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
+      "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
       "cpu": [
         "x64"
       ],
@@ -1304,9 +1444,9 @@
       }
     },
     "node_modules/lightningcss-freebsd-x64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
-      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
+      "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
       "cpu": [
         "x64"
       ],
@@ -1325,9 +1465,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm-gnueabihf": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
-      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
+      "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
       "cpu": [
         "arm"
       ],
@@ -1346,13 +1486,16 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-gnu": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
-      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
+      "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -1367,13 +1510,16 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-musl": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
-      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
+      "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -1388,13 +1534,16 @@
       }
     },
     "node_modules/lightningcss-linux-x64-gnu": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
-      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
+      "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -1409,13 +1558,16 @@
       }
     },
     "node_modules/lightningcss-linux-x64-musl": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
-      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
+      "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -1430,9 +1582,9 @@
       }
     },
     "node_modules/lightningcss-win32-arm64-msvc": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
-      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
+      "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
       "cpu": [
         "arm64"
       ],
@@ -1451,9 +1603,9 @@
       }
     },
     "node_modules/lightningcss-win32-x64-msvc": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
-      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
+      "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
       "cpu": [
         "x64"
       ],
@@ -1481,6 +1633,34 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/magicast": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.4.tgz",
+      "integrity": "sha512-llBEhWm1SacoRwgHUoQJYtwp4PBLF4faQi5TCpIGyGs9n4y5+juI0tDgyKIfpqxckRHaHzouUEph3THklWh03w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7",
+        "source-map-js": "^1.2.1"
+      }
+    },
+    "node_modules/make-dir": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
+      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.5.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/minimist": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -1491,9 +1671,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {
@@ -1556,9 +1736,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
-      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1569,9 +1749,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.23",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
-      "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
+      "version": "8.5.26",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
       "dev": true,
       "funding": [
         {
@@ -1589,7 +1769,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.16",
+        "nanoid": "^3.3.17",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -1667,13 +1847,13 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.4.tgz",
-      "integrity": "sha512-IjZYiLxZwpnhwhdBH2ugdTGVSdhCQUmLxLoqyjiL0JxYjyRst+5a0P3xfrTxJ5F638j4Mvvw5FAX5XE6eHpXbA==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.5.tgz",
+      "integrity": "sha512-VD2IE5PUG4Oj8zz2VGykiYd5wbnjdIiSsNQb8Qu5B+noEp+A78mu2iVvpp27g8es14Tk9rofNs5Tku9iQCS4fA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.138.0",
+        "@oxc-project/types": "=0.146.0",
         "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
@@ -1683,21 +1863,21 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.1.4",
-        "@rolldown/binding-darwin-arm64": "1.1.4",
-        "@rolldown/binding-darwin-x64": "1.1.4",
-        "@rolldown/binding-freebsd-x64": "1.1.4",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.1.4",
-        "@rolldown/binding-linux-arm64-gnu": "1.1.4",
-        "@rolldown/binding-linux-arm64-musl": "1.1.4",
-        "@rolldown/binding-linux-ppc64-gnu": "1.1.4",
-        "@rolldown/binding-linux-s390x-gnu": "1.1.4",
-        "@rolldown/binding-linux-x64-gnu": "1.1.4",
-        "@rolldown/binding-linux-x64-musl": "1.1.4",
-        "@rolldown/binding-openharmony-arm64": "1.1.4",
-        "@rolldown/binding-wasm32-wasi": "1.1.4",
-        "@rolldown/binding-win32-arm64-msvc": "1.1.4",
-        "@rolldown/binding-win32-x64-msvc": "1.1.4"
+        "@rolldown/binding-android-arm-eabi": "1.2.5",
+        "@rolldown/binding-android-arm64": "1.2.5",
+        "@rolldown/binding-darwin-arm64": "1.2.5",
+        "@rolldown/binding-darwin-x64": "1.2.5",
+        "@rolldown/binding-freebsd-x64": "1.2.5",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.2.5",
+        "@rolldown/binding-linux-arm64-gnu": "1.2.5",
+        "@rolldown/binding-linux-arm64-musl": "1.2.5",
+        "@rolldown/binding-linux-ppc64-gnu": "1.2.5",
+        "@rolldown/binding-linux-s390x-gnu": "1.2.5",
+        "@rolldown/binding-linux-x64-gnu": "1.2.5",
+        "@rolldown/binding-linux-x64-musl": "1.2.5",
+        "@rolldown/binding-openharmony-arm64": "1.2.5",
+        "@rolldown/binding-win32-arm64-msvc": "1.2.5",
+        "@rolldown/binding-win32-x64-msvc": "1.2.5"
       }
     },
     "node_modules/semver": {
@@ -1805,6 +1985,19 @@
       "integrity": "sha512-zOh9jPYI+xrNOyisSelgym4tolKTJCQd5GBhK0+0xJvcYDcwlOoxF/rnFKQ2KRZknXSG9jWAp66fwP6AxN9STg==",
       "license": "MIT"
     },
+    "node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/tinybench": {
       "version": "2.9.0",
       "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
@@ -1849,14 +2042,6 @@
         "node": ">=14.0.0"
       }
     },
-    "node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "dev": true,
-      "license": "0BSD",
-      "optional": true
-    },
     "node_modules/type-fest": {
       "version": "4.41.0",
       "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.41.0.tgz",
@@ -1915,16 +2100,16 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.1.3",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.3.tgz",
-      "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
+      "version": "8.2.2",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.2.tgz",
+      "integrity": "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "lightningcss": "^1.32.0",
-        "picomatch": "^4.0.4",
-        "postcss": "^8.5.16",
-        "rolldown": "~1.1.3",
+        "lightningcss": "^1.33.0",
+        "picomatch": "^4.0.5",
+        "postcss": "^8.5.26",
+        "rolldown": "~1.2.4",
         "tinyglobby": "^0.2.17"
       },
       "bin": {
@@ -1941,7 +2126,7 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.3.0",
+        "@vitejs/devtools": "^0.4.0 || ^0.5.0",
         "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
@@ -1993,19 +2178,19 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz",
-      "integrity": "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.11.tgz",
+      "integrity": "sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.1.9",
-        "@vitest/mocker": "4.1.9",
-        "@vitest/pretty-format": "4.1.9",
-        "@vitest/runner": "4.1.9",
-        "@vitest/snapshot": "4.1.9",
-        "@vitest/spy": "4.1.9",
-        "@vitest/utils": "4.1.9",
+        "@vitest/expect": "4.1.11",
+        "@vitest/mocker": "4.1.11",
+        "@vitest/pretty-format": "4.1.11",
+        "@vitest/runner": "4.1.11",
+        "@vitest/snapshot": "4.1.11",
+        "@vitest/spy": "4.1.11",
+        "@vitest/utils": "4.1.11",
         "es-module-lexer": "^2.0.0",
         "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
@@ -2033,12 +2218,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.9",
-        "@vitest/browser-preview": "4.1.9",
-        "@vitest/browser-webdriverio": "4.1.9",
-        "@vitest/coverage-istanbul": "4.1.9",
-        "@vitest/coverage-v8": "4.1.9",
-        "@vitest/ui": "4.1.9",
+        "@vitest/browser-playwright": "4.1.11",
+        "@vitest/browser-preview": "4.1.11",
+        "@vitest/browser-webdriverio": "4.1.11",
+        "@vitest/coverage-istanbul": "4.1.11",
+        "@vitest/coverage-v8": "4.1.11",
+        "@vitest/ui": "4.1.11",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
diff --git a/plugin-sdk/package.json b/plugin-sdk/package.json
index ff3f14104..3e3008c5c 100644
--- a/plugin-sdk/package.json
+++ b/plugin-sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "trek-plugin-sdk",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "SDK for building TREK plugins: types, definePlugin, a mock host, manifest validation, and the create-trek-plugin / trek-plugin CLIs.",
   "type": "module",
   "license": "MIT",
@@ -71,12 +71,14 @@
     "build": "tsc -p tsconfig.json && tsc -p tsconfig.cjs.json && node scripts/finish-cjs.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "prepublishOnly": "npm run build && npm test"
   },
   "devDependencies": {
     "@types/node": "^22.20.0",
     "@types/semver": "^7.7.1",
     "@types/update-notifier": "^6.0.8",
+    "@vitest/coverage-v8": "^4.1.9",
     "typescript": "^5.9.3",
     "vitest": "^4.1.9"
   },
diff --git a/plugin-sdk/src/cli/checks/context.ts b/plugin-sdk/src/cli/checks/context.ts
index 753a094e4..76fe70520 100644
--- a/plugin-sdk/src/cli/checks/context.ts
+++ b/plugin-sdk/src/cli/checks/context.ts
@@ -30,7 +30,7 @@ export function loadContext(
     try {
       // Tolerate a UTF-8 BOM. Windows editors add one, and a bare JSON.parse then fails with a
       // cryptic "Unexpected token" pointing at an invisible character. Same rule as readJsonFile.
-      const text = manifestRaw.charCodeAt(0) === 0xfeff ? manifestRaw.slice(1) : manifestRaw;
+      const text = manifestRaw.codePointAt(0) === 0xfeff ? manifestRaw.slice(1) : manifestRaw;
       const parsed: unknown = JSON.parse(text);
       if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
         manifestError = 'trek-plugin.json is not a JSON object';
@@ -56,10 +56,10 @@ export function loadContext(
 
 /** Convenience for tests and for callers that already hold the strings. */
 export function makeContext(over: Partial<CheckContext> & { dir?: string }): CheckContext {
-  const files = new Set<string>();
   return {
     dir: over.dir ?? '/plugin',
-    exists: (rel: string) => files.has(rel),
+    // Nothing is on disk here unless the caller passes its own `exists`.
+    exists: () => false,
     ...over,
   };
 }
diff --git a/plugin-sdk/src/cli/checks/network.ts b/plugin-sdk/src/cli/checks/network.ts
index 2de2356df..4e321f2e4 100644
--- a/plugin-sdk/src/cli/checks/network.ts
+++ b/plugin-sdk/src/cli/checks/network.ts
@@ -57,7 +57,9 @@ function targetVersions(c: CheckContext): RegistryEntryVersion[] {
   return c.allVersions ? vs : vs.slice(0, 1);
 }
 
-async function fetchText(url: string, headers: Record<string, string> = { 'User-Agent': 'trek-plugin-preflight' }): Promise<string | null> {
+const PLAIN_HEADERS: Record<string, string> = { 'User-Agent': 'trek-plugin-preflight' };
+
+async function fetchText(url: string, headers: Record<string, string> = PLAIN_HEADERS): Promise<string | null> {
   try {
     const r = await fetch(url, { headers });
     return r.ok ? await r.text() : null;
@@ -141,12 +143,12 @@ const manifestAtCommit: NetworkCheck = {
       if ((m.operatorEgress === true) !== (v.operatorEgress === true)) {
         p(`manifest operatorEgress ${m.operatorEgress === true} != entry ${v.operatorEgress === true}`);
       }
-      const normAddons = (a: unknown) => (Array.isArray(a) ? [...a].map(String).sort() : []);
+      const normAddons = (a: unknown) => (Array.isArray(a) ? [...a].map(String).sort((x, y) => (x < y ? -1 : x > y ? 1 : 0)) : []);
       if (JSON.stringify(normAddons(m.requiredAddons)) !== JSON.stringify(normAddons(v.requiredAddons))) {
         p('manifest requiredAddons != entry requiredAddons');
       }
       const normDeps = (d: unknown) =>
-        (Array.isArray(d) ? d.map((x) => `${(x as { id?: string })?.id}@${(x as { version?: string })?.version}`).sort() : []);
+        (Array.isArray(d) ? d.map((x) => `${(x as { id?: string })?.id}@${(x as { version?: string })?.version}`).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)) : []);
       if (JSON.stringify(normDeps(m.pluginDependencies)) !== JSON.stringify(normDeps(v.pluginDependencies))) {
         p('manifest pluginDependencies != entry pluginDependencies');
       }
diff --git a/plugin-sdk/src/cli/checks/offline.ts b/plugin-sdk/src/cli/checks/offline.ts
index e518085a3..411fc069d 100644
--- a/plugin-sdk/src/cli/checks/offline.ts
+++ b/plugin-sdk/src/cli/checks/offline.ts
@@ -106,7 +106,7 @@ const manifestTrekRange: OfflineCheck = {
       ? fail(
           `trek: "${trek}"`,
           'This claims support for every TREK version, including ones that do not exist yet. It opts you out of the\n' +
-            'one mechanism that stops your plugin running on a host it was never tested against. Pin a range like ">=3.4.0 <4.0.0".',
+            'one mechanism that stops your plugin running on a host it was never tested against. Pin a range like ">=4.0.0 <5.0.0".',
         )
       : pass(trek);
   },
@@ -530,12 +530,12 @@ const releaseEntryParity: OfflineCheck = {
       problems.push(`• manifest operatorEgress ${m.operatorEgress === true} != entry ${v.operatorEgress === true}`);
     }
 
-    const normAddons = (a: unknown) => [...arr(a)].sort();
+    const normAddons = (a: unknown) => [...arr(a)].sort((x, y) => (x < y ? -1 : x > y ? 1 : 0));
     if (JSON.stringify(normAddons(m.requiredAddons)) !== JSON.stringify(normAddons(v.requiredAddons))) {
       problems.push(`• manifest requiredAddons [${normAddons(m.requiredAddons)}] != entry [${normAddons(v.requiredAddons)}]`);
     }
     const normDeps = (d: unknown) =>
-      (Array.isArray(d) ? d.map((x) => `${(x as { id?: string })?.id}@${(x as { version?: string })?.version}`).sort() : []);
+      (Array.isArray(d) ? d.map((x) => `${(x as { id?: string })?.id}@${(x as { version?: string })?.version}`).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)) : []);
     if (JSON.stringify(normDeps(m.pluginDependencies)) !== JSON.stringify(normDeps(v.pluginDependencies))) {
       problems.push(`• manifest pluginDependencies [${normDeps(m.pluginDependencies)}] != entry [${normDeps(v.pluginDependencies)}]`);
     }
diff --git a/plugin-sdk/src/cli/create.ts b/plugin-sdk/src/cli/create.ts
index 410ab693b..64e12b466 100644
--- a/plugin-sdk/src/cli/create.ts
+++ b/plugin-sdk/src/cli/create.ts
@@ -57,6 +57,23 @@ export interface ScaffoldOptions {
 
 export const TEMPLATES = ['blank', 'notification-channel'] as const;
 
+/**
+ * The credential fields the OAuth broker (server-side `oauth.getToken`) needs to run the
+ * authorization-code flow on the plugin's behalf. ALL `scope: 'instance'` — unlike the
+ * notification-channel template's `scope: 'user'` settings above, these are configured ONCE
+ * per install by an admin, not per recipient: the broker itself reads them at token-exchange
+ * time, there is no per-user client id/secret. Deliberately not user-scoped.
+ */
+const OAUTH_SETTINGS: Array<{
+  key: string; label: string; input_type: string; required: boolean; secret?: boolean; scope: 'instance';
+}> = [
+  { key: 'oauth_authorize_url', label: 'OAuth authorize URL', input_type: 'text', required: true, scope: 'instance' },
+  { key: 'oauth_token_url', label: 'OAuth token URL', input_type: 'text', required: true, scope: 'instance' },
+  { key: 'oauth_scopes', label: 'OAuth scopes (space-separated)', input_type: 'text', required: false, scope: 'instance' },
+  { key: 'oauth_client_id', label: 'OAuth client id', input_type: 'text', required: true, scope: 'instance' },
+  { key: 'oauth_client_secret', label: 'OAuth client secret', input_type: 'text', required: true, secret: true, scope: 'instance' },
+];
+
 /** Mirrors the server's widget slots (and the manifest validator's). */
 export const WIDGET_SLOTS = ['sidebar', 'hero', 'place-detail', 'day-detail', 'reservation-detail'] as const;
 export type WidgetSlot = (typeof WIDGET_SLOTS)[number];
@@ -96,7 +113,7 @@ export function scaffold(name: string, type: string, targetDir: string, opts: Sc
   if (fs.existsSync(root)) throw new Error(`${root} already exists`);
   fs.mkdirSync(path.join(root, 'server'), { recursive: true });
 
-  const displayName = name.replace(/-/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
+  const displayName = name.replaceAll('-', ' ').replaceAll(/\b\w/g, (c) => c.toUpperCase());
   let perms = opts.permissions?.length ? opts.permissions : ['db:own'];
   const egress = opts.egress ?? [];
   if (isChannel) {
@@ -121,11 +138,13 @@ export function scaffold(name: string, type: string, targetDir: string, opts: Sc
     author: opts.author || 'Your Name',
     description: opts.description || (isChannel ? `Deliver TREK notifications over ${displayName}.` : 'Describe what your plugin does.'),
     type,
-    // 3.4.0, not 3.3.0. The `ctx` namespaces this scaffold is written against — ctx.meta,
-    // ctx.places, ctx.days, ctx.itinerary, ctx.costs, ctx.packing, ctx.files — only exist from
-    // 3.4.0. Claiming 3.3.0 lets the plugin install on a host where they are `undefined`, which
-    // fails at the first call with a TypeError instead of a clear "incompatible" at install.
-    trek: '>=3.4.0 <4.0.0',
+    // Floor 4.0.0: the host surface this scaffold is written against — the enforced
+    // apiVersion gate, the generated core-event catalog (EVENT_FAMILIES /
+    // EVENT_SNAPSHOT_GRANT), the OAuth-broker settings contract — is the TREK 4 surface.
+    // Claiming an older floor lets the plugin install on a host where parts of it are
+    // missing, which fails at the first call instead of a clear "incompatible" at install.
+    // Ceiling 5.0.0: bounded, per the trek-range rule; widen only against a tested host.
+    trek: '>=4.0.0 <5.0.0',
     nativeModules: false,
     permissions: perms,
     // Dependency declarations (empty by default). `requiredAddons` lists addon ids
@@ -183,6 +202,16 @@ export function scaffold(name: string, type: string, targetDir: string, opts: Sc
       },
     ];
   }
+  // The broker (ctx.oauth.getToken) needs somewhere to read the authorize/token URLs and the
+  // app's client id/secret — an admin configures them once, instance-wide, and the broker
+  // reads them at token-exchange time. Merge with any settings the template above already
+  // wrote (a channel template never grants oauth:client today, so there is no real overlap,
+  // but keys are deduped anyway rather than trusting that stays true).
+  if (perms.includes('oauth:client')) {
+    const existing = (manifest.settings as Array<{ key: string }> | undefined) ?? [];
+    const seen = new Set(existing.map((s) => s.key));
+    manifest.settings = [...existing, ...OAUTH_SETTINGS.filter((s) => !seen.has(s.key))];
+  }
 
   fs.writeFileSync(path.join(root, 'trek-plugin.json'), JSON.stringify(manifest, null, 2) + '\n');
   fs.writeFileSync(path.join(root, 'server', 'index.js'), isChannel ? CHANNEL_JS : SERVER_JS(perms.includes('db:own')));
diff --git a/plugin-sdk/src/cli/entry.ts b/plugin-sdk/src/cli/entry.ts
index 068d2b35f..0db5bc104 100644
--- a/plugin-sdk/src/cli/entry.ts
+++ b/plugin-sdk/src/cli/entry.ts
@@ -56,7 +56,7 @@ interface Entry {
 }
 
 /**
- * Lower bound of a `trek` range like ">=3.2.0 <4.0.0" -> "3.2.0" (matches the server).
+ * Lower bound of a `trek` range like ">=4.0.0 <5.0.0" -> "4.0.0" (matches the server).
  *
  * Read off the range with semver rather than by finding the first version-shaped substring:
  * for "<4.0.0" the first such substring is 4.0.0, which is the range's *upper* bound and
@@ -91,7 +91,7 @@ export function buildEntry(opts: {
   if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(opts.repo)) throw new Error(`--repo must be "owner/name", got "${opts.repo}"`);
   // minVersion() is null for a range nothing can satisfy (">=4.0.0 <3.0.0" parses fine), so
   // this doubles as the satisfiability check — TREK would refuse to install such a plugin.
-  if (!minTrekFrom(manifest.trek)) throw new Error('manifest has no valid "trek" version range (e.g. "trek": ">=3.2.0 <4.0.0")');
+  if (!minTrekFrom(manifest.trek)) throw new Error('manifest has no valid "trek" version range (e.g. "trek": ">=4.0.0 <5.0.0")');
   if (!fs.existsSync(opts.zipPath)) throw new Error(`artifact not found: ${opts.zipPath} — run \`trek-plugin pack\` first`);
 
   const buf = fs.readFileSync(opts.zipPath);
diff --git a/plugin-sdk/src/cli/help.ts b/plugin-sdk/src/cli/help.ts
index f37283cc5..3e0d374e3 100644
--- a/plugin-sdk/src/cli/help.ts
+++ b/plugin-sdk/src/cli/help.ts
@@ -18,7 +18,7 @@ export const VERSION_LINE = (v: string): string => `trek-plugin-sdk ${v}`;
 export const PATH_COMMANDS = ['create', 'dev', 'status', 'publish'] as const;
 
 /** Real, supported, and not what a newcomer needs to see first. */
-export const OTHER_COMMANDS = ['validate', 'pack', 'shot', 'keygen', 'sign', 'entry', 'preflight', 'submit', 'release'] as const;
+export const OTHER_COMMANDS = ['validate', 'pack', 'shot', 'keygen', 'sign', 'entry', 'preflight', 'submit', 'release', 'unrelease'] as const;
 
 export interface CommandHelp {
   /** One line, for the top-level list. */
@@ -85,7 +85,7 @@ you like.`,
 
   publish: {
     summary: 'release + open the registry PR',
-    usage: 'trek-plugin publish [dir] --repo <owner/name> --tag <vX.Y.Z> [--sign]',
+    usage: 'trek-plugin publish [dir] --repo <owner/name> --tag <vX.Y.Z> [--sign] [--keep-release]',
     body: `The whole release, in order:
 
   1. check       every registry gate that can be checked locally
@@ -98,6 +98,12 @@ Step 1 comes first for a reason: a GitHub release is effectively immutable, beca
 pins its sha256. If a check fails, NOTHING is packed, tagged, pushed or released — so you can fix
 it and re-run against the same version.
 
+And when a LATER step fails, publish rolls back exactly what the run created — the release, the
+pushed tag, the local tag — so the same tag is free to re-run against once you have fixed the
+problem. Pass --keep-release to leave them in place instead (the error then prints the manual
+cleanup). Anything that existed before the run is never touched. A leftover tag from an earlier
+failed run is recognised (no release for it, not on HEAD) and moved to HEAD rather than reused.
+
 In a terminal it OFFERS TO SIGN, and creates a key for you if you have none. A signature proves the
 artifact came from you, not just that its bytes match what the registry saw. You can add signing
 later — publishing unsigned now and signing at v1.4.0 breaks nobody — but you can never take it
@@ -217,6 +223,19 @@ hand, or to re-check a release you have already cut.
     body: `Packs, cuts the GitHub release, and prints the registry entry — but does NOT open the registry PR.
 For when you want to release now and submit later. \`publish\` is the whole thing.`,
   },
+  unrelease: {
+    summary: 'delete a stranded tag + release (never a published one)',
+    usage: 'trek-plugin unrelease <vX.Y.Z> [dir] --repo <owner/name> [--registry owner/name] [--yes]',
+    body: `Undoes a release that never made it into the registry: deletes the GitHub release, the remote
+tag, and the local tag — each reported, each skipped when already gone. For when a publish
+failed halfway (though \`publish\` now rolls its own failures back), or you changed your mind
+before the registry PR merged.
+
+The one hard rule: a version that IS published in the registry is immutable — the registry pins
+the artifact's sha256, so deleting its release breaks install/update for everyone who has it.
+unrelease checks the published index first and refuses those outright, with no override. If the
+registry cannot be reached to check, it refuses unless you pass --yes.`,
+  },
 };
 
 export function topLevelHelp(version: string): string {
diff --git a/plugin-sdk/src/cli/json.ts b/plugin-sdk/src/cli/json.ts
index eb379225e..9a8b003d0 100644
--- a/plugin-sdk/src/cli/json.ts
+++ b/plugin-sdk/src/cli/json.ts
@@ -7,5 +7,5 @@ import fs from 'node:fs';
  */
 export function readJsonFile<T = unknown>(p: string): T {
   const text = fs.readFileSync(p, 'utf8');
-  return JSON.parse(text.charCodeAt(0) === 0xfeff ? text.slice(1) : text) as T;
+  return JSON.parse(text.codePointAt(0) === 0xfeff ? text.slice(1) : text) as T;
 }
diff --git a/plugin-sdk/src/cli/menu.ts b/plugin-sdk/src/cli/menu.ts
index d60d13743..901dbbe4d 100644
--- a/plugin-sdk/src/cli/menu.ts
+++ b/plugin-sdk/src/cli/menu.ts
@@ -38,6 +38,7 @@ export const ADVANCED_MENU: MenuItem[] = [
   { value: 'preflight', label: 'Preflight', hint: 'The registry checks that need the release to exist' },
   { value: 'submit', label: 'Submit', hint: 'Open the registry PR' },
   { value: 'release', label: 'Release', hint: 'Pack → GitHub release → print entry' },
+  { value: 'unrelease', label: 'Unrelease', hint: 'Delete a stranded tag + release (never a published one)' },
   { value: 'back', label: '← Back', hint: '' },
 ];
 
diff --git a/plugin-sdk/src/cli/pack.ts b/plugin-sdk/src/cli/pack.ts
index 7585ddee2..8dff1f86e 100644
--- a/plugin-sdk/src/cli/pack.ts
+++ b/plugin-sdk/src/cli/pack.ts
@@ -100,6 +100,6 @@ export function packPluginDir(dir: string, outPath: string): PackResult {
     artifact: outAbs,
     sha256: createHash('sha256').update(buf).digest('hex'),
     size: buf.length,
-    files: filtered.map((f) => f.name).sort(),
+    files: filtered.map((f) => f.name).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)),
   };
 }
diff --git a/plugin-sdk/src/cli/publish.ts b/plugin-sdk/src/cli/publish.ts
index 3632c8b38..807872c4c 100644
--- a/plugin-sdk/src/cli/publish.ts
+++ b/plugin-sdk/src/cli/publish.ts
@@ -31,8 +31,12 @@ import { plainLog, type LogSink } from './ui.js';
 function git(dir: string, args: string[], quiet = true): string {
   return execFileSync('git', ['-C', dir, ...args], { encoding: 'utf8', stdio: quiet ? 'pipe' : 'inherit' }).toString().trim();
 }
-function tagExists(dir: string, tag: string): boolean {
-  try { git(dir, ['rev-parse', `${tag}^{commit}`]); return true; } catch { return false; }
+/** The commit a local tag points at, or null when the tag does not exist. */
+function tagSha(dir: string, tag: string): string | null {
+  try { return git(dir, ['rev-parse', `${tag}^{commit}`]); } catch { return null; }
+}
+function remoteTagExists(dir: string, tag: string): boolean {
+  try { return git(dir, ['ls-remote', '--tags', 'origin', `refs/tags/${tag}`]) !== ''; } catch { return false; }
 }
 function releaseExists(repo: string, tag: string): boolean {
   try { execFileSync('gh', ['release', 'view', tag, '--repo', repo], { stdio: 'pipe' }); return true; } catch { return false; }
@@ -45,6 +49,8 @@ export async function publishPlugin(opts: {
   force?: boolean;
   /** Skip the local gates. An escape hatch for a re-run, never a good idea on a first publish. */
   skipChecks?: boolean;
+  /** On failure, leave the tag/release this run created in place instead of rolling them back. */
+  keepRelease?: boolean;
   /**
    * A signing state the CLI already looked up (it does, to know whether to offer signing). Passed
    * in so a single publish does not hit the registry twice for the same answer.
@@ -93,14 +99,36 @@ export async function publishPlugin(opts: {
 
   // 3. Tag (if needed) + push + GitHub release with the artifact attached
   step(3, `Tagging ${opts.tag} + creating the GitHub release…`);
-  if (!tagExists(dir, opts.tag)) git(dir, ['tag', opts.tag]);
-  try { git(dir, ['push', 'origin', opts.tag]); } catch {
+  const head = git(dir, ['rev-parse', 'HEAD']);
+  const existingTagSha = tagSha(dir, opts.tag);
+  const relExisted = releaseExists(opts.repo, opts.tag);
+  let createdLocalTag = false;
+  let movedTag = false;
+  if (existingTagSha === null) {
+    git(dir, ['tag', opts.tag]);
+    createdLocalTag = true;
+  } else if (existingTagSha !== head) {
+    // A tag that doesn't point at HEAD and has no release is debris from a failed run — reusing
+    // it silently would release the UNFIXED commit. Move it. One that HAS a release is immutable.
+    if (relExisted && !opts.force) {
+      throw new Error(
+        `tag ${opts.tag} points at ${existingTagSha.slice(0, 7)}, not HEAD (${head.slice(0, 7)}) — and its release already exists on ${opts.repo}.\n` +
+        `A released artifact is immutable (the registry pins its sha256). Cut a new version,\n` +
+        `or pass --force if this release was never merged into the registry.`,
+      );
+    }
+    log(`      ! tag ${opts.tag} pointed at ${existingTagSha.slice(0, 7)} (debris from an earlier run) — moving it to HEAD`);
+    git(dir, ['tag', '-f', opts.tag]);
+    movedTag = true;
+  }
+  const remoteTagExisted = remoteTagExists(dir, opts.tag);
+  try { git(dir, ['push', ...(movedTag ? ['--force'] : []), 'origin', opts.tag]); } catch {
     throw new Error(`could not push tag ${opts.tag} — is "origin" your plugin's GitHub repo and are you authenticated? (git push origin ${opts.tag})`);
   }
   // A released artifact is IMMUTABLE: the registry pins its sha256, so overwriting the bytes of a
   // release that is already in the registry breaks the checksum for everyone who has that version
   // — they can no longer install or update it. Refuse by default.
-  if (releaseExists(opts.repo, opts.tag)) {
+  if (relExisted) {
     if (!opts.force) {
       throw new Error(
         `release ${opts.tag} already exists on ${opts.repo}.\n` +
@@ -115,31 +143,65 @@ export async function publishPlugin(opts: {
   }
   log(`      ✓ release ${opts.tag} on ${opts.repo}`);
 
-  // 4. Build the entry, then run the gates that need the tag and the release to exist
-  const entry = buildEntry({ dir, repo: opts.repo, tag: opts.tag, zipPath: packed.artifact, signKeyPath: opts.signKeyPath, now: opts.now });
-  if (opts.skipPreflight) {
-    log('[4/5] Preflight skipped (--no-preflight).');
-  } else {
-    step(4, 'Preflight — the gates that need the release to exist…');
-    const rep = await preflight(entry, { dir, registry: opts.registry });
-    for (const f of rep.failures) log('      ✗ ' + f);
-    if (!rep.ok) {
+  // What THIS run created — the exact scope of a rollback. Anything that existed before the run
+  // (a merged release, a pre-pushed tag) is deliberately out of bounds.
+  const created = { release: !relExisted, remoteTag: !remoteTagExisted, localTag: createdLocalTag || movedTag };
+  const manualCleanup =
+    `  gh release delete ${opts.tag} --repo ${opts.repo} --yes\n` +
+    `  git push origin :refs/tags/${opts.tag}\n` +
+    `  git tag -d ${opts.tag}`;
+  const rollback = () => {
+    if (created.release) {
+      try { execFileSync('gh', ['release', 'delete', opts.tag, '--repo', opts.repo, '--yes'], { stdio: 'pipe' }); log(`      ↩ deleted release ${opts.tag}`); }
+      catch { log(`      ! could not delete release ${opts.tag} — run: gh release delete ${opts.tag} --repo ${opts.repo} --yes`); }
+    }
+    if (created.remoteTag) {
+      try { git(dir, ['push', 'origin', `:refs/tags/${opts.tag}`]); log(`      ↩ deleted remote tag ${opts.tag}`); }
+      catch { log(`      ! could not delete remote tag ${opts.tag} — run: git push origin :refs/tags/${opts.tag}`); }
+    }
+    if (created.localTag) {
+      try { git(dir, ['tag', '-d', opts.tag]); log(`      ↩ deleted local tag ${opts.tag}`); }
+      catch { log(`      ! could not delete local tag ${opts.tag} — run: git tag -d ${opts.tag}`); }
+    }
+  };
+
+  try {
+    // 4. Build the entry, then run the gates that need the tag and the release to exist
+    const entry = buildEntry({ dir, repo: opts.repo, tag: opts.tag, zipPath: packed.artifact, signKeyPath: opts.signKeyPath, now: opts.now });
+    if (opts.skipPreflight) {
+      log('[4/5] Preflight skipped (--no-preflight).');
+    } else {
+      step(4, 'Preflight — the gates that need the release to exist…');
+      const rep = await preflight(entry, { dir, registry: opts.registry });
+      for (const f of rep.failures) log('      ✗ ' + f);
+      if (!rep.ok) {
+        throw new Error(
+          `preflight found ${rep.failures.length} problem(s) — nothing was submitted.\n` +
+          `Did you push your code to ${opts.repo} before publishing?`,
+        );
+      }
+      log(`      ✓ all ${rep.passed.length} checks passed`);
+    }
+
+    // 5. Open the registry PR
+    step(5, 'Opening the registry PR…');
+    const { prUrl } = await submitEntry(entry, { registry: opts.registry, draft: opts.draft, signKeyPath: opts.signKeyPath });
+    log('      ✓ done');
+    // Keep the artifact. It is the exact bytes the release and the entry's sha256 pin were computed
+    // from — a re-pack on another machine or SDK version can differ (CRLF, walk order), so anyone
+    // re-running `entry`/`sign` afterwards must hash THIS file, not a rebuild.
+    log(`      artifact kept at ${zip}`);
+    return { prUrl };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    if (opts.keepRelease) {
       throw new Error(
-        `preflight found ${rep.failures.length} problem(s) — nothing was submitted.\n` +
-        `The release is cut, so fix these, commit, and re-run against a NEW tag (or --force if this one was never merged).\n` +
-        `Did you push your code to ${opts.repo} before publishing?`,
+        `${msg}\n\nThe tag and release were left in place (--keep-release). To clean up by hand:\n${manualCleanup}`,
       );
     }
-    log(`      ✓ all ${rep.passed.length} checks passed`);
+    rollback();
+    throw new Error(
+      `${msg}\n\nEverything this run created was rolled back — the tag ${opts.tag} is free again. Fix the problem and re-run.`,
+    );
   }
-
-  // 5. Open the registry PR
-  step(5, 'Opening the registry PR…');
-  const { prUrl } = submitEntry(entry, { registry: opts.registry, draft: opts.draft });
-  log('      ✓ done');
-  // Keep the artifact. It is the exact bytes the release and the entry's sha256 pin were computed
-  // from — a re-pack on another machine or SDK version can differ (CRLF, walk order), so anyone
-  // re-running `entry`/`sign` afterwards must hash THIS file, not a rebuild.
-  log(`      artifact kept at ${zip}`);
-  return { prUrl };
 }
diff --git a/plugin-sdk/src/cli/retro-sign.ts b/plugin-sdk/src/cli/retro-sign.ts
new file mode 100644
index 000000000..10492d954
--- /dev/null
+++ b/plugin-sdk/src/cli/retro-sign.ts
@@ -0,0 +1,81 @@
+/**
+ * Retro-signing: the missing half of "you can start signing late".
+ *
+ * Server-side, adding a key at v1.4.0 breaks nobody — TREK pins the key only when a signed
+ * version installs. But the REGISTRY refuses a mixed entry (key present, older versions
+ * unsigned), and for good reason: once an instance pins your key, it refuses the unsigned
+ * older versions, and "install latest compatible" can legitimately resolve an older host to
+ * one of them. So every version must be signed the moment a key appears — which used to mean
+ * downloading each old artifact and signing it by hand.
+ *
+ * This does that tedious part: for each unsigned version it downloads the pinned artifact,
+ * verifies the bytes still hash to the entry's pinned sha256 (a mismatch means the release
+ * asset was changed — a far bigger problem than signing), and signs those exact bytes.
+ */
+import { createHash } from 'node:crypto';
+import { loadPrivateKey, publicKeyBase64, signArtifact } from './sign.js';
+
+export interface RetroSignableEntry {
+  id?: string;
+  authorPublicKey?: string;
+  versions: Array<{ version: string; downloadUrl: string; sha256: string; signature?: string }>;
+}
+
+/** True when the entry carries a key but not a signature on every version. */
+export function needsRetroSign(entry: RetroSignableEntry): boolean {
+  return !!entry.authorPublicKey && entry.versions.some((v) => !v.signature);
+}
+
+/**
+ * Sign every unsigned version in place with the key at `keyPath`. Returns the versions it
+ * signed. Throws — without half-signing the entry — when the key doesn't match the entry's
+ * `authorPublicKey`, or when any artifact can't be fetched or no longer matches its pin.
+ */
+export async function retroSignVersions(
+  entry: RetroSignableEntry,
+  keyPath: string,
+  log: (line: string) => void = () => {},
+): Promise<string[]> {
+  if (!needsRetroSign(entry)) return [];
+
+  const key = loadPrivateKey(keyPath);
+  if (publicKeyBase64(key) !== entry.authorPublicKey) {
+    throw new Error(
+      'this signing key differs from the entry\'s authorPublicKey — retro-signing older versions with it would produce signatures TREK rejects. Use the original key.',
+    );
+  }
+
+  const unsigned = entry.versions.filter((v) => !v.signature);
+  const signatures = new Map<string, string>();
+  const failures: string[] = [];
+  for (const v of unsigned) {
+    try {
+      const r = await fetch(v.downloadUrl, { headers: { 'User-Agent': 'trek-plugin' } });
+      if (!r.ok) { failures.push(`v${v.version}: HTTP ${r.status} fetching ${v.downloadUrl}`); continue; }
+      const bytes = Buffer.from(await r.arrayBuffer());
+      const hash = createHash('sha256').update(bytes).digest('hex');
+      if (hash !== v.sha256) {
+        failures.push(`v${v.version}: the release asset no longer hashes to its pinned sha256 (got ${hash.slice(0, 12)}…, pinned ${v.sha256.slice(0, 12)}…) — the artifact was changed after publishing, which is a bigger problem than signing`);
+        continue;
+      }
+      signatures.set(v.version, signArtifact(bytes, key));
+    } catch (e) {
+      failures.push(`v${v.version}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+
+  if (failures.length) {
+    throw new Error(
+      `could not retro-sign ${failures.length} older version(s) — the registry requires every version signed once a key is present:\n` +
+      failures.map((f) => `  ✗ ${f}`).join('\n') +
+      '\n\nNothing was signed. Fix the artifacts above (or remove those versions from the entry) and re-run.',
+    );
+  }
+
+  // All-or-nothing: only mutate the entry once every artifact verified and signed.
+  for (const v of unsigned) {
+    v.signature = signatures.get(v.version)!;
+    log(`      ✓ retro-signed v${v.version}`);
+  }
+  return unsigned.map((v) => v.version);
+}
diff --git a/plugin-sdk/src/cli/submit.ts b/plugin-sdk/src/cli/submit.ts
index ffca8cd51..41c90e5da 100644
--- a/plugin-sdk/src/cli/submit.ts
+++ b/plugin-sdk/src/cli/submit.ts
@@ -11,12 +11,13 @@ import os from 'node:os';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { readJsonFile } from './json.js';
+import { needsRetroSign, retroSignVersions } from './retro-sign.js';
 
 const DEFAULT_REGISTRY = 'liketrek/TREK-Plugins';
 
 interface EntryLike {
   id: string; name?: string; authorPublicKey?: string;
-  versions: { version: string }[];
+  versions: { version: string; downloadUrl: string; sha256: string; signature?: string }[];
 }
 
 function git(cwd: string, ...a: string[]): string {
@@ -42,7 +43,7 @@ function mergeOnto(existing: EntryLike, fresh: EntryLike): EntryLike {
   return merged;
 }
 
-export function submitEntry(entry: EntryLike, opts: { registry?: string; branch?: string; draft?: boolean; keep?: boolean } = {}): { prUrl: string } {
+export async function submitEntry(entry: EntryLike, opts: { registry?: string; branch?: string; draft?: boolean; keep?: boolean; signKeyPath?: string } = {}): Promise<{ prUrl: string }> {
   const registry = opts.registry || DEFAULT_REGISTRY;
   const name = registry.split('/')[1];
   const login = gh('api', 'user', '--jq', '.login');
@@ -51,6 +52,17 @@ export function submitEntry(entry: EntryLike, opts: { registry?: string; branch?
   // Ensure the fork exists (idempotent — prints "already exists" if it does).
   try { gh('repo', 'fork', registry, '--clone=false'); } catch { /* already forked */ }
 
+  // Fast-forward the fork from the registry. The PR branch is based on upstream/main either
+  // way, but a fork left far behind has broken pushes and PRs in the wild — and costs nothing
+  // to keep current. Best-effort: a diverged fork can't be fast-forwarded, and that alone
+  // must not sink the submit.
+  try { gh('repo', 'sync', `${login}/${name}`, '--source', registry); } catch {
+    console.error(
+      `! could not fast-forward your fork ${login}/${name} (diverged?) — continuing, the PR branch is based on the registry's main.\n` +
+      `  If the push or PR fails, reset the fork with: gh repo sync ${login}/${name} --force`,
+    );
+  }
+
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'trek-submit-'));
   try {
     // Clone the fork (pushable via gh auth), then base a branch on the CURRENT upstream main.
@@ -77,6 +89,19 @@ export function submitEntry(entry: EntryLike, opts: { registry?: string; branch?
       toWrite = mergeOnto(existing, entry);
       action = 'update';
     }
+    // First signed update onto an unsigned history: the registry refuses a mixed entry (key
+    // present, older versions unsigned) — see retro-sign.ts for why. Sign the older versions
+    // with the same key, or say exactly what is missing.
+    if (needsRetroSign(toWrite)) {
+      if (!opts.signKeyPath) {
+        throw new Error(
+          `this update adds your signing key, but ${toWrite.versions.filter((v) => !v.signature).length} older version(s) are unsigned — ` +
+          'the registry requires every version signed once a key is present. Re-run with --sign so they can be signed for you.',
+        );
+      }
+      console.error('      older versions are unsigned — signing them with your key so the registry accepts the update');
+      await retroSignVersions(toWrite, opts.signKeyPath, (line) => console.error(line));
+    }
     fs.mkdirSync(path.dirname(abs), { recursive: true });
     fs.writeFileSync(abs, JSON.stringify(toWrite, null, 2) + '\n');
 
diff --git a/plugin-sdk/src/cli/trek-plugin.ts b/plugin-sdk/src/cli/trek-plugin.ts
index 971b420ff..0ae8f2067 100644
--- a/plugin-sdk/src/cli/trek-plugin.ts
+++ b/plugin-sdk/src/cli/trek-plugin.ts
@@ -24,6 +24,8 @@ import { runShot } from './shot.js';
 import { preflight } from './preflight.js';
 import { submitEntry } from './submit.js';
 import { publishPlugin } from './publish.js';
+import { unrelease } from './unrelease.js';
+import { needsRetroSign, retroSignVersions } from './retro-sign.js';
 import { loadContext } from './checks/context.js';
 import { runOffline } from './checks/index.js';
 import { renderPlain } from './checks/report.js';
@@ -81,7 +83,8 @@ const COMMAND_FLAGS: Record<string, readonly string[]> = {
   preflight: ['repo', 'tag', 'entry', 'zip', 'commit', 'sign', 'key', 'all', 'registry'],
   submit: ['repo', 'tag', 'zip', 'commit', 'sign', 'key', 'registry', 'branch', 'draft', 'keep'],
   release: ['repo', 'tag', 'out', 'notes', 'commit', 'merge', 'sign', 'key'],
-  publish: ['repo', 'tag', 'sign', 'key', 'registry', 'draft', 'notes', 'no-preflight', 'no-checks', 'force'],
+  publish: ['repo', 'tag', 'sign', 'key', 'registry', 'draft', 'notes', 'no-preflight', 'no-checks', 'force', 'keep-release'],
+  unrelease: ['repo', 'tag', 'registry', 'yes'],
 };
 
 function assertKnownFlags(command: string, f: Flags): void {
@@ -107,6 +110,26 @@ function signKey(f: Flags): string | undefined {
   return f.sign === 'true' ? (f.key || defaultKeyPath()) : f.sign;
 }
 
+/**
+ * First signed update onto an unsigned history (`--merge` + `--sign`): the registry requires
+ * every version signed once a key is present, so sign the older versions too — or say exactly
+ * what is missing. See retro-sign.ts.
+ */
+async function maybeRetroSign(
+  entry: { authorPublicKey?: string; versions: Array<{ version: string; downloadUrl: string; sha256: string; signature?: string }> },
+  keyPath: string | undefined,
+): Promise<void> {
+  if (!needsRetroSign(entry)) return;
+  if (!keyPath) {
+    fail(
+      `this entry carries your signing key, but ${entry.versions.filter((v) => !v.signature).length} older version(s) are unsigned — ` +
+      'the registry requires every version signed once a key is present. Re-run with --sign so they can be signed for you.',
+    );
+  }
+  console.error('older versions are unsigned — signing them with your key so the registry accepts the update');
+  await retroSignVersions(entry, keyPath!, (line) => console.error(line));
+}
+
 /**
  * Resolve the repo + tag every publishing command needs. Interactive: prompt for
  * whatever is missing. Non-interactive: reproduce the command's exact error so
@@ -322,6 +345,7 @@ async function dispatch(command: string, f: Flags, positional: string[]): Promis
       commit: f.commit, asset: f.asset, mergePath: f.merge,
       signKeyPath: signKey(f), now: new Date().toISOString(),
     });
+    await maybeRetroSign(entry, signKey(f));
     const json = JSON.stringify(entry, null, 2) + '\n';
     if (f.out) {
       fs.writeFileSync(f.out, json);
@@ -384,6 +408,7 @@ async function dispatch(command: string, f: Flags, positional: string[]): Promis
       dir, repo, tag,
       signKeyPath, signing, registry: f.registry, draft: !!f.draft,
       notes: f.notes, skipPreflight: !!f['no-preflight'], skipChecks: !!f['no-checks'], force: !!f.force,
+      keepRelease: !!f['keep-release'],
       now: new Date().toISOString(),
       log: tui ? clackLogSink : undefined,
     });
@@ -400,12 +425,12 @@ async function dispatch(command: string, f: Flags, positional: string[]): Promis
       const ok = await promptConfirm({ message: 'Open the registry PR now?', initialValue: true });
       if (!ok) { outro('Cancelled — no PR opened.'); return; }
       const s = spinner(); s.start('Opening the registry PR');
-      const { prUrl } = submitEntry(entry, { registry: f.registry, branch: f.branch, draft: !!f.draft, keep: !!f.keep });
+      const { prUrl } = await submitEntry(entry, { registry: f.registry, branch: f.branch, draft: !!f.draft, keep: !!f.keep, signKeyPath: signKey(f) });
       s.stop('Registry PR opened');
       console.log(prUrl);
     } else {
       console.error(`Opening a registry PR for ${entry.id} ${entry.versions[0].version}…`);
-      const { prUrl } = submitEntry(entry, { registry: f.registry, branch: f.branch, draft: !!f.draft, keep: !!f.keep });
+      const { prUrl } = await submitEntry(entry, { registry: f.registry, branch: f.branch, draft: !!f.draft, keep: !!f.keep, signKeyPath: signKey(f) });
       console.log(prUrl);
     }
   } else if (command === 'release') {
@@ -421,6 +446,7 @@ async function dispatch(command: string, f: Flags, positional: string[]): Promis
       execFileSync('gh', ['release', 'create', tag, packed.artifact, '--repo', repo, '--title', tag, '--notes', f.notes || `Release ${tag}`], { stdio: 'pipe' });
       s.stop(`Released ${tag} on ${repo}`);
       const entry = buildEntry({ dir, repo, tag, zipPath: packed.artifact, commit: f.commit, mergePath: f.merge, signKeyPath: signKey(f), now: new Date().toISOString() });
+      await maybeRetroSign(entry, signKey(f));
       logInfo(`Registry entry (add as registry/plugins/${entry.id}.json, or run \`npx trek-plugin-sdk submit\`):`);
       process.stdout.write(JSON.stringify(entry, null, 2) + '\n');
     } else {
@@ -429,9 +455,28 @@ async function dispatch(command: string, f: Flags, positional: string[]): Promis
       console.error(`Creating GitHub release ${tag} on ${repo}…`);
       execFileSync('gh', ['release', 'create', tag, packed.artifact, '--repo', repo, '--title', tag, '--notes', f.notes || `Release ${tag}`], { stdio: 'inherit' });
       const entry = buildEntry({ dir, repo, tag, zipPath: packed.artifact, commit: f.commit, mergePath: f.merge, signKeyPath: signKey(f), now: new Date().toISOString() });
+      await maybeRetroSign(entry, signKey(f));
       console.error('\nRegistry entry (add as registry/plugins/' + entry.id + '.json in a TREK-Plugins PR, or run `npx trek-plugin-sdk submit`):\n');
       process.stdout.write(JSON.stringify(entry, null, 2) + '\n');
     }
+  } else if (command === 'unrelease') {
+    if (positional[0]) f.tag = positional[0];
+    const { repo, tag } = await ensureRepoTag(f, 'unrelease needs a tag and --repo <owner/name>: trek-plugin unrelease vX.Y.Z --repo <owner/name>');
+    const dir = positional[1] || '.';
+    let yes = !!f.yes;
+    if (tui && !yes) {
+      const ok = await promptConfirm({
+        message: `Delete the GitHub release, remote tag and local tag ${tag} on ${repo}?`,
+        initialValue: false,
+      });
+      if (!ok) { outro('Cancelled — nothing was deleted.'); return; }
+      yes = true; // the human just consented — that covers the registry-unreachable guard too
+    }
+    const { deleted } = await unrelease({ dir, tag, repo, registry: f.registry, yes, log: tui ? clackLogSink : undefined });
+    const summary = deleted.length
+      ? `Deleted: ${deleted.join(', ')} — ${tag} is free to publish again.`
+      : `Nothing to delete — no release or tags found for ${tag}.`;
+    if (tui) logSuccess(summary); else console.error(summary);
   } else {
     console.error(`unknown command: ${command}\n${USAGE}`);
     process.exit(2);
diff --git a/plugin-sdk/src/cli/ui.ts b/plugin-sdk/src/cli/ui.ts
index f8a0955dd..08400859a 100644
--- a/plugin-sdk/src/cli/ui.ts
+++ b/plugin-sdk/src/cli/ui.ts
@@ -268,7 +268,7 @@ export const PERMISSION_CATALOG: { value: string; label: string; hint: string; f
   );
 
 /** Every grantable permission id. Derived — never hand-maintained. */
-export const KNOWN_PERMISSIONS: string[] = PERMISSION_CATALOG.map((p) => p.value);
+export const PICKER_PERMISSIONS: string[] = PERMISSION_CATALOG.map((p) => p.value);
 
 // ── reporter seam (for commands that log their own progress, e.g. publish) ────
 
diff --git a/plugin-sdk/src/cli/unrelease.ts b/plugin-sdk/src/cli/unrelease.ts
new file mode 100644
index 000000000..d0111ba29
--- /dev/null
+++ b/plugin-sdk/src/cli/unrelease.ts
@@ -0,0 +1,110 @@
+/**
+ * trek-plugin unrelease <tag> — undo a release that never made it into the registry.
+ *
+ * A failed publish (or a change of heart before the PR merges) leaves up to three things
+ * behind: the GitHub release, the remote tag, and the local tag. Cleaning them up by hand
+ * is three commands in the right order; this is that, with one hard safety rail:
+ *
+ * A version that IS published in the registry is immutable — the registry pins the
+ * artifact's sha256, so deleting or re-cutting its release breaks install/update for
+ * everyone who already has it. unrelease refuses those outright, with no override.
+ */
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { readJsonFile } from './json.js';
+import { DEFAULT_REGISTRY } from './checks/network.js';
+import { plainLog, type LogSink } from './ui.js';
+
+function git(dir: string, args: string[]): string {
+  return execFileSync('git', ['-C', dir, ...args], { encoding: 'utf8', stdio: 'pipe' }).toString().trim();
+}
+
+interface PublishedIndex { plugins?: Array<{ id?: string; versions?: Array<{ version?: string }> }> }
+
+/**
+ * The published registry index, or null when it cannot be read (offline, mirror down).
+ * Null is the dangerous answer — the caller must then have explicit consent (--yes).
+ */
+async function publishedIndex(registry: string): Promise<PublishedIndex | null> {
+  try {
+    const r = await fetch(`https://raw.githubusercontent.com/${registry}/main/dist/index.json`, {
+      headers: { 'User-Agent': 'trek-plugin' },
+    });
+    if (!r.ok) return null;
+    return (await r.json()) as PublishedIndex;
+  } catch {
+    return null;
+  }
+}
+
+export async function unrelease(opts: {
+  dir: string; tag: string; repo: string; registry?: string;
+  /** Consent to delete when the registry index cannot be verified. */
+  yes?: boolean;
+  log?: LogSink;
+}): Promise<{ deleted: string[] }> {
+  const log = opts.log ?? plainLog;
+  const dir = path.resolve(opts.dir);
+  const { tag, repo } = opts;
+  const registry = opts.registry || DEFAULT_REGISTRY;
+  const manifest = readJsonFile<{ id?: unknown }>(path.join(dir, 'trek-plugin.json'));
+  const id = String(manifest.id ?? '');
+  const version = tag.replace(/^v/, '');
+
+  const index = await publishedIndex(registry);
+  if (index === null) {
+    if (!opts.yes) {
+      throw new Error(
+        `could not read the registry index (${registry}) to verify ${id} ${version} is not published.\n` +
+        `Deleting a PUBLISHED version's release breaks its sha256 pin for everyone who installed it.\n` +
+        `If you are sure this version never merged into the registry, re-run with --yes.`,
+      );
+    }
+    log(`      ! registry unreachable — proceeding on --yes`);
+  } else {
+    const mine = index.plugins?.find((p) => p.id === id);
+    if (mine?.versions?.some((v) => v.version === version)) {
+      throw new Error(
+        `${id} ${version} is PUBLISHED in the registry (${registry}) — its release is immutable.\n` +
+        `The registry pins this artifact's sha256; deleting the release would break install/update\n` +
+        `for everyone who has it. Ship a new version instead. (There is deliberately no override.)`,
+      );
+    }
+  }
+
+  // Delete in blast-radius order: release, remote tag, local tag. Each is best-effort and
+  // reported, so a partial previous cleanup doesn't stop the rest.
+  const deleted: string[] = [];
+
+  let hasRelease = false;
+  try { execFileSync('gh', ['release', 'view', tag, '--repo', repo], { stdio: 'pipe' }); hasRelease = true; } catch { /* absent */ }
+  if (hasRelease) {
+    execFileSync('gh', ['release', 'delete', tag, '--repo', repo, '--yes'], { stdio: 'pipe' });
+    deleted.push('release');
+    log(`      ✓ deleted release ${tag} on ${repo}`);
+  } else {
+    log(`      - no release ${tag} on ${repo}`);
+  }
+
+  let hasRemoteTag = false;
+  try { hasRemoteTag = git(dir, ['ls-remote', '--tags', 'origin', `refs/tags/${tag}`]) !== ''; } catch { /* no origin — nothing to delete */ }
+  if (hasRemoteTag) {
+    git(dir, ['push', 'origin', `:refs/tags/${tag}`]);
+    deleted.push('remote tag');
+    log(`      ✓ deleted remote tag ${tag}`);
+  } else {
+    log(`      - no tag ${tag} on origin`);
+  }
+
+  let hasLocalTag = false;
+  try { git(dir, ['rev-parse', `${tag}^{commit}`]); hasLocalTag = true; } catch { /* absent */ }
+  if (hasLocalTag) {
+    git(dir, ['tag', '-d', tag]);
+    deleted.push('local tag');
+    log(`      ✓ deleted local tag ${tag}`);
+  } else {
+    log(`      - no local tag ${tag}`);
+  }
+
+  return { deleted };
+}
diff --git a/plugin-sdk/src/egress-policy.ts b/plugin-sdk/src/egress-policy.ts
index 45b3a3007..6c8130d09 100644
--- a/plugin-sdk/src/egress-policy.ts
+++ b/plugin-sdk/src/egress-policy.ts
@@ -91,7 +91,10 @@ function embeddedTransitionIpv4(g: number[]): string | null {
 
 /** Expand an IPv6 literal into its 8 numeric hextets, or null if not a valid IPv6. */
 function expandV6(ip: string): number[] | null {
-  let h = ip.toLowerCase().replace(/%.*$/, '');
+  // Cut the zone id off (`fe80::1%eth0`): indexOf rather than a `%.*$` regex, whose
+  // greedy tail rescans the whole string once per `%` on a host that never matches.
+  const zone = ip.indexOf('%');
+  let h = (zone === -1 ? ip : ip.slice(0, zone)).toLowerCase();
   if (!h.includes(':')) return null;
   const dotted = h.match(/^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
   if (dotted) {
@@ -104,9 +107,9 @@ function expandV6(ip: string): number[] | null {
   const head = halves[0] ? halves[0].split(':') : [];
   const tail = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
   const groups =
-    halves.length === 2 ? [...head, ...Array(8 - head.length - tail.length).fill('0'), ...tail] : head;
+    halves.length === 2 ? [...head, ...new Array(8 - head.length - tail.length).fill('0'), ...tail] : head;
   if (groups.length !== 8) return null;
-  const nums = groups.map((x) => (x === '' ? NaN : parseInt(x, 16)));
+  const nums = groups.map((x) => (x === '' ? Number.NaN : Number.parseInt(x, 16)));
   return nums.some((n) => !Number.isInteger(n) || n < 0 || n > 0xffff) ? null : nums;
 }
 
diff --git a/plugin-sdk/src/generated/host-facts.ts b/plugin-sdk/src/generated/host-facts.ts
index cc8a46976..48db7e5eb 100644
--- a/plugin-sdk/src/generated/host-facts.ts
+++ b/plugin-sdk/src/generated/host-facts.ts
@@ -1,5 +1,5 @@
 // GENERATED — do not edit by hand.
-// Source: server/src/nest/plugins/protocol/envelope.ts
+// Source: server/src/nest/plugins/protocol/envelope.ts + server/src/plugin-event-sink.ts
 // Regenerate: node --import tsx server/scripts/gen-plugin-facts.ts
 
 export const HOOK_PERMISSION: Readonly<Record<string, string>> = {
@@ -316,3 +316,36 @@ export const USER_DATA_PERMISSION = 'hook:user-data';
 export const EVENTS_PERMISSION = 'events:subscribe';
 export const JOBS_PERMISSION = 'jobs:run';
 export const HTTP_OUTBOUND_PREFIX = 'http:outbound:';
+
+/**
+ * Core-event catalog. Delivery names are the WebSocket broadcast names,
+ * `<family>:<verb>` (e.g. `place:created`). A subscribed plugin receives
+ * `{event, tripId, entity?, entityId?, snapshot?}`; `snapshot` is delivered only
+ * when the plugin also holds EVENT_SNAPSHOT_GRANT[family]. Delete/reorder/bulk
+ * events carry no snapshot.
+ */
+export const EVENT_FAMILIES: readonly string[] = [
+  'accommodation',
+  'assignment',
+  'budget',
+  'day',
+  'dayNote',
+  'file',
+  'packing',
+  'place',
+  'reservation',
+  'trip',
+];
+
+export const EVENT_SNAPSHOT_GRANT: Readonly<Record<string, string>> = {
+  place: 'db:read:trips',
+  day: 'db:read:trips',
+  reservation: 'db:read:trips',
+  accommodation: 'db:read:trips',
+  assignment: 'db:read:trips',
+  trip: 'db:read:trips',
+  budget: 'db:read:costs',
+  packing: 'db:read:packing',
+  dayNote: 'db:read:daynotes',
+  file: 'db:read:files',
+};
diff --git a/plugin-sdk/src/index.ts b/plugin-sdk/src/index.ts
index 5c30157be..a2d79997f 100644
--- a/plugin-sdk/src/index.ts
+++ b/plugin-sdk/src/index.ts
@@ -23,6 +23,11 @@ export interface BudgetItem { id: number; trip_id?: number; name?: string; total
 export interface Assignment { id: number; day_id?: number; place_id?: number; notes?: string | null; [k: string]: unknown }
 export interface User { id: number; username?: string; display_name?: string | null; avatar?: string | null; [k: string]: unknown }
 
+/** Every ctx.* call is rate-limited per plugin at the host RPC dispatch boundary:
+ * burst 60, sustained 20/s, 16 in-flight. A throttled call is refused (retryable)
+ * rather than executed, with:
+ *   HOST_ERROR: rate limit exceeded — slow down ctx.* calls
+ * A legitimate plugin never hits the generous burst. See README § Runtime limits. */
 export interface PluginContext {
   readonly id: string;
   readonly config: Readonly<Record<string, unknown>>;
@@ -32,6 +37,9 @@ export interface PluginContext {
   settings: {
     get(key: string): Promise<unknown>;
   };
+  /** Your OWN sqlite database (`db:own`) — a separate file the plugin never gets a
+   * path or connection to directly. Quota: 256 MB per plugin (writes past it fail);
+   * result sets are capped at 100,000 rows. See `tx()` below for the atomic-batch cap. */
   db: {
     query<T = unknown>(sql: string, ...args: unknown[]): Promise<T[]>;
     exec(sql: string, ...args: unknown[]): Promise<{ changes: number }>;
@@ -42,10 +50,15 @@ export interface PluginContext {
     tx(ops: Array<{ sql: string; args?: unknown[] }>): Promise<{ results: Array<{ changes?: number; rows?: unknown[] }> }>;
   };
   trips: {
-    getById(tripId: number, asUserId?: number): Promise<Trip | null>;
-    getPlaces(tripId: number, asUserId?: number): Promise<Place[]>;
+    // `asUserId` is accepted for source compatibility but IGNORED by the host —
+    // trip reads are always membership-checked against the authenticated user of
+    // the current invocation (the request's `req.user`), which the plugin cannot
+    // override. Only reachable from a route handler (a user context); a job has
+    // no user and its trip reads are refused.
+    getById(tripId: number, /** @deprecated ignored by the host */ asUserId?: number): Promise<Trip | null>;
+    getPlaces(tripId: number, /** @deprecated ignored by the host */ asUserId?: number): Promise<Place[]>;
     /** Hydrated like the REST list: each row carries `endpoints`, `day_positions` + the day/place joins. */
-    getReservations(tripId: number, asUserId?: number): Promise<Reservation[]>;
+    getReservations(tripId: number, /** @deprecated ignored by the host */ asUserId?: number): Promise<Reservation[]>;
     /** The trip's days with their `assignments` + `notes_items` (the planner GET's shape). Needs `db:read:trips`. */
     getDays(tripId: number): Promise<Day[]>;
     /** The trip's lodging blocks (day_accommodations) with joined place fields. Needs `db:read:trips`. */
@@ -97,7 +110,9 @@ export interface PluginContext {
     update(tripId: number, itemId: number, input: Record<string, unknown>): Promise<PackingItem>;
     /** Delete a packing item. Needs `db:write:packing` + packing_edit. */
     delete(tripId: number, itemId: number): Promise<{ deleted: boolean }>;
-    /** List/create/update/delete packing bags + set members (no privacy). Needs `db:write:packing` + packing_edit. */
+    // List/create/update/delete packing bags + set members (no privacy). Needs
+    // `db:write:packing` + packing_edit.
+    /** Needs 'db:write:packing' (intentional — bags are the write-side structure; packing.list is the read surface). */
     listBags(tripId: number): Promise<unknown[]>;
     createBag(tripId: number, input: { name: string; color?: string }): Promise<unknown>;
     updateBag(tripId: number, bagId: number, input: Record<string, unknown>): Promise<unknown>;
@@ -133,13 +148,17 @@ export interface PluginContext {
   };
   /** Host-mediated notification. The plugin supplies only target + plain text; the host
    * owns delivery + preferences. Recipient is FORCED to the acting user (scope 'user',
-   * targetId = the acting user) or a trip they belong to (scope 'trip'). Needs `notify:send`. */
+   * targetId = the acting user) or a trip they belong to (scope 'trip'). Needs `notify:send`.
+   * Daily budget: 100/day per plugin (UTC midnight rollover); past it `send` throws
+   * "daily notification budget exhausted (resets at UTC midnight)". See README § Runtime limits. */
   notify: {
     send(input: { title: string; body: string; link?: string; scope: 'user' | 'trip'; targetId: number }): Promise<{ sent: boolean }>;
   };
   /** Host-mediated LLM using the admin/user-configured provider — the plugin never holds a
    * key. `complete` returns { text }; `extract` returns { results } for your JSON schema.
-   * Output is DATA: to persist it, push it through the gated write methods yourself. Needs `ai:invoke`. */
+   * Output is DATA: to persist it, push it through the gated write methods yourself. Needs `ai:invoke`.
+   * Daily budget: 200/day per plugin (UTC midnight rollover); past it these throw
+   * "daily AI budget exhausted (resets at UTC midnight)". See README § Runtime limits. */
   ai: {
     complete(prompt: string, system?: string): Promise<{ text: string }>;
     extract(text: string, jsonSchema: object, prompt?: string): Promise<{ results: Record<string, unknown>[] }>;
@@ -147,7 +166,17 @@ export interface PluginContext {
   /** Host-brokered outbound OAuth: a short-lived access token for the ACTING USER of a
    * third-party service the host connected on their behalf (Settings → Plugins → Connect).
    * Returns null when the user hasn't connected or in a userless context. The host holds
-   * the refresh token + client secret — you never see them. Needs `oauth:client`. */
+   * the refresh token + client secret — you never see them. Needs `oauth:client`.
+   *
+   * The host runs the whole flow (authorize -> callback -> token exchange -> refresh)
+   * with PKCE + a 10-minute state TTL. Provider config is the plugin's admin-owned
+   * INSTANCE settings — declare `scope:'instance'` manifest fields named
+   * `oauth_authorize_url`, `oauth_token_url`, `oauth_scopes` (optional),
+   * `oauth_client_id`, `oauth_client_secret` and the admin fills them in. Both
+   * endpoint URLs must be https and may not point at loopback/`.local`/`.internal`/
+   * private/metadata addresses. The host exposes
+   * `/api/plugin-oauth/:id/status|connect|callback|disconnect` for the connect UI —
+   * plugin code only ever calls `getAccessToken()`. See README § OAuth broker. */
   oauth: {
     getAccessToken(): Promise<string | null>;
   };
@@ -282,7 +311,9 @@ export interface PluginContext {
   };
   // Your OWN namespaced key/value store on a trip/place/day (#1429) — enrich core
   // entities without forking the schema. Needs `db:meta`; the entity must belong to
-  // a trip the current user can access. Values are JSON-serialisable.
+  // a trip the current user can access. Values are JSON-serialisable. Quotas (per
+  // plugin + entity): 64 KB serialized JSON per value, 256 chars per key, 100 keys.
+  // See README § Runtime limits.
   meta: {
     get(entityType: 'trip' | 'place' | 'day' | 'reservation' | 'accommodation', entityId: number, key: string): Promise<unknown>;
     set(entityType: 'trip' | 'place' | 'day' | 'reservation' | 'accommodation', entityId: number, key: string, value: unknown): Promise<unknown>;
@@ -361,7 +392,8 @@ export interface Photo {
 export interface PhotoProvider {
   /** Search your photo backend. `ctx` is the last arg so you can reach it via
    * ctx.settings/oauth/http. Needs `hook:photo-provider`. Surfaced in the photo picker
-   * and at `GET /api/plugin-photos/search`; thumbnail/full URLs must be http/https. */
+   * and at `GET /api/plugin-photos/search`; thumbnail/full URLs must be http/https.
+   * The host caps results at 60 photos per page. */
   search(query: string, opts: { page: number; limit: number }, ctx: PluginContext): Promise<{ photos: Photo[]; total: number; hasMore: boolean }>;
   getById(id: string, ctx: PluginContext): Promise<Photo | null>;
 }
@@ -421,18 +453,21 @@ export interface CalendarSource {
   // start/end are ISO strings — the host->plugin boundary is JSON, so a Date would
   // arrive as a string anyway (kept in lockstep with the runtime SDK copy). `ctx` is the
   // last arg. Aggregated for the signed-in user at `GET /api/plugin-calendar`.
+  // The host caps results at 500 events per source per request.
   getEvents(userId: number, start: string, end: string, ctx: PluginContext): Promise<CalendarEvent[]>;
 }
 /** One row of extra place info TREK renders natively (reviews/ratings/links/…). */
 export interface PlaceDetailItem { label: string; value?: string; url?: string; }
 export interface PlaceDetailProvider {
-  /** Extra info for a place; core calls this for a `place-detail` panel. Needs `hook:place-detail-provider`. */
+  /** Extra info for a place; core calls this for a `place-detail` panel. Needs `hook:place-detail-provider`.
+   * The host caps results at 12 items per provider. */
   getDetails(placeId: number, ctx: PluginContext): Promise<PlaceDetailItem[]>;
 }
 /** A validation/warning a plugin raises on a trip; TREK surfaces it in the planner. */
 export interface TripWarning { level: 'info' | 'warning' | 'error'; message: string; dayId?: number; placeId?: number; }
 export interface WarningProvider {
-  /** Problems/warnings for a trip (e.g. overpacked day, place closed). Needs `hook:trip-warning-provider`. */
+  /** Problems/warnings for a trip (e.g. overpacked day, place closed). Needs `hook:trip-warning-provider`.
+   * The host caps results at 20 warnings per provider, each message truncated to 300 chars. */
   getWarnings(tripId: number, ctx: PluginContext): Promise<TripWarning[]>;
 }
 
@@ -466,7 +501,8 @@ export type TableContribution = TableColumnContribution | TableActionContributio
 export interface TableContributor {
   /** `view` is one of 'reservations' | 'places' | 'day' | 'costs' | 'packing' | 'files'.
    * Runs with the current user bound, on a short timeout; a slow/failing call is
-   * skipped, never fatal. Needs `hook:table-contributor`. */
+   * skipped, never fatal. Needs `hook:table-contributor`. The host caps results at
+   * 20 columns and 10 actions per entity. */
   getContributions(view: string, tripId: number, ctx: PluginContext): Promise<TableContribution[]>;
 }
 
@@ -485,7 +521,7 @@ export interface MapMarkerContribution {
 export interface MapMarkerProvider {
   /** Return markers to overlay on a trip's map. Runs with the current user bound,
    * on a short timeout; the host caps the marker count and skips a failing call.
-   * Needs `hook:map-marker-provider`. */
+   * Needs `hook:map-marker-provider`. The host caps results at 200 markers per provider. */
   getMarkers(tripId: number, ctx: PluginContext): Promise<MapMarkerContribution[]>;
 }
 
@@ -652,7 +688,8 @@ export interface PdfSection {
 export interface PdfSectionProvider {
   /** Return sections to append to a trip's PDF export. Runs with the current user
    * bound, on a short timeout; the host caps counts/lengths and skips a failing
-   * call. Needs `hook:pdf-section-provider`. */
+   * call. Needs `hook:pdf-section-provider`. The host caps results at 5 sections
+   * per provider (see `PdfSection` above for the per-section paragraph/table caps). */
   getSections(tripId: number, ctx: PluginContext): Promise<PdfSection[]>;
 }
 
@@ -668,7 +705,8 @@ export interface AtlasLayerProvider {
   /** Return tint layers for the ACTING USER's Atlas map. User-scoped — the host binds
    * the current user; the hook takes no target parameter. Runs on a short timeout;
    * the host caps the layer/country counts and skips a failing call.
-   * Needs `hook:atlas-layer-provider`. */
+   * Needs `hook:atlas-layer-provider`. The host caps results at 3 layers per provider
+   * (see `AtlasLayer` above for the per-layer country cap). */
   getLayers(ctx: PluginContext): Promise<AtlasLayer[]>;
 }
 
@@ -687,7 +725,8 @@ export interface TripCardProvider {
   /** Return badges for the dashboard trip cards currently on screen. `tripIds` are
    * exactly those cards (each already access-checked for the acting user). Runs with
    * the current user bound, on a short timeout; the host caps the badge count and
-   * skips a failing call. Needs `hook:trip-card-provider`. */
+   * skips a failing call. Needs `hook:trip-card-provider`. The host caps results at
+   * 4 badges per trip, 240 total per provider. */
   getCards(tripIds: number[], ctx: PluginContext): Promise<TripCardContribution[]>;
 }
 
@@ -703,11 +742,12 @@ export interface JournalEntryProvider {
 /** A core-event subscription (#1429 eco). Handlers run with NO user (like a job).
  * Needs `events:subscribe`. */
 export interface PluginEventSubscription {
-  /** A core event name (e.g. `place:created`, `day:updated`, `file:created`) or `*` for all. */
+  /** A core event name `<family>:<verb>` (e.g. `place:created`, `day:updated`, `file:created`)
+   * where `<family>` is a value in EVENT_FAMILIES, or `*` for all. */
   on: string;
   // `entity` = the event family (e.g. 'reservation'); `entityId` = WHICH entity changed,
   // when known. `snapshot` = a whitelisted field view of the changed entity, delivered
-  // only when the plugin also holds the family's db:read:* grant — never user ids,
+  // only when the plugin also holds EVENT_SNAPSHOT_GRANT[family] — never user ids,
   // private packing items or secrets; delete/reorder/bulk events carry none. Still no
   // acting user: a trip read from the handler is refused.
   handler(payload: { event: string; tripId: number; entity?: string; entityId?: number; snapshot?: Record<string, unknown> }, ctx: PluginContext): Promise<void> | void;
@@ -778,7 +818,16 @@ export function definePlugin(def: PluginDefinition): PluginDefinition {
   return def;
 }
 
-export { validateManifest, CHANNEL_EVENTS, type PluginManifest, type ValidationResult } from './manifest.js';
+export {
+  validateManifest,
+  CHANNEL_EVENTS,
+  type PluginManifest,
+  type NormalizedManifest,
+  type ValidationResult,
+  type ManifestSettingField,
+  type ManifestAction,
+  type ManifestCapabilities,
+} from './manifest.js';
 export { createMockHost, type MockHostOptions } from './mock-host.js';
 // The permissions TREK enforces OUTSIDE ctx — hooks, events, jobs, egress. An entry
 // point you implement without its grant is never called in production, silently; these
@@ -787,6 +836,10 @@ export {
   PermissionDenied, HOOK_PERMISSION, USER_DATA_PERMISSION, EVENTS_PERMISSION, JOBS_PERMISSION,
   grantGaps, grantedHosts, type GrantGap, type PluginEntryPoints,
 } from './permissions.js';
+// The core-event catalog: families and the snapshot-delivery permission each family requires.
+export {
+  EVENT_FAMILIES, EVENT_SNAPSHOT_GRANT, KNOWN_PERMISSIONS,
+} from './generated/host-facts.js';
 
 /** Scope for host-managed, per-user session state in a sandboxed plugin UI. */
 export type PluginSessionStorageScope = 'plugin' | 'trip';
diff --git a/plugin-sdk/src/manifest.ts b/plugin-sdk/src/manifest.ts
index c7099b3bb..c0bae80dd 100644
--- a/plugin-sdk/src/manifest.ts
+++ b/plugin-sdk/src/manifest.ts
@@ -10,24 +10,69 @@ export interface PluginDependency {
   id: string;
   version: string;
 }
+export interface ManifestSettingField {
+  key: string;
+  label?: string;
+  input_type?: string;
+  placeholder?: string;
+  hint?: string;
+  required?: boolean;
+  secret?: boolean;
+  scope?: 'instance' | 'user';
+  options?: Array<string | number | { value: string | number; label?: string }>;
+  oauth?: { initPath?: string; callbackPath?: string };
+}
+export interface ManifestAction {
+  key: string;
+  label?: string;
+  hint?: string;
+  danger?: boolean;
+}
+export interface ManifestCapabilities {
+  settingsUi?: boolean;
+  widget?: { title?: string; defaultSize?: string; slot?: 'sidebar' | 'hero' | 'place-detail' | 'day-detail' | 'reservation-detail' };
+  tripPage?: { replaces?: string[]; position?: number };
+  notificationChannel?: { title?: string; events?: string[] };
+  routeProfiles?: Array<{ id: string; label: string; icon?: string }>;
+  provides?: string[];
+  emits?: string[];
+}
 export interface PluginManifest {
   id: string;
   name: string;
   version: string;
-  apiVersion: number;
-  /** The semver RANGE of TREK versions this plugin supports (">=3.2.0 <4.0.0"). */
+  /** The semver RANGE of TREK versions this plugin supports (">=4.0.0 <5.0.0"). */
   trek: string;
   type: 'integration' | 'page' | 'widget' | 'trip-page';
+  apiVersion?: number;
+  permissions?: string[];
+  egress?: string[];
+  nativeModules?: boolean;
+  operatorEgress?: boolean;
+  requiredAddons?: string[];
+  pluginDependencies?: PluginDependency[];
+  capabilities?: ManifestCapabilities;
+  settings?: ManifestSettingField[];
+  actions?: ManifestAction[];
+  icon?: string;
+  author?: string;
+  description?: string;
+  homepage?: string;
+  tags?: string[];
+  license?: string;
+}
+export interface NormalizedManifest extends PluginManifest {
+  apiVersion: number;
   permissions: string[];
   egress: string[];
-  nativeModules?: boolean;
+  nativeModules: false;
   requiredAddons: string[];
   pluginDependencies: PluginDependency[];
 }
 export interface ValidationResult {
   ok: boolean;
   errors: string[];
-  manifest?: PluginManifest;
+  manifest?: NormalizedManifest;
 }
 
 const ID_RE = /^[a-z][a-z0-9-]{2,39}$/;
@@ -123,8 +168,8 @@ export function validateManifest(raw: unknown): ValidationResult {
   if (!isSatisfiableRange(m.trek)) {
     errors.push(
       typeof m.trek === 'string' && m.trek
-        ? `"trek" is not a satisfiable semver range: "${m.trek}" (e.g. ">=3.2.0 <4.0.0")`
-        : 'missing "trek" — declare the TREK versions this plugin supports, e.g. ">=3.2.0 <4.0.0"',
+        ? `"trek" is not a satisfiable semver range: "${m.trek}" (e.g. ">=4.0.0 <5.0.0")`
+        : 'missing "trek" — declare the TREK versions this plugin supports, e.g. ">=4.0.0 <5.0.0"',
     );
   }
   if (m.apiVersion !== undefined && typeof m.apiVersion !== 'number') errors.push('apiVersion must be a number');
@@ -209,6 +254,10 @@ export function validateManifest(raw: unknown): ValidationResult {
   // Mirrors the server's routeProfiles parsing: the planner's route picker shows these,
   // so they must be well-formed and only exist alongside the routeProvider grant.
   const routeProfiles = capabilities?.routeProfiles;
+  // Normalized routeProfiles entries (icon dropped when non-string, like the server's
+  // optStr()) — populated only when routeProfiles is present and shaped as an array;
+  // used to build the output below in place of the raw, possibly-dirty input array.
+  let normalizedRouteProfiles: Array<{ id: string; label: string; icon?: string }> | undefined;
   if (routeProfiles !== undefined) {
     if (!permissions.includes('hook:route-provider')) {
       errors.push('capabilities.routeProfiles requires the "hook:route-provider" permission');
@@ -217,14 +266,21 @@ export function validateManifest(raw: unknown): ValidationResult {
     else {
       if (routeProfiles.length > 3) errors.push('capabilities.routeProfiles: at most 3 profiles');
       const seen = new Set<string>();
+      normalizedRouteProfiles = [];
       for (const v of routeProfiles) {
-        const p = (v && typeof v === 'object' ? v : {}) as { id?: unknown; label?: unknown };
+        const p = (v && typeof v === 'object' ? v : {}) as { id?: unknown; label?: unknown; icon?: unknown };
         const id = typeof p.id === 'string' ? p.id : '';
         if (!/^[a-z][a-z0-9-]{0,23}$/.test(id)) errors.push('capabilities.routeProfiles: id must be lowercase [a-z][a-z0-9-], max 24 chars');
         else if (seen.has(id)) errors.push(`capabilities.routeProfiles: duplicate id "${id}"`);
         else seen.add(id);
         const label = typeof p.label === 'string' ? p.label.trim() : '';
         if (!label || label.length > 40) errors.push('capabilities.routeProfiles: label is required (max 40 chars)');
+        // icon is optional; a non-string icon is silently dropped, not rejected — mirrors
+        // the server's optStr() (server/src/nest/plugins/install/manifest.ts:519-521),
+        // which returns undefined for a non-string value rather than throwing. Length is
+        // never rejected either — the server slices to 40 chars at install time.
+        const icon = typeof p.icon === 'string' ? p.icon : undefined;
+        normalizedRouteProfiles.push(icon !== undefined ? { id, label, icon } : { id, label });
       }
     }
   }
@@ -243,6 +299,33 @@ export function validateManifest(raw: unknown): ValidationResult {
       if (s.scope !== undefined && s.scope !== 'user' && s.scope !== 'instance') {
         errors.push(`settings["${key}"].scope must be "user" or "instance"`);
       }
+      if (s.options !== undefined) {
+        if (!Array.isArray(s.options)) {
+          errors.push('settings option list must be an array');
+        } else {
+          for (const o of s.options) {
+            if (typeof o === 'string' || typeof o === 'number') continue;
+            if (o && typeof o === 'object') {
+              const value = (o as { value?: unknown }).value;
+              if (value === undefined || value === null || String(value) === '') {
+                errors.push('settings option must have a non-empty "value"');
+              }
+            } else {
+              errors.push(`invalid settings option ${JSON.stringify(o)} (expected a string or { value, label })`);
+            }
+          }
+        }
+      }
+      if (s.oauth !== undefined) {
+        if (!s.oauth || typeof s.oauth !== 'object' || Array.isArray(s.oauth)) {
+          errors.push('settings oauth must be an object');
+        } else {
+          for (const k of ['initPath', 'callbackPath'] as const) {
+            const v = (s.oauth as Record<string, unknown>)[k];
+            if (v !== undefined && typeof v !== 'string') errors.push(`settings oauth.${k} must be a string`);
+          }
+        }
+      }
     }
   }
   // Settings-page action buttons ("Test connection"). Keys share the settings-key rules.
@@ -269,23 +352,38 @@ export function validateManifest(raw: unknown): ValidationResult {
   const pluginDependencies = validatePluginDependencies(m.pluginDependencies, typeof m.id === 'string' ? m.id : '', errors);
 
   if (errors.length) return { ok: false, errors };
-  return {
-    ok: true,
-    errors: [],
-    manifest: {
-      id: m.id as string,
-      name: m.name as string,
-      version: m.version as string,
-      apiVersion: typeof m.apiVersion === 'number' ? m.apiVersion : 1,
-      trek: m.trek as string,
-      type: m.type as PluginManifest['type'],
-      permissions,
-      egress,
-      nativeModules: false,
-      requiredAddons,
-      pluginDependencies,
-    },
+  const manifest: NormalizedManifest = {
+    id: m.id as string,
+    name: m.name as string,
+    version: m.version as string,
+    apiVersion: typeof m.apiVersion === 'number' ? m.apiVersion : 1,
+    trek: m.trek as string,
+    type: m.type as PluginManifest['type'],
+    permissions,
+    egress,
+    nativeModules: false,
+    requiredAddons,
+    pluginDependencies,
   };
+  // Carried through verbatim when present — absent stays absent (no undefined keys) — except
+  // routeProfiles, which is rebuilt from normalizedRouteProfiles so a dropped (non-string)
+  // icon doesn't leak the raw input value back out.
+  if (m.capabilities !== undefined) {
+    const rawCapabilities = m.capabilities as ManifestCapabilities;
+    manifest.capabilities = normalizedRouteProfiles !== undefined
+      ? { ...rawCapabilities, routeProfiles: normalizedRouteProfiles }
+      : rawCapabilities;
+  }
+  if (m.settings !== undefined) manifest.settings = m.settings as ManifestSettingField[];
+  if (m.actions !== undefined) manifest.actions = m.actions as ManifestAction[];
+  if (m.operatorEgress !== undefined) manifest.operatorEgress = m.operatorEgress as boolean;
+  if (m.icon !== undefined) manifest.icon = m.icon as string;
+  if (m.author !== undefined) manifest.author = m.author as string;
+  if (m.description !== undefined) manifest.description = m.description as string;
+  if (m.homepage !== undefined) manifest.homepage = m.homepage as string;
+  if (m.tags !== undefined) manifest.tags = m.tags as string[];
+  if (m.license !== undefined) manifest.license = m.license as string;
+  return { ok: true, errors: [], manifest };
 }
 
 // Export/event names exposed to other plugins (dots allowed for event names).
diff --git a/plugin-sdk/src/mock-host.ts b/plugin-sdk/src/mock-host.ts
index 5d20b0ab9..2f743bb18 100644
--- a/plugin-sdk/src/mock-host.ts
+++ b/plugin-sdk/src/mock-host.ts
@@ -107,6 +107,18 @@ export interface MockHostOptions {
   aiResults?: Record<string, unknown>[];
   /** The acting user's connected-service token for ctx.oauth.getAccessToken (default null). */
   oauthAccessToken?: string | null;
+  /** Daily cap on ctx.ai.complete/ctx.ai.extract calls, mirroring the host's
+   * per-plugin daily-budget broker (daily-budget.ts). Default 200; `0` disables
+   * the broker entirely, so the FIRST call fails with the exhaustion string.
+   * Unlike the real host, this is a plain in-memory counter for the life of this
+   * mock host: it never rolls over at UTC midnight — there is no timer here, and
+   * no wall-clock window. A test that wants to see the budget "reset" should
+   * create a fresh mock host rather than wait. */
+  aiPerDay?: number;
+  /** Same idea as `aiPerDay`, for ctx.notify.send. Default 100; `0` disables the
+   * broker (first call fails with the exhaustion string). See `aiPerDay` for the
+   * no-rollover caveat — this counter never resets on its own either. */
+  notifyPerDay?: number;
 }
 
 /** Drives a plugin's OWN entry points against the mock ctx — the missing half of a
@@ -202,11 +214,14 @@ function stripLeadingComments(sql: string): string {
 // The host's stripEmoji (text-sanitize.ts), copied so notify.send cleans/rejects the
 // same strings without a server import: colour emoji + sequence glue removed, then
 // the horizontal gaps they leave are collapsed. An all-emoji title becomes ''.
-const EMOJI_RE = /\p{Emoji_Presentation}|\p{Emoji_Modifier}|\p{Regional_Indicator}|[\u200D\uFE00-\uFE0F\u20E3\u{E0020}-\u{E007F}]/gu;
+const EMOJI_RE = /\p{Emoji_Presentation}|\p{Emoji_Modifier}|\p{Regional_Indicator}|\u200D|[\uFE00-\uFE0F\u20E3\u{E0020}-\u{E007F}]/gu;
 function stripEmoji(s: string): string {
   const stripped = s.replace(EMOJI_RE, '');
   if (stripped === s) return s;
-  return stripped.replace(/[^\S\r\n]{2,}/g, ' ').replace(/ +$/gm, '').trim();
+  // Trailing-space trim as the host spells it: the char in front of the run (or the
+  // line start) comes into the match and goes back out, so the run is only walked
+  // from its own start instead of restarting inside every space of a long one.
+  return stripped.replace(/[^\S\r\n]{2,}/g, ' ').replace(/(^|[^ ]) +$/gm, '$1').trim();
 }
 
 // The host's settings-key rules (install/manifest.ts). A field the host would refuse to
@@ -234,6 +249,13 @@ function settingsBlob(src: Record<string, unknown> | undefined, what: string): R
 const PLACE_STR_LIMITS: Record<string, number> = { name: 200, description: 2000, address: 500, notes: 2000 };
 const TRIP_STR_LIMITS: Record<string, number> = { title: 200, description: 2000 };
 
+// ctx.meta quotas, mirrored from meta.rpc.ts's disk-DoS guard: value size (characters
+// of the serialized JSON, matching the host — UTF-16 code units, not UTF-8 bytes),
+// key length, and keys per (plugin, entity).
+const META_VALUE_MAX = 64 * 1024;
+const META_KEY_MAX = 256;
+const META_KEYS_MAX = 100;
+
 export function createMockHost(opts: MockHostOptions = {}): MockHost {
   const grants = new Set(opts.grants ?? []);
   const calls: MockHost['calls'] = [];
@@ -372,6 +394,14 @@ export function createMockHost(opts: MockHostOptions = {}): MockHost {
   const metaStore: Record<string, unknown> = {};
   const metaKey = (et: string, eid: number, key: string) => `${et}:${eid}:${key}`;
 
+  // Per-host daily budgets for ai.*/notify.send, mirroring daily-budget.ts. Plain
+  // counters, no timers: this mock never rolls the window over at UTC midnight (see
+  // the MockHostOptions docblocks) — a test wanting a fresh budget creates a new host.
+  const aiPerDay = opts.aiPerDay ?? 200;
+  const notifyPerDay = opts.notifyPerDay ?? 100;
+  let aiUsed = 0;
+  let notifyUsed = 0;
+
   const buildCtx = (actingUserId: number | undefined): PluginContext => {
     const requireActingUser = (): number => {
       if (actingUserId === undefined) throw new Error('RESOURCE_FORBIDDEN: this call requires an authenticated user context');
@@ -816,6 +846,8 @@ export function createMockHost(opts: MockHostOptions = {}): MockHost {
             if (!input.link.startsWith('/') || input.link.startsWith('//')) throw new Error('link must be an in-app path starting with /');
             link = input.link.slice(0, 512);
           }
+          if (notifyUsed >= notifyPerDay) throw new Error('daily notification budget exhausted (resets at UTC midnight)');
+          notifyUsed += 1;
           notifications.push({ title, body, ...(link ? { link } : {}), scope, targetId: input.targetId });
           return { sent: true };
         },
@@ -823,10 +855,14 @@ export function createMockHost(opts: MockHostOptions = {}): MockHost {
       ai: {
         async complete() {
           need('ai:invoke', 'ai.complete');
+          if (aiUsed >= aiPerDay) throw new Error('daily AI budget exhausted (resets at UTC midnight)');
+          aiUsed += 1;
           return { text: opts.aiText ?? '' };
         },
         async extract() {
           need('ai:invoke', 'ai.extract');
+          if (aiUsed >= aiPerDay) throw new Error('daily AI budget exhausted (resets at UTC midnight)');
+          aiUsed += 1;
           return { results: opts.aiResults ?? [] };
         },
       },
@@ -1351,7 +1387,21 @@ export function createMockHost(opts: MockHostOptions = {}): MockHost {
         async set(entityType, entityId, key, value) {
           need('db:meta', 'meta.set');
           metaGate(entityType, entityId);
-          metaStore[metaKey(entityType, entityId, key)] = value ?? null;
+          // Quota order mirrors meta.rpc.ts: key length -> value size -> key count.
+          if (key.length > META_KEY_MAX) throw new Error(`metadata key too long (>${META_KEY_MAX} chars)`);
+          const json = JSON.stringify(value ?? null);
+          // Matches the host exactly: json.length (UTF-16 code units of the serialized
+          // JSON), not Buffer.byteLength (UTF-8 bytes) — see meta.rpc.ts:71.
+          if (json.length > META_VALUE_MAX) {
+            throw new Error(`metadata value too large (>${META_VALUE_MAX} bytes)`);
+          }
+          const fullKey = metaKey(entityType, entityId, key);
+          if (!(fullKey in metaStore)) {
+            const prefix = `${entityType}:${entityId}:`;
+            const count = Object.keys(metaStore).filter((k) => k.startsWith(prefix)).length;
+            if (count >= META_KEYS_MAX) throw new Error(`too many metadata keys on this ${entityType} (max ${META_KEYS_MAX})`);
+          }
+          metaStore[fullKey] = value ?? null;
           return { key, value: value ?? null };
         },
         async list(entityType, entityId) {
diff --git a/plugin-sdk/src/zip.ts b/plugin-sdk/src/zip.ts
index 199a30174..08457a289 100644
--- a/plugin-sdk/src/zip.ts
+++ b/plugin-sdk/src/zip.ts
@@ -58,7 +58,7 @@ export function makeZip(files: ZipInput[]): Buffer {
   let offset = 0;
 
   for (const f of files) {
-    const nameBuf = Buffer.from(f.name.replace(/\\/g, '/'), 'utf8');
+    const nameBuf = Buffer.from(f.name.replaceAll(/\\/g, '/'), 'utf8');
     const crc = crc32(f.data);
     // Deflate; fall back to stored if that somehow grows the data.
     const deflated = zlib.deflateRawSync(f.data, { level: 9 });
diff --git a/plugin-sdk/test/cli.test.ts b/plugin-sdk/test/cli.test.ts
index adc2dfabd..8000a37a8 100644
--- a/plugin-sdk/test/cli.test.ts
+++ b/plugin-sdk/test/cli.test.ts
@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { validateManifest } from '../src/index.js';
 import { scaffold } from '../src/cli/create.js';
-import { PERMISSION_CATALOG, PERMISSION_FAMILIES, KNOWN_PERMISSIONS, isInteractive, missingArgs } from '../src/cli/ui.js';
+import { PERMISSION_CATALOG, PERMISSION_FAMILIES, PICKER_PERMISSIONS, isInteractive, missingArgs } from '../src/cli/ui.js';
 // The authoritative set — what the HOST accepts at activation. The picker must match it.
 import { KNOWN_PERMISSIONS as MANIFEST_PERMISSIONS } from '../src/manifest.js';
 import { resolveMenuChoice, PRIMARY_MENU, ADVANCED_MENU } from '../src/cli/menu.js';
@@ -47,7 +47,7 @@ describe('permission catalog', () => {
   // list the host actually honours — so a new TREK permission fails here until `create`
   // can offer it.
   it('offers every permission the host accepts — no more, no less', () => {
-    expect([...KNOWN_PERMISSIONS].sort()).toEqual([...MANIFEST_PERMISSIONS].sort());
+    expect([...PICKER_PERMISSIONS].sort()).toEqual([...MANIFEST_PERMISSIONS].sort());
   });
 
   it('describes every permission, and files it in exactly one family', () => {
@@ -57,7 +57,7 @@ describe('permission catalog', () => {
         .toHaveLength(1);
     }
     // No duplicates across families — a permission listed twice would render twice.
-    expect(new Set(KNOWN_PERMISSIONS).size).toBe(KNOWN_PERMISSIONS.length);
+    expect(new Set(PICKER_PERMISSIONS).size).toBe(PICKER_PERMISSIONS.length);
   });
 
   it('every family is non-empty and described (an empty one is a dead prompt entry)', () => {
@@ -245,3 +245,36 @@ describe('capabilities.notificationChannel validation', () => {
     expect(r.errors!.join(' ')).toMatch(/requires the "hook:notification-channel" permission/);
   });
 });
+
+describe('scaffold oauth:client settings', () => {
+  let tmp: string;
+  beforeEach(() => { tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'oauth-')); });
+  afterEach(() => { fs.rmSync(tmp, { recursive: true, force: true }); });
+
+  const OAUTH_KEYS = ['oauth_authorize_url', 'oauth_token_url', 'oauth_scopes', 'oauth_client_id', 'oauth_client_secret'];
+
+  it('scaffolds the five instance-scoped broker settings when oauth:client is granted', () => {
+    scaffold('oauth-plug', 'integration', tmp, { permissions: ['db:own', 'oauth:client'] });
+    const m = JSON.parse(fs.readFileSync(path.join(tmp, 'oauth-plug', 'trek-plugin.json'), 'utf8'));
+    const settings = m.settings as Array<{ key: string; secret?: boolean; scope?: string }>;
+    for (const key of OAUTH_KEYS) {
+      expect(settings.some((s) => s.key === key), `missing setting "${key}"`).toBe(true);
+    }
+    const secret = settings.find((s) => s.key === 'oauth_client_secret')!;
+    expect(secret.secret).toBe(true);
+    for (const key of OAUTH_KEYS) {
+      const s = settings.find((x) => x.key === key)!;
+      expect(s.scope, `${key}.scope`).toBe('instance');
+    }
+    expect(validateManifest(m).ok).toBe(true);
+  });
+
+  it('scaffolds none of the broker settings without oauth:client', () => {
+    scaffold('plain-oauth-plug', 'integration', tmp, { permissions: ['db:own'] });
+    const m = JSON.parse(fs.readFileSync(path.join(tmp, 'plain-oauth-plug', 'trek-plugin.json'), 'utf8'));
+    const settings = (m.settings ?? []) as Array<{ key: string }>;
+    for (const key of OAUTH_KEYS) {
+      expect(settings.some((s) => s.key === key), `unexpected setting "${key}"`).toBe(false);
+    }
+  });
+});
diff --git a/plugin-sdk/test/manifest-roundtrip.test.ts b/plugin-sdk/test/manifest-roundtrip.test.ts
new file mode 100644
index 000000000..f9fa9cd56
--- /dev/null
+++ b/plugin-sdk/test/manifest-roundtrip.test.ts
@@ -0,0 +1,44 @@
+import { describe, it, expect } from 'vitest';
+import { validateManifest } from '../src/manifest.js';
+
+describe('validateManifest normalized output', () => {
+  it('normalized manifest keeps every recognized field', () => {
+    const input = {
+      id: 'my-plugin', name: 'My Plugin', version: '1.0.0', type: 'widget', trek: '>=4.0.0 <5.0.0',
+      permissions: ['db:own'], operatorEgress: false, icon: 'Bell', author: 'A', description: 'Does things.',
+      homepage: 'https://example.com', tags: ['fun'], license: 'MIT',
+      capabilities: { widget: { title: 'W', slot: 'hero' }, provides: ['getState'] },
+      settings: [{ key: 'mode', scope: 'user', options: ['a', 'b'] }],
+      actions: [{ key: 'ping', label: 'Ping' }],
+    };
+    const r = validateManifest(input);
+    expect(r.ok).toBe(true);
+    const m = r.manifest!;
+    expect(m.capabilities?.widget?.slot).toBe('hero');
+    expect(m.settings?.[0].options).toEqual(['a', 'b']);
+    expect(m.actions?.[0]).toEqual({ key: 'ping', label: 'Ping' });
+    expect(m.icon).toBe('Bell');
+    expect(m.operatorEgress).toBe(false);
+    expect(m.nativeModules).toBe(false); // still forced
+    expect(m.apiVersion).toBe(1); // still defaulted
+    expect(m.requiredAddons).toEqual([]);
+  });
+
+  it('accepts routeProfiles icon', () => {
+    const r = validateManifest({
+      id: 'rt-plug', name: 'R', version: '1.0.0', type: 'integration', trek: '>=4.0.0 <5.0.0',
+      permissions: ['hook:route-provider'], capabilities: { routeProfiles: [{ id: 'hike', label: 'Hiking', icon: 'Mountain' }] },
+    });
+    expect(r.ok).toBe(true);
+    expect(r.manifest!.capabilities?.routeProfiles?.[0].icon).toBe('Mountain');
+  });
+
+  it('drops a non-string routeProfiles icon instead of rejecting the manifest', () => {
+    const r = validateManifest({
+      id: 'rt-plug', name: 'R', version: '1.0.0', type: 'integration', trek: '>=4.0.0 <5.0.0',
+      permissions: ['hook:route-provider'], capabilities: { routeProfiles: [{ id: 'hike', label: 'Hiking', icon: 42 }] },
+    });
+    expect(r.ok).toBe(true);
+    expect(r.manifest!.capabilities?.routeProfiles?.[0].icon).toBeUndefined();
+  });
+});
diff --git a/plugin-sdk/test/manifest-settings.test.ts b/plugin-sdk/test/manifest-settings.test.ts
new file mode 100644
index 000000000..d6b287a44
--- /dev/null
+++ b/plugin-sdk/test/manifest-settings.test.ts
@@ -0,0 +1,35 @@
+import { describe, it, expect } from 'vitest';
+import { validateManifest } from '../src/manifest.js';
+
+const base = () => ({ id: 'my-plugin', name: 'My Plugin', version: '1.0.0', type: 'integration', trek: '>=4.0.0 <5.0.0' });
+const withSetting = (extra: object) => ({ ...base(), settings: [{ key: 'mode', ...extra }] });
+
+describe('validateManifest settings[].options / settings[].oauth', () => {
+  it('accepts string/number option lists', () => {
+    expect(validateManifest(withSetting({ options: ['a', 'b'] })).ok).toBe(true);
+    expect(validateManifest(withSetting({ options: [1, 2] })).ok).toBe(true);
+  });
+  it('accepts {value,label} options incl. value 0', () => {
+    expect(validateManifest(withSetting({ options: [{ value: 0, label: 'Zero' }] })).ok).toBe(true);
+  });
+  it('rejects a non-array options', () => {
+    const r = validateManifest(withSetting({ options: 'a,b' }));
+    expect(r.ok).toBe(false);
+    expect(r.errors).toContain('settings option list must be an array');
+  });
+  it('rejects an option with empty value', () => {
+    const r = validateManifest(withSetting({ options: [{ value: '', label: 'x' }] }));
+    expect(r.errors).toContain('settings option must have a non-empty "value"');
+  });
+  it('rejects a garbage option entry', () => {
+    const r = validateManifest(withSetting({ options: [true] }));
+    expect(r.errors).toContain('invalid settings option true (expected a string or { value, label })');
+  });
+  it('rejects a non-object oauth', () => {
+    expect(validateManifest(withSetting({ oauth: 'x' })).errors).toContain('settings oauth must be an object');
+  });
+  it('rejects non-string oauth paths, accepts valid oauth', () => {
+    expect(validateManifest(withSetting({ oauth: { initPath: 3 } })).errors).toContain('settings oauth.initPath must be a string');
+    expect(validateManifest(withSetting({ oauth: { initPath: '/oauth/init' } })).ok).toBe(true);
+  });
+});
diff --git a/plugin-sdk/test/mock-limits.test.ts b/plugin-sdk/test/mock-limits.test.ts
new file mode 100644
index 000000000..44c0792d0
--- /dev/null
+++ b/plugin-sdk/test/mock-limits.test.ts
@@ -0,0 +1,134 @@
+import { describe, it, expect } from 'vitest';
+import { createMockHost } from '../src/index.js';
+
+/**
+ * Mock-host fidelity for the two host-mediated daily budgets (ai.complete/extract and
+ * notify.send, daily-budget.ts) and the ctx.meta quotas (meta.rpc.ts). Error strings
+ * and check order are copied verbatim from the server so a plugin author sees the
+ * exact same failure locally that production would give them.
+ */
+
+describe('daily budgets', () => {
+  it('exhausts the AI budget', async () => {
+    const host = createMockHost({ grants: ['ai:invoke'], actingUserId: 1, aiPerDay: 2 });
+    await host.ctx.ai.complete('hi');
+    await host.ctx.ai.complete('hi');
+    await expect(host.ctx.ai.complete('hi')).rejects.toThrow('daily AI budget exhausted (resets at UTC midnight)');
+  });
+
+  it('ai.extract shares the same per-host AI budget as ai.complete', async () => {
+    const host = createMockHost({ grants: ['ai:invoke'], actingUserId: 1, aiPerDay: 1 });
+    await host.ctx.ai.complete('hi');
+    await expect(host.ctx.ai.extract('text', {})).rejects.toThrow('daily AI budget exhausted (resets at UTC midnight)');
+  });
+
+  it('aiPerDay: 0 disables the broker — the first call fails', async () => {
+    const host = createMockHost({ grants: ['ai:invoke'], actingUserId: 1, aiPerDay: 0 });
+    await expect(host.ctx.ai.complete('hi')).rejects.toThrow('daily AI budget exhausted (resets at UTC midnight)');
+  });
+
+  it('defaults to 200/day for ai, far above what a normal test suite calls', async () => {
+    const host = createMockHost({ grants: ['ai:invoke'], actingUserId: 1 });
+    for (let i = 0; i < 200; i++) await host.ctx.ai.complete('hi');
+    await expect(host.ctx.ai.complete('hi')).rejects.toThrow('daily AI budget exhausted (resets at UTC midnight)');
+  });
+
+  it('exhausts the notify budget', async () => {
+    const host = createMockHost({
+      grants: ['notify:send'],
+      actingUserId: 1,
+      trips: { 1: { members: [1] } },
+      notifyPerDay: 1,
+    });
+    await host.ctx.notify.send({ title: 't', body: 'b', scope: 'user', targetId: 1 });
+    await expect(host.ctx.notify.send({ title: 't', body: 'b', scope: 'user', targetId: 1 })).rejects.toThrow(
+      'daily notification budget exhausted (resets at UTC midnight)',
+    );
+  });
+
+  it('notifyPerDay: 0 disables the broker — the first call fails', async () => {
+    const host = createMockHost({
+      grants: ['notify:send'],
+      actingUserId: 1,
+      trips: { 1: { members: [1] } },
+      notifyPerDay: 0,
+    });
+    await expect(host.ctx.notify.send({ title: 't', body: 'b', scope: 'user', targetId: 1 })).rejects.toThrow(
+      'daily notification budget exhausted (resets at UTC midnight)',
+    );
+  });
+
+  it('defaults to 100/day for notify, far above what a normal test suite calls', async () => {
+    const host = createMockHost({ grants: ['notify:send'], actingUserId: 1, trips: { 1: { members: [1] } } });
+    for (let i = 0; i < 100; i++) await host.ctx.notify.send({ title: 't', body: 'b', scope: 'user', targetId: 1 });
+    await expect(host.ctx.notify.send({ title: 't', body: 'b', scope: 'user', targetId: 1 })).rejects.toThrow(
+      'daily notification budget exhausted (resets at UTC midnight)',
+    );
+  });
+});
+
+describe('ctx.meta quotas', () => {
+  const fixture = () =>
+    createMockHost({ grants: ['db:meta'], actingUserId: 1, trips: { 1: { members: [1] } } });
+
+  it('meta value quota: 65536 bytes passes, 65537 rejects', async () => {
+    const { ctx } = fixture();
+    // Size the payload via Buffer.byteLength(JSON.stringify(v)), same as the server's
+    // notion of "serialized JSON bytes" — a bare string serializes with 2 quote bytes,
+    // so budget those into the repeat count.
+    const okValue = 'x'.repeat(65536 - 2);
+    expect(Buffer.byteLength(JSON.stringify(okValue), 'utf8')).toBe(65536);
+    await expect(ctx.meta.set('trip', 1, 'k', okValue)).resolves.toEqual({ key: 'k', value: okValue });
+
+    const tooBig = 'x'.repeat(65537 - 2);
+    expect(Buffer.byteLength(JSON.stringify(tooBig), 'utf8')).toBe(65537);
+    await expect(ctx.meta.set('trip', 1, 'k2', tooBig)).rejects.toThrow('metadata value too large (>65536 bytes)');
+  });
+
+  it('meta key length: 256 chars passes, 257 rejects', async () => {
+    const { ctx } = fixture();
+    const okKey = 'k'.repeat(256);
+    await expect(ctx.meta.set('trip', 1, okKey, 'v')).resolves.toEqual({ key: okKey, value: 'v' });
+
+    const tooLongKey = 'k'.repeat(257);
+    await expect(ctx.meta.set('trip', 1, tooLongKey, 'v')).rejects.toThrow('metadata key too long (>256 chars)');
+  });
+
+  it('meta key count: 100 keys per (plugin, entity) passes, the 101st rejects', async () => {
+    const { ctx } = fixture();
+    for (let i = 0; i < 100; i++) {
+      await ctx.meta.set('trip', 1, `key-${i}`, i);
+    }
+    await expect(ctx.meta.set('trip', 1, 'key-100', 100)).rejects.toThrow(
+      'too many metadata keys on this trip (max 100)',
+    );
+  });
+
+  it('overwriting an existing key never counts against the 100-key cap', async () => {
+    const { ctx } = fixture();
+    for (let i = 0; i < 100; i++) {
+      await ctx.meta.set('trip', 1, `key-${i}`, i);
+    }
+    // The entity already has 100 keys; updating one of them must still succeed.
+    await expect(ctx.meta.set('trip', 1, 'key-0', 'updated')).resolves.toEqual({ key: 'key-0', value: 'updated' });
+  });
+
+  it('checks in server order: key length before value size before key count', async () => {
+    const { ctx } = fixture();
+    // A key that is simultaneously too long AND paired with an oversized value must
+    // fail on the key-length check first.
+    const tooLongKey = 'k'.repeat(257);
+    const tooBigValue = 'x'.repeat(70000);
+    await expect(ctx.meta.set('trip', 1, tooLongKey, tooBigValue)).rejects.toThrow('metadata key too long (>256 chars)');
+
+    // Fill the entity to the cap, then a value that is ALSO too large must fail on
+    // the value-size check (raised before the key-count check ever runs).
+    const full = fixture();
+    for (let i = 0; i < 100; i++) {
+      await full.ctx.meta.set('trip', 1, `key-${i}`, i);
+    }
+    await expect(full.ctx.meta.set('trip', 1, 'new-key', tooBigValue)).rejects.toThrow(
+      'metadata value too large (>65536 bytes)',
+    );
+  });
+});
diff --git a/plugin-sdk/test/permissions-parity.test.ts b/plugin-sdk/test/permissions-parity.test.ts
index c01d5754d..04d3e30ce 100644
--- a/plugin-sdk/test/permissions-parity.test.ts
+++ b/plugin-sdk/test/permissions-parity.test.ts
@@ -15,7 +15,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { HOOK_PERMISSION } from '../src/permissions.js';
-import { PLUGIN_SESSION_MAX_KEYS, PLUGIN_SESSION_MAX_KEY_LENGTH, PLUGIN_SESSION_MAX_VALUE_BYTES } from '../src/index.js';
+import { PLUGIN_SESSION_MAX_KEYS, PLUGIN_SESSION_MAX_KEY_LENGTH, PLUGIN_SESSION_MAX_VALUE_BYTES, EVENT_FAMILIES, EVENT_SNAPSHOT_GRANT, KNOWN_PERMISSIONS } from '../src/index.js';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const serverPlugins = path.resolve(here, '../../server/src/nest/plugins');
@@ -86,3 +86,13 @@ describe.skipIf(!fs.existsSync(hostFrame))('parity with the host frame', () => {
     }
   });
 });
+
+describe.skipIf(!inMonorepo)('core event catalog', () => {
+  it('event snapshot grants are known read permissions on known families', () => {
+    expect(EVENT_FAMILIES.length).toBeGreaterThan(0);
+    for (const [family, perm] of Object.entries(EVENT_SNAPSHOT_GRANT)) {
+      expect(EVENT_FAMILIES).toContain(family);
+      expect(KNOWN_PERMISSIONS).toContain(perm);
+    }
+  });
+});
diff --git a/plugin-sdk/test/publish.test.ts b/plugin-sdk/test/publish.test.ts
index 758383aab..a2a629319 100644
--- a/plugin-sdk/test/publish.test.ts
+++ b/plugin-sdk/test/publish.test.ts
@@ -6,6 +6,11 @@ import path from 'node:path';
 // publish shells out to git + gh; drive those from here so we can assert what it WOULD run.
 const calls: Array<{ bin: string; args: string[] }> = [];
 let releaseExistsOnRemote = false;
+/** The commit the local tag points at; null = no local tag. `git tag` mutates it like git would. */
+let localTagSha: string | null = null;
+let remoteTagOnOrigin = false;
+let failPrCreate = false;
+const HEAD_SHA = 'headfeedheadfeedheadfeedheadfeedheadfeed';
 
 vi.mock('node:child_process', () => ({
   execFileSync: (bin: string, args: string[]) => {
@@ -14,8 +19,24 @@ vi.mock('node:child_process', () => ({
       if (!releaseExistsOnRemote) throw new Error('release not found');
       return Buffer.from('');
     }
-    // `git rev-parse <tag>^{commit}` — pretend the tag does not exist yet.
-    if (bin === 'git' && args.includes('rev-parse')) throw new Error('unknown revision');
+    if (bin === 'gh' && args[0] === 'pr' && args[1] === 'create' && failPrCreate) throw new Error('pr create exploded');
+    if (bin === 'gh' && args[0] === 'api') return Buffer.from('someone');
+    if (bin === 'git' && args.includes('ls-remote')) {
+      return Buffer.from(remoteTagOnOrigin ? `${HEAD_SHA}\trefs/tags/v1.0.0` : '');
+    }
+    if (bin === 'git' && args.includes('tag')) {
+      // Mirror git's behaviour so later rev-parses see what the run did.
+      const i = args.indexOf('tag');
+      if (args[i + 1] === '-d') localTagSha = null;
+      else localTagSha = HEAD_SHA; // `git tag <t>` and `git tag -f <t>` both land on HEAD
+      return Buffer.from('');
+    }
+    if (bin === 'git' && args.includes('rev-parse')) {
+      const target = args[args.indexOf('rev-parse') + 1];
+      if (target === 'HEAD') return Buffer.from(HEAD_SHA);
+      if (localTagSha === null) throw new Error('unknown revision');
+      return Buffer.from(localTagSha);
+    }
     return Buffer.from('');
   },
 }));
@@ -24,6 +45,12 @@ const { publishPlugin } = await import('../src/cli/publish.js');
 const { scaffold } = await import('../src/cli/create.js');
 const { makePublishable } = await import('./helpers.js');
 
