fix(admin): keep header-style tiles from overflowing their cards (stable) (#1423)

Apply the header-style overflow fix to stable: size the grids from their container width and wrap long translated labels within each card.

.env.example

@@ -4,8 +4,11 @@
 # Environment
 NODE_ENV=production
 
-# JWT Secret (generate with: openssl rand -base64 64)
-JWT_SECRET=your_very_long_random_jwt_secret_here
+# JWT Secret — OPTIONAL. Leave unset and it is auto-generated on first run
+# (Docker: the secrets-init service writes it to a private volume and reuses it
+# across restarts). Set it explicitly only to pin your own value.
+# Generate one with: openssl rand -base64 64
+#JWT_SECRET=your_very_long_random_jwt_secret_here
 
 # Auth cookie Secure flag
 #   unset  - default: follows NODE_ENV (production=true, dev=false)
@@ -38,19 +41,29 @@ JWT_SECRET=your_very_long_random_jwt_secret_here
 # Database Configuration (PostgreSQL)
 DATABASE_CLIENT=pg
 DB_USER=picpeak
+# DB_PASSWORD — OPTIONAL. Leave unset and it is auto-generated on first run
+# (Docker). Set it explicitly to pin your own, e.g. for an external database.
 # IMPORTANT: Avoid $ character in passwords - Docker Compose interprets it as variable substitution
 # If you must use $, escape it as $$ (e.g., Pass$$word instead of Pass$word)
-DB_PASSWORD=your_secure_postgres_password_here
+#DB_PASSWORD=your_secure_postgres_password_here
 DB_NAME=picpeak_prod
 
 # Redis Configuration
+# REDIS_PASSWORD — OPTIONAL. Leave unset and it is auto-generated on first run (Docker).
 # IMPORTANT: Same warning applies - avoid $ or escape as $$
-REDIS_PASSWORD=your_secure_redis_password_here
+#REDIS_PASSWORD=your_secure_redis_password_here
 
-# Admin Account (initial setup)
-ADMIN_USERNAME=admin
-ADMIN_EMAIL=admin@yourdomain.com
-ADMIN_PASSWORD=your_secure_admin_password_here
+# Admin Account (initial setup) — OPTIONAL
+# Leave these unset (default) to create your admin IN THE BROWSER on first run:
+# open /admin and PicPeak shows a setup screen. The one-time setup token is
+# written to data/SETUP_TOKEN with mode 0600 — read it with
+# `docker compose exec backend cat /app/data/SETUP_TOKEN`. It is NOT logged
+# unless that write fails, so it never sits in `docker logs`.
+# Set ADMIN_PASSWORD to auto-create the admin on first boot instead (legacy;
+# credentials written to data/ADMIN_CREDENTIALS.txt).
+#ADMIN_USERNAME=admin
+#ADMIN_EMAIL=admin@yourdomain.com
+#ADMIN_PASSWORD=your_secure_admin_password_here
 
 # Email Configuration
 # For Gmail: use app-specific password
@@ -68,6 +81,16 @@ EMAIL_FROM=noreply@yourdomain.com
 FRONTEND_URL=https://yourdomain.com
 ADMIN_URL=https://yourdomain.com
 
+# Static HTML title + description used for social link previews when the
+# fetcher doesn't trigger the per-event OG endpoint — most notably the
+# WhatsApp Business API and various 3rd-party preview-service caches
+# (#521). Set these to your brand so link previews aren't generic.
+# Substituted into index.html at frontend-container start, so changes
+# take effect on the next `docker compose up -d frontend` — no rebuild
+# required.
+BRAND_TITLE=PicPeak
+BRAND_DESCRIPTION=Photo gallery shared with PicPeak.
+
 # API URL for email assets (logos, images in notification emails)
 # This must be the publicly accessible URL where email recipients can load images.
 # If not set, defaults to http://localhost:3001 which will show broken images in emails.
@@ -97,12 +120,6 @@ UPDATE_CHECK_ENABLED=true
 # Timezone
 TZ=UTC
 
-# Runtime user mapping for Docker (optional)
-# Set these to your host user's UID/GID to avoid permission issues on bind mounts.
-# Run `id -u` and `id -g` on host to get values. Defaults to 1001.
-PUID=1001
-PGID=1001
-
 # Analytics (Optional - Umami)
 VITE_UMAMI_URL=
 VITE_UMAMI_WEBSITE_ID=

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
+
+buy_me_a_coffee: theluap

.github/ISSUE_TEMPLATE/config.yml

@@ -1,11 +1,11 @@
 blank_issues_enabled: false
 contact_links:
   - name: 📚 Documentation
-    url: https://github.com/the-luap/picpeak/blob/main/DEPLOYMENT.md
+    url: https://github.com/PicPeak/picpeak/blob/main/DEPLOYMENT.md
     about: Please read the documentation before opening an issue
   - name: 💬 Discussions
-    url: https://github.com/the-luap/picpeak/discussions
+    url: https://github.com/PicPeak/picpeak/discussions
     about: Ask questions and discuss with the community
   - name: 🔒 Security Issues
-    url: https://github.com/the-luap/picpeak/blob/main/SECURITY.md
+    url: https://github.com/PicPeak/picpeak/blob/main/SECURITY.md
     about: Please review our security policy for reporting vulnerabilities

.github/ISSUE_TEMPLATE/security_vulnerability.md

@@ -9,7 +9,7 @@ assignees: ''
 
 ⚠️ **IMPORTANT: For serious security vulnerabilities, please DO NOT create a public issue.**
 
-Instead, please use [GitHub Private Vulnerability Reporting](https://github.com/the-luap/picpeak/security/advisories/new) or email **info@picpeak.app** with the details.
+Instead, please use [GitHub Private Vulnerability Reporting](https://github.com/PicPeak/picpeak/security/advisories/new) or email **info@picpeak.app** with the details.
 
 For minor security improvements or questions, you can use this template:
 

.github/workflows/README-DOCKER.md

@@ -42,16 +42,16 @@ Once published, images can be pulled using:
 
 ```bash
 # Pull backend image
-docker pull ghcr.io/the-luap/picpeak/backend:latest
+docker pull ghcr.io/picpeak/picpeak/backend:latest
 
 # Pull frontend image
-docker pull ghcr.io/the-luap/picpeak/frontend:latest
+docker pull ghcr.io/picpeak/picpeak/frontend:latest
 
 # Pull specific version
-docker pull ghcr.io/the-luap/picpeak/backend:v1.0.0
+docker pull ghcr.io/picpeak/picpeak/backend:v1.0.0
 
 # Pull for specific architecture
-docker pull --platform linux/arm64 ghcr.io/the-luap/picpeak/backend:latest
+docker pull --platform linux/arm64 ghcr.io/picpeak/picpeak/backend:latest
 ```
 
 ### Using in Docker Compose
@@ -61,14 +61,14 @@ version: '3.8'
 
 services:
   backend:
-    image: ghcr.io/the-luap/picpeak/backend:latest
+    image: ghcr.io/picpeak/picpeak/backend:latest
     environment:
       - NODE_ENV=production
     ports:
       - "3001:3000"
 
   frontend:
-    image: ghcr.io/the-luap/picpeak/frontend:latest
+    image: ghcr.io/picpeak/picpeak/frontend:latest
     ports:
       - "80:80"
 ```
@@ -86,7 +86,7 @@ spec:
     spec:
       containers:
       - name: backend
-        image: ghcr.io/the-luap/picpeak/backend:latest
+        image: ghcr.io/picpeak/picpeak/backend:latest
         imagePullPolicy: Always
 ```
 
@@ -149,8 +149,8 @@ If images aren't visible after successful push:
 ### View Packages
 
 Your Docker images are available at:
-- Backend: `https://github.com/users/the-luap/packages/container/package/picpeak%2Fbackend`
-- Frontend: `https://github.com/users/the-luap/packages/container/package/picpeak%2Ffrontend`
+- Backend: `https://github.com/orgs/PicPeak/packages/container/package/picpeak%2Fbackend`
+- Frontend: `https://github.com/orgs/PicPeak/packages/container/package/picpeak%2Ffrontend`
 
 ### Delete Old Versions
 

.github/workflows/bypass-size-gate.yml

@@ -0,0 +1,70 @@
+name: Bypass size gate
+
+# Caps how large a PR a "review-bypass" collaborator (e.g. @Luca-Timo) can
+# self-merge without a maintainer review. The branch-protection bypass list
+# alone is binary — once a user is on it they can merge anything without
+# review. This workflow reports a REQUIRED status check that fails when a
+# bypass user's PR exceeds the configured size threshold, which blocks the
+# merge even with bypass enabled. Other contributors are unaffected (the
+# check reports success for them so the required-check gate doesn't trip).
+#
+# To tune: edit LINE_LIMIT or BYPASS_USERS below.
+#
+# Trigger note: uses `pull_request_target` so the workflow has the elevated
+# permissions of the base repo's GITHUB_TOKEN (read PR metadata, write
+# checks). The script never executes code FROM the PR — it only reads
+# metadata via the API — so this is safe against fork-PR attacks.
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
+
+permissions:
+  pull-requests: read
+  checks: write
+
+jobs:
+  size-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Compute PR size and report check status
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Tune these two constants if the policy shifts.
+            const LINE_LIMIT = 300;
+            const BYPASS_USERS = ['Luca-Timo'];
+
+            const pr = context.payload.pull_request;
+            const author = pr.user.login;
+            const linesChanged = pr.additions + pr.deletions;
+            const filesChanged = pr.changed_files;
+
+            let conclusion, title, summary;
+
+            if (!BYPASS_USERS.includes(author)) {
+              // Not a bypass user — this gate doesn't apply to them. They
+              // go through normal review. Report success so the required
+              // check doesn't block their merge.
+              conclusion = 'success';
+              title = 'Not applicable';
+              summary = `This gate only restricts review-bypass for: ${BYPASS_USERS.join(', ')}. PRs from other authors (${author} here) go through the normal review path and are unaffected.`;
+            } else if (linesChanged <= LINE_LIMIT) {
+              conclusion = 'success';
+              title = `OK — within bypass limit (${linesChanged} lines)`;
+              summary = `Small PR: ${linesChanged} lines changed across ${filesChanged} file(s). Within the ${LINE_LIMIT}-line self-merge limit for @${author}. Can be merged without a maintainer review.`;
+            } else {
+              conclusion = 'failure';
+              title = `Too large for bypass (${linesChanged} lines)`;
+              summary = `Large PR: ${linesChanged} lines changed across ${filesChanged} file(s). Exceeds the ${LINE_LIMIT}-line self-merge limit for @${author} — needs an approving review from a maintainer before merge. Split into smaller PRs or wait for review.`;
+            }
+
+            await github.rest.checks.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: 'bypass-size-gate',
+              head_sha: pr.head.sha,
+              status: 'completed',
+              conclusion,
+              output: { title, summary }
+            });

.github/workflows/docker-build.yml

@@ -1,17 +1,30 @@
 name: Build and Push Docker Images
 
 # This workflow is triggered by:
-# - Push to main/develop branches (builds 'latest' or branch-tagged images)
+# - Push to main/stable branches (main → ':main' rolling tag for active-dev
+#   builds; stable → ':stable' + ':latest' for the curated channel)
 # - Version tags from Release Please (e.g., v1.2.0 -> builds versioned images)
 # - GitHub Releases (created by Release Please)
+# - Pull requests (build verification only, no push by default)
 # - Manual workflow dispatch
+#
+# Multi-arch strategy:
+#   Each image (backend, frontend) is built once per architecture on a
+#   native runner — linux/amd64 on ubuntu-latest, linux/arm64 on
+#   ubuntu-24.04-arm. Each leg pushes by digest to GHCR. A follow-up
+#   merge job combines the digests into a multi-arch manifest and applies
+#   the human-readable tags. This is the pattern documented at
+#   https://docs.docker.com/build/ci/github-actions/multi-platform/
+#
+#   Native runners are used instead of QEMU because npm install under
+#   QEMU was previously too slow/unreliable for regular branch builds.
 
