test(unsplash): check both refusals without awaiting in a loop

Without an Access Key the image search goes through Unsplash's web endpoint,
which refuses datacenter addresses with a 401 or 403 or answers with a
challenge page. The search then said only "Unsplash search unavailable",
although an admin can already enter a free key in the settings. Such a
refusal now answers 502 with that hint and the code unsplash_key_needed, and
the cover search shows it in the user's language.

Closes #1449

charts/trek/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
 name: trek
-version: 5.0.0
+version: 5.0.1
 description: Minimal Helm chart for TREK app
-appVersion: "5.0.0"
+appVersion: "5.0.1"

client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trek/client",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "engines": {
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },

client/scripts/eslint-baseline.json

@@ -1,7 +1,7 @@
 {
   "src": {
     "@typescript-eslint/no-non-null-assertion": 382,
-    "@typescript-eslint/no-misused-promises": 849,
+    "@typescript-eslint/no-misused-promises": 848,
     "no-console": 88,
     "complexity": 220,
     "@typescript-eslint/no-explicit-any": 146,
@@ -30,7 +30,7 @@
     "no-useless-escape": 1
   },
   "suppressed": {
-    "@typescript-eslint/no-explicit-any": 40,
+    "@typescript-eslint/no-explicit-any": 38,
     "react-hooks/exhaustive-deps": 46
   },
   "tests": {

client/scripts/i18n-unused-baseline.json

@@ -1,5 +1,5 @@
 {
-  "admin.ts": 126,
+  "admin.ts": 112,
   "atlas.ts": 9,
   "backup.ts": 10,
   "budget.ts": 36,

client/scripts/rtl-baseline.json

@@ -1,5 +1,5 @@
 {
-  "components/Admin/AdminPluginsPanel.tsx": 2,
+  "components/Admin/plugins/pluginMenu.ts": 2,
   "components/Budget/BudgetPanelMemberChips.tsx": 6,
   "components/Budget/CostsPanel.tsx": 3,
   "components/Budget/ReceiptPreviewModal.tsx": 2,

client/scripts/size-baseline.json

@@ -2,12 +2,12 @@
   "e2e/help/fixtures.ts": 2291,
   "src/api/client.ts": 1873,
   "src/components/Admin/AdminPluginsPanel.test.tsx": 2704,
-  "src/components/Admin/AdminPluginsPanel.tsx": 1667,
+  "src/components/Admin/AdminPluginsPanel.tsx": 1277,
   "src/components/Budget/CostsPanel.test.tsx": 2736,
   "src/components/Budget/CostsPanel.tsx": 1798,
   "src/components/Map/MapView.tsx": 1385,
   "src/components/Map/MapViewGL.test.tsx": 2919,
-  "src/components/Map/MapViewGL.tsx": 2290,
+  "src/components/Map/MapViewGL.tsx": 2218,
   "src/components/Map/RouteCalculator.ts": 1063,
   "src/components/PDF/TripPDF.tsx": 1082,
   "src/components/Planner/DayDetailPanel.test.tsx": 2333,

client/scripts/theme-baseline.json

@@ -1,7 +1,7 @@
 {
   "App.tsx": 11,
-  "components/Admin/AdminPluginsPanel.tsx": 2,
   "components/Admin/DefaultUserSettingsTab.tsx": 1,
+  "components/Admin/plugins/pluginMenu.ts": 2,
   "components/Atlas/AtlasCountryPlaces.tsx": 6,
   "components/BackgroundTasks/BackgroundTasksWidget.tsx": 4,
   "components/Budget/BudgetPanel.helpers.ts": 2,

client/src/api/client.surface.test.ts

@@ -692,6 +692,7 @@ describe('client > request payloads', () => {
   it('FE-APISURF-030: adminApi.pluginActivate only sends consent when granted', async () => {
     expect((await traceOne(() => adminApi.pluginActivate('koffi'))).body).toEqual({})
     expect((await traceOne(() => adminApi.pluginActivate('koffi', true))).body).toEqual({ consent: true })
+    expect((await traceOne(() => adminApi.pluginActivate('koffi', false, true))).body).toEqual({ acceptTrekRange: true })
   })
 
   it('FE-APISURF-031: adminApi.pluginInstall spreads its options next to the id', async () => {

client/src/api/client.ts

@@ -574,9 +574,9 @@ export const adminApi = {
   plugins: () => apiClient.get('/admin/plugins').then(r => r.data),
   pluginBrowse: (refresh?: boolean) => apiClient.get('/admin/plugins/registry', { params: refresh ? { refresh: 1 } : undefined }).then(r => r.data),
   pluginDetail: (id: string) => apiClient.get(`/admin/plugins/registry/${encodeURIComponent(id)}`).then(r => r.data),
-  pluginInstall: (id: string, opts?: Pick<PluginInstallRequest, 'version' | 'constraint' | 'withDependencies'>) =>
+  pluginInstall: (id: string, opts?: Omit<PluginInstallRequest, 'id'>) =>
     apiClient.post('/admin/plugins/install', { id, ...opts } satisfies PluginInstallRequest).then(r => r.data),
-  pluginActivate: (id: string, consent?: boolean) => apiClient.post(`/admin/plugins/${id}/activate`, consent ? { consent: true } : {}).then(r => r.data),
+  pluginActivate: (id: string, consent?: boolean, accept?: boolean) => apiClient.post(`/admin/plugins/${id}/activate`, { consent: consent || undefined, acceptTrekRange: accept || undefined }).then(r => r.data),
   pluginDeactivate: (id: string) => apiClient.post(`/admin/plugins/${id}/deactivate`).then(r => r.data),
   // `version` pins the exact version to install (the rollback path); omitted, the server
   // resolves the newest TREK-compatible version itself.

client/src/components/Admin/AdminPluginsPanel.test.tsx

@@ -489,10 +489,10 @@ describe('AdminPluginsPanel — TREK-version compatibility', () => {
     fireEvent.click(await screen.findByText('Discover'))
   }
 
-  it('blocks Install when no published version runs on this TREK, and says why', async () => {
+  it('marks a plugin no published version runs on, and still lets the admin install it', async () => {
     await openDiscover({ trek: '>=4.0.0', hostVersion: '3.3.0', compatible: false, latestCompatible: null })
-    const btn = await screen.findByRole('button', { name: /^incompatible$/i })
-    expect(btn).toBeDisabled()
+    expect(await screen.findByText('Not confirmed for TREK 3.3.0 yet')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /^install$/i })).toBeEnabled()
   })
 
   it('offers the newest version that DOES run here rather than a dead button', async () => {
@@ -549,9 +549,11 @@ function panelRoot(container: HTMLElement): HTMLElement {
 }
 
 /** Opens one of the toolbar dropdowns (identified by its current title) and picks an option. */
-async function pickFilter(trigger: RegExp, option: RegExp) {
-  fireEvent.click(await screen.findByTitle(trigger))
-  fireEvent.click(await screen.findByRole('button', { name: option }))
+/** The toolbar's one Filter button; a pick in its menu leaves the menu open. */
+const filterButton = (): HTMLElement => screen.getByRole('button', { name: /^Filter/ })
+async function pickFilter(option: RegExp) {
+  if ((await screen.findByRole('button', { name: /^Filter/ })).getAttribute('aria-expanded') !== 'true') fireEvent.click(filterButton())
+  fireEvent.click(await screen.findByRole('menuitemradio', { name: option }))
 }
 
 /** The enable toggle of a named installed row. */
@@ -610,9 +612,9 @@ describe('AdminPluginsPanel — load states and toolbar', () => {
     render(<AdminPluginsPanel />)
     await screen.findByText('Gotify')
 
-    await pickFilter(/^Type: All types$/, /^Widget$/)
+    await pickFilter(/^Widget$/)
 
-    expect(await screen.findByTitle('Type: Widget')).toBeInTheDocument()
+    expect(await screen.findByRole('menuitemradio', { name: 'Widget' })).toHaveAttribute('aria-checked', 'true')
     expect(screen.getByText('Countdown')).toBeInTheDocument()
     expect(screen.queryByText('Gotify')).not.toBeInTheDocument()
   })
@@ -626,15 +628,15 @@ describe('AdminPluginsPanel — load states and toolbar', () => {
     render(<AdminPluginsPanel />)
     await screen.findByText('OnOne')
 
-    await pickFilter(/^Status: All$/, /^Off$/)
+    await pickFilter(/^Off$/)
     expect(await screen.findByText('OffOne')).toBeInTheDocument()
     expect(screen.queryByText('OnOne')).not.toBeInTheDocument()
 
-    await pickFilter(/^Status: Off$/, /^Error$/)
+    await pickFilter(/^Error$/)
     expect(await screen.findByText('BadOne')).toBeInTheDocument()
     expect(screen.getByText('boom')).toBeInTheDocument()
 
-    await pickFilter(/^Status: Error$/, /^Update available$/)
+    await pickFilter(/^Update available$/)
     expect(await screen.findByText('OnOne')).toBeInTheDocument()
     expect(screen.queryByText('BadOne')).not.toBeInTheDocument()
   })
@@ -644,11 +646,10 @@ describe('AdminPluginsPanel — load states and toolbar', () => {
     render(<AdminPluginsPanel />)
     await screen.findByText('Gotify')
 
-    await pickFilter(/^Sort: Name$/, /^Updates first$/)
-    expect(await screen.findByTitle('Sort: Updates first')).toBeInTheDocument()
-
+    await pickFilter(/^Updates first$/)
+    expect(filterButton()).toHaveTextContent('Updates first')
     await clickDiscover()
-    await waitFor(() => expect(screen.getByTitle('Sort: Name')).toBeInTheDocument())
+    await waitFor(() => expect(filterButton()).toHaveTextContent(/Name$/))
   })
 
   it('FE-COMP-PLUGINS-PANEL-008: rescan re-pulls the registry past its cache and confirms with a toast', async () => {
@@ -1663,15 +1664,16 @@ describe('AdminPluginsPanel — Discover cards and the detail modal', () => {
   })
 })
 
-describe('AdminPluginsPanel — security footer', () => {
-  it('FE-COMP-PLUGINS-PANEL-048: the containment note expands into its sections', async () => {
+describe('AdminPluginsPanel — security dialog', () => {
+  it('FE-COMP-PLUGINS-PANEL-048: the shield in the header opens how plugins are contained', async () => {
     panelWith([])
     render(<AdminPluginsPanel />)
     await screen.findByText('No plugins installed yet.')
 
     expect(screen.queryByText('Every plugin runs boxed in')).not.toBeInTheDocument()
-    fireEvent.click(screen.getByText('How plugins are contained — and the limits'))
+    fireEvent.click(screen.getByRole('button', { name: 'How plugins are secured' }))
 
+    expect(screen.getByRole('dialog', { name: 'How plugins are secured' })).toBeInTheDocument()
     expect(screen.getByText('Every plugin runs boxed in')).toBeInTheDocument()
     expect(screen.getByText('What "Reviewed" means')).toBeInTheDocument()
     expect(screen.getByText('What "Signed" means')).toBeInTheDocument()
@@ -1700,9 +1702,9 @@ describe('AdminPluginsPanel toolbar and dialogs', () => {
     row({ id: 'c-page', name: 'Gamma Page', description: 'a page', type: 'page', enabled: 1, status: 'error', last_error: 'boom' }),
   ]
 
-  const pickFilter = async (user: ReturnType<typeof userEvent.setup>, filter: RegExp, option: RegExp) => {
-    await user.click(screen.getByTitle(filter))
-    await user.click(screen.getByRole('button', { name: option }))
+  const pickFilter = async (user: ReturnType<typeof userEvent.setup>, option: RegExp) => {
+    if (filterButton().getAttribute('aria-expanded') !== 'true') await user.click(filterButton())
+    await user.click(screen.getByRole('menuitemradio', { name: option }))
   }
 
   it('FE-W5PLG-001: the search box narrows the installed list by name and description', async () => {
@@ -1734,7 +1736,7 @@ describe('AdminPluginsPanel toolbar and dialogs', () => {
     render(<AdminPluginsPanel />)
     await screen.findByText('Alpha Widget')
 
-    await pickFilter(user, /^Type:/, /^Widget$/)
+    await pickFilter(user, /^Widget$/)
 
     await waitFor(() => expect(screen.queryByText('Beta Bridge')).not.toBeInTheDocument())
     expect(screen.getByText('Alpha Widget')).toBeInTheDocument()
@@ -1746,15 +1748,15 @@ describe('AdminPluginsPanel toolbar and dialogs', () => {
     render(<AdminPluginsPanel />)
     await screen.findByText('Alpha Widget')
 
-    await pickFilter(user, /^Status:/, /^Active$/)
+    await pickFilter(user, /^Active$/)
     await waitFor(() => expect(screen.queryByText('Beta Bridge')).not.toBeInTheDocument())
     expect(screen.queryByText('Gamma Page')).not.toBeInTheDocument()
 
-    await pickFilter(user, /^Status:/, /^Off$/)
+    await pickFilter(user, /^Off$/)
     await waitFor(() => expect(screen.getByText('Beta Bridge')).toBeInTheDocument())
     expect(screen.queryByText('Alpha Widget')).not.toBeInTheDocument()
 
-    await pickFilter(user, /^Status:/, /^Error$/)
+    await pickFilter(user, /^Error$/)
     await waitFor(() => expect(screen.getByText('Gamma Page')).toBeInTheDocument())
     expect(screen.queryByText('Alpha Widget')).not.toBeInTheDocument()
   })
@@ -1766,13 +1768,13 @@ describe('AdminPluginsPanel toolbar and dialogs', () => {
     await screen.findByText('Alpha Widget')
     await waitFor(() => expect(screen.getByText(/updates? available/i)).toBeInTheDocument())
 
-    await pickFilter(user, /^Sort:/, /^Updates first$/)
+    await pickFilter(user, /^Updates first$/)
     await waitFor(() => {
       const names = screen.getAllByText(/Alpha Widget|Beta Bridge|Gamma Page/).map(e => e.textContent)
       expect(names[0]).toBe('Gamma Page')
     })
 
-    await pickFilter(user, /^Status:/, /^Update available$/)
+    await pickFilter(user, /^Update available$/)
     await waitFor(() => expect(screen.queryByText('Alpha Widget')).not.toBeInTheDocument())
     expect(screen.getByText('Gamma Page')).toBeInTheDocument()
   })
@@ -1783,11 +1785,10 @@ describe('AdminPluginsPanel toolbar and dialogs', () => {
     render(<AdminPluginsPanel />)
     await screen.findByText('Alpha Widget')
 
-    await pickFilter(user, /^Sort:/, /^Updates first$/)
-    expect(screen.getByTitle(/^Sort: Updates first$/)).toBeInTheDocument()
-
+    await pickFilter(user, /^Updates first$/)
+    expect(filterButton()).toHaveTextContent('Updates first')
     await user.click(screen.getByRole('tab', { name: /Discover/ }))
-    await waitFor(() => expect(screen.getByTitle(/^Sort: Name$/)).toBeInTheDocument())
+    await waitFor(() => expect(filterButton()).toHaveTextContent(/Name$/))
   })
 
   it('FE-W5PLG-007: the registry sorts by downloads and by review date', async () => {
@@ -1802,19 +1803,19 @@ describe('AdminPluginsPanel toolbar and dialogs', () => {
     await user.click(screen.getByRole('tab', { name: /Discover/ }))
     await screen.findByText('Old Tool')
 
-    await pickFilter(user, /^Sort:/, /^Most downloads$/)
+    await pickFilter(user, /^Most downloads$/)
     await waitFor(() => {
       const names = screen.getAllByText(/^(Old|New) Tool$/).map(e => e.textContent)
       expect(names[0]).toBe('New Tool')
     })
 
-    await pickFilter(user, /^Sort:/, /^Recently updated$/)
+    await pickFilter(user, /^Recently updated$/)
     await waitFor(() => {
       const names = screen.getAllByText(/^(Old|New) Tool$/).map(e => e.textContent)
       expect(names[0]).toBe('New Tool')
     })
 
-    await pickFilter(user, /^Sort:/, /^Name$/)
+    await pickFilter(user, /^Name$/)
     await waitFor(() => {
       const names = screen.getAllByText(/^(Old|New) Tool$/).map(e => e.textContent)
       expect(names[0]).toBe('New Tool')
@@ -1833,7 +1834,7 @@ describe('AdminPluginsPanel toolbar and dialogs', () => {
     await user.click(screen.getByRole('tab', { name: /Discover/ }))
     await screen.findByText('Mapper')
 
-    await pickFilter(user, /^Type:/, /^Page$/)
+    await pickFilter(user, /^Page$/)
     await waitFor(() => expect(screen.queryByText('Mapper')).not.toBeInTheDocument())
     expect(screen.getByText('Poster')).toBeInTheDocument()
 
@@ -1962,12 +1963,12 @@ describe('AdminPluginsPanel toolbar and dialogs', () => {
     const { container } = render(<AdminPluginsPanel />)
     await screen.findByText('Alpha Widget')
 
-    await user.click(screen.getByTitle(/^Type:/))
-    expect(screen.getByRole('button', { name: /^Widget$/ })).toBeInTheDocument()
+    await user.click(filterButton())
+    expect(screen.getByRole('menuitemradio', { name: /^Widget$/ })).toBeInTheDocument()
 
     const layer = container.querySelector('.fixed.inset-0.z-20') as HTMLElement
     fireEvent.click(layer)
-    await waitFor(() => expect(screen.queryByRole('button', { name: /^Widget$/ })).not.toBeInTheDocument())
+    await waitFor(() => expect(screen.queryByRole('menuitemradio', { name: /^Widget$/ })).not.toBeInTheDocument())
   })
 })
 
@@ -2004,12 +2005,11 @@ describe('AdminPluginsPanel registry cards and dependency chips', () => {
     await screen.findByText('Alpha Widget')
 
     await openDiscover(user)
-    await user.click(screen.getByTitle(/^Sort:/))
-    await user.click(screen.getByRole('button', { name: /^Most downloads$/ }))
-    expect(screen.getByTitle(/^Sort: Most downloads$/)).toBeInTheDocument()
-
+    await user.click(filterButton())
+    await user.click(screen.getByRole('menuitemradio', { name: /^Most downloads$/ }))
+    expect(filterButton()).toHaveTextContent('Most downloads')
     await user.click(screen.getByRole('tab', { name: /Installed/ }))
-    await waitFor(() => expect(screen.getByTitle(/^Sort: Name$/)).toBeInTheDocument())
+    await waitFor(() => expect(filterButton()).toHaveTextContent(/Name$/))
   })
 
   it('FE-W5PLG-017: an outrun release offers the newest compatible version instead of a dead button', async () => {
@@ -2026,9 +2026,8 @@ describe('AdminPluginsPanel registry cards and dependency chips', () => {
     expect(offer).not.toBeDisabled()
     expect(offer).toHaveAttribute('title', expect.stringContaining('3.5.0'))
 
-    const dead = screen.getByRole('button', { name: /^Incompatible$/ })
-    expect(dead).toBeDisabled()
-    expect(dead.getAttribute('title')).toBeTruthy()
+    // Nothing fits: no dead button any more, but a card that says so before anything installs.
+    expect(screen.getByText(/^Not confirmed for TREK .+ yet$/)).toBeInTheDocument()
   })
 
   it('FE-W5PLG-018: an already installed registry entry cannot be installed again', async () => {
@@ -2556,7 +2555,7 @@ describe('AdminPluginsPanel — TREK-range bypass (TREK_PLUGINS_IGNORE_TREK_RANG
     expect(await screen.findByText('Version checks off')).toBeInTheDocument()
   })
 
-  it('FE-PLG-BYPASS-002: offers "Install anyway" for an incompatible entry and asks before installing', async () => {
+  it('FE-PLG-BYPASS-002: offers Install for an incompatible entry and asks before installing', async () => {
     let posted: unknown = null
     bypassPanel([plugin({ id: 'something-else' })], incompatibleEntry())
     server.use(http.post('*/api/admin/plugins/install', async ({ request }) => {
@@ -2566,7 +2565,7 @@ describe('AdminPluginsPanel — TREK-range bypass (TREK_PLUGINS_IGNORE_TREK_RANG
     withToast()
     fireEvent.click(await screen.findByText('Discover'))
 
-    const btn = await screen.findByRole('button', { name: /^install anyway$/i })
+    const btn = await screen.findByRole('button', { name: /^install$/i })
     expect(btn).toBeEnabled()
     fireEvent.click(btn)
 
@@ -2585,7 +2584,7 @@ describe('AdminPluginsPanel — TREK-range bypass (TREK_PLUGINS_IGNORE_TREK_RANG
     server.use(http.post('*/api/admin/plugins/install', () => { posted = true; return HttpResponse.json({ id: 'trek-gotify', version: '2.0.0', trekRangeBypassed: null }) }))
     withToast()
     fireEvent.click(await screen.findByText('Discover'))
-    fireEvent.click(await screen.findByRole('button', { name: /^install anyway$/i }))
+    fireEvent.click(await screen.findByRole('button', { name: /^install$/i }))
 
     const dialog = await screen.findByRole('dialog', { name: /outside its supported trek versions/i })
     fireEvent.click(within(dialog).getByRole('button', { name: /cancel/i }))

client/src/components/Admin/AdminPluginsPanel.tsx

@@ -1,10 +1,9 @@
-import { useEffect, useRef, useState, type CSSProperties, type ReactNode } from 'react'
-import { createPortal } from 'react-dom'
+import { useState, type ReactNode } from 'react'
 import {
   Blocks, AlertTriangle, RefreshCw, Trash2, Download, Bug, ShieldCheck, UploadCloud,
-  ArrowUpCircle, Github, ExternalLink, ChevronDown, Check, Lock, Search, Link2, KeyRound, ShieldAlert,
-  SlidersHorizontal, ArrowUpDown, CircleDot, MoreHorizontal, RotateCw, Database,
-  Globe, Info, History, PauseCircle, Puzzle, Bot, Loader2,
+  ArrowUpCircle, Github, ExternalLink, Check, Search, Link2, KeyRound, ShieldAlert,
+  SlidersHorizontal, CircleDot, Database,
+  Globe, History, Puzzle, Bot, Loader2,
 } from 'lucide-react'
 import PluginIcon from '../shared/PluginIcon'
 import { useInstanceSettings } from './useInstanceSettings'
@@ -23,15 +22,17 @@ import {
   SettingsCard, SettingRows, SettingRow, SettingsHint, StatusPill,
   SETTINGS_BUTTON_PRIMARY, SETTINGS_ICON_BUTTON,
 } from '../Settings/settingsKit'
-import { POPOVER } from '../Packing/packingPopoverStyles'
 import {
-  KNOWN_TYPES, PERM_KEYS, blockIsCurrent, dependencyRows, deriveDeps, fingerprint, formatCompactCount,
-  installOffer, isRegistrySourced, parseJson, signatureBlockView, sortLabel, statusLabel,
-  type PluginDep, type PluginRow, type RegistryItem, type SigSubject, type SortKey,
-  type StatusFilter, type T, type TypeFilter, type VersionInfo, type VersionMismatch,
+  KNOWN_TYPES, PERM_KEYS, blockIsCurrent, dependencyRows, fingerprint, formatCompactCount,
+  installOffer, signatureBlockView,
+  type PluginDep, type PluginRow, type RegistryItem, type SigSubject,
+  type T, type VersionInfo, type VersionMismatch,
 } from './plugins/pluginModel'
 import { usePluginDetail } from './plugins/usePluginDetail'
 import { usePluginsAdmin } from './plugins/usePluginsAdmin'
+import PluginFilterMenu from './plugins/PluginFilterMenu'
+import PluginInstalledRow from './plugins/PluginInstalledRow'
+import PluginSecurityDialog from './plugins/PluginSecurityDialog'
 
 /**
  * Admin → Plugins (#plugins). A full plugin-management surface: a segmented
@@ -42,31 +43,13 @@ import { usePluginsAdmin } from './plugins/usePluginsAdmin'
  * tile; the security section at the bottom explains the model honestly.
  */
 
-// Runtime health → dot colour on the icon tile.
-const HEALTH: Record<string, string> = {
-  active: 'bg-success',
-  starting: 'bg-info animate-pulse',
-  error: 'bg-danger',
-  inactive: 'bg-content-faint/60',
-  disabled: 'bg-warning',
-  incompatible: 'bg-warning',
-}
-
 /** The head band of a dialog that warns before something happens: a faint wash of the warning tone. */
 const WARN_TINT = 'color-mix(in srgb, var(--warning) 10%, transparent)'
 /** The eyebrow over a block, the size the dialogs' sections use. */
 const EYEBROW = 'm-0 font-geist font-bold uppercase tracking-[.08em] text-content-faint'
-/** A capability or dependency chip on an installed row. */
-const CHIP = 'inline-flex max-w-full items-center gap-1.5 rounded-full border px-2 py-[2px] font-medium'
-const CHIP_NEUTRAL = 'border-edge-faint bg-surface-secondary text-content-secondary'
-const CHIP_NET = 'border-transparent bg-info-soft text-info'
-const CHIP_WARN = 'border-transparent bg-warning-soft text-warning'
 /** A small action inside a row or a card: the kit's button, a size down. */
 const SMALL_BUTTON = 'inline-flex flex-none items-center justify-center gap-1.5 rounded-[10px] bg-surface-card px-2.5 py-1.5 font-semibold text-content shadow-sm ring-1 ring-edge-faint hover:bg-surface-secondary disabled:cursor-default disabled:opacity-50'
 const SMALL_PRIMARY = 'inline-flex flex-none items-center justify-center gap-1.5 rounded-[10px] bg-accent px-3 py-1.5 font-semibold text-accent-text hover:opacity-90 disabled:cursor-default disabled:bg-surface-tertiary disabled:text-content-faint'
-/** A line of state under a row's name: a refused update, a paused one, an error. */
-const ROW_NOTE = 'mt-1.5 flex min-w-0 items-center gap-1.5'
-
 /** A pill that explains itself on hover. */
 function HintPill({ hint, children }: { hint: string; children: ReactNode }) {
   return (
@@ -76,19 +59,6 @@ function HintPill({ hint, children }: { hint: string; children: ReactNode }) {
   )
 }
 
-function ReviewedBadge({ t }: { t: T }) {
-  return <ShieldCheck size={13} className="text-success shrink-0" aria-label={t('admin.plugins.reviewed')} />
-}
-
-/** Marks a manually-uploaded (sideloaded) plugin: no registry, unsigned, not reviewed. */
-function SideloadedBadge({ t }: { t: T }) {
-  return (
-    <HintPill hint={t('admin.plugins.sideloadedHint')}>
-      <StatusPill tone="warning" icon={<UploadCloud size={11} />}>{t('admin.plugins.sideloaded')}</StatusPill>
-    </HintPill>
-  )
-}
-
 /**
  * Signed / Unsigned, for registry plugins only (see isRegistrySourced).
  *
@@ -113,15 +83,6 @@ function TrustBadge({ signed, t }: { signed: boolean; t: T }) {
   )
 }
 
-/** Marks a dev-linked plugin: loaded from a local build dir + hot-reloaded (dev only). */
-function DevLinkBadge({ t }: { t: T }) {
-  return (
-    <HintPill hint={t('admin.plugins.devLinkHint')}>
-      <StatusPill icon={<Link2 size={11} />}>{t('admin.plugins.devLinkBadge')}</StatusPill>
-    </HintPill>
-  )
-}
-
 function TypeBadge({ type, t }: { type: string; t: T }) {
   return (
     <span className="inline-flex flex-none items-center rounded-full bg-surface-tertiary px-2 py-[3px] font-geist font-bold uppercase tracking-[.06em] text-content-muted" style={fs(9.5)}>
@@ -145,6 +106,7 @@ export default function AdminPluginsPanel() {
     sort, statusFilter, toggle, typeFilter, uninstallConfirmed, updatable, updateAll, updateAvailable, uploadInputRef,
     uploadPlugin, versionPicker, view,
   } = usePluginsAdmin()
+  const [securityOpen, setSecurityOpen] = useState(false)
 
   return (
     <div className="relative mb-24 sm:mb-0"
@@ -181,6 +143,9 @@ export default function AdminPluginsPanel() {
         ) : undefined}
         action={ready ? (
           <>
+            <BandButton label={t('admin.plugins.security.short')} onClick={() => setSecurityOpen(true)}>
+              <ShieldCheck size={15} strokeWidth={2} />
+            </BandButton>
             <BandButton label={t('admin.plugins.upload')} onClick={pickUpload} disabled={busy === '__upload'}>
               <UploadCloud size={15} strokeWidth={2} />
             </BandButton>
@@ -242,31 +207,9 @@ export default function AdminPluginsPanel() {
                 />
               </label>
 
-              <FilterMenu id="type" label={t('admin.plugins.filterType')} value={typeFilter} menu={menu} setMenu={setMenu} icon={<SlidersHorizontal size={14} />}
-                options={[
-                  ['all', t('admin.plugins.allTypes')], ['widget', t('admin.plugins.type.widget')],
-                  ['integration', t('admin.plugins.type.integration')], ['page', t('admin.plugins.type.page')],
-                  ['trip-page', t('admin.plugins.type.trip-page')],
-                ]}
-                valueLabel={typeFilter === 'all' ? t('admin.plugins.allTypes') : t(`admin.plugins.type.${typeFilter}` as never)}
-                onPick={v => setTypeFilter(v as TypeFilter)} />
-
-              {view === 'installed' && (
-                <FilterMenu id="status" label={t('admin.plugins.filterStatus')} value={statusFilter} menu={menu} setMenu={setMenu} icon={<CircleDot size={14} />}
-                  options={[
-                    ['all', t('admin.plugins.allStatuses')], ['on', t('admin.plugins.status.active')], ['off', t('admin.plugins.stateOff')],
-                    ['update', t('admin.plugins.filterUpdate')], ['err', t('admin.plugins.status.error')],
-                  ]}
-                  valueLabel={statusLabel(statusFilter, t)}
-                  onPick={v => setStatusFilter(v as StatusFilter)} />
-              )}
-
-              <FilterMenu id="sort" label={t('admin.plugins.sortBy')} value={sort} menu={menu} setMenu={setMenu} icon={<ArrowUpDown size={14} />}
-                options={view === 'discover'
-                  ? [['name', t('admin.plugins.sortName')], ['recent', t('admin.plugins.sortRecent')], ['downloads', t('admin.plugins.sortDownloads')]]
-                  : [['name', t('admin.plugins.sortName')], ['recent', t('admin.plugins.sortRecent')], ['updates', t('admin.plugins.sortUpdates')]]}
-                valueLabel={sortLabel(sort, t)}
-                onPick={v => setSort(v as SortKey)} />
+              <PluginFilterMenu t={t} view={view} typeFilter={typeFilter} setTypeFilter={setTypeFilter}
+                statusFilter={statusFilter} setStatusFilter={setStatusFilter} sort={sort} setSort={setSort}
+                menu={menu} setMenu={setMenu} />
             </div>
 
             {view === 'discover' ? (
@@ -299,7 +242,7 @@ export default function AdminPluginsPanel() {
                 ) : (
                   <SettingRows>
                     {shownInstalled.map(p => (
-                      <InstalledRow key={p.id} p={p} t={t} busy={busy} menu={menu} setMenu={setMenu}
+                      <PluginInstalledRow key={p.id} p={p} t={t} busy={busy} menu={menu} setMenu={setMenu}
                         hasUpdate={updateAvailable(p)} latestVer={latest[p.id]}
                         newerIncompatible={newerIncompatible(p)}
                         blocked={blockIsCurrent(p, latest[p.id])}
@@ -320,7 +263,7 @@ export default function AdminPluginsPanel() {
         )}
       </SettingsCard>
 
-      <SecurityInfo t={t} />
+      {securityOpen && <PluginSecurityDialog t={t} onClose={() => setSecurityOpen(false)} />}
 
       {/* Registry detail dialog */}
       {detailFor && (
@@ -438,268 +381,6 @@ function SegBtn({ active, onClick, label, count }: { active: boolean; onClick: (
   )
 }
 