+beforeEach(() => {
+  localTagSha = null;
+  remoteTagOnOrigin = false;
+  failPrCreate = false;
+});
+
 describe('publish — a released artifact is immutable', () => {
   let tmp: string;
   let dir: string;
@@ -139,6 +166,105 @@ describe('publish — the local gates run before anything is cut', () => {
  * cut at step 3 — so the author learned it with their tag already burned, for a fact that was
  * knowable before a single byte was packed. The check belongs in step 1, and this pins it there.
  */
+/**
+ * The cleanup half of the immutability story. Step 3 creates a local tag, pushes it, and cuts
+ * the release; when step 4/5 then failed, all three were stranded and the author had to delete
+ * them by hand before re-running. A failed publish now rolls back exactly what IT created —
+ * and only that: anything that existed before the run (a merged release, a pre-pushed tag) is
+ * never touched.
+ */
+describe('publish — a failed run rolls back what it created', () => {
+  let tmp: string;
+  let dir: string;
+
+  beforeEach(() => {
+    calls.length = 0;
+    releaseExistsOnRemote = false;
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'publish-rollback-'));
+    scaffold('rollback-plug', 'integration', tmp);
+    dir = path.join(tmp, 'rollback-plug');
+    makePublishable(dir);
+  });
+  afterEach(() => { fs.rmSync(tmp, { recursive: true, force: true }); });
+
+  const run = (opts: { force?: boolean; keepRelease?: boolean } = {}) => publishPlugin({
+    dir, repo: 'someone/trek-plugin-rollback-plug', tag: 'v1.0.0',
+    now: '2026-01-01T00:00:00Z', skipPreflight: true, log: () => {}, ...opts,
+  });
+
+  it('deletes the release, remote tag, and local tag this run created', async () => {
+    failPrCreate = true;
+    await expect(run()).rejects.toThrow(/rolled back/i);
+    expect(calls.some((c) => c.bin === 'gh' && c.args[0] === 'release' && c.args[1] === 'delete' && c.args.includes('v1.0.0'))).toBe(true);
+    expect(calls.some((c) => c.bin === 'git' && c.args.includes(':refs/tags/v1.0.0'))).toBe(true);
+    expect(calls.some((c) => c.bin === 'git' && c.args.includes('tag') && c.args.includes('-d'))).toBe(true);
+  });
+
+  it('--keep-release leaves everything in place and prints the manual cleanup', async () => {
+    failPrCreate = true;
+    await expect(run({ keepRelease: true })).rejects.toThrow(/gh release delete/);
+    expect(calls.some((c) => c.bin === 'gh' && c.args[1] === 'delete')).toBe(false);
+    expect(calls.some((c) => c.args.includes(':refs/tags/v1.0.0'))).toBe(false);
+  });
+
+  it('never deletes a release or remote tag that existed BEFORE the run', async () => {
+    releaseExistsOnRemote = true;
+    remoteTagOnOrigin = true;
+    failPrCreate = true;
+    await run({ force: true }).catch(() => {});
+    expect(calls.some((c) => c.bin === 'gh' && c.args[1] === 'delete')).toBe(false);
+    expect(calls.some((c) => c.args.includes(':refs/tags/v1.0.0'))).toBe(false);
+    // the local tag WAS created by this run, so that one goes
+    expect(calls.some((c) => c.bin === 'git' && c.args.includes('tag') && c.args.includes('-d'))).toBe(true);
+  });
+});
+
+/**
+ * The stale-tag trap: a failed publish leaves a tag; the author commits a fix and re-runs; the
+ * old flow silently reused the stale tag and released the UNFIXED code. A tag that does not
+ * point at HEAD and has no release is debris — move it. One that HAS a release is immutable.
+ */
+describe('publish — a stale tag from a failed run is moved, not reused', () => {
+  let tmp: string;
+  let dir: string;
+
+  beforeEach(() => {
+    calls.length = 0;
+    releaseExistsOnRemote = false;
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'publish-stale-'));
+    scaffold('stale-plug', 'integration', tmp);
+    dir = path.join(tmp, 'stale-plug');
+    makePublishable(dir);
+  });
+  afterEach(() => { fs.rmSync(tmp, { recursive: true, force: true }); });
+
+  const run = () => publishPlugin({
+    dir, repo: 'someone/trek-plugin-stale-plug', tag: 'v1.0.0',
+    now: '2026-01-01T00:00:00Z', skipPreflight: true, log: () => {},
+  });
+
+  it('re-points a debris tag (no release) at HEAD and force-pushes it', async () => {
+    localTagSha = 'stalestalestalestalestalestalestalestale';
+    await run().catch(() => {});
+    expect(calls.some((c) => c.bin === 'git' && c.args.includes('tag') && c.args.includes('-f'))).toBe(true);
+    const push = calls.find((c) => c.bin === 'git' && c.args.includes('push') && c.args.includes('v1.0.0'));
+    expect(push?.args).toContain('--force');
+  });
+
+  it('refuses a mismatched tag whose release already exists', async () => {
+    localTagSha = 'stalestalestalestalestalestalestalestale';
+    releaseExistsOnRemote = true;
+    await expect(run()).rejects.toThrow(/points at/i);
+    expect(calls.some((c) => c.bin === 'git' && c.args.includes('-f'))).toBe(false);
+  });
+
+  it('reuses a tag already on HEAD without touching it', async () => {
+    localTagSha = HEAD_SHA;
+    await run().catch(() => {});
+    expect(calls.some((c) => c.bin === 'git' && c.args.includes('tag') && !c.args.includes('-d'))).toBe(false);
+  });
+});
+
 describe('publish — a signed plugin cannot quietly go unsigned', () => {
   let tmp: string;
   let dir: string;
diff --git a/plugin-sdk/test/retro-sign.test.ts b/plugin-sdk/test/retro-sign.test.ts
new file mode 100644
index 000000000..42504ab22
--- /dev/null
+++ b/plugin-sdk/test/retro-sign.test.ts
@@ -0,0 +1,77 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { generateKeypair, loadPrivateKey, publicKeyBase64, verifyArtifact } from '../src/cli/sign.js';
+import { retroSignVersions } from '../src/cli/retro-sign.js';
+
+const V1_BYTES = Buffer.from('the exact bytes of the v1.0.0 release asset');
+const sha = (b: Buffer) => createHash('sha256').update(b).digest('hex');
+
+describe('retro-sign — first signed update signs the older versions too', () => {
+  let tmp: string;
+  let keyPath: string;
+  let publicKey: string;
+
+  beforeEach(() => {
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'retro-sign-'));
+    keyPath = path.join(tmp, 'signing.key');
+    publicKey = generateKeypair(keyPath).publicKey;
+    vi.stubGlobal('fetch', async (url: string) => {
+      if (String(url).includes('v1.0.0')) return { ok: true, arrayBuffer: async () => V1_BYTES } as unknown as Response;
+      return { ok: false, status: 404 } as Response;
+    });
+  });
+  afterEach(() => {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    vi.unstubAllGlobals();
+  });
+
+  const entry = (v1: Partial<{ sha256: string; signature: string }> = {}) => ({
+    id: 'retro-plug',
+    authorPublicKey: publicKey,
+    versions: [
+      { version: '1.1.0', downloadUrl: 'https://github.com/x/y/releases/download/v1.1.0/plugin.zip', sha256: 'deadbeef', signature: 'already-signed' },
+      { version: '1.0.0', downloadUrl: 'https://github.com/x/y/releases/download/v1.0.0/plugin.zip', sha256: sha(V1_BYTES), ...v1 },
+    ],
+  });
+
+  it('downloads, verifies, and signs each unsigned older version', async () => {
+    const e = entry();
+    const signed = await retroSignVersions(e, keyPath, () => {});
+    expect(signed).toEqual(['1.0.0']);
+    const sig = e.versions[1].signature!;
+    expect(verifyArtifact(V1_BYTES, sig, publicKey)).toBe(true);
+    expect(e.versions[0].signature).toBe('already-signed'); // untouched
+  });
+
+  it('REFUSES when the downloaded bytes no longer hash to the pinned sha256', async () => {
+    const e = entry({ sha256: 'not-the-real-hash' });
+    await expect(retroSignVersions(e, keyPath, () => {})).rejects.toThrow(/1\.0\.0.*sha256/is);
+    expect(e.versions[1].signature).toBeUndefined();
+  });
+
+  it('REFUSES a key that does not match the entry authorPublicKey', async () => {
+    const otherKey = path.join(tmp, 'other.key');
+    generateKeypair(otherKey);
+    await expect(retroSignVersions(entry(), otherKey, () => {})).rejects.toThrow(/key/i);
+  });
+
+  it('is a no-op for an unsigned entry or one with nothing to sign', async () => {
+    const unsignedEntry = { id: 'x', versions: [{ version: '1.0.0', downloadUrl: 'u', sha256: 'h' }] };
+    expect(await retroSignVersions(unsignedEntry, keyPath, () => {})).toEqual([]);
+    const fullySigned = entry({ signature: 'sig' });
+    expect(await retroSignVersions(fullySigned, keyPath, () => {})).toEqual([]);
+  });
+
+  it('names every version whose artifact could not be fetched', async () => {
+    const e = entry();
+    e.versions[1].downloadUrl = 'https://github.com/x/y/releases/download/v9.9.9/plugin.zip'; // 404s
+    await expect(retroSignVersions(e, keyPath, () => {})).rejects.toThrow(/1\.0\.0/);
+  });
+
+  it('key sanity: publicKeyBase64 round-trips through loadPrivateKey', () => {
+    expect(publicKeyBase64(loadPrivateKey(keyPath))).toBe(publicKey);
+  });
+});
diff --git a/plugin-sdk/test/submit.test.ts b/plugin-sdk/test/submit.test.ts
new file mode 100644
index 000000000..8a8ad68e6
--- /dev/null
+++ b/plugin-sdk/test/submit.test.ts
@@ -0,0 +1,110 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+
+const calls: Array<{ bin: string; args: string[] }> = [];
+let failSync = false;
+/** Seeded into the fake fork clone as the plugin's existing registry entry (update case). */
+let existingEntry: unknown = null;
+let lastCloneDir = '';
+
+// submit's git()/gh() run execFileSync with encoding:'utf8', which returns STRINGS — the
+// mock must too, or `.trim()` explodes on a Buffer.
+vi.mock('node:child_process', () => ({
+  execFileSync: (bin: string, args: string[]) => {
+    calls.push({ bin, args });
+    if (bin === 'gh' && args[0] === 'api') return 'someone';
+    if (bin === 'gh' && args[0] === 'repo' && args[1] === 'sync' && failSync) throw new Error('fork has diverged');
+    if (bin === 'gh' && args[0] === 'repo' && args[1] === 'clone') {
+      lastCloneDir = args[3];
+      if (existingEntry !== null) {
+        const p = path.join(lastCloneDir, 'registry', 'plugins', `${(existingEntry as { id: string }).id}.json`);
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, JSON.stringify(existingEntry, null, 2));
+      }
+      return '';
+    }
+    if (bin === 'gh' && args[0] === 'pr' && args[1] === 'create') return 'https://github.com/liketrek/TREK-Plugins/pull/999';
+    return '';
+  },
+}));
+
+const { submitEntry } = await import('../src/cli/submit.js');
+const { generateKeypair } = await import('../src/cli/sign.js');
+const { verifyArtifact } = await import('../src/cli/sign.js');
+
+const V1_BYTES = Buffer.from('old release asset bytes');
+const sha = (b: Buffer) => createHash('sha256').update(b).digest('hex');
+
+describe('submit — fork sync and retro-signing', () => {
+  let tmp: string;
+  let keyPath: string;
+  let publicKey: string;
+
+  beforeEach(() => {
+    calls.length = 0;
+    failSync = false;
+    existingEntry = null;
+    lastCloneDir = '';
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'submit-'));
+    keyPath = path.join(tmp, 'signing.key');
+    publicKey = generateKeypair(keyPath).publicKey;
+    vi.stubGlobal('fetch', async (url: string) => {
+      if (String(url).includes('v1.0.0')) return { ok: true, arrayBuffer: async () => V1_BYTES } as unknown as Response;
+      return { ok: false, status: 404 } as Response;
+    });
+  });
+  afterEach(() => {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    vi.unstubAllGlobals();
+  });
+
+  const freshEntry = (signed = false) => ({
+    id: 'sync-plug',
+    name: 'Sync Plug',
+    ...(signed ? { authorPublicKey: publicKey } : {}),
+    versions: [{
+      version: '1.1.0', downloadUrl: 'https://github.com/x/y/releases/download/v1.1.0/plugin.zip',
+      sha256: 'deadbeef', ...(signed ? { signature: 'fresh-sig' } : {}),
+    }],
+  });
+
+  it('fast-forwards the fork from the registry before branching', async () => {
+    await submitEntry(freshEntry(), {});
+    const sync = calls.find((c) => c.bin === 'gh' && c.args[0] === 'repo' && c.args[1] === 'sync');
+    expect(sync?.args).toContain('someone/TREK-Plugins');
+    expect(sync?.args).toContain('--source');
+    expect(sync?.args).toContain('liketrek/TREK-Plugins');
+  });
+
+  it('a diverged fork warns but does not stop the submit', async () => {
+    failSync = true;
+    const { prUrl } = await submitEntry(freshEntry(), {});
+    expect(prUrl).toContain('/pull/999');
+  });
+
+  it('retro-signs unsigned older versions on the first signed update', async () => {
+    existingEntry = {
+      id: 'sync-plug', name: 'Sync Plug',
+      versions: [{ version: '1.0.0', downloadUrl: 'https://github.com/x/y/releases/download/v1.0.0/plugin.zip', sha256: sha(V1_BYTES) }],
+    };
+    await submitEntry(freshEntry(true), { signKeyPath: keyPath, keep: true });
+    const written = JSON.parse(fs.readFileSync(path.join(lastCloneDir, 'registry', 'plugins', 'sync-plug.json'), 'utf8')) as {
+      versions: Array<{ version: string; signature?: string }>;
+    };
+    const v1 = written.versions.find((v) => v.version === '1.0.0')!;
+    expect(v1.signature).toBeDefined();
+    expect(verifyArtifact(V1_BYTES, v1.signature!, publicKey)).toBe(true);
+    fs.rmSync(lastCloneDir, { recursive: true, force: true });
+  });
+
+  it('refuses a first signed update when no key is available to retro-sign the older versions', async () => {
+    existingEntry = {
+      id: 'sync-plug', name: 'Sync Plug',
+      versions: [{ version: '1.0.0', downloadUrl: 'https://github.com/x/y/releases/download/v1.0.0/plugin.zip', sha256: sha(V1_BYTES) }],
+    };
+    await expect(submitEntry(freshEntry(true), {})).rejects.toThrow(/--sign/);
+  });
+});
diff --git a/plugin-sdk/test/unrelease.test.ts b/plugin-sdk/test/unrelease.test.ts
new file mode 100644
index 000000000..d7258e65d
--- /dev/null
+++ b/plugin-sdk/test/unrelease.test.ts
@@ -0,0 +1,99 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// unrelease shells out to git + gh; drive those from here so we can assert what it deletes.
+const calls: Array<{ bin: string; args: string[] }> = [];
+let releaseExistsOnRemote = false;
+let remoteTagOnOrigin = false;
+let localTagExists = false;
+
+vi.mock('node:child_process', () => ({
+  execFileSync: (bin: string, args: string[]) => {
+    calls.push({ bin, args });
+    if (bin === 'gh' && args[0] === 'release' && args[1] === 'view') {
+      if (!releaseExistsOnRemote) throw new Error('release not found');
+      return Buffer.from('');
+    }
+    if (bin === 'git' && args.includes('ls-remote')) {
+      return Buffer.from(remoteTagOnOrigin ? 'abc\trefs/tags/v1.0.0' : '');
+    }
+    if (bin === 'git' && args.includes('rev-parse')) {
+      if (!localTagExists) throw new Error('unknown revision');
+      return Buffer.from('abc');
+    }
+    return Buffer.from('');
+  },
+}));
+
+const { unrelease } = await import('../src/cli/unrelease.js');
+
+/** The published registry index the immutability guard consults. */
+let indexBody: unknown = { plugins: [] };
+let indexFails = false;
+
+describe('unrelease — delete a stranded tag + release safely', () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    calls.length = 0;
+    releaseExistsOnRemote = false;
+    remoteTagOnOrigin = false;
+    localTagExists = false;
+    indexBody = { plugins: [] };
+    indexFails = false;
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unrelease-'));
+    fs.writeFileSync(path.join(tmp, 'trek-plugin.json'), JSON.stringify({ id: 'doomed-plug', version: '1.0.0' }));
+    vi.stubGlobal('fetch', async () => {
+      if (indexFails) throw new Error('offline');
+      return { ok: true, json: async () => indexBody } as Response;
+    });
+  });
+  afterEach(() => {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    vi.unstubAllGlobals();
+  });
+
+  const run = (yes?: boolean) => unrelease({
+    dir: tmp, tag: 'v1.0.0', repo: 'someone/trek-plugin-doomed-plug', yes, log: () => {},
+  });
+
+  it('REFUSES when that version is published in the registry — those artifacts are immutable', async () => {
+    indexBody = { plugins: [{ id: 'doomed-plug', versions: [{ version: '1.0.0' }] }] };
+    releaseExistsOnRemote = true;
+    await expect(run(true)).rejects.toThrow(/published in the registry/i);
+    expect(calls.some((c) => c.bin === 'gh' && c.args[1] === 'delete')).toBe(false);
+  });
+
+  it('deletes the release, remote tag, and local tag when they exist', async () => {
+    releaseExistsOnRemote = true;
+    remoteTagOnOrigin = true;
+    localTagExists = true;
+    const { deleted } = await run();
+    expect(deleted).toEqual(['release', 'remote tag', 'local tag']);
+    expect(calls.some((c) => c.bin === 'gh' && c.args[0] === 'release' && c.args[1] === 'delete' && c.args.includes('--yes'))).toBe(true);
+    expect(calls.some((c) => c.bin === 'git' && c.args.includes(':refs/tags/v1.0.0'))).toBe(true);
+    expect(calls.some((c) => c.bin === 'git' && c.args.includes('tag') && c.args.includes('-d'))).toBe(true);
+  });
+
+  it('reports what was already absent without failing', async () => {
+    const { deleted } = await run();
+    expect(deleted).toEqual([]);
+  });
+
+  it('when the registry cannot be checked, refuses without --yes and proceeds with it', async () => {
+    indexFails = true;
+    localTagExists = true;
+    await expect(run()).rejects.toThrow(/--yes/);
+    const { deleted } = await run(true);
+    expect(deleted).toEqual(['local tag']);
+  });
+
+  it('a different published version of the same plugin does not block this tag', async () => {
+    indexBody = { plugins: [{ id: 'doomed-plug', versions: [{ version: '0.9.0' }] }] };
+    localTagExists = true;
+    const { deleted } = await run();
+    expect(deleted).toEqual(['local tag']);
+  });
+});
diff --git a/plugin-sdk/vitest.config.ts b/plugin-sdk/vitest.config.ts
new file mode 100644
index 000000000..9b4cb8759
--- /dev/null
+++ b/plugin-sdk/vitest.config.ts
@@ -0,0 +1,20 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    coverage: {
+      provider: 'v8',
+      reporter: ['lcov', 'text'],
+      reportsDirectory: './coverage',
+      include: ['src/**/*.ts'],
+      // Mirrored in the repo root's sonar.coverage.exclusions — a file skipped
+      // here emits no lcov entry, so Sonar must not count it as uncovered either.
+      exclude: [
+        // Machine-written by server/scripts/gen-plugin-facts.ts.
+        'src/generated/**',
+        // Generated snapshot (scripts/gen-lucide-icon-names.mjs) — pure data.
+        'src/lucide-icon-names.ts',
+      ],
+    },
+  },
+});
diff --git a/roadmap.md b/roadmap.md
deleted file mode 100644
index bf13b9830..000000000
--- a/roadmap.md
+++ /dev/null
@@ -1,459 +0,0 @@
-# Server modernization roadmap
-
-Written 2026-07-28, after the budgetService migration and the domain-coherence audit.
-Companion docs: `migrate.md` (service wave list), `migration-graph.md` (dependency-honest
-order, regenerated 2026-07-28), `audit_report/domain-coherence-audit.md` (the 73 verified
-coherence findings — IDs like `auth-1` below refer to it), `server/src/nest/README.md`
-(the per-domain migration recipe), `server/src/nest/plugins/DI-MIGRATION.md` (plugin host,
-Option B), `guards-audit.md` (request-pipeline guard audit, 2026-08-01 — authorization
-before the Zod pipe; see the "Request-pipeline guards" stream below).
-
-> **Status 2026-08-10 — the migration itself is finished.** Phases 0–5 all landed:
-> `src/services/` was deleted (`49652816`) and `server/eslint.config.mjs` now errors
-> on any import of it; every wave domain has a Nest module; the body-contract
-> allow-list is empty; the guards capstone (default-deny `GlobalAuthGuard` +
-> `@Public()` + boot ratchet) shipped. The "deliberately late" plugin RPC decorator
-> registry (Option B) and the backupService fold also landed. Still open below:
-> guard slices 1/3 and their parked decisions, the last three tokenization
-> registries, the operational-hardening items (all but the CI de-flake), and the
-> bridge endgame — see the re-checked "Definition of done" at the bottom.
-
-## Sequencing principles (learned from what already worked)
-
-1. **Cross-cutting seams migrate early and cheap** — the permissions + auditLog precedent:
-   a small injectable + module-scoped cache + a bridge for legacy callers, swept through
-   consumers. Do this for anything imported by "nearly everything" *before* the big domains.
-2. **Coherence fixes ride their domain's migration** — the exchangeRate→budget precedent:
-   misplaced code moves into its true domain *as part of* that domain's fold (parity first,
-   quirk fixes in a trailing `fix(server)` commit), not as a separate big-bang project.
-   Only the fixes that reshape the migration graph itself go first.
-3. **Parity is law, ratchets stay on** — every migration is byte-identical relocation +
-   DTO adoption (the boot gate enforces allow-list shrinkage), verified by the full suite.
-4. **Wrap globals behind injectables before replacing them** — the DatabaseService
-   precedent: an `@Injectable` facade first (mechanical sweep), transport swap later,
-   invisible behind the facade.
-
----
-
-## Phase 0 — cross-cutting quick wins (before more domain migrations)
-
-- [x] **`getAppUrl()` / `getMcpSafeUrl()` → `src/app-config`** (done 2026-07-28; findings `auth-2`,
-  `notifications-1`, `admin-3`, `mcp-1` — four auditors independently). Two functions,
-  near-zero risk. Deletes the fake `→ notifications` edges for auth, oidc, webauthn,
-  plugin-oauth, maps, transit, the MCP issuer and `index.ts`. Do first: it shrinks the
-  notifications cluster before Phase 2 migrates it.
-- [x] **Extract addons from adminService** (done 2026-07-28; findings `admin-1`;
-  permissions-style: DI `AddonsService` methods + `addons.bridge.ts` for legacy callers —
-  the module-scoped cache was deliberately skipped: the legacy reads were uncached per-call
-  queries and `updateAddon` (still in adminService) has no invalidation hook, so a cache
-  would change admin-toggle visibility; revisit when `updateAddon` moves in Wave 5).
-  `isAddonEnabled` was imported by nearly every domain incl. every `.mcp.ts` `when:` gate.
-  Removed the biggest fan-in from the Wave-5 admin god-service.
-- [x] **Injectable `RealtimeService` over the ws singleton** (done 2026-07-29: `@Global`
-  RealtimeModule, call-time delegation so the 106 `vi.mock('src/websocket')` suites keep
-  intercepting, arity-preserving pass-through; all 17 `nest/` importers + 9 bridges swept;
-  typed against the registry in a follow-up commit) (DatabaseService pattern:
-  `@Injectable` wrapping `broadcast`/`broadcastToUser`, module-scoped so bridge instances
-  share it). Sweep migrated `nest/` services to inject it instead of
-  `import { broadcast } from '../../websocket'`. This is step 1 of the WebSocket goal —
-  the actual `@WebSocketGateway` transport swap comes much later, invisibly, behind this
-  facade. Do NOT rewrite the ws server itself (auth/rooms/heartbeat/rate-limiting is
-  production-grade; audit says extend, don't rewrite). Pair with the **WS event contract
-  registry** (see "Tokenization & registries") — the facade is the choke point where the
-  typed event signature lands.
-
-## Phase 1 — tripService migration (done 2026-07)
-
-The hub: no blockers left, six bridge consumers die (budget/collab/days/packing/
-reservations/vacay bridges become injections). Includes, per the standard recipe:
-- MCP: port the trips registrar (+ prompts/resources seams) to `trips.mcp.ts`.
-- DTOs: trips controller adopts shared-schema DTOs, allow-list entries removed.
-- Coherence fixes to fold in (trailing fix commits): `trip-1` (ICS engine → own module),
-  `collections-3` (guest-erasure ownership), `collections-7` (cover-file reclamation
-  helper out of the trips god-file), and the registrar drift findings `mcp-5`
-  (update_trip hand-wired rebase ordering) die with the MCP port.
-
-## Phase 2 — notifications cluster → notificationService (+ scheduler) (done 2026-08)
-
-Smaller after Phase 0. Unblocks the maps chain and the admin corner.
-- Migrate `notifications.ts` + `notificationService` + prefs + inApp + channelRegistry as
-  one unit (they are one concept in five files — see notifications section of the audit).
-- Migrated domains then replace the lazy `import('...notificationService')` sends with the
-  injected service.
-- **Scheduler** — **done 2026-08-10**: `src/scheduler.ts` is deleted; every cron is
-  a provider in its owning domain, registered through `CronRegistrarService`
-  (`src/nest/scheduling/` — `@nestjs/schedule` + a NODE_ENV=test gate so the
-  shared `buildApp()` harness never ticks). `notifications.bridge` and
-  `admin.bridge` died with it, `SchedulerDeps`/`setSchedulerDeps` too, and
-  `node-cron` left `package.json` (the plugin host's job scheduler moved to the
-  `cron` package). Reminder enable-gates are per-tick now — a settings change
-  takes effect at the next run without a restart.
-
-## Phase 3 — geo chain: maps → transit → place → transitItinerary (done 2026-07/08)
-
-- Fold `placeEnrichment` into places (the helper-fold pattern).
-- Pull third-party API-key ownership into the maps/integrations domain: authService's
-  `updateMapsKey`/`updateApiKeys`/`validateKeys` probes and the duplicated admin-maps-key
-  SQL (`auth-4`) — maps becomes sole owner of key resolution.
-- `airportService` can go any time; when it does, move the db-boot backfill (a WRITE into
-  `reservation_endpoints` at module-eval time, finding `places-1`) into Nest bootstrap.
-
-## Phase 4 — the Wave-5 corner, restructured by the audit (done 2026-08-09)
-
-Order inside the corner: **atlas → auth-split → admin → oauth** (oidc/passkey ride auth).
-- **atlas** first, and it takes `getTravelStats` out of authService with it (the original
-  archetype finding) — the `auth → atlas` edge is deleted, not bridged.
-- **authService is migrated as a three-way split**, not as one domain (`auth-1`, `auth-3`,
-  `auth-4`, `auth-5`):
-  - `nest/auth` — credentials, sessions, MFA, tokens, password reset (dependency-clean,
-    crown-jewel code: relocate, don't rework);
-  - a **users/profile domain** — getCurrentUser/stripUserForClient, avatar (+ multer
-    wiring out of the auth controller), settings, user directory, account lifecycle
-    (deleteAccount + userCleanup seams);
-  - **admin instance settings out of `/api/auth`** — getAppSettings/updateAppSettings
-    (SMTP, channels, webhooks, the scheduler restart) belong to nest/admin; route parity
-    can keep the URL, ownership moves. `getAppConfig` becomes a platform aggregator
-    composing per-domain accessors (`auth-5`).
-  - MCP-token CRUD (`mcp-3`) moves toward the MCP domain; invite-token triplication
-    (`auth-7`/`admin-10`) gets one owner.
-- **admin** (already slimmed by Phase 0 addons + packing-template relocation `admin-2`/
-  `collections-1` — templates belong to packing and can move whenever packing-side work
-  happens), then **oauth**, merging the diverged `mcp/oauthProvider.ts` half into the one
-  OAuth domain (`mcp-2`).
-
-## Phase 5 — remainder (done 2026-08-09/10 — `src/services/` deleted in `49652816`)
-
-- memories/ cluster → journeyService → journeyShareService; collectionsService any time
-  (its notificationService edge is lazy; fix `collections-2`'s cross-domain place writes
-  during its fold).
-- Leaves any time: weatherService, wikiService, airportService (see Phase 3 note).
-- backupService last by design (owns the closeDb/reinitialize lifecycle).
-
-## Seam-ownership decisions to make (before the code that touches them)
-
-From the audit's "shared concepts owned in halves" theme — each needs a single-owner
-decision, ideally settled when the neighboring migration opens the files anyway:
-- [ ] **reservation↔budget link lifecycle** (`budget-1`, `budget-2`, `days-2`): today split
-  across budget (`syncReservationPrice` writes reservations), reservations
-  (syncBudgetOn* + raw budget_items SQL) and days. Likely owner: reservations orchestrates,
-  budget/days expose domain methods.
-- [x] **accommodations** (`days-1`): SQL+MCP in days, REST in reservations — pick one home.
-  (done 2026-08-10, `3d522be0` "Give accommodations one home instead of two halves" —
-  `nest/accommodations/` is the single owner.)
-- [ ] **per-domain user erasure** (`collections-4`, `collections-5`): domain-owned erasure
-  methods vs the central userCleanupService — pick a convention before the users domain
-  exists (Phase 4 forces this).
-- [ ] **todo riding packing's addon + permission** (`collections-6`): decide if that's a
-  product decision (document it) or an accident (give todo its own addon/permission).
-
-## Tokenization & registries — kill the string contracts
-
-Several security- and sync-critical contracts are typo-prone free strings today, even where
-a registry already exists but isn't enforced. The repo already has the right precedents:
-`SCOPES` (`mcp/scopes.ts`, `as const` + derived `Scope` type), `ADDON_IDS` (`addons.ts`),
-plugin `KNOWN_PERMISSIONS` (`plugins/protocol/envelope.ts`, shared host+child, sdk-mirrored
-with parity tests), the notifications `channelRegistry`, and the boot-time fail-closed
-ratchet (`validateBodyContracts`). The pattern to replicate: **one `as const` registry, a
-derived union type at every call site, and a boot gate that refuses unknown tokens.**
-Ordered by value:
-
-- [x] **WS event contract registry in `@trek/shared`** (done 2026-07-29: authoritative
-  count is **65 trip + 29 user = 94** events, not 52; `TREK_WS_EVENTS` +
-  `TrekWsPayload<E>`; RealtimeService overloads enforce registry keys at compile time
-  (`plugin:` namespace is the escape hatch); client switches became enumerable lookups
-  with a registry-parity test — 46 handled, 29 handled via dedicated listeners,
-  19 explicitly ignored; payload schemas are loose scaffolding, tighten opportunistically;
-  8 payload-drift shapes documented as unions in the schema's DRIFT comments) — Today
-  **52 distinct event names** are broadcast server-side but only **33 appear** in the
-  client's `remoteEventHandler` switch, and the budget migration just proved payload-shape
-  drift is real (the MCP `{item}` payloads were silent client no-ops — audit finding, fixed
-  2026-07-28). Mechanism: `shared/src/realtime/events.schema.ts` with event-name constants
-  + a Zod payload schema per event; server `broadcast()`/`RealtimeService` typed against it
-  (event name must be a registry key, payload must satisfy its schema), client handler
-  switching exhaustively over the same union (unhandled event = compile-time or test-time
-  error, not silence). Do it **with Phase 0's `RealtimeService`** — the facade is the
-  natural choke point to introduce the typed signature; migrate events opportunistically.
-- [x] **Typed MCP access groups + boot validation** (done 2026-07-28: `ScopeGroup`
-  derived from `SCOPES`, `McpAccessGroupRegistry` augmentation types every
-  `access.group`, `trekMcpValidateAccess` boot gate refuses unknown group/mode
-  combos incl. `write` on read-only `geo`/`weather`; legacy `canRead`/`canWrite`
-  now take `ScopeGroup`) — `access: { group: 'vacay', mode:
-  'write' }` appears ~100+ times across `.mcp.ts` files as free strings. A typo'd group
-  never matches a real scope: scoped tokens get denied (fail closed) but `scopes: null`
-  sessions pass (fail open) — silent scope-model drift either way. Mechanism: derive a
-  `ScopeGroup` union from `SCOPES` and type the decorator's `access.group` against it
-  (originally a `declare module '@trek/nest-mcp'` augmentation; since the 2026-08-22 fold
-  the registries live directly in `server/src/nest-mcp/types.ts`); plus a **boot gate in
-  the MCP registry**: at discovery
-  time, refuse to boot on an `access.group`/tool-name/`when` combination that doesn't
-  resolve against `SCOPES` — the body-contract ratchet pattern applied to the MCP surface.
-  The registry the user-facing scopes UI reads (`SCOPE_INFO`) then serves decorators, the
-  legacy `canRead/canWrite`, and the OAuth consent screen from one source.
-- [ ] **Permission-action tokens** — `checkPermission('budget_edit', …)` /
-  `hasTripPermission('packing_edit', …)` at 90+ call sites; the actions are already
-  defined once as data in `permissions.service.ts` (key + defaultLevel + allowedLevels)
-  but nothing types the call sites against that table. Mechanism: export
-  `PERMISSION_ACTIONS as const` + `PermissionAction` union from the permissions domain and
-  type `checkPermission`/`hasTripPermission`/the bridge against it. Candidate for
-  `@trek/shared` if the client's permission store uses the same keys (verify — if yes,
-  it's the same single-source rule as the Zod contracts).
-- [ ] **Audit-action tokens** — 73 `writeAudit('admin.addon_update' …)`-style call sites
-  with dotted free strings; a typo silently mis-files audit rows forever. Low effort:
-  `AUDIT_ACTIONS as const` in `nest/audit/`, typed `writeAudit`. Opportunistic — sweep a
-  domain's actions whenever a migration touches it.
-- [ ] **`app_settings` key registry** — keys are scattered (partial `ADMIN_SETTINGS_KEYS`
-  in authService, OIDC rows in adminService, 14 inline reads in `getAppConfig`) with
-  ownership split across auth/admin (findings `auth-1`, `auth-5`). Fold the registry into
-  the Phase 4 admin-settings relocation: one typed key catalog, per-domain accessors, no
-  raw `app_settings` string queries outside the owning module.
-- [ ] **Verify, don't rebuild, the good ones** — `ADDON_IDS` (ensure every `when:` gate
-  and client addon check derives from it, no re-typed literals), plugin
-  `KNOWN_PERMISSIONS`/`HOOK_PERMISSION` (already parity-tested against plugin-sdk — the
-  model the others should follow), i18n keys (already typed via `TranslationStrings`).
-  Small constants worth a home while passing by: `trek_session` cookie name,
-  `X-Socket-Id` / `X-Idempotency-Key` headers.
-
-## Request-pipeline guards — authorization before validation (audited 2026-08-01)
-
-Full audit with call sites, error-string parity landmines, do-not-guard list and
-sequencing: **`guards-audit.md`**. The finding in one line: authentication is already a
-guard (runs before the global `ZodValidationPipe`), but authorization — trip access 404s,
-`checkPermission` 403s, admin/demo/addon gates — is almost entirely inline in
-handlers/services, so unauthorized callers with invalid bodies see Zod 400s before
-access errors. Same strangler discipline as the DI migration: each conversion is a
-wire-behavior change (400↔403/404 ordering), one focused commit per slice, ordering
-pinned by tests.
-
-- [ ] **Slice 1 — trivial toggle guards** (mostly open 2026-08-10): `PluginsEnabledGuard`
-  (9 duplicated 503 blocks), `DevLinkEnabledGuard`, `McpEnabledGuard` (7 call sites,
-  keep 403), the two drop-in `AdminGuard` conversions (guards-audit.md §2.2–2.5, §5.1)
-  — all still inline. Two items resolved differently: `DemoUploadGuard` was
-  **deliberately rejected as a guard** — guards run before the multipart parser, so
-  throwing yields ECONNRESET instead of 403 (PROFILE-015); the dedup landed as the
-  shared `nest/common/demo-write.ts` helper instead. And the three hand-written addon
-  guards collapsed into one `AddonGuard` + `@RequireAddon` (`22d178d2`).
-- [x] **Slice 2 — `TripAccessGuard` + `@RequirePermission`** (landed 2026-08-09,
-  `8c0280e2` + `94221a6d`; the decorator shipped as `@RequirePermission` with a
-  `@Trip()` param decorator, not the planned `@RequireTripPermission`): 13 controllers
-  on `TripAccessGuard`, 81 `@RequirePermission` sites, **zero** inline `checkPermission`
-  left in controllers. Remaining tail (as predicted, the bespoke-string domains):
-  **trips** (7 bespoke 403 strings), **share**, **trip-invite**, **feeds** (still
-  hand-rolled trip-access SQL, §4.7), and partial conversions in **files** (guard
-  per-handler but permissions inline — one class-level decorator can't express
-  upload/edit/delete; upload stays off the guard for the multipart reason),
-  **places** and **collab** (old `requireTrip` helpers still present).
-- [ ] **Slice 3 — per-resource guards** (1 of 3 done 2026-08-10): `TripOwnerGuard` is
-  done (`45611e25`-era; applied to the 4 trip-members routes, deliberately skipping
-  `PermissionsService` so admins can't transfer trips). Still open: `JourneyRoleGuard`
-  (16 inline `Not allowed` 403s remain; + align its 403-for-invisible enumeration
-  signal to the collections 404-first idiom) and `PhotoAccessGuard` (memories
-  cross-user access still inline `canAccessUserPhoto`) (§2.6–2.8).
-- [x] **Capstone ratchet — global `APP_GUARD` `JwtAuthGuard` + `@Public()` decorator**
-  (done 2026-08-10, `ffb73fac` "Turn protection from opt-in into default-deny" +
-  `be8081c3` MFA guard): `GlobalAuthGuard` + `MfaPolicyGuard` as `APP_GUARD`s,
-  `@Public()`/`@OptionalAuth()` decorators, and the boot-time
-  `validate-route-guards.ts` ratchet (`PUBLIC_ROUTE_ALLOW_LIST`). One deviation from
-  §6's plan: instead of sweeping the per-controller `@UseGuards(JwtAuthGuard)` sites,
-  the global guard *stands down* for any route with a declared guard chain (reads
-  `GUARDS_METADATA`, resolves `req.user` without throwing so MFA still sees the
-  caller) — that solves the addon-404-before-401 ordering caveat. MFA middleware
-  folded (one intended behavior change: public `/api` routes no longer 403 MFA-less
-  logged-in users); all four dead middleware files deleted (`939452f9`, `9814480a`,
-  `be8081c3` — `src/middleware/` now holds only `globalMiddleware.ts`).
-- [ ] **Decisions parked in the audit** (still open 2026-08-10): the missing server-side
-  `documents` addon gate (only ungated addon without a load-bearing parity comment,
-  §4.2 — `/api/trips/:tripId/files` still serves with the addon off); rate-limit
-  unification (§4.4 — **half done**: one shared `RateLimitService`/`RateLimitModule`
-  now serves 5 modules, but `transit.mcp.ts`, backup, `mcp/index.ts` and the plugin
-  host still roll their own, and no `@RateLimit` decorator exists). Do NOT guard the body-dependent
-  checks (collections owner checks, `PUT /trips/:id`'s body-derived permission key,
-  vacay) or the fail-soft plugin contribution routes — the audit's §3 list is load-bearing.
-
-## Continuous streams (not phases)
-
-- **DTO ratchet**: every migration includes its domain's DTOs; remaining allow-list entries
-  for already-migrated domains are independent hour-scale filler tasks. The boot gate keeps
-  this honest.
-- **MCP decorator ports**: every migration moves its legacy registrar to `<domain>.mcp.ts`;
-  registrar-drift findings (`mcp-4`, `mcp-5`, `mcp-6`) die as their domains port.
-- **Quirk-fix trailing commits**: parity migration first, verified-defect fixes in a
-  separate `fix(server)` commit (established pattern).
-
-## Deliberately late
-
-- **Option B decorator RPC registry** (DI-MIGRATION.md §3) — **done 2026-08-09**
-  (`7b11680c` decorator kit → `f72aba0c` full rollout; `PluginsModule` split into
-  four with per-domain coverage gates, `6680bc7c`).
-- **True `@WebSocketGateway` transport swap**: behind the Phase 0 `RealtimeService` facade,
-  whenever — it becomes an implementation detail.
-- **`index.ts` boot dismantling**: the scheduler went with Phase 2 (2026-08-10 —
-  Nest lifecycle owns every cron); MCP/ws wiring migrate into Nest lifecycle hooks
-  opportunistically; the db `reinitialize` Proxy retires only with backupService,
-  last.
-
-## Operational hardening — will bite soonest (verified 2026-07-28)
-
-Not architecture, but the things most likely to hurt before the phases above finish:
-
-- [x] **De-flake the CI gate.** (done — see the Status block below; the checkbox lagged
-  the work.) `test:coverage` is the merge gate (test.yml) and it can
-  exit 1 spuriously: reproduced 2026-07-28 — an `EnvironmentTeardownError` from
-  `vacay.service.test.ts`, caused by a fire-and-forget dynamic
-  `import('services/notificationService')` resolving after the vitest environment tore
-  down. A flaky main gate trains everyone to re-run, and then real failures slip. Fix the
-  race (await/guard the lazy sends in tests — and note Phase 2's injected notifications
-  removes the pattern entirely), sweep the expected-error stderr noise (SQLITE_ERROR spam
-  makes real failures invisible in logs), and watch the coverage run's cost (~11 min of
-  module imports under istanbul instrumentation and growing with every migration).
-  - **Status 2026-07-28** (commits `c7dc38a5` + `80f39585`, test-side only, zero `src/`
-    changes):
-    - *Race*: defensively closed — global `afterEach` drain in `tests/setup.ts` settles
-      the unawaited import/`.then` chains while DB + worker env are alive, plus vacay-style
-      `beforeAll` warm-ups in the cold suites (unit trips.service, integration
-      vacay/collab/packing/trips). Mechanism verified against vitest 4.1.9 source (the
-      dynamic import's host-RPC fetch is what teardown rejects; warmed URLs skip the RPC);
-      NOT reproduced locally in ~110 stress runs (fast machine — CI's 2-core runner is
-      where the window is wide), so keep an eye on the gate before calling it dead.
-    - *Noise*: swept — green `test:unit` stderr went 8,249 → ~195 lines
-      (`tests/setup.console-noise.ts`, two exact-pattern filters: migrations
-      duplicate-column replay artifact + the vitest-only airportService backfill require
-      failure). Remaining follow-up if wanted: ~168 stdout `[DB] Running migration N/M`
-      lines per test file.
-    - *Cost* (watch item, unchanged): two clean gate runs at 52s wall on a 16-thread dev
-      box, but cumulative import time ~657s vs ~97s actual test time — instrumented
-      module imports are ~6.6× the tests themselves and scale with migrated-module count,
-      not test count. Phase 2's injected notifications still deletes the send pattern
-      entirely.
-- [ ] **Migration-identity safety.** `schema_version` is a single integer and a step's
-  identity is its array position; append-only is enforced only by convention plus a
-  hygiene test, and failed steps log "Non-fatal migration step failed" and continue.
-  The bite: two branches each appending "step N" merge cleanly, and instances migrated at
-  different times silently diverge. Add: a named/checksummed applied-migrations ledger
-  (keep positional order, record identity), a boot-time collision check, and an automatic
-  pre-migration snapshot (backupService already knows how) before any pending step runs.
-- [ ] **Swallowed cross-domain side-effect failures.** 11 `catch → console.error` sites in
-  `nest/**` services alone — mostly the sync seams (reservation↔budget item creation,
-  price sync, booking-import costs). These silently lose user-visible data: a booking
-  saves, its expense doesn't, nobody is told. Define one policy (at minimum: audit-log the
-  failure + emit a client-visible warning event; ideally a small retry queue for the
-  money-adjacent ones) and sweep the seams — pairs naturally with the seam-ownership
-  decisions above, since each seam gets one owner anyway. The client-side rule already
-  exists ("optimistic writes must reconcile — no silent catch"); this is its server twin.
-- [ ] **Dependency currency.** No automation visible for dependency updates (better-sqlite3
-  ABI bumps, Nest majors, the Express adapter). Pick a cadence or a bot (Renovate/
-  dependabot) before the gap gets expensive; the plugin-sdk's standalone lockfile doubles
-  the surface.
-
-## Definition of done (so "finished" is checkable, not vibes)
-
-The migration/modernization is complete when all of these hold — each is grep- or
-gate-verifiable, worth re-checking after every phase:
-
-- `server/src/services/` contains only the deliberate plain-module helpers listed in
-  `migration-graph.md`'s classification (no domain service files).
-- Zero `*.bridge.ts` files remain (bridge deletion notes in each file say when).
-- The `db` Proxy is imported only by `DatabaseModule`/`database.ts` internals and
-  backupService's lifecycle code; every other consumer injects `DatabaseService`.
-- `index.ts` is thin: no hand-booted scheduler/ws/MCP wiring (Nest lifecycle owns them);
-  the db-boot airport backfill is gone (`places-1`).
-- `src/mcp/tools.ts` fan-out is empty (registry attach only); `src/mcp/resources.ts` gone.
-- `body-contract-allow-list.ts` is empty and deleted (gate removed with it).
-- Tests: no `vi.mock('src/db/database')` outside DatabaseService's own tests — the
-  through-line promise in `migrate.md`.
-- The tokenization boot gates (MCP access groups, WS events) are on and non-empty.
-
-**Re-checked 2026-08-10** (after the `src/services/` deletion):
-
-- ✅ `src/services/` gone — deleted outright, plus the ESLint wall.
-- ✅ No `vi.mock('src/db/database')` outside DatabaseService's own tests.
-- ✅ `src/mcp/tools.ts` is registry-attach-only (3 live lines); all 24 domains on
-  `<domain>.mcp.ts`, prompts included.
-- ✅ Tokenization boot gates on (`nest-mcp-policy.ts`, `validateBodyContracts`,
-  `validate-route-guards.ts`).
-- 🟡 `body-contract-allow-list.ts` is **empty** (`ba7d55f9` cleared the last 17) but
-  the file + boot gate still exist — arguably keep the gate as the ratchet.
-- ✅ (2026-08-10) The scheduler is Nest-owned: `src/scheduler.ts` deleted, every
-  cron a domain provider on `CronRegistrarService` (`src/nest/scheduling/`),
-  `node-cron` out of `package.json`. `index.ts` no longer boots any cron and its
-  `shutdown()` rides `nestApp.close()`. The db-boot airport backfill was already
-  gone (`9c46f31c`). (2026-08-11: the ws gateway binds inside `buildApp()` and
-  /mcp is a Nest controller — `index.ts`'s only MCP touch left is the
-  `closeMcpSessions()` housekeeping call in `shutdown()`.)
-- ✅ (2026-08-11, MCP/OAuth mount migration) **Zero** `*.bridge.ts` files
-  remain. The one remaining seam died: /api/health, OAuth discovery, the
-  consent COOP override, /oauth/authorize + /oauth/register (SDK routers via
-  `OauthModule.configure`) and /mcp (`nest/mcp-transport/`) all moved behind
-  the container, so `oauth`/`audit`/`addons`/`auth`/`permissions` bridges
-  became ordinary injections and were deleted, along with
-  `mcp/registry-handoff.ts` (the transport injects `McpRegistryService`).
-  `_shared.ts`'s impure guards became the injectable `McpToolGuardsService`
-  (`nest/mcp-shared/`). Pre-init Express now carries only global middleware,
-  uploads, the DI-built discovery metadata middleware, static assets, api-docs
-  and the named body-parser wrappers (which keep `/mcp` bodies raw for the
-  SDK).
-- 🟡 (historical — the 2026-08-11 morning state this replaced) 5 bridges
-  remained after the bridge fold, all pinned by the pre-`app.init()` mount.
-  The 2026-08-10 endgame executed and then some:
-  the 4 dead ones deleted (`8e4261ed`); `journey.bridge` +
-  `src/mcp/resources.ts` retired with the journey-resource migration;
-  `budget.bridge` deleted (UserCleanupService injects BudgetService);
-  the backup-restore / systemNotices in-container edges folded
-  (`permissions-cache.ts`, threaded `addonEnabled`); and the three
-  "verified-permanent" cycle-dodges eliminated by restructuring rather than
-  forwardRef — `trips.bridge` via leaf TripMembership reads + prompt
-  relocation, `assignments.bridge` via an `AssignmentsDomainModule` split,
-  `airtrail.bridge` via `ReservationsReadRepository` + `AirtrailLinkService`
-  in `AirtrailCoreModule`. `notifications.instance.ts` died with the last of
-  them.
-- ✅ (2026-08-11) `src/mcp/resources.ts` gone — the 4 journey resources are
-  decorator-registered on `journey.mcp.ts`; `journey.bridge` died with it.
-- 🟡 (re-checked 2026-08-11, after the mount migration) The `db` proxy is
-  imported outside DatabaseModule by exactly four files: `backup.impl.ts`
-  (the backup lifecycle the DoD explicitly allows), `auth/jwt-verify.ts`
-  (the canonical pre-init token verifier the uploads route shares),
-  `platform.routes.ts` (the guarded /uploads/photos route) and
-  `places/place-image.ts`. Nothing under `src/mcp/` touches it anymore —
-  `oauthProvider.ts` is the injectable `oauth-sdk.provider.ts`, `_shared.ts`
-  is pure, and every bridge is gone.
-
-## Keep in mind — ORM / data-layer swap (not scheduled, just recorded)
-
-An ORM move is under consideration but deliberately NOT a roadmap phase. What to remember
-when the time comes (discussed 2026-07-28):
-
-- **The sync/async decision dominates everything.** better-sqlite3 being synchronous is
-  load-bearing: `db.transaction()` cannot contain an `await` (the budget FX-freeze design
-  exists because of this), controllers return without racing broadcasts, and there are no
-  async gaps inside multi-statement writes. Prisma/TypeORM/MikroORM/Kysely are all
-  Promise-based — adopting one is a rewrite of the concurrency model, not a data-layer
-  swap. **Drizzle** is the mainstream option that keeps sync semantics over
-  better-sqlite3; its schema-as-code + migration generator would also address the
-  migration-identity item in "Operational hardening". Decide sync-vs-async first, via a
-  short spike with hard criteria: sync preserved? byte-parity strategy for the documented
-  SQL quirks (COALESCE/CASE sentinels, INSERT OR IGNORE, lastInsertRowid)? migration story
-  vs the positional `schema_version`?
-- **Do NOT pre-build an abstract DatabaseService or hand-rolled repository interfaces.**
-  Abstraction at the `prepare/get/all/run` level is the wrong seam (no ORM can be
-  implemented behind it), and interfaces designed before the target is chosen get shaped
-  around today's implementation — every ORM imposes its own repository/entity idioms.
-  Premature abstraction here is negative work.
-- **The migration IS the ORM prep.** Each fold consolidates a domain's SQL into one
-  injectable class — that's most of what a repository layer provides. The table-ownership
-  seam decisions (see "Seam-ownership decisions") are the true ORM prerequisites: entities
-  need one owner per table.
-- **Cheap conventions worth adopting when convenient** (no parity risk):
-  large NEW folds may split into `<domain>.service.ts` (logic/permissions/broadcasts) +
-  `<domain>.repository.ts` (SQL, still over the concrete `DatabaseService`, byte-identical)
-  — tripService is the natural first candidate; and per-domain typed row types
-  (`SettlementRow` pattern → a `rows.ts` per domain) as proto-entities. Don't retrofit
-  finished domains until the target is chosen.
-
-## Known not-covered (future audits)
-
-- **Client-side coherence**: this audit was server-only; client CLAUDE.md notes the
-  files bypassing the store→repo→api layering — a parallel audit + ratchet is its own
-  project. **The debt is growing**: ~137 files at the 2026-07 count, **~190** at a
-  2026-08-10 recount (components 98, mobile 55, pages 31, plus sync/services/hooks),
-  with no lint/CI ratchet holding the line.
-- Low-severity audit findings not scheduled above remain valid opportunistic fixes — see
-  `audit_report/domain-coherence-audit.md` per-domain sections.
diff --git a/server/CLAUDE.md b/server/CLAUDE.md
index 35da3276b..e4786d994 100644
--- a/server/CLAUDE.md
+++ b/server/CLAUDE.md
@@ -10,6 +10,7 @@ Scope: the **`@trek/server`** workspace. See the repo-root `CLAUDE.md` for the m
 npm run dev               # scripts/dev.mjs: tsc -w then node --watch dist/index.js (server on :3001)
 npm run build             # scripts/build.mjs — see "emit-anyway" note below
 npm run typecheck         # tsc --noEmit (the real type gate; build does NOT fail on type errors)
+npm run typecheck:tests   # tsc over tests/ — CI runs this too; vitest green does NOT mean typed mocks compile
 npm run lint              # eslint --fix on src/apps/libs/test
 npm run lint:check        # eslint, no fix
 npm run test              # vitest run (all of tests/**)
@@ -18,6 +19,8 @@ npm run test:integration  # tests/integration
 npm run test:ws           # tests/websocket
 npm run test:e2e          # tests/e2e (boots Nest modules against a temp in-memory SQLite)
 npm run test:coverage     # istanbul coverage; per-domain ratchet over src/nest/** (floor ≥80%)
+npm run gen:plugin-facts  # regenerate the plugin-protocol tables into plugin-sdk/ + shared/
+npm run check:plugin-facts # CI gate — fails if the generated copies drifted from envelope.ts
 ```
 
 Single test:
@@ -41,10 +44,11 @@ Nest owns everything: the strangler migration **completed 2026-08-10**, and the
 - **`src/db/`** — `better-sqlite3` (WAL, FK on). `database.ts` boots and runs `schema.ts` → `migrations.ts` → `seeds.ts`. `NODE_ENV=test` ⇒ isolated `:memory:` DB per vitest worker; `TREK_DB_FILE` ⇒ explicit file DB (Playwright harness).
 - **`src/websocket.ts`** — JWT-authed `ws` server on `/ws`, room-per-trip, heartbeat, per-connection rate limiting. Trip mutations forward `X-Socket-Id` so the originating client doesn't echo its own change.
 - **`src/mcp/`** — process-wide MCP state (scopes, sessionManager, tuning knobs, rate-limit map, `nest-mcp-policy.ts` boot gate). The HTTP transport is `src/nest/mcp-transport/` (a `@Public` controller + service); the tools/resources/prompts live in decorator-driven `<domain>.mcp.ts` files under `src/nest/` — `src/mcp/tools.ts` is registry-attach-only. Every tool invocation writes an `mcp.tool_call` audit row (user, OAuth client, tool name, ip) via the nest-mcp `onInvoke` seam.
+- **`src/nest-mcp/`** — the decorator/registry layer itself (`@McpController`/`@Tool`/`@Resource`/`@Prompt`, `McpRegistry`, `McpModule`, result helpers) that the `<domain>.mcp.ts` files build on. Formerly the standalone `@trek/nest-mcp` workspace, folded in 2026-08-22; see its `README.md` for the API and invariants (self-contained apart from a type-only `../mcp/scopes` import; no scope semantics of its own). Tests: `tests/unit/nest-mcp/`.
 - **`src/nest/scheduling/`** — `CronRegistrarService`, the one way TREK schedules a cron (`@nestjs/schedule` + the `cron` package). Every job is a `*.job.ts` provider in its owning domain, registered from `onApplicationBootstrap`; the registrar refuses to schedule under `NODE_ENV=test` (the shared `buildApp()` harness must never tick — `tests/integration/scheduler-gate.test.ts` pins it) and stops everything on `nestApp.close()`. Never use a `@Cron` decorator — decorator jobs bypass the gate.
-- **`src/nest/plugins/`** — sandboxed plugin runtime in three layers: `supervisor/` + `runtime/plugin-host-entry.ts` + `protocol/envelope.ts` (forked child per plugin, IPC envelopes, rate/RSS policing — **intentionally not Nest**, it's the security boundary); `host/rpc-host.ts` (enforcement: a method is registered at spawn only if the plugin holds the unlocking permission — registration = authorization); `host/plugin-host-deps.factory.ts` (dependency wiring — an `@Injectable()` factory injecting the domain services; the RPC surface is decorator-driven since 2026-08-09, with `PluginsModule` split into four and per-domain coverage gates) + `host/plugin-host-state.ts` (process-wide data-DB/budget maps, module-level on purpose). Install-time gates in `install/` (manifest, safe-extract, Ed25519 signature verify, egress). ⚠️ `runtime/egress-policy.ts` and `HOOK_PERMISSION` in `supervisor/plugin-supervisor.ts` are mirrored (egress-policy **byte-identical**) into `plugin-sdk/` and guarded by parity tests there — keep both sides in sync when touching either.
+- **`src/nest/plugins/`** — sandboxed plugin runtime in three layers: `supervisor/` + `runtime/plugin-host-entry.ts` + `protocol/envelope.ts` (forked child per plugin, IPC envelopes, rate/RSS policing — **intentionally not Nest**, it's the security boundary); `host/rpc-host.ts` (enforcement: a method is registered at spawn only if the plugin holds the unlocking permission — registration = authorization); `host/plugin-host-deps.factory.ts` (dependency wiring — an `@Injectable()` factory injecting the domain services; the RPC surface is decorator-driven since 2026-08-09, with `PluginsModule` split into four and per-domain coverage gates) + `host/plugin-host-state.ts` (process-wide data-DB/budget maps, module-level on purpose). Install-time gates in `install/` (manifest, safe-extract, Ed25519 signature verify, egress). ⚠️ The protocol tables — permissions, RPC methods, hooks, and the core-event catalog — live in `protocol/envelope.ts` (+ `src/plugin-event-sink.ts` for the event families) and are **generated** into `plugin-sdk/src/generated/host-facts.ts` and `shared/src/plugin-permissions.ts` by `npm run gen:plugin-facts`; `check:plugin-facts` is the CI gate, so run it after touching any of them and commit the regenerated files. `runtime/egress-policy.ts` is still a hand-kept **byte-identical** mirror into `plugin-sdk/`, guarded by parity tests there — keep both sides in sync when touching either.
 
-## Direction (from the 2026 audit — `audit_report/TREK_audit_reports/`)
+## Direction (post-migration guardrails, from the 2026 audit)
 
 **Nest is the destination — and as of 2026-08-10 the code is there.** These rules now guard against regression rather than describe a migration in flight:
 
diff --git a/server/scripts/gen-plugin-facts.ts b/server/scripts/gen-plugin-facts.ts
index 0cdc0da22..eccb32a33 100644
--- a/server/scripts/gen-plugin-facts.ts
+++ b/server/scripts/gen-plugin-facts.ts
@@ -21,12 +21,13 @@ import {
   HOOK_PERMISSION, KNOWN_METHODS, KNOWN_PERMISSIONS, METHOD_PERMISSION,
   EVENTS_PERMISSION, JOBS_PERMISSION, USER_DATA_PERMISSION, HTTP_OUTBOUND_PREFIX,
 } from '../src/nest/plugins/protocol/envelope';
+import { SNAPSHOT_GRANT, ENTITY_ID_KEYS } from '../src/plugin-event-sink';
 
 const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 
 const HEADER = [
   '// GENERATED — do not edit by hand.',
-  '// Source: server/src/nest/plugins/protocol/envelope.ts',
+  '// Source: server/src/nest/plugins/protocol/envelope.ts + server/src/plugin-event-sink.ts',
   '// Regenerate: node --import tsx server/scripts/gen-plugin-facts.ts',
   '',
 ].join('\n');
@@ -43,6 +44,8 @@ const pairs = (o: Readonly<Record<string, string>>) =>
  * source-breaking type change for any plugin author doing a dynamic lookup. Strictness
  * belongs on the host side, where the data source lives.
  */
+const EVENT_FAMILIES = [...new Set([...Object.keys(ENTITY_ID_KEYS), ...Object.keys(SNAPSHOT_GRANT)])].sort();
+
 const SDK_FACTS = `${HEADER}
 export const HOOK_PERMISSION: Readonly<Record<string, string>> = {
 ${pairs(HOOK_PERMISSION)}
@@ -64,6 +67,21 @@ export const USER_DATA_PERMISSION = '${USER_DATA_PERMISSION}';
 export const EVENTS_PERMISSION = '${EVENTS_PERMISSION}';
 export const JOBS_PERMISSION = '${JOBS_PERMISSION}';
 export const HTTP_OUTBOUND_PREFIX = '${HTTP_OUTBOUND_PREFIX}';
+
+/**
+ * Core-event catalog. Delivery names are the WebSocket broadcast names,
+ * \`<family>:<verb>\` (e.g. \`place:created\`). A subscribed plugin receives
+ * \`{event, tripId, entity?, entityId?, snapshot?}\`; \`snapshot\` is delivered only
+ * when the plugin also holds EVENT_SNAPSHOT_GRANT[family]. Delete/reorder/bulk
+ * events carry no snapshot.
+ */
+export const EVENT_FAMILIES: readonly string[] = [
+${list(EVENT_FAMILIES)}
+];
+
+export const EVENT_SNAPSHOT_GRANT: Readonly<Record<string, string>> = {
+${pairs(SNAPSHOT_GRANT)}
+};
 `;
 
 const SHARED_FACTS = `${HEADER}
diff --git a/server/src/app-config/app-url.ts b/server/src/app-config/app-url.ts
index f91f5038e..ce53e3641 100644
--- a/server/src/app-config/app-url.ts
+++ b/server/src/app-config/app-url.ts
@@ -1,4 +1,5 @@
 import { readEnv } from './env';
+import { stripTrailingSlashes } from './parsers';
 
 /**
  * Instance base-URL resolution: APP_URL → first ALLOWED_ORIGINS entry →
@@ -12,7 +13,7 @@ export function getAppUrl(): string {
   if (appUrl) {
     try {
       const _ = new URL(appUrl);
-      return appUrl.replace(/\/+$/, '');
+      return stripTrailingSlashes(appUrl);
     } catch (_ignored) {}
   }
   const origins = readEnv().http.allowedOriginsRaw;
@@ -21,7 +22,7 @@ export function getAppUrl(): string {
     if (first) {
       try {
         const _ = new URL(first);
-        return first.replace(/\/+$/, '');
+        return stripTrailingSlashes(first);
       } catch (_ignored) {}
     }
   }
diff --git a/server/src/app-config/derive.ts b/server/src/app-config/derive.ts
index 0d02eea01..a4b3d95d8 100644
--- a/server/src/app-config/derive.ts
+++ b/server/src/app-config/derive.ts
@@ -233,6 +233,12 @@ export function deriveIntegrations(raw: RawEnv) {
     overpassUrl: raw.OVERPASS_URL,
     overpassTimeoutMs: positiveNumberOr(raw.OVERPASS_TIMEOUT_MS, 12000),
     kitineraryExtractorPath: raw.KITINERARY_EXTRACTOR_PATH,
+    // Windows spells it Path; every other platform PATH. Split here so callers
+    // get a list and never re-implement the delimiter.
+    searchPath: (raw.PATH || raw.Path || '')
+      .split(process.platform === 'win32' ? ';' : ':')
+      .map(p => p.trim())
+      .filter(Boolean),
   };
 }
 
diff --git a/server/src/app-config/env.schema.ts b/server/src/app-config/env.schema.ts
index d2669bc41..4bf41ac3d 100644
--- a/server/src/app-config/env.schema.ts
+++ b/server/src/app-config/env.schema.ts
@@ -113,6 +113,12 @@ export const envSchema = z.object({
   OVERPASS_URL: anyString,
   OVERPASS_TIMEOUT_MS: positiveNumber,
   KITINERARY_EXTRACTOR_PATH: anyString,
+  // The OS search path. Not configuration anybody sets for TREK — it is here so
+  // the kitinerary probe can resolve its binary to an absolute path itself
+  // instead of handing an unqualified name to exec, which would re-resolve
+  // through whatever PATH held at that moment.
+  PATH: anyString,
+  Path: anyString,
 
   // Data / paths
   TREK_DB_FILE: anyString,
diff --git a/server/src/app-config/parsers.ts b/server/src/app-config/parsers.ts
index 2d75e4db3..fb148b5c3 100644
--- a/server/src/app-config/parsers.ts
+++ b/server/src/app-config/parsers.ts
@@ -68,9 +68,13 @@ export function csvListFiltered(raw: string | undefined): string[] | null {
     : null;
 }
 
-/** Strip ALL trailing slashes (`/\/+$/`) — app-url.getAppUrl / TRANSIT_API_URL variant. */
+/** Strip ALL trailing slashes (`/\/+$/`) — app-url.getAppUrl / TRANSIT_API_URL variant.
+ *  Scanned rather than replaced: `/\/+$/` re-walks the slash run from every start
+ *  position, which is quadratic on a slash-heavy value. Same result, same quirk. */
 export function stripTrailingSlashes(value: string): string {
-  return value.replace(/\/+$/, '');
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47 /* '/' */) end--;
+  return value.slice(0, end);
 }
 
 const DURATION_UNITS_MS: Record<string, number> = {
@@ -90,7 +94,7 @@ const DURATION_UNITS_MS: Record<string, number> = {
 export function parseDurationMs(value: string): number | null {
   const m = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w|y)?$/i.exec(value.trim());
   if (!m) return null;
-  const n = parseFloat(m[1]);
+  const n = Number.parseFloat(m[1]);
   if (!Number.isFinite(n) || n <= 0) return null;
   return n * DURATION_UNITS_MS[(m[2] || 'ms').toLowerCase()];
 }
diff --git a/server/src/db/migrations.ts b/server/src/db/migrations.ts
index 55383d398..bc77e7304 100644
--- a/server/src/db/migrations.ts
+++ b/server/src/db/migrations.ts
@@ -4123,6 +4123,19 @@ function runMigrations(db: Database.Database): void {
         }
       }
     },
+
+    // A deliberate non-latest plugin install sets `update_hold`: the row leaves the
+    // update banner and "Update all" until the admin resumes updates, or until an
+    // install lands back on the newest compatible version. Only an EXPLICIT version
+    // pick ever sets it — dependency resolution pins versions too, but never
+    // deliberately. Appended LAST — the array is index-addressed against schema_version.
+    () => {
+      try {
+        db.exec('ALTER TABLE plugins ADD COLUMN update_hold INTEGER NOT NULL DEFAULT 0;');
+      } catch (err) {
+        console.warn('[migrations] Non-fatal migration step failed:', err);
+      }
+    },
   ];
 
   if (currentVersion < migrations.length) {
diff --git a/server/src/demo/demo-seed.ts b/server/src/demo/demo-seed.ts
index c10291055..c08e1753d 100644
--- a/server/src/demo/demo-seed.ts
+++ b/server/src/demo/demo-seed.ts
@@ -1,6 +1,7 @@
 import bcrypt from 'bcryptjs';
 import Database from 'better-sqlite3';
 import { readEnv } from '../app-config';
+import { DEMO_PASS } from '../nest/common/demo';
 // Static like in demo-reset.job.ts: the module top is inert, everything that
 // touches the database happens inside the functions.
 import { saveBaseline, hasBaseline } from './demo-reset';
@@ -10,7 +11,6 @@ function seedDemoData(db: Database.Database): { adminId: number; demoId: number
   const ADMIN_EMAIL = readEnv().demo.adminEmailRaw || 'admin@trek.app';
   const ADMIN_PASS = readEnv().demo.adminPass;
   const DEMO_EMAIL = 'demo@trek.app';
-  const DEMO_PASS = 'demo12345';
 
   // Create admin user if not exists
   let admin = db.prepare('SELECT id FROM users WHERE email = ?').get(ADMIN_EMAIL) as { id: number } | undefined;
diff --git a/server/src/nest/admin/admin.helpers.ts b/server/src/nest/admin/admin.helpers.ts
index 2c984c210..9e9ede0e2 100644
--- a/server/src/nest/admin/admin.helpers.ts
+++ b/server/src/nest/admin/admin.helpers.ts
@@ -27,7 +27,7 @@ export function compareVersions(a: string, b: string): number {
   const parse = (v: string) => {
     const [base, pre] = v.split('-pre.');
     const parts = base.split('.').map(Number);
-    const n = pre !== undefined ? parseInt(pre, 10) : null;
+    const n = pre !== undefined ? Number.parseInt(pre, 10) : null;
     const preN = n !== null && Number.isFinite(n) ? n : null;
     return { parts, preN };
   };
diff --git a/server/src/nest/admin/admin.service.ts b/server/src/nest/admin/admin.service.ts
index 9cb35f9ab..5a50ab991 100644
--- a/server/src/nest/admin/admin.service.ts
+++ b/server/src/nest/admin/admin.service.ts
@@ -249,7 +249,7 @@ export class AdminService {
   }
 
   deleteUser(id: string, currentUserId: number) {
-    if (parseInt(id) === currentUserId) {
+    if (Number.parseInt(id) === currentUserId) {
       return { error: 'Cannot delete own account', status: 400 };
     }
 
@@ -328,8 +328,8 @@ export class AdminService {
   // ── Audit Log ──────────────────────────────────────────────────────────────
 
   getAuditLog(query: { limit?: string; offset?: string }) {
-    const limitRaw = parseInt(String(query.limit || '100'), 10);
-    const offsetRaw = parseInt(String(query.offset || '0'), 10);
+    const limitRaw = Number.parseInt(String(query.limit || '100'), 10);
+    const offsetRaw = Number.parseInt(String(query.offset || '0'), 10);
     const limit = Math.min(Math.max(Number.isFinite(limitRaw) ? limitRaw : 100, 1), 500);
     const offset = Math.max(Number.isFinite(offsetRaw) ? offsetRaw : 0, 0);
 
diff --git a/server/src/nest/atlas/atlas.service.ts b/server/src/nest/atlas/atlas.service.ts
index b966b9a0d..b80af625b 100644
--- a/server/src/nest/atlas/atlas.service.ts
+++ b/server/src/nest/atlas/atlas.service.ts
@@ -254,7 +254,7 @@ export class AtlasService {
       const dates = countryTrips
         .map((t) => t.start_date)
         .filter(Boolean)
-        .sort();
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
       return {
         code: c.code,
         placeCount: c.places.length,
@@ -376,7 +376,8 @@ export class AtlasService {
     const visited = countries.filter((c) => c.status === 'visited');
     const planned = countries.filter((c) => c.status === 'planned');
 
-    const mostVisited = visited.length > 0 ? visited.reduce((a, b) => (a.placeCount > b.placeCount ? a : b)) : null;
+    const mostVisited =
+      visited.length > 0 ? visited.reduce((a, b) => (a.placeCount > b.placeCount ? a : b), visited[0]) : null;
 
     const continents: Record<string, number> = {};
     visited.forEach((c) => {
@@ -429,7 +430,7 @@ export class AtlasService {
       nextTrip.daysUntil = Math.max(0, diff);
     }
 
-    const tripYears = new Set(trips.filter((t) => t.start_date).map((t) => parseInt(t.start_date!.split('-')[0])));
+    const tripYears = new Set(trips.filter((t) => t.start_date).map((t) => Number.parseInt(t.start_date!.split('-')[0])));
     let streak = 0;
     const currentYear = new Date().getFullYear();
     for (let y = currentYear; y >= 2000; y--) {
diff --git a/server/src/nest/auth/auth.helpers.ts b/server/src/nest/auth/auth.helpers.ts
index e3a76811a..fc0457aac 100644
--- a/server/src/nest/auth/auth.helpers.ts
+++ b/server/src/nest/auth/auth.helpers.ts
@@ -16,8 +16,10 @@ import { decrypt_api_key } from '../common/crypto/apiKeyCrypto';
 // resetPassword and the dummy-hash timing equaliser below — must stay in sync.
 export const BCRYPT_COST = 12;
 
-// Shape check for email input on register and profile update.
-export const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+// Shape check for email input on register and profile update. The dot is pinned to
+// the first one that can split the domain, so the runs on either side of it can
+// never claim the same characters. Same strings as before, without backtracking.
+export const EMAIL_REGEX = /^[^\s@]+@[^\s@][^\s.@]*\.[^\s@]+$/;
 
 // Pre-computed bcrypt hash to equalise timing of "unknown email" and
 // "OIDC-only account" branches with the real verification path (CWE-208).
diff --git a/server/src/nest/auth/auth.service.ts b/server/src/nest/auth/auth.service.ts
index a18dab305..a00d1b6eb 100644
--- a/server/src/nest/auth/auth.service.ts
+++ b/server/src/nest/auth/auth.service.ts
@@ -25,7 +25,7 @@ import { splitManagedKeys } from '../common/managed';
 import { emitUserDeleted } from '../../plugin-user-lifecycle';
 import { verifyJwtAndLoadUser } from './jwt-verify';
 import { User } from '../../types';
-import { DEMO_EMAIL_PRIMARY, isDemoEmail } from '../common/demo';
+import { DEMO_EMAIL_PRIMARY, DEMO_PASS, isDemoEmail } from '../common/demo';
 import { avatarUrl } from '../common/avatarUrl';
 import { TripMembershipService } from '../trip-membership/trip-membership.service';
 import { WebauthnConfigService } from './webauthn-config.service';
@@ -303,7 +303,7 @@ export class AuthService {
       managed: readEnv().managed.enabled,
       demo_mode: isDemo,
       demo_email: isDemo ? DEMO_EMAIL_PRIMARY : undefined,
-      demo_password: isDemo ? 'demo12345' : undefined,
+      demo_password: isDemo ? DEMO_PASS : undefined,
       timezone: readEnv().app.tz || Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC',
       notification_channel: notifChannel,
       notification_channels: activeChannels,
@@ -855,8 +855,10 @@ export class AuthService {
   requestPasswordReset(rawEmail: string, createdIp: string | null): PasswordResetRequestOutcome {
     const email = String(rawEmail || '').trim().toLowerCase();
     // Basic shape check — a fully empty / malformed email is treated like
-    // "no user" so we still spend the same time internally.
-    const looksLikeEmail = email.length > 0 && /.+@.+\..+/.test(email);
+    // "no user" so we still spend the same time internally. Same "x@y.z somewhere
+    // on one line" test as the old /.+@.+\..+/, but anchored per line and pinned to
+    // the first usable '@' and '.', so a body full of '@' can no longer stall it.
+    const looksLikeEmail = email.length > 0 && /^.[^@\r\n\u2028\u2029]*@.[^.\r\n\u2028\u2029]*\../m.test(email);
 
     // Global policy check: password login disabled → no reset possible.
     const toggles = this.resolveAuthToggles();
diff --git a/server/src/nest/auth/registration-invites.service.ts b/server/src/nest/auth/registration-invites.service.ts
index a3426c17a..581592600 100644
--- a/server/src/nest/auth/registration-invites.service.ts
+++ b/server/src/nest/auth/registration-invites.service.ts
@@ -40,18 +40,18 @@ export class RegistrationInvitesService {
     createdBy: number,
     data: { max_uses?: string | number; expires_in_days?: string | number; trip_id?: string | number | null },
   ) {
-    const rawUses = parseInt(String(data.max_uses));
+    const rawUses = Number.parseInt(String(data.max_uses));
     const uses = rawUses === 0 ? 0 : Math.min(Math.max(rawUses || 1, 1), 5);
     const token = crypto.randomBytes(16).toString('hex');
     const expiresAt = data.expires_in_days
-      ? new Date(Date.now() + parseInt(String(data.expires_in_days)) * 86400000).toISOString()
+      ? new Date(Date.now() + Number.parseInt(String(data.expires_in_days)) * 86400000).toISOString()
       : null;
 
     // Optional trip binding: only persist a trip that actually exists, so a stale
     // or forged id can never bind (and never auto-adds anyone on registration).
     let tripId: number | null = null;
     if (data.trip_id != null && String(data.trip_id).trim() !== '') {
-      const parsed = parseInt(String(data.trip_id));
+      const parsed = Number.parseInt(String(data.trip_id));
       if (!Number.isInteger(parsed) || !this.db.get('SELECT id FROM trips WHERE id = ?', parsed)) {
         // Used to bind null silently, handing back a plain registration invite
         // the admin never asked for.
diff --git a/server/src/nest/auth/webauthn-config.service.ts b/server/src/nest/auth/webauthn-config.service.ts
index 831911110..fed212fab 100644
--- a/server/src/nest/auth/webauthn-config.service.ts
+++ b/server/src/nest/auth/webauthn-config.service.ts
@@ -59,7 +59,9 @@ export class WebauthnConfigService {
     const explicitRpId = (readEnv().webauthn.rpId || this.setting('webauthn_rp_id'))?.trim() || null;
     const explicitOrigins = (readEnv().webauthn.origins || this.setting('webauthn_origins') || '')
       .split(',')
-      .map((o) => o.trim().replace(/\/+$/, ''))
+      // The lookbehind matches only the first slash of the trailing run. Without it the
+      // engine retries from every slash, which is quadratic on a slash-heavy value.
+      .map((o) => o.trim().replace(/(?<!\/)\/+$/, ''))
       .filter(Boolean);
 
     const appUrl = getAppUrl();
@@ -77,7 +79,7 @@ export class WebauthnConfigService {
     //    silently union dev localhost origins into a production allow-list.
     let origins = explicitOrigins;
     if (origins.length === 0) {
-      if (appHost) origins = [appUrl.replace(/\/+$/, '')];
+      if (appHost) origins = [appUrl.replace(/(?<!\/)\/+$/, '')];
       if (rpID === 'localhost') {
         // Dev: the browser origin is the Vite dev server (:5173), not the API port.
         origins = Array.from(new Set([...origins, 'http://localhost:5173', 'http://localhost:3001']));
diff --git a/server/src/nest/backup/backup.impl.ts b/server/src/nest/backup/backup.impl.ts
index 16e91804f..8d623af4a 100644
--- a/server/src/nest/backup/backup.impl.ts
+++ b/server/src/nest/backup/backup.impl.ts
@@ -47,7 +47,7 @@ export function formatSize(bytes: number): string {
 export function parseIntField(raw: unknown, fallback: number): number {
   if (typeof raw === 'number' && Number.isFinite(raw)) return Math.floor(raw);
   if (typeof raw === 'string' && raw.trim() !== '') {
-    const n = parseInt(raw, 10);
+    const n = Number.parseInt(raw, 10);
     if (Number.isFinite(n)) return n;
   }
   return fallback;
@@ -239,7 +239,7 @@ export async function createBackup(storage: StorageService, prefix: 'backup' | '
         let dbToArchive = dbPath;
         try {
           if (fs.existsSync(dbSnap)) fs.rmSync(dbSnap, { force: true });
-          db.exec(`VACUUM INTO '${dbSnap.replace(/'/g, "''")}'`);
+          db.exec(`VACUUM INTO '${dbSnap.replaceAll("'", "''")}'`);
           dbToArchive = dbSnap;
         } catch (e) {
           // Snapshot failed (disk/lock) — fall back to the checkpointed live file rather
diff --git a/server/src/nest/booking-import/booking-import.service.ts b/server/src/nest/booking-import/booking-import.service.ts
index 0643e2184..1f042dc02 100644
--- a/server/src/nest/booking-import/booking-import.service.ts
+++ b/server/src/nest/booking-import/booking-import.service.ts
@@ -315,7 +315,7 @@ export class BookingImportService {
             reservationData.metadata && typeof reservationData.metadata === 'object'
               ? (reservationData.metadata as Record<string, unknown>)
               : null;
-          const price = meta && meta.price != null ? Number(meta.price) : NaN;
+          const price = meta && meta.price != null ? Number(meta.price) : Number.NaN;
           if (Number.isFinite(price) && price > 0) {
             try {
               const budgetData = {
diff --git a/server/src/nest/booking-import/kitinerary-extractor.service.ts b/server/src/nest/booking-import/kitinerary-extractor.service.ts
index 9fc6999eb..a9bbee3d9 100644
--- a/server/src/nest/booking-import/kitinerary-extractor.service.ts
+++ b/server/src/nest/booking-import/kitinerary-extractor.service.ts
@@ -5,11 +5,14 @@ import { tmpdir } from 'node:os';
 import { join, extname } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { readEnv } from '../../app-config';
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { promisify } from 'node:util';
 import type { KiReservation } from './kitinerary.types';
 
 const execFileAsync = promisify(execFile);
+
+/** Also the leaf name looked for on each PATH entry. */
+const BINARY_NAME = 'kitinerary-extractor';
 const TIMEOUT_MS = 30_000;
 const MAX_BUFFER = 5 * 1024 * 1024;
 
@@ -89,16 +92,26 @@ export class KitineraryExtractorService implements OnModuleInit {
     // Debian/Ubuntu: /usr/lib/<triplet>/libexec/kf6/kitinerary-extractor
     try {
       for (const dir of readdirSync('/usr/lib')) {
-        const candidate = join('/usr/lib', dir, 'libexec', 'kf6', 'kitinerary-extractor');
+        const candidate = join('/usr/lib', dir, 'libexec', 'kf6', BINARY_NAME);
         if (existsSync(candidate)) return candidate;
       }
     } catch { /* not a Debian system */ }
 
-    // Fallback: binary in PATH
-    try {
-      execSync('kitinerary-extractor --version', { stdio: 'pipe', timeout: 3000 });
-      return 'kitinerary-extractor';
-    } catch { /* not in PATH */ }
+    // Fallback: binary on the search path — resolved to an absolute path here,
+    // not left as a bare name. Storing 'kitinerary-extractor' meant every later
+    // extraction re-resolved it through whatever PATH held at that moment, so on
+    // a bare-metal install (the official image sets KITINERARY_EXTRACTOR_PATH, so
+    // this branch is dead there) anyone who could write to a PATH directory could
+    // have their binary run as the TREK user. Probing the concrete file with
+    // execFileSync also drops the /bin/sh hop the old execSync string needed.
+    for (const dir of readEnv().integrations.searchPath) {
+      const candidate = join(dir, BINARY_NAME);
+      if (!existsSync(candidate)) continue;
+      try {
+        execFileSync(candidate, ['--version'], { stdio: 'pipe', timeout: 3000 });
+        return candidate;
+      } catch { /* present but not runnable — keep looking */ }
+    }
 
     return null;
   }
diff --git a/server/src/nest/calendar/calendar.service.ts b/server/src/nest/calendar/calendar.service.ts
index 4dc31f582..39e138faa 100644
--- a/server/src/nest/calendar/calendar.service.ts
+++ b/server/src/nest/calendar/calendar.service.ts
@@ -165,12 +165,12 @@ export class CalendarService {
       .all(tripId) as any[];
 
     const esc = (s: string) => s
-      .replace(/\\/g, '\\\\')
-      .replace(/;/g, '\\;')
-      .replace(/,/g, '\\,')
+      .replaceAll(/\\/g, '\\\\')
+      .replaceAll(';', '\\;')
+      .replaceAll(',', '\\,')
       .replace(/\r?\n/g, '\\n')
-      .replace(/\r/g, '');
-    const fmtDate = (d: string) => d.replace(/-/g, '');
+      .replaceAll(/\r/g, '');
+    const fmtDate = (d: string) => d.replaceAll('-', '');
     const now = new Date().toISOString().replace(/[-:]/g, '').split('.')[0] + 'Z';
     const uid = (id: number, type: string) => `trek-${type}-${id}@trek`;
 
@@ -189,7 +189,7 @@ export class CalendarService {
       // the TZID and leaves a floating time in the feed (#1453 again).
       if (refDate && d.match(/^\d{2}:\d{2}/)) {
         const datePart = refDate.split('T')[0];
-        const raw = `${datePart}T${d.replace(/:/g, '')}`.replace(/-/g, '');
+        const raw = `${datePart}T${d.replaceAll(':', '')}`.replaceAll('-', '');
         return raw.length === 13 ? raw + '00' : raw;
       }
       return d.replace(/[-:]/g, '');
diff --git a/server/src/nest/common/compare.ts b/server/src/nest/common/compare.ts
new file mode 100644
index 000000000..89dd0e8b7
--- /dev/null
+++ b/server/src/nest/common/compare.ts
@@ -0,0 +1,19 @@
+/**
+ * The comparator a bare `.sort()` already applies, written out.
+ *
+ * `Array.prototype.sort()` with no argument compares the UTF-16 code units of
+ * each element's string form. For ISO dates, ASCII keys, currency codes and the
+ * like that is the order the code wants, but Sonar's S2871 flags the bare call
+ * because the same syntax silently mis-sorts numbers ([10, 9, 1] becomes
+ * [1, 10, 9]).
+ *
+ * Shared rather than inlined at each call site: an inline arrow is a new
+ * function on every sort, and the ones that live on error paths are never
+ * executed by a passing test — which drags a whole domain's coverage down for a
+ * comparator that does nothing but restate the default. One exported function,
+ * covered once.
+ *
+ * NOT for user-visible names. Code-unit order files every accented word behind
+ * the entire ASCII range, so a list a person reads wants `localeCompare`.
+ */
+export const byCodeUnit = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0);
diff --git a/server/src/nest/common/demo.ts b/server/src/nest/common/demo.ts
index 8e30cd3b3..e6b34d450 100644
--- a/server/src/nest/common/demo.ts
+++ b/server/src/nest/common/demo.ts
@@ -10,6 +10,14 @@
 
 export const DEMO_EMAIL_PRIMARY = 'demo@trek.app';
 
+/**
+ * The demo account's password. Public on purpose — a demo instance shows it on
+ * the login screen so visitors can get in — but it was written out twice, in the
+ * seeder and in the config payload, which is one copy too many for something the
+ * seeder has to match exactly for the login to work.
+ */
+export const DEMO_PASS = 'demo12345';
+
 /**
  * All email addresses that should be treated as the demo account.
  * Includes the historical `demo@nomad.app` identifier so instances that
diff --git a/server/src/nest/common/idempotency.interceptor.ts b/server/src/nest/common/idempotency.interceptor.ts
index f630bc4cb..ff0f0fa40 100644
--- a/server/src/nest/common/idempotency.interceptor.ts
+++ b/server/src/nest/common/idempotency.interceptor.ts
@@ -76,7 +76,7 @@ export class IdempotencyInterceptor implements NestInterceptor {
 
     const signature = `${userId}|${req.method}|${req.path}|${key}`;
     const pending = inFlight.get(signature);
-    if (pending) {
+    if (pending !== undefined) {
       return from(pending).pipe(
         switchMap(() => {
           const stored = this.lookup(key, userId, req);
diff --git a/server/src/nest/common/managed.ts b/server/src/nest/common/managed.ts
index f39ab61a8..0f216e9fd 100644
--- a/server/src/nest/common/managed.ts
+++ b/server/src/nest/common/managed.ts
@@ -1,5 +1,6 @@
 import { SetMetadata } from '@nestjs/common';
 import { RuntimeEnvService } from '../app-config/runtime-env.service';
+import { byCodeUnit } from './compare';
 
 /** Metadata key `@ManagedForbidden()` writes. */
 export const MANAGED_FORBIDDEN = 'trek:managed-forbidden';
@@ -166,5 +167,5 @@ export function splitManagedKeys<T extends Record<string, unknown>>(
     if (LOCKED.has(key)) blocked.push(key);
     else (allowed as Record<string, unknown>)[key] = value;
   }
-  return { allowed, blocked: blocked.sort() };
+  return { allowed, blocked: blocked.sort(byCodeUnit) };
 }
diff --git a/server/src/nest/common/stripHtmlTags.ts b/server/src/nest/common/stripHtmlTags.ts
new file mode 100644
index 000000000..03000ef91
--- /dev/null
+++ b/server/src/nest/common/stripHtmlTags.ts
@@ -0,0 +1,44 @@
+/**
+ * Remove HTML-ish tags from a string, exactly as `/<[^>]+>/g` did.
+ *
+ * Written as a scan rather than a regex because that pattern backtracks: `[^>]`
+ * matches `<` too, so on a run of `<` with no closing `>` the engine retries
+ * from every one of them and rescans to the end each time. Measured on a 16k
+ * run: 0.52s, and both callers take attacker-supplied text — an uploaded KML
+ * description and Wikimedia Commons metadata.
+ *
+ * The semantics are the regex's, quirks included:
+ *  - a tag needs at least one character between the brackets, so `<>` is left
+ *    alone (`[^>]+` is one-or-more);
+ *  - `<` inside a tag is content, so `<a<b>` is one tag, not two — which is
+ *    what browsers do with malformed markup, and why narrowing the class to
+ *    `[^<>]` would have been a behaviour change rather than a fix;
+ *  - an unterminated `<` at the end is literal text.
+ */
+export function stripHtmlTags(input: string, replacement = ''): string {
+  let out = '';
+  let cursor = 0;
+
+  for (;;) {
+    const open = input.indexOf('<', cursor);
+    if (open === -1) break;
+
+    const close = input.indexOf('>', open + 1);
+    // No closing bracket anywhere after: the rest is literal, and this is the
+    // case the regex spent quadratic time discovering.
+    if (close === -1) break;
+
+    // `<>` — nothing between the brackets, so not a tag. Keep the `<` and carry
+    // on from the next character, exactly as the regex's next match attempt would.
+    if (close === open + 1) {
+      out += input.slice(cursor, open + 1);
+      cursor = open + 1;
+      continue;
+    }
+
+    out += input.slice(cursor, open) + replacement;
+    cursor = close + 1;
+  }
+
+  return out + input.slice(cursor);
+}
diff --git a/server/src/nest/common/validate-body-contracts.ts b/server/src/nest/common/validate-body-contracts.ts
index 5e093948f..81b1f4f44 100644
--- a/server/src/nest/common/validate-body-contracts.ts
+++ b/server/src/nest/common/validate-body-contracts.ts
@@ -5,6 +5,7 @@ import { RouteParamtypes } from '@nestjs/common/enums/route-paramtypes.enum';
 import { ModulesContainer } from '@nestjs/core';
 import { isZodDto } from 'nestjs-zod/dto';
 import { BODY_CONTRACT_ALLOW_LIST } from './body-contract-allow-list';
+import { byCodeUnit } from './compare';
 
 const MUTATION_METHODS = new Set<RequestMethod>([
   RequestMethod.POST,
@@ -86,14 +87,14 @@ export function validateBodyContracts(
     problems.push(
       `${violations.length} mutation handler(s) read @Body() without a createZodDto class ` +
         `(add a <domain>.dto.ts wrapper over the @trek/shared schema — do NOT extend the allow-list): ` +
-        violations.sort().join(', '),
+        violations.sort(byCodeUnit).join(', '),
     );
   }
   if (stale.length) {
     problems.push(
       `stale body-contract allow-list entr${stale.length === 1 ? 'y' : 'ies'} ` +
         `(route removed or now validated — delete from body-contract-allow-list.ts): ` +
-        stale.sort().join(', '),
+        stale.sort(byCodeUnit).join(', '),
     );
   }
   if (problems.length) {
diff --git a/server/src/nest/days/days.service.ts b/server/src/nest/days/days.service.ts
index 0b0942136..ce00d1b28 100644
--- a/server/src/nest/days/days.service.ts
+++ b/server/src/nest/days/days.service.ts
@@ -398,7 +398,7 @@ export class DaysService {
 
     const oldDateById = new Map(rows.map(r => [r.id, r.date]));
     // Dates stay pinned to slots: position i keeps the i-th date (ascending).
-    const sortedDates = rows.map(r => r.date).filter((d): d is string => !!d).sort();
+    const sortedDates = rows.map(r => r.date).filter((d): d is string => !!d).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
     const isDated = sortedDates.length > 0;
 
     const setDayNumber = this.db.prepare('UPDATE days SET day_number = ? WHERE id = ?');
@@ -452,7 +452,7 @@ export class DaysService {
     }
 
     // Dated trip: rebuild N+1 contiguous dates from the earliest date.
-    const start = datedRows.map(r => r.date).sort()[0];
+    const start = datedRows.map(r => r.date).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))[0];
     const dates = Array.from({ length: n + 1 }, (_, i) => addDays(start, i));
     const oldDateById = new Map(rows.map(r => [r.id, r.date]));
     const setDayNumberAndDate = this.db.prepare('UPDATE days SET day_number = ?, date = ? WHERE id = ?');
diff --git a/server/src/nest/feeds/feeds.service.ts b/server/src/nest/feeds/feeds.service.ts
index d3265ac60..9c62a9b90 100644
--- a/server/src/nest/feeds/feeds.service.ts
+++ b/server/src/nest/feeds/feeds.service.ts
@@ -153,7 +153,7 @@ export class FeedsService {
       .all(user.id, user.id, cutoff) as { id: number }[];
 
     const esc = (s: string) =>
-      s.replace(/\\/g, '\\\\').replace(/;/g, '\\;').replace(/,/g, '\\,').replace(/\r?\n/g, '\\n');
+      s.replaceAll('\\', '\\\\').replaceAll(';', '\\;').replaceAll(',', '\\,').replace(/\r?\n/g, '\\n');
 
     const calName = `${user.username} – All Trips`;
     let header = CALENDAR_HEADER;
diff --git a/server/src/nest/help/wiki.ts b/server/src/nest/help/wiki.ts
index d35465dba..aa94c0e31 100644
--- a/server/src/nest/help/wiki.ts
+++ b/server/src/nest/help/wiki.ts
@@ -116,7 +116,11 @@ function parseSidebar(md: string): WikiNavSection[] {
   const sections: WikiNavSection[] = [];
   let current: WikiNavSection | null = null;
   for (const raw of md.split('\n')) {
-    const heading = raw.match(/^#{1,4}\s+(.+?)\s*$/);
+    // The title, trimmed: a run that starts and ends on a non-space, or a single
+    // character (a heading whose body is only spaces still opens a section, the way
+    // `(.+?)\s*$` did). Spelled out so no two quantifiers compete for the same
+    // spaces — that pairing backtracks quadratically on a long ragged line.
+    const heading = raw.match(/^#{1,4}\s+(\S.*\S|.)\s*$/);
     if (heading) {
       current = { title: heading[1].replace(/[*_`]/g, '').trim(), pages: [] };
       sections.push(current);
@@ -151,7 +155,9 @@ function processMarkdown(md: string): string {
     const hash = anchor ? `#${anchor.trim()}` : '';
     return `[${title.trim()}](/help/${slug}${hash})`;
   });
-  out = out.replace(/!\[([^\]]*)\]\(([^)\s]+)([^)]*)\)/g, (m, alt: string, url: string) => {
+  // The optional title after the URL (`![a](u "t")`) has to start on whitespace,
+  // so it cannot compete with the URL group for the same characters.
+  out = out.replace(/!\[([^\]]*)\]\(([^)\s]+)(\s[^)]*)?\)/g, (m, alt: string, url: string) => {
     if (/^https?:\/\//i.test(url) || url.startsWith('/api/help/asset/')) return m;
     const clean = url.replace(/^\.?\//, '').replace(/^wiki\//, '');
     return `![${alt}](/api/help/asset/${clean})`;
@@ -196,8 +202,9 @@ function outsideCode(md: string, fn: (segment: string) => string): string {
 }
 
 function extractTitle(md: string, fallback: string): string {
-  const h1 = md.match(/^#\s+(.+?)\s*$/m);
-  return h1 ? h1[1].replace(/[*_`]/g, '').trim() : fallback.replace(/-/g, ' ');
+  // Same shape as the sidebar heading above — see the note there.
+  const h1 = md.match(/^#\s+(\S.*\S|.)\s*$/m);
+  return h1 ? h1[1].replace(/[*_`]/g, '').trim() : fallback.replaceAll('-', ' ');
 }
 
 export interface WikiPage {
diff --git a/server/src/nest/integrations/airtrail-import.service.ts b/server/src/nest/integrations/airtrail-import.service.ts
index 280f86b0d..1265e9788 100644
--- a/server/src/nest/integrations/airtrail-import.service.ts
+++ b/server/src/nest/integrations/airtrail-import.service.ts
@@ -62,7 +62,7 @@ function flightSignature(flight: AirtrailFlightRaw): string | null {
 function orderConnectionChain(group: AirtrailFlightRaw[]): AirtrailFlightRaw[] | null {
   if (group.length < 2) return null;
   const norm = group.map(raw => ({ raw, n: normalizeFlight(raw) }));
-  const depMs = (n: (typeof norm)[number]['n']): number => (n.departure ? Date.parse(n.departure) : NaN);
+  const depMs = (n: (typeof norm)[number]['n']): number => (n.departure ? Date.parse(n.departure) : Number.NaN);
   if (norm.some(x => Number.isNaN(depMs(x.n)))) return null;
   norm.sort((a, b) => depMs(a.n) - depMs(b.n));
   const origin = norm[0].n.fromCode;
@@ -71,7 +71,7 @@ function orderConnectionChain(group: AirtrailFlightRaw[]): AirtrailFlightRaw[] |
     const next = norm[i].n;
     if (!prev.toCode || !next.fromCode || prev.toCode.toUpperCase() !== next.fromCode.toUpperCase()) return null;
     if (origin && next.toCode && next.toCode.toUpperCase() === origin.toUpperCase()) return null;
-    const arrMs = prev.arrival ? Date.parse(prev.arrival) : NaN;
+    const arrMs = prev.arrival ? Date.parse(prev.arrival) : Number.NaN;
     if (Number.isNaN(arrMs)) return null;
     const gap = depMs(next) - arrMs;
     if (gap < 0 || gap > 24 * 3600 * 1000) return null;
diff --git a/server/src/nest/integrations/airtrail-sync.job.ts b/server/src/nest/integrations/airtrail-sync.job.ts
index 821783d7f..5e76527b7 100644
--- a/server/src/nest/integrations/airtrail-sync.job.ts
+++ b/server/src/nest/integrations/airtrail-sync.job.ts
@@ -22,7 +22,7 @@ export class AirtrailSyncJob implements OnApplicationBootstrap {
   onApplicationBootstrap(): void {
     if (!this.registrar.isEnabled()) return;
     const value = this.db.get<{ value: string }>('SELECT value FROM app_settings WHERE key = ?', 'airtrail_poll_interval_minutes')?.value;
-    const raw = parseInt(value || '5', 10);
+    const raw = Number.parseInt(value || '5', 10);
     const minutes = Number.isFinite(raw) && raw >= 1 && raw <= 59 ? raw : 5;
     logInfo(`AirTrail sync: scheduled every ${minutes}m`);
     this.registrar.register('airtrail-sync', `*/${minutes} * * * *`, () => this.tick());
diff --git a/server/src/nest/integrations/airtrail.client.ts b/server/src/nest/integrations/airtrail.client.ts
index 80e18235e..e3ed2a208 100644
--- a/server/src/nest/integrations/airtrail.client.ts
+++ b/server/src/nest/integrations/airtrail.client.ts
@@ -154,7 +154,9 @@ export interface AirtrailPassengerWrite {
 
 function apiBase(baseUrl: string): string {
   // Tolerate a pasted trailing slash or '/api' suffix so we never build '/api/api'.
-  const origin = baseUrl.trim().replace(/\/+$/, '').replace(/\/api$/i, '');
+  // The lookbehind matches only the first slash of the trailing run. Without it the
+  // engine retries from every slash, which is quadratic on a slash-heavy value.
+  const origin = baseUrl.trim().replace(/(?<!\/)\/+$/, '').replace(/\/api$/i, '');
   return origin + '/api';
 }
 
diff --git a/server/src/nest/journey/journey-public.controller.ts b/server/src/nest/journey/journey-public.controller.ts
index 7ac6293e4..53fa14e66 100644
--- a/server/src/nest/journey/journey-public.controller.ts
+++ b/server/src/nest/journey/journey-public.controller.ts
@@ -91,7 +91,7 @@ export class JourneyPublicController {
       { userId: effectiveOwnerId, ownerId: effectiveOwnerId, assetId },
       wantThumb,
     );
-    if (!streaming) {
+    if (streaming === null) {
       res.status(404).json({ error: 'Provider not supported' });
       return;
     }
diff --git a/server/src/nest/journey/journey-stats.ts b/server/src/nest/journey/journey-stats.ts
index 1a66feb72..98d5ac9d4 100644
--- a/server/src/nest/journey/journey-stats.ts
+++ b/server/src/nest/journey/journey-stats.ts
@@ -179,10 +179,10 @@ export interface StatsInput {
  */
 export function computeJourneyStats(input: StatsInput): JourneyStats {
   const points = thinRoute(input.points);
-  const dated = points.map(p => isoDay(p.date)).filter((d): d is string => !!d).sort();
+  const dated = points.map(p => isoDay(p.date)).filter((d): d is string => !!d).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
 
-  const tripStarts = input.tripDates.map(t => isoDay(t.start)).filter((d): d is string => !!d).sort();
-  const tripEnds = input.tripDates.map(t => isoDay(t.end)).filter((d): d is string => !!d).sort();
+  const tripStarts = input.tripDates.map(t => isoDay(t.start)).filter((d): d is string => !!d).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+  const tripEnds = input.tripDates.map(t => isoDay(t.end)).filter((d): d is string => !!d).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
 
   const start = dated[0] ?? tripStarts[0] ?? null;
   const end = dated[dated.length - 1] ?? tripEnds[tripEnds.length - 1] ?? null;
diff --git a/server/src/nest/llm-parse/clients/anthropic.client.ts b/server/src/nest/llm-parse/clients/anthropic.client.ts
index 983b5b650..a1ce5a720 100644
--- a/server/src/nest/llm-parse/clients/anthropic.client.ts
+++ b/server/src/nest/llm-parse/clients/anthropic.client.ts
@@ -16,7 +16,11 @@ const TOOL_NAME = 'emit_reservations';
  */
 export class AnthropicClient implements LlmExtractionClient {
   async extract(input: LlmExtractionInput): Promise<Record<string, unknown>[]> {
-    const base = (input.baseUrl ?? 'https://api.anthropic.com').replace(/\/+$/, '');
+    // The lookbehind pins the run to its own start. Without it `\/+$` restarts at every
+    // slash of a trailing run that turns out not to end the string, rescanning to the
+    // end each time; the assertion only rules out start positions the leftmost match
+    // could never have used, so the trimmed result is unchanged.
+    const base = (input.baseUrl ?? 'https://api.anthropic.com').replace(/(?<!\/)\/+$/, '');
     const url = `${base}/v1/messages`;
 
     const content: unknown[] = [];
diff --git a/server/src/nest/llm-parse/clients/openai-compatible.client.ts b/server/src/nest/llm-parse/clients/openai-compatible.client.ts
index 39772964e..d965a135a 100644
--- a/server/src/nest/llm-parse/clients/openai-compatible.client.ts
+++ b/server/src/nest/llm-parse/clients/openai-compatible.client.ts
@@ -26,7 +26,9 @@ const MAX_TOKENS = 4096;
  */
 export class OpenAiCompatibleClient implements LlmExtractionClient {
   async extract(input: LlmExtractionInput): Promise<Record<string, unknown>[]> {
-    const base = (input.baseUrl ?? 'https://api.openai.com/v1').replace(/\/+$/, '');
+    // The lookbehind matches only the first slash of the trailing run. Without it the
+    // engine retries from every slash, which is quadratic on a slash-heavy value.
+    const base = (input.baseUrl ?? 'https://api.openai.com/v1').replace(/(?<!\/)\/+$/, '');
     const url = `${base}/chat/completions`;
     const nuextract = isNuExtractModel(input.model);
 
diff --git a/server/src/nest/llm-parse/llm-local.service.ts b/server/src/nest/llm-parse/llm-local.service.ts
index 095813cb7..b70ee6afb 100644
--- a/server/src/nest/llm-parse/llm-local.service.ts
+++ b/server/src/nest/llm-parse/llm-local.service.ts
@@ -23,7 +23,11 @@ export class LlmLocalService {
     if (url.protocol !== 'http:' && url.protocol !== 'https:') {
       throw new HttpException({ error: 'Base URL must be http(s)' }, 400);
     }
-    return raw.replace(/\/+$/, '').replace(/\/v1$/, '');
+    // Trailing slashes are scanned off instead of `/\/+$/`-replaced: that pattern
+    // re-walks the slash run from every start position of the admin-supplied URL.
+    let end = raw.length;
+    while (end > 0 && raw.charCodeAt(end - 1) === 47 /* '/' */) end--;
+    return raw.slice(0, end).replace(/\/v1$/, '');
   }
 
   /** List models already pulled on the local server. */
diff --git a/server/src/nest/llm-parse/mime-email.ts b/server/src/nest/llm-parse/mime-email.ts
index e395a6ffb..a6801ae36 100644
--- a/server/src/nest/llm-parse/mime-email.ts
+++ b/server/src/nest/llm-parse/mime-email.ts
@@ -218,10 +218,10 @@ function decodeQuotedPrintable(payload: string): Buffer {
   for (let i = 0; i < joined.length; i++) {
     const hex = joined[i] === '=' ? joined.slice(i + 1, i + 3) : '';
     if (/^[0-9a-fA-F]{2}$/.test(hex)) {
-      out[len++] = parseInt(hex, 16);
+      out[len++] = Number.parseInt(hex, 16);
       i += 2;
     } else {
-      out[len++] = joined.charCodeAt(i) & 0xff;
+      out[len++] = joined.codePointAt(i) & 0xff;
     }
   }
   return out.subarray(0, len);
@@ -245,7 +245,7 @@ function decodeEncodedWords(value: string): string {
   return value
     .replace(/=\?([^?]+)\?([BbQq])\?([^?]*)\?=/g, (whole, charset: string, encoding: string, payload: string) => {
       const bytes =
-        encoding.toUpperCase() === 'B' ? decodeBase64(payload) : decodeQuotedPrintable(payload.replace(/_/g, ' '));
+        encoding.toUpperCase() === 'B' ? decodeBase64(payload) : decodeQuotedPrintable(payload.replaceAll('_', ' '));
       const decoded = decodeCharset(bytes, charset);
       return decoded || whole;
     })
diff --git a/server/src/nest/llm-parse/router/extraction-router.ts b/server/src/nest/llm-parse/router/extraction-router.ts
index c97ff9703..4befc0a04 100644
--- a/server/src/nest/llm-parse/router/extraction-router.ts
+++ b/server/src/nest/llm-parse/router/extraction-router.ts
@@ -79,9 +79,16 @@ export function detectFlightNumbers(text: string): string[] {
 export function extractBookingRef(text: string): string | undefined {
   // The captured code must contain a digit: real PNRs/booking codes effectively always
   // do, while the case-insensitive [A-Z0-9] class would otherwise grab a following prose
-  // word ("Confirmation\nThank you…" → "Thank") after a bare label.
+  // word ("Confirmation\nThank you…" → "Thank") after a bare label. The lookahead asserts
+  // exactly that (the run's first digit is only ever preceded by letters), and the
+  // separator says "spaces, then optionally a colon and more spaces" — both spellings
+  // avoid quantifiers that overlap and make document text backtrack.
+  // "Confirmation" carries its own spacing INSIDE the optional suffix: spelled
+  // `Confirmation\s*(?:number|code)?`, a dropped suffix left that \s* sitting directly
+  // against the separator's \s*, and two adjacent runs can split a stretch of spaces
+  // in n ways — quadratic on "Confirmation" followed by a long indent.
   const m = text.match(
-    /(?:PNR|Buchungs(?:code|nummer|referenz)|Booking\s*(?:reference|code|number)|Confirmation\s*(?:number|code)?|Reservierungsnummer|Reservation\s*(?:No\.?|Number|Nr\.?)|Best(?:ä|ae)tigungs[-\s]?(?:nummer|code)|(?:Expedia[-\s]*)?Reiseplan|Reference)\s*:?\s*((?=[A-Z0-9]*\d)[A-Z0-9]{5,})/i,
+    /(?:PNR|Buchungs(?:code|nummer|referenz)|Booking\s*(?:reference|code|number)|Confirmation(?:\s*(?:number|code))?|Reservierungsnummer|Reservation\s*(?:No\.?|Number|Nr\.?)|Best(?:ä|ae)tigungs[-\s]?(?:nummer|code)|(?:Expedia[-\s]*)?Reiseplan|Reference)\s*(?::\s*)?((?=[A-Z]*\d)[A-Z0-9]{5,})/i,
   );
   return m?.[1];
 }
@@ -100,13 +107,23 @@ export function normCurrency(token: string): string | undefined {
 export function extractTotalPrice(text: string): { price: string; currency?: string } | null {
   const strip = (s: string) => s.replace(/[€$£¥\s]/g, '');
   // A labeled total: "Gesamtpreis: 1.234,56 €", "Total Amount 99 USD", "Bezahlter Betrag 651,86 €".
+  // The symbol keeps the space that trails IT inside its own optional group: spelled
+  // `[€$£¥]?\s*`, a missing symbol left that \s* directly against the separator's \s*,
+  // and two adjacent runs split a stretch of spaces in n ways — quadratic on a label
+  // followed by a long indent and no amount.
   const labeled = text.match(
-    /(?:Gesamtpreis|Gesamtbetrag|Gesamtsumme|Total(?:\s*(?:price|amount))?|Amount|Summe|Betrag)\s*:?\s*([€$£¥]?\s*\d[\d.,]*)\s*(EUR|USD|GBP|CHF|JPY|€|\$|£|¥)?/i,
+    /(?:Gesamtpreis|Gesamtbetrag|Gesamtsumme|Total(?:\s*(?:price|amount))?|Amount|Summe|Betrag)\s*(?::\s*)?((?:[€$£¥]\s*)?\d[\d.,]*)\s*(EUR|USD|GBP|CHF|JPY|€|\$|£|¥)?/i,
   );
   if (labeled) return { price: strip(labeled[1]), currency: normCurrency(labeled[2] ?? labeled[1]) };
   // Fallback: a standalone amount carrying a currency symbol on its own line (e.g. a voucher's
-  // "¥9,400") — the price sits far from any label the pattern above can anchor to.
-  const symbol = text.match(/^\s*([€$£¥]\s?\d[\d.,]*)\b/m);
+  // "¥9,400") — the price sits far from any label the pattern above can anchor to. The
+  // indent is horizontal whitespace only: under /m the anchor already sits at every line
+  // start, so a \s* run that could also eat the newlines just re-scans the document.
+  // U+2028/U+2029 are line terminators too — /m starts a line after each one — so they
+  // have to leave the class for the same reason \r\n do. `[^\S\r\n]` still contained
+  // them (they are \s), which made a run of them both a line start and indent the class
+  // could eat: 16k of U+2028 took 348ms, and the run grows quadratically.
+  const symbol = text.match(/^[^\S\r\n\u2028\u2029]*([€$£¥]\s?\d[\d.,]*)\b/m);
   if (symbol) return { price: strip(symbol[1]), currency: normCurrency(symbol[1]) };
   return null;
 }
diff --git a/server/src/nest/llm-parse/router/ollama-format.client.ts b/server/src/nest/llm-parse/router/ollama-format.client.ts
index 49db787fe..cb7c3822a 100644
--- a/server/src/nest/llm-parse/router/ollama-format.client.ts
+++ b/server/src/nest/llm-parse/router/ollama-format.client.ts
@@ -32,7 +32,12 @@ export interface EnforcedExtractInput {
 
 /** Resolve the native API base from a config base URL that may end in `/v1`. */
 export function toNativeBase(baseUrl: string): string {
-  return baseUrl.replace(/\/+$/, '').replace(/\/v1$/, '');
+  // Trailing slashes come off as a scan, not /\/+$/: that pattern is unanchored at the
+  // front, so the engine restarts it at every slash of a run and rescans to the end each
+  // time (quadratic — 25s on 200k). Same result: the maximal trailing run goes.
+  let end = baseUrl.length;
+  while (end > 0 && baseUrl[end - 1] === '/') end--;
+  return baseUrl.slice(0, end).replace(/\/v1$/, '');
 }
 
 /**
diff --git a/server/src/nest/llm-parse/text-extract.ts b/server/src/nest/llm-parse/text-extract.ts
index c032372dd..8adc11bcf 100644
--- a/server/src/nest/llm-parse/text-extract.ts
+++ b/server/src/nest/llm-parse/text-extract.ts
@@ -1,6 +1,7 @@
 import { parseEmail } from './mime-email';
 import { extname } from 'node:path';
 import { PDFParse } from 'pdf-parse';
+import { stripHtmlTags } from '../common/stripHtmlTags';
 
 /** File extensions whose bytes are inherently text and can be decoded directly. */
 const TEXT_LIKE = new Set(['.txt', '.html', '.htm', '.eml']);
@@ -57,7 +58,7 @@ const HTML_ENTITIES = new Map<string, string>([
   ['larr', '←'],
   ['rarr', '→'],
   ['harr', '↔'],
-  ...LATIN1_ENTITIES.map((name, i): [string, string] => [name, String.fromCharCode(0xa0 + i)]),
+  ...LATIN1_ENTITIES.map((name, i): [string, string] => [name, String.fromCodePoint(0xa0 + i)]),
 ]);
 
 function entityCodePoint(code: number): string | null {
@@ -77,7 +78,7 @@ function decodeEntities(s: string): string {
   return s.replace(/&(#\d{1,7}|#[xX][0-9a-fA-F]{1,6}|[A-Za-z][A-Za-z0-9]{1,30});/g, (whole, ref: string) => {
     if (ref[0] === '#') {
       const hex = ref[1] === 'x' || ref[1] === 'X';
-      return entityCodePoint(parseInt(hex ? ref.slice(2) : ref.slice(1), hex ? 16 : 10)) ?? whole;
+      return entityCodePoint(Number.parseInt(hex ? ref.slice(2) : ref.slice(1), hex ? 16 : 10)) ?? whole;
     }
     // Case matters (&Uuml; vs &uuml;); only fall back to lower case for names
     // that are shouted in old templates.
@@ -85,12 +86,20 @@ function decodeEntities(s: string): string {
   });
 }
 
-/** Strip HTML/XML tags, resolve entities and collapse whitespace for a cleaner LLM prompt. */
+/**
+ * Strip HTML/XML tags, resolve entities and collapse whitespace for a cleaner
+ * LLM prompt.
+ *
+ * The tag stripping is stripHtmlTags rather than a `/<[^>]+>/g` replace: a match
+ * can only start at a `<`, so a run of brackets with nothing closing them — and
+ * an uploaded .eml or .html is free to carry one — makes the engine rescan the
+ * tail once per bracket.
+ */
 function stripMarkup(s: string): string {
-  const withoutTags = s
-    .replace(/<script[\s\S]*?<\/script>/gi, ' ')
-    .replace(/<style[\s\S]*?<\/style>/gi, ' ')
-    .replace(/<[^>]+>/g, ' ');
+  const withoutTags = stripHtmlTags(
+    s.replace(/<script[\s\S]*?<\/script>/gi, ' ').replace(/<style[\s\S]*?<\/style>/gi, ' '),
+    ' ',
+  );
   // Entities come last so that a decoded `&lt;` cannot turn into a tag the
   // stripper would then eat.
   return decodeEntities(withoutTags)
@@ -137,6 +146,115 @@ async function extractPdfText(buffer: Buffer): Promise<string> {
   }
 }
 
+/** Exactly the code points JS `\s` matches — the class the page-marker pattern walks over. */
+const SPACE_CODES = new Set([
+  0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x20, 0xa0, 0x1680, 0x2000, 0x2001, 0x2002, 0x2003, 0x2004, 0x2005, 0x2006, 0x2007,
+  0x2008, 0x2009, 0x200a, 0x2028, 0x2029, 0x202f, 0x205f, 0x3000, 0xfeff,
+]);
+
+/** The line breaks a multiline `^` starts after and `$` ends before. */
+const LINE_END_CODES = new Set([0x0a, 0x0d, 0x2028, 0x2029]);
+
+function isSpaceAt(text: string, i: number): boolean {
+  return SPACE_CODES.has(text.charCodeAt(i));
+}
+
+function isLineEndAt(text: string, i: number): boolean {
+  return LINE_END_CODES.has(text.charCodeAt(i));
+}
+
+function isDigitAt(text: string, i: number): boolean {
+  const c = text.charCodeAt(i);
+  return c >= 0x30 && c <= 0x39;
+}
+
+function isDashAt(text: string, i: number): boolean {
+  return text.charCodeAt(i) === 0x2d;
+}
+
+function skipRun(text: string, from: number, matches: (text: string, i: number) => boolean): number {
+  let i = from;
+  while (i < text.length && matches(text, i)) i++;
+  return i;
+}
+
+/**
+ * A page marker from its first dash on: `-+\s*\d+\s+of\s+\d+\s*-+\s*$`. Returns
+ * where the match ends, or -1 when there is none. Every quantifier in there is
+ * followed by a class that excludes what it just matched, so each one can only
+ * take its whole run — giving characters back never opens a second way through,
+ * which is why one forward pass is enough.
+ */
+function markerEnd(text: string, dashStart: number): number {
+  let i = skipRun(text, skipRun(text, dashStart, isDashAt), isSpaceAt);
+  const pageNo = i;
+  i = skipRun(text, i, isDigitAt);
+  if (i === pageNo) return -1;
+  const beforeOf = i;
+  i = skipRun(text, i, isSpaceAt);
+  if (i === beforeOf) return -1;
+  const o = text.charCodeAt(i);
+  const f = text.charCodeAt(i + 1);
+  if ((o !== 0x6f && o !== 0x4f) || (f !== 0x66 && f !== 0x46)) return -1;
+  const afterOf = i + 2;
+  i = skipRun(text, afterOf, isSpaceAt);
+  if (i === afterOf) return -1;
+  const pageCount = i;
+  i = skipRun(text, i, isDigitAt);
+  if (i === pageCount) return -1;
+  const closing = skipRun(text, i, isSpaceAt);
+  i = skipRun(text, closing, isDashAt);
+  if (i === closing) return -1;
+  // `\s*$` hands the trailing run back until `$` sits on a line end; with no
+  // line end in it and text still to come, `$` never matches and neither does
+  // the marker.
+  let lastLineEnd = -1;
+  let end = i;
+  while (end < text.length && isSpaceAt(text, end)) {
+    if (isLineEndAt(text, end)) lastLineEnd = end;
+    end++;
+  }
+  return end === text.length ? end : lastLineEnd;
+}
+
+/** The first `^` in `[from, to]` — the earliest position the marker can start at. */
+function markerStart(text: string, from: number, to: number): number {
+  if (from === 0 || isLineEndAt(text, from - 1)) return from;
+  for (let i = from; i < to; i++) if (isLineEndAt(text, i)) return i + 1;
+  return -1;
+}
+
+/**
+ * Drop `-- N of M --` page markers: `/^\s*-+\s*\d+\s+of\s+\d+\s*-+\s*$/gim` as a
+ * single left-to-right pass. As a regex it is quadratic — `\s` matches line
+ * breaks, so under `m` every line start inside a whitespace run walks that same
+ * run again looking for a dash (40k of `" \n"` took ~0.6 s, and this runs first
+ * over the raw text layer of an uploaded PDF).
+ */
+function stripPageMarkers(text: string): string {
+  let kept = '';
+  let done = 0; // the pattern's lastIndex: nothing before it can match any more
+  let i = 0;
+  while (i < text.length) {
+    const dashStart = text.indexOf('-', i);
+    if (dashStart === -1) break;
+    // The leading `\s*` reaches back across the whole whitespace run, and the
+    // match then starts at the first `^` — string start or line start — in it.
+    let runStart = dashStart;
+    while (runStart > done && isSpaceAt(text, runStart - 1)) runStart--;
+    const start = markerStart(text, runStart, dashStart);
+    const end = start === -1 ? -1 : markerEnd(text, dashStart);
+    if (end === -1) {
+      i = dashStart + 1;
+      continue;
+    }
+    kept += text.slice(done, start);
+    done = end;
+    i = end;
+  }
+  return done === 0 ? text : kept + text.slice(done);
+}
+
 /**
  * Clean up pdf-parse output for the LLM:
  *  - strip `-- N of M --` page markers
@@ -145,10 +263,11 @@ async function extractPdfText(buffer: Buffer): Promise<string> {
  *    a common PDF kerning artifact that otherwise hides booking fields
  */
 function cleanPdfText(text: string): string {
-  return text
-    .replace(/^\s*-+\s*\d+\s+of\s+\d+\s*-+\s*$/gim, '')
+  return stripPageMarkers(text)
     .replace(/[ \t]+/g, ' ')
-    .replace(/\b(?:[A-Z] ){2,}[A-Z]\b/g, m => m.replace(/ /g, ''))
+    // Same run of three-or-more spaced capitals, written so the repeated group no
+    // longer overlaps the [A-Z] behind it and has to hand characters back to it.
+    .replace(/\b[A-Z](?: [A-Z]){2,}\b/g, m => m.replaceAll(' ', ''))
     .replace(/ *\n */g, '\n')
     .replace(/\n{3,}/g, '\n\n')
     .trim();
diff --git a/server/src/nest/maps/maps.controller.ts b/server/src/nest/maps/maps.controller.ts
index 07b75d872..644889fb0 100644
--- a/server/src/nest/maps/maps.controller.ts
+++ b/server/src/nest/maps/maps.controller.ts
@@ -163,7 +163,7 @@ export class MapsController {
     // empty result, not a missing resource, and one 404 per photo-less place gets
     // the user's IP banned by any 404-rate IPS in front of TREK (#1727).
     try {
-      return await this.maps.photo(user.id, placeId, parseFloat(lat as string), parseFloat(lng as string), name);
+      return await this.maps.photo(user.id, placeId, Number.parseFloat(lat as string), Number.parseFloat(lng as string), name);
     } catch (err: unknown) {
       const status = (err as { status?: number }).status || 500;
       if (status >= 500) console.error('Place photo error:', err);
diff --git a/server/src/nest/maps/maps.helpers.ts b/server/src/nest/maps/maps.helpers.ts
index dffbf5427..a32bdaa5f 100644
--- a/server/src/nest/maps/maps.helpers.ts
+++ b/server/src/nest/maps/maps.helpers.ts
@@ -1,4 +1,5 @@
 import { readEnv, getAppUrl } from '../../app-config';
+import { stripHtmlTags } from '../common/stripHtmlTags';
 
 /**
  * Pure maps/geo helpers — no DB, no Nest, no side effects beyond reading env.
@@ -328,10 +329,10 @@ function osmPeriods(dayIdx: number, timePart: string): OpeningPeriod[] {
   const day = (dayIdx + 1) % 7;
   const periods: OpeningPeriod[] = [];
   for (const match of timePart.matchAll(OSM_TIME_RANGE)) {
-    const openHour = parseInt(match[1], 10);
-    const openMinute = parseInt(match[2], 10);
-    let closeHour = parseInt(match[3], 10);
-    const closeMinute = parseInt(match[4], 10);
+    const openHour = Number.parseInt(match[1], 10);
+    const openMinute = Number.parseInt(match[2], 10);
+    let closeHour = Number.parseInt(match[3], 10);
+    const closeMinute = Number.parseInt(match[4], 10);
     if (openHour > 23 || openMinute > 59 || closeHour > 24 || closeMinute > 59) continue;
     // OSM writes the end of a day as 24:00, a clock reading Google's numbering has no
     // hour 24 — that is midnight of the following day, same as any range that wraps.
@@ -378,8 +379,12 @@ export function parseOpeningHours(ohString: string): {
   for (const segment of ohString.split(';')) {
     const trimmed = segment.trim();
     if (!trimmed) continue;
+    // The time part is `\S.*`, not `.+`: the segment was trimmed above, so both
+    // spell "everything after the gap". But `\s+(.+)` lets the gap and the time
+    // part fight over the same spaces, and a segment that is a weekday followed by
+    // nothing but blanks then costs a pass per space.
     const match = trimmed.match(
-      /^((?:Mo|Tu|We|Th|Fr|Sa|Su)(?:\s*-\s*(?:Mo|Tu|We|Th|Fr|Sa|Su))?(?:\s*,\s*(?:Mo|Tu|We|Th|Fr|Sa|Su)(?:\s*-\s*(?:Mo|Tu|We|Th|Fr|Sa|Su))?)*)\s+(.+)$/i,
+      /^((?:Mo|Tu|We|Th|Fr|Sa|Su)(?:\s*-\s*(?:Mo|Tu|We|Th|Fr|Sa|Su))?(?:\s*,\s*(?:Mo|Tu|We|Th|Fr|Sa|Su)(?:\s*-\s*(?:Mo|Tu|We|Th|Fr|Sa|Su))?)*)\s+(\S.*)$/i,
     );
     if (!match) continue;
     const [, daysPart, timePart] = match;
@@ -421,8 +426,8 @@ export function parseOpeningHours(ohString: string): {
     if (timeRanges.length > 0) {
       const nowMins = now.getHours() * 60 + now.getMinutes();
       openNow = timeRanges.some((m) => {
-        const start = parseInt(m[1]) * 60 + parseInt(m[2]);
-        const end = parseInt(m[3]) * 60 + parseInt(m[4]);
+        const start = Number.parseInt(m[1]) * 60 + Number.parseInt(m[2]);
+        const end = Number.parseInt(m[3]) * 60 + Number.parseInt(m[4]);
         return end > start ? nowMins >= start && nowMins < end : nowMins >= start || nowMins < end;
       });
     }
@@ -489,9 +494,8 @@ export function buildOsmDetails(tags: Record<string, string>, osmType: string, o
  */
 export function stripWikiMarkup(value: string | undefined | null): string | null {
   if (!value) return null;
-  const text = value
-    .replace(/<[^>]+>/g, ' ')
-    .replace(/&nbsp;/g, ' ')
+  const text = stripHtmlTags(value, ' ')
+    .replaceAll('&nbsp;', ' ')
     .replace(/\s+/g, ' ')
     .trim();
   return text || null;
@@ -572,7 +576,10 @@ function seriesStem(title: string): string {
     // 20260614 100717648 HDR — a camera dump, all from the same minute
     .replace(/\b\d{8}[ _-]\d{6,9}\b/g, ' ')
     .replace(/\b(19|20)\d{2}\b/g, ' ')
-    .replace(/[ _-]+\(?\d{1,4}\)?$/g, '')
+    // The character in front of the suffix is matched and put straight back:
+    // /[ _-]+…$/ on its own restarts at every space of a title that has no such
+    // suffix, and re-reads the rest of the run each time.
+    .replace(/([^ _-]|^)[ _-]+\(?\d{1,4}\)?$/g, '$1')
     .replace(/[^a-z]+/g, ' ')
     .trim();
 }
diff --git a/server/src/nest/maps/maps.service.ts b/server/src/nest/maps/maps.service.ts
index f8447f5b0..d1da18539 100644
--- a/server/src/nest/maps/maps.service.ts
+++ b/server/src/nest/maps/maps.service.ts
@@ -58,7 +58,10 @@ const PLACES_UPSTREAM = 'https://places.googleapis.com';
 function placesEndpoint(endpoint: string): string {
   const base = readEnv().maps.placesApiBase;
   if (!base || !endpoint.startsWith(PLACES_UPSTREAM)) return endpoint;
-  return base.replace(/\/+$/, '') + endpoint.slice(PLACES_UPSTREAM.length);
+  // The character before the run is matched and written straight back. A bare
+  // /\/+$/ restarts at every slash of a base that does not end in one, reading
+  // the rest of the run again from each of them.
+  return base.replace(/([^/]|^)\/+$/, '$1') + endpoint.slice(PLACES_UPSTREAM.length);
 }
 
 /**
@@ -181,7 +184,7 @@ function wikidataImageClaims(claims: WikidataClaims, limit: number): string[] {
 
 /** `File:` prefix off, underscores and case normalised — Commons treats these as one title. */
 function normalizeFileTitle(title: string): string {
-  return title.replace(/^File:/i, '').replace(/_/g, ' ').trim().toLowerCase();
+  return title.replace(/^File:/i, '').replaceAll('_', ' ').trim().toLowerCase();
 }
 
 /**
@@ -639,8 +642,8 @@ export class MapsService {
     return data.map((item) => {
       // Number.isFinite, not `|| null`: a place on the equator or prime
       // meridian has a legitimate 0 coordinate.
-      const lat = parseFloat(item.lat);
-      const lng = parseFloat(item.lon);
+      const lat = Number.parseFloat(item.lat);
+      const lng = Number.parseFloat(item.lon);
       return {
         google_place_id: null,
         google_ftid: null,
@@ -714,8 +717,8 @@ export class MapsService {
       const best = data
         .map((item) => ({
           item,
-          lat: parseFloat(item.lat),
-          lng: parseFloat(item.lon),
+          lat: Number.parseFloat(item.lat),
+          lng: Number.parseFloat(item.lon),
         }))
         .filter(({ item, lat: hitLat, lng: hitLng }) => {
           if (!Number.isFinite(hitLat) || !Number.isFinite(hitLng)) return false;
@@ -773,8 +776,8 @@ export class MapsService {
       const data = (await res.json()) as NominatimResult[];
       const item = data[0];
       if (!item) return null;
-      const lat = parseFloat(item.lat);
-      const lng = parseFloat(item.lon);
+      const lat = Number.parseFloat(item.lat);
+      const lng = Number.parseFloat(item.lon);
       return {
         name: item.name || item.display_name?.split(',')[0] || '',
         address: item.display_name || '',
@@ -1851,7 +1854,7 @@ export class MapsService {
 
     // Deduplicate concurrent requests for the same placeId
     const existing = this.photoCache.getInFlight(placeId);
-    if (existing) {
+    if (existing !== undefined) {
       const result = await existing;
       if (!result) return noPhoto;
       return { photoUrl: `/api/maps/place-photo/${encodeURIComponent(placeId)}/bytes`, attribution: result.attribution };
@@ -1872,7 +1875,7 @@ export class MapsService {
         // so a place added via search still gets a marker image when Google returns
         // nothing. Returns null (without marking an error) so the caller decides.
         const fetchWikimediaFallback = async (): Promise<{ attribution: string | null } | null> => {
-          if (isNaN(lat) || isNaN(lng)) return null;
+          if (Number.isNaN(lat) || Number.isNaN(lng)) return null;
           try {
             const wiki = await this.fetchWikimediaPhoto(lat, lng, name);
             if (!wiki) return null;
@@ -2023,11 +2026,11 @@ export class MapsService {
     // them several ways: /@lat,lng,zoom · !3dlat!4dlng (map data param) · ?q=/?ll=.
     const extractCoords = (s: string): { lat: number; lng: number } | null => {
       const at = s.match(/@(-?\d+\.\d+),(-?\d+\.\d+)/);
-      if (at) return { lat: parseFloat(at[1]), lng: parseFloat(at[2]) };
+      if (at) return { lat: Number.parseFloat(at[1]), lng: Number.parseFloat(at[2]) };
       const data = s.match(/!3d(-?\d+\.\d+)!4d(-?\d+\.\d+)/);
-      if (data) return { lat: parseFloat(data[1]), lng: parseFloat(data[2]) };
+      if (data) return { lat: Number.parseFloat(data[1]), lng: Number.parseFloat(data[2]) };
       const q = s.match(/[?&](?:q|ll)=(-?\d+\.\d+),(-?\d+\.\d+)/);
-      if (q) return { lat: parseFloat(q[1]), lng: parseFloat(q[2]) };
+      if (q) return { lat: Number.parseFloat(q[1]), lng: Number.parseFloat(q[2]) };
       return null;
     };
 
@@ -2091,10 +2094,10 @@ export class MapsService {
     let placeName: string | null = null;
     const placeMatch = resolvedUrl.match(/\/place\/([^/@]+)/);
     if (placeMatch) {
-      placeName = decodeURIComponent(placeMatch[1].replace(/\+/g, ' '));
+      placeName = decodeURIComponent(placeMatch[1].replaceAll(/\+/g, ' '));
     }
 
-    if (!coords || isNaN(coords.lat) || isNaN(coords.lng)) {
+    if (!coords || Number.isNaN(coords.lat) || Number.isNaN(coords.lng)) {
       throw Object.assign(new Error('Could not extract coordinates from URL'), { status: 400 });
     }
     const { lat, lng } = coords;
diff --git a/server/src/nest/mcp-transport/mcp-transport.service.ts b/server/src/nest/mcp-transport/mcp-transport.service.ts
index 8a71d062b..e8e3b96fa 100644
--- a/server/src/nest/mcp-transport/mcp-transport.service.ts
+++ b/server/src/nest/mcp-transport/mcp-transport.service.ts
@@ -82,13 +82,24 @@ export function jsonRpcError(message: string, code = -32000): object {
 export function sameScopes(a: string[] | null, b: string[] | null): boolean {
   if (a === null || b === null) return a === b;
   if (a.length !== b.length) return false;
-  const left = [...a].sort();
-  const right = [...b].sort();
+  const left = [...a].sort((x, y) => (x < y ? -1 : x > y ? 1 : 0));
+  const right = [...b].sort((x, y) => (x < y ? -1 : x > y ? 1 : 0));
   return left.every((scope, i) => scope === right[i]);
 }
 
+/**
+ * Drop the trailing slashes of a base URL, as a scan rather than /\/+$/: that pattern
+ * is unanchored at the front, so the engine restarts it at every slash of a run and
+ * rescans to the end each time (quadratic — 25s on 200k). Same string either way.
+ */
+function trimTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === '/') end--;
+  return value.slice(0, end);
+}
+
 export function setAuthChallenge(res: Response, error = 'invalid_token'): void {
-  const base = (getMcpSafeUrl() || '').replace(/\/+$/, '');
+  const base = trimTrailingSlashes(getMcpSafeUrl() || '');
   // RFC 9728 §5: resource with path component /mcp → PRM URL must include the path
   res.set('WWW-Authenticate',
       `Bearer realm="TREK MCP", resource_metadata="${base}/.well-known/oauth-protected-resource/mcp", error="${error}"`);
@@ -129,7 +140,7 @@ export class McpTransportService {
       if (!result) return null;
       // RFC 8707: audience must always match this resource endpoint.
       // Pre-audit tokens with audience=null are revoked by the SEC-H6 migration.
-      const expected = `${(getMcpSafeUrl() || '').replace(/\/+$/, '')}/mcp`;
+      const expected = `${trimTrailingSlashes(getMcpSafeUrl() || '')}/mcp`;
       if (result.audience !== expected) return null;
       return { user: result.user, scopes: result.scopes, clientId: result.clientId, isStaticToken: false };
     }
diff --git a/server/src/nest/memories/photo-resolver.service.ts b/server/src/nest/memories/photo-resolver.service.ts
index 142435754..071bf3252 100644
--- a/server/src/nest/memories/photo-resolver.service.ts
+++ b/server/src/nest/memories/photo-resolver.service.ts
@@ -50,7 +50,7 @@ export class PhotoResolverService {
     if (await this.cache.serveFresh(res, key)) return;
 
     const existing = this.cache.getInFlight(key);
-    if (existing) {
+    if (existing !== undefined) {
       const bytes = await existing;
       if (bytes && (await this.cache.serveFresh(res, key))) return;
       await fallback();
diff --git a/server/src/nest/notifications/mailer/email-html.ts b/server/src/nest/notifications/mailer/email-html.ts
index e9171f4cd..9fd35e1d6 100644
--- a/server/src/nest/notifications/mailer/email-html.ts
+++ b/server/src/nest/notifications/mailer/email-html.ts
@@ -12,11 +12,11 @@ import type { NotifEventType } from '../notification-events';
 
 function escapeHtml(str: string): string {
   return str
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
 }
 
 // Localized title/body for an event.
diff --git a/server/src/nest/notifications/mailer/mailer.service.ts b/server/src/nest/notifications/mailer/mailer.service.ts
index 870bdf40f..79e9932f2 100644
--- a/server/src/nest/notifications/mailer/mailer.service.ts
+++ b/server/src/nest/notifications/mailer/mailer.service.ts
@@ -2,7 +2,7 @@ import { Injectable } from '@nestjs/common';
 import nodemailer from 'nodemailer';
 import { PASSWORD_RESET_I18N } from '@trek/shared/i18n/externalNotifications';
 import { readEnv } from '../../../app-config';
-import { logError, logInfo, logDebug } from '../../audit/audit-log.logger';
+import { logError, logInfo, logDebug, logWarn } from '../../audit/audit-log.logger';
 import { decrypt_api_key } from '../../common/crypto/apiKeyCrypto';
 import { DatabaseService } from '../../database/database.service';
 import { buildEmailHtml, buildPasswordResetHtml } from './email-html';
@@ -28,6 +28,8 @@ interface SmtpConfig {
  */
 @Injectable()
 export class MailerService {
+  private skippedTlsWarned = false;
+
   constructor(private readonly db: DatabaseService) {}
 
   private getAppSetting(key: string): string | null {
@@ -44,11 +46,11 @@ export class MailerService {
     if (!host || !port || !from) return null;
     return {
       host,
-      port: parseInt(port, 10),
+      port: Number.parseInt(port, 10),
       user: user || '',
       pass: pass || '',
       from,
-      secure: parseInt(port, 10) === 465,
+      secure: Number.parseInt(port, 10) === 465,
     };
   }
 
@@ -61,15 +63,35 @@ export class MailerService {
    */
   private createTransport(config: SmtpConfig) {
     const skipTls = readEnv().smtp.skipTlsVerify || this.getAppSetting('smtp_skip_tls_verify') === 'true';
+    if (skipTls) this.warnOnceAboutSkippedTls(config);
     return nodemailer.createTransport({
       host: config.host,
       port: config.port,
       secure: config.secure,
       auth: config.user ? { user: config.user, pass: config.pass } : undefined,
+      // The operator's opt-out for a relay with a self-signed certificate, off by
+      // default and reachable only through SMTP_SKIP_TLS_VERIFY or the matching
+      // admin setting. It stays because self-hosted installs behind an internal
+      // relay depend on it; warnOnceAboutSkippedTls is what keeps it from being a
+      // silent downgrade.
       ...(skipTls ? { tls: { rejectUnauthorized: false } } : {}),
     });
   }
 
+  /**
+   * Once per process, not once per mail — a transport is built on every send, and
+   * a line on every notification would train the operator to scroll past it.
+   */
+  private warnOnceAboutSkippedTls(config: SmtpConfig): void {
+    if (this.skippedTlsWarned) return;
+    this.skippedTlsWarned = true;
+    logWarn(
+      `SECURITY: SMTP certificate verification is disabled for ${config.host}:${config.port}. ` +
+        'Mail — including password-reset links and the SMTP credentials — travels over a channel an ' +
+        'active attacker can impersonate. Keep this on only for a relay you control on a trusted network.',
+    );
+  }
+
   /** Is SMTP configured at the instance level? (Independent of any one user's address.) */
   isSmtpConfigured(): boolean {
     return !!(readEnv().smtp.host || this.getAppSetting('smtp_host'));
diff --git a/server/src/nest/notifications/notifications.controller.ts b/server/src/nest/notifications/notifications.controller.ts
index 5cdad0e55..29c4d4a88 100644
--- a/server/src/nest/notifications/notifications.controller.ts
+++ b/server/src/nest/notifications/notifications.controller.ts
@@ -132,8 +132,8 @@ export class NotificationsController {
     @Query('unread_only') unreadOnly?: string,
   ) {
     return this.notifications.listInApp(user.id, {
-      limit: Math.min(parseInt(limit as string) || 20, 50),
-      offset: parseInt(offset as string) || 0,
+      limit: Math.min(Number.parseInt(limit as string) || 20, 50),
+      offset: Number.parseInt(offset as string) || 0,
       unreadOnly: unreadOnly === 'true',
     });
   }
@@ -197,8 +197,8 @@ export class NotificationsController {
 
   /** parseInt + the legacy "Invalid id" 400 guard, shared by the /:id handlers. */
   private parseId(idParam: string): number {
-    const id = parseInt(idParam);
-    if (isNaN(id)) {
+    const id = Number.parseInt(idParam);
+    if (Number.isNaN(id)) {
       throw new HttpException({ error: 'Invalid id' }, 400);
     }
     return id;
diff --git a/server/src/nest/notifications/transports/ntfy.service.ts b/server/src/nest/notifications/transports/ntfy.service.ts
index 33905595f..cf76033b4 100644
--- a/server/src/nest/notifications/transports/ntfy.service.ts
+++ b/server/src/nest/notifications/transports/ntfy.service.ts
@@ -38,20 +38,22 @@ const NTFY_DEFAULT_META = { priority: 3 as const, tags: [] as string[] };
 export function resolveNtfyUrl(adminCfg: NtfyConfig, userCfg: NtfyConfig | null): string | null {
   const topic = userCfg?.topic;
   if (!topic) return null;
-  const base = (userCfg?.server || adminCfg.server || 'https://ntfy.sh').replace(/\/+$/, '');
+  // The lookbehind pins the strip to the start of the trailing run. Without it a
+  // configured server of nothing but slashes retries from every one of them.
+  const base = (userCfg?.server || adminCfg.server || 'https://ntfy.sh').replace(/(?<!\/)\/+$/, '');
   return `${base}/${encodeURIComponent(topic)}`;
 }
 
 /** Resolve the ntfy POST URL for admin-scoped sends. Returns null if no admin topic. */
 export function resolveAdminNtfyUrl(adminCfg: NtfyConfig): string | null {
   if (!adminCfg.topic) return null;
-  const base = (adminCfg.server || 'https://ntfy.sh').replace(/\/+$/, '');
+  const base = (adminCfg.server || 'https://ntfy.sh').replace(/(?<!\/)\/+$/, '');
   return `${base}/${encodeURIComponent(adminCfg.topic)}`;
 }
 
 function encodeHeaderValue(value: string): string {
-  for (let i = 0; i < value.length; i++) {
-    const code = value.charCodeAt(i);
+  for (const ch of value) {
+    const code = ch.codePointAt(0)!;
     // Control characters go through the same RFC 2047 wrapper as non-ASCII: a
     // trip title with a stray newline in it would otherwise be rejected by
     // undici as an invalid header value and drop the notification silently.
diff --git a/server/src/nest/oauth/oauth-public.controller.ts b/server/src/nest/oauth/oauth-public.controller.ts
index a0544ef9c..bd2b425eb 100644
--- a/server/src/nest/oauth/oauth-public.controller.ts
+++ b/server/src/nest/oauth/oauth-public.controller.ts
@@ -9,6 +9,15 @@ import { Public } from '../auth/public.decorator';
 
 const MIN = 60_000;
 
+/** Drops every trailing slash from a resource indicator, exactly like the `/\/+$/` replace
+ *  it stands in for — as a scan, because that pattern re-walks the slash run from every
+ *  start position of a `resource` value the caller controls. */
+function stripTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47 /* '/' */) end--;
+  return value.slice(0, end);
+}
+
 /**
  * Public OAuth 2.1 endpoints (no session) — byte-identical to the legacy
  * oauthPublicRouter (server/src/routes/oauth.ts): MCP-addon gated (404), the
@@ -57,7 +66,7 @@ export class OauthPublicController {
       if (!pending) return invalidGrant('code_invalid_or_expired', null);
       if (pending.clientId !== client_id) return invalidGrant('client_id_mismatch', pending.userId);
       if (pending.redirectUri !== redirect_uri) return invalidGrant('redirect_uri_mismatch', pending.userId);
-      if (pending.resource && resource && pending.resource !== resource.replace(/\/+$/, '')) return invalidGrant('resource_mismatch', pending.userId);
+      if (pending.resource && resource && pending.resource !== stripTrailingSlashes(resource)) return invalidGrant('resource_mismatch', pending.userId);
       if (!this.oauth.authenticateClient(client_id, client_secret)) {
         logWarn(`[OAuth] Invalid client credentials for client_id=${client_id} ip=${ip ?? '-'}`);
         this.audit.writeAudit({ userId: pending.userId, action: 'oauth.token.client_auth_failed', details: { client_id }, ip });
@@ -116,7 +125,7 @@ export class OauthPublicController {
       } else {
         grantedScopes = allowedScopes;
       }
-      const audience = resource ? resource.replace(/\/+$/, '') : `${this.oauth.mcpSafeUrl().replace(/\/+$/, '')}/mcp`;
+      const audience = resource ? stripTrailingSlashes(resource) : `${stripTrailingSlashes(this.oauth.mcpSafeUrl())}/mcp`;
       const tokens = this.oauth.issueClientCredentialsToken(client_id, client.user_id, grantedScopes, audience);
       this.audit.writeAudit({ userId: client.user_id, action: 'oauth.token.issue', details: { client_id, scopes: grantedScopes, audience, grant: 'client_credentials' }, ip });
       res.json(tokens);
diff --git a/server/src/nest/oauth/oauth-sdk.provider.ts b/server/src/nest/oauth/oauth-sdk.provider.ts
index 961832f77..7910025cf 100644
--- a/server/src/nest/oauth/oauth-sdk.provider.ts
+++ b/server/src/nest/oauth/oauth-sdk.provider.ts
@@ -121,8 +121,10 @@ export class TrekOAuthProvider implements OAuthServerProvider {
 
     // Redirects browser to the SPA consent page with OAuth params forwarded.
     async authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void> {
-        const mcpResource = `${getMcpSafeUrl().replace(/\/+$/, '')}/mcp`;
-        const resource = params.resource ? params.resource.href.replace(/\/+$/, '') : mcpResource;
+        // The lookbehind matches only the first slash of the trailing run. Without it the
+        // engine retries from every slash, which is quadratic on a slash-heavy value.
+        const mcpResource = `${getMcpSafeUrl().replace(/(?<!\/)\/+$/, '')}/mcp`;
+        const resource = params.resource ? params.resource.href.replace(/(?<!\/)\/+$/, '') : mcpResource;
 
         if (resource !== mcpResource) {
             const url = new URL(params.redirectUri);
@@ -143,7 +145,7 @@ export class TrekOAuthProvider implements OAuthServerProvider {
         if (params.state) qs.set('state', params.state);
         if (params.resource) qs.set('resource', params.resource.href);
 
-        const base = getMcpSafeUrl().replace(/\/+$/, '');
+        const base = getMcpSafeUrl().replace(/(?<!\/)\/+$/, '');
         res.redirect(302, `${base}/oauth/consent?${qs.toString()}`);
     }
 
@@ -169,7 +171,7 @@ export class TrekOAuthProvider implements OAuthServerProvider {
         if (redirectUri && pending.redirectUri !== redirectUri)
             throw new Error('Authorization grant is invalid.');
 
-        const resourceStr = resource ? resource.href.replace(/\/+$/, '') : null;
+        const resourceStr = resource ? resource.href.replace(/(?<!\/)\/+$/, '') : null;
         if (pending.resource && resourceStr && pending.resource !== resourceStr)
             throw new Error('Authorization grant is invalid.');
 
diff --git a/server/src/nest/oauth/oauth.service.ts b/server/src/nest/oauth/oauth.service.ts
index b1f2e32e9..98f3e76de 100644
--- a/server/src/nest/oauth/oauth.service.ts
+++ b/server/src/nest/oauth/oauth.service.ts
@@ -624,9 +624,11 @@ export class OauthService {
     // bind the token to the MCP endpoint by default — previously this
     // left `audience = null`, and the audience-bind check on MCP requests
     // then treated a null audience as "valid for any resource".
-    const mcpResource = `${getMcpSafeUrl().replace(/\/+$/, '')}/mcp`;
+    // The lookbehind matches only the first slash of the trailing run. Without it the
+    // engine retries from every slash, which is quadratic on a slash-heavy value.
+    const mcpResource = `${getMcpSafeUrl().replace(/(?<!\/)\/+$/, '')}/mcp`;
     const resource = params.resource
-      ? params.resource.replace(/\/+$/, '')
+      ? params.resource.replace(/(?<!\/)\/+$/, '')
       : mcpResource;
     if (resource !== mcpResource) {
       return { valid: false, error: 'invalid_target', error_description: 'Requested resource must be the TREK MCP endpoint' };
diff --git a/server/src/nest/oidc/oidc.controller.ts b/server/src/nest/oidc/oidc.controller.ts
index c4d3bf96b..37cc8daec 100644
--- a/server/src/nest/oidc/oidc.controller.ts
+++ b/server/src/nest/oidc/oidc.controller.ts
@@ -52,7 +52,9 @@ export class OidcController {
         res.status(500).json({ error: 'APP_URL is not configured. OIDC cannot be used.' });
         return;
       }
-      const redirectUri = `${appUrl.replace(/\/+$/, '')}/api/auth/oidc/callback`;
+      // `(?<!\/)` as in oidc.service.ts: it pins the run to its own start so a trailing
+      // run that does not end the string is not rescanned from every slash in it.
+      const redirectUri = `${appUrl.replace(/(?<!\/)\/+$/, '')}/api/auth/oidc/callback`;
       // Lenient parse: a malformed query must never 400 a login redirect, so
       // unknown values simply fall back to the raw invite + default duration.
       const query = oidcLoginQuerySchema.safeParse(req.query);
@@ -130,7 +132,9 @@ export class OidcController {
         tokenData.id_token,
         doc,
         config.clientId,
-        (doc.issuer ?? '').replace(/\/+$/, '') || config.issuer,
+        // Same trim as oidc.service.ts, and the same reason for the lookbehind — this one
+        // runs over an issuer read out of a fetched discovery document.