 on:
   push:
-    branches: [ main, beta ]
+    branches: [ main, stable ]
     tags: [ 'v*.*.*', 'v*.*.*-beta.*' ]  # Triggered by Release Please tags (stable and beta)
   pull_request:
-    branches: [ main, beta ]
+    branches: [ main, stable ]
   release:
     types: [ published ]  # Triggered when Release Please creates a release
   workflow_dispatch:
@@ -25,53 +38,68 @@ on:
           - 'true'
           - 'false'
 
+# Once release-please authors releases with a PAT (#719), a new version fires
+# BOTH the tag-push and the release-published triggers (GITHUB_TOKEN used to
+# suppress them). They build the same immutable version, so collapse them into a
+# single run by grouping on the ref. Branch and PR builds use different refs and
+# still run independently; a superseding push cancels an in-flight run for the
+# same ref (only the newest build per ref is kept).
+concurrency:
+  group: docker-build-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   REGISTRY: ghcr.io
-  BACKEND_IMAGE_NAME: ${{ github.repository }}/backend
-  FRONTEND_IMAGE_NAME: ${{ github.repository }}/frontend
+  # BACKEND_IMAGE_NAME and FRONTEND_IMAGE_NAME are computed per job in the
+  # "Compute image names" step. GHCR requires all-lowercase repository names,
+  # but ${{ github.repository }} preserves the original case (e.g. "Luca-Timo/...").
+  # Computing them with bash parameter expansion (${VAR,,}) keeps the workflow
+  # working on forks regardless of the owner's name casing.
+
+# Default GITHUB_TOKEN to read-only at the workflow level. Each job that
+# needs to publish to GHCR sets `packages: write` explicitly. This keeps
+# the rest of the workflow (and any future steps) from inheriting unneeded
+# privileges (CKV2_GHA_1).
+permissions:
+  contents: read
 
 jobs:
+  # -----------------------------------------------------------------------------
+  # Backend: per-arch build, then merge into a multi-arch manifest
+  # -----------------------------------------------------------------------------
   build-backend:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
       packages: write
+      # Trivy uploads its SARIF to the Security tab from this job — see
+      # the "Run Trivy" step below. Scanning per-arch by digest (#476)
+      # is reliable; scanning the multi-arch index by tag from the
+      # merge-* job was not.
       security-events: write
 
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
 
-    - name: Determine build context
-      id: context
+    - name: Compute image names (lowercase for GHCR)
       run: |
-        # Determine if this is a beta or stable release
-        if [[ "${{ github.ref }}" == refs/tags/v*-beta* ]] || [[ "${{ github.ref }}" == refs/heads/beta ]]; then
-          echo "channel=beta" >> $GITHUB_OUTPUT
-          echo "is_prerelease=true" >> $GITHUB_OUTPUT
-        else
-          echo "channel=stable" >> $GITHUB_OUTPUT
-          echo "is_prerelease=false" >> $GITHUB_OUTPUT
-        fi
+        repo_lc="${GITHUB_REPOSITORY,,}"
+        echo "BACKEND_IMAGE_NAME=${repo_lc}/backend" >> "$GITHUB_ENV"
+        echo "FRONTEND_IMAGE_NAME=${repo_lc}/frontend" >> "$GITHUB_ENV"
 
-    - name: Determine build platforms
-      id: platforms
+    - name: Prepare platform pair
       run: |
-        # Only build ARM64 for tagged releases (v*.*.*)
-        # QEMU emulation is too slow/unreliable for npm operations on regular builds
-        if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
-          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
-          echo "skip_qemu=false" >> $GITHUB_OUTPUT
-        else
-          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
-          echo "skip_qemu=true" >> $GITHUB_OUTPUT
-        fi
-
-    - name: Set up QEMU
-      if: steps.platforms.outputs.skip_qemu != 'true'
-      uses: docker/setup-qemu-action@v3
-      with:
-        platforms: arm64
+        platform="${{ matrix.platform }}"
+        echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
@@ -86,6 +114,166 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: Determine if pushing
+      id: push-decision
+      run: |
+        if [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.inputs.push }}" != "true" ]]; then
+          echo "push=false" >> "$GITHUB_OUTPUT"
+        elif [[ "${{ steps.login-ghcr.outcome }}" != "success" ]]; then
+          echo "push=false" >> "$GITHUB_OUTPUT"
+        else
+          echo "push=true" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Extract metadata for Backend (labels only)
+      id: meta-backend
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}
+        labels: |
+          org.opencontainers.image.title=PicPeak Backend
+          org.opencontainers.image.description=PicPeak photo sharing platform backend service
+          org.opencontainers.image.vendor=PicPeak
+          maintainer=${{ github.repository_owner }}
+
+    - name: Build Backend image (push by digest)
+      id: build
+      uses: docker/build-push-action@v5
+      with:
+        context: ./backend
+        file: ./backend/Dockerfile
+        platforms: ${{ matrix.platform }}
+        labels: ${{ steps.meta-backend.outputs.labels }}
+        cache-from: type=gha,scope=backend-${{ env.PLATFORM_PAIR }}
+        # ignore-error: a flaky GitHub Actions cache write ("error writing
+        # layer blob: not_found") must not fail an otherwise-successful build
+        # that already pushed the image.
+        cache-to: type=gha,mode=max,scope=backend-${{ env.PLATFORM_PAIR }},ignore-error=true
+        outputs: ${{ steps.push-decision.outputs.push == 'true' && format('type=image,name={0}/{1},push-by-digest=true,name-canonical=true,push=true', env.REGISTRY, env.BACKEND_IMAGE_NAME) || 'type=cacheonly' }}
+        build-args: |
+          CACHEBUST=${{ github.run_number }}
+          BUILD_DATE=${{ github.event.head_commit.timestamp }}
+          VCS_REF=${{ github.sha }}
+          VERSION=${{ steps.meta-backend.outputs.version }}
+
+    - name: Export digest
+      if: steps.push-decision.outputs.push == 'true'
+      run: |
+        mkdir -p /tmp/digests
+        digest="${{ steps.build.outputs.digest }}"
+        touch "/tmp/digests/${digest#sha256:}"
+
+    - name: Upload digest artifact
+      if: steps.push-decision.outputs.push == 'true'
+      uses: actions/upload-artifact@v4
+      with:
+        name: digests-backend-${{ env.PLATFORM_PAIR }}
+        path: /tmp/digests/*
+        if-no-files-found: error
+        retention-days: 1
+
+    # Per-arch vulnerability scan (#476). Scanning the multi-arch
+    # manifest from the merge-* job by tag is unreliable — Trivy's
+    # remote resolver crashes intermittently with "no child with
+    # platform linux/amd64 in index". The fix is to scan each leg
+    # by its single-platform digest right here, where it just landed
+    # in GHCR. Tag pinned (was @master) so the action + bundled
+    # Trivy binary don't float between runs.
+    #
+    # exit-code is left unset (=0) for now: Trivy reports findings
+    # to the Security tab but doesn't fail the build. Flipping that
+    # to '1' to actually gate CI is a deliberate follow-up — needs an
+    # audit pass first so the next beta build doesn't surprise red.
+    - name: Run Trivy vulnerability scanner (per-arch, by digest)
+      if: steps.push-decision.outputs.push == 'true'
+      uses: aquasecurity/trivy-action@v0.36.0
+      env:
+        # docker/build-push-action wraps every push in an OCI index
+        # (carries the SLSA provenance attestation alongside the
+        # actual image). Trivy's remote backend defaults to
+        # linux/amd64 regardless of host arch when resolving an
+        # index, which makes the arm64 leg crash with "no child
+        # with platform linux/amd64". Telling Trivy which child to
+        # scan keeps the provenance attestation intact and fixes
+        # the resolver crash. Pin to matrix.platform so each leg
+        # scans its own arch.
+        TRIVY_PLATFORM: ${{ matrix.platform }}
+      with:
+        image-ref: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}@${{ steps.build.outputs.digest }}
+        format: 'sarif'
+        output: 'trivy-backend-${{ env.PLATFORM_PAIR }}.sarif'
+        severity: 'CRITICAL,HIGH'
+        # Base-image CVEs with no released fix are not actionable: the
+        # Dockerfiles already run `apt-get upgrade -y` behind a CACHEBUST,
+        # so a fix lands in the next build automatically. Reporting them
+        # buries the findings someone can actually do something about.
+        # Dropping them is also the precondition for ever setting
+        # exit-code: 1, which build-backend's comment flags as a
+        # deliberate follow-up.
+        ignore-unfixed: true
+        timeout: '10m'
+
+    - name: Upload Trivy scan results to GitHub Security tab
+      if: steps.push-decision.outputs.push == 'true'
+      uses: github/codeql-action/upload-sarif@v4
+      with:
+        sarif_file: 'trivy-backend-${{ env.PLATFORM_PAIR }}.sarif'
+        # Distinct category per arch so the Security tab surfaces
+        # per-platform findings independently — an amd64-only CVE in
+        # a base layer doesn't get masked by the arm64 scan.
+        category: 'backend-vulnerabilities-${{ env.PLATFORM_PAIR }}'
+
+  merge-backend:
+    needs: build-backend
+    runs-on: ubuntu-latest
+    # No security-events permission here — vulnerability scanning moved
+    # to per-arch build-backend jobs (#476). This job's only job is to
+    # combine the per-arch digests into a multi-arch manifest.
+    permissions:
+      contents: read
+      packages: write
+    # Only run when at least one digest was pushed (i.e. not on PRs without push intent).
+    if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
+
+    steps:
+    - name: Compute image names (lowercase for GHCR)
+      run: |
+        repo_lc="${GITHUB_REPOSITORY,,}"
+        echo "BACKEND_IMAGE_NAME=${repo_lc}/backend" >> "$GITHUB_ENV"
+        echo "FRONTEND_IMAGE_NAME=${repo_lc}/frontend" >> "$GITHUB_ENV"
+
+    - name: Download digest artifacts
+      uses: actions/download-artifact@v4
+      with:
+        path: /tmp/digests
+        pattern: digests-backend-*
+        merge-multiple: true
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Log in to Container Registry
+      id: login-ghcr
+      continue-on-error: true
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Determine build context
+      id: context
+      run: |
+        if [[ "${{ github.ref }}" == refs/tags/v*-beta* ]] || [[ "${{ github.ref }}" == refs/heads/main ]]; then
+          # Active-dev branch (`main`, renamed from `beta` per #669) produces
+          # prereleases; the `-beta.N` version-suffix scheme is unchanged.
+          echo "channel=beta" >> $GITHUB_OUTPUT
+          echo "is_prerelease=true" >> $GITHUB_OUTPUT
+        else
+          echo "channel=stable" >> $GITHUB_OUTPUT
+          echo "is_prerelease=false" >> $GITHUB_OUTPUT
+        fi
+
     - name: Extract metadata for Backend
       id: meta-backend
       uses: docker/metadata-action@v5
@@ -103,86 +291,59 @@ jobs:
           type=semver,pattern={{major}}.{{minor}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
           type=semver,pattern={{major}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
           type=sha,format=short
-          type=raw,value=latest,enable={{is_default_branch}}
-          type=raw,value=stable,enable=${{ github.ref == 'refs/heads/main' || (startsWith(github.ref, 'refs/tags/v') && steps.context.outputs.is_prerelease == 'false') }}
-          type=raw,value=beta,enable=${{ github.ref == 'refs/heads/beta' || steps.context.outputs.is_prerelease == 'true' }}
+          # `:latest` + `:stable` follow the stable channel (the `stable` branch +
+          # stable release tags). The default branch is now `main` (active dev),
+          # so `is_default_branch` no longer maps to "stable" — be explicit.
+          type=raw,value=latest,enable=${{ github.ref == 'refs/heads/stable' || (startsWith(github.ref, 'refs/tags/v') && steps.context.outputs.is_prerelease == 'false') }}
+          type=raw,value=stable,enable=${{ github.ref == 'refs/heads/stable' || (startsWith(github.ref, 'refs/tags/v') && steps.context.outputs.is_prerelease == 'false') }}
+          # `:beta` is RETIRED post-rename (Option B / #669). Active-dev pulls
+          # are `:main` (auto via type=ref,event=branch). The pre-rename `:beta`
+          # tag remains frozen at its last build — operators should update.
 