-/** Re-renders while the page moves under an open, portaled menu, so it stays pinned to its trigger. */
-function useFollowTrigger(open: boolean) {
-  const [, reanchor] = useState(0)
-  useEffect(() => {
-    if (!open) return
-    const onMove = () => reanchor(n => n + 1)
-    window.addEventListener('scroll', onMove, true)
-    window.addEventListener('resize', onMove)
-    return () => {
-      window.removeEventListener('scroll', onMove, true)
-      window.removeEventListener('resize', onMove)
-    }
-  }, [open])
-}
-
-function FilterMenu({ id, label, valueLabel, options, onPick, value, menu, setMenu, icon }: {
-  id: string; label: string; valueLabel: string
-  options: Array<[string, string]>; onPick: (v: string) => void; value: string
-  menu: string | null; setMenu: (v: string | null) => void; icon?: ReactNode
-}) {
-  const open = menu === id
-  const active = value !== options[0]?.[0]
-  const btnRef = useRef<HTMLButtonElement>(null)
-  // Portaled like the row menu: the card around the toolbar clips what overflows it.
-  useFollowTrigger(open)
-  return (
-    <div className="relative flex-none">
-      <button type="button" ref={btnRef} onClick={() => setMenu(open ? null : id)} title={`${label}: ${valueLabel}`} aria-expanded={open}
-        className={`inline-flex h-9 items-center gap-1.5 whitespace-nowrap rounded-[10px] border bg-surface-card px-3 text-content-secondary transition-colors hover:text-content ${
-          active ? 'border-[color:var(--text-primary)]' : 'border-edge'}`}
-        style={fs(12.5, 'body')}>
-        <span className="flex-none text-content-faint">{icon}</span>
-        <span>{label}: </span>
-        <span className="font-semibold text-content">{valueLabel}</span>
-        <ChevronDown size={13} className={`flex-none text-content-faint transition-transform ${open ? 'rotate-180' : ''}`} />
-      </button>
-      {open && createPortal(
-        <div className="min-w-[200px] max-w-[calc(100vw-2rem)]" style={{ ...POPOVER, ...anchorMenu(btnRef.current) }}>
-          {options.map(([v, lbl]) => (
-            <button type="button" key={v} onClick={() => { onPick(v); setMenu(null) }}
-              className={`${MENU_ITEM} ${value === v ? 'font-semibold text-content' : 'text-content-secondary'}`} style={fs(12.5, 'body')}>
-              <span className="min-w-0 flex-1 truncate text-start">{lbl}</span>
-              <Check size={14} className={`flex-none text-content-muted ${value === v ? 'opacity-100' : 'opacity-0'}`} />
-            </button>
-          ))}
-        </div>,
-        document.body,
-      )}
-    </div>
-  )
-}
-
-function InstalledRow({ p, t, busy, menu, setMenu, hasUpdate, latestVer, newerIncompatible, blocked, onToggle, onUpdate, onRestart, onChangeVersion, onResume, onReviewBlock, onErrors, onEgress, onSettings, onUninstall }: {
-  p: PluginRow; t: T; busy: string | null; menu: string | null; setMenu: (v: string | null) => void
-  hasUpdate: boolean; latestVer?: string; newerIncompatible: { version: string; range: string } | null; blocked: boolean
-  onToggle: () => void; onUpdate: () => void; onRestart: () => void; onChangeVersion: () => void; onResume: () => void; onReviewBlock: () => void
-  onErrors: () => void; onEgress: () => void; onSettings: () => void; onUninstall: () => void
-}) {
-  const caps = deriveCaps(parseJson<string[]>(p.permissions, []), parseJson<{ widget?: { slot?: string } }>(p.capabilities, {}), t)
-  const deps = deriveDeps(p, t)
-  const menuOpen = menu === `row:${p.id}`
-  const menuBtnRef = useRef<HTMLButtonElement>(null)
-  const working = busy === p.id
-  const on = p.enabled === 1 && p.status !== 'error'
-
-  // The menu is portaled to <body> and positioned `fixed` against the ⋯ button,
-  // because the row's ancestor (PageSidebar) is `overflow-hidden` and would clip
-  // an in-flow `absolute` menu — losing Delete on the lower rows of a long list.
-  // Re-anchor while the page moves under it.
-  useFollowTrigger(menuOpen)
-
-  const hostCount = p.egressHostCount ?? 0
-
-  return (
-    <div className={`group relative flex items-start gap-3 px-3.5 py-3 transition-colors hover:bg-surface-secondary ${working ? 'opacity-60' : ''}`}>
-      <div className="relative mt-0.5 flex-none">
-        <span className="grid h-10 w-10 place-items-center rounded-[12px] border border-edge-faint bg-surface-secondary">
-          <PluginIcon name={p.icon} size={19} className="text-content-secondary" />
-        </span>
-        <Tooltip label={t(`admin.plugins.status.${p.status}` as never)}>
-          <span className={`absolute -bottom-0.5 -end-0.5 h-3 w-3 rounded-full ring-2 ring-surface-card ${HEALTH[p.status] || HEALTH.inactive}`} />
-        </Tooltip>
-      </div>
-
-      <div className="min-w-0 flex-1">
-        <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
-          <span className="min-w-0 truncate font-semibold tracking-[-.006em] text-content" style={fs(13.5, 'body')}>{p.name}</span>
-          {p.version && <span className="font-geist font-medium tabular-nums text-content-faint" style={fs(11)}>v{p.version}</span>}
-          {p.reviewed_at && <ReviewedBadge t={t} />}
-          {p.source_repo === 'local:upload' && <SideloadedBadge t={t} />}
-          {p.source_repo === 'local:link' && <DevLinkBadge t={t} />}
-          {/* Registry plugins only — a sideloaded/dev-linked plugin already says something
-              strictly stronger, and stacking "Unsigned" on top of it just dilutes the amber. */}
-          {isRegistrySourced(p.source_repo) && <TrustBadge signed={!!p.signed} t={t} />}
-        </div>
-        {p.description && <p className="m-0 mt-0.5 truncate text-content-muted" style={fs(12, 'body')}>{p.description}</p>}
-        {/* A refused update leaves a WORKING plugin pinned at its old version — so this is
-            its own row state, not an error state, and it persists until it is resolved
-            rather than dying with the toast that first reported it. */}
-        {blocked && p.updateBlock && (
-          <div className={`${ROW_NOTE} text-warning`} style={fs(11.5)}>
-            <ShieldAlert size={13} className="flex-none" />
-            <span className="truncate">{t('admin.plugins.updateBlocked', { reason: p.updateBlock.detail ?? p.updateBlock.code })}</span>
-            <button type="button" onClick={onReviewBlock}
-              className="flex-none font-semibold underline underline-offset-2 hover:opacity-80">
-              {t('admin.plugins.reviewBlock')}
-            </button>
-          </div>
-        )}
-        {/* A newer version this TREK can't run — informational, never a button: the fix
-            is a TREK upgrade, so the row must not nag or offer a doomed install. */}
-        {newerIncompatible && (
-          <div className={`${ROW_NOTE} text-content-faint`} style={fs(11.5)}>
-            <Info size={13} className="flex-none" />
-            <span className="truncate">{t('admin.plugins.newerNeedsTrek', { version: newerIncompatible.version, range: newerIncompatible.range })}</span>
-          </div>
-        )}
-        {/* Held: the admin deliberately installed a non-latest version, so updates are
-            paused rather than nagged — resuming is one click, right where the pause shows. */}
-        {p.updateHold && (
-          <div className={`${ROW_NOTE} text-content-faint`} style={fs(11.5)}>
-            <PauseCircle size={13} className="flex-none" />
-            <span className="truncate">{t('admin.plugins.updatesHeld', { version: p.version ?? '' })}</span>
-            <button type="button" onClick={onResume} disabled={working}
-              className="flex-none font-semibold text-content-secondary underline underline-offset-2 hover:opacity-80 disabled:opacity-50">
-              {t('admin.plugins.resumeUpdates')}
-            </button>
-          </div>
-        )}
-        {p.status === 'error' && p.last_error ? (
-          <div className={`${ROW_NOTE} text-danger`} style={fs(11.5)}>
-            <AlertTriangle size={13} className="flex-none" /><span className="truncate">{p.last_error}</span>
-          </div>
-        ) : (caps.length > 0 || p.operatorEgress) && (
-          <div className="mt-2 flex flex-wrap items-center gap-1.5">
-            {caps.map((c, i) => (
-              <span key={i} className={`${CHIP} ${c.net ? CHIP_NET : CHIP_NEUTRAL}`} style={fs(11)}>
-                <c.icon size={12} className={c.net ? 'text-info' : 'text-content-muted'} /><span className="truncate">{c.label}</span>
-              </span>
-            ))}
-            {/* This plugin talks to a service only the OPERATOR can name (a self-hosted
-                Gotify/ntfy), so its manifest can't list the host — the admin adds it.
-                Actionable, and warning-toned until at least one host exists, because
-                until then the plugin cannot reach anything and looks silently broken. */}
-            {p.operatorEgress && (
-              <Tooltip label={t('admin.plugins.allowedHosts.hint')}>
-                <button type="button" onClick={onEgress}
-                  className={`${CHIP} ${hostCount > 0 ? CHIP_NET : CHIP_WARN} hover:opacity-80`} style={fs(11)}>
-                  <Globe size={12} />
-                  {hostCount > 0
-                    ? t('admin.plugins.allowedHosts.count', { n: hostCount })
-                    : t('admin.plugins.allowedHosts.add')}
-                </button>
-              </Tooltip>
-            )}
-          </div>
-        )}
-        {deps.length > 0 && (
-          <div className="mt-1.5 flex flex-wrap items-center gap-1.5">
-            {deps.map((d, i) => (
-              <span key={i} className={`${CHIP} ${d.blocked || d.warn ? CHIP_WARN : CHIP_NEUTRAL}`} style={fs(11)}>
-                <d.icon size={12} className={d.blocked || d.warn ? 'text-warning' : 'text-content-muted'} /><span className="truncate">{d.label}</span>
-              </span>
-            ))}
-          </div>
-        )}
-      </div>
-
-      <div className="flex flex-none items-center gap-2 self-center">
-        {hasUpdate && (
-          <button type="button" onClick={onUpdate} disabled={working}
-            className="inline-flex items-center gap-1.5 rounded-full bg-warning-soft px-2.5 py-1 font-semibold text-warning hover:opacity-90 disabled:opacity-50"
-            style={fs(11.5)}>
-            <ArrowUpCircle size={13} /> <span>{t('admin.plugins.updateTo', { version: latestVer })}</span>
-          </button>
-        )}
-        <span className={`min-w-[42px] text-end font-medium ${on ? 'text-content-secondary' : 'text-content-faint'}`} style={fs(12)}>
-          {p.enabled === 1 ? t('admin.plugins.status.active') : t('admin.plugins.stateOff')}
-        </span>
-        <ToggleSwitch on={p.enabled === 1} label={t('admin.plugins.enabledToggle')} onToggle={onToggle} />
-        <div className="relative">
-          <Tooltip label={t('admin.table.actions')} disabled={menuOpen}>
-            <button type="button" ref={menuBtnRef} data-testid={`plugin-row-menu-btn-${p.id}`} onClick={() => setMenu(menuOpen ? null : `row:${p.id}`)}
-              aria-expanded={menuOpen} aria-label={t('admin.table.actions')}
-              className={`grid h-8 w-8 place-items-center rounded-[10px] transition-colors ${menuOpen ? 'bg-surface-card text-content shadow-sm ring-1 ring-edge-faint' : 'text-content-faint hover:bg-surface-card hover:text-content'}`}>
-              <MoreHorizontal size={17} />
-            </button>
-          </Tooltip>
-          {menuOpen && createPortal(
-            <div data-testid={`plugin-row-menu-${p.id}`} style={{ ...POPOVER, ...anchorMenu(menuBtnRef.current) }}
-              className="min-w-[200px]">
-              {p.enabled === 1 && (
-                <MenuItem icon={<RotateCw size={14} />} label={t('admin.plugins.restart')} onClick={onRestart} />
-              )}
-              {/* A plugin gets the item if it declares scope:'instance' fields OR actions —
-                  an action-only plugin still needs the dialog to run its buttons. */}
-              {((p.instanceSettingsCount ?? 0) > 0 || (p.instanceActionsCount ?? 0) > 0) && (
-                <MenuItem icon={<SlidersHorizontal size={14} />} label={t('admin.plugins.instanceSettings')} onClick={onSettings} />
-              )}
-              <MenuItem icon={<Bug size={14} />} label={t('admin.plugins.viewErrors')} onClick={onErrors} />
-              {/* Only a plugin that DECLARED operatorEgress gets the item — an admin must
-                  never be invited to widen egress for a plugin that didn't ask for it
-                  (same rule the row's egress chip follows). */}
-              {p.operatorEgress && (
-                <MenuItem icon={<Globe size={14} />} label={t('admin.plugins.allowedHosts')} onClick={onEgress} />
-              )}
-              {/* Registry plugins only — a sideload/dev-link has no registry versions to pick from. */}
-              {isRegistrySourced(p.source_repo) && (
-                <MenuItem icon={<History size={14} />} label={t('admin.plugins.changeVersion')} onClick={onChangeVersion} />
-              )}
-              {p.source_repo && p.source_repo !== 'local:upload' && p.source_repo !== 'local:link' && (
-                <>
-                  <a href={`https://github.com/${p.source_repo}`} target="_blank" rel="noreferrer" onClick={() => setMenu(null)}
-                    className={`${MENU_ITEM} text-content-secondary`} style={fs(12.5, 'body')}>
-                    <span className="flex w-4 flex-none justify-center text-content-muted"><Github size={14} /></span> {t('admin.plugins.sourceRepo')}
-                  </a>
-                  <a href={`https://github.com/${p.source_repo}/issues`} target="_blank" rel="noreferrer" onClick={() => setMenu(null)}
-                    className={`${MENU_ITEM} text-content-secondary`} style={fs(12.5, 'body')}>
-                    <span className="flex w-4 flex-none justify-center text-content-muted"><CircleDot size={14} /></span> {t('admin.plugins.reportIssue')}
-                  </a>
-                </>
-              )}
-              <div className="mx-1.5 my-1 h-px bg-edge-faint" />
-              <MenuItem icon={<Trash2 size={14} />} label={t('common.delete')} danger onClick={onUninstall} />
-            </div>,
-            document.body,
-          )}
-        </div>
-      </div>
-    </div>
-  )
-}
-
-/** Tallest the ⋯ menu gets (6 items + divider + padding). Drives the flip. */
-const ROW_MENU_MAX_H = 260
-
-/** Pin a portaled menu to the right edge of its trigger, flipping up when the bottom is tight. */
-function anchorMenu(trigger: HTMLElement | null): CSSProperties {
-  const r = trigger?.getBoundingClientRect()
-  if (!r) return { position: 'fixed', top: 0, right: 0, zIndex: 100 }
-  const spaceBelow = window.innerHeight - r.bottom
-  const openUp = spaceBelow < ROW_MENU_MAX_H && r.top > spaceBelow
-  return {
-    position: 'fixed',
-    right: Math.max(8, window.innerWidth - r.right),
-    ...(openUp ? { bottom: window.innerHeight - r.top + 4 } : { top: r.bottom + 4 }),
-    zIndex: 100,
-  }
-}
-
-/** One entry of a popover menu, in the packing popovers' shape. */
-const MENU_ITEM = 'flex w-full items-center gap-2.5 rounded-[9px] px-2.5 py-2 font-medium transition-colors hover:bg-surface-tertiary'
-
-function MenuItem({ icon, label, onClick, danger }: { icon: ReactNode; label: string; onClick: () => void; danger?: boolean }) {
-  return (
-    <button type="button" onClick={onClick}
-      className={`${MENU_ITEM} ${danger ? 'text-danger hover:bg-danger-soft' : 'text-content-secondary'}`} style={fs(12.5, 'body')}>
-      <span className={`flex w-4 flex-none justify-center ${danger ? 'text-danger' : 'text-content-muted'}`}>{icon}</span> {label}
-    </button>
-  )
-}
-
 function Screenshot({ url, className, iconSize = 28 }: { url: string | null; className: string; iconSize?: number }) {
   const [failed, setFailed] = useState(false)
   return (
@@ -751,6 +432,16 @@ function RegistryGrid({ items, onInstall, onOpenDetail, busy, t, installedIds, f
                   <StatusPill icon={<ShieldCheck size={11} className="text-success" />}>{t('admin.plugins.reviewed')}</StatusPill>
                 </span>
               )}
+              {/* Says up front that this one has not been confirmed for the TREK it would run on,
+                  so "Install" never reads as a plain install; the dialog explains the risk. */}
+              {!installed && offer.warn && (
+                // Solid, not the soft pill "Reviewed" uses: it has to stand out on any screenshot.
+                <span className="absolute start-2.5 top-2.5 inline-flex max-w-[62%] items-center gap-1 rounded-full bg-warning px-2 py-[3px] font-geist font-semibold text-[color:var(--surface-card)] shadow-md"
+                  style={fs(11)}>
+                  <AlertTriangle size={11} className="flex-none" />
+                  <span className="truncate">{t('admin.plugins.untestedChip', { host: offer.warn.hostVersion })}</span>
+                </span>
+              )}
               <span className="absolute -bottom-4 start-3.5 z-[1] grid h-10 w-10 place-items-center rounded-[12px] border border-edge-faint bg-surface-card shadow-sm">
                 <PluginIcon name={item.icon} size={20} className="text-content-secondary" />
               </span>
@@ -829,8 +520,8 @@ function Tile({ children, warn }: { children: ReactNode; warn?: boolean }) {
  * The TREK_PLUGINS_IGNORE_TREK_RANGE warning (copy and modes from useRangeBypass). Its own
  * component rather than ConfirmDialog because the notice mode has no cancel button.
  */
-function RangeBypassDialog({ copy: { title, body, confirm }, onConfirm, onClose, t }: {
-  copy: { title: string; body: string; confirm: boolean }; onConfirm: () => void; onClose: () => void; t: T
+function RangeBypassDialog({ copy: { title, body, confirm, confirmLabel }, onConfirm, onClose, t }: {
+  copy: { title: string; body: string; confirm: boolean; confirmLabel: string }; onConfirm: () => void; onClose: () => void; t: T
 }) {
   return (
     <DialogShell
@@ -844,7 +535,7 @@ function RangeBypassDialog({ copy: { title, body, confirm }, onConfirm, onClose,
           {confirm ? (
             <>
               <DialogButton onClick={onClose}>{t('common.cancel')}</DialogButton>
-              <DialogButton variant="primary" onClick={onConfirm}>{t('admin.plugins.installAnyway')}</DialogButton>
+              <DialogButton variant="primary" onClick={onConfirm}>{confirmLabel}</DialogButton>
             </>
           ) : (
             <DialogButton variant="primary" onClick={onClose}>{t('common.ok')}</DialogButton>
@@ -1495,45 +1186,3 @@ function DependencyResolveDialog({ data, t, busy, installedIds, onDownload, onCl
     </DialogShell>
   )
 }
-
-// Footer: a plain-language note on what "Reviewed" means, plus a collapsible
-// panel that lays out how plugins are contained, the limits, and the worst case.
-function SecurityInfo({ t }: { t: T }) {
-  const [open, setOpen] = useState(false)
-  const sections: Array<[string, string]> = [
-    ['admin.plugins.security.isolationTitle', 'admin.plugins.security.isolationBody'],
-    ['admin.plugins.security.permsTitle', 'admin.plugins.security.permsBody'],
-    ['admin.plugins.security.limitsTitle', 'admin.plugins.security.limitsBody'],
-    ['admin.plugins.security.worstTitle', 'admin.plugins.security.worstBody'],
-    ['admin.plugins.security.reviewedTitle', 'admin.plugins.security.reviewedBody'],
-    ['admin.plugins.security.signedTitle', 'admin.plugins.security.signedBody'],
-    ['admin.plugins.security.trustTitle', 'admin.plugins.security.trustBody'],
-  ]
-  return (
-    <SettingsCard
-      icon={Lock}
-      title={(
-        <button type="button" onClick={() => setOpen(o => !o)} aria-expanded={open}
-          className="inline-flex max-w-full items-center gap-1.5 text-start font-bold text-content hover:opacity-80">
-          <span className="truncate">{t('admin.plugins.security.title')}</span>
-          <ChevronDown size={15} className={`flex-none text-content-faint transition-transform ${open ? 'rotate-180' : ''}`} />
-        </button>
-      )}
-    >
-      <div className="flex items-start gap-2.5">
-        <ShieldCheck size={14} className="mt-0.5 flex-none text-content-faint" />
-        <SettingsHint>{t('admin.plugins.reviewedMeaning')}</SettingsHint>
-      </div>
-      {open && (
-        <div className="grid gap-2.5 sm:grid-cols-2">
-          {sections.map(([h, b]) => (
-            <div key={h} className="rounded-[12px] border border-edge-faint bg-surface-card px-3.5 py-3">
-              <h4 className="m-0 font-semibold text-content" style={fs(12.5, 'body')}>{t(h as never)}</h4>
-              <p className="m-0 mt-1 leading-relaxed text-content-muted" style={fs(12, 'body')}>{t(b as never)}</p>
-            </div>
-          ))}
-        </div>
-      )}
-    </SettingsCard>
-  )
-}

client/src/components/Admin/plugins/PluginFilterMenu.tsx

@@ -0,0 +1,167 @@
+import { Check, ChevronDown, SlidersHorizontal } from 'lucide-react';
+import { useRef } from 'react';
+import { createPortal } from 'react-dom';
+import { POPOVER } from '../../Packing/packingPopoverStyles';
+import { fs } from '../../shared/DialogShell';
+import { anchorMenu, MENU_ITEM, useFollowTrigger } from './pluginMenu';
+import { sortLabel, type SortKey, type StatusFilter, type T, type TypeFilter } from './pluginModel';
+
+const MENU_ID = 'filters';
+
+interface Section {
+  title: string;
+  value: string;
+  options: Array<[string, string]>;
+  onPick: (v: string) => void;
+}
+
+/**
+ * Type, status and order of the plugin list behind one button instead of three, so the
+ * toolbar stays search plus one control. The button counts the filters that narrow the
+ * list (the order does not narrow it) and names the order it is in.
+ */
+export default function PluginFilterMenu({
+  t,
+  view,
+  typeFilter,
+  setTypeFilter,
+  statusFilter,
+  setStatusFilter,
+  sort,
+  setSort,
+  menu,
+  setMenu,
+}: {
+  t: T;
+  view: 'installed' | 'discover';
+  typeFilter: TypeFilter;
+  setTypeFilter: (v: TypeFilter) => void;
+  statusFilter: StatusFilter;
+  setStatusFilter: (v: StatusFilter) => void;
+  sort: SortKey;
+  setSort: (v: SortKey) => void;
+  menu: string | null;
+  setMenu: (v: string | null) => void;
+}) {
+  const open = menu === MENU_ID;
+  const btnRef = useRef<HTMLButtonElement>(null);
+  useFollowTrigger(open);
+
+  const sections: Section[] = [
+    {
+      title: t('admin.plugins.filterType'),
+      value: typeFilter,
+      options: [
+        ['all', t('admin.plugins.allTypes')],
+        ['widget', t('admin.plugins.type.widget')],
+        ['integration', t('admin.plugins.type.integration')],
+        ['page', t('admin.plugins.type.page')],
+        ['trip-page', t('admin.plugins.type.trip-page')],
+      ],
+      onPick: (v) => setTypeFilter(v as TypeFilter),
+    },
+    ...(view === 'installed'
+      ? [
+          {
+            title: t('admin.plugins.filterStatus'),
+            value: statusFilter,
+            options: [
+              ['all', t('admin.plugins.allStatuses')],
+              ['on', t('admin.plugins.status.active')],
+              ['off', t('admin.plugins.stateOff')],
+              ['update', t('admin.plugins.filterUpdate')],
+              ['err', t('admin.plugins.status.error')],
+            ] as Array<[string, string]>,
+            onPick: (v: string) => setStatusFilter(v as StatusFilter),
+          },
+        ]
+      : []),
+    {
+      title: t('admin.plugins.sortBy'),
+      value: sort,
+      options:
+        view === 'discover'
+          ? [
+              ['name', t('admin.plugins.sortName')],
+              ['recent', t('admin.plugins.sortRecent')],
+              ['downloads', t('admin.plugins.sortDownloads')],
+            ]
+          : [
+              ['name', t('admin.plugins.sortName')],
+              ['recent', t('admin.plugins.sortRecent')],
+              ['updates', t('admin.plugins.sortUpdates')],
+            ],
+      onPick: (v) => setSort(v as SortKey),
+    },
+  ];
+  const narrowing = (typeFilter !== 'all' ? 1 : 0) + (view === 'installed' && statusFilter !== 'all' ? 1 : 0);
+
+  return (
+    <div className="relative flex-none">
+      <button
+        type="button"
+        ref={btnRef}
+        onClick={() => setMenu(open ? null : MENU_ID)}
+        aria-expanded={open}
+        aria-haspopup="menu"
+        className={`inline-flex h-9 items-center gap-2 whitespace-nowrap rounded-[10px] border bg-surface-card px-3 text-content-secondary transition-colors hover:text-content ${
+          narrowing ? 'border-[color:var(--text-primary)]' : 'border-edge'
+        }`}
+        style={fs(12.5, 'body')}
+      >
+        <SlidersHorizontal size={14} className="flex-none text-content-faint" />
+        <span className="font-semibold text-content">{t('admin.plugins.filters')}</span>
+        {narrowing > 0 && (
+          <span
+            className="inline-flex h-[18px] min-w-[18px] items-center justify-center rounded-full bg-accent px-1.5 font-geist font-bold tabular-nums text-accent-text"
+            style={fs(10.5)}
+          >
+            {narrowing}
+          </span>
+        )}
+        <span className="text-content-faint">{sortLabel(sort, t)}</span>
+        <ChevronDown
+          size={13}
+          className={`flex-none text-content-faint transition-transform ${open ? 'rotate-180' : ''}`}
+        />
+      </button>
+      {open &&
+        createPortal(
+          <div
+            role="menu"
+            className="w-[240px] max-w-[calc(100vw-2rem)]"
+            style={{ ...POPOVER, ...anchorMenu(btnRef.current) }}
+          >
+            {sections.map((s, i) => (
+              <div key={s.title} className={i > 0 ? 'mt-1.5 border-t border-edge-faint pt-1.5' : undefined}>
+                <p
+                  className="m-0 px-2.5 pb-1 pt-1 font-geist font-bold uppercase tracking-[.08em] text-content-faint"
+                  style={fs(10)}
+                >
+                  {s.title}
+                </p>
+                {s.options.map(([v, label]) => (
+                  <button
+                    type="button"
+                    role="menuitemradio"
+                    aria-checked={s.value === v}
+                    key={v}
+                    onClick={() => s.onPick(v)}
+                    className={`${MENU_ITEM} ${s.value === v ? 'font-semibold text-content' : 'text-content-secondary'}`}
+                    style={fs(12.5, 'body')}
+                  >
+                    <span className="min-w-0 flex-1 truncate text-start">{label}</span>
+                    <Check
+                      size={14}
+                      className={`flex-none text-content-muted ${s.value === v ? 'opacity-100' : 'opacity-0'}`}
+                    />
+                  </button>
+                ))}
+              </div>
+            ))}
+          </div>,
+          document.body
+        )}
+    </div>
+  );
+}

client/src/components/Admin/plugins/PluginInstalledRow.tsx

@@ -0,0 +1,426 @@
+import {
+  AlertTriangle,
+  ArrowUpCircle,
+  Bug,
+  CircleDot,
+  Github,
+  Globe,
+  History,
+  Info,
+  KeyRound,
+  Link2,
+  MoreHorizontal,
+  PauseCircle,
+  RotateCw,
+  ShieldAlert,
+  ShieldCheck,
+  SlidersHorizontal,
+  Trash2,
+  UploadCloud,
+} from 'lucide-react';
+import { useRef, type ComponentType, type ReactNode } from 'react';
+import { createPortal } from 'react-dom';
+import { POPOVER } from '../../Packing/packingPopoverStyles';
+import ToggleSwitch from '../../Settings/ToggleSwitch';
+import { fs } from '../../shared/DialogShell';
+import PluginIcon from '../../shared/PluginIcon';
+import { Tooltip } from '../../shared/Tooltip';
+import { deriveCaps } from '../pluginCaps';
+import { anchorMenu, MENU_ITEM, useFollowTrigger } from './pluginMenu';
+import { deriveDeps, isRegistrySourced, parseJson, type PluginRow, type T } from './pluginModel';
+
+// Runtime health → dot colour on the icon tile.
+const HEALTH: Record<string, string> = {
+  active: 'bg-success',
+  starting: 'bg-info animate-pulse',
+  error: 'bg-danger',
+  inactive: 'bg-content-faint/60',
+  disabled: 'bg-warning',
+  incompatible: 'bg-warning',
+};
+
+/** Every fact about a plugin wears the same chip; only its icon carries a colour. */
+const FACT =
+  'inline-flex max-w-full items-center gap-1.5 rounded-full border border-edge-faint bg-surface-secondary px-2 py-[2px] font-medium text-content-secondary';
+
+type Tone = 'warning' | 'danger' | 'neutral';
+const NOTICE_LOOK: Record<Tone, string> = {
+  warning: 'bg-warning-soft text-warning',
+  danger: 'bg-danger-soft text-danger',
+  neutral: 'bg-surface-secondary text-content-muted',
+};
+
+/** A state of the plugin worth reading on its own line: what it means, and the one action that fixes it. */
+interface Notice {
+  key: string;
+  tone: Tone;
+  icon: ComponentType<{ size?: number; className?: string }>;
+  text: string;
+  action?: { label: string; onClick: () => void; disabled?: boolean };
+}
+
+function Fact({
+  icon,
+  iconClass = 'text-content-muted',
+  hint,
+  children,
+}: {
+  icon: ReactNode;
+  iconClass?: string;
+  hint?: string;
+  children: ReactNode;
+}) {
+  const chip = (
+    <span className={FACT} style={fs(11)}>
+      <span className={`flex flex-none ${iconClass}`}>{icon}</span>
+      <span className="truncate">{children}</span>
+    </span>
+  );
+  return hint ? (
+    <Tooltip label={hint}>
+      <span className="inline-flex max-w-full">{chip}</span>
+    </Tooltip>
+  ) : (
+    chip
+  );
+}
+
+function NoticeLine({ n }: { n: Notice }) {
+  return (
+    <div
+      className={`flex min-w-0 items-center gap-2 rounded-[10px] px-2.5 py-1.5 ${NOTICE_LOOK[n.tone]}`}
+      style={fs(11.5)}
+    >
+      <n.icon size={13} className="flex-none" />
+      <span className="min-w-0 flex-1 truncate">{n.text}</span>
+      {n.action && (
+        <button
+          type="button"
+          onClick={n.action.onClick}
+          disabled={n.action.disabled}
+          className="flex-none font-semibold underline underline-offset-2 hover:opacity-80 disabled:opacity-50"
+        >
+          {n.action.label}
+        </button>
+      )}
+    </div>
+  );
+}
+
+function MenuItem({
+  icon,
+  label,
+  onClick,
+  danger,
+}: {
+  icon: ReactNode;
+  label: string;
+  onClick: () => void;
+  danger?: boolean;
+}) {
+  return (
+    <button
+      type="button"
+      onClick={onClick}
+      className={`${MENU_ITEM} ${danger ? 'text-danger hover:bg-danger-soft' : 'text-content-secondary'}`}
+      style={fs(12.5, 'body')}
+    >
+      <span className={`flex w-4 flex-none justify-center ${danger ? 'text-danger' : 'text-content-muted'}`}>
+        {icon}
+      </span>{' '}
+      {label}
+    </button>
+  );
+}
+
+interface InstalledRowProps {
+  p: PluginRow;
+  t: T;
+  busy: string | null;
+  menu: string | null;
+  setMenu: (v: string | null) => void;
+  hasUpdate: boolean;
+  latestVer?: string;
+  newerIncompatible: { version: string; range: string } | null;
+  blocked: boolean;
+  onToggle: () => void;
+  onUpdate: () => void;
+  onRestart: () => void;
+  onChangeVersion: () => void;
+  onResume: () => void;
+  onReviewBlock: () => void;
+  onErrors: () => void;
+  onEgress: () => void;
+  onSettings: () => void;
+  onUninstall: () => void;
+}
+
+/**
+ * One installed plugin, read top to bottom: its name and version, what it does, the
+ * facts about it as one row of alike chips (what it adds, whether it was reviewed and
+ * signed, where it may connect), then each state that needs attention on a line of its
+ * own with the action that resolves it. The controls stay on the right.
+ */
+export default function PluginInstalledRow(props: InstalledRowProps) {
+  const { p, t, busy, menu, setMenu, hasUpdate, latestVer, newerIncompatible, blocked } = props;
+  const caps = deriveCaps(
+    parseJson<string[]>(p.permissions, []),
+    parseJson<{ widget?: { slot?: string } }>(p.capabilities, {}),
+    t
+  );
+  const deps = deriveDeps(p, t);
+  const menuOpen = menu === `row:${p.id}`;
+  const menuBtnRef = useRef<HTMLButtonElement>(null);
+  const working = busy === p.id;
+  const hostCount = p.egressHostCount ?? 0;
+
+  // The menu is portaled to <body> and positioned `fixed` against the ⋯ button,
+  // because the row's ancestor (PageSidebar) is `overflow-hidden` and would clip
+  // an in-flow `absolute` menu — losing Delete on the lower rows of a long list.
+  useFollowTrigger(menuOpen);
+
+  const notices: Notice[] = [];
+  if (p.status === 'error' && p.last_error) {
+    notices.push({ key: 'error', tone: 'danger', icon: AlertTriangle, text: p.last_error });
+  }
+  // A refused update leaves a WORKING plugin pinned at its old version: its own state,
+  // kept until resolved rather than dying with the toast that first reported it.
+  if (blocked && p.updateBlock) {
+    notices.push({
+      key: 'block',
+      tone: 'warning',
+      icon: ShieldAlert,
+      text: t('admin.plugins.updateBlocked', { reason: p.updateBlock.detail ?? p.updateBlock.code }),
+      action: { label: t('admin.plugins.reviewBlock'), onClick: props.onReviewBlock },
+    });
+  }
+  for (const [i, d] of deps.entries()) {
+    if (d.blocked || d.warn) notices.push({ key: `dep${i}`, tone: 'warning', icon: d.icon, text: d.label });
+  }
+  // Held: the admin deliberately installed a non-latest version, so updates are paused
+  // rather than nagged — resuming is one click, right where the pause shows.
+  if (p.updateHold) {
+    notices.push({
+      key: 'hold',
+      tone: 'neutral',
+      icon: PauseCircle,
+      text: t('admin.plugins.updatesHeld', { version: p.version ?? '' }),
+      action: { label: t('admin.plugins.resumeUpdates'), onClick: props.onResume, disabled: working },
+    });
+  }
+  // A newer version this TREK can't run: informational, never a button, the fix is a TREK upgrade.
+  if (newerIncompatible) {
+    notices.push({
+      key: 'newer',
+      tone: 'neutral',
+      icon: Info,
+      text: t('admin.plugins.newerNeedsTrek', { version: newerIncompatible.version, range: newerIncompatible.range }),
+    });
+  }
+
+  return (
+    <div
+      className={`group relative flex items-start gap-3 px-3.5 py-3.5 transition-colors hover:bg-surface-secondary ${working ? 'opacity-60' : ''}`}
+    >
+      <div className="relative mt-0.5 flex-none">
+        <span className="grid h-10 w-10 place-items-center rounded-[12px] border border-edge-faint bg-surface-secondary">
+          <PluginIcon name={p.icon} size={19} className="text-content-secondary" />
+        </span>
+        <Tooltip label={t(`admin.plugins.status.${p.status}` as never)}>
+          <span
+            className={`absolute -bottom-0.5 -end-0.5 h-3 w-3 rounded-full ring-2 ring-surface-card ${HEALTH[p.status] || HEALTH.inactive}`}
+          />
+        </Tooltip>
+      </div>
+
+      <div className="min-w-0 flex-1">
+        <div className="flex min-w-0 items-baseline gap-2">
+          <span className="min-w-0 truncate font-semibold tracking-[-.006em] text-content" style={fs(13.5, 'body')}>
+            {p.name}
+          </span>
+          {p.version && (
+            <span className="flex-none font-geist font-medium tabular-nums text-content-faint" style={fs(11)}>
+              v{p.version}
+            </span>
+          )}
+        </div>
+        {p.description && (
+          <p className="m-0 mt-0.5 truncate text-content-muted" style={fs(12, 'body')}>
+            {p.description}
+          </p>
+        )}
+
+        <div className="mt-2 flex flex-wrap items-center gap-1.5">
+          {caps.map((c, i) => (
+            <Fact key={i} icon={<c.icon size={12} />} iconClass={c.net ? 'text-info' : 'text-content-muted'}>
+              {c.label}
+            </Fact>
+          ))}
+          {deps
+            .filter((d) => !d.blocked && !d.warn)
+            .map((d, i) => (
+              <Fact key={`d${i}`} icon={<d.icon size={12} />}>
+                {d.label}
+              </Fact>
+            ))}
+          {p.reviewed_at && (
+            <Fact icon={<ShieldCheck size={12} />} iconClass="text-success">
+              {t('admin.plugins.reviewed')}
+            </Fact>
+          )}
+          {p.source_repo === 'local:upload' && (
+            <Fact icon={<UploadCloud size={12} />} iconClass="text-warning" hint={t('admin.plugins.sideloadedHint')}>
+              {t('admin.plugins.sideloaded')}
+            </Fact>
+          )}
+          {p.source_repo === 'local:link' && (
+            <Fact icon={<Link2 size={12} />} hint={t('admin.plugins.devLinkHint')}>
+              {t('admin.plugins.devLinkBadge')}
+            </Fact>
+          )}
+          {/* Registry plugins only: a sideloaded or dev-linked plugin already says something stronger. */}
+          {isRegistrySourced(p.source_repo) &&
+            (p.signed ? (
+              <Fact icon={<KeyRound size={12} />} hint={t('admin.plugins.signedHint')}>
+                {t('admin.plugins.signed')}
+              </Fact>
+            ) : (
+              <Fact icon={<ShieldAlert size={12} />} iconClass="text-warning" hint={t('admin.plugins.unsignedHint')}>
+                {t('admin.plugins.unsigned')}
+              </Fact>
+            ))}
+          {/* A service only the operator can name (a self-hosted Gotify/ntfy): the admin adds
+              its host, and until one exists the plugin reaches nothing, so it asks for it. */}
+          {p.operatorEgress && (
+            <Tooltip label={t('admin.plugins.allowedHosts.hint')}>
+              <button type="button" onClick={props.onEgress} className={`${FACT} hover:opacity-80`} style={fs(11)}>
+                <Globe size={12} className={hostCount > 0 ? 'text-info' : 'text-warning'} />
+                {hostCount > 0
+                  ? t('admin.plugins.allowedHosts.count', { n: hostCount })
+                  : t('admin.plugins.allowedHosts.add')}
+              </button>
+            </Tooltip>
+          )}
+        </div>
+
+        {notices.length > 0 && (
+          <div className="mt-2.5 flex flex-col gap-1.5">
+            {notices.map((n) => (
+              <NoticeLine key={n.key} n={n} />
+            ))}
+          </div>
+        )}
+      </div>
+
+      <div className="flex flex-none items-center gap-2 self-center">
+        {hasUpdate && (
+          <button
+            type="button"
+            onClick={props.onUpdate}
+            disabled={working}
+            className="inline-flex items-center gap-1.5 rounded-full bg-warning-soft px-2.5 py-1 font-semibold text-warning hover:opacity-90 disabled:opacity-50"
+            style={fs(11.5)}
+          >
+            <ArrowUpCircle size={13} /> <span>{t('admin.plugins.updateTo', { version: latestVer })}</span>
+          </button>
+        )}
+        <span
+          className={`min-w-[42px] text-end font-medium ${p.enabled === 1 ? 'text-content-secondary' : 'text-content-faint'}`}
+          style={fs(12)}
+        >
+          {p.enabled === 1 ? t('admin.plugins.status.active') : t('admin.plugins.stateOff')}
+        </span>
+        <ToggleSwitch on={p.enabled === 1} label={t('admin.plugins.enabledToggle')} onToggle={props.onToggle} />
+        <div className="relative">
+          <Tooltip label={t('admin.table.actions')} disabled={menuOpen}>
+            <button
+              type="button"
+              ref={menuBtnRef}
+              data-testid={`plugin-row-menu-btn-${p.id}`}
+              onClick={() => setMenu(menuOpen ? null : `row:${p.id}`)}
+              aria-expanded={menuOpen}
+              aria-label={t('admin.table.actions')}
+              className={`grid h-8 w-8 place-items-center rounded-[10px] transition-colors ${menuOpen ? 'bg-surface-card text-content shadow-sm ring-1 ring-edge-faint' : 'text-content-faint hover:bg-surface-card hover:text-content'}`}
+            >
+              <MoreHorizontal size={17} />
+            </button>
+          </Tooltip>
+          {menuOpen &&
+            createPortal(
+              <div
+                data-testid={`plugin-row-menu-${p.id}`}
+                style={{ ...POPOVER, ...anchorMenu(menuBtnRef.current) }}
+                className="min-w-[200px]"
+              >
+                {p.enabled === 1 && (
+                  <MenuItem
+                    icon={<RotateCw size={14} />}
+                    label={t('admin.plugins.restart')}
+                    onClick={props.onRestart}
+                  />
+                )}
+                {/* Instance fields OR actions: an action-only plugin still needs the dialog to run its buttons. */}
+                {((p.instanceSettingsCount ?? 0) > 0 || (p.instanceActionsCount ?? 0) > 0) && (
+                  <MenuItem
+                    icon={<SlidersHorizontal size={14} />}
+                    label={t('admin.plugins.instanceSettings')}
+                    onClick={props.onSettings}
+                  />
+                )}
+                <MenuItem icon={<Bug size={14} />} label={t('admin.plugins.viewErrors')} onClick={props.onErrors} />
+                {/* Only a plugin that DECLARED operatorEgress: an admin is never invited to widen egress for one that did not ask. */}
+                {p.operatorEgress && (
+                  <MenuItem
+                    icon={<Globe size={14} />}
+                    label={t('admin.plugins.allowedHosts')}
+                    onClick={props.onEgress}
+                  />
+                )}
+                {/* Registry plugins only — a sideload/dev-link has no registry versions to pick from. */}
+                {isRegistrySourced(p.source_repo) && (
+                  <MenuItem
+                    icon={<History size={14} />}
+                    label={t('admin.plugins.changeVersion')}
+                    onClick={props.onChangeVersion}
+                  />
+                )}
+                {p.source_repo && p.source_repo !== 'local:upload' && p.source_repo !== 'local:link' && (
+                  <>
+                    <a
+                      href={`https://github.com/${p.source_repo}`}
+                      target="_blank"
+                      rel="noreferrer"
+                      onClick={() => setMenu(null)}
+                      className={`${MENU_ITEM} text-content-secondary`}
+                      style={fs(12.5, 'body')}
+                    >
+                      <span className="flex w-4 flex-none justify-center text-content-muted">
+                        <Github size={14} />
+                      </span>{' '}
+                      {t('admin.plugins.sourceRepo')}
+                    </a>
+                    <a
+                      href={`https://github.com/${p.source_repo}/issues`}
+                      target="_blank"
+                      rel="noreferrer"
+                      onClick={() => setMenu(null)}
+                      className={`${MENU_ITEM} text-content-secondary`}
+                      style={fs(12.5, 'body')}
+                    >
+                      <span className="flex w-4 flex-none justify-center text-content-muted">
+                        <CircleDot size={14} />
+                      </span>{' '}
+                      {t('admin.plugins.reportIssue')}
+                    </a>
+                  </>
+                )}
+                <div className="mx-1.5 my-1 h-px bg-edge-faint" />
+                <MenuItem icon={<Trash2 size={14} />} label={t('common.delete')} danger onClick={props.onUninstall} />
+              </div>,
+              document.body
+            )}
+        </div>
+      </div>
+    </div>
+  );
+}