+        (doc.issuer ?? '').replace(/(?<!\/)\/+$/, '') || config.issuer,
       );
       if (idVerify.ok !== true) {
         const reason = 'error' in idVerify ? idVerify.error : 'unknown';
diff --git a/server/src/nest/oidc/oidc.service.ts b/server/src/nest/oidc/oidc.service.ts
index c68a505d9..8263f0f25 100644
--- a/server/src/nest/oidc/oidc.service.ts
+++ b/server/src/nest/oidc/oidc.service.ts
@@ -84,7 +84,7 @@ type JwksEntry = { keys: Array<Record<string, unknown>>; fetchedAt: number };
 // ---------------------------------------------------------------------------
 
 function base64url(buf: Buffer): string {
-  return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+  return buf.toString('base64url');
 }
 
 const isRecord = (v: unknown): v is Record<string, unknown> =>
@@ -120,7 +120,7 @@ interface InviteTokenRow {
 }
 
 function base64UrlDecode(input: string): Buffer {
-  const padded = input.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (input.length % 4)) % 4);
+  const padded = input.replaceAll('-', '+').replaceAll('_', '/') + '='.repeat((4 - (input.length % 4)) % 4);
   return Buffer.from(padded, 'base64');
 }
 
@@ -259,7 +259,9 @@ export class OidcService implements OnModuleDestroy {
     const discoveryUrl = oidcEnv.discoveryUrl || get('oidc_discovery_url') || null;
 
     if (!issuer || !clientId || !clientSecret) return null;
-    return { issuer: issuer.replace(/\/+$/, ''), clientId, clientSecret, displayName, discoveryUrl };
+    // The lookbehind pins the trailing-slash strip (here and below) to the start of
+    // the run — without it an issuer of nothing but slashes retries from every one.
+    return { issuer: issuer.replace(/(?<!\/)\/+$/, ''), clientId, clientSecret, displayName, discoveryUrl };
   }
 
   // -------------------------------------------------------------------------
@@ -283,7 +285,7 @@ export class OidcService implements OnModuleDestroy {
     // and we reject. When the operator explicitly overrides the discovery URL (e.g.
     // Authentik realm paths), the discovery doc's issuer is the canonical value —
     // trust it and warn rather than blocking login.
-    const docIssuer = doc.issuer?.replace(/\/+$/, '') ?? '';
+    const docIssuer = doc.issuer?.replace(/(?<!\/)\/+$/, '') ?? '';
     if (docIssuer && docIssuer !== issuer) {
       if (discoveryUrl) {
         console.warn(
@@ -480,7 +482,7 @@ export class OidcService implements OnModuleDestroy {
 
     // Normalize trailing slash before issuer comparison — some IdPs (e.g. Authentik)
     // include a trailing slash in the id_token iss claim.
-    const tokenIssuer = typeof claims['iss'] === 'string' ? claims['iss'].replace(/\/+$/, '') : '';
+    const tokenIssuer = typeof claims['iss'] === 'string' ? claims['iss'].replace(/(?<!\/)\/+$/, '') : '';
     if (tokenIssuer !== expectedIssuer) {
       return { ok: false, error: `signature_or_claim_mismatch: jwt issuer invalid. expected: ${expectedIssuer}` };
     }
diff --git a/server/src/nest/packing/packing.controller.ts b/server/src/nest/packing/packing.controller.ts
index f0f06287b..9e3d9bdd3 100644
--- a/server/src/nest/packing/packing.controller.ts
+++ b/server/src/nest/packing/packing.controller.ts
@@ -228,7 +228,7 @@ export class PackingController {
     @Headers('x-socket-id') socketId?: string,
   ) {
     // You can drop your own pledge; the owner can remove anyone's.
-    const target = parseInt(userId);
+    const target = Number.parseInt(userId);
     const item = this.packing.removeContributor(tripId, id, target);
     if (!item) {
       throw new HttpException({ error: 'Item not found' }, 404);
diff --git a/server/src/nest/packing/packing.service.ts b/server/src/nest/packing/packing.service.ts
index 01c169ccb..502d6bb7c 100644
--- a/server/src/nest/packing/packing.service.ts
+++ b/server/src/nest/packing/packing.service.ts
@@ -434,7 +434,7 @@ export class PackingService {
       for (const item of items) {
         if (!item.name?.trim()) continue;
         const checked = item.checked ? 1 : 0;
-        const weight = item.weight_grams ? parseInt(String(item.weight_grams)) || null : null;
+        const weight = item.weight_grams ? Number.parseInt(String(item.weight_grams)) || null : null;
 
         // Resolve bag by name if provided
         let bagId = null;
diff --git a/server/src/nest/place-enrichment/place-enrichment.service.ts b/server/src/nest/place-enrichment/place-enrichment.service.ts
index 4aa5a2acb..ada4d3e9b 100644
--- a/server/src/nest/place-enrichment/place-enrichment.service.ts
+++ b/server/src/nest/place-enrichment/place-enrichment.service.ts
@@ -172,7 +172,7 @@ export function collectFacts(details: Record<string, unknown> | null): PlaceFact
 
   const cuisine = typeof details.cuisine === 'string' ? details.cuisine : null;
   // OSM writes several cuisines semicolon-separated and underscored.
-  if (cuisine) push('cuisine', cuisine.split(';').map((c) => c.replace(/_/g, ' ').trim()).filter(Boolean).join(', '));
+  if (cuisine) push('cuisine', cuisine.split(';').map((c) => c.replaceAll('_', ' ').trim()).filter(Boolean).join(', '));
 
   // `menu_url` is a community-editable OSM tag that becomes an href on the
   // client, so it goes through the same allow-list as a place's website —
diff --git a/server/src/nest/places/gpx-export.helpers.ts b/server/src/nest/places/gpx-export.helpers.ts
index 41b878876..d9fce662c 100644
Binary files a/server/src/nest/places/gpx-export.helpers.ts and b/server/src/nest/places/gpx-export.helpers.ts differ
diff --git a/server/src/nest/places/kml-import.helpers.ts b/server/src/nest/places/kml-import.helpers.ts
index 599cffff1..f6d7f3812 100644
--- a/server/src/nest/places/kml-import.helpers.ts
+++ b/server/src/nest/places/kml-import.helpers.ts
@@ -1,4 +1,5 @@
 import { TextDecoder } from 'util';
+import { stripHtmlTags } from '../common/stripHtmlTags';
 
 export interface ParsedKmlPlacemark {
   name: string | null;
@@ -83,14 +84,14 @@ export function sanitizeKmlDescription(value: unknown): string | null {
 
   // Unwrap CDATA sections — present when fast-xml-parser returns raw node text
   // via stopNodes. Must happen before tag-stripping so the CDATA markers are
-  // not mis-parsed by the <[^>]+> regex.
+  // not mis-parsed as tags.
   const withoutCdata = raw.replace(/<!\[CDATA\[([\s\S]*?)\]\]>/g, '$1');
 
   const withLineBreaks = withoutCdata.replace(/<br\s*\/?>/gi, '\n');
-  const stripped = withLineBreaks.replace(/<[^>]+>/g, '');
+  const stripped = stripHtmlTags(withLineBreaks);
   const decoded = decodeHtmlEntities(stripped)
-    .replace(/\r\n/g, '\n')
-    .replace(/\r/g, '\n')
+    .replaceAll('\r\n', '\n')
+    .replaceAll('\r', '\n')
     .replace(/[\t\f\v]+/g, ' ')
     .replace(/\n{3,}/g, '\n\n')
     .trim();
@@ -109,7 +110,7 @@ export function parseKmlLineStringCoordinates(value: unknown): Array<{ lat: numb
       const parts = coord.split(',');
       const lng = Number.parseFloat(parts[0] ?? '');
       const lat = Number.parseFloat(parts[1] ?? '');
-      const eleRaw = parts[2] != null ? Number.parseFloat(parts[2]) : NaN;
+      const eleRaw = parts[2] != null ? Number.parseFloat(parts[2]) : Number.NaN;
       if (!Number.isFinite(lat) || !Number.isFinite(lng)) return null;
       return { lat, lng, ele: Number.isFinite(eleRaw) ? eleRaw : null };
     })
diff --git a/server/src/nest/places/places.service.ts b/server/src/nest/places/places.service.ts
index fea5d1e94..eb8e3b25b 100644
--- a/server/src/nest/places/places.service.ts
+++ b/server/src/nest/places/places.service.ts
@@ -562,7 +562,9 @@ export class PlacesService {
   // -------------------------------------------------------------------------
 
   importGpx(tripId: string, fileBuffer: Buffer, opts: GpxImportOptions = {}): GpxImportResult | null {
-    return this.colorizeImportedTracks(tripId, this.importGpxRows(tripId, fileBuffer, opts));
+    const result = this.importGpxRows(tripId, fileBuffer, opts);
+    this.colorizeImportedTracks(tripId, result);
+    return result;
   }
 
   /**
@@ -621,7 +623,7 @@ export class PlacesService {
     if (!gpx) return null;
 
     const str = (v: unknown) => (v != null ? String(v).trim() : null);
-    const num = (v: unknown) => { const n = parseFloat(String(v)); return isNaN(n) ? null : n; };
+    const num = (v: unknown) => { const n = Number.parseFloat(String(v)); return Number.isNaN(n) ? null : n; };
 
     // Routes and tracks rarely carry their own <name>. Without one they all fall back to the
     // same generic label, so name-based dedup drops every import after the first. Derive a
@@ -713,7 +715,9 @@ export class PlacesService {
   // -------------------------------------------------------------------------
 
   async importMapFile(tripId: string, fileBuffer: Buffer, filename: string, opts: KmlImportOptions = {}): Promise<PlaceImportResult> {
-    return this.colorizeImportedTracks(tripId, await this.importMapFileRows(tripId, fileBuffer, filename, opts));
+    const result = await this.importMapFileRows(tripId, fileBuffer, filename, opts);
+    this.colorizeImportedTracks(tripId, result);
+    return result;
   }
 
   private async importMapFileRows(tripId: string, fileBuffer: Buffer, filename: string, opts: KmlImportOptions = {}): Promise<PlaceImportResult> {
@@ -844,10 +848,14 @@ export class PlacesService {
    *
    * Only rows that carry geometry are touched, and only ones that have no
    * colour yet; plain waypoints and existing places stay untouched.
+   *
+   * Writes the colour into the rows AND onto the passed-in result, in place —
+   * it used to hand the same object back, which read like a transformation and
+   * was none.
    */
-  private colorizeImportedTracks<T extends { places: ImportedPlace[] } | null>(tripId: string, result: T): T {
+  private colorizeImportedTracks(tripId: string, result: { places: ImportedPlace[] } | null): void {
     const tracks = result?.places?.filter((p) => p.route_geometry && !p.route_color) ?? [];
-    if (tracks.length === 0) return result;
+    if (tracks.length === 0) return;
 
     // Read and write in one transaction so two concurrent imports cannot both
     // read the same set of free colours.
@@ -867,8 +875,6 @@ export class PlacesService {
         track.route_color = color;
       });
     });
-
-    return result;
   }
 
   // -------------------------------------------------------------------------
@@ -974,7 +980,7 @@ export class PlacesService {
       const name = item?.[2];
       const note = item?.[3] || null;
 
-      if (name && typeof lat === 'number' && typeof lng === 'number' && !isNaN(lat) && !isNaN(lng)) {
+      if (name && typeof lat === 'number' && typeof lng === 'number' && !Number.isNaN(lat) && !Number.isNaN(lng)) {
         places.push({ name, lat, lng, notes: note || null, googleFtid: googleMapsFeatureIdFromItem(item) });
       }
     }
diff --git a/server/src/nest/platform/discovery-metadata.service.ts b/server/src/nest/platform/discovery-metadata.service.ts
index 760b36eed..5eb2e9551 100644
--- a/server/src/nest/platform/discovery-metadata.service.ts
+++ b/server/src/nest/platform/discovery-metadata.service.ts
@@ -22,7 +22,7 @@ export class DiscoveryMetadataService {
 
   getOAuthMetadata(): OAuthMetadata {
     if (this.oauthMetadata) return this.oauthMetadata;
-    const base = getMcpSafeUrl().replace(/\/+$/, '');
+    const base = getMcpSafeUrl().replace(/(?<!\/)\/+$/, '');
     this.oauthMetadata = {
       issuer:                                base,
       authorization_endpoint:                `${base}/oauth/authorize`,
diff --git a/server/src/nest/plugins/host/plugin-data.service.ts b/server/src/nest/plugins/host/plugin-data.service.ts
index 858f9b86b..ae798e466 100644
--- a/server/src/nest/plugins/host/plugin-data.service.ts
+++ b/server/src/nest/plugins/host/plugin-data.service.ts
@@ -181,7 +181,7 @@ export class PluginDataDb {
    * FORBIDDEN guard by design. */
   snapshotInto(destPath: string): void {
     fs.rmSync(destPath, { force: true }); // VACUUM INTO fails if the target already exists
-    this.db.exec(`VACUUM INTO '${destPath.replace(/'/g, "''")}'`);
+    this.db.exec(`VACUUM INTO '${destPath.replaceAll("'", "''")}'`);
   }
 
   close(): void {
diff --git a/server/src/nest/plugins/host/rpc-host.ts b/server/src/nest/plugins/host/rpc-host.ts
index c685b4ebd..df5ce33eb 100644
--- a/server/src/nest/plugins/host/rpc-host.ts
+++ b/server/src/nest/plugins/host/rpc-host.ts
@@ -1,5 +1,6 @@
 import {
   KNOWN_METHODS,
+  METHOD_PERMISSION,
   type KnownMethod,
   type RpcError,
   type RpcRequest,
@@ -81,7 +82,11 @@ export class PluginRpcHost {
   }
 
   async dispatch(req: RpcRequest, actingUserId?: number): Promise<RpcResponse | RpcError> {
-    const raw = (req.params ?? {}) as Record<string, unknown>;
+    // Anything but an object is treated as no params at all. The envelope comes
+    // off an IPC channel a plugin can write to, and `'_inv' in raw` below throws a
+    // TypeError on a primitive — outside handle()'s try/catch, so it escapes as a
+    // rejection rather than an error envelope.
+    const raw = (typeof req.params === 'object' && req.params !== null ? req.params : {}) as Record<string, unknown>;
     // The supervisor resolves the acting user from `_inv` BEFORE dispatch and passes
     // the request on untouched, so `_inv` is visible to every handler today and is in
     // effect a reserved param name. Strip it here: no handler and no audit reads
@@ -119,7 +124,7 @@ export class PluginRpcHost {
         req.id,
         known ? 'PERMISSION_DENIED' : 'UNKNOWN_METHOD',
         known
-          ? `${req.method} requires a permission "${this.pluginId}" was not granted`
+          ? `${req.method} requires the "${(METHOD_PERMISSION as Record<string, string>)[req.method]}" permission, which was not granted to plugin "${this.pluginId}"`
           : `unknown method ${req.method}`,
       );
     }
diff --git a/server/src/nest/plugins/install/manifest.ts b/server/src/nest/plugins/install/manifest.ts
index c6450ed4c..10efe2072 100644
--- a/server/src/nest/plugins/install/manifest.ts
+++ b/server/src/nest/plugins/install/manifest.ts
@@ -1,5 +1,5 @@
 import semver from 'semver';
-import { isKnownPermission } from '../protocol/envelope';
+import { isKnownPermission, PLUGIN_API_VERSION } from '../protocol/envelope';
 import { isValidTrekRange, minTrekOf } from './host-compat';
 import type { NotifEventType } from '../../notifications/notification-events';
 
@@ -148,7 +148,7 @@ export class ManifestError extends Error {}
 
 /** JSON.parse that tolerates a UTF-8 BOM (0xFEFF) — manifests written on Windows often carry one. */
 export function parseJsonText(text: string): unknown {
-  return JSON.parse(text.charCodeAt(0) === 0xfeff ? text.slice(1) : text);
+  return JSON.parse(text.codePointAt(0) === 0xfeff ? text.slice(1) : text);
 }
 
 /**
@@ -220,11 +220,21 @@ export function parseManifest(raw: unknown, opts?: { requireTrek?: boolean }): P
         : 'missing "trek" version range — declare the TREK versions this plugin supports, e.g. ">=3.2.0 <4.0.0"',
     );
   }
+
+  const rawApi = m.apiVersion;
+  if (rawApi !== undefined && (typeof rawApi !== 'number' || !Number.isInteger(rawApi) || rawApi < 1)) {
+    throw new ManifestError('apiVersion must be a positive integer');
+  }
+  const apiVersion = (rawApi as number | undefined) ?? 1;
+  if (opts?.requireTrek && apiVersion > PLUGIN_API_VERSION) {
+    throw new ManifestError(`plugin requires plugin-API v${apiVersion}; this TREK supports v${PLUGIN_API_VERSION}`);
+  }
+
   return {
     id,
     name: str(m.name, 'name'),
     version,
-    apiVersion: typeof m.apiVersion === 'number' ? m.apiVersion : 1,
+    apiVersion,
     author: optStr(m.author),
     description: optStr(m.description),
     homepage: optStr(m.homepage),
diff --git a/server/src/nest/plugins/install/safe-extract.ts b/server/src/nest/plugins/install/safe-extract.ts
index 568f1f79b..5c3429001 100644
--- a/server/src/nest/plugins/install/safe-extract.ts
+++ b/server/src/nest/plugins/install/safe-extract.ts
@@ -28,7 +28,7 @@ export class ExtractError extends Error {}
 
 /** Assert a member path stays within dest; return the safe absolute path. */
 export function safeJoin(dest: string, name: string): string {
-  const norm = name.replace(/\\/g, '/');
+  const norm = name.replaceAll(/\\/g, '/');
   if (norm.startsWith('/') || /^[a-zA-Z]:/.test(norm)) throw new ExtractError(`absolute path rejected: ${name}`);
   if (norm.split('/').some((seg) => seg === '..')) throw new ExtractError(`path traversal rejected: ${name}`);
   const resolved = path.resolve(dest, norm);
@@ -82,8 +82,17 @@ function readTarGz(buf: Buffer, lim: Required<ExtractLimits>): Member[] {
     let name = block.subarray(0, 100).toString('utf8').replace(/\0.*$/, '');
     const prefix = block.subarray(345, 500).toString('utf8').replace(/\0.*$/, '');
     if (prefix) name = `${prefix}/${name}`;
-    const size = parseInt(block.subarray(124, 136).toString('utf8').replace(/\0.*$/, '').trim() || '0', 8);
-    const typeflag = String.fromCharCode(block[156]);
+    const size = Number.parseInt(block.subarray(124, 136).toString('utf8').replace(/\0.*$/, '').trim() || '0', 8);
+    // A negative size walks the cursor backwards: `off += 512` and then
+    // `off += Math.ceil(size / 512) * 512` cancel out at -512 and go negative
+    // below it, so the same header is read forever while every pass appends a
+    // member — a 70-byte archive is enough to hold the main thread and exhaust
+    // memory. The entry budgets in extractArchive never get a say; they run on
+    // the list this function has to finish building first.
+    if (!Number.isSafeInteger(size) || size < 0) {
+      throw new ExtractError(`invalid entry size in tar header: ${block.subarray(124, 136).toString('utf8').replace(/\0.*$/, '').trim()}`);
+    }
+    const typeflag = String.fromCodePoint(block[156]);
     off += 512;
     const data = tar.subarray(off, off + size);
     off += Math.ceil(size / 512) * 512;
diff --git a/server/src/nest/plugins/install/safe-fetch.ts b/server/src/nest/plugins/install/safe-fetch.ts
index f3f93952d..b38aecf93 100644
--- a/server/src/nest/plugins/install/safe-fetch.ts
+++ b/server/src/nest/plugins/install/safe-fetch.ts
@@ -99,6 +99,6 @@ async function readCapped(resp: Response, maxBytes: number): Promise<Buffer> {
 export function sha256Matches(actual: string, expected: string): boolean {
   if (actual.length !== expected.length) return false;
   let diff = 0;
-  for (let i = 0; i < actual.length; i++) diff |= actual.charCodeAt(i) ^ expected.charCodeAt(i);
+  for (let i = 0; i < actual.length; i++) diff |= (actual.codePointAt(i) ?? 0) ^ (expected.codePointAt(i) ?? 0);
   return diff === 0;
 }
diff --git a/server/src/nest/plugins/oauth/plugin-oauth.service.ts b/server/src/nest/plugins/oauth/plugin-oauth.service.ts
index 2d2716e6a..c1e658ba4 100644
--- a/server/src/nest/plugins/oauth/plugin-oauth.service.ts
+++ b/server/src/nest/plugins/oauth/plugin-oauth.service.ts
@@ -32,7 +32,7 @@ const STATE_TTL_MS = 10 * 60 * 1000; // an authorize round-trip must finish with
 const REFRESH_SKEW_S = 60; // refresh a token expiring within a minute
 
 function b64url(buf: Buffer): string {
-  return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+  return buf.toString('base64url');
 }
 
 /** Cheap fast-fail for an obviously-internal token endpoint. This is a pre-check, not the
diff --git a/server/src/nest/plugins/paths.ts b/server/src/nest/plugins/paths.ts
index 276a3343c..32b4fd630 100644
--- a/server/src/nest/plugins/paths.ts
+++ b/server/src/nest/plugins/paths.ts
@@ -23,9 +23,31 @@ export function pluginsDataRoot(): string {
   return readEnv().plugins.dataDir || path.join(DATA_ROOT, 'plugins-data');
 }
 
+/**
+ * Plugin ids reach these helpers straight from a route parameter — `POST
+ * /api/admin/plugins/:id/uninstall` hands its id to pluginCodeDir, and what comes
+ * back goes to a recursive remove. Express decodes `%2F` AFTER routing, so
+ * `..%2F..%2Fuploads` still matches the route and arrives here as
+ * `../../uploads`; a plain path.join then points outside the plugin tree.
+ *
+ * Deliberately narrower than the manifest's ID_RE, which demands 3–40 lowercase
+ * characters and is the right rule at install time. This one only has to keep an
+ * id from leaving its parent, so it stays permissive about length and case and
+ * refuses exactly what steers a path: separators, a leading dot, and the
+ * drive/stream colon.
+ */
+const SAFE_PLUGIN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+function safePluginId(id: string): string {
+  if (typeof id !== 'string' || id.length > 64 || !SAFE_PLUGIN_ID.test(id)) {
+    throw new Error(`invalid plugin id: ${JSON.stringify(id)}`);
+  }
+  return id;
+}
+
 /** A plugin's installed code directory (contains trek-plugin.json + server/index.js). */
 export function pluginCodeDir(id: string): string {
-  return path.join(pluginsCodeRoot(), id);
+  return path.join(pluginsCodeRoot(), safePluginId(id));
 }
 
 /**
@@ -60,7 +82,7 @@ export function ensurePluginModuleType(codeDir: string): void {
 
 /** A plugin's writable data directory (its own sqlite file + any blobs). */
 export function pluginDataDir(id: string): string {
-  return path.join(pluginsDataRoot(), id);
+  return path.join(pluginsDataRoot(), safePluginId(id));
 }
 
 /** The plugin's own sqlite file — opened by the HOST, reached by the plugin only via RPC. */
diff --git a/server/src/nest/plugins/plugin-runtime.service.ts b/server/src/nest/plugins/plugin-runtime.service.ts
index 49c77708f..8a1687b63 100644
--- a/server/src/nest/plugins/plugin-runtime.service.ts
+++ b/server/src/nest/plugins/plugin-runtime.service.ts
@@ -1,4 +1,4 @@
-import { Injectable, type OnModuleInit, type OnModuleDestroy } from '@nestjs/common';
+import { Injectable, type OnApplicationBootstrap, type OnModuleDestroy } from '@nestjs/common';
 import semver from 'semver';
 import { DatabaseService } from '../database/database.service';
 import { pluginsEnabled } from './kill-switch';
@@ -33,7 +33,7 @@ import type { PluginDependency } from './install/manifest';
 import type { VersionMismatch, PluginDepRow } from './dependencies';
 import { parseDependencies, disabledRequiredAddons, resolveDependencyState, enableOrder, findDependentsTransitive, DependencyCycleError } from './dependencies';
 
-import { HTTP_OUTBOUND_PREFIX as HTTP_OUTBOUND } from './protocol/envelope';
+import { HTTP_OUTBOUND_PREFIX as HTTP_OUTBOUND, PLUGIN_API_VERSION } from './protocol/envelope';
 
 // Mirrors HOST_RE in install/manifest.ts: an exact hostname or a `*.`-prefixed wildcard
 // with a real multi-label suffix. Rejects a bare `*`, a whole-TLD wildcard, a scheme and
@@ -85,7 +85,9 @@ export type PluginDependencyCode =
   /** The plugin's declared TREK range doesn't admit the running host. */
   | 'TREK_VERSION_INCOMPATIBLE'
   /** The plugin never declared a range, so we can't know that it does. */
-  | 'TREK_VERSION_UNKNOWN';
+  | 'TREK_VERSION_UNKNOWN'
+  /** The plugin's manifest apiVersion is newer than this TREK's plugin-API surface. */
+  | 'API_VERSION_INCOMPATIBLE';
 
 /**
  * Thrown when a plugin can't activate because a required addon is disabled, a declared
@@ -119,7 +121,7 @@ export class PluginDependencyError extends Error {
  */
 
 @Injectable()
-export class PluginRuntimeService implements OnModuleInit, OnModuleDestroy {
+export class PluginRuntimeService implements OnApplicationBootstrap, OnModuleDestroy {
   // The rpc-host factory is bound to `this` as the inter-plugin router, so a
   // plugin's ctx.plugins.call / ctx.events.emit resolve through callPlugin/
   // emitPluginEvent below (which own the dependency-edge authorization). The
@@ -180,7 +182,15 @@ export class PluginRuntimeService implements OnModuleInit, OnModuleDestroy {
     return this.dbs.connection;
   }
 
-  onModuleInit(): void {
+  // onApplicationBootstrap, NOT onModuleInit: boot activation builds each plugin's
+  // rpc host synchronously, and the host snapshots PluginRpcRegistryService at
+  // construction (bindInto). Same-module onModuleInit hooks fire in providers-array
+  // declaration order, where this service precedes the registry — so booting from
+  // onModuleInit bound every host to a still-empty registry and every enabled
+  // plugin's first RPC after a restart came back PERMISSION_DENIED (pinned by
+  // tests/integration/plugins/boot-registry-order.test.ts). onApplicationBootstrap
+  // is guaranteed to run after EVERY module's onModuleInit, registry scan included.
+  onApplicationBootstrap(): void {
     if (!pluginsEnabled()) return;
     // If a restore staged plugin trees, swap them into place NOW — before we open any
     // plugin DB below. This is where a restored backup's plugin data/code actually
@@ -303,7 +313,7 @@ export class PluginRuntimeService implements OnModuleInit, OnModuleDestroy {
     // a drain, and a pass awaits per-row delivery (up to the invoke timeout each), so
     // running two concurrently would select the SAME rows and deliver an erasure twice.
     // A caller that awaits still waits for a full pass (the in-flight one).
-    if (this.drainInFlight) return this.drainInFlight;
+    if (this.drainInFlight !== null) return this.drainInFlight;
     this.drainInFlight = this.runDrainOnce().finally(() => { this.drainInFlight = null; });
     return this.drainInFlight;
   }
@@ -478,11 +488,12 @@ export class PluginRuntimeService implements OnModuleInit, OnModuleDestroy {
   /**
    * Read-only activation gate for one plugin — throws (without mutating) if it may
    * not activate. Checks run most- to least-severe: TREK-version compatibility →
-   * permission re-consent → required addon disabled → missing/mismatched plugin dependency.
+   * plugin-API version compatibility → permission re-consent → required addon disabled →
+   * missing/mismatched plugin dependency.
    */
   private assertActivatable(id: string, installed: Map<string, PluginDepRow>, consentWiden: boolean): void {
-    const row = this.db.prepare('SELECT permissions, granted_permissions, dependencies, trek_range FROM plugins WHERE id = ?').get(id) as
-      | { permissions: string; granted_permissions: string; dependencies: string | null; trek_range: string | null }
+    const row = this.db.prepare('SELECT permissions, granted_permissions, dependencies, trek_range, api_version FROM plugins WHERE id = ?').get(id) as
+      | { permissions: string; granted_permissions: string; dependencies: string | null; trek_range: string | null; api_version: number | null }
       | undefined;
     if (!row) throw new Error(`plugin ${id} not found`);
 
@@ -505,6 +516,16 @@ export class PluginRuntimeService implements OnModuleInit, OnModuleDestroy {
         { trekRange: row.trek_range, hostVersion: hostVersion() },
       );
     }
+    // Same reasoning as the TREK-version gate above: a plugin whose manifest apiVersion
+    // outpaces this TREK's plugin-API surface can never run correctly, so it must be
+    // refused before any consent dialog is offered.
+    const apiVersion = row.api_version ?? 1;
+    if (apiVersion > PLUGIN_API_VERSION) {
+      throw new PluginDependencyError(
+        `plugin requires plugin-API v${apiVersion}; this TREK supports v${PLUGIN_API_VERSION}`,
+        'API_VERSION_INCOMPATIBLE',
+      );
+    }
 
     const declared = parseArray(row.permissions).filter(isKnownPermission);
     const granted = parseArray(row.granted_permissions);
diff --git a/server/src/nest/plugins/plugins.controller.ts b/server/src/nest/plugins/plugins.controller.ts
index 2ccb1d11c..189951bad 100644
--- a/server/src/nest/plugins/plugins.controller.ts
+++ b/server/src/nest/plugins/plugins.controller.ts
@@ -11,7 +11,7 @@ import { CurrentUser } from '../auth/current-user.decorator';
 import { getClientIp } from '../audit/client-ip';
 import { pluginsEnabled } from './kill-switch';
 import { devLinkEnabled } from './dev-link';
-import { PluginActivateDto, PluginConfigDto, PluginEgressHostsDto, PluginInstallDto, PluginLinkDto, PluginRetrustDto, PluginUninstallDto } from './plugins.dto';
+import { PluginActivateDto, PluginConfigDto, PluginEgressHostsDto, PluginInstallDto, PluginLinkDto, PluginRetrustDto, PluginUninstallDto, PluginUpdateDto } from './plugins.dto';
 import { ManagedForbidden, isManagedBlocked, MANAGED_FORBIDDEN_ERROR } from '../common/managed';
 import { RuntimeEnvService } from '../app-config/runtime-env.service';
 
@@ -81,8 +81,12 @@ export class PluginsController {
       // withDependencies (used by the "resolve missing dependency" admin flow) pulls
       // the target + its transitive plugin deps, resolving each to its latest
       // compatible version and reporting addons the admin still has to enable.
+      // Dependency resolution pins versions internally but never DELIBERATELY, so
+      // only the plain path below recomputes the update hold.
       if (body.withDependencies) return await this.registry.installWithDependencies(body.id, body.constraint);
-      return await this.registry.install(body.id, { version: body.version, constraint: body.constraint });
+      const res = await this.registry.install(body.id, { version: body.version, constraint: body.constraint });
+      await this.registry.recomputeUpdateHold(res.id, res.version, !!body.version);
+      return res;
     } catch (e) {
       throw registryFailure(e, 'install failed');
     }
@@ -221,15 +225,31 @@ export class PluginsController {
 
   @Post(':id/update')
   @HttpCode(200)
-  async update(@Param('id') id: string) {
+  async update(@Param('id') id: string, @Body() body?: PluginUpdateDto) {
     if (!pluginsEnabled()) throw new HttpException({ error: 'Plugins are disabled by server configuration' }, 503);
     try {
-      return await this.runtime.update(id);
+      // An explicit version is the rollback path: install exactly what the admin picked
+      // (the TREK-compat gate still refuses in selectVersion). Absent, the runtime
+      // resolves the newest compatible version itself.
+      const res = await this.runtime.update(id, { version: body?.version });
+      // A deliberate non-latest pick holds future updates; landing on the newest
+      // (any path) releases a stale hold. Only after success — a failed update
+      // changed nothing and must not touch the flag.
+      await this.registry.recomputeUpdateHold(id, res.version, !!body?.version);
+      return res;
     } catch (e) {
       throw registryFailure(e, 'update failed');
     }
   }
 
+  /** Release a per-plugin update hold (set by a deliberate non-latest install). */
+  @Post(':id/resume-updates')
+  @HttpCode(200)
+  resumeUpdates(@Param('id') id: string) {
+    if (!this.plugins.resumeUpdates(id)) throw new HttpException({ error: `plugin ${id} not found` }, 404);
+    return { updateHold: false };
+  }
+
   /**
    * Re-trust a plugin whose author signing key ROTATED, and update it in the same call.
    *
diff --git a/server/src/nest/plugins/plugins.dto.ts b/server/src/nest/plugins/plugins.dto.ts
index 877ee59d2..4f530a9bc 100644
--- a/server/src/nest/plugins/plugins.dto.ts
+++ b/server/src/nest/plugins/plugins.dto.ts
@@ -41,6 +41,14 @@ export class PluginRetrustDto extends createZodDto(
   z.looseObject({ version: z.string().optional(), publicKey: z.string().optional() }),
 ) {}
 
+/**
+ * `version` pins the exact version to install — the rollback path. Omitted, the
+ * runtime resolves the newest TREK-compatible version itself (the classic update).
+ */
+export class PluginUpdateDto extends createZodDto(
+  z.looseObject({ version: z.string().optional() }),
+) {}
+
 /**
  * `hosts` is deliberately unknown, not `string[]`.
  *
diff --git a/server/src/nest/plugins/plugins.service.ts b/server/src/nest/plugins/plugins.service.ts
index 4522b6ba6..b2f0463f3 100644
--- a/server/src/nest/plugins/plugins.service.ts
+++ b/server/src/nest/plugins/plugins.service.ts
@@ -43,6 +43,7 @@ interface PluginRawRow {
   update_block_code: string | null;
   update_block_detail: string | null;
   update_block_version: string | null;
+  update_hold: number;
 }
 
 export interface PluginListItem {
@@ -87,6 +88,9 @@ export interface PluginListItem {
   /** Why an update was refused, if one was. `version` is the registry version that was
    * refused, so a caller can treat the block as stale once a newer one is on offer. */
   updateBlock: { code: string; detail: string | null; version: string | null } | null;
+  /** A deliberate non-latest install paused updates: excluded from the banner/Update all
+   * until the admin resumes, or an install lands back on the newest compatible version. */
+  updateHold: boolean;
 }
 
 @Injectable()
@@ -114,7 +118,7 @@ export class PluginsService {
       .prepare(
         `SELECT id, name, description, type, icon, version, status, enabled, last_error, reviewed_at, source_repo,
                 permissions, capabilities, dependencies, operator_egress, trek_range,
-                author_pubkey, update_block_code, update_block_detail, update_block_version
+                author_pubkey, update_block_code, update_block_detail, update_block_version, update_hold
          FROM plugins
          ORDER BY sort_order, name`,
       )
@@ -143,6 +147,7 @@ export class PluginsService {
         update_block_code,
         update_block_detail,
         update_block_version,
+        update_hold,
         ...rest
       } = r as PluginRawRow & { operator_egress?: number };
       return {
@@ -159,11 +164,20 @@ export class PluginsService {
         updateBlock: update_block_code
           ? { code: update_block_code, detail: update_block_detail, version: update_block_version }
           : null,
+        updateHold: update_hold === 1,
       };
     });
     return { enabled: pluginsEnabled(), devLink: devLinkEnabled(), plugins };
   }
 
+  /**
+   * Release a per-plugin update hold (set by a deliberate non-latest install).
+   * Returns whether the plugin row existed — the controller answers 404 otherwise.
+   */
+  resumeUpdates(id: string): boolean {
+    return this.db.prepare('UPDATE plugins SET update_hold = 0 WHERE id = ?').run(id).changes > 0;
+  }
+
   /**
    * Merge instance-scope settings into the plugin's config, encrypting fields
    * declared secret (unless the value is the unchanged mask sentinel). Only keys
diff --git a/server/src/nest/plugins/protocol/envelope.ts b/server/src/nest/plugins/protocol/envelope.ts
index 1e920579b..54a084541 100644
--- a/server/src/nest/plugins/protocol/envelope.ts
+++ b/server/src/nest/plugins/protocol/envelope.ts
@@ -7,6 +7,14 @@
  * or the websocket server. Keep it dependency-free.
  */
 
+/**
+ * The plugin-API surface version (#plugins, M4) — bumped on any breaking change to the
+ * ctx methods / manifest shape a plugin author can rely on. Mirrored into every
+ * manifest as `apiVersion`; the install and activation gates refuse a plugin declaring
+ * a version newer than this one.
+ */
+export const PLUGIN_API_VERSION = 1;
+
 export type PluginErrCode =
   | 'PERMISSION_DENIED' // a real method the plugin was not granted
   | 'UNKNOWN_METHOD' // not a method the host exposes at all
@@ -202,6 +210,10 @@ export const METHOD_PERMISSION = {
   'packing.create': 'db:write:packing',
   'packing.update': 'db:write:packing',
   'packing.delete': 'db:write:packing',
+  // Intentional: bags are the write-side organizational structure of packing —
+  // a read-only consumer uses packing.list; only bag-managing (write) plugins
+  // need the bag tree. Moving this to db:read:packing would strip access from
+  // every installed write-only plugin and force consent re-prompts.
   'packing.listBags': 'db:write:packing',
   'packing.createBag': 'db:write:packing',
   'packing.updateBag': 'db:write:packing',
diff --git a/server/src/nest/plugins/registry/registry.service.ts b/server/src/nest/plugins/registry/registry.service.ts
index 8243d5a18..c56935ca7 100644
--- a/server/src/nest/plugins/registry/registry.service.ts
+++ b/server/src/nest/plugins/registry/registry.service.ts
@@ -304,6 +304,17 @@ export class PluginRegistryService {
       screenshotUrl: entry.screenshotUrl ?? (latest ? rawFileUrl(entry.repo, latest.commitSha, 'docs/screenshot.png') : null),
       signed: !!entry.authorPublicKey && !!latest?.signature,
       authorPublicKey: entry.authorPublicKey ?? null,
+      // The version picker's data: every published version with its OWN server-computed
+      // compat verdict. The client has no semver and must never re-derive range logic —
+      // a picker that disagreed with the install gate would offer a version that 400s.
+      versions: entry.versions.map((v) => ({
+        version: v.version,
+        publishedAt: v.publishedAt ?? null,
+        size: v.size ?? null,
+        signed: !!entry.authorPublicKey && !!v.signature,
+        trek: trekRequirementOrNull(v),
+        compatible: hostCompatible(v, normalizedHost()),
+      })),
       ...this.hostCompat(entry),
       manifest,
     };
@@ -508,6 +519,30 @@ export class PluginRegistryService {
     return { installed, requiredAddons: [...requiredAddons] };
   }
 
+  /**
+   * Recompute the per-plugin update hold after a successful install/update.
+   *
+   * The hold exists so a DELIBERATE rollback isn't immediately nagged away by the
+   * update banner. It is set only when `explicit` (the admin picked this exact
+   * version) AND a newer TREK-compatible version exists; every other outcome writes
+   * 0, so landing back on the newest compatible version — by any path — releases a
+   * stale hold. An unresolvable registry never sets a hold: refusing to pin on
+   * missing information beats silently muting future updates.
+   */
+  async recomputeUpdateHold(id: string, installedVersion: string, explicit: boolean): Promise<boolean> {
+    let hold = false;
+    if (explicit) {
+      try {
+        const newest = await this.resolveVersion(id);
+        hold = semver.lt(installedVersion, newest.version);
+      } catch {
+        hold = false;
+      }
+    }
+    this.db.prepare('UPDATE plugins SET update_hold = ? WHERE id = ?').run(hold ? 1 : 0, id);
+    return hold;
+  }
+
   /**
    * Sideload step 1: extract + validate an uploaded archive into a staging dir,
    * WITHOUT touching the live plugin. Returns the manifest id/version + the staged
@@ -710,17 +745,23 @@ export function assertHostCompatible(range: string | null, id: string): void {
 }
 
 /**
- * How a version's TREK requirement reads in an error/UI string. Each bound is optional —
- * an entry may declare only a ceiling, or (once `trek` is absent too) nothing at all — so
- * this composes whatever bounds exist rather than interpolating a missing one as "null".
+ * A version's declared TREK requirement as a range string, or null when the entry
+ * carries no bounds at all. Each bound is optional — an entry may declare only a
+ * ceiling, or (once `trek` is absent too) nothing — so this composes whatever
+ * bounds exist rather than interpolating a missing one as "null".
  */
-function trekRequirement(v: RegistryVersion): string {
+function trekRequirementOrNull(v: RegistryVersion): string | null {
   if (v.trek) return v.trek;
   const bounds = [
     v.minTrekVersion ? `>=${v.minTrekVersion}` : null,
     v.maxTrekVersion ? `<=${v.maxTrekVersion}` : null,
   ].filter(Boolean);
-  return bounds.length ? bounds.join(' ') : 'any version';
+  return bounds.length ? bounds.join(' ') : null;
+}
+
+/** How a version's TREK requirement reads in an error/UI string. */
+function trekRequirement(v: RegistryVersion): string {
+  return trekRequirementOrNull(v) ?? 'any version';
 }
 
 /**
diff --git a/server/src/nest/plugins/runtime/egress-policy.ts b/server/src/nest/plugins/runtime/egress-policy.ts
index 36663f8a5..fe0f70eab 100644
--- a/server/src/nest/plugins/runtime/egress-policy.ts
+++ b/server/src/nest/plugins/runtime/egress-policy.ts
@@ -69,7 +69,10 @@ function embeddedTransitionIpv4(g: number[]): string | null {
 
 /** Expand an IPv6 literal into its 8 numeric hextets, or null if not a valid IPv6. */
 function expandV6(ip: string): number[] | null {
-  let h = ip.toLowerCase().replace(/%.*$/, '');
+  // Cut the zone id off (`fe80::1%eth0`): indexOf rather than a `%.*$` regex, whose
+  // greedy tail rescans the whole string once per `%` on a host that never matches.
+  const zone = ip.indexOf('%');
+  let h = (zone === -1 ? ip : ip.slice(0, zone)).toLowerCase();
   if (!h.includes(':')) return null;
   const dotted = h.match(/^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
   if (dotted) {
@@ -82,9 +85,9 @@ function expandV6(ip: string): number[] | null {
   const head = halves[0] ? halves[0].split(':') : [];
   const tail = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
   const groups =
-    halves.length === 2 ? [...head, ...Array(8 - head.length - tail.length).fill('0'), ...tail] : head;
+    halves.length === 2 ? [...head, ...new Array(8 - head.length - tail.length).fill('0'), ...tail] : head;
   if (groups.length !== 8) return null;
-  const nums = groups.map((x) => (x === '' ? NaN : parseInt(x, 16)));
+  const nums = groups.map((x) => (x === '' ? Number.NaN : Number.parseInt(x, 16)));
   return nums.some((n) => !Number.isInteger(n) || n < 0 || n > 0xffff) ? null : nums;
 }
 
diff --git a/server/src/nest/plugins/runtime/plugin-sdk.ts b/server/src/nest/plugins/runtime/plugin-sdk.ts
index 0510541f6..bc8ce59ba 100644
--- a/server/src/nest/plugins/runtime/plugin-sdk.ts
+++ b/server/src/nest/plugins/runtime/plugin-sdk.ts
@@ -9,7 +9,7 @@
  */
 
 /** Mirrors the published package's constant — bumped on any breaking API change. */
-export const PLUGIN_API_VERSION = 1 as const;
+export { PLUGIN_API_VERSION } from '../protocol/envelope';
 
 export interface PluginContext {
   readonly id: string;
@@ -93,7 +93,12 @@ export interface PluginContext {
     update(tripId: number, itemId: number, input: Record<string, unknown>): Promise<unknown>;
     /** Delete a packing item. Needs 'db:write:packing' + 'packing_edit'. */
     delete(tripId: number, itemId: number): Promise<{ deleted: boolean }>;
-    /** List/create/update/delete packing bags + set members (no privacy). Needs 'db:write:packing' + 'packing_edit'. */
+    /**
+     * List/create/update/delete packing bags + set members (no privacy). Bag methods need
+     * 'db:write:packing' + the acting user's 'packing_edit' trip permission — except this
+     * one: listBags is a read, but the envelope still gates it on the write scope
+     * (intentional — bags are the write-side structure; packing.list is the read surface).
+     */
     listBags(tripId: number): Promise<unknown[]>;
     createBag(tripId: number, input: { name: string; color?: string }): Promise<unknown>;
     updateBag(tripId: number, bagId: number, input: Record<string, unknown>): Promise<unknown>;
diff --git a/server/src/nest/plugins/supervisor/plugin-supervisor.ts b/server/src/nest/plugins/supervisor/plugin-supervisor.ts
index 5577b7fb1..3e2e0595e 100644
--- a/server/src/nest/plugins/supervisor/plugin-supervisor.ts
+++ b/server/src/nest/plugins/supervisor/plugin-supervisor.ts
@@ -474,7 +474,7 @@ export class PluginSupervisor {
     sup.child = child;
     sup.lastBeat = Date.now();
 
-    child.on('message', (raw: unknown) => this.onMessage(sup, raw as Envelope));
+    child.on('message', (raw: unknown) => this.handleChildMessage(sup, raw));
     child.on('exit', (code, signal) => this.onExit(sup, code, signal));
     child.on('error', (e) => this.hooks.onLog?.(sup.id, 'error', `child error: ${e.message}`));
     child.stdout?.on('data', (b) => this.recordLog(sup, 'info', String(b).trimEnd()));
@@ -502,6 +502,19 @@ export class PluginSupervisor {
     this.hooks.onLog?.(sup.id, level, msg, meta);
   }
 
+  /**
+   * An EventEmitter listener throws away what its callback returns, and onMessage is
+   * async — so a rejection in there surfaces as an unhandledRejection, which Node 22
+   * turns into process exit. The host installs no net for it (the plugin child does,
+   * for itself), so one malformed envelope would take down the very supervisor whose
+   * job is to contain a misbehaving plugin. Log it against the plugin and carry on.
+   */
+  private handleChildMessage(sup: Supervised, raw: unknown): void {
+    this.onMessage(sup, raw as Envelope).catch((e: unknown) => {
+      this.hooks.onLog?.(sup.id, 'error', `message handling failed: ${e instanceof Error ? e.message : String(e)}`);
+    });
+  }
+
   private async onMessage(sup: Supervised, msg: Envelope): Promise<void> {
     if (!msg || typeof msg !== 'object') return;
 
diff --git a/server/src/nest/plugins/text-sanitize.ts b/server/src/nest/plugins/text-sanitize.ts
index d80b51c44..b0eaabb64 100644
--- a/server/src/nest/plugins/text-sanitize.ts
+++ b/server/src/nest/plugins/text-sanitize.ts
@@ -26,9 +26,12 @@ export function stripEmoji(s: string): string {
   const stripped = s.replace(EMOJI_RE, '');
   // Nothing removed → return verbatim so a plain string keeps its exact spacing and
   // paragraph breaks (matters for PDF paragraphs). Otherwise collapse only the
-  // horizontal gaps an emoji left, never newlines.
+  // horizontal gaps an emoji left, never newlines. The trailing-space trim carries the
+  // char in front of the run (or the line start) into the match and puts it back, so the
+  // run is only ever walked from its own start — plugin text must not make ` +$` restart
+  // inside every space of a long one.
   if (stripped === s) return s;
-  return stripped.replace(/[^\S\r\n]{2,}/g, ' ').replace(/ +$/gm, '').trim();
+  return stripped.replace(/[^\S\r\n]{2,}/g, ' ').replace(/(^|[^ ]) +$/gm, '$1').trim();
 }
 
 /** True if the string contains at least one emoji — used by the dev/validate warnings. */
diff --git a/server/src/nest/storage/drivers/s3.driver.ts b/server/src/nest/storage/drivers/s3.driver.ts
index 6d17bede8..b24a2ce81 100644
--- a/server/src/nest/storage/drivers/s3.driver.ts
+++ b/server/src/nest/storage/drivers/s3.driver.ts
@@ -465,11 +465,17 @@ export class S3Driver implements StorageDriver {
 /**
  * '' stays ''; anything else becomes one or more slash-joined segments with a
  * trailing slash, or throws StorageInvalidKeyError. app-config/env.ts's
- * s3Preconditions validates the same slash-stripped shape at boot — keep the
- * two strip-regexes identical (`/^\/+|\/+$/g`).
+ * s3Preconditions validates the same slash-stripped shape at boot — keep the two
+ * strips identical: leading AND trailing slash runs removed, as `/^\/+|\/+$/g` did.
+ * Scanned rather than replaced, because that pattern re-walks the trailing run from
+ * every start position.
  */
 function normalizeKeyPrefix(raw: string): string {
-  const trimmed = raw.replace(/^\/+|\/+$/g, '');
+  let start = 0;
+  let end = raw.length;
+  while (start < end && raw.charCodeAt(start) === 47 /* '/' */) start++;
+  while (end > start && raw.charCodeAt(end - 1) === 47) end--;
+  const trimmed = raw.slice(start, end);
   if (trimmed === '') return '';
   assertValidPrefix(`${trimmed}/`);
   return `${trimmed}/`;
diff --git a/server/src/nest/storage/storage-keys.ts b/server/src/nest/storage/storage-keys.ts
index 32bb7a5ce..0b56a0ef0 100644
--- a/server/src/nest/storage/storage-keys.ts
+++ b/server/src/nest/storage/storage-keys.ts
@@ -17,8 +17,8 @@ import { StorageInvalidKeyError } from './storage.types';
 const MAX_KEY_LENGTH = 1024;
 
 function hasControlChars(value: string): boolean {
-  for (let i = 0; i < value.length; i++) {
-    const code = value.charCodeAt(i);
+  for (const char of value) {
+    const code = char.codePointAt(0) as number;
     if (code < 0x20 || code === 0x7f) return true;
   }
   return false;
diff --git a/server/src/nest/transit/transit.service.ts b/server/src/nest/transit/transit.service.ts
index 7e05d4c0a..beff0957c 100644
--- a/server/src/nest/transit/transit.service.ts
+++ b/server/src/nest/transit/transit.service.ts
@@ -190,7 +190,7 @@ export class TransitService {
 
     if (q.time) {
       const parsed = new Date(q.time);
-      if (isNaN(parsed.getTime())) bad('time must be an ISO date-time');
+      if (Number.isNaN(parsed.getTime())) bad('time must be an ISO date-time');
       params.set('time', parsed.toISOString());
     }
     if (q.arriveBy) params.set('arriveBy', 'true');
diff --git a/server/src/nest/trip-invite/trip-invite.controller.ts b/server/src/nest/trip-invite/trip-invite.controller.ts
index ee3269493..505ea5845 100644
--- a/server/src/nest/trip-invite/trip-invite.controller.ts
+++ b/server/src/nest/trip-invite/trip-invite.controller.ts
@@ -47,7 +47,7 @@ export class TripInviteLinkController {
   ) {
     this.requireManage(tripId, user);
     const days = body?.expires_in_days != null && String(body.expires_in_days).trim() !== ''
-      ? parseInt(String(body.expires_in_days))
+      ? Number.parseInt(String(body.expires_in_days))
       : null;
     const info = this.invites.createOrRotate(tripId, user.id, Number.isFinite(days as number) ? days : null);
     this.audit.writeAudit({ userId: user.id, action: 'trip.invite_link_create', resource: tripId, ip: getClientIp(req), details: { expires_in_days: days } });
diff --git a/server/src/nest/trip-members/trip-members.controller.ts b/server/src/nest/trip-members/trip-members.controller.ts
index eef37bf91..d2a758e1b 100644
--- a/server/src/nest/trip-members/trip-members.controller.ts
+++ b/server/src/nest/trip-members/trip-members.controller.ts
@@ -84,7 +84,7 @@ export class TripMembersController {
     if (!access) {
       throw new HttpException({ error: 'Trip not found' }, 404);
     }
-    const targetId = parseInt(userId);
+    const targetId = Number.parseInt(userId);
     if (targetId !== user.id && !this.roster.can('member_manage', user.role, access.user_id, user.id, access.user_id !== user.id)) {
       throw new HttpException({ error: 'No permission to remove members' }, 403);
     }
@@ -139,7 +139,7 @@ export class TripMembersController {
   @RequireTripOwner('Only the owner can manage guests', { param: 'id' })
   renameGuest(@CurrentUser() user: User, @Param('id') id: string, @Param('userId') userId: string, @Body() body: TripRenameGuestDto) {
     try {
-      if (!this.roster.renameGuest(id, parseInt(userId), body.name)) {
+      if (!this.roster.renameGuest(id, Number.parseInt(userId), body.name)) {
         throw new HttpException({ error: 'Guest not found' }, 404);
       }
       return { success: true };
@@ -154,7 +154,7 @@ export class TripMembersController {
   @UseGuards(TripOwnerGuard)
   @RequireTripOwner('Only the owner can manage guests', { param: 'id' })
   deleteGuest(@CurrentUser() user: User, @Param('id') id: string, @Param('userId') userId: string) {
-    if (!this.roster.deleteGuest(id, parseInt(userId))) {
+    if (!this.roster.deleteGuest(id, Number.parseInt(userId))) {
       throw new HttpException({ error: 'Guest not found' }, 404);
     }
     return { success: true };
diff --git a/server/src/nest/trips/trips.mcp.ts b/server/src/nest/trips/trips.mcp.ts
index ee2057904..e9af810f9 100644
--- a/server/src/nest/trips/trips.mcp.ts
+++ b/server/src/nest/trips/trips.mcp.ts
@@ -100,12 +100,12 @@ export class TripsMcp {
     if (this.auth.isDemoUser(ctx.userId)) return demoDenied();
     if (start_date) {
       const d = new Date(start_date + 'T00:00:00Z');
-      if (isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== start_date)
+      if (Number.isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== start_date)
         return { content: [{ type: 'text' as const, text: 'start_date is not a valid calendar date.' }], isError: true };
     }
     if (end_date) {
       const d = new Date(end_date + 'T00:00:00Z');
-      if (isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== end_date)
+      if (Number.isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== end_date)
         return { content: [{ type: 'text' as const, text: 'end_date is not a valid calendar date.' }], isError: true };
     }
     if (start_date && end_date && new Date(end_date) < new Date(start_date)) {
@@ -145,12 +145,12 @@ export class TripsMcp {
     if (!this.guards.hasTripPermission('trip_edit', tripId, ctx.userId)) return permissionDenied();
     if (start_date) {
       const d = new Date(start_date + 'T00:00:00Z');
-      if (isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== start_date)
+      if (Number.isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== start_date)
         return { content: [{ type: 'text' as const, text: 'start_date is not a valid calendar date.' }], isError: true };
     }
     if (end_date) {
       const d = new Date(end_date + 'T00:00:00Z');
-      if (isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== end_date)
+      if (Number.isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== end_date)
         return { content: [{ type: 'text' as const, text: 'end_date is not a valid calendar date.' }], isError: true };
     }
     // update() re-anchors the budget before the trip row moves off the old
diff --git a/server/src/nest/vacay/vacay.controller.ts b/server/src/nest/vacay/vacay.controller.ts
index 435152cd1..40325877b 100644
--- a/server/src/nest/vacay/vacay.controller.ts
+++ b/server/src/nest/vacay/vacay.controller.ts
@@ -83,7 +83,7 @@ export class VacayController {
     @Body() body: VacayUpdateHolidayCalendarDto,
     @Headers('x-socket-id') socketId?: string,
   ) {
-    const id = parseInt(idParam);
+    const id = Number.parseInt(idParam);
     const planId = this.vacay.getActivePlanId(user.id);
     const calendar = this.vacay.updateHolidayCalendar(id, planId, body, socketId);
     if (!calendar) {
@@ -94,7 +94,7 @@ export class VacayController {
 
   @Delete('plan/holiday-calendars/:id')
   deleteHolidayCalendar(@CurrentUser() user: User, @Param('id') idParam: string, @Headers('x-socket-id') socketId?: string) {
-    const id = parseInt(idParam);
+    const id = Number.parseInt(idParam);
     const planId = this.vacay.getActivePlanId(user.id);
     if (!this.vacay.deleteHolidayCalendar(id, planId, socketId)) {
       throw new HttpException({ error: 'Calendar not found' }, 404);
@@ -109,7 +109,7 @@ export class VacayController {
     @Headers('x-socket-id') socketId?: string,
   ) {
     const planId = this.vacay.getActivePlanId(user.id);
-    const userId = body.target_user_id ? parseInt(String(body.target_user_id)) : user.id;
+    const userId = body.target_user_id ? Number.parseInt(String(body.target_user_id)) : user.id;
     if (!this.vacay.getPlanUsers(planId).find((u) => u.id === userId)) {
       throw new HttpException({ error: 'User not in plan' }, 403);
     }
@@ -187,7 +187,7 @@ export class VacayController {
 
   @Delete('years/:year')
   deleteYear(@CurrentUser() user: User, @Param('year') yearParam: string, @Headers('x-socket-id') socketId?: string) {
-    const year = parseInt(yearParam);
+    const year = Number.parseInt(yearParam);
     const planId = this.vacay.getActivePlanId(user.id);
     return { years: this.vacay.deleteYear(planId, year, socketId) };
   }
@@ -222,8 +222,8 @@ export class VacayController {
   ) {
     const planId = this.vacay.getActivePlanId(user.id);
     let userId = user.id;
-    if (body.target_user_id && parseInt(String(body.target_user_id)) !== user.id) {
-      const tid = parseInt(String(body.target_user_id));
+    if (body.target_user_id && Number.parseInt(String(body.target_user_id)) !== user.id) {
+      const tid = Number.parseInt(String(body.target_user_id));
       if (!this.vacay.getPlanUsers(planId).find((u) => u.id === tid)) {
         throw new HttpException({ error: 'User not in plan' }, 403);
       }
@@ -249,7 +249,7 @@ export class VacayController {
 
   @Get('stats/:year')
   stats(@CurrentUser() user: User, @Param('year') yearParam: string) {
-    const year = parseInt(yearParam);
+    const year = Number.parseInt(yearParam);
     const planId = this.vacay.getActivePlanId(user.id);
     return { stats: this.vacay.getStats(planId, year) };
   }
@@ -261,9 +261,9 @@ export class VacayController {
     @Body() body: VacayUpdateStatsDto,
     @Headers('x-socket-id') socketId?: string,
   ) {
-    const year = parseInt(yearParam);
+    const year = Number.parseInt(yearParam);
     const planId = this.vacay.getActivePlanId(user.id);
-    const userId = body.target_user_id ? parseInt(String(body.target_user_id)) : user.id;
+    const userId = body.target_user_id ? Number.parseInt(String(body.target_user_id)) : user.id;
     if (!this.vacay.getPlanUsers(planId).find((u) => u.id === userId)) {
       throw new HttpException({ error: 'User not in plan' }, 403);
     }
@@ -286,7 +286,7 @@ export class VacayController {
     if (!body.user_id) {
       throw new HttpException({ error: 'user_id required' }, 400);
     }
-    const result = this.vacay.shareCalendar(user.id, user.email, parseInt(String(body.user_id)), socketId);
+    const result = this.vacay.shareCalendar(user.id, user.email, Number.parseInt(String(body.user_id)), socketId);
     if (result.error) {
       throw new HttpException({ error: result.error }, result.status!);
     }
@@ -310,7 +310,7 @@ export class VacayController {
     @Body() body: VacayShareUpdateDto,
     @Headers('x-socket-id') socketId?: string,
   ) {
-    if (!this.vacay.setShareHidden(parseInt(idParam), user.id, body.hidden, socketId)) {
+    if (!this.vacay.setShareHidden(Number.parseInt(idParam), user.id, body.hidden, socketId)) {
       throw new HttpException({ error: 'Share not found' }, 404);
     }
     return { success: true };
@@ -318,7 +318,7 @@ export class VacayController {
 
   @Delete('shares/:id')
   deleteShare(@CurrentUser() user: User, @Param('id') idParam: string, @Headers('x-socket-id') socketId?: string) {
-    if (!this.vacay.removeShare(parseInt(idParam), user.id, socketId)) {
+    if (!this.vacay.removeShare(Number.parseInt(idParam), user.id, socketId)) {
       throw new HttpException({ error: 'Share not found' }, 404);
     }
     return { success: true };
diff --git a/server/src/nest/vacay/vacay.service.ts b/server/src/nest/vacay/vacay.service.ts
index 474ef7a7a..128015624 100644
--- a/server/src/nest/vacay/vacay.service.ts
+++ b/server/src/nest/vacay/vacay.service.ts
@@ -158,7 +158,7 @@ function normalizeYearType(value: unknown): 'calendar' | 'fiscal' | 'anniversary
  * ending on Jan 1 (the calendar default) stops inside the previous year.
  */
 function windowEndYear(end: string): number {
-  const y = parseInt(end.slice(0, 4), 10);
+  const y = Number.parseInt(end.slice(0, 4), 10);
   return end.endsWith('-01-01') ? y - 1 : y;
 }
 
@@ -255,8 +255,8 @@ export class VacayService {
     let day = s.year_start_day || 1;
     if (s.year_type === 'anniversary') {
       const parts = s.hire_date!.split('-');
-      month = parseInt(parts[1], 10) || 1;
-      day = parseInt(parts[2], 10) || 1;
+      month = Number.parseInt(parts[1], 10) || 1;
+      day = Number.parseInt(parts[2], 10) || 1;
     }
     month = Math.min(12, Math.max(1, month));
     // A Feb 29 hire date (or a stored Feb 30) would name a boundary that most years
@@ -272,7 +272,7 @@ export class VacayService {
    * plain calendar year, which is exactly what a 'calendar' user resolves to.
    */
   private viewerWindow(year: number | string, viewerId?: number): { start: string; end: string } {
-    const y = typeof year === 'number' ? year : parseInt(year, 10);
+    const y = typeof year === 'number' ? year : Number.parseInt(year, 10);
     // A non-numeric year matched nothing under the old date prefix; an empty range
     // matches nothing either, so a bad parameter still yields an empty result.
     if (!Number.isFinite(y)) return { start: '', end: '' };
@@ -316,8 +316,8 @@ export class VacayService {
     data: { year_type?: unknown; year_start_month?: unknown; year_start_day?: unknown; hire_date?: unknown },
   ): VacayUserSettings {
     const type = normalizeYearType(data.year_type);
-    const month = Math.min(12, Math.max(1, parseInt(String(data.year_start_month ?? 1), 10) || 1));
-    const day = Math.min(31, Math.max(1, parseInt(String(data.year_start_day ?? 1), 10) || 1));
+    const month = Math.min(12, Math.max(1, Number.parseInt(String(data.year_start_month ?? 1), 10) || 1));
+    const day = Math.min(31, Math.max(1, Number.parseInt(String(data.year_start_day ?? 1), 10) || 1));
     const hire = typeof data.hire_date === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(data.hire_date) ? data.hire_date : null;
     this.db.run(`
     INSERT INTO vacay_user_settings (user_id, year_type, year_start_month, year_start_day, hire_date)
@@ -716,8 +716,9 @@ export class VacayService {
       return {};
     });
 
-    if (result.error) return result;
-    this.notifyPlanUsers(planId, socketId, 'vacay:accepted');
+    // Only announce a fusion that actually happened — the transaction returns the
+    // refusal for an invite that was already gone.
+    if (!result.error) this.notifyPlanUsers(planId, socketId, 'vacay:accepted');
     return result;
   }
 
diff --git a/server/src/nest/weather/weather.impl.ts b/server/src/nest/weather/weather.impl.ts
index e9d4624f7..2ba7a86a8 100644
--- a/server/src/nest/weather/weather.impl.ts
+++ b/server/src/nest/weather/weather.impl.ts
@@ -49,7 +49,7 @@ async function fetchOpenMeteo(url: string): Promise<{ response: Response; data:
 function coord(value: string, max: number, label: string): number {
   // Number('') and Number('  ') are 0, which would silently geolocate the Gulf
   // of Guinea instead of failing, so an empty value is rejected outright.
-  const n = String(value ?? '').trim() === '' ? NaN : Number(value);
+  const n = String(value ?? '').trim() === '' ? Number.NaN : Number(value);
   if (!Number.isFinite(n) || Math.abs(n) > max) {
     throw new ApiError(400, `Invalid ${label}`);
   }
@@ -199,8 +199,8 @@ const TTL_CURRENT_MS  = 15 * 60 * 1000;      // 15 minutes
 const TTL_CLIMATE_MS  = 24 * 60 * 60 * 1000; // 24 hours
 
 export function cacheKey(lat: string, lng: string, date?: string): string {
-  const rlat = parseFloat(lat).toFixed(2);
-  const rlng = parseFloat(lng).toFixed(2);
+  const rlat = Number.parseFloat(lat).toFixed(2);
+  const rlng = Number.parseFloat(lng).toFixed(2);
   return `${rlat}_${rlng}_${date || 'current'}`;
 }
 
@@ -430,7 +430,7 @@ export async function getWeather(
 
   const inFlightKey = `${ck}:${lang}`;
   const existing = inFlight.get(inFlightKey);
-  if (existing) return existing;
+  if (existing !== undefined) return existing;
   const promise = _getWeatherImpl(lat, lng, date, lang, time);
   inFlight.set(inFlightKey, promise);
   try { return await promise; } finally { inFlight.delete(inFlightKey); }
@@ -601,7 +601,7 @@ export async function getDetailedWeather(
 
   const inFlightKey = `${ck}:${lang}`;
   const existing = inFlight.get(inFlightKey);
-  if (existing) return existing;
+  if (existing !== undefined) return existing;
   const promise = _getDetailedWeatherImpl(lat, lng, date, lang);
   inFlight.set(inFlightKey, promise);
   try { return await promise; } finally { inFlight.delete(inFlightKey); }
diff --git a/server/src/plugin-event-sink.ts b/server/src/plugin-event-sink.ts
index b66f80934..98006edf2 100644
--- a/server/src/plugin-event-sink.ts
+++ b/server/src/plugin-event-sink.ts
@@ -37,7 +37,7 @@ export function emitPluginEvent(tripId: number, event: string, meta?: PluginEven
 // from leaking: e.g. `budget:member-paid-updated` carries { itemId, userId } and we
 // deliberately only read itemId, never userId. Families not listed (settlement/bag
 // sub-entities, reorders, bulk position updates) yield no entityId, which is correct.
-const ENTITY_ID_KEYS: Readonly<Record<string, readonly string[]>> = {
+export const ENTITY_ID_KEYS: Readonly<Record<string, readonly string[]>> = {
   place: ['placeId', 'place.id'],
   day: ['dayId', 'day.id'],
   reservation: ['reservationId', 'reservation.id'],
diff --git a/server/src/utils/ipv6.ts b/server/src/utils/ipv6.ts
index 142221661..afa8bbf81 100644
--- a/server/src/utils/ipv6.ts
+++ b/server/src/utils/ipv6.ts
@@ -12,7 +12,10 @@
 
 /** Expand an IPv6 literal into its 8 numeric hextets, or null if not a valid IPv6. */
 export function expandIpv6(ip: string): number[] | null {
-  let h = ip.toLowerCase().replace(/%.*$/, '');
+  // Cut the zone id off (`fe80::1%eth0`): indexOf rather than a `%.*$` regex, whose
+  // greedy tail rescans the whole string once per `%` on a host that never matches.
+  const zone = ip.indexOf('%');
+  let h = (zone === -1 ? ip : ip.slice(0, zone)).toLowerCase();
   if (!h.includes(':')) return null;
   const dotted = h.match(/^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
   if (dotted) {
@@ -25,9 +28,9 @@ export function expandIpv6(ip: string): number[] | null {
   const head = halves[0] ? halves[0].split(':') : [];
   const tail = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
   const groups =
-    halves.length === 2 ? [...head, ...Array(8 - head.length - tail.length).fill('0'), ...tail] : head;
+    halves.length === 2 ? [...head, ...new Array(8 - head.length - tail.length).fill('0'), ...tail] : head;
   if (groups.length !== 8) return null;
-  const nums = groups.map((x) => (x === '' ? NaN : parseInt(x, 16)));
+  const nums = groups.map((x) => (x === '' ? Number.NaN : Number.parseInt(x, 16)));
   return nums.some((n) => !Number.isInteger(n) || n < 0 || n > 0xffff) ? null : nums;
 }
 
diff --git a/server/tests/integration/plugins/boot-registry-order.test.ts b/server/tests/integration/plugins/boot-registry-order.test.ts
new file mode 100644
index 000000000..d14532cc9
--- /dev/null
+++ b/server/tests/integration/plugins/boot-registry-order.test.ts
@@ -0,0 +1,142 @@
+/**
+ * Boot-order regression (#plugins): the RPC registry must be scanned before the
+ * runtime auto-activates the plugins an admin had enabled.
+ *
+ * The bug this pins: PluginRuntimeService booted enabled plugins from
+ * onModuleInit, and Nest fires same-module onModuleInit hooks in providers-array
+ * declaration order — where the runtime service is listed BEFORE
+ * PluginRpcRegistryService. Each boot activation builds its PluginRpcHost
+ * synchronously (bindInto snapshots the registry at construction), so every host
+ * was bound from a STILL-EMPTY registry: the plugin's first RPC on activation
+ * (typically ctx.db.migrate in onLoad) came back PERMISSION_DENIED and the plugin
+ * landed in error state on every cold boot, until an admin deactivated and
+ * reactivated it by hand. The fix moves the boot reconcile to
+ * onApplicationBootstrap, which Nest guarantees runs after EVERY module's
+ * onModuleInit — so this suite assembles a real Nest module mirroring the
+ * production declaration order (runtime provider first, registry scan later) and
+ * asserts the plugin still comes up clean.
+ */
+import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { Test } from '@nestjs/testing';
+import type { TestingModule } from '@nestjs/testing';
+
+const { testDb } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec(`CREATE TABLE plugins (
+    id TEXT PRIMARY KEY, status TEXT, enabled INTEGER DEFAULT 0, version TEXT, api_version INTEGER DEFAULT 1, permissions TEXT DEFAULT '[]', operator_egress INTEGER DEFAULT 0, granted_permissions TEXT DEFAULT '',
+    config TEXT DEFAULT '{}', dependencies TEXT DEFAULT '{}', capabilities TEXT DEFAULT '{}', last_error TEXT, updated_at TEXT,
+    trek_range TEXT DEFAULT '>=3.0.0',
+    source_repo TEXT, author_pubkey TEXT, update_block_code TEXT, update_block_detail TEXT, update_block_version TEXT);
+    CREATE TABLE plugin_error_log (id INTEGER PRIMARY KEY AUTOINCREMENT, plugin_id TEXT, level TEXT, message TEXT, ts TEXT);
+    CREATE TABLE plugin_settings_fields (plugin_id TEXT, field_key TEXT, scope TEXT, secret INTEGER);
+    CREATE TABLE settings (user_id INTEGER, key TEXT, value TEXT);
+    CREATE TABLE plugin_entity_metadata (id INTEGER PRIMARY KEY AUTOINCREMENT, plugin_id TEXT, entity_type TEXT, entity_id INTEGER, key TEXT, value TEXT, updated_at TEXT);
+    CREATE TABLE plugin_user_config (plugin_id TEXT, user_id INTEGER, field_key TEXT, value TEXT, PRIMARY KEY (plugin_id, user_id, field_key));
+    CREATE TABLE plugin_meta_migrations (plugin_id TEXT, migration_id TEXT, PRIMARY KEY (plugin_id, migration_id));
+    CREATE TABLE plugin_capability_audit (id INTEGER PRIMARY KEY AUTOINCREMENT, plugin_id TEXT, acting_user_id INTEGER, method TEXT, resource TEXT, code TEXT, ts TEXT, prev_hash TEXT, hash TEXT);
+    CREATE TABLE plugin_scheduled_tasks (id INTEGER PRIMARY KEY AUTOINCREMENT, plugin_id TEXT NOT NULL, name TEXT NOT NULL, due_at INTEGER NOT NULL, payload TEXT NOT NULL DEFAULT 'null', every_ms INTEGER, created_at TEXT DEFAULT (datetime('now')), UNIQUE(plugin_id, name));
+    CREATE TABLE plugin_user_erasure_queue (id INTEGER PRIMARY KEY AUTOINCREMENT, plugin_id TEXT NOT NULL, user_id INTEGER NOT NULL, created_at TEXT DEFAULT (datetime('now')), UNIQUE(plugin_id, user_id));
+    CREATE TABLE addons (id TEXT PRIMARY KEY, enabled INTEGER DEFAULT 0);
+    CREATE TABLE audit_log (
+      id INTEGER PRIMARY KEY AUTOINCREMENT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+      user_id INTEGER, action TEXT NOT NULL, resource TEXT, details TEXT, ip TEXT);`);
+  return { testDb: db };
+});
+vi.mock('../../../src/db/database', () => ({ db: testDb, canAccessTrip: () => undefined }));
+vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));
+
+import { db as dbConn } from '../../../src/db/database';
+import { DatabaseService } from '../../../src/nest/database/database.service';
+import { AuditService } from '../../../src/nest/audit/audit.service';
+import { AddonsService } from '../../../src/nest/addons/addons.service';
+import { PluginRuntimeService } from '../../../src/nest/plugins/plugin-runtime.service';
+import { PluginUserSettingsService } from '../../../src/nest/plugins/plugin-user-settings.service';
+import { PluginRpcHostFactory } from '../../../src/nest/plugins/host/plugin-rpc-host.factory';
+import { PluginRpcRegistry } from '../../../src/nest/plugins/host/rpc-kit/registry';
+import type { PluginRpcRegistryService } from '../../../src/nest/plugins/host/rpc-kit/registry.service';
+import { DbRpc } from '../../../src/nest/plugins/host/rpc/db.rpc';
+
+let codeRoot: string;
+let dataRoot: string;
+let mod: TestingModule;
+
+beforeAll(() => {
+  codeRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'trekplug-boot-code-'));
+  dataRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'trekplug-boot-data-'));
+  process.env.TREK_PLUGINS_DIR = codeRoot;
+  process.env.TREK_PLUGINS_DATA_DIR = dataRoot;
+  process.env.TREK_PLUGINS_ENABLED = 'true';
+
+  // The exact shape the bug bit: a plugin that runs its own-db migration as the
+  // first thing its onLoad does — what every db-backed plugin's activation looks like.
+  const dir = path.join(codeRoot, 'migrator', 'server');
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(
+    path.join(dir, 'index.js'),
+    `module.exports = { async onLoad(ctx) { await ctx.db.migrate('001', 'CREATE TABLE t (n INTEGER)'); } };`,
+  );
+  // The row a container recreate leaves behind: enabled, already consented to
+  // db:own. Seeded 'inactive' (not the 'active' a real shutdown leaves) so the
+  // poll below only terminates on a status the THIS-boot supervisor wrote.
+  testDb
+    .prepare("INSERT INTO plugins (id, status, enabled, permissions, granted_permissions, config) VALUES ('migrator','inactive',1,'[\"db:own\"]','[\"db:own\"]','{}')")
+    .run();
+});
+
+afterAll(async () => {
+  await mod?.close();
+  delete process.env.TREK_PLUGINS_DIR;
+  delete process.env.TREK_PLUGINS_DATA_DIR;
+  delete process.env.TREK_PLUGINS_ENABLED;
+  fs.rmSync(codeRoot, { recursive: true, force: true });
+  fs.rmSync(dataRoot, { recursive: true, force: true });
+});
+
+describe('plugin boot vs registry scan ordering', () => {
+  it('BOOT-REG-001 a plugin enabled before a restart activates cleanly even though the registry scan runs in a LATER provider\'s onModuleInit', async () => {
+    const dbs = new DatabaseService(dbConn);
+    const userSettings = new PluginUserSettingsService(dbs);
+    // Empty at construction — exactly what PluginRpcRegistryService is before its
+    // own onModuleInit scan has run.
+    const registry = new PluginRpcRegistry();
+    const hostFactory = new PluginRpcHostFactory(dbs, registry as unknown as PluginRpcRegistryService);
+
+    mod = await Test.createTestingModule({
+      providers: [
+        // Mirrors plugins-runtime.module.ts: the runtime service is DECLARED BEFORE
+        // the provider that populates the registry, so Nest fires its onModuleInit
+        // (if it had one) first. The boot reconcile must therefore not live there.
+        {
+          provide: PluginRuntimeService,
+          useFactory: () => new PluginRuntimeService(dbs, new AuditService(dbs), new AddonsService(dbs), userSettings, undefined, hostFactory),
+        },
+        {
+          provide: 'REGISTRY_SCAN',
+          useFactory: () => ({
+            onModuleInit() {
+              registry.register(new DbRpc(userSettings));
+            },
+          }),
+        },
+      ],
+    }).compile();
+    await mod.init();
+
+    // Boot activation is fire-and-forget; wait for the supervisor to settle the row.
+    const runtime = mod.get(PluginRuntimeService);
+    let row = { status: 'starting', last_error: null as string | null };
+    for (let i = 0; i < 100; i++) {
+      row = testDb.prepare("SELECT status, last_error FROM plugins WHERE id='migrator'").get() as typeof row;
+      if (row.status === 'active' || row.status === 'error') break;
+      await new Promise((r) => setTimeout(r, 50));
+    }
+
+    expect(row.last_error).toBeNull();
+    expect(row.status).toBe('active');
+    expect(runtime.isActive('migrator')).toBe(true);
+  });
+});
diff --git a/server/tests/integration/plugins/plugin-runtime.test.ts b/server/tests/integration/plugins/plugin-runtime.test.ts
index 2ef14e2f3..0ce24c5ba 100644
--- a/server/tests/integration/plugins/plugin-runtime.test.ts
+++ b/server/tests/integration/plugins/plugin-runtime.test.ts
@@ -12,7 +12,7 @@ const { testDb } = vi.hoisted(() => {
   const Database = require('better-sqlite3');
   const db = new Database(':memory:');
   db.exec(`CREATE TABLE plugins (
-    id TEXT PRIMARY KEY, status TEXT, enabled INTEGER DEFAULT 0, version TEXT, permissions TEXT DEFAULT '[]', operator_egress INTEGER DEFAULT 0, granted_permissions TEXT DEFAULT '',
+    id TEXT PRIMARY KEY, status TEXT, enabled INTEGER DEFAULT 0, version TEXT, api_version INTEGER DEFAULT 1, permissions TEXT DEFAULT '[]', operator_egress INTEGER DEFAULT 0, granted_permissions TEXT DEFAULT '',
     config TEXT DEFAULT '{}', dependencies TEXT DEFAULT '{}', capabilities TEXT DEFAULT '{}', last_error TEXT, updated_at TEXT,
     -- Activation refuses a plugin that declares no TREK range, so the fixtures default to a
     -- satisfied one: these tests are about permissions/dependencies, and every row would
@@ -148,9 +148,9 @@ describe('PluginRuntimeService (M2 end-to-end)', () => {
     // first activate is covered by the 'counter' happy-path test above.)
   });
 
-  it('onModuleInit is a no-op when the runtime is disabled', () => {
+  it('onApplicationBootstrap is a no-op when the runtime is disabled', () => {
     process.env.TREK_PLUGINS_ENABLED = 'false';
-    expect(() => createPluginRuntime(new DatabaseService(dbConn)).onModuleInit()).not.toThrow();
+    expect(() => createPluginRuntime(new DatabaseService(dbConn)).onApplicationBootstrap()).not.toThrow();
     process.env.TREK_PLUGINS_ENABLED = 'true';
   });
 
@@ -246,26 +246,26 @@ describe('PluginRuntimeService (M2 end-to-end)', () => {
     expect(testDb.prepare("SELECT COUNT(*) c FROM plugin_user_erasure_queue WHERE plugin_id='counter' AND user_id=9").get()).toMatchObject({ c: 0 });
   });
 
-  it('onModuleInit boots every ENABLED plugin — even one left in error state', async () => {
+  it('onApplicationBootstrap boots every ENABLED plugin — even one left in error state', async () => {
     fs.mkdirSync(path.join(codeRoot, 'booter', 'server'), { recursive: true });
     fs.writeFileSync(path.join(codeRoot, 'booter', 'server', 'index.js'), 'module.exports = { async onLoad() {} };');
     // status='error' from a previous crash, but enabled=1 → must still boot
     testDb.prepare("INSERT INTO plugins (id, status, enabled, granted_permissions, config) VALUES ('booter','error',1,'[]','{}')").run();
 
     const rt = createPluginRuntime(new DatabaseService(dbConn));
-    rt.onModuleInit(); // fire-and-forget spawn
+    rt.onApplicationBootstrap(); // fire-and-forget spawn
     for (let i = 0; i < 40 && !rt.isActive('booter'); i++) await new Promise((r) => setTimeout(r, 50));
     expect(rt.isActive('booter')).toBe(true);
     await rt.deactivate('booter');
   });
 
-  it('onModuleInit does NOT boot a disabled plugin', async () => {
+  it('onApplicationBootstrap does NOT boot a disabled plugin', async () => {
     fs.mkdirSync(path.join(codeRoot, 'sleeper', 'server'), { recursive: true });
     fs.writeFileSync(path.join(codeRoot, 'sleeper', 'server', 'index.js'), 'module.exports = { async onLoad() {} };');
     testDb.prepare("INSERT INTO plugins (id, status, enabled, granted_permissions, config) VALUES ('sleeper','inactive',0,'[]','{}')").run();
 
     const rt = createPluginRuntime(new DatabaseService(dbConn));
-    rt.onModuleInit();
+    rt.onApplicationBootstrap();
     await new Promise((r) => setTimeout(r, 300));
     expect(rt.isActive('sleeper')).toBe(false);
   });
@@ -701,7 +701,7 @@ describe('TREK host-version gating', () => {
     process.env.APP_VERSION = '4.0.0';
     seedRanged('boot-broken', '>=3.2.0 <4.0.0', 1);
     const rt = createPluginRuntime(new DatabaseService(dbConn));
-    expect(() => rt.onModuleInit()).not.toThrow();
+    expect(() => rt.onApplicationBootstrap()).not.toThrow();
     for (let i = 0; i < 40; i++) {
       const row = testDb.prepare("SELECT enabled FROM plugins WHERE id='boot-broken'").get() as { enabled: number };
       if (row.enabled === 0) break;
@@ -722,3 +722,39 @@ describe('TREK host-version gating', () => {
     cleanup('both-wrong');
   });
 });
+
+/**
+ * The activation gate also refuses a plugin whose manifest `apiVersion` is newer than
+ * what this TREK's plugin-API surface supports (`PLUGIN_API_VERSION`) — mirrors the
+ * TREK-version gate above, just for the plugin-API surface instead of the host version.
+ */
+describe('plugin-API version gating', () => {
+  const seedApi = (id: string, apiVersion: number) => {
+    fs.mkdirSync(path.join(codeRoot, id, 'server'), { recursive: true });
+    fs.writeFileSync(path.join(codeRoot, id, 'server', 'index.js'), 'module.exports = { async onLoad() {} };');
+    testDb
+      .prepare(
+        "INSERT INTO plugins (id, status, enabled, permissions, granted_permissions, config, trek_range, api_version) VALUES (?, 'inactive', 0, '[]', '[]', '{}', '>=3.0.0', ?)",
+      )
+      .run(id, apiVersion);
+  };
+  const cleanup = (...ids: string[]) => { for (const id of ids) testDb.prepare('DELETE FROM plugins WHERE id = ?').run(id); };
+
+  it('refuses to activate a plugin whose apiVersion this TREK does not support', async () => {
+    seedApi('future-api', 2);
+    const err = await createPluginRuntime(new DatabaseService(dbConn)).activate('future-api').catch((e) => e);
+    expect(err).toBeInstanceOf(PluginDependencyError);
+    expect(err).toMatchObject({ code: 'API_VERSION_INCOMPATIBLE' });
+    expect(err.message).toBe('plugin requires plugin-API v2; this TREK supports v1');
+    cleanup('future-api');
+  });
+
+  it('activates normally when apiVersion is within what this TREK supports', async () => {
+    seedApi('current-api', 1);
+    const rt = createPluginRuntime(new DatabaseService(dbConn));
+    await rt.activate('current-api');
+    expect(rt.isActive('current-api')).toBe(true);
+    await rt.deactivate('current-api');
+    cleanup('current-api');
+  });
+});
diff --git a/server/tests/integration/plugins/registry.test.ts b/server/tests/integration/plugins/registry.test.ts
index 8215ef00f..8facfd85f 100644
--- a/server/tests/integration/plugins/registry.test.ts
+++ b/server/tests/integration/plugins/registry.test.ts
@@ -23,7 +23,7 @@ const { testDb } = vi.hoisted(() => {
     CREATE TABLE plugins (id TEXT PRIMARY KEY, name TEXT, description TEXT, type TEXT, icon TEXT, version TEXT,
       api_version INTEGER, min_trek_version TEXT, trek_range TEXT, permissions TEXT, capabilities TEXT DEFAULT '{}', dependencies TEXT DEFAULT '{}', operator_egress INTEGER DEFAULT 0, granted_permissions TEXT, status TEXT, enabled INTEGER DEFAULT 0, config TEXT,
       source_repo TEXT, source_commit TEXT, sha256 TEXT, reviewed_at TEXT, author_pubkey TEXT, updated_at TEXT,
-      update_block_code TEXT, update_block_detail TEXT, update_block_version TEXT);
+      update_block_code TEXT, update_block_detail TEXT, update_block_version TEXT, update_hold INTEGER NOT NULL DEFAULT 0);
     CREATE TABLE plugin_settings_fields (plugin_id TEXT, field_key TEXT, label TEXT, input_type TEXT, placeholder TEXT, hint TEXT, required INTEGER, secret INTEGER, scope TEXT, options TEXT, oauth_config TEXT, sort_order INTEGER);
     CREATE TABLE plugin_error_log (id INTEGER PRIMARY KEY AUTOINCREMENT, plugin_id TEXT, level TEXT, message TEXT, ts TEXT);`);
   return { testDb: db };
@@ -257,6 +257,123 @@ describe('PluginRegistryService', () => {
     await expect(svc.detail('ghost')).rejects.toThrow(RegistryError);
   });
 
+  // The per-plugin update hold: a DELIBERATE non-latest install excludes the plugin from
+  // the update banner until the admin resumes updates or lands back on the newest
+  // compatible version. Dependency resolution pins versions too, but never deliberately —
+  // the `explicit` flag is what separates the two.
+  describe('recomputeUpdateHold', () => {
+    const twoVersions = {
+      schemaVersion: 1,
+      plugins: [
+        {
+          id: 'flight-tracker', name: 'Flight', author: 'Acme', description: 'flights', repo: 'acme/trek-flight', type: 'widget',
+          versions: [
+            { version: '2.0.0', gitTag: 'v2.0.0', commitSha: 'b'.repeat(40), downloadUrl: 'https://x/2', sha256: '2'.repeat(64) },
+            { version: '1.0.0', gitTag: 'v1.0.0', commitSha: 'd'.repeat(40), downloadUrl: 'https://x/1', sha256: '0'.repeat(64) },
+          ],
+        },
+      ],
+    };
+    const seedRow = (hold = 0) =>
+      testDb.prepare("INSERT INTO plugins (id, status, enabled, update_hold) VALUES ('flight-tracker','inactive',0,?)").run(hold);
+    const holdInDb = () =>
+      (testDb.prepare("SELECT update_hold FROM plugins WHERE id='flight-tracker'").get() as { update_hold: number }).update_hold;
+
+    beforeEach(() => {
+      vi.stubGlobal('fetch', vi.fn(async () => ({ ok: true, json: async () => twoVersions }) as unknown as Response));
+      __clearRegistryCacheForTests();
+    });
+
+    it('holds when the admin explicitly picked an older version', async () => {
+      seedRow();
+      await expect(svc.recomputeUpdateHold('flight-tracker', '1.0.0', true)).resolves.toBe(true);
+      expect(holdInDb()).toBe(1);
+    });
+
+    it('does not hold when the explicit pick IS the newest compatible version', async () => {
+      seedRow(1);
+      await expect(svc.recomputeUpdateHold('flight-tracker', '2.0.0', true)).resolves.toBe(false);
+      expect(holdInDb()).toBe(0);
+    });
+
+    // The comparison is against the newest version THIS TREK can run, not the newest
+    // published one. Both fixtures above leave `trek` unset, so every version is
+    // compatible and the two readings agree; only a version this host must skip tells
+    // them apart. Getting it wrong stamps a hold on an admin who picked the best
+    // available version, and the row silently leaves the banner and "Update all".
+    it('does not hold when a newer version exists but this TREK cannot run it', async () => {
+      const withIncompatibleNewest = {
+        schemaVersion: 1,
+        plugins: [
+          {
+            ...twoVersions.plugins[0],
+            versions: [
+              { version: '3.0.0', gitTag: 'v3.0.0', commitSha: 'c'.repeat(40), downloadUrl: 'https://x/3', sha256: '3'.repeat(64), trek: '>=4.0.0' },
+              ...twoVersions.plugins[0].versions,
+            ],
+          },
+        ],
+      };
+      process.env.APP_VERSION = '3.3.0';
+      vi.stubGlobal('fetch', vi.fn(async () => ({ ok: true, json: async () => withIncompatibleNewest }) as unknown as Response));
+      __clearRegistryCacheForTests();
+      try {
+        seedRow(1);
+        await expect(svc.recomputeUpdateHold('flight-tracker', '2.0.0', true)).resolves.toBe(false);
+        expect(holdInDb()).toBe(0);
+      } finally {
+        delete process.env.APP_VERSION;
+      }
+    });
+
+    it('a non-deliberate update clears a stale hold', async () => {
+      seedRow(1);
+      await expect(svc.recomputeUpdateHold('flight-tracker', '2.0.0', false)).resolves.toBe(false);
+      expect(holdInDb()).toBe(0);
+    });
+
+    it('an unresolvable registry never sets a hold', async () => {
+      seedRow();
+      vi.stubGlobal('fetch', vi.fn(async () => { throw new Error('offline'); }));
+      __clearRegistryCacheForTests();
+      await expect(svc.recomputeUpdateHold('flight-tracker', '1.0.0', true)).resolves.toBe(false);
+      expect(holdInDb()).toBe(0);
+    });
+  });
+
+  // The version picker's data: every published version, each with its OWN server-computed
+  // compat verdict — the client has no semver and must never re-derive range logic.
+  it('detail lists every published version with its own compat verdict', async () => {
+    process.env.APP_VERSION = '3.3.0';
+    const multi = {
+      schemaVersion: 1,
+      plugins: [
+        {
+          id: 'flight-tracker', name: 'Flight', author: 'Acme', description: 'flights', repo: 'acme/trek-flight',
+          type: 'widget', authorPublicKey: 'K'.repeat(44),
+          versions: [
+            { version: '2.0.0', gitTag: 'v2.0.0', commitSha: 'b'.repeat(40), downloadUrl: 'https://x/2', sha256: '2'.repeat(64), trek: '>=4.0.0', publishedAt: '2026-08-01', size: 2048, signature: 'sig2' },
+            { version: '1.5.0', gitTag: 'v1.5.0', commitSha: 'c'.repeat(40), downloadUrl: 'https://x/15', sha256: '1'.repeat(64), trek: '>=3.0.0 <4.0.0', publishedAt: '2026-07-01', size: 1024 },
+            { version: '1.0.0', gitTag: 'v1.0.0', commitSha: 'd'.repeat(40), downloadUrl: 'https://x/1', sha256: '0'.repeat(64), minTrekVersion: '3.0.0' },
+          ],
+        },
+      ],
+    };
+    vi.stubGlobal('fetch', vi.fn(async () => ({ ok: true, json: async () => multi }) as unknown as Response));
+    __clearRegistryCacheForTests();
+    try {
+      const d = (await svc.detail('flight-tracker')) as { versions: unknown };
+      expect(d.versions).toEqual([
+        { version: '2.0.0', publishedAt: '2026-08-01', size: 2048, signed: true, trek: '>=4.0.0', compatible: false },
+        { version: '1.5.0', publishedAt: '2026-07-01', size: 1024, signed: false, trek: '>=3.0.0 <4.0.0', compatible: true },
+        // A legacy entry composes its requirement from the min/max bounds it has.
+        { version: '1.0.0', publishedAt: null, size: null, signed: false, trek: '>=3.0.0', compatible: true },
+      ]);
+    } finally {
+      delete process.env.APP_VERSION;
+    }
+  });
+
   it('fetchRegistry soft-fails to an empty registry on a cold cache', async () => {
     __clearRegistryCacheForTests();
     vi.stubGlobal('fetch', vi.fn(async () => { throw new Error('offline'); }));
@@ -824,6 +941,14 @@ describe('TREK-version gating on install', () => {
       const bytes = makeArtifact({ id: 'my-upload', name: 'Up', version: '1.0.0', type: 'integration', trek: undefined });
       expect(() => svc.stageUpload(bytes)).toThrow(/missing "trek"/);
     });
+
+    it('refuses an uploaded archive declaring apiVersion 2 (this TREK only speaks plugin-API v1), and writes nothing to the plugin code dir', () => {
+      // trek range is satisfiable on its own — parseManifest's apiVersion check must
+      // fire (and stop the upload) before assertHostCompatible is ever reached.
+      const bytes = makeArtifact({ id: 'my-upload', name: 'Up', version: '1.0.0', type: 'integration', apiVersion: 2 });
+      expect(() => svc.stageUpload(bytes)).toThrow('plugin requires plugin-API v2; this TREK supports v1');
+      expect(fs.existsSync(path.join(codeRoot, 'my-upload'))).toBe(false);
+    });
   });
 
   it('installWithDependencies installs the version it RESOLVED, not versions[0]', async () => {
diff --git a/server/tests/unit/db/budget-ticket-json-migration.test.ts b/server/tests/unit/db/budget-ticket-json-migration.test.ts
index 4d5c091db..ec47799bb 100644
--- a/server/tests/unit/db/budget-ticket-json-migration.test.ts
+++ b/server/tests/unit/db/budget-ticket-json-migration.test.ts
@@ -63,8 +63,11 @@ describe('budget_items ticket_json migration', () => {
 describe('recovering what the case-insensitive match destroyed', () => {
   /**
    * A database that already ran the buggy step: migrated to the tip, then wound
-   * back one version so only the recovery step is left to run — which is exactly
-   * what an existing install does on the next boot.
+   * back to just before the recovery step so it runs again — which is exactly
+   * what an existing install does on the next boot. The wind-back target is the
+   * recovery step's ABSOLUTE version (the array is append-only and
+   * index-addressed, so it never moves); anything appended after it replays too,
+   * which every later migration must tolerate anyway.
    */
   function makeDamagedDb(): Database.Database {
     const db = new Database(':memory:');
@@ -85,8 +88,8 @@ describe('recovering what the case-insensitive match destroyed', () => {
     db.prepare('INSERT INTO budget_items (id, trip_id, name, note, ticket_json) VALUES (?, ?, ?, ?, ?)')
       .run(3, 1, 'Taxi', 'split at the hotel', '{"items":[]}');
 
-    const version = (db.prepare('SELECT version FROM schema_version LIMIT 1').get() as { version: number }).version;
-    db.prepare('UPDATE schema_version SET version = ?').run(version - 1);
+    // 196 = the version just before the recovery step (migration #197).
+    db.prepare('UPDATE schema_version SET version = ?').run(196);
     return db;
   }
 
diff --git a/server/tests/unit/nest/admin.controller.test.ts b/server/tests/unit/nest/admin.controller.test.ts
index daffb4c35..b8f718221 100644
--- a/server/tests/unit/nest/admin.controller.test.ts
+++ b/server/tests/unit/nest/admin.controller.test.ts
@@ -153,12 +153,12 @@ describe('AdminController error envelope fallbacks', () => {
 });
 
 describe('AdminController read-only getters', () => {
-  it('return service values verbatim', () => {
+  it('return service values verbatim', async () => {
     expect(adminCtl(svc({ resetUserPasskeys: vi.fn().mockReturnValue({ email: 'a@b.c', deleted: 2 }) } as Partial<AdminService>)).resetUserPasskeys(user, '4', req)).toEqual({ success: true, deleted: 2 });
     expect(adminCtl(svc({ getStats: vi.fn().mockReturnValue({ users: 3 }) } as Partial<AdminService>)).stats()).toEqual({ users: 3 });
     expect(adminCtl(svc({ getPermissions: vi.fn().mockReturnValue({ a: 1 }) } as Partial<AdminService>)).permissions()).toEqual({ a: 1 });
     expect(adminCtl(svc({ getAuditLog: vi.fn().mockReturnValue({ entries: [] }) } as Partial<AdminService>)).auditLog({})).toEqual({ entries: [] });
-    expect(adminCtl(svc({ checkVersion: vi.fn().mockResolvedValue({ current: '1' }) } as Partial<AdminService>)).versionCheck()).resolves.toEqual({ current: '1' });
+    await expect(adminCtl(svc({ checkVersion: vi.fn().mockResolvedValue({ current: '1' }) } as Partial<AdminService>)).versionCheck()).resolves.toEqual({ current: '1' });
     expect(adminCtl(svc(), undefined, undefined, {}, { listInvites: vi.fn().mockReturnValue([{ id: 1 }]) }).listInvites()).toEqual({ invites: [{ id: 1 }] });
     expect(adminCtl(svc({ listAddons: vi.fn().mockReturnValue([{ id: 'mcp' }]) } as Partial<AdminService>)).listAddons()).toEqual({ addons: [{ id: 'mcp' }] });
     expect(adminCtl(svc(), undefined, undefined, { listAllMcpTokens: vi.fn().mockReturnValue([{ id: 1 }]) }).listMcpTokens()).toEqual({ tokens: [{ id: 1 }] });
diff --git a/server/tests/unit/nest/booking-import/kitinerary-extractor.service.test.ts b/server/tests/unit/nest/booking-import/kitinerary-extractor.service.test.ts
index 1ebf54290..cfd21e0ea 100644
--- a/server/tests/unit/nest/booking-import/kitinerary-extractor.service.test.ts
+++ b/server/tests/unit/nest/booking-import/kitinerary-extractor.service.test.ts
@@ -8,11 +8,11 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
  * at all, and every branch that resolves it is a filesystem lookup that behaves
  * differently on the three platforms TREK ships to.
  */
-const { existsSync, readdirSync, readEnv, execSync, execFile } = vi.hoisted(() => ({
+const { existsSync, readdirSync, readEnv, execFileSync, execFile } = vi.hoisted(() => ({
   existsSync: vi.fn(),
   readdirSync: vi.fn(),
   readEnv: vi.fn(),
-  execSync: vi.fn(),
+  execFileSync: vi.fn(),
   // A plain function, because the service promisifies it at module load.
   execFile: vi.fn(),
 }));
@@ -23,16 +23,23 @@ vi.mock('node:fs', () => ({
   writeFileSync: vi.fn(),
   unlinkSync: vi.fn(),
 }));
-// The last branch of the probe shells out. Unmocked, the suite spawns a real
-// process on every machine and comes back green-or-red depending on whether the
-// developer happens to have KItinerary installed.
-vi.mock('node:child_process', () => ({ execSync, execFile }));
+// The last branch of the probe runs the candidate to see whether it works.
+// Unmocked, the suite spawns a real process on every machine and comes back
+// green-or-red depending on whether the developer happens to have KItinerary
+// installed.
+vi.mock('node:child_process', () => ({ execFileSync, execFile }));
 vi.mock('../../../../src/app-config', () => ({ readEnv }));
 
+import { join } from 'node:path';
 import { KitineraryExtractorService } from '../../../../src/nest/booking-import/kitinerary-extractor.service';
 
-function boot(env: { kitineraryExtractorPath?: string } = {}) {
-  readEnv.mockReturnValue({ integrations: env });
+// The probe builds candidates with path.join, so the expectations have to as
+// well — on Windows the separator is a backslash and a hardcoded '/usr/...'
+// string would never match.
+const onPath = (dir: string) => join(dir, 'kitinerary-extractor');
+
+function boot(env: { kitineraryExtractorPath?: string; searchPath?: string[] } = {}) {
+  readEnv.mockReturnValue({ integrations: { searchPath: [], ...env } });
   const svc = new KitineraryExtractorService();
   svc.onModuleInit();
   return svc;
@@ -42,7 +49,7 @@ beforeEach(() => {
   vi.clearAllMocks();
   existsSync.mockReturnValue(false);
   readdirSync.mockReturnValue([]);
-  execSync.mockImplementation(() => { throw new Error('command not found'); });
+  execFileSync.mockImplementation(() => { throw new Error('command not found'); });
 });
 
 describe('KitineraryExtractorService binary probe', () => {
@@ -79,9 +86,41 @@ describe('KitineraryExtractorService binary probe', () => {
     await expect(boot().extract(Buffer.from(''), 'x.pdf')).rejects.toThrow('not available');
   });
 
-  it('KIT-EXT-007: falls back to the binary on PATH when nothing is on disk', () => {
-    execSync.mockReturnValue(Buffer.from(''));
-    expect(boot().isAvailable()).toBe(true);
-    expect(execSync).toHaveBeenCalledWith('kitinerary-extractor --version', expect.objectContaining({ timeout: 3000 }));
+  it('KIT-EXT-007: falls back to a binary on the search path when nothing is on disk', () => {
+    existsSync.mockImplementation((p: string) => p === onPath('/usr/local/bin'));
+    execFileSync.mockReturnValue(Buffer.from(''));
+
+    expect(boot({ searchPath: ['/usr/local/bin'] }).isAvailable()).toBe(true);
+    expect(execFileSync).toHaveBeenCalledWith(
+      onPath('/usr/local/bin'), ['--version'], expect.objectContaining({ timeout: 3000 }),
+    );
+  });
+
+  it('KIT-EXT-008: stores the absolute path, never the bare name', async () => {
+    existsSync.mockImplementation((p: string) => p === onPath('/opt/tools'));
+    execFileSync.mockReturnValue(Buffer.from(''));
+    execFile.mockImplementation((_b: string, _a: string[], _o: unknown, cb: (e: null, r: unknown) => void) =>
+      cb(null, { stdout: '[]', stderr: '' }));
+
+    // An unqualified name would be re-resolved through PATH on every extraction,
+    // so what the probe stores has to be the concrete file it verified.
+    await boot({ searchPath: ['/opt/tools'] }).extract(Buffer.from(''), 'x.pdf');
+
+    expect(execFile).toHaveBeenCalledWith(
+      onPath('/opt/tools'), [expect.any(String)], expect.anything(), expect.anything(),
+    );
+  });
+
+  it('KIT-EXT-009: a search-path entry that exists but will not run is skipped', () => {
+    existsSync.mockReturnValue(true);
+    execFileSync.mockImplementation((bin: string) => {
+      if (bin === onPath('/broken')) throw new Error('not executable');
+      return Buffer.from('');
+    });
+
+    expect(boot({ searchPath: ['/broken', '/good'] }).isAvailable()).toBe(true);
+    expect(execFileSync).toHaveBeenLastCalledWith(
+      onPath('/good'), ['--version'], expect.anything(),
+    );
   });
 });
diff --git a/server/tests/unit/nest/calendar.service.test.ts b/server/tests/unit/nest/calendar.service.test.ts
index cf04e4e77..ff172f490 100644
--- a/server/tests/unit/nest/calendar.service.test.ts
+++ b/server/tests/unit/nest/calendar.service.test.ts
@@ -1138,7 +1138,7 @@ describe('foldICS', () => {
 
     const folded = foldICS(line);
 
-    expect(folded).not.toContain('�');
+    expect(folded).not.toContain('\uFFFD');
     expect(unfold(folded)).toBe(line);
     for (const part of folded.split('\r\n')) expect(octets(part)).toBeLessThanOrEqual(75);
   });
@@ -1150,7 +1150,7 @@ describe('foldICS', () => {
 
     const folded = foldICS(line);
 
-    expect(folded).not.toContain('�');
+    expect(folded).not.toContain('\uFFFD');
     expect(unfold(folded)).toBe(line);
     for (const part of folded.split('\r\n')) expect(octets(part)).toBeLessThanOrEqual(75);
   });
diff --git a/server/tests/unit/nest/compare.test.ts b/server/tests/unit/nest/compare.test.ts
new file mode 100644
index 000000000..ffcdb94b2
--- /dev/null
+++ b/server/tests/unit/nest/compare.test.ts
@@ -0,0 +1,43 @@
+/**
+ * byCodeUnit restates what a bare `.sort()` already did, so the contract is
+ * "identical to the default order" — and that is what these check, against the
+ * default rather than against hand-written expectations.
+ */
+import { describe, it, expect } from 'vitest';
+import { byCodeUnit } from '../../../src/nest/common/compare';
+
+describe('byCodeUnit', () => {
+  it('CMP-001: reports less, greater and equal', () => {
+    expect(byCodeUnit('a', 'b')).toBe(-1);
+    expect(byCodeUnit('b', 'a')).toBe(1);
+    expect(byCodeUnit('a', 'a')).toBe(0);
+  });
+
+  it('CMP-002: orders ISO dates chronologically, which is why the callers can use it', () => {
+    expect(['2026-03-01', '2026-01-15', '2026-02-28'].sort(byCodeUnit))
+      .toEqual(['2026-01-15', '2026-02-28', '2026-03-01']);
+  });
+
+  it('CMP-003: reproduces the default sort exactly for the ASCII the callers pass', () => {
+    const samples = [
+      ['EUR', 'usd', 'CHF', 'JPY'],
+      ['b', 'A', 'a', 'B', ''],
+      ['plugin:one', 'plugin:One', 'plugin:1', 'plugin:'],
+      ['2026-01-01', '2026-1-1', '2026-01-1'],
+      ['x'],
+      [],
+    ];
+    for (const sample of samples) {
+      expect([...sample].sort(byCodeUnit)).toEqual([...sample].sort());
+    }
+  });
+
+  it('CMP-004: is NOT locale-aware — the reason the doc comment warns callers off names', () => {
+    // Code-unit order files every accented word behind the whole ASCII range.
+    // A list a person reads wants localeCompare instead; this asserts the
+    // difference so nobody reaches for byCodeUnit there by accident.
+    expect(['Zelt', 'Übernachtung'].sort(byCodeUnit)).toEqual(['Zelt', 'Übernachtung']);
+    expect(['Zelt', 'Übernachtung'].sort((a, b) => a.localeCompare(b, 'de')))
+      .toEqual(['Übernachtung', 'Zelt']);
+  });
+});
diff --git a/server/tests/unit/nest/journey-domain.service.test.ts b/server/tests/unit/nest/journey-domain.service.test.ts
index a9c7f3373..b6d445715 100644
--- a/server/tests/unit/nest/journey-domain.service.test.ts
+++ b/server/tests/unit/nest/journey-domain.service.test.ts
@@ -1161,8 +1161,12 @@ describe('onPlaceDeleted', () => {
     const trip = createTrip(testDb, user.id, { title: 'Unlinked' });
     const place = createPlace(testDb, trip.id, { name: 'Nowhere' });
 
-    // Should not throw
-    svc.onPlaceDeleted(place.id);
+    expect(() => svc.onPlaceDeleted(place.id)).not.toThrow();
+
+    const orphaned = testDb.prepare(
+      "SELECT COUNT(*) AS n FROM journey_entries WHERE source_place_id = ?"
+    ).get(place.id) as { n: number };
+    expect(orphaned.n).toBe(0);
   });
 });
 
diff --git a/server/tests/unit/nest/llm-parse/text-extract.test.ts b/server/tests/unit/nest/llm-parse/text-extract.test.ts
index 3682f9c6d..9396a0d95 100644
--- a/server/tests/unit/nest/llm-parse/text-extract.test.ts
+++ b/server/tests/unit/nest/llm-parse/text-extract.test.ts
@@ -226,4 +226,75 @@ describe('text-extract', () => {
       expect(out).toContain('Zimmer für zwei – 120,00 €');
     });
   });
+
+  describe('pdf page markers', () => {
+    const fromPdf = async (text: string) => {
+      getText.mockResolvedValueOnce({ text });
+      return extractText(Buffer.from('%PDF-1.4'), 'a.pdf');
+    };
+
+    it('drops a marker together with the blank lines around it', async () => {
+      expect(await fromPdf('Hotel Ibis\n\n\n--- 3 of 12 ---\n\n\nCheck-in 04.08.')).toBe(
+        'Hotel Ibis\n\nCheck-in 04.08.',
+      );
+    });
+
+    it('drops a marker that opens or closes the document', async () => {
+      expect(await fromPdf('--- 1 of 2 ---\nBoarding pass')).toBe('Boarding pass');
+      expect(await fromPdf('Rechnung\n--- 4 of 4 ---')).toBe('Rechnung');
+    });
+
+    it('drops an indented marker, spaces or non-breaking ones', async () => {
+      expect(await fromPdf('Gate 12\n    --- 2 of 12 ---\nSeat 4A')).toBe('Gate 12\n\nSeat 4A');
+      expect(await fromPdf('Gate 12\n  --- 2 of 12 ---\nSeat 4A')).toBe('Gate 12\n\nSeat 4A');
+    });
+
+    it('reads the marker case-insensitively and across CRLF line ends', async () => {
+      expect(await fromPdf('Zimmer 12\r\n\r\n-- 1 OF 9 --\r\nAnreise')).toBe('Zimmer 12\r\nAnreise');
+    });
+
+    it('clears every marker of a multi-page document and still de-kerns the text', async () => {
+      const pages = 'A M S T E R D A M\n--- 1 of 3 ---\nGate  12\n-- 2 of 3 --\nSeat 4A\n--- 3 of 3 ---';
+      expect(await fromPdf(pages)).toBe('AMSTERDAM\n\nGate 12\n\nSeat 4A');
+    });
+
+    it('keeps dashed lines that only look like a marker', async () => {
+      const kept = [
+        'Total -- 3 of 4 --', // not at the start of its line
+        'Summe\n--- 3 of 4 --- netto', // something else follows on the line
+        'Summe\n--- 3of 4 ---\nX', // no gap behind the page number
+        'Summe\n--- 3 on 4 ---\nX',
+        'Summe\n--- 3 of4 ---\nX',
+        'Summe\n--- 3 of vier ---\nX',
+        'Summe\n--- 3 of 4\nX', // nothing closes it
+        'Summe\n--- keine Zahl ---\nX',
+        'Summe\n----------\nX',
+      ];
+      for (const text of kept) expect(await fromPdf(text)).toBe(text);
+    });
+
+    it('stays linear on a page that is nothing but whitespace', async () => {
+      const started = Date.now();
+      expect(await fromPdf(' \n'.repeat(50000))).toBe('');
+      // The pattern this replaced walked the whole run again from every line
+      // start and needed ~4 s for these 100k characters.
+      expect(Date.now() - started).toBeLessThan(1000);
+    });
+  });
+  describe('tag stripping keeps the old regex edge cases', () => {
+    it('leaves an empty `<>` alone, because `[^>]+` had nothing to match', async () => {
+      expect(await extractText(Buffer.from('a<>b<p>c</p>'), 'a.html')).toBe('a<>b c');
+    });
+
+    it('keeps a `<` that nothing closes at all as literal text', async () => {
+      expect(await extractText(Buffer.from('3 < 4'), 'a.html')).toBe('3 < 4');
+    });
+
+    it('treats a `<` inside a tag as content, the way the regex did', async () => {
+      // `[^>]` matches `<` too, so `< 4 and <b>` is ONE tag, not a stray `<`
+      // followed by a `<b>`. Narrowing the class would split it and leave the
+      // first `<` behind — a different sanitiser output on malformed markup.
+      expect(await extractText(Buffer.from('3 < 4 and <b>5</b>'), 'a.html')).toBe('3 5');
+    });
+  });
 });
diff --git a/server/tests/unit/nest/mailer.service.test.ts b/server/tests/unit/nest/mailer.service.test.ts
new file mode 100644
index 000000000..e50a489cf
--- /dev/null
+++ b/server/tests/unit/nest/mailer.service.test.ts
@@ -0,0 +1,146 @@
+/**
+ * mailer.service.test.ts
+ *
+ * Covers the SMTP transport options MailerService hands to nodemailer, and in
+ * particular the skip-TLS opt-out: it must stay reachable for operators behind an
+ * internal relay, and it must announce itself instead of downgrading quietly.
+ * Constructed directly (no TestingModule, repo convention).
+ */
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    canAccessTrip: () => undefined,
+    isOwner: () => false,
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+const { sendMail, createTransport } = vi.hoisted(() => {
+  const send = vi.fn().mockResolvedValue({ messageId: 'test' });
+  return {
+    sendMail: send,
+    createTransport: vi.fn((_options: Record<string, unknown>) => ({ sendMail: send })),
+  };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('nodemailer', () => ({ default: { createTransport } }));
+vi.mock('../../../src/nest/audit/audit-log.logger', () => ({
+  logInfo: vi.fn(),
+  logDebug: vi.fn(),
+  logError: vi.fn(),
+  logWarn: vi.fn(),
+}));
+
+import { describe, it, expect, beforeAll, beforeEach, afterAll, vi } from 'vitest';
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { MailerService } from '../../../src/nest/notifications/mailer/mailer.service';
+import { DatabaseService } from '../../../src/nest/database/database.service';
+import { logWarn } from '../../../src/nest/audit/audit-log.logger';
+
+function setAppSetting(key: string, value: string): void {
+  testDb.prepare('INSERT OR REPLACE INTO app_settings (key, value) VALUES (?, ?)').run(key, value);
+}
+
+/** The minimum that makes getSmtpConfig() return a config instead of null. */
+function configureSmtp(): void {
+  setAppSetting('smtp_host', 'mail.internal.example');
+  setAppSetting('smtp_port', '587');
+  setAppSetting('smtp_from', 'trek@example.com');
+}
+
+function newMailer(): MailerService {
+  return new MailerService(new DatabaseService(testDb));
+}
+
+/** The options object of the most recent nodemailer.createTransport() call. */
+function lastTransportOptions(): Record<string, unknown> {
+  const calls = createTransport.mock.calls;
+  return calls[calls.length - 1][0] as Record<string, unknown>;
+}
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+  vi.clearAllMocks();
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+describe('MailerService TLS options', () => {
+  it('MAILER-001: leaves certificate verification on by default', async () => {
+    configureSmtp();
+
+    expect(await newMailer().sendEmail('someone@example.com', 'Subject', 'Body')).toBe(true);
+
+    expect(lastTransportOptions()).not.toHaveProperty('tls');
+    expect(logWarn).not.toHaveBeenCalled();
+  });
+
+  it('MAILER-002: the smtp_skip_tls_verify setting turns verification off', async () => {
+    configureSmtp();
+    setAppSetting('smtp_skip_tls_verify', 'true');
+
+    await newMailer().sendEmail('someone@example.com', 'Subject', 'Body');
+
+    expect(lastTransportOptions().tls).toEqual({ rejectUnauthorized: false });
+  });
+
+  it('MAILER-003: anything other than "true" leaves verification on', async () => {
+    configureSmtp();
+    setAppSetting('smtp_skip_tls_verify', 'false');
+
+    await newMailer().sendEmail('someone@example.com', 'Subject', 'Body');
+
+    expect(lastTransportOptions()).not.toHaveProperty('tls');
+    expect(logWarn).not.toHaveBeenCalled();
+  });
+
+  it('MAILER-004: skipping verification is announced, and names the host it applies to', async () => {
+    configureSmtp();
+    setAppSetting('smtp_skip_tls_verify', 'true');
+
+    await newMailer().sendEmail('someone@example.com', 'Subject', 'Body');
+
+    expect(logWarn).toHaveBeenCalledTimes(1);
+    const warning = vi.mocked(logWarn).mock.calls[0][0];
+    expect(warning).toContain('mail.internal.example:587');
+    expect(warning).toContain('SECURITY');
+  });
+
+  it('MAILER-005: the warning is logged once per process, not once per mail', async () => {
+    configureSmtp();
+    setAppSetting('smtp_skip_tls_verify', 'true');
+    const mailer = newMailer();
+
+    await mailer.sendEmail('first@example.com', 'One', 'Body');
+    await mailer.sendEmail('second@example.com', 'Two', 'Body');
+    await mailer.sendPasswordResetEmail('third@example.com', 'https://trek.example/reset', null);
+
+    expect(createTransport).toHaveBeenCalledTimes(3);
+    expect(logWarn).toHaveBeenCalledTimes(1);
+  });
+
+  it('MAILER-006: a send with no SMTP configured builds no transport at all', async () => {
+    expect(await newMailer().sendEmail('someone@example.com', 'Subject', 'Body')).toBe(false);
+
+    expect(createTransport).not.toHaveBeenCalled();
+    expect(sendMail).not.toHaveBeenCalled();
+  });
+});
diff --git a/server/tests/unit/nest/places.service.test.ts b/server/tests/unit/nest/places.service.test.ts
index 5de63f564..6663f6d1c 100644
--- a/server/tests/unit/nest/places.service.test.ts
+++ b/server/tests/unit/nest/places.service.test.ts
@@ -1157,11 +1157,14 @@ describe('PlacesService — automatic track colours (#776)', () => {
     expect(new Set(colors).size).toBe(colors.length);
   });
 
-  it('PLACES-SVC-005 — an import that yields nothing is passed straight through', () => {
+  it('PLACES-SVC-005 — an import that yields nothing colours nothing', () => {
     const { user } = createUser(testDb);
     const trip = createTrip(testDb, user.id);
-    expect((svc as any).colorizeImportedTracks(String(trip.id), null)).toBeNull();
-    expect((svc as any).colorizeImportedTracks(String(trip.id), { places: [] })).toEqual({ places: [] });
+
+    expect(() => (svc as any).colorizeImportedTracks(String(trip.id), null)).not.toThrow();
+    expect(() => (svc as any).colorizeImportedTracks(String(trip.id), { places: [] })).not.toThrow();
+
+    expect(tracksOf(trip.id)).toEqual([]);
   });
 });
 
diff --git a/server/tests/unit/nest/strip-html-tags.test.ts b/server/tests/unit/nest/strip-html-tags.test.ts
new file mode 100644
index 000000000..1950576f3
--- /dev/null
+++ b/server/tests/unit/nest/strip-html-tags.test.ts
@@ -0,0 +1,72 @@
+/**
+ * stripHtmlTags replaced `/<[^>]+>/g` on two attacker-reachable paths (an
+ * uploaded KML description, Wikimedia Commons metadata), where that pattern
+ * backtracks: `[^>]` matches `<` as well, so a run of `<` with no closing
+ * bracket is retried from every one of them.
+ *
+ * The contract is "identical output to the regex, including its quirks", so the
+ * cases below are written against the regex rather than against what a tidy tag
+ * stripper would do.
+ */
+import { describe, it, expect } from 'vitest';
+import { stripHtmlTags } from '../../../src/nest/common/stripHtmlTags';
+
+/** The pattern this function replaced — the oracle for every case here. */
+const oracle = (s: string, repl = '') => s.replace(/<[^>]+>/g, repl);
+
+describe('stripHtmlTags', () => {
+  it('STRIP-001: removes ordinary tags and keeps the text between them', () => {
+    expect(stripHtmlTags('<b>bold</b> and <i>it</i>')).toBe('bold and it');
+  });
+
+  it('STRIP-002: substitutes the replacement string when one is given', () => {
+    expect(stripHtmlTags('<a href="x">link</a>', ' ')).toBe(' link ');
+  });
+
+  it('STRIP-003: leaves text with no tags untouched', () => {
+    expect(stripHtmlTags('plain text, 3 < 4 and nothing else')).toBe('plain text, 3 < 4 and nothing else');
+  });
+
+  it('STRIP-004: leaves `<>` alone, because the pattern needs a character between the brackets', () => {
+    expect(stripHtmlTags('a<>b')).toBe('a<>b');
+    expect(stripHtmlTags('a<>b')).toBe(oracle('a<>b'));
+  });
+
+  it('STRIP-005: treats `<` inside a tag as content, the way a browser does', () => {
+    // Narrowing the class to [^<>] would make this two tags and leave "<a" behind.
+    expect(stripHtmlTags('<a<b>x')).toBe('x');
+    expect(stripHtmlTags('<a<b>x')).toBe(oracle('<a<b>x'));
+  });
+
+  it('STRIP-006: keeps an unterminated `<` as literal text', () => {
+    expect(stripHtmlTags('text <not closed')).toBe('text <not closed');
+  });
+
+  it('STRIP-007: spans newlines inside a tag', () => {
+    expect(stripHtmlTags('<div\n class="x">y</div>')).toBe('y');
+  });
+
+  it('STRIP-008: matches the regex on every string over `<>ab \\n` up to length 6', () => {
+    const alphabet = ['<', '>', 'a', 'b', ' ', '\n'];
+    let compared = 0;
+    const walk = (prefix: string, depth: number) => {
+      for (const repl of ['', ' ']) {
+        expect(stripHtmlTags(prefix, repl), JSON.stringify(prefix)).toBe(oracle(prefix, repl));
+        compared++;
+      }
+      if (depth === 0) return;
+      for (const c of alphabet) walk(prefix + c, depth - 1);
+    };
+    walk('', 6);
+    expect(compared).toBeGreaterThan(100_000);
+  });
+
+  it('STRIP-009: stays linear on the input the regex went quadratic on', () => {
+    // 40k '<' with no '>': the regex restarted at every one and rescanned to the
+    // end, ~0.9s. A generous bound — the point is the shape, not the machine.
+    const evil = '<'.repeat(40_000);
+    const started = Date.now();
+    expect(stripHtmlTags(evil)).toBe(evil);
+    expect(Date.now() - started).toBeLessThan(500);
+  });
+});
diff --git a/server/tests/unit/plugins/event-facts.test.ts b/server/tests/unit/plugins/event-facts.test.ts
new file mode 100644
index 000000000..765a23df3
--- /dev/null
+++ b/server/tests/unit/plugins/event-facts.test.ts
@@ -0,0 +1,15 @@
+import { it, expect } from 'vitest';
+import { SNAPSHOT_GRANT, ENTITY_ID_KEYS } from '../../../src/plugin-event-sink';
+import { KNOWN_PERMISSIONS } from '../../../src/nest/plugins/protocol/envelope';
+
+it('every snapshot grant is a known db:read permission', () => {
+  for (const p of Object.values(SNAPSHOT_GRANT)) {
+    expect(KNOWN_PERMISSIONS).toContain(p);
+    expect(p).toMatch(/^db:read:/);
+  }
+});
+it('every snapshot family has an id-key path', () => {
+  for (const family of Object.keys(SNAPSHOT_GRANT)) {
+    expect(Object.keys(ENTITY_ID_KEYS)).toContain(family);
+  }
+});
diff --git a/server/tests/unit/plugins/manifest.test.ts b/server/tests/unit/plugins/manifest.test.ts
index 8a8c6d45f..3d41acf6e 100644
--- a/server/tests/unit/plugins/manifest.test.ts
+++ b/server/tests/unit/plugins/manifest.test.ts
@@ -6,6 +6,7 @@ import { describe, it, expect } from 'vitest';
 import { parseManifest, ManifestError } from '../../../src/nest/plugins/install/manifest';
 
 const base = { id: 'flight-tracker', name: 'Flight', version: '1.2.0', type: 'widget', apiVersion: 1 };
+const withApi = (apiVersion: unknown) => ({ ...base, apiVersion, trek: '>=3.2.0 <4.0.0' });
 
 describe('parseManifest', () => {
   it('parses a valid manifest with defaults', () => {
@@ -99,6 +100,23 @@ describe('parseManifest', () => {
   });
 });
 
+describe('apiVersion', () => {
+  it.each([[0], [-3], [1.5], ['1']])('rejects non-positive-integer %p', (v) => {
+    expect(() => parseManifest(withApi(v))).toThrow('apiVersion must be a positive integer');
+  });
+  it('defaults to 1 when absent', () => {
+    const { apiVersion: _omitted, ...noApi } = base;
+    expect(parseManifest(noApi).apiVersion).toBe(1);
+  });
+  it('tolerates a future apiVersion under discovery (no requireTrek)', () => {
+    expect(parseManifest(withApi(2)).apiVersion).toBe(2);
+  });
+  it('refuses a future apiVersion on install paths (requireTrek)', () => {
+    expect(() => parseManifest(withApi(2), { requireTrek: true }))
+      .toThrow('plugin requires plugin-API v2; this TREK supports v1');
+  });
+});
+
 describe('parseManifest capabilities', () => {
   it('parses a hero widget slot and defaults to sidebar', () => {
     const hero = parseManifest({ ...base, capabilities: { widget: { slot: 'hero', title: 'T' } } });
diff --git a/server/tests/unit/plugins/plugin-retrust.controller.test.ts b/server/tests/unit/plugins/plugin-retrust.controller.test.ts
index f644ef3b3..47797de17 100644
--- a/server/tests/unit/plugins/plugin-retrust.controller.test.ts
+++ b/server/tests/unit/plugins/plugin-retrust.controller.test.ts
@@ -49,11 +49,14 @@ let runtime: PluginRuntimeService;
 let registry: PluginRegistryService;
 let controller: PluginsController;
 
+let plugins: PluginsService;
+
 beforeEach(() => {
   process.env.TREK_PLUGINS_ENABLED = 'true';
   runtime = { update: vi.fn(), retrust: vi.fn() } as unknown as PluginRuntimeService;
-  registry = { install: vi.fn() } as unknown as PluginRegistryService;
-  controller = new PluginsController({} as PluginsService, runtime, registry, { isManaged: () => false } as unknown as RuntimeEnvService);
+  registry = { install: vi.fn(), installWithDependencies: vi.fn(), recomputeUpdateHold: vi.fn() } as unknown as PluginRegistryService;
+  plugins = { resumeUpdates: vi.fn(() => true) } as unknown as PluginsService;
+  controller = new PluginsController(plugins, runtime, registry, { isManaged: () => false } as unknown as RuntimeEnvService);
 });
 
 describe('signature refusal codes survive to the client', () => {
@@ -98,6 +101,87 @@ describe('signature refusal codes survive to the client', () => {
   });
 });
 
+// The rollback path: an admin picks a specific (possibly older) version, and the runtime
+// must install exactly that one — the compat gate stays server-side in selectVersion.
+describe('POST :id/update — explicit version', () => {
+  it('forwards the requested version to the runtime', async () => {
+    vi.mocked(runtime.update).mockResolvedValue({ version: '1.2.0', activated: true, newPermissions: [], newEgress: [] });
+
+    const res = await controller.update('flight-tracker', { version: '1.2.0' });
+
+    expect(vi.mocked(runtime.update).mock.calls[0]).toEqual(['flight-tracker', { version: '1.2.0' }]);
+    expect(res).toEqual({ version: '1.2.0', activated: true, newPermissions: [], newEgress: [] });
+  });
+
+  it('an omitted body keeps the default newest-compatible resolution', async () => {
+    vi.mocked(runtime.update).mockResolvedValue({ version: '2.0.0', activated: true, newPermissions: [], newEgress: [] });
+
+    await controller.update('flight-tracker');
+
+    expect(vi.mocked(runtime.update).mock.calls[0]).toEqual(['flight-tracker', { version: undefined }]);
+  });
+});
+
+// The update hold: only a DELIBERATE version pick may set it, every successful
+// install/update recomputes it (so landing back on the newest clears a stale one),
+// and dependency resolution — which pins versions too, but never deliberately —
+// must not touch it.
+describe('update hold wiring', () => {
+  it('an explicit-version update recomputes the hold as deliberate', async () => {
+    vi.mocked(runtime.update).mockResolvedValue({ version: '1.2.0', activated: true, newPermissions: [], newEgress: [] });
+
+    await controller.update('flight-tracker', { version: '1.2.0' });
+
+    expect(registry.recomputeUpdateHold).toHaveBeenCalledWith('flight-tracker', '1.2.0', true);
+  });
+
+  it('a default update recomputes as non-deliberate (clears a stale hold)', async () => {
+    vi.mocked(runtime.update).mockResolvedValue({ version: '2.0.0', activated: true, newPermissions: [], newEgress: [] });
+
+    await controller.update('flight-tracker');
+
+    expect(registry.recomputeUpdateHold).toHaveBeenCalledWith('flight-tracker', '2.0.0', false);
+  });
+
+  it('an explicit-version install recomputes the hold as deliberate', async () => {
+    vi.mocked(registry.install).mockResolvedValue({ id: 'flight-tracker', version: '1.2.0' });
+
+    await controller.install({ id: 'flight-tracker', version: '1.2.0' });
+
+    expect(registry.recomputeUpdateHold).toHaveBeenCalledWith('flight-tracker', '1.2.0', true);
+  });
+
+  it('a dependency-resolution install does NOT touch the hold', async () => {
+    vi.mocked(registry.installWithDependencies).mockResolvedValue({ installed: ['flight-tracker'], requiredAddons: [] });
+
+    await controller.install({ id: 'flight-tracker', withDependencies: true });
+
+    expect(registry.recomputeUpdateHold).not.toHaveBeenCalled();
+  });
+
+  it('a failed update leaves the hold untouched', async () => {
+    vi.mocked(runtime.update).mockRejectedValue(new Error('network unreachable'));
+
+    await expect(controller.update('flight-tracker', { version: '1.2.0' })).rejects.toThrow(HttpException);
+
+    expect(registry.recomputeUpdateHold).not.toHaveBeenCalled();
+  });
+
+  it('POST :id/resume-updates clears the hold', async () => {
+    const res = await controller.resumeUpdates('flight-tracker');
+
+    expect(plugins.resumeUpdates).toHaveBeenCalledWith('flight-tracker');
+    expect(res).toEqual({ updateHold: false });
+  });
+
+  it('POST :id/resume-updates is a 404 for an unknown plugin', async () => {
+    vi.mocked(plugins.resumeUpdates).mockReturnValue(false);
+
+    const { status } = await wireFailure(async () => controller.resumeUpdates('ghost'));
+    expect(status).toBe(404);
+  });
+});
+
 describe('POST :id/retrust', () => {
   it('re-pins AND installs in one call, returning the update result', async () => {
     vi.mocked(runtime.retrust).mockResolvedValue({ version: '2.0.0', activated: true, newPermissions: [], newEgress: [] });
diff --git a/server/tests/unit/plugins/plugins-service.test.ts b/server/tests/unit/plugins/plugins-service.test.ts
index a3d931427..c0db0d8a1 100644
--- a/server/tests/unit/plugins/plugins-service.test.ts
+++ b/server/tests/unit/plugins/plugins-service.test.ts
@@ -11,7 +11,7 @@ const { testDb } = vi.hoisted(() => {
     id TEXT PRIMARY KEY, name TEXT, description TEXT, type TEXT, icon TEXT, version TEXT,
     status TEXT, enabled INTEGER DEFAULT 0, last_error TEXT, reviewed_at TEXT, source_repo TEXT, config TEXT DEFAULT '{}', permissions TEXT DEFAULT '[]', granted_permissions TEXT DEFAULT '[]', capabilities TEXT DEFAULT '{}', dependencies TEXT DEFAULT '{}', operator_egress INTEGER DEFAULT 0, updated_at TEXT,
     author_pubkey TEXT, update_block_code TEXT, update_block_detail TEXT, update_block_version TEXT,
-    trek_range TEXT, sort_order INTEGER DEFAULT 0);
+    trek_range TEXT, sort_order INTEGER DEFAULT 0, update_hold INTEGER NOT NULL DEFAULT 0);
     CREATE TABLE plugin_settings_fields (plugin_id TEXT, field_key TEXT, scope TEXT, secret INTEGER);
     CREATE TABLE plugin_error_log (id INTEGER PRIMARY KEY AUTOINCREMENT, plugin_id TEXT, level TEXT, message TEXT, ts TEXT DEFAULT '2026-01-01');`);
   return { testDb: db };
@@ -48,6 +48,30 @@ describe('PluginsService.list', () => {
     expect(out.plugins[0]).toMatchObject({ id: 'flight', name: 'Flight', status: 'inactive' });
   });
 
+  it('surfaces updateHold as a boolean (held plugins leave the update banner)', () => {
+    testDb
+      .prepare("INSERT INTO plugins (id, name, type, status, version, update_hold) VALUES ('held','Held','widget','inactive','1.0.0',1)")
+      .run();
+    testDb
+      .prepare("INSERT INTO plugins (id, name, type, status, version) VALUES ('free','Free','widget','inactive','1.0.0')")
+      .run();
+
+    const out = new PluginsService(new DatabaseService(dbConn), new AddonsService(new DatabaseService(dbConn))).list();
+    expect(out.plugins.find((p) => p.id === 'held')).toMatchObject({ updateHold: true });
+    expect(out.plugins.find((p) => p.id === 'free')).toMatchObject({ updateHold: false });
+  });
+
+  it('resumeUpdates clears the hold and reports whether the plugin existed', () => {
+    testDb
+      .prepare("INSERT INTO plugins (id, name, type, status, version, update_hold) VALUES ('held','Held','widget','inactive','1.0.0',1)")
+      .run();
+    const svc = new PluginsService(new DatabaseService(dbConn), new AddonsService(new DatabaseService(dbConn)));
+
+    expect(svc.resumeUpdates('held')).toBe(true);
+    expect(testDb.prepare("SELECT update_hold FROM plugins WHERE id='held'").get()).toMatchObject({ update_hold: 0 });
+    expect(svc.resumeUpdates('ghost')).toBe(false);
+  });
+
   it('reports enabled by default (no kill switch set)', () => {
     testDb
       .prepare('INSERT INTO plugins (id, name, description, type, status, version) VALUES (?,?,?,?,?,?)')
diff --git a/server/tests/unit/plugins/protocol-paths.test.ts b/server/tests/unit/plugins/protocol-paths.test.ts
index c7d98b0a2..a24ca888f 100644
--- a/server/tests/unit/plugins/protocol-paths.test.ts
+++ b/server/tests/unit/plugins/protocol-paths.test.ts
@@ -5,7 +5,7 @@
 import { describe, it, expect, afterEach } from 'vitest';
 import { isKnownPermission, METHOD_PERMISSION, KNOWN_METHODS, HOOK_PERMISSION } from '../../../src/nest/plugins/protocol/envelope';
 import path from 'node:path';
-import { pluginsCodeRoot, pluginsDataRoot, pluginCodeDir, pluginDbFile, resolveChildEntry, serverCodeRoot, pluginPermissionArgs, pluginRealCodeDir, ensurePluginModuleType } from '../../../src/nest/plugins/paths';
+import { pluginsCodeRoot, pluginsDataRoot, pluginCodeDir, pluginDataDir, pluginDbFile, resolveChildEntry, serverCodeRoot, pluginPermissionArgs, pluginRealCodeDir, ensurePluginModuleType } from '../../../src/nest/plugins/paths';
 
 afterEach(() => {
   delete process.env.TREK_PLUGINS_DIR;
@@ -101,3 +101,44 @@ describe('paths', () => {
     }
   });
 });
+
+/**
+ * The id these helpers get comes off a route parameter — POST
+ * /api/admin/plugins/:id/uninstall walks it into pluginCodeDir and hands the result
+ * to a recursive remove. Express decodes %2F only AFTER routing, so a traversal
+ * still matches the route and arrives here decoded.
+ */
+describe('plugin id containment', () => {
+  const traversals = [
+    '../../uploads',
+    '../..',
+    '..',
+    '.',
+    'a/b',
+    'a\b',
+    'C:\Windows',
+    '.hidden',
+    '',
+  ];
+
+  it('refuses any id that could point outside its parent', () => {
+    for (const id of traversals) {
+      expect(() => pluginCodeDir(id), id).toThrow(/invalid plugin id/);
+      expect(() => pluginDataDir(id), id).toThrow(/invalid plugin id/);
+    }
+  });
+
+  it('still accepts the ids plugins actually use', () => {
+    for (const id of ['x', 'a1', '001', 'flight-tracker', 'Bad-Id', 'trip.todos', 'koffi_and_friends']) {
+      expect(path.basename(pluginCodeDir(id))).toBe(id);
+      expect(path.basename(pluginDataDir(id))).toBe(id);
+    }
+  });
+
+  it('keeps every accepted id inside the plugin roots', () => {
+    for (const id of ['x', 'flight-tracker', 'a.b', 'a-b_c']) {
+      expect(pluginCodeDir(id).startsWith(pluginsCodeRoot() + path.sep)).toBe(true);
+      expect(pluginDataDir(id).startsWith(pluginsDataRoot() + path.sep)).toBe(true);
+    }
+  });
+});
diff --git a/server/tests/unit/plugins/rpc-host-inv-strip.test.ts b/server/tests/unit/plugins/rpc-host-inv-strip.test.ts
index 9739dd507..a904b54c2 100644
--- a/server/tests/unit/plugins/rpc-host-inv-strip.test.ts
+++ b/server/tests/unit/plugins/rpc-host-inv-strip.test.ts
@@ -110,4 +110,29 @@ describe('dispatch strips the supervisor _inv marker', () => {
     await host.dispatch(req('packing.setBagMembers', { tripId: 1, bagId: 80, userIds: [3], _inv: 'req-7' }), 42);
     expect(setBagMembers).toHaveBeenCalledWith('1', '80', [3]);
   });
+
+  /**
+   * The `_inv` check runs before handle()'s try/catch, so a params value that is not
+   * an object used to throw a TypeError out of dispatch instead of coming back as an
+   * error envelope. The supervisor discards the promise dispatch lives on, which made
+   * that an unhandledRejection — process exit, from one malformed envelope.
+   */
+  it('RPCINV-007 params that are not an object come back as an envelope, not a rejection', async () => {
+    const host = new PluginRpcHost('p', new Set(['db:own']), makeDeps(), dbRegistry());
+
+    for (const params of [5, 'text', true] as unknown as Record<string, unknown>[]) {
+      const res = await host.dispatch({ k: 'req', id: 'x', method: 'db.query', params });
+      expect(res).toMatchObject({ k: 'res', id: 'x', ok: false });
+    }
+  });
+
+  it('RPCINV-008 null and undefined params still behave as an empty object', async () => {
+    const host = new PluginRpcHost('p', new Set(['db:own']), makeDeps(), dbRegistry());
+
+    const nulled = await host.dispatch({ k: 'req', id: 'x', method: 'db.query', params: null as unknown as Record<string, unknown> });
+    // The type says params is required; the IPC channel does not, so a child can
+    // leave it off entirely.
+    const missing = await host.dispatch({ k: 'req', id: 'x', method: 'db.query', params: undefined as unknown as Record<string, unknown> });
+    expect(nulled).toEqual(missing);
+  });
 });
diff --git a/server/tests/unit/plugins/rpc-host.test.ts b/server/tests/unit/plugins/rpc-host.test.ts
index ce30579fe..d7b4f6cd1 100644
--- a/server/tests/unit/plugins/rpc-host.test.ts
+++ b/server/tests/unit/plugins/rpc-host.test.ts
@@ -76,9 +76,14 @@ describe('PluginRpcHost — capability enforcement', () => {
     expect((res as RpcError).error.message).toBe('unknown method fs.readFile');
   });
 
-  it('RPCHOST-003 a denied known method names the plugin, so the log says who asked', async () => {
+  it('RPCHOST-003 a denied known method names the missing permission AND the plugin', async () => {
+    // The old template interpolated the plugin id where the permission belonged
+    // ('tags.list requires a permission "p" was not granted'), so an operator read
+    // their plugin's NAME as an unknown permission. The message must name both.
     const res = await makeHost([]).dispatch(req('tags.list'), 42);
-    expect((res as RpcError).error.message).toBe('tags.list requires a permission "p" was not granted');
+    expect((res as RpcError).error.message).toBe(
+      'tags.list requires the "db:read:tags" permission, which was not granted to plugin "p"',
+    );
   });
 
   it('RPCHOST-004 with no permissions at all, every permissioned method is denied', async () => {
diff --git a/server/tests/unit/plugins/safe-extract.test.ts b/server/tests/unit/plugins/safe-extract.test.ts
index 723d305f8..ac12540c9 100644
--- a/server/tests/unit/plugins/safe-extract.test.ts
+++ b/server/tests/unit/plugins/safe-extract.test.ts
@@ -11,13 +11,15 @@ import zlib from 'node:zlib';
 import { safeJoin, extractArchive, ExtractError } from '../../../src/nest/plugins/install/safe-extract';
 
 // ── tiny archive builders ────────────────────────────────────────────────────
-function tarHeader(name: string, size: number, typeflag = '0', linkname = ''): Buffer {
+function tarHeader(name: string, size: number, typeflag = '0', linkname = '', rawSize?: string): Buffer {
   const h = Buffer.alloc(512, 0);
   h.write(name, 0);
   h.write('0000644', 100);
   h.write('0000000', 108);
   h.write('0000000', 116);
-  h.write(size.toString(8).padStart(11, '0'), 124);
+  // rawSize writes the 12-byte field verbatim, for headers a real tar would never
+  // produce (negative, non-octal) — the reader has to survive those too.
+  h.write(rawSize !== undefined ? rawSize.padEnd(11, ' ') : size.toString(8).padStart(11, '0'), 124);
   h.write('00000000000', 136);
   h.write('        ', 148); // checksum placeholder = spaces
   h.write(typeflag, 156);
@@ -29,12 +31,12 @@ function tarHeader(name: string, size: number, typeflag = '0', linkname = ''): B
   h.write(sum.toString(8).padStart(6, '0') + '\0 ', 148);
   return h;
 }
-function makeTarGz(entries: Array<{ name: string; data?: string; type?: string; link?: string }>): Buffer {
+function makeTarGz(entries: Array<{ name: string; data?: string; type?: string; link?: string; rawSize?: string }>): Buffer {
   const parts: Buffer[] = [];
   for (const e of entries) {
     const body = Buffer.from(e.data ?? '');
-    parts.push(tarHeader(e.name, e.type === '5' || e.type === '2' ? 0 : body.length, e.type ?? '0', e.link ?? ''));
-    if (e.type !== '5' && e.type !== '2') {
+    parts.push(tarHeader(e.name, e.type === '5' || e.type === '2' ? 0 : body.length, e.type ?? '0', e.link ?? '', e.rawSize));
+    if (e.rawSize === undefined && e.type !== '5' && e.type !== '2') {
       parts.push(body);
       const pad = (512 - (body.length % 512)) % 512;
       if (pad) parts.push(Buffer.alloc(pad, 0));
@@ -130,4 +132,20 @@ describe('extractArchive', () => {
   it('rejects an unsupported format', () => {
     expect(() => extractArchive(Buffer.from('not an archive'), dest)).toThrow(/unsupported/);
   });
+
+  // A size field is 12 ASCII bytes of octal, and parseInt honours a leading minus.
+  // The reader advanced by `512 + Math.ceil(size / 512) * 512`, which is zero at
+  // -512 and negative below it: the cursor never leaves the first header, and every
+  // pass appends another member until the heap is gone. Synchronous, on the main
+  // thread, from a 70-byte upload.
+  it('refuses a negative entry size instead of looping on it', () => {
+    const gz = makeTarGz([{ name: 'evil.txt', rawSize: '-1000' }]);
+    expect(() => extractArchive(gz, dest)).toThrow(ExtractError);
+    expect(() => extractArchive(gz, dest)).toThrow(/invalid entry size/);
+  });
+
+  it('refuses a size field that is not a number at all', () => {
+    const gz = makeTarGz([{ name: 'evil.txt', rawSize: 'not-octal' }]);
+    expect(() => extractArchive(gz, dest)).toThrow(/invalid entry size/);
+  });
 });
diff --git a/server/tests/unit/plugins/supervisor-lifecycle.test.ts b/server/tests/unit/plugins/supervisor-lifecycle.test.ts
index b52fb7a14..7681aa737 100644
--- a/server/tests/unit/plugins/supervisor-lifecycle.test.ts
+++ b/server/tests/unit/plugins/supervisor-lifecycle.test.ts
@@ -311,3 +311,39 @@ describe('supervisor throttles plugin log/stderr volume (host-thread DoS guard)'
     expect(sup.droppedLogs).toBe(0);
   });
 });
+
+/**
+ * The 'message' listener is where a rejection would escape: an EventEmitter discards
+ * what its callback returns, onMessage is async, and the host has no
+ * unhandledRejection handler — so Node 22 would end the process. A plugin getting to
+ * kill the supervisor that contains it defeats the point of the supervisor.
+ */
+describe('supervisor message handling never escapes as a rejection', () => {
+  it('logs a failed message against the plugin and keeps running', async () => {
+    const onLog = vi.fn();
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const s = new PluginSupervisor((() => ({ dispose: vi.fn() })) as any, { onLog }, {});
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (s as any).onMessage = () => Promise.reject(new Error('malformed envelope'));
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    expect(() => (s as any).handleChildMessage({ id: 'p' }, { k: 'req', id: 'x' })).not.toThrow();
+
+    await new Promise((r) => setTimeout(r, 0));
+    expect(onLog).toHaveBeenCalledWith('p', 'error', expect.stringContaining('malformed envelope'));
+  });
+
+  it('says nothing when the message is handled normally', async () => {
+    const onLog = vi.fn();
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const s = new PluginSupervisor((() => ({ dispose: vi.fn() })) as any, { onLog }, {});
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (s as any).onMessage = () => Promise.resolve();
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (s as any).handleChildMessage({ id: 'p' }, { k: 'evt', topic: 'log' });
+
+    await new Promise((r) => setTimeout(r, 0));
+    expect(onLog).not.toHaveBeenCalled();
+  });
+});
diff --git a/shared/CLAUDE.md b/shared/CLAUDE.md
new file mode 100644
index 000000000..bb2e19e14
--- /dev/null
+++ b/shared/CLAUDE.md
@@ -0,0 +1,61 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+Scope: the **`@trek/shared`** workspace. See the repo-root `CLAUDE.md` for the monorepo picture, and `server/CLAUDE.md` / `client/CLAUDE.md` for the consumers. This package is the **single source of truth** for API contracts (Zod) and all i18n strings; both server and client import from it.
+
+## Commands (run from `shared/`)
+
+```bash
+npm run build              # tsdown → dist/ (CJS + ESM + .d.ts). REQUIRED before server/client typecheck or run
+npm run build:watch        # tsdown --watch --no-clean (the root `npm run dev` runs this)
+npm run typecheck          # tsc --noEmit
+npm run lint               # eslint --fix src/**/*.ts
+npm run test               # vitest run
+npm run i18n:parity        # audit locale drift, exits 0 (prints a per-locale report)
+npm run i18n:parity:strict # CI gate — exits 1 on any drift
+```
+
+Single test:
+
+```bash
+npx vitest run src/sanitize/sanitize.spec.ts
+npx vitest run src/i18n/i18n-parity.spec.ts
+npx vitest run -t "rejects extra keys"
+```
+
+**Always rebuild after changing a schema or locale** — the consumers import the compiled `dist/`, not `src/`. If a server/client typecheck fails to see a new export, you probably forgot `npm run build` here.
+
+## Build & exports
+
+`tsdown.config.ts` emits **three kinds of entry**: the root barrel (`src/index.ts`), the i18n metadata barrel (`src/i18n/index.ts`), and **one entry per locale** (`src/i18n/*/index.ts`) so each locale becomes its own lazy-loadable chunk (the client dynamic-imports them). `zod` is never bundled (`deps.neverBundle`). Both CJS and ESM are emitted with `.d.ts`. The `exports` map in `package.json` exposes `@trek/shared` (contracts), `@trek/shared/i18n` (metadata/types), and `@trek/shared/i18n/<locale>` (a single locale).
+
+## Contracts (`src/<domain>/<domain>.schema.ts`)
+
+One folder per domain; each exports Zod schemas plus their inferred types (`export type X = z.infer<typeof xSchema>`). The root barrel `src/index.ts` re-exports every domain. Domain-agnostic primitives live in `src/common/` (`primitives.schema.ts`, `pagination.schema.ts`).
+
+**`src/plugin-permissions.ts` is machine-generated** (by `server/scripts/gen-plugin-facts.ts` from the server's plugin protocol) — never hand-edit it; regenerate with `npm run gen:plugin-facts` from `server/`, where `check:plugin-facts` is the CI drift gate.
+
+A route is considered "migrated" only once its contract lives here and **both** sides import the inferred types. Key convention seen across schemas (e.g. `weather/weather.schema.ts`): **schemas mirror the exact legacy wire behavior** — strings stay strings if the legacy route never coerced them, optional fields reflect partial response subsets, and **bespoke 4xx error strings are reproduced in the server controller, not derived from the schema**, so the error body stays byte-identical. Don't "tidy up" a schema to be stricter than the contract it documents.
+
+## Direction (from the 2026 audit)
+
+The parity rule above governs **existing** routes; it is not a license to mint new debt. For anything new:
+