-    - name: Build and push Backend Docker image
-      uses: docker/build-push-action@v5
-      with:
-        context: ./backend
-        file: ./backend/Dockerfile
-        # Always build; only push when registry login succeeded
-        push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
-        tags: ${{ steps.meta-backend.outputs.tags }}
-        labels: ${{ steps.meta-backend.outputs.labels }}
-        platforms: ${{ steps.platforms.outputs.platforms }}
-        cache-from: type=gha,scope=backend
-        cache-to: type=gha,mode=max,scope=backend
-        build-args: |
-          CACHEBUST=${{ github.run_number }}
-          BUILD_DATE=${{ github.event.head_commit.timestamp }}
-          VCS_REF=${{ github.sha }}
-          VERSION=${{ steps.meta-backend.outputs.version }}
+    - name: Create and push multi-arch manifest
+      working-directory: /tmp/digests
+      run: |
+        docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          $(printf "${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}@sha256:%s " *)
 
-    - name: Run Trivy vulnerability scanner
-      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
-      uses: aquasecurity/trivy-action@master
-      with:
-        image-ref: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}:${{ steps.meta-backend.outputs.version }}
-        format: 'sarif'
-        output: 'trivy-backend.sarif'
-        severity: 'CRITICAL,HIGH'
-        timeout: '10m'
-
-    - name: Upload Trivy scan results to GitHub Security tab
-      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
-      uses: github/codeql-action/upload-sarif@v4
-      with:
-        sarif_file: 'trivy-backend.sarif'
-        category: 'backend-vulnerabilities'
+    - name: Inspect manifest
+      run: |
+        docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}:${{ steps.meta-backend.outputs.version }}
 
+  # -----------------------------------------------------------------------------
+  # Frontend: per-arch build, then merge into a multi-arch manifest
+  # -----------------------------------------------------------------------------
   build-frontend:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
       packages: write
+      # See build-backend for the rationale (#476). Same pattern: per-arch
+      # vulnerability scan by digest, SARIF uploaded to the Security tab.
       security-events: write
 
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
 
-    - name: Determine build context
-      id: context
+    - name: Compute image names (lowercase for GHCR)
       run: |
-        # Determine if this is a beta or stable release
-        if [[ "${{ github.ref }}" == refs/tags/v*-beta* ]] || [[ "${{ github.ref }}" == refs/heads/beta ]]; then
-          echo "channel=beta" >> $GITHUB_OUTPUT
-          echo "is_prerelease=true" >> $GITHUB_OUTPUT
-        else
-          echo "channel=stable" >> $GITHUB_OUTPUT
-          echo "is_prerelease=false" >> $GITHUB_OUTPUT
-        fi
+        repo_lc="${GITHUB_REPOSITORY,,}"
+        echo "BACKEND_IMAGE_NAME=${repo_lc}/backend" >> "$GITHUB_ENV"
+        echo "FRONTEND_IMAGE_NAME=${repo_lc}/frontend" >> "$GITHUB_ENV"
 
-    - name: Determine build platforms
-      id: platforms
+    - name: Prepare platform pair
       run: |
-        # Only build ARM64 for tagged releases (v*.*.*)
-        # QEMU emulation is too slow/unreliable for npm operations on regular builds
-        if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
-          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
-          echo "skip_qemu=false" >> $GITHUB_OUTPUT
-        else
-          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
-          echo "skip_qemu=true" >> $GITHUB_OUTPUT
-        fi
-
-    - name: Set up QEMU
-      if: steps.platforms.outputs.skip_qemu != 'true'
-      uses: docker/setup-qemu-action@v3
-      with:
-        platforms: arm64
+        platform="${{ matrix.platform }}"
+        echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
@@ -197,6 +358,147 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: Determine if pushing
+      id: push-decision
+      run: |
+        if [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.inputs.push }}" != "true" ]]; then
+          echo "push=false" >> "$GITHUB_OUTPUT"
+        elif [[ "${{ steps.login-ghcr.outcome }}" != "success" ]]; then
+          echo "push=false" >> "$GITHUB_OUTPUT"
+        else
+          echo "push=true" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Extract metadata for Frontend (labels only)
+      id: meta-frontend
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}
+        labels: |
+          org.opencontainers.image.title=PicPeak Frontend
+          org.opencontainers.image.description=PicPeak photo sharing platform frontend application
+          org.opencontainers.image.vendor=PicPeak
+          maintainer=${{ github.repository_owner }}
+
+    - name: Build Frontend image (push by digest)
+      id: build
+      uses: docker/build-push-action@v5
+      with:
+        context: ./frontend
+        file: ./frontend/Dockerfile
+        platforms: ${{ matrix.platform }}
+        labels: ${{ steps.meta-frontend.outputs.labels }}
+        cache-from: type=gha,scope=frontend-${{ env.PLATFORM_PAIR }}
+        # ignore-error: a flaky GitHub Actions cache write ("error writing
+        # layer blob: not_found") must not fail an otherwise-successful build
+        # that already pushed the image.
+        cache-to: type=gha,mode=max,scope=frontend-${{ env.PLATFORM_PAIR }},ignore-error=true
+        outputs: ${{ steps.push-decision.outputs.push == 'true' && format('type=image,name={0}/{1},push-by-digest=true,name-canonical=true,push=true', env.REGISTRY, env.FRONTEND_IMAGE_NAME) || 'type=cacheonly' }}
+        build-args: |
+          CACHEBUST=${{ github.run_number }}
+          BUILD_DATE=${{ github.event.head_commit.timestamp }}
+          VCS_REF=${{ github.sha }}
+          VERSION=${{ steps.meta-frontend.outputs.version }}
+
+    - name: Export digest
+      if: steps.push-decision.outputs.push == 'true'
+      run: |
+        mkdir -p /tmp/digests
+        digest="${{ steps.build.outputs.digest }}"
+        touch "/tmp/digests/${digest#sha256:}"
+
+    - name: Upload digest artifact
+      if: steps.push-decision.outputs.push == 'true'
+      uses: actions/upload-artifact@v4
+      with:
+        name: digests-frontend-${{ env.PLATFORM_PAIR }}
+        path: /tmp/digests/*
+        if-no-files-found: error
+        retention-days: 1
+
+    # Per-arch vulnerability scan (#476). See build-backend for the
+    # full rationale; identical pattern here, only the image-ref +
+    # SARIF filename + category change.
+    - name: Run Trivy vulnerability scanner (per-arch, by digest)
+      if: steps.push-decision.outputs.push == 'true'
+      uses: aquasecurity/trivy-action@v0.36.0
+      env:
+        # See build-backend for the rationale — pin Trivy's platform
+        # to the matrix arch so its remote-index resolver picks the
+        # right child instead of defaulting to linux/amd64 and
+        # crashing on the arm64 leg.
+        TRIVY_PLATFORM: ${{ matrix.platform }}
+      with:
+        image-ref: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}@${{ steps.build.outputs.digest }}
+        format: 'sarif'
+        output: 'trivy-frontend-${{ env.PLATFORM_PAIR }}.sarif'
+        severity: 'CRITICAL,HIGH'
+        # Base-image CVEs with no released fix are not actionable: the
+        # Dockerfiles already run `apt-get upgrade -y` behind a CACHEBUST,
+        # so a fix lands in the next build automatically. Reporting them
+        # buries the findings someone can actually do something about.
+        # Dropping them is also the precondition for ever setting
+        # exit-code: 1, which build-backend's comment flags as a
+        # deliberate follow-up.
+        ignore-unfixed: true
+        timeout: '10m'
+
+    - name: Upload Trivy scan results to GitHub Security tab
+      if: steps.push-decision.outputs.push == 'true'
+      uses: github/codeql-action/upload-sarif@v4
+      with:
+        sarif_file: 'trivy-frontend-${{ env.PLATFORM_PAIR }}.sarif'
+        category: 'frontend-vulnerabilities-${{ env.PLATFORM_PAIR }}'
+
+  merge-frontend:
+    needs: build-frontend
+    runs-on: ubuntu-latest
+    # See merge-backend — vulnerability scanning moved to the per-arch
+    # build-frontend matrix (#476). This job only publishes the manifest.
+    permissions:
+      contents: read
+      packages: write
+    if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
+
+    steps:
+    - name: Compute image names (lowercase for GHCR)
+      run: |
+        repo_lc="${GITHUB_REPOSITORY,,}"
+        echo "BACKEND_IMAGE_NAME=${repo_lc}/backend" >> "$GITHUB_ENV"
+        echo "FRONTEND_IMAGE_NAME=${repo_lc}/frontend" >> "$GITHUB_ENV"
+
+    - name: Download digest artifacts
+      uses: actions/download-artifact@v4
+      with:
+        path: /tmp/digests
+        pattern: digests-frontend-*
+        merge-multiple: true
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Log in to Container Registry
+      id: login-ghcr
+      continue-on-error: true
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Determine build context
+      id: context
+      run: |
+        if [[ "${{ github.ref }}" == refs/tags/v*-beta* ]] || [[ "${{ github.ref }}" == refs/heads/main ]]; then
+          # Active-dev branch (`main`, renamed from `beta` per #669) produces
+          # prereleases; the `-beta.N` version-suffix scheme is unchanged.
+          echo "channel=beta" >> $GITHUB_OUTPUT
+          echo "is_prerelease=true" >> $GITHUB_OUTPUT
+        else
+          echo "channel=stable" >> $GITHUB_OUTPUT
+          echo "is_prerelease=false" >> $GITHUB_OUTPUT
+        fi
+
     - name: Extract metadata for Frontend
       id: meta-frontend
       uses: docker/metadata-action@v5
@@ -214,84 +516,88 @@ jobs:
           type=semver,pattern={{major}}.{{minor}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
           type=semver,pattern={{major}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
           type=sha,format=short
-          type=raw,value=latest,enable={{is_default_branch}}
-          type=raw,value=stable,enable=${{ github.ref == 'refs/heads/main' || (startsWith(github.ref, 'refs/tags/v') && steps.context.outputs.is_prerelease == 'false') }}
-          type=raw,value=beta,enable=${{ github.ref == 'refs/heads/beta' || steps.context.outputs.is_prerelease == 'true' }}
+          # `:latest` + `:stable` follow the stable channel (the `stable` branch +
+          # stable release tags). The default branch is now `main` (active dev),
+          # so `is_default_branch` no longer maps to "stable" — be explicit.
+          type=raw,value=latest,enable=${{ github.ref == 'refs/heads/stable' || (startsWith(github.ref, 'refs/tags/v') && steps.context.outputs.is_prerelease == 'false') }}
+          type=raw,value=stable,enable=${{ github.ref == 'refs/heads/stable' || (startsWith(github.ref, 'refs/tags/v') && steps.context.outputs.is_prerelease == 'false') }}
+          # `:beta` is RETIRED post-rename (Option B / #669). Active-dev pulls
+          # are `:main` (auto via type=ref,event=branch). The pre-rename `:beta`
+          # tag remains frozen at its last build — operators should update.
 