client/src/components/Admin/plugins/PluginSecurityDialog.tsx

@@ -0,0 +1,72 @@
+import { ShieldCheck } from 'lucide-react';
+import {
+  DialogButton,
+  DialogFooter,
+  DialogHeader,
+  DialogShell,
+  DialogTile,
+  FooterSpacer,
+  NEUTRAL_TINT,
+  fs,
+} from '../../shared/DialogShell';
+import type { T } from './pluginModel';
+
+/**
+ * How plugins are contained and where that ends, opened from the shield in the panel's
+ * header. It used to sit under the list as a card of its own, which pushed a wall of
+ * text into the page every admin scrolls past.
+ */
+export default function PluginSecurityDialog({ t, onClose }: { t: T; onClose: () => void }) {
+  const sections: Array<[string, string]> = [
+    [t('admin.plugins.security.isolationTitle'), t('admin.plugins.security.isolationBody')],
+    [t('admin.plugins.security.permsTitle'), t('admin.plugins.security.permsBody')],
+    [t('admin.plugins.security.limitsTitle'), t('admin.plugins.security.limitsBody')],
+    [t('admin.plugins.security.worstTitle'), t('admin.plugins.security.worstBody')],
+    [t('admin.plugins.security.reviewedTitle'), t('admin.plugins.security.reviewedBody')],
+    [t('admin.plugins.security.signedTitle'), t('admin.plugins.security.signedBody')],
+    [t('admin.plugins.security.trustTitle'), t('admin.plugins.security.trustBody')],
+  ];
+  return (
+    <DialogShell
+      onClose={onClose}
+      labelledBy="plugin-security-title"
+      width="detail"
+      header={
+        <DialogHeader
+          tile={
+            <DialogTile>
+              <ShieldCheck size={20} className="text-content-secondary" />
+            </DialogTile>
+          }
+          tint={NEUTRAL_TINT}
+          labelId="plugin-security-title"
+          title={t('admin.plugins.security.short')}
+          sub={t('admin.plugins.reviewedMeaning')}
+          subWraps
+          onClose={onClose}
+        />
+      }
+      footer={
+        <DialogFooter>
+          <FooterSpacer />
+          <DialogButton variant="primary" onClick={onClose}>
+            {t('common.ok')}
+          </DialogButton>
+        </DialogFooter>
+      }
+    >
+      <div className="grid gap-2.5 sm:grid-cols-2">
+        {sections.map(([h, b]) => (
+          <div key={h} className="rounded-[12px] border border-edge-faint bg-surface-card px-3.5 py-3">
+            <h4 className="m-0 font-semibold text-content" style={fs(12.5, 'body')}>
+              {h}
+            </h4>
+            <p className="m-0 mt-1 leading-relaxed text-content-muted" style={fs(12, 'body')}>
+              {b}
+            </p>
+          </div>
+        ))}
+      </div>
+    </DialogShell>
+  );
+}

client/src/components/Admin/plugins/pluginMenu.ts

@@ -0,0 +1,41 @@
+import { useEffect, useState, type CSSProperties } from 'react';
+
+/** The tallest a row's ⋯ menu gets; below that it opens upwards instead. */
+const ROW_MENU_MAX_H = 260;
+
+/**
+ * Where a portaled menu sits: right-aligned under its trigger, or above it when the
+ * window has no room below. Fixed, because the cards around the toolbar and the rows
+ * clip whatever overflows them.
+ */
+export function anchorMenu(trigger: HTMLElement | null): CSSProperties {
+  const r = trigger?.getBoundingClientRect();
+  if (!r) return { position: 'fixed', top: 0, right: 0, zIndex: 100 };
+  const spaceBelow = window.innerHeight - r.bottom;
+  const openUp = spaceBelow < ROW_MENU_MAX_H && r.top > spaceBelow;
+  return {
+    position: 'fixed',
+    right: Math.max(8, window.innerWidth - r.right),
+    ...(openUp ? { bottom: window.innerHeight - r.top + 4 } : { top: r.bottom + 4 }),
+    zIndex: 100,
+  };
+}
+
+/** One entry of a popover menu, in the packing popovers' shape. */
+export const MENU_ITEM =
+  'flex w-full items-center gap-2.5 rounded-[9px] px-2.5 py-2 font-medium transition-colors hover:bg-surface-tertiary';
+
+/** Re-renders while the page moves under an open, portaled menu, so it stays pinned to its trigger. */
+export function useFollowTrigger(open: boolean) {
+  const [, reanchor] = useState(0);
+  useEffect(() => {
+    if (!open) return;
+    const onMove = () => reanchor((n) => n + 1);
+    window.addEventListener('scroll', onMove, true);
+    window.addEventListener('resize', onMove);
+    return () => {
+      window.removeEventListener('scroll', onMove, true);
+      window.removeEventListener('resize', onMove);
+    };
+  }, [open]);
+}

client/src/components/Admin/plugins/pluginModel.test.ts

@@ -111,8 +111,14 @@ describe('pluginModel', () => {
       blocked: false,
       version: '0.9.0',
     });
-    expect(installOffer(incompatible, t)).toMatchObject({ blocked: true, label: 'admin.plugins.incompatible' });
-    expect(installOffer(incompatible, t, true)).toMatchObject({ blocked: false, label: 'admin.plugins.installAnyway' });
+    // Nothing fits this TREK: still an Install, behind the admin's own warning for this plugin.
+    expect(installOffer(incompatible, t)).toMatchObject({
+      blocked: false,
+      label: 'admin.plugins.install',
+      warn: { acceptedByAdmin: true, trekRange: '>=9', hostVersion: '4.0.0' },
+    });
+    // TREK_PLUGINS_IGNORE_TREK_RANGE lets every plugin through, so the warning is not the admin's own choice.
+    expect(installOffer(incompatible, t, true)).toMatchObject({ blocked: false, warn: { acceptedByAdmin: false } });
   });
 
   it('FE-ADMIN-PLUGIN-MODEL-008: deriveDeps marks the blockers among the declared dependencies', () => {

client/src/components/Admin/plugins/pluginModel.ts

@@ -298,7 +298,8 @@ export function installOffer(
       title,
     };
   }
-  return { blocked: true, label: t('admin.plugins.incompatible'), title };
+  // No version fits this TREK: the admin may still install this one plugin at their own risk.
+  return bypassOffer(item, t, title, true);
 }
 
 /**

client/src/components/Admin/plugins/usePluginsAdmin.test.ts

@@ -1,4 +1,4 @@
-// FE-ADMIN-PLUGINS-HOOK-001 to -012: the plugin admin logic behind both admin shells.
+// FE-ADMIN-PLUGINS-HOOK-001 to -014: the plugin admin logic behind both admin shells.
 import { act, renderHook, waitFor } from '@testing-library/react';
 import type { DragEvent } from 'react';
 
@@ -266,4 +266,36 @@ describe('usePluginsAdmin', () => {
     expect(toast.success).toHaveBeenCalledWith('admin.plugins.uninstalled');
     expect(result.current.confirmUninstall).toBeNull();
   });
+
+  it('FE-ADMIN-PLUGINS-HOOK-013: switching on a plugin outside its TREK range asks first, then runs it anyway', async () => {
+    serve([
+      row({ enabled: 0, dependencyStatus: 'hostIncompatible', trekRange: '>=3.2.0 <4.0.0', hostVersion: '5.0.0' }),
+    ]);
+    vi.spyOn(adminApi, 'pluginActivate').mockResolvedValue({});
+    const { result } = await mounted();
+    act(() => result.current.toggle(result.current.plugins[0] as PluginRow));
+    expect(adminApi.pluginActivate).not.toHaveBeenCalled();
+    expect(result.current.bypass.warning).toMatchObject({
+      acceptedByAdmin: true,
+      action: 'activate',
+      trekRange: '>=3.2.0 <4.0.0',
+    });
+    await act(async () => {
+      result.current.bypass.confirm();
+    });
+    await waitFor(() => expect(adminApi.pluginActivate).toHaveBeenCalledWith('alpha', false, true));
+  });
+
+  it('FE-ADMIN-PLUGINS-HOOK-014: installing behind the admin warning sends their consent for this plugin', async () => {
+    serve([], [entry({ id: 'beta', name: 'Beta' })]);
+    vi.spyOn(adminApi, 'pluginInstall').mockResolvedValue({ id: 'beta', version: '1.0.0', trekRangeBypassed: null });
+    const { result } = await mounted();
+    const warn = { name: 'Beta', trekRange: '<5.0.0', hostVersion: '5.0.0', acceptedByAdmin: true, onConfirm: null };
+    act(() => result.current.install('beta', undefined, warn));
+    expect(adminApi.pluginInstall).not.toHaveBeenCalled();
+    await act(async () => {
+      result.current.bypass.confirm();
+    });
+    await waitFor(() => expect(adminApi.pluginInstall).toHaveBeenCalledWith('beta', { acceptTrekRange: true }));
+  });
 });

client/src/components/Admin/plugins/usePluginsAdmin.ts

@@ -317,9 +317,14 @@ export function usePluginsAdmin() {
       act(
         id,
         () =>
-          adminApi.pluginInstall(id, version ? { version } : undefined).then((r) => {
-            if (!warn) bypass.notice(id, r?.trekRangeBypassed);
-          }),
+          adminApi
+            .pluginInstall(id, {
+              ...(version ? { version } : {}),
+              ...(warn?.acceptedByAdmin ? { acceptTrekRange: true } : {}),
+            })
+            .then((r) => {
+              if (!warn) bypass.notice(id, r?.trekRangeBypassed);
+            }),
         t('admin.plugins.installed')
       )
     );
@@ -392,10 +397,10 @@ export function usePluginsAdmin() {
     }
   };
 
-  const attemptActivate = (p: PluginRow) => {
+  const attemptActivate = (p: PluginRow, acceptTrekRange = false) => {
     const cascaded = autoEnabledDeps(p);
     return adminApi
-      .pluginActivate(p.id)
+      .pluginActivate(p.id, false, acceptTrekRange)
       .then(() => {
         toast.success(t('admin.plugins.activated'));
         if (cascaded.length)
@@ -415,12 +420,29 @@ export function usePluginsAdmin() {
       void act(p.id, () => adminApi.pluginDeactivate(p.id), t('admin.plugins.deactivated'));
       return;
     }
-    setBusy(p.id);
-    setMenu(null);
-    attemptActivate(p).finally(() => {
-      setBusy(null);
-      refresh();
-    });
+    const run = (acceptTrekRange: boolean) => {
+      setBusy(p.id);
+      setMenu(null);
+      attemptActivate(p, acceptTrekRange).finally(() => {
+        setBusy(null);
+        refresh();
+      });
+    };
+    // Outside the TREK versions its author declared: the admin may run it anyway, after
+    // reading what that risks. The choice holds for this version of the plugin only.
+    if (p.dependencyStatus === 'hostIncompatible') {
+      const warn: RangeWarning = {
+        name: p.name,
+        trekRange: p.trekRange ?? null,
+        hostVersion: p.hostVersion ?? '?',
+        acceptedByAdmin: true,
+        onConfirm: null,
+        action: 'activate',
+      };
+      bypass.guard(warn, () => run(true));
+      return;
+    }
+    run(false);
   };
 
   // Download a missing/outdated plugin dependency (latest compatible for its range,

client/src/components/Admin/useRangeBypass.test.ts

@@ -16,15 +16,23 @@ describe('rangeBypass helpers', () => {
       blocked: false, warn: true, label: 'admin.plugins.dep.trekBypassed:{"range":">=3.2.0 <4.0.0","host":"4.0.0"}',
     })
     expect(bypassChip({ trekRange: null, hostVersion: '4.0.0' }, t)).toMatchObject({ label: 'admin.plugins.dep.trekBypassedUnknown' })
+    // An admin's own "run it anyway" for this one plugin says so, not "version checks off".
+    expect(bypassChip({ trekRange: '>=3.2.0 <4.0.0', hostVersion: '5.0.0', acceptedByAdmin: true }, t)).toMatchObject({
+      warn: true, label: 'admin.plugins.dep.trekAccepted:{"range":">=3.2.0 <4.0.0","host":"5.0.0"}',
+    })
+    expect(bypassChip({ trekRange: null, hostVersion: '5.0.0', acceptedByAdmin: true }, t)).toMatchObject({
+      label: 'admin.plugins.dep.trekAcceptedUnknown',
+    })
   })
 
-  it('bypassOffer: an enabled "Install anyway" carrying what the dialog must say', () => {
+  it('bypassOffer: an enabled Install that carries what the dialog must say first', () => {
     const offer = bypassOffer({ name: 'Gotify', trek: '>=4.0.0', hostVersion: '3.3.0' }, t, 'why')
     expect(offer).toEqual({
-      blocked: false, label: 'admin.plugins.installAnyway', title: 'why',
-      warn: { name: 'Gotify', trekRange: '>=4.0.0', hostVersion: '3.3.0', onConfirm: null },
+      blocked: false, label: 'admin.plugins.install', title: 'why',
+      warn: { name: 'Gotify', trekRange: '>=4.0.0', hostVersion: '3.3.0', acceptedByAdmin: false, onConfirm: null },
     })
     expect(bypassOffer({ name: 'X' }, t, 'why').warn).toMatchObject({ trekRange: null, hostVersion: '?' })
+    expect(bypassOffer({ name: 'X' }, t, 'why', true).warn).toMatchObject({ acceptedByAdmin: true })
   })
 
   it('rangeWarningCopy: confirm vs notice title, ranged vs rangeless body', () => {
@@ -32,10 +40,25 @@ describe('rangeBypass helpers', () => {
     expect(rangeWarningCopy({ ...ranged, onConfirm: () => {} }, t)).toEqual({
       confirm: true, title: 'admin.plugins.rangeBypass.title',
       body: 'admin.plugins.rangeBypass.body:{"name":"G","range":">=4.0.0","host":"3.3.0"}',
+      confirmLabel: 'admin.plugins.installAnyway',
     })
     expect(rangeWarningCopy({ name: 'G', trekRange: null, hostVersion: '3.3.0', onConfirm: null }, t)).toEqual({
       confirm: false, title: 'admin.plugins.rangeBypass.noticeTitle',
-      body: 'admin.plugins.rangeBypass.bodyUnknown:{"name":"G","host":"3.3.0"}',
+      body: 'admin.plugins.rangeBypass.bodyUnknown:{"name":"G","range":null,"host":"3.3.0"}',
+      confirmLabel: 'admin.plugins.installAnyway',
+    })
+  })
+
+  it('rangeWarningCopy: an admin choosing for one plugin gets the short title, their own body and the right button', () => {
+    const mine = { name: 'G', trekRange: '>=4.0.0', hostVersion: '5.0.0', acceptedByAdmin: true, onConfirm: () => {} }
+    expect(rangeWarningCopy(mine, t)).toEqual({
+      confirm: true, title: 'admin.plugins.rangeBypass.titleAdmin',
+      body: 'admin.plugins.rangeBypass.bodyAdmin:{"name":"G","range":">=4.0.0","host":"5.0.0"}',
+      confirmLabel: 'admin.plugins.installAnyway',
+    })
+    expect(rangeWarningCopy({ ...mine, trekRange: null, action: 'activate' }, t)).toMatchObject({
+      body: 'admin.plugins.rangeBypass.bodyAdminUnknown:{"name":"G","range":null,"host":"5.0.0"}',
+      confirmLabel: 'admin.plugins.activateAnyway',
     })
   })
 })

client/src/components/Admin/useRangeBypass.ts

@@ -4,10 +4,21 @@ import { useTranslation } from '../../i18n'
 
 type T = (k: string, p?: Record<string, unknown>) => string
 
-/** The server's "this only went through because TREK_PLUGINS_IGNORE_TREK_RANGE is set" marker. */
-export interface TrekRangeBypass { trekRange: string | null; hostVersion: string }
-/** What the range-bypass warning needs to say, and what to do if the admin accepts (null = a notice). */
-export interface RangeWarning extends TrekRangeBypass { name: string; onConfirm: (() => void) | null }
+/**
+ * The server's "this only went through because the version check was set aside" marker:
+ * by an admin for this one plugin (`acceptedByAdmin`), or for every plugin through
+ * TREK_PLUGINS_IGNORE_TREK_RANGE.
+ */
+export interface TrekRangeBypass { trekRange: string | null; hostVersion: string; acceptedByAdmin?: boolean }
+/**
+ * What the range-bypass warning needs to say, and what to do if the admin accepts (null = a
+ * notice). `action` names what the confirm button does: install (the default) or activate.
+ */
+export interface RangeWarning extends TrekRangeBypass {
+  name: string
+  onConfirm: (() => void) | null
+  action?: 'install' | 'activate'
+}
 
 /**
  * The chip a row carries while it runs outside its declared range on the operator's
@@ -16,29 +27,42 @@ export interface RangeWarning extends TrekRangeBypass { name: string; onConfirm:
  */
 export function bypassChip(b: TrekRangeBypass | null | undefined, t: T) {
   if (!b) return null
+  const label = b.acceptedByAdmin
+    ? b.trekRange
+      ? t('admin.plugins.dep.trekAccepted', { range: b.trekRange, host: b.hostVersion })
+      : t('admin.plugins.dep.trekAcceptedUnknown')
+    : b.trekRange
+      ? t('admin.plugins.dep.trekBypassed', { range: b.trekRange, host: b.hostVersion })
+      : t('admin.plugins.dep.trekBypassedUnknown')
   return {
     icon: AlertTriangle,
-    label: b.trekRange
-      ? t('admin.plugins.dep.trekBypassed', { range: b.trekRange, host: b.hostVersion })
-      : t('admin.plugins.dep.trekBypassedUnknown'),
+    label,
     blocked: false,
     warn: true,
   }
 }
 
 /**
- * The Install button for a registry entry the server flagged incompatible, once the
- * operator set TREK_PLUGINS_IGNORE_TREK_RANGE: the server will take the newest version
- * regardless, so the button says exactly that — and carries what the warning has to say
- * first. `title` is the shell's existing "why" line (needs TREK X — this server runs Y).
+ * The Install button for a registry entry the server flagged incompatible: the server will
+ * take the newest version regardless, so the button says exactly that — and carries what
+ * the warning has to say first. `byAdmin` is the admin's own "install anyway" for this one
+ * plugin; without it the operator set TREK_PLUGINS_IGNORE_TREK_RANGE for every plugin.
+ * `title` is the shell's existing "why" line (needs TREK X — this server runs Y).
  */
-export function bypassOffer(item: { name: string; trek?: string | null; hostVersion?: string }, t: T, title: string) {
-  return {
-    blocked: false,
-    label: t('admin.plugins.installAnyway'),
-    title,
-    warn: { name: item.name, trekRange: item.trek ?? null, hostVersion: item.hostVersion ?? '?', onConfirm: null } as RangeWarning,
+export function bypassOffer(
+  item: { name: string; trek?: string | null; hostVersion?: string },
+  t: T,
+  title: string,
+  byAdmin = false
+) {
+  const warn: RangeWarning = {
+    name: item.name,
+    trekRange: item.trek ?? null,
+    hostVersion: item.hostVersion ?? '?',
+    acceptedByAdmin: byAdmin,
+    onConfirm: null,
   }
+  return { blocked: false, label: t('admin.plugins.install'), title, warn }
 }
 
 /**
@@ -48,14 +72,29 @@ export function bypassOffer(item: { name: string; trek?: string | null; hostVers
  * whole point: the admin is accepting that the author never vouched for this TREK and
  * that, in rare cases, that can cost them data.
  */
-export function rangeWarningCopy(w: RangeWarning, t: T): { title: string; body: string; confirm: boolean } {
+export function rangeWarningCopy(
+  w: RangeWarning,
+  t: T
+): { title: string; body: string; confirm: boolean; confirmLabel: string } {
   const confirm = w.onConfirm !== null
+  const vars = { name: w.name, range: w.trekRange, host: w.hostVersion }
+  const body = w.acceptedByAdmin
+    ? w.trekRange
+      ? t('admin.plugins.rangeBypass.bodyAdmin', vars)
+      : t('admin.plugins.rangeBypass.bodyAdminUnknown', vars)
+    : w.trekRange
+      ? t('admin.plugins.rangeBypass.body', vars)
+      : t('admin.plugins.rangeBypass.bodyUnknown', vars)
+  const title = w.acceptedByAdmin
+    ? t('admin.plugins.rangeBypass.titleAdmin')
+    : confirm
+      ? t('admin.plugins.rangeBypass.title')
+      : t('admin.plugins.rangeBypass.noticeTitle')
   return {
     confirm,
-    title: confirm ? t('admin.plugins.rangeBypass.title') : t('admin.plugins.rangeBypass.noticeTitle'),
-    body: w.trekRange
-      ? t('admin.plugins.rangeBypass.body', { name: w.name, range: w.trekRange, host: w.hostVersion })
-      : t('admin.plugins.rangeBypass.bodyUnknown', { name: w.name, host: w.hostVersion }),
+    title,
+    body,
+    confirmLabel: w.action === 'activate' ? t('admin.plugins.activateAnyway') : t('admin.plugins.installAnyway'),
   }
 }
 

client/src/components/Assistant/assistantParts.ts

@@ -440,6 +440,8 @@ export const CHANGE_LABELS: Record<AssistantChangeLabelKey, { labelKey: string }
   currency: { labelKey: 'assistant.change.label.currency' },
   stopType: { labelKey: 'assistant.change.label.stopType' },
   text: { labelKey: 'assistant.change.label.text' },
+  title: { labelKey: 'assistant.change.label.title' },
+  content: { labelKey: 'assistant.change.label.content' },
   icon: { labelKey: 'assistant.change.label.icon' },
   color: { labelKey: 'assistant.change.label.color' },
   position: { labelKey: 'assistant.change.label.position' },

client/src/components/Files/docsync/DocSyncBinding.test.tsx

@@ -1,4 +1,4 @@
-// FE-DOCSYNC-BIND-001 to FE-DOCSYNC-BIND-030
+// FE-DOCSYNC-BIND-001 to FE-DOCSYNC-BIND-032
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import en from '@trek/shared/i18n/en'
 import { render, screen, fireEvent, waitFor, within } from '../../../../tests/helpers/render'
@@ -66,6 +66,7 @@ function renderCard(
     canManage?: boolean
     providerName?: string
     onReconnect?: () => void
+    onEditConnection?: () => void
   } = {},
 ) {
   const utils = render(
@@ -75,6 +76,7 @@ function renderCard(
       sync={makeSync(opts.sync)}
       canManage={opts.canManage ?? true}
       onReconnect={opts.onReconnect}
+      onEditConnection={opts.onEditConnection}
     />,
   )
   const header = utils.container.querySelector('header') as HTMLElement
@@ -421,3 +423,31 @@ describe('DocSyncBinding: the direction lanes', () => {
     expect(updateLink).not.toHaveBeenCalled()
   })
 })
+
+describe('DocSyncBinding: the connection behind it', () => {
+  const S = en as unknown as Record<string, string>
+  const editButton = () => screen.queryByRole('button', { name: S['docsync.connection.edit'] })
+
+  it('FE-DOCSYNC-BIND-031: the settings open the stored connection at any time, not only after a refusal', () => {
+    const onEditConnection = vi.fn()
+    renderCard({ link: { lastSyncState: 'ok' }, onEditConnection })
+
+    expect(editButton()).not.toBeInTheDocument()
+    openSettings()
+    expect(screen.getByText(S['docsync.connection.title'])).toBeInTheDocument()
+    fireEvent.click(editButton() as HTMLElement)
+
+    expect(onEditConnection).toHaveBeenCalledTimes(1)
+  })
+
+  it('FE-DOCSYNC-BIND-032: a member, or a panel without the form, gets no way to the connection', () => {
+    const member = renderCard({ canManage: false, onEditConnection: vi.fn() })
+    expect(screen.queryByRole('button', { name: 'Settings' })).not.toBeInTheDocument()
+    expect(editButton()).not.toBeInTheDocument()
+    member.unmount()
+
+    renderCard()
+    openSettings()
+    expect(editButton()).not.toBeInTheDocument()
+  })
+})

client/src/components/Files/docsync/DocSyncBinding.tsx

@@ -1,6 +1,6 @@
 import { useState } from 'react'
 import {
-  AlertTriangle, Check, ChevronDown, Clock, Copy, FolderOpen, Link2Off, RefreshCw,
+  AlertTriangle, Check, ChevronDown, Clock, Copy, FolderOpen, KeyRound, Link2Off, RefreshCw,
 } from 'lucide-react'
 import ConfirmDialog from '../../shared/ConfirmDialog'
 import CustomSelect from '../../shared/CustomSelect'
@@ -27,6 +27,7 @@ export default function DocSyncBinding({
   sync,
   canManage,
   onReconnect,
+  onEditConnection,
 }: {
   link: DocSyncLink
   providerName: string
@@ -38,6 +39,8 @@ export default function DocSyncBinding({
    * not carry; left out, a refused credential is reported but not curable.
    */
   onReconnect?: () => void
+  /** The same form at any time, to change the address or the login, or to remove the connection. */
+  onEditConnection?: () => void
 }) {
   const { t } = useTranslation()
   const [open, setOpen] = useState(false)
@@ -237,6 +240,21 @@ export default function DocSyncBinding({
                   </div>
                 </div>
               )}
+
+              {onEditConnection && (
+                <Row label={t('docsync.connection.title')} hint={t('docsync.connection.hint')}>
+                  <span className="flex justify-end">
+                    <button
+                      type="button"
+                      onClick={onEditConnection}
+                      className="flex items-center gap-1.5 rounded-lg border border-edge bg-surface px-2.5 py-1.5 text-caption font-medium text-content-secondary transition-colors hover:bg-surface-hover"
+                    >
+                      <KeyRound size={13} />
+                      {t('docsync.connection.edit')}
+                    </button>
+                  </span>
+                </Row>
+              )}
             </div>
           )}
         </>

client/src/components/Files/docsync/DocSyncConnectModal.test.tsx

@@ -1,4 +1,4 @@
-// FE-DOCSYNC-CONNECT-001 to FE-DOCSYNC-CONNECT-027
+// FE-DOCSYNC-CONNECT-001 to FE-DOCSYNC-CONNECT-030
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import en from '@trek/shared/i18n/en'
 import { render, screen, fireEvent, waitFor, act, within } from '../../../../tests/helpers/render'
@@ -13,6 +13,7 @@ const listLinks = vi.fn(async (_tripId: number | string): Promise<unknown> => []
 const status = vi.fn(async (_tripId: number | string): Promise<unknown> => ({ items: {}, links: [] }))
 const saveConnection = vi.fn(async (_tripId: number | string, _data: unknown): Promise<unknown> => ({ id: 1 }))
 const testConnection = vi.fn(async (_tripId: number | string, _data: unknown): Promise<unknown> => ({ connected: true }))
+const deleteConnection = vi.fn(async (_tripId: number | string, _id: number): Promise<unknown> => ({ success: true }))
 
 vi.mock('../../../api/client', async (importOriginal) => {
   const actual = await importOriginal<typeof import('../../../api/client')>()
@@ -26,6 +27,7 @@ vi.mock('../../../api/client', async (importOriginal) => {
       listLinks: (tripId: number | string) => listLinks(tripId),
       saveConnection: (tripId: number | string, data: unknown) => saveConnection(tripId, data),
       testConnection: (tripId: number | string, data: unknown) => testConnection(tripId, data),
+      deleteConnection: (tripId: number | string, id: number) => deleteConnection(tripId, id),
     },
   }
 })
@@ -81,11 +83,13 @@ function Harness({
   provider,
   onClose,
   onConnected,
+  onRemoved,
   waitForConnection,
 }: {
   provider: DocSyncProvider
   onClose: () => void
   onConnected: (providerId: string) => void
+  onRemoved?: () => void
   /**
    * Hold the dialog back until the stored connection is in hand, the way the
    * panel does: it only offers "connect" once it knows what is already there.
@@ -94,7 +98,9 @@ function Harness({
 }) {
   const sync = useDocSync(TRIP_ID, true)
   if (waitForConnection && !sync.connectionFor(provider.id)) return null
-  return <DocSyncConnectModal provider={provider} sync={sync} onClose={onClose} onConnected={onConnected} />
+  return (
+    <DocSyncConnectModal provider={provider} sync={sync} onClose={onClose} onConnected={onConnected} onRemoved={onRemoved} />
+  )
 }
 
 /** Let the hook's initial load land before anything is asserted. */
@@ -492,3 +498,52 @@ describe('DocSyncConnectModal with a connection already stored', () => {
     expect(saveConnection).toHaveBeenCalledWith(TRIP_ID, expect.objectContaining({ baseUrl: 'https://cloud.example.com' }))
   })
 })
+
+describe('DocSyncConnectModal removal', () => {
+  const removeButton = () => screen.queryByRole('button', { name: tx('docsync.connection.remove') })
+  // The confirmation is portalled after the dialog, so its button is the last one of that name.
+  const confirmRemoval = () => {
+    const named = screen.getAllByRole('button', { name: tx('docsync.connection.remove') })
+    return named[named.length - 1]
+  }
+
+  async function openWithRemoval(stored: boolean) {
+    if (stored) listConnections.mockResolvedValue([connection()])
+    const onRemoved = vi.fn()
+    render(<Harness provider={nextcloud} onClose={vi.fn()} onConnected={vi.fn()} onRemoved={onRemoved} waitForConnection={stored} />)
+    await flush()
+    return onRemoved
+  }
+
+  it('FE-DOCSYNC-CONNECT-028: a stored connection can be removed after a confirmation, and the dialog is told', async () => {
+    const onRemoved = await openWithRemoval(true)
+    await waitFor(() => expect(removeButton()).toBeInTheDocument())
+
+    fireEvent.click(screen.getByRole('button', { name: tx('docsync.connection.remove') }))
+    expect(deleteConnection).not.toHaveBeenCalled()
+    await screen.findByText(tx('docsync.connection.confirmRemove'))
+    fireEvent.click(confirmRemoval())
+
+    await waitFor(() => expect(deleteConnection).toHaveBeenCalledWith(TRIP_ID, 9))
+    await waitFor(() => expect(onRemoved).toHaveBeenCalled())
+  })
+
+  it('FE-DOCSYNC-CONNECT-029: a refused removal keeps the dialog and says why', async () => {
+    deleteConnection.mockRejectedValueOnce({ response: { status: 403, data: { error: 'forbidden' } } })
+    const onRemoved = await openWithRemoval(true)
+    await waitFor(() => expect(removeButton()).toBeInTheDocument())
+
+    fireEvent.click(screen.getByRole('button', { name: tx('docsync.connection.remove') }))
+    await screen.findByText(tx('docsync.connection.confirmRemove'))
+    fireEvent.click(confirmRemoval())
+
+    await waitFor(() => expect(deleteConnection).toHaveBeenCalled())
+    expect(onRemoved).not.toHaveBeenCalled()
+    expect(await screen.findByText(tx('docsync.error.forbidden'))).toBeInTheDocument()
+  })
+
+  it('FE-DOCSYNC-CONNECT-030: a first connection has nothing to remove', async () => {
+    await openWithRemoval(false)
+    expect(removeButton()).not.toBeInTheDocument()
+  })
+})

client/src/components/Files/docsync/DocSyncConnectModal.tsx

@@ -1,6 +1,7 @@
 import { useId, useState } from 'react'
 import { AlertTriangle, Check, Loader2, Plug, ShieldAlert } from 'lucide-react'
-import { DialogButton, DialogFooter, DialogHeader, DialogShell, DialogTile, FooterSpacer, NEUTRAL_TINT } from '../../shared/DialogShell'
+import { DeleteButton, DialogButton, DialogFooter, DialogHeader, DialogShell, DialogTile, FooterSpacer, NEUTRAL_TINT } from '../../shared/DialogShell'
+import ConfirmDialog from '../../shared/ConfirmDialog'
 import { Tooltip } from '../../shared/Tooltip'
 import ToggleSwitch from '../../Settings/ToggleSwitch'
 import { useTranslation } from '../../../i18n/TranslationContext'
@@ -22,11 +23,14 @@ export default function DocSyncConnectModal({
   sync,
   onClose,
   onConnected,
+  onRemoved,
 }: {
   provider: DocSyncProvider
   sync: ReturnType<typeof useDocSync>
   onClose: () => void
   onConnected: (providerId: string) => void
+  /** After the stored connection was removed from here; left out, the form offers no removal. */
+  onRemoved?: () => void
 }) {
   const { t } = useTranslation()
   const existing = sync.connectionFor(provider.id)
@@ -34,6 +38,11 @@ export default function DocSyncConnectModal({
 
   const form = useConnectForm(provider, existing, sync)
   const [verdict, setVerdict] = useState<DocSyncVerdict | null>(null)
+  const [confirmRemove, setConfirmRemove] = useState(false)
+
+  const remove = async () => {
+    if (existing && (await sync.removeConnection(existing.id))) onRemoved?.()
+  }
 
   const test = async () => setVerdict(await form.probe())
   const labelId = useId()
@@ -46,6 +55,7 @@ export default function DocSyncConnectModal({
     <DialogShell
       onClose={onClose}
       labelledBy={labelId}
+      blocked={confirmRemove}
       header={(
         <DialogHeader
           tile={<DialogTile>{Icon ? <Icon className="h-5 w-5 text-content" /> : <Plug size={20} strokeWidth={1.9} className="text-content-muted" />}</DialogTile>}
@@ -57,6 +67,13 @@ export default function DocSyncConnectModal({
       )}
       footer={(
         <DialogFooter>
+          {existing && onRemoved && (
+            <DeleteButton
+              label={t('docsync.connection.remove')}
+              onClick={() => setConfirmRemove(true)}
+              disabled={sync.busy === 'connection'}
+            />
+          )}
           <Verdict verdict={verdict} busy={sync.busy === 'test'} failure={sync.error} />
           <FooterSpacer />
           <DialogButton onClick={() => void test()} disabled={!form.complete || sync.busy === 'test'}>
@@ -101,6 +118,15 @@ export default function DocSyncConnectModal({
           </span>
         </label>
       </div>
+
+      <ConfirmDialog
+        isOpen={confirmRemove}
+        onClose={() => setConfirmRemove(false)}
+        onConfirm={() => void remove()}
+        title={t('docsync.connection.remove')}
+        message={t('docsync.connection.confirmRemove')}
+        confirmLabel={t('docsync.connection.remove')}
+      />
     </DialogShell>
   )
 }

client/src/components/Files/docsync/DocSyncPanel.tsx

@@ -62,6 +62,9 @@ export default function DocSyncPanel({
     setSelected(prev => (sync.links.some(l => l.id === prev) ? prev : (sync.links[0]?.id ?? null)))
   }, [sync.links])
 