+- **The contract describes the wire, not the storage engine.** New boolean fields are `z.boolean()` — convert SQLite 0/1 at the service boundary, never add a new `z.union([z.boolean(), z.number()])`. New id fields use `idSchema`/`idParamSchema`, never `number | string` unions. A field's request and response types must agree (a write→read round trip must not change a type).
+- **Use the shared primitives** in `src/common/` (`idSchema`, `nonEmptyString`, pagination, …) instead of re-declaring bare `z.number()`/`z.string()` per domain. Prefer narrowing an existing open object over adding a new `z.record(...)`/passthrough body — "any object" gives zero drift protection.
+- **Add a schema, add a spec** — especially for lenient parsers fed by untrusted or LLM input.
+- **This package stays lean and isomorphic**: zero imports from client/server, no `node:` APIs in `src/`, and effectively no new runtime dependencies (long-term the contract layer approaches `zod`-only; i18n is a separable concern with its own release cadence — don't couple new contract code to it).
+- **Never hand-copy a locale list.** `SUPPORTED_LANGUAGES` in `languages.ts` is the one registry — derive everything (barrels, loaders, spec maps) from it; adding a locale should be one edit, not four.
+- **`shared` is the monorepo's strict-TypeScript template** (`strict` + `noUncheckedIndexedAccess`). Hold that line: no new `any`, no new suppressions.
+
+## i18n (`src/i18n/`)
+
+- **`languages.ts`** — `SUPPORTED_LANGUAGES` (the `{ value, label, locale }` tuples) is the canonical language registry and the source of `SupportedLanguageCode`. Adding a language starts here.
+- **`<locale>/`** — one folder per language, with one file per UI domain (`common.ts`, `admin.ts`, `budget.ts`, …) plus an `index.ts` barrel. Every file exports a flat map of **dot-namespaced string keys** typed as `TranslationStrings` (e.g. `'common.save': 'Save'`). The runtime `t(key)` only resolves these top-level keys.
+- **`en/` is canonical.** Every other locale must have the **identical file set and identical top-level keys** — this is enforced by `i18n:parity:strict` (and `i18n-parity.spec.ts`) and is a CI gate (`chore: enforce i18n parity`). When you add or rename a key, update **every** locale, or parity fails.
+- `types.ts` defines `TranslationStrings`; `index.ts` re-exports types + language metadata (not the strings themselves — those load per-locale).
+
+## Sanitization (`src/sanitize/sanitize.ts`)
+
+`isomorphic-dompurify` (same code in browser and Node, tree-shakes so the client bundle doesn't pull jsdom). Minimal inline-only allow-list today; it guards the few surfaces that interpolate user strings into markup (currently the Journey banner) and is the designated home if rich-text/Markdown ships later.
diff --git a/shared/package.json b/shared/package.json
index f5a36556f..bb2ea14ab 100644
--- a/shared/package.json
+++ b/shared/package.json
@@ -54,6 +54,7 @@
     "build:watch": "tsdown --watch --no-clean",
     "test": "vitest run",
     "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
     "typecheck": "tsc --noEmit",
     "format": "prettier --write \"src/**/*.ts\"",
     "format:check": "prettier --check \"src/**/*.ts\"",
@@ -68,6 +69,7 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@trivago/prettier-plugin-sort-imports": "^6.0.2",
+    "@vitest/coverage-v8": "^4.1.9",
     "eslint": "^10.3.0",
     "eslint-config-flat-gitignore": "^2.3.0",
     "eslint-config-prettier": "^10.1.8",
diff --git a/shared/src/i18n/ar/admin.ts b/shared/src/i18n/ar/admin.ts
index a078f7762..0265093b6 100644
--- a/shared/src/i18n/ar/admin.ts
+++ b/shared/src/i18n/ar/admin.ts
@@ -428,6 +428,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'التحديثات أولًا',
   'admin.plugins.sortDownloads': 'الأكثر تنزيلًا',
   'admin.plugins.updatesAvailable': '{count} تحديثات متاحة لإضافاتك.',
+  'admin.plugins.newerNeedsTrek': 'الإصدار v{version} متوفر — يتطلب TREK {range}',
+  'admin.plugins.versionsTitle': 'الإصدارات',
+  'admin.plugins.versionPickerTitle': 'تغيير الإصدار — {name}',
+  'admin.plugins.versionSwitch': 'التبديل إلى {version}',
+  'admin.plugins.versionNeedsTrek': 'يتطلب TREK {range}',
+  'admin.plugins.changeVersion': 'تغيير الإصدار…',
+  'admin.plugins.noVersions': 'لم يتم العثور على إصدارات منشورة في السجل.',
+  'admin.plugins.downgradeTitle': 'التراجع عن هذه الإضافة؟',
+  'admin.plugins.downgradeBody': 'التبديل من v{from} إلى v{to}: تبقى البيانات المكتوبة بواسطة الإصدار الأحدث في مكانها، وقد لا يفهمها الإصدار الأقدم.',
+  'admin.plugins.downgradeConfirm': 'تراجع',
+  'admin.plugins.updatesHeld': 'التحديثات متوقفة عند v{version}',
+  'admin.plugins.resumeUpdates': 'استئناف التحديثات',
+  'admin.plugins.updatesResumed': 'تم استئناف التحديثات',
   'admin.plugins.updateAll': 'تحديث الكل',
   'admin.plugins.noMatchInstalled': 'لا توجد إضافات مثبّتة تطابق بحثك.',
   'admin.plugins.noMatchRegistry': 'لا توجد إضافات في السجل تطابق بحثك.',
diff --git a/shared/src/i18n/br/admin.ts b/shared/src/i18n/br/admin.ts
index 3817d4274..32f3ea386 100644
--- a/shared/src/i18n/br/admin.ts
+++ b/shared/src/i18n/br/admin.ts
@@ -417,6 +417,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Atualizações primeiro',
   'admin.plugins.sortDownloads': 'Mais baixados',
   'admin.plugins.updatesAvailable': '{count} atualizações disponíveis para seus plugins.',
+  'admin.plugins.newerNeedsTrek': 'v{version} disponível — requer TREK {range}',
+  'admin.plugins.versionsTitle': 'Versões',
+  'admin.plugins.versionPickerTitle': 'Alterar versão — {name}',
+  'admin.plugins.versionSwitch': 'Mudar para {version}',
+  'admin.plugins.versionNeedsTrek': 'requer TREK {range}',
+  'admin.plugins.changeVersion': 'Alterar versão…',
+  'admin.plugins.noVersions': 'Nenhuma versão publicada encontrada no registro.',
+  'admin.plugins.downgradeTitle': 'Reverter este plugin?',
+  'admin.plugins.downgradeBody': 'Mudando de v{from} para v{to}: os dados gravados pela versão mais recente permanecem no lugar, e a versão mais antiga pode não entendê-los.',
+  'admin.plugins.downgradeConfirm': 'Reverter',
+  'admin.plugins.updatesHeld': 'Atualizações pausadas em v{version}',
+  'admin.plugins.resumeUpdates': 'Retomar atualizações',
+  'admin.plugins.updatesResumed': 'Atualizações retomadas',
   'admin.plugins.updateAll': 'Atualizar todos',
   'admin.plugins.noMatchInstalled': 'Nenhum plugin instalado corresponde à sua busca.',
   'admin.plugins.noMatchRegistry': 'Nenhum plugin no registro corresponde à sua busca.',
diff --git a/shared/src/i18n/ca/admin.ts b/shared/src/i18n/ca/admin.ts
index c31809098..df4084d65 100644
--- a/shared/src/i18n/ca/admin.ts
+++ b/shared/src/i18n/ca/admin.ts
@@ -542,6 +542,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Primer les actualitzacions',
   'admin.plugins.sortDownloads': 'Més baixades',
   'admin.plugins.updatesAvailable': '{count} actualitzacions disponibles per als teus connectors.',
+  'admin.plugins.newerNeedsTrek': 'v{version} disponible — necessita TREK {range}',
+  'admin.plugins.versionsTitle': 'Versions',
+  'admin.plugins.versionPickerTitle': 'Canvia la versió — {name}',
+  'admin.plugins.versionSwitch': 'Canvia a {version}',
+  'admin.plugins.versionNeedsTrek': 'necessita TREK {range}',
+  'admin.plugins.changeVersion': 'Canvia la versió…',
+  'admin.plugins.noVersions': 'No s\'han trobat versions publicades al registre.',
+  'admin.plugins.downgradeTitle': 'Vols revertir aquest connector?',
+  'admin.plugins.downgradeBody': 'Canvi de v{from} a v{to}: les dades escrites per la versió més nova es mantenen, i la versió antiga pot no entendre-les.',
+  'admin.plugins.downgradeConfirm': 'Reverteix',
+  'admin.plugins.updatesHeld': 'Actualitzacions en pausa a la v{version}',
+  'admin.plugins.resumeUpdates': 'Reprèn les actualitzacions',
+  'admin.plugins.updatesResumed': 'Actualitzacions represes',
   'admin.plugins.updateAll': 'Actualitza-ho tot',
   'admin.plugins.noMatchInstalled': 'Cap connector instal·lat coincideix amb la teva cerca.',
   'admin.plugins.noMatchRegistry': 'Cap connector del registre coincideix amb la teva cerca.',
diff --git a/shared/src/i18n/cs/admin.ts b/shared/src/i18n/cs/admin.ts
index 83ccc83ce..f69d9274b 100644
--- a/shared/src/i18n/cs/admin.ts
+++ b/shared/src/i18n/cs/admin.ts
@@ -415,6 +415,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Nejdřív aktualizace',
   'admin.plugins.sortDownloads': 'Nejstahovanější',
   'admin.plugins.updatesAvailable': 'Pro vaše pluginy je k dispozici {count} aktualizací.',
+  'admin.plugins.newerNeedsTrek': 'v{version} k dispozici — vyžaduje TREK {range}',
+  'admin.plugins.versionsTitle': 'Verze',
+  'admin.plugins.versionPickerTitle': 'Změnit verzi — {name}',
+  'admin.plugins.versionSwitch': 'Přepnout na {version}',
+  'admin.plugins.versionNeedsTrek': 'vyžaduje TREK {range}',
+  'admin.plugins.changeVersion': 'Změnit verzi…',
+  'admin.plugins.noVersions': 'V registru nebyly nalezeny žádné publikované verze.',
+  'admin.plugins.downgradeTitle': 'Vrátit tento plugin na starší verzi?',
+  'admin.plugins.downgradeBody': 'Přechod z v{from} na v{to}: data zapsaná novější verzí zůstanou na místě a starší verze jim nemusí rozumět.',
+  'admin.plugins.downgradeConfirm': 'Vrátit zpět',
+  'admin.plugins.updatesHeld': 'Aktualizace pozastaveny na v{version}',
+  'admin.plugins.resumeUpdates': 'Obnovit aktualizace',
+  'admin.plugins.updatesResumed': 'Aktualizace obnoveny',
   'admin.plugins.updateAll': 'Aktualizovat vše',
   'admin.plugins.noMatchInstalled': 'Žádné nainstalované pluginy neodpovídají vašemu hledání.',
   'admin.plugins.noMatchRegistry': 'Žádné pluginy v registru neodpovídají vašemu hledání.',
diff --git a/shared/src/i18n/de/admin.ts b/shared/src/i18n/de/admin.ts
index a78fe7a5b..075f7d649 100644
--- a/shared/src/i18n/de/admin.ts
+++ b/shared/src/i18n/de/admin.ts
@@ -424,6 +424,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Updates zuerst',
   'admin.plugins.sortDownloads': 'Meiste Downloads',
   'admin.plugins.updatesAvailable': '{count} Updates für deine Plugins verfügbar.',
+  'admin.plugins.newerNeedsTrek': 'v{version} verfügbar — benötigt TREK {range}',
+  'admin.plugins.versionsTitle': 'Versionen',
+  'admin.plugins.versionPickerTitle': 'Version wechseln — {name}',
+  'admin.plugins.versionSwitch': 'Zu {version} wechseln',
+  'admin.plugins.versionNeedsTrek': 'benötigt TREK {range}',
+  'admin.plugins.changeVersion': 'Version wechseln…',
+  'admin.plugins.noVersions': 'Keine veröffentlichten Versionen in der Registry gefunden.',
+  'admin.plugins.downgradeTitle': 'Dieses Plugin zurücksetzen?',
+  'admin.plugins.downgradeBody': 'Wechsel von v{from} zu v{to}: Von der neueren Version geschriebene Daten bleiben erhalten, und die ältere Version versteht sie möglicherweise nicht.',
+  'admin.plugins.downgradeConfirm': 'Zurücksetzen',
+  'admin.plugins.updatesHeld': 'Updates pausiert bei v{version}',
+  'admin.plugins.resumeUpdates': 'Updates fortsetzen',
+  'admin.plugins.updatesResumed': 'Updates fortgesetzt',
   'admin.plugins.updateAll': 'Alle aktualisieren',
   'admin.plugins.noMatchInstalled': 'Keine installierten Plugins passen zu deiner Suche.',
   'admin.plugins.noMatchRegistry': 'Keine Plugins in der Registry passen zu deiner Suche.',
diff --git a/shared/src/i18n/en/admin.ts b/shared/src/i18n/en/admin.ts
index 679a0da55..0634b2ffd 100644
--- a/shared/src/i18n/en/admin.ts
+++ b/shared/src/i18n/en/admin.ts
@@ -459,7 +459,20 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Updates first',
   'admin.plugins.sortDownloads': 'Most downloads',
   'admin.plugins.updatesAvailable': '{count} updates available for your plugins.',
+  'admin.plugins.newerNeedsTrek': 'v{version} available — needs TREK {range}',
   'admin.plugins.updateAll': 'Update all',
+  'admin.plugins.versionsTitle': 'Versions',
+  'admin.plugins.versionPickerTitle': 'Change version — {name}',
+  'admin.plugins.versionSwitch': 'Switch to {version}',
+  'admin.plugins.versionNeedsTrek': 'needs TREK {range}',
+  'admin.plugins.changeVersion': 'Change version…',
+  'admin.plugins.noVersions': 'No published versions found in the registry.',
+  'admin.plugins.downgradeTitle': 'Roll back this plugin?',
+  'admin.plugins.downgradeBody': 'Switching from v{from} to v{to}: data written by the newer version stays in place, and the older version may not understand it.',
+  'admin.plugins.downgradeConfirm': 'Roll back',
+  'admin.plugins.updatesHeld': 'Updates paused at v{version}',
+  'admin.plugins.resumeUpdates': 'Resume updates',
+  'admin.plugins.updatesResumed': 'Updates resumed',
   'admin.plugins.noMatchInstalled': 'No installed plugins match your search.',
   'admin.plugins.noMatchRegistry': 'No plugins in the registry match your search.',
   'admin.plugins.restart': 'Restart',
diff --git a/shared/src/i18n/es/admin.ts b/shared/src/i18n/es/admin.ts
index d421f6405..c76db1d92 100644
--- a/shared/src/i18n/es/admin.ts
+++ b/shared/src/i18n/es/admin.ts
@@ -426,6 +426,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Actualizaciones primero',
   'admin.plugins.sortDownloads': 'Más descargados',
   'admin.plugins.updatesAvailable': '{count} actualizaciones disponibles para tus plugins.',
+  'admin.plugins.newerNeedsTrek': 'v{version} disponible — necesita TREK {range}',
+  'admin.plugins.versionsTitle': 'Versiones',
+  'admin.plugins.versionPickerTitle': 'Cambiar versión — {name}',
+  'admin.plugins.versionSwitch': 'Cambiar a {version}',
+  'admin.plugins.versionNeedsTrek': 'necesita TREK {range}',
+  'admin.plugins.changeVersion': 'Cambiar versión…',
+  'admin.plugins.noVersions': 'No se encontraron versiones publicadas en el registro.',
+  'admin.plugins.downgradeTitle': '¿Revertir este plugin?',
+  'admin.plugins.downgradeBody': 'Cambio de v{from} a v{to}: los datos escritos por la versión más reciente se conservan, y la versión anterior podría no entenderlos.',
+  'admin.plugins.downgradeConfirm': 'Revertir',
+  'admin.plugins.updatesHeld': 'Actualizaciones en pausa en v{version}',
+  'admin.plugins.resumeUpdates': 'Reanudar actualizaciones',
+  'admin.plugins.updatesResumed': 'Actualizaciones reanudadas',
   'admin.plugins.updateAll': 'Actualizar todo',
   'admin.plugins.noMatchInstalled': 'Ningún plugin instalado coincide con tu búsqueda.',
   'admin.plugins.noMatchRegistry': 'Ningún plugin del registro coincide con tu búsqueda.',
diff --git a/shared/src/i18n/fr/admin.ts b/shared/src/i18n/fr/admin.ts
index 8699e0496..af857033e 100644
--- a/shared/src/i18n/fr/admin.ts
+++ b/shared/src/i18n/fr/admin.ts
@@ -429,6 +429,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Mises à jour en premier',
   'admin.plugins.sortDownloads': 'Plus téléchargés',
   'admin.plugins.updatesAvailable': '{count} mises à jour disponibles pour vos plugins.',
+  'admin.plugins.newerNeedsTrek': 'v{version} disponible — nécessite TREK {range}',
+  'admin.plugins.versionsTitle': 'Versions',
+  'admin.plugins.versionPickerTitle': 'Changer de version — {name}',
+  'admin.plugins.versionSwitch': 'Passer à {version}',
+  'admin.plugins.versionNeedsTrek': 'nécessite TREK {range}',
+  'admin.plugins.changeVersion': 'Changer de version…',
+  'admin.plugins.noVersions': 'Aucune version publiée trouvée dans le registre.',
+  'admin.plugins.downgradeTitle': 'Revenir à une version antérieure de ce plugin ?',
+  'admin.plugins.downgradeBody': 'Passage de v{from} à v{to} : les données écrites par la version plus récente restent en place, et la version plus ancienne pourrait ne pas les comprendre.',
+  'admin.plugins.downgradeConfirm': 'Rétrograder',
+  'admin.plugins.updatesHeld': 'Mises à jour en pause à la v{version}',
+  'admin.plugins.resumeUpdates': 'Reprendre les mises à jour',
+  'admin.plugins.updatesResumed': 'Mises à jour reprises',
   'admin.plugins.updateAll': 'Tout mettre à jour',
   'admin.plugins.noMatchInstalled': 'Aucun plugin installé ne correspond à votre recherche.',
   'admin.plugins.noMatchRegistry': 'Aucun plugin du registre ne correspond à votre recherche.',
diff --git a/shared/src/i18n/gr/admin.ts b/shared/src/i18n/gr/admin.ts
index 3e7f0ada4..2ae99ca57 100644
--- a/shared/src/i18n/gr/admin.ts
+++ b/shared/src/i18n/gr/admin.ts
@@ -477,6 +477,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Ενημερώσεις πρώτα',
   'admin.plugins.sortDownloads': 'Περισσότερες λήψεις',
   'admin.plugins.updatesAvailable': 'Διαθέσιμες {count} ενημερώσεις για τα plugins σας.',
+  'admin.plugins.newerNeedsTrek': 'Διαθέσιμη η v{version} — απαιτεί TREK {range}',
+  'admin.plugins.versionsTitle': 'Εκδόσεις',
+  'admin.plugins.versionPickerTitle': 'Αλλαγή έκδοσης — {name}',
+  'admin.plugins.versionSwitch': 'Μετάβαση σε {version}',
+  'admin.plugins.versionNeedsTrek': 'απαιτεί TREK {range}',
+  'admin.plugins.changeVersion': 'Αλλαγή έκδοσης…',
+  'admin.plugins.noVersions': 'Δεν βρέθηκαν δημοσιευμένες εκδόσεις στο μητρώο.',
+  'admin.plugins.downgradeTitle': 'Επαναφορά αυτού του πρόσθετου;',
+  'admin.plugins.downgradeBody': 'Μετάβαση από v{from} σε v{to}: τα δεδομένα της νεότερης έκδοσης παραμένουν, και η παλαιότερη έκδοση ίσως να μην τα κατανοεί.',
+  'admin.plugins.downgradeConfirm': 'Επαναφορά',
+  'admin.plugins.updatesHeld': 'Οι ενημερώσεις είναι σε παύση στην v{version}',
+  'admin.plugins.resumeUpdates': 'Συνέχιση ενημερώσεων',
+  'admin.plugins.updatesResumed': 'Οι ενημερώσεις συνεχίστηκαν',
   'admin.plugins.updateAll': 'Ενημέρωση όλων',
   'admin.plugins.noMatchInstalled': 'Κανένα εγκατεστημένο plugin δεν ταιριάζει με την αναζήτησή σας.',
   'admin.plugins.noMatchRegistry': 'Κανένα plugin στο μητρώο δεν ταιριάζει με την αναζήτησή σας.',
diff --git a/shared/src/i18n/hu/admin.ts b/shared/src/i18n/hu/admin.ts
index 0bcc382c0..24e6beaf6 100644
--- a/shared/src/i18n/hu/admin.ts
+++ b/shared/src/i18n/hu/admin.ts
@@ -429,6 +429,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Frissítések elöl',
   'admin.plugins.sortDownloads': 'Legtöbb letöltés',
   'admin.plugins.updatesAvailable': '{count} frissítés érhető el a pluginjaidhoz.',
+  'admin.plugins.newerNeedsTrek': 'v{version} elérhető — TREK {range} szükséges',
+  'admin.plugins.versionsTitle': 'Verziók',
+  'admin.plugins.versionPickerTitle': 'Verzióváltás — {name}',
+  'admin.plugins.versionSwitch': 'Váltás erre: {version}',
+  'admin.plugins.versionNeedsTrek': 'TREK {range} szükséges',
+  'admin.plugins.changeVersion': 'Verzióváltás…',
+  'admin.plugins.noVersions': 'Nem található publikált verzió a jegyzékben.',
+  'admin.plugins.downgradeTitle': 'Visszaállítod ezt a bővítményt?',
+  'admin.plugins.downgradeBody': 'Váltás v{from} verzióról v{to} verzióra: az újabb verzió által írt adatok megmaradnak, és a régebbi verzió lehet, hogy nem érti őket.',
+  'admin.plugins.downgradeConfirm': 'Visszaállítás',
+  'admin.plugins.updatesHeld': 'Frissítések szüneteltetve a v{version} verzión',
+  'admin.plugins.resumeUpdates': 'Frissítések folytatása',
+  'admin.plugins.updatesResumed': 'Frissítések folytatva',
   'admin.plugins.updateAll': 'Összes frissítése',
   'admin.plugins.noMatchInstalled': 'Nincs a keresésnek megfelelő telepített plugin.',
   'admin.plugins.noMatchRegistry': 'Nincs a keresésnek megfelelő plugin a tárban.',
diff --git a/shared/src/i18n/id/admin.ts b/shared/src/i18n/id/admin.ts
index 0ec4aacb3..2b441f399 100644
--- a/shared/src/i18n/id/admin.ts
+++ b/shared/src/i18n/id/admin.ts
@@ -471,6 +471,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Pembaruan dulu',
   'admin.plugins.sortDownloads': 'Paling banyak diunduh',
   'admin.plugins.updatesAvailable': '{count} pembaruan tersedia untuk plugin kamu.',
+  'admin.plugins.newerNeedsTrek': 'v{version} tersedia — membutuhkan TREK {range}',
+  'admin.plugins.versionsTitle': 'Versi',
+  'admin.plugins.versionPickerTitle': 'Ubah versi — {name}',
+  'admin.plugins.versionSwitch': 'Beralih ke {version}',
+  'admin.plugins.versionNeedsTrek': 'membutuhkan TREK {range}',
+  'admin.plugins.changeVersion': 'Ubah versi…',
+  'admin.plugins.noVersions': 'Tidak ada versi terpublikasi yang ditemukan di registri.',
+  'admin.plugins.downgradeTitle': 'Kembalikan plugin ini?',
+  'admin.plugins.downgradeBody': 'Beralih dari v{from} ke v{to}: data yang ditulis oleh versi yang lebih baru tetap ada, dan versi yang lebih lama mungkin tidak memahaminya.',
+  'admin.plugins.downgradeConfirm': 'Kembalikan',
+  'admin.plugins.updatesHeld': 'Pembaruan dijeda di v{version}',
+  'admin.plugins.resumeUpdates': 'Lanjutkan pembaruan',
+  'admin.plugins.updatesResumed': 'Pembaruan dilanjutkan',
   'admin.plugins.updateAll': 'Perbarui semua',
   'admin.plugins.noMatchInstalled': 'Tidak ada plugin terpasang yang cocok dengan pencarianmu.',
   'admin.plugins.noMatchRegistry': 'Tidak ada plugin di registri yang cocok dengan pencarianmu.',
diff --git a/shared/src/i18n/it/admin.ts b/shared/src/i18n/it/admin.ts
index 83ab41636..29fd73d22 100644
--- a/shared/src/i18n/it/admin.ts
+++ b/shared/src/i18n/it/admin.ts
@@ -424,6 +424,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Prima gli aggiornamenti',
   'admin.plugins.sortDownloads': 'Più scaricati',
   'admin.plugins.updatesAvailable': '{count} aggiornamenti disponibili per i tuoi plugin.',
+  'admin.plugins.newerNeedsTrek': 'v{version} disponibile — richiede TREK {range}',
+  'admin.plugins.versionsTitle': 'Versioni',
+  'admin.plugins.versionPickerTitle': 'Cambia versione — {name}',
+  'admin.plugins.versionSwitch': 'Passa a {version}',
+  'admin.plugins.versionNeedsTrek': 'richiede TREK {range}',
+  'admin.plugins.changeVersion': 'Cambia versione…',
+  'admin.plugins.noVersions': 'Nessuna versione pubblicata trovata nel registro.',
+  'admin.plugins.downgradeTitle': 'Ripristinare questo plugin?',
+  'admin.plugins.downgradeBody': 'Passaggio da v{from} a v{to}: i dati scritti dalla versione più recente restano, e la versione precedente potrebbe non comprenderli.',
+  'admin.plugins.downgradeConfirm': 'Ripristina',
+  'admin.plugins.updatesHeld': 'Aggiornamenti in pausa alla v{version}',
+  'admin.plugins.resumeUpdates': 'Riprendi aggiornamenti',
+  'admin.plugins.updatesResumed': 'Aggiornamenti ripresi',
   'admin.plugins.updateAll': 'Aggiorna tutti',
   'admin.plugins.noMatchInstalled': 'Nessun plugin installato corrisponde alla tua ricerca.',
   'admin.plugins.noMatchRegistry': 'Nessun plugin nel registro corrisponde alla tua ricerca.',
diff --git a/shared/src/i18n/ja/admin.ts b/shared/src/i18n/ja/admin.ts
index 6d0a70b41..fc54be6c5 100644
--- a/shared/src/i18n/ja/admin.ts
+++ b/shared/src/i18n/ja/admin.ts
@@ -436,6 +436,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'アップデート優先',
   'admin.plugins.sortDownloads': 'ダウンロード数順',
   'admin.plugins.updatesAvailable': 'プラグインに{count}件のアップデートがあります。',
+  'admin.plugins.newerNeedsTrek': 'v{version} が利用可能 — TREK {range} が必要',
+  'admin.plugins.versionsTitle': 'バージョン',
+  'admin.plugins.versionPickerTitle': 'バージョン変更 — {name}',
+  'admin.plugins.versionSwitch': '{version} に切り替え',
+  'admin.plugins.versionNeedsTrek': 'TREK {range} が必要',
+  'admin.plugins.changeVersion': 'バージョン変更…',
+  'admin.plugins.noVersions': 'レジストリに公開バージョンが見つかりません。',
+  'admin.plugins.downgradeTitle': 'このプラグインをロールバックしますか？',
+  'admin.plugins.downgradeBody': 'v{from} から v{to} への切り替え：新しいバージョンが書き込んだデータはそのまま残り、古いバージョンはそれを認識できない可能性があります。',
+  'admin.plugins.downgradeConfirm': 'ロールバック',
+  'admin.plugins.updatesHeld': 'v{version} で更新を一時停止中',
+  'admin.plugins.resumeUpdates': '更新を再開',
+  'admin.plugins.updatesResumed': '更新を再開しました',
   'admin.plugins.updateAll': 'すべて更新',
   'admin.plugins.noMatchInstalled': '検索条件に一致するインストール済みプラグインはありません。',
   'admin.plugins.noMatchRegistry': '検索条件に一致するプラグインはレジストリにありません。',
diff --git a/shared/src/i18n/ko/admin.ts b/shared/src/i18n/ko/admin.ts
index 30de344b5..fe36bad8e 100644
--- a/shared/src/i18n/ko/admin.ts
+++ b/shared/src/i18n/ko/admin.ts
@@ -436,6 +436,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': '업데이트 우선',
   'admin.plugins.sortDownloads': '다운로드순',
   'admin.plugins.updatesAvailable': '플러그인 업데이트 {count}건이 있습니다.',
+  'admin.plugins.newerNeedsTrek': 'v{version} 사용 가능 — TREK {range} 필요',
+  'admin.plugins.versionsTitle': '버전',
+  'admin.plugins.versionPickerTitle': '버전 변경 — {name}',
+  'admin.plugins.versionSwitch': '{version}(으)로 전환',
+  'admin.plugins.versionNeedsTrek': 'TREK {range} 필요',
+  'admin.plugins.changeVersion': '버전 변경…',
+  'admin.plugins.noVersions': '레지스트리에서 게시된 버전을 찾을 수 없습니다.',
+  'admin.plugins.downgradeTitle': '이 플러그인을 롤백하시겠습니까?',
+  'admin.plugins.downgradeBody': 'v{from}에서 v{to}(으)로 전환: 최신 버전이 기록한 데이터는 그대로 유지되며, 이전 버전이 이를 인식하지 못할 수 있습니다.',
+  'admin.plugins.downgradeConfirm': '롤백',
+  'admin.plugins.updatesHeld': 'v{version}에서 업데이트 일시 중지됨',
+  'admin.plugins.resumeUpdates': '업데이트 재개',
+  'admin.plugins.updatesResumed': '업데이트가 재개되었습니다',
   'admin.plugins.updateAll': '모두 업데이트',
   'admin.plugins.noMatchInstalled': '검색과 일치하는 설치된 플러그인이 없습니다.',
   'admin.plugins.noMatchRegistry': '레지스트리에 검색과 일치하는 플러그인이 없습니다.',
diff --git a/shared/src/i18n/nl/admin.ts b/shared/src/i18n/nl/admin.ts
index d4927bad9..b803a3e4d 100644
--- a/shared/src/i18n/nl/admin.ts
+++ b/shared/src/i18n/nl/admin.ts
@@ -423,6 +423,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Updates eerst',
   'admin.plugins.sortDownloads': 'Meest gedownload',
   'admin.plugins.updatesAvailable': '{count} updates beschikbaar voor je plugins.',
+  'admin.plugins.newerNeedsTrek': 'v{version} beschikbaar — vereist TREK {range}',
+  'admin.plugins.versionsTitle': 'Versies',
+  'admin.plugins.versionPickerTitle': 'Versie wijzigen — {name}',
+  'admin.plugins.versionSwitch': 'Overschakelen naar {version}',
+  'admin.plugins.versionNeedsTrek': 'vereist TREK {range}',
+  'admin.plugins.changeVersion': 'Versie wijzigen…',
+  'admin.plugins.noVersions': 'Geen gepubliceerde versies gevonden in het register.',
+  'admin.plugins.downgradeTitle': 'Deze plugin terugdraaien?',
+  'admin.plugins.downgradeBody': 'Overschakelen van v{from} naar v{to}: gegevens die door de nieuwere versie zijn geschreven blijven staan, en de oudere versie begrijpt ze mogelijk niet.',
+  'admin.plugins.downgradeConfirm': 'Terugdraaien',
+  'admin.plugins.updatesHeld': 'Updates gepauzeerd op v{version}',
+  'admin.plugins.resumeUpdates': 'Updates hervatten',
+  'admin.plugins.updatesResumed': 'Updates hervat',
   'admin.plugins.updateAll': 'Alles bijwerken',
   'admin.plugins.noMatchInstalled': 'Geen geïnstalleerde plugins komen overeen met je zoekopdracht.',
   'admin.plugins.noMatchRegistry': 'Geen plugins in het register komen overeen met je zoekopdracht.',
diff --git a/shared/src/i18n/pl/admin.ts b/shared/src/i18n/pl/admin.ts
index a3d90216d..59cccf9e9 100644
--- a/shared/src/i18n/pl/admin.ts
+++ b/shared/src/i18n/pl/admin.ts
@@ -421,6 +421,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Najpierw aktualizacje',
   'admin.plugins.sortDownloads': 'Najczęściej pobierane',
   'admin.plugins.updatesAvailable': 'Dostępne aktualizacje dla Twoich wtyczek: {count}.',
+  'admin.plugins.newerNeedsTrek': 'v{version} dostępna — wymaga TREK {range}',
+  'admin.plugins.versionsTitle': 'Wersje',
+  'admin.plugins.versionPickerTitle': 'Zmień wersję — {name}',
+  'admin.plugins.versionSwitch': 'Przełącz na {version}',
+  'admin.plugins.versionNeedsTrek': 'wymaga TREK {range}',
+  'admin.plugins.changeVersion': 'Zmień wersję…',
+  'admin.plugins.noVersions': 'Nie znaleziono opublikowanych wersji w rejestrze.',
+  'admin.plugins.downgradeTitle': 'Przywrócić starszą wersję tej wtyczki?',
+  'admin.plugins.downgradeBody': 'Przejście z v{from} na v{to}: dane zapisane przez nowszą wersję pozostają, a starsza wersja może ich nie rozumieć.',
+  'admin.plugins.downgradeConfirm': 'Przywróć',
+  'admin.plugins.updatesHeld': 'Aktualizacje wstrzymane na v{version}',
+  'admin.plugins.resumeUpdates': 'Wznów aktualizacje',
+  'admin.plugins.updatesResumed': 'Wznowiono aktualizacje',
   'admin.plugins.updateAll': 'Zaktualizuj wszystkie',
   'admin.plugins.noMatchInstalled': 'Żadna zainstalowana wtyczka nie pasuje do wyszukiwania.',
   'admin.plugins.noMatchRegistry': 'Żadna wtyczka w rejestrze nie pasuje do wyszukiwania.',
diff --git a/shared/src/i18n/ru/admin.ts b/shared/src/i18n/ru/admin.ts
index c4ec1e4fb..ef613decd 100644
--- a/shared/src/i18n/ru/admin.ts
+++ b/shared/src/i18n/ru/admin.ts
@@ -425,6 +425,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Сначала с обновлениями',
   'admin.plugins.sortDownloads': 'По загрузкам',
   'admin.plugins.updatesAvailable': 'Доступно обновлений для ваших плагинов: {count}.',
+  'admin.plugins.newerNeedsTrek': 'Доступна v{version} — требуется TREK {range}',
+  'admin.plugins.versionsTitle': 'Версии',
+  'admin.plugins.versionPickerTitle': 'Сменить версию — {name}',
+  'admin.plugins.versionSwitch': 'Перейти на {version}',
+  'admin.plugins.versionNeedsTrek': 'требуется TREK {range}',
+  'admin.plugins.changeVersion': 'Сменить версию…',
+  'admin.plugins.noVersions': 'В реестре не найдено опубликованных версий.',
+  'admin.plugins.downgradeTitle': 'Откатить этот плагин?',
+  'admin.plugins.downgradeBody': 'Переход с v{from} на v{to}: данные, записанные более новой версией, остаются на месте, и старая версия может их не понять.',
+  'admin.plugins.downgradeConfirm': 'Откатить',
+  'admin.plugins.updatesHeld': 'Обновления приостановлены на v{version}',
+  'admin.plugins.resumeUpdates': 'Возобновить обновления',
+  'admin.plugins.updatesResumed': 'Обновления возобновлены',
   'admin.plugins.updateAll': 'Обновить все',
   'admin.plugins.noMatchInstalled': 'Нет установленных плагинов по вашему запросу.',
   'admin.plugins.noMatchRegistry': 'В реестре нет плагинов по вашему запросу.',
diff --git a/shared/src/i18n/sv/admin.ts b/shared/src/i18n/sv/admin.ts
index 473e23dc8..d222807cf 100644
--- a/shared/src/i18n/sv/admin.ts
+++ b/shared/src/i18n/sv/admin.ts
@@ -479,6 +479,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Uppdateringar först',
   'admin.plugins.sortDownloads': 'Mest nedladdade',
   'admin.plugins.updatesAvailable': '{count} uppdateringar tillgängliga för dina plugins.',
+  'admin.plugins.newerNeedsTrek': 'v{version} tillgänglig — kräver TREK {range}',
+  'admin.plugins.versionsTitle': 'Versioner',
+  'admin.plugins.versionPickerTitle': 'Byt version — {name}',
+  'admin.plugins.versionSwitch': 'Byt till {version}',
+  'admin.plugins.versionNeedsTrek': 'kräver TREK {range}',
+  'admin.plugins.changeVersion': 'Byt version…',
+  'admin.plugins.noVersions': 'Inga publicerade versioner hittades i registret.',
+  'admin.plugins.downgradeTitle': 'Rulla tillbaka detta tillägg?',
+  'admin.plugins.downgradeBody': 'Byte från v{from} till v{to}: data som skrivits av den nyare versionen finns kvar, och den äldre versionen kanske inte förstår dem.',
+  'admin.plugins.downgradeConfirm': 'Rulla tillbaka',
+  'admin.plugins.updatesHeld': 'Uppdateringar pausade vid v{version}',
+  'admin.plugins.resumeUpdates': 'Återuppta uppdateringar',
+  'admin.plugins.updatesResumed': 'Uppdateringar återupptagna',
   'admin.plugins.updateAll': 'Uppdatera alla',
   'admin.plugins.noMatchInstalled': 'Inga installerade plugins matchar din sökning.',
   'admin.plugins.noMatchRegistry': 'Inga plugins i registret matchar din sökning.',
diff --git a/shared/src/i18n/tr/admin.ts b/shared/src/i18n/tr/admin.ts
index 0cbeb6721..21b427b28 100644
--- a/shared/src/i18n/tr/admin.ts
+++ b/shared/src/i18n/tr/admin.ts
@@ -468,6 +468,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Önce güncellemeler',
   'admin.plugins.sortDownloads': 'En çok indirilen',
   'admin.plugins.updatesAvailable': 'Eklentileriniz için {count} güncelleme mevcut.',
+  'admin.plugins.newerNeedsTrek': 'v{version} mevcut — TREK {range} gerektirir',
+  'admin.plugins.versionsTitle': 'Sürümler',
+  'admin.plugins.versionPickerTitle': 'Sürüm değiştir — {name}',
+  'admin.plugins.versionSwitch': '{version} sürümüne geç',
+  'admin.plugins.versionNeedsTrek': 'TREK {range} gerektirir',
+  'admin.plugins.changeVersion': 'Sürüm değiştir…',
+  'admin.plugins.noVersions': 'Kayıt defterinde yayımlanmış sürüm bulunamadı.',
+  'admin.plugins.downgradeTitle': 'Bu eklenti geri alınsın mı?',
+  'admin.plugins.downgradeBody': 'v{from} sürümünden v{to} sürümüne geçiş: daha yeni sürümün yazdığı veriler yerinde kalır ve eski sürüm bunları anlamayabilir.',
+  'admin.plugins.downgradeConfirm': 'Geri al',
+  'admin.plugins.updatesHeld': 'Güncellemeler v{version} sürümünde duraklatıldı',
+  'admin.plugins.resumeUpdates': 'Güncellemeleri sürdür',
+  'admin.plugins.updatesResumed': 'Güncellemeler sürdürüldü',
   'admin.plugins.updateAll': 'Tümünü güncelle',
   'admin.plugins.noMatchInstalled': 'Aramanızla eşleşen yüklü eklenti yok.',
   'admin.plugins.noMatchRegistry': 'Dizinde aramanızla eşleşen eklenti yok.',
diff --git a/shared/src/i18n/uk/admin.ts b/shared/src/i18n/uk/admin.ts
index 6634fda54..42441282d 100644
--- a/shared/src/i18n/uk/admin.ts
+++ b/shared/src/i18n/uk/admin.ts
@@ -422,6 +422,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Спочатку оновлення',
   'admin.plugins.sortDownloads': 'За завантаженнями',
   'admin.plugins.updatesAvailable': 'Для ваших плагінів доступно оновлень: {count}.',
+  'admin.plugins.newerNeedsTrek': 'Доступна v{version} — потрібен TREK {range}',
+  'admin.plugins.versionsTitle': 'Версії',
+  'admin.plugins.versionPickerTitle': 'Змінити версію — {name}',
+  'admin.plugins.versionSwitch': 'Перейти на {version}',
+  'admin.plugins.versionNeedsTrek': 'потрібен TREK {range}',
+  'admin.plugins.changeVersion': 'Змінити версію…',
+  'admin.plugins.noVersions': 'У реєстрі не знайдено опублікованих версій.',
+  'admin.plugins.downgradeTitle': 'Відкотити цей плагін?',
+  'admin.plugins.downgradeBody': 'Перехід з v{from} на v{to}: дані, записані новішою версією, залишаються, і старіша версія може їх не розуміти.',
+  'admin.plugins.downgradeConfirm': 'Відкотити',
+  'admin.plugins.updatesHeld': 'Оновлення призупинено на v{version}',
+  'admin.plugins.resumeUpdates': 'Відновити оновлення',
+  'admin.plugins.updatesResumed': 'Оновлення відновлено',
   'admin.plugins.updateAll': 'Оновити все',
   'admin.plugins.noMatchInstalled': 'Жоден встановлений плагін не відповідає вашому запиту.',
   'admin.plugins.noMatchRegistry': 'Жоден плагін у реєстрі не відповідає вашому запиту.',
diff --git a/shared/src/i18n/vi/admin.ts b/shared/src/i18n/vi/admin.ts
index 170c10c49..e3c00665d 100644
--- a/shared/src/i18n/vi/admin.ts
+++ b/shared/src/i18n/vi/admin.ts
@@ -421,6 +421,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': 'Ưu tiên bản cập nhật',
   'admin.plugins.sortDownloads': 'Tải nhiều nhất',
   'admin.plugins.updatesAvailable': 'Có {count} bản cập nhật cho các plugin của bạn.',
+  'admin.plugins.newerNeedsTrek': 'Đã có v{version} — cần TREK {range}',
+  'admin.plugins.versionsTitle': 'Phiên bản',
+  'admin.plugins.versionPickerTitle': 'Đổi phiên bản — {name}',
+  'admin.plugins.versionSwitch': 'Chuyển sang {version}',
+  'admin.plugins.versionNeedsTrek': 'cần TREK {range}',
+  'admin.plugins.changeVersion': 'Đổi phiên bản…',
+  'admin.plugins.noVersions': 'Không tìm thấy phiên bản đã xuất bản trong sổ đăng ký.',
+  'admin.plugins.downgradeTitle': 'Quay lại phiên bản cũ của plugin này?',
+  'admin.plugins.downgradeBody': 'Chuyển từ v{from} sang v{to}: dữ liệu do phiên bản mới hơn ghi vẫn còn nguyên, và phiên bản cũ hơn có thể không hiểu được.',
+  'admin.plugins.downgradeConfirm': 'Quay lại',
+  'admin.plugins.updatesHeld': 'Đã tạm dừng cập nhật ở v{version}',
+  'admin.plugins.resumeUpdates': 'Tiếp tục cập nhật',
+  'admin.plugins.updatesResumed': 'Đã tiếp tục cập nhật',
   'admin.plugins.updateAll': 'Cập nhật tất cả',
   'admin.plugins.noMatchInstalled': 'Không có plugin đã cài đặt nào khớp với tìm kiếm của bạn.',
   'admin.plugins.noMatchRegistry': 'Không có plugin nào trong kho đăng ký khớp với tìm kiếm của bạn.',
diff --git a/shared/src/i18n/zh-TW/admin.ts b/shared/src/i18n/zh-TW/admin.ts
index ed1274b46..47d4845f3 100644
--- a/shared/src/i18n/zh-TW/admin.ts
+++ b/shared/src/i18n/zh-TW/admin.ts
@@ -418,6 +418,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': '更新優先',
   'admin.plugins.sortDownloads': '下載最多',
   'admin.plugins.updatesAvailable': '你的外掛有 {count} 項可用更新。',
+  'admin.plugins.newerNeedsTrek': 'v{version} 可用 — 需要 TREK {range}',
+  'admin.plugins.versionsTitle': '版本',
+  'admin.plugins.versionPickerTitle': '更換版本 — {name}',
+  'admin.plugins.versionSwitch': '切換到 {version}',
+  'admin.plugins.versionNeedsTrek': '需要 TREK {range}',
+  'admin.plugins.changeVersion': '更換版本…',
+  'admin.plugins.noVersions': '在登錄檔中未找到已發布的版本。',
+  'admin.plugins.downgradeTitle': '回滾此外掛？',
+  'admin.plugins.downgradeBody': '從 v{from} 切換到 v{to}：較新版本寫入的資料將保留，較舊版本可能無法識別這些資料。',
+  'admin.plugins.downgradeConfirm': '回滾',
+  'admin.plugins.updatesHeld': '更新已暫停在 v{version}',
+  'admin.plugins.resumeUpdates': '恢復更新',
+  'admin.plugins.updatesResumed': '已恢復更新',
   'admin.plugins.updateAll': '全部更新',
   'admin.plugins.noMatchInstalled': '沒有符合搜尋條件的已安裝外掛。',
   'admin.plugins.noMatchRegistry': '外掛庫中沒有符合搜尋條件的外掛。',
diff --git a/shared/src/i18n/zh/admin.ts b/shared/src/i18n/zh/admin.ts
index 66f49b88e..4277fa72b 100644
--- a/shared/src/i18n/zh/admin.ts
+++ b/shared/src/i18n/zh/admin.ts
@@ -378,6 +378,19 @@ const admin: TranslationStrings = {
   'admin.plugins.sortUpdates': '优先显示有更新的',
   'admin.plugins.sortDownloads': '下载最多',
   'admin.plugins.updatesAvailable': '你的插件有 {count} 个可用更新。',
+  'admin.plugins.newerNeedsTrek': 'v{version} 可用 — 需要 TREK {range}',
+  'admin.plugins.versionsTitle': '版本',
+  'admin.plugins.versionPickerTitle': '更换版本 — {name}',
+  'admin.plugins.versionSwitch': '切换到 {version}',
+  'admin.plugins.versionNeedsTrek': '需要 TREK {range}',
+  'admin.plugins.changeVersion': '更换版本…',
+  'admin.plugins.noVersions': '在注册表中未找到已发布的版本。',
+  'admin.plugins.downgradeTitle': '回滚此插件？',
+  'admin.plugins.downgradeBody': '从 v{from} 切换到 v{to}：较新版本写入的数据将保留，较旧版本可能无法识别这些数据。',
+  'admin.plugins.downgradeConfirm': '回滚',
+  'admin.plugins.updatesHeld': '更新已暂停在 v{version}',
+  'admin.plugins.resumeUpdates': '恢复更新',
+  'admin.plugins.updatesResumed': '已恢复更新',
   'admin.plugins.updateAll': '全部更新',
   'admin.plugins.noMatchInstalled': '没有已安装的插件与你的搜索匹配。',
   'admin.plugins.noMatchRegistry': '插件库中没有与你的搜索匹配的插件。',
diff --git a/shared/src/plugin-permissions.ts b/shared/src/plugin-permissions.ts
index 3004701a9..752daca74 100644
--- a/shared/src/plugin-permissions.ts
+++ b/shared/src/plugin-permissions.ts
@@ -1,5 +1,5 @@
 // GENERATED — do not edit by hand.
-// Source: server/src/nest/plugins/protocol/envelope.ts
+// Source: server/src/nest/plugins/protocol/envelope.ts + server/src/plugin-event-sink.ts
 // Regenerate: node --import tsx server/scripts/gen-plugin-facts.ts
 
 /** Widened on purpose so client callers can .includes() with a plain string. */
diff --git a/shared/vitest.config.ts b/shared/vitest.config.ts
new file mode 100644
index 000000000..dc98ad27c
--- /dev/null
+++ b/shared/vitest.config.ts
@@ -0,0 +1,22 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    coverage: {
+      provider: 'v8',
+      reporter: ['lcov', 'text'],
+      reportsDirectory: './coverage',
+      include: ['src/**/*.ts'],
+      // Mirrored in sonar.coverage.exclusions — a file skipped here emits no
+      // lcov entry, so Sonar must not count it as uncovered either.
+      exclude: [
+        // Machine-generated by server/scripts/gen-plugin-facts.ts.
+        'src/plugin-permissions.ts',
+        // Per-locale string tables are data, not executable code; the parity
+        // specs import every locale, which would report them as 100% covered
+        // and inflate the package number.
+        'src/i18n/*/**',
+      ],
+    },
+  },
+});
diff --git a/sonar-project.properties b/sonar-project.properties
index 25af293be..4f79484ad 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,4 +1,5 @@
-sonar.projectKey=TREK
+sonar.projectKey=liketrek_TREK
+sonar.organization=liketrek
 sonar.projectName=TREK
 sonar.sourceEncoding=UTF-8
 
@@ -6,7 +7,8 @@ sonar.sourceEncoding=UTF-8
 sonar.sources=client/src,server/src,shared/src,plugin-sdk/src
 
 # Tests — dedicated test dirs per package, plus co-located client tests in src
-sonar.tests=server/tests,client/tests,client/e2e,client/src,plugin-sdk/test
+# and co-located shared schema/sanitize/i18n specs in shared/src
+sonar.tests=server/tests,client/tests,client/e2e,client/src,shared/src,plugin-sdk/test
 sonar.test.inclusions=\
    server/tests/**/*.test.ts,\
    client/tests/**/*.test.ts,\
@@ -14,6 +16,7 @@ sonar.test.inclusions=\
    client/e2e/**/*.spec.ts,\
    client/src/**/*.test.ts,\
    client/src/**/*.test.tsx,\
+   shared/src/**/*.spec.ts,\
    plugin-sdk/test/**/*.test.ts
 
 # Keep generated output and test files out of source analysis
@@ -25,28 +28,92 @@ sonar.exclusions=\
    client/dev-dist/**,\
    **/*.test.ts,\
    **/*.test.tsx,\
+   **/*.spec.ts,\
    **/*.d.ts
 
-# Coverage — lcov paths relative to repo root.
-# shared/ has no tests yet and plugin-sdk doesn't emit lcov; see coverage exclusions.
+# Coverage — lcov paths relative to repo root, one per package
+# (each package's vitest config emits lcov to <pkg>/coverage/).
 sonar.javascript.lcov.reportPaths=\
    server/coverage/lcov.info,\
-   client/coverage/lcov.info
+   client/coverage/lcov.info,\
+   shared/coverage/lcov.info,\
+   plugin-sdk/coverage/lcov.info
 
-# Infrastructure/bootstrap files and packages without coverage instrumentation
+# Infrastructure/bootstrap files plus generated/data files the vitest configs
+# exclude from instrumentation (a file absent from lcov would otherwise count
+# as 0% covered here — keep these in sync with each package's vitest.config.ts)
 sonar.coverage.exclusions=\
    server/src/index.ts,\
    server/src/config.ts,\
-   server/src/scheduler.ts,\
    server/src/db/database.ts,\
    server/src/db/migrations.ts,\
    server/src/db/seeds.ts,\
    server/src/demo/**,\
    server/src/nest/plugins/runtime/plugin-host-entry.ts,\
+   server/assets/**,\
    client/src/main.tsx,\
    client/src/types.ts,\
-   shared/src/**,\
-   plugin-sdk/src/**
+   shared/src/plugin-permissions.ts,\
+   shared/src/i18n/*/**,\
+   plugin-sdk/src/generated/**,\
+   plugin-sdk/src/lucide-icon-names.ts
 
 # Locale files are large near-identical literal objects — keep them out of duplication metrics
 sonar.cpd.exclusions=shared/src/i18n/**
+
+
+# Only categorical, path-wide suppressions live here — cases where the rule can
+# never meaningfully apply to anything in the path. Instance-specific findings
+# (a handful of flagged lines in one file) are resolved as false positive /
+# accepted / reviewed-safe on SonarCloud instead, so a future violation of the
+# same rule in the same file still surfaces.
+sonar.issue.ignore.multicriteria=i18nsec1,i18nsec2,i18nsec3,rand1,rand2,path1,empty2
+
+
+# Locale files are UI copy — strings like "Password", "API key", "token" are
+# labels, not credentials, and the secret detectors false-positive on them
+# constantly. Ignore the secrets analyzer and the hard-coded-credential rules on
+# the locale directories only (shared/src/i18n/*/** — the top-level code files
+# such as languages.ts stay fully scanned).
+
+sonar.issue.ignore.multicriteria.i18nsec1.ruleKey=secrets:*
+sonar.issue.ignore.multicriteria.i18nsec1.resourceKey=shared/src/i18n/*/**
+sonar.issue.ignore.multicriteria.i18nsec2.ruleKey=typescript:S2068
+sonar.issue.ignore.multicriteria.i18nsec2.resourceKey=shared/src/i18n/*/**
+sonar.issue.ignore.multicriteria.i18nsec3.ruleKey=typescript:S6418
+sonar.issue.ignore.multicriteria.i18nsec3.resourceKey=shared/src/i18n/*/**
+
+
+# S2245 (Math.random in a security context) — Studio + studioStore only: minting
+# element and spread ids with Math.random is pervasive by design there (uid()
+# helpers across the whole component tree), so per-instance marks would recur on
+# every refactor. The ids live inside the photo-book document, stored and
+# fetched as one blob scoped by journey id — the server never indexes, looks up
+# or authorizes on an element or spread id. Worst case of a collision is
+# documented in studioStore itself: two elements would share a selection.
+
+sonar.issue.ignore.multicriteria.rand1.ruleKey=typescript:S2245
+sonar.issue.ignore.multicriteria.rand1.resourceKey=client/src/components/Studio/**
+sonar.issue.ignore.multicriteria.rand2.ruleKey=typescript:S2245
+sonar.issue.ignore.multicriteria.rand2.resourceKey=client/src/store/studioStore.ts
+
+
+# S4036 (OS command via PATH) — the plugin SDK is a CLI a plugin author runs on
+# their own machine, and reaching git/gh/npm through the developer's own PATH is
+# the point of it. Every child-process invocation passes an argv array with no
+# shell, so nothing is shell-parsed. The one server-side site was NOT
+# suppressed: it resolves its binary to an absolute path before spawning
+# (see server/src/nest/booking-import/kitinerary-extractor.service.ts).
+
+sonar.issue.ignore.multicriteria.path1.ruleKey=typescript:S4036
+sonar.issue.ignore.multicriteria.path1.resourceKey=plugin-sdk/src/cli/**
+
+
+# S4158 (empty collection accessed) — client/src/managed is a build-time seam:
+# the arrays are empty in this repo and in every build of it, and an operator
+# shipping extra screens replaces the file. Its header comment makes reading
+# them unconditionally a rule, so the public build takes the same code path as
+# a managed one.
+
+sonar.issue.ignore.multicriteria.empty2.ruleKey=typescript:S4158
+sonar.issue.ignore.multicriteria.empty2.resourceKey=client/src/managed/**
diff --git a/wiki/AI-Booking-Import.md b/wiki/AI-Booking-Import.md
index 420a9aa9e..f0a2725d7 100644
--- a/wiki/AI-Booking-Import.md
+++ b/wiki/AI-Booking-Import.md
@@ -4,7 +4,7 @@ The **AI Parsing** addon adds a large-language-model fallback to TREK's booking
 
 It is an **opt-in addon, disabled by default**, and it works with a self-hosted local model, so no booking data has to leave your server.
 
-> **Admin:** Enable **AI Parsing** in [Admin-Addons](Admin-Addons) (it sits in the *Integration* group). Booking import itself still requires the `kitinerary-extractor` binary — see [Reservations-and-Bookings](Reservations-and-Bookings#when-the-button-is-not-visible).
+> **Admin:** Enable **AI Parsing** in [Admin-Addons](Admin-Addons) (it sits in the *Integration* group). Booking import then works even without the `kitinerary-extractor` binary — with no extractor present the model parses every uploaded file instead of only the ones Itinerary can't read. Installing the extractor is still the better setup: structured tickets stay fast and deterministic and the model remains a fallback. Configure a provider and model before pointing anyone at it, though: the **Import from file** button appears as soon as the addon is on, and with neither an extractor nor a configured model the import fails outright. See [Reservations-and-Bookings](Reservations-and-Bookings#import-from-booking-confirmation).
 
 ## How it fits with normal import
 
@@ -12,9 +12,9 @@ AI parsing does not replace [KDE Itinerary](Reservations-and-Bookings) — it ba
 
 1. Every uploaded file is parsed by KDE Itinerary first.
 2. Only files that Itinerary returns **nothing** for are sent to the AI model.
-3. Every reservation the AI produces is flagged **Review** so you can confirm it before (or after) saving.
+3. Because LLM extraction is less certain, every reservation the AI produces is marked for review internally, and the import walks you through the normal editor item by item to confirm and correct it before it is saved. The mark never becomes a visible badge: the review editor saves each booking as reviewed, so a saved AI import carries no **Review** flag.
 
-So structured tickets keep being parsed the fast, deterministic way; the AI only steps in for the documents that would otherwise fail. If the addon is disabled, import behaves exactly as before.
+So structured tickets keep being parsed the fast, deterministic way; the AI only steps in for the documents that would otherwise fail. If the addon is disabled, import behaves exactly as before. On an install without the extractor there is nothing to back up — every file goes straight to the model.
 
 ## Choosing a provider
 
@@ -54,9 +54,11 @@ You can also select any other model already installed on the server, or type a m
 
 If an admin leaves the instance config blank, each user can configure their own model under **Settings → Integrations → AI parsing** (the section only appears when the addon is enabled):
 
-> *Use your own AI model to extract bookings from uploaded files. This applies only when your administrator has not configured a model for the whole instance.*
+> *Choose the AI model used to extract bookings from uploaded files. This applies only when your administrator has not configured a model for the whole instance.*
 
-The fields mirror the admin panel — provider, model, base URL (for local / OpenAI), and an API key that is *stored encrypted* (leave blank to keep the current key). There is also a **Send documents as images** toggle for vision-capable models.
+The fields are a **Provider** (only **OpenAI** or **Anthropic** here), a **Model** id, and an **API key** that is *stored encrypted* (leave blank to keep the current key). There is no personal Base URL: the address this server calls is instance configuration, so a local (Ollama) model can only be set up by an admin on the addon, and the server answers 403 to anyone, admins included, who tries to store a personal base URL or a personal `local` provider.
+
+There is also a **Send documents as images** toggle. It is stored per user, but extraction currently ignores it: only Anthropic is sent the raw PDF, every other provider always gets the extracted text.
 
 > **Precedence:** an admin instance model always wins. Personal settings only take effect when no instance-wide model is configured.
 
@@ -64,18 +66,24 @@ The fields mirror the admin panel — provider, model, base URL (for local / Ope
 
 The upload flow is the normal booking import — the AI simply runs behind it:
 
-1. In the trip planner, open the **Reservations** tab and click **Import from file**.
+1. In the trip planner, open the **Bookings** tab and click **Import from file**.
 2. Drop your files (EML, PDF, PKPass, HTML, TXT — up to 5 files, 10 MB each) onto the upload area.
 3. The upload dialog closes right away and a **background widget** (bottom-right) shows *Parsing files…* with a running count. You can keep navigating TREK while it works; the widget survives a page reload and even follows you to other pages.
 4. When parsing finishes, click the widget's **Import** button to start the review.
 5. Each parsed booking opens **pre-filled in the normal reservation (or transport) editor**, one at a time. Nothing is saved until you confirm each one.
 
+### When nothing is found
+
+If a job finishes with *No reservations could be extracted*, the widget offers a **Try AI parsing** button. It re-uploads the same files in force-AI mode: KDE Itinerary is skipped entirely and every file goes straight to the model. The offer only appears on an empty result, and never on a run that was already forced. If neither an instance-wide nor a personal model is configured, the retry fails with the error on the card instead of starting.
+
+It is a retry, not a different route — on a normal import the model has already seen every file Itinerary returned nothing for, so it is worth pressing mainly when the addon or the model was configured after that job started. There is no way to push a document Itinerary *did* read through the model: as soon as the parse produced any booking at all, the widget shows **Import** and no retry button. Fix such a booking in the review editor instead.
+
 ### What gets filled in and created
 
 The model is asked to capture the full booking — including **every leg of a multi-segment flight** — and, on save, TREK wires each item into the trip:
 
 - **Fields** — booking/confirmation code, dates and times, and per type: seat, class, platform, total price and currency; hotels bring their address, rental cars their company, restaurants and events their venue with phone and website.
-- **Places** — hotel, restaurant and event venues (and un-geocoded transport stops) are geocoded and added as trip places, so the map pin appears.
+- **Places** — only a **hotel** booking becomes a trip place. On save the review editor reuses an existing trip place whose name matches; otherwise the reviewed address is geocoded and a new place is created and linked, so the map pin appears. Transport stops are geocoded while the files are parsed, but they are stored on the booking as its **From → To endpoints**, not as trip places — a stop that could not be located is listed as a warning on the parse result and is dropped when you save, so fix it in the review editor first. Restaurant and event venues arrive only as the booking's location text: the editor can link a place that already exists in the trip, but it never creates one for you.
 - **Accommodations** — a hotel booking creates the accommodation on the matching check-in/check-out days.
 - **Linked cost** — if the [Costs/Budget addon](Budget-Tracking) is enabled and the booking has a price, a linked expense is created. Without that addon, the price stays on the reservation only.
 - **Source document** — the uploaded file is attached to the reservation's files.
diff --git a/wiki/Accommodations.md b/wiki/Accommodations.md
index 49f681153..f617e333e 100644
--- a/wiki/Accommodations.md
+++ b/wiki/Accommodations.md
@@ -6,7 +6,7 @@ Link an accommodation to specific check-in and check-out days so it appears for
 
 There are two ways to create an accommodation:
 
-**From the Reservations panel:** Click **Add** and select **Hotel** as the booking type. When the type is set to Hotel, the date/time and location fields are replaced by accommodation-specific inputs (see below). Saving the form creates both the hotel reservation and the underlying accommodation record at the same time.
+**From the Reservations panel:** Click **Manual Booking** and select **Hotel** as the booking type. When the type is set to Hotel, the date/time and location fields are replaced by accommodation-specific inputs (see below). Saving the form creates both the hotel reservation and the underlying accommodation record at the same time.
 
 **From the Day Detail panel:** Click the hotel icon or the **Add accommodation** button in the Day Detail overlay. A picker appears that lets you select a place from the trip, choose the day range, and optionally fill in check-in/check-out times and a confirmation code. This creates the accommodation record and its linked Hotel reservation together.
 
diff --git a/wiki/Admin-Addons.md b/wiki/Admin-Addons.md
index f38c33aac..e600860f8 100644
--- a/wiki/Admin-Addons.md
+++ b/wiki/Admin-Addons.md
@@ -31,10 +31,11 @@ Each sub-toggle can be disabled independently while the parent addon remains ena
 
 ### Global addons
 
-Global addons add features that are not tied to a single trip. The default global addons are **Vacay**, **Atlas**, and **Journey**.
+Global addons add features that are not tied to a single trip. The default global addons are **Vacay**, **Atlas**, **Collections**, and **Journey**.
 
 - **Vacay** — personal vacation day planner with calendar view. Enabled by default.
 - **Atlas** — world map of visited countries with travel stats. Enabled by default.
+- **Collections** — personal place library: save places across trips into named lists, copy them into any trip, and share them. **Disabled by default.** See [Collections](Collections).
 - **Journey** — trip tracking and travel journal (check-ins, photos, daily stories). **Disabled by default.**
 
 **Sub-items on global addons:**
@@ -43,9 +44,11 @@ Global addons add features that are not tied to a single trip. The default globa
 
 ### Integration addons
 
-Integration addons connect TREK to external services. Enabling an integration addon typically requires additional configuration (API keys, URLs) in the **Settings** tab.
+Integration addons connect TREK to external services. Most of them need additional configuration (API keys, URLs) once enabled, but not in the admin **Settings** tab — each one has its own place.
 
 - The **MCP** addon requires `APP_URL` to be set in your environment. When enabled, the **MCP Access** tab appears in the Admin Panel. **Disabled by default.** See [MCP-Overview](MCP-Overview) for full details.
+- The **AirTrail** addon syncs flights from a self-hosted AirTrail instance. **Disabled by default.** The toggle here is the instance-wide switch only; each user connects their own instance (URL + API key) in **Settings → Integrations**.
+- The **AI Parsing** addon is the LLM fallback for booking imports KItinerary cannot read. **Disabled by default.** When enabled, its provider, base URL, API key, and model fields appear inline underneath the addon row. Filling them in sets the instance-wide config for all users; leaving them blank lets each user configure their own provider in **Settings → Integrations**. See [AI-Booking-Import](AI-Booking-Import).
 
 ## Enabling or disabling an addon
 
diff --git a/wiki/Admin-Categories.md b/wiki/Admin-Categories.md
index 0b5d40f4a..ad1c4cebe 100644
--- a/wiki/Admin-Categories.md
+++ b/wiki/Admin-Categories.md
@@ -11,7 +11,7 @@ A category is a label consisting of a name, a color, and an icon. Users assign c
 - In the place form's category selector
 - As colored chips on place cards
 - In the places filter panel
-- In the map legend
+- As the color of a place's map marker, and in the marker's hover popup
 
 ## Creating a category
 
diff --git a/wiki/Admin-GitHub-Releases.md b/wiki/Admin-GitHub-Releases.md
index c24b9ec4b..056216741 100644
--- a/wiki/Admin-GitHub-Releases.md
+++ b/wiki/Admin-GitHub-Releases.md
@@ -26,7 +26,7 @@ Below the support cards, a chronological timeline lists GitHub releases for the
 - **Release date** and author
 - A **Show details / Hide details** toggle that expands the release notes (Markdown rendered inline)
 
-When the running server version is a stable release, pre-release entries are filtered out of the timeline.
+Pre-release entries are hidden unless the server has both found a newer version and is itself running a pre-release. In every other case, including a pre-release install that is already on the newest pre-release, the timeline shows stable releases only.
 
 Releases load 10 at a time. Click **Load more** at the bottom of the timeline to fetch additional pages.
 
diff --git a/wiki/Admin-MCP-Tokens.md b/wiki/Admin-MCP-Tokens.md
index 2db0004ad..c3f7f4caf 100644
--- a/wiki/Admin-MCP-Tokens.md
+++ b/wiki/Admin-MCP-Tokens.md
@@ -14,7 +14,7 @@ OAuth sessions are created when a user authorizes an MCP client via the OAuth 2.
 
 | Column | Description |
 |--------|-------------|
-| Client name | The name of the registered OAuth client. Granted scopes are shown as badges below the name (up to 6 are shown; click "+N more" to expand) |
+| Client | The name of the registered OAuth client. Granted scopes are shown as badges below the name (up to 6 are shown; click "+N more" to expand) |
 | Owner | The username of the user who authorized the session |
 | Created | Date the session was established |
 | (actions) | Trash icon button to revoke |
diff --git a/wiki/Admin-Panel-Overview.md b/wiki/Admin-Panel-Overview.md
index 088f99f22..a331754c7 100644
--- a/wiki/Admin-Panel-Overview.md
+++ b/wiki/Admin-Panel-Overview.md
@@ -4,7 +4,7 @@ The Admin Panel is the central control surface for TREK instance operators. It i
 
 ## Accessing the Admin Panel
 
-Navigate to the **Admin** link in the top navbar. If you do not see it, your account does not have admin privileges.
+Open the user menu in the top navigation bar (your avatar), then select **Admin**. If the entry is not there, your account does not have admin privileges.
 
 ![Admin Panel](assets/AdminPanel.png)
 
@@ -18,11 +18,11 @@ The Admin Panel is divided into tabs. Most tabs are always visible; a few appear
 | **Personalization** | Packing templates and place categories | No |
 | **User Defaults** | Default settings applied to new users | No |
 | **Addons** | Enable or disable optional features instance-wide | No |
-| **Plugins** | Install, update, and manage plugins; rescan the plugins folder; review each plugin's capability audit. See [Admin-Plugins](Admin-Plugins) | No |
+| **Plugins** | Install, update, and manage plugins; rescan the plugins folder; view each plugin's error log. See [Admin-Plugins](Admin-Plugins) | No |
 | **Storage** | Storage backends, category assignment, replication, health | Hidden on managed instances |
 | **Settings** | Authentication methods, MFA, allowed file types, API keys, OIDC/SSO configuration, and JWT secret rotation | No |
 | **Notifications** | SMTP, webhook, ntfy, and push notification channel configuration; trip reminder toggle; admin notification preferences | No |
-| **Backup** | Manual and scheduled database backups | Hidden on managed instances |
+| **Backup** | Manual and scheduled full-instance backups: database, uploads, plugin data and plugin code. See [Backups](Backups) | Hidden on managed instances |
 | **Audit** | Chronological activity log | No |
 | **MCP Access** | OAuth sessions and static API tokens | Only when the MCP addon is enabled |
 | **GitHub** | Release timeline and support links | Hidden on managed instances |
@@ -30,11 +30,39 @@ The Admin Panel is divided into tabs. Most tabs are always visible; a few appear
 
 ![Admin panel on the User Defaults tab, setting instance-wide defaults for colour mode, temperature unit, distance unit, time format, currency and blurred booking codes](assets/AdminUserDefaults.png)
 
+### Linking to a tab directly
+
+Every panel is reachable by URL, so a bookmark, an onboarding mail or a support reply can point at the one tab it is about instead of at the top of a page with thirteen of them:
+
+```
+/admin?tab=audit
+```
+
+Unlike the trip planner's `tab` parameter, this one stays in the address bar and is rewritten as you switch tabs, so the URL always says which panel you are looking at. It replaces the current history entry instead of adding one, so the back button still leaves the admin page rather than walking back through the tabs you visited.
+
+| Tab | Id |
+|-----|-----|
+| Users | `users` (the default — carries no `?tab=`) |
+| Personalization | `config` |
+| User Defaults | `defaults` |
+| Addons | `addons` |
+| Plugins | `plugins` |
+| Storage | `storage` |
+| Settings | `settings` |
+| Notifications | `notifications` |
+| Backup | `backup` |
+| Audit | `audit` |
+| MCP Access | `mcp-tokens` |
+| GitHub | `github` |
+| Dev: Notifications | `dev-notifications` |
+
+An id with no panel behind it opens **Users**, and on a managed instance the three tabs hidden there — `storage`, `github` and `backup` — fall back to **Users** as well. The other two conditional tabs behave differently: `mcp-tokens` and `dev-notifications` open their panel even when the MCP addon is off or the instance is not in development mode, with nothing highlighted in the sidebar, because the entry is missing from it.
+
 ## Plugin activity and audit
 
 Plugins that are granted data-access capabilities have every host-mediated action they take recorded in a tamper-evident, hash-chained log. This log is separate from the instance **Audit** tab described above.
 
-- **Admins** can review the per-plugin capability audit — every core-data read, broadcast, notification, and AI call a plugin made, with the acting user, the resource touched, and the outcome. This is exposed for each installed plugin in the admin plugin management view.
+- **Admins** can review the per-plugin capability audit — every core-data read, broadcast, notification, and AI call a plugin made, with the acting user, the resource touched, and the outcome. It is served by `GET /api/admin/plugins/<id>/audit`; the admin plugin view itself currently surfaces only each plugin's error log (**View error log**).
 - **Every user** (not just admins) can see the plugin actions taken in their own name under **Settings → Plugins**. This is what keeps a plugin's broad read grants accountable to the person whose data was read.
 
 See [Audit-Log](Audit-Log) for details on the hash chain and how the two logs differ.
diff --git a/wiki/Admin-Plugins.md b/wiki/Admin-Plugins.md
index 14467483a..bc86ff711 100644
--- a/wiki/Admin-Plugins.md
+++ b/wiki/Admin-Plugins.md
@@ -29,7 +29,7 @@ Both views share a toolbar: a **Search plugins…** box, a **Type** filter (Widg
 2. Click a card to open the **pre-install review dialog** (see below).
 3. Click **Install**.
 
-If the newest release requires a newer TREK than you are running, the button changes: when an older release still fits you get **Install {version}** for that one; when nothing fits, the button reads **Incompatible** and is disabled. Either way the dialog explains why in an amber note — it does not hide the reason behind a tooltip.
+If the newest release does not support the TREK you are running — either it needs a newer one, or your TREK has outgrown the upper bound it declares (`>=3.2.0 <4.0.0` on TREK 4, say) — the button changes: when an older release still fits you get **Install {version}** for that one; when nothing fits, the button reads **Incompatible** and is disabled. Either way the dialog explains why in an amber note — it does not hide the reason behind a tooltip.
 
 A newly installed plugin is **off**. Nothing runs until you enable it.
 
@@ -37,7 +37,7 @@ A newly installed plugin is **off**. Nothing runs until you enable it.
 
 Before installing, read these sections:
 
-- **What it can access** — the plugin's requested permissions, rendered as plain-language lines ("Read the trips…", "Create and edit places…"). Unknown permission codes appear verbatim. If it asks for nothing, this reads *Needs no special access.*
+- **What it can access** — a plain-language summary of what the plugin's permissions let it do ("Reads your trips", "Edits places", "Provides photos"), plus a line for its own isolated database. It is a summary, not the raw permission list: permissions TREK has no summary line for — `notify:send`, `ai:invoke`, `jobs:run`, `db:write:members` and others — do not appear here at all, and a plugin that asks only for those still reads *Needs no special access.* For the complete list, read the manifest in the plugin's source repository. Only the consent dialog for an update renders permissions code by code, unknown codes verbatim.
 - **Connects to** — every host the manifest declares it may reach, as monospace chips.
 - **Setup** — settings the plugin will ask you (or each user) to fill in, tagged **Instance-wide** or **Per user**, and **Required** where applicable.
 - **Details** — version, size, the TREK version range it requires, when it was reviewed, and total downloads.
@@ -48,7 +48,7 @@ A footer links to the **Source repository**, **Report an issue**, and the plugin
 
 Some plugins talk to a service only *you* can name — a self-hosted Gotify, ntfy, or similar. Their manifest cannot list a host, so the review dialog adds a **+ hosts you add** chip and this note:
 
-> *This plugin talks to a service only you can name (a self-hosted server). After installing, add the hosts it may reach under ⋯ → Allowed hosts. It can reach no others.*
+> *This plugin talks to a service only you can name. After installing, add the hosts it may reach under ⋯ → Allowed hosts. It can reach no others.*
 
 After install, open the row's **⋯ → Allowed hosts** dialog and add hostnames one at a time. Until you add at least one, the plugin's row shows an amber **Add allowed host** chip, because it can reach nothing and would otherwise look silently broken. Once hosts exist the chip turns blue and counts them.
 
@@ -56,10 +56,13 @@ Saving restarts the plugin so it picks up the new list — a running plugin's al
 
 ## Enabling, restarting, and disabling
 
-Each installed row has a toggle (**Enable plugin**) and shows **Active** or **Off**. A coloured dot on the icon tile reflects runtime health: active, starting, error, inactive, disabled, or incompatible.
+Each installed row has a toggle (**Enable plugin**) and shows **Active** or **Off**. A coloured dot on the icon tile reflects runtime health: green when the plugin is active, a pulsing blue while it starts, red when it has errored, grey when it is not running. Incompatibility is not a dot colour — a plugin this TREK cannot run gets an amber chip on the row instead.
 
-Enabling can be refused for good reasons, each of which opens the right remedy:
+Enabling can be refused for good reasons. The first three are version gates that run before everything else — a plugin that cannot run on this TREK is never offered a permission dialog, because consenting would not make it start:
 
+- **This TREK is outside the range the plugin declares** — the row carries an amber *Needs TREK {range} — this server runs {host}* chip and the toggle is refused. Expect this after a major upgrade: a plugin that declared `>=3.2.0 <4.0.0` stops activating on TREK 4 even though it ran fine the day before. There is no dialog to click through, it takes a release from the author that admits this TREK — and once the registry has one, the row's **Update** button offers it.
+- **The plugin does not say which TREK versions it supports** — the chip reads *Does not say which TREK versions it supports*. That is a plugin folder which predates the range field or was dropped into the plugins directory by hand: **Rescan** registers it rather than letting it vanish silently, and the gate then refuses it instead of guessing. It needs a manifest with a `trek` range.
+- **The plugin needs a newer plugin API** — its manifest's `apiVersion` is higher than the plugin API this TREK implements (currently v1). Install, upload, and dev-link reject that up front, so this only shows for a plugin picked up from the plugins directory on disk — registered at the next restart, or when you press **Rescan**.
 - **A required addon is disabled** — a toast names the addon; turn it on in [Admin-Addons](Admin-Addons).
 - **A plugin dependency is missing or outdated** — a dialog lists each dependency with a one-click **Download** / **Update** that installs the newest compatible version and then retries.
 - **The update widened its permissions** — the consent dialog (below).
diff --git a/wiki/Admin-Storage.md b/wiki/Admin-Storage.md
index e9f473fdb..3e144e658 100644
--- a/wiki/Admin-Storage.md
+++ b/wiki/Admin-Storage.md
@@ -143,8 +143,29 @@ For scripted deployments, place a `storage-config.json` in the data directory
 (in Docker: mount it at `/app/data/storage-config.json`). It is imported
 exactly once — on the first boot that has no stored storage configuration —
 then ignored (a log line says so). An invalid file aborts boot with the exact
-validation error. Example and the compose mount line: see the
-[README Storage section](https://github.com/liketrek/TREK#storage).
+validation error.
+
+```jsonc
+// storage-config.json - secrets may be plaintext (encrypted on import)
+// or already-encrypted enc:v1: values.
+{
+  "backends": [
+    { "name": "off-site", "type": "s3", "options": {
+      "endpoint": "https://s3.example.com", "bucket": "trek",
+      "accessKeyId": "...", "secretAccessKey": "..." } },
+    { "name": "backups-mirror", "type": "mirror", "options": {
+      "primary": "backups-local", "replicas": ["off-site"] } }
+  ],
+  "categories": { "backups": "backups-mirror" }
+}
+```
+
+The panel presents this exact setup as **Mirror targets** on `backups-local`.
+
+```yaml
+# docker-compose: add under the trek service's volumes
+      - ./storage-config.json:/app/data/storage-config.json:ro
+```
 
 To reset storage configuration (or re-import a seed file): stop the server,
 `sqlite3 data/travel.db "DELETE FROM app_settings WHERE key LIKE 'storage.%';"`,
diff --git a/wiki/Admin-Users-and-Invites.md b/wiki/Admin-Users-and-Invites.md
index 7cbd8e0fb..ef57dbe9a 100644
--- a/wiki/Admin-Users-and-Invites.md
+++ b/wiki/Admin-Users-and-Invites.md
@@ -12,7 +12,7 @@ The user table shows every registered account with the following columns:
 |--------|-------------|
 | **User** | Avatar, username, and an always-visible presence dot (green = online, grey = offline) |
 | **Email** | Account email address |
-| **Role** | Badge showing `admin` or `user` |
+| **Role** | Badge showing **Administrator** or **User** |
 | **Created** | Account creation date |
 | **Last Login** | Date and time of most recent login |
 | **Actions** | Edit and delete buttons |
@@ -27,11 +27,13 @@ Click the pencil icon on any row to open the edit form. You can change:
 
 - **Username**
 - **Email address**
-- **Role** — toggle between `user` and `admin`
-- **Password** — set a new password; must be at least 8 characters
+- **Role** — a dropdown with **User** and **Administrator**
+- **Password** — set a new password. It must be at least 8 characters and contain an uppercase letter, a lowercase letter, a number and a special character; commonly used passwords and strings made of a single repeated character are rejected. The same rules apply to the password you set under [Creating a user directly](#creating-a-user-directly). See [Login and Registration](Login-and-Registration#password-requirements).
 
 Click **Save** to apply changes.
 
+Below the fields sits **Reset passkeys**, which removes every passkey that user has registered — the recovery path when someone loses their authenticator. It asks for confirmation, reports how many passkeys it removed, and takes effect immediately rather than on **Save**. The user can still sign in with their password. See [Passkeys](Passkeys).
+
 ### Delete a user
 
 Click the trash icon and confirm. Deletion is permanent. The user's account is removed from the database along with their data (cascade behavior is enforced at the database level).
@@ -50,7 +52,7 @@ Invite links let a specific number of people register themselves. This is useful
 
 ### Creating an invite
 
-Click **Create Invite** (invite links section, below the user table). Configure:
+Click **Create Link** (invite links section, below the user table). Configure:
 
 - **Max uses** — how many times the link can be used before it expires: `1×`, `2×`, `3×`, `4×`, `5×`, or `∞` (unlimited). Defaults to `1×`.
 - **Expiry** — how long the link remains valid: `1d`, `3d`, `7d`, `14d`, or `∞` (no expiry). Defaults to `7d`.
@@ -87,4 +89,5 @@ The **Users** tab also hosts the Permissions panel at the bottom, which controls
 - [Invite-Links](Invite-Links)
 - [Admin-Permissions](Admin-Permissions)
 - [Two-Factor-Authentication](Two-Factor-Authentication)
+- [Passkeys](Passkeys)
 - [Admin-Panel-Overview](Admin-Panel-Overview)
diff --git a/wiki/Appearance-Settings.md b/wiki/Appearance-Settings.md
index 41caebdef..6ed4ac32e 100644
--- a/wiki/Appearance-Settings.md
+++ b/wiki/Appearance-Settings.md
@@ -8,7 +8,7 @@ Tune how TREK looks — colour mode, accent scheme, readability, and which dashb
 
 Open **Settings** and select the **Appearance** tab.
 
-Changes preview instantly and are saved to your account a moment later, so they follow you to every browser you sign in with. A **Reset to defaults** button at the bottom of the tab restores everything on this page in one click.
+Changes preview instantly and are saved to your account a moment later, so they follow you to every browser you sign in with. A **Reset to defaults** button at the bottom of the tab restores the colour scheme, the readability settings, the dashboard widgets and the mobile layout in one click. Your **Color mode** (Light / Dark / Auto) is a separate setting and is left as it is.
 
 > These are personal settings — no permission and no admin toggle gate them.
 
@@ -77,6 +77,15 @@ Each of the four rows renders a live sample in that tier ("Large heading", "Medi
 
 Hiding a widget here only affects your own dashboard. Widgets that depend on an addon (for example **Collections**) also need that addon enabled by an admin — see [Dashboard-Widgets](Dashboard-Widgets) and [Admin-Addons](Admin-Addons).
 
+## On a phone
+
+Opened on a phone, the Appearance screen carries an extra **Mobile** card that the desktop tab does not have:
+
+- **Bottom navbar** — which items sit in the bottom bar, in which order, and which are demoted under **More**. **Dashboard** is pinned first and cannot be moved; two more items fit next to it, and a counter above the list shows how full the bar is. Leaving both lists untouched keeps TREK's automatic split.
+- **Dashboard order** — reorder how the trip list and the inline widgets stack on the phone dashboard. The featured trip always stays on top. A block whose widget is switched off under **Dashboard widgets** keeps its place in the list and is marked **Hidden**.
+
+Both are stored on your account alongside the rest of the appearance settings, and both are cleared by **Reset to defaults**.
+
 ## Permissions
 
 None. Every setting on this tab applies only to your own account.
diff --git a/wiki/Atlas.md b/wiki/Atlas.md
index b4e120b0f..d2543fd5e 100644
--- a/wiki/Atlas.md
+++ b/wiki/Atlas.md
@@ -51,7 +51,7 @@ Your Atlas statistics panel shows:
 - **Countries visited** — total number of distinct countries you have actually been to. Countries from upcoming trips are counted separately and shown next to this number.
 - **Trips** — total number of trips across all time.
 - **Places** — total number of individual places logged in trips.
-- **Cities** — total number of distinct cities visited. Derived from the addresses of your places, read from the administrative end of the address and cross-checked against the region the map resolved for that place, so a restaurant or a street is never mistaken for a city.
+- **Cities** — total number of distinct cities visited, derived from the addresses of your places. TREK drops the last comma-separated part (the country), then walks back through the remaining parts and takes the first one that is still non-empty once digits, hyphens and postal marks are stripped, lower-cased so spelling variants collapse into a single entry. This is a heuristic over a formatted address string rather than a lookup, so the figure is approximate: a short address such as `Osteria Francescana, Italy` leaves nothing but the place's own name, and an address whose administrative tail ends on a state or prefecture (`…, Shibuya, Tokyo, 150-0002, Japan`) counts that region rather than the city.
 - **Travel days** — total days spent travelling.
 - **Continent breakdown** — number of countries visited per continent (Europe, Asia, North America, South America, Africa, Oceania). Antarctica joins the row once you have been.
 - **Travel streak** — number of consecutive years in which you have taken at least one trip.
diff --git a/wiki/Audit-Log.md b/wiki/Audit-Log.md
index a51f9a606..e12890d97 100644
--- a/wiki/Audit-Log.md
+++ b/wiki/Audit-Log.md
@@ -21,6 +21,11 @@ Actions are grouped by area below. The **Action key** is the raw value stored in
 | `user.login_failed` | Login attempt failed |
 | `user.password_change` | User changed their password |
 | `user.account_delete` | User deleted their account |
+| `user.password_reset_request` | Password reset requested |
+| `user.password_reset_success` | Password reset completed |
+| `user.password_reset_fail` | Password reset attempt rejected (`reason` in details) |
+
+A request for an account that can actually be reset writes **two** rows: one with `delivered: "pending"` when the mail is handed off, one with the delivery result. Every other outcome writes a single row carrying a `reason` instead — `no_user`, `oidc_only`, `throttled_per_email` or `password_login_disabled`. Passkey logins are not a separate key: they land as `user.login` with `method: passkey` in the details.
 
 ### MFA
 
@@ -29,6 +34,14 @@ Actions are grouped by area below. The **Action key** is the raw value stored in
 | `user.mfa_enable` | MFA enabled on an account |
 | `user.mfa_disable` | MFA disabled on an account |
 
+### Passkeys
+
+| Action key | Description |
+|---|---|
+| `user.passkey_register` | Passkey enrolled |
+| `user.passkey_delete` | Passkey removed (resource = the passkey's numeric ID) |
+| `user.passkey_clone_suspected` | A passkey presented a signature counter that did not advance — a possible cloned authenticator. That assertion is rejected, the credential stays enabled |
+
 ### Trips
 
 | Action key | Description |
@@ -37,6 +50,10 @@ Actions are grouped by area below. The **Action key** is the raw value stored in
 | `trip.update` | Trip updated (includes changed fields) |
 | `trip.copy` | Trip duplicated (includes source and new trip IDs) |
 | `trip.delete` | Trip deleted (includes trip ID and title) |
+| `trip.transfer_ownership` | Trip ownership transferred (includes the trip title and both owner emails) |
+| `trip.invite_link_create` | Trip invite link created or rotated (a trip has one link, so creating it again replaces the previous token) |
+| `trip.invite_link_delete` | Trip invite link revoked |
+| `trip.invite_link_join` | An invite link was accepted (`joined` in details). The row is written even when nobody was added — the trip owner or an existing member opening the link logs `joined: false` |
 
 ### Admin actions
 
@@ -45,22 +62,41 @@ Actions are grouped by area below. The **Action key** is the raw value stored in
 | `admin.user_create` | User created by admin |
 | `admin.user_update` | User edited by admin (role, email, username, etc.) |
 | `admin.user_delete` | User deleted by admin |
+| `admin.user_mfa_reset` | A user's MFA reset by admin |
+| `admin.user_passkeys_reset` | All of a user's passkeys removed by admin |
 | `admin.invite_create` | Invite link created |
 | `admin.invite_delete` | Invite link deleted |
 | `admin.permissions_update` | Instance permissions updated |
 | `admin.oidc_update` | OIDC/SSO settings updated |
 | `admin.addon_update` | Addon enabled, disabled, or configured |
-| `admin.oauth_session.revoke` | OAuth session revoked by admin |
+| `admin.oauth_session_revoke` | OAuth session revoked by admin |
+| `admin.mcp_token_delete` | MCP token revoked by admin |
 | `admin.rotate_jwt_secret` | JWT secret rotated |
 | `admin.bag_tracking` | Bag tracking feature toggled |
 | `admin.places_photos` | Places photos feature toggled |
 | `admin.places_autocomplete` | Places autocomplete feature toggled |
 | `admin.places_details` | Places details feature toggled |
+| `admin.places_enrich` | Place enrichment feature toggled |
 | `admin.collab_features` | Collaboration features updated |
+| `admin.packing_template_create` | Packing template created |
 | `admin.packing_template_delete` | Packing template deleted |
+| `admin.plugin_retrust` | Plugin signing key re-trusted (records the old and the new key fingerprint) |
+| `admin.storage_update` | Storage configuration saved (secrets redacted in the details) |
+| `admin.storage_test` | Storage backend probed (the probe writes and deletes one test object) |
+| `admin.storage_backfill` | Replica catch-up started |
+| `admin.storage_backfill_cancel` | Replica catch-up cancelled |
+| `admin.storage_migration` | Category migration started |
+| `admin.storage_migration_cancel` | Category migration cancelled |
+| `admin.storage_stats_refresh` | Storage usage stats recomputed |
 | `admin.default_user_settings_update` | Default user settings updated |
 | `admin.demo_baseline_save` | Demo baseline snapshot saved |
+
+### Settings
+
+| Action key | Description |
+|---|---|
 | `settings.app_update` | App settings updated (SMTP, webhooks, MFA policy, etc.) |
+| `settings.api_keys_update` | Maps / OpenWeather / Unsplash API keys changed. Written for any user saving their own keys; an admin's save also updates the instance-wide ones. Records the changed key **names** only, never the values |
 
 ### Backups
 
@@ -91,19 +127,21 @@ Actions are grouped by area below. The **Action key** is the raw value stored in
 | `oauth.token.revoke` | OAuth token revoked |
 | `oauth.token.grant_failed` | OAuth token grant attempt failed |
 | `oauth.token.client_auth_failed` | OAuth client authentication failed |
+| `oauth.token.replay_detected` | An already-revoked refresh token was replayed. The whole token chain and the user's OAuth sessions for that client are revoked. Two clients racing on the same token do **not** land here: that is logged as `oauth.token.refresh` with `concurrent: true` |
 
 ### Integrations
 
 | Action key | Description |
 |---|---|
 | `immich.private_ip_configured` | Immich URL saved that resolves to a private IP |
+| `airtrail.private_ip_configured` | AirTrail URL saved that resolves to a private IP |
 
 ## Log columns
 
 | Column | Description |
 |---|---|
 | Time | Timestamp of the action |
-| User | Username and email of the acting user (or `anonymous` for unauthenticated events) |
+| User | Username of the acting user, falling back to their email, then `#<user id>`. Unauthenticated events show `—` (the plain-text log file writes `anonymous` for those instead) |
 | Action | Action key (see tables above) |
 | Resource | Affected resource (filename, trip ID, tool name, etc.) where applicable |
 | IP | Client IP address |
@@ -117,7 +155,7 @@ The panel loads 100 entries at a time by default. Click **Load more** at the bot
 
 The client IP is the one Express resolves after applying `TRUST_PROXY`, not whatever the `X-Forwarded-For` header happens to say. That distinction matters: the header is written by the caller, and an audit row an attacker can address to someone else's IP is worse than no row at all.
 
-`TRUST_PROXY` is **the number of proxy hops in front of TREK**, and it has to be accurate. With `TRUST_PROXY=1` (the default) TREK trusts exactly one hop, so a request that passed through two proxies is recorded as coming from the *inner* one. If your setup is Cloudflare in front of nginx in front of TREK, set `TRUST_PROXY=2`. Set it to `0` to trust nothing and always record the socket address.
+`TRUST_PROXY` is **the number of proxy hops in front of TREK**, and it has to be accurate. With `TRUST_PROXY=1` (the default) TREK trusts exactly one hop, so a request that passed through two proxies is recorded as coming from the *outer* one — the Cloudflare edge in the example below, not nginx and not the real client. If your setup is Cloudflare in front of nginx in front of TREK, set `TRUST_PROXY=2`. Set it to `0` to trust nothing and always record the socket address.
 
 See [Environment-Variables](Environment-Variables).
 
diff --git a/wiki/Backups.md b/wiki/Backups.md
index f9a78ea3b..0789710ae 100644
--- a/wiki/Backups.md
+++ b/wiki/Backups.md
@@ -15,7 +15,7 @@ A backup is a ZIP archive with these entries:
 | Entry | Contents |
 |---|---|
 | `travel.db` | The full SQLite database |
-| `uploads/` | All uploaded attachments, covers, and avatars (default location — see [[Admin: Storage|Admin-Storage]]) |
+| `uploads/` | All uploaded attachments, covers, and avatars (default location — see [Admin: Storage](Admin-Storage)) |
 | `plugins-data/` | Each installed plugin's own database + files (present only if plugins are installed) |
 | `plugins-code/` | The installed plugin code, so a restore is self-contained (dev-linked plugins are skipped) |
 
@@ -32,7 +32,9 @@ You can also download or delete any existing backup from the list.
 You can restore from:
 
 - **A stored backup** — click **Restore** next to any backup in the list.
-- **An uploaded ZIP** — click **Upload & Restore** and select a backup file from your computer (maximum upload size: 500 MB by default, configurable with the `BACKUP_UPLOAD_LIMIT_MB` environment variable — see [Environment-Variables](Environment-Variables)).
+- **An uploaded ZIP** — click **Upload Backup** and select a backup file from your computer (maximum upload size: 500 MB by default, configurable with the `BACKUP_UPLOAD_LIMIT_MB` environment variable — see [Environment-Variables](Environment-Variables)).
+
+A second limit caps the **decompressed** size of a restore archive at 5 GB by default (`BACKUP_MAX_DECOMPRESSED_MB`). It applies to both routes — a stored backup as well as an uploaded ZIP — and a restore that exceeds it is refused with `Backup exceeds the maximum decompressed size.` Raise it if your own backups legitimately grow past the default, otherwise they become unrestorable.
 
 Before restoring, TREK runs integrity checks on the uploaded database:
 
@@ -41,7 +43,7 @@ Before restoring, TREK runs integrity checks on the uploaded database:
 
 > **Warning:** Restoring replaces all current data. Back up your current state first if you want to keep it.
 
-> **Plugins & restart:** `travel.db` and `uploads/` are swapped in immediately. Plugin data and code are **staged** and applied on the **next server restart** — the running plugins hold their databases open, so they can't be swapped live (the same reason the bundled encryption key only takes effect on restart). Restart the server after restoring an instance that uses plugins.
+> **Plugins & restart:** `travel.db` and `uploads/` are swapped in immediately. Plugin data and code are **staged** beside the live trees and applied right away: the running plugins hold their databases open, so the restore asks the plugin runtime to shut them down and swaps the trees in the moment the handles are closed. If the runtime isn't up (plugins switched off, or a restore that happens during startup), the staged trees are applied at the next boot instead. Restart the server after restoring an instance that uses plugins — the plugins are stopped for the swap and stay down until the process restarts, and the bundled encryption key is only read at startup.
 
 ## Auto-backup
 
@@ -54,7 +56,7 @@ Enable scheduled backups in the **Auto-Backup** section of the Backup tab.
 - Weekly
 - Monthly
 
-**Retention** (`Keep last … days`) — enter a number of days. Backups older than that many days are pruned after each auto-backup run. Set to **0** to keep all backups indefinitely (no pruning).
+**Retention** (`Delete old backups after`) — pick one of the preset windows: 1 day, 3 days, 7 days, 14 days, 30 days, or **Keep forever**. Auto-backups older than the chosen window are pruned after each auto-backup run; **Keep forever** (stored as `keep_days = 0`) keeps all backups indefinitely.
 
 **Schedule** options (depend on interval):
 
@@ -84,7 +86,7 @@ The following actions are recorded in the [Audit-Log](Audit-Log):
 
 ## See also
 
-- [[Admin: Storage|Admin-Storage]] — replicate backups to S3-compatible storage
+- [Admin: Storage](Admin-Storage) — replicate backups to S3-compatible storage
 - [Encryption-Key-Rotation](Encryption-Key-Rotation)
 - [Admin-Panel-Overview](Admin-Panel-Overview)
 - [Security-Hardening](Security-Hardening)
diff --git a/wiki/Budget-Tracking.md b/wiki/Budget-Tracking.md
index d4c522bae..e092b86d5 100644
--- a/wiki/Budget-Tracking.md
+++ b/wiki/Budget-Tracking.md
@@ -24,40 +24,36 @@ Costs is **multi-currency** (#551). Three settings are involved, and they do dif
 - Each **expense** carries **its own currency** — pick it in the expense modal and enter what the receipt says (a $100 dinner on a rouble trip is `100 USD`). It is converted into the trip currency at a rate **frozen when you save it**, so a settled debt doesn't reopen when the market moves.
 - Your **display currency** (Settings → General) converts what you *read* — totals, chart, balances — into one currency. It changes nothing that is stored. Left on **Trip currency** (the default), each trip is shown in its own currency.
 
-165 currencies are supported, with rates from [Frankfurter](https://frankfurter.dev) (no API key needed). When an item's currency differs from the display currency, the modal shows the converted amount alongside the rate (`1 {from} in {to}`), and the ledger row shows both (`$100.00 → 7 668,71 ₽`).
+165 currencies are supported, with rates from [Frankfurter](https://frankfurter.dev) (no API key needed). When an item's currency differs from the display currency, the modal shows the original next to the converted amount (`$100.00 ≈ 7 668,71 ₽ · live rate`), and the ledger row shows both (`$100.00 → 7 668,71 ₽`).
 
 > **Read [Currencies](Currencies) for the full picture** — how the three interact, what happens when you change a trip's currency, and which currency a public share link is shown in.
 
 ## Categories
 
-Expenses are grouped into categories. Each category is shown with a small colored square indicator that cycles through a 12-color palette as you add more categories.
+Every expense sits in one of **14 fixed categories**. You cannot add, rename, reorder or delete them — you pick one from a row of pills in the expense modal. Each category carries its own icon and colour, which is what the coloured tab on an expense row and the swatches in the sidebar breakdown are showing:
 
-From the toolbar you can:
+**Accommodation**, **Food & drink**, **Groceries**, **Transport**, **Flights**, **Activities**, **Sightseeing**, **Shopping**, **Fees & tickets**, **Health**, **Tips**, **Fuel**, **Parking**, **Other**.
 
-- **Add a category** — type a name and click the **+** button (or press Enter).
-- **Rename a category** — click the pencil icon next to its name in the category header.
-- **Reorder categories** — drag the grip handle on the left of the category header.
-- **Delete a category** — click the trash icon in the category header. This deletes all expense items inside it.
+Expenses written before the Costs rework carried free-text categories. Those are matched onto the fixed keys where the stored label is recognisable (a booking saved as `Flight` reads as **Flights**, `gas` as **Fuel**) and fall back to **Other** otherwise. Nothing is rewritten in the database, only how the row is displayed.
 
 ## Expense items
 
-Each category contains a table of items with the following columns:
+Expenses are listed as a ledger grouped by **day**, newest day first, with the day's total on the right of each group header. Recorded settle-up payments sit in the same list, so the ledger reads as everything that happened on the trip's money in order. A row shows the category as a coloured tab, the name, the payer chips with what each of them put in, the note, and the total in your display currency — plus a green **you lent** / red **you borrowed** chip under the amount when the split leaves you up or down on it. An expense entered in another currency shows the original and the converted amount under the name.
 
-| Column | Notes |
+Above the list are a search box, a category filter, a day filter, an **All / Paid by me / I'm owed** switch and the CSV export button.
+
+Click **Add expense**, or the pencil beside a row, to open the expense editor:
+
+| Field | Notes |
 |---|---|
-| Name | Editable inline. Read-only when linked to a reservation. |
-| Total | The total cost for this item. |
-| Persons | Number of persons (or member chips on multi-member trips). |
-| Days | Number of days. |
-| Per Person | Calculated: Total ÷ Persons. |
-| Per Day | Calculated: Total ÷ Days. |
-| Per Person/Day | Calculated: Total ÷ (Persons × Days). |
-| Date | Optional expense date. |
-| Note | Free-text note. |
-
-Click any editable cell to edit it inline. Drag the grip handle to reorder items within a category.
-
-Add a new item using the inline **add row** at the bottom of each category table.
+| What was it for? | The expense name. Required — the dialog will not save without it. |
+| Total amount | What the receipt says. In Ticket mode it is summed from the items instead and cannot be typed. |
+| Currency | The expense's own currency. |
+| Day | Optional expense date. Undated expenses group under **No date**. |
+| Category | One of the 14 fixed categories. |
+| Who paid? | Who actually put the money down — see [Who paid](#who-paid). |
+| Split | How the total is shared out — see [Splitting costs](#splitting-costs). |
+| Note | Free-text note, shown on the row. |
 
 ### Expenses linked to a booking or a place
 
@@ -65,26 +61,34 @@ An expense can hang off a **booking** (reservation or transport) or off a **plac
 
 Deleting the booking or the place deletes its linked expense with it. Removing the expense from the record's Costs block deletes only the expense and leaves the record standing.
 
+## Who paid
+
+**Who paid?** in the expense editor records who actually put the money down. It is the other half of the settlement maths — the split says who owes for the expense, this says who is out of pocket for it:
+
+- **One person paid** — pick a member from the dropdown. This is the default.
+- **Multiple people paid** — switch with the link beside the label, include each payer and type what each of them put in. The amounts have to add up to the total; until they do, the dialog reads *Payer amounts must add up to …* and refuses to save.
+- **No one paid yet** — the first entry in the single-payer dropdown, for an expense you are only planning. The amount still counts toward **Total trip spend**, and everyone on its split is still charged their share in **Balances** — what is missing is the credit side, so nobody is recorded as having covered it.
+
+An expense with no payer is flagged **Unfinished** on its row and counted into the **Outstanding amount** card, which is where to look when the balances show money owed that nobody is down as having paid.
+
 ## Splitting costs
 
-The **Persons** column behaves differently depending on the trip:
+**Split** decides who owes for the expense. Every trip member is listed and can be included or excluded, and there are three modes:
 
-- **Single-user trip** — enter a number of persons directly.
-- **Multi-member trip** — a member chip picker appears. Click the edit button to open the expense modal, where you can select:
-  - **Equally** — Splits the cost equally among selected members. Remainder cents (from rounding errors) are distributed deterministically and rotated using the item ID to ensure everyone is charged equally over the course of the trip.
-  - **Custom** — Enter specific custom amounts for each traveler. The sum of the custom splits must balance exactly to the total price.
-  - **Ticket** — Build an itemized list of expenses (e.g. Apples: $10, cake: $50, Milk: $40) and assign specific trip participants to split each individual item. Individual shares are calculated cent-perfectly, the total expense price is automatically summed, and the list of itemized splits is saved/restored across edits.
-
-Click an assigned member chip again to mark them as **paid** (the chip shows a green ring).
+- **Equally** — Splits the cost equally among selected members. Remainder cents (from rounding errors) are distributed deterministically and rotated using the item ID to ensure everyone is charged equally over the course of the trip.
+- **Custom** — Enter specific custom amounts for each traveler. The sum of the custom splits must balance exactly to the total price.
+- **Ticket** — Build an itemized list of expenses (e.g. Apples: $10, cake: $50, Milk: $40) and assign specific trip participants to split each individual item. Individual shares are calculated cent-perfectly, the total expense price is automatically summed, and the list of itemized splits is saved/restored across edits.
 
 ![Add Expense](assets/BudgetAddExpensive.gif)
 
 ## Settlement calculator
 
-When multiple members are assigned to expenses and there are outstanding debts between members, a collapsible **Settlement** section appears inside the total card. Click the section header to expand it. It shows the minimum number of transfers needed to settle all debts (using a greedy matching algorithm), including:
+Costs works out the minimum number of transfers needed to settle all debts (using a greedy matching algorithm) and keeps the answer in the right-hand column, split across two cards:
 
-- Transfer flows: who pays whom and how much.
-- Net balances: each member's overall surplus or deficit.
+- **Settle up** — the transfer flows: who pays whom and how much. The number of open flows sits in the card header, and each flow has a **Settle** button that records it as done.
+- **Balances** — net balances: each member's overall surplus or deficit.
+
+**Settle up** in the panel header records every open flow at once. **Add payment** on the card records a single transfer by hand, for a repayment that did not follow a suggested flow. Recorded payments then appear in the expense ledger as their own rows, with edit and undo beside them.
 
 Balances are always netted in the **trip currency** and converted to your display currency once, at the end — so they stay stable even when the trip mixes currencies.
 
@@ -96,10 +100,14 @@ A recorded payment carries **its own currency** too: settling a rouble debt with
 
 ## Costs summary
 
-The right-hand column contains two widgets:
+Four cards sit above the expense list:
 
-- **Total card** — displays the grand total in large type. On multi-member trips it also shows a per-member breakdown with a proportional bar.
-- **Donut chart** — spending by category. Each segment uses that category's color. The legend always shows the amount and percentage for each category; hovering a legend row highlights it.
+- **You owe** — what you still have to transfer, with the members you owe it to.
+- **You're owed** — the same in the other direction.
+- **Outstanding amount** — the total of the expenses that have no payer yet, and how many of them there are.
+- **Total trip spend** — the grand total in large type, with your share and what you paid underneath.
+
+Below the settle-up and balances cards, the right-hand column ends with **By category**: spending per category as a ranked list of bars in the category colours. Only categories with spend on them appear, sorted by amount, and the bars are scaled against the biggest category rather than the trip total, so the ranking stays readable.
 
 ## Exporting
 
@@ -107,7 +115,7 @@ Click **Export CSV** in the toolbar to download all expenses as a spreadsheet (r
 
 ## Permissions
 
-All write operations (adding/editing/deleting items and categories, and an expense's currency) require the `budget_edit` permission. The **trip** currency lives on the trip itself, so changing that requires `trip_edit` instead.
+All write operations (adding/editing/deleting expenses and settle-up payments, and an expense's currency) require the `budget_edit` permission. The **trip** currency lives on the trip itself, so changing that requires `trip_edit` instead.
 
 ## See also
 
diff --git a/wiki/Calendar-Feeds.md b/wiki/Calendar-Feeds.md
index 7e9bdcf06..f187b5bfb 100644
--- a/wiki/Calendar-Feeds.md
+++ b/wiki/Calendar-Feeds.md
@@ -2,13 +2,13 @@
 
 Subscribe your calendar app to a TREK trip so it stays in sync automatically, instead of importing a snapshot once.
 
-> **Not the same as the ICS export.** The **Download ICS** action described in [Day-Plans-and-Notes](Day-Plans-and-Notes) writes a one-off `.ics` file that never changes after you import it. A calendar *feed* is a live URL your calendar re-fetches on its own. Use the export for a frozen copy, a feed for something that keeps up with your edits.
+> **Not the same as the ICS export.** The **Download .ics** action described in [Day-Plans-and-Notes](Day-Plans-and-Notes) writes a one-off `.ics` file that never changes after you import it. A calendar *feed* is a live URL your calendar re-fetches on its own. Use the export for a frozen copy, a feed for something that keeps up with your edits.
 
 ## Where to find it
 
 There are two feeds, reached from two places:
 
-- **Per-trip feed** — in the trip planner, hover the **ICS** button in the Day Plan sidebar toolbar and choose **Subscribe to calendar**. (The other entry in that menu, **Download ICS**, is the one-off export.)
+- **Per-trip feed** — in the trip planner, click the **Export** button in the Day Plan sidebar toolbar and pick **Subscribe to calendar** under **Calendar**. (The entry above it, **Download .ics**, is the one-off export.) The subscribe entry only shows up if you may manage the trip's share links — see *Permissions* below.
 - **All-trips feed** — on the **My Trips** dashboard, click the calendar-plus button in the toolbar (**Subscribe to all trips**).
 
 Both open the same dialog.
@@ -61,12 +61,13 @@ The feed carries the same events as the ICS export:
 - **Reservations** — hotels, restaurants, and transport. Flights and other transport take their start and end from the departure and arrival endpoints, each in its own time zone. Reservations with no placeable date are skipped.
 - **Accommodations** — an all-day event covering every night of the stay, from the arrival day to the departure day, so a hotel sits above those days rather than appearing once on the day you check in. The dates come from the trip days the stay is attached to, so reordering days moves the event with them.
 - **Check-in and check-out** — separate timed events on the arrival and departure days whenever the stay records those times. If you entered a check-in window, its end becomes the event's end time.
+- **Car pickup and drop-off** — a reservation of type *Car* also gets two standalone timed events, *Pickup: {title}* and *Drop-off: {title}*, on top of the rental's own booking block, both carrying the reservation's location. Each side prefers its own endpoint — the pickup endpoint for the pickup, the return endpoint for the drop-off — and takes that endpoint's local time and time zone. Otherwise it falls back to the booking's own times (an end value stored as a bare clock is paired with the booking's start date) and to the time zone of the linked place. A side with no usable date and time from either source is skipped, so a rental imported with only one geocoded endpoint can end up with just one marker.
 
 Feeds are served with cache headers that tell clients not to cache, plus an hourly refresh hint (`REFRESH-INTERVAL` / `X-PUBLISHED-TTL` of one hour). Most calendar apps treat that as a suggestion — Google in particular refreshes on its own schedule, often much slower — so an edit may take a while to show up.
 
 ## Permissions
 
-No dedicated permission gates feeds. You can manage a per-trip token if you own the trip or are a member of it; anyone else gets a *Trip not found*. The all-trips feed is always scoped to your own account.
+Managing a per-trip token requires the **`share_manage`** permission — the same right that governs invite and share links. By default it sits with the trip owner; an instance can lower it to trip members in [Admin-Permissions](Admin-Permissions). A member without it never sees **Subscribe to calendar** in the export dialog and gets a *No permission* from the token endpoint, while anyone with no access to the trip at all still gets a *Trip not found*. The all-trips feed needs no permission — it is always scoped to your own account.
 
 Because the token grants unauthenticated read access, enabling a feed effectively shares that trip's contents with whoever holds the link, regardless of trip roles — see [Public-Share-Links](Public-Share-Links) for the equivalent trade-off on the sharing side.
 
diff --git a/wiki/Collab-Chat.md b/wiki/Collab-Chat.md
index fbf7bea79..17462e8c9 100644
--- a/wiki/Collab-Chat.md
+++ b/wiki/Collab-Chat.md
@@ -14,7 +14,7 @@ The Collab addon must be enabled by an admin and the Chat sub-feature must be tu
 
 Type in the input field at the bottom and press **Enter** (or click the send button) to post. Hold **Shift + Enter** to insert a line break without sending.
 
-Messages load in pages of 100. A **Load more** button appears at the top of the chat when older messages are available.
+Messages load in pages of 100. A **Load older messages** button appears at the top of the chat when older messages are available.
 
 ## Emoji
 
diff --git a/wiki/Collab-Notes.md b/wiki/Collab-Notes.md
index f4a19eb6e..963da2d9b 100644
--- a/wiki/Collab-Notes.md
+++ b/wiki/Collab-Notes.md
@@ -47,7 +47,13 @@ Click the pin icon on a note card to pin it. Pinned notes sort to the top of the
 
 You can attach images, PDFs, and other files to a note (requires the `file_upload` permission). Maximum file size is **50 MB** per file.
 
-The following file types are blocked: `.svg`, `.html`, `.htm`, `.xml`, `.xhtml`, `.js`, `.jsx`, `.ts`, `.exe`, `.bat`, `.sh`, `.cmd`, `.msi`, `.dll`, `.com`, `.vbs`, `.ps1`, `.php`.
+The following file types are blocked:
+
+- Markup a browser would render: `.svg`, `.svgz`, `.html`, `.htm`, `.shtml`, `.shtm`, `.xml`, `.xhtml`, `.xht`
+- Scripts: `.js`, `.jsx`, `.ts`, `.tsx`, `.mjs`, `.cjs`, `.php`, `.py`, `.rb`, `.pl`
+- Executables: `.exe`, `.bat`, `.sh`, `.cmd`, `.msi`, `.dll`, `.com`, `.vbs`, `.ps1`, `.app`
+
+An attachment is also rejected when its MIME type contains `svg`, `html`, or `javascript`, whatever its extension says. The same blocklist guards the trip file manager (see [Documents-and-Files](Documents-and-Files)), where uploads must additionally match the admin's **Allowed File Types** setting (video files are exempt from that list) — note attachments are not subject to it at all.
 
 Image thumbnails are shown on the note card. Click a thumbnail to open a lightbox. PDFs open in a document viewer overlay.
 
diff --git a/wiki/Collab-Polls.md b/wiki/Collab-Polls.md
index d00143593..faa33703c 100644
--- a/wiki/Collab-Polls.md
+++ b/wiki/Collab-Polls.md
@@ -10,21 +10,22 @@ Open the trip planner → **Collab** tab → **Polls** section. The Collab addon
 
 ## Creating a poll
 
-Users with `collab_edit` permission can click **+ New** in the Polls header. A modal opens with the following fields:
+Users with `collab_edit` permission can click **+ New Poll** in the Polls header. A modal opens with the following fields:
 
 | Field | Required | Notes |
 |-------|----------|-------|
 | Question | Yes | The poll prompt |
 | Options | Yes | At least 2 options required; add more with **+ Add option** |
 | Multiple choice | No | Toggle on to allow voters to select more than one option |
+| Deadline | No | Mobile only; date and time after which voting closes automatically |
 
-Click **Create** to save and broadcast the poll to all connected members.
+Click **Create Poll** to save and broadcast the poll to all connected members.
 
 ## Voting
 
 Click an option button to vote. A filled circle and blue highlight indicate your selection. For **multiple-choice** polls, you can click additional options to select more than one; clicking an already-selected option removes your vote for that option. For **single-choice** polls, clicking a different option moves your vote to the new selection.
 
-Percentage bars and voter avatars are only visible **after you have voted** or once the poll is closed or expired.
+Voter avatars and the numeric percentage are only visible **after you have voted** or once the poll is closed or expired. The fill bar behind each option is always drawn, in a faint neutral tint until you vote, and the total vote count in the poll header is visible to everyone — so the rough distribution can be read before you cast your vote.
 
 ## Results
 
@@ -38,7 +39,7 @@ The option with the most votes is highlighted when the poll is closed or expired
 
 ## Deadline
 
-Polls may have an optional deadline set via the API. When a deadline is present, a live countdown badge appears on the poll card, updating every **30 seconds**. The badge shows the remaining time in days/hours/minutes format.
+Polls may carry an optional deadline. On **mobile** the new-poll sheet has a **Deadline** field — a date-and-time picker with a clear button. The desktop create modal does not offer one yet, so on desktop a deadline can only be set through the API or MCP. When a deadline is present, a live countdown badge appears on the poll card, updating every **30 seconds**. The badge shows the remaining time in days/hours/minutes format.
 
 When the deadline passes, the poll is automatically treated as closed: voting is disabled and results are displayed to everyone.
 
diff --git a/wiki/Collections.md b/wiki/Collections.md
index 005dc5911..e1f57b305 100644
--- a/wiki/Collections.md
+++ b/wiki/Collections.md
@@ -1,6 +1,6 @@
 # Collections
 
-Collections is a personal, server-wide library of saved places that lives outside of any single trip. Keep multiple named lists of places you have discovered — a "Norway road trip" wishlist, "Best coffee in Lisbon", "Someday" — each with a want-to-go / visited status, and share a list with other users.
+Collections is a personal, server-wide library of saved places that lives outside of any single trip. Keep multiple named lists of places you have discovered — a "Norway road trip" wishlist, "Best coffee in Lisbon", "Someday" — each place carrying an idea / want-to-go / visited status, and share a list with other users.
 
 > **Admin:** enable Collections in [Admin-Addons](Admin-Addons).
 
@@ -14,7 +14,7 @@ A place you save to a trip only exists inside that trip. Collections is the oppo
 
 When the admin has enabled the addon, a **Collections** entry appears in the main navigation (and a bottom-tab on mobile). Opening it shows your lists on the left, the active list's places in the middle, and a map on the right.
 
-The dashboard also gains a **Collections widget** that surfaces your lists as compact badges. Each user can hide that widget from their own dashboard under [Display Settings](Display-Settings) without affecting anyone else.
+The dashboard also gains a **Collections widget** that surfaces your lists as compact badges. Each user can hide that widget from their own dashboard under **Dashboard widgets** on the Appearance tab (see [Appearance-Settings](Appearance-Settings)) without affecting anyone else.
 
 ## Lists
 
@@ -90,7 +90,7 @@ When sharing, the owner assigns each member a permission role, and can change it
 
 | Role | Can do |
 |---|---|
-| **Viewer** | View the list and copy its places into their own trips, and filter by label — no changes to the list. |
+| **Viewer** | View the list, cast their own star rating on its places, copy its places into their own trips, and filter by label — no other changes to the list. |
 | **Editor** *(default)* | Add new places and edit existing ones, and manage + assign the list's labels. |
 | **Admin** | Everything an editor can, plus delete places. |
 
diff --git a/wiki/Contributing.md b/wiki/Contributing.md
index 5d5c21d0f..f4a0db201 100644
--- a/wiki/Contributing.md
+++ b/wiki/Contributing.md
@@ -52,12 +52,14 @@ See the [[Development Environment|Development-environment]] page for the full se
 
 ## Tech Stack
 
-| Layer | Technology                                                                      |
-|---|---------------------------------------------------------------------------------|
-| Frontend | React 18, TypeScript, Zustand, Leaflet, Tailwind CSS, Vite                      |
-| Backend | Express, TypeScript, better-sqlite3                                             |
-| Real-time | WebSocket (ws)                                                                  |
-| Database | SQLite with WAL mode                                                            |
-| Auth | JWT (HS256), bcrypt, TOTP MFA, OIDC                                             |
-| Maps | Leaflet + react-leaflet, OSRM, Nominatim, CartoDB tiles                         |
-| i18n | 15 languages (EN, DE, ES, FR, NL, IT, PT-BR, CS, PL, HU, RU, ZH, ZH-TW, AR, ID) |
+| Layer | Technology                                                                                |
+|---|-------------------------------------------------------------------------------------------|
+| Frontend | React 19, TypeScript, Zustand 5, Leaflet, Tailwind CSS 3.4, Vite 8 (Rolldown)             |
+| Backend | NestJS 11 (Express 4 adapter), TypeScript, better-sqlite3, Zod (@trek/shared)             |
+| Real-time | WebSocket (ws)                                                                            |
+| Database | SQLite with WAL mode                                                                      |
+| Auth | JWT (HS256), bcrypt, TOTP MFA, OIDC                                                       |
+| Maps | Leaflet + react-leaflet (default, CartoDB tiles), MapLibre GL, Mapbox GL, OSRM, Nominatim |
+| i18n | 23 languages, EN canonical (locale directories live in shared/src/i18n/)                  |
+
+Every translation key must exist in all 23 locales — the `i18n Key Parity` CI job fails on drift, so run `npm run i18n:parity:strict --workspace=shared` before pushing. Two directory names differ from the language they hold: Brazilian Portuguese is `br`, Greek is `gr`.
diff --git a/wiki/Creating-a-Trip.md b/wiki/Creating-a-Trip.md
index ad11667e0..51b0315c0 100644
--- a/wiki/Creating-a-Trip.md
+++ b/wiki/Creating-a-Trip.md
@@ -4,7 +4,7 @@
 
 ## Opening the Dialog
 
-Click the **New Trip** button in the dashboard toolbar (or the **Create First Trip** button on the empty state) to open the Create Trip dialog.
+On desktop, click the floating **New Trip** button in the bottom-right corner of the dashboard, or the dashed **New Trip** tile at the end of the trip grid, to open the Create New Trip dialog. On mobile the floating button is replaced by the **+** in the centre of the bottom tab bar, and an empty dashboard also offers a **Create First Trip** button.
 
 You can also open it directly via a deep link: navigate to `/dashboard?create=1`. This is the URL used by system notices that prompt you to create a trip.
 
@@ -16,27 +16,27 @@ The trip name. Cannot be empty — saving is blocked until a title is entered.
 
 ### Description (optional)
 
-A short free-text description shown on the trip card.
+A short free-text description. It is not shown on the trip card or on the Spotlight card. It appears on a [public share page](Public-Share-Links), on the cover of a [PDF export](PDF-Export), and as the notes of the trip's all-day event in [calendar feeds and .ics exports](Calendar-Feeds).
 
 ### Dates
 
 Set a **Start date** and **End date** using the date picker. The day count is calculated automatically when both are set.
 
-If you leave **both** dates empty, a separate **Day count** field appears. Enter a number between **1 and 365** to create a date-less itinerary with a fixed number of days.
+On desktop, if you leave **both** dates empty, a separate **Day count** field appears. Enter a number between **1 and 365** to create a date-less itinerary with a fixed number of days. The mobile sheet has no such field: a date-less trip created there always starts with 7 days.
 
-You cannot set only one date and leave the other blank via normal interaction — setting a start date auto-fills or adjusts the end date to preserve the previous duration.
+Only the **start** date is linked to the other one. Picking a start date fills the end date to match it, and moving the start date of an already-dated trip shifts the end date so the previous duration is kept. Nothing links them the other way round: you can pick an end date on its own, and the picker's **✕** button clears either field afterwards. A trip can therefore be saved with both dates, with only a start date, with only an end date, or with neither. A trip left with exactly one date gets an undated day grid (7 days by default), just like a date-less one.
 
 ### Currency
 
-The trip's currency — its **accounting base**. Every expense in the Costs tab is converted into it, and every balance and settle-up suggestion is calculated in it. Defaults to **EUR**; 165 currencies are available.
+The trip's currency — its **accounting base**. Every expense in the Costs tab is converted into it, and every balance and settle-up suggestion is calculated in it. The dialog pre-fills your own display currency (Settings → General → *Display currency*); if you left that on **Trip currency**, it falls back to **EUR**. An administrator can preset the instance-wide value under Admin → **User Defaults**, which new users inherit until they pick their own. 165 currencies are available.
 
 Pick the currency you will actually settle up in. It is not a cosmetic label, but it is not a one-way door either: you can change it later from the same dialog (with the `trip_edit` permission), and TREK re-bases the existing expenses so no money moves — see [Currencies → Changing the trip currency](Currencies#changing-the-trip-currency).
 
-> This is **not** the same as the display currency in Settings → General, which only changes what *you* read. See [Currencies](Currencies).
+> This is **not** the same as the display currency in Settings → General, which changes what *you* read on trips that already exist. See [Currencies](Currencies).
 
 ### Cover Image
 
-The cover image is displayed on the trip card and as the background of the Spotlight card. You can add one in three ways:
+The cover image is displayed on the trip card and as the background of the Spotlight card. You can add one in four ways:
 
 - **Drag and drop** an image file onto the dashed upload area.
 - **Paste from clipboard** — if you have an image in your clipboard, paste it anywhere in the dialog.
@@ -69,7 +69,7 @@ Add initial trip members from the members selector. On a **new** trip, selected
 
 ## Saving
 
-Click **Create Trip**. The trip is saved and you are taken to the [Trip-Planner-Overview](Trip-Planner-Overview) for the new trip.
+Click **Create New Trip**. The trip is saved, the dialog closes and a *"Trip created successfully!"* toast confirms it — you stay on the dashboard. The new trip is sorted into the trip list by its dates; click its card (or the Spotlight card, if it is the trip that earns that spot) to open the [Trip-Planner-Overview](Trip-Planner-Overview).
 
 ## Related Pages
 
diff --git a/wiki/Currencies.md b/wiki/Currencies.md
index b0d839254..7be7db623 100644
--- a/wiki/Currencies.md
+++ b/wiki/Currencies.md
@@ -12,7 +12,7 @@ The short version: **the trip currency is the accounting base, the expense curre
 
 ## Trip currency
 
-Every trip has exactly one currency. It is set when you create the trip and can be changed later in the trip edit dialog (requires the `trip_edit` permission). It defaults to **EUR**.
+Every trip has exactly one currency. It is set when you create the trip and can be changed later in the trip edit dialog (requires the `trip_edit` permission). The new-trip dialog pre-fills it with **your display currency**, falling back to **EUR** when you have left that on *Trip currency*. This is the one moment the display currency touches stored data: it seeds the field, and from then on the trip's currency is its own.
 
 This is the trip's **accounting base**. It is not a cosmetic label:
 
@@ -59,7 +59,9 @@ It has two modes:
 | **Trip currency** (the default) | Each trip is shown in **its own** currency. A Tokyo trip reads in yen, a Moscow trip in roubles. |
 | A specific currency (e.g. `USD`) | **Every** trip is converted into that currency for you, whatever its own currency is. |
 
-Leave it on **Trip currency** unless you specifically want everything in your home currency regardless of where you are going. An administrator can set an instance-wide default for new users (Admin → Default User Settings); choosing **Trip currency** yourself overrides it, because it is a deliberate choice rather than an absence of one.
+Leave it on **Trip currency** unless you specifically want everything in your home currency regardless of where you are going.
+
+An administrator can set an instance-wide default (Admin → User Defaults), and it interacts with **Trip currency**: picking **Trip currency** stores an *empty* value, and an empty value on a defaultable setting counts as "not set", so the admin's currency is applied again (#1634). While an instance-wide default currency is configured, there is no way back to per-trip currencies from the Settings page — the admin has to clear it.
 
 > Display conversion uses **live** rates, not the frozen ones — it is a view, and a view should reflect today. This is why a converted total can shift slightly day to day while the underlying balances stay rock steady.
 
diff --git a/wiki/Dashboard-Widgets.md b/wiki/Dashboard-Widgets.md
index 0dc131112..acede69e2 100644
--- a/wiki/Dashboard-Widgets.md
+++ b/wiki/Dashboard-Widgets.md
@@ -1,18 +1,24 @@
 # Dashboard Widgets
 
-The My Trips dashboard includes two utility widgets: a currency converter and a timezone clock.
+The My Trips dashboard has a widget sidebar holding a currency converter, a timezone clock and a list of upcoming reservations, plus a Collections shortcut when the [Collections](Collections) addon is enabled (it ships disabled). Installed plugins can contribute further widgets to the same sidebar. This page covers the currency converter and the timezone clock.
 
 ![Dashboard Widgets](assets/DashboardWidgets.png)
 
 ## Where they appear
 
-On large screens (desktop/wide tablet), both widgets appear in a sticky right-hand sidebar of the [My-Trips-Dashboard](My-Trips-Dashboard). On mobile and narrow screens, the widgets are accessible via **Quick Actions** buttons on the dashboard — tapping the Currency or Timezone button opens a bottom sheet containing the full widget.
+On large screens (desktop/wide tablet), the widgets appear in a sticky right-hand sidebar of the [My-Trips-Dashboard](My-Trips-Dashboard). At 1280px and below that column stops being sticky and reflows underneath the trip grid as a wrapping row of cards. On a phone (under 768px) the mobile dashboard takes over and renders each enabled widget inline as its own panel, interleaved with the trip list in an order you can rearrange under Settings → Appearance. There is no bottom sheet for the widgets on any screen size.
 
-Each user configures their own widgets independently. Whether each widget is shown or hidden is saved to your account on the server (synced across devices). The selected currency pair and saved timezone list are stored in your browser's local storage and are device-specific.
+Each user configures their own widgets independently. Whether each widget is shown or hidden is saved to your account on the server (synced across devices). The selected currency pair and the saved timezone list live on your account as well, so they follow you to every device you sign in on.
 
 ### Showing and hiding widgets
 
-On desktop, click the **Settings (gear) icon** in the dashboard toolbar to reveal toggle switches for each widget. Turning a widget off removes it from the sidebar; the preference is saved to your account.
+Widget visibility lives in **Settings → Appearance**, under **Dashboard widgets** — there is no gear icon on the dashboard itself. Desktop and mobile are configured independently:
+
+- **Desktop → Right sidebar** has a master switch for the whole column (turn it off and the dashboard centers) plus one switch each for Currency, Collections, Timezones and Upcoming reservations.
+- **Desktop → Below the hero** switches the Atlas / countries, Trips total, Days traveled and Distance flown tiles.
+- **Mobile → Bottom of page** switches Currency, Collections, Timezones and Upcoming reservations; **Mobile → Below the hero** switches Trips total and Days traveled.
+
+Turning a widget off removes it from the dashboard; the preference is saved to your account.
 
 ---
 
@@ -25,13 +31,13 @@ The currency converter lets you quickly convert an amount between two currencies
 1. Enter an amount in the input field.
 2. Select a source currency from the left selector.
 3. Select a target currency from the right selector.
-4. The converted amount is displayed immediately below.
+4. The converted amount appears in the right-hand ("To") field, directly opposite the amount you entered and above the target-currency selector — shown to two decimals, without a currency symbol. Below the row, the current rate is printed as `1 EUR = 1.0850 USD`; if no rate could be fetched, the field shows `—` and the line reads "Rate unavailable".
 
 You can also click the swap arrow to reverse source and target.
 
-**Exchange rates** are fetched from [Frankfurter](https://frankfurter.dev) using the `https://api.frankfurter.dev/v2/rates?base={from}` endpoint. Rates are refreshed each time you change a currency or click the refresh icon.
+**Exchange rates** are fetched from [Frankfurter](https://frankfurter.dev) using the `https://api.frankfurter.dev/v2/rates?base={from}` endpoint. One request returns every quote for the source currency, so rates are re-fetched when you change the source currency (including via the swap arrow) or click the refresh icon; changing only the target currency re-uses the rates already loaded.
 
-**Supported currencies:** 162 currencies are available in the selector, including all major fiat currencies (USD, EUR, GBP, JPY, etc.) and many minor ones.
+**Supported currencies:** 165 currencies are available in the selector — the full set Frankfurter v2 supports, including all major fiat currencies (USD, EUR, GBP, JPY, etc.) and many minor ones.
 
 ---
 
@@ -41,16 +47,12 @@ The timezone clock displays live clocks for multiple time zones simultaneously.
 
 **How to use:**
 
-- Your local time is always shown at the top.
-- Below it, any zones you have added are listed with their current time and offset relative to your local zone.
-- Click **+** to add a zone. You can pick from 18 preset city zones, or enter any IANA timezone identifier (e.g. `America/Denver`) with an optional custom label (if omitted, the city portion of the identifier is used as the label).
+- Until you change the list, the widget starts with your local zone plus London and Tokyo. Your local zone is an ordinary row and can be removed like any other.
+- Each row shows the zone's current time and its short timezone name or UTC offset (for example `GMT+9`), not an offset relative to your own zone.
+- Click **+** to add a zone. A searchable dropdown lists every IANA timezone your browser knows (e.g. `America/Denver`); type to filter and pick one. The row is labelled with the city part of the identifier — there is no custom label.
 - Hover over a zone row and click **×** to remove it.
 
-**Preset zones (18):**
-
-New York, London, Berlin, Paris, Dubai, Mumbai, Bangkok, Tokyo, Sydney, Los Angeles, Chicago, São Paulo, Istanbul, Singapore, Hong Kong, Seoul, Moscow, Cairo.
-
-Clocks update every 10 seconds. The 12-hour or 24-hour format follows your display settings (see [Display-Settings](Display-Settings)).
+Clocks refresh every 30 seconds and are always shown in 24-hour time — the 12-hour display setting does not apply to this widget.
 
 ---
 
diff --git a/wiki/Day-Plans-and-Notes.md b/wiki/Day-Plans-and-Notes.md
index daa4428b4..decd1ced1 100644
--- a/wiki/Day-Plans-and-Notes.md
+++ b/wiki/Day-Plans-and-Notes.md
@@ -6,7 +6,7 @@ The Day Plan sidebar lets you organize places into days, add free-form notes, an
 
 ## The Day Plan sidebar
 
-The Day Plan sidebar is the left panel in the trip planner. Each trip day is shown as a collapsible section. Expanded or collapsed state is saved per trip in `sessionStorage` (key: `day-expanded-{tripId}`), so your layout is preserved across page reloads in the same browser session.
+The Day Plan sidebar is the left panel in the trip planner. Each trip day is shown as a collapsible section. Expanded or collapsed state is saved per trip in `localStorage` (key: `day-expanded-{tripId}`), so your layout is preserved across page reloads and between browser sessions on that device.
 
 ## Day timeline
 
@@ -24,7 +24,7 @@ Items are sorted by their time or position index.
 
 ![Adding a place by dragging](assets/DayItineraryAddPlaceDragging.gif)
 
-- **Add button** — Click on the day and then click the **+** button inside an expanded day section to open an inline search panel; find the place and tap it to assign.
+- **Add button** — click a day header to select it, then click the **+** on a place in the right-hand Places sidebar; the place is assigned to the selected day straight away.
 
 ![Adding a place by button](assets/DayItineraryAddPlaceByButton.gif)
 
@@ -32,7 +32,7 @@ Items are sorted by their time or position index.
 
 You can also reorder places within a day, or move them to a different day, by dragging and dropping inside the sidebar.
 
-To remove a place from a day, click the **X** button next to the place in the day timeline.
+To remove a place from a day, right-click the entry in the day timeline and choose **Remove from day**, or select the place and use the **Remove from Day** button in the place detail panel. On mobile, switch the plan screen to **Plan** and tap the **X** next to the place. Deleting the place itself, from the same right-click menu, removes it from every day.
 
 ![Removing a place by button](assets/DayItineraryRemovePlaceByButton.gif)
 
@@ -44,17 +44,19 @@ A reservation that spans multiple days appears in each relevant day with a phase
 |---|---|---|---|
 | Flight | Departure | In transit | Arrival |
 | Car | Pickup | Active | Return |
+| Parking | Drop-off | Not shown | Pickup |
 | Other | Start | Ongoing | End |
 
-Car rentals that are in the "Active" (middle) phase are shown in the day header rather than the timeline.
+Car rentals that are in the "Active" (middle) phase are shown in the day header rather than the timeline. A multi-day parking booking is dropped from the days in between entirely — it appears on its drop-off day and its pickup day only, with no day header badge.
 
 ## Day notes
 
-Click the note **+** button in any day section to add a note. Notes have three fields:
+Click the note **+** button in any day section to add a note. Notes have four fields:
 
 - **Title** (required) — the main note text shown in the timeline
 - **Subtitle / detail** (optional) — a free-form text field (Markdown supported) displayed beneath the title
-- **Icon** — choose from 20 icons: FileText, Info, Clock, MapPin, Navigation, Train, Plane, Bus, Car, Ship, Coffee, Ticket, Star, Heart, Camera, Flag, Lightbulb, AlertTriangle, ShoppingBag, Bookmark
+- **Icon** — choose from 32 icons: FileText, Info, Clock, MapPin, Navigation, Train, Plane, Bus, Car, Ship, Coffee, Ticket, Star, Heart, Camera, Flag, Lightbulb, AlertTriangle, ShoppingBag, Bookmark, Utensils, Wine, ParkingSquare, Fuel, Footprints, Mountain, Waves, Sun, Umbrella, Music, Landmark, Gift
+- **Colour** (optional) — tints the note card in the day timeline; the dialog shows a live preview of the card the note will become
 
 Notes interleave with places and transports in the day timeline and are ordered by their `sort_order`. Use the **↑ / ↓** chevron buttons on a note to reposition it within the merged timeline. Notes can also be repositioned by dragging.
 
@@ -72,11 +74,18 @@ The panel can be collapsed to a slim header bar or closed entirely with the **X*
 
 At the top of the Day Plan sidebar:
 
-- **Export PDF** — downloads a PDF of the full trip plan. See [PDF-Export](PDF-Export).
-- **ICS** — exports the trip as a calendar file (.ics) for import into calendar apps.
+- **Export** — opens the export dialog, which holds every format in three groups: **Document** (a PDF of the full trip plan, see [PDF-Export](PDF-Export)), **Calendar** (a `.ics` file for import into calendar apps, plus a subscribable calendar feed for members who can manage share links) and **Maps & GPS** (GPX — whole trip, places only, or days as routes).
 - **Expand / Collapse all** — toggles all day sections open or closed at once.
 - **Undo** — reverses the last drag, reorder, or assign action.
+- **Reorder days** — reorder the days of the trip or insert a new one. A day's places, notes and bookings move with it. Shown to members who can edit days.
+- **Show all booking routes** — draws the connection of every routable booking on the map at once. Shown once the trip has at least one routable booking.
 
-Route controls (optimize order, open in Google Maps) appear inside each expanded day section after the place list.
+Route controls appear at the bottom of a day section, after the place list, and only for the day you have selected — click a day header to select it. The row only appears on a day that can actually be routed: two or more places on the day, a single located place that accommodation optimization can bookend with a hotel, or a transfer day where you check out of one hotel and into another. On a phone the same controls sit in the **Daily Overview** sheet instead, opened from the pill above the plan timeline, and appear there when the day has two located places, or one located place plus a hotel to start from.
+
+- **Route** — draws that day's route on the map.
+- **Open in Google Maps** — hands the day's stops to Google Maps as a route, in planned order.
+- **Open in CoMaps** — the same day handed to CoMaps for offline navigation, carrying the day's travel mode.
+- **Optimize** — reorders the day's places into the shortest route. See [Route-Optimization](Route-Optimization).
+- **Travel mode** — Driving or Walking for that day, plus any travel mode a plugin adds.
 
 **See also:** [Places-and-Search](Places-and-Search) · [Map-Features](Map-Features) · [Route-Optimization](Route-Optimization) · [Weather-Forecasts](Weather-Forecasts) · [Reservations-and-Bookings](Reservations-and-Bookings)
\ No newline at end of file
diff --git a/wiki/Demo-Mode.md b/wiki/Demo-Mode.md
index 4aab92ba4..1c0060b96 100644
--- a/wiki/Demo-Mode.md
+++ b/wiki/Demo-Mode.md
@@ -38,15 +38,19 @@ The admin account is unaffected and retains full access.
 TREK schedules an automatic hourly reset of the demo database. At each reset:
 
 1. The current `travel.db` is replaced with the saved baseline (`travel-baseline.db`).
-2. The admin account's credentials (`password_hash`, API keys, avatar) are re-applied on top of the restored baseline, so admin API keys and password changes survive the reset.
+2. The admin account's credentials (`password_hash`, API keys, avatar) are re-applied on top of the restored baseline, so admin API keys and password changes survive the reset — but only when `DEMO_ADMIN_EMAIL` is set explicitly.
 
 If no baseline has been saved yet, the reset is skipped and a message is logged.
 
+The seeder defaults the admin address to `admin@trek.app` while the reset defaults it to `admin@nomad.app`, a legacy quirk that is pinned deliberately. With `DEMO_ADMIN_EMAIL` unset the reset looks up an address that does not exist, finds no admin row, and skips the carry-over entirely — a password change, API key or avatar set after the baseline was saved is lost on every hourly reset. Set `DEMO_ADMIN_EMAIL` (to `admin@trek.app`, for instance) if you want them to survive. Unlike the seed-time variables above, the reset reads it on every run, so setting it on an already-seeded instance and restarting is enough.
+
+The instance-wide Maps and Unsplash keys stored in `app_settings` are carried across either way, so map and photo search keep working after a reset.
+
 ## Saving a baseline
 
 The baseline is the snapshot the hourly reset restores to. The admin can update it at any time:
 
-**Endpoint:** `POST /admin/save-demo-baseline`
+**Endpoint:** `POST /api/admin/save-demo-baseline`
 
 This is available in the admin panel. The baseline captures the current state of the database — including trip data, settings, and encrypted API keys — so demo features (maps, photos, weather) continue to work after each reset.
 
diff --git a/wiki/Development-environment.md b/wiki/Development-environment.md
index 86426c1bb..9b06e7c17 100644
--- a/wiki/Development-environment.md
+++ b/wiki/Development-environment.md
@@ -71,12 +71,18 @@ Branch naming conventions:
 
 ## 5. Install Dependencies
 
-The repo is an npm workspace monorepo. One command at the root installs everything:
+The repo is an npm workspace monorepo with three workspaces — `shared`, `server`, and `client`. One command at the root installs all three:
 