-    - name: Build and push Frontend Docker image
-      uses: docker/build-push-action@v5
-      with:
-        context: ./frontend
-        file: ./frontend/Dockerfile
-        # Always build; only push when registry login succeeded
-        push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
-        tags: ${{ steps.meta-frontend.outputs.tags }}
-        labels: ${{ steps.meta-frontend.outputs.labels }}
-        platforms: ${{ steps.platforms.outputs.platforms }}
-        cache-from: type=gha,scope=frontend
-        cache-to: type=gha,mode=max,scope=frontend
-        build-args: |
-          CACHEBUST=${{ github.run_number }}
-          BUILD_DATE=${{ github.event.head_commit.timestamp }}
-          VCS_REF=${{ github.sha }}
-          VERSION=${{ steps.meta-frontend.outputs.version }}
+    - name: Create and push multi-arch manifest
+      working-directory: /tmp/digests
+      run: |
+        docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          $(printf "${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}@sha256:%s " *)
 
-    - name: Run Trivy vulnerability scanner
-      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
-      uses: aquasecurity/trivy-action@master
-      with:
-        image-ref: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}:${{ steps.meta-frontend.outputs.version }}
-        format: 'sarif'
-        output: 'trivy-frontend.sarif'
-        severity: 'CRITICAL,HIGH'
-        timeout: '10m'
-
-    - name: Upload Trivy scan results to GitHub Security tab
-      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
-      uses: github/codeql-action/upload-sarif@v4
-      with:
-        sarif_file: 'trivy-frontend.sarif'
-        category: 'frontend-vulnerabilities'
-
-  # Note: The publish-manifest job is not needed since docker/build-push-action@v5
-  # automatically creates multi-arch manifests when building for multiple platforms.
-  # The images are already properly tagged and include all architectures.
+    - name: Inspect manifest
+      run: |
+        docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}:${{ steps.meta-frontend.outputs.version }}
 
   summary:
-    needs: [build-backend, build-frontend]
+    needs: [build-backend, merge-backend, build-frontend, merge-frontend]
     if: always()
     runs-on: ubuntu-latest
     permissions:
       contents: read
-    
+
     steps:
+    - name: Compute image names (lowercase for GHCR)
+      run: |
+        repo_lc="${GITHUB_REPOSITORY,,}"
+        echo "BACKEND_IMAGE_NAME=${repo_lc}/backend" >> "$GITHUB_ENV"
+        echo "FRONTEND_IMAGE_NAME=${repo_lc}/frontend" >> "$GITHUB_ENV"
+
     - name: Build Summary
       run: |
         echo "## 🐳 Docker Build Summary" >> $GITHUB_STEP_SUMMARY
         echo "" >> $GITHUB_STEP_SUMMARY
-        
+
         if [[ "${{ needs.build-backend.result }}" == "success" ]]; then
-          echo "✅ **Backend**: Successfully built" >> $GITHUB_STEP_SUMMARY
+          echo "✅ **Backend build (per-arch)**: Successfully built" >> $GITHUB_STEP_SUMMARY
         else
-          echo "❌ **Backend**: Build failed" >> $GITHUB_STEP_SUMMARY
+          echo "❌ **Backend build (per-arch)**: ${{ needs.build-backend.result }}" >> $GITHUB_STEP_SUMMARY
         fi
-        
+
+        if [[ "${{ needs.merge-backend.result }}" == "success" ]]; then
+          echo "✅ **Backend manifest merge**: Successfully published" >> $GITHUB_STEP_SUMMARY
+        elif [[ "${{ needs.merge-backend.result }}" == "skipped" ]]; then
+          echo "ℹ️ **Backend manifest merge**: Skipped (verify-only build)" >> $GITHUB_STEP_SUMMARY
+        else
+          echo "❌ **Backend manifest merge**: ${{ needs.merge-backend.result }}" >> $GITHUB_STEP_SUMMARY
+        fi
+
         if [[ "${{ needs.build-frontend.result }}" == "success" ]]; then
-          echo "✅ **Frontend**: Successfully built" >> $GITHUB_STEP_SUMMARY
+          echo "✅ **Frontend build (per-arch)**: Successfully built" >> $GITHUB_STEP_SUMMARY
         else
-          echo "❌ **Frontend**: Build failed" >> $GITHUB_STEP_SUMMARY
+          echo "❌ **Frontend build (per-arch)**: ${{ needs.build-frontend.result }}" >> $GITHUB_STEP_SUMMARY
         fi
-        
+
+        if [[ "${{ needs.merge-frontend.result }}" == "success" ]]; then
+          echo "✅ **Frontend manifest merge**: Successfully published" >> $GITHUB_STEP_SUMMARY
+        elif [[ "${{ needs.merge-frontend.result }}" == "skipped" ]]; then
+          echo "ℹ️ **Frontend manifest merge**: Skipped (verify-only build)" >> $GITHUB_STEP_SUMMARY
+        else
+          echo "❌ **Frontend manifest merge**: ${{ needs.merge-frontend.result }}" >> $GITHUB_STEP_SUMMARY
+        fi
+
         echo "" >> $GITHUB_STEP_SUMMARY
         echo "### 📦 Images" >> $GITHUB_STEP_SUMMARY
         echo "- Backend: \`${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
         echo "- Frontend: \`${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
-        
+
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### 🏗️ Architectures" >> $GITHUB_STEP_SUMMARY
+        echo "Published manifests include both \`linux/amd64\` and \`linux/arm64\` (built natively, no QEMU)." >> $GITHUB_STEP_SUMMARY
+
         echo "" >> $GITHUB_STEP_SUMMARY
         echo "### 🏷️ Tags" >> $GITHUB_STEP_SUMMARY
         echo "Images are tagged based on:" >> $GITHUB_STEP_SUMMARY
         echo "- Branch name (for branch pushes)" >> $GITHUB_STEP_SUMMARY
-        echo "- PR number (for pull requests)" >> $GITHUB_STEP_SUMMARY
+        echo "- PR number (for pull requests, when push is enabled)" >> $GITHUB_STEP_SUMMARY
         echo "- Version tags (for releases)" >> $GITHUB_STEP_SUMMARY
-        echo "- Short SHA with branch prefix" >> $GITHUB_STEP_SUMMARY
+        echo "- Short SHA" >> $GITHUB_STEP_SUMMARY
         echo "- \`latest\` (for main branch)" >> $GITHUB_STEP_SUMMARY
+        echo "- \`stable\` (for main branch and stable releases)" >> $GITHUB_STEP_SUMMARY
+        echo "- \`beta\` (for beta branch and pre-releases)" >> $GITHUB_STEP_SUMMARY