+  // The connection behind the folder picker, which the picker can send back to.
+  const scopeProvider = scopeFor ? sync.providers.find(p => p.id === scopeFor) : undefined
+
   const attention = ATTENTION_STATES.reduce((n, k) => n + (sync.itemCounts[k] ?? 0), 0)
   const labelId = useId()
 
@@ -113,6 +116,7 @@ export default function DocSyncPanel({
                     sync={sync}
                     canManage={canManage}
                     onReconnect={activeProvider ? () => setReconnecting(activeProvider) : undefined}
+                    onEditConnection={canManage && activeProvider ? () => setReconnecting(activeProvider) : undefined}
                   />
                   {/* Every action in this column reports here: a refused run, a
                       switch that flipped back, a conflict the server would not
@@ -141,6 +145,7 @@ export default function DocSyncPanel({
           sync={sync}
           onClose={() => setConnecting(null)}
           onConnected={id => { setConnecting(null); setScopeFor(id) }}
+          onRemoved={() => setConnecting(null)}
         />
       )}
 
@@ -149,6 +154,7 @@ export default function DocSyncPanel({
           provider={reconnecting}
           sync={sync}
           onClose={() => setReconnecting(null)}
+          onRemoved={() => setReconnecting(null)}
           onConnected={id => {
             setReconnecting(null)
             // Run straight away, as binding does: the card still reports the
@@ -168,6 +174,7 @@ export default function DocSyncPanel({
           sync={sync}
           onClose={() => setScopeFor(null)}
           onBound={() => setScopeFor(null)}
+          onEditConnection={scopeProvider ? () => { setScopeFor(null); setConnecting(scopeProvider) } : undefined}
         />
       )}
     </>

client/src/components/Files/docsync/DocSyncScopeModal.test.tsx

@@ -1,4 +1,4 @@
-// FE-DOCSYNC-SCOPE-001 to FE-DOCSYNC-SCOPE-023
+// FE-DOCSYNC-SCOPE-001 to FE-DOCSYNC-SCOPE-024
 
 /**
  * The folder picker of the document-sync dialog.
@@ -84,9 +84,10 @@ function deferred<T>() {
   return { promise, resolve, reject }
 }
 
-function Harness({ suggestedName = 'trek-paris-42', providerName = 'Paperless' }: {
+function Harness({ suggestedName = 'trek-paris-42', providerName = 'Paperless', onEditConnection }: {
   suggestedName?: string
   providerName?: string
+  onEditConnection?: () => void
 }) {
   const sync = useDocSync(TRIP_ID, false)
   return (
@@ -97,6 +98,7 @@ function Harness({ suggestedName = 'trek-paris-42', providerName = 'Paperless' }
       sync={sync}
       onClose={onClose}
       onBound={onBound}
+      onEditConnection={onEditConnection}
     />
   )
 }
@@ -381,3 +383,20 @@ describe('DocSyncScopeModal errors', () => {
     expect(createButton()).toBeEnabled()
   })
 })
+
+describe('DocSyncScopeModal connection', () => {
+  it('FE-DOCSYNC-SCOPE-024: leads back to the stored connection before a folder is chosen', async () => {
+    const editButton = () => screen.queryByRole('button', { name: S['docsync.connection.edit'] })
+    const onEditConnection = vi.fn()
+    const first = render(<Harness onEditConnection={onEditConnection} />)
+    await waitFor(() => expect(listScopes).toHaveBeenCalled())
+
+    fireEvent.click(editButton() as HTMLElement)
+    expect(onEditConnection).toHaveBeenCalledTimes(1)
+    expect(createLink).not.toHaveBeenCalled()
+    first.unmount()
+
+    render(<Harness />)
+    expect(editButton()).not.toBeInTheDocument()
+  })
+})

client/src/components/Files/docsync/DocSyncScopeModal.tsx

@@ -1,5 +1,5 @@
 import { useId, useMemo, useState } from 'react'
-import { FolderPlus, Loader2, Search } from 'lucide-react'
+import { FolderPlus, KeyRound, Loader2, Search } from 'lucide-react'
 import { DialogHeader, DialogShell, DialogTile, NEUTRAL_TINT } from '../../shared/DialogShell'
 import { useTranslation } from '../../../i18n/TranslationContext'
 import type { DocSyncConnection, useDocSync } from './useDocSync'
@@ -22,6 +22,7 @@ export default function DocSyncScopeModal({
   sync,
   onClose,
   onBound,
+  onEditConnection,
 }: {
   connection: DocSyncConnection
   providerName: string
@@ -30,6 +31,8 @@ export default function DocSyncScopeModal({
   sync: ReturnType<typeof useDocSync>
   onClose: () => void
   onBound: () => void
+  /** Back to the stored connection, to change the login or remove it before choosing a folder. */
+  onEditConnection?: () => void
 }) {
   const { t } = useTranslation()
   const labelId = useId()
@@ -63,7 +66,19 @@ export default function DocSyncScopeModal({
       )}
     >
       <div className="space-y-4">
-        <p className="text-caption text-content-muted">{t('docsync.scope.intro')}</p>
+        <div className="flex items-start justify-between gap-3">
+          <p className="text-caption text-content-muted">{t('docsync.scope.intro')}</p>
+          {onEditConnection && (
+            <button
+              type="button"
+              onClick={onEditConnection}
+              className="flex shrink-0 items-center gap-1.5 rounded-lg border border-edge px-2.5 py-1 text-caption font-medium text-content-secondary transition-colors hover:bg-surface-hover"
+            >
+              <KeyRound size={13} />
+              {t('docsync.connection.edit')}
+            </button>
+          )}
+        </div>
 
         <div className="rounded-xl border border-edge bg-surface-secondary p-3">
           <span className="mb-2 block text-body font-medium text-content">{t('docsync.scope.createTitle')}</span>

client/src/components/Files/docsync/useDocSync.test.ts

@@ -1,4 +1,4 @@
-// FE-DOCSYNC-HOOK-001 to FE-DOCSYNC-HOOK-030
+// FE-DOCSYNC-HOOK-001 to FE-DOCSYNC-HOOK-032
 
 /**
  * The document-sync hook.
@@ -22,6 +22,7 @@ const testConnectionApi = vi.fn(async (_tripId: number | string, _data: unknown)
 const updateLinkApi = vi.fn(async (_tripId: number | string, _linkId: number, _patch: unknown): Promise<unknown> => ({}))
 const syncNowApi = vi.fn(async (_tripId: number | string, _linkId: number, _full: boolean): Promise<unknown> => ({}))
 const listScopesApi = vi.fn(async (_tripId: number | string, _connectionId: number, _q?: string): Promise<unknown> => ({ scopes: [] }))
+const deleteConnectionApi = vi.fn(async (_tripId: number | string, _id: number): Promise<unknown> => ({ success: true }))
 const resolveApi = vi.fn(async (_tripId: number | string, _itemId: number, _keep: string): Promise<unknown> => ({ success: true }))
 
 vi.mock('../../../api/client', async (importOriginal) => {
@@ -40,6 +41,7 @@ vi.mock('../../../api/client', async (importOriginal) => {
       syncNow: (tripId: number | string, linkId: number, full: boolean) => syncNowApi(tripId, linkId, full),
       listScopes: (tripId: number | string, connectionId: number, q?: string) => listScopesApi(tripId, connectionId, q),
       resolve: (tripId: number | string, itemId: number, keep: string) => resolveApi(tripId, itemId, keep),
+      deleteConnection: (tripId: number | string, id: number) => deleteConnectionApi(tripId, id),
     },
   }
 })
@@ -126,6 +128,7 @@ beforeEach(() => {
   syncNowApi.mockResolvedValue({ state: 'ok', pulled: 0, pushed: 0, conflicts: 0, missing: 0 })
   listScopesApi.mockResolvedValue({ scopes: [] })
   resolveApi.mockResolvedValue({ success: true })
+  deleteConnectionApi.mockResolvedValue({ success: true })
 })
 
 describe('useDocSync initial load', () => {
@@ -471,6 +474,38 @@ describe('useDocSync resolveConflict', () => {
   })
 })
 
+describe('useDocSync removeConnection', () => {
+  it('FE-DOCSYNC-HOOK-031: forgets the connection and reloads, so its bindings leave the screen too', async () => {
+    const { result } = await mountLoaded()
+    expect(result.current.links).toHaveLength(1)
+    // The server drops the bindings with the connection (ON DELETE CASCADE).
+    listConnectionsApi.mockResolvedValue([])
+    listLinksApi.mockResolvedValue([])
+
+    let ok: boolean | undefined
+    await act(async () => { ok = await result.current.removeConnection(9) })
+
+    expect(ok).toBe(true)
+    expect(deleteConnectionApi).toHaveBeenCalledWith(TRIP, 9)
+    expect(result.current.connectionFor('nextcloud')).toBeNull()
+    expect(result.current.links).toEqual([])
+    expect(result.current.busy).toBeNull()
+  })
+
+  it('FE-DOCSYNC-HOOK-032: a refused removal keeps everything and says why', async () => {
+    deleteConnectionApi.mockRejectedValueOnce({ response: { status: 403, data: { error: 'forbidden' } } })
+    const { result } = await mountLoaded()
+
+    let ok: boolean | undefined
+    await act(async () => { ok = await result.current.removeConnection(9) })
+
+    expect(ok).toBe(false)
+    expect(result.current.error).toBe('forbidden')
+    expect(result.current.connectionFor('nextcloud')).not.toBeNull()
+    expect(result.current.busy).toBeNull()
+  })
+})
+
 describe('needsReauth', () => {
   it('FE-DOCSYNC-HOOK-030: reads a refused credential off either the state or the error code', () => {
     expect(needsReauth({ lastSyncState: 'needs_reauth', lastSyncError: null })).toBe(true)

client/src/components/Files/docsync/useDocSync.ts

@@ -264,6 +264,27 @@ export function useDocSync(tripId: number | string, enabled: boolean) {
     }
   }, [tripId, load])
 
+  /**
+   * Forget a stored connection, and with it every binding of this trip that
+   * runs through it. The documents stay on both sides; what goes is the
+   * address and the login TREK kept for the store, which is the one thing a
+   * person changing accounts or folders had no way to take back.
+   */
+  const removeConnection = useCallback(async (connectionId: number) => {
+    setBusy('connection')
+    setError(null)
+    try {
+      await docsyncApi.deleteConnection(tripId, connectionId)
+      await load()
+      return true
+    } catch (e: unknown) {
+      setError(readError(e))
+      return false
+    } finally {
+      setBusy(null)
+    }
+  }, [tripId, load])
+
   /**
    * Probe without saving. Always resolves to a verdict object: the route
    * answers 200 even for an unreachable instance, because a form showing a typo
@@ -427,7 +448,7 @@ export function useDocSync(tripId: number | string, enabled: boolean) {
     connections, links, itemCounts,
     loading, busy, error,
     connectionFor, load,
-    saveConnection, testConnection,
+    saveConnection, testConnection, removeConnection,
     loadScopes, createScope,
     createLink, updateLink, removeLink, syncNow, resolveConflict,
   }

client/src/components/Help/HelpPanel.tsx

@@ -102,16 +102,20 @@ export default function HelpPanel(): React.ReactElement | null {
           <HelpNav context={context} currentId={contextId} activeGuideId={!searching && guide ? guide.id : null} />
 
           <div className="relative flex flex-col min-h-0 bg-surface" role="main">
-            <button
-              type="button"
-              onClick={closeHelp}
-              aria-label={t('help.center.close')}
-              className="absolute top-4 end-4 z-10 w-9 h-9 rounded-full flex items-center justify-center text-content-muted bg-surface-card border border-edge shadow-card hover:text-content hover:bg-surface-hover transition-colors"
-            >
-              <X className="w-4 h-4" />
-            </button>
+            {/* The close button sits in a row of its own above the scrolling content rather
+                than floating over it, so no card ever runs up against it. */}
+            <div className="flex shrink-0 justify-end px-4 pt-4">
+              <button
+                type="button"
+                onClick={closeHelp}
+                aria-label={t('help.center.close')}
+                className="w-9 h-9 rounded-full flex items-center justify-center text-content-muted bg-surface-card border border-edge shadow-card hover:text-content hover:bg-surface-hover transition-colors"
+              >
+                <X className="w-4 h-4" />
+              </button>
+            </div>
             <div ref={scrollRef} className="trek-help-scroll flex-1 min-h-0 overflow-y-auto overscroll-contain">
-              <div className="max-w-[1080px] mx-auto px-6 sm:px-10 py-8">
+              <div className="max-w-[1080px] mx-auto px-6 sm:px-10 pt-4 pb-8">
                 {searching ? (
                   <HelpSearchResults key="search" />
                 ) : guide ? (

client/src/components/Journey/JourneyDetailPageDatePicker.test.tsx

@@ -1,4 +1,4 @@
-// FE-COMP-JOURNEYDATEPICKER-001 to FE-COMP-JOURNEYDATEPICKER-007
+// FE-COMP-JOURNEYDATEPICKER-001 to FE-COMP-JOURNEYDATEPICKER-008
 import React from 'react'
 import { describe, it, expect, vi } from 'vitest'
 import { render, screen } from '../../../tests/helpers/render'
@@ -119,3 +119,28 @@ describe('DatePicker week start (#2029)', () => {
     }
   })
 })
+
+describe('DatePicker inside a clipping dialog (#2858)', () => {
+  it('FE-COMP-JOURNEYDATEPICKER-008: the calendar floats over the page, stays inside the viewport and closes on a click away', async () => {
+    const user = userEvent.setup()
+    const { container } = render(
+      <div style={{ overflow: 'hidden' }}>
+        <DatePicker value="2026-03-15" onChange={vi.fn()} />
+      </div>,
+    )
+    const trigger = screen.getByText(/Mar 15, 2026/).closest('button') as HTMLButtonElement
+    // A trigger at the right edge, where the end date of a range sits.
+    trigger.getBoundingClientRect = () => ({ top: 100, bottom: 136, left: window.innerWidth - 120, right: window.innerWidth - 8, width: 112, height: 36, x: 0, y: 0, toJSON: () => ({}) })
+    await user.click(trigger)
+
+    const day31 = screen.getByRole('button', { name: '31' })
+    // Rendered outside the dialog that would clip it.
+    expect(container.contains(day31)).toBe(false)
+    const panel = day31.closest('.fixed') as HTMLElement
+    expect(panel.style.top).toBe('140px')
+    expect(parseFloat(panel.style.left)).toBe(window.innerWidth - 280 - 8)
+
+    await user.click(document.querySelector('[role="presentation"]') as HTMLElement)
+    expect(screen.queryByRole('button', { name: '31' })).toBeNull()
+  })
+})

client/src/components/Journey/JourneyDetailPageDatePicker.tsx

@@ -1,9 +1,11 @@
-import { useState } from 'react'
+import { useRef, useState } from 'react'
+import { createPortal } from 'react-dom'
 import { localIsoDate } from '../../utils/localDate'
 import { ArrowLeft, ChevronRight, Calendar } from 'lucide-react'
 import { useTranslation } from '../../i18n'
 import { useWeekStartDay } from '../../hooks/useWeekStartDay'
 import { leadingBlanks, weekdayLabels } from '../../utils/calendarWeek'
+import { useAnchoredPosition } from '../../hooks/useAnchoredPosition'
 
 /**
  * The header steps up a level on each click, days → months → years, and a
@@ -14,6 +16,9 @@ import { leadingBlanks, weekdayLabels } from '../../utils/calendarWeek'
  */
 type CalendarView = 'days' | 'months' | 'years'
 const YEAR_PAGE_SIZE = 12
+/** The calendar's width; `w-[280px]` below. */
+const PANEL_WIDTH = 280
+const VIEWPORT_PAD = 8
 
 export function DatePicker({ value, onChange, tripDates }: {
   value: string
@@ -23,6 +28,13 @@ export function DatePicker({ value, onChange, tripDates }: {
   const { t, locale } = useTranslation()
   const weekStart = useWeekStartDay()
   const [open, setOpen] = useState(false)
+  const triggerRef = useRef<HTMLButtonElement>(null)
+  // The calendar used to hang absolutely under its trigger, inside dialogs that clip
+  // their content: the photo picker cut off the last week and, for the end date in
+  // the right-hand column, the last weekday (#2858). It now floats over the page,
+  // pinned to the trigger, flipped above it when below is too short and kept inside
+  // the viewport sideways.
+  const anchored = useAnchoredPosition(triggerRef, open, { estimatedHeight: 340, matchWidth: false })
   const [view, setView] = useState<CalendarView>('days')
   const [yearPageStart, setYearPageStart] = useState(0)
   const [viewMonth, setViewMonth] = useState(() => {
@@ -107,6 +119,7 @@ export function DatePicker({ value, onChange, tripDates }: {
   return (
     <div className="relative">
       <button
+        ref={triggerRef}
         type="button"
         onClick={toggleOpen}
         className="w-full px-3 py-2 border border-zinc-200 dark:border-zinc-700 rounded-lg text-[13px] bg-white dark:bg-zinc-800 text-zinc-900 dark:text-white text-start flex items-center justify-between"
@@ -122,12 +135,20 @@ export function DatePicker({ value, onChange, tripDates }: {
         <Calendar size={13} className="text-zinc-400" />
       </button>
 
-      {open && (
+      {open && anchored && createPortal(
         <>
           {/* Click-away catcher — no semantics of its own; the trigger button
               above closes the popover again from the keyboard. */}
-          <div role="presentation" className="fixed inset-0 z-[10]" onClick={() => setOpen(false)} />
-          <div className="absolute top-full start-0 mt-1 z-[20] bg-white dark:bg-zinc-800 border border-zinc-200 dark:border-zinc-700 rounded-xl shadow-lg p-3 w-[280px]">
+          <div role="presentation" className="fixed inset-0 z-[var(--z-toast)]" onClick={() => setOpen(false)} />
+          <div
+            className="fixed z-[var(--z-toast)] overflow-y-auto bg-white dark:bg-zinc-800 border border-zinc-200 dark:border-zinc-700 rounded-xl shadow-lg p-3 w-[280px]"
+            style={{
+              top: anchored.top,
+              bottom: anchored.bottom,
+              left: Math.max(VIEWPORT_PAD, Math.min(anchored.left, window.innerWidth - PANEL_WIDTH - VIEWPORT_PAD)),
+              maxHeight: anchored.maxHeight,
+            }}
+          >
             {/* Header: arrows step the current view, the label climbs to the next one up */}
             <div className="flex items-center justify-between mb-2">
               <button type="button" onClick={handlePrev} aria-label={prevLabel} className={navButton}>
@@ -200,7 +221,7 @@ export function DatePicker({ value, onChange, tripDates }: {
                       >
                         {day}
                         {isTrip && !isSelected && (
-                          <span className="absolute bottom-1 left-1/2 -translate-x-1/2 w-1 h-1 rounded-full bg-indigo-500" />
+                          <span className="absolute bottom-1 inset-x-0 mx-auto w-1 h-1 rounded-full bg-indigo-500" />
                         )}
                       </button>
                     )
@@ -209,7 +230,8 @@ export function DatePicker({ value, onChange, tripDates }: {
               </>
             )}
           </div>
-        </>
+        </>,
+        document.body,
       )}
     </div>
   )

client/src/components/Journey/JourneyDetailPageProviderPicker.test.tsx

@@ -375,11 +375,12 @@ describe('ProviderPicker', () => {
     await user.click(screen.getByRole('button', { name: 'Search' }))
     expect(ranges).toHaveLength(0)
 
+    // The calendar opens in a portal, so its days are looked up on the page, not under the trigger.
     const [fromPicker, toPicker] = Array.from(baseElement.querySelectorAll('.flex-1 > .relative')) as HTMLElement[]
     await user.click(within(fromPicker).getByRole('button'))
-    await user.click(within(fromPicker).getByRole('button', { name: '3' }))
+    await user.click(screen.getByRole('button', { name: '3' }))
     await user.click(within(toPicker).getByRole('button'))
-    await user.click(within(toPicker).getByRole('button', { name: '9' }))
+    await user.click(screen.getByRole('button', { name: '9' }))
     await user.click(screen.getByRole('button', { name: 'Search' }))
 
     await waitFor(() => expect(ranges).toHaveLength(1))

client/src/components/Map/MapViewGL.tsx

@@ -50,16 +50,10 @@ import { pluginsApi, type PluginMapMarker, type PluginMapLayer } from '../../api
 import { DEFAULT_MAP_CENTER, DEFAULT_MAP_ZOOM } from '../../constants/mapDefaults'
 import { alongShortestArc, computeMapViewport, TILE_SIZE_GL } from '../../utils/mapViewport'
 import { selectedPlaceTarget } from './selectedPlaceTarget'
-import { PLACE_CLUSTER_CIRCLE_LAYER_ID, PLACE_CLUSTER_COUNT_LAYER_ID } from './placeClusterLayers'
-
-// Marker grouping for the GL map (#1385): MapLibre/Mapbox can't show the rich
-// HTML photo markers *and* cluster them natively, so we feed the place points
-// into a clustered GeoJSON source. The cluster bubbles render as GL circles +
-// a count label; the individual rich HTML markers are then only drawn for the
-// points the source reports as currently unclustered. Grouping is always on,
-// matching the Leaflet map's MarkerClusterGroup.
-const PLACE_CLUSTER_SOURCE_ID = 'trip-place-clusters'
-const PLACE_UNCLUSTERED_LAYER_ID = 'trip-place-unclustered-hit'
+import {
+  PLACE_CLUSTER_CIRCLE_LAYER_ID, PLACE_CLUSTER_COUNT_LAYER_ID, PLACE_CLUSTER_SOURCE_ID,
+  addPlaceClusterLayers, drawClusterBubbles, expandCluster,
+} from './placeClusterLayers'
 
 type PlaceWithCoords = Place & { lat: number; lng: number }
 
@@ -112,72 +106,6 @@ interface Props extends MapViewProps {
   gl: any
 }
 
-/**
- * How eagerly place markers merge into a cluster.
- *
- * The overview band the Leaflet map clusters in as well (`CLUSTER_UNTIL_ZOOM` there),
- * kept as plain numbers rather than shared constants so the GL bundle does not have to
- * carry Leaflet for them. Above the cutoff supercluster hands every point back on its
- * own, and the stops that share a coordinate are folded together at the pin level
- * instead — see the reconcile below.
- */
-const CLUSTER_RADIUS = 20
-const CLUSTER_MAX_ZOOM = 8
-
-/** The cluster source and the three layers over it. Extracted so the rebuild on a mode
- *  change and the initial build cannot drift apart. */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function addPlaceClusterLayers(map: any): void {
-      map.addSource(PLACE_CLUSTER_SOURCE_ID, {
-        type: 'geojson',
-        data: { type: 'FeatureCollection', features: [] },
-        cluster: true,
-        clusterRadius: CLUSTER_RADIUS,
-        clusterMaxZoom: CLUSTER_MAX_ZOOM,
-      })
-      map.addLayer({
-        id: PLACE_CLUSTER_CIRCLE_LAYER_ID,
-        type: 'circle',
-        source: PLACE_CLUSTER_SOURCE_ID,
-        filter: ['has', 'point_count'],
-        paint: {
-          'circle-color': '#111827',
-          'circle-opacity': 0.97,
-          'circle-radius': ['step', ['get', 'point_count'], 18, 10, 21, 50, 24],
-          'circle-stroke-width': 2.5,
-          'circle-stroke-color': 'rgba(255,255,255,0.9)',
-        },
-      })
-      map.addLayer({
-        id: PLACE_CLUSTER_COUNT_LAYER_ID,
-        type: 'symbol',
-        source: PLACE_CLUSTER_SOURCE_ID,
-        filter: ['has', 'point_count'],
-        layout: {
-          'text-field': ['get', 'point_count_abbreviated'],
-          'text-size': 12,
-          'text-allow-overlap': true,
-        },
-        paint: {
-          'text-color': '#ffffff',
-          'text-halo-color': 'rgba(17,24,39,0.35)',
-          'text-halo-width': 1,
-        },
-      })
-      map.addLayer({
-        id: PLACE_UNCLUSTERED_LAYER_ID,
-        type: 'circle',
-        source: PLACE_CLUSTER_SOURCE_ID,
-        filter: ['!', ['has', 'point_count']],
-        paint: {
-          'circle-radius': 24,
-          'circle-opacity': 0,
-          'circle-stroke-opacity': 0,
-        },
-      })
-}
-
-
 function createMarkerElement(place: Place & PlaceMarkerFlags & { category_color?: string; category_icon?: string }, photoUrl: string | null, orderNumbers: number[] | null, selected: boolean): HTMLDivElement {
   // A stop that interrupts the drive gets its own small disc, decided before the photo
   // branch: the brand logo a fuel search comes back with is exactly what this replaces.
@@ -612,6 +540,8 @@ export function MapViewGL({
   useDawarichTrailGL(mapRef.current, mapReady, dawarichTrack, dawarichSelectedDate, 'trip-route-casing', dawarichHiddenDates)
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const markersRef = useRef<Map<number, PlacePin>>(new Map())
+  /** The count bubbles, one per cluster the source currently reports. */
+  const clusterPinsRef = useRef<PlacePin[]>([])
   // Own layer for the hand-positioned place pins (MapLibre path, see makePlacePin).
   const pinLayerRef = useRef<HTMLDivElement | null>(null)
   const locationMarkerRef = useRef<LocationMarkerHandle | null>(null)
@@ -642,6 +572,7 @@ export function MapViewGL({
   // in the same frame the canvas draws, or the ones left out swim against the ones in.
   const repositionPins = useCallback(() => {
     markersRef.current.forEach(pin => pin.reposition())
+    clusterPinsRef.current.forEach(pin => pin.reposition())
     poiMarkersRef.current.forEach(pin => pin.reposition())
     pluginMarkersRef.current.forEach(pin => pin.reposition())
     routeViaMarkersRef.current.forEach(pin => pin.reposition())
@@ -1304,21 +1235,7 @@ export function MapViewGL({
             ? map.queryRenderedFeatures(e.point, { layers: [PLACE_CLUSTER_CIRCLE_LAYER_ID, PLACE_CLUSTER_COUNT_LAYER_ID] })
             : []
           const feature = features?.[0]
-          const clusterId = feature?.properties?.cluster_id
-          const coordinates = feature?.geometry?.coordinates
-          if (clusterId == null || !Array.isArray(coordinates)) return
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          const source = map.getSource(PLACE_CLUSTER_SOURCE_ID) as any
-          const easeToZoom = (nextZoom: number) => {
-            try { map.easeTo({ center: coordinates, zoom: nextZoom, duration: 350 }) } catch { /* noop */ }
-          }
-          try {
-            const maybeZoom = source?.getClusterExpansionZoom?.(clusterId, (err: Error | null, nextZoom: number) => {
-              if (!err && typeof nextZoom === 'number') easeToZoom(nextZoom)
-            })
-            if (typeof maybeZoom === 'number') easeToZoom(maybeZoom)
-            else if (maybeZoom && typeof maybeZoom.then === 'function') maybeZoom.then(easeToZoom).catch(() => {})
-          } catch { /* noop */ }
+          expandCluster(map, feature?.properties?.cluster_id, feature?.geometry?.coordinates)
         }
         const setClusterCursor = () => {
           const canvas = typeof map.getCanvas === 'function' ? map.getCanvas() : null
@@ -1704,8 +1621,17 @@ export function MapViewGL({
     source.setData(buildPlaceClusterData(places) as any)
     const placesById = new Map<number, PlaceWithCoords>(validPlaces.map(place => [place.id, place]))
     let raf: number | null = null
+    const dropClusterPins = () => {
+      clusterPinsRef.current.forEach(pin => pin.remove())
+      clusterPinsRef.current = []
+    }
+    const reconcileClusterPins = () => {
+      dropClusterPins()
+      clusterPinsRef.current = drawClusterBubbles(map, (el, lng, lat) => attachPin(map, gl, pinLayerRef.current, el, lng, lat))
+    }
     const runReconcile = () => {
       raf = null
+      reconcileClusterPins()
       const features = map.querySourceFeatures(PLACE_CLUSTER_SOURCE_ID, { filter: ['!', ['has', 'point_count']] }) || []
       const seen = new Set<number>()
       const visiblePlaces: PlaceWithCoords[] = []
@@ -1752,6 +1678,7 @@ export function MapViewGL({
 
     return () => {
       if (raf !== null) cancelAnimationFrame(raf)
+      dropClusterPins()
       map.off('moveend', scheduleReconcile)
       map.off('zoomend', scheduleReconcile)
       map.off('idle', scheduleReconcile)

client/src/components/Map/markerCluster.ts

@@ -1,5 +1,6 @@
 import L from 'leaflet'
 import { STACK_RADIUS_PX } from './coincidentPlaces'
+import { clusterBubbleSize } from './placeClusterLayers'
 
 /** Up to here the map is an overview, where stops merge to keep the world readable. */
 export const CLUSTER_UNTIL_ZOOM = 9
@@ -66,7 +67,7 @@ export interface ClusterLike {
 /** A count bubble sized by its count, styled by `.marker-cluster-custom` in index.css. */
 export function createClusterIcon(cluster: ClusterLike) {
   const count = cluster.getChildCount()
-  const size = count < 10 ? 36 : count < 50 ? 42 : 48
+  const size = clusterBubbleSize(count)
   return L.divIcon({
     html: `<div class="marker-cluster-custom" style="width:${size}px;height:${size}px;"><span>${count}</span></div>`,
     className: 'marker-cluster-wrapper',

client/src/components/Map/placeClusterLayers.test.ts

@@ -0,0 +1,86 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import {
+  type ClusterMap,
+  PLACE_CLUSTER_SOURCE_ID,
+  addPlaceClusterLayers,
+  clusterBubbleSize,
+  createClusterBubble,
+  drawClusterBubbles,
+} from './placeClusterLayers';
+
+function fakeMap(features: unknown[], expansionZoom: unknown = 11) {
+  const source = { getClusterExpansionZoom: vi.fn(() => expansionZoom) };
+  const map = {
+    addSource: vi.fn(),
+    addLayer: vi.fn(),
+    getSource: vi.fn((id: string) => (id === PLACE_CLUSTER_SOURCE_ID ? source : undefined)),
+    easeTo: vi.fn(),
+    querySourceFeatures: vi.fn((_id: string, query: { filter: unknown[] }) =>
+      query.filter[0] === 'has' ? features : []
+    ),
+  };
+  return { map: map as unknown as ClusterMap & typeof map, source };
+}
+
+describe('cluster bubbles', () => {
+  it('FE-COMP-PLACECLUSTER-001: a bubble grows in three steps with its count', () => {
+    expect([1, 9, 10, 49, 50, 500].map(clusterBubbleSize)).toEqual([36, 36, 42, 42, 48, 48]);
+  });
+
+  it('FE-COMP-PLACECLUSTER-002: the GL bubble is the Leaflet markup inside a bare wrapper the pin can move', () => {
+    const wrapper = createClusterBubble(38);
+    expect(wrapper.className).toBe('');
+    const bubble = wrapper.firstElementChild as HTMLElement;
+    expect(bubble.className).toBe('marker-cluster-custom');
+    expect(bubble.style.width).toBe('42px');
+    expect(bubble.style.height).toBe('42px');
+    expect(bubble.textContent).toBe('38');
+  });
+
+  it('FE-COMP-PLACECLUSTER-003: the canvas circle and count stay as an invisible hit area', () => {
+    const { map } = fakeMap([]);
+    addPlaceClusterLayers(map);
+    expect(map.addSource).toHaveBeenCalledWith(PLACE_CLUSTER_SOURCE_ID, expect.objectContaining({ cluster: true }));
+    const layers = map.addLayer.mock.calls.map(([layer]) => layer as { id: string; paint: Record<string, unknown> });
+    expect(layers.find((l) => l.id === 'trip-place-clusters-circle')?.paint['circle-opacity']).toBe(0);
+    expect(layers.find((l) => l.id === 'trip-place-clusters-count')?.paint['text-opacity']).toBe(0);
+  });
+
+  it('FE-COMP-PLACECLUSTER-004: one bubble per cluster, placed at its centre, that zooms in on a click', () => {
+    const cluster = { properties: { cluster_id: 5, point_count: 12 }, geometry: { coordinates: [139.7, 35.6] } };
+    const { map, source } = fakeMap([
+      cluster,
+      cluster, // the same cluster crossing a tile edge
+      { properties: { cluster_id: 6 }, geometry: { coordinates: [1, 1] } }, // no count
+      { properties: { cluster_id: 7, point_count: 3 } }, // no geometry
+    ]);
+    const placed: { el: HTMLElement; lng: number; lat: number }[] = [];
+    const pins = drawClusterBubbles(map, (el, lng, lat) => {
+      placed.push({ el, lng, lat });
+      return lng;
+    });
+
+    expect(pins).toEqual([139.7]);
+    expect(placed[0].el.textContent).toBe('12');
+    expect(placed[0].lat).toBe(35.6);
+
+    const onMapClick = vi.fn();
+    document.body.appendChild(placed[0].el);
+    document.body.addEventListener('click', onMapClick);
+    placed[0].el.dispatchEvent(new MouseEvent('click', { bubbles: true }));
+    document.body.removeEventListener('click', onMapClick);
+    placed[0].el.remove();
+
+    // The click is the bubble's: the map underneath never sees it.
+    expect(onMapClick).not.toHaveBeenCalled();
+    expect(source.getClusterExpansionZoom).toHaveBeenCalledWith(5, expect.any(Function));
+    expect(map.easeTo).toHaveBeenCalledWith({ center: [139.7, 35.6], zoom: 11, duration: 350 });
+  });
+
+  it('FE-COMP-PLACECLUSTER-005: a source that reports nothing draws nothing', () => {
+    const { map } = fakeMap([]);
+    map.querySourceFeatures.mockReturnValue(null as never);
+    expect(drawClusterBubbles(map, () => 1)).toEqual([]);
+  });
+});