 ```bash
 npm ci
 ```
 
+`plugin-sdk/` is **not** a root workspace: it has its own lockfile and is published to npm independently, so a root `npm ci` never touches it. If you are working on the SDK, install and run its commands from that directory:
+
+```bash
+cd plugin-sdk && npm ci
+```
+
 ---
 
 ## 6. Optional: KItinerary (Booking Import)
@@ -94,17 +100,17 @@ sudo apt-get install -y libkitinerary-bin
 Add these to your local `.env` (or export them before starting the server):
 
 ```bash
-# Required: path to the extractor binary
-KITINERARY_EXTRACTOR_PATH=/usr/local/bin/kitinerary-extractor
-
 # Prevent Qt from probing for a display in headless/server environments
 QT_QPA_PLATFORM=offscreen
 
 # KDE cache directory (avoids writing to $HOME)
 XDG_CACHE_HOME=/tmp/kf6-cache
+
+# Optional: only needed when the binary is not found on its own
+# KITINERARY_EXTRACTOR_PATH=/usr/lib/x86_64-linux-gnu/libexec/kf6/kitinerary-extractor
 ```
 
-You can override `KITINERARY_EXTRACTOR_PATH` if you installed the binary to a different location.
+`KITINERARY_EXTRACTOR_PATH` is optional. Left unset, the server looks for the Debian/Ubuntu location `/usr/lib/<triplet>/libexec/kf6/kitinerary-extractor` and then for `kitinerary-extractor` on `PATH` — one of which is what `libkitinerary-bin` gives you. Set it only if the binary ended up somewhere neither lookup reaches, and make sure the path exists: a value that does not resolve logs a warning and stops the lookup instead of falling back, which turns the import feature off. The Docker image sets it to `/usr/local/bin/kitinerary-extractor`, a symlink created at image build; that path does not exist on a plain apt install.
 
 ---
 
@@ -119,7 +125,7 @@ These commands run across all workspaces at once and are the recommended way to
 | `npm run dev`        | Build shared, then start shared (watch), server, and client together via `concurrently` |
 | `npm run build`      | Build shared → server → client in order                            |
 | `npm test`           | Run tests in shared, server, and client                            |
-| `npm run test:cov`   | Run coverage for server and client                                 |
+| `npm run test:cov`   | Run coverage for shared, server, client and plugin-sdk             |
 | `npm run test:e2e`   | Run end-to-end tests (server)                                      |
 | `npm run lint`       | Lint shared, server, and client                                    |
 | `npm run format`     | Format shared, server, and client                                  |
@@ -133,7 +139,7 @@ The `@trek/shared` package is the single source of truth for code shared between
 
 | Command                     | Description                          |
 |-----------------------------|--------------------------------------|
-| `npm run build`             | Compile shared package (tsup)        |
+| `npm run build`             | Compile shared package (tsdown)      |
 | `npm run build:watch`       | Compile in watch mode                |
 | `npm test`                  | Run tests                            |
 | `npm run test:watch`        | Run tests in watch mode              |
@@ -146,21 +152,26 @@ The `@trek/shared` package is the single source of truth for code shared between
 
 ### Server (`/server`)
 
-| Command                    | Description                              |
-|----------------------------|------------------------------------------|
-| `npm start`                | Start the server (production)            |
-| `npm run dev`              | Start the server in watch mode           |
-| `npm run build`            | Compile server                           |
-| `npm run typecheck`        | Type-check without emitting              |
-| `npm test`                 | Run all tests                            |
-| `npm run test:unit`        | Run unit tests only                      |
-| `npm run test:integration` | Run integration tests                    |
-| `npm run test:ws`          | Run WebSocket tests                      |
-| `npm run test:e2e`         | Run end-to-end tests                     |
-| `npm run test:watch`       | Run tests in watch mode                  |
-| `npm run test:coverage`    | Run tests with coverage report           |
-| `npm run lint`             | Lint source                              |
-| `npm run format`           | Format source                            |
+> **Tip:** `tests/` sits outside the build `tsconfig.json`, so `npm run typecheck` skips it — `npm run typecheck:tests` is the only step that catches a broken test call site. CI runs both.
+
+| Command                      | Description                              |
+|------------------------------|------------------------------------------|
+| `npm start`                  | Start the server (production)            |
+| `npm run dev`                | Start the server in watch mode           |
+| `npm run build`              | Compile server                           |
+| `npm run typecheck`          | Type-check without emitting              |
+| `npm run typecheck:tests`    | Type-check `tests/` too (CI gate)        |
+| `npm test`                   | Run all tests                            |
+| `npm run test:unit`          | Run unit tests only                      |
+| `npm run test:integration`   | Run integration tests                    |
+| `npm run test:ws`            | Run WebSocket tests                      |
+| `npm run test:e2e`           | Run end-to-end tests                     |
+| `npm run test:watch`         | Run tests in watch mode                  |
+| `npm run test:coverage`      | Run tests with coverage report           |
+| `npm run lint`               | Lint source                              |
+| `npm run lint:check`         | Lint everything, no `--fix` (CI gate)    |
+| `npm run check:plugin-facts` | Verify generated plugin facts (CI gate)  |
+| `npm run format`             | Format source                            |
 
 ### Client (`/client`)
 
@@ -169,12 +180,16 @@ The `@trek/shared` package is the single source of truth for code shared between
 | `npm run dev`              | Start the Vite dev server                            |
 | `npm run build`            | Build for production (runs icon generation first)    |
 | `npm run preview`          | Preview the production build locally                 |
+| `npm run typecheck`        | Type-check without emitting (CI gate)                |
 | `npm test`                 | Run all tests                                        |
 | `npm run test:unit`        | Run unit tests only                                  |
 | `npm run test:integration` | Run integration tests                                |
 | `npm run test:watch`       | Run tests in watch mode                              |
 | `npm run test:coverage`    | Run tests with coverage report                       |
 | `npm run lint`             | Lint source                                          |
+| `npm run lint:check`       | Same command as `npm run lint` — the name CI uses    |
+| `npm run lint:pages`       | Enforce the Page pattern (CI gate)                   |
+| `npm run theme:lint`       | Flag styling that bypasses the appearance tokens     |
 | `npm run format`           | Format source                                        |
 
 ---
@@ -199,5 +214,5 @@ Then open a Pull Request from your fork to `liketrek/TREK` targeting the `dev` b
 ## Tips
 
 - Always branch off from an up-to-date `dev` — run `git fetch upstream && git rebase upstream/dev` before starting new work.
-- Run tests before pushing: `npm test` at the repo root runs all workspaces.
+- Run tests before pushing: `npm test` at the repo root runs all workspaces. That alone is not the full CI gate — also run `npm run typecheck && npm run typecheck:tests && npm run lint:check && npm run check:plugin-facts` in `server/`, `npm run typecheck && npm run lint:check && npm run lint:pages` in `client/`, and `npm run i18n:parity:strict --workspace=shared` at the root if you touched translations.
 - Follow the commit message conventions described in the [[Contributing]] guidelines.
diff --git a/wiki/Display-Settings.md b/wiki/Display-Settings.md
index e6ccd931c..aea399351 100644
--- a/wiki/Display-Settings.md
+++ b/wiki/Display-Settings.md
@@ -8,7 +8,7 @@ The General tab (Settings → General) controls your locale preferences and a fe
 
 Open the user menu in the top navigation bar, select **Settings**, and stay on the **General** tab — it is the tab the page opens on.
 
-The tab is split into three sections: **Startup** (where opening TREK lands), **Language & region** (currency, language, temperature, distance, time format) and **Travel & map** (booking route labels, POI pills, blur booking codes).
+The tab is split into three sections: **Startup** (where opening TREK lands), **Language & region** (currency, language, temperature, distance, time format) and **Travel & map** (booking route labels, always show booking routes, explore places on the map, blur booking codes, optimize route from accommodation).
 
 > Color mode (Light / Dark / Auto) is **not** here — it lives on the **Appearance** tab. See [Appearance-Settings](Appearance-Settings).
 
@@ -44,7 +44,7 @@ The parameter takes the planner's internal tab ids, which are historic German na
 | Tab | Id |
 |-----|-----|
 | Plan | `plan` |
-| Transport | `transports` |
+| Transports | `transports` |
 | Bookings | `buchungen` |
 | Lists | `listen` |
 | Costs | `finanzplan` |
@@ -67,7 +67,7 @@ Your **display currency** — the currency you want to *read* amounts in on the
 
 > This is **not** the trip's currency, which is set on the trip itself and is the base its balances are calculated in. The distinction matters — see [Currencies](Currencies).
 
-An administrator can set the instance-wide default for new users in Admin → Default User Settings. Choosing **Trip currency** yourself overrides it.
+An administrator can set an instance-wide default in Admin → Default User Settings. It is not only a starting value for new accounts: it is merged in every time your settings are loaded, so it applies to anyone whose own display currency is empty. Picking a specific currency of your own overrides it. **Trip currency** does not, because it stores an empty value that counts as "not set", so the admin default takes effect again on your next reload.
 
 ## Language
 
@@ -116,6 +116,12 @@ This only sets the *default* for a trip you haven't touched before. If you've al
 
 When enabled, confirmation codes and reference numbers are blurred until you hover or tap. Set to **On** or **Off**.
 
+## Optimize route from accommodation
+
+When **On** (the default), the **Optimize** button in the day's route tools anchors the route on that day's accommodation instead of only reordering the places among themselves: an ordinary day becomes a loop out from the hotel and back to it, a transfer day a run from the hotel you check out of to the one you check into that evening. Set to **On** or **Off**.
+
+A day without an accommodation, or one whose hotel has no coordinates, is optimized from its first place as before. Locked and timed places keep their slots either way. See [Route-Optimization](Route-Optimization).
+
 ## See also
 
 - [Currencies](Currencies)
diff --git a/wiki/Documents-and-Files.md b/wiki/Documents-and-Files.md
index b3f44786b..790acc755 100644
--- a/wiki/Documents-and-Files.md
+++ b/wiki/Documents-and-Files.md
@@ -17,23 +17,23 @@ Open the **Files** tab inside the trip planner, or navigate directly to `/trips/
 Drag and drop files onto the upload area, click it to open the file picker, or paste an image directly into the Files panel.
 
 - **Maximum file size:** 50 MB per file.
-- **Blocked file types:** `.svg`, `.html`, `.htm`, `.xml` — these are always rejected.
-- **Default allowed types:** jpg, jpeg, png, gif, webp, heic, pdf, doc, docx, xls, xlsx, txt, csv, pkpass. An admin can customize the allowed list in [Admin-Addons](Admin-Addons).
+- **Blocked file types:** renderable documents (`.svg`, `.svgz`, `.html`, `.htm`, `.shtml`, `.shtm`, `.xml`, `.xhtml`, `.xht`), scripts (`.js`, `.jsx`, `.ts`, `.tsx`, `.mjs`, `.cjs`, `.php`, `.py`, `.rb`, `.pl`) and executables (`.exe`, `.bat`, `.sh`, `.cmd`, `.msi`, `.dll`, `.com`, `.vbs`, `.ps1`, `.app`) — these are always rejected, as is any file whose MIME type contains `svg`.
+- **Default allowed types:** jpg, jpeg, png, gif, webp, heic, pdf, doc, docx, xls, xlsx, txt, csv, pkpass, pkpasses, md, markdown. An admin can customize the allowed list under **Admin → Settings → Allowed File Types** — comma-separated extensions, or `*` to allow everything except the blocked types above.
 
 Requires the `file_upload` permission.
 
 ## Browsing and filtering
 
-The toolbar provides filter tabs: **All**, **PDF**, **Images**, **Docs**, and conditionally **Starred** (only shown when at least one file is starred) and **Collab** (only shown when files exist from collaborative notes). Each tab shows a count badge.
+The toolbar provides filter tabs, in this order: **All**, a star icon for **Starred** (only shown when at least one file is starred), **PDFs**, **Images**, **Documents**, and **Collab Notes** (only shown when files exist from collaborative notes). Each tab shows a count badge.
 
 ## Previewing files
 
-Clicking a non-image file (e.g., PDF) opens an inline preview modal with options to open in a new tab or download. Clicking an image file opens a full-screen lightbox. You can:
+Clicking a file that is neither an image nor a video (e.g., PDF or Markdown) opens an inline preview modal with options to open in a new tab or download. `.pkpass` and `.pkpasses` Wallet passes are the exception: clicking one downloads it straight away, so the OS can hand it to Apple Wallet rather than forcing it into the in-app preview. Clicking an image or video file opens a full-screen lightbox. You can:
 
-- Navigate between images using the **arrow buttons** or the **left/right arrow keys**.
+- Navigate between images and videos using the **arrow buttons** or the **left/right arrow keys**.
 - Swipe left/right on touch devices.
-- Jump to a specific image using the **thumbnail strip** at the bottom.
-- Download or open the image in a new tab from the lightbox header.
+- Jump to a specific file using the **thumbnail strip** at the bottom. Videos have no stored thumbnail and show a play placeholder there.
+- Download or open the file in a new tab from the lightbox header.
 
 ## Starring
 
diff --git a/wiki/Encryption-Key-Rotation.md b/wiki/Encryption-Key-Rotation.md
index b0d558cf9..419012bfc 100644
--- a/wiki/Encryption-Key-Rotation.md
+++ b/wiki/Encryption-Key-Rotation.md
@@ -9,14 +9,17 @@ TREK encrypts sensitive settings at rest using AES-256-GCM. The following values
 - Mapbox access token (per user)
 - OpenWeather API key (per user)
 - Immich API key (per user)
+- AirTrail API key (per user)
 - Synology Photos password, session ID, and device ID (per user)
-- Per-user webhook URL and ntfy notification token (in `settings` table)
+- Per-user webhook URL, ntfy notification token, and LLM provider API key (in `settings` table)
 - OIDC client secret (global, in `app_settings`)
 - SMTP password (global, in `app_settings`)
 - Admin webhook URL and admin ntfy token (global, in `app_settings`)
 - MFA (TOTP) secrets for all users
 - Photo passphrases for Synology shared-link photos (in `trek_photos`)
+- Passphrases for shared trip album links (in `trip_album_links`)
 - S3 storage backend secret access keys (in `app_settings['storage.backends']`; see [Admin-Storage](Admin-Storage))
+- Plugin OAuth access and refresh tokens, plus every plugin settings field the plugin's manifest marks `secret` (instance scope in `plugins.config`, user scope in `plugin_user_config.config`)
 
 The encryption derives a key from `ENCRYPTION_KEY` using SHA-256 (with a domain suffix per secret type), so the raw `ENCRYPTION_KEY` value is never stored in the database.
 
@@ -35,7 +38,9 @@ All encrypted settings (API keys, SMTP password, OIDC secret, MFA secrets, notif
 
 ## Backing up the key
 
-Your backup ZIP does **not** include the encryption key. Store the key separately from your backups — for example, in a password manager or a secrets manager. See [Backups](Backups).
+Unless you set `ENCRYPTION_KEY` in the environment, your backup ZIP **does** include the encryption key: `./data/.encryption_key` is bundled into every archive, manual and automatic, as a root-level `.encryption_key` entry, so a restore onto a different install can still decrypt the stored secrets. That makes the ZIP exactly as sensitive as the key itself — store and transfer it accordingly.
+
+On installs that supply the key through the environment the file is not the source of truth, so no backup carries it. Keep it somewhere separate — for example, in a password manager or a secrets manager. See [Backups](Backups).
 
 To find your current key: check the `ENCRYPTION_KEY` environment variable or read `./data/.encryption_key`.
 
@@ -46,7 +51,7 @@ Use `scripts/migrate-encryption.ts` to re-encrypt all stored secrets without dow
 **Docker:**
 