.github/workflows/install-smoke.yml

@@ -0,0 +1,221 @@
+name: Fresh-install smoke
+
+# Verifies that a clean Postgres install boots cleanly under the same
+# conditions a new user hits on their first `docker compose up -d`. The
+# specific scenarios this guards against — see #484 for the original
+# reproduction:
+#
+#   1. Bind-mounted host directories owned by a UID other than 1001
+#      (the container's nodejs user). The entrypoint must self-chown
+#      and drop privileges via su-exec.
+#   2. Cold-start Postgres with no prior schema (the FK-order bug fixed
+#      in #494, the index/created_at error fixed in #511, and any
+#      future migration-order issue that only surfaces on an empty DB).
+#
+# Triggers only on changes that touch the install path so unrelated PRs
+# don't pay the build cost.
+
+on:
+  # No `paths:` filter — branch protection on `main` + `stable` lists
+  # `fresh-install` as a REQUIRED check, and a path-filtered trigger
+  # that skipped on unrelated PRs (e.g. frontend-only) would leave the
+  # required check "missing" forever and block the merge. Better to
+  # pay the boot cost on every PR than maintain a per-path allowlist
+  # that drifts as the install surface evolves. (Branches also updated
+  # post-#669 rename: beta → main, old main → stable.)
+  push:
+    branches: [main, stable]
+  pull_request:
+    branches: [main, stable]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  fresh-install:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Build for the runner's arch only — we just need a runnable image.
+      # The full multi-arch build is the docker-build workflow's job.
+      - name: Build backend image
+        uses: docker/build-push-action@v5
+        with:
+          context: ./backend
+          file: ./backend/Dockerfile
+          load: true
+          tags: picpeak-backend:smoke
+          cache-from: type=gha,scope=install-smoke
+          # ignore-error: a flaky GHA cache write must not fail the build.
+          cache-to: type=gha,mode=max,scope=install-smoke,ignore-error=true
+
+      - name: Create Docker network
+        run: docker network create picpeak-smoke
+
+      # Mount as UID 1000 (the typical GitHub Actions runner user, and a
+      # common mismatch case on Linux hosts). The entrypoint must chown
+      # this to 1001 itself — that's the regression we're guarding.
+      - name: Prepare host bind-mount dirs owned by UID 1000
+        run: |
+          mkdir -p smoke-mounts/storage smoke-mounts/data smoke-mounts/logs
+          chmod 755 smoke-mounts smoke-mounts/*
+          ls -ld smoke-mounts/*
+
+      - name: Start Postgres
+        run: |
+          docker run -d --name picpeak-smoke-pg --network picpeak-smoke \
+            -e POSTGRES_USER=picpeak \
+            -e POSTGRES_PASSWORD=smokepass \
+            -e POSTGRES_DB=picpeak_prod \
+            --health-cmd="pg_isready -U picpeak -d picpeak_prod" \
+            --health-interval=2s --health-timeout=2s --health-retries=30 \
+            postgres:15-alpine
+
+      - name: Wait for Postgres healthy
+        run: |
+          for i in $(seq 1 60); do
+            status=$(docker inspect -f '{{.State.Health.Status}}' picpeak-smoke-pg 2>/dev/null || echo starting)
+            if [ "$status" = "healthy" ]; then
+              echo "postgres healthy after ${i}s"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "postgres did not become healthy in 60s"
+          docker logs picpeak-smoke-pg
+          exit 1
+
+      - name: Start backend with mismatched-UID bind mounts (fresh install)
+        run: |
+          docker run -d --name picpeak-smoke-bk --network picpeak-smoke \
+            -e NODE_ENV=production \
+            -e JWT_SECRET=smoketestsecretvalueof32characters \
+            -e DB_HOST=picpeak-smoke-pg \
+            -e DB_USER=picpeak \
+            -e DB_PASSWORD=smokepass \
+            -e DB_NAME=picpeak_prod \
+            -e ADMIN_EMAIL=admin@smoke.local \
+            -e ADMIN_PASSWORD=smokeAdminPass12345 \
+            -e STORAGE_PATH=/app/storage \
+            -v "$PWD/smoke-mounts/storage:/app/storage" \
+            -v "$PWD/smoke-mounts/data:/app/data" \
+            -v "$PWD/smoke-mounts/logs:/app/logs" \
+            picpeak-backend:smoke
+
+      - name: Wait for backend healthy
+        run: |
+          for i in $(seq 1 120); do
+            status=$(docker inspect -f '{{.State.Status}}' picpeak-smoke-bk 2>/dev/null || echo missing)
+            health=$(docker inspect -f '{{.State.Health.Status}}' picpeak-smoke-bk 2>/dev/null || echo none)
+            if [ "$status" = "exited" ]; then
+              echo "FAIL: backend exited during cold-start (restart loop scenario)"
+              docker logs picpeak-smoke-bk
+              echo "--- error.log ---"
+              cat smoke-mounts/logs/error.log 2>/dev/null || echo "(no error.log)"
+              exit 1
+            fi
+            if [ "$health" = "healthy" ]; then
+              echo "backend healthy after ${i}s"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "FAIL: backend did not become healthy in 120s"
+          docker ps -a
+          docker logs picpeak-smoke-bk
+          exit 1
+
+      - name: Verify chown happened (container view)
+        run: |
+          # All three dirs should now be owned by nodejs (UID 1001).
+          # If the entrypoint's self-chown branch didn't fire, they'd
+          # still be owned by the runner UID and node would have hit
+          # EACCES creating storage subdirs.
+          for d in /app/storage /app/data /app/logs; do
+            owner_uid=$(docker exec picpeak-smoke-bk stat -c '%u' "$d")
+            if [ "$owner_uid" != "1001" ]; then
+              echo "FAIL: $d is owned by UID $owner_uid (expected 1001)"
+              exit 1
+            fi
+            echo "ok: $d owned by UID $owner_uid"
+          done
+
+      - name: Verify app is actually serving
+        run: |
+          # /health is what docker's HEALTHCHECK polls, but hit it
+          # directly to confirm the response shape matches what the
+          # frontend + reverse proxy expect.
+          body=$(docker exec picpeak-smoke-bk wget -qO- http://localhost:3000/health)
+          echo "/health => $body"
+          echo "$body" | grep -q '"status":"ok"' || {
+            echo "FAIL: /health did not return status:ok"
+            exit 1
+          }
+
+      - name: Verify node runs as nodejs (not root)
+        run: |
+          # dumb-init runs as root (PID 1), node must be running as
+          # nodejs (UID 1001) — if su-exec drop didn't happen the app
+          # would be running as root which is the security regression
+          # we're guarding against. Alpine ships BusyBox ps, which
+          # doesn't support `-p PID` or pgrep, so list + awk instead.
+          user=$(docker exec picpeak-smoke-bk ps -o user,comm | awk '$2=="node" {print $1; exit}')
+          if [ "$user" != "nodejs" ]; then
+            echo "FAIL: node running as '$user' (expected nodejs)"
+            docker exec picpeak-smoke-bk ps -o pid,user,comm
+            exit 1
+          fi
+          echo "ok: node running as $user"
+
+      - name: Verify no restart loop
+        run: |
+          restart_count=$(docker inspect -f '{{.RestartCount}}' picpeak-smoke-bk)
+          if [ "$restart_count" -gt 0 ]; then
+            echo "FAIL: container restarted $restart_count time(s) — install loop bug returning"
+            docker logs picpeak-smoke-bk
+            exit 1
+          fi
+          echo "ok: 0 restarts"
+
+      # Restart with `--user 5005:5005` (no root, can't chown) against
+      # bind mounts owned by 1000 — entrypoint must fail loud with the
+      # actionable preflight error, not silently restart-loop.
+      - name: Verify preflight fails loud on unwritable mounts
+        run: |
+          docker rm -f picpeak-smoke-bk2 2>/dev/null || true
+          set +e
+          out=$(docker run --rm --user 5005:5005 --network picpeak-smoke \
+            -e NODE_ENV=production -e JWT_SECRET=x \
+            -e DB_HOST=picpeak-smoke-pg -e DB_USER=picpeak \
+            -e DB_PASSWORD=smokepass -e DB_NAME=picpeak_prod \
+            -e STORAGE_PATH=/app/storage \
+            -v "$PWD/smoke-mounts/storage:/app/storage" \
+            -v "$PWD/smoke-mounts/data:/app/data" \
+            -v "$PWD/smoke-mounts/logs:/app/logs" \
+            picpeak-backend:smoke 2>&1)
+          rc=$?
+          set -e
+          echo "$out"
+          if [ $rc -eq 0 ]; then
+            echo "FAIL: preflight should have exited non-zero"
+            exit 1
+          fi
+          echo "$out" | grep -q "is not writable by UID 5005" || {
+            echo "FAIL: preflight error message missing or wrong"
+            exit 1
+          }
+          echo "ok: preflight failed loud with actionable error"
+
+      - name: Cleanup
+        if: always()
+        run: |
+          docker rm -f picpeak-smoke-bk picpeak-smoke-bk2 picpeak-smoke-pg 2>/dev/null || true
+          docker network rm picpeak-smoke 2>/dev/null || true

.github/workflows/pr-title-lint.yml

@@ -0,0 +1,36 @@
+name: PR Title Lint
+
+# Release Please derives version bumps and the changelog from Conventional
+# Commit prefixes (feat:, fix:, ...). PRs whose title/commits use other
+# conventions (e.g. gitmoji) are silently ignored, so their changes ship
+# without a version bump or a changelog entry. This check fails a PR whose
+# title is not a valid Conventional Commit so the release stays automated.
+
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  lint-pr-title:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR title is a Conventional Commit
+        uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            perf
+            revert
+            docs
+            style
+            chore
+            refactor
+            test
+            build
+            ci

.github/workflows/release-please-beta.yml

@@ -2,7 +2,7 @@ name: Release Please (Beta)
 
 on:
   push:
-    branches: [beta]
+    branches: [main]
 
 permissions:
   contents: write
@@ -20,10 +20,48 @@ jobs:
         uses: googleapis/release-please-action@v4
         id: release
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # A dedicated token (fine-grained PAT) makes the release PR run CI
+          # automatically (no "workflows awaiting approval") and lets it be
+          # merged without a manual review. Falls back to GITHUB_TOKEN so the
+          # workflow still works before the secret is added (#719).
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
           config-file: release-please-config-beta.json
           manifest-file: .release-please-manifest-beta.json
-          target-branch: beta
+          target-branch: main
+
+      # Auto-approve + enable auto-merge on the open release PR so betas publish
+      # with no manual clicks. Approval uses GITHUB_TOKEN (github-actions[bot]) —
+      # a different identity than the PR author (RELEASE_PLEASE_TOKEN) — so it is
+      # a valid review (requires the org's "Allow GitHub Actions to approve pull
+      # requests" + the repo's "Allow auto-merge"). Only meaningful when a PAT is
+      # set: without it the PR is bot-authored and can't be self-approved, so we
+      # skip and leave today's manual flow. Best-effort — never blocks the run.
+      - name: Auto-approve and enable auto-merge on the release PR
+        if: ${{ steps.release.outputs.release_created != 'true' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_PAT: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          # This job has no checkout, so gh can't infer the repo from a git
+          # remote — set it explicitly (same pattern as whatsnew, 2a5f0a8).
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if [ -z "$RELEASE_PAT" ]; then
+            echo "RELEASE_PLEASE_TOKEN not set — skipping auto-merge (manual review still required)."
+            exit 0
+          fi
+          pr=$(gh pr list --head release-please--branches--main --state open --json number --jq '.[0].number // empty')
+          if [ -n "$pr" ]; then
+            # Approve as github-actions[bot] (GITHUB_TOKEN) — a different identity
+            # than the PR author (the PAT) — so it counts as a valid review.
+            gh pr review "$pr" --approve --body "Automated approval — release-please version bump + changelog (#719)." || true
+            # Enable auto-merge as the PAT so the eventual merge commit is
+            # attributed to a real identity. If enabled via GITHUB_TOKEN the merge
+            # push is suppressed by recursion prevention and the follow-up run that
+            # cuts the tag/release never fires (#719).
+            GH_TOKEN="$RELEASE_PAT" gh pr merge "$pr" --squash --auto || true
+          else
+            echo "No open release PR to auto-merge."
+          fi
 
       - name: Output Release Info
         if: ${{ steps.release.outputs.release_created }}
@@ -35,3 +73,16 @@ jobs:
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "Docker images will be built and tagged with this beta version." >> $GITHUB_STEP_SUMMARY
 
+  # Best-effort "What's New" highlights on the freshly-created release. Runs in
+  # this same workflow run (not a `release:` trigger) because release-please
+  # creates the release with GITHUB_TOKEN, which never starts new workflow runs.
+  whatsnew:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created }}
+    permissions:
+      contents: write   # edit the release body
+      models: read       # GitHub Models (free tier)
+    uses: ./.github/workflows/whatsnew-highlights.yml
+    with:
+      tag: ${{ needs.release-please.outputs.tag_name }}
+

.github/workflows/release-please.yml

@@ -2,7 +2,7 @@ name: Release Please
 
 on:
   push:
-    branches: [main]
+    branches: [stable]
 
 permissions:
   contents: write
@@ -20,9 +20,19 @@ jobs:
         uses: googleapis/release-please-action@v4
         id: release
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # Dedicated token so the release PR runs CI + can auto-merge without a
+          # manual review. Falls back to GITHUB_TOKEN before the secret is set (#719).
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+          target-branch: stable
+
+      # NOTE: stable release PRs are intentionally NOT auto-merged here
+      # anymore. Fixes accumulate in the rolling release PR and are cut as
+      # ONE patch version per day by release-stable-daily.yml (18:00 UTC,
+      # or on demand via workflow_dispatch / a manual merge of the release
+      # PR). Beta keeps instant releases — see release-please-beta.yml —
+      # because same-day reporter verification depends on it.
 