client/src/components/Map/placeClusterLayers.ts

@@ -5,3 +5,169 @@
  */
 export const PLACE_CLUSTER_CIRCLE_LAYER_ID = 'trip-place-clusters-circle';
 export const PLACE_CLUSTER_COUNT_LAYER_ID = 'trip-place-clusters-count';
+
+// Marker grouping for the GL map (#1385): MapLibre/Mapbox can't show the rich
+// HTML photo markers *and* cluster them natively, so we feed the place points
+// into a clustered GeoJSON source. The source decides what is clustered; the
+// bubbles are drawn as DOM (`drawClusterBubbles`) and the individual rich HTML
+// markers only for the points the source reports as currently unclustered.
+// Grouping is always on, matching the Leaflet map's MarkerClusterGroup.
+export const PLACE_CLUSTER_SOURCE_ID = 'trip-place-clusters';
+const PLACE_UNCLUSTERED_LAYER_ID = 'trip-place-unclustered-hit';
+
+/**
+ * How eagerly place markers merge into a cluster.
+ *
+ * The overview band the Leaflet map clusters in as well (`CLUSTER_UNTIL_ZOOM` there),
+ * kept as plain numbers rather than shared constants so the GL bundle does not have to
+ * carry Leaflet for them. Above the cutoff supercluster hands every point back on its
+ * own, and the stops that share a coordinate are folded together at the pin level
+ * instead — see the reconcile in MapViewGL.
+ */
+const CLUSTER_RADIUS = 20;
+const CLUSTER_MAX_ZOOM = 8;
+
+/** The part of either SDK's map the cluster code calls. */
+export interface ClusterMap {
+  addSource: (id: string, source: object) => void;
+  addLayer: (layer: object) => void;
+  getSource: (id: string) => unknown;
+  easeTo: (options: { center: unknown[]; zoom: number; duration: number }) => void;
+  querySourceFeatures: (id: string, options: { filter: unknown[] }) => ClusterFeature[] | null | undefined;
+}
+
+interface ClusterFeature {
+  properties?: { cluster_id?: unknown; point_count?: unknown } | null;
+  geometry?: { coordinates?: unknown };
+}
+
+interface ClusterSource {
+  getClusterExpansionZoom?: (id: unknown, done: (err: Error | null, zoom: number) => void) => unknown;
+}
+
+/** The cluster source and the three layers over it. Extracted so the rebuild on a mode
+ *  change and the initial build cannot drift apart. */
+export function addPlaceClusterLayers(map: Pick<ClusterMap, 'addSource' | 'addLayer'>): void {
+  map.addSource(PLACE_CLUSTER_SOURCE_ID, {
+    type: 'geojson',
+    data: { type: 'FeatureCollection', features: [] },
+    cluster: true,
+    clusterRadius: CLUSTER_RADIUS,
+    clusterMaxZoom: CLUSTER_MAX_ZOOM,
+  });
+  // Invisible: the bubble the user sees is DOM (createClusterBubble), these two
+  // layers stay as the hit area the track and route layers check a click against.
+  map.addLayer({
+    id: PLACE_CLUSTER_CIRCLE_LAYER_ID,
+    type: 'circle',
+    source: PLACE_CLUSTER_SOURCE_ID,
+    filter: ['has', 'point_count'],
+    paint: {
+      'circle-opacity': 0,
+      'circle-stroke-opacity': 0,
+      'circle-radius': ['step', ['get', 'point_count'], 18, 10, 21, 50, 24],
+    },
+  });
+  map.addLayer({
+    id: PLACE_CLUSTER_COUNT_LAYER_ID,
+    type: 'symbol',
+    source: PLACE_CLUSTER_SOURCE_ID,
+    filter: ['has', 'point_count'],
+    layout: {
+      'text-field': ['get', 'point_count_abbreviated'],
+      'text-size': 12,
+      'text-allow-overlap': true,
+    },
+    paint: { 'text-opacity': 0 },
+  });
+  map.addLayer({
+    id: PLACE_UNCLUSTERED_LAYER_ID,
+    type: 'circle',
+    source: PLACE_CLUSTER_SOURCE_ID,
+    filter: ['!', ['has', 'point_count']],
+    paint: {
+      'circle-radius': 24,
+      'circle-opacity': 0,
+      'circle-stroke-opacity': 0,
+    },
+  });
+}
+
+/** Eases the map in to the zoom a cluster falls apart at. Both SDKs answer that
+ *  question, one through a callback and one through a promise. */
+export function expandCluster(
+  map: Pick<ClusterMap, 'getSource' | 'easeTo'>,
+  clusterId: unknown,
+  coordinates: unknown
+): void {
+  if (clusterId == null || !Array.isArray(coordinates)) return;
+  const source = map.getSource(PLACE_CLUSTER_SOURCE_ID) as ClusterSource | undefined;
+  const easeToZoom = (nextZoom: number) => {
+    try {
+      map.easeTo({ center: coordinates, zoom: nextZoom, duration: 350 });
+    } catch {
+      /* noop */
+    }
+  };
+  try {
+    const maybeZoom = source?.getClusterExpansionZoom?.(clusterId, (err, nextZoom) => {
+      if (!err && typeof nextZoom === 'number') easeToZoom(nextZoom);
+    });
+    if (typeof maybeZoom === 'number') easeToZoom(maybeZoom);
+    else if (maybeZoom instanceof Promise) maybeZoom.then(easeToZoom).catch(() => {});
+  } catch {
+    /* noop */
+  }
+}
+
+/**
+ * Puts one count bubble on the map per cluster the source currently reports, through
+ * `place` (the caller's pin factory), and returns what `place` handed back. A cluster
+ * crossing a tile edge comes back once per tile, so bubbles are keyed by cluster id.
+ */
+export function drawClusterBubbles<T>(map: ClusterMap, place: (el: HTMLElement, lng: number, lat: number) => T): T[] {
+  const pins: T[] = [];
+  const seen = new Set<unknown>();
+  for (const feature of map.querySourceFeatures(PLACE_CLUSTER_SOURCE_ID, { filter: ['has', 'point_count'] }) ?? []) {
+    const clusterId = feature?.properties?.cluster_id;
+    const count = feature?.properties?.point_count;
+    const coordinates = feature?.geometry?.coordinates;
+    if (typeof count !== 'number' || !Array.isArray(coordinates) || seen.has(clusterId)) continue;
+    seen.add(clusterId);
+    const el = createClusterBubble(count);
+    el.addEventListener('click', (ev) => {
+      ev.stopPropagation();
+      expandCluster(map, clusterId, coordinates);
+    });
+    pins.push(place(el, coordinates[0], coordinates[1]));
+  }
+  return pins;
+}
+
+/** A count bubble's diameter in pixels: both renderers size their bubbles by it. */
+export function clusterBubbleSize(count: number): number {
+  return count < 10 ? 36 : count < 50 ? 42 : 48;
+}
+
+/**
+ * A count bubble as DOM, styled by `.marker-cluster-custom` in index.css.
+ *
+ * The GL map draws its bubbles with this element rather than as canvas text, so they
+ * read in the app's own font and get the same hover the Leaflet map has. A canvas
+ * symbol layer can only use the glyphs the map style ships and knows no `:hover`.
+ * The bubble sits in a bare wrapper because the pin positions its element through
+ * `transform`, which would otherwise override the hover's scale.
+ */
+export function createClusterBubble(count: number): HTMLDivElement {
+  const size = clusterBubbleSize(count);
+  const bubble = document.createElement('div');
+  bubble.className = 'marker-cluster-custom';
+  bubble.style.width = `${size}px`;
+  bubble.style.height = `${size}px`;
+  const label = document.createElement('span');
+  label.textContent = String(count);
+  bubble.appendChild(label);
+  const wrapper = document.createElement('div');
+  wrapper.appendChild(bubble);
+  return wrapper;
+}

client/src/components/Packing/PackingListPanelCategoryGroup.test.tsx

@@ -485,6 +485,17 @@ describe('KategorieGruppe — inline add item', () => {
     expect(onAddItem).not.toHaveBeenCalled()
   })
 
+  it('FE-W5CAT-028a: Enter on the first item typed into the placeholder row opens the add field (#2825)', async () => {
+    server.use(http.put('/api/trips/1/packing/1', () => HttpResponse.json({ item: buildPackingItem({ id: 1, name: 'Tent', category: 'Gear' }) })))
+    setup({ items: [buildPackingItem({ id: 1, name: '...', category: 'Gear' })] })
+
+    fireEvent.click(screen.getByText('...'))
+    fireEvent.change(screen.getByPlaceholderText('...'), { target: { value: 'Tent' } })
+    fireEvent.keyDown(screen.getByPlaceholderText('...'), { key: 'Enter' })
+
+    await waitFor(() => expect(screen.getByPlaceholderText('Item name...')).toHaveFocus())
+  })
+
   it('FE-W5CAT-028: the confirm button adds the item, and stays inert while empty', () => {
     const onAddItem = vi.fn(async () => {})
     const { container } = setup({ onAddItem })

client/src/components/Packing/PackingListPanelCategoryGroup.tsx

@@ -86,6 +86,7 @@ export function KategorieGruppe({ kategorie, items, tripId, allCategories, onRen
   const [showAddItem, setShowAddItem] = useState(false)
   const [newItemName, setNewItemName] = useState('')
   const addItemRef = useRef<HTMLInputElement>(null)
+  const openAddItem = () => { setShowAddItem(true); setTimeout(() => addItemRef.current?.focus(), 30) }
   const menuBtnRef = useRef<HTMLButtonElement>(null)
   const assigneeDropdownRef = useRef<HTMLDivElement>(null)
   const { togglePackingItem } = useTripStore()
@@ -292,7 +293,7 @@ export function KategorieGruppe({ kategorie, items, tripId, allCategories, onRen
             const contributions = contribFor(item.id)
             return (
               <React.Fragment key={item.id}>
-                <ArtikelZeile item={item} tripId={tripId} categories={allCategories} onCategoryChange={() => {}} onDelete={onDeleteItem} bagTrackingEnabled={bagTrackingEnabled} bags={bags} onCreateBag={onCreateBag} canEdit={canEdit} divider={index > 0}
+                <ArtikelZeile item={item} tripId={tripId} categories={allCategories} onCategoryChange={() => {}} onDelete={onDeleteItem} onPlaceholderFilled={openAddItem} bagTrackingEnabled={bagTrackingEnabled} bags={bags} onCreateBag={onCreateBag} canEdit={canEdit} divider={index > 0}
                   tripMembers={tripMembers} currentUserId={currentUserId} onSetSharing={onSetSharing} onClone={onClone} onJoin={onJoin} onLeave={onLeave}
                   drag={canEdit && reorderable ? {
                     isDragging: dragId === item.id,
@@ -343,7 +344,7 @@ export function KategorieGruppe({ kategorie, items, tripId, allCategories, onRen
             // A row of its own on a faint tint, so it closes the card instead
             // of trailing off: a dashed box in the checkbox column (past the drag
             // grip's width) and the label where an item's name sits.
-            <button type="button" onClick={() => { setShowAddItem(true); setTimeout(() => addItemRef.current?.focus(), 30) }}
+            <button type="button" onClick={openAddItem}
               style={{ display: 'flex', alignItems: 'center', gap: 9, width: 'calc(100% - 8px)', margin: '6px 4px 0', paddingBlock: 8, paddingInlineEnd: 10, paddingInlineStart: 28, borderRadius: 10, border: 'none', background: 'var(--bg-secondary)', cursor: 'pointer', fontSize: 'calc(13px * var(--fs-scale-body, 1))', fontWeight: 500, color: 'var(--text-faint)', fontFamily: 'inherit', textAlign: 'start' }}
               onMouseEnter={e => e.currentTarget.style.color = 'var(--text-secondary)'}
               onMouseLeave={e => e.currentTarget.style.color = 'var(--text-faint)'}>

client/src/components/Packing/PackingListPanelItemRow.test.tsx

@@ -257,6 +257,23 @@ describe('ArtikelZeile — renaming', () => {
     await waitFor(() => expect(screen.getByText('...')).toBeInTheDocument())
   })
 
+  it('FE-W5ROW-008b: Enter on a filled placeholder row hands the typing on, a blur does not (#2825)', async () => {
+    server.use(http.put('/api/trips/1/packing/1', () => HttpResponse.json({ item: buildPackingItem({ id: 1, name: 'Tent' }) })))
+    const onPlaceholderFilled = vi.fn()
+    setup({ item: buildPackingItem({ id: 1, name: '...', category: 'Gear' }), onPlaceholderFilled })
+
+    fireEvent.click(screen.getByText('...'))
+    fireEvent.change(screen.getByPlaceholderText('...'), { target: { value: 'Tent' } })
+    fireEvent.blur(screen.getByPlaceholderText('...'))
+    await waitFor(() => expect(screen.queryByPlaceholderText('...')).toBeNull())
+    expect(onPlaceholderFilled).not.toHaveBeenCalled()
+
+    fireEvent.click(screen.getByText('...'))
+    fireEvent.change(screen.getByPlaceholderText('...'), { target: { value: 'Tent' } })
+    fireEvent.keyDown(screen.getByPlaceholderText('...'), { key: 'Enter' })
+    await waitFor(() => expect(onPlaceholderFilled).toHaveBeenCalledTimes(1))
+  })
+
   it('FE-W5ROW-009: a failing rename surfaces a save error', async () => {
     server.use(http.put('/api/trips/1/packing/1', () => new HttpResponse(null, { status: 500 })))
     setup()

client/src/components/Packing/PackingListPanelItemRow.tsx

@@ -25,6 +25,8 @@ interface ArtikelZeileProps {
   categories: string[]
   onCategoryChange: () => void
   onDelete?: (item: PackingItem) => Promise<void>
+  /** Enter on the filled '...' row, so the category's add field can take over the typing (#2825). */
+  onPlaceholderFilled?: () => void
   bagTrackingEnabled?: boolean
   bags?: PackingBag[]
   onCreateBag: (name: string) => Promise<PackingBag | undefined>
@@ -49,7 +51,7 @@ interface ArtikelZeileProps {
   }
 }
 
-export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCategoryChange, onDelete, bagTrackingEnabled, bags = [], onCreateBag, canEdit = true, tripMembers = [], currentUserId, onSetSharing, onClone, onJoin, onLeave, divider = false, drag }: ArtikelZeileProps) {
+export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCategoryChange, onDelete, onPlaceholderFilled, bagTrackingEnabled, bags = [], onCreateBag, canEdit = true, tripMembers = [], currentUserId, onSetSharing, onClone, onJoin, onLeave, divider = false, drag }: ArtikelZeileProps) {
   const isPlaceholder = item.name === PACKING_PLACEHOLDER_NAME
   const [editing, setEditing] = useState(false)
   const [editName, setEditName] = useState(isPlaceholder ? '' : item.name)
@@ -80,9 +82,12 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
 
   const handleToggle = () => togglePackingItem(tripId, item.id, !item.checked)
 
-  const handleSaveName = async () => {
+  const handleSaveName = async (viaEnter = false) => {
     if (!editName.trim()) { setEditing(false); setEditName(isPlaceholder ? '' : item.name); return }
-    try { await updatePackingItem(tripId, item.id, { name: editName.trim() }); setEditing(false) }
+    try {
+      await updatePackingItem(tripId, item.id, { name: editName.trim() }); setEditing(false)
+      if (viaEnter && isPlaceholder) onPlaceholderFilled?.()
+    }
     catch { toast.error(t('packing.toast.saveError')) }
   }
 
@@ -188,8 +193,8 @@ export function ArtikelZeile({ item, tripId, categories, onCategoryChange: _onCa
           type="text" value={editName} autoFocus
           placeholder={isPlaceholder ? '...' : undefined}
           onChange={e => setEditName(e.target.value)}
-          onBlur={handleSaveName}
-          onKeyDown={e => { if (e.key === 'Enter') void handleSaveName(); if (e.key === 'Escape') { setEditing(false); setEditName(isPlaceholder ? '' : item.name) } }}
+          onBlur={() => void handleSaveName()}
+          onKeyDown={e => { if (e.key === 'Enter') void handleSaveName(true); if (e.key === 'Escape') { setEditing(false); setEditName(isPlaceholder ? '' : item.name) } }}
           style={{ flex: 1, minWidth: 0, fontSize: 'calc(13.5px * var(--fs-scale-body, 1))', padding: '2px 8px', borderRadius: 6, border: '1px solid var(--border-primary)', outline: 'none', fontFamily: 'inherit' }}
         />
       ) : canEdit ? (

client/src/components/Planner/TransitSearchPanel.test.tsx

@@ -138,6 +138,34 @@ describe('TransitSearchPanel', () => {
     expect(payload.metadata.transit.legs[1]).toMatchObject({ mode: 'SUBWAY', line: 'U2', line_color: '#FF3300', headsign: 'Ruhleben' })
   })
 
+  it('FE-PLANNER-TRANSIT-003b: routes Google answered name Google Maps and are saved as Google’s (#2850)', async () => {
+    const user = userEvent.setup()
+    const onAdd = vi.fn().mockResolvedValue({})
+    transitApiMock.plan.mockResolvedValueOnce({ itineraries: [ITINERARY], provider: 'google' })
+    render(<TransitSearchPanel {...makeProps({ onAdd })} />)
+    await pickFromAndTo(user)
+    await user.click(screen.getByRole('button', { name: /^Search$/ }))
+    await user.click(await screen.findByText(/08:30 – 09:00/))
+
+    // Google's terms want the words as written, so the browser must not translate them.
+    expect(screen.getByText('Google Maps')).toHaveAttribute('translate', 'no')
+    expect(screen.queryByRole('link', { name: 'Transitous' })).not.toBeInTheDocument()
+
+    await user.click(await screen.findByRole('button', { name: 'Add to day' }))
+    await waitFor(() => expect(onAdd).toHaveBeenCalled())
+    expect(onAdd.mock.calls[0][0].metadata.transit.provider).toBe('google')
+  })
+
+  it('FE-PLANNER-TRANSIT-003c: routes Transitous answered credit Transitous with its sources link', async () => {
+    const user = userEvent.setup()
+    transitApiMock.plan.mockResolvedValueOnce({ itineraries: [ITINERARY], provider: 'transitous' })
+    render(<TransitSearchPanel {...makeProps()} />)
+    await pickFromAndTo(user)
+    await user.click(screen.getByRole('button', { name: /^Search$/ }))
+    expect(await screen.findByRole('link', { name: 'Transitous' })).toHaveAttribute('href', 'https://transitous.org/sources/')
+    expect(screen.queryByText('Google Maps')).not.toBeInTheDocument()
+  })
+
   it('FE-PLANNER-TRANSIT-004: search failure shows the empty state, not a crash', async () => {
     const user = userEvent.setup()
     transitApiMock.plan.mockRejectedValueOnce(new Error('boom'))

client/src/components/Planner/TransitSearchPanel.tsx

@@ -604,7 +604,7 @@ export default function TransitSearchPanel({ day, days, places, accommodations =
         notes: null,
         metadata: {
           transit: {
-            provider: 'transitous',
+            provider: provider ?? 'transitous',
             duration: it.duration,
             transfers: it.transfers,
             walk_seconds: it.walkSeconds,
@@ -760,7 +760,10 @@ export default function TransitSearchPanel({ day, days, places, accommodations =
             ))}
             <div className="text-content-faint" style={{ fontSize: 'calc(10.5px * var(--fs-scale-caption, 1))', textAlign: 'center', marginTop: 2 }}>
               {t('transit.attribution')}{' '}
-              <a href="https://transitous.org/sources/" target="_blank" rel="noopener noreferrer" style={{ color: 'inherit', textDecoration: 'underline' }}>Transitous</a>
+              {/* Named after the backend that answered; Google's terms want "Google Maps" as written, never translated. */}
+              {provider === 'google'
+                ? <span translate="no">Google Maps</span>
+                : <a href="https://transitous.org/sources/" target="_blank" rel="noopener noreferrer" style={{ color: 'inherit', textDecoration: 'underline' }}>Transitous</a>}
             </div>
           </div>
         )}

client/src/components/Roadtrip/useRoadtripRoutes.test.ts

@@ -803,6 +803,34 @@ describe('useRoadtripRoutes', () => {
       }
     })
 
+    it('FE-ROADTRIP-ROUTES-052: a join this device routed before is not paced like a request (#2794)', async () => {
+      // A join kept its request slot whatever answered it, so a month of connected days
+      // waited half a minute on every open with every road already on the device. The
+      // clock is held still, so every answer reads as one from the cache; a join that
+      // still waited its turn would wait 1.1 s of real time, past what waitFor gives it.
+      const clock = vi.spyOn(performance, 'now').mockImplementation(() => 10_000)
+      try {
+        const MUNICH: [number, number] = [48.1374, 11.5755]
+        const INNSBRUCK: [number, number] = [47.2692, 11.4041]
+        const BOZEN: [number, number] = [46.4983, 11.3548]
+        setting({ roadtrip_connect_days: true })
+        const daysList = [day(1, 1), day(2, 2), day(3, 3)]
+        const assignments = {
+          ...map(1, [{ id: 1, at: HAMBURG, time: '09:00' }, { id: 2, at: LUENEBURG }]),
+          ...map(2, [{ id: 3, at: BERLIN, time: '09:00' }, { id: 4, at: MUNICH }]),
+          ...map(3, [{ id: 5, at: INNSBRUCK, time: '09:00' }, { id: 6, at: BOZEN }]),
+        } as AssignmentsMap
+        renderHook(() => useRoadtripRoutes(7, daysList, assignments))
+
+        await waitFor(() => {
+          expect(askedFor(LUENEBURG, BERLIN)).toHaveLength(1)
+          expect(askedFor(MUNICH, INNSBRUCK)).toHaveLength(1)
+        })
+      } finally {
+        clock.mockRestore()
+      }
+    })
+
     it('FE-ROADTRIP-ROUTES-051: a join OSRM answered in the engine’s place is drawn, flagged, and asked for again on request', async () => {
       // Filed like any answer, it stood in for the weighed road until the page was loaded
       // again, and a picker on it read the stand-in line as the road already taken.

client/src/components/Roadtrip/useRoadtripRoutes.ts

@@ -692,11 +692,19 @@ export function useRoadtripRoutes(
    * for both, so a choice being checked cannot fire into the gap a seam is keeping.
    */
   const lastSpacedRequestAt = useRef(0)
-  /** Waits until the gap since the last such request is kept, then claims the next slot. */
-  const spacedRequest = useCallback(async (signal: AbortSignal): Promise<void> => {
+  /**
+   * Waits until the gap since the last such request is kept, then claims the next slot.
+   * Hands back what gives the slot up again, for a request the cache answered.
+   */
+  const spacedRequest = useCallback(async (signal: AbortSignal): Promise<() => void> => {
     const since = performance.now() - lastSpacedRequestAt.current
     if (since < REQUEST_SPACING_MS) await sleep(REQUEST_SPACING_MS - since, signal)
-    if (!signal.aborted) lastSpacedRequestAt.current = performance.now()
+    const before = lastSpacedRequestAt.current
+    const claimed = performance.now()
+    if (!signal.aborted) lastSpacedRequestAt.current = claimed
+    return () => {
+      if (lastSpacedRequestAt.current === claimed) lastSpacedRequestAt.current = before
+    }
   }, [])
 
   useEffect(() => {
@@ -727,7 +735,7 @@ export function useRoadtripRoutes(
         // shared routing hosts answered the tail with 429, and a refused seam
         // writes no state, so nothing changed to make the effect try again: the
         // map drew the trip in pieces and the totals came back short.
-        await spacedRequest(controller.signal)
+        const release = await spacedRequest(controller.signal)
         if (controller.signal.aborted) return
         try {
           // The via points on this seam, threaded in the same way the day runs thread
@@ -735,6 +743,7 @@ export function useRoadtripRoutes(
           // shape: it is asked for on its own, so the points the traveller dropped on it
           // never reached the router and dragging one did visibly nothing.
           const shaping = viasOnLeg(seam.from, seam.to, viasByDay[seam.from.ownerDayId] ?? [])
+          const startedAt = performance.now()
           const r = await calculateRouteWithLegs(
             [
               { lat: seam.from.lat, lng: seam.from.lng },
@@ -743,6 +752,10 @@ export function useRoadtripRoutes(
             ],
             { signal: controller.signal, profile: mode, tripId: tripId ?? null, dayId: seam.dayId, avoid },
           )
+          // A seam this device routed before came back from its cache and went nowhere, so
+          // its slot goes back before the store below re-runs this effect. Holding it made a
+          // trip of connected days wait a second per join on every open (#2794).
+          if (performance.now() - startedAt <= CACHE_HIT_MS) release()
           if (controller.signal.aborted) return
           // One leg per waypoint PAIR, so a shaped seam comes back in pieces and the rail
           // wants the whole drive: merged here, exactly as a day run folds its via legs

client/src/components/Settings/ai/aiConnectModel.test.ts

@@ -47,6 +47,14 @@ describe('aiConnectModel', () => {
     expect(connectErrorKey(new Error('boom'))).toBe('assistant.error.generic');
   });
 
+  it('FE-AI-CONNECT-MODEL-002b: tells an own server that answered without a model list from one that is down (#2808)', () => {
+    const noList = { response: { data: { code: 'provider_unavailable', reason: 'no_model_list' } } };
+    expect(connectErrorKey(noList)).toBe('assistant.connect.noModelList');
+    expect(connectErrorKey({ response: { data: { code: 'provider_unavailable', reason: 'other' } } })).toBe(
+      'assistant.error.providerDown'
+    );
+  });
+
   it('FE-AI-CONNECT-MODEL-003: offers the way back into a broken connection, none for a working one', () => {
     expect(repairModeOf(VIEW)).toBeNull();
     expect(repairModeOf({ ...VIEW, status: 'error' })).toBe('key');

client/src/components/Settings/ai/aiConnectModel.ts

@@ -33,9 +33,20 @@ const CONNECT_ERRORS: Record<string, { messageKey: string }> = {
   offline: { messageKey: 'assistant.error.offline' },
 };
 
-/** The line a failed connect shows. Takes `{provider}` where the line names one. */
+/** What a refused connect says for the `reason` it carries next to its code, ahead of the code's line. */
+const CONNECT_REASONS: Record<string, { messageKey: string }> = {
+  no_model_list: { messageKey: 'assistant.connect.noModelList' },
+};
+
+/**
+ * The line a failed connect shows. Takes `{provider}` where the line names one.
+ * An own server that answered without a model list is up, so it gets its own
+ * line about the address instead of "not responding" (#2808).
+ */
 export function connectErrorKey(err: unknown): string {
-  return CONNECT_ERRORS[refusalCode(err) ?? '']?.messageKey ?? 'assistant.error.generic';
+  const reason = (err as { response?: { data?: { reason?: unknown } } } | null)?.response?.data?.reason;
+  const byReason = typeof reason === 'string' ? CONNECT_REASONS[reason] : undefined;
+  return byReason?.messageKey ?? CONNECT_ERRORS[refusalCode(err) ?? '']?.messageKey ?? 'assistant.error.generic';
 }
 
 /** How each connection state reads on its pill. */

client/src/components/Tours/TourGpxPreviewDialog.test.tsx

@@ -1,4 +1,4 @@
-// FE-GPX-PREVIEW-001 to FE-GPX-PREVIEW-003
+// FE-GPX-PREVIEW-001 to FE-GPX-PREVIEW-004
 // The GPX preview as ACT-01 uses it: preset to the tour's type, a city walk
 // imported as one, and when a track was recorded shown where it carried times.
 import { fireEvent, render, screen } from '@testing-library/react';
@@ -47,6 +47,13 @@ describe('TourGpxPreviewDialog (ACT-01)', () => {
     expect(recorded[0]).toHaveTextContent('50 min');
   });
 
+  it('FE-GPX-PREVIEW-004: a track taken over from before Tours reads as one, not as a duplicate (#2810)', () => {
+    render(<TourGpxPreviewDialog gpxImport={gpxImport([track({ adopts_track: true })])} />);
+    expect(screen.getByTestId('gpx-preview-track')).not.toHaveAttribute('data-duplicate');
+    expect(screen.getByText(/tours\.import\.previewAdopts|becomes a tour/)).toBeInTheDocument();
+    expect(screen.queryByText(/tours\.import\.previewDuplicate|Already in the trip/)).toBeNull();
+  });
+
   it('FE-GPX-PREVIEW-002: imports as the preset type, a paddle tour with its boat and water', () => {
     const current = gpxImport([track()]);
     render(

client/src/components/Tours/TourGpxPreviewDialog.tsx

@@ -79,6 +79,7 @@ function PreviewTrackRow({
           {track.name || name}
         </span>
         {track.duplicate && <SoftPill tone="warning">{t('tours.import.previewDuplicate')}</SoftPill>}
+        {track.adopts_track && <SoftPill>{t('tours.import.previewAdopts')}</SoftPill>}
       </div>
       <div className="flex flex-wrap items-center gap-1.5 ps-8" style={fs(11)}>
         <span className={BADGE}>{formatDistance(track.distance_km, unit)}</span>

client/src/components/Tours/planner/TourEditorFields.tsx

@@ -212,7 +212,7 @@ function TourTimeFields({ planner, locked }: TourFieldProps) {
           id="tour-planner-planned-duration"
           label={t('tours.planner.plannedTotalDuration')}
           value={planner.plannedDurationMinutes ?? planner.plannedTotalMinutes}
-          invalid={planner.plannedDurationInvalid}
+          invalid={planner.plannedDurationInvalid || planner.plannedTotalInvalid}
           errorId="tour-planner-planned-duration-error"
           locked={locked}
           onCommit={planner.setPlannedDurationMinutes}
@@ -220,6 +220,10 @@ function TourTimeFields({ planner, locked }: TourFieldProps) {
         {planner.plannedDurationInvalid && (
           <FieldError id="tour-planner-planned-duration-error">{t('tours.planner.timeValueInvalid')}</FieldError>
         )}
+        {/* #2869: over a day a stage Save waits, and says why rather than only greying out. */}
+        {!planner.plannedDurationInvalid && planner.plannedTotalInvalid && (
+          <FieldError id="tour-planner-planned-duration-error">{t('tours.planner.plannedTotalOverDay')}</FieldError>
+        )}
       </div>
     </div>
   );
@@ -337,7 +341,11 @@ export function TourDetailsSection({
 }: TourFieldProps & { onDifficultyChange: (value: Difficulty) => void }) {
   const { t } = useTranslation();
   const [open, setOpen] = useState(readDetailsOpen);
-  const forcedOpen = planner.websiteInvalid || planner.plannedDurationInvalid || planner.breakAdditionalInvalid;
+  const forcedOpen =
+    planner.websiteInvalid ||
+    planner.plannedDurationInvalid ||
+    planner.breakAdditionalInvalid ||
+    planner.plannedTotalInvalid;
   const expanded = open || forcedOpen;
   const toggle = () => {
     const next = !expanded;

client/src/components/Tours/planner/TourPlannerPanels.test.tsx

@@ -526,6 +526,18 @@ describe('TourPlannerRail', () => {
     expect(screen.getByRole('alert')).toHaveTextContent('Enter a whole value from 0 to 1,440 minutes.')
   })
 
+  it('says why Save waits on a tour over a day a stage, and opens the details to say it (#2869)', () => {
+    window.localStorage.clear()
+    render(<TourPlannerRail planner={planner({
+      mode: { type: 'new-draft' }, hasUnsavedChanges: true, canSave: false,
+      walkingDurationMinutes: 1500, plannedTotalMinutes: 1500, plannedTotalInvalid: true,
+    })} />)
+    expect(screen.getByLabelText(/Planned total duration/)).toHaveAttribute('aria-invalid', 'true')
+    expect(screen.getByRole('alert')).toHaveTextContent(
+      'Walking time and breaks add up to more than 24 hours a day. Make it a multi-day tour with “End stage here” at a stop, or enter a shorter planned total.',
+    )
+  })
+
   it('RS-02: Info controls are keyboard focusable and explain themselves only through the shared tooltip', async () => {
     render(<TourPlannerRail planner={planner({
       mode: { type: 'new-draft' }, hasUnsavedChanges: true, walkingDurationMinutes: 80,

client/src/components/Trips/useTripCoverPicker.test.ts

@@ -135,6 +135,16 @@ describe('useTripCoverPicker', () => {
     expect(result.current.searchError).toBe('offline');
   });
 
+  it('FE-COMP-TRIPCOVER-010b: a server Unsplash turned away says the admin can add the key (#1449)', async () => {
+    vi.spyOn(tripsApi, 'searchCoverImages').mockRejectedValueOnce({
+      response: { status: 502, data: { error: 'Unsplash refused this server.', code: 'unsplash_key_needed' } },
+    });
+    const { result } = picker();
+    act(() => result.current.setSearchQuery('Lisbon'));
+    await act(() => result.current.search());
+    expect(result.current.searchError).toBe('dashboard.unsplashKeyNeeded');
+  });
+
   it('FE-COMP-TRIPCOVER-011: only the latest search applies its results', async () => {
     let resolveFirst!: (v: { photos: (typeof photo)[] }) => void;
     vi.spyOn(tripsApi, 'searchCoverImages')

client/src/components/Trips/useTripCoverPicker.ts

@@ -4,6 +4,7 @@ import { tripsApi } from '../../api/client';
 import { useTranslation } from '../../i18n';
 import { isEffectivelyOffline } from '../../sync/networkMode';
 import { getApiErrorMessage } from '../../types';
+import { getApiErrorCode } from '../../utils/apiError';
 import { normalizeImageFile } from '../../utils/convertHeic';
 import { refusedOffline } from '../../utils/needsConnection';
 import { useToast } from '../shared/Toast';
@@ -149,7 +150,12 @@ export function useTripCoverPicker({ trip, title, onCoverUpdate, releasePreviewO
       if (photos.length === 0) setSearchError(t('dashboard.unsplashNoResults'));
     } catch (err: unknown) {
       if (seq !== coverSearchSeq.current) return;
-      setSearchError(getApiErrorMessage(err, t('dashboard.coverSearchError')));
+      // #1449: Unsplash turns a datacenter address away until an admin enters the free key.
+      setSearchError(
+        getApiErrorCode(err) === 'unsplash_key_needed'
+          ? t('dashboard.unsplashKeyNeeded')
+          : getApiErrorMessage(err, t('dashboard.coverSearchError'))
+      );
     } finally {
       if (seq === coverSearchSeq.current) setSearching(false);
     }

client/src/mobile/screens/admin/MAdminPluginsPanel.tsx

@@ -294,7 +294,7 @@ export default function MAdminPluginsPanel() {
       {bypass.copy && (
         <MConfirmSheet open onClose={bypass.dismiss} onConfirm={bypass.copy.confirm ? bypass.confirm : undefined}
           title={bypass.copy.title} message={bypass.copy.body}
-          confirmLabel={t('admin.plugins.installAnyway')} cancelLabel={bypass.copy.confirm ? t('common.cancel') : t('common.ok')} danger />
+          confirmLabel={bypass.copy.confirmLabel} cancelLabel={bypass.copy.confirm ? t('common.cancel') : t('common.ok')} danger />
       )}
 
       {/* Row ⋯ action sheet */}

client/src/mobile/screens/trip/tabs/MDocSyncSheet.test.tsx

@@ -1,4 +1,4 @@
-// FE-DOCSYNC-MOBILE-001 to FE-DOCSYNC-MOBILE-024
+// FE-DOCSYNC-MOBILE-001 to FE-DOCSYNC-MOBILE-027
 import type { ComponentProps } from 'react'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { render, screen, fireEvent, waitFor, within } from '../../../../../tests/helpers/render'
@@ -137,6 +137,12 @@ beforeEach(() => {
   vi.spyOn(docsyncApi, 'createLink').mockResolvedValue({})
   vi.spyOn(docsyncApi, 'items').mockResolvedValue([])
   vi.spyOn(docsyncApi, 'resolve').mockResolvedValue({ success: true })
+  vi.spyOn(docsyncApi, 'deleteConnection').mockImplementation(async (_tripId, id) => {
+    // The bindings go with their connection, as ON DELETE CASCADE has it.
+    connections = connections.filter(c => c.id !== id)
+    links = links.filter(l => l.connectionId !== id)
+    return { success: true }
+  })
 })
 