 ```bash
-docker exec -it trek node --import tsx scripts/migrate-encryption.ts
+docker exec -it -w /app/server trek node --import tsx scripts/migrate-encryption.ts
 ```
 
 **Host (run from the `server/` directory):**
@@ -63,8 +68,10 @@ The script:
 4. Re-encrypts all stored secrets across all tables:
    - `app_settings`: `oidc_client_secret`, `smtp_pass`, `admin_webhook_url`, `admin_ntfy_token`, `maps_api_key`, `unsplash_api_key`
    - `app_settings['storage.backends']`: the `secretAccessKey` of every S3 storage backend
-   - `users` (per user): `maps_api_key`, `unsplash_api_key`, `openweather_api_key`, `immich_api_key`, `synology_password`, `synology_sid`, `synology_did`, `mfa_secret`
-   - `settings` (per user): `webhook_url`, `ntfy_token`, `mapbox_access_token`
+   - `users` (per user): `maps_api_key`, `unsplash_api_key`, `openweather_api_key`, `immich_api_key`, `synology_password`, `synology_sid`, `synology_did`, `airtrail_api_key`, `mfa_secret`
+   - `settings` (per user): `webhook_url`, `ntfy_token`, `mapbox_access_token`, `llm_api_key`
+   - `plugin_oauth_tokens`: `access_token`, `refresh_token` (per plugin and user)
+   - `plugins.config` and `plugin_user_config.config`: every settings field a plugin's manifest marks `secret`, resolved per plugin and scope from `plugin_settings_fields`
    - `trip_album_links`: `passphrase`
    - `trek_photos`: `passphrase`
 5. Reports counts of migrated, already-migrated, skipped (empty), and errored values.
diff --git a/wiki/Environment-Variables.md b/wiki/Environment-Variables.md
index 479069fb5..5dff7acc4 100644
--- a/wiki/Environment-Variables.md
+++ b/wiki/Environment-Variables.md
@@ -6,12 +6,39 @@ Complete reference for all environment variables TREK reads.
 
 - **Docker Compose** — use the `environment:` block or a `.env` file alongside `docker-compose.yml`
 - **Docker run** — pass each variable with `-e VARIABLE=value`
-- **Helm** — use `env:` for plain values and `secretEnv:` for sensitive values in `values.yaml`
+- **Helm** — use `env:` for plain values and `secretEnv:` for sensitive values in `values.yaml`. The chart only
+  passes through the keys it declares (26 in `templates/configmap.yaml`, 5 in `templates/secret.yaml`), so a variable
+  that is not one of them is dropped silently — patch it onto the Deployment or add it to the chart
 - **Unraid** — set in the container template editor
 - **Proxmox Community Script** — set in `/opt/trek/server/.env`
 
 ---
 
+## Startup Validation
+
+TREK checks almost all of this surface once at boot. A variable that is **unset or blank** falls back to its documented
+default; a variable that is **present but malformed** aborts startup, with an aggregated report naming every
+offending value:
+
+```
+Invalid environment configuration:
+  - PORT="not-a-port": must be a port number (1-65535)
+  - SESSION_DURATION="bogus": must be a duration like "1h", "7d" or "30d"
+```
+
+In Docker this crash-loops the container until the value is corrected or removed. Boolean switches accept
+`true`/`false`, `1`/`0`, `on`/`off`, `yes`/`no` in any casing — anything else counts as malformed. Variables TREK
+does not know are passed through untouched.
+
+`TREK_DB_JOURNAL_MODE` and `TREK_DB_SYNCHRONOUS` are exceptions: they log a warning and fall back instead of
+aborting, because `reset-admin.js` — the way back into a locked-out instance — reads the same two variables and has
+to keep working. The three plugin caps `TREK_PLUGIN_AI_PER_DAY`, `TREK_PLUGIN_NOTIFY_PER_DAY` and
+`TREK_PLUGIN_AUDIT_MAX_ROWS` are read by the plugin host rather than by the boot schema, so a malformed value there
+falls back to the default without a warning. `NODE_ENV` and `TZ` are not validated at all, so a non-standard value
+like `NODE_ENV=staging` still boots.
+
+---
+
 ## Core
 
 | Variable                    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Default                         |
@@ -23,12 +50,12 @@ Complete reference for all environment variables TREK reads.
 | `TZ`                        | Timezone for logs, reminders, and cron jobs (e.g. `Europe/Berlin`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `UTC`                           |
 | `LOG_LEVEL`                 | `info` = concise user actions; `debug` = verbose details                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `info`                          |
 | `DEFAULT_LANGUAGE`          | Default language on the login page — see supported codes below                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `en`                            |
-| `SESSION_DURATION`          | How long a login session stays valid before re-login is required. Used when **"Remember me" is unchecked** on the login form (the default): applies to the `trek_session` JWT `exp` claim, and the cookie is issued as a **browser-session cookie** (no `maxAge`, cleared when the browser closes). Accepts `ms`-style strings: `1h`, `12h`, `7d`, `30d`, `90d`. Invalid values warn at startup and fall back to the default. Does not affect the short-lived MFA challenge token or MCP OAuth tokens (those keep their own TTL). | `24h`                           |
-| `SESSION_DURATION_REMEMBER` | Session length used when the user **ticks "Remember me"** on login: a longer-lived JWT `exp` claim plus a **persistent** `trek_session` cookie whose `maxAge` matches, so the session survives browser restarts. Same `ms`-style format and startup-fallback behaviour as `SESSION_DURATION`.                                                                                                                                                                                                                                     | `30d`                           |
+| `SESSION_DURATION`          | How long a login session stays valid before re-login is required. Used when **"Remember me" is unchecked** on the login form (the default): applies to the `trek_session` JWT `exp` claim, and the cookie is issued as a **browser-session cookie** (no `maxAge`, cleared when the browser closes). Accepts `ms`-style strings: `1h`, `12h`, `7d`, `30d`, `90d`. Invalid values abort startup — see Startup Validation above. Does not affect the short-lived MFA challenge token or MCP OAuth tokens (those keep their own TTL). | `24h`                           |
+| `SESSION_DURATION_REMEMBER` | Session length used when the user **ticks "Remember me"** on login: a longer-lived JWT `exp` claim plus a **persistent** `trek_session` cookie whose `maxAge` matches, so the session survives browser restarts. Same `ms`-style format and the same startup validation as `SESSION_DURATION`.                                                                                                                                                                                                                                     | `30d`                           |
 | `ALLOWED_ORIGINS`           | Comma-separated origins for CORS and email notification links                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | same-origin                     |
 | `ALLOW_INTERNAL_NETWORK`    | Allow outbound requests to private/RFC-1918 IPs. Set `true` if Immich or other integrated services are on your local network. Loopback (`127.x`) and link-local (`169.254.x`) addresses remain blocked regardless.                                                                                                                                                                                                                                                                                                                | `false`                         |
 | `APP_URL`                   | Public base URL (e.g. `https://trek.example.com`). Required when OIDC is enabled — must match the redirect URI registered with your IdP. Also used as the base URL for email notification links and subscribable calendar feed URLs (the `webcal://`/`https://` links the Subscribe dialog hands to Google/Apple/Outlook).                                                                                                                                                                                                          | —                               |
-| `TREK_WIKI_DIR`             | Where the in-app Help pages (`/help`) read their content from. TREK ships this wiki and serves it from disk, so the docs always match the version you are running. You should not need to set this — it is an escape hatch for unusual layouts. If the directory cannot be found, Help falls back to fetching the public GitHub wiki (which tracks the latest release and needs outbound network access).                                                                                                                            | the bundled `wiki/` directory   |
+| `TREK_WIKI_DIR`             | Where the in-app Help pages (`/help`) read their content from. TREK ships this wiki and serves it from disk, so the docs always match the version you are running. You should not need to set this — it is an escape hatch for unusual layouts. If the directory cannot be found, Help falls back to fetching the repository's `wiki/` folder from the `main` branch on GitHub (which can be ahead of the release you are running, and needs outbound network access).                                                               | the bundled `wiki/` directory   |
 
 ### `HOST` — Source and Proxmox installs only
 
@@ -65,7 +92,7 @@ Setting `ENCRYPTION_KEY` explicitly is recommended so you can back it up indepen
 
 ### `DEFAULT_LANGUAGE` — Supported Codes
 
-You can set `DEFAULT_LANGUAGE` to any of the 22 languages TREK ships. The currently supported codes are:
+You can set `DEFAULT_LANGUAGE` to any of the 23 languages TREK ships. The currently supported codes are:
 
 | Code    | Language           |
 |---------|--------------------|
@@ -91,8 +118,10 @@ You can set `DEFAULT_LANGUAGE` to any of the 22 languages TREK ships. The curren
 | `gr`    | Ελληνικά           |
 | `sv`    | Svenska            |
 | `vi`    | Tiếng Việt         |
+| `ca`    | Català             |
 
-If you set a code that isn't supported, TREK falls back to English (`en`). This list grows as new
+If you set a code that isn't on this list, TREK refuses to start and prints
+`DEFAULT_LANGUAGE="…": must be one of: …`. Leave the variable unset to use English (`en`). This list grows as new
 translations are added to TREK.
 
 ---
@@ -127,12 +156,17 @@ full explanation.
 
 | Variable                  | Description                                                                                                                                                                                                                                                                             | Default          |
 |---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
-| `FORCE_HTTPS`             | When `true`: 301-redirects HTTP→HTTPS, sends HSTS (`max-age=31536000`), adds CSP `upgrade-insecure-requests`, forces cookie `secure` flag. Only useful behind a TLS proxy. Requires `TRUST_PROXY`.                                                                                      | `false`          |
+| `FORCE_HTTPS`             | When `true`: 301-redirects HTTP→HTTPS, sends HSTS (`max-age=31536000`), adds CSP `upgrade-insecure-requests`, forces cookie `secure` flag. Only useful behind a TLS proxy. Your proxy must send `X-Forwarded-Proto: https`.                                                             | `false`          |
 | `HSTS_INCLUDE_SUBDOMAINS` | When `true`: adds the `includeSubDomains` directive to the HSTS header, extending HTTPS enforcement to all subdomains. Only effective when HSTS is active (`FORCE_HTTPS=true` or `NODE_ENV=production`). Leave `false` if you run other services on sibling subdomains over plain HTTP. | `false`          |
-| `TRUST_PROXY`             | Number of trusted proxy hops. Tells Express how far into `X-Forwarded-For` to look for the real client IP, and where to read `X-Forwarded-Proto`. Count your hops: with two proxies in front of TREK and `TRUST_PROXY=1`, the IP on every audit row is the inner proxy's. `0` trusts nothing and always uses the socket address. Required for `FORCE_HTTPS` to detect the forwarded protocol.                                          | `1` (production) |
-| `COOKIE_SECURE`           | Controls the `secure` flag on the `trek_session` cookie. Auto-derived as `true` when `NODE_ENV=production` or `FORCE_HTTPS=true`. Set to `false` only as an escape hatch for LAN testing without TLS — not recommended in production.                                                   | auto             |
+| `TRUST_PROXY`             | Number of trusted proxy hops. Tells Express how far into `X-Forwarded-For` to look for the real client IP, and where to read `X-Forwarded-Proto`. Count your hops: with two proxies in front of TREK and `TRUST_PROXY=1`, the IP on every audit row is the inner proxy's. `0` trusts nothing and always uses the socket address. Not required for the `FORCE_HTTPS` redirect, which reads the `X-Forwarded-Proto` header directly — set it for correct client IPs in the audit log, and for the `COOKIE_SECURE` auto-derivation, which goes through `req.secure`. | `1` (production) |
+| `COOKIE_SECURE`           | Controls the `secure` flag on the `trek_session` cookie. Auto-derived as `true` when `NODE_ENV=production`, when `FORCE_HTTPS=true`, or when the request itself arrived over TLS on the outermost hop (`X-Forwarded-Proto: https` with `TRUST_PROXY` set). Set to `false` only as an escape hatch for LAN testing without TLS — not recommended in production.                                                   | auto             |
 
-> **Warning:** `FORCE_HTTPS=true` without `TRUST_PROXY` set causes a redirect loop.
+> **Warning:** `FORCE_HTTPS=true` behind a proxy that does not forward `X-Forwarded-Proto: https` causes a
+> redirect loop — every request looks like plain HTTP to TREK and gets 301'd again. Fix the proxy to send the
+> header. Setting `TRUST_PROXY` does not help: the redirect accepts the raw `X-Forwarded-Proto: https` header on
+> its own, whatever `trust proxy` is set to. (`TRUST_PROXY` only feeds the second half of the check, `req.secure`,
+> which additionally covers a proxy chain that sends a comma-joined `X-Forwarded-Proto` — and production already
+> trusts one hop by default.)
 
 ---
 
@@ -147,7 +181,7 @@ For setup instructions, see [OIDC-SSO](OIDC-SSO).
 | `OIDC_CLIENT_SECRET` | OIDC client secret                                                                                                                                                                     | —                      |
 | `OIDC_DISPLAY_NAME`  | Label shown on the SSO login button                                                                                                                                                    | `SSO`                  |
 | `OIDC_ONLY`          | Force SSO-only mode: disables password login and registration, overrides Admin > Settings toggles, cannot be changed at runtime. First SSO login becomes admin on a fresh instance.    | `false`                |
-| `OIDC_ADMIN_CLAIM`   | OIDC claim used to identify admin users (e.g. `groups`)                                                                                                                                | —                      |
+| `OIDC_ADMIN_CLAIM`   | OIDC claim inspected for the admin role. Only takes effect once `OIDC_ADMIN_VALUE` is set.                                                                                             | `groups`               |
 | `OIDC_ADMIN_VALUE`   | Value of the OIDC claim that grants admin role (e.g. `app-trek-admins`)                                                                                                                | —                      |
 | `OIDC_SCOPE`         | Space-separated OIDC scopes to request. **Fully replaces** the default — always include `openid email profile` plus any extra scopes (e.g. add `groups` when using `OIDC_ADMIN_CLAIM`) | `openid email profile` |
 | `OIDC_DISCOVERY_URL` | Override the auto-constructed OIDC discovery endpoint. Required for providers with a non-standard path (e.g. Authentik)                                                                | —                      |
@@ -207,7 +241,7 @@ For setup instructions, see [MCP-Overview](MCP-Overview).
 
 | Variable                   | Description                                                                                             | Default |
 |----------------------------|---------------------------------------------------------------------------------------------------------|---------|
-| `MCP_RATE_LIMIT`           | Max MCP API requests per user per minute                                                                 | `300`   |
+| `MCP_RATE_LIMIT`           | Max MCP API requests per minute, counted **per user and per OAuth client** — a user connected from two MCP clients gets this budget twice. Requests made with a static `trek_` token or a session JWT carry no client and share one further bucket per user. | `300`   |
 | `MCP_MAX_SESSION_PER_USER` | Max concurrent MCP sessions per user. At the cap the user's least-recently-active session is closed to make room — requests are not rejected. | `20`    |
 | `MCP_SESSION_TTL`          | Session idle timeout in seconds (max 86400)                                                              | `3600`  |
 | `MCP_SSE_KEEPALIVE`        | SSE keep-alive ping interval in seconds — keeps the stream alive through reverse proxies. `0` disables the pings; an open stream still refreshes the session's idle timeout. | `25`    |
@@ -232,11 +266,13 @@ Request bodies validated with Zod are documented automatically from the same sch
 |-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
 | `KITINERARY_EXTRACTOR_PATH` | Full path to the `kitinerary-extractor` binary. When unset, TREK searches `/usr/lib/*/libexec/kf6/kitinerary-extractor` and then `PATH`. Set this if you install the binary to a non-standard location. | auto-detected |
 
-The official TREK Docker image bundles the binary automatically: on amd64 it downloads the static release from
-`https://cdn.kde.org/ci-builds/pim/kitinerary/`; on arm64 it installs `libkitinerary-bin` via apt (Debian trixie). When
-running TREK from source, install `libkitinerary-bin` (Debian trixie / Ubuntu 25.04+) or download the static binary
-directly and place it anywhere on `PATH`. The `GET /api/health/features` endpoint returns `{ "bookingImport": true }`
-when the binary is found, and the Import button in the Reservations panel is hidden when it is not.
+The official TREK Docker image bundles the binary automatically: on both amd64 and arm64 it installs
+`libkitinerary-bin` via apt (Debian trixie) and symlinks it to `/usr/local/bin/kitinerary-extractor`, which the image
+also pins via `KITINERARY_EXTRACTOR_PATH`. When running TREK from source, install `libkitinerary-bin` (Debian trixie /
+Ubuntu 25.04+) or download the static binary directly and place it anywhere on `PATH`. The
+`GET /api/health/features` endpoint returns `{ "bookingImport": true }` when the binary is found. The Import button in
+the Reservations panel is hidden only when **neither** extractor is available — an instance running the AI Parsing
+addon still offers it with `bookingImport: false`.
 
 Booking import can also fall back to an AI model for documents KDE Itinerary can't read. That feature (the **AI Parsing** addon) is configured entirely in the UI and needs no environment variables — see [AI-Booking-Import](AI-Booking-Import).
 
@@ -279,12 +315,13 @@ Storage backends and category assignment are configured in
 [[Admin: Storage|Admin-Storage]] (or a seed-once `storage-config.json`), not
 through environment variables. `TREK_PLACE_PHOTO_DIR` below is unaffected.
 
-| Variable                 | Description                                                                                                                                                                                                                                            | Default                 |
-|--------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------|
-| `TREK_PLACE_PHOTO_DIR`   | Directory where cached Google place photos are stored. Created recursively on boot. Set this to point photo storage at a dedicated mounted volume.                                                                                                     | `uploads/photos/google` |
-| `BACKUP_UPLOAD_LIMIT_MB` | Maximum **compressed** size (in MB) of a restore-backup archive that may be uploaded. Raise it if your backups (which include the `uploads/` directory) exceed the default. Non-positive or invalid values log a warning and fall back to the default. | `500`                   |
-| `TREK_DB_JOURNAL_MODE`   | SQLite [journal mode](https://sqlite.org/pragma.html#pragma_journal_mode): `DELETE`, `TRUNCATE`, `PERSIST`, `MEMORY`, `WAL` or `OFF`. Set `DELETE` when the data directory lives on network storage — see below. Values SQLite doesn't know log a warning and fall back. | `WAL`                   |
-| `TREK_DB_SYNCHRONOUS`    | SQLite [synchronous](https://sqlite.org/pragma.html#pragma_synchronous) level: `OFF`, `NORMAL`, `FULL` or `EXTRA`. The default follows the journal mode — `NORMAL` under WAL (what SQLite itself uses there), `FULL` otherwise, because a rollback journal at `NORMAL` can lose committed transactions on a power cut. | `NORMAL` / `FULL`       |
+| Variable                     | Description                                                                                                                                                                                                                                            | Default                 |
+|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------|
+| `TREK_PLACE_PHOTO_DIR`       | Directory where cached Google place photos are stored. Created recursively on boot. Set this to point photo storage at a dedicated mounted volume.                                                                                                     | `uploads/photos/google` |
+| `BACKUP_UPLOAD_LIMIT_MB`     | Maximum **compressed** size (in MB) of a restore-backup archive that may be uploaded. Raise it if your backups (which include the `uploads/` directory) exceed the default. Non-positive or invalid values abort startup. | `500`                   |
+| `BACKUP_MAX_DECOMPRESSED_MB` | Maximum **decompressed** size (in MB) of a restore-backup archive — the zip-bomb guard. Independent of `BACKUP_UPLOAD_LIMIT_MB` and enforced on both restore paths, so a restore that fits the upload cap can still be refused with `Backup exceeds the maximum decompressed size.` Raise both when restoring a very large instance. | `5120` (5 GB)          |
+| `TREK_DB_JOURNAL_MODE`       | SQLite [journal mode](https://sqlite.org/pragma.html#pragma_journal_mode): `DELETE`, `TRUNCATE`, `PERSIST`, `MEMORY`, `WAL` or `OFF`. Set `DELETE` when the data directory lives on network storage — see below. Values SQLite doesn't know log a warning and fall back. | `WAL`                   |
+| `TREK_DB_SYNCHRONOUS`        | SQLite [synchronous](https://sqlite.org/pragma.html#pragma_synchronous) level: `OFF`, `NORMAL`, `FULL` or `EXTRA`. The default follows the journal mode — `NORMAL` under WAL (what SQLite itself uses there), `FULL` otherwise, because a rollback journal at `NORMAL` can lose committed transactions on a power cut. | `NORMAL` / `FULL`       |
 
 ### Running the database on network storage
 
@@ -314,9 +351,9 @@ next key rotation or admin reset would quietly switch the file back to WAL.
 
 | Variable                  | Description                                                                                                                                                                                                                                                                                                                | Default             |
 |---------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------|
-| `IDEMPOTENCY_TTL_SECONDS` | How long (in seconds) stored idempotency keys are kept before garbage collection. The offline client replays queued mutations with their `X-Idempotency-Key` on reconnect, so this must exceed the longest expected offline window or a replay could create a duplicate. Invalid values silently fall back to the default. | `2592000` (30 days) |
+| `IDEMPOTENCY_TTL_SECONDS` | How long (in seconds) stored idempotency keys are kept before garbage collection. The offline client replays queued mutations with their `X-Idempotency-Key` on reconnect, so this must exceed the longest expected offline window or a replay could create a duplicate. Invalid values abort startup. | `2592000` (30 days) |
 | `OVERPASS_URL`            | Custom [Overpass API](https://wiki.openstreetmap.org/wiki/Overpass_API) endpoint(s) used by the map's POI "explore" search, comma-separated. When set it **replaces** the bundled public mirrors — point it at an internal or self-hosted Overpass instance when the public mirrors are unreachable from your network (e.g. firewalled/locked-down egress in a Kubernetes cluster). Entries that aren't valid `http(s)` URLs are ignored. If you don't run your own Overpass but the public mirrors throttle TREK, first make sure `APP_URL` (or `ALLOWED_ORIGINS`) is set: that alone gives outbound Overpass/Nominatim requests a unique User-Agent, which the public mirrors rate-limit far less. | bundled public mirrors |
-| `OVERPASS_TIMEOUT_MS`     | Per-endpoint timeout (in milliseconds) for Overpass POI requests. Endpoints race in parallel and one that hasn't answered within this window is abandoned so a faster mirror can win. Raise it if you run a slow self-hosted Overpass instance. Invalid values fall back to the default. | `12000` |
+| `OVERPASS_TIMEOUT_MS`     | Per-endpoint timeout (in milliseconds) for Overpass POI requests. Endpoints race in parallel and one that hasn't answered within this window is abandoned so a faster mirror can win. Raise it if you run a slow self-hosted Overpass instance. Invalid values abort startup. | `12000` |
 
 ---
 
@@ -347,15 +384,17 @@ The plugin system is **on by default**. The runtime and the Admin → Plugins pa
 | `TREK_PLUGINS_DATA_DIR`           | Directory for each plugin's own **data** (its private SQLite file). Kept separate from the code tree; persist it as a volume too.                                                                                     | `<data>/plugins-data`                                                               |
 | `TREK_PLUGIN_REGISTRY_URL`        | Override the plugin registry index the *Discover* tab browses. Point it at your own fork or mirror of the registry.                                                                                                  | `https://raw.githubusercontent.com/liketrek/TREK-Plugins/main/dist/index.json` |
 | `TREK_PLUGIN_MAX_RSS_MB`          | Per-plugin memory ceiling in MB. A plugin process that exceeds it is stopped.                                                                                                                                         | `300`                                                                               |
-| `TREK_PLUGIN_PERMISSIONS`         | Set to `off` to opt **out** of the Node.js OS-level permission sandbox for plugin child processes (not recommended). Any other value keeps the sandbox on.                                                            | `on`                                                                                |
+| `TREK_PLUGIN_PERMISSIONS`         | Set to any falsy value (`off`, `false`, `0`, `no` — any casing) to opt **out** of the Node.js OS-level permission sandbox for plugin child processes (not recommended). A truthy value, or leaving it unset, keeps the sandbox on; anything outside that set is rejected at boot.                                                            | `on`                                                                                |
 | `TREK_PLUGIN_ALLOW_PRIVATE_EGRESS`| Set to `on` to let a plugin's declared outbound hosts resolve to private/internal addresses (e.g. a service on your LAN). By default connections to private, loopback, link-local and metadata addresses are refused. | off (private egress blocked)                                                        |
-| `TREK_PLUGINS_DEV_LINK`           | **Development only.** Set to exactly `1` to enable *dev-link*: registering a plugin from a local build directory and hot-reloading it against a live instance's data. Dev-linked code bypasses the install-time signature/integrity checks and (under `npm run dev`) runs with the OS permission jail off, so it must never be reachable in production — any value other than `1` (including absent) keeps it off. Data access is still fully gated by the capability host. | off (disabled)                                                                      |
+| `TREK_PLUGINS_DEV_LINK`           | **Development only.** Set to any truthy value (`1`, `true`, `on`, `yes` — any casing) to enable *dev-link*: registering a plugin from a local build directory and hot-reloading it against a live instance's data. Dev-linked code bypasses the install-time signature/integrity checks and (under `npm run dev`) runs with the OS permission jail off, so it must never be reachable in production — absent, blank or an explicitly falsy value (`0`, `false`, `off`, `no`) keeps it off. Data access is still fully gated by the capability host. | off (disabled)                                                                      |
 | `TREK_PLUGIN_AI_PER_DAY`          | Per-plugin **daily** cap on shared-LLM broker calls (`ai.complete` / `ai.extract`). Bounds how much a single plugin can spend on the admin's LLM quota per UTC day, independent of its granted permissions. Counts persist across restarts within the same day; set to `0` to disable the AI broker entirely. Generous by design — only bites a runaway plugin. | `200`                                                                               |
 | `TREK_PLUGIN_NOTIFY_PER_DAY`      | Per-plugin **daily** cap on user-notification broker calls (`notify.send`), so one plugin can't spam a user. Same UTC-day window and restart-safe counting as `TREK_PLUGIN_AI_PER_DAY`; set to `0` to disable the notify broker. | `100`                                                                               |
 | `TREK_PLUGIN_RPC_PER_SEC`         | Sustained rate limit (calls **per second**) for a plugin's host RPC calls (`ctx.*`) once its burst allowance is spent. Prevents a tight-loop plugin from starving the single-threaded host. | `20`                                                                                |
 | `TREK_PLUGIN_RPC_BURST`           | Burst allowance — how many host RPC calls a plugin may fire back-to-back before the per-second limit applies. | `60`                                                                                |
 | `TREK_PLUGIN_RPC_INFLIGHT`        | Max concurrent host→plugin RPC dispatches allowed for a single plugin at once (concurrency cap). | `16`                                                                                |
-| `TREK_PLUGIN_AUDIT_MAX_ROWS`      | Per-plugin retention cap for the capability audit log (kept in the shared `trek.db`). The newest N rows per plugin are retained and older ones pruned; the retained window stays tamper-evident. Set to `0` to disable pruning. | `20000`                                                                             |
+| `TREK_PLUGIN_LOG_PER_SEC`         | Sustained rate limit (log lines **per second**) for a plugin's log output — `ctx.log.*`, the child process's stdout/stderr, and unknown plugin event topics — once its burst allowance is spent. This path is **not** covered by the RPC limiter above, and `warn`/`error` lines land in a synchronous `plugin_error_log` INSERT + prune on the host thread, so this is what stops a `while (true) ctx.log.error(...)` loop from pinning the instance. Excess lines are dropped; when logging resumes, one `warn` line reports how many were dropped, so the throttling is visible to an operator. | `10`                                                                                |
+| `TREK_PLUGIN_LOG_BURST`           | Burst allowance — how many log lines a plugin may emit back-to-back before the per-second limit applies. | `50`                                                                                |
+| `TREK_PLUGIN_AUDIT_MAX_ROWS`      | Per-plugin retention cap for the capability audit log (kept in the shared `data/travel.db`). The newest N rows per plugin are retained and older ones pruned; the retained window stays tamper-evident. Set to `0` to disable pruning. | `20000`                                                                             |
 
 All of these are optional — the defaults are safe. Set `TREK_PLUGINS_ENABLED=false` if you want to switch the plugin system off entirely.
 
diff --git a/wiki/FAQ.md b/wiki/FAQ.md
index 7d3888cae..ec3599c53 100644
--- a/wiki/FAQ.md
+++ b/wiki/FAQ.md
@@ -2,13 +2,13 @@
 
 ## Do I need a Google Maps API key?
 
-No. When no Google Maps key is configured, TREK automatically falls back to OpenStreetMap (Nominatim) for place search — no API key or account required. If you want richer place data (photos, ratings, opening hours), an admin can optionally add a Google Maps key in [User Settings](User-Settings).
+No. When no Google Maps key is configured, TREK automatically falls back to OpenStreetMap (Nominatim) for place search — no API key or account required. If you want richer place data (photos, ratings, opening hours), an admin can optionally add a Google Maps key in **Admin Panel → Settings** — see [Admin Panel Overview](Admin-Panel-Overview). A key saved there applies instance-wide to every member; there is no per-user field for it in the UI.
 
 ## Can I use TREK offline?
 
-Yes. TREK is a Progressive Web App. After your first visit, the service worker (powered by Workbox) caches map tiles (Carto and OpenStreetMap), non-sensitive API responses, uploaded covers and avatars, and all static assets. Subsequent visits work without a network connection for already-cached content. See [Offline Mode and PWA](Offline-Mode-and-PWA) for installation instructions.
+Yes. TREK is a Progressive Web App. After your first visit, the service worker (powered by Workbox) caches map tiles (Carto, OpenStreetMap, Mapbox GL and OpenFreeMap), uploaded covers and avatars, and every page of the app. Subsequent visits work without a network connection for already-cached content. Trip data does not come from that cache: it is stored per user in IndexedDB and read back through TREK's own offline layer, with writes queued and replayed once you reconnect. See [Offline Mode and PWA](Offline-Mode-and-PWA) for installation instructions.
 
-> **Note:** Auth, admin, backup, and settings endpoints are intentionally excluded from the offline cache.
+> **Note:** API responses are **never** stored in the service-worker cache. Workbox keys its entries by URL and cannot vary them on the session cookie, so caching them would mean one account's data could be served to the next on a shared device.
 
 ## How many MCP tokens can I create?
 
diff --git a/wiki/Home.md b/wiki/Home.md
index a934fb7c4..c0f692642 100644
--- a/wiki/Home.md
+++ b/wiki/Home.md
@@ -24,29 +24,39 @@ TREK is a self-hosted, real-time collaborative travel planner licensed under AGP
 ### Collaboration
 - **Real-Time Sync** — WebSocket-based live sync; changes appear instantly for all connected users
 - **Multi-User** — invite members with role-based access
-- **Invite Links** — one-time registration links with configurable max uses and expiry
+- **Invite Links** — registration links with configurable max uses (1–5 or unlimited) and expiry
 - **OIDC SSO** — sign in with Google, Apple, Authentik, Keycloak, or any OIDC provider
 - **Two-Factor Authentication** — TOTP-based 2FA with QR code setup
+- **Passkeys** _(admin-enabled)_ — passwordless WebAuthn sign-in with Touch ID, Windows Hello, Android screen lock, or a hardware key; owning one also satisfies the require-2FA policy (see [Passkeys](Passkeys))
 - **Public Share Links** — share a read-only view of any trip
 
 ### Addons _(admin-toggleable)_
 - **Lists** — packing lists and to-dos with templates, member assignments, optional bag tracking
-- **Budget Planner** — expense tracker with category breakdown, splits, multi-currency
+- **Costs** — expense tracker with category breakdown, splits, multi-currency
 - **Documents** — file manager for trips, places, and reservations
 - **Collab** — group chat, shared notes, polls, day-by-day attendance
 - **Vacay** — personal vacation day planner with calendar view, public holidays, and carry-over tracking
 - **Atlas** — interactive world map, bucket list, travel stats, continent breakdown
+- **Collections** — personal place library: save places across trips into named lists, copy them into any trip, share with per-member roles (see [Collections](Collections))
 - **Journey** — magazine-style travel journal with entries, photos (via Immich/Synology Photos), maps, and moods
 - **Naver List Import** — import places from shared Naver Maps lists
 - **MCP** — expose TREK to AI assistants via the Model Context Protocol (OAuth 2.1)
+- **AirTrail** — sync flights from your self-hosted AirTrail instance into trips
+- **AI Parsing** — LLM fallback that extracts bookings from confirmation files KDE Itinerary cannot read (see [AI-Booking-Import](AI-Booking-Import))
 
 > Dashboard widgets (currency converter and timezone clock) are per-user preferences, not an admin-toggleable addon — see [Dashboard-Widgets](Dashboard-Widgets).
+>
+> The full addon table, with type and per-addon notes, lives in [Addons-Overview](Addons-Overview).
+
+### Plugins
+- **Sandboxed Plugin Runtime** — third-party plugins run in a forked child process with permission-gated RPC, install-time manifest and signature checks, and an egress allowlist (see [Plugins](Plugins))
+- **Plugin SDK** — build and publish plugins with the `trek-plugin-sdk` npm package: dev server, preflight, signing, submit (see [Plugin-Development](Plugin-Development))
 
 ### AI / MCP Integration
 - **MCP Server** — built-in Model Context Protocol server with OAuth 2.1 authentication
 - **150+ Tools** — create trips, plan itineraries, manage budgets, send messages, and more
 - **30 Resources** — read-only `trek://` URIs for trips, days, places, budget, packing, journeys, and more
-- **27 OAuth Scopes** — granular permissions across 13 permission groups
+- **29 OAuth Scopes** — granular permissions across 14 permission groups
 - **Pre-built Prompts** — `trip-summary`, `packing-list`, and `budget-overview` context loaders
 
 ### Admin
diff --git a/wiki/Install-Docker-Compose.md b/wiki/Install-Docker-Compose.md
index da08b8690..ca6cc1c54 100644
--- a/wiki/Install-Docker-Compose.md
+++ b/wiki/Install-Docker-Compose.md
@@ -12,11 +12,11 @@ The compose file ships with several hardening options enabled by default:
 
 | Setting | What it does |
 |---|---|
-| `read_only: true` | Mounts the container filesystem read-only; only the two named volumes and `/tmp` are writable |
+| `read_only: true` | Mounts the container filesystem read-only; only the two mounted volumes (`/app/data`, `/app/uploads`) and `/tmp` are writable |
 | `security_opt: no-new-privileges:true` | Prevents the process from gaining additional Linux privileges via setuid/setgid executables |
 | `cap_drop: [ALL]` | Drops all Linux capabilities from the container |
 | `cap_add: [CHOWN, SETUID, SETGID]` | Adds back only the capabilities needed for the entrypoint to drop privileges to the `node` user |
-| `tmpfs: /tmp:noexec,nosuid,size=64m` | Mounts a 64 MB in-memory `/tmp`; required because the container root is read-only |
+| `tmpfs: /tmp:noexec,nosuid,size=128m` | Mounts a 128 MB in-memory `/tmp`; required because the container root is read-only |
 
 > **Note (Docker from snap):** If you installed Docker via `snap` (config under `/var/snap/docker/...`), `no-new-privileges:true` will prevent the container from starting with `exec /usr/bin/dumb-init: operation not permitted`. This is a [snap/AppArmor limitation](https://bugs.launchpad.net/snapd/+bug/1908448), not a TREK issue — install Docker from the [official apt repository](https://docs.docker.com/engine/install/ubuntu/) instead, or remove `no-new-privileges`. See [Troubleshooting](Troubleshooting#container-wont-start-exec-usrbindumb-init-operation-not-permitted).
 
@@ -48,17 +48,23 @@ Docker creates the volumes automatically on first `docker compose up`. Use `dock
 
 ## Environment Variables
 
-The compose file reads variables from a `.env` file placed alongside `docker-compose.yml`. At minimum, set:
+The compose file has no `env_file:` key, so a `.env` placed alongside `docker-compose.yml` is used only for `${VAR}` interpolation — a value reaches the container only if a line in the `environment:` block references it. Four entries are wired that way:
 
 ```bash
 # .env
 ENCRYPTION_KEY=<output of: openssl rand -hex 32>
 TZ=Europe/Berlin
+LOG_LEVEL=info
 ALLOWED_ORIGINS=https://trek.example.com
-APP_URL=https://trek.example.com
 ```
 
-Uncomment and fill in the OIDC, initial setup, or MCP variables as needed. For a full description of every variable, see [Environment-Variables](Environment-Variables).
+The commented `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` lines are interpolated as well, so uncommenting them is enough to pick their values up from `.env`.
+
+Every other variable — `APP_URL`, the OIDC block, `FORCE_HTTPS`, `TRUST_PROXY`, `ADMIN_EMAIL`/`ADMIN_PASSWORD`, the MCP limits — ships as a commented literal. Uncomment the line in `docker-compose.yml` and put the value there; setting it in `.env` alone has no effect.
+
+`APP_URL` is usually not needed. TREK resolves its public base URL as `APP_URL` → first `ALLOWED_ORIGINS` entry → `http://localhost:<PORT>`, so the `ALLOWED_ORIGINS` value above already gives OIDC redirect URIs, passkey origin checks and the links in email notifications the correct origin. Uncomment `APP_URL` only when the public base URL has to differ from the first allowed origin.
+
+For a full description of every variable, see [Environment-Variables](Environment-Variables).
 
 ## Image Tags
 
@@ -67,14 +73,14 @@ Three tag strategies are available:
 | Tag | Example                  | Behavior |
 |---|--------------------------|---|
 | `latest` | `mauriceboe/trek:latest` | Always the newest release across all major versions |
-| Major version | `mauriceboe/trek:3`      | Latest release pinned to that major version |
-| Full version | `mauriceboe/trek:3.4.0`  | Exact release; never changes |
+| Major version | `mauriceboe/trek:4`      | Latest release pinned to that major version |
+| Full version | `mauriceboe/trek:4.0.0`  | Exact release; never changes |
 
 The compose file above uses `latest`. To pin, change the `image:` line:
 
 ```yaml
-image: mauriceboe/trek:3        # track major version 3
-image: mauriceboe/trek:3.4.0   # pin to exact release
+image: mauriceboe/trek:4        # track major version 4
+image: mauriceboe/trek:4.0.0   # pin to exact release
 ```
 
 ## Start TREK
diff --git a/wiki/Install-Helm.md b/wiki/Install-Helm.md
index 87ee8cb3c..4e447b22d 100644
--- a/wiki/Install-Helm.md
+++ b/wiki/Install-Helm.md
@@ -110,7 +110,7 @@ env:
   # TZ: "Europe/Berlin"          # timezone for logs, reminders, cron jobs
   # LOG_LEVEL: "info"            # "info" = concise, "debug" = verbose
   # TREK_WIKI_DIR: "/app/wiki"   # where /help reads its docs from; leave unset (the image ships them)
-  # DEFAULT_LANGUAGE: "en"       # fallback language on login page; supported: de, en, es, fr, hu, nl, br, cs, pl, ru, zh, zh-TW, it, tr, ar, id, ja, ko, uk, gr
+  # DEFAULT_LANGUAGE: "en"       # fallback language on login page; supported: de, en, es, fr, hu, nl, br, cs, pl, ru, zh, zh-TW, it, tr, ar, id, ja, ko, uk, gr, sv, vi, ca
   # ALLOWED_ORIGINS: "https://trek.example.com"
   # APP_URL: "https://trek.example.com"
   # FORCE_HTTPS: "false"         # enable HTTPS redirect + HSTS; requires TRUST_PROXY
@@ -139,10 +139,13 @@ secretEnv:
   ADMIN_EMAIL: ""           # initial admin email (first boot only)
   ADMIN_PASSWORD: ""        # initial admin password (first boot only)
   OIDC_CLIENT_SECRET: ""    # set if using OIDC
+  UNSPLASH_ACCESS_KEY: ""   # optional; free key from unsplash.com/developers
 ```
 
 Alternatively, use `generateEncryptionKey: true` to let the chart generate and manage the encryption key, or point `existingSecret` / `existingSecretKey` at an existing Kubernetes Secret.
 
+> **Note:** Without `UNSPLASH_ACCESS_KEY` the server queries Unsplash's unauthenticated endpoint, which many datacenter and VPS IP ranges — including a lot of Kubernetes clusters — are blocked or rate-limited on. Trip-cover and place-image search then fail with **"Unsplash search unavailable"**. A free Access Key switches the server to Unsplash's authenticated API (`api.unsplash.com`), which is not subject to that block. The key can also be set in **Admin → Settings → API Keys**; this value takes priority over that one. See [Environment-Variables](Environment-Variables#image-search-unsplash).
+
 ### Persistent Storage
 
 ```yaml
diff --git a/wiki/Install-Portainer.md b/wiki/Install-Portainer.md
index 207709a35..4af93c8a4 100644
--- a/wiki/Install-Portainer.md
+++ b/wiki/Install-Portainer.md
@@ -28,7 +28,11 @@ Portainer must be installed and connected to your Docker environment. Use **Stac
 
 See https://github.com/liketrek/TREK/blob/main/docker-compose.yml
 
-Set at minimum `ENCRYPTION_KEY`, `TZ`, and `APP_URL` in the **Environment variables** section of the stack editor. Generate an encryption key with:
+Set at minimum `ENCRYPTION_KEY`, `TZ`, and `ALLOWED_ORIGINS` in the **Environment variables** section of the stack editor. Portainer's stack variables are only substituted into `${...}` placeholders in the compose file, they are not injected into the container, and the shipped compose file interpolates exactly four: `ENCRYPTION_KEY`, `TZ`, `LOG_LEVEL`, and `ALLOWED_ORIGINS`.
+
+Every other variable ships commented out, so setting it here does nothing. To use one — `APP_URL`, for example, which OIDC needs and which email notification links are built from — uncomment its line in the **Web editor** and put the value there directly, or change it to `- APP_URL=${APP_URL:-}` so the stack variable is picked up.
+
+Generate an encryption key with:
 
 ```bash
 openssl rand -hex 32
@@ -41,10 +45,10 @@ Three tag strategies are available:
 | Tag | Example | Behavior |
 |---|---|---|
 | `latest` | `mauriceboe/trek:latest` | Always the newest release across all major versions |
-| Major version | `mauriceboe/trek:3` | Latest release pinned to that major version |
-| Full version | `mauriceboe/trek:3.4.0` | Exact release; never changes |
+| Major version | `mauriceboe/trek:4` | Latest release pinned to that major version |
+| Full version | `mauriceboe/trek:4.0.0` | Exact release; never changes |
 
-Use `latest` or a major-version tag (e.g. `3`) if you want automatic updates on redeploy. Use a full version tag (e.g. `3.4.0`) if you want explicit control over which release runs.
+Use `latest` or a major-version tag (e.g. `4`) if you want automatic updates on redeploy. Use a full version tag (e.g. `4.0.0`) if you want explicit control over which release runs.
 
 ## Updating
 
@@ -54,13 +58,13 @@ How you update depends on the tag you chose:
 
 ![Re-pull image and redeploy switch ticked, with arrows pointing to the switch and the Update button](assets/portainer-force-pull.png)
 
-**Pinned full-version tag** — Edit the stack, change the tag in the `image:` line (e.g. `3.4.0` → `3.4.1`), then click **Update the stack**. No need to toggle the re-pull switch — a tag change forces a fresh pull.
+**Pinned full-version tag** — Edit the stack, change the tag in the `image:` line (e.g. `4.0.0` → `4.0.1`), then click **Update the stack**. No need to toggle the re-pull switch — a tag change forces a fresh pull.
 
 ![Edit stack page with an arrow pointing to the image tag in the compose editor](assets/portainer-update-version.png)
 
 ![Edit stack page with an arrow pointing to the Update the stack button](assets/portainer-update-stack.png)
 
-> Back up your data before any update. Go to **Admin Panel → Backups** or copy your `./data` and `./uploads` directories. See [Backups](Backups).
+> Back up your data before any update. Go to **Admin Panel → Backup** or copy your `./data` and `./uploads` directories. See [Backups](Backups).
 
 ## Volumes
 
diff --git a/wiki/Install-Proxmox.md b/wiki/Install-Proxmox.md
index 158472ccc..9f0acb339 100644
--- a/wiki/Install-Proxmox.md
+++ b/wiki/Install-Proxmox.md
@@ -84,7 +84,6 @@ If your Proxmox host has multiple network interfaces and you want TREK to listen
 
 ```
 HOST=10.0.0.72   # bind only on this LAN interface
-PORT=3001
 ```
 
 > **Note:** `HOST` is only relevant for source-based and Proxmox installs. Do not use it in Docker or any containerised deployment.
diff --git a/wiki/Install-Unraid.md b/wiki/Install-Unraid.md
index ea361d0e9..d8da44e98 100644
--- a/wiki/Install-Unraid.md
+++ b/wiki/Install-Unraid.md
@@ -40,12 +40,12 @@ The Unraid template exposes the following fields in the container UI:
 | `TZ` | `UTC` | Timezone for logs, reminders, and scheduled tasks (e.g. `Europe/Berlin`) |
 | `ALLOWED_ORIGINS` | *(empty)* | Comma-separated origins for CORS and email notification links, e.g. `https://trek.example.com` |
 | `APP_URL` | *(empty)* | Public base URL; required when OIDC is enabled (must match the redirect URI registered with your IdP) |
-| `ADMIN_EMAIL` | *(empty)* | Email for the first admin account (first-boot only; no effect once any user exists). Must be set together with `ADMIN_PASSWORD`. |
+| `ADMIN_EMAIL` | `admin@trek.local` | Email for the first admin account (first-boot only; no effect once any user exists). Pre-filled by the template — must be set together with `ADMIN_PASSWORD`, otherwise both are ignored. |
 | `ADMIN_PASSWORD` | *(empty)* | Password for the first admin account (first-boot only). Must be set together with `ADMIN_EMAIL`. If either is omitted, TREK creates the account with email `admin@trek.local` and a random password printed to the container log. |
 
 ### Advanced Variables
 
-Additional variables (`PORT`, `NODE_ENV`, `LOG_LEVEL`, `TREK_WIKI_DIR`, `DEFAULT_LANGUAGE`, `FORCE_HTTPS`, `TRUST_PROXY`, `COOKIE_SECURE`, `ALLOW_INTERNAL_NETWORK`, `SESSION_DURATION`, `SESSION_DURATION_REMEMBER`, all OIDC variables, `MCP_RATE_LIMIT`, `MCP_MAX_SESSION_PER_USER`, `DEMO_MODE`) are available under **Advanced View** in the template editor.
+Additional variables (`PORT`, `NODE_ENV`, `LOG_LEVEL`, `TREK_WIKI_DIR`, `DEFAULT_LANGUAGE`, `FORCE_HTTPS`, `HSTS_INCLUDE_SUBDOMAINS`, `TRUST_PROXY`, `COOKIE_SECURE`, `ALLOW_INTERNAL_NETWORK`, `SESSION_DURATION`, `SESSION_DURATION_REMEMBER`, all OIDC variables, `MCP_RATE_LIMIT`, `MCP_MAX_SESSION_PER_USER`, `DEMO_MODE`, `UNSPLASH_ACCESS_KEY`) are available under **Advanced View** in the template editor.
 
 ## Setting the Encryption Key
 
diff --git a/wiki/Internal-Network-Access.md b/wiki/Internal-Network-Access.md
index 981ae63d4..074590e3a 100644
--- a/wiki/Internal-Network-Access.md
+++ b/wiki/Internal-Network-Access.md
@@ -4,19 +4,25 @@ TREK makes outbound HTTP requests when you configure integrations such as Immich
 
 ## Default behavior
 
-All outbound requests go through an SSRF guard (`ssrfGuard.ts`). The guard resolves the hostname to an IP address before allowing the connection and blocks addresses in private ranges.
+TREK has two SSRF guards, both in `ssrfGuard.ts`. Which one applies depends on the call site, not on who configured the URL.
+
+**The strict guard** (`safeFetch` / `safeFetchFollow`, built on `checkSsrf`) covers most outbound traffic — Immich, Synology Photos, AirTrail, notification webhooks, ntfy, Unsplash, and place lookups. It resolves the hostname to an IP address before allowing the connection and blocks loopback, link-local and private ranges. Only the private ranges open up, and only with `ALLOW_INTERNAL_NETWORK=true`. The two tables below describe this guard.
+
+**The relaxed guard** (`safeFetchAdminConfigured`, also exported as `safeFetchLlm`) covers endpoints that are expected to live on your own network: OIDC (discovery, token, userinfo, JWKS), the LLM providers behind the AI Parsing addon (a local Ollama or any OpenAI-compatible endpoint), and plugin OAuth token exchanges. It deliberately permits loopback and LAN targets, so a model server on `localhost` or an identity provider on your LAN works **without** `ALLOW_INTERNAL_NETWORK`. It still resolves every hostname, re-checks every redirect hop, and always blocks link-local and cloud-metadata addresses (`169.254.0.0/16`, the full `fe80::/10`, and the AWS and Alibaba metadata addresses).
 
 ## Always blocked (no override possible)
 
-These ranges are blocked regardless of any setting:
+Under the strict guard, these ranges are blocked regardless of any setting:
 
 | Range | Description |
 |---|---|
 | `127.0.0.0/8`, `::1` | Loopback |
 | `0.0.0.0/8` | Unspecified |
-| `169.254.0.0/16`, `fe80::/10` | Link-local / cloud metadata endpoints |
+| `169.254.0.0/16`, `fe80::/16` | Link-local / cloud metadata endpoints |
 | `::ffff:127.x.x.x`, `::ffff:169.254.x.x` | IPv4-mapped loopback and link-local |
 
+The IPv6 link-local rule here matches the `fe80:` hextet only, which is narrower than the nominal `fe80::/10` prefix (`fe80:`–`febf:`). In practice that is the same set of addresses, since RFC 4291 link-local addresses are always `fe80::/64`. The relaxed guard covers the whole `/10`.
+
 ## Blocked unless `ALLOW_INTERNAL_NETWORK=true`
 
 | Range / Hostname | Description |
@@ -27,15 +33,15 @@ These ranges are blocked regardless of any setting:
 | `100.64.0.0/10` | CGNAT / Tailscale shared address space |
 | `fc00::/7` | IPv6 ULA |
 | IPv4-mapped RFC-1918 variants | e.g. `::ffff:10.x`, `::ffff:192.168.x` |
-| `*.local`, `*.internal` hostnames | mDNS / internal DNS suffixes (e.g. Docker service names, LAN hosts) |
+| `*.local`, `*.internal`, `localhost` hostnames | mDNS / internal DNS suffixes (e.g. Docker service names, LAN hosts) and the literal `localhost` |
 
-The hostname `localhost` is not blocked at the hostname stage, but it resolves to `127.0.0.1` which is caught by the loopback rule above and is therefore always blocked.
+The hostname `localhost` is matched at the hostname stage too, but it normally resolves to a loopback address (`127.0.0.1` or `::1`), which the always-blocked loopback rule catches first — so under the strict guard it is blocked no matter how `ALLOW_INTERNAL_NETWORK` is set. On a host that maps `localhost` somewhere else, the hostname rule still applies and it stays blocked unless `ALLOW_INTERNAL_NETWORK=true`. The relaxed guard allows `localhost` outright, which is what makes a local Ollama the supported default for AI Parsing.
 
 `*.local` and `*.internal` hostnames are permitted when `ALLOW_INTERNAL_NETWORK=true` — the guard still resolves them to an IP and enforces all IP-level rules, so any such hostname that resolves to a loopback or link-local address remains blocked regardless.
 
 ## When to enable
 
-Set `ALLOW_INTERNAL_NETWORK=true` when Immich, Synology Photos, or another integrated service is hosted on your local network and you need TREK to reach it.
+Set `ALLOW_INTERNAL_NETWORK=true` when a service reached through the strict guard — Immich, Synology Photos, AirTrail, or a notification webhook — is hosted on your local network and you need TREK to reach it. You do **not** need it for a local or LAN Ollama, an OpenAI-compatible endpoint, an OIDC provider on your LAN, or plugin OAuth; those go through the relaxed guard and already work. Leave the flag off if only those need internal access, since turning it on widens the surface for every strict-guard integration at once.
 
 See [Environment-Variables](Environment-Variables) for how to set environment variables.
 
@@ -47,7 +53,7 @@ Even with `ALLOW_INTERNAL_NETWORK=true`, TREK pins the DNS resolution to prevent
 
 ## Audit log
 
-When a user saves an Immich URL that resolves to a private IP, TREK records an `immich.private_ip_configured` entry in the [Audit-Log](Audit-Log) including the URL and the resolved IP address. This audit event is specific to Immich; Synology Photos does not emit an equivalent event.
+When a user saves an Immich URL that resolves to a private IP, TREK records an `immich.private_ip_configured` entry in the [Audit-Log](Audit-Log) including the URL and the resolved IP address. AirTrail does the same with `airtrail.private_ip_configured`. Synology Photos does not emit an equivalent event.
 
 ## See also
 
diff --git a/wiki/Invite-Links.md b/wiki/Invite-Links.md
index 7ed023ad7..3ac04405c 100644
--- a/wiki/Invite-Links.md
+++ b/wiki/Invite-Links.md
@@ -20,7 +20,7 @@ When creating an invite link you set two parameters:
 
 **Expiry** — how long until the link stops working. Choose from preset buttons: **1d, 3d, 7d, 14d**, or **∞** (no expiry).
 
-**Add to trip (optional)** — bind the invite to one of your trips. When someone registers through the link, they are automatically added to that trip as a member. Leave it on **No trip** for a plain registration invite. The selector only appears when at least one trip exists.
+**Add to trip (optional)** — bind the invite to any trip on the instance, not just your own. When someone registers through the link, they are automatically added to that trip as a member. Leave it on **No trip** for a plain registration invite. The selector only appears when at least one trip exists.
 
 Once created, a 32-character hexadecimal token is generated and the URL is automatically copied to your clipboard.
 
diff --git a/wiki/Journey-Journal.md b/wiki/Journey-Journal.md
index f3c704457..ab7789402 100644
--- a/wiki/Journey-Journal.md
+++ b/wiki/Journey-Journal.md
@@ -33,7 +33,7 @@ Each entry corresponds to a day in your journey. The entry editor provides:
   | `neutral` | Neutral | Grey |
   | `rough` | Rough | Violet |
 
-- **Weather** — choose one of six values: Sunny, Partly cloudy, Cloudy, Rainy, Stormy, Cold.
+- **Weather** — choose one of six values: Sunny, Partly cloudy, Cloudy, Rainy, Stormy, Snowy. (Snowy is stored under the id `cold`.)
 - **Photos** — attach photos to the entry. The first photo becomes the card thumbnail in list views.
   > **Note on HEIC files:** HEIC is an Apple-only format that many browsers and platforms do not recognise as an image. To ensure broad compatibility, HEIC/HEIF files are automatically converted to JPEG before upload. This conversion may result in the loss of embedded metadata (EXIF data such as GPS coordinates, camera information, etc.).
 - **Pros / Cons** — optional verdict cards. Add items to a **Pros** list (thumbs-up) or a **Cons** list (thumbs-down) to summarise what you loved or what could have been better. These are stored in the `pros_cons.pros` and `pros_cons.cons` arrays on the entry.
@@ -43,7 +43,7 @@ Each entry corresponds to a day in your journey. The entry editor provides:
 
 ### Getting around a long journal
 
-Everything that adds to a journal sits at the top of the page — the **Add Entry** button, the gallery upload — while what you were last reading sits at the bottom. Two small buttons ride along the left edge of the timeline once there is more than a screenful to travel: one jumps back to the top, the other to the last entry. Each appears only when there is somewhere to go in that direction.
+Everything that adds to a journal sits at the top of the page — the **Add Entry** button, the gallery upload — while what you were last reading sits at the bottom. On desktop, two small round buttons float centred over the timeline, just above its bottom edge, once there is more than 400 px of scroll to travel: one jumps back to the top, the other to the last entry. Each appears only when there is somewhere to go in that direction.
 
 ### External photos
 
@@ -65,6 +65,26 @@ The thin dashed line connecting entries in date order is something else and stay
 
 ![Journey detail page for "Autumn in Japan" with its cover header and day/place/entry/photo counts, the day-by-day timeline with Add Entry actions on the left, and the entry map on the right](assets/JourneyDetail.png)
 
+## TREK Studio
+
+A journey can also be laid out as a printable photo book. Open a journey and click **Studio** in the header. The designer opens on top of the journey at `/journey/:id/studio`, so the journey stays open underneath and **Back to the journey** drops you straight back into it. Studio is marked **Beta**.
+
+![The TREK Studio editor with the pages rail on the left, a spread on the workbench and the properties inspector on the right](assets/TREK-Studio-Editor.png)
+
+- **Page format** — Square 21 × 21 cm (the default), Square 30 × 30 cm, A4 landscape, A4 portrait, A5 landscape, or a custom width × height in millimetres. Everything is drawn as a spread (two pages side by side) with 3 mm bleed and a 5 mm safe margin.
+- **Auto layout** has two entries. **This spread** builds the spread on screen again from the journal entry it came from, and is only offered on a spread that came from one. **The whole book** replaces every page, keeping your title and page setup. Both are ordinary undo steps, so you can press one, look at it, and undo.
+- **Pages, Content, Elements, Travel and Layouts** are the sections of the left rail. Content holds the journey's own photos and entries; Layouts has thirteen spread layouts (Hero and story, Four up, Strip and text, Mosaic and so on) plus a separate set of five for the cover and back; Elements has text styles, shapes, lines, grids, empty frames with their frame styles, and a searchable icon library; Travel builds figures out of the journey itself — route maps, country outlines and lists, flags, date, day and distance marks, and a trip summary.
+- **Properties** on the right edits whatever is selected: position and size, crop and focal point, fill or fit, a look filter, corner radius, frame style, stacking order, lock. An element that auto layout tied to a journal entry follows that entry until you edit it here, which breaks the link.
+- **Export** opens a print view that your browser turns into a PDF. Pick **Single pages** (one leaf per sheet, what a printer wants) or **Spreads** (two pages at a time, the way the book opens), with optional crop marks that add the bleed on every edge and mark where to cut.
+- **Spreads travel between books.** Download the spread you are on as a design file and import it into another book. The file carries the design only, not the photographs.
+- **Several people can design at once.** Everyone in the same book sees the others' pointers with their names on them, and a save is pushed to the rest live. A save that lands on a version somebody else has already changed comes back as a conflict, with the other version alongside it, rather than quietly overwriting their work.
+
+![Frame styles and frame shapes in TREK Studio, with a photo's crop, look and frame options in the inspector](assets/TREK-Studio-Frames.png)
+
+The book belongs to its journey and inherits its access exactly: anyone who may read the journey may open its book, and only those who may edit the journey may save or delete it. There is no second set of permissions to keep in step.
+
+Studio is desktop only: it needs a viewport at least 1024 px wide. Below that — a tablet, or a narrowed browser window — it opens over the journey and shows a "Studio needs a bigger screen" notice with a way back. On a phone the journey opens in its mobile view as usual and Studio is not offered at all. Making the PDF is desktop only too.
+
 ## Plugin entry rows
 
 Installed plugins can add extra rows to a journal entry card via the `journalEntryProvider` hook. A plugin returns rows (`label`, optional `value`, optional `url`) and TREK renders them natively under the entry — no iframe. Rows are additive and fail-safe: they require the Journey addon, the entry's journey is access-checked the same way as reading it, only http/https/mailto links are allowed, and a provider that errors or is slow is simply skipped.
@@ -75,6 +95,10 @@ Installed plugins can add extra rows to a journal entry card via the `journalEnt
 
 You can share a journey with a read-only public link. When creating the link you can independently toggle which sections are visible to visitors: **Timeline** (entries and stories), **Gallery** (photos), and **Map**. Visitors can only see the sections you have enabled, and no TREK account is required. See [Public-Share-Links](Public-Share-Links) for details on the separate journey share token mechanism.
 
+**Photos appear on the public map too**, as long as **Gallery** and **Map** are both on. A gallery photo that knows where it was taken becomes a thumbnail pin, clustered into one pin where several were taken close together, and sitting below the entry pins so the itinerary stays the point of the map. The location comes from the file's own EXIF for uploads and from Immich or Synology for provider photos, and a photo that carries none simply stays off the map (see the HEIC note above — that conversion drops GPS, so iPhone uploads usually arrive without a location).
+
+Both toggles matter. A photo's coordinates follow the **Map** switch: with Map off the gallery is still shared, but every photo's coordinates are stripped before they leave the server. With Gallery off no photos are sent at all, so a map-only share shows the entry pins and nothing else.
+
 ## See also
 
 - [Addons-Overview](Addons-Overview)
diff --git a/wiki/Languages.md b/wiki/Languages.md
index dc3131ab2..52105e8ac 100644
--- a/wiki/Languages.md
+++ b/wiki/Languages.md
@@ -1,6 +1,6 @@
 # Languages
 
-TREK ships with translations for 20 languages. You can change your language at any time without logging out.
+TREK ships with translations for 23 languages. You can change your language at any time without logging out.
 
 ## Supported languages
 
@@ -26,6 +26,9 @@ TREK ships with translations for 20 languages. You can change your language at a
 | `ko` | 한국어 |
 | `uk` | Українська |
 | `gr` | Ελληνικά |
+| `sv` | Svenska |
+| `vi` | Tiếng Việt |
+| `ca` | Català |
 
 ## RTL support
 
diff --git a/wiki/Login-and-Registration.md b/wiki/Login-and-Registration.md
index 622162848..c19585534 100644
--- a/wiki/Login-and-Registration.md
+++ b/wiki/Login-and-Registration.md
@@ -4,7 +4,7 @@
 
 ## Signing in
 
-Navigate to `/login` and enter your email and password. On success, the server sets a `trek_session` cookie — httpOnly, sameSite=`lax`, and secure in production — that persists your session for 24 hours across page reloads and browser restarts. You do not need to sign in again until the session expires or you explicitly log out.
+Navigate to `/login` and enter your email and password. On success, the server sets a `trek_session` cookie — httpOnly, sameSite=`lax`, and secure in production — that keeps you signed in across page reloads. How long it survives depends on the **Remember me** switch, described below. You do not need to sign in again until the session expires or you explicitly log out.
 
 > **Note:** The `secure` flag on the cookie can be overridden by setting `COOKIE_SECURE=false` in the server environment (useful for plain-HTTP dev setups), or force-enabled with `FORCE_HTTPS=true`.
 
@@ -12,17 +12,30 @@ If your account has two-factor authentication enabled, you are prompted for a TO
 
 If you have forgotten your password, click the **"Forgot password?"** link below the password field to start the self-service reset flow. See [Password-Reset](Password-Reset) for details.
 
+### Remember me
+
+The **Remember me** switch below the password field decides how long the session lives:
+
+- **Off** (the default) — a browser-session cookie with no `maxAge`, cleared when you close the browser, backed by a token valid for `SESSION_DURATION` (default `24h`).
+- **On** — a persistent cookie matching a token valid for `SESSION_DURATION_REMEMBER` (default `30d`), so the session survives browser restarts.
+
+Both durations are configurable per instance, see [Environment-Variables](Environment-Variables). Your choice is carried through the MFA step, through a password change, and through SSO sign-in. While you keep using TREK the cookie is silently re-issued once the token is past half its lifetime, with the same Remember me semantics, so an active session never expires mid-use. Only cookie sessions are renewed this way — API and MCP clients authenticating with a bearer token are not.
+
+Sign-ins that never pass through this switch — registration, the demo button and passkey sign-in — get the historical default instead: a persistent cookie lasting `SESSION_DURATION`.
+
 ### Forced password change
 
-If an admin has marked your account as requiring a password change, a **Set new password** form is shown immediately after a successful login (or after the MFA step). The session cookie is not issued until the new password is saved.
+Some accounts are flagged as needing a new password: the admin account TREK seeds on first boot always is, and so is an account restored with the `reset-admin.js` recovery script (see [Troubleshooting](Troubleshooting)). For those accounts a **Set new password** form is shown immediately after a successful login (or after the MFA step). The session cookie has already been issued at that point — the app simply keeps you on the form until the new password is saved, and saving it re-issues the cookie and signs your other sessions out.
+
+There is no control in the Admin Panel that flags an existing account. An admin-set password (see [Admin-Users-and-Invites](Admin-Users-and-Invites)) neither raises the flag nor clears it, so a user who already carries it is still asked to choose their own password at the next sign-in.
 
 ## Registering
 
 The Register form appears under one of these conditions:
 
 - **Open registration** — the admin has enabled password registration for the instance (`password_registration` setting).
-- **Valid invite link** — you visited `/login?invite=TOKEN` with a valid token (see below).
-- **First user** — no accounts exist yet; the registration form is shown automatically and the first account created becomes an admin.
+- **Valid invite link** — you visited `/register?invite=TOKEN` with a valid token (see below).
+- **No accounts at all** — nobody has signed up yet; the registration form is shown automatically and the first account created becomes an admin. On a normal install this never happens, because TREK seeds an admin on first boot (see [First run](#first-run) below).
 
 Registration fields: **username**, **email**, and **password**.
 
@@ -42,7 +55,7 @@ Passwords must meet all of the following rules:
 
 ### Invite link flow
 
-When an admin shares an invite link (`/login?invite=TOKEN`), visiting it:
+When an admin shares an invite link (`/register?invite=TOKEN`), visiting it:
 
 1. Validates the token against the server.
 2. Switches the login page to Register mode automatically.
@@ -50,13 +63,25 @@ When an admin shares an invite link (`/login?invite=TOKEN`), visiting it:
 
 If the token is invalid, expired, or exhausted, an error is shown.
 
-## First user
+## First run
 
-On a fresh TREK instance with no existing accounts, the registration form opens immediately. The first account created is automatically assigned the **admin** role.
+On a normal install TREK seeds an admin account on first boot, before anyone can register, so the login page opens in Sign In mode and the Register link is hidden. The credentials depend on how you start the container:
+
+- With **both** `ADMIN_EMAIL` and `ADMIN_PASSWORD` set, those values are used.
+- With only one of the two set, both are ignored (a warning is logged) and the generated credentials below are used instead.
+- Otherwise the account is `admin@trek.local`, username `admin`, with a randomly generated password printed to the container log — run `docker logs trek` to retrieve it.
+
+The seeded admin is flagged as requiring a password change, so you are forced to set a new password on first sign-in. Until that happens the Register link stays hidden even though password registration is enabled by default; once the password is changed the link appears normally.
+
+Two setups skip the seeder entirely. `DEMO_MODE=true` seeds the demo data instead (see [Demo-Mode](Demo-Mode)), and on an **OIDC-only** install no local account is created at all — there the first user who signs in through the identity provider is assigned the **admin** role.
+
+See [Quick-Start](Quick-Start) for the full first-boot walkthrough.
 
 ## Rate limiting
 
-Failed login attempts are rate-limited to **10 attempts per 15-minute window** per IP address. After exceeding the limit, further attempts return HTTP 429 until the window resets.
+Requests to the login endpoint are rate-limited to **10 per 15-minute window** per IP address. The counter is incremented before the credentials are checked, so successful sign-ins count against it too, not only failed ones. After exceeding the limit, further requests return HTTP 429 until the window resets. The window is fixed from the first counted request, and blocked requests do not extend it.
+
+That counter is shared rather than per-endpoint. `POST /api/auth/login`, `POST /api/auth/register`, `GET /api/auth/invite/:token` and the passkey sign-in ceremony each allow 10 requests from it; `PUT /api/auth/me/password`, `POST /api/auth/mfa/disable`, `POST /api/auth/mcp-tokens` and passkey deletion draw on the same counter but are rejected once it reaches 5. Unrelated activity from the same IP therefore eats into the allowance — ten registration attempts will 429 the next login, and five requests of any kind will 429 a password change.
 
 MFA verification attempts are rate-limited separately to **5 attempts per 15-minute window** per IP address.
 
@@ -64,7 +89,7 @@ Forgot-password requests are rate-limited to **3 attempts per 15-minute window**
 
 ## Demo mode
 
-When the server is started with `DEMO_MODE=true`, a **"Try demo"** button appears below the login form. Clicking it signs you in as the demo user without entering credentials. The demo credentials (`demo@trek.app` / `demo12345`) are also displayed in the app config for reference, but the one-click button is the intended entry point.
+When the server is started with `DEMO_MODE=true`, a **"Try the demo — no registration needed"** button appears below the login form. Clicking it signs you in as the demo user without entering credentials. The demo credentials (`demo@trek.app` / `demo12345`) are also displayed in the app config for reference, but the one-click button is the intended entry point.
 
 ## SSO
 
diff --git a/wiki/MCP-Addon-Tools.md b/wiki/MCP-Addon-Tools.md
index aec122211..b17888cfd 100644
--- a/wiki/MCP-Addon-Tools.md
+++ b/wiki/MCP-Addon-Tools.md
@@ -1,6 +1,6 @@
 # MCP Addon Tools and Resources
 
-This page covers MCP tools and resources that require specific addons to be enabled on your TREK instance. For core tools (trips, places, day planning, accommodations, transport, reservations, budget, tags, maps, and notifications) see [MCP-Tools-and-Resources](MCP-Tools-and-Resources).
+This page covers MCP tools and resources that require specific addons to be enabled on your TREK instance. For the rest of the surface (trips, places, day planning, accommodations, transport, reservations, tags, maps, and notifications — plus the Budget tools, which need the Budget addon but are documented there) see [MCP-Tools-and-Resources](MCP-Tools-and-Resources).
 
 ---
 
@@ -18,8 +18,10 @@ Requires `packing:read` or `packing:write` scope.
 | `delete_packing_item` | Remove a packing item. |
 | `reorder_packing_items` | Set the display order of packing items within a trip. |
 | `bulk_import_packing` | Import multiple packing items at once from a list (with optional quantity). |
+| `list_packing_templates` | List the reusable packing templates (id, name, item count) so one can be applied. |
 | `apply_packing_template` | Apply a saved packing template to a trip. |
-| `save_packing_template` | Save the current packing list as a reusable template. |
+| `save_packing_template` | Save the current packing list as a reusable template. Templates are global, so this is admin only — a non-admin gets `Admin access required`. |
+| `delete_packing_template` | Delete a reusable packing template. Global too, so admin only. |
 | `list_packing_bags` | List all packing bags for a trip. |
 | `create_packing_bag` | Create a new packing bag (e.g. "Carry-on", "Checked bag"). |
 | `update_packing_bag` | Rename or recolor a packing bag. |
@@ -64,6 +66,14 @@ Requires `atlas:read` or `atlas:write` scope.
 
 Requires `collab:read` or `collab:write` scope.
 
+The addon alone is not enough. Collab has four sub-features an admin switches on and off independently in Admin → Addons — Notes, Polls, Chat and What's Next, all on by default — and three of them gate MCP entries. A tool or resource is only registered when its own sub-feature is enabled on top of the addon, so switching one off makes its entries vanish from the tool list rather than return an error. What's Next has no MCP tools or resources of its own, so toggling it changes nothing here.
+
+| Sub-feature | Tools it gates | Resource it gates |
+|---|---|---|
+| Notes | `create_collab_note`, `update_collab_note`, `delete_collab_note` | `trek://trips/{tripId}/collab-notes` |
+| Polls | `list_collab_polls`, `create_collab_poll`, `vote_collab_poll`, `close_collab_poll`, `delete_collab_poll` | `trek://trips/{tripId}/collab/polls` |
+| Chat | `list_collab_messages`, `send_collab_message`, `delete_collab_message`, `react_collab_message` | `trek://trips/{tripId}/collab/messages` |
+
 | Tool | Description |
 |---|---|
 | `create_collab_note` | Create a shared note visible to all trip members. Supports title, content, category, and color. |
@@ -79,6 +89,38 @@ Requires `collab:read` or `collab:write` scope.
 | `delete_collab_message` | Delete a chat message (own messages only). |
 | `react_collab_message` | Toggle a reaction emoji on a chat message. |
 
+### Collections _(Collections addon required)_
+
+Requires `collections:read` or `collections:write` scope.
+
+| Tool | Description |
+|---|---|
+| `list_collections` | List the saved-place collections the user owns or has accepted a share for, plus any pending incoming invites. |
+| `get_collection` | Get one collection with its members, labels, and all saved places, including the average rating and each member's vote. |
+| `available_collection_users` | List users who can still be invited to a collection (excludes current members and guests). |
+| `create_collection` | Create a new saved-place collection owned by the user. |
+| `update_collection` | Update a collection's name, description, colour, icon, cover, links, or sort order. Owner/admin only. |
+| `delete_collection` | Permanently delete a collection and all its saved places. Owner only, and it cannot be undone. |
+| `reorder_collections` | Reorder the user's collections — pass every collection id in the desired order. |
+| `save_place_to_collection` | Save a place into a collection from a raw payload. Returns a duplicate marker instead of saving when a similar place already exists, unless `force` is true. |
+| `save_trip_places_to_collection` | Copy one or more existing trip places into a collection. Duplicates are skipped unless `force` is true. |
+| `update_collection_place` | Update a saved place's name, address, coordinates, description, notes, status, category, links, tags, labels, image, or move it to another collection. |
+| `set_collection_place_status` | Set a saved place's status: `idea`, `want`, or `visited`. |
+| `rate_collection_place` | Set or clear the current user's 1-5 star rating on a saved place. Every member rates independently; pass `null` to remove the vote. |
+| `delete_collection_place` | Remove a saved place from its collection. Requires delete permission on the list. |
+| `copy_collection_places_to_trip` | Copy one or more saved places into a trip, ratings included. Requires edit access to the target trip. |
+| `create_collection_label` | Create a custom per-collection label (name plus optional hex colour) for grouping and filtering places. |
+| `update_collection_label` | Rename or recolour a collection label, or change its sort order. |
+| `delete_collection_label` | Delete a collection label; its assignments on places are cleared. |
+| `assign_collection_labels` | Add labels across a set of saved places, or take them away with `remove=true`. |
+| `invite_to_collection` | Invite a user to collaborate on a collection as `viewer`, `editor`, or `admin` (default `editor`). Owner only. |
+| `set_collection_member_role` | Change an accepted member's role. Owner only. |
+| `remove_collection_member` | Remove an accepted member from a shared collection. Owner only. |
+| `cancel_collection_invite` | Cancel a pending invite you sent for a collection. Owner only. |
+| `accept_collection_invite` | Accept a pending invite to join a shared collection. |
+| `decline_collection_invite` | Decline a pending invite to a shared collection. |
+| `leave_collection` | Leave a shared collection you are a member of. The owner cannot leave — delete the list instead. |
+
 ### Vacay _(Vacay addon required)_
 
 Requires `vacay:read` or `vacay:write` scope.
diff --git a/wiki/MCP-Overview.md b/wiki/MCP-Overview.md
index 92360666e..9c645dd79 100644
--- a/wiki/MCP-Overview.md
+++ b/wiki/MCP-Overview.md
@@ -31,7 +31,7 @@ See [MCP-Setup](MCP-Setup) for step-by-step instructions for each method.
 ## Requirements
 
 - **MCP addon enabled** — an administrator must enable the MCP addon (`mcp`) from the Admin Panel before the `/mcp` endpoint becomes available and the MCP section appears in user settings.
-- **`APP_URL` set** — the `APP_URL` environment variable must be configured to your TREK instance's public URL so that OAuth discovery works correctly. Without it, clients that use OAuth 2.1 cannot complete authentication.
+- **`APP_URL` set** — set the `APP_URL` environment variable to your TREK instance's public URL so OAuth discovery advertises the right issuer and endpoints. If it is unset or not a valid URL, TREK falls back to the first entry of `ALLOWED_ORIGINS`, and then to `http://localhost:{PORT}`. Only an `https://` origin or `localhost` / `127.0.0.1` is accepted as the issuer — anything else is replaced by `http://localhost:{PORT}`, which remote OAuth clients cannot reach.
 
 ## Rate limits and session limits
 
diff --git a/wiki/MCP-Scopes.md b/wiki/MCP-Scopes.md
index 3f48f03f9..ec4037c2e 100644
--- a/wiki/MCP-Scopes.md
+++ b/wiki/MCP-Scopes.md
@@ -6,16 +6,18 @@ OAuth scopes control exactly which data your AI client can read or write in TREK
 
 ## All scopes
 
-TREK defines 27 scopes across 13 groups.
+TREK defines 29 scopes across 14 groups.
 
 | Group | Scope | Permission |
 |---|---|---|
 | **Trips** | `trips:read` | View trips, days, day notes, and members |
-| | `trips:write` | Create, update, and delete trips, days, day notes, and accommodations; manage members; duplicate trips |
+| | `trips:write` | Create and update trips; create, update, and delete days, day notes, and accommodations; manage members; duplicate trips |
 | | `trips:delete` | Permanently delete entire trips (irreversible) |
 | | `trips:share` | Create, update, and revoke public share links for trips |
 | **Places** | `places:read` | Read places, day assignments, tags, and categories |
 | | `places:write` | Create, update, and delete places, assignments, and tags |
+| **Collections** | `collections:read` | Read saved-place collections, their places, ratings, labels, and members |
+| | `collections:write` | Create and edit collections, save, rate, label and copy places, and share lists |
 | **Atlas** | `atlas:read` | Read visited countries, regions, and bucket list |
 | | `atlas:write` | Mark countries and regions visited, manage bucket list |
 | **Packing** | `packing:read` | Read packing items, bags, and category assignees |
@@ -45,7 +47,7 @@ TREK defines 27 scopes across 13 groups.
 - `journey:read` or `journey:write` grants journey read access. `journey:share` alone does **not** grant read access — it only enables managing public share links.
 - `list_trips` and `get_trip_summary` are always available regardless of scope — they are navigation tools.
 - Static tokens and web session JWTs have full access equivalent to all scopes.
-- Addon-gated tools (Atlas, Collab, Vacay, Journey) require both the relevant scope **and** the corresponding addon to be enabled by an admin.
+- Addon-gated tools (Packing, To-dos, Budget, Collections, Atlas, Collab, Vacay, Journey) require both the relevant scope **and** the corresponding addon to be enabled by an admin. The to-do tools ride the **Packing** addon, not an addon of their own.
 
 ## Choosing the right scopes
 
diff --git a/wiki/MCP-Setup.md b/wiki/MCP-Setup.md
index 95b936034..9fa95c8c3 100644
--- a/wiki/MCP-Setup.md
+++ b/wiki/MCP-Setup.md
@@ -4,7 +4,7 @@ This page explains how to connect an AI assistant to your TREK instance. TREK su
 
 ![MCP Setup](assets/MCPConfig.png)
 
-> **Cloudflare users:** If your TREK instance is proxied through Cloudflare, Bot Fight Mode and Super Bot Fight Mode will block MCP requests from ChatGPT. Claude.ai is not affected. See [Troubleshooting → MCP requests blocked by Cloudflare WAF](#mcp-requests-blocked-by-cloudflare-waf-bot-fight-mode) for the fix.
+> **Cloudflare users:** If your TREK instance is proxied through Cloudflare, Bot Fight Mode and Super Bot Fight Mode will block MCP requests from ChatGPT. Claude.ai is not affected. See [Troubleshooting → MCP requests blocked by Cloudflare WAF](Troubleshooting#mcp-requests-blocked-by-cloudflare-waf-bot-fight-mode) for the fix.
 
 ## Option A: OAuth 2.1 (recommended)
 
@@ -14,7 +14,7 @@ OAuth 2.1 is the preferred connection method. You grant specific scopes during t
 
 Claude.ai (web) supports native MCP connections — no JSON config file required:
 
-1. In TREK, go to **Settings → Integrations → MCP → OAuth Clients** and click **Create**.
+1. In TREK, go to **Settings → Integrations → MCP → OAuth 2.1 Clients** and click **New Client**.
 2. Select the **Claude.ai** preset. This fills in the redirect URI (`https://claude.ai/api/mcp/auth_callback`) and a default scope set.
 3. Give the client a name, adjust scopes if needed, and save. Copy the client ID and client secret (`trekcs_` prefix) — the secret is shown only once.
 4. In Claude.ai, open the MCP settings and add a new server using your TREK URL (`https://<your-trek-instance>/mcp`). Claude.ai will open your browser to complete the OAuth consent flow.
@@ -23,7 +23,7 @@ Claude.ai (web) supports native MCP connections — no JSON config file required
 
 Claude Desktop supports native MCP connections — no JSON config file required:
 
-1. In TREK, go to **Settings → Integrations → MCP → OAuth Clients** and click **Create**.
+1. In TREK, go to **Settings → Integrations → MCP → OAuth 2.1 Clients** and click **New Client**.
 2. Select the **Claude Desktop** preset. This fills in the redirect URI and a default scope set.
 3. Give the client a name, adjust scopes if needed, and save. Copy the client ID and client secret — the secret is shown only once.
 4. In Claude Desktop, open Settings → MCP and add a new server using your TREK URL (`https://<your-trek-instance>/mcp`). Claude Desktop will open your browser to complete the OAuth consent flow.
@@ -76,7 +76,7 @@ Create a client in TREK using the appropriate preset (Cursor, VS Code, Windsurf,
 
 ### Pre-created OAuth clients
 
-**Settings → Integrations → MCP → OAuth Clients** lets you create named OAuth clients before connecting. This gives you:
+**Settings → Integrations → MCP → OAuth 2.1 Clients** lets you create named OAuth clients before connecting. This gives you:
 
 - A fixed, named scope list defined up front
 - A client secret (`trekcs_` prefix, shown once) for confidential client mode
@@ -94,7 +94,7 @@ Use this when your AI agent or automation script needs to authenticate silently
 
 ### Create a machine client
 
-1. Go to **Settings → Integrations → MCP → OAuth Clients** and click **New Client**.
+1. Go to **Settings → Integrations → MCP → OAuth 2.1 Clients** and click **New Client**.
 2. Tick **Machine client (no browser login)**. The redirect URI field disappears — machine clients don't need one.
 3. Give it a name, select scopes, and click **Register Client**.
 4. Copy the `client_id` and `client_secret` shown — the secret is displayed only once.
@@ -113,7 +113,7 @@ Machine clients are designed for **AI agent frameworks and custom MCP client imp
 
 > **Deprecated:** Static tokens will stop working in a future version of TREK. Migrate to OAuth 2.1 or machine clients.
 
-Static tokens grant full access to all tools and resources with no scope restrictions. Sessions using a static token will receive deprecation warnings in the AI client on every tool call.
+Static tokens grant full access to all tools and resources with no scope restrictions. A static-token session is warned about the deprecation once, not on every call: the notice rides along with the result of the first `list_trips` or `get_trip_summary` in that session — the trip-discovery tools an AI client normally reaches for first — for the client to surface to you. The tool's own payload still comes with it, and every later call in that session returns a plain result. The notice is also part of the session instructions the server sends when the connection initializes.
 
 1. Go to **Settings → Integrations → MCP**, open the **API Tokens** sub-tab, and click **Create New Token**.
 2. Give the token a name and copy it immediately — it is shown only once. The token starts with `trek_`.
diff --git a/wiki/MCP-Tools-and-Resources.md b/wiki/MCP-Tools-and-Resources.md
index 633781ad5..145dfde27 100644
--- a/wiki/MCP-Tools-and-Resources.md
+++ b/wiki/MCP-Tools-and-Resources.md
@@ -2,7 +2,7 @@
 
 TREK exposes **tools** (read and write actions) and **resources** (read-only `trek://` URIs). Tools are registered per-session based on OAuth scopes and enabled addons.
 
-For addon-gated tools (Packing, To-Dos, Atlas, Collab, Vacay, Journey) and their resources, see [MCP-Addon-Tools](MCP-Addon-Tools).
+For addon-gated tools (Packing, To-Dos, Atlas, Collab, Collections, Vacay, Journey) and their resources, see [MCP-Addon-Tools](MCP-Addon-Tools).
 
 ## Tools
 
@@ -52,6 +52,7 @@ Requires `places:read` or `places:write` scope.
 | `list_places` | List places in a trip, optionally filtered by assignment status, category, tag, or search query. |
 | `create_place` | Add a place with name, coordinates, address, category, notes, website, phone, and optional `google_place_id` / `osm_id`. |
 | `update_place` | Update any field of an existing place including transport mode, timing, and price. |
+| `rate_place` | Set or clear your own 1–5 star rating on a place. Every trip member rates independently and the place shows the average. Pass `null` to clear the vote. |
 | `bulk_update_places` | Update many places at once, applying the same field values (e.g. category, price, transport mode) to every listed place in a single call. |
 | `delete_place` | Remove a place from a trip. Also removes all day assignments. |
 | `bulk_delete_places` | Delete multiple places by ID. Removes all day assignments. Cannot be undone. |
@@ -75,8 +76,8 @@ Requires `trips:read` or `trips:write` scope.
 | `update_assignment_time` | Set start/end times for a place assignment (e.g. `"09:00"` – `"11:30"`). Pass `null` to clear. Requires `places:write`. |
 | `move_assignment` | Move a place assignment to a different day. Requires `places:write`. |
 | `set_leg_transport_mode` | Set the travel mode of a route leg for a place assignment. `direction` `"outgoing"` (default) targets the leg leaving the stop, `"incoming"` the arriving one. Pass `null` to inherit the day default. Requires `places:write`. |
-| `get_assignment_participants` | Get users participating in a specific place assignment. |
-| `set_assignment_participants` | Set participants for a place assignment (replaces current list). |
+| `get_assignment_participants` | Get users participating in a specific place assignment. Requires `places:read` or `places:write`. |
+| `set_assignment_participants` | Set participants for a place assignment (replaces current list). Requires `places:write`. |
 
 ### Day Notes
 
@@ -141,6 +142,11 @@ Requires `budget:read` or `budget:write` scope. Budget addon must be enabled.
 | `delete_budget_item` | Remove a budget item. |
 | `set_budget_item_members` | Set which members are splitting a budget item (replaces current list). |
 | `toggle_budget_member_paid` | Mark or unmark a member as having paid their share. |
+| `get_settlement_summary` | Each member's net balance and the suggested payments to settle shared expenses, in the trip's base currency. Call this before recording a settlement. |
+| `list_settlements` | List the recorded settle-up payments for a trip — who paid whom, how much, and when. |
+| `create_settlement` | Record a settle-up payment: one member paid another the given amount in the trip's base currency. |
+| `update_settlement` | Update a recorded settle-up payment (payer, recipient, and amount). |
+| `delete_settlement` | Delete a recorded settle-up payment. This is the undo for `create_settlement` and restores the affected balances. |
 
 ### Tags
 
@@ -189,14 +195,14 @@ Resources provide read-only access via `trek://` URIs. Read them to understand c
 |---|---|---|
 | `trek://trips` | `trips:*` | All trips you own or are a member of |
 | `trek://trips/{tripId}` | `trips:*` | Single trip with metadata and member count |
-| `trek://trips/{tripId}/days` | `trips:*` | Days of a trip with their assigned places |
+| `trek://trips/{tripId}/days` | `trips:read` | Days of a trip with their assigned places |
 | `trek://trips/{tripId}/places` | `places:read` | All places in a trip. Supports `?assignment=all\|unassigned\|assigned` |
 | `trek://trips/{tripId}/reservations` | `reservations:read` | Flights, hotels, restaurants, and other reservations |
-| `trek://trips/{tripId}/days/{dayId}/notes` | `trips:*` | Notes for a specific day |
-| `trek://trips/{tripId}/accommodations` | `trips:*` | Hotels and rentals with check-in/out details |
+| `trek://trips/{tripId}/days/{dayId}/notes` | `trips:read` | Notes for a specific day |
+| `trek://trips/{tripId}/accommodations` | `trips:read` | Hotels and rentals with check-in/out details |
 | `trek://trips/{tripId}/members` | `trips:*` | Owner and collaborators |
 | `trek://categories` | (any) | Available place categories (id, name, icon, color) |
-| `trek://notifications/in-app` | `notifications:read` | Your in-app notifications (most recent 50, unread first) |
+| `trek://notifications/in-app` | `notifications:read` | Your in-app notifications (most recent 50, newest first) |
 
 For addon-gated resources (Budget, Packing, To-Dos, Collab, Atlas, Vacay, Journey), see [MCP-Addon-Tools](MCP-Addon-Tools).
 
diff --git a/wiki/Map-Features.md b/wiki/Map-Features.md
index 73b79e6e7..fe70854d4 100644
--- a/wiki/Map-Features.md
+++ b/wiki/Map-Features.md
@@ -6,14 +6,18 @@ The trip planner map shows your places, route lines, transport overlays, and you
 
 ## Map renderer
 
-TREK uses **Leaflet** by default. If you configure a Mapbox access token in Settings → Map, the map upgrades to **Mapbox GL** with higher-quality tiles, 3D buildings, and terrain. If Mapbox GL is selected but no access token is present, TREK falls back to Leaflet automatically so the map is never blank.
+TREK uses **Leaflet** by default. The renderer is picked in Settings → Map under **Map provider**: **Leaflet** for raster tiles, **MapLibre GL** for OpenFreeMap vector tiles (no token required), or **Mapbox GL** for vector tiles with 3D buildings and terrain, which additionally needs a Mapbox access token. If Mapbox GL is selected but no access token is present, TREK falls back to Leaflet automatically so the map is never blank.
 
 The scopes required for Mapbox GL are:
 - STYLES:TILES
 - STYLES:READ
 - FONTS:READ
-- DATASETS:WRITE
-- VISION:CREATE
+- DATASETS:READ
+- VISION:READ
+
+## Satellite view
+
+A round button in the bottom-left corner of the Leaflet map flips the base layer between the normal map tiles and **satellite** imagery (ESRI World Imagery — no API key needed, usable up to zoom 19). The icon always shows the layer it switches to. Your choice is stored on your account (`map_base_layer`), so it carries over to every trip and survives a reload. Markers, route lines, tracks and booking overlays are drawn on top of either layer.
 
 ## Place markers
 
@@ -28,7 +32,9 @@ When zoomed out, nearby markers are grouped into clusters. Clicking a cluster zo
 
 ## Route lines
 
-When you have a day selected, a dark dashed line connects consecutive places in that day's order.
+A day's route is drawn as a solid blue line — a bright core over a darker casing, the look Apple Maps uses — through that day's stops in the order you arranged them. It is not on automatically: switch it on with the **Route** toggle on the day, in the day-plan sidebar on desktop or in the day sheet on mobile. The choice is remembered per trip in your browser, and the mobile map turns it on by default the first time you open a trip you have not decided on.
+
+A straight line is drawn immediately, then upgraded to real road geometry from a public OSRM router (or from a plugin route profile), each leg routed in the transport mode that leg carries. If routing fails, that leg stays a straight line between the two stops.
 
 ## GPX tracks
 
@@ -42,7 +48,7 @@ Clicking a line on the map selects that track and opens its details — useful w
 
 ### Exporting a trip as GPX
 
-The **GPX** button in the day sidebar's toolbar, next to PDF and ICS, hands the trip back as a `.gpx` file for offline maps such as Organic Maps, for a handheld GPS, or for any other tool that reads the format. On a phone the same download sits in the trip's **Export** sheet, under "More".
+The **Export** button in the day sidebar's toolbar opens one dialog with every way a trip leaves TREK: the day plan as a PDF, the bookings as a calendar, and under **Maps & GPS · GPX** the trip as a `.gpx` file for offline maps such as Organic Maps, for a handheld GPS, or for any other tool that reads the format. On a phone the same downloads sit in the trip's **Export** sheet, under "More".
 
 Three scopes:
 
@@ -52,28 +58,32 @@ Three scopes:
 
 Places carry their description and address, and their category travels along as the GPX symbol, so devices that support it can show a different icon per kind of stop. Elevation is written back for tracks that were imported with it. Exporting is a read, so every trip member can do it, not only those who may edit.
 
-## Route time pills
+## Travel times between stops
 
-At zoom level 12 or higher, small pill-shaped labels appear between consecutive places and show the estimated **walking time** and **driving time** for each segment. Below zoom 12 they are hidden to keep the map clean.
+Travel times are not drawn on the map — they sit in the day plan. Switch a day's route on and a slim connector row appears between each pair of consecutive stops with that leg's travel time and distance, and an icon for the mode it was routed in: a car for driving, a foot for walking, a bolt for a plugin route profile. On a phone the same rows sit in the day's plan timeline, where they are always shown and need no toggle. If the day has an accommodation and "optimize from accommodation" is on, two extra connectors bookend the day, naming the hotel with the drive out in the morning and back in the evening.
+
+Each leg carries its own mode, so a day routed by car can still have one leg you walk. If you may edit the day, clicking a connector opens the transport-mode menu for that leg alone.
+
+Car and foot times come from a public OSRM router, so they follow real roads and footpaths instead of straight-line estimates. A plugin route profile is answered by the plugin's own route provider instead, which is what lets it fold in things like charging stops; those legs can add a short note next to the distance. When routing is unavailable the leg falls back to a straight line and shows no time.
 
 ## Reservation and transport overlay
 
-Flights, trains, cars, and cruises can be drawn as overlays between their endpoint places. Overlays are **off by default** — activate each reservation individually by clicking the small **Route** icon next to the booking row in the day sidebar, or use one of the bulk options below. The selection is remembered per trip in your browser. Click the icon again to hide it.
+Flights, trains, cars, and cruises can be drawn as overlays between their endpoint places. Overlays are **off by default** — activate each reservation individually by clicking the small **Route** icon next to the booking row in the day sidebar, or use one of the bulk options below (automated public-transit journeys are the exception — see the transit bullet). The selection is remembered per trip in your browser. Click the icon again to hide it.
 
-- **Flights and cruises** — geodesic great-circle arcs
+- **Flights, cruises and ferries** — geodesic great-circle arcs
 - **Cars, buses, taxis and bicycles** — real routed lines that follow actual roads, fetched on demand from a public OSRM router (driving for car/bus/taxi, cycling for bicycle). A straight line is shown while the route loads and kept if routing fails or the trip is very long (~2000 km+)
 - **Trains** — a straight line between the endpoints; a multi-leg train draws its whole station chain (from → stop → to)
+- **Automated public transit** — a journey added from the transit search draws its real rail and bus alignment instead of a straight line: each ride leg in its line's own colour over a white casing, walking transfers as a dotted grey line. A journey whose provider sent no shape falls back to a straight line. Unlike every other type it has no per-booking **Route** icon in the day sidebar — it is drawn when the day's own **Route** toggle is on and the journey runs on that day, and independently of that by the bulk button, the account-wide default, or the **On map** button in the journey's detail sheet on a phone. Because those are two separate gates, **hide all** does not clear a transit journey while that day's **Route** toggle is still on
 - **Antimeridian crossings** — routes that cross the date line now draw as one continuous arc instead of splitting into disconnected segments at the map edges
 - **Endpoint markers** — pill-shaped labels with the transport icon and the endpoint code (e.g. IATA airport code) or location name
-- **Flight stats** — a floating label on the arc shows departure code → arrival code and, when times are available, the duration and great-circle distance. Stats labels are only rendered for flights.
 - **Confirmed reservations** — solid line; **Pending** — dashed line
 
 **Bulk options**, alongside the per-booking toggle:
 
-- **Show all / hide all** — a route icon button in the day-plan toolbar (next to Undo/Reorder) flips every routable booking on the trip on or off at once, without affecting bookings you've toggled individually.
+- **Show all / hide all** — a route icon button in the day-plan toolbar (next to Undo/Reorder) flips the whole trip between showing every routable booking and showing none. It is a clean slate rather than a layer on top: whatever you had set with the per-booking **Route** icons is discarded, so pressing it twice leaves you with all routes on or all off, not back where you started. (Automated public-transit journeys have a second gate of their own — see the transit bullet.)
 - **Always show booking routes** (Settings → General → Travel & map) — an account-wide default that shows every booking's route automatically on any trip you haven't touched before. It sets the *default* only — a trip where you've already used the per-booking toggle or the bulk button keeps its own choice even if you change this setting afterwards.
 
-> **Admin:** Whether endpoint text labels appear on the endpoint markers is controlled by the **Booking route labels** setting in Settings → General (`map_booking_labels`).
+> **Tip:** Whether endpoint text labels appear on the endpoint markers is your own choice — the **Booking route labels** setting in Settings → General → Travel & map (`map_booking_labels`). It is off by default; with it off, the endpoint markers show only the transport icon.
 
 ## Plugin map markers
 
@@ -99,6 +109,6 @@ If geolocation is denied or unavailable, the button turns red.
 
 Right-click anywhere on the **Leaflet** map to open the Place form with the clicked coordinates and a reverse-geocoded address already filled in.
 
-On the **Mapbox GL** map, right-click is reserved for the built-in rotate/pitch gesture, so use **middle-click** instead to trigger the same Place form.
+The **Mapbox GL** and **MapLibre GL** maps take the same right-click, and additionally **middle-click** and a **long-press** on touch. A right-button drag that rotates or pitches the map is not mistaken for a click, so the gesture and the shortcut coexist.
 
 **See also:** [Places-and-Search](Places-and-Search) · [Day-Plans-and-Notes](Day-Plans-and-Notes) · [Route-Optimization](Route-Optimization) · [Map-Settings](Map-Settings) · [Reservations-and-Bookings](Reservations-and-Bookings)
diff --git a/wiki/Map-Settings.md b/wiki/Map-Settings.md
index c5456c184..0036b9e4e 100644
--- a/wiki/Map-Settings.md
+++ b/wiki/Map-Settings.md
@@ -51,7 +51,7 @@ Required scopes are:
 - DATASETS:READ
 - VISION:READ
 
-If Mapbox GL is selected but no token is saved, the map area shows an empty state with a prompt to configure the token under Settings → Map → Mapbox GL.
+If Mapbox GL is selected but no token is saved, TREK falls back to the Leaflet renderer, so the Trip Planner and Journey maps keep working. Only the preview on this settings page stays blank, with the note *Enter a Mapbox access token to preview*.
 
 **Built-in style presets:**
 
@@ -72,7 +72,7 @@ You can also enter a custom `mapbox://styles/USER/ID` URL directly.
 
 ### 3D Buildings & Terrain
 
-Enables pitch and building extrusions on all styles. Terrain elevation (DEM-based height) is additionally applied on satellite styles (`Satellite` and `Satellite Streets`). On non-satellite styles only building extrusions are added; terrain is intentionally omitted on those styles because the elevation data would cause route lines to visually drift away from the HTML place markers.
+Enables pitch and 3D buildings on all styles. `Mapbox Standard` and `Standard Satellite` ship their own building volumes, so TREK adds no extrusion layer there; every other style gets one injected. Terrain elevation (DEM-based height) is additionally applied on `Satellite`, `Satellite Streets` and `Outdoors`; `Standard Satellite` brings its own terrain from Mapbox and is left alone. The remaining styles get buildings but no terrain — including plain `Mapbox Standard`, whose built-in terrain TREK switches off — because the elevation data would cause route lines to visually drift away from the HTML place markers.
 
 ### High Quality Mode *(Experimental)*
 
@@ -98,7 +98,7 @@ The **3D Buildings & Terrain** and **High Quality Mode** toggles are Mapbox-only
 
 There is **no** default map center or zoom setting — it was removed in v3.4.0. Instead, every map works out its own opening camera from the places it is about to draw, so a trip in Japan opens on Japan instead of starting on the world view and then flying across the planet.
 