       - name: Output Release Info
         if: ${{ steps.release.outputs.release_created }}
@@ -34,3 +44,16 @@ jobs:
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "Docker images will be built and tagged with this version." >> $GITHUB_STEP_SUMMARY
 
+  # Best-effort "What's New" highlights on the freshly-created release. Runs in
+  # this same workflow run (not a `release:` trigger) because release-please
+  # creates the release with GITHUB_TOKEN, which never starts new workflow runs.
+  whatsnew:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created }}
+    permissions:
+      contents: write   # edit the release body
+      models: read       # GitHub Models (free tier)
+    uses: ./.github/workflows/whatsnew-highlights.yml
+    with:
+      tag: ${{ needs.release-please.outputs.tag_name }}
+

.github/workflows/release-stable-daily.yml

@@ -0,0 +1,86 @@
+name: Cut Stable Release (daily batch)
+
+# Stable fixes accumulate in release-please's rolling release PR instead of
+# each cutting its own patch version (the old per-merge auto-merge produced
+# e.g. 3.45.8 AND 3.45.9 on the same day). This workflow merges the open
+# stable release PR once a day, so a day of N bugfixes ships as ONE version
+# with all N changelog entries — and one Docker build instead of N.
+#
+# - schedule only fires from the default branch (main); the stable copy of
+#   this file is inert and exists to keep the branches in sync.
+# - Need a release NOW? Run this via workflow_dispatch, or merge the
+#   release PR by hand — the schedule is a default, not a gate.
+# - Approval/merge mechanics mirror the old inline step (#719): approve as
+#   github-actions[bot] (GITHUB_TOKEN, a valid distinct reviewer), enable
+#   auto-merge as the PAT so the merge attributes to a real identity and
+#   triggers the tag-cutting run. --auto waits for green checks.
+
+on:
+  schedule:
+    - cron: '0 18 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  merge-stable-release-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Approve and enable auto-merge on the open stable release PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_PAT: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          # No checkout — set the repo explicitly so gh works without a
+          # git remote (same pattern as whatsnew, 2a5f0a8).
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if [ -z "$RELEASE_PAT" ]; then
+            echo "RELEASE_PLEASE_TOKEN not set — skipping (manual review required)."
+            exit 0
+          fi
+          # Strict selection (review P1): this job runs daily even without a
+          # stable push, and `gh pr list --head` matches the branch NAME only
+          # — a fork PR can spoof `release-please--branches--stable`. Pin the
+          # base to stable AND require a same-repo head (isCrossRepository
+          # == false); a fork PR is cross-repository, so it can never be
+          # picked and auto-merged with the privileged PAT.
+          pr=$(gh pr list \
+            --base stable \
+            --head release-please--branches--stable \
+            --state open \
+            --json number,isCrossRepository \
+            --jq '[.[] | select(.isCrossRepository == false)] | .[0].number // empty')
+          if [ -z "$pr" ]; then
+            echo "No open same-repo stable release PR — nothing to cut today."
+            exit 0
+          fi
+          # Approve is tolerant — a pre-existing approval already satisfies
+          # branch protection and re-approving can return non-zero.
+          gh pr review "$pr" --approve --body "Automated approval — daily stable release batch (release-please version bump + changelog)." || echo "::warning::approve returned non-zero (PR may already be approved)"
+          # But the auto-merge enable is the load-bearing step: this scheduled
+          # job is the ONLY automatic stable cut, so DON'T swallow its failure
+          # (review P2) — an expired/under-scoped PAT would otherwise stop
+          # releases while the workflow stays green.
+          GH_TOKEN="$RELEASE_PAT" gh pr merge "$pr" --squash --auto
+          # `gh pr merge --auto` merges IMMEDIATELY when the required checks
+          # are already green — the normal case at 18:00, since the fixes
+          # merged hours earlier and CI passed. So success is EITHER the PR is
+          # already merged OR an auto-merge request is now pending; only a PR
+          # that is still open with no auto-merge request is a real failure
+          # (expired/under-scoped PAT) worth failing the job on (review round 2).
+          # One snapshot of both fields (review round 3): querying state and
+          # autoMergeRequest separately races — auto-merge can complete
+          # between the two calls, so the first sees OPEN and the second sees
+          # the request already cleared on the now-merged PR → false failure.
+          read -r state automerge < <(gh pr view "$pr" --json state,autoMergeRequest \
+            --jq '[.state, (.autoMergeRequest != null)] | @tsv')
+          if [ "$state" = "MERGED" ]; then
+            echo "Stable release PR #$pr merged immediately (checks were already green)."
+          elif [ "$automerge" = "true" ]; then
+            echo "Auto-merge enabled on stable release PR #$pr — merges when checks are green."
+          else
+            echo "::error::stable release PR #$pr is still open with no auto-merge — check RELEASE_PLEASE_TOKEN scope/expiry."
+            exit 1
+          fi

.github/workflows/schema-drift.yml

@@ -0,0 +1,186 @@
+name: Schema drift (#530)
+
+# Verifies that `migrate:safe` can recover a DB that's been seeded only
+# by `initializeDatabase()` — the recovery scenario where the migrations
+# tracking table is empty but the schema already has the modern bootstrap.
+#
+# This is NOT how production reaches its state on normal installs or
+# upgrades. The scenario only fires when:
+#   - A backup was restored that captured tables but not the migrations
+#     table (manifest divergence),
+#   - Someone manually invoked initializeDatabase() outside the migration
+#     runner (recovery / debugging),
+#   - The DB was moved between systems and the migrations table was not
+#     copied along.
+#
+# When `detectExistingSchema()` sees the modern-bootstrap fingerprint
+# (photo_categories + cms_pages tables) but an empty migrations table,
+# it treats it as an "existing deployment" — which runs the legacy
+# chain first. Legacy/008 renames email_templates.subject → subject_en,
+# but core/029 (which runs later in this chain) inserts email templates
+# referencing the pre-rename column name. The chain dies with a
+# "column subject does not exist" error.
+#
+# Fix (in the same PR as this workflow): when the modern-bootstrap
+# fingerprint is detected, mark all legacy migrations as applied so the
+# chain matches what a fresh install runs — only core/*, in order.
+#
+# This workflow boots the failing scenario from scratch on every PR
+# that touches the migrations or db.js, so any future migration with
+# the same shape is caught before merge.
+
+on:
+  # No `paths:` filter — branch protection on `main` + `stable` lists
+  # `upgrade-from-bootstrap` as a REQUIRED check. A path-filtered
+  # trigger that skipped on unrelated PRs would leave the required
+  # check "missing" forever, blocking every PR that doesn't touch
+  # migrations. The ~75-second cost on every PR buys an unconditional
+  # safety net. (Branches also updated post-#669 rename: beta → main,
+  # old main → stable.)
+  push:
+    branches: [main, stable]
+  pull_request:
+    branches: [main, stable]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  upgrade-from-bootstrap:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    services:
+      postgres:
+        image: postgres:15-alpine
+        env:
+          POSTGRES_USER: picpeak
+          POSTGRES_PASSWORD: testpass
+          POSTGRES_DB: picpeak_drift
+        options: >-
+          --health-cmd "pg_isready -U picpeak -d picpeak_drift"
+          --health-interval 2s
+          --health-timeout 2s
+          --health-retries 30
+        ports:
+          - 5432:5432
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: backend/package-lock.json
+
+      - name: Install backend deps
+        working-directory: ./backend
+        run: npm ci
+
+      # Step 1: simulate the recovery state — DB has the modern bootstrap
+      # (post-initializeDatabase) but no migrations recorded. Calling
+      # initializeDatabase() directly outside the migration runner is the
+      # one-line repro for backup-restore-lost-migrations and manual-
+      # invocation paths.
+      - name: Seed DB with initializeDatabase() only
+        working-directory: ./backend
+        env:
+          NODE_ENV: production
+          DATABASE_CLIENT: pg
+          DB_HOST: localhost
+          DB_PORT: 5432
+          DB_USER: picpeak
+          DB_PASSWORD: testpass
+          DB_NAME: picpeak_drift
+        run: |
+          node -e "require('./src/database/db').initializeDatabase().then(() => { console.log('bootstrap ok'); process.exit(0); }).catch(e => { console.error('bootstrap FAILED:', e.message); process.exit(1); })"
+
+      # Sanity-check the recovery shape before migrate:safe runs. If
+      # initializeDatabase() ever stops producing photo_categories +
+      # cms_pages, the fingerprint check would silently no-op and this
+      # workflow would lose its teeth — assert the precondition.
+      - name: Assert recovery-state fingerprint
+        env:
+          PGPASSWORD: testpass
+        run: |
+          installed=$(psql -h localhost -U picpeak -d picpeak_drift -tAc "SELECT count(*) FROM pg_tables WHERE schemaname='public' AND tablename IN ('photo_categories', 'cms_pages')")
+          if [ "$installed" != "2" ]; then
+            echo "FAIL: expected photo_categories + cms_pages from initializeDatabase(); got $installed."
+            psql -h localhost -U picpeak -d picpeak_drift -c "SELECT tablename FROM pg_tables WHERE schemaname='public' ORDER BY tablename"
+            exit 1
+          fi
+          # initializeDatabase() doesn't create the `migrations` tracking
+          # table — that's the migrate:safe runner's job. So in the recovery
+          # scenario, the table either (a) doesn't exist yet or (b) exists
+          # but is empty (e.g. someone created it but didn't populate it).
+          # Both are valid recovery states; check via to_regclass first so
+          # we don't parse a SELECT against a nonexistent table.
+          has_migrations_table=$(psql -h localhost -U picpeak -d picpeak_drift -tAc "SELECT to_regclass('public.migrations')::text")
+          if [ -z "$has_migrations_table" ]; then
+            migrations_count=0
+          else
+            migrations_count=$(psql -h localhost -U picpeak -d picpeak_drift -tAc "SELECT count(*) FROM migrations")
+          fi
+          if [ "$migrations_count" != "0" ]; then
+            echo "FAIL: migrations table should be empty for the recovery scenario; has $migrations_count rows."
+            exit 1
+          fi
+          echo "ok: recovery state confirmed (bootstrap tables present, migrations table empty or absent)."
+
+      # Step 2: run migrate:safe — the test. Before #530's fix in
+      # detectExistingSchema, this died at core/029 with a "column
+      # subject does not exist" error. After the fix, it should complete
+      # cleanly with every migration either applied or marked.
+      - name: Run migrate:safe against the recovery state
+        working-directory: ./backend
+        env:
+          NODE_ENV: production
+          DATABASE_CLIENT: pg
+          DB_HOST: localhost
+          DB_PORT: 5432
+          DB_USER: picpeak
+          DB_PASSWORD: testpass
+          DB_NAME: picpeak_drift
+        run: npm run migrate:safe
+
+      # Step 3: schema-shape assertion. A fresh install through migrate:
+      # safe produces 48 tables; the recovery scenario should converge
+      # to the same number. Off-by-one is fine but a 10+ table delta
+      # means a migration silently bailed in the recovery path.
+      - name: Assert final schema matches fresh-install shape
+        env:
+          PGPASSWORD: testpass
+        run: |
+          tables=$(psql -h localhost -U picpeak -d picpeak_drift -tAc "SELECT count(*) FROM pg_tables WHERE schemaname='public'")
+          echo "Final table count: $tables"
+          # Allow a small drift window — exact count creeps over time as
+          # new migrations land; tight pin would force a workflow edit
+          # on every schema PR. 40+ is a healthy floor that catches the
+          # original bug (which left 17 tables) while staying robust to
+          # forward changes.
+          if [ "$tables" -lt 40 ]; then
+            echo "FAIL: too few tables ($tables) — migrate:safe likely bailed mid-chain."
+            psql -h localhost -U picpeak -d picpeak_drift -c "SELECT tablename FROM pg_tables WHERE schemaname='public' ORDER BY tablename"
+            exit 1
+          fi
+          echo "ok: schema converged to a fresh-install-equivalent shape."
+
+      # Step 4: verify the legacy migrations were all marked applied
+      # (rather than silently bailing inside the chain). The fix in
+      # detectExistingSchema marks legacy/* when the modern bootstrap
+      # is detected — confirm the markings actually landed.
+      - name: Assert legacy migrations marked applied
+        env:
+          PGPASSWORD: testpass
+        run: |
+          legacy_count=$(psql -h localhost -U picpeak -d picpeak_drift -tAc "SELECT count(*) FROM migrations WHERE filename LIKE '008_%' OR filename LIKE '009_%' OR filename LIKE '013_%' OR filename LIKE '019_%' OR filename LIKE '020_%' OR filename LIKE '026_%' OR filename LIKE '028_%'")
+          if [ "$legacy_count" -lt 7 ]; then
+            echo "FAIL: legacy migrations not marked applied ($legacy_count of 7 expected)."
+            psql -h localhost -U picpeak -d picpeak_drift -c "SELECT filename FROM migrations WHERE filename LIKE '0%' ORDER BY filename"
+            exit 1
+          fi
+          echo "ok: legacy migrations marked applied by detectExistingSchema."