 /** The status route with a number of conflicts on it, holdings as usual. */
@@ -528,3 +534,45 @@ describe('MDocSyncSheet: what a member may do', () => {
     expect(screen.queryByRole('button', { name: /Papra/ })).not.toBeInTheDocument()
   })
 })
+
+describe('MDocSyncSheet: the stored connection', () => {
+  const removeButtons = () => screen.getAllByRole('button', { name: 'Remove connection' })
+
+  it('FE-DOCSYNC-MOBILE-025: a binding opens its connection at any time, and removing it asks first', async () => {
+    renderSheet()
+    await openDetail()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Edit connection' }))
+    expect(await screen.findByPlaceholderText('https://paperless.example')).toHaveValue('https://paperless.example')
+
+    fireEvent.click(removeButtons()[0])
+    expect(docsyncApi.deleteConnection).not.toHaveBeenCalled()
+    expect(await screen.findByText(/TREK forgets the address and login/)).toBeInTheDocument()
+    // The confirmation sheet opens over the form, so its button is the last one of that name.
+    const named = removeButtons()
+    fireEvent.click(named[named.length - 1])
+
+    await waitFor(() => expect(docsyncApi.deleteConnection).toHaveBeenCalledWith(TRIP_ID, 5))
+    // Back at the list, with Paperless offered again from scratch.
+    expect(await screen.findByText('Connect a provider')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Sync now' })).not.toBeInTheDocument()
+  })
+
+  it('FE-DOCSYNC-MOBILE-026: a stored connection without a binding can be edited from the folder picker', async () => {
+    renderSheet()
+    fireEvent.click(await screen.findByRole('button', { name: /Nextcloud/ }))
+    await screen.findByText('Photos')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Edit connection' }))
+
+    expect(await screen.findByRole('button', { name: 'Remove connection' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeInTheDocument()
+  })
+
+  it('FE-DOCSYNC-MOBILE-027: a member sees no way to the connection', async () => {
+    renderSheet({ canManage: false })
+    await openDetail()
+
+    expect(screen.queryByRole('button', { name: 'Edit connection' })).not.toBeInTheDocument()
+  })
+})

client/src/mobile/screens/trip/tabs/MDocSyncSheet.tsx

@@ -1,7 +1,7 @@
 import { useEffect, useMemo, useState } from 'react'
 import {
   ArrowLeft, ArrowRight, Check, ChevronLeft, ChevronRight, FolderPlus, FolderSync, KeyRound, Link2Off,
-  Loader2, Plus, RefreshCw,
+  Loader2, Plus, RefreshCw, Trash2,
 } from 'lucide-react'
 import MSheet from '../../../components/MSheet'
 import MIconBtn from '../../../components/MIconBtn'
@@ -149,6 +149,7 @@ export default function MDocSyncSheet({
               provider={pending}
               sync={sync}
               onDone={connected}
+              onRemoved={() => { setReconnectFor(null); setPending(null); setView('list') }}
             />
           ) : view === 'scope' && pending && sync.connectionFor(pending.id) ? (
             <ScopeView
@@ -156,6 +157,7 @@ export default function MDocSyncSheet({
               suggestedName={slugFor(tripTitle, tripId)}
               sync={sync}
               onBound={() => setView('list')}
+              onEditConnection={() => setView('connect')}
             />
           ) : view === 'detail' && link ? (
             <DetailView
@@ -417,6 +419,19 @@ function DetailView({
             </button>
           </SettingRow>
 
+          {onReconnect && (
+            <SettingRow label={t('docsync.connection.title')} hint={t('docsync.connection.hint')}>
+              <button
+                type="button"
+                onClick={onReconnect}
+                className="flex items-center gap-1.5 rounded-full bg-[color:var(--m-ic)] px-3 py-[6px] font-geist text-caption font-bold text-m-ink"
+              >
+                <KeyRound size={12} strokeWidth={2.2} />
+                {t('docsync.connection.edit')}
+              </button>
+            </SettingRow>
+          )}
+
           <button
             type="button"
             onClick={onUnlink}
@@ -443,14 +458,18 @@ function ConnectView({
   provider,
   sync,
   onDone,
+  onRemoved,
 }: {
   provider: DocSyncProvider
   sync: ReturnType<typeof useDocSync>
   onDone: () => void
+  onRemoved: () => void
 }) {
   const { t } = useTranslation()
-  const form = useConnectForm(provider, sync.connectionFor(provider.id), sync)
+  const existing = sync.connectionFor(provider.id)
+  const form = useConnectForm(provider, existing, sync)
   const [verdict, setVerdict] = useState<DocSyncVerdict | null>(null)
+  const [confirmRemove, setConfirmRemove] = useState(false)
 
   return (
     <div className="mt-3 flex flex-col gap-3">
@@ -534,6 +553,32 @@ function ConnectView({
           {sync.busy === 'save' ? <Loader2 size={15} className="mx-auto animate-spin" /> : t('common.save')}
         </button>
       </div>
+
+      {existing && (
+        <button
+          type="button"
+          onClick={() => setConfirmRemove(true)}
+          disabled={sync.busy === 'connection'}
+          className="flex h-11 w-full items-center justify-center gap-2 rounded-2xl border border-[color:var(--m-rowbr)] text-body font-bold text-[color:var(--m-st-danger)] disabled:opacity-50"
+        >
+          <Trash2 size={15} strokeWidth={2.2} />
+          {t('docsync.connection.remove')}
+        </button>
+      )}
+
+      <MConfirmSheet
+        open={confirmRemove}
+        onClose={() => setConfirmRemove(false)}
+        title={t('docsync.connection.remove')}
+        message={t('docsync.connection.confirmRemove')}
+        confirmLabel={t('docsync.connection.remove')}
+        cancelLabel={t('common.cancel')}
+        danger
+        onConfirm={() => {
+          setConfirmRemove(false)
+          if (existing) void sync.removeConnection(existing.id).then(ok => { if (ok) onRemoved() })
+        }}
+      />
     </div>
   )
 }
@@ -544,11 +589,14 @@ function ScopeView({
   suggestedName,
   sync,
   onBound,
+  onEditConnection,
 }: {
   connectionId: number
   suggestedName: string
   sync: ReturnType<typeof useDocSync>
   onBound: () => void
+  /** Back to the stored connection, to change the login or remove it before choosing a folder. */
+  onEditConnection: () => void
 }) {
   const { t } = useTranslation()
   const { scopes, error, name, setName, working, bind, createAndBind } = useScopePicker({
@@ -562,6 +610,15 @@ function ScopeView({
     <div className="mt-3 flex flex-col gap-3">
       <p className="font-geist text-[0.71875rem] leading-snug text-m-muted">{t('docsync.scope.intro')}</p>
 
+      <button
+        type="button"
+        onClick={onEditConnection}
+        className="flex h-9 items-center justify-center gap-1.5 self-start rounded-full bg-[color:var(--m-ic)] px-3 font-geist text-caption font-bold text-m-ink"
+      >
+        <KeyRound size={12} strokeWidth={2.2} />
+        {t('docsync.connection.edit')}
+      </button>
+
       <div className="flex gap-2">
         <input
           value={name}

client/src/store/studioStore.ts

@@ -13,9 +13,9 @@ import { studioLayerActions, type StudioLayerActions } from './studioLayers'
  * The book being edited.
  *
  * History is snapshot-based rather than patch-based, and deliberately so: a
- * document is a few hundred kilobytes of plain JSON at most (the schema caps it
- * at 150 spreads of 60 elements), and a snapshot stack that cannot possibly
- * disagree with the document beats a patch stack that can. It is capped so a
+ * snapshot shares every page it did not change with the one before it, so even
+ * a book of hundreds of pages costs one page per step, and a snapshot stack
+ * that cannot possibly disagree with the document beats a patch stack that can. It is capped so a
  * long session does not grow without limit.
  *
  * Granularity is the part that matters for how it *feels*: a drag is one undo

client/tests/unit/mobile/admin/MAdminPluginsPanel.test.tsx

@@ -359,12 +359,22 @@ describe('MAdminPluginsPanel — Discover', () => {
     await waitFor(() => expect(toastMessages()).toContain('Installed'));
   });
 
-  it('FE-MOB-PLUGP-018: an entry no published version fits gets a dead, explained button', async () => {
+  it('FE-MOB-PLUGP-018: an entry no published version fits installs only after the admin accepts the risk', async () => {
+    let body: unknown = null;
     await openDiscover([registryEntry({ trek: '>=4.0.0', hostVersion: '3.3.0', compatible: false, latestCompatible: null })]);
+    server.use(http.post('*/api/admin/plugins/install', async ({ request }) => {
+      body = await request.json();
+      return HttpResponse.json({ id: 'trek-gotify', version: '2.0.0', trekRangeBypassed: null });
+    }));
 
-    const btn = await screen.findByRole('button', { name: 'Incompatible' });
-    expect(btn).toBeDisabled();
+    const btn = await screen.findByRole('button', { name: /^Install$/ });
     expect(btn).toHaveAttribute('title', 'Needs TREK >=4.0.0 — this server runs 3.3.0');
+    fireEvent.click(btn);
+
+    const sheet = await screen.findByRole('dialog', { name: 'Untested on this TREK' });
+    expect(body).toBeNull();
+    fireEvent.click(within(sheet).getByRole('button', { name: 'Install anyway' }));
+    await waitFor(() => expect(body).toEqual({ id: 'trek-gotify', acceptTrekRange: true }));
   });
 
   it('FE-MOB-PLUGP-019: when only an older release fits, that version is offered and installed', async () => {
@@ -1806,7 +1816,7 @@ describe('MAdminPluginsPanel — TREK-range bypass (TREK_PLUGINS_IGNORE_TREK_RAN
     expect(await screen.findByText('Version checks off')).toBeInTheDocument();
   });
 
-  it('FE-MOB-PLUGP-BYPASS-002: offers "Install anyway" and asks before installing', async () => {
+  it('FE-MOB-PLUGP-BYPASS-002: offers Install and asks before installing', async () => {
     let body: unknown = null;
     mockPanel([], [incompatibleEntry()], { ignoreTrekRange: true });
     server.use(http.post('*/api/admin/plugins/install', async ({ request }) => {
@@ -1816,7 +1826,7 @@ describe('MAdminPluginsPanel — TREK-range bypass (TREK_PLUGINS_IGNORE_TREK_RAN
     render(<MAdminPluginsPanel />);
     fireEvent.click(await screen.findByRole('tab', { name: /Discover/ }));
 
-    const btn = await screen.findByRole('button', { name: 'Install anyway' });
+    const btn = await screen.findByRole('button', { name: /^Install$/ });
     expect(btn).toBeEnabled();
     fireEvent.click(btn);
 
@@ -1834,7 +1844,7 @@ describe('MAdminPluginsPanel — TREK-range bypass (TREK_PLUGINS_IGNORE_TREK_RAN
     server.use(http.post('*/api/admin/plugins/install', () => { posted = true; return HttpResponse.json({ id: 'trek-gotify', version: '2.0.0', trekRangeBypassed: null }); }));
     render(<MAdminPluginsPanel />);
     fireEvent.click(await screen.findByRole('tab', { name: /Discover/ }));
-    fireEvent.click(await screen.findByRole('button', { name: 'Install anyway' }));
+    fireEvent.click(await screen.findByRole('button', { name: /^Install$/ }));
 
     const sheet = await screen.findByRole('dialog', { name: 'Outside its supported TREK versions' });
     fireEvent.click(within(sheet).getByRole('button', { name: 'Cancel' }));

client/tests/unit/studio/autoLayout.travel.test.ts

@@ -268,9 +268,11 @@ describe('the entry spreads', () => {
 })
 
 describe('the document as a whole', () => {
-  it('stays within the schema cap on spreads', () => {
+  it('lays out a long journey whole, its last page and back cover after the entries', () => {
     const many = Array.from({ length: 200 }, (_, i) => entry({ id: i + 1 }))
-    expect(build({ entries: many }).spreads.length).toBeLessThanOrEqual(150)
+    const doc = build({ entries: many })
+    expect(doc.spreads.length).toBeGreaterThan(150)
+    expect(doc.spreads.slice(-2).map(sp => sp.role)).toEqual(['last', 'back'])
   })
 
   it('gives every spread and every element an id of its own', () => {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@trek/root",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@trek/root",
-      "version": "5.0.0",
+      "version": "5.0.1",
       "workspaces": [
         "client",
         "server",
@@ -29,7 +29,7 @@
     },
     "client": {
       "name": "@trek/client",
-      "version": "5.0.0",
+      "version": "5.0.1",
       "dependencies": {
         "@assistant-ui/react": "0.15.25",
         "@fontsource/abril-fatface": "^5.3.0",
@@ -25005,7 +25005,7 @@
     },
     "server": {
       "name": "@trek/server",
-      "version": "5.0.0",
+      "version": "5.0.1",
       "dependencies": {
         "@aws-lite/client": "^0.23.7",
         "@aws-lite/s3": "^0.2.7",
@@ -25384,7 +25384,7 @@
     },
     "shared": {
       "name": "@trek/shared",
-      "version": "5.0.0",
+      "version": "5.0.1",
       "dependencies": {
         "isomorphic-dompurify": "^3.23.0",
         "zod": "^4.6.7"

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@trek/root",
   "private": true,
-  "version": "5.0.0",
+  "version": "5.0.1",
   "engines": {
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },

server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trek/server",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "engines": {
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },

server/scripts/build-airports.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 // Build server/assets/airports.json from OurAirports (davidmegginson.github.io/ourairports-data).
-// License: Public Domain. Keeps large/medium airports with an IATA code; timezone derived from coords via tz-lookup.
+// License: Public Domain. Keeps large/medium airports with an IATA code, small ones only with scheduled service;
+// timezone derived from coords via tz-lookup.
 import fs from 'node:fs';
 import https from 'node:https';
 import path from 'node:path';
@@ -91,7 +92,9 @@ for (let i = 1; i < rows.length; i++) {
   if (!KEEP.has(r[TYPE])) continue;
   const iata = r[IATA]?.trim().toUpperCase();
   if (!iata || iata.length !== 3) continue;
-  if (r[SERVICE] !== 'yes') continue;
+  // The scheduled_service flag lags reality: Little Cayman (LYB) has daily flights and is
+  // marked "no". So it only filters the small fields, where it keeps every airstrip with a code out.
+  if (r[TYPE] === 'small_airport' && r[SERVICE] !== 'yes') continue;
   const lat = Number(r[LAT]);
   const lng = Number(r[LNG]);
   if (!Number.isFinite(lat) || !Number.isFinite(lng)) continue;

server/scripts/eslint-baseline.json

@@ -5,7 +5,7 @@
     "@typescript-eslint/no-require-imports": 18,
     "@typescript-eslint/no-unsafe-function-type": 1,
     "@typescript-eslint/no-unused-vars": 36,
-    "no-await-in-loop": 563,
+    "no-await-in-loop": 562,
     "no-console": 235,
     "no-empty": 6
   },

server/scripts/mcp-inline-zod-baseline.json

@@ -7,7 +7,7 @@
     "src/nest/budget/budget.mcp.ts": 36,
     "src/nest/collab/collab.mcp.ts": 20,
     "src/nest/collections/collections.mcp.ts": 14,
-    "src/nest/day-notes/day-notes.mcp.ts": 10,
+    "src/nest/day-notes/day-notes.mcp.ts": 6,
     "src/nest/days/days.mcp.ts": 2,
     "src/nest/doc-sync/doc-sync.mcp.ts": 1,
     "src/nest/files/files.mcp.ts": 4,

server/scripts/size-baseline.json

@@ -1,7 +1,7 @@
 {
   "scripts/db-call-graph.mjs": 1036,
   "scripts/generate-entities.ts": 2259,
-  "src/db/repositories/Places.repository.ts": 1439,
+  "src/db/repositories/Places.repository.ts": 1438,
   "src/db/repositories/Reservations.repository.ts": 1604,
   "src/db/repositories/Trips.repository.ts": 1121,
   "src/db/repositories/Users.repository.ts": 1445,
@@ -13,7 +13,7 @@
   "src/nest/doc-sync/providers/synology-drive.client.ts": 1160,
   "src/nest/journey/journey-domain.service.ts": 1659,
   "src/nest/places/places.service.ts": 1592,
-  "src/nest/plugins/plugin-runtime.service.ts": 1463,
+  "src/nest/plugins/plugin-runtime.service.ts": 1460,
   "src/nest/plugins/runtime/plugin-sdk.ts": 1093,
   "src/nest/reservations/reservations.service.ts": 1237,
   "src/nest/trips/trips.service.ts": 1006,

server/src/bootstrap.ts

@@ -177,13 +177,15 @@ export async function buildApp(): Promise<INestApplication> {
    * it is the wrong one for a photo book. A Studio document is sent WHOLE on
    * every autosave — deliberately, see book-store.schema.ts, because a patch
    * protocol would need an ordering guarantee and a merge rule per field — and
-   * the contract already caps it at 150 spreads of 90 elements. A real book of
-   * a fortnight's journey is well past a hundred kilobytes before anybody asks
+   * a book has as many pages as its journey needs. A real book of a
+   * fortnight's journey is well past a hundred kilobytes before anybody asks
    * for road geometry, and what the ceiling produces is not an error message
    * but a save that quietly fails and an editor that says "not saved" without
    * saying why.
    *
    * So the book route is measured against the size a book can actually be.
+   * An auto laid page is two to five kilobytes, so eight megabytes hold a
+   * book of a few thousand pages: the page count has no limit of its own.
    *
    * A list file is the same story at a smaller scale. Its contract allows a
    * megabyte and the import posts it whole, yet a list of a few hundred places

server/src/db/entities/Plugins.entity.ts

@@ -35,6 +35,8 @@ export class Plugins {
   update_block_version?: string | null;
   trek_range?: string | null;
   update_hold: number & Opt = 0;
+  trek_range_accepted_version?: string | null;
+  trek_range_accepted_host?: string | null;
 }
 
 export const PluginsSchema = defineEntity({
@@ -72,5 +74,7 @@ export const PluginsSchema = defineEntity({
     update_block_version: p.text().nullable(),
     trek_range: p.text().nullable(),
     update_hold: p.integer().default(0),
+    trek_range_accepted_version: p.text().nullable(),
+    trek_range_accepted_host: p.text().nullable(),
   },
 });

server/src/db/json-columns.ts

@@ -375,6 +375,12 @@ const aiProviderStateSchema = z.discriminatedUnion('adapter', [
     adapter: z.literal('anthropic-messages'),
     blocks: z.array(z.record(z.string(), z.unknown())),
   }),
+  // Gemini's thought signature per tool call id, which its Chat Completions endpoint wants back with the call.
+  z.object({
+    adapter: z.literal('openai-chat'),
+    model: z.string(),
+    signatures: z.record(z.string(), z.string()),
+  }),
 ]);
 export type AiProviderState = z.infer<typeof aiProviderStateSchema>;
 

server/src/db/kysely/Plugins.table.ts

@@ -34,4 +34,6 @@ export interface PluginsTable {
   update_block_version: InsertOptional<string | null>;
   trek_range: InsertOptional<string | null>;
   update_hold: InsertOptional<number>;
+  trek_range_accepted_version: InsertOptional<string | null>;
+  trek_range_accepted_host: InsertOptional<string | null>;
 }

server/src/db/migrations/Migration20200101046310_an_admin_can_run_a_plugin_outside_its_trek_range.ts

@@ -0,0 +1,18 @@
+import { Migration } from '@mikro-orm/migrations';
+
+/**
+ * An admin can run one plugin outside the TREK versions its author declared,
+ * instead of switching the check off for every plugin through
+ * TREK_PLUGINS_IGNORE_TREK_RANGE. The consent belongs to what the admin was
+ * shown: `trek_range_accepted_version` is the plugin version they accepted and
+ * `trek_range_accepted_host` the TREK version it ran on then. An update of the
+ * plugin or a new TREK major asks again.
+ */
+export class Migration20200101046310_an_admin_can_run_a_plugin_outside_its_trek_range extends Migration {
+  override name = 'Migration20200101046310_an_admin_can_run_a_plugin_outside_its_trek_range';
+
+  override up(): void {
+    this.addSql('ALTER TABLE plugins ADD COLUMN trek_range_accepted_version TEXT');
+    this.addSql('ALTER TABLE plugins ADD COLUMN trek_range_accepted_host TEXT');
+  }
+}

server/src/db/repositories/Places.repository.ts

@@ -605,16 +605,15 @@ export class PlacesRepository extends TrekRepository<Places> {
    * it was.
    */
   async listDedupInputs(trip_id: string): Promise<{
-    name: string | null; lat: number | null; lng: number | null;
+    name: string | null; lat: number | null; lng: number | null; route_geometry: string | null;
     google_place_id: string | null; google_ftid: string | null; osm_id: string | null; amap_poi_id: string | null;
   }[]> {
+    // route_geometry tells a track from a pin: a track to import matches only tracks (#2810).
     return this.qb('p')
-      .select(['p.name', 'p.lat', 'p.lng', 'p.google_place_id', 'p.google_ftid', 'p.osm_id', 'p.amap_poi_id'])
+      .select(['p.name', 'p.lat', 'p.lng', 'p.route_geometry',
+        'p.google_place_id', 'p.google_ftid', 'p.osm_id', 'p.amap_poi_id'])
       .where('p.trip_id = ?', [trip_id])
-      .execute<{
-        name: string | null; lat: number | null; lng: number | null;
-        google_place_id: string | null; google_ftid: string | null; osm_id: string | null; amap_poi_id: string | null;
-      }[]>('all', false);
+      .execute<Awaited<ReturnType<PlacesRepository['listDedupInputs']>>>('all', false);
   }
 
   /**

server/src/db/repositories/Plugins.repository.ts

@@ -26,13 +26,16 @@ export interface PluginIdPermissionRow {
   permissions: string | null;
 }
 
-/** PR17 — `SELECT permissions, granted_permissions, dependencies, trek_range, api_version FROM plugins WHERE id = ?` (`assertActivatable`'s one-row activation gate). */
+/** PR17 — the one-row activation gate `assertActivatable` reads: grants, dependencies, the TREK range and an admin's consent to run outside it. */
 export interface PluginActivationGateRow {
   permissions: string;
   granted_permissions: string;
   dependencies: string | null;
   trek_range: string | null;
   api_version: number | null;
+  version: string | null;
+  trek_range_accepted_version: string | null;
+  trek_range_accepted_host: string | null;
 }
 
 /** PR18 — `SELECT permissions, config FROM plugins WHERE id = ?` (`spawnActivated`). */
@@ -89,6 +92,8 @@ export interface PluginAdminRow {
   dependencies: string | null;
   operator_egress: number;
   trek_range: string | null;
+  trek_range_accepted_version: string | null;
+  trek_range_accepted_host: string | null;
   author_pubkey: string | null;
   update_block_code: string | null;
   update_block_detail: string | null;
@@ -144,7 +149,18 @@ export class PluginsRepository extends TrekRepository<Plugins> {
   async findActivationGate(id: string): Promise<PluginActivationGateRow | null> {
     const row = await this.findOne(
       { id },
-      { fields: ['permissions', 'granted_permissions', 'dependencies', 'trek_range', 'api_version'] },
+      {
+        fields: [
+          'permissions',
+          'granted_permissions',
+          'dependencies',
+          'trek_range',
+          'api_version',
+          'version',
+          'trek_range_accepted_version',
+          'trek_range_accepted_host',
+        ],
+      },
     );
     return row
       ? {
@@ -153,6 +169,9 @@ export class PluginsRepository extends TrekRepository<Plugins> {
           dependencies: row.dependencies ?? null,
           trek_range: row.trek_range ?? null,
           api_version: row.api_version ?? null,
+          version: row.version ?? null,
+          trek_range_accepted_version: row.trek_range_accepted_version ?? null,
+          trek_range_accepted_host: row.trek_range_accepted_host ?? null,
         }
       : null;
   }
@@ -370,6 +389,8 @@ export class PluginsRepository extends TrekRepository<Plugins> {
           'dependencies',
           'operator_egress',
           'trek_range',
+          'trek_range_accepted_version',
+          'trek_range_accepted_host',
           'author_pubkey',
           'update_block_code',
           'update_block_detail',
@@ -396,6 +417,8 @@ export class PluginsRepository extends TrekRepository<Plugins> {
       dependencies: r.dependencies ?? null,
       operator_egress: r.operator_egress,
       trek_range: r.trek_range ?? null,
+      trek_range_accepted_version: r.trek_range_accepted_version ?? null,
+      trek_range_accepted_host: r.trek_range_accepted_host ?? null,
       author_pubkey: r.author_pubkey ?? null,
       update_block_code: r.update_block_code ?? null,
       update_block_detail: r.update_block_detail ?? null,
@@ -545,6 +568,11 @@ export class PluginsRepository extends TrekRepository<Plugins> {
     await this.nativeUpdate({ id }, { update_hold: hold ? 1 : 0 });
   }
 
+  /** An admin accepted running this plugin version outside its TREK range, on this TREK. */
+  async acceptTrekRange(id: string, version: string, host: string): Promise<void> {
+    await this.nativeUpdate({ id }, { trek_range_accepted_version: version, trek_range_accepted_host: host });
+  }
+
   /**
    * RG8 (`commitUpload`, sideload step 2) — `` UPDATE plugins SET source_repo = ?,
    * source_commit = NULL, sha256 = NULL, reviewed_at = NULL, author_pubkey = NULL,

server/src/nest/ai-connections/ai-chat-client.service.ts

@@ -1,6 +1,6 @@
 import { safeFetch, safeFetchLlm } from '../../utils/ssrfGuard';
 import type { AiChatClient } from './ai-chat-client.interface';
-import { AI_BASE_URLS } from './ai-connections.constants';
+import { AI_BASE_URLS, ownServerChatBase } from './ai-connections.constants';
 import type { ResolvedAiConnection } from './ai-connections.types';
 import { ChatgptAuthService } from './chatgpt-auth.service';
 import { AnthropicMessagesClient } from './providers/anthropic-messages.client';
@@ -67,7 +67,7 @@ export class AiChatClientService {
         return new OpenAiChatClient(
           kind,
           model,
-          (connection.baseUrl ?? '').replace(/(?<!\/)\/+$/, ''),
+          ownServerChatBase(connection.baseUrl),
           credential.apiKey,
           adminServerFetch,
         );

server/src/nest/ai-connections/ai-connections.constants.ts

@@ -22,6 +22,26 @@ export function aiHostOf(kind: AiConnectionKind, baseUrl: string | null): string
   }
 }
 
+/**
+ * Where an own server's Chat Completions live. An address with a path, such as
+ * `https://api.groq.com/openai/v1` or `http://ollama.lan:11434/v1`, is used as
+ * entered. A bare server address gets `/v1`: Ollama, LM Studio, vLLM,
+ * llama.cpp and LiteLLM all answer there, while Ollama answers
+ * `/chat/completions` at its root with a 404. Connecting already found the
+ * model list of such an address under the root, so the chat failed where the
+ * connection had worked.
+ */
+export function ownServerChatBase(baseUrl: string | null): string {
+  const entered = (baseUrl ?? '').trim().replace(/(?<!\/)\/+$/, '');
+  try {
+    const url = new URL(entered);
+    if (url.pathname === '/' && !url.search && !url.hash) return `${entered}/v1`;
+  } catch {
+    // An address that does not parse fails on the request, as it did before.
+  }
+  return entered;
+}
+
 /** Whether OpenRouter's OAuth can send the browser back here: it only returns to an https address. */
 export function openrouterOAuthAvailable(): boolean {
   return getAppUrl().startsWith('https://');
@@ -91,7 +111,17 @@ const PROVIDER_MESSAGES: Partial<Record<AssistantErrorCode, string>> = {
   provider_unavailable: 'The provider is not responding',
 };
 
-/** A provider's failure as the refusal a REST route answers with. */
+/**
+ * A provider's failure as the refusal a REST route answers with. An own server
+ * that answered without a model list says so in `reason`, so the form can name
+ * the address instead of calling a server that is up unresponsive (#2808).
+ */
 export function providerRefusal(err: AiProviderError): DomainError {
+  if (err.providerCode === 'no_model_list') {
+    return new DomainError(REFUSAL_STATUS[err.code], 'The server answered, but sent no model list', {
+      code: err.code,
+      details: { code: err.code, reason: 'no_model_list' },
+    });
+  }
   return aiRefusal(err.code, PROVIDER_MESSAGES[err.code] ?? 'The provider refused the request');
 }

server/src/nest/ai-connections/model-catalog.service.ts

@@ -238,7 +238,15 @@ export class ModelCatalogService {
       const { models } = await this.llmLocal.listModels(baseUrl ?? undefined, apiKey ?? undefined);
       return models.map((m) => ({ id: m.name, label: m.name, supportsTools: true }));
     } catch (err) {
-      if (err instanceof DomainError) throw new AiProviderError('provider_unavailable', err.getStatus(), true);
+      // The server's own answer decides what the admin reads: a refused key, a
+      // server that answered without a model list, or one that is not there.
+      // All three read as "not responding" before, which sent people looking
+      // at a server that was up (#2808).
+      if (err instanceof DomainError) {
+        if (err.code === 'llm_key_refused') throw new AiProviderError('invalid_key', err.getStatus(), false);
+        const reason = err.code === 'llm_no_model_list' ? 'no_model_list' : undefined;
+        throw new AiProviderError('provider_unavailable', err.getStatus(), true, undefined, reason);
+      }
       throw err;
     }
   }

server/src/nest/ai-connections/providers/openai-chat.client.ts

@@ -26,16 +26,29 @@ import type { AiConnectionKind } from '@trek/shared';
 /** The end of an OpenAI-compatible stream. */
 const DONE = '[DONE]';
 
+/** The host of Gemini's OpenAI-compatible endpoint, which an admin may also enter as their own server. */
+const GEMINI_HOST = 'generativelanguage.googleapis.com';
+
+function isGeminiHost(baseUrl: string): boolean {
+  try {
+    return new URL(baseUrl).hostname === GEMINI_HOST;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * The provider-neutral history as Chat Completions messages, the instructions
  * and the trip card first. A tool message takes no image, so the images of a
- * step's tool results follow its last result as one user message.
+ * step's tool results follow its last result as one user message. `model` is
+ * the one the request goes to: a thought signature goes back only to the model
+ * that signed it, since another one cannot read it.
  */
-export function toChatMessages(request: AiChatRequest): Record<string, unknown>[] {
+export function toChatMessages(request: AiChatRequest, model?: string): Record<string, unknown>[] {
   const system = [request.system, request.context].filter(Boolean).join('\n\n');
   const out: Record<string, unknown>[] = [{ role: 'system', content: system }];
   request.messages.forEach((message, index) => {
-    out.push(toChatMessage(message));
+    out.push(toChatMessage(message, model));
     const withImages = toolImagesEndingAt(request.messages, index);
     if (withImages.length === 0) return;
     const content = withImages.flatMap((tool) => [
@@ -51,12 +64,14 @@ function imagePart(image: AiImage): Record<string, unknown> {
   return { type: 'image_url', image_url: { url: imageDataUrl(image), detail: image.detail ?? 'high' } };
 }
 
-function toChatMessage(message: AiChatMessage): Record<string, unknown> {
+function toChatMessage(message: AiChatMessage, model: string | undefined): Record<string, unknown> {
   if (message.role === 'user') {
     if (!message.images?.length) return { role: 'user', content: message.text };
     return { role: 'user', content: [{ type: 'text', text: message.text }, ...message.images.map(imagePart)] };
   }
   if (message.role === 'tool') return { role: 'tool', tool_call_id: message.toolCallId, content: message.output };
+  const state = message.providerState;
+  const signatures = state?.adapter === 'openai-chat' && state.model === model ? state.signatures : {};
   return {
     role: 'assistant',
     content: message.text || null,
@@ -66,19 +81,32 @@ function toChatMessage(message: AiChatMessage): Record<string, unknown> {
             id: call.id,
             type: 'function',
             function: { name: call.name, arguments: JSON.stringify(call.args) },
+            ...(signatures[call.id] ? { extra_content: { google: { thought_signature: signatures[call.id] } } } : {}),
           })),
         }
       : {}),
   };
 }
 
+/** Gemini signs a tool call on its first piece; the call has to go back with it or the next request is refused. */
+function thoughtSignatureOf(piece: Record<string, unknown>): string {
+  return asText(asRecord(asRecord(piece.extra_content).google).thought_signature);
+}
+
+/** The id a call goes on with; a provider that names none gets one from the call's position. */
+function callId(index: number, id: string): string {
+  return id || `call_${index}`;
+}
+
 const FINISH_REASONS: Record<string, AiFinishReason> = { tool_calls: 'tool-calls', length: 'length' };
 
 /**
  * The OpenAI-compatible Chat Completions API, streamed: OpenAI itself, Gemini
  * (its `/v1beta/openai` endpoint), OpenRouter and an admin's own server. The
  * kind decides only what a request may carry: Gemini gets its narrower tool
- * schemas, OpenAI the prompt cache key, which the others do not know.
+ * schemas, also when an admin enters its endpoint as their own server, and
+ * OpenAI the prompt cache key, which the others do not know. Gemini's thought
+ * signatures come back as the turn's provider state.
  */
 export class OpenAiChatClient implements AiChatClient {
   /** OpenRouter searches the web for any model through its web plugin; the others have no search here. */
@@ -86,20 +114,25 @@ export class OpenAiChatClient implements AiChatClient {
     return this.kind === 'openrouter';
   }
 
+  /** The kind whose tool schemas the endpoint takes. */
+  private readonly schemaKind: AiConnectionKind;
+
   constructor(
     readonly kind: AiConnectionKind,
     readonly model: string,
     private readonly baseUrl: string,
     private readonly apiKey: string | null,
     private readonly fetcher: AiFetch,
-  ) {}
+  ) {
+    this.schemaKind = kind === 'custom' && isGeminiHost(baseUrl) ? 'gemini' : kind;
+  }
 
   async *stream(request: AiChatRequest, signal: AbortSignal): AsyncGenerator<AiChatEvent> {
     const body = {
       model: this.model,
       stream: true,
       stream_options: { include_usage: true },
-      messages: toChatMessages(request),
+      messages: toChatMessages(request, this.model),
       ...(request.tools.length > 0
         ? {
             tools: request.tools.map((tool) => ({
@@ -107,7 +140,7 @@ export class OpenAiChatClient implements AiChatClient {
               function: {
                 name: tool.name,
                 description: tool.description,
-                parameters: toProviderSchema(tool.parameters, this.kind),
+                parameters: toProviderSchema(tool.parameters, this.schemaKind),
               },
             })),
             tool_choice: 'auto',
@@ -153,10 +186,22 @@ export class OpenAiChatClient implements AiChatClient {
       cachedInputTokens: turn.cachedInputTokens,
       outputTokens: turn.outputTokens,
     };
+    const signatures = turn.signatures();
+    if (Object.keys(signatures).length > 0) {
+      yield { type: 'provider-state', state: { adapter: 'openai-chat', model: this.model, signatures } };
+    }
     yield { type: 'finish', reason: turn.finishReason() };
   }
 }
 
+/** A tool call while it streams in: its id, name and arguments so far, and Gemini's signature. */
+interface PendingCall {
+  id: string;
+  name: string;
+  args: string;
+  signature: string;
+}
+
 /**
  * What one streamed Chat Completions turn has said so far. A tool call
  * arrives in pieces keyed by its index (its id and name in the first, the
@@ -168,7 +213,7 @@ class ChatTurn {
   outputTokens = 0;
   reason: string | null = null;
   done = false;
-  private readonly pending = new Map<number, { id: string; name: string; args: string }>();
+  private readonly pending = new Map<number, PendingCall>();
   private readonly cited = new Set<string>();
   private fresh: AiSource[] = [];
 
@@ -199,10 +244,11 @@ class ChatTurn {
       const piece = asRecord(raw);
       const index = typeof piece.index === 'number' ? piece.index : position;
       const fn = asRecord(piece.function);
-      const call = this.pending.get(index) ?? { id: '', name: '', args: '' };
+      const call = this.pending.get(index) ?? { id: '', name: '', args: '', signature: '' };
       call.id ||= asText(piece.id);
       call.name ||= asText(fn.name);
       call.args += asText(fn.arguments);
+      call.signature ||= thoughtSignatureOf(piece);
       this.pending.set(index, call);
     });
     return asText(delta.content);
@@ -216,10 +262,24 @@ class ChatTurn {
   }
 
   calls(): AiToolCall[] {
-    return [...this.pending.entries()]
-      .sort(([a], [b]) => a - b)
-      .filter(([, call]) => call.name)
-      .map(([index, call]) => ({ id: call.id || `call_${index}`, name: call.name, args: parseToolArgs(call.args) }));
+    return this.named().map(([index, call]) => ({
+      id: callId(index, call.id),
+      name: call.name,
+      args: parseToolArgs(call.args),
+    }));
+  }
+
+  /** The thought signature of each signed call, by the id the call goes back with. */
+  signatures(): Record<string, string> {
+    return Object.fromEntries(
+      this.named()
+        .filter(([, call]) => call.signature)
+        .map(([index, call]) => [callId(index, call.id), call.signature]),
+    );
+  }
+
+  private named(): [number, PendingCall][] {
+    return [...this.pending.entries()].sort(([a], [b]) => a - b).filter(([, call]) => call.name);
   }
 
   finishReason(): AiFinishReason {

server/src/nest/ai-connections/providers/provider-http.ts

@@ -59,11 +59,21 @@ export async function refusalOf(kind: AiConnectionKind, res: Response): Promise<
   // refusal the provider's own code already explains (a plan that does not cover it) keeps that code.
   const image = namesImageInput(res.status, body) && providerFailure(kind, res.status, named).code === 'generic';
   const code = image ? IMAGE_INPUT_REFUSED : named;
-  // Status and code only: an error body can quote the request, and the request holds the trip.
-  logWarn(`[ai] ${kind} refused the request: HTTP ${res.status}${code ? ` (${code})` : ''}`);
+  // Status, code and the refused field's path only: an error message can quote the request, and the
+  // request holds the trip. The path alone says which part of a replayed conversation the provider refused.
+  const param = refusedParamOf(body);
+  logWarn(
+    `[ai] ${kind} refused the request: HTTP ${res.status}${code ? ` (${code})` : ''}${param ? ` at ${param}` : ''}`,
+  );
   return providerFailure(kind, res.status, code);
 }
 