-For each map, TREK takes the coordinates it is given and computes the center and zoom that frame them all:
+For each trip map — Trip Planner, Collections and shared-trip links — TREK takes the coordinates it is given and computes the center and zoom that frame them all (the Journey maps frame themselves with the renderer's own `fitBounds`, capped at zoom 16 on both engines):
 
 - **Several places** — the camera fits their bounding box. The zoom is capped (16 on Leaflet, 15 on the GL renderers) so a tight cluster does not open absurdly far in, and the center is taken in projected (Mercator) space rather than as an average of the latitudes, so the northernmost place does not fall out of frame.
 - **A single place** (or several stacked on the same spot) — there is no extent to fit, so it opens at city level: zoom 12 on Leaflet, 11 on the GL renderers.
@@ -106,7 +106,7 @@ For each map, TREK takes the coordinates it is given and computes the center and
 - **Side panels** — chrome overlaying the map shifts the center, so the places stay inside the part of the map you can actually see.
 - **No usable coordinates** — a brand-new trip with nothing placed yet has nothing to frame, so the map falls back to a world view (center `0, 0` at zoom 2).
 
-The small map preview on this settings page is the one exception: it stays on a fixed city (Paris, zoom 16) so you can judge label density, 3D buildings and satellite texture. It is not a setting and no real map opens there.
+The small map preview on this settings page is the exception: it stays on a fixed city (Paris) — zoom 16 on the two GL previews, city-level zoom 12 under Leaflet — so you can judge label density, 3D buildings and satellite texture. It is not a setting and no real map opens there.
 
 ## See also
 
diff --git a/wiki/My-Trips-Dashboard.md b/wiki/My-Trips-Dashboard.md
index bf9030e9c..fd22680b2 100644
--- a/wiki/My-Trips-Dashboard.md
+++ b/wiki/My-Trips-Dashboard.md
@@ -8,7 +8,7 @@ The dashboard at `/dashboard` is your home base — it lists all your trips, let
 
 Use the toggle button in the top toolbar to switch between **grid** (card thumbnails) and **list** (compact rows). Your preference is saved in `localStorage` under the key `trek_dashboard_view` and persists across sessions.
 
-In grid mode the dashboard shows a large [Spotlight card](#spotlight-card) for your most relevant trip, with remaining trips in a responsive grid below. In list mode the Spotlight card is not shown separately — all trips (including the one that would be the spotlight) appear as uniform rows in the same sort order.
+In both modes the dashboard shows a large [Spotlight card](#spotlight-card) for your most relevant trip at the top of the page — the toggle only changes how the trips below it are laid out. The spotlighted trip is taken out of that list when it earns the spot on its own: an ongoing trip, or the next upcoming one. If you have neither, the spotlight borrows your first trip for the header and that trip still shows up in the list below.
 
 ## Sort Order
 
@@ -22,27 +22,29 @@ Trips without dates are treated as past.
 
 ## Spotlight Card
 
-The first ongoing trip — or the next upcoming trip if none is ongoing — is promoted to a full-width **Spotlight card** at the top of the grid on desktop. On mobile this card appears as a hero at the top of the page. The spotlight card shows a progress bar for ongoing trips and a stats strip (days, places, travel companions).
+The first ongoing trip — or the next upcoming trip if none is ongoing — is promoted to a full-width **Spotlight card** at the top of the grid on desktop, where it shows the travel companions, the trip dates, a countdown and the places as a boarding pass. On mobile this card appears as a hero at the top of the page, with a progress bar for ongoing trips and a stats strip (days, places, travel companions).
 
 If you have no trips yet, the spotlight card is not shown.
 
 ## Archived Trips
 
-Archived trips are hidden from the main list and collapsed into a separate **Archived** section at the bottom of the page. Click the section header to expand it. You can **Copy**, **Restore**, or permanently **Delete** an archived trip from the row actions.
+Archived trips are kept out of the default list. The trips section header carries a **Planned / Archived / Completed** filter and the grid shows exactly one of those three sets — switch to **Archived** to see them. On desktop an archived card has the same four actions as any other card, with **Archive** turned into **Restore**. On mobile an archived card drops **Edit**: you can **Copy**, **Restore**, or permanently **Delete** the trip.
 
-## Greeting (Mobile)
+## Mobile Header
 
-On mobile, the header shows a time-of-day greeting — "Good morning", "Good afternoon", or "Good evening" — along with your username and avatar. The greeting changes at 12:00 (noon) and 18:00. The mobile header also includes a **Notifications** button (bell icon) that navigates to `/notifications`.
+On mobile, the header is a floating glass bar: the TREK logo on the left (tap it to scroll back to the top), a **Notifications** button (bell icon, with a dot when something is unread) that navigates to `/notifications`, and your avatar on the right. The avatar opens the user menu — settings, the admin panel for admins, the dark/light/auto theme cycle, and sign out.
 
 ## Dashboard Widgets Sidebar
 
-On wide screens a sticky right column shows the **Currency Converter** and **Timezone Clock** widgets. Each can be toggled on or off via the Settings icon in the toolbar. On mobile, the widgets are available as a bottom sheet from the quick-action buttons at the top of the page.
+On wide screens a sticky right column shows the **Currency**, **Collections** (only with the Collections addon enabled), **Timezones**, and **Upcoming reservations** widgets, plus any widget a plugin contributes. Each one is switched on or off separately for desktop and mobile under **Settings → Appearance → Dashboard widgets**; desktop also has a **Right sidebar** master toggle that removes the whole column, and the column disappears on its own once every widget in it is off.
+
+On mobile, the same widgets are inline panels below the spotlight card, not a bottom sheet. By default the trip list comes first and the widgets stack underneath it. How they stack — and where the trip list sits among them — is set on the phone under **Settings → Appearance → Mobile → Dashboard order**.
 
 See [Dashboard-Widgets](Dashboard-Widgets) for full usage details.
 
 ## Per-Trip Actions
 
-On desktop, hover over a card (or open the row actions in list view) to reveal the action buttons — they appear on mouse-over only. On mobile, action buttons are always visible directly on the card cover. The available actions are:
+On desktop the action buttons sit on the card cover at all times — hovering the card only lifts them from a slightly dimmed resting state to full opacity, and list rows carry the same buttons on their cover. On mobile, action buttons are always visible directly on the card cover. The available actions are:
 
 | Action | Permission required |
 |---|---|
@@ -51,11 +53,11 @@ On desktop, hover over a card (or open the row actions in list view) to reveal t
 | **Archive / Unarchive** | `trip_archive` on that trip |
 | **Delete** | `trip_delete` on that trip |
 
-Actions not permitted for your role are hidden. Admins always see all actions.
+Which actions appear depends on layout and archive state, not on your role — the dashboard draws the buttons without checking permissions. On mobile a grid card leaves **Archive** out (it lives in the edit sheet) while a list row includes it. The permissions above are enforced by the server: an action your role is not allowed to perform comes back as a 403 and you get an error message instead of the button being hidden. Permissions do take effect inside the trip dialog — without `trip_cover_upload` the cover-image panel is not shown, and without `trip_edit` the title, description, and currency fields are read-only.
 
 ## Empty State
 
-When you have no trips, the dashboard shows an illustration and a **Plan your first trip** button that opens the [Creating-a-Trip](Creating-a-Trip) dialog.
+When you have no trips, the dashboard shows the TREK mascot with the caption **No trips yet**. Start one from the **New Trip** button in the bottom-right corner or the dashed **New Trip** tile at the end of the grid; both open the [Creating-a-Trip](Creating-a-Trip) dialog. On mobile the empty state itself carries a **Create First Trip** button.
 
 ## Related Pages
 
diff --git a/wiki/Notifications.md b/wiki/Notifications.md
index 765f027c4..55533dedb 100644
--- a/wiki/Notifications.md
+++ b/wiki/Notifications.md
@@ -19,7 +19,7 @@ TREK ships four delivery channels, and a plugin can add more. Which channels app
 
 A plugin can register an **additional channel** — Gotify, Pushover, Telegram, anything that
 takes a message — by implementing the `notificationChannel` hook. See
-[Plugin-Development](Plugin-Development.md#notification-channels).
+[Plugin-Development](Plugin-Development#notification-channels).
 
 Once the admin installs the plugin and switches its channel on, it appears as a new column in
 the preferences matrix beside Email and In-App, and behaves like any other channel: each user
@@ -43,8 +43,10 @@ The following events are configurable in user settings:
 | `trip_invite` | Someone invited you to a trip |
 | `booking_change` | A booking was added, updated, or removed in a trip you're part of |
 | `trip_reminder` | Reminder before a trip starts |
+| `todo_due` | A to-do assigned to you, or in a trip you're part of, is due soon |
 | `vacay_invite` | You were invited to fuse vacation plans |
 | `vacay_share` | Someone shared their vacation calendar with you (view only) |
+| `collection_invite` | Someone invited you to share a collection |
 | `photos_shared` | Photos were shared with a trip |
 | `collab_message` | A new message in a collaborative trip |
 | `packing_tagged` | You were assigned to a packing category in a trip |
@@ -59,10 +61,11 @@ The following events are shown in the admin panel (Admin → Notifications) and
 | Event | Description | Channels |
 |-------|-------------|---------|
 | `version_available` | A new TREK version is available | in-app, email, webhook, ntfy |
+| `replica_failure` | A write to a storage replica failed (repeats within the hour are suppressed and counted) | in-app, email, webhook, ntfy |
 
-### System-only events
+### In-app-only events
 
-The following events are fired automatically and are not exposed as toggles in any settings panel:
+The following event is fired automatically and can only be delivered in-app — it appears in the preferences matrix with an In-app toggle and a dash in every other column:
 
 | Event | Description | Channels |
 |-------|-------------|---------|
diff --git a/wiki/OIDC-SSO.md b/wiki/OIDC-SSO.md
index 69413bb0b..135515dc8 100644
--- a/wiki/OIDC-SSO.md
+++ b/wiki/OIDC-SSO.md
@@ -15,13 +15,23 @@ OpenID Connect (OIDC) lets users log in with an existing identity provider — G
 5. The server issues a short-lived one-time code and redirects your browser to `/login?oidc_code=<code>`. The frontend immediately exchanges that code at `GET /api/auth/oidc/exchange?code=<code>` to obtain the session.
 6. Your `trek_session` cookie is set and you land on the dashboard.
 
+**Remember me.** The Remember-me switch on the login page is carried into SSO as a query flag on the login URL: `GET /api/auth/oidc/login?remember=1` (or `remember=0`), appended with `&` when an invite token is already present. Only `0` and `1` are accepted; any other value — and starting SSO from the register tab, where the switch is not shown — is treated as if the parameter were absent. The choice is held in the server-side login state, survives the provider round-trip and the one-time-code exchange, and decides both the session lifetime and the cookie lifetime:
+
+| `remember` | Session lifetime | `trek_session` cookie |
+|---|---|---|
+| `1` | `SESSION_DURATION_REMEMBER` (default `30d`) | persistent, `maxAge` matches |
+| `0` | `SESSION_DURATION` (default `24h`) | browser-session cookie, cleared when the browser closes |
+| omitted | `SESSION_DURATION` (default `24h`) | persistent, `maxAge` matches |
+
+If SSO sessions are dying at browser close, the login link is sending `remember=0`.
+
 ## Prerequisites
 
 Set the following environment variables before starting the server:
 
 | Variable | Required | Description |
 |---|---|---|
-| `APP_URL` | Yes | Base URL of your TREK instance (e.g. `https://trek.example.com`). Used to build the redirect URI. Can also be set via Admin → Settings. |
+| `APP_URL` | Yes | Base URL of your TREK instance (e.g. `https://trek.example.com`). Used to build the redirect URI. **Env var only — not configurable via the admin panel.** If it is unset (or not a parseable URL, in which case it is ignored), TREK falls back to the first `ALLOWED_ORIGINS` entry, and only if that one is missing or unparseable to `http://localhost:{PORT}` — which produces a redirect URI your IdP will reject. A scheme-less `ALLOWED_ORIGINS=trek.example.com` does not parse, so it ends up on localhost too. |
 | `OIDC_ISSUER` | Yes | Issuer URL of your identity provider. Must use HTTPS in production. |
 | `OIDC_CLIENT_ID` | Yes | OAuth 2.0 client ID registered with your IdP. |
 | `OIDC_CLIENT_SECRET` | Yes | OAuth 2.0 client secret. |
@@ -47,7 +57,7 @@ For example: `https://trek.example.com/api/auth/oidc/callback`
 
 ## New-user registration via SSO
 
-When an SSO login matches an existing TREK account by email or OIDC subject (`sub`), that account is used and the OIDC identity is linked automatically. If no matching account exists, TREK attempts to create one. The outcome depends on the following:
+When an SSO login matches an existing TREK account by OIDC subject (`sub`), that account is used directly. When it matches only by **email**, the OIDC identity is linked to that account only if the provider asserts `email_verified` for it; if the claim is missing or false the login is rejected with an `email_not_verified` error, so an unverified address can never take over a local account. Make sure your IdP includes `email_verified` in the userinfo response — it is part of the `email` scope. If no matching account exists, TREK attempts to create one. The outcome depends on the following:
 
 - **First user ever**: always created as admin, no invite required.
 - **Open SSO registration enabled** (admin panel toggle `oidc_registration`): account is created as a regular user.
@@ -56,7 +66,7 @@ When an SSO login matches an existing TREK account by email or OIDC subject (`su
 
 ## Admin panel (runtime configuration)
 
-OIDC can also be configured without environment variables via **Admin → SSO**. The following fields are settable at runtime:
+OIDC can also be configured without environment variables via **Admin → Settings**, in the **Single Sign-On (OIDC)** card. The following fields are settable at runtime:
 
 | Field | Env var equivalent |
 |---|---|
diff --git a/wiki/Offline-Mode-and-PWA.md b/wiki/Offline-Mode-and-PWA.md
index 373458aad..4c4a7b060 100644
--- a/wiki/Offline-Mode-and-PWA.md
+++ b/wiki/Offline-Mode-and-PWA.md
@@ -29,8 +29,9 @@ TREK uses Workbox service-worker caching plus an IndexedDB database (Dexie) for
 | Content | Cache name | Strategy | Duration | Max entries |
 |---------|------------|----------|----------|-------------|
 | CartoDB / OpenStreetMap map tiles | `map-tiles` | CacheFirst | 30 days | 12 288 |
-| Mapbox GL style, glyphs, sprites and vector tiles | `mapbox-tiles` | StaleWhileRevalidate | 30 days | 3 000 |
-| OpenFreeMap MapLibre style and tiles | `openfreemap-tiles` | StaleWhileRevalidate | 30 days | 3 000 |
+| Mapbox GL and OpenFreeMap style documents | `gl-map-styles` | NetworkFirst (5 s timeout) | 30 days | 20 |
+| Mapbox GL glyphs, sprites and vector tiles | `mapbox-tiles` | StaleWhileRevalidate | 30 days | 3 000 |
+| OpenFreeMap MapLibre glyphs, sprites and vector tiles | `openfreemap-tiles` | StaleWhileRevalidate | 30 days | 3 000 |
 | Cover images and avatars (`/uploads/covers`, `/uploads/avatars`) | `user-uploads` | CacheFirst | 7 days | 300 |
 | App shell and every page of the app (HTML / JS / CSS) | precache | Precached | Until next deploy | — |
 
@@ -40,11 +41,13 @@ TREK uses Workbox service-worker caching plus an IndexedDB database (Dexie) for
 
 **IndexedDB (Dexie) — structured trip data**
 
-On login, after each trip-list refresh, and on WebSocket reconnect, TREK runs a background sync that writes full trip bundles into IndexedDB:
+On login, when the browser comes back online, and when you lift **Force offline mode**, TREK runs a background sync that writes full trip bundles into IndexedDB — you can also start one by hand with **Re-sync now**, with **Download for offline use** for a progress-tracked run, or by re-enabling a trip's offline toggle:
 
 - Trips, days, places, packing items, to-dos, budget items, reservations, accommodations, trip members, tags, and categories.
-- Non-photo file attachments (PDFs, documents, etc.) are downloaded and stored as blobs in IndexedDB.
-- Map tiles are pre-fetched into the service-worker `map-tiles` cache for zoom levels 10–16 across each trip's bounding box (capped at ~50 MB of tiles per sync).
+- File attachments that are neither photos nor videos (PDFs, documents, etc.) are downloaded and stored as blobs in IndexedDB. Videos are deliberately skipped — a single clip can be hundreds of megabytes and would evict the trip's real documents.
+- Map tiles are pre-fetched into the service-worker `map-tiles` cache for zoom levels 10–16 across each trip's bounding box, stopping at the zoom level that would push the total past 12 288 tiles (roughly 180 MB).
+
+> **Note:** A WebSocket reconnect does *not* run this sync. It replays your queued changes and then re-reads the trip you currently have open — days, places, packing items, to-dos, budget items, reservations and files — which refreshes that one trip's cached rows. It never re-downloads the bundles for your other trips, the file blobs or the map tiles; skipping the full sync there is deliberate, so a dropped socket on an otherwise online device doesn't run into the server's rate limiter.
 
 **Sync scope and eviction**
 
@@ -81,8 +84,8 @@ The stats panel shows cached trips, pending changes, conflicts and failed change
 - Offline **editing** is supported for places and packing items (with conflict detection). Other entities — budget, to-dos, reservations, days — require connectivity to edit; while forced offline those edits still go to the live server when a connection is actually present.
 - A change you made offline that **deletes** an item wins over a concurrent server edit of that same item ("delete wins"); only edit-vs-edit conflicts are surfaced for resolution.
 - The conflict token has one-second resolution, so two edits to the same field within the same second can't be told apart and fall back to last-write-wins (only relevant to sub-second races; normal offline windows are unaffected).
-- New trips created while offline are queued and synced when connectivity is restored.
-- Photo uploads require connectivity; non-photo file attachments are pre-cached automatically during sync.
+- Creating a trip requires connectivity. Trip creation is not queued, so a new trip cannot be started while offline.
+- Photo uploads require connectivity. Photo and video attachments are not pre-cached; every other file attachment is pre-cached automatically during sync.
 - Real-time collaboration features require an active WebSocket connection.
 - Mapbox GL / vector tiles are not pre-downloaded; raster (Leaflet) tiles are. With map-tile storage off, individually viewed tiles may still be cached opportunistically by the service worker.
 
diff --git a/wiki/PDF-Export.md b/wiki/PDF-Export.md
index 971a7a3ca..e5242b42e 100644
--- a/wiki/PDF-Export.md
+++ b/wiki/PDF-Export.md
@@ -1,6 +1,6 @@
 # PDF Export
 
-TREK can generate two kinds of PDFs from your trip data: a structured **Trip Plan PDF** and a photo-book-style **Journey Book PDF**. Both render as HTML in a sandboxed iframe and open the browser's native print/save dialog — no server-side processing is involved.
+TREK generates a structured **Trip Plan PDF** from your trip data. It renders as HTML in a sandboxed iframe and opens the browser's native print/save dialog — no server-side processing is involved. Journey entries no longer go through a fixed PDF template: they are laid out in **TREK Studio** and printed through the same browser mechanism (see below).
 
 ![PDF Export](assets/PDFTrip.png)
 
@@ -10,22 +10,24 @@ TREK can generate two kinds of PDFs from your trip data: a structured **Trip Pla
 
 ### How to generate
 
-Open the Day Plan sidebar in the trip planner. Click the **PDF** button in the toolbar at the top of the sidebar. A preview modal opens immediately; click **Save as PDF** to open your browser's print dialog and save the file.
+Open the Day Plan sidebar in the trip planner and click the **Export** button in the toolbar at the top of the sidebar. The Export dialog opens with three groups — **Document**, **Calendar**, and **Maps & GPS**. Pick the PDF row under **Document**: a preview modal opens, and **Save as PDF** hands the document to your browser's print dialog.
 
 ### Cover page
 
-- Blurred cover image as background (if the trip has one), with the same image in a circular badge
+- Faded cover image as background (if the trip has one), with the same image in a circular badge
 - Trip title and description
 - Date range (first day to last day)
 - Stat tiles:
   - **Days** — total number of days in the trip
   - **Places** — total places in your trip's place list
   - **Planned** — number of unique places assigned to at least one day
-  - **Estimated cost** — sum of all assigned place prices, shown in the trip's currency (hidden if zero)
+  - **Cost** — sum of all assigned place prices, shown in the trip's currency (hidden if zero). Mixed currencies are converted at current rates and prefixed with "≈"; when a rate is missing, the tile shows a per-currency breakdown instead
 
 ### Per-day pages
 
-Each day starts on a new page with a dark header bar showing the day number, day title, date, and the day's estimated cost.
+Each day starts on a new page (unless you turn off **Page break per day**) with a dark header bar showing the day number, day title, date, and the day's estimated cost.
+
+The **Page break per day** toggle sits in the preview modal's header, next to Save as PDF. It is on by default; turn it off and the days flow into each other instead, which is worth doing on a trip of short days that would otherwise print one sheet per handful of lines. The choice is remembered in that browser for the next export.
 
 Below the header:
 
@@ -51,47 +53,19 @@ Installed plugins can append their own sections to the Trip Plan PDF via the `pd
 
 ---
 
-## Journey Book PDF
+## Journey photo books
 
-### How to generate
+The Travel Journal has no fixed-template PDF export any more. Open a Journey entry and click **Studio** in the journal header (the book icon in the top bar on phones) to open **TREK Studio**, the photo-book designer.
 
-Open a Journey entry in the Travel Journal. Click the **download icon** button in the journal's header area. A preview modal opens; click **Save as PDF** to print.
+Studio lays the journey out as editable spreads instead of a fixed page template: five page presets (210 mm and 300 mm square, A4 landscape, A4 portrait, A5 landscape) or a custom size between 60 and 500 mm, and seven bundled font families.
 
-![Journey Book PDF Preview](assets/PDFJourney.png)
-
-### Format
-
-A4 landscape (`@page { size: A4 landscape; margin: 0 }`). Font: Inter, loaded from Google Fonts.
-
-### Cover page
-
-- Hero image (journey cover image, or the first entry photo if none is set)
-- Journey title and optional subtitle
-- Stat tiles: Days, Entries, Photos
-
-### Entry pages
-
-One page per journal entry, in chronological order. The first entry of each date carries a day header (day number and full date) above the content.
-
-Photo layout adapts to the number of photos on the entry:
-
-| Photos | Layout |
-|--------|--------|
-| 1 | Single image, full width |
-| 2 | Two images side by side |
-| 3 or more | Large hero image on the left, two stacked images on the right |
-
-Below the photos: entry time and location, entry title, journal text (rendered from Markdown), and pros/cons verdict cards if present.
-
-### Closing page
-
-A dark "The End" card.
+Printing works the same way as the Trip Plan PDF — the sheets are written into a sandboxed `srcdoc` iframe and handed to the browser's print dialog, so nothing is rendered on the server. A browser writes no TrimBox or BleedBox, so the sheets can carry crop marks for a print shop instead. **Single pages** or **Spreads**, and crop marks on or off, are chosen in Studio's export panel.
 
 ---
 
 ## How rendering works
 
-Both PDFs use the same mechanism: the HTML document is written into a sandboxed `<iframe>` via `srcdoc`, and `iframe.contentWindow.print()` opens the browser's print dialog. There is no server-side PDF generation. The file is saved through the browser's built-in "Save as PDF" print destination.
+The Trip Plan PDF and Studio's print view use the same mechanism: the HTML document is written into a sandboxed `<iframe>` via `srcdoc`, and `iframe.contentWindow.print()` opens the browser's print dialog. There is no server-side PDF generation. The file is saved through the browser's built-in "Save as PDF" print destination.
 
 ---
 
diff --git a/wiki/Packing-Lists.md b/wiki/Packing-Lists.md
index a53527675..9d656e813 100644
--- a/wiki/Packing-Lists.md
+++ b/wiki/Packing-Lists.md
@@ -6,13 +6,13 @@ Create categorized packing checklists with member assignments and optional bag t
 
 ## Where to find it
 
-Open the **Lists** tab inside the trip planner and select **Packing**. The tab is only visible when the Packing addon is enabled.
+Open the **Lists** tab inside the trip planner and select **Packing**. The tab is only visible when the Lists addon is enabled.
 
-> **Admin:** Enable the Packing addon and optionally turn on Bag Tracking in [Admin-Addons](Admin-Addons).
+> **Admin:** Enable the **Lists** addon (its internal id is `packing`, and it covers both Packing and Todo) and optionally turn on its nested **Bag Tracking** toggle in [Admin-Addons](Admin-Addons).
 
 ## Progress bar
 
-A progress bar shows how many items have been checked (packed) out of the total. It is hidden on small screens and visible on larger viewports. When all items are checked, a completion message replaces the bar.
+A progress bar shows how many items have been checked (packed) out of the total. It is hidden on small screens and visible on larger viewports. When all items are checked, an **All packed!** message replaces the packed/total counter and the bar turns green.
 
 ## Filters
 
@@ -24,14 +24,18 @@ Three filter buttons let you narrow the item view:
 
 ## Categories
 
-Items are grouped into categories. Each category has a colored dot that cycles through a 10-color palette. When you create a new packing list, suggested items are pre-populated in these categories: **Documents** (Passport, Travel Insurance, Visa Documents, Flight Tickets, Hotel Bookings, Vaccination Card), **Clothing** (T-Shirts (5x), Pants (2x), Underwear (7x), Socks (7x), Jacket, Swimwear, Sport Shoes), **Toiletries** (Toothbrush, Toothpaste, Shampoo, Sunscreen, Deodorant, Razor), **Electronics** (Phone Charger, Travel Adapter, Headphones, Camera, Power Bank), **Health** (First Aid Kit, Prescription Medication, Pain Medication, Insect Repellent), and **Finances** (Cash, Credit Card).
+Items are grouped into categories. Each category has a colored dot that cycles through a 10-color palette. A new packing list starts empty — nothing is pre-populated, and the panel just reads *Packing list is empty* until you add something. Fill it by adding categories and items by hand, by applying a saved template (see [Templates](#templates)), or by pasting a whole list in at once (see [Importing a list](#importing-a-list)).
+
+The UI labels these groups **lists** rather than categories: the button that creates one reads **Add list** with the placeholder *List name (e.g. Clothing)*, moving an item between them reads **Move to List**, and the confirm dialog asks about deleting *the list "{name}"*. The REST API and this page still call them categories.
 
 Each category header has a collapse/expand toggle and an overflow menu with these actions:
 
-- **Check all** — mark every item in the category as packed.
-- **Uncheck all** — unmark every item in the category.
 - **Rename** — rename the category.
-- **Delete** — delete the category and all its items.
+- **Check All** — mark every item in the category as packed.
+- **Uncheck All** — unmark every item in the category.
+- **Delete List** — delete the category and all its items.
+
+**Rename** and **Delete List** need the `packing_edit` permission; **Check All** and **Uncheck All** are always shown.
 
 ### Assigning members to a category
 
@@ -46,10 +50,29 @@ Each item row contains:
 - A **quantity** field (always visible).
 - When bag tracking is enabled: a **weight** field (in grams) and a **bag picker**.
 
-Hovering over an item reveals a **category picker** (colored dot), a **rename** button (pencil icon), and a **delete** button. Add new items using the inline "add item" row at the bottom of each category.
+Each row also carries a **category picker** (colored dot), a **rename** button (pencil icon), and a **delete** button. Add new items using the inline "add item" row at the bottom of each category, or bring a whole list in at once with **Import** (below).
 
 On phones the row keeps the name and reduces everything else: sharing shows as an icon rather than a sentence, a weight nobody entered prints nothing, and edit/delete sit behind the **⋯** button at the end of the row while the list is in edit mode.
 
+## Importing a list
+
+**Import** in the Lists header opens a paste box, or use **Load CSV/TXT** to pick a file. One item per line:
+
+```
+Category, Name, Weight in g (optional), Bag (optional), checked/unchecked (optional)
+```
+
+```
+Toiletries, Toothbrush
+Clothing, T-Shirts, 200
+Documents, Passport, , Carry-on
+Electronics, Charger, 50, Suitcase, checked
+```
+
+Commas, semicolons and tabs all work as separators, and a quoted value keeps its commas (`"Shirt, blue"`). A line with a single value is treated as just a name. A line without a category lands in **Other**, and a bag name that does not exist yet is created for you. Imported items are appended; nothing already on the list is removed.
+
+Import is the only place in the UI that loads weights and bag assignments in bulk — applying a template brings across names and categories only. It requires the `packing_edit` permission.
+
 ## Sharing packing items
 
 Every packing item has a sharing tier that controls who sees it and who is bringing it. By default everything sits in the shared group pool, exactly as before — the tiers are opt-in per item.
@@ -71,7 +94,7 @@ Open an item's **Sharing** control (the share icon on the row) to move it betwee
 - **Personal** — *Private — only you can see it.*
 - **Shared with…** — pick specific trip members below the two tier options. The item then shows only on your list and on theirs. (If you're the only one on the trip, this reads *No one else on this trip yet*.)
 
-New items inherit the view you add them in: adding an item while in **My list** makes it Personal, adding it in **Shared** makes it Common. To share an item with specific people, add it first, then open its Sharing control and choose them.
+New items inherit the view you add them in: adding an item while in **My list** makes it Personal, adding it in **Shared** puts it in the shared group pool. To share an item with specific people, add it first, then open its Sharing control and choose them.
 
 Only the item's owner (the person bringing it) can change its sharing. Someone you shared an item *with* just sees it on their **My list** with a **by {name}** badge and can tick it off — they don't manage who else it's shared with.
 
@@ -97,7 +120,8 @@ Bag tracking is only available when an admin has enabled it.
 When enabled, a **Bags** panel appears as a right-hand sidebar on wide screens, or as a modal sheet on narrow screens (tap the **Bags** button in the header to open it). Each bag shows:
 
 - Name and color dot.
-- Total weight and a weight-limit progress bar (if a limit is set).
+- Total weight, and a weight limit if you set one. Click **Set limit** next to the weight (or the limit itself, to change it) and type the limit in kilograms — that is how airlines state them, and TREK stores it in grams. Clearing the field removes the limit again.
+- A fill bar. With a limit it reads against that limit; without one the bag is scaled against the heaviest bag, so bags stay comparable.
 - Member avatars assigned to that bag.
 - Item count.
 
@@ -105,7 +129,7 @@ The sidebar also shows an **unassigned** section for items that have no bag, and
 
 To use bags:
 
-1. Click **+ Add bag** to create a bag with a name and color.
+1. Click **+ Add bag** and type a name. The color dot is assigned automatically from a fixed palette; there is no color picker.
 2. Assign items to a bag using the bag picker on each item row (visible when bag tracking is enabled).
 3. Assign members to a bag using the member chip row on the bag card.
 
@@ -113,14 +137,14 @@ To use bags:
 
 You can save and reuse packing lists across trips:
 
-- **Save as Template** — click the **Save as Template** button in the header (visible when the list has items) to save the current list's items and categories as a named template.
+- **Save as template** (admins only) — click the **Save as template** button in the header to save the current list's items and categories as a named template. It only shows for instance admins, and only when the list has items.
 - **Apply Template** — if templates exist, an **Apply Template** dropdown appears in the header. Selecting a template appends its items to the current list without removing existing items.
 
 Templates are managed by admins in [Admin-Packing-Templates](Admin-Packing-Templates).
 
 ## Permissions
 
-All write operations require the `packing_edit` permission.
+All write operations require the `packing_edit` permission. Saving a list as a template on top of that requires an instance admin account; applying a template does not.
 
 ## See also
 
diff --git a/wiki/Packing-Templates.md b/wiki/Packing-Templates.md
index ad4813b29..dfdbbb029 100644
--- a/wiki/Packing-Templates.md
+++ b/wiki/Packing-Templates.md
@@ -12,13 +12,13 @@ Applying a template copies all categories and items from the template into the c
 
 Requires the `packing_edit` permission.
 
-The Apply Template button only appears when at least one template exists and you have edit permission.
+On the desktop planner the **Apply Template** button appears as soon as at least one template exists — it is not permission-gated in the UI. A member without `packing_edit` still sees it; the server refuses the apply with `403 No permission` and the app shows a *Failed to apply template* toast. On mobile the packing tab does gate it: the action menu that holds Apply Template only opens for members who have `packing_edit`.
 
 ## Saving the current list as a template
 
-In the packing panel toolbar, click the **Save as template** button (folder-plus icon) when items exist in the list. An inline name input appears in the toolbar — type a name and press **Enter** or click the confirm button. The current trip's categories and items are saved as a new reusable template.
+In the packing panel toolbar, click the **Save as template** button (folder-plus icon) when items exist in the list. An inline name input appears in the toolbar — type a name and press **Enter** or click the confirm button. The template captures the **Shared** pool plus your own items — other members' Personal items, and the items they shared with specific people, are deliberately left out. Only each item's name and category are stored; quantities, weights, bag assignments and checked state are not.
 
-The Save as Template button only appears when there are items in the list and you have `packing_edit` permission.
+The Save as Template button only appears when there are items in the list, you have the `packing_edit` permission, and you are an instance admin. Non-admins can apply templates but not create them; the API answers a non-admin with `403 Admin access required`.
 
 > **Admin:** Templates are created and managed in [Admin-Packing-Templates](Admin-Packing-Templates). Each template has a three-level structure: template → categories → items.
 
diff --git a/wiki/Passkeys.md b/wiki/Passkeys.md
index 6f6e7bc69..dff3f7f8d 100644
--- a/wiki/Passkeys.md
+++ b/wiki/Passkeys.md
@@ -59,7 +59,7 @@ Passkeys are bound to a domain (the *Relying Party ID*). If no usable domain res
 
 Both values can be pinned with environment variables, which take priority over the Admin panel fields:
 
-- `WEBAUTHN_RP_ID` — the registrable domain, e.g. `trek.example.com`. Bare IP addresses are rejected.
+- `WEBAUTHN_RP_ID` — the registrable domain, e.g. `trek.example.com`. A pinned value is used verbatim, so it has to be a real domain: browsers refuse a bare IP address as a Relying Party ID. TREK checks for one only on the RP ID it derives from `APP_URL` — an IP host there resolves to nothing and the feature reports itself as not configured.
 - `WEBAUTHN_ORIGINS` — comma-separated allowed origins, e.g. `https://trek.example.com`.
 
 See [Environment-Variables](Environment-Variables) for the full description of both.
diff --git a/wiki/Password-Reset.md b/wiki/Password-Reset.md
index 5526c501b..5c7dd9ab8 100644
--- a/wiki/Password-Reset.md
+++ b/wiki/Password-Reset.md
@@ -14,7 +14,7 @@ TREK supports email-based self-service password reset. On the login page, click
 2. Enter your email address and submit.
 3. Open the reset link from your email (or console) — valid for **60 minutes**.
 4. Enter a new password. If your account has **MFA enabled**, you must also supply a valid TOTP code or backup code before the reset completes.
-5. After a successful reset you are redirected to login. **All existing sessions are invalidated** — every device is signed out immediately.
+5. After a successful reset the page shows a **Password updated** confirmation ("You can now sign in with your new password.") with a **Sign In** button back to the login page — there is no automatic redirect. **All existing sessions are invalidated** — every device is signed out immediately.
 
 ### Security properties
 
@@ -35,21 +35,23 @@ The email delivery uses the same SMTP settings as other notification emails. See
 
 ### OIDC accounts
 
-Accounts that signed up via SSO and have no local password set cannot use the forgot-password flow — there is no local password to reset. The forgot-password page still shows the generic confirmation to avoid revealing whether the email is OIDC-only. Continue using [OIDC-SSO](OIDC-SSO) to sign in.
+Any account linked to an identity provider cannot use the forgot-password flow — one created by SSO, but equally a local account that was auto-linked to the IdP on its first SSO login. The forgot-password page still shows the generic confirmation to avoid revealing whether the email is SSO-linked. Continue using [OIDC-SSO](OIDC-SSO) to sign in; a local password can still be set by an admin, or by you from **Settings → Account** if you know your current one.
 
 ### Password login disabled
 
-If the admin has globally disabled password login, the forgot-password endpoint returns an error and the flow is unavailable.
+If the admin has globally disabled password login, no reset link is ever issued. For enumeration safety the endpoint still answers with the same generic confirmation, so the page looks exactly as it always does — the email (or the console line) simply never arrives. The refusal is recorded in the audit log as `user.password_reset_request` with `reason: password_login_disabled`.
 
 ## Admin-initiated reset
 
-An admin can set a new password for any user directly from the admin panel (**Admin → Users**). The admin enters a new password for the account, which is saved immediately — no email is required. The admin can also enable the **"Force password change on next login"** flag so the user is prompted to choose their own password the next time they sign in.
+An admin can set a new password for any user directly from the admin panel (**Admin → Users**, edit the user). Leaving the **New Password** field empty keeps the current password; entering one saves it immediately — no email is required. Setting a password this way also bumps the account's `password_version`, which signs the user out of every live session; separately, it deletes all of their MCP tokens and revokes their OAuth tokens.
+
+There is no **"Force password change on next login"** option in the Admin Panel. That prompt is raised only for the admin account TREK seeds on first boot and for accounts restored with the `reset-admin.js` recovery script (see [Troubleshooting](Troubleshooting)). An admin-set password neither raises the flag nor clears it, so a user who already carries it is still asked to choose their own password at the next sign-in.
 
 See [Admin-Users-and-Invites](Admin-Users-and-Invites) for step-by-step instructions.
 
 ## Password requirements
 
-When choosing a new password (whether via the reset flow, the forced-change prompt, or the normal **Settings → Security** page) the password must:
+When choosing a new password (whether via the reset flow, the forced-change prompt, or the **Change Password** form in **Settings → Account**) the password must:
 
 - Be at least **8 characters** long
 - Contain at least one **uppercase letter**
diff --git a/wiki/Photo-Providers.md b/wiki/Photo-Providers.md
index 5be8d8b57..97a6d304a 100644
--- a/wiki/Photo-Providers.md
+++ b/wiki/Photo-Providers.md
@@ -2,7 +2,7 @@
 
 TREK can browse your personal photo library on Immich or Synology Photos and attach selected photos to trips. TREK never copies the original files — it stores only a reference (provider name + asset ID) and proxies all image streams through its own server, so your provider credentials are never sent to the browser.
 
-> **Admin:** Enable at least one photo provider (Immich or Synology Photos) in **Admin → Addons** — photo provider toggles appear as sub-items under the **Journey** addon. Once a provider is on, a Photo Providers section appears in each user's **Settings → Integrations**. If your provider runs on a local or private network, the server must be configured to allow internal network access. See [Admin-Addons](Admin-Addons) and [Internal-Network-Access](Internal-Network-Access).
+> **Admin:** Enable at least one photo provider (Immich or Synology Photos) in **Admin → Addons** — photo provider toggles appear as sub-items under the **Journey** addon. Once a provider is on, its settings card appears in each user's **Settings → Integrations**. If your provider runs on a local or private network, the server must be configured to allow internal network access. See [Admin-Addons](Admin-Addons) and [Internal-Network-Access](Internal-Network-Access).
 
 ---
 
@@ -19,7 +19,7 @@ Both providers can be active at the same time.
 
 ## Configuring a provider
 
-Go to **Settings → Integrations → Photo Providers**. Each enabled provider shows its own settings section.
+Go to **Settings → Integrations**. Each enabled provider gets its own settings card there, titled with the provider's name — **Immich** and/or **Synology Photos**.
 
 <!-- TODO: screenshot: Photo Providers section in Settings > Integrations -->
 
@@ -56,8 +56,8 @@ TREK never modifies or deletes anything in Immich, so no `update`, `delete`, or
 | Server URL | Yes | Full URL including the Photos app path, e.g. `https://your-nas:5001/photo` |
 | Username | Yes | Synology account username |
 | Password | Yes | Stored encrypted; leave blank to keep the existing password |
-| OTP code | No | One-time password for 2FA; only needed on first connection or when re-authenticating |
-| Skip SSL verification | No | Checkbox; disable TLS certificate validation for self-signed certificates |
+| MFA code (if enabled) | No | One-time password for 2FA; only needed on first connection or when re-authenticating |
+| Skip SSL certificate verification | No | Checkbox; disable TLS certificate validation for self-signed certificates |
 
 #### Required DSM account permissions
 
diff --git a/wiki/Places-and-Search.md b/wiki/Places-and-Search.md
index 77cfc76ec..2fc2612ad 100644
--- a/wiki/Places-and-Search.md
+++ b/wiki/Places-and-Search.md
@@ -17,7 +17,7 @@ Type in the search box at the top of the form. After 2 or more characters, with
 
 ### With a Google Maps API key
 
-> **Admin:** A Google Maps API key is configured in [User-Settings](User-Settings).
+> **Admin:** The Google Maps API key is instance-wide, set in **Admin → Settings → API Keys**. It is stored encrypted at rest and used for every member of the instance; on managed instances the operator supplies it and the panel is hidden.
 
 When a key is present, the autocomplete uses the Google Places API, which can return ratings, opening hours, photos, and phone numbers from Google's database.
 
@@ -25,7 +25,7 @@ When a key is present, the autocomplete uses the Google Places API, which can re
 
 ### Without a Google Maps API key
 
-TREK falls back to OpenStreetMap (Nominatim) automatically — no API key needed. A notice appears above the search box explaining that OpenStreetMap is in use and that photos, ratings, and opening hours are unavailable. Results include name, address, and coordinates.
+TREK falls back to OpenStreetMap (Nominatim) automatically — no API key needed. A notice appears above the search box — *Using OpenStreetMap. A Google API key adds ratings and opening hours.* Results include name, address, and coordinates.
 
 ## Place details while searching
 
@@ -36,13 +36,13 @@ The column shows:
 - **Pictures** near or of the place. Click one to make it that place's thumbnail; click it again to clear the choice. The picture then appears everywhere the place does — list, map marker, itinerary, PDF export and shared trips — exactly like a [custom place image](#custom-place-image).
 - **A description**, when one is available. It is *not* written into the place automatically. Use **Use this text** to copy it into the description field; the button is disabled while you already have a description of your own, so nothing you wrote gets overwritten.
 
-Every picture is credited under its thumbnail with its author, its licence and a link to the source page. Most Wikimedia Commons pictures are CC BY or CC BY-SA, which means the credit has to travel with the picture — so once you pick one, the credit stays visible under the thumbnail in the place's detail panel too.
+One credit line sits under the picture grid, and it belongs to the picture in play: the tile you are hovering, or failing that the one you picked, or the first picture before you have done either. It names the author, links that name to the source page, and adds the licence with a link to its terms. The other tiles carry author and licence as a tooltip only, without the links. Google's pictures get an author line and nothing else, because Google grants no reusable licence for them. Most Wikimedia Commons pictures are CC BY or CC BY-SA, which means the credit has to travel with the picture, so once you pick one, the credit stays visible under the thumbnail in the place's detail panel too.
 
 ### Where the information comes from
 
 Wikipedia and OpenStreetMap are always used and need no configuration:
 
-- Pictures from **Wikimedia Commons**, found by coordinate.
+- Pictures from **Wikimedia Commons**, resolved from the place's own tags first — the Wikidata image, the lead image of its Wikipedia article, its Commons category — and falling back to a search by coordinate only when those turn up too few.
 - Descriptions from the OpenStreetMap `description` tag, or from the Wikipedia article the place is tagged with. TREK resolves the article from that tag rather than guessing it from the name, so an ambiguous name never pulls in the wrong article. A place with no such tag simply gets no description.
 
 With a Google Maps API key, and only if the matching admin switches are on, up to three **Google Places** photos and Google's editorial summary are added on top.
@@ -59,7 +59,7 @@ Paste a `maps.app.goo.gl/…`, `goo.gl/maps/…`, or `maps.google.*/…` URL dir
 
 ## Entering coordinates manually
 
-Type or paste a `lat, lng` pair (e.g. `48.8566, 2.3522`) into the **Latitude** field. TREK detects the comma-separated pair and fills both coordinate fields at once.
+**Paste** a `lat, lng` pair (e.g. `48.8566, 2.3522`) into the **Latitude** field — comma, semicolon or space separated. TREK detects the pair and fills both coordinate fields at once. This works on paste only: the coordinate fields accept digits, a decimal point and a leading minus, so typing a pair by hand drops the separator and leaves a single invalid number (`48.85662.3522`) behind. Type the two values into their own fields instead.
 
 ## Place fields
 
@@ -75,7 +75,7 @@ Type or paste a `lat, lng` pair (e.g. `48.8566, 2.3522`) into the **Latitude** f
 | Category | Pick an existing category or type a new name to create one inline (default color `#6366f1`, icon `MapPin`) |
 | Start time / End time | Shown only when editing an existing place |
 | Website | URL |
-| File attachments | Images or PDFs — click the Paperclip icon or paste from the clipboard |
+| File attachments | Click the Paperclip icon to attach a file, or paste an image or PDF from the clipboard. The Paperclip takes anything on the instance's **Allowed File Types** list — by default jpg, jpeg, png, gif, webp, heic, pdf, doc, docx, xls, xlsx, txt, csv, pkpass, pkpasses, md and markdown — plus video, which is exempt from that list. See [Documents-and-Files](Documents-and-Files) |
 
 Two inline warnings are shown when editing times: one if the end time is set to a value before or equal to the start time, and one if the times overlap with another place already assigned to the same day.
 
@@ -101,6 +101,6 @@ Imported tracks each get their own line colour so multiple routes stay apart on
 
 Importing the same list again does not duplicate what is already in the trip. A place is recognised by the provider id it was imported with (Google place id, Google feature id, or OSM id) before its name or its coordinates are considered, so renaming a place in TREK — or moving its pin — does not make it come back as a second copy on the next import.
 
-> **Admin:** Google Maps API key is set in [User-Settings](User-Settings). Without it, OSM search is used automatically.
+> **Admin:** The Google Maps API key is set instance-wide in **Admin → Settings → API Keys**. Without it, OSM search is used automatically.
 
 **See also:** [Day-Plans-and-Notes](Day-Plans-and-Notes) · [Map-Features](Map-Features) · [Tags-and-Categories](Tags-and-Categories)
diff --git a/wiki/Plugin-Cookbook.md b/wiki/Plugin-Cookbook.md
index 4f125815b..1979db3e5 100644
--- a/wiki/Plugin-Cookbook.md
+++ b/wiki/Plugin-Cookbook.md
@@ -10,7 +10,9 @@ for the permission catalogue see [[Plugin Permissions|Plugin-Permissions]].
 > need that user's `*_edit` permission. A read/write you're not allowed to do fails
 > loudly; it never silently escalates.
 
-The complete, runnable version of these recipes is the
+A runnable version of a handful of these recipes — reading a trip's places and
+bookings, raising validation warnings, contributing a place-detail row, and the
+entity metadata behind it — is the
 [`trip-doctor`](https://github.com/liketrek/TREK/tree/main/plugin-sdk/examples/trip-doctor)
 example plugin.
 
@@ -47,7 +49,8 @@ Both are membership-checked against the current user — same gate as `ctx.trips
 const place = await ctx.places.create(tripId, { name: 'Teamlab', lat: 35.62, lng: 139.78 })
 const day   = await ctx.days.create(tripId, { date: '2027-04-02', notes: 'Odaiba' })
 await ctx.itinerary.assign(tripId, day.id, place.id, 'buy tickets first')
-// days.create accepts { date?, notes?, position? }; set a day title later with ctx.days.update(tripId, day.id, { title: 'Odaiba' }).
+// days.create reads { date?, notes? } and always appends at the end — a position is honoured on the REST route only, not on the plugin path.
+// Set a day title later with ctx.days.update(tripId, day.id, { title: 'Odaiba' }).
 ```
 
 Updates and deletes mirror the REST app exactly (`ctx.places.update/delete`,
@@ -128,19 +131,22 @@ with core events.
 
 **Needs:** `events:subscribe`
 
-Handlers run with no user and get the event name + tripId only (never the payload).
+Handlers run with no user and get `{ event, tripId, entity?, entityId?, snapshot? }` —
+the `snapshot` (a whitelisted field view of the changed entity) is delivered only when
+your plugin also holds that family's `db:read:*` grant; deletes/bulk/reorder events
+carry none.
 
 ```js
 events: [
-  { on: 'file:created', async handler({ tripId }, ctx) {
-      await notifySlack(`New file on trip ${tripId}`)   // needs http:outbound
+  { on: 'file:created', async handler({ tripId, entityId }, ctx) {
+      await notifySlack(`New file on trip ${tripId}`)   // needs http:outbound:<host>
   } },
 ]
 ```
 
 Fire-and-forget on a short timeout — never blocks a core write. Trip reads are
-refused (no user); use `ctx.db`, `ctx.ws.*`, or an outbound call. Your own
-`plugin:*` broadcasts are never re-delivered, so handlers can't loop.
+refused (no user), and so are `ctx.ws.*` broadcasts; use `ctx.db` or an outbound
+call. Your own `plugin:*` broadcasts are never re-delivered, so handlers can't loop.
 
 ## Depend on another plugin — call it and hear its events
 
@@ -254,8 +260,8 @@ whole point: you can be handed someone's push token without being handed their t
 Targeting a **self-hosted** Gotify? Your manifest can't name the user's hostname, so add
 `"operatorEgress": true` and let the admin add the real host after install
 (Admin → Plugins → Allowed hosts). See
-[Plugin-Development → Operator-supplied egress hosts](Plugin-Development.md#operator-supplied-egress-hosts-operatoregress),
-plus [Notification channels](Plugin-Development.md#notification-channels) for the event list, the
+[Plugin-Development → Operator-supplied egress hosts](Plugin-Development#operator-supplied-egress-hosts-operatoregress),
+plus [Notification channels](Plugin-Development#notification-channels) for the event list, the
 "configured" rule, and the `TREK_PLUGIN_ALLOW_PRIVATE_EGRESS` flag you need if the service runs
 on your own LAN.
 
@@ -320,7 +326,7 @@ Output is **data**. To store it, push it through a gated write yourself (e.g. `c
 
 ## Call a third-party API the user connected
 
-**Needs:** `oauth:client` (and `http:outbound` for the fetch)
+**Needs:** `oauth:client` (and `http:outbound:<host>` for the fetch)
 
 The user connects the service under Settings → Plugins → Connect. The host keeps the refresh token and client secret; you only ever get a short-lived access token for the acting user.
 
@@ -350,7 +356,7 @@ Tenant-free and cached upstream — no trip access needed.
 
 **Needs:** `jobs:run`
 
-Two flavours: a fixed **cron job** declared in the manifest, or a **dynamic timer** you set at runtime via `ctx.scheduler`.
+Two flavours: a fixed **cron job** declared on the plugin definition, or a **dynamic timer** you set at runtime via `ctx.scheduler`.
 
 ```js
 module.exports = {
@@ -374,7 +380,7 @@ module.exports = {
 }
 ```
 
-Both jobs and scheduled tasks run with **no acting user** (trip reads are refused; only your own db + declared egress). `ctx.scheduler.set` is an upsert by name and survives restarts. Caps: ≤100 tasks/plugin, ≤128-char name, ≤8 KB payload, recurring interval ≥60s, ≤1 year out.
+Both jobs and scheduled tasks run with **no acting user** (trip reads are refused; only your own db + declared egress). `at`, `in` and `every` upsert by name — scheduling the same name again replaces the pending task — and survive restarts. Caps: ≤100 tasks/plugin, ≤128-char name, ≤8 KB payload, recurring interval ≥60s, ≤1 year out.
 
 ---
 
@@ -384,7 +390,7 @@ Seven declarative hooks let a plugin push data into TREK's own screens — the h
 
 ```js
 hooks: {
-  // hook:table-contributor — cells/buttons on a row. view ∈ reservations|places|day|costs|packing|files
+  // hook:table-contributor — cells/buttons on a row. view ∈ reservations|transports|places|day|costs|packing|files|todos
   tableContributor: { async getContributions(view, tripId, ctx) {
     return [{ kind: 'column', entityId: 42, id: 'crowd', label: 'Crowd', value: 'Quiet', tone: 'success' }]
   } },
@@ -599,7 +605,7 @@ module.exports = {
 
 ## Write across every subsystem
 
-Beyond places/days/itinerary, TREK 3.3.0 opens create/update/delete on almost every trip subsystem. Each is membership-checked against the acting user and needs its `db:write:*` scope **plus** the app's edit permission — declare only what you use.
+Beyond places/days/itinerary, TREK opens create/update/delete on almost every trip subsystem. Each is membership-checked against the acting user and needs its `db:write:*` scope **plus** the app's edit permission — declare only what you use.
 
 ```js
 // Bookings & lodging — needs 'reservation_edit' / 'day_edit'
@@ -609,11 +615,11 @@ await ctx.accommodations.create(tripId, { place_id, start_day_id, end_day_id, ch
 await ctx.packing.create(tripId, { name: 'Passport', visibility: 'personal' })
 await ctx.todos.create(tripId, { name: 'Buy JR pass', due_date: '2027-04-01' })
 // Costs (budget) — needs 'budget_edit' + the Costs addon
-await ctx.costs.create(tripId, { title: 'Hotel', amount: 120, currency: 'EUR' })
+await ctx.costs.create(tripId, { name: 'Hotel', total_price: 120, currency: 'EUR' })
 // Collab notes/polls/chat — needs 'collab_edit' + the Collab addon
 await ctx.collab.createNote(tripId, { title: 'Meeting point' })
 // Day notes — needs 'day_edit'
-await ctx.daynotes.create(tripId, dayId, { content: 'Rainy — swap plans' })
+await ctx.daynotes.create(tripId, dayId, { text: 'Rainy — swap plans' })
 // Tags (the acting user's own)
 const tag = await ctx.tags.create({ name: 'foodie', color: '#4F46E5' })
 ```
diff --git a/wiki/Plugin-Development.md b/wiki/Plugin-Development.md
index 327f18a87..45e2969d9 100644
--- a/wiki/Plugin-Development.md
+++ b/wiki/Plugin-Development.md
@@ -50,9 +50,11 @@ my-plugin/
   .gitattributes        # LF everywhere, so the packed artifact's sha256 is reproducible
 ```
 
-The scaffold declares `"trek": ">=3.4.0 <4.0.0"` — the `ctx` namespaces it is written
-against only exist from 3.4.0, and claiming an older floor would let the plugin install
-on a host where they are `undefined`.
+The scaffold declares `"trek": ">=4.0.0 <5.0.0"` — the host surface it is written
+against is the TREK 4 surface, and claiming an older floor would let the plugin
+install on a host where parts of it are missing. Picking `oauth:client` in the wizard
+also scaffolds the five instance-scope settings the OAuth broker reads (see
+[Host-brokered OAuth](#host-brokered-oauth-ctxoauth)).
 
 What you get **runs and packs immediately**, but it does **not** pass `validate` yet:
 the README is still a template and there is no screenshot. That is deliberate — those
@@ -137,11 +139,9 @@ permissions still requires explicit re-consent).
 
 ## The plugin types
 
-- **integration** — background logic (jobs, routes) with no UI of its own. Most
-  provider hooks are **live** (placeDetailProvider, warningProvider,
-  tableContributor, mapMarkerProvider, mapLayerProvider, pdfSectionProvider,
-  atlasLayerProvider, journalEntryProvider); only `photoProvider` / `calendarSource` are declared in the
-  SDK but **not yet wired into the host** — see [Provider hooks](#provider-hooks).
+- **integration** — background logic (jobs, routes) with no UI of its own. Every
+  provider hook is **live** — from placeDetailProvider and warningProvider through
+  photoProvider (Memories) and calendarSource — see [Provider hooks](#provider-hooks).
 - **page** — adds a nav entry that opens a full-page sandboxed iframe.
 - **widget** — adds a card to the dashboard (`sidebar` slot), a hero-bar overlay
   (`hero` slot), a panel inside the trip planner's **place-detail** view
@@ -237,21 +237,21 @@ module.exports = definePlugin({
 
 The routes and job ids you declare here are the **authoritative** ones: the host
 reads them off your loaded definition (a route's array index is its internal id).
-The `routes` block the scaffold writes into `trek-plugin.json` is only a
-declaration for readers — the manifest parser does not consume it.
+The scaffold writes no `routes` block into `trek-plugin.json`, and the manifest
+parser would ignore one if you added it.
 
 ### The `ctx` object
 
 | Area | Methods | Requires |
 |---|---|---|
-| `ctx.db` | `query(sql, …args)` / `exec(sql, …args)` / `migrate(id, sql)` / `tx(ops)` against your **own** SQLite file. `tx([{sql, args?}, …])` runs up to 100 statements in one transaction (all commit or all roll back; reads see the batch's own earlier writes) → `{ results: [{changes?}|{rows?}, …] }` | `db:own` |
+| `ctx.db` | `query(sql, …args)` / `exec(sql, …args)` / `migrate(id, sql)` / `tx(ops)` against your **own** SQLite file. `tx([{sql, args?}, …])` runs up to 100 statements in one transaction (all commit or all roll back; reads see the batch's own earlier writes) → `{ results: [{changes?}\|{rows?}, …] }`. Your file is capped at **256 MB** (a write past it fails `SQLITE_FULL`, contained to your plugin) and a single result set at **100,000 rows** — page your reads instead of materialising a cartesian product | `db:own` |
 | `ctx.trips` | `getById` / `getPlaces` / `getReservations` / `getDays` / `getAccommodations` / `listMine()` — enumerate every trip the acting user can access (membership-checked). `getDays` includes each day's `assignments` + `notes_items`; `getReservations` includes `endpoints` + `day_positions` | `db:read:trips` |
 | `ctx.trips.update(tripId, fields)` | update trip fields (title/dates/currency/reminder_days/…) | `db:write:trips` |
 | `ctx.trips.create(input)` | create a **new trip owned by the acting user** (importers) — `title` required, plus `description?`/`start_date?`/`end_date?`/`currency?`/`reminder_days?`/`day_count?` | `db:create:trips` (+ `trip_create`) |
 | `ctx.places` | `create(tripId, fields)` / `update(tripId, placeId, fields)` / `delete(tripId, placeId)` | `db:write:places` |
 | `ctx.days` | `create(tripId, {date?, notes?})` / `update(tripId, dayId, {notes?, title?})` / `delete(tripId, dayId)` | `db:write:days` |
 | `ctx.itinerary` | `assign(tripId, dayId, placeId, notes?)` / `unassign(tripId, assignmentId)` — place↔day | `db:write:itinerary` |
-| `ctx.meta` | `get` / `set` / `list` / `delete` your **own** namespaced data on a `trip`/`place`/`day` (enrich core entities without forking the schema) | `db:meta` |
+| `ctx.meta` | `get` / `set` / `list` / `delete` your **own** namespaced data on a `trip`/`place`/`day`/`reservation`/`accommodation` (enrich core entities without forking the schema) | `db:meta` |
 | `ctx.packing` | `list(tripId)` — a trip's packing items (membership-checked, respects private-item visibility) | `db:read:packing` |
 | `ctx.files` | `list(tripId)` — a trip's files, trash excluded (membership-checked) | `db:read:files` |
 | `ctx.files.getContent` | `getContent(tripId, fileId)` → `{ name, mimetype, size, content_base64 }` — a file's bytes as base64 (10MB cap; trashed files refused) | `db:read:files:content` |
@@ -333,15 +333,56 @@ validated against TREK's budget schema, and a successful create broadcasts the s
 Routes are authenticated by default (`req.user` is the logged-in user). Set
 `auth: false` for OAuth callbacks or webhooks that can't carry a session.
 
-The proxy forwards `{ method, path, query, body, headers, user }`. **`req.headers`
-is populated ONLY on `auth: false` routes** (an authenticated route gets `{}`) and
-only an explicit, credential-free **allowlist** — the common provider signature +
-event headers (`stripe-signature`, `x-hub-signature-256`, `svix-signature`,
-`x-gitlab-event`, `content-type`, `user-agent`, …). **`Cookie`, `Authorization`,
-`X-Socket-Id` and every session/forwarded-auth header are stripped** and never reach
-your code, so a forwarded header can't leak a TREK session. To trust a webhook,
-verify the provider's signature over the raw body against a secret you hold in
-`ctx.config` (admin-set instance setting) or `ctx.settings` (per-user).
+The proxy forwards `{ method, path, query, body, rawBodyBase64, headers, user }`.
+**`req.headers` is populated ONLY on `auth: false` routes** (an authenticated route
+gets `{}`) and only an explicit, credential-free **allowlist** — the common provider
+signature + event headers (`stripe-signature`, `x-hub-signature-256`,
+`svix-signature`, `x-gitlab-event`, `content-type`, `user-agent`, …). **`Cookie`,
+`Authorization`, `X-Socket-Id` and every session/forwarded-auth header are stripped**
+and never reach your code, so a forwarded header can't leak a TREK session.
+
+**`req.rawBodyBase64` is webhook-only in the same way** — the exact request bytes,
+base64-encoded, on `auth: false` routes, and absent on an authenticated route, which
+never needs them. To trust a webhook, verify the provider's signature over *those*
+bytes against a secret you hold in `ctx.config` (admin-set instance setting) or
+`ctx.settings` (per-user). Never re-serialize `req.body` for the check:
+`JSON.stringify` won't reproduce the key order, whitespace and unicode escaping the
+sender signed, so the HMAC won't match.
+
+The snippet below handles two things, and yours has to as well. TREK only keeps the
+raw bytes when a body parser ran, i.e. for `application/json` and
+`application/x-www-form-urlencoded` — a webhook posted as `text/plain` or a GET
+callback with no body arrives with `rawBodyBase64: null`, so **fail closed** instead
+of running the HMAC over an empty buffer, which is a constant anyone can forge. And
+the request body ceiling is 100 kB; a larger payload is rejected before your route
+runs.
+
+```js
+const crypto = require('node:crypto')
+
+if (typeof req.rawBodyBase64 !== 'string') return { status: 400, body: { error: 'no raw body' } }
+const raw  = Buffer.from(req.rawBodyBase64, 'base64')
+const mac  = crypto.createHmac('sha256', ctx.config.webhookSecret).update(raw).digest()
+const sent = Buffer.from(String(req.headers['x-hub-signature-256'] || '').replace(/^sha256=/, ''), 'hex')
+if (sent.length !== mac.length || !crypto.timingSafeEqual(mac, sent)) return { status: 401, body: { error: 'bad signature' } }
+```
+
+### Runtime limits
+
+The host enforces these on every plugin. They are generous for real work and only
+bite a runaway one, but they are exactly what a plugin that loops over `ctx.*` or
+stores blobs in `ctx.db` runs into, so build against them.
+
+| Area | Limit |
+|---|---|
+| every `ctx.*` call | burst 60, sustained 20/s, 16 in-flight per plugin; a throttled call is refused with `HOST_ERROR: rate limit exceeded — slow down ctx.* calls`. Tunable with `TREK_PLUGIN_RPC_BURST` / `TREK_PLUGIN_RPC_PER_SEC` / `TREK_PLUGIN_RPC_INFLIGHT` (see [Environment-Variables](Environment-Variables#plugins)) |
+| `ctx.db` | 256 MB per plugin, one result set capped at 100,000 rows |
+| event subscriptions | 200 events buffered per plugin while it restarts, dropped unreplayed after 15 minutes |
+| the plugin process | 300 MB RSS (`TREK_PLUGIN_MAX_RSS_MB`) — the child is killed past it; auto-disabled with status `error` after 5 crashes inside a 5-minute window |
+
+The daily `ctx.ai` / `ctx.notify` budgets and the `ctx.meta` quotas are in
+[Testing without a running TREK](#testing-without-a-running-trek), because the mock
+host enforces those too.
 
 ## Writing the client (page / widget)
 
@@ -660,10 +701,12 @@ context, so media queries inside it measure the frame, and they work.
 ## Settings
 
 Declare settings in the manifest; TREK renders the form (you write no settings
-UI). `scope: "instance"` settings are set once by the admin; `scope: "user"`
-settings are per-user. `secret: true` fields are stored encrypted and delivered
-decrypted through `ctx.config` (server-side only) — never to the iframe. Resolved
-values arrive in `ctx.config`.
+UI). `scope: "instance"` settings are set once by the admin and arrive resolved in
+`ctx.config`; `scope: "user"` settings are per-user and are read one key at a time
+with `await ctx.settings.get(key)` (a userless job / `onLoad` gets `undefined` —
+fall back to `ctx.config` there). `secret: true` fields are stored encrypted and
+delivered decrypted through whichever of the two applies (server-side only) —
+never to the iframe.
 
 ### A custom settings page (`capabilities.settingsUi`)
 
@@ -681,7 +724,7 @@ simply ignore the flag, so declaring it never breaks an install.
 
 A plugin can act as an OAuth *client* of a third-party service **without ever handling the secrets**. The **host** runs the entire flow — authorize → callback → token exchange → refresh — with PKCE (S256) and a `state` check, and holds the tokens. The plugin only triggers "connect" and reads a **short-lived access token** at runtime.
 
-**Setup.** Declare the provider as `scope: "instance"` settings the admin fills in: `oauth_authorize_url`, `oauth_token_url`, `oauth_scopes` (optional), plus the two `secret: true` fields `oauth_client_id` and `oauth_client_secret`. (A settings field may also carry an `oauth: { initPath, callbackPath }` block.)
+**Setup.** Declare the provider as `scope: "instance"` settings the admin fills in: `oauth_authorize_url`, `oauth_token_url`, `oauth_scopes` (optional), plus `oauth_client_id` and the `secret: true` `oauth_client_secret`. (A settings field may also carry an `oauth: { initPath, callbackPath }` block.) `trek-plugin create` scaffolds all five for you when you pick the `oauth:client` permission.
 
 **Connecting.** A user connects under **Settings → Plugins → Connect**, which sends them to the provider's authorize page. The callback returns to `…/api/plugin-oauth/<id>/callback`; the host verifies the `state` (single-use, 10-minute TTL, bound to that user — CSRF defence), exchanges the code and stores the tokens **per user, encrypted at rest**.
 
@@ -703,8 +746,8 @@ if (!token) return { status: 401, body: 'connect this plugin first' }
 Grant `hook:user-data` and implement either handler to honour data-subject rights. Both are **userless** — the plugin only receives the `userId` and acts on its **own** `ctx.db`:
 
 ```js
+// trek-plugin.json: "permissions": ["db:own", "hook:user-data"]
 module.exports = definePlugin({
-  permissions: ['db:own', 'hook:user-data'],
   async deleteUserData({ userId }, ctx) {           // erasure
     await ctx.db.exec('DELETE FROM my_prefs WHERE user_id = ?', userId)
   },
@@ -750,7 +793,7 @@ module.exports = definePlugin({
 | `pdfSectionProvider.getSections(tripId, ctx)` → `PdfSection[]` | `hook:pdf-section-provider` | **live** — text-only sections appended to the trip PDF export. Each is `{title, paragraphs?, table?}`; the host escapes and lays everything out itself (no markup ever reaches the document), caps counts (≤5 sections/plugin, ≤20 paragraphs, ≤8 headers, ≤50 rows) + lengths (title 120, paragraph 2000, header 60, cell 200) and clips rows to the header width. Also `GET /api/pdf-sections/:tripId` |
 | `atlasLayerProvider.getLayers(ctx)` → `AtlasLayer[]` | `hook:atlas-layer-provider` | **live** — country tint layers drawn over the Atlas world map (wishlists, advisories, …). **User-scoped**: the host binds the acting user, the hook takes no target parameter. Each layer is `{id, name?, countries: [{code, tone?, label?}]}`; codes must be ISO-3166 alpha-2 (uppercase-coerced), tone is enum-whitelisted, counts capped (≤3 layers/plugin, ≤300 countries/layer). Declarative only — plugin JS never runs on the map canvas. Also `GET /api/atlas-layers` |
 | `journalEntryProvider.getRows(entryId, ctx)` → `{ label, value?, url? }[]` | `hook:journal-entry-provider` | **live** — extra rows rendered under a journal entry card (needs the Journey addon; the entry's journey is access-checked like the journal detail routes). Same hardening as place details plus server-side normalization: ≤12 rows/plugin, label ≤60, value ≤200, url http/https/mailto-only. Also `GET /api/journal-entry-rows/:entryId` |
-| `tripCardProvider.getCards(tripIds, ctx)` → `TripCardContribution[]` | `hook:trip-card-provider` | **live** — small badges on the dashboard trip cards. Called ONCE with all visible `tripIds` (each already access-checked for the acting user), returns `{ tripId, id, label, value?, icon?, tone?, url? }[]`; the host bounds every field (label 64, value 256, tone enum, url http/https/mailto-only), caps the count (≤40/plugin) and drops any badge whose `tripId` wasn't requested. Declarative only. Also `GET /api/trip-card-contributions?tripIds=…` |
+| `tripCardProvider.getCards(tripIds, ctx)` → `TripCardContribution[]` | `hook:trip-card-provider` | **live** — small badges on the dashboard trip cards. Called ONCE with all visible `tripIds` (each already access-checked for the acting user), returns `{ tripId, id, label, value?, icon?, tone?, url? }[]`; the host bounds every field (label 64, value 256, tone enum, url http/https/mailto-only), caps the count (≤4 badges per trip, ≤240 total per plugin) and drops any badge whose `tripId` wasn't requested. Declarative only. Also `GET /api/trip-card-contributions?tripIds=…` |
 | `photoProvider.search(query, {page, limit}, ctx)` / `.getById(id, ctx)` | `hook:photo-provider` | **live** — plugin photo sources aggregated at `GET /api/plugin-photos/search` (+ `/sources`, `/item`) for the picker. Each `{id, title?, thumbnailUrl, fullUrl, takenAt?}`; thumbnail/full URLs must be http/https, per-source count capped, a failing source skipped |
 | `calendarSource.getName(ctx)` / `.getEvents(userId, start, end, ctx)` | `hook:calendar-source` | **live** — plugin calendar events aggregated for the signed-in user at `GET /api/plugin-calendar?start=&end=`. Each `{id, title, start, end, allDay}` (ISO dates); count capped, a failing source skipped |
 | `notificationChannel.send(msg, config, ctx)` / `.test(config, ctx)` | `hook:notification-channel` | **live** — registers a new notification channel. **Userless** (see below). See [Notification channels](#notification-channels) |
@@ -819,9 +862,19 @@ also being given the right to read their trips as them.
 Notes:
 
 - **`title`** names the column in the notification preferences matrix (defaults to your
-  plugin's name). **`events`** may *narrow* which events the channel carries; the default is
-  every non-admin event. Admin-scoped events (`version_available`) are never deliverable to a
-  plugin channel — those go over the admin's own credentials.
+  plugin's name). **`events`** may *narrow* which events the channel carries; omit it and
+  the channel carries all ten deliverable events: `trip_invite`, `booking_change`,
+  `trip_reminder`, `todo_due`, `vacay_invite`, `collection_invite`, `photos_shared`,
+  `collab_message`, `packing_tagged`, `plugin_notification`. The SDK exports the same list
+  as `CHANNEL_EVENTS`, and both `trek-plugin validate` and the installer refuse anything
+  outside it with `capabilities.notificationChannel.events: "x" is not a plugin-deliverable
+  event`.
+
+  The four events TREK sends that a plugin channel never carries are the admin-scoped
+  `version_available` and `replica_failure` (those go over the admin's own credentials),
+  the in-app-only `synology_session_cleared`, and `vacay_share`. Don't read the set off the
+  table in [Notifications](Notifications) — that one lists what a user can toggle, not what
+  a channel can carry.
 - **Configured-ness is inferred, not asked.** A user's column is "not configured" until every
   `required`, `scope:'user'` field has a value. A plugin with no required user fields counts as
   configured for everyone (an instance-wide channel, e.g. a shared workspace webhook).
@@ -938,8 +991,8 @@ place/day/reservation/accommodation/assignment/trip, `db:read:costs` for budget,
 file). Without that grant you get exactly the id hint, as before:
 
 ```js
+// trek-plugin.json: "permissions": ["events:subscribe", "db:read:trips"]
 module.exports = definePlugin({
-  permissions: ['events:subscribe', 'db:read:trips'],
   events: [
     { on: 'reservation:created', async handler({ event, tripId, entityId, snapshot }, ctx) {
         // with db:read:trips the snapshot carries the reservation's fields
@@ -962,8 +1015,10 @@ Delivery is fire-and-forget on a short timeout, so a slow subscriber never block
 core write. Because there's no user, trip reads (`ctx.trips.*`) are refused inside a
 handler — beyond the snapshot, use the plugin's own `ctx.db`, `ctx.ws.*`, or an
 outbound call. A plugin's own `plugin:*` broadcasts are never delivered back, so
-handlers can't loop. Common events: `place:*`, `day:*`, `assignment:*`, `budget:*`,
-`file:*`, `accommodation:*`.
+handlers can't loop. Event names follow `<family>:<verb>` (`place:created`,
+`day:updated`, `file:*`, `assignment:*`, `budget:*`, `accommodation:*`, …); the SDK
+exports the authoritative family list and the snapshot-grant mapping as
+`EVENT_FAMILIES` and `EVENT_SNAPSHOT_GRANT`.
 
 ## Dependencies
 
@@ -1093,10 +1148,14 @@ import { createMockHost } from 'trek-plugin-sdk/testing'
 
 const { ctx, broadcasts } = createMockHost({
   grants: ['db:read:trips'],
-  trips: { 1: { members: [42], data: { id: 1, name: 'Japan' } } },
+  actingUserId: 42,                                   // the user every read is checked against
+  trips: {
+    1: { members: [42], data: { id: 1, name: 'Japan' } },
+    2: { members: [99], data: { id: 2, name: 'Peru' } },
+  },
 })
-await ctx.trips.getById(1, 42)                        // ok — member
-await expect(ctx.trips.getById(1, 99)).rejects…       // RESOURCE_FORBIDDEN
+await ctx.trips.getById(1)                            // ok — member
+await expect(ctx.trips.getById(2)).rejects…           // RESOURCE_FORBIDDEN
 await expect(ctx.db.query('SELECT 1')).rejects…       // PERMISSION_DENIED (no db:own)
 ```
 
@@ -1105,6 +1164,13 @@ integration test for real SQL. To test inter-plugin calls, pass
 `pluginExports: { koffi: { convert: (args) => … } }` and assert on `mock.emitted`
 for anything your plugin publishes via `ctx.events.emit`.
 
+The mock also enforces the host's operational limits, so a test can prove your
+plugin backs off correctly: the **daily AI and notification budgets** (defaults
+200 / 100 per day; configure with `aiPerDay` / `notifyPerDay` — `0` disables the
+broker entirely, the exhausted call fails with the host's exact error) and the
+**`ctx.meta` quotas** (≤256-char keys, ≤64 KB serialized values, ≤100 keys per
+entity).
+
 ### Driving your plugin's handlers
 
 `createMockHost` also gives you `run(def)` — the other half of a test. Where the
@@ -1182,13 +1248,14 @@ what your manifest declares.
 | `id` | string, **required** | lowercase slug, `^[a-z][a-z0-9-]{2,39}$` (3–40 chars). Must match the directory name. |
 | `name` | string, **required** | display name; also the page nav label. |
 | `version` | string, **required** | semver (`1.2.3`, optional pre-release). |
-| `apiVersion` | number | plugin API version (currently `1`; `PLUGIN_API_VERSION`). Defaults to `1`. |
+| `apiVersion` | number | plugin API version (currently `1`; `PLUGIN_API_VERSION`). Defaults to `1`; must be a positive integer, and a version newer than the host supports is refused at install and won't activate (`API_VERSION_INCOMPATIBLE`). |
 | `type` | string, **required** | `integration` \| `page` \| `widget` \| `trip-page`. |
-| `trek` | string, **required** | the TREK versions this plugin supports, as a semver **range**: `">=3.4.0 <4.0.0"` (what the scaffold writes). Must be *satisfiable* (`">=4.0.0 <3.0.0"` parses but nothing can satisfy it — rejected). **Enforced at install and at activation** (see below); it is copied verbatim onto the registry entry, which is the entry's only compatibility field. Keep it **bounded** — an unbounded range claims support for TREK versions that do not exist yet. |
+| `trek` | string, **required** | the TREK versions this plugin supports, as a semver **range**: `">=4.0.0 <5.0.0"` (what the scaffold writes). Must be *satisfiable* (`">=4.0.0 <3.0.0"` parses but nothing can satisfy it — rejected). **Enforced at install and at activation** (see below); it is copied verbatim onto the registry entry, which is the entry's only compatibility field. Keep it **bounded** — an unbounded range claims support for TREK versions that do not exist yet. |
 | `author` | string | shown in the store. |
 | `description` | string | one-line summary for the store. |
 | `icon` | string | lucide-react icon name (default `Blocks`); used for the page nav entry. |
 | `homepage` | string | project URL. |
+| `tags` | string[] | store keywords, copied verbatim onto the registry entry. Each must be a lowercase slug of 2–24 chars (`[a-z0-9-]`), at most 8 — `validate` rejects a capital or a space, because the registry's schema does. |
 | `license` | string | shown in the store detail (read from the manifest, not enforced). |
 | `nativeModules` | boolean | must be `false`/absent — `true` is rejected. |
 | `permissions` | string[] | see below. |
@@ -1197,7 +1264,7 @@ what your manifest declares.
 | `capabilities.tripPage` | object | `{ replaces?, position? }` for `trip-page` plugins — `replaces` names core planner tabs to hide while active (`transports`, `buchungen`, `listen`, `finanzplan`, `dateien`, `collab`; never `plan`), `position` is the tab's 0-based index in the bar (0–50; omitted = appended). |
 | `actions` | array | Buttons on the plugin's own settings page — `{ key, label, hint?, danger? }` (max 8). Implement each as `actions[key](ctx)` on the definition. **User-initiated**, so `ctx.settings.get()` returns the clicking user's value. See [Settings-page actions](#settings-page-actions). |
 | `operatorEgress` | boolean | The plugin talks to a **self-hosted** service whose hostname only the operator knows. The admin adds the real hosts after install (Admin → Plugins → Allowed hosts) and the runtime unions them into the egress allow-list. Requires an `http:outbound` permission, and is the only way to declare one with an empty `egress[]`. See [Operator-supplied egress hosts](#operator-supplied-egress-hosts-operatoregress). |
-| `capabilities.notificationChannel` | object | `{ title?, events? }` for a plugin implementing the `notificationChannel` hook — `title` names the column in the notification preferences matrix (default: the plugin's `name`), `events` **narrows** which events the channel carries (default: every non-admin event; admin-scoped events are never deliverable). Requires the `hook:notification-channel` permission. See [Notification channels](#notification-channels). |
+| `capabilities.notificationChannel` | object | `{ title?, events? }` for a plugin implementing the `notificationChannel` hook — `title` names the column in the notification preferences matrix (default: the plugin's `name`), `events` **narrows** which events the channel carries (default: all ten plugin-deliverable events; `events` may only narrow that set). Requires the `hook:notification-channel` permission. See [Notification channels](#notification-channels). |
 | `capabilities.routeProfiles` | array | up to 3 `{ id, label, icon? }` entries for a plugin implementing the `routeProvider` hook — each becomes a selectable mode in the planner's route toggle (next to Driving/Walking). `id` is lowercase `[a-z][a-z0-9-]` (max 24 chars) and is what `getRoute` receives as `request.profile`; `label` (≤40 chars) is shown to the user. Requires the `hook:route-provider` permission. |
 | `capabilities.provides` | string[] | function names this plugin exposes to its dependents via `ctx.plugins.call` (see [Talking to other plugins](#talking-to-other-plugins)). |
 | `capabilities.emits` | string[] | event names this plugin publishes to its dependents via `ctx.events.emit`. |
@@ -1232,9 +1299,10 @@ build arg defaults to the literal `dev` — has nothing to compare a range again
 the check is skipped and an unversioned build installs anything. Plugins should still
 guard optional `ctx.*` namespaces.
 
-**Permissions** — the commonly-used core subset below; the **full list of ~50**
+**Permissions** — the commonly-used core subset below; the **full list of 63**
 (all read/write scopes, the notify/ai/oauth brokers, every provider hook) lives in
-**[[Plugin Permissions|Plugin-Permissions]]**. Unknown values are rejected at activation.
+**[[Plugin Permissions|Plugin-Permissions]]**. Unknown values are rejected at install
+(and by `trek-plugin validate` and registry CI, which check against the same list).
 
 | Permission | Grants |
 |---|---|
@@ -1252,7 +1320,7 @@ guard optional `ctx.*` namespaces.
 | `db:meta` | `ctx.meta.*` — your own namespaced data on a trip/place/day/reservation/accommodation |
 | `db:read:users` | `ctx.users.getById` |
 | `events:subscribe` | receive core activity events via `events: [...]` (event name + tripId + a { entity, entityId } hint, plus a whitelisted entity **snapshot** when the plugin also holds the family's `db:read:*` grant; never a user) |
-| `hook:trip-card-provider` | `hooks.tripCardProvider` — small badges on the dashboard trip cards |
+| `hook:trip-card-provider` | `hooks.tripCardProvider` — small badges on the dashboard trip cards (`getCards(tripIds, ctx)` → `{ tripId, id, label, value?, icon?, tone?, url? }[]`; `id` is required — a badge without one is dropped; the host bounds every field and access-checks each tripId) |
 | `jobs:run` | run declared background `jobs` on their cron schedule **and** `ctx.scheduler` runtime timers → `scheduled` handler (opt-in; no user, so trip reads are refused) |
 | `ws:broadcast:trip` | `ctx.ws.broadcastToTrip` |
 | `ws:broadcast:user` | `ctx.ws.broadcastToUser` |
@@ -1268,9 +1336,9 @@ guard optional `ctx.*` namespaces.
 | `hook:pdf-section-provider` | `hooks.pdfSectionProvider` — sections appended to the trip PDF export |
 | `hook:atlas-layer-provider` | `hooks.atlasLayerProvider` — per-user country tint layers on the Atlas map |
 | `hook:journal-entry-provider` | `hooks.journalEntryProvider` — extra rows on a journal entry card |
-| `hook:trip-card-provider` | `hooks.tripCardProvider` — small badges on the dashboard trip cards (`getCards(tripIds, ctx)` → `{ tripId, label, value?, icon?, tone?, url? }[]`; host bounds every field + access-checks each tripId) |
 | `hook:user-data` | `deleteUserData` / `exportUserData` handlers — honour GDPR erasure (durable, retried) and data-export for a deleted/requesting user (userless; own db only) |
-| `hook:photo-provider` / `hook:calendar-source` | reserved (see [Provider hooks](#provider-hooks)) |
+| `hook:photo-provider` | `hooks.photoProvider` — a photo source for Memories, aggregated at `GET /api/plugin-photos/search` (see [Provider hooks](#provider-hooks)) |
+| `hook:calendar-source` | `hooks.calendarSource` — calendar events for the signed-in user, aggregated at `GET /api/plugin-calendar` (see [Provider hooks](#provider-hooks)) |
 
 > There is **no `ws:broadcast:*`** — use `ws:broadcast:trip` and/or
 > `ws:broadcast:user` explicitly.
@@ -1286,14 +1354,14 @@ guard optional `ctx.*` namespaces.
 | `required` | boolean. |
 | `secret` | boolean — encrypted at rest, decrypted only into `ctx.config`. |
 | `placeholder`, `hint` | form hints. |
-| `options` | `[{ value, label }]` for select inputs. |
+| `options` | `[{ value, label }]` for select inputs; bare strings/numbers are accepted and coerced, but an option needs a non-empty `value`. |
 | `oauth` | `{ initPath, callbackPath }` for OAuth flows. |
 
 **Page nav:** the host builds a page plugin's nav entry from the top-level `name`
-and `icon` — the installed-manifest parser only consumes `capabilities.widget`, so
-there is nothing else to set. `icon` must be a real lucide name: TREK resolves it at
-render time and silently falls back to `Blocks`, which makes a typo invisible locally,
-so `validate` rejects one.
+and `icon` — there is no `capabilities.nav`, so there is nothing else to set.
+`icon` must be a real lucide name: TREK resolves it at render time and silently
+falls back to `Blocks`, which makes a typo invisible locally, so `validate`
+rejects one.
 
 See [[Plugin Permissions|Plugin-Permissions]] for the full permission model.
 
@@ -1307,7 +1375,7 @@ whatever else it needs. Pass a command explicitly to skip the menu (and for scri
 CI). `trek-plugin help <command>` — or `trek-plugin <command> --help` — prints a full
 page for any command.
 
-**The path is four commands**, and the other nine are steps one of them already does:
+**The path is four commands**, and the other ten are steps one of them already does:
 
 ```bash
 trek-plugin create [name] [--type integration|page|widget|trip-page]
@@ -1362,12 +1430,19 @@ trek-plugin release [dir] --repo owner/name --tag vX.Y.Z [--sign] [--merge entry
 
 # Fork the registry, write registry/plugins/<id>.json, open the PR. Needs `gh`.
 trek-plugin submit [dir] --repo owner/name --tag vX.Y.Z [--registry o/n] [--draft]
+
+# Delete a stranded release + remote tag + local tag in one go. Checks the published
+# registry index first and REFUSES a version that is actually published (immutable);
+# --yes consents when the index can't be reached.
+trek-plugin unrelease vX.Y.Z [dir] --repo owner/name [--yes]
 ```
 
 `publish` chains those last steps in the order that matters: **check → pack → release →
 preflight → submit**. The local gates run *before* anything is tagged or released,
-because a GitHub release is effectively immutable — the registry pins its sha256. See
-[[Publishing a Plugin|Plugin-Publishing]].
+because a GitHub release is effectively immutable — the registry pins its sha256 —
+and a failure *after* the release is cut rolls back everything that run created (the
+release, both tags), so the same tag is free to re-run against (`--keep-release`
+opts out). See [[Publishing a Plugin|Plugin-Publishing]].
 
 ## Registry & publishing
 
diff --git a/wiki/Plugin-Permissions.md b/wiki/Plugin-Permissions.md
index 1be61ea56..f79bc4ca4 100644
--- a/wiki/Plugin-Permissions.md
+++ b/wiki/Plugin-Permissions.md
@@ -10,7 +10,7 @@ ungranted capability is physically unreachable**, not just disallowed. See
 
 | Permission | Grants | Notes |
 |---|---|---|
-| `db:own` | Read/write the plugin's **own** SQLite file via `ctx.db` — `db.query`, `db.exec`, **and `db.migrate`** | A separate file per plugin — never `trek.db`. `db.migrate` runs a keyed, idempotent migration (schema/table creation, e.g. `CREATE TABLE`) once per id. `ATTACH`/`DETACH`/`VACUUM`/`PRAGMA` are refused. |
+| `db:own` | Read/write the plugin's **own** SQLite file via `ctx.db` — `db.query`, `db.exec`, **and `db.migrate`** | A separate `plugin.db` per plugin under the plugin's data dir — never TREK's own `travel.db`. `db.migrate` runs a keyed, idempotent migration (schema/table creation, e.g. `CREATE TABLE`) once per id. `ATTACH`/`DETACH`/`VACUUM`/`PRAGMA` are refused. |
 | `db:read:trips` | Read-only trip data via `ctx.trips` (`getById`, `getPlaces`, `getReservations`, `getDays`, `getAccommodations`, `listMine`, `members`) | Every call is **membership-checked** against the acting user — a plugin can't read a trip that user can't see. `getDays` returns each day with its `assignments` + `notes_items`; `getReservations` rows carry `endpoints` + `day_positions` like the REST list. `members` returns the roster (id + display fields only). |
 | `db:read:users` | Read-only public profile via `ctx.users.getById` | Returns id, username, display name, avatar only — **never** password hashes, tokens, or secrets. |
 | `db:read:packing` | Read-only packing items of a trip via `ctx.packing.list(tripId)` | Membership-checked, and scoped to the acting user's visibility — a plugin never sees another member's private packing items. |
@@ -41,18 +41,18 @@ ungranted capability is physically unreachable**, not just disallowed. See
 | `db:write:tags` | Create/edit/delete the acting user's own tags via `ctx.tags` | User-scoped; ownership re-checked before each write. |
 | `db:write:atlas` | Mark/unmark visited countries + regions and manage the bucket list via `ctx.atlas` | All rows are the **acting user's own** — no trip scoping, no cross-tenant surface. Needs the Atlas addon; unblocks e.g. AirTrail-style two-way sync. |
 | `db:write:vacay` | Toggle PTO days + company holidays via `ctx.vacay` | The plan is resolved **host-side from the acting user's active plan** — a plugin can never name another plan; `toggleEntry` only toggles the acting user's own day. Needs the Vacay addon. |
-| `db:write:journal` | Create/edit/delete journal entries via `ctx.journal` | Gated by `journeyService.canEdit` (owner/contributor) against the acting user. Needs the Journey addon. |
+| `db:write:journal` | Create/edit/delete journal entries **and create/delete whole journals** via `ctx.journal` (`createEntry`/`updateEntry`/`deleteEntry` plus `createJourney`/`deleteJourney`) | Entry writes go through the journey domain service's `canEdit`: the journal's owner, or a contributor whose role is `editor`/`owner` — a `viewer` contributor is refused. `createJourney` has no journey-level gate (there is no journey yet); it always creates a **new journal owned by the acting user**, which is how importers bootstrap the journal they then fill. `deleteJourney` is **owner-only** (`isOwner`), not `canEdit` — a contributor, even an editor, cannot delete the journal. Every call needs a bound acting user (a no-user job is refused) and the Journey addon. |
 | `db:write:collections` | Create/edit collections, save places, copy to a trip via `ctx.collections` | The service enforces the acting user's **per-collection role** (owner/admin/editor) itself. Needs the Collections addon. |
 | `db:write:files` | Attach files + manage links via `ctx.files` (`create`, `createLink`, `update`, `softDelete`) | Trip access **+** the app's `file_upload`/`file_edit`/`file_delete` rights respectively. Content arrives as base64 (10MB cap); the extension is validated against the central blocklist before touching disk; link targets must live on the same trip. |
 | `db:write:collab` | Post notes, polls and chat messages via `ctx.collab` | Trip access **+** `collab_edit`; needs the Collab addon. Broadcasts the same `collab:*` events as the app. |
-| `db:write:members` | Add a user to a trip via `ctx.trips.addMember` | **Grants trip access** — deliberately its own permission behind the app's `member_manage` right (default: trip owner only), never bundled with a lower-risk write. The acting user is recorded as the inviter. |
+| `db:write:members` | Add/remove a user on a trip via `ctx.trips.addMember` / `removeMember` | **Grants (and revokes) trip access** — deliberately its own permission behind the app's `member_manage` right (default: trip owner only), never bundled with a lower-risk write. The acting user is recorded as the inviter; the owner can never be removed. |
 | `db:write:todos` | Create/edit/delete a trip's to-dos via `ctx.todos` | Trip access **+** `packing_edit` (the app gates to-dos with the same right). |
 | `db:meta` | Store the plugin's **own** private key/value data on a trip/place/day/**reservation**/**accommodation** via `ctx.meta` | Namespaced per plugin (a plugin only sees its own rows). Reads need trip **access**; **writes** additionally need the entity's edit permission (`trip_edit`/`place_edit`/`day_edit`; reservations use `reservation_edit`, accommodations use `day_edit`). The natural home for an external-id mapping (AirTrail/calendar/booking-import sync) without forking the schema. Quotas: ≤256-char key, ≤64 KB value, ≤100 keys per entity. Purged on uninstall-with-delete-data. |
 | `ws:broadcast:trip` | Push a real-time event to a trip room via `ctx.ws.broadcastToTrip` | Event types are force-namespaced `plugin:<id>:<event>` — a plugin can't forge a core event. |
 | `ws:broadcast:user` | Push a real-time event to a user's connections | Same namespacing. |
-| `notify:send` | Send a persisted notification (bell inbox + email/ntfy/webhook fan-out) via `ctx.notify.send` | Host-mediated: the host owns recipient resolution, channel fan-out and per-user preferences. Recipients are **forced** to the acting user (`scope:'user'`, `targetId` = the acting user) or a trip they belong to (`scope:'trip'`); `scope:'admin'` is refused. The plugin supplies only a plain-text title/body (caps 200/1000) + an optional in-app `link` (must be a relative `/…` path — open-redirect-safe). No arbitrary recipient, no impersonation. |
+| `notify:send` | Send a persisted notification (bell inbox + email/ntfy/webhook fan-out) via `ctx.notify.send` | Host-mediated: the host owns recipient resolution, channel fan-out and per-user preferences. Recipients are **forced** to the acting user (`scope:'user'`, `targetId` = the acting user) or a trip they belong to (`scope:'trip'`); `scope:'admin'` is refused. The plugin supplies only a plain-text title/body (caps 200/1000) + an optional in-app `link` (must be a relative `/…` path — open-redirect-safe). No arbitrary recipient, no impersonation. Budgeted: 100 sends/day per plugin, resetting at UTC midnight. |
 | `oauth:client` | Become an OAuth *client* of a third-party service via `ctx.oauth.getAccessToken()` | Host-brokered: the host runs the whole flow (authorize→callback→token→refresh) with **PKCE + state** and **holds the tokens** — client secret + refresh token never leave the host. Provider config (`oauth_authorize_url`/`oauth_token_url`/`oauth_scopes` + the secrets `oauth_client_id`/`oauth_client_secret`) is the plugin's **admin-owned instance settings**; endpoints must be **https** (SSRF backstop). Each user connects under **Settings → Plugins**; tokens are per-user + encrypted at rest. The plugin only ever gets a **short-lived access token** for the acting user. |
-| `ai:invoke` | Run the admin/user-configured LLM via `ctx.ai.complete` / `ctx.ai.extract` | Host-mediated: the host holds the (encrypted) credential and runs the call under the acting user's resolved provider — the plugin never sees a key. Refused when no provider is configured; prompt/text capped at 20 000 chars. Output is **DATA** — `complete` returns `{ text }`, `extract` returns `{ results }` for your JSON schema — and is never auto-written, so prompt-injection can't reach a write without your own gated call. |
+| `ai:invoke` | Run the admin/user-configured LLM via `ctx.ai.complete` / `ctx.ai.extract` | Host-mediated: the host holds the (encrypted) credential and runs the call under the acting user's resolved provider — the plugin never sees a key. Refused when no provider is configured; prompt/text capped at 20 000 chars. Output is **DATA** — `complete` returns `{ text }`, `extract` returns `{ results }` for your JSON schema — and is never auto-written, so prompt-injection can't reach a write without your own gated call. Budgeted: 200 calls/day per plugin, resetting at UTC midnight. |
 | `events:subscribe` | React to core activity via `events: [{ on, handler }]` on the plugin definition | The handler gets the **event name + tripId + a `{ entity, entityId }` hint**, plus a **whitelisted `snapshot` of the changed entity when the plugin also holds the family's `db:read:*` grant** (per-plugin filtered at deliver time — no grant, no fields). It runs with **no user** (like a job), so nothing beyond the snapshot is readable. The whitelist never carries user ids, private packing items (#858) or secrets; deletes/bulk/reorder events carry no snapshot, a non-entity id (e.g. a userId) never surfaces. Fire-and-forget on a short timeout; `plugin:*` re-broadcasts are never delivered back. |
 | `jobs:run` | Run the plugin's declared background `jobs` on their cron schedule **and** its runtime timers via `ctx.scheduler` (`at`/`in`/`every`/`cancel`) | **Opt-in.** Scheduled work runs with **no user** (its trip reads are refused), so a job can only touch its own `ctx.db` and declared egress. Invalid cron expressions are skipped; jobs stop when the plugin is deactivated. `ctx.scheduler` tasks are persisted (survive restarts), capped at 100/plugin with an 8 KB payload and a 60 s minimum recurring interval, and removed on uninstall. |
 | `hook:photo-provider` | Register as a photo provider in Memories | Implement the `PhotoProvider` interface. |
@@ -63,13 +63,13 @@ ungranted capability is physically unreachable**, not just disallowed. See
 | `hook:map-layer-provider` | Overlay bounded **vector layers** (polylines, polygons, metric circles) on the trip map via the `hooks.mapLayerProvider` provider hook | Implement `MapLayerProvider` in `hooks` — returns `{id, name?, features}[]` where a feature is `{type, points?/center?+radiusM?, tone?, width?, dash?, opacity?, fill?, label?}`. **Declarative only** — the host draws everything; styling is the tone palette plus clamped numerics (width 1–8, opacity 0.05–1, radius ≤2000 km) and a dash enum, so a layer can't impersonate core UI. Budgets per plugin: ≤4 layers / ≤150 features / ≤8000 vertices / ≤2000 vertices per shape; invalid or oversized shapes are dropped whole (never truncated); a failing provider is skipped. Drawn beneath TREK's own routes. Exposed at `GET /api/map-layers/:tripId`. |
 | `hook:route-provider` | Offer **routing profiles** the planner's route toggle can route days with, via the `hooks.routeProvider` provider hook | Implement `RouteProvider` in `hooks` and declare the profiles in `capabilities.routeProfiles` (max 3; each `{id, label, icon?}`). TREK calls `getRoute({tripId, dayId, profile, waypoints})` for exactly the profile the user picked — this is **targeted**, not a fan-out — with a 20 s timeout so the plugin can call an external solver through its declared egress. The result (`coordinates`, `distance`, `duration`, `legs`, `viaPoints?`) is validated whole (leg count must equal `waypoints−1`, ≤10000 vertices, ≤40 vias); anything malformed is discarded and the planner falls back to straight lines. Exposed at `POST /api/plugin-routes/:pluginId/:profileId` (member-gated per trip). |
 | `hook:day-schedule-provider` | Attach **time contributions** to the day plan via the `hooks.dayScheduleProvider` provider hook | Implement `DayScheduleProvider` in `hooks` — returns `{id, dayId, assignmentId?/reservationId?/position?, minutes?, label, tone?}[]`. Rows render under their anchor (a place/booking row, or a day's start/end) on desktop and mobile, and `minutes` is **folded into the day's route-footer total** — the one hook whose output feeds displayed timing, which is why minutes are clamped (1–1440) and `dayId` is checked against the trip's own days. ≤60 items per plugin, labels sanitized + capped (≤120); a failing provider is skipped. Exposed at `GET /api/day-schedule/:tripId`. |
-| `hook:day-tint-provider` | Colour-code **whole days** in the day plan via the `hooks.dayTintProvider` provider hook | Implement `DayTintProvider` in `hooks` — returns `{dayId, tone?, color?, badgeTone?, badgeColor?, headerTone?, headerColor?, activityTone?, activityColor?, label?}[]`, one entry per day you want coloured. A day card has **three separately tintable regions** — the day-number badge (which is also the mobile day chip), the header row, and the expanded activity list — so you can mark a leg boldly on the badge and leave the dense activity list plain. `tone` / `color` are shorthands for every region you do not name; a region you never name is not tinted at all and renders exactly as it does without your plugin. Paint a region with a palette tone or with your own colour — **`#rrggbb` only**, since the value ends up inside a CSS colour the host builds; a colour beats a tone within a region, and a region's own value beats the shorthand. **You choose the hue, the host chooses the weight**: it sets the alpha per theme and per region (a large surface behind dense text gets a fainter tint than a small badge) and clamps your colour's lightness into a band that reads on both the light and the dark sidebar, so no contribution can hand a user a day card they cannot read. A tinted header hovers to a deeper mix of its own colour instead of losing it. `dayId` is checked against the trip's own days, `label` (≤60) becomes the day's tooltip, the raw array is sliced at 2000. **A day takes at most one contribution, and it is resolved whole**: within one provider's list the first entry for a day wins, and across plugins the first granted provider wins — so a day can't flicker between colours, and a losing plugin can't fill in the winner's untinted regions. Unlike `hook:day-schedule-provider` there is no fixed item cap; the bound is the trip's day count, which is what makes this usable on a six-month itinerary. A failing provider is skipped. Exposed at `GET /api/day-tints/:tripId`. |
+| `hook:day-tint-provider` | Colour-code **whole days** in the day plan via the `hooks.dayTintProvider` provider hook | Implement `DayTintProvider` in `hooks` — returns `{dayId, tone?, color?, badgeTone?, badgeColor?, headerTone?, headerColor?, activityTone?, activityColor?, label?}[]`, one entry per day you want coloured. A day card has **three separately tintable regions** — the day-number badge (which is also the mobile day chip), the header row, and the expanded activity list — so you can mark a leg boldly on the badge and leave the dense activity list plain. `tone` / `color` are shorthands that paint every region you do not name; omit both and only the regions you name are tinted, and the rest render exactly as they do without your plugin. An entry that would paint nothing at all — no region named and no usable shorthand — still means "tint this day", so all three regions fall back to the `default` tone. Paint a region with a palette tone or with your own colour — **`#rrggbb` only**, since the value ends up inside a CSS colour the host builds; a colour beats a tone within a region, and a region's own value beats the shorthand. **You choose the hue, the host chooses the weight**: it sets the alpha per theme and per region (a large surface behind dense text gets a fainter tint than a small badge) and clamps your colour's lightness into a band that reads on both the light and the dark sidebar, so no contribution can hand a user a day card they cannot read. A tinted header hovers to a deeper mix of its own colour instead of losing it. `dayId` is checked against the trip's own days, `label` (≤60) becomes the day's tooltip, the raw array is sliced at 2000. **A day takes at most one contribution, and it is resolved whole**: within one provider's list the first entry for a day wins, and across plugins the first granted provider wins — so a day can't flicker between colours, and a losing plugin can't fill in the winner's untinted regions. Unlike `hook:day-schedule-provider` there is no fixed item cap; the bound is the trip's day count, which is what makes this usable on a six-month itinerary. A failing provider is skipped. Exposed at `GET /api/day-tints/:tripId`. |
 | `geolocation:read` | Ask the HOST for the browser's live position from the plugin's sandboxed frames (`window.trek.geolocation`) | A **bridge-level** permission — it unlocks no ctx RPC method. The sandbox itself never gains the geolocation API: the host page reads `navigator.geolocation` (the browser's own site permission prompt still applies) and posts plain `{lat, lng, accuracy, heading, speed, timestamp}` data into the frame over postMessage. `get()` resolves one fix; `watch(cb)` streams updates until unsubscribed, and the host force-stops the GPS watch when the frame closes. Nothing is sent to the server — a position only reaches the plugin's server code if its own client ships it through one of its routes (visible in that route's traffic like any other call). |
-| `hook:table-contributor` | Contribute host-rendered **columns/actions** into a native planner view via the `hooks.tableContributor` provider hook | Implement `TableContributor` in `hooks` — returns declarative column/action leaves keyed by `entityId` (never markup). The host normalizes + bounds every field (length caps, `http`/`https`/`mailto`-only urls, enum tone/target) and renders them in the reservations, places, day, costs, packing and files views; an action opens your sandboxed frame or calls one of your routes. Also exposed at `GET /api/view-contributions/:view/:tripId`. |
+| `hook:table-contributor` | Contribute host-rendered **columns/actions** into a native planner view via the `hooks.tableContributor` provider hook | Implement `TableContributor` in `hooks` — returns declarative column/action leaves keyed by `entityId` (never markup). The host normalizes + bounds every field (length caps, `http`/`https`/`mailto`-only urls, enum tone/target) and renders them in the reservations, transports, places, day, costs, packing, files and todos views; an action opens your sandboxed frame or calls one of your routes. Also exposed at `GET /api/view-contributions/:view/:tripId`. |
 | `hook:pdf-section-provider` | Append text-only **sections** to the trip PDF export via the `hooks.pdfSectionProvider` provider hook | Implement `PdfSectionProvider` in `hooks` — returns `{title, paragraphs?, table?}[]` of plain strings the export escapes and lays out itself; no markup ever reaches the document. The host caps the section/paragraph/header/row counts (≤5/≤20/≤8/≤50) and every string length, and clips table rows to the header width; a failing provider is skipped. Exposed at `GET /api/pdf-sections/:tripId`. |
 | `hook:atlas-layer-provider` | Draw country **tint layers** over the Atlas world map via the `hooks.atlasLayerProvider` provider hook | Implement `AtlasLayerProvider` in `hooks` — returns `{id, name?, countries: [{code, tone?, label?}]}[]` for the **acting user** (the hook takes no target parameter, so a plugin can't ask for anyone else's map). Codes must be ISO-3166 alpha-2 (uppercase-coerced, anything else dropped), tone is enum-whitelisted, counts capped (≤3 layers, ≤300 countries each). **Declarative only** — plugin JS never runs on the map canvas. Exposed at `GET /api/atlas-layers`. |
 | `hook:journal-entry-provider` | Contribute extra **rows** under a journal entry via the `hooks.journalEntryProvider` provider hook | Implement `JournalEntryProvider` in `hooks` — returns `{label, value?, url?}[]` per entry, rendered under the entry card. The entry's journey is access-checked against the acting user (owner/contributor, like the journal detail routes) and the Journey addon must be on. The host caps the row count (≤12) + lengths (label 60, value 200) and allowlists the url (http/https/mailto); a failing provider is skipped. Exposed at `GET /api/journal-entry-rows/:entryId`. |
-| `hook:trip-card-provider` | Add small **badges** to the dashboard trip cards via the `hooks.tripCardProvider` provider hook | Implement `TripCardProvider` in `hooks` — `getCards(tripIds, ctx)` is called ONCE with all the trip cards currently on the user's dashboard (each already access-checked for the acting user), returns `{tripId, id, label, value?, icon?, tone?, url?}[]`. **Declarative only** — plugin JS never runs on the dashboard. The host String-coerces + length-caps every field, enum-whitelists the tone, allowlists the url (http/https/mailto), caps the count (≤40/plugin) and drops any badge whose `tripId` the dashboard didn't ask about; a failing provider is skipped. Exposed at `GET /api/trip-card-contributions?tripIds=…`. |
+| `hook:trip-card-provider` | Add small **badges** to the dashboard trip cards via the `hooks.tripCardProvider` provider hook | Implement `TripCardProvider` in `hooks` — `getCards(tripIds, ctx)` is called ONCE with all the trip cards currently on the user's dashboard (each already access-checked for the acting user), returns `{tripId, id, label, value?, icon?, tone?, url?}[]`. **Declarative only** — plugin JS never runs on the dashboard. The host String-coerces + length-caps every field, enum-whitelists the tone, allowlists the url (http/https/mailto), caps the count (≤4 badges per trip, ≤240 total per plugin) and drops any badge whose `tripId` the dashboard didn't ask about; a failing provider is skipped. Exposed at `GET /api/trip-card-contributions?tripIds=…`. |
 | `hook:notification-channel` | Register a new **notification channel** (Gotify, Pushover, …) via the `hooks.notificationChannel` provider hook | Implement `NotificationChannel` in `hooks` — `send(msg, config, ctx)` receives a notification TREK has **already rendered** into the recipient's language (`{event, title, body, url?, tripName?}`) plus that recipient's own decrypted `scope:'user'` settings as `config`. Unlike every other hook this one is **host-initiated for an arbitrary recipient**, so it runs **userless**: `ctx.settings.get()` returns `undefined` and trip reads are refused — the recipient's credentials arrive as `config` precisely so the plugin never gains the right to read anything *as* them. Optional `test(config, ctx)` backs the "Send test" button. Declare the channel with `capabilities.notificationChannel: { title?, events? }`; `title` names the column in the preferences matrix (default: the plugin's name) and `events` may **narrow** which events it carries (default: every non-admin event — admin-scoped events are never deliverable to a plugin). Throw on failure: the host logs it and isolates it, so a dead channel can't stop the others. |
 | `hook:user-data` | Honour GDPR **data-subject rights** — erase and export the data the plugin stores about a user — via the `deleteUserData` / `exportUserData` handlers | Implement `deleteUserData({userId}, ctx)` and/or `exportUserData({userId}, ctx)` on the plugin definition (not on `ctx`). Both are **userless** (no acting user; the plugin only learns the `userId` and touches its OWN db). When a TREK account is deleted, the host queues an erasure for every plugin holding this grant and retries it **durably** until the plugin ACKs — even across restarts — so implement `deleteUserData` idempotently. `exportUserData` returns a JSON-serialisable value the host aggregates for an admin at `GET /api/admin/plugins/user-data/:userId/export`. |
 | `http:outbound` / `http:outbound:<host>` | Make outbound network requests | **Requires** a non-empty `egress[]` — unless the manifest sets `operatorEgress: true`. Only a **per-host** `http:outbound:<host>` actually opens a host at runtime — see below. |
@@ -86,14 +86,16 @@ Two independent guards restrict a plugin's network, and **both are built from th
 - the plugin iframe's **CSP `connect-src`** (the client can only fetch the same
   hosts).
 
-`egress[]` is a **separate declaration** the manifest validator only checks for
-*presence*, not contents. The rule it enforces is narrow:
+`egress[]` is a **separate declaration**: the manifest validator checks its shape,
+but never cross-checks it against the `http:outbound:<host>` permissions you
+granted. The rules it enforces are narrow:
 
 - Only the permissions above are accepted; an unknown string fails validation.
 - If **any** `http:outbound` permission (bare or per-host) is declared, `egress[]`
   must be **non-empty** — *unless* the manifest sets `operatorEgress: true`, whose
   hosts arrive from the admin after install (see below).
-- `egress[]` may not contain a bare `*`.
+- Every entry must be a bare host or a `*.suffix` wildcard: a bare `*`, a whole-TLD
+  `*.com` and anything carrying a scheme are rejected.
 