.github/workflows/tests.yml

@@ -0,0 +1,115 @@
+name: Tests
+
+# Runs the backend Jest suite and the frontend Vitest suite on every PR.
+# Both suites already exist and cover the CRM service layer (quoteService,
+# contractService, invoiceService.*, customerHoursService, eventService.
+# calendar) plus the photo / settings / OG / auth surface — wiring them
+# into CI makes regressions visible at PR time instead of post-merge.
+#
+# Six backend suites are excluded via --testPathIgnorePatterns. They
+# fail on `upstream/beta` too (pre-existing mock/infra issues, NOT CRM
+# regressions). Excluding them here keeps CI green from day 1; revisit
+# each individually as its own fix.
+#
+# Triggers on any change that could affect either suite. The backend
+# job intentionally omits frontend paths and vice versa so unrelated
+# PRs don't pay both build costs.
+
+on:
+  push:
+    branches: [main, beta, stable]
+  pull_request:
+    branches: [main, beta, stable]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    # The .picpeak restore suites gate their real-Postgres cases behind
+    # PICPEAK_PG_TEST_URL and `describe.skip` themselves out when it is
+    # unset — so until now they never ran here. That hid the half that
+    # matters: sequence resync, operator/role preservation across a
+    # cross-instance restore, and (with #1041) whether a SQLite-shaped
+    # row actually lands in Postgres with the right STORED VALUES rather
+    # than merely not throwing. Everything else in the suite still runs
+    # on SQLite; this service only un-gates those cases.
+    services:
+      postgres:
+        image: postgres:15-alpine
+        env:
+          POSTGRES_USER: picpeak
+          POSTGRES_PASSWORD: testpass
+          POSTGRES_DB: picpeak_test
+        options: >-
+          --health-cmd "pg_isready -U picpeak -d picpeak_test"
+          --health-interval 2s
+          --health-timeout 2s
+          --health-retries 30
+        ports:
+          - 5432:5432
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: backend/package-lock.json
+
+      - name: Install backend deps
+        working-directory: ./backend
+        run: npm ci
+
+      - name: Run Jest suite
+        working-directory: ./backend
+        env:
+          # backupService tests would otherwise try a real S3 round-trip.
+          # The S3 path itself is covered separately by the integration
+          # suite when MinIO is provisioned.
+          SKIP_S3_TESTS: 'true'
+          # Un-gates the real-Postgres cases in the .picpeak restore suites
+          # (see the `services:` note above). Absent it they silently skip.
+          PICPEAK_PG_TEST_URL: 'postgres://picpeak:testpass@127.0.0.1:5432/picpeak_test'
+        run: |
+          # Excluded suites — fail on upstream/beta too, tracked
+          # separately as test-infra debt:
+          #   adminSettings.logo                  — supertest fixture
+          #   integration/adminPhotos.reference   — supertest fixture
+          #   integration/webhookDelivery         — supertest fixture
+          #   services/backupService.enhanced     — knex mock chain
+          #   routes/__tests__/adminAuth          — supertest fixture
+          # (adminNotifications was excluded; #597 fix re-enables it.)
+          npx jest \
+            --testPathIgnorePatterns='/node_modules/|adminSettings\.logo\.test|integration/adminPhotos\.reference|integration/webhookDelivery|backupService\.enhanced|routes/__tests__/adminAuth' \
+            --ci
+
+  frontend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend deps
+        working-directory: ./frontend
+        run: npm ci
+
+      - name: Run Vitest suite
+        working-directory: ./frontend
+        run: npm test -- --run

.github/workflows/whatsnew-highlights.yml

@@ -0,0 +1,98 @@
+# What's New highlights — GitHub Models release step (reusable)
+#
+# Called by the release-please workflows AFTER a release is created
+# (release-please.yml for `stable`, release-please-beta.yml for `main`). It runs
+# as a job in the SAME workflow run rather than on its own `release: published`
+# trigger, because release-please creates the release with the default
+# GITHUB_TOKEN and GitHub does not start new workflow runs from token-generated
+# events — a standalone `release:` workflow would simply never fire.
+#
+# What it does: condenses the new release's "### Features" into <=8 short
+# bullets via GitHub Models (free tier, `models: read`) and injects a
+# `<!-- whatsnew -->` block at the top of the release notes. The app reads that
+# block (backend utils/whatsNew.parseWhatsNew) and falls back to the raw
+# Features list for releases without it — so this is purely a quality upgrade,
+# never a hard dependency. Failure is isolated by `continue-on-error` + the
+# deterministic fallback below, so it can never break a release.
+#
+# GitHub Models is OPTIONAL. If it is disabled/unavailable for the org the AI
+# step fails soft (continue-on-error) and the deterministic fallback produces
+# the bullets instead — the feature works either way, Models just polishes them.
+#
+# Validated end-to-end on a fork (extract -> openai/gpt-4o-mini -> inject into
+# real release notes; app parseWhatsNew() reads the block back).
+
+name: What's New highlights
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: Release tag to annotate (e.g. v2.3.0)
+        required: true
+        type: string
+
+jobs:
+  highlights:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # to edit the release body
+      models: read      # GitHub Models (free tier)
+    # GH_REPO at job scope so every `gh` call targets the right repo without
+    # needing an actions/checkout step. Without this, `gh` falls back to
+    # parsing `.git/config` in the runner's empty workspace and dies with
+    # "fatal: not a git repository" — which hard-fails the whole job before
+    # any continue-on-error can save it.
+    env:
+      GH_REPO: ${{ github.repository }}
+    steps:
+      - name: Extract Features from the published release
+        id: feat
+        # Belt-and-braces: the job-level comment says "never let highlights
+        # break a release", but the original wiring only marked the AI +
+        # inject steps as continue-on-error. A hiccup here (rate limit,
+        # transient API error) would still hard-fail the job. Match the
+        # design intent and fail soft.
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ inputs.tag }}
+        run: |
+          BODY=$(gh release view "$TAG" --json body -q .body)
+          FEATURES=$(printf '%s\n' "$BODY" | awk '/^#{2,4} +Features/{f=1;next} /^#{1,4} +\S/{f=0} f')
+          { echo "features<<EOF"; printf '%s\n' "$FEATURES"; echo EOF; } >> "$GITHUB_OUTPUT"
+
+      - name: Summarize with GitHub Models
+        if: ${{ steps.feat.outputs.features != '' }}
+        id: ai
+        continue-on-error: true   # Models may be disabled/unavailable for the org; fall back deterministically below
+        uses: actions/ai-inference@v1
+        with:
+          model: openai/gpt-4o-mini   # catalog id (verified present); openai/gpt-4.1-mini or openai/gpt-5-nano also work
+          system-prompt: >
+            You write release highlights for the admins of a self-hosted
+            photo-gallery + CRM app. Given raw changelog "Features" lines, output
+            AT MOST 8 markdown bullets, each 3-4 words, user-facing, no scopes,
+            no jargon, no issue numbers. One bullet per distinct user-visible
+            feature. Output ONLY "- " bullets, nothing else.
+          prompt: ${{ steps.feat.outputs.features }}
+
+      - name: Inject the What's New block
+        if: ${{ steps.feat.outputs.features != '' }}
+        continue-on-error: true   # never let highlights break a release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ inputs.tag }}
+          AI: ${{ steps.ai.outputs.response }}
+          FEATURES: ${{ steps.feat.outputs.features }}
+        run: |
+          BULLETS="$AI"
+          # Deterministic fallback if the model returned nothing (e.g. Models not yet enabled).
+          if [ -z "$BULLETS" ]; then
+            BULLETS=$(printf '%s\n' "$FEATURES" | head -8 \
+              | sed -E 's/^\* \*\*[^:]+:\*\* */- /; s/ \(\[[^]]*\]\([^)]*\)\)//g')
+          fi
+          BODY=$(gh release view "$TAG" --json body -q .body)
+          # Idempotent: strip any prior block before re-injecting.
+          BODY=$(printf '%s' "$BODY" | perl -0pe 's/<!--\s*whatsnew\s*-->.*?<!--\s*\/whatsnew\s*-->\n*//is')
+          gh release edit "$TAG" --notes "$(printf '<!-- whatsnew -->\n%s\n<!-- /whatsnew -->\n\n%s' "$BULLETS" "$BODY")"

.gitignore

@@ -129,3 +129,28 @@ docker-compose.dev.yml
 
 # New layout development files
 new-layouts/
+
+# Backend runtime storage (generated media, previews, thumbnails,
+# CRM/accounting documents) — never commit. Matches main: a dev instance
+# writes event photos into backend/storage/, and the narrower
+# business-docs-only rule let `git add -A` sweep them into a commit.
+backend/storage/
+
+# Python bytecode. The ML sidecar lives on main only, so this branch never
+# needed the rule — which is how a `git add -A` from a shared working tree
+# committed 16 .pyc files here in #1247.
+__pycache__/
+*.pyc
+
+# Issue / PR screenshots belong on a `screenshots/*` branch, never on main or
+# stable — that is what those branches exist for. Two landed at the repo root
+# on main in #1241 and shipped as part of the source tree; nothing stopped it.
+#
+# Anchored with a leading slash so docs/ keeps its own images.
+/issue-*.png
+/issue-*.jpg
+/screenshot-*.png
+/screenshot-*.jpg
+/*-screenshot.png
+/*-screenshot.jpg
+

.release-please-manifest-beta.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.32.3-beta.0"
+  ".": "3.83.0-beta.0"
 }

.release-please-manifest.json

@@ -1,3 +1 @@
-{
-  ".": "2.6.1"
-}
+{".":"3.46.12"}

CODE_OF_CONDUCT.md

@@ -20,7 +20,7 @@ We are committed to providing a welcoming and inspiring community for all photog
 
 ## Enforcement
 
-Instances of unacceptable behavior may be reported by [opening an issue](https://github.com/the-luap/picpeak/issues/new?labels=conduct) on GitHub. All complaints will be reviewed and investigated promptly and fairly.
+Instances of unacceptable behavior may be reported by [opening an issue](https://github.com/PicPeak/picpeak/issues/new?labels=conduct) on GitHub. All complaints will be reviewed and investigated promptly and fairly.
 
 ## Attribution
 

CONTRIBUTING.md

@@ -33,12 +33,12 @@ Enhancement suggestions are tracked as GitHub issues. When creating an enhanceme
 
 Unsure where to begin? You can start by looking through these issues:
 
-* [Good first issues](https://github.com/the-luap/picpeak/labels/good%20first%20issue) - issues which should only require a few lines of code
-* [Help wanted issues](https://github.com/the-luap/picpeak/labels/help%20wanted) - issues which need extra attention
+* [Good first issues](https://github.com/PicPeak/picpeak/labels/good%20first%20issue) - issues which should only require a few lines of code
+* [Help wanted issues](https://github.com/PicPeak/picpeak/labels/help%20wanted) - issues which need extra attention
 
 ### Pull Requests
 
-1. **Fork the repo** and create your branch from `main`
+1. **Fork the repo** and create your branch from `main` (active development)
 2. **Install dependencies**:
    ```bash
    cd backend && npm install
@@ -50,7 +50,10 @@ Unsure where to begin? You can start by looking through these issues:
    - Linting passes: `npm run lint`
 4. **Write tests** if you've added code
 5. **Update documentation** if needed
-6. **Create a Pull Request**
+6. **Attach a screenshot for any UI change** (see below)
+7. **Create a Pull Request**
+
+> **📸 Screenshots are required for UI changes.** Any PR that changes a user-facing surface — a component, page, layout, style, or in-app copy — must include at least one screenshot of the result in the PR description, showing before/after where it helps reviewers see the difference. PRs that touch the UI without a screenshot will be asked to add one before review. Backend-only or otherwise non-visual changes don't need one.
 