+/** The field an error body names as refused (OpenAI's `param`, such as `input[12]`), when it is a bare path. */
+function refusedParamOf(body: unknown): string | undefined {
+  const param = asRecord(asRecord(body).error).param;
+  return typeof param === 'string' && /^[\w.[\]-]{1,80}$/.test(param) ? param : undefined;
+}
+
 /** One SSE data payload as a JSON object; null for anything else (a `[DONE]`, a keepalive). */
 export function parseEventData(data: string): Record<string, unknown> | null {
   try {

server/src/nest/assistant/assistant-history.ts

@@ -9,6 +9,7 @@ import { fitToSize } from './assistant-output';
 import {
   ADD_FOUND_PLACE_TOOL,
   APPROVAL_TTL_MS,
+  ASSISTANT_MODEL_CALLED_SERVER_TOOLS,
   ASSISTANT_SERVER_TOOLS,
   IMPORT_BOOKING_TOOL,
   IMPORT_TOUR_FILE_TOOL,
@@ -190,13 +191,6 @@ function earlierCut(text: string, earlier: boolean): string {
     : text;
 }
 
-/**
- * The model's own calls on attached files: told after the step that made
- * them, so the history ends on the user's side when the user's decision on
- * them goes on.
- */
-const ATTACHED_FILE_TOOLS: ReadonlySet<string> = new Set([READ_ATTACHED_FILE_TOOL, KEEP_ATTACHED_FILE_TOOL]);
-
 /** What became of keeping an attached file in Files, as its stored part says. */
 function keptFileLine(part: ToolCallPart): string {
   const file = quoted(part.args.name);
@@ -234,30 +228,31 @@ function attachedReadLine(
 }
 
 /**
- * What the model is told of its reads of attached files in one step: the
- * text of each file the user let it read, the first time the history holds
- * it (`told` keeps track), and what became of a read the user did not allow.
- * `texts` are the shared files' texts, by attachment id; one no longer there
- * was swept with its file.
+ * The answer a replayed call gets: what became of an attached file (the text
+ * of a file the user let it read, the first time the history holds it, `told`
+ * keeping track; `texts` are the shared files' texts by attachment id), "not
+ * applied" for a held change that never ran, the stored result otherwise.
  */
-function attachedReadNote(
-  calls: readonly ToolCallPart[],
+function replayedOutput(
+  part: ToolCallPart,
   texts: ReadonlyMap<string, string>,
   told: Set<string>,
   earlier: boolean,
 ): string {
-  return calls
-    .map((part) =>
-      part.toolName === KEEP_ATTACHED_FILE_TOOL ? keptFileLine(part) : attachedReadLine(part, texts, told, earlier),
-    )
-    .join('\n\n');
+  if (part.toolName === KEEP_ATTACHED_FILE_TOOL) return keptFileLine(part);
+  if (part.toolName === READ_ATTACHED_FILE_TOOL) return attachedReadLine(part, texts, told, earlier);
+  if (part.result === undefined) return NOT_APPLIED;
+  return outputText(earlier ? fitToSize(part.result, EARLIER_TOOL_OUTPUT_CHARS) : part.result);
 }
 
 /**
  * The thread as the provider reads it, oldest first, from its first user
  * message on. A step's tool calls are followed by their answers; a held
  * change that was never applied answers that it was not, since every call
- * must be answered. `providerIds` maps a held call's own id to the id the
+ * must be answered. That includes the server's tools the model called itself
+ * (a trip note, an attached file): the providers that replay their own record
+ * of a step refuse it with a call left unanswered, and every later message of
+ * the thread with it. `providerIds` maps a held call's own id to the id the
  * provider gave it.
  */
 export function toChatHistory(
@@ -282,42 +277,31 @@ export function toChatHistory(
       (part): part is Extract<AssistantMessagePart, { type: 'tool-call' }> =>
         part.type === 'tool-call' && part.toolName !== ASSISTANT_WEB_SEARCH_STEP,
     );
-    const reads = allCalls.filter((part) => ATTACHED_FILE_TOOLS.has(part.toolName));
-    const serverCalls = allCalls.filter(
-      (part) => ASSISTANT_SERVER_TOOLS.has(part.toolName) && !ATTACHED_FILE_TOOLS.has(part.toolName),
-    );
+    const serverStep = (part: ToolCallPart) =>
+      ASSISTANT_SERVER_TOOLS.has(part.toolName) && !ASSISTANT_MODEL_CALLED_SERVER_TOOLS.has(part.toolName);
     // Told as the user's side of the conversation: the history then ends on it
     // when a decision on these bookings starts the next answer.
-    if (serverCalls.length > 0) history.push({ role: 'user', text: serverStepsNote(serverCalls) });
-    const calls = allCalls.filter((part) => !ASSISTANT_SERVER_TOOLS.has(part.toolName));
+    const note = serverStepsNote(allCalls.filter(serverStep));
+    if (note) history.push({ role: 'user', text: note });
+    const calls = allCalls.filter((part) => !serverStep(part));
     const toolCalls: AiToolCall[] = calls.map((part) => ({
       id: providerIds.get(part.toolCallId) ?? part.toolCallId,
       name: part.toolName,
       args: part.args,
     }));
     const text = textOf(parts);
-    // Told after the step that read the files, so the history ends on the user's side when a consent goes on.
-    const readNote = reads.length > 0 ? attachedReadNote(reads, attachedTexts, told, earlier) : '';
-    if (!text && toolCalls.length === 0) {
-      if (readNote) history.push({ role: 'user', text: readNote });
-      return;
-    }
+    if (!text && toolCalls.length === 0) return;
     const providerState = decodeJson(ASSISTANT_PROVIDER_STATE, row.provider_state, `message ${row.id}`);
     history.push({ role: 'assistant', text, toolCalls, providerState });
     calls.forEach((part, index) => {
-      const output =
-        part.result === undefined
-          ? NOT_APPLIED
-          : outputText(earlier ? fitToSize(part.result, EARLIER_TOOL_OUTPUT_CHARS) : part.result);
       history.push({
         role: 'tool',
         toolCallId: toolCalls[index].id,
         name: part.toolName,
-        output,
+        output: replayedOutput(part, attachedTexts, told, earlier),
         ...(part.isError ? { isError: true } : {}),
       });
     });
-    if (readNote) history.push({ role: 'user', text: readNote });
   });
   return history;
 }

server/src/nest/assistant/assistant-tools.constants.ts

@@ -255,6 +255,18 @@ export const ASSISTANT_SERVER_TOOLS: ReadonlySet<string> = new Set([
   ...Object.keys(ASSISTANT_SERVER_WRITE_TOOLS),
 ]);
 
+/**
+ * The server's tools the model calls itself. TREK answers them, but they are
+ * calls in the provider's own record of the step, so a replayed step has to
+ * answer them like any other; the rest of the server's tools are steps the
+ * server took, which the provider never saw.
+ */
+export const ASSISTANT_MODEL_CALLED_SERVER_TOOLS: ReadonlySet<string> = new Set([
+  REMEMBER_TOOL,
+  READ_ATTACHED_FILE_TOOL,
+  KEEP_ATTACHED_FILE_TOOL,
+]);
+
 /** The largest file the assistant reads. */
 export const MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;
 

server/src/nest/assistant/tool-call-preview.helpers.ts

@@ -195,7 +195,7 @@ const DESCRIBERS: Readonly<Record<string, Describer>> = {
     const dayId = id(args, 'dayId');
     const rows = new Rows()
       .add('day', dayLabel(ctx, dayId))
-      .add('time', text(args.time))
+      .add('content', text(args.time))
       .add('icon', text(args.icon))
       .add('color', text(args.color));
     return { subject: text(args.text), rows, dayId, placeIds: [] };
@@ -203,8 +203,8 @@ const DESCRIBERS: Readonly<Record<string, Describer>> = {
   update_day_note: (ctx, args) => {
     const note = ctx.card.notes.get(id(args, 'noteId') ?? 0);
     const rows = new Rows();
-    if (has(args, 'text')) rows.change('text', note?.text ?? null, text(args.text));
-    if (has(args, 'time')) rows.change('time', note?.time ?? null, text(args.time));
+    if (has(args, 'text')) rows.change('title', note?.text ?? null, text(args.text));
+    if (has(args, 'time')) rows.change('content', note?.time ?? null, text(args.time));
     if (has(args, 'icon')) rows.change('icon', note?.icon ?? null, text(args.icon));
     if (has(args, 'color')) rows.change('color', note?.color ?? null, text(args.color));
     return { subject: note?.text ?? text(args.text), rows, dayId: id(args, 'dayId'), placeIds: [] };

server/src/nest/day-notes/day-notes.mcp.ts

@@ -11,7 +11,13 @@ import {
 } from '../../nest-mcp';
 import { McpToolGuardsService } from '../mcp-shared/mcp-tool-guards.service';
 import { DayNotesService } from './day-notes.service';
-import { idSchema, NOTE_COLORS, type NoteColor } from '@trek/shared';
+import {
+  dayNoteCreateRequestSchema,
+  dayNoteUpdateRequestSchema,
+  idSchema,
+  NOTE_COLORS,
+  type NoteColor,
+} from '@trek/shared';
 
 import { z } from 'zod';
 
@@ -23,6 +29,18 @@ import { z } from 'zod';
  */
 const noteColorSchema = z.enum(NOTE_COLORS);
 
+/**
+ * The note's two text fields carry their names from the time a note was a line
+ * with a clock time: `text` is the heading and `time` the Markdown body under it.
+ * The REST contract holds the bounds, so a note written in the planner can always
+ * be edited here; the descriptions are what tells a model which field is which.
+ */
+const NOTE_TITLE = 'The note title, shown as its heading in the day plan. Keep it short';
+const NOTE_BODY =
+  'The note body shown under the title: details, links, reminders, Markdown allowed. ' +
+  'Despite the field name this is the content, not a clock time';
+const noteTitleSchema = dayNoteCreateRequestSchema.shape.text.describe(NOTE_TITLE);
+
 function parseId(value: string | string[]): number | null {
   const n = Number(Array.isArray(value) ? value[0] : value);
   return Number.isInteger(n) && n > 0 ? n : null;
@@ -52,12 +70,12 @@ export class DayNotesMcp {
 
   @Tool({
     name: 'create_day_note',
-    description: 'Add a note to a specific day in a trip.',
+    description: 'Add a note to a specific day in a trip: a title in `text` and its body in `time`.',
     inputSchema: {
       tripId: idSchema,
       dayId: idSchema,
-      text: z.string().min(1).max(500),
-      time: z.string().max(250).optional().describe('Time label (e.g. "09:00" or "Morning")'),
+      text: noteTitleSchema,
+      time: dayNoteCreateRequestSchema.shape.time.describe(NOTE_BODY),
       icon: z.string().max(64).optional().describe('Emoji icon for the note'),
       color: noteColorSchema
         .nullable()
@@ -86,7 +104,7 @@ export class DayNotesMcp {
       tripId: number;
       dayId: number;
       text: string;
-      time?: string;
+      time?: string | null;
       icon?: string;
       color?: NoteColor | null;
       sort_order?: number;
@@ -104,18 +122,14 @@ export class DayNotesMcp {
 
   @Tool({
     name: 'update_day_note',
-    description: 'Edit an existing note on a specific day.',
+    description: 'Edit an existing note on a specific day: its title is `text`, its body `time`.',
     inputSchema: {
       tripId: idSchema,
       dayId: idSchema,
       noteId: idSchema,
-      text: z.string().min(1).max(500).optional(),
-      time: z
-        .string()
-        .max(250)
-        .nullable()
-        .optional()
-        .describe('Time label (e.g. "09:00" or "Morning"), or null to clear'),
+      // The create bound, so an update cannot blank the title the planner requires.
+      text: noteTitleSchema.optional(),
+      time: dayNoteUpdateRequestSchema.shape.time.describe(`${NOTE_BODY}, or null to clear it`),
       icon: z.string().max(64).optional().describe('Emoji icon for the note'),
       color: noteColorSchema
         .nullable()

server/src/nest/journey/book-design-apply.ts

@@ -1,7 +1,6 @@
 import {
   bookSpreadPhotoIds,
   compareCodeUnits,
-  MAX_SPREADS,
   type BookDesignPlanRow,
   type BookDesignSkipped,
   type BookDocument,
@@ -176,7 +175,7 @@ export function applyDesignDraft(
       if (at < 0 || !samePage(spreads[at], base.get(row.spreadId))) return skip(row.spreadId, 'changed_since');
       spreads[at] = page;
     } else {
-      if (at >= 0 || spreads.length >= MAX_SPREADS) return skip(row.spreadId, 'changed_since');
+      if (at >= 0) return skip(row.spreadId, 'changed_since');
       spreads.splice(insertAt(spreads, draft.plan, i, page), 0, page);
     }
     applied.push(row.spreadId);

server/src/nest/journey/journey-book-design.service.ts

@@ -178,7 +178,7 @@ export class JourneyBookDesignService {
       baseVersion: draft.baseVersion,
       expiresAt: new Date(draft.expiresAt).toISOString(),
       document: draft.doc,
-      plan: draft.plan.slice(0, BOOK_DESIGN_LIMITS.selection).map(planRowOut),
+      plan: draft.plan.map(planRowOut),
       selection: draft.selection,
     };
   }
@@ -376,7 +376,7 @@ function answerOf(draft: BookDesignDraft): BookDesignAnswer {
     expires_at: new Date(draft.expiresAt).toISOString(),
     plan: rows,
     more_rows: draft.plan.length - rows.length,
-    selected: draft.selection.slice(0, BOOK_DESIGN_LIMITS.selection),
+    selected: draft.selection,
     style: draft.style,
     photos: {
       used: draft.usedPhotos,

server/src/nest/llm-parse/llm-local.service.ts

@@ -26,6 +26,12 @@ const tagsResponseSchema = z.object({
 /** The OpenAI-compatible list (`GET /v1/models`) that LM Studio, vLLM and llama.cpp serve. */
 const openAiModelsSchema = z.object({ data: z.array(z.object({ id: z.string().optional() })) });
 
+/** One place a server may list its models, and how its answer reads. */
+interface ModelListSource {
+  url: string;
+  read: (body: unknown) => { name?: string; size?: number }[] | undefined;
+}
+
 /** The Bearer header the extraction sends, when a key is configured. */
 function authHeader(apiKey: string | undefined): Record<string, string> {
   return apiKey ? { authorization: `Bearer ${apiKey}` } : {};
@@ -43,11 +49,23 @@ function upstreamRefusal(status: number, apiKey: string | undefined, fallback: s
       apiKey
         ? `Local LLM server rejected the API key (${status})`
         : `Local LLM server requires an API key (${status}). Save the key for this address first.`,
+      { code: 'llm_key_refused' },
     );
   }
   return new DomainError(502, fallback);
 }
 
+/**
+ * A URL without its trailing slashes. Scanned off instead of `/\/+$/`-replaced:
+ * that pattern re-walks the slash run from every start position of the
+ * admin-supplied URL.
+ */
+function trimTrailingSlashes(url: string): string {
+  let end = url.length;
+  while (end > 0 && url.charCodeAt(end - 1) === 47 /* '/' */) end--;
+  return url.slice(0, end);
+}
+
 /**
  * Admin helpers for managing a local OpenAI-compatible LLM server (Ollama).
  * Talks to Ollama's *management* API (`/api/tags`, `/api/pull`), which lives at
@@ -72,11 +90,7 @@ export class LlmLocalService {
     if (url.protocol !== 'http:' && url.protocol !== 'https:') {
       throw new HttpException({ error: 'Base URL must be http(s)' }, 400);
     }
-    // Trailing slashes are scanned off instead of `/\/+$/`-replaced: that pattern
-    // re-walks the slash run from every start position of the admin-supplied URL.
-    let end = raw.length;
-    while (end > 0 && raw.charCodeAt(end - 1) === 47 /* '/' */) end--;
-    return raw.slice(0, end).replace(/\/v1$/, '');
+    return trimTrailingSlashes(raw).replace(/\/v1$/, '');
   }
 
   /**
@@ -94,39 +108,69 @@ export class LlmLocalService {
   }
 
   /**
-   * List models already pulled on the local server. A server without Ollama's
-   * `/api/tags` (LM Studio, vLLM, llama.cpp) answers 404 there, so its
-   * OpenAI-compatible `/v1/models` is asked instead.
+   * List the models the server offers. Ollama's `/api/tags` is asked first, then
+   * the OpenAI-compatible list: at the address as entered (the one the chat
+   * calls `/chat/completions` on, `https://api.groq.com/openai/v1` say), then at
+   * `/v1/models` under the root for an address given without `/v1`.
+   *
+   * An answer only counts when it reads as a model list. LM Studio answers an
+   * unknown path with 200 and an error object, and a proxy may answer it with a
+   * login page, so stopping at the first answer that is not a 404 refused
+   * servers whose list was one request further (#2808).
    */
   async listModels(
     baseUrl: string | undefined,
     apiKey?: string,
   ): Promise<{ models: { name: string; size: number }[] }> {
     const root = this.ollamaRoot(baseUrl);
-    let res = await this.getModelList(`${root}/api/tags`, root, apiKey);
-    let openAi = false;
-    if (res.status === 404) {
-      const fallback = await this.getModelList(`${root}/v1/models`, root, apiKey);
-      if (fallback.ok) {
-        discardBody(res);
-        res = fallback;
-        openAi = true;
+    const asEntered = trimTrailingSlashes((baseUrl ?? '').trim()) || root;
+    const lists: ModelListSource[] = [
+      { url: `${root}/api/tags`, read: (body) => tagsResponseSchema.safeParse(body).data?.models },
+      ...[...new Set([`${asEntered}/models`, `${root}/v1/models`])].map((url) => ({
+        url,
+        read: (body: unknown) => openAiModelsSchema.safeParse(body).data?.data.map((m) => ({ name: m.id, size: 0 })),
+      })),
+    ];
+    const seen = { firstStatus: 0, refusedStatus: 0 };
+    const listed = await this.firstModelList(lists, 0, root, apiKey, seen);
+    if (listed) return { models: listed.map((m) => ({ name: m.name ?? '', size: m.size ?? 0 })).filter((m) => m.name) };
+    if (seen.refusedStatus) throw upstreamRefusal(seen.refusedStatus, apiKey, '');
+    throw new DomainError(502, `Local LLM server sent no model list (${seen.firstStatus})`, {
+      code: 'llm_no_model_list',
+    });
+  }
+
+  /**
+   * The first of `lists`, from `index` on, that answers with a readable list,
+   * asked one after the other. Only the first request tells whether the server
+   * is there at all; a later one failing is that path, not the server.
+   */
+  private async firstModelList(
+    lists: ModelListSource[],
+    index: number,
+    root: string,
+    apiKey: string | undefined,
+    seen: { firstStatus: number; refusedStatus: number },
+  ): Promise<{ name?: string; size?: number }[] | null> {
+    const list = lists[index];
+    if (!list) return null;
+    let res: Response | null = null;
+    try {
+      res = await this.getModelList(list.url, root, apiKey);
+    } catch (err) {
+      if (index === 0) throw err;
+    }
+    if (res) {
+      seen.firstStatus ||= res.status;
+      if (res.status === 401 || res.status === 403) seen.refusedStatus ||= res.status;
+      if (res.ok) {
+        const listed = list.read(await readCappedJson<unknown>(res, MAX_LIST_BYTES).catch(() => undefined));
+        if (listed) return listed;
       } else {
-        // Neither list exists: report the first answer, as before.
-        discardBody(fallback);
+        discardBody(res);
       }
     }
-    if (!res.ok) {
-      discardBody(res);
-      throw upstreamRefusal(res.status, apiKey, `Local LLM server error (${res.status})`);
-    }
-    const body = await readCappedJson<unknown>(res, MAX_LIST_BYTES);
-    const listed = openAi
-      ? openAiModelsSchema.safeParse(body).data?.data.map((m) => ({ name: m.id, size: 0 }))
-      : tagsResponseSchema.safeParse(body).data?.models;
-    if (!listed) throw new DomainError(502, 'Local LLM server sent an unreadable model list');
-    const models = listed.map((m) => ({ name: m.name ?? '', size: m.size ?? 0 })).filter((m) => m.name);
-    return { models };
+    return this.firstModelList(lists, index + 1, root, apiKey, seen);
   }
 
   private async getModelList(url: string, root: string, apiKey: string | undefined): Promise<Response> {

server/src/nest/llm-parse/router/ollama-format.client.ts

@@ -1,5 +1,7 @@
 /**
- * Minimal Ollama native-API client used by the extraction router.
+ * Minimal Ollama native-API client used by the extraction router. A server that
+ * has no `/api/chat` gets the same extraction over OpenAI-compatible
+ * `/chat/completions` instead (see extractOpenAiCompatible below).
  *
  * Why not the OpenAI-compatible `/v1/chat/completions` path the rest of llm-parse uses?
  * Ollama's `/v1` endpoint does NOT faithfully honour OpenAI's `response_format:{json_schema,strict}`
@@ -12,7 +14,9 @@
  */
 import { readEnv } from '../../../app-config';
 import { safeFetchLlm } from '../../../utils/ssrfGuard';
+import { OpenAiCompatibleClient } from '../clients/openai-compatible.client';
 import { parseLenientJson } from '../lenient-json';
+import type { LlmExtractionFile } from '../llm-provider.interface';
 
 export interface EnforcedExtractInput {
   /** Ollama base URL — accepts the addon's `…/v1` form; the `/v1` suffix is stripped. */
@@ -40,6 +44,13 @@ export function toNativeBase(baseUrl: string): string {
   return baseUrl.slice(0, end).replace(/\/v1$/, '');
 }
 
+/**
+ * The answers that say the server has no `/api/chat` at all, unless the body is
+ * Ollama's own 404 for a model it has not pulled (OLLAMA_MISSING_MODEL).
+ */
+const NOT_OLLAMA_STATUSES = new Set([404, 405, 501]);
+const OLLAMA_MISSING_MODEL = /\bmodel\b.*\bnot found\b/i;
+
 /**
  * Run one schema-constrained chat completion against Ollama's native `/api/chat`.
  * Returns the parsed JSON object (constrained to `schema`), or null if the request
@@ -85,10 +96,61 @@ export async function extractEnforced(input: EnforcedExtractInput): Promise<Reco
 
   if (!res.ok) {
     const detail = await res.text().catch(() => '');
+    if (NOT_OLLAMA_STATUSES.has(res.status) && !OLLAMA_MISSING_MODEL.test(detail))
+      return extractOpenAiCompatible(input);
     throw new Error(`Ollama /api/chat failed (${res.status}): ${detail.slice(0, 200)}`);
   }
 
-  const data = (await res.json()) as { message?: { content?: string } };
+  const data = (await res.json().catch(() => null)) as { message?: { content?: string } } | null;
+  // LM Studio answers a path it does not serve with 200 and an error object,
+  // so an answer without Ollama's `message` is a server of another kind too.
+  if (!data || typeof data.message !== 'object') return extractOpenAiCompatible(input);
   const parsed = parseLenientJson(data.message?.content);
   return parsed && typeof parsed === 'object' ? (parsed as Record<string, unknown>) : null;
 }
+
+/**
+ * The same extraction against an OpenAI-compatible server (Groq, vLLM,
+ * LM Studio, a LiteLLM proxy), which the "Own server" connection also names.
+ * It goes to `/chat/completions` at the address as entered, the endpoint the
+ * assistant chats on, through the client that already handles what such
+ * servers refuse (`json_schema`, `max_tokens`, `temperature`). The schema is
+ * asked for as a one-element list, the shape that client reads (#2806).
+ */
+async function extractOpenAiCompatible(input: EnforcedExtractInput): Promise<Record<string, unknown> | null> {
+  const [file, ...pageImages] = (input.images ?? []).map(imageFile);
+  const list = await new OpenAiCompatibleClient().extract({
+    // The shape goes into the prompt as well: the client's later rungs send no
+    // schema (json_object, then nothing), and json_object wants the word JSON.
+    prompt:
+      `${input.system} Answer with JSON only, as {"result": [object]} where the object follows this ` +
+      `JSON Schema: ${JSON.stringify(input.schema)}`,
+    jsonSchema: {
+      type: 'object',
+      properties: { result: { type: 'array', items: input.schema } },
+      required: ['result'],
+    },
+    rootKey: 'result',
+    userText: input.user,
+    model: input.model,
+    baseUrl: input.baseUrl,
+    apiKey: input.apiKey,
+    file,
+    pageImages,
+  });
+  const first = list[0];
+  return first && typeof first === 'object' ? first : null;
+}
+
+/** The first characters of a base64 image, per type. Anything else is sent as JPEG. */
+const IMAGE_PREFIXES: [string, string][] = [
+  ['iVBOR', 'image/png'],
+  ['UklGR', 'image/webp'],
+  ['R0lGOD', 'image/gif'],
+];
+
+/** A base64 image as a file, its type read from its first bytes. */
+function imageFile(base64: string): LlmExtractionFile {
+  const mimeType = IMAGE_PREFIXES.find(([prefix]) => base64.startsWith(prefix))?.[1] ?? 'image/jpeg';
+  return { mimeType, data: Buffer.from(base64, 'base64') };
+}

server/src/nest/places/places.helpers.ts

@@ -86,11 +86,67 @@ export async function reclaimPhotoCache(
 
 export interface DedupSet {
   names: Set<string>;
+  /**
+   * The places with a line, keyed by name and course (`trackKey`): a track to import
+   * matches only these (#2810), and only one that runs the same way (#2870). Absent
+   * where none is read.
+   */
+  tracks?: Set<string>;
   coords: Array<{ lat: number; lng: number }>;
   /** Provider ids (google_place_id, google_ftid, osm_id, amap_poi_id) of the places already in the trip. */
   externalIds: Set<string>;
 }
 
+/**
+ * A candidate for the dedup set; `track` when it is a line (a GPX track or route, a
+ * KML path), with that line in `routeGeometry`.
+ */
+export type DedupCandidate = PlaceMatchCandidate & { track?: boolean; routeGeometry?: string | null };
+
+/**
+ * Where a line starts, ends and how far it reaches, to about a hundred metres: two
+ * hikes a watch names alike ("Afternoon Hike") differ here, while the same file read
+ * again gives the same answer however its points were rounded or thinned. Empty for
+ * a line that does not parse.
+ */
+function lineCourse(routeGeometry: string | null | undefined): string {
+  let points: unknown;
+  try {
+    points = JSON.parse(routeGeometry ?? '');
+  } catch {
+    return '';
+  }
+  if (!Array.isArray(points)) return '';
+  const line = points.filter(
+    (p): p is [number, number] => Array.isArray(p) && Number.isFinite(p[0]) && Number.isFinite(p[1]),
+  );
+  if (line.length === 0) return '';
+  // A loop rather than Math.min(...): a recorded day holds more points than a call takes arguments.
+  let [south, west] = line[0];
+  let [north, east] = line[0];
+  for (const [lat, lng] of line) {
+    south = Math.min(south, lat);
+    north = Math.max(north, lat);
+    west = Math.min(west, lng);
+    east = Math.max(east, lng);
+  }
+  const [first, last] = [line[0], line[line.length - 1]];
+  return [first[0], first[1], last[0], last[1], south, west, north, east].map((v) => v.toFixed(3)).join(',');
+}
+
+/** An imported row as the dedup set reads it: a line when it carries one. */
+export function lineCandidate(
+  name: string | null | undefined,
+  row: { lat: number | null; lng: number | null; routeGeometry?: string | null },
+): DedupCandidate {
+  return { name, lat: row.lat, lng: row.lng, track: !!row.routeGeometry, routeGeometry: row.routeGeometry };
+}
+
+/** A track's entry in `DedupSet.tracks`: its normalized name and its course. */
+function trackKey(name: string, routeGeometry: string | null | undefined): string {
+  return `${name}\u0000${lineCourse(routeGeometry)}`;
+}
+
 /**
  * Returns true if a candidate place is already represented in the dedup set.
  *
@@ -104,12 +160,19 @@ export interface DedupSet {
  * JavaScript's is not, and only unnamed rows contribute coordinates to a dedup
  * set. `findDuplicatePlace` spells out where the two still answer differently.
  */
-export function isPlaceDuplicate(candidate: PlaceMatchCandidate, dedup: DedupSet): boolean {
+export function isPlaceDuplicate(candidate: DedupCandidate, dedup: DedupSet): boolean {
   for (const strategy of placeMatchStrategies(candidate)) {
     if (strategy.by === 'externalId') {
       if (dedup.externalIds.has(strategy.id)) return true;
     } else if (strategy.by === 'name') {
-      if (dedup.names.has(strategy.name)) return true;
+      // A track is the same as a track of that name that runs the same way, never as a
+      // sight of that name: a watch names a hike after the place it went to (#2810), and
+      // two hikes of one day alike (#2870).
+      if (candidate.track) {
+        if (dedup.tracks?.has(trackKey(strategy.name, candidate.routeGeometry))) return true;
+      } else if (dedup.names.has(strategy.name)) {
+        return true;
+      }
     } else if (
       dedup.coords.some(
         (c) =>
@@ -130,29 +193,34 @@ export function isPlaceDuplicate(candidate: PlaceMatchCandidate, dedup: DedupSet
  */
 export function dedupSetOf(
   rows: ReadonlyArray<
-    { name: string | null; lat: number | null; lng: number | null } & Parameters<typeof externalIdsOf>[0]
+    { name: string | null; lat: number | null; lng: number | null; route_geometry?: string | null } & Parameters<
+      typeof externalIdsOf
+    >[0]
   >,
 ): DedupSet {
   const names = new Set<string>();
+  const tracks = new Set<string>();
   const coords: Array<{ lat: number; lng: number }> = [];
   const externalIds = new Set<string>();
   for (const row of rows) {
     for (const id of externalIdsOf(row)) externalIds.add(id);
     if (row.name) {
       names.add(row.name.trim().toLowerCase());
+      if (row.route_geometry) tracks.add(trackKey(row.name.trim().toLowerCase(), row.route_geometry));
     } else if (row.lat != null && row.lng != null) {
       coords.push({ lat: row.lat, lng: row.lng });
     }
   }
-  return { names, coords, externalIds };
+  return { names, tracks, coords, externalIds };
 }
 
 /** Record a newly inserted place so subsequent candidates in the same batch are checked against it. */
-export function trackInsertedInDedupSet(place: PlaceMatchCandidate, dedup: DedupSet): void {
+export function trackInsertedInDedupSet(place: DedupCandidate, dedup: DedupSet): void {
   for (const id of externalIdsOf(place)) dedup.externalIds.add(id);
   const normalizedName = normalizePlaceName(place.name);
   if (normalizedName) {
     dedup.names.add(normalizedName);
+    if (place.track) (dedup.tracks ??= new Set()).add(trackKey(normalizedName, place.routeGeometry));
   } else if (place.lat != null && place.lng != null) {
     dedup.coords.push({ lat: place.lat, lng: place.lng });
   }

server/src/nest/places/places.service.ts

@@ -58,7 +58,7 @@ import {
   buildCategoryNameLookup,
   escapeLikePattern,
   dedupSetOf,
-  isPlaceDuplicate,
+  isPlaceDuplicate, lineCandidate,
   mapWithConcurrency,
   pickEnrichmentMatch,
   reclaimPhotoCache,
@@ -758,7 +758,7 @@ export class PlacesService {
   async gpxDuplicates(tripId: string, rows: PreparedGpxPlace[]): Promise<boolean[]> {
     const dedup = await this.buildDedupSet(tripId);
     return rows.map((wp) => {
-      const candidate = { name: wp.name, lat: wp.lat, lng: wp.lng };
+      const candidate = lineCandidate(wp.name, wp);
       if (isPlaceDuplicate(candidate, dedup)) return true;
       trackInsertedInDedupSet(candidate, dedup);
       return false;
@@ -925,7 +925,7 @@ export class PlacesService {
     // `findWithTagsAndRatings` INSIDE the caller's transaction, so the read
     // sees the still-uncommitted row.
     for (const wp of waypoints) {
-      if (isPlaceDuplicate({ name: wp.name, lat: wp.lat, lng: wp.lng }, dedup)) {
+      if (isPlaceDuplicate(lineCandidate(wp.name, wp), dedup)) {
         skipped++;
         continue;
       }
@@ -960,7 +960,7 @@ export class PlacesService {
       });
       const place = (await this.placesRepo.findWithTagsAndRatings(placeId))!;
       created.push(place);
-      trackInsertedInDedupSet({ name: wp.name, lat: wp.lat, lng: wp.lng }, dedup);
+      trackInsertedInDedupSet(lineCandidate(wp.name, wp), dedup);
     }
 
     return { places: created, count: created.length, skipped };
@@ -1033,7 +1033,7 @@ export class PlacesService {
         const fallbackName = `Placemark ${fallbackIndex}`;
         const name = parsedPlacemark.name || fallbackName;
 
-        if (isPlaceDuplicate({ name, lat: parsedPlacemark.lat, lng: parsedPlacemark.lng }, dedup)) {
+        if (isPlaceDuplicate(lineCandidate(name, parsedPlacemark), dedup)) {
           summary.skippedCount += 1;
           dupCount++;
           fallbackIndex += 1;
@@ -1079,7 +1079,7 @@ export class PlacesService {
 
         const place = (await this.placesRepo.findWithTagsAndRatings(placeId))!;
         created.push(place);
-        trackInsertedInDedupSet({ name, lat: parsedPlacemark.lat, lng: parsedPlacemark.lng }, dedup);
+        trackInsertedInDedupSet(lineCandidate(name, parsedPlacemark), dedup);
         summary.createdCount += 1;
         fallbackIndex += 1;
       }

server/src/nest/plugins/install/host-compat.ts

@@ -126,18 +126,98 @@ export interface TrekRangeBypass {
   /** The plugin's declared range, or null when it declared none at all. */
   trekRange: string | null;
   hostVersion: string;
+  /**
+   * True when an admin accepted this one plugin outside its range, false when
+   * TREK_PLUGINS_IGNORE_TREK_RANGE lets every plugin through.
+   */
+  acceptedByAdmin: boolean;
+}
+
+/** An admin's consent to run one plugin outside its range, as the plugins row keeps it. */
+interface TrekRangeAcceptance {
+  /** The plugin version that was installed when the admin accepted. */
+  acceptedVersion: string | null;
+  /** The TREK version it ran on then. */
+  acceptedHost: string | null;
 }
 