 ### `operatorEgress` — hosts only the operator knows
 
@@ -158,13 +160,14 @@ flow is in [[Publishing a Plugin|Plugin-Publishing]].
 |---|---|
 | `trek-plugin create [name]` | Scaffold a plugin. With no name it runs an interactive wizard (id, type, author, permissions); with a name it takes `--type`/`--author`/`--permissions` flags. |
 | `trek-plugin dev [dir]` | Run the plugin locally with a real request loop + hot reload — no full TREK. The injected `ctx` enforces your granted permissions, `db:own` is a real SQLite file, routes serve under `/api/<path>`, and page/widget UI at `/ui`. |
-| `trek-plugin validate [dir]` | Manifest + layout checks: parses the manifest with the same rules as install, requires a `README.md` (warns if it has no screenshot or still holds template placeholders) and a built `server/index.js`, and warns if the directory name ≠ the plugin id. This is a **subset** of registry CI — CI additionally verifies the release tag/commit, the artifact's sha256, and the README over the network. A local pass predicts a CI pass. |
+| `trek-plugin validate [dir]` | Manifest + layout checks, and the gate for publishing: parses the manifest with the same rules as install, then runs every registry gate that can be answered from the working tree — exiting non-zero on any of them. It **fails** if `README.md` is missing, is missing one of the four required sections, has too little prose, still holds template placeholders, does not explain every permission the manifest declares, or has no usable screenshot (no image at all, or every local image path is missing on disk — a remote `https://` image passes here and is verified later by `preflight`); it also fails if `server/index.js` was never built. Failures that only the registry cares about do **not** block `trek-plugin pack`, so the dev loop keeps working while the docs are still a stub — but they do stop `publish`, which runs these same checks first and refuses before anything is packed, tagged or released. A handful of checks are *warnings* that never fail the command: directory name ≠ plugin id, an unbounded `trek` range, an unknown required addon, emoji in manifest text, an undeclared egress host, and a page/widget not using the design kit. This is a **subset** of registry CI — CI additionally verifies the release tag/commit, the artifact's sha256, and the README over the network. A local pass predicts a CI pass. |
 | `trek-plugin preflight --repo <o/n> --tag <vX>` | Runs the **full** registry CI checks locally over the network (tag→commit, manifest parity, artifact sha256/size, native scan, README quality gate) against your pushed release — so you catch a CI failure before opening the PR. |
-| `trek-plugin submit --repo <o/n> --tag <vX>` | Opens the registry PR for you: forks TREK-Plugins, branches off current main, writes/merges `registry/plugins/<id>.json`, pushes, and creates the PR. Requires `gh`. |
-| `trek-plugin publish --repo <o/n> --tag <vX>` | **The one-command release**: pack → tag + GitHub release → preflight → open the registry PR. Stops before submitting if preflight fails. Add `--sign` to sign it. Requires `git` + `gh`. |
+| `trek-plugin submit --repo <o/n> --tag <vX>` | Opens the registry PR for you: forks TREK-Plugins, fast-forwards the fork, branches off the registry's current main, writes/merges `registry/plugins/<id>.json`, pushes, and creates the PR. Requires `gh`. |
+| `trek-plugin publish --repo <o/n> --tag <vX>` | **The one-command release**: local gates → pack → tag + GitHub release → preflight → open the registry PR. Nothing is packed, tagged or released until the local gates pass (`--no-checks` skips them). A failure after the release is cut rolls back the tag and release that run created, so the same tag can be re-used (`--keep-release` opts out). Add `--sign` to sign it. Requires `git` + `gh`. |
+| `trek-plugin unrelease <vX> --repo <o/n>` | Deletes a stranded GitHub release + remote tag + local tag. Refuses a version that is published in the registry (its artifact is immutable); `--yes` consents when the registry index can't be checked. |
 | `trek-plugin keygen` / `sign` | `keygen` creates an Ed25519 signing key; `sign` (or `--sign` on `entry`/`release`/`submit`) signs the artifact and fills `authorPublicKey` + `signature` so TREK pins your identity (TOFU). |
 | `trek-plugin pack [dir] [--out plugin.zip] [--json]` | Validates, then builds `plugin.zip` in the installer's exact layout (`trek-plugin.json`, `README.md`, `LICENSE`, `package.json` at the root; `server/` and `client/` recursed) and prints its **sha256 + byte size**. Skips `node_modules`, `.git`, `.ts` and `.map` files, and **refuses native binaries** (`.node`, `binding.gyp`, `prebuilds/`) and over-size archives, same as the installer. **`docs/` is intentionally NOT shipped** — the store fetches your screenshot from `docs/screenshot.png` in the repo. |
-| `trek-plugin entry --repo <owner/name> --tag <vX.Y.Z> [--zip plugin.zip] [--merge entry.json] [--out file]` | Emits the ready-to-PR registry entry: `commitSha` (resolved from the tag), `downloadUrl`, `sha256` + `size` (from the packed zip), and `minTrekVersion` (derived from the manifest's `trek` range, e.g. `>=3.2.0 <4.0.0` → `3.2.0`). `--merge` prepends this version onto an existing `registry/plugins/<id>.json` for an update, keeping versions newest-first. |
+| `trek-plugin entry --repo <owner/name> --tag <vX.Y.Z> [--zip plugin.zip] [--merge entry.json] [--out file]` | Emits the ready-to-PR registry entry: `commitSha` (resolved from the tag), `downloadUrl`, `sha256` + `size` (from the packed zip), and the manifest's **`trek` range verbatim** — the entry's only compatibility field. `--merge` prepends this version onto an existing `registry/plugins/<id>.json` for an update, keeping versions newest-first (registry CI enforces that ordering). |
 | `trek-plugin release [dir] --repo <owner/name> --tag <vX.Y.Z>` | The one-shot: `pack` → `gh release create` (uploads the zip) → print the registry `entry`. Requires the `gh` CLI authenticated. |
 
 ### Registry policy
diff --git a/wiki/Plugin-Publishing.md b/wiki/Plugin-Publishing.md
index 279957568..4115b5c9f 100644
--- a/wiki/Plugin-Publishing.md
+++ b/wiki/Plugin-Publishing.md
@@ -29,8 +29,20 @@ The order is the point. A GitHub release is effectively immutable: the registry
 its sha256, so overwriting the bytes breaks the checksum for everyone who already
 installed that version. So the local gates run **first** — if one fails, nothing is
 packed, tagged, pushed or released, and you can fix it and re-run against the same
-version. (Before this, the checks ran *after* the release was cut, and an author who
-failed them had burned their `v1.0.0` tag on an unwritten README.)
+version.
+
+And when a **later** step fails — a preflight or PR problem after the release is
+cut — `publish` rolls back exactly what that run created: the GitHub release, the
+pushed tag, and the local tag, so the same tag is free to re-run against once you
+have fixed the problem. Anything that existed before the run is never touched, and
+`--keep-release` opts out (the error then prints the manual cleanup commands). A
+leftover tag from an earlier failed run — one with no release that no longer points
+at `HEAD` — is recognised as debris and **moved to your current commit** rather than
+silently releasing the stale one. And for a stranded state you already have,
+`trek-plugin unrelease <vX.Y.Z> --repo you/repo` deletes the release, the remote
+tag, and the local tag in one go — after checking the published registry index and
+**refusing, with no override, to touch a version that is actually published** (its
+artifact is immutable; ship a new version instead).
 
 It prints the PR URL at the end. In a terminal it **offers to sign** the release (and
 creates the key if you have none); scripts and CI are never prompted and pass `--sign`.
@@ -90,12 +102,17 @@ Between them they now catch, **offline**, nearly everything the registry rejects
 - an `egress[]` host with no matching `http:outbound:<host>` permission — TREK builds
   the network allow-list and the iframe CSP from those permissions only and never reads
   `egress[]`, so such a host is silently unreachable at runtime
+- a permission TREK doesn't know — the SDK and registry CI check against the same
+  63-entry list the host enforces, so a typo'd permission fails here instead of at
+  install on every instance
 
-Only **four** gates genuinely need the network, and they all need the release to exist:
-that the tag resolves to the commit the entry pins, that the released artifact downloads
-and hashes to the pinned sha256 (and verifies against your key), that your plugin id
-isn't bound to another GitHub owner, and that an update doesn't drop or rotate a signing
-key you already published under. Those run in `preflight` — step 4 of `publish`.
+Only **six** gates genuinely need the network, because none of them can be answered from
+your working tree: that the tag resolves to the commit the entry pins, that the manifest at
+that commit matches the entry, that the README at that commit still passes the quality gate,
+that the released artifact downloads and hashes to the pinned sha256 (and verifies against
+your key), that your plugin id isn't bound to another GitHub owner, and that an update
+doesn't drop or rotate a signing key you already published under. Those run in `preflight`
+— step 4 of `publish`.
 
 ### Capture the screenshot
 
@@ -196,9 +213,9 @@ release, so you catch what CI would reject without a review round-trip:
 npx trek-plugin-sdk preflight --repo you/trek-plugin-flight-tracker --tag v1.0.0
 ```
 
-`preflight` runs everything `validate` runs, plus the four gates that genuinely need
-the network: the tag resolves to the pinned `commitSha`; the manifest **and the
-README** at that commit match the entry and pass the quality gate; the released
+`preflight` runs everything `validate` runs, plus the six gates that genuinely need
+the network: the tag resolves to the pinned `commitSha`; the **manifest** at that commit
+matches the entry; the **README** at that commit passes the quality gate; the released
 artifact downloads, hashes to the pinned **sha256**, carries **no native binaries** and
 verifies against your key; your plugin id is not bound to a different GitHub owner; and
 an update does not drop or rotate a signing key you already published under.
@@ -218,7 +235,9 @@ npx trek-plugin-sdk submit --repo you/trek-plugin-flight-tracker --tag v1.0.0
 ```
 
 It forks [TREK-Plugins](https://github.com/liketrek/TREK-Plugins) (once),
-branches off the current `main`, writes (or, for an update, merges into)
+**fast-forwards your fork from the registry** (a diverged fork warns with the
+`gh repo sync --force` command to reset it, and the submit continues), branches off
+the registry's current `main`, writes (or, for an update, merges into)
 `registry/plugins/<id>.json`, pushes, and opens the PR — printing its URL. Add
 `--draft` for a draft PR, `--registry <owner/name>` for a mirror. (Requires `gh`,
 authenticated.)
@@ -244,16 +263,19 @@ changed `registry/plugins/*.json`. Nearly every rule below is a pure function of
 you have tagged anything — you should never learn any of this from CI.
 
 **Entry** (`validate-entry.mjs`): valid schema · `id` matches the filename and
-the slug pattern `^[a-z][a-z0-9-]{2,39}$` · your `id` is bound to your GitHub
+the slug pattern `^[a-z][a-z0-9-]{2,39}$` and is not one of the reserved ids
+`registry`/`install`/`rescan` (they collide with admin API route segments — CI and
+the install loader both refuse them) · your `id` is bound to your GitHub
 owner on first registration, so nobody can repoint it later (owner changes need a
-maintainer override) · homoglyph/mixed-script name check · the release tag exists
+maintainer override) · homoglyph/mixed-script name check · `versions[]` sorted
+newest-first · the release tag exists
 and resolves to `commitSha` · manifest parity at that commit (`id`, `version`,
-`type`, `apiVersion`, and `nativeModules` must not be `true`) · **the downloaded
+`type`, `apiVersion`, and `nativeModules` must not be `true`) · every declared
+permission is on TREK's known-permission list (or a valid `http:outbound:<host>`) ·
+**the downloaded
 artifact's SHA-256 matches the pin** and its size is within bounds · **no native
 binaries** in the archive · `egress[]` present (and no bare `*`) when
-`http:outbound` is declared. Any unique slug is fine **except `registry`,
-`install` and `rescan`**, which the install loader refuses (they collide with
-admin API route segments).
+`http:outbound` is declared.
 
 **README** (`check-readme.mjs`, fetched at the pinned commit): must exist at the
 repo root, contain the sections **What it does / Screenshots / Permissions /
@@ -330,7 +352,12 @@ next to its `sha256`:
 Signing is **opt-in**, and it is a one-way door you may walk through **late**. An
 entry without `authorPublicKey`/`signature` installs on `sha256` alone; **going
 unsigned → signed later breaks nobody**, because nothing is pinned until a signed
-version installs — adding a key at v1.4.0 is a real option, not a lost cause. What
+version installs — adding a key at v1.4.0 is a real option, not a lost cause. The
+registry does require every version signed once your key appears in the entry, and
+the SDK handles that for you: your first signed update **retro-signs the older
+versions** (each pinned artifact is downloaded, verified against its `sha256`, and
+signed with the same key — a byte mismatch refuses, since that artifact no longer
+matches its pin). What
 you can never do is go back: once a plugin has shipped signed, an *unsigned* update
 is refused (`SIGNATURE_MISSING`) on every instance that already has it, and a key
 *rotation* needs a registry maintainer override (`allow-key-change`) plus an admin
diff --git a/wiki/Plugins.md b/wiki/Plugins.md
index 6bce900fa..8ac2fd204 100644
--- a/wiki/Plugins.md
+++ b/wiki/Plugins.md
@@ -29,8 +29,9 @@ An `integration` plugin can add a whole new **notification channel** — Gotify,
 Telegram, anything that takes a message — alongside TREK's built-in email, webhook and
 ntfy.
 
-Once you install and enable such a plugin, switch its channel on in
-**Admin → Notifications**. It then appears as a new column in every user's
+Once you install and activate such a plugin, its channel is live — there is no separate
+switch for it in **Admin → Notifications**, which only turns the built-in email, webhook
+and ntfy channels on. It appears right away as a new column in every user's
 **Settings → Notifications** matrix, and each user supplies their own credentials on the
 plugin's own settings page and picks per-event what they want pushed — exactly like a
 built-in channel.
@@ -95,9 +96,10 @@ code:
 
 - It has **no** access to `JWT_SECRET`, the database connection, or any TREK
   secret — those are simply not reachable by its process.
-- It **cannot** open `trek.db`, write files, spawn child processes, use worker
-  threads, or load native addons. Its own data lives in a separate SQLite file it
-  reaches only through TREK.
+- It **cannot** open TREK's own database (`server/data/travel.db`, or
+  `/app/data/travel.db` in the container), write files, spawn child processes, use
+  worker threads, or load native addons. Its own data lives in a separate SQLite file
+  it reaches only through TREK.
 - It talks to TREK exclusively over an internal RPC channel, and TREK only
   answers the capabilities the plugin's manifest **declares and you approve**.
   An ungranted call is refused, not merely ignored.
@@ -123,9 +125,11 @@ A single panel with a segmented **Installed / Discover** switch at the top left,
 plus a toolbar:
 
 - **Search** — filters the current list by name/description (and author, in Discover).
-- **Type** filter — All / Widget / Integration / Page.
+- **Type** filter — All types / Widget / Integration / Page / Trip page.
 - **Status** filter (Installed view only) — All / Active / Off / Update available / Error.
-- **Sort** — Name / Recently updated / Updates first.
+- **Sort** — Name / Recently updated, plus **Updates first** in Installed and **Most
+  downloads** in Discover. The view-specific option falls back to Name when you switch
+  views.
 - **Upload** — sideload a plugin from a `.zip`/`.tar.gz` (see [Installing](#installing-a-plugin)).
 - **Rescan** — rediscovers the on-disk plugins directory **and** force-pulls the
   remote registry, bypassing the 30-minute server cache and GitHub's CDN so a
@@ -137,7 +141,7 @@ blue pulse = starting, red = error, amber = disabled/incompatible, faint = inact
 the name and version, a **Reviewed** shield if applicable, a **Sideloaded** tag
 for manually-uploaded plugins (see [Installing](#installing-a-plugin)), and
 **capability chips** derived from its declared permissions — "Reads your trips",
-"Reads costs" / "Writes costs", "Dashboard widget", "Real-time updates",
+"Reads your costs" / "Adds costs", "Dashboard widget", "Real-time updates",
 "Provides photos", outbound hosts, and so on — so a plugin's real reach is
 legible without opening anything.
 
@@ -222,7 +226,9 @@ The **⋯** menu on each row:
 - **Allowed hosts** — add the hosts a plugin may reach, for a plugin that talks to a
   service only *you* can name. See [Allowed hosts](#allowed-hosts) below.
 - **Source repository** — opens the plugin's GitHub repo (registry installs only).
-- **Delete** — uninstalls: removes the code and lets you keep or delete its data.
+- **Report an issue** — opens that repo's issue tracker (registry installs only).
+- **Delete** — uninstalls, after a confirmation: it stops the plugin, removes its code,
+  **and deletes all of its data**. This cannot be undone.
 
 ## Allowed hosts
 
@@ -231,9 +237,11 @@ install. But a plugin that talks to a **self-hosted service** — a Gotify, an n
 Uptime Kuma — cannot know *your* hostname when it is published. Such a plugin declares
 `operatorEgress`, and you supply the hosts yourself.
 
-The plugin card shows a **"+ hosts"** chip when it works this way. Open **⋯ → Allowed
-hosts** and add the hostname (e.g. `gotify.mydomain.com`). TREK restarts the plugin so it
-picks up the new list.
+Before install, the detail modal marks such a plugin with a **"+ hosts you add"** pill
+under *Connects to*. On the installed row it shows an **Add allowed host** chip
+(**{n} allowed host(s)** once you have added some). Open **⋯ → Allowed hosts** and add
+the hostname (e.g. `gotify.mydomain.com`). TREK restarts the plugin so it picks up the
+new list.
 
 What this does *not* let anyone do:
 
@@ -259,7 +267,8 @@ plugin took while acting for you — across all plugins, newest first: each trip
 cost it read, each place it wrote, each outbound call TREK made on its behalf.
 
 This is the user-facing half of TREK's tamper-evident (hash-chained) plugin
-audit: admins see the per-plugin view in **Admin → Plugins**, while this view is
+audit: the same chain is readable per plugin over the admin API
+(`GET /api/admin/plugins/:id/audit`), while this view is
 **never admin-gated** — anyone can review what was done with their own data. It's
 what keeps a plugin's deliberately broad read grants accountable to the person
 whose data is read. See [[Plugin Permissions|Plugin-Permissions]] for what each
@@ -287,7 +296,7 @@ registry entry, so you never hand-compute a SHA-256 or hand-write registry JSON:
 |---|---|
 | `trek-plugin validate [dir]` | Runs the manifest + layout checks locally (a subset of registry CI, which additionally verifies the release, the artifact SHA-256, and the README over the network). |
 | `trek-plugin pack [dir] [--out plugin.zip] [--json]` | Builds `plugin.zip` in the installer's exact layout and prints its SHA-256 + byte size. Refuses native binaries; `docs/` is intentionally not shipped (the store fetches the screenshot from your repo). |
-| `trek-plugin entry --repo <o/n> --tag <vX> [--zip z] [--merge entry.json] [--out f]` | Emits the registry entry — `commitSha`, `downloadUrl`, `sha256`, `size` and `minTrekVersion` (derived from the manifest `trek` range) all filled in. `--merge` prepends the new version onto an existing entry for updates. |
+| `trek-plugin entry --repo <o/n> --tag <vX> [--zip z] [--merge entry.json] [--out f]` | Emits the registry entry — `commitSha`, `downloadUrl`, `sha256`, `size` and the manifest's `trek` range (verbatim) all filled in. `--merge` prepends the new version onto an existing entry for updates. |
 | `trek-plugin release [dir] --repo <o/n> --tag <vX>` | The one-shot: `pack` → create the GitHub release → print the entry. |
 
 Run them via `npx trek-plugin-sdk …`. See [[Plugin Development|Plugin-Development]]
diff --git a/wiki/Public-Share-Links.md b/wiki/Public-Share-Links.md
index 14534c9b8..90fc3c09d 100644
--- a/wiki/Public-Share-Links.md
+++ b/wiki/Public-Share-Links.md
@@ -18,31 +18,41 @@ The share URL takes the form:
 
 Copy this URL and send it to anyone you want to share the trip with. No TREK account is required to view it.
 
+### How long a link lives
+
+A share link is valid for **90 days**, counted from the last time it was saved. Creating the link writes a 90-day expiry, and flipping one of the unlocked permission toggles re-saves the link and writes a new one, so a link you actively manage never lapses under you.
+
+Once the 90 days are up, visitors get **Link expired or invalid**. The share section in the Members & Share modal does not show this — it keeps displaying the URL and the **Delete link** button, because the owner-side lookup ignores the expiry. There is no expired badge to warn you.
+
+To revive a lapsed link, flip one of the unlocked toggles — **Bookings**, **Packing**, **Costs** or **Chat** — and flip it back if you did not mean to change anything. **Map & Plan** is locked, so clicking it sends no request and will not revive the link. Flipping an unlocked toggle re-saves the **same** token for another 90 days and the old URL starts working again. If you want a genuinely different URL, because the old one leaked for instance, use **Delete link** and then **Create link**.
+
+Links created before TREK added the expiry carry no expiry at all and work indefinitely. The first time you change one of their toggles, that save puts them on the 90-day clock like every other link.
+
 ## Permission toggles
 
 When creating or updating a share link you choose what the recipient can see. The available flags are:
 
 | Toggle | Default | What it shows |
 |--------|---------|---------------|
-| **Map** | Always on | The Plan tab with the interactive map and day-by-day itinerary. This toggle is locked on and cannot be disabled from the UI. |
+| **Map & Plan** (`share_map`) | Always on | The Plan tab with the interactive map and day-by-day itinerary. This toggle is locked on and cannot be disabled from the UI; a link whose flag was turned off outside the UI has no Plan tab, and the server withholds its days, places and notes entirely. |
 | **Bookings** (`share_bookings`) | **On** | The Bookings tab with reservations and transport. Also controls whether transport items appear inline in the day plan. |
 | **Packing** (`share_packing`) | Off | The packing list tab, grouped by category |
-| **Budget** (`share_budget`) | Off | The Budget tab with a total summary and line items grouped by category |
-| **Collab** (`share_collab`) | Off | A read-only Chat tab showing messages in chronological order |
+| **Costs** (`share_budget`) | Off | The Costs tab with a total summary and line items grouped by category |
+| **Chat** (`share_collab`) | Off | A read-only Chat tab showing messages in chronological order |
 
 Disabled toggles hide the corresponding tab from the public viewer entirely. Permission changes take effect immediately — you do not need to recreate the link.
 
 ### Which currency guests see
 
-A public viewer has no account, so there is no "their" display currency to use. The Budget tab is rendered in **the sharer's display currency, falling back to the trip's own currency** — in other words, a guest sees the money the way the person who shared the trip sees it. If the sharer leaves their display currency on **Trip currency** (the default), guests read the trip in the trip's own currency. See [Currencies](Currencies).
+A public viewer has no account, so there is no "their" display currency to use. The Costs tab is rendered in **the sharer's display currency, falling back to the trip's own currency** — in other words, a guest sees the money the way the person who shared the trip sees it. If the sharer leaves their display currency on **Trip currency** (the default), guests read the trip in the trip's own currency. See [Currencies](Currencies).
 
 ## What the public viewer shows
 
 The shared trip page renders a branded read-only interface with a dark hero header showing the trip title, description, and date range. A tab bar at the top provides access to the sections you enabled. The viewer can switch the display language using a language picker in the top-right corner.
 
-The Plan tab is always available and shows an interactive map, a collapsible day-by-day itinerary (with places, notes, and transport inline when Bookings is enabled), and accommodation badges per day.
+The Plan tab appears whenever **Map & Plan** is on — which is every link created through the share UI, since that toggle is locked on there. A link whose `share_map` flag was turned off outside the UI (through the REST API or the `create_share_link` MCP tool, both of which take it as a plain boolean) has no Plan tab at all: the server withholds the days, places, assignments and notes entirely, and the viewer opens on the first section the owner did share. A **day picker** sits directly above the map — an **All** pill plus one pill per day (**Day 1**, **Day 2**, …) — and drives the same selection as the day cards below it, so the map and the expanded day never disagree. Pick a day and its stops are numbered on the map in visiting order (a place the day returns to shows both positions on one marker, e.g. `1 · 3`) and joined by a dashed connector. That connector is a straight line showing sequence, not a driving route: TREK will not send a shared itinerary to a third-party routing service on an anonymous visitor's behalf. On **All** the map shows every geocoded place as an unnumbered pin with no connector. Below the map sits a collapsible day-by-day itinerary (with places, notes, and transport inline when Bookings is enabled) and accommodation badges per day.
 
-The Collab tab (when enabled via `share_collab`) shows chat messages grouped by date with sender avatars. Viewers cannot send messages.
+The Chat tab (when enabled via `share_collab`) shows chat messages grouped by date with sender avatars. Viewers cannot send messages.
 
 ## Revoking a share link
 
diff --git a/wiki/Quick-Start.md b/wiki/Quick-Start.md
index 17e7b970d..a7ca3f0d1 100644
--- a/wiki/Quick-Start.md
+++ b/wiki/Quick-Start.md
@@ -14,10 +14,10 @@ Get TREK running in under five minutes with a single Docker command.
 Generate an encryption key and start the container in one step:
 
 ```bash
-ENCRYPTION_KEY=$(openssl rand -hex 32) docker run -d \
+docker run -d \
   --name trek \
   -p 3000:3000 \
-  -e ENCRYPTION_KEY=$ENCRYPTION_KEY \
+  -e ENCRYPTION_KEY="$(openssl rand -hex 32)" \
   -v ./data:/app/data \
   -v ./uploads:/app/uploads \
   --restart unless-stopped \
@@ -35,7 +35,7 @@ ENCRYPTION_KEY=$(openssl rand -hex 32) docker run -d \
 | `-v ./uploads:/app/uploads` | Persist uploaded files |
 | `--restart unless-stopped` | Auto-restart on reboot |
 
-**Why the encryption key?** TREK encrypts stored secrets (API keys, MFA seeds, OIDC credentials) using this key. If you skip it, TREK auto-generates one and saves it to `./data/.encryption_key`. Setting it explicitly means you control the key and can back it up separately.
+**Why the encryption key?** TREK encrypts stored secrets (API keys, MFA seeds, OIDC credentials) using this key. If you skip it, TREK auto-generates one and saves it to `./data/.encryption_key`. Setting it explicitly means you control the key and can back it up separately. The key generated inline above never gets printed, but TREK writes it to `./data/.encryption_key` on first start, so `cat ./data/.encryption_key` gets it back when you want a copy elsewhere.
 
 Generate a standalone key at any time:
 
diff --git a/wiki/Real-Time-Collaboration.md b/wiki/Real-Time-Collaboration.md
index d2a3a8509..b38f979d4 100644
--- a/wiki/Real-Time-Collaboration.md
+++ b/wiki/Real-Time-Collaboration.md
@@ -14,15 +14,18 @@ All changes to a trip — places, day plans, reservations, budget entries, and p
 |-----------|-------|
 | Path | `/ws` |
 | Scope | One room per trip |
-| Rate limit | 30 messages per 10-second window |
+| Rate limit | 30 messages per 10-second window, plus a looser ceiling of 200 frames per 10 seconds that every frame counts against before it is parsed. Live cursor frames (`book:cursor`) are exempt from the tighter limit, not from the looser one |
 | Max payload | 64 KB per message |
 | Heartbeat | Ping every 30 seconds; sockets that miss a pong are terminated |
+| Origin check | Only enforced when `ALLOWED_ORIGINS` is set: an upgrade whose `Origin` header is not an exact match for a list entry is refused with HTTP **403** during the handshake. An upgrade that sends no `Origin` header at all is always admitted |
 
 **Authentication** uses a short-lived ephemeral token passed as a query parameter on connect. If authentication fails, the server closes the connection with one of these codes:
 
 - **4001** — missing, invalid, or expired token; user not found
 - **4403** — site-wide MFA is required but the account does not have MFA enabled
 
+An origin rejection happens before the socket exists, so it produces no close code at all — the browser just reports a failed connection. And because clients that send no `Origin` header are exempt, curl and other CLI clients keep connecting while every browser fails, which makes it look like a client bug. If real-time sync stops working behind a reverse proxy, check that `ALLOWED_ORIGINS` lists the exact scheme, host, and port the browser uses: the comparison is a plain string match, so `https://trek.example.com` matches neither `http://trek.example.com` nor `https://trek.example.com:443`. See [Environment-Variables](Environment-Variables) and [Reverse-Proxy](Reverse-Proxy).
+
 ## The Collab addon
 
 The Collab addon (`collab`) must be enabled by an admin before the panel is visible inside a trip. Once enabled, it provides four sub-features that can each be toggled independently:
diff --git a/wiki/Reservations-and-Bookings.md b/wiki/Reservations-and-Bookings.md
index e12801c8f..0cdde4637 100644
--- a/wiki/Reservations-and-Bookings.md
+++ b/wiki/Reservations-and-Bookings.md
@@ -4,28 +4,34 @@ Track all your trip bookings — hotels, restaurants, events, tours, and more 
 
 ## Where to find it
 
-Open your trip in the planner and select the **Reservations** tab. The panel lists all bookings grouped by status, with a type filter bar at the top.
+Open your trip in the planner and select the **Bookings** tab. The panel lists your hotel, restaurant, event, tour, parking and other bookings grouped by status, with a type filter bar at the top. Transport bookings live on their own **Transports** tab — see [Transport-Flights-Trains-Cars](Transport-Flights-Trains-Cars).
 
 ![Reservations panel](assets/Bookings.png)
 
 ## Reservation types
 
-TREK supports ten reservation types:
+TREK supports sixteen reservation types, split across the two tabs:
 
 | Type | How to create |
 |------|--------------|
 | Flight | [Transport modal](Transport-Flights-Trains-Cars) |
 | Train | [Transport modal](Transport-Flights-Trains-Cars) |
+| Bus | [Transport modal](Transport-Flights-Trains-Cars) |
 | Car | [Transport modal](Transport-Flights-Trains-Cars) |
+| Taxi | [Transport modal](Transport-Flights-Trains-Cars) |
+| Bicycle | [Transport modal](Transport-Flights-Trains-Cars) |
 | Cruise | [Transport modal](Transport-Flights-Trains-Cars) |
-| Hotel | Add button in Reservations panel — see [Accommodations](Accommodations) |
-| Restaurant | Add button in Reservations panel |
-| Event | Add button in Reservations panel |
-| Tour | Add button in Reservations panel |
-| Parking | Add button in Reservations panel — a fixed-location booking (e.g. airport parking) |
-| Other | Add button in Reservations panel |
+| Ferry | [Transport modal](Transport-Flights-Trains-Cars) |
+| Public transit | [Transport modal](Transport-Flights-Trains-Cars) |
+| Other (transport) | [Transport modal](Transport-Flights-Trains-Cars) |
+| Accommodation (Hotel) | Add button in Bookings panel — see [Accommodations](Accommodations) |
+| Restaurant | Add button in Bookings panel |
+| Event | Add button in Bookings panel |
+| Tour | Add button in Bookings panel |
+| Parking | Add button in Bookings panel — a fixed-location booking (e.g. airport parking) |
+| Other | Add button in Bookings panel |
 
-Transport types (Flight, Train, Car, Cruise) are created through the dedicated Transport modal, where you can enter endpoint and transit-specific fields. All other types are created directly from the Reservations panel.
+The ten transport types are created through the dedicated Transport modal on the **Transports** tab, where you can enter endpoint and transit-specific fields. The other six are created directly from the Bookings panel, and only those six appear there.
 
 ## Pending and Confirmed
 
@@ -33,6 +39,8 @@ Reservations are grouped into two collapsible sections: **Pending** and **Confir
 
 On desktop, a type filter bar lets you show only specific types. Filter selections are kept for the current browser session.
 
+A traveler filter sits next to it — on desktop and mobile — once the trip has more than one member and at least one booking has travelers assigned. Click an avatar to show only that person's bookings; several can be active at once. On desktop the selection is kept for the browser session like the type filter; on mobile it resets when you leave the tab.
+
 ## Reservation card contents
 
 Each card displays:
@@ -52,28 +60,33 @@ Each card displays:
   - Flights: airline name, flight number
   - Trains: train number, platform, seat
   - Hotels: check-in window, check-out time (see [Accommodations](Accommodations))
-- **Location / address** — for non-hotel, non-transport types
+- **Location / address** — whenever the booking has one; for a hotel this is the address from its hotel block
 - **Linked accommodation** — hotel name, if this reservation is linked to an accommodation record
 - **Day-plan assignment** — the day and place this reservation is linked to
+- **Link** — the booking URL, opened in a new tab. A link with a scheme TREK refuses to open is shown as plain text instead
 - **Notes**
 - **Attached files** — shown as clickable download links
+- **Travelers** — avatars of the members and guests assigned to this booking, shown only when at least one is assigned
 
 ## Creating a reservation
 
-Click **Add** (or the + button) in the Reservations panel. Fill in the form:
+Click **Add** (or the + button) in the Bookings panel. Fill in the form:
 
 1. **Type** — choose Hotel, Restaurant, Event, Tour, Parking, or Other
 2. **Title** — required
 3. **Link to day-plan assignment** — optional; search across all days and places, grouped by day. Not available for Hotel type
 4. **Start date and time** — not shown for Hotel type
 5. **End date and time** — not shown for Hotel type
-6. **Location / address** — not shown for Hotel type
-7. **Confirmation code**
-8. **Status** — Pending or Confirmed
-9. **Hotel-specific fields** — shown only for Hotel type, immediately after status: hotel place, check-in day, check-out day, check-in time (window start and end), and check-out time. See [Accommodations](Accommodations)
-10. **Notes**
-11. **Files** — attach from your device (PDF, Word documents, text files, images) or link an existing trip file. Files added before saving are uploaded automatically after the reservation is created
-12. **Costs** — shown only when the Budget addon is enabled. Instead of a price field, the form carries a **Create expense** button: it saves the booking and then opens the Costs editor for a new expense linked to it, so the expense gets a payer, a split and a date like any other. Once linked, the block shows that expense with edit and remove actions. See [Budget-Tracking](Budget-Tracking)
+6. **Place / Activity** — optionally link an existing trip place to the booking. Picking one fills in the title and the location only where you left them blank. Not shown for Hotel type, which has its own hotel place picker below
+7. **Location / address** — for Hotel type this field sits in the hotel-specific block instead (item 10)
+8. **Confirmation code**
+9. **Status** — Pending or Confirmed
+10. **Hotel-specific fields** — shown only for Hotel type, immediately after status: hotel place, check-in day, check-out day, location / address, check-in time (window start and end), and check-out time. The address is pre-filled from the picked hotel place, and a hand-typed one is kept if that place has none. See [Accommodations](Accommodations)
+11. **Link** — an optional booking URL, shown for every type
+12. **Notes**
+13. **Travelers** — assign trip members and named guests to this booking. Guests appear in the same picker as members
+14. **Files** — attach from your device (PDF, Word documents, text files, images) or link an existing trip file. Files added before saving are uploaded automatically after the reservation is created
+15. **Costs** — shown only when the Budget addon is enabled. Instead of a price field, the form carries a **Create expense** button: it saves the booking and then opens the Costs editor for a new expense linked to it, so the expense gets a payer, a split and a date like any other. Once linked, the block shows that expense with edit and remove actions. See [Budget-Tracking](Budget-Tracking)
 
 <!-- TODO: screenshot: Create Reservation modal -->
 
@@ -95,14 +108,14 @@ Up to 5 files, 10 MB each, per import.
 
 ### How to import
 
-1. Open the **Reservations** tab.
-2. Click the **Import** (download) button in the toolbar — the button is only shown when the extractor is available on your server.
+1. Open the **Bookings** tab — the same import button also sits in the **Transports** toolbar.
+2. Click the **Import from file** (download) button in the toolbar — the button is only shown when the extractor is available on your server or the AI Parsing addon is enabled.
 3. Drag and drop your files onto the upload area, or click to browse.
-4. TREK parses each file and shows a **preview list** of the detected reservations with type, title, dates, endpoints, and confirmation number.
-5. Deselect any items you do not want to import by clicking the × on their card.
-6. Click **Confirm** to create the selected reservations.
+4. The upload dialog closes right away and a **background widget** in the bottom-right corner shows *Parsing files…*, with a running count when you uploaded more than one file. You can keep working in TREK while it parses — the widget follows you to other pages and survives a reload.
+5. When parsing finishes, click the widget's **Import** button to start the review. If nothing could be extracted, the widget says so instead and offers **Try AI parsing** on the same files when the AI Parsing addon is enabled.
+6. Each detected booking opens **pre-filled in the normal booking (or transport) form**, one after the other, with the file it came from already attached. Nothing is saved until you confirm each one.
 
-All created reservations appear immediately in the panel and are broadcast to all connected trip members in real time.
+Each booking appears in the panel and is broadcast to all connected trip members in real time as you save it.
 
 ### What gets created automatically
 
@@ -112,7 +125,7 @@ All created reservations appear immediately in the panel and are broadcast to al
 
 ### When the button is not visible
 
-The Import button is hidden when the `kitinerary-extractor` binary is not available. The binary ships inside the official TREK Docker image. If you run TREK from source, install the `libkitinerary-bin` package (Debian trixie / Ubuntu 25.04+) or set `KITINERARY_EXTRACTOR_PATH` to the binary's full path. See [Environment-Variables](Environment-Variables).
+The **Import from file** button is hidden only when neither the `kitinerary-extractor` binary nor the [AI Parsing addon](AI-Booking-Import) is available. With the AI addon enabled and configured, import works without the binary — every file goes straight to the model. The binary ships inside the official TREK Docker image. If you run TREK from source, install the `libkitinerary-bin` package (Debian trixie / Ubuntu 25.04+) or set `KITINERARY_EXTRACTOR_PATH` to the binary's full path. See [Environment-Variables](Environment-Variables).
 
 ### Needs review flag
 
@@ -124,13 +137,13 @@ KDE Itinerary only recognises structured tickets. For confirmations it can't rea
 
 ## Import from AirTrail
 
-With the **AirTrail** integration addon enabled and your instance connected under **Settings → Integrations**, the reservations toolbar shows an **AirTrail** button. It lists the flights from your AirTrail account — flights inside the trip dates come pre-selected — and imports each one as a flight reservation that stays in sync with AirTrail both ways.
+With the **AirTrail** integration addon enabled and your instance connected under **Settings → Integrations**, the **Transports** toolbar shows an **AirTrail** button. It lists the flights from your AirTrail account — flights inside the trip dates come pre-selected — and imports each one as a flight reservation that stays in sync with AirTrail both ways.
 
 ### Connecting flights (layovers)
 
 When selected flights form a connection — each leg departs from the airport the previous one landed at, onward within 24 hours — the picker groups them and offers to **import them as one flight with a layover**. The offer is on by default; untick it to keep separate bookings. A joined booking keeps each leg's own airline, flight number, times and seat, the connection airport becomes a layover **stop** on the route, and each leg files into its own day in the planner. Since a stop is not a destination, the layover country no longer shows up as visited in Atlas.
 
-AirTrail itself has no multi-leg flights, so a joined booking is imported **without live sync** (it shows the *Not synced* badge). Its source flights stay recognised — the picker will not offer them for import again. The same applies when you add a stop to a synced single flight by hand: the booking detaches from AirTrail instead of syncing a shape AirTrail cannot represent.
+AirTrail itself has no multi-leg flights, so a joined booking is imported **without live sync**. It keeps the blue **AirTrail** badge — hover it and the tooltip says the layover has no single AirTrail flight to sync back to. The grey *Not synced* badge means something else: that flight was removed in AirTrail. Its source flights stay recognised — the picker will not offer them for import again. The same applies when you add a stop to a synced single flight by hand: the booking detaches from AirTrail instead of syncing a shape AirTrail cannot represent.
 
 ## Editing and deleting
 
diff --git a/wiki/Reverse-Proxy.md b/wiki/Reverse-Proxy.md
index 1da04c571..7006683b2 100644
--- a/wiki/Reverse-Proxy.md
+++ b/wiki/Reverse-Proxy.md
@@ -14,7 +14,7 @@ Putting TREK behind a TLS-terminating reverse proxy is strongly recommended for
 Whatever proxy you use, it must satisfy three constraints:
 
 1. **WebSocket upgrades on `/ws`** — TREK uses WebSockets for real-time sync. Set `proxy_read_timeout 86400` (Nginx) or rely on Caddy's automatic upgrade handling.
-2. **Body size ≥ 500 MB** — backup restore ZIPs can include the full uploads directory. Set `client_max_body_size 500m` (Nginx) or `request_body_max_size 500mb` (Caddy) if you restore large backups.
+2. **Body size ≥ 500 MB** — backup restore ZIPs can include the full uploads directory. Set `client_max_body_size 500m` (Nginx); Caddy imposes no request-body limit of its own, so it already passes them — just keep any `request_body { max_size … }` block you have at `500mb` or more.
 3. **Pass the `Mcp-Session-Id` header through on `/mcp`** — if you use MCP. See below.
 
 ## Nginx
@@ -43,8 +43,11 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_read_timeout 86400;
-        # File uploads are capped at 50 MB; backup restore ZIPs can include the full
-        # uploads directory and may exceed that — raise this value if restores fail.
+        # Documents are capped at 50 MB and photos/covers at 20 MB, but video
+        # uploads go up to 500 MB — both journey gallery clips and videos in a
+        # trip's file manager. Backup restore ZIPs can include the full uploads
+        # directory and may exceed even that (see BACKUP_UPLOAD_LIMIT_MB, default
+        # 500) — raise this value if uploads or restores fail.
         client_max_body_size 500m;
     }
 
@@ -75,11 +78,13 @@ trek.yourdomain.com {
 }
 ```
 
-For large backup restores, add:
+Caddy applies no request-body limit by default, so large backup restores already pass through the config above. Only add `request_body` if you want to cap uploads deliberately — and then keep the cap at 500 MB or more. It is a block, not a one-line directive:
 
 ```
 trek.yourdomain.com {
-    request_body max_size 500mb
+    request_body {
+        max_size 500mb
+    }
     reverse_proxy localhost:3000
 }
 ```
@@ -124,15 +129,18 @@ TREK sends an SSE keep-alive comment every 25 seconds (`MCP_SSE_KEEPALIVE`) prec
 
 ## HTTPS Environment Variables
 
-Four variables control how TREK behaves behind a proxy. They work as a group:
+Five variables control how TREK behaves behind a proxy. They work as a group:
 
 | Variable | Purpose | Default |
 |---|---|---|
 | `FORCE_HTTPS` | When `true`: 301-redirects HTTP→HTTPS (except `/api/health`), sends HSTS (`max-age=31536000`), adds CSP `upgrade-insecure-requests`, forces cookie `secure` flag | `false` |
+| `HSTS_INCLUDE_SUBDOMAINS` | When `true`: adds the `includeSubDomains` directive to the HSTS header, extending HTTPS enforcement to all subdomains. Only effective while HSTS is active. Leave `false` if you run other services on sibling subdomains over plain HTTP. | `false` |
 | `TRUST_PROXY` | Number of trusted proxy hops. Lets Express read the real client IP from `X-Forwarded-For`. Automatically set to `1` in production even if not explicitly configured. | `1` (production), off (development) |
-| `COOKIE_SECURE` | Controls the `secure` flag on `trek_session`. Auto-derived as `true` when `NODE_ENV=production` or `FORCE_HTTPS=true`. Set to `false` explicitly to allow cookies over plain HTTP (e.g. LAN testing without TLS). | auto |
+| `COOKIE_SECURE` | Controls the `secure` flag on `trek_session`. Auto-derived as `true` when `NODE_ENV=production`, when `FORCE_HTTPS=true`, or when the request itself arrived over TLS — Express sets `req.secure` once your proxy sends `X-Forwarded-Proto: https` and `TRUST_PROXY` is configured. Set to `false` explicitly to allow cookies over plain HTTP (e.g. LAN testing without TLS). | auto |
 | `ALLOWED_ORIGINS` | Comma-separated list of allowed CORS origins (e.g. `https://trek.example.com`). In production without this set, all cross-origin requests are blocked. In development without this set, all origins are allowed. | blocked in prod, open in dev |
 
+> **Note on HSTS:** The `max-age=31536000` header goes out whenever `FORCE_HTTPS=true` **or** `NODE_ENV=production`, and `NODE_ENV=production` is the default in the Docker image, the compose file and the Helm chart — so a standard install sends HSTS even with `FORCE_HTTPS` unset. Browsers ignore the header on a plain-HTTP response, so an instance you only ever reach over HTTP is unaffected. Once a browser has seen it over HTTPS, though, it refuses plain HTTP to that hostname for a year, so don't plan on falling back to `http://` for a hostname you have already served over HTTPS.
+
 > **Note on `FORCE_HTTPS` and proxy headers:** The HTTPS redirect reads `X-Forwarded-Proto` directly from the incoming headers — it does not depend on Express's `trust proxy` setting. If you set `FORCE_HTTPS=true` and your reverse proxy correctly sends `X-Forwarded-Proto: https`, the redirect will work regardless of `TRUST_PROXY`. However, you still need `TRUST_PROXY` set so Express resolves the correct client IP from `X-Forwarded-For`.
 
 If you access TREK directly on `http://<host>:3000` without a proxy, leave `FORCE_HTTPS` unset and do not set `TRUST_PROXY`.
diff --git a/wiki/Route-Optimization.md b/wiki/Route-Optimization.md
index e35ae6575..b15c52d31 100644
--- a/wiki/Route-Optimization.md
+++ b/wiki/Route-Optimization.md
@@ -10,25 +10,38 @@ TREK uses **OSRM** (Open Source Routing Machine) to calculate routes between con
 
 The route toggle in the day-plan footer offers a **Driving** and a **Walking** profile (each routed on the matching OSRM network). Installed plugins can add further profiles: a plugin with the `routeProvider` hook — for example an e-mobility plugin that plans charging stops — appears as an extra mode next to Driving/Walking. When such a profile is selected, that plugin computes the day's route: its geometry is drawn on the map, planned stops (e.g. chargers) appear as small dots on the line, and the leg connectors show the plugin's travel times plus any note it attaches ("25 min charge"). If the plugin fails or times out, TREK falls back to straight lines exactly as it does on an OSRM outage.
 
+That toggle sets the **day's** default travel mode. It is stored on the day, so each day of a trip can differ and the choice survives a reload.
+
+A single leg can override the day default: click the connector row between two entries and pick **Driving**, **Walking**, or any plugin profile for that leg alone, or **Use day default** to clear the override again. The same menu sits on the connectors to and from the day's accommodation and on the connector arriving after a transport booking, where it sets the mode of the leg *arriving* at that stop. Every connector shows the icon and the time of the mode its leg was actually drawn with.
+
+When the trip has a start and an end date and you may edit the day, that menu also carries a **Public transit** entry. It opens the automated transit search (see [Transport-Flights-Trains-Cars](Transport-Flights-Trains-Cars)) already filled in with the leg's two endpoints and the departure time of the stop you are leaving.
+
 Route segments reset at any transport reservation (flight, train, car, bus, or cruise) between two places — that leg is not driven or walked, so no ground route is drawn across it.
 
 ## Route display
 
 - Colored line segments connect consecutive places on the map.
-- At zoom level 12 or higher, time pills show the estimated walking and driving time between each pair of consecutive places.
-- When at least two places are on the selected day, total distance and duration are shown in the sidebar footer.
+- Between each pair of consecutive places, a slim connector row in the day plan carries that leg's travel time and distance, with an icon for the mode it was routed in.
 - Plugins can attach time entries to the day plan (e.g. planned charging time at a stop, a security buffer before a flight). They appear as slim rows under the place or booking they belong to, and their minutes are added to the day's footer total as "+X min".
 
 ## Optimize route
 
-The **Optimize** button in the sidebar footer reorders places in the current day to minimize total travel distance using a **nearest-neighbor algorithm**. It starts from the first place, then repeatedly visits the closest unvisited place by straight-line (Euclidean) distance.
+The **Optimize** button in the day's route tools reorders places in the current day to minimize total travel distance. A **nearest-neighbor** pass produces a good starting order, then a **2-opt** pass untangles the crossings that pass leaves behind — both measure straight-line (Euclidean) distance.
 
-Only unlocked places are reordered — locked places stay in their current positions.
+With **Optimize route from accommodation** (Settings → General → Travel & map, on by default) the run is anchored on the day's hotel: a loop out from and back to it, or a hotel-to-hotel run on a transfer day. With the setting off, or on a day whose accommodation has no coordinates, it starts from the first place instead. A day with fewer than three places is left alone on desktop, and the mobile day sheet only offers the button from three up. The **Optimize** action in the plan screen's **Plan** mode has no such floor — two movable places with coordinates are enough, and with a hotel anchoring the run even those two can swap.
+
+Only free places are reordered. A place keeps its slot if you locked it, or if it has a time set — a timed stop is anchored by its time. Those stops stay where they are and the reordered ones fill the gaps between them. On mobile there is no lock, so only a set time pins a stop.
 
 The reorder can be undone immediately using the undo action that appears after it is applied.
 
-## Export day to Google Maps
+## Open the day in a map app
 
-The **Open in Google Maps** button (icon next to Optimize) generates a `https://www.google.com/maps/dir/lat,lng/lat,lng/…` URL containing all places in order and opens it in a new tab.
+Two icon buttons in the day's route tools hand the current day to an external map app, both using its places in planned order, bookended by the day's accommodation exactly the way the drawn route is.
+
+**Open in Google Maps** builds a `https://www.google.com/maps/dir/lat,lng/lat,lng/…` URL containing all stops in order and opens it in a new tab. A day with a single stop opens as a map search on that point instead.
+
+**Open in CoMaps** (the compass icon beside it) hands the same day to CoMaps for offline navigation and carries the day's travel mode with it — the day's own default, or the current route profile when the day has none. A day of exactly two stops goes over as a real turn-by-turn route in that mode (walking as pedestrian, cycling as bicycle, everything else as vehicle). Any other day goes over as named pins, because CoMaps' route link takes a start and a destination and nothing between them, and handing over the whole day beats quietly dropping the middle of the plan. For the full itinerary as one navigable track, use the GPX export.
+
+Both buttons are on mobile as well, in the day sheet.
 
 **See also:** [Day-Plans-and-Notes](Day-Plans-and-Notes) · [Map-Features](Map-Features) · [Display-Settings](Display-Settings)
diff --git a/wiki/Security-Hardening.md b/wiki/Security-Hardening.md
index dfb51bb0f..fea986ee5 100644
--- a/wiki/Security-Hardening.md
+++ b/wiki/Security-Hardening.md
@@ -12,19 +12,20 @@ A production TREK deployment checklist. All items reference actual TREK configur
 
 - [ ] Run TREK behind a TLS-terminating reverse proxy (nginx, Caddy, Traefik). See [Reverse-Proxy](Reverse-Proxy).
 - [ ] Set `TRUST_PROXY=1` so client IPs are captured correctly in the audit log. In `NODE_ENV=production` this defaults to `1` automatically, but set it explicitly if you use a non-standard proxy hop count.
-- [ ] Set `FORCE_HTTPS=true` to enable HSTS (`max-age=31536000`), redirect HTTP to HTTPS, and add `upgrade-insecure-requests` to the CSP. Requires `TRUST_PROXY` — omitting it causes a redirect loop.
-- [ ] Keep `ALLOW_INTERNAL_NETWORK=false` unless Immich or Synology is on your LAN. See [Internal-Network-Access](Internal-Network-Access). Note: loopback (`127.x`, `::1`) and link-local (`169.254.x`) addresses are always blocked regardless of this setting.
+- [ ] Set `FORCE_HTTPS=true` to 301-redirect HTTP to HTTPS and add `upgrade-insecure-requests` to the CSP. Your proxy must send `X-Forwarded-Proto: https` (or terminate TLS on the same connection), otherwise the redirect fires on every request and loops.
+- [ ] Know that HSTS (`max-age=31536000`) does not depend on `FORCE_HTTPS`: it is sent whenever `FORCE_HTTPS=true` **or** `NODE_ENV=production`, which the Docker image sets by default — so an instance behind Traefik, Caddy or a Cloudflare Tunnel advertises HSTS without setting `FORCE_HTTPS` at all. Set `HSTS_INCLUDE_SUBDOMAINS=true` to add `includeSubDomains`; it is off by default so an install on an apex domain does not force HTTPS onto sibling subdomains you may still serve over plain HTTP.
+- [ ] Keep `ALLOW_INTERNAL_NETWORK=false` unless a strict-guard integration — Immich, Synology Photos, AirTrail, a notification webhook or ntfy — is on your LAN. See [Internal-Network-Access](Internal-Network-Access). Note: loopback (`127.x`, `::1`) and link-local (`169.254.x`) addresses are always blocked regardless of this setting.
 
 ## Authentication
 
 - [ ] Enable two-factor authentication for your admin account. See [Two-Factor-Authentication](Two-Factor-Authentication).
-- [ ] Require MFA for all users via [Admin-Permissions](Admin-Permissions) if your use case demands it. Note: you must have MFA enabled on your own admin account before you can enforce it globally.
+- [ ] Require MFA for all users if your use case demands it: Admin Panel → Settings → **Require two-factor authentication (2FA)**. Note: you must secure your own admin account first, with either TOTP or a registered passkey — the server refuses the toggle otherwise. A passkey satisfies the policy for everyone else too, so nobody is forced onto TOTP specifically.
 - [ ] Disable open registration if you control who can access the instance. See [Admin-Users-and-Invites](Admin-Users-and-Invites).
-- [ ] Rotate the JWT signing secret if a session may have been leaked: Admin Panel → Admin → Rotate JWT Secret (`POST /api/admin/rotate-jwt-secret`). This invalidates all active sessions immediately.
+- [ ] Rotate the JWT signing secret if a session may have been leaked: Admin Panel → Settings → Danger Zone → **Rotate** (`POST /api/admin/rotate-jwt-secret`). This invalidates all active sessions immediately, including your own.
 
 ## Session Security
 
-TREK stores sessions as JWTs in an httpOnly `trek_session` cookie (SameSite=Lax, 24-hour expiry). The `secure` flag is set automatically when `NODE_ENV=production` or `FORCE_HTTPS=true`. Tokens are also accepted via `Authorization: Bearer` header for MCP and API clients.
+TREK stores sessions as JWTs in an httpOnly `trek_session` cookie (SameSite=Lax). A normal login expires after `SESSION_DURATION` (default 24 hours) and rides in a browser-session cookie that the browser drops when it closes; ticking **Remember me** issues a persistent cookie whose lifetime and JWT expiry are `SESSION_DURATION_REMEMBER` (default 30 days) — shorten it if a 30-day window is too wide for your threat model. The `secure` flag is set automatically when `NODE_ENV=production`, when `FORCE_HTTPS=true`, or when Express sees that the request arrived over TLS (`X-Forwarded-Proto: https`) — the last of those needs `trust proxy` active, which is automatic in production and otherwise means setting `TRUST_PROXY` yourself. Tokens are also accepted via `Authorization: Bearer` header for MCP and API clients.
 
 - [ ] Ensure `FORCE_HTTPS=true` (or `NODE_ENV=production`) so the `trek_session` cookie carries the `secure` flag and is never sent over plain HTTP.
 - [ ] Set `COOKIE_SECURE=false` only as a temporary escape hatch for LAN testing without TLS — do not use in production.
@@ -58,9 +59,9 @@ These limits are per source IP. If TREK is behind a reverse proxy, set `TRUST_PR
 Helmet applies a strict CSP on all responses. Key directives:
 
 - `default-src 'self'`
-- `script-src 'self' 'wasm-unsafe-eval'` (no `unsafe-inline`)
-- `object-src 'none'`
-- `frame-src 'none'`
+- `script-src 'self' 'wasm-unsafe-eval' 'unsafe-eval'` (no `unsafe-inline`; `'unsafe-eval'` is required by the in-browser HEIC converter, which initialises through `new Function()`)
+- `object-src 'self'` (so same-origin file previews can embed PDFs via `<object>`/`<embed>`)
+- `frame-src 'self'` (for the sandboxed plugin frames at `/plugin-frame/*`, which run at an opaque origin under their own CSP)
 - `frameAncestors 'self'` (prevents clickjacking from external frames)
 - `upgrade-insecure-requests` (added automatically when `FORCE_HTTPS=true`)
 
@@ -70,7 +71,7 @@ Installed plugins run **untrusted third-party code**. TREK contains a plugin in
 
 - [ ] Leave the plugin system's defaults in place. It is **on by default** but installed plugins still have to be **activated one by one**, so no third-party code runs until an admin turns a specific plugin on. Set `TREK_PLUGINS_ENABLED=false` (accepts `false`/`0`/`off`/`no`) to switch the whole system off — installed plugins stay on disk, deactivated, and the runtime is idle.
 - [ ] Keep the **OS permission jail** enabled (the default). In production each plugin runs in an isolated child process launched with Node's `--permission` model: filesystem **writes**, `child_process`, worker threads and native addons are denied outright, and reads are scoped to just the plugin's own code — so a plugin cannot read `trek.db` or the secret files, or shell out. The child's environment is scrubbed (no `JWT_SECRET`, no DB credentials). Setting `TREK_PLUGIN_PERMISSIONS=off` disables this jail (isolation then falls back to crash-only) and logs a loud warning — only ever do this on a machine you fully trust.
-- [ ] Rely on the **private-egress block** (SSRF backstop). Even a plugin that declared an outbound host cannot reach a destination that resolves to a loopback, private, link-local, ULA, carrier-grade-NAT, cloud-metadata (`169.254.169.254`), multicast or reserved address — the guard re-checks the resolved IP, so a plugin can't pivot to internal services or DNS-rebind to them. This is independent of `ALLOW_INTERNAL_NETWORK` (which only governs core Immich/Synology features).
+- [ ] Rely on the **private-egress block** (SSRF backstop). Even a plugin that declared an outbound host cannot reach a destination that resolves to a loopback, private, link-local, ULA, carrier-grade-NAT, cloud-metadata (`169.254.169.254`), multicast or reserved address — the guard re-checks the resolved IP, so a plugin can't pivot to internal services or DNS-rebind to them. This is independent of `ALLOW_INTERNAL_NETWORK` (which governs the core integrations reached through the strict guard — Immich, Synology Photos, AirTrail, notification webhooks and ntfy — not plugin egress). The one escape hatch is `TREK_PLUGIN_ALLOW_PRIVATE_EGRESS=on`, for a plugin that has to reach a service on your LAN (a Gotify, an ntfy, an Ollama). It is instance-wide rather than per plugin, and it lifts the block entirely rather than narrowing it: a declared host may then resolve to any address, the `169.254.169.254` metadata IP included, and unix-socket or named-pipe connects (`docker.sock`, a local database socket) are permitted without even being declared, since the OS jail does not gate socket connects. Leave it unset unless a specific plugin genuinely needs a LAN target.
 - [ ] The supervisor caps each plugin's **resident memory** (default 300 MB, `TREK_PLUGIN_MAX_RSS_MB`) — measured host-side from the OS, never the plugin's self-report — and kills a plugin that blows the ceiling or stops sending heartbeats; repeat offenders auto-disable. Every `ctx.*` capability call is also **rate-limited** at the dispatch boundary (a token bucket: ~60-call burst, 20 calls/sec sustained, 16 concurrent; `TREK_PLUGIN_RPC_BURST` / `TREK_PLUGIN_RPC_PER_SEC` / `TREK_PLUGIN_RPC_INFLIGHT`), so one plugin in a tight loop gets throttled instead of freezing the instance.
 - [ ] Review the **capability audit** if you grant plugins broad data access. Every host-mediated core-data read and broadcast a plugin makes is recorded at the RPC boundary against the real acting user (not a value the plugin supplies) in a per-plugin, hash-chained, tamper-evident log. Admins see it per plugin; each user can see "what have plugins done in my name?". Retention is capped per plugin (default 20 000 rows, `TREK_PLUGIN_AUDIT_MAX_ROWS`).
 
diff --git a/wiki/Tags-and-Categories.md b/wiki/Tags-and-Categories.md
index cdb8274db..6e357edaf 100644
--- a/wiki/Tags-and-Categories.md
+++ b/wiki/Tags-and-Categories.md
@@ -3,7 +3,7 @@
 TREK has two independent labelling systems for places:
 
 - **Global Place Categories** — admin-managed, shared across every user on the instance (e.g. `Restaurant`, `Museum`).
-- **Personal Tags** — user-scoped, private labels (e.g. `hidden gem`, `kid-friendly`).
+- **Personal Tags** — user-scoped labels (e.g. `hidden gem`, `kid-friendly`).
 
 <!-- TODO: screenshot: tag list on place detail -->
 
@@ -28,18 +28,24 @@ Categories appear in:
 
 ## Personal Tags
 
-Tags are private labels owned by each user. They attach to individual places via a many-to-many relationship (`place_tags` table), so the same tag can be applied to as many places as you like, and a single place can carry multiple tags.
+Tags are personal labels owned by each user. They attach to individual places via a many-to-many relationship (`place_tags` table), so the same tag can be applied to as many places as you like, and a single place can carry multiple tags.
 
 **Fields per tag:**
 
 - **Name** — free-form text.
 - **Color** — hex value displayed alongside the tag name. Default: `#10b981` (emerald).
 
-Tags are scoped to their creator — other trip members do not see your tags, and different users can create tags with identical names without conflict. Deleting a tag automatically removes it from every place it was attached to.
+Tags are owned by their creator, but only the *list* is private. `GET /api/tags` and the `list_tags` MCP tool return only your own tags, and tag names carry no uniqueness constraint, so different users — or even the same user — can create tags with identical names without conflict.
+
+A tag you attach to a place is **not** private. It becomes part of that place: the place read-back joins `place_tags` → `tags` with no owner filter, so every trip member gets it from `GET /api/trips/:id/places`, the day and assignment endpoints, and the MCP `list_places` tool and `trek://trips/{tripId}/places` resource — gated by trip access alone. The `?tag=` filter on the places list is likewise not user-scoped, so a member can filter by a co-traveller's tag ID. This is deliberate: a tag is kept as long as its owner is on the trip roster, so a co-traveller's tag is not silently stripped when another member re-saves the place. A tag owned by someone outside the trip is dropped instead.
+
+If a trip has a public share link with the map/itinerary section enabled, the tags of places **scheduled on a day** also reach anonymous viewers — trimmed to the tag's ID, name and color, so the owner's user ID never leaves the server. Unscheduled places in the shared place pool carry no tags.
+
+In practice these tags surface through the API and MCP rather than in the app — no view renders a place's tags yet. Deleting a tag automatically removes it from every place it was attached to.
 
 ### Where to manage them
 
-At the moment tags are exposed primarily through the MCP API — AI assistants connected to your instance can list, create, update, and delete tags (`list_tags`, `create_tag`, `update_tag`, `delete_tag`) and attach them to places through the place endpoints. A dedicated web UI for tag management is not yet available; the filter `tag` parameter on the places API / MCP resource does support filtering places by a tag ID once one exists.
+At the moment tags are exposed primarily through the MCP API — AI assistants connected to your instance can list, create, update, and delete tags (`list_tags`, `create_tag`, `update_tag`, `delete_tag`) and attach them to places through the place endpoints. A dedicated web UI for tag management is not yet available; the filter `tag` parameter on the places API and on the MCP `list_places` tool does support filtering places by a tag ID once one exists (the `trek://trips/{tripId}/places` MCP resource only filters by `assignment`).
 
 > **AI / MCP:** See [MCP-Tools-and-Resources](MCP-Tools-and-Resources) for the full tag tool list.
 
diff --git a/wiki/Todos-and-Tasks.md b/wiki/Todos-and-Tasks.md
index aec4ccde4..a720b137c 100644
--- a/wiki/Todos-and-Tasks.md
+++ b/wiki/Todos-and-Tasks.md
@@ -14,7 +14,7 @@ Open the **Lists** tab inside the trip planner and select **Todo**. The Todo fea
 
 The panel is divided into two columns by default:
 
-- **Left sidebar** — category navigation, smart filters, sort toggle, and a completion progress card.
+- **Left sidebar** — list navigation, smart filters, sort toggle, and a completion progress card.
 - **Task list** — the tasks that match the active filter.
 
 When you click a task, a **detail pane** opens as a third column on the right side of the task list (on desktop) or slides up as a bottom sheet (on mobile). The new-task form also opens as a modal overlay.
@@ -29,7 +29,7 @@ Each task has the following fields:
 |---|---|
 | Name | Required. |
 | Checked | Boolean — marks the task done. |
-| Category | Optional grouping label. |
+| List | Optional grouping label. The sidebar heading is **Lists**, the button reads **Add list**, and a task without one shows **No list**. |
 | Due date | Optional date. |
 | Description | Optional free-text body. |
 | Assignee | Optional trip member. |
@@ -55,7 +55,7 @@ Tasks with no priority set show no badge.
 | **My tasks** | Unchecked tasks assigned to you. |
 | **Overdue** | Unchecked tasks with a past due date. |
 | **Done** | Checked tasks. |
-| Per-category rows | All tasks in that specific category (checked and unchecked). |
+| Per-list rows | All tasks in that specific list (checked and unchecked). |
 
 ## Sort by priority
 
@@ -63,7 +63,7 @@ Toggle the **Priority** button in the sidebar to sort the current task list from
 
 ## Adding tasks
 
-Click the **+ Add task** button in the top-right corner of the Lists panel header (visible when the **Todo** sub-tab is active). A new-task form opens as a modal where you can set all fields before saving. On mobile it slides up from the bottom of the screen.
+Click the **+ Add new task** button in the top-right corner of the Lists panel header (visible when the **To-Do** sub-tab is active). A new-task form opens as a modal where you can set all fields before saving. On mobile it slides up from the bottom of the screen.
 
 ## Permissions
 
diff --git a/wiki/Transport-Flights-Trains-Cars.md b/wiki/Transport-Flights-Trains-Cars.md
index 12729cfd8..18fde44b5 100644
--- a/wiki/Transport-Flights-Trains-Cars.md
+++ b/wiki/Transport-Flights-Trains-Cars.md
@@ -6,18 +6,20 @@ Log flights, trains, car rentals, and cruises with departure and arrival endpoin
 
 ## Where to create
 
-Open the **Transports** tab in the trip planner and click **Add**, or open the planner from a day view and use the transport shortcut. Transport records appear in the [Reservations](Reservations-and-Bookings) panel alongside other bookings.
+Open the **Transports** tab in the trip planner and click **Add**, or open the planner from a day view and use the transport shortcut. Transport records stay on the **Transports** tab — the [Bookings](Reservations-and-Bookings) tab lists only the non-transport reservations (accommodation, restaurant, event, tour, parking, other), so the same record never shows up on both. Transports do appear next to your other bookings in two other places: inline in the day plan, and on a [public share link](Public-Share-Links), whose single **Bookings** tab lists reservations and transport together.
 
 ## Public transit search
 
-The **Add transport** dialog has two modes: **Manual transport** (the classic form) and **Automated transport** — a public-transit route search powered by [Transitous](https://transitous.org/), free open data with no API key or paid provider. The **transit button** (tram icon) on each day header opens the dialog straight in the Automated mode. (The rename pencil this button replaced moved next to the day name in the day detail panel.)
+The **Add transport** dialog has two modes: **Manual** (the classic form) and **Automated** — a public-transit route search powered by [Transitous](https://transitous.org/), free open data with no API key or paid provider. The **transit button** (tram icon) on each day header opens the dialog straight in the Automated mode. (The rename pencil this button replaced moved next to the day name in the day detail panel.)
+
+You can also start the search from a single leg: click the travel-time connector between two stops in the day plan and pick **Public transit** from the menu. The search opens with that leg's start and end already filled in and the departure time taken from the stop you are leaving.
 
 The mode switch only appears when the trip has a **start date and an end date** — a transit search needs real dates to depart against. On a trip without dates the dialog opens directly on the manual form; add dates in the trip settings to get the Automated mode back.
 
 - Pick **from** and **to** (stop/station search; the day's own places and hotels appear as quick picks), a **depart/arrive** time, and filter by mode: train, subway, tram, bus, ferry, cable car.
 - Rank the results by **best route**, **fewer transfers**, or **less walking**.
 - Each result shows local departure/arrival times, duration, transfers, walking time and the line badges in their official colors; expand it for the stop-by-stop breakdown.
-- **Add to day** saves the chosen connection as a first-class **transit** entry. It slots into the day timeline at its departure time and shows its line badges, transfers and walking time right in the plan. Clicking it opens the **journey view**: the full stop-by-stop itinerary together with the editable booking fields (title, status, confirmation code, notes), a **Change route** action that re-runs the search and replaces the itinerary, and delete. In the Transports tab these journeys appear in their own **Automated public transit** section.
+- **Add to day** saves the chosen connection as a first-class **transit** entry. It slots into the day timeline at its departure time and shows its line badges, transfers and walking time right in the plan. Clicking it opens the **journey view**: the full stop-by-stop itinerary together with the editable title and notes, a **Change route** action that re-runs the search and replaces the itinerary, and delete. In the Transports tab these journeys appear in their own **Automated public transit** section.
 
 Self-hosters can point the `TRANSIT_API_URL` environment variable at their own MOTIS instance.
 
@@ -52,16 +54,19 @@ Once you select an airport, the **timezone** for that airport appears next to th
 
 ### Trains, cars, and cruises
 
-Departure and arrival fields use the **generic location picker** — search by place name or enter a free-text location. Results come from the maps search service.
+Departure and arrival fields use the **generic location picker** — type at least three characters and pick one of the search results; a name that is only typed, never picked, is not saved. Results come from the maps search service.
 
-If you use **car rentals** instead of your own Car, the departure field is labelled **Pickup date/time** and the arrival field is labelled **Return date/time**.
+For the **Car** type the date fields are relabelled to match a rental: the departure side reads **Pickup** and **Pickup time**, the arrival side **Return** and **Return time**. There is no separate car-rental type — a rental and your own car are both logged as Car.
 
 ## Flight-specific fields
 
-When the type is set to Flight, two additional fields appear:
+When the type is set to Flight, three additional fields appear on every leg:
 
 - **Airline** — carrier name (e.g. Lufthansa)
 - **Flight number** — (e.g. LH 123)
+- **Seat** — seat number (e.g. 12A)
+
+A flight with more than two airports gets a fourth per-leg field, its own **booking / confirmation code**, so each segment of a connecting itinerary can carry its own reference.
 
 ## Train-specific fields (multi-leg route)
 
@@ -77,11 +82,11 @@ Trains created before this feature keep working: their existing train number/pla
 
 Transport records with both endpoints set appear as lines on the trip map:
 
-- **Flights** and **cruises** render as geodesic great-circle curves that follow the curvature of the Earth.
+- **Flights**, **cruises** and **ferries** render as geodesic great-circle curves that follow the curvature of the Earth.
 - **Cars**, **buses**, **taxis** and **bicycles** follow **real roads**, routed on demand via a public OSRM router (driving for car/bus/taxi, cycling for bicycle). A straight line shows while the route loads, and is kept if routing fails or the trip is over ~2000 km.
 - **Trains** render as a straight polyline; a **multi-leg train** draws its full station chain (from → stop → to).
 
-Confirmed bookings are drawn as solid lines; pending bookings use a dashed line. Endpoint markers are shown at each location. For flights, a midpoint label appears along the arc showing the route codes (e.g. ZRH → JFK) and flight duration and distance when enough screen space is available.
+Confirmed bookings are drawn as solid lines; pending bookings use a dashed line. Each endpoint gets a pill-shaped marker with the transport icon. Turn on **Booking route labels** (Settings → General → Travel & map) to print the airport code or station name in the pill as well; the label appears once the two endpoints are far enough apart on screen.
 
 See [Map-Features](Map-Features) for details on how these overlays work.
 
diff --git a/wiki/Trip-Members-and-Sharing.md b/wiki/Trip-Members-and-Sharing.md
index 651e58e34..971f67d3a 100644
--- a/wiki/Trip-Members-and-Sharing.md
+++ b/wiki/Trip-Members-and-Sharing.md
@@ -4,8 +4,8 @@
 
 ## Opening the Members Panel
 
-- From the **dashboard**: click the share/members icon on a trip card.
 - From the **trip planner**: click the Share button in the top navigation bar.
+- On **mobile**: open the trip, then **More** → **Share Trip**.
 
 When you have the `share_manage` permission the modal opens to a two-column layout on wider screens (members on the left, share link on the right). Without that permission only the members column is shown. On narrow screens the columns always stack.
 
@@ -15,7 +15,7 @@ The left column lists everyone who has access to the trip.
 
 - The **trip owner** is marked with a crown badge.
 - Your own entry is labeled **(you)**.
-- Each non-owner member shows a remove button.
+- A remove button appears on your own row, and on every non-owner row if you have the `member_manage` permission.
 
 ### Inviting Members
 
@@ -29,6 +29,12 @@ If you click the remove icon next to **your own** name, the action is labeled **
 
 The trip owner cannot be removed through this panel.
 
+### Transferring Ownership
+
+Only the current owner sees a crown button next to each non-owner member. Click it and confirm the prompt — that member becomes the trip owner, you drop to a regular member, and the page reloads so the new permissions take effect everywhere.
+
+Guests are never listed among the members, and the server refuses to hand ownership to one.
+
 ## Guest Members
 
 Not everyone on a trip has — or wants — a TREK account. **Guests** let you add travel companions by name only, so you can assign them to costs, packing and tasks just like a real member, without creating a login for them.
@@ -43,7 +49,7 @@ Only the **trip owner** can manage guests (this is stricter than inviting member
 
 Other members see the Guests section too (when guests exist) but cannot add, rename or remove them.
 
-> If two guests share a name, TREK keeps them distinct internally (the second "Anna" becomes "Anna 2"), so assignments never get confused.
+> Two guests may share the same name — TREK stores the name you type as-is and keeps the two apart by their internal id, so assignments never get confused. A guest name may be at most 50 characters.
 
 ### What a guest can be assigned to
 
@@ -87,7 +93,7 @@ Viewers do not need to log in. The link can be shared with anyone.
 
 ### Creating a Link
 
-Click **Create share link**. A URL is generated and shown with a copy button.
+Click **Create link** in the **Public Link** section. A URL is generated and shown with a copy button.
 
 ### Permission Toggles
 
@@ -95,17 +101,17 @@ Before or after creating the link, you can control what the link exposes. Toggle
 
 | Toggle | Default | What it shows |
 |---|---|---|
-| **Map** | Always on | Trip map with place markers — cannot be disabled |
+| **Map & Plan** | Always on | Trip map, the day plan (days, activities, day notes) and the place list — cannot be disabled |
 | **Bookings** | On | Reservations and accommodations |
 | **Packing** | Off | Packing list |
-| **Budget** | Off | Budget tab |
-| **Collab** | Off | Read-only view of notes, chat, and polls |
+| **Costs** | Off | Costs tab |
+| **Chat** | Off | Read-only view of the trip chat (collab notes and polls are never shared) |
 
 Changes to toggles take effect immediately for an existing link.
 
 ### Deleting a Link
 
-Click **Delete link** (red button below the URL) to revoke access. The token is invalidated and existing viewers are redirected.
+Click **Delete link** (red button below the URL) to revoke access. The token is invalidated; anyone who opens the old URL now sees *Link expired or invalid*.
 
 ## Trip Invite Link
 
@@ -118,7 +124,7 @@ Below the public share link, users with the `share_manage` permission can also c
 Unlike the read-only share link, this one is **not anonymous**:
 
 - Whoever opens it must have a TREK account and be **signed in**. If they are not, they are sent to the login page and returned to the invite afterwards — there is **no registration** from this link.
-- Anyone who opens it while signed in is added to the trip as a **member** (the same access a manually-added member gets). The owner and existing members are simply taken straight to the trip.
+- Opening it while signed in shows a confirmation card naming the trip. Clicking **Join trip** adds you as a **member** (the same access a manually-added member gets) and opens the trip. The owner and existing members see the same card and are simply taken to the trip when they accept.
 - To invite people who do **not** yet have an account, use an admin invite link with an optional trip binding instead — see [Invite-Links](Invite-Links).
 
 ### Creating and revoking
diff --git a/wiki/Trip-Planner-Overview.md b/wiki/Trip-Planner-Overview.md
index 53d9cef67..957116dc0 100644
--- a/wiki/Trip-Planner-Overview.md
+++ b/wiki/Trip-Planner-Overview.md
@@ -1,6 +1,6 @@
 # Trip Planner Overview
 
-The trip planner is the main workspace for building your itinerary. It opens automatically after you create a trip, or any time you click a trip card on the dashboard.
+The trip planner is the main workspace for building your itinerary. You open it by clicking a trip card on the dashboard.
 
 ![Trip Planner](assets/TripPlannerWithPlane.png)
 
@@ -25,7 +25,7 @@ Each sidebar has a drag handle on its inner edge for resizing.
 
 ![Planner in its three-pane layout: the day plan sidebar with days, places, notes and flight entries on the left, the map in the centre, and the places sidebar with search and category filter on the right](assets/TripPlanner.png)
 
-A **Day Detail overlay** slides in over the center pane when you open a specific day, showing weather, the day's notes, reservation summaries, and the accommodation block. It can be minimized without closing it.
+A **Day Detail panel** floats over the map area when you open a specific day, showing the weather forecast, that day's reservations, and the accommodation block. It can be collapsed to a slim header bar without closing it.
 
 ## Tabs
 
@@ -35,7 +35,7 @@ The tab bar sits directly below the main navigation bar.
 |---|---|
 | **Plan** | The three-pane map view described above. Always visible. |
 | **Transports** | Flights, trains, cars, cruises, and buses. |
-| **Reservations** | Hotels, restaurants, events, tours, and other bookings. |
+| **Bookings** | Hotels, restaurants, events, tours, and other bookings. |
 | **Lists** | Packing list and to-do list. |
 | **Costs** | Expense tracking, splitting, and settlement. |
 | **Files** | Document manager for receipts, tickets, and other files. |
@@ -47,16 +47,11 @@ The active tab is saved in `sessionStorage` per trip, so switching between trips
 
 ## Mobile Layout
 
-On screens narrower than 768 px, the two sidebars are not shown side-by-side. Instead, two floating buttons appear over the map:
-
-- **Plan** — opens the Day Plan Sidebar as a full-screen overlay.
-- **Places** — opens the Places Sidebar as a full-screen overlay.
-
-Tap outside the overlay or use the close button to return to the map.
+On screens narrower than 768 px, TREK does not squeeze the three-pane layout — it opens a dedicated mobile trip screen instead: a day-chip rail under the top bar, a switch between the day plan and a full-screen map, and a bottom dock for the other tabs. Tablets and desktops (768 px and up) get the three-pane layout described above.
 
 ## Undo
 
-The planner tracks your recent actions — adding places, assigning them to days, reordering, and removing assignments — in a short undo ring. The **Undo** button appears in the Day Plan Sidebar toolbar (at the top of the sidebar) whenever an undoable action is available. It shows the name of the last action as a tooltip on hover and reverses it when clicked.
+The planner tracks your recent actions — adding places, assigning them to days, reordering, and removing assignments — in a short undo ring. The **Undo** button sits in the Day Plan Sidebar toolbar (at the top of the sidebar); it is greyed out until an undoable action is available. It shows the name of the last action as a tooltip on hover and reverses it when clicked.
 
 ## Splash Screen
 
diff --git a/wiki/Troubleshooting.md b/wiki/Troubleshooting.md
index 28d6ef815..555d8fdb2 100644
--- a/wiki/Troubleshooting.md
+++ b/wiki/Troubleshooting.md
@@ -105,9 +105,13 @@ If you are accessing TREK directly on `http://<host>:3000` with no proxy, remove
 
 ## Locked out of MFA / lost authenticator
 
-**Fix:** If you still have access to your account, use one of the 10 backup codes generated during MFA setup to complete login. After signing in, go to **Settings > Security** to disable or reconfigure MFA.
+**Fix:** If you still have access to your account, use one of the 10 backup codes generated during MFA setup to complete login. After signing in, go to **Settings > Account** to disable or reconfigure MFA.
 
-If you no longer have access to backup codes and cannot log in, an admin must disable MFA for your account directly in the database, or use the `reset-admin.js` script to regain access to an admin account. There is no per-user MFA reset in the Admin Panel UI — the Admin Panel only controls the global "require MFA for all users" policy. See [Admin: Users and Invites](Admin-Users-and-Invites).
+If you no longer have access to backup codes and cannot log in, an admin can clear your MFA for you: `DELETE /api/admin/users/<id>/mfa` (admin session required). It clears `mfa_enabled`, `mfa_secret` and `mfa_backup_codes` — the same three columns a self-service disable clears — and is written to the audit log as `admin.user_mfa_reset`.
+
+The endpoint refuses to reset the caller's own account (*"Use Settings to change your own two-factor setup"*), so an admin cannot unlock themselves with it. If the locked-out account is the only admin, run `reset-admin.js` with a **new** `RESET_ADMIN_EMAIL` to create a second admin account — for an email that already exists the script only resets the password and role and leaves MFA untouched, so you would still hit the TOTP prompt — then sign in as that account and clear the first one's MFA. Hand-editing the database is the last resort, not the only route.
+
+There is no button for it: the Admin Panel UI has no per-user MFA reset (the user modal offers only **Reset passkeys**) — it only controls the global "require MFA for all users" policy. See [Admin: Users and Invites](Admin-Users-and-Invites).
 
 ---
 
@@ -123,7 +127,7 @@ If you no longer have access to backup codes and cannot log in, an admin must di
 
 **Cause:** Your reverse proxy has a default body size limit (commonly 1 MB or 10 MB) that is smaller than the backup ZIP. Backup archives include the full uploads directory and can be large.
 
-**Fix:** Raise the body size limit in your proxy config. TREK's own backup upload cap is 500 MB. For nginx:
+**Fix:** Raise the body size limit in your proxy config. TREK's own cap on the uploaded (compressed) archive is 500 MB by default. For nginx:
 
 ```nginx
 client_max_body_size 500m;
@@ -131,18 +135,36 @@ client_max_body_size 500m;
 
 Add this to the `location /` block (or the specific backup route). See [Reverse Proxy](Reverse-Proxy) and [Backups](Backups).
 
+If the archive is genuinely larger than that, raise TREK's own caps too. There are two, and they are independent: one on the compressed upload, one on the total **decompressed** size of the archive (the zip-bomb guard). An archive that gets past the upload limit can still be refused part-way through extraction with `Backup exceeds the maximum decompressed size.`
+
+```yaml
+environment:
+  - BACKUP_UPLOAD_LIMIT_MB=2000       # compressed upload cap (default: 500)
+  - BACKUP_MAX_DECOMPRESSED_MB=20480  # decompressed cap (default: 5120, i.e. 5 GB)
+```
+
+Keep the proxy's `client_max_body_size` at or above `BACKUP_UPLOAD_LIMIT_MB`. Non-positive or invalid values for either variable abort startup.
+
 ---
 
 ## "Cannot find module" on startup
 
-**Likely cause:** A Docker volume mount is missing or the `/app/data` and `/app/uploads` directories are not writable by the container process. TREK automatically creates all required subdirectories on startup (`data/logs`, `data/backups`, `data/tmp`, `uploads/files`, `uploads/covers`, `uploads/avatars`, `uploads/photos`) — if this fails because the volume is read-only or owned by the wrong user, startup will abort.
+**Likely cause:** A volume is mounted at `/app`, which hides the application code (`node_modules` and `dist`) shipped inside the image. Mount only the data and uploads directories — `-v ./data:/app/data -v ./uploads:/app/uploads` — never `/app` itself. Current images detect this before Node starts and print `FATAL: TREK application files are missing from the image.` instead of the bare module error.
 
-**Fix:** Check your Docker volume configuration. Both `./data:/app/data` and `./uploads:/app/uploads` must be mounted and writable. Run `docker inspect <container> --format '{{json .Mounts}}'` to verify the mounts are present and point to valid host paths. If the host directories are owned by root, the container's `chown` step (which runs as root before dropping to `node`) should correct permissions automatically — but if your host filesystem is read-only or permissions are locked down, grant write access manually:
+**Fix:** List your mounts and remove any that target `/app`:
 
 ```bash
-sudo chown -R 1000:1000 ./data ./uploads
+docker inspect <container> --format '{{json .Mounts}}'
 ```
 
+Keep only `./data:/app/data` and `./uploads:/app/uploads`, then recreate the container. Your data in those two directories is preserved when you switch.
+
+> **Note:** Unwritable `data`/`uploads` directories are a *different* failure — they abort with a permission error (`EACCES`), not with `Cannot find module`. TREK creates the subdirectories it needs on startup (`data/logs`, `data/backups`, `data/tmp`, `uploads/files`, `uploads/covers`, `uploads/avatars`, `uploads/photos`, `uploads/journey`, `uploads/places`). The container's `chown` step (which runs as root before dropping to `node`) normally corrects ownership, but if your host filesystem is read-only or permissions are locked down, grant write access manually:
+>
+> ```bash
+> sudo chown -R 1000:1000 ./data ./uploads
+> ```
+
 ---
 
 ## Container won't start: "exec /usr/bin/dumb-init: operation not permitted"
@@ -192,7 +214,7 @@ See [Encryption Key Rotation](Encryption-Key-Rotation) for how to retrieve or ro
 
 ## OIDC login returns "APP_URL is not configured"
 
-**Cause:** When OIDC is enabled, TREK needs to know its own public URL to build the redirect URI. It resolves this from (1) `APP_URL` env var, (2) the first entry in `ALLOWED_ORIGINS`, (3) `http://localhost:<PORT>` as a last resort. If none of these are set and the request is not coming from localhost, TREK returns a 500 error.
+**Cause:** When OIDC is enabled, TREK needs to know its own public URL to build the redirect URI. It resolves this from (1) `APP_URL` env var, (2) the first entry in `ALLOWED_ORIGINS`, (3) `http://localhost:<PORT>` as a last resort. Step (3) always produces a value, so the message in the heading is a guard that never actually fires. What you get instead, with `APP_URL` and `ALLOWED_ORIGINS` both unset, is a redirect URI of `http://localhost:<PORT>/api/auth/oidc/callback` — and the provider rejects it as an unregistered `redirect_uri`.
 
 **Fix:** Set `APP_URL` to the public URL of your instance:
 
@@ -205,7 +227,7 @@ environment:
 
 ## OIDC login fails with issuer mismatch
 
-**Cause:** TREK validates that the `issuer` field in the provider's discovery document exactly matches the configured `OIDC_ISSUER`. A trailing-slash difference (e.g. `https://auth.example.com` vs `https://auth.example.com/`) is enough to fail.
+**Cause:** TREK validates that the `issuer` field in the provider's discovery document matches the configured `OIDC_ISSUER`. Trailing slashes are stripped from both sides before the comparison, so `https://auth.example.com` and `https://auth.example.com/` are the same value here — the difference is somewhere else: a realm path the provider adds, an internal hostname configured where the provider advertises the public one, or `http://` against `https://`.
 
 **Fix:** Check the exact issuer value your provider advertises and match it:
 
@@ -215,19 +237,24 @@ curl -s https://<your-oidc-issuer>/.well-known/openid-configuration | jq .issuer
 
 Set `OIDC_ISSUER` to that exact string.
 
+> **Note:** The mismatch is only fatal while no custom discovery URL is set. With `OIDC_DISCOVERY_URL` configured — which is how Authentik realm paths are usually wired up — TREK treats the discovery document's issuer as the canonical one, logs `[OIDC] Discovery doc issuer … differs from configured OIDC_ISSUER …` and continues.
+
 ---
 
 ## OIDC login fails when provider is on a private/internal network
 
-**Cause:** TREK's SSRF guard blocks outbound requests to private IP ranges by default. If your OIDC provider (e.g. Keycloak, Authentik) is running on an internal address, the discovery document fetch will be blocked with: `Requests to private/internal network addresses are not allowed.`
+**Cause:** Not the SSRF guard, despite what it looks like. All four OIDC calls — discovery, token, userinfo, JWKS — go through the admin-configured fetch path, which deliberately **allows** loopback and private/LAN targets: a Keycloak or Authentik on `192.168.x` or `10.x` is a supported setup and needs no extra variable. `ALLOW_INTERNAL_NETWORK` belongs to the guard on *user*-supplied URLs and changes nothing about OIDC. The only addresses that path refuses are link-local and cloud-metadata ones (`169.254.0.0/16`, `fe80::/10`), which fail with `Requests to link-local / cloud-metadata addresses are not allowed`.
 
-**Fix:**
+**Fix:** Look for the reasons an internal provider actually fails. A failed discovery fetch answers `500 { "error": "OIDC login failed" }` and logs the real message as `[OIDC] Login error: …`, so start there:
 
-```yaml
-environment:
-  - ALLOW_INTERNAL_NETWORK=true
+```bash
+docker logs <container> 2>&1 | grep "OIDC"
 ```
 
+- **The container cannot reach the issuer.** Test from inside it, not from your desktop — the container has its own DNS and its own network: `docker exec <container> wget -qO- https://<issuer>/.well-known/openid-configuration`. A `Could not resolve hostname` in the log is this.
+- **The issuer is not HTTPS.** In production TREK refuses a plain-HTTP issuer up front with `400 { "error": "OIDC issuer must use HTTPS in production" }`, before any request goes out.
+- **The provider's certificate is not trusted by the container.** A self-signed certificate on an internal Keycloak fails the TLS handshake; issue it from a CA the container trusts.
+
 ---
 
 ## Password reset emails are not delivered / SMTP is silent
@@ -236,9 +263,13 @@ environment:
 
 **Fix:**
 
-1. Check server logs for `Email send failed`:
+1. Check server logs for a failed send. The password-reset path and the generic notification path log different lines, so match both:
    ```bash
-   docker logs <container> 2>&1 | grep "Email send failed"
+   docker logs <container> 2>&1 | grep -E "Password reset email failed|Email send failed"
+   ```
+   If neither matches, check whether the mail ever left at all — TREK needs a host, a port **and** a from-address (`SMTP_HOST` / `SMTP_PORT` / `SMTP_FROM`, or the same three fields under **Admin > Notifications**). With any one of them missing it skips SMTP entirely and logs `Password reset link issued (no SMTP)` plus the `===== PASSWORD RESET LINK =====` block instead of any error:
+   ```bash
+   docker logs <container> 2>&1 | grep "no SMTP"
    ```
 2. If the error mentions TLS or certificate, set `SMTP_SKIP_TLS_VERIFY=true`.
 3. Verify the port: `587` for STARTTLS, `465` for implicit TLS, `25` for plain SMTP.
@@ -262,7 +293,7 @@ environment:
   - ALLOWED_ORIGINS=https://trek.example.com,https://other.example.com
 ```
 
-If `ALLOWED_ORIGINS` is not set, TREK allows all origins (development default). See [Environment Variables](Environment-Variables).
+If `ALLOWED_ORIGINS` is not set, the default is **same-origin only** — cross-origin browser requests are rejected — because every shipped deployment path (Dockerfile, `docker-compose.yml`, the Helm chart) runs with `NODE_ENV=production`. Allowing any origin is the development default, and only applies outside production. See [Environment Variables](Environment-Variables).
 
 ---
 
@@ -278,18 +309,28 @@ If `ALLOWED_ORIGINS` is not set, TREK allows all origins (development default).
 **Fix:**
 
 - Code `4001`: Log out and log back in. If it persists, check that your reverse proxy is not stripping the `token` query parameter from the WebSocket upgrade request.
-- Code `4403`: The user must enable MFA in **Settings > Security**, or an admin can disable the global MFA requirement in **Admin > Settings**.
+- Code `4403`: The user must enable MFA in **Settings > Account**, or an admin can disable the global MFA requirement in **Admin > Settings**.
 
 ---
 
 ## Clipboard features not working (copy link, share, etc.)
 
-**Cause:** The browser Clipboard API (`navigator.clipboard`) is only available in a [secure context](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts). When accessing TREK over plain HTTP on a non-localhost address, the API is unavailable and clipboard operations silently fail or show an error.
+**Cause:** The browser Clipboard API (`navigator.clipboard`) is only available in a [secure context](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts), so on plain HTTP at a non-localhost address it is undefined.
 
-**Fix:** The only supported options are:
+TREK works around this where it matters most. The share-link and invite-link buttons in the trip **Members** dialog, the journey share link, and the calendar-subscribe URLs fall back to a hidden textarea plus the deprecated `document.execCommand('copy')`, which is not secure-context gated — **those keep working over plain HTTP**, on desktop and mobile alike.
+
+The remaining copy buttons call `navigator.clipboard` directly and have no fallback:
+
+- **Settings > Integrations (MCP)** — the MCP endpoint URL, the JSON client config, a newly created MCP token, and OAuth client IDs, client secrets and rotated secrets. These fail with no message at all, because the click handler throws before any toast is shown.
+- **Settings > Account** — the 2FA backup codes. This one shows a generic error toast. Use the **Download** button next to it as a workaround; it does not need a secure context.
+- **Admin Panel > Users & Invites** — the registration invite link, both on create ("create and copy") and via the copy button on an existing invite.
+
+**Fix:** For those buttons, one of:
 
 - Access TREK over HTTPS with a valid SSL certificate.
-- Access TREK directly from `http://localhost:<port>` — browsers treat `localhost` as a secure context for the Clipboard API (unlike the session cookie, which always requires HTTPS regardless of hostname).
+- Access TREK directly from `http://localhost:<port>` — browsers treat `localhost` as a secure context for the Clipboard API.
+
+Failing that, select the value shown in the field and copy it manually; every one of these buttons sits next to the text it copies.
 
 ---
 
@@ -297,7 +338,7 @@ If `ALLOWED_ORIGINS` is not set, TREK allows all origins (development default).
 
 **Cause:** When a Google Maps API key is set, TREK fetches photo references and image bytes from the Google Places API on the server side. If the server-side call is rejected or returns no photos, the `/place-photo/:id` endpoint answers `200 { "photoUrl": null }` and the place falls back to the default map-pin thumbnail. The image proxy behind it, `/place-photo/:id/bytes`, answers `204 No Content` when it has nothing cached — neither endpoint returns 404, so a trip full of photo-less places cannot trip a 404 rate limit in a reverse proxy or IPS. The most common causes are:
 
-1. **HTTP referrer restriction on the API key.** Google Cloud Console lets you restrict a key to specific HTTP referrers. Because TREK calls Google from the server (not the browser), it sends a `Referer` header derived from `APP_URL`. If `APP_URL` is not set, the fallback is `http://localhost:<PORT>`, which will not match any domain whitelist in GCP.
+1. **HTTP referrer restriction on the API key.** Google Cloud Console lets you restrict a key to specific HTTP referrers. Because TREK calls Google from the server (not the browser), it sends a `Referer` header only when `APP_URL` is set — the header is the value of `APP_URL`. If `APP_URL` is not set, TREK sends no `Referer` header at all, and a referrer-restricted key rejects a request with no referrer just as it rejects a wrong one.
 
 2. **Wrong key restriction type.** API keys restricted by **HTTP referrers** are designed for browser-side JavaScript. For a self-hosted server application, use **IP address** restrictions instead — add the public IP of your TREK server and no `APP_URL` configuration is needed.
 
@@ -334,7 +375,7 @@ If the response is `{}` or `{"error": {...}}`, the key or its restrictions are b
 
 ## MCP OAuth flow does not initiate / "Connect" redirects but authentication never starts
 
-**Cause:** TREK builds the OAuth 2.1 redirect URI from `APP_URL`. If `APP_URL` is not set, the authorization URL is constructed from a localhost fallback that external clients (Claude.ai, Claude Desktop) cannot reach, so the OAuth handshake never completes.
+**Cause:** TREK advertises its OAuth 2.1 issuer and authorization endpoint from its resolved public base URL (`APP_URL`, else the first entry of `ALLOWED_ORIGINS`, else `http://localhost:<PORT>`; the resolved value is kept only if it is `https://` or `localhost`/`127.0.0.1`). If that resolution lands on `http://localhost:<PORT>`, external clients (Claude.ai, Claude Desktop) cannot reach the authorization endpoint and the OAuth handshake never completes.
 
 **Fix:** Set `APP_URL` to the public URL of your instance:
 
@@ -345,7 +386,7 @@ environment:
 
 Restart the container after adding the variable. Once set, clicking **Connect** in the MCP client should redirect to your TREK instance and complete the OAuth flow normally.
 
-> **Note:** `APP_URL` is required for any MCP OAuth integration. Without it, the authorization endpoint resolves to `http://localhost:<PORT>`, which is unreachable from external MCP clients.
+> **Note:** Set `APP_URL` for any MCP OAuth integration. TREK resolves its public base URL **once**, in this order: (1) `APP_URL`, (2) the first entry of `ALLOWED_ORIGINS`, (3) `http://localhost:<PORT>` as a last resort — a step is skipped only when the value is unset or not a valid URL. The winner is then checked for MCP: only an `https://` URL or a `localhost` / `127.0.0.1` host is kept; anything else is replaced by `http://localhost:<PORT>`, which external MCP clients cannot reach. Because only the resolved winner is checked, a valid but plain-HTTP `APP_URL` (e.g. `http://trek.internal.lan`) is **not** rescued by an `https://` entry in `ALLOWED_ORIGINS` — it still ends up on localhost.
 
 ---
 
diff --git a/wiki/Two-Factor-Authentication.md b/wiki/Two-Factor-Authentication.md
index 622d30984..37220b199 100644
--- a/wiki/Two-Factor-Authentication.md
+++ b/wiki/Two-Factor-Authentication.md
@@ -8,11 +8,11 @@ TREK supports Time-based One-Time Password (TOTP) two-factor authentication, com
 
 ## Setting up 2FA
 
-Go to **Settings → Account** and click **"Set up two-factor authentication"**.
+Go to **Settings → Account**, find the **Two-factor authentication (2FA)** section and click **Set up authenticator**.
 
 1. A QR code and a text secret are displayed. Scan the QR code with your authenticator app.
    > **Note:** The setup session expires after **15 minutes**. If you do not complete setup within that window, start again.
-2. Enter the 6-digit code shown in your authenticator app and click **Confirm**.
+2. Enter the 6-digit code shown in your authenticator app and click **Enable 2FA**.
 3. Save your **10 backup codes**. These are single-use codes shown only once — store them somewhere safe (a password manager, printed paper). Each code has the format `XXXX-XXXX`.
 4. 2FA is now active on your account.
 
@@ -25,18 +25,22 @@ After entering your email and password, TREK shows a second prompt for your TOTP
 
 ## Disabling 2FA
 
-Go to **Settings → Account** and click **"Disable two-factor authentication"**. You must provide both:
+Go to **Settings → Account** and use the **Disable 2FA** form. You must provide both:
 
 - Your current account **password**
 - A valid **TOTP code** from your authenticator app
 
-> **Note:** You cannot disable 2FA while the admin has required it for all users (see below).
+> **Note:** You cannot disable 2FA while the admin has required it for all users (see below). Owning a passkey does not lift that restriction.
 
 ## Admin-enforced 2FA
 
-An admin can require 2FA for all users. Before enabling this setting the admin must have 2FA active on their own account — the server rejects the change otherwise.
+An admin can require 2FA for all users. Before enabling this setting the admin must have secured their own account with either an authenticator app or a passkey — the server rejects the change otherwise with *Secure your own account with two-factor authentication or a passkey before requiring it for all users.*
 
-If the setting is active and your account does not have 2FA set up, any API request after login returns a 403 error and the client redirects you to **Settings → Account** with a prompt to complete 2FA setup. You cannot use the app until setup is complete. See [Admin-Permissions](Admin-Permissions).
+If the setting is active and your account has neither 2FA nor a passkey, any API request after login returns a 403 error and the client redirects you to **Settings → Account** with a prompt to complete 2FA setup. You cannot use the app until setup is complete. See [Admin-Permissions](Admin-Permissions).
+
+A user-verified **passkey** satisfies this policy the way a TOTP authenticator does: with at least one passkey on your account the API stops blocking you and you never need an authenticator app. That holds even if an admin later turns passkey login off again — an existing passkey keeps satisfying the policy. Real-time sync is the one exception: the WebSocket handshake accepts only TOTP, so a passkey-only account under this policy can use TREK normally but never receives live updates from other members. Nothing tells you — the client simply keeps retrying the connection.
+
+Whether enrolling a passkey is a way *out* of the lockout depends on the instance. Passkey login is off by default (see [Passkeys](Passkeys)); where an admin has turned it on, the enrolment endpoints stay reachable while the rest of the API is blocked, so you can add a passkey from **Settings → Account** instead of setting up an authenticator app. Where it is off, TOTP setup is the only way to unblock yourself — or ask an admin to reset your 2FA.
 
 > **Admin:** You can reset 2FA for a locked-out user from the admin panel. See [Admin-Users-and-Invites](Admin-Users-and-Invites).
 
@@ -57,4 +61,4 @@ The demo user account cannot enable or disable MFA.
 
 ---
 
-**See also:** [Login-and-Registration](Login-and-Registration) · [Admin-Permissions](Admin-Permissions) · [Admin-Users-and-Invites](Admin-Users-and-Invites) · [User-Settings](User-Settings)
+**See also:** [Login-and-Registration](Login-and-Registration) · [Passkeys](Passkeys) · [Admin-Permissions](Admin-Permissions) · [Admin-Users-and-Invites](Admin-Users-and-Invites) · [User-Settings](User-Settings)
diff --git a/wiki/Updating.md b/wiki/Updating.md
index 71644ecc1..00dd9a503 100644
--- a/wiki/Updating.md
+++ b/wiki/Updating.md
@@ -11,8 +11,8 @@ Back up your data first. Go to Admin Panel → Backups and create a manual backu
 | Tag | Example | Behavior |
 |---|---|---|
 | `latest` | `mauriceboe/trek:latest` | Always the newest release across all major versions |
-| Major version | `mauriceboe/trek:3` | Latest release pinned to that major version |
-| Full version | `mauriceboe/trek:3.4.0` | Exact release; never changes |
+| Major version | `mauriceboe/trek:4` | Latest release pinned to that major version |
+| Full version | `mauriceboe/trek:4.0.0` | Exact release; never changes |
 
 Use `latest` or a major-version tag if you want updates on each redeploy. Use a full version tag for explicit control — update by changing the tag, not by re-pulling.
 
@@ -28,7 +28,7 @@ This pulls the newest matching image and recreates the container with your exist
 
 **Pinned full-version tag:**
 
-Edit `docker-compose.yml`, update the tag in the `image:` line (e.g. `3.4.0` → `3.4.1`), then redeploy:
+Edit `docker-compose.yml`, update the tag in the `image:` line (e.g. `4.0.0` → `4.0.1`), then redeploy:
 
 ```bash
 docker compose up -d
@@ -113,7 +113,7 @@ Open the **Stacks** list, click the TREK stack, then click **Redeploy**.
 
 ![Re-pull image and redeploy switch ticked, with arrows pointing to the switch and the Update button](assets/portainer-force-pull.png)
 
-**Pinned full-version tag** (e.g. `3.4.0`) — edit the stack, update the tag in the `image:` line, then click **Update the stack**. No re-pull switch needed; the tag change forces a fresh pull.
+**Pinned full-version tag** (e.g. `4.0.0`) — edit the stack, update the tag in the `image:` line, then click **Update the stack**. No re-pull switch needed; the tag change forces a fresh pull.
 
 ![Edit stack page with an arrow pointing to the image tag in the compose editor](assets/portainer-update-version.png)
 
diff --git a/wiki/User-Settings.md b/wiki/User-Settings.md
index ffb31b4bf..989a25461 100644
--- a/wiki/User-Settings.md
+++ b/wiki/User-Settings.md
@@ -12,14 +12,14 @@ If your account requires MFA setup, TREK redirects you directly to the **Account
 
 | Tab | Purpose | Shown when |
 |-----|---------|------------|
-| General | Start page and start tab, currency, language, temperature unit, distance unit, time format, booking route labels, map POI pills, and blur booking codes | Always |
+| General | Start page and start tab, currency, language, temperature unit, distance unit, time format, booking route labels, always show booking routes, map POI pills, blur booking codes, and optimize route from accommodation | Always |
 | Appearance | Color mode, color scheme / accent, readability (transparency, reduce motion, density, text size), and which widgets appear on your dashboard | Always |
 | Map | Map provider (Leaflet, Mapbox GL, or MapLibre GL), tile presets, map style and Mapbox token, 3D buildings, high-quality mode | Always |
 | Notifications | Email, webhook, ntfy, and in-app notification preferences | Always |
-| Integrations | Photo providers (Immich, Synology, etc.) and MCP OAuth clients / API tokens | Only when the Memories or MCP addon is enabled |
+| Integrations | Photo providers (Immich, Synology, etc.), the AirTrail connection, your own AI parsing model, and MCP OAuth clients / API tokens | Only when a photo provider (Immich or Synology Photos), MCP, AirTrail or AI Parsing is enabled |
 | Plugins | Per-user settings for installed plugins | Only when at least one plugin is installed |
 | Offline | Cached trips, pending changes, re-sync and clear cache | Always |
-| Account | Username, email, password, MFA (TOTP + backup codes), avatar, delete account | Always |
+| Account | Username, email, password, MFA (TOTP + backup codes), passkeys, avatar, delete account | Always |
 | About | App version, links to Ko-fi / Buy Me a Coffee / Discord / GitHub (bug reports, feature requests) / Wiki | Only when version metadata is available |
 
 ## General tab
@@ -42,8 +42,10 @@ The General tab controls the following preferences, all saved immediately on cha
 **Travel & map**
 
 - **Booking route labels** — show or hide station / airport names on booking route endpoint markers.
+- **Always show booking routes** — draw the route for every flight, train and other booking on the map automatically, instead of switching it on per item.
 - **Explore places on the map** — show a POI category pill on the trip map for finding nearby places from OpenStreetMap.
 - **Blur booking codes** — blur confirmation codes and reference numbers (useful when screen-sharing).
+- **Optimize route from accommodation** — when optimizing a day, start the route at the hotel you wake up in and end it at the one you check into that evening.
 
 ## Appearance tab
 
@@ -81,6 +83,7 @@ The Account tab lets you:
 - Edit your **username** and **email address**.
 - Change your **password** (hidden when the server runs in OIDC-only mode — see [OIDC-SSO](OIDC-SSO)).
 - Set up or disable **two-factor authentication** (TOTP). After enabling MFA, backup codes are shown once and can be copied, downloaded, or printed. See [Two-Factor-Authentication](Two-Factor-Authentication).
+- Manage your **passkeys** — add one (confirm your password, then follow your device prompt), rename it, or remove it. **Add a passkey** only appears when the instance has passkeys switched on and a WebAuthn domain resolves; an existing passkey stays listed either way so you can always clean it up. See [Passkeys](Passkeys).
 - Upload or remove your **profile avatar**.
 - **Delete your account** (irreversible; blocked if you are the only admin).
 
@@ -88,9 +91,11 @@ If your account was linked via SSO, an **SSO** badge appears next to your role a
 
 ## Integrations tab
 
-The Integrations tab is only visible when the **Memories** or **MCP** addon is enabled. It contains:
+The Integrations tab is only visible when a **photo provider** (Immich or Synology Photos), **MCP**, **AirTrail** or **AI Parsing** is enabled. Each section then appears with its own addon, so the tab holds only what your instance actually runs:
 
-- **Photo Providers** — Configure Immich, Synology Photos, and other photo integrations (always shown when the Integrations tab is visible).
+- **Photo Providers** (only when a photo provider is enabled) — Configure Immich, Synology Photos, and other photo integrations. One card appears per enabled provider.
+- **AirTrail** (only when the AirTrail addon is enabled) — Instance URL and API key for your self-hosted AirTrail, plus a self-signed-certificate switch and a **Write changes back to AirTrail** toggle (off by default: AirTrail is the source of truth and TREK only reads from it). **Test connection** reports how many flights it can see. The key is stored encrypted and never prefilled — leaving the field blank keeps the stored one.
+- **AI parsing** (only when the AI Parsing addon is enabled) — The provider (OpenAI or Anthropic), model and API key used to extract bookings from your uploaded files, plus **Send documents as images** for vision-capable models. This is the per-user fallback: it only takes effect when your administrator has not configured a model for the whole instance. A local Ollama endpoint is not offered here — that is set up once, instance-wide, in the admin settings (#1772). See [AI-Booking-Import](AI-Booking-Import).
 - **MCP section** (only when MCP addon is enabled):
   - Shows the MCP server endpoint URL.
   - **OAuth Clients** sub-tab — Create and manage OAuth 2.1 clients (with redirect URIs and scopes). Quick-fill presets are provided for Claude.ai, Claude Desktop, Cursor, VS Code, Windsurf, and Zed. Active OAuth sessions can be viewed and revoked here.
diff --git a/wiki/Vacay.md b/wiki/Vacay.md
index 00b81c819..f8d21f0a8 100644
--- a/wiki/Vacay.md
+++ b/wiki/Vacay.md
@@ -62,8 +62,10 @@ Each toggle's icon in the toolbar is the marker it places, so you can see what a
 - **Block weekends** — prevents logging on weekend days. You choose which days count as the weekend.
 - **Week start** — Monday or Sunday.
 - **Carry-over** — toggle as described above.
+- **Vacation year** — Calendar, Fiscal or Hire date, as described under Leave year above. Unlike the rest of this panel it is personal to you rather than to the plan.
 - **Company holidays** — enable a shared company holiday layer that any fused user can edit.
 - **Public holidays** — add one or more country/region holiday calendars so that public holidays appear on the grid. Holiday data is fetched from the nager.at public holiday API. Each calendar has a label, a colour, and a country or region selector (sub-national regions such as German states or Swiss cantons are supported).
+- **School holidays** — a second holiday layer with its own toggle, independent of the public one and purely visual. Each calendar has an optional label, a colour and a country; where the source splits a country up you also pick a region (a German state, a Swiss canton, a French académie) or a school holiday group (Belgium, the Netherlands), and the calendar cannot be added until you have. A few countries publish a single national calendar (Estonia, Ireland, Serbia) and need nothing beyond the country. School holiday data comes from the OpenHolidays API rather than nager.at and covers fewer countries, so only the supported ones appear in the picker. On the grid a school holiday day gets a coloured band along the bottom of the cell, split into up to three segments when several calendars cover the same day, and a day inside a break that carries nothing else (no logged entry, no company holiday, no public holiday) is washed in the calendar colour. School holidays never deduct from anyone's allowance.
 
 ## Inviting collaborators
 
diff --git a/wiki/Weather-Forecasts.md b/wiki/Weather-Forecasts.md
index 970d28a66..91fb655db 100644
--- a/wiki/Weather-Forecasts.md
+++ b/wiki/Weather-Forecasts.md
@@ -26,7 +26,7 @@ The Day Detail panel weather widget displays:
 | Date range | Data source | Cache TTL |
 |---|---|---|
 | Within 16 days (today −1 day to today +16 days) | Open-Meteo forecast API | 1 hour |
-| More than 1 day in the past | Open-Meteo archive API (actual historical data) | 24 hours |
+| More than 1 day in the past | Open-Meteo archive API (actual historical data), for the compact sidebar badge. The Day Detail panel asks the forecast API for past days too | 24 hours (1 hour in the Day Detail panel) |
 | More than 16 days in the future | Climate estimate from the same date in the prior year | 24 hours |
 
 Far-future estimates are labeled with a **Ø** prefix (e.g. "Ø 18 °C") to make it clear they are climate estimates, not a real forecast. The compact sidebar badge re-fetches silently in the background if a cached climate estimate could be upgraded to a live forecast.
diff --git a/wiki/Whats-Next-Widget.md b/wiki/Whats-Next-Widget.md
index 8dc47614f..846a783a7 100644
--- a/wiki/Whats-Next-Widget.md
+++ b/wiki/Whats-Next-Widget.md
@@ -6,7 +6,7 @@ The What's Next widget shows the upcoming assigned places across all days of you
 
 ## Where to find it
 
-Open the trip planner → **Collab** tab. On **desktop** the widget appears as a panel (alongside Chat, Notes, and Polls). On **mobile** it appears as a tab labeled "What's Next" with a sparkle icon in the Collab tab bar. The Collab addon must be enabled and the What's Next sub-feature must be turned on. See [Real-Time-Collaboration](Real-Time-Collaboration).
+Open the trip planner → **Collab** tab. On **desktop** (window 1024px and wider) the widget appears as a panel alongside Chat, Notes, and Polls. In a narrower window the four panels collapse into a tab bar and it becomes a tab labeled "What's Next". On a **phone** (under 768px) the mobile trip planner takes over, and its Collab tab only offers Chat, Notes and Polls — the widget is not available there. The Collab addon must be enabled and the What's Next sub-feature must be turned on. See [Real-Time-Collaboration](Real-Time-Collaboration).
 
 ## What it shows