 /**
- * Non-null exactly when `range` would have been refused and only the bypass lets it
- * through: the marker that makes an install/activate response say "this worked, but
- * only because you told TREK to ignore the version check". Null for a normal install
- * (the range fits) and null when the bypass is off (the gate refuses instead).
+ * Whether an admin's consent still covers the plugin as it is installed now: the
+ * same plugin version, on the same TREK major. An update of the plugin, or a TREK
+ * major past the one the admin saw it run on, asks again.
  */
-export function bypassedRange(range: string | null | undefined): TrekRangeBypass | null {
+export function acceptanceHolds(
+  pluginVersion: string | null | undefined,
+  a: TrekRangeAcceptance | null | undefined,
+): boolean {
+  if (!a?.acceptedVersion || !a.acceptedHost || !pluginVersion) return false;
+  if (a.acceptedVersion !== pluginVersion) return false;
+  const accepted = semver.coerce(a.acceptedHost);
+  const host = normalizedHost();
+  if (!accepted || host === null) return false;
+  return semver.major(accepted) === semver.major(host);
+}
+
+/**
+ * Non-null exactly when `range` would have been refused and only a bypass lets it
+ * through: the marker that makes an install/activate response say "this worked, but
+ * only because you told TREK to run it anyway". `accepted` is this one plugin's
+ * consent from the admin; the environment switch covers every plugin. Null for a
+ * normal install (the range fits) and null when neither applies (the gate refuses).
+ */
+export function bypassedRange(range: string | null | undefined, accepted = false): TrekRangeBypass | null {
   if (hostSatisfies(range)) return null;
-  if (!trekRangeBypassed()) return null;
-  return { trekRange: range ?? null, hostVersion: hostVersion() };
+  const everyPlugin = trekRangeBypassed();
+  if (!everyPlugin && !accepted) return null;
+  return { trekRange: range ?? null, hostVersion: hostVersion(), acceptedByAdmin: !everyPlugin };
+}
+
+/** What the activation gate reads off a plugin's row to decide whether it may run on this TREK. */
+interface TrekRangeRow {
+  trek_range: string | null;
+  version: string | null;
+  trek_range_accepted_version: string | null;
+  trek_range_accepted_host: string | null;
+}
+
+/** Why the activation gate refuses a plugin on this TREK, in the shape its error carries. */
+interface TrekRangeRefusal {
+  message: string;
+  code: 'TREK_VERSION_UNKNOWN' | 'TREK_VERSION_INCOMPATIBLE';
+  detail: { trekRange: string | null; hostVersion: string };
+}
+
+/**
+ * The TREK-version half of the activation gate: null when the plugin may run, else why
+ * not. An admin's consent (`acceptNow`, or one kept on the row for this version and TREK
+ * major) or TREK_PLUGINS_IGNORE_TREK_RANGE lets an outgrown plugin through, and every
+ * start of one says so in the log; the plugin list carries the same marker for the UI.
+ */
+export function trekRangeRefusal(id: string, row: TrekRangeRow, acceptNow = false): TrekRangeRefusal | null {
+  const accepted =
+    acceptNow ||
+    acceptanceHolds(row.version, {
+      acceptedVersion: row.trek_range_accepted_version,
+      acceptedHost: row.trek_range_accepted_host,
+    });
+  const bypass = bypassedRange(row.trek_range, accepted);
+  if (bypass) {
+    warnRangeBypass(id, bypass);
+    return null;
+  }
+  if (!row.trek_range) {
+    return {
+      message: `plugin ${id} does not declare which TREK versions it supports`,
+      code: 'TREK_VERSION_UNKNOWN',
+      detail: { trekRange: null, hostVersion: hostVersion() },
+    };
+  }
+  if (hostSatisfies(row.trek_range)) return null;
+  return {
+    message: `plugin ${id} requires TREK ${row.trek_range} — this is TREK ${hostVersion()}`,
+    code: 'TREK_VERSION_INCOMPATIBLE',
+    detail: { trekRange: row.trek_range, hostVersion: hostVersion() },
+  };
 }
 
 /**
@@ -147,7 +227,8 @@ export function bypassedRange(range: string | null | undefined): TrekRangeBypass
  */
 export function warnRangeBypass(id: string, b: TrekRangeBypass): void {
   const declared = b.trekRange ? `declares TREK ${b.trekRange}` : 'declares no TREK version range';
+  const because = b.acceptedByAdmin ? 'an admin chose to run it anyway' : 'TREK_PLUGINS_IGNORE_TREK_RANGE is set';
   console.warn(
-    `[plugins] ${id} ${declared} — this is TREK ${b.hostVersion}; continuing because TREK_PLUGINS_IGNORE_TREK_RANGE is set. The author has not verified it on this version: it may not work, and it could corrupt TREK data.`,
+    `[plugins] ${id} ${declared} — this is TREK ${b.hostVersion}; continuing because ${because}. The author has not verified it on this version: it may not work, and it could corrupt TREK data.`,
   );
 }

server/src/nest/plugins/plugin-runtime.service.ts

@@ -62,7 +62,7 @@ import { scanForNativeBinaries } from './install/native-scan';
 import { devLinkEnabled, DEV_LINK_SOURCE } from './dev-link';
 import { pluginCodeDir, pluginDataDir } from './paths';
 import { assertHostCompatible, PluginRegistryService, RegistryError } from './registry/registry.service';
-import { hostSatisfies, hostVersion, bypassedRange, warnRangeBypass } from './install/host-compat';
+import { hostSatisfies, hostVersion, trekRangeRefusal } from './install/host-compat';
 import type { TrekRangeBypass } from './install/host-compat';
 import { keyFingerprint } from './signature-status';
 import { AuditService } from '../audit/audit.service';
@@ -639,8 +639,10 @@ export class PluginRuntimeService implements OnApplicationBootstrap, OnModuleDes
    * freshly-installed plugin (no prior grant) is itself the consent for its
    * declared set; widening an already-consented set requires `consentWiden` (the
    * update consent dialog), and otherwise throws PluginConsentRequired.
+   * `acceptTrekRange` is the admin's "run it anyway" outside the TREK range the author
+   * declared: for this plugin only, never a dependency, kept on its row for this version.
    */
-  async activate(id: string, consentWiden = false): Promise<void> {
+  async activate(id: string, consentWiden = false, acceptTrekRange = false): Promise<void> {
     const installed = await this.installedDepRows();
     // Deps-first order over the installed graph (throws DependencyCycleError on a
     // cycle). Missing deps aren't in `installed` so they don't appear here — the
@@ -652,6 +654,7 @@ export class PluginRuntimeService implements OnApplicationBootstrap, OnModuleDes
     // blocked dependency never leaves the chain half-activated. Only the target
     // may consent-widen; dependencies are auto-enabled at their existing grant.
     const toCheck = rootInstalled ? order : [id];
+    if (acceptTrekRange) await this.rememberRangeAcceptance(id);
     for (const nodeId of toCheck) await this.assertActivatable(nodeId, installed, nodeId === id ? consentWiden : false);
 
     // Enable dependencies first (skip ones already enabled), then the target.
@@ -661,6 +664,16 @@ export class PluginRuntimeService implements OnApplicationBootstrap, OnModuleDes
     }
   }
 
+  /**
+   * Keeps the admin's "run it anyway" for the installed version, when it is in fact outside its range.
+   * @txStandalone the admin's answer to a dialog; it stands whether or not the plugin then starts.
+   */
+  private async rememberRangeAcceptance(id: string): Promise<void> {
+    const row = await this.plugins.findActivationGate(id);
+    if (!row?.version || hostSatisfies(row.trek_range)) return;
+    await this.plugins.acceptTrekRange(id, row.version, hostVersion());
+  }
+
   /** All plugin rows projected to what the dependency helpers reason over. */
   private async installedDepRows(): Promise<Map<string, PluginDepRow>> {
     const rows: PluginDepRow[] = await this.plugins.listDepRows();
@@ -682,24 +695,8 @@ export class PluginRuntimeService implements OnApplicationBootstrap, OnModuleDes
     // it would not make the plugin start. It is also the gate that catches the case
     // install can't — TREK was upgraded PAST the plugin's declared upper bound, so code
     // that was legitimately installed no longer supports the host it's sitting on.
-    const bypass = bypassedRange(row.trek_range);
-    if (bypass) {
-      // TREK_PLUGINS_IGNORE_TREK_RANGE: the operator chose to run it anyway. Say so in the
-      // log every time it starts — the plugin list carries the same marker for the UI.
-      warnRangeBypass(id, bypass);
-    } else if (!row.trek_range) {
-      throw new PluginDependencyError(
-        `plugin ${id} does not declare which TREK versions it supports`,
-        'TREK_VERSION_UNKNOWN',
-        { trekRange: null, hostVersion: hostVersion() },
-      );
-    } else if (!hostSatisfies(row.trek_range)) {
-      throw new PluginDependencyError(
-        `plugin ${id} requires TREK ${row.trek_range} — this is TREK ${hostVersion()}`,
-        'TREK_VERSION_INCOMPATIBLE',
-        { trekRange: row.trek_range, hostVersion: hostVersion() },
-      );
-    }
+    const refusal = trekRangeRefusal(id, row);
+    if (refusal) throw new PluginDependencyError(refusal.message, refusal.code, refusal.detail);
     // Same reasoning as the TREK-version gate above: a plugin whose manifest apiVersion
     // outpaces this TREK's plugin-API surface can never run correctly, so it must be
     // refused before any consent dialog is offered.

server/src/nest/plugins/plugins.controller.ts

@@ -113,8 +113,15 @@ export class PluginsController {
       // compatible version and reporting addons the admin still has to enable.
       // Dependency resolution pins versions internally but never DELIBERATELY, so
       // only the plain path below recomputes the update hold.
-      if (body.withDependencies) return await this.registry.installWithDependencies(body.id, body.constraint);
-      const res = await this.registry.install(body.id, { version: body.version, constraint: body.constraint });
+      const acceptTrekRange = body.acceptTrekRange === true;
+      if (body.withDependencies) {
+        return await this.registry.installWithDependencies(body.id, body.constraint, acceptTrekRange);
+      }
+      const res = await this.registry.install(body.id, {
+        version: body.version,
+        constraint: body.constraint,
+        acceptTrekRange,
+      });
       await this.registry.recomputeUpdateHold(res.id, res.version, !!body.version);
       return res;
     } catch (e) {
@@ -272,7 +279,7 @@ export class PluginsController {
   async activate(@Param('id') id: string, @Body() body: PluginActivateDto) {
     if (!pluginsEnabled()) throw new HttpException({ error: 'Plugins are disabled by server configuration' }, 503);
     try {
-      await this.runtime.activate(id, !!body?.consent);
+      await this.runtime.activate(id, !!body?.consent, body?.acceptTrekRange === true);
     } catch (e) {
       // Re-enabling a plugin whose update widened its permissions must NOT grant
       // them silently — surface a distinct code so the UI opens the consent dialog.

server/src/nest/plugins/plugins.service.ts

@@ -25,7 +25,7 @@ import {
 import { devLinkEnabled } from './dev-link';
 import { readAudit } from './host/plugin-audit';
 import { pluginBudgetUsage } from './host/plugin-host-state';
-import { bypassedRange, hostSatisfies, hostVersion, trekRangeBypassed } from './install/host-compat';
+import { acceptanceHolds, bypassedRange, hostSatisfies, hostVersion, trekRangeBypassed } from './install/host-compat';
 import type { TrekRangeBypass } from './install/host-compat';
 import type { PluginDependency } from './install/manifest';
 import { pluginsEnabled } from './kill-switch';
@@ -71,6 +71,8 @@ interface PluginRawRow {
   capabilities: string;
   dependencies: string | null;
   trek_range: string | null;
+  trek_range_accepted_version: string | null;
+  trek_range_accepted_host: string | null;
   author_pubkey: string | null;
   update_block_code: string | null;
   update_block_detail: string | null;
@@ -113,9 +115,10 @@ export interface PluginListItem {
   /** The running TREK, so the UI can say "needs X, you have Y" without doing semver. */
   hostVersion: string;
   /**
-   * Non-null when the plugin is outside its declared range (or declared none) and only
-   * TREK_PLUGINS_IGNORE_TREK_RANGE lets it activate. The card shows it as a warning
-   * rather than a blocker: the admin chose this, but must keep seeing what they chose.
+   * Non-null when the plugin is outside its declared range (or declared none) and only an
+   * admin's "run it anyway" for this plugin, or TREK_PLUGINS_IGNORE_TREK_RANGE, lets it
+   * activate. The card shows it as a warning rather than a blocker: the admin chose this,
+   * but must keep seeing what they chose.
    */
   trekRangeBypassed: TrekRangeBypass | null;
   /** The concrete blockers, so the UI can render chips + the resolve dialog. */
@@ -200,7 +203,13 @@ export class PluginsService {
       const state = resolveDependencyState(deps, installed);
       // Mirrors the order of assertActivatable's gate, so the card explains the same
       // blocker the activate call would hit rather than a second, lesser one.
-      const trekBypass = bypassedRange(r.trek_range);
+      const trekBypass = bypassedRange(
+        r.trek_range,
+        acceptanceHolds(r.version, {
+          acceptedVersion: r.trek_range_accepted_version,
+          acceptedHost: r.trek_range_accepted_host,
+        }),
+      );
       const dependencyStatus: PluginDependencyStatus =
         !hostSatisfies(r.trek_range) && !trekBypass
           ? 'hostIncompatible'
@@ -213,6 +222,8 @@ export class PluginsService {
         dependencies: _raw,
         operator_egress: _oe,
         trek_range,
+        trek_range_accepted_version: _acceptedVersion,
+        trek_range_accepted_host: _acceptedHost,
         author_pubkey,
         update_block_code,
         update_block_detail,

server/src/nest/plugins/registry/registry.service.ts

@@ -392,11 +392,11 @@ export class PluginRegistryService {
    * version (`minTrekVersion`/`maxTrekVersion`). Throws if the plugin isn't in the
    * registry or nothing qualifies. Backs "download the latest compatible version".
    */
-  async resolveVersion(id: string, constraint?: string): Promise<RegistryVersion> {
+  async resolveVersion(id: string, constraint?: string, acceptTrekRange = false): Promise<RegistryVersion> {
     const reg = await this.fetchRegistry();
     const entry = reg.plugins.find((p) => p.id === id);
     if (!entry) throw new RegistryError(`plugin ${id} not in registry`);
-    const v = this.latestCompatible(entry, constraint);
+    const v = this.latestCompatible(entry, constraint) ?? (acceptTrekRange ? this.newestOf(entry, constraint) : null);
     if (!v) {
       throw new RegistryError(
         constraint
@@ -427,6 +427,15 @@ export class PluginRegistryService {
     return [...candidates].sort((a, b) => semver.rcompare(a.version, b.version))[0];
   }
 
+  /**
+   * The newest version that satisfies `constraint`, whatever TREK it declares: what an
+   * admin's "install anyway" takes when no version fits this TREK. A version that does
+   * fit is always preferred over this (see {@link selectVersion}).
+   */
+  private newestOf(entry: RegistryEntry, constraint?: string): RegistryVersion | null {
+    return this.latestCompatible(entry, constraint, () => true);
+  }
+
   /**
    * Pick the version `install()` will fetch, and refuse an incompatible one — on EVERY
    * path, which is the whole point. An explicit `version` and the bare "install latest"
@@ -434,11 +443,15 @@ export class PluginRegistryService {
    * through resolveVersion), so the admin UI's own Install button — which sends neither —
    * happily installed a plugin that declared it doesn't support this TREK.
    */
-  private selectVersion(entry: RegistryEntry, opts?: { version?: string; constraint?: string }): RegistryVersion {
+  private selectVersion(
+    entry: RegistryEntry,
+    opts?: { version?: string; constraint?: string; acceptTrekRange?: boolean },
+  ): RegistryVersion {
+    const accept = opts?.acceptTrekRange === true;
     if (opts?.version) {
       const ver = entry.versions.find((v) => v.version === opts.version);
       if (!ver) throw new RegistryError(`version ${opts.version} not found for ${entry.id}`);
-      if (!installable(ver, normalizedHost())) {
+      if (!accept && !installable(ver, normalizedHost())) {
         throw new RegistryError(
           `${entry.id} ${ver.version} requires TREK ${trekRequirement(ver)} — this is TREK ${hostVersion()}`,
           'TREK_VERSION_INCOMPATIBLE',
@@ -446,7 +459,8 @@ export class PluginRegistryService {
       }
       return ver;
     }
-    const ver = this.latestCompatible(entry, opts?.constraint);
+    const ver =
+      this.latestCompatible(entry, opts?.constraint) ?? (accept ? this.newestOf(entry, opts?.constraint) : null);
     if (ver) return ver;
     // Nothing compatible. Say WHY against the newest version the admin was actually
     // shown, rather than a bare "not found" — the fix is a TREK upgrade, not a retry.
@@ -476,7 +490,7 @@ export class PluginRegistryService {
    */
   async install(
     id: string,
-    opts?: { version?: string; constraint?: string; retrustKey?: string },
+    opts?: { version?: string; constraint?: string; retrustKey?: string; acceptTrekRange?: boolean },
   ): Promise<{ id: string; version: string; trekRangeBypassed: TrekRangeBypass | null }> {
     const reg = await this.fetchRegistry();
     const entry = reg.plugins.find((p) => p.id === id);
@@ -518,7 +532,7 @@ export class PluginRegistryService {
       // published entries usually carry a lower bound and no upper one at all, so a
       // plugin that declares "<4.0.0" passes the pre-download filter on TREK 4 and is
       // caught only here.
-      const trekRangeBypassed = assertHostCompatible(manifest.trekRange, id);
+      const trekRangeBypassed = assertHostCompatible(manifest.trekRange, id, opts?.acceptTrekRange === true);
       if (scanForNativeBinaries(pluginRoot).length) throw new RegistryError('artifact contains native binaries');
 
       // 6. atomic move into place
@@ -543,6 +557,9 @@ export class PluginRegistryService {
         // The plugin is now on new code that passed every check — whatever refusal was
         // recorded before no longer describes reality.
         await clearUpdateBlock(this.plugins, id);
+        // The admin's "install anyway" for this plugin, kept for the version that landed
+        // so activating it later does not ask a second time.
+        if (trekRangeBypassed?.acceptedByAdmin) await this.plugins.acceptTrekRange(id, ver.version, hostVersion());
       });
       return { id, version: ver.version, trekRangeBypassed };
     } finally {
@@ -560,6 +577,7 @@ export class PluginRegistryService {
   async installWithDependencies(
     id: string,
     constraint?: string,
+    acceptTrekRange = false,
   ): Promise<{ installed: string[]; requiredAddons: string[]; trekRangeBypassed: TrekRangeBypass | null }> {
     let trekRangeBypassed: TrekRangeBypass | null = null;
     const installedNow = new Set(await this.plugins.listAllIds());
@@ -570,12 +588,14 @@ export class PluginRegistryService {
     const visit = async (pid: string, range: string | undefined, stack: string[]): Promise<void> => {
       if (done.has(pid)) return;
       if (stack.includes(pid)) throw new RegistryError(`plugin dependency cycle: ${[...stack, pid].join(' -> ')}`);
-      const ver = await this.resolveVersion(pid, range); // throws if not in registry / unsatisfiable
+      // The admin's "install anyway" covers the plugin they asked for, never a dependency.
+      const acceptHere = acceptTrekRange && pid === id;
+      const ver = await this.resolveVersion(pid, range, acceptHere); // throws if not in registry / unsatisfiable
       if (!installedNow.has(pid)) {
         // Install the version we just RESOLVED. Passing the range back (or nothing, for
         // the root) made install() re-pick on its own and land on entry.versions[0] —
         // so the compatible version resolveVersion had chosen was computed and discarded.
-        const res = await this.install(pid, { version: ver.version });
+        const res = await this.install(pid, { version: ver.version, acceptTrekRange: acceptHere });
         // The admin asked for the root; that is the bypass they are warned about (a
         // dependency's own bypass still lands in the log).
         if (pid === id) trekRangeBypassed = res.trekRangeBypassed;
@@ -817,13 +837,14 @@ function installable(v: RegistryVersion, host: string | null): boolean {
  * every install front door (registry, sideload, dev-link) so they all fail the same way,
  * with a code the admin UI can act on rather than prose it would have to string-match.
  *
- * Under TREK_PLUGINS_IGNORE_TREK_RANGE the refusal becomes a log warning, and the
- * returned marker is what the front door hands back so the admin is told too. Null
- * means the range fits and nothing was bypassed.
+ * Under TREK_PLUGINS_IGNORE_TREK_RANGE, or when the admin `accepted` this one plugin
+ * outside its range, the refusal becomes a log warning, and the returned marker is what
+ * the front door hands back so the admin is told too. Null means the range fits and
+ * nothing was bypassed.
  */
-export function assertHostCompatible(range: string | null, id: string): TrekRangeBypass | null {
+export function assertHostCompatible(range: string | null, id: string, accepted = false): TrekRangeBypass | null {
   if (hostSatisfies(range)) return null;
-  const bypass = bypassedRange(range);
+  const bypass = bypassedRange(range, accepted);
   if (bypass) {
     warnRangeBypass(id, bypass);
     return bypass;

server/src/nest/tours/tour-activities.helpers.ts

@@ -70,7 +70,10 @@ export function activityFacts(
 }
 
 /** The times an import stores for a track, as the DATETIME columns hold them; NULL without. */
-function storedTimes(row: PreparedGpxPlace | undefined): { started: DbTimestamp | null; ended: DbTimestamp | null } {
+export function recordedTimesOf(row: PreparedGpxPlace | undefined): {
+  started: DbTimestamp | null;
+  ended: DbTimestamp | null;
+} {
   const times = row?.trackTimes;
   return times
     ? { started: dbNow(new Date(times.startedAt)), ended: dbNow(new Date(times.endedAt)) }
@@ -93,7 +96,7 @@ export function trackTimesFor(
       (row, at) => !taken.has(at) && row.name === place.name && row.lat === place.lat && row.lng === place.lng,
     );
     if (index >= 0) taken.add(index);
-    byPlace.set(place.id, storedTimes(rows[index]));
+    byPlace.set(place.id, recordedTimesOf(rows[index]));
   }
   return byPlace;
 }

server/src/nest/tours/tour-file-read.service.ts

@@ -3,6 +3,7 @@ import type { PreparedGpxPlace } from '../place-import/place-import.types';
 import { PlacesService } from '../places/places.service';
 import { readTourFile } from './tour-file-import.helpers';
 import { gpxOfLine, splitGpxTrackPieces } from './tour-file-split.helpers';
+import { tracksToAdopt } from './tour-track-adoption';
 import { computeTourMetrics, parseRouteGeometry } from './tours.helpers';
 import { Injectable } from '@nestjs/common';
 import { TOUR_GPX_TEXT_MAX, type TourFileLeftOut } from '@trek/shared';
@@ -15,7 +16,10 @@ export interface TourFileTrack {
   point_count: number;
   distance_km: number;
   has_heights: boolean;
-  /** A track already in the trip under the same name and start, which the import would skip. */
+  /**
+   * A track already in the trip under the same name and start, which the import would skip. A track
+   * from before Tours under the same name is none: the import takes it over as a tour (#2810).
+   */
   duplicate: boolean;
 }
 
@@ -55,7 +59,9 @@ export class TourFileReadService {
   async read(tripId: number, buffer: Buffer, fileName: string): Promise<TourFileTracks> {
     const { rows, leftOut } = await readTourFile(this.placeImport, buffer, fileName);
     if (rows.length === 0) return { tracks: [], whole: false };
-    const duplicates = await this.places.gpxDuplicates(String(tripId), rows);
+    const found = await this.places.gpxDuplicates(String(tripId), rows);
+    const adopt = tracksToAdopt(rows, await this.places.list(String(tripId), {}));
+    const duplicates = found.map((duplicate, index) => duplicate && !adopt.has(index));
     const extra = leftOut ? { left_out: leftOut } : {};
     if (!isGpxName(fileName)) {
       const tracks = rows.map((row, index) =>

server/src/nest/tours/tour-track-adoption.ts

@@ -0,0 +1,42 @@
+import { normalizePlaceName } from '@trek/shared';
+
+/** A place of the trip as the places list reads it: enough to tell a track that is no tour yet. */
+export interface TripPlaceForAdoption {
+  id: number;
+  name: string;
+  route_geometry?: string | null;
+  tour_place_id?: number | null;
+}
+
+/** A track of the trip a file row takes over: its place and the line it already holds. */
+export interface AdoptedTrack {
+  id: number;
+  route_geometry: string;
+}
+
+/**
+ * The rows of a tour import that take over a track already in the trip, by
+ * row index: a place with a line and no tour yet, under the same name
+ * (trimmed, any case, the duplicate rule's own reading), one place per row
+ * and oldest first. A GPX file imported before Tours existed (4.x) left its
+ * tracks as plain places, and the name alone made every tour import of the
+ * same file a duplicate, with no tour to show for it (#2810).
+ */
+export function tracksToAdopt(
+  rows: ReadonlyArray<{ name: string }>,
+  places: ReadonlyArray<TripPlaceForAdoption>,
+): Map<number, AdoptedTrack> {
+  const byName = new Map<string, AdoptedTrack[]>();
+  for (const place of [...places].sort((a, b) => a.id - b.id)) {
+    const key = normalizePlaceName(place.name);
+    if (!key || !place.route_geometry || place.tour_place_id != null) continue;
+    byName.set(key, [...(byName.get(key) ?? []), { id: place.id, route_geometry: place.route_geometry }]);
+  }
+  const adopt = new Map<number, AdoptedTrack>();
+  rows.forEach((row, index) => {
+    const key = normalizePlaceName(row.name);
+    const track = key ? byName.get(key)?.shift() : undefined;
+    if (track) adopt.set(index, track);
+  });
+  return adopt;
+}

server/src/nest/tours/tours.service.ts

@@ -16,7 +16,7 @@ import { toRowId } from '../common/row-id';
 import { UnitOfWork } from '../database/unit-of-work';
 import { PlaceImportService } from '../place-import/place-import.service';
 import { PlacesService } from '../places/places.service';
-import { toActivity, trackTimesFor } from './tour-activities.helpers';
+import { recordedTimesOf, toActivity, trackTimesFor } from './tour-activities.helpers';
 import {
   copiedFacet,
   copyStart,
@@ -29,6 +29,7 @@ import { readTourFile } from './tour-file-import.helpers';
 import { provenanceSource, tourItemOf } from './tour-item.helpers';
 import { TourPaddleCheckService } from './tour-paddle-check.service';
 import { advanceTourRevision } from './tour-revision';
+import { tracksToAdopt } from './tour-track-adoption';
 import { toVisit } from './tour-visits.service';
 import { checkTourCommand, firstPointOf, importFileName, keyedWaypoints, tourRouteFields } from './tour-write.helpers';
 import { computeTourMetrics, localHashOf, parseRouteGeometry, type GeometryPoint } from './tours.helpers';
@@ -58,6 +59,30 @@ import {
   wandererDifficultyToSac,
 } from '@trek/shared';
 
+/** `fn` over `items` one after the other, in order: the writes of one import share a transaction. */
+async function inOrder<T, R>(items: readonly T[], fn: (item: T) => Promise<R>): Promise<R[]> {
+  return items.reduce<Promise<R[]>>(async (done, item) => [...(await done), await fn(item)], Promise.resolve([]));
+}
+
+/**
+ * What the type adds to each tour a file import makes: a bike tour and a run
+ * their profile, a paddle tour its boat and water, a ski track its discipline
+ * and technique (SKI-02). A run comes in without a pace and a ski track
+ * without a time: neither is worked out for them, so they stay unknown.
+ */
+function importedTypeFields(fields: TourGpxImportFields) {
+  return {
+    bike_profile: fields.bike_profile ?? null,
+    run_profile: fields.run_profile ?? null,
+    run_pace_seconds_per_km: null,
+    ski_discipline: fields.ski_discipline ?? null,
+    ski_technique: fields.ski_technique ?? null,
+    boat_type: fields.boat_type ?? null,
+    water_context: fields.water_context ?? null,
+    paddle_speed_kmh: null,
+  };
+}
+
 export interface ImportGpxAsTourResult {
   tours: TourListItem[];
   caution: boolean;
@@ -783,88 +808,45 @@ export class ToursService {
     const { rows } = await readTourFile(this.placeImport, fileBuffer, fileName);
     if (rows.length === 0) return null;
     await this.assertTourTypeEnabled(fields.tour_type);
-    // What the type adds to each imported tour: a bike tour and a run their profile, a paddle tour its boat and water,
-    // a ski track its discipline and technique (SKI-02). A run comes in without a pace and a ski track without a
-    // time: neither is worked out for them, so they stay unknown.
-    const typeFields = {
-      bike_profile: fields.bike_profile ?? null,
-      run_profile: fields.run_profile ?? null,
-      run_pace_seconds_per_km: null,
-      ski_discipline: fields.ski_discipline ?? null,
-      ski_technique: fields.ski_technique ?? null,
-      boat_type: fields.boat_type ?? null,
-      water_context: fields.water_context ?? null,
-      paddle_speed_kmh: null,
-    };
+    const typeFields = importedTypeFields(fields);
 
+    const adopt = await this.adoptableTracks(tripId, rows);
+    const fresh = rows.filter((_, index) => !adopt.has(index));
     const tours: TourListItem[] = [];
+    const adopted: number[] = [];
     const result = await this.uow.transactional(async () => {
       // A nested transactional, so the places and their facets commit together.
-      const imported = await this.places.importPreparedGpx(tripId, rows);
-      const times = trackTimesFor(rows, imported.places);
-      for (const place of imported.places) {
-        const recorded = times.get(place.id);
-        const metrics = computeTourMetrics(parseRouteGeometry(place.route_geometry));
-        const matchConfidence = metrics.hasElevation ? 1 : 0.3;
-        await this.toursRepo.insertTour({
-          place_id: place.id,
-          tour_type: fields.tour_type,
-          ...typeFields,
-          distance: metrics.distanceKm,
-          elevation_gain: metrics.elevationGainM,
-          elevation_loss: metrics.elevationLossM,
-          duration: null,
-          planned_duration_minutes: null,
-          break_additional_minutes: null,
-          match_confidence: matchConfidence,
-          max_hiking_difficulty: null,
-          origin: 'gpx',
-          origin_file_name: importFileName(fileName),
-          track_started_at: recorded?.started ?? null,
-          track_ended_at: recorded?.ended ?? null,
-        });
-        tours.push(
-          tourItemOf({
-            place_id: place.id,
-            name: place.name,
-            description: place.description ?? null,
-            website: place.website ?? null,
-            tour_type: fields.tour_type,
-            ...typeFields,
-            distance: metrics.distanceKm,
-            elevation_gain: metrics.elevationGainM,
-            elevation_loss: metrics.elevationLossM,
-            duration: null,
-            planned_duration_minutes: null,
-            break_additional_minutes: null,
-            difficulty: null,
-            wanderer_ref: null,
-            match_confidence: matchConfidence,
-            max_hiking_difficulty: null,
-            derived_from_place_id: null,
-            origin: 'gpx',
-            portage_speed_kmh: null,
-            paddle_lake_style: null,
-            track_marks: null,
-            has_recorded_track: 0,
-            planned: 0,
-            has_waypoints: 0,
-            stage_ends: 0,
-            route_missing: 0,
-            revision: 1,
-            hiking_preferences: null,
-            track_started_at: recorded?.started ?? null,
-            track_ended_at: recorded?.ended ?? null,
-          }),
-        );
-      }
+      const imported =
+        fresh.length > 0 ? await this.places.importPreparedGpx(tripId, fresh) : { places: [], count: 0, skipped: 0 };
+      const times = trackTimesFor(fresh, imported.places);
+      tours.push(
+        ...(await inOrder(imported.places, (place) =>
+          this.insertImportedTour(
+            place,
+            place.route_geometry ?? null,
+            times.get(place.id),
+            fields,
+            typeFields,
+            fileName,
+          ),
+        )),
+      );
+      // A track from before Tours keeps its place and its line and becomes the
+      // tour; the file adds the recorded times 4.x never stored.
+      await inOrder([...adopt], async ([index, track]) => {
+        const place = await this.places.get(tripId, String(track.id));
+        if (!place) return;
+        const recorded = recordedTimesOf(rows[index]);
+        tours.push(await this.insertImportedTour(place, track.route_geometry, recorded, fields, typeFields, fileName));
+        adopted.push(place.id);
+      });
       return imported;
     });
 
-    if (result.places.length === 0) return { tours: [], caution: false, skipped: result.skipped };
+    if (tours.length === 0) return { tours: [], caution: false, skipped: result.skipped };
     this.broadcastToursChanged(
       tripId,
-      result.places.map((place) => place.id),
+      tours.map((tour) => tour.place_id),
       socketId,
     );
     for (const place of result.places) {
@@ -874,9 +856,90 @@ export class ToursService {
         this.logger.warn(`Committed GPX place ${place.id}: realtime notification failed`);
       }
     }
+    // The taken-over places now read as tours; the other clients get the row again.
+    await inOrder(adopted, async (id) => {
+      try {
+        const place = await this.places.get(tripId, String(id));
+        if (place) this.places.broadcast(tripId, 'place:updated', { place }, socketId);
+      } catch {
+        this.logger.warn(`Committed GPX tour on place ${id}: realtime notification failed`);
+      }
+    });
     return { tours, caution: tours.some((t) => t.caution), skipped: result.skipped };
   }
 
+  /** Which rows of a file take over a track of the trip from before Tours (#2810), read off the places list. */
+  private async adoptableTracks(tripId: string, rows: ReadonlyArray<{ name: string }>) {
+    return tracksToAdopt(rows, await this.places.list(tripId, {}));
+  }
+
+  /**
+   * The `tours` row for one place of a GPX import, with its metrics read off
+   * `geometry` and the recorded times, and the list item the import answers
+   * with. A new place and a track taken over from before Tours (#2810) get the
+   * same row.
+   */
+  private async insertImportedTour(
+    place: { id: number; name: string; description?: string | null; website?: string | null },
+    geometry: string | null,
+    recorded: ReturnType<typeof recordedTimesOf> | undefined,
+    fields: TourGpxImportFields,
+    typeFields: ReturnType<typeof importedTypeFields>,
+    fileName: string | undefined,
+  ): Promise<TourListItem> {
+    const metrics = computeTourMetrics(parseRouteGeometry(geometry));
+    const matchConfidence = metrics.hasElevation ? 1 : 0.3;
+    await this.toursRepo.insertTour({
+      place_id: place.id,
+      tour_type: fields.tour_type,
+      ...typeFields,
+      distance: metrics.distanceKm,
+      elevation_gain: metrics.elevationGainM,
+      elevation_loss: metrics.elevationLossM,
+      duration: null,
+      planned_duration_minutes: null,
+      break_additional_minutes: null,
+      match_confidence: matchConfidence,
+      max_hiking_difficulty: null,
+      origin: 'gpx',
+      origin_file_name: importFileName(fileName),
+      track_started_at: recorded?.started ?? null,
+      track_ended_at: recorded?.ended ?? null,
+    });
+    return tourItemOf({
+      place_id: place.id,
+      name: place.name,
+      description: place.description ?? null,
+      website: place.website ?? null,
+      tour_type: fields.tour_type,
+      ...typeFields,
+      distance: metrics.distanceKm,
+      elevation_gain: metrics.elevationGainM,
+      elevation_loss: metrics.elevationLossM,
+      duration: null,
+      planned_duration_minutes: null,
+      break_additional_minutes: null,
+      difficulty: null,
+      wanderer_ref: null,
+      match_confidence: matchConfidence,
+      max_hiking_difficulty: null,
+      derived_from_place_id: null,
+      origin: 'gpx',
+      portage_speed_kmh: null,
+      paddle_lake_style: null,
+      track_marks: null,
+      has_recorded_track: 0,
+      planned: 0,
+      has_waypoints: 0,
+      stage_ends: 0,
+      route_missing: 0,
+      revision: 1,
+      hiking_preferences: null,
+      track_started_at: recorded?.started ?? null,
+      track_ended_at: recorded?.ended ?? null,
+    });
+  }
+
   /**
    * PAD-02: what a file would import, read with the import's own parser and
    * duplicate rule and written nowhere. Null when the file holds no track or
@@ -887,6 +950,7 @@ export class ToursService {
     const { rows, leftOut } = await readTourFile(this.placeImport, fileBuffer, fileName);
     if (rows.length === 0) return null;
     const duplicates = await this.places.gpxDuplicates(tripId, rows);
+    const adopt = await this.adoptableTracks(tripId, rows);
     return {
       tracks: rows.map((row, index) => {
         const geometry = parseRouteGeometry(row.routeGeometry);
@@ -900,7 +964,8 @@ export class ToursService {
           elevation_loss_m: metrics.elevationLossM,
           started_at: row.trackTimes?.startedAt ?? null,
           ended_at: row.trackTimes?.endedAt ?? null,
-          duplicate: duplicates[index] ?? false,
+          duplicate: !adopt.has(index) && (duplicates[index] ?? false),
+          ...(adopt.has(index) ? { adopts_track: true } : {}),
         };
       }),
       ...(leftOut ? { left_out: leftOut } : {}),