 ## 💻 Development Setup
 
@@ -79,6 +82,15 @@ cp .env.example .env
 docker-compose -f docker-compose.dev.yml up
 ```
 
+**After pulling changes that touch `backend/package.json` / `backend/package-lock.json` (or the frontend equivalents)**, rebuild the affected image so the live-mounted source can `require()` the new deps:
+
+```bash
+docker compose -f docker-compose.dev.yml up -d --build backend
+# (or `frontend`, or both)
+```
+
+The dev compose bakes `node_modules` into the image while live-mounting `./backend/src` and `./frontend/src` from disk. A dep added on disk won't be picked up until the image is rebuilt — typical symptom is a `MODULE_NOT_FOUND` restart loop on the affected container.
+
 ### Running Tests
 
 ```bash
@@ -144,17 +156,38 @@ picpeak/
 │   └── public/          # Static assets
 ```
 
+## 🌿 Branch model
+
+PicPeak runs on two long-lived branches:
+
+| Branch | Role | What targets it |
+|---|---|---|
+| **`main`** | Active development. The next release is being assembled here. | Feature PRs. Most bugfix PRs. |
+| **`stable`** | Curated release channel. Production-recommended. | Security fixes and regular bugfix backports, kept small and free of unrelated features. |
+
+### Which branch should my PR target?
+
+- **New feature** → target `main`.
+- **Bugfix that ONLY affects active dev** → target `main`.
+- **Bugfix that current stable users need** → target `main`; regular bug fixes are generally backported automatically to `stable`. Maintainers handle conflicts or create a separate focused backport PR when needed.
+- **Security vulnerability** → report privately using [SECURITY.md](SECURITY.md). Security fixes are always released on both `stable` and `main`; coordinate any fix with the maintainers before opening a public PR.
+
+**Hard rule on PR scope**: bugfix PRs against `stable` must be small enough to backport without conflict. Omnibus PRs (e.g. five unrelated sub-features) are fine for `main`, but never for `stable` — they make the next `main → stable` merge painful and break the "stable is always shippable" invariant.
+
+If you're not sure which branch to target, default to `main` and a maintainer will retarget during review.
+
 ## 🔄 Release Process
 
-1. Update version numbers in package.json files
-2. Update CHANGELOG.md
-3. Create a new release on GitHub
-4. Docker images are automatically built and published
+Releases are cut independently from `main` (pre-release versions for the active channel) and `stable` (semver releases for the curated channel). `release-please` handles version bumps, changelog generation, and Docker image publication automatically — contributors don't update `package.json` or `CHANGELOG.md` by hand.
+
+Periodic `main → stable` merges promote a batch of `main` work to the stable channel. The maintainer chooses when (typically every ~4 weeks, sooner if a hot bug demands it).
+
+See [RELEASING.md](RELEASING.md) for the full operational doc (promotion criteria, conflict-resolution checklist for the `main → stable` merge, hotfix backport path, versioning rules).
 
 ## 📮 Contact
 
-- Create an [issue](https://github.com/the-luap/picpeak/issues) for bugs or features
-- Join [discussions](https://github.com/the-luap/picpeak/discussions) for questions
-- Security issues: Open a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
+- Create an [issue](https://github.com/PicPeak/picpeak/issues) for bugs or features
+- Join [discussions](https://github.com/PicPeak/picpeak/discussions) for questions
+- Security vulnerabilities: Follow the [security policy](SECURITY.md) and use [private vulnerability reporting](https://github.com/PicPeak/picpeak/security/advisories/new)
 
-Thank you for contributing! 🎉
+Thank you for contributing! 🎉

README.md

@@ -1,5 +1,13 @@
 # 📸 PicPeak - Open Source Photo Sharing for Events
 
+> [!IMPORTANT]
+> **PicPeak has moved to its own GitHub organization.**
+>
+> - **Docker images** are now published at `ghcr.io/picpeak/picpeak/{backend,frontend}`. The old path (`ghcr.io/the-luap/picpeak/...`) is no longer served — update your `docker-compose.yml`.
+> - **Branches**: active development is now on `main` (was `beta`); the curated stable channel is now `stable` (was `main`). Existing PRs and clones auto-redirect via GitHub.
+>
+> See **[`docs/migration-to-org.md`](docs/migration-to-org.md)** for the one-line `docker-compose.yml` edit and full details.
+
 <div align="center">
   <img src="docs/picpeak-logo.png" alt="PicPeak Logo" width="300" />
   
@@ -49,6 +57,7 @@ Unlike expensive SaaS solutions, PicPeak gives you:
 - 🔐 **Password Protection** - Secure client galleries
 - 📧 **Automated Emails** - Creation confirmations and expiration warnings
 - 📊 **Analytics Dashboard** - Track views, downloads, and engagement
+- 📽️ **Live Slideshow** - A separate fullscreen "Diashow" link per event for projectors at live events — auto-picks-up new uploads while it runs, with transitions, a logo watermark, and image-fit/colour options ([guide](docs/live-slideshow.md))
 - 🎨 **Custom Themes** - Match your brand perfectly
 - 🌐 **Public Landing Page** - Publish a curated marketing page when guests visit your root URL
 
@@ -68,38 +77,62 @@ Unlike expensive SaaS solutions, PicPeak gives you:
 - 🛡️ **Security First** - JWT auth, rate limiting, CORS protection
 - 📈 **Scalable** - From small studios to large agencies
 
+### For Studios — CRM & Accounting (Beta · off by default)
+- 📝 **Quotes → Contracts → Invoices** - One deal lineage; cancel-and-reissue (Storno) keeps issued invoices immutable
+- ⏱️ **Hours Logging & Calendar** - Per-customer time tracking; admin calendar of events, logged hours, and pending quotes/contracts
+- 🧾 **Inbound Supplier Invoices & Expenses** - Capture received invoices (upload/camera, rasterised server-side), categorise, and re-bill costs to clients
+- 📊 **Tax Report & Accountant Export** - Period-scoped income/cost report with VAT breakdown; PDF/CSV plus a Treuhänder/Banana (Swiss/LI) journal export, scopable to income-only or cost-only
+- 🌍 **VAT & Multi-currency** - Single VAT-code registry snapshotted onto each document; data-driven per-country rates
+- ⚠️ **Verify locally** - Feature-flagged off by default. Seeded contracts, QR/IBAN and tax defaults are **examples only** — review your own legal **and tax** regulations first (see disclaimers below)
+
 ## 🚀 Quick Start
 
 Get PicPeak running in under 5 minutes:
 
 ```bash
 # Clone the repository
-git clone https://github.com/the-luap/picpeak.git
+git clone https://github.com/PicPeak/picpeak.git
 cd picpeak
 
-# Copy environment template
+# Copy the environment template — the defaults work out of the box.
+# Machine secrets (JWT, DB, Redis) are auto-generated on first run, and the
+# admin account is created in the browser (see below). Edit .env only to
+# customise (domain, SMTP, storage paths, …) — nothing is required.
 cp .env.example .env
 
-# Edit configuration (required: JWT_SECRET)
-nano .env
-
 # Start with Docker Compose
 docker compose up -d
 
 # Access at http://localhost:3000
 ```
 
-Note on Docker file permissions (PUID/PGID)
-- When using bind mounts (e.g., `./storage`, `./data`, `./logs`, `./events`), ensure the container user can write to these host folders. The backend runs as a non‑root user by default.
-- Set `PUID` and `PGID` in your `.env` to match your host user’s UID/GID (run `id -u` and `id -g` on the host). Compose maps the container user to these values.
-- Example in `.env`:
-  - `PUID=1000`
-  - `PGID=1000`
-- Without this, creating events, uploads, thumbnails, or logs can fail with "Permission denied".
+### First run — create your admin account
+
+On first start with no `ADMIN_PASSWORD` set, PicPeak has **no admin account yet** and greets you with an in-browser setup screen — no credentials in `.env`:
+
+1. Open **http://localhost:3000/admin** — you'll be redirected to `/setup`.
+2. Read the **one-time setup token** from the 0600 file the backend writes it to
+   (it is deliberately *not* printed to the logs — that would leave a live
+   bootstrap credential in `docker logs`):
+   ```bash
+   docker compose exec backend cat /app/data/SETUP_TOKEN
+   ```
+   It is bind-mounted, so `sudo cat data/SETUP_TOKEN` on the host works too. Only
+   if that file could not be written does the backend fall back to logging the
+   token (`docker compose logs backend | grep -i "setup token"`).
+3. Paste the token, set your admin **email + password**, and you're in. The token is single-use, and the setup screen closes permanently once an admin exists.
+
+> Prefer the old behaviour? Set `ADMIN_PASSWORD` in `.env` and PicPeak auto-creates the admin on first boot instead (credentials written to `data/ADMIN_CREDENTIALS.txt`).
+
+Note on Docker file permissions
+- The backend container starts as root, chowns bind-mounted host directories (`./storage`, `./data`, `./logs`) to UID 1001 (`nodejs`), then drops privileges via `su-exec` before running the app. No host-side setup needed for fresh installs.
+- If you pin `user:` in a compose override (e.g. to map a specific host UID), the self-chown is skipped and you must pre-chown the host directories to that UID — see [docs.picpeak.app/deployment/docker#permissions](https://docs.picpeak.app/deployment/docker#permissions).
+
+**ARM64 (aarch64) systems:** Pre-built images include native `linux/arm64`, no platform flags or emulation needed. If you're on an older image tag that's still amd64-only, see [docker-compose.amd64.override.yml](docker-compose.amd64.override.yml) for a transitional fallback.
 
 ## 🔄 Release Channels
 
-PicPeak offers two release channels for different needs:
+PicPeak offers two release channels for different needs. Stable promotions are cut from a known-good beta point every 4–6 weeks — see [RELEASING.md](RELEASING.md) for the maintainer's promotion criteria and cadence policy.
 
 ### Stable Channel (Recommended)
 - Production-ready releases
@@ -148,7 +181,8 @@ Full documentation lives at **[docs.picpeak.app](https://docs.picpeak.app)** —
 - 🚀 [**Deployment**](https://docs.picpeak.app/deployment) - Docker, environment variables, reverse proxy, SSL
 - ⚙️ [**Admin Settings**](https://docs.picpeak.app/guides/admin-settings) - Every tab in the Settings panel
 - 🎯 [**Creating Events**](https://docs.picpeak.app/guides/creating-events) - Full event field reference
-- 💾 [**Backup & Restore**](https://docs.picpeak.app/guides/backup-restore) - Local, S3, rsync destinations
+- 📽️ [**Live Slideshow**](https://docs.picpeak.app/features/live-slideshow) - Fullscreen projector view that auto-updates during live events
+- 💾 [**Backup & Restore**](https://docs.picpeak.app/guides/backup-restore) - Backup configuration, restore wizard, full disaster recovery
 - 🔌 [**API Reference**](https://docs.picpeak.app/api) - REST endpoints, OpenAPI spec, webhooks
 - 🪝 [**Webhooks**](https://docs.picpeak.app/features/webhooks) - Event payloads, signing, filters, templates
 
@@ -179,6 +213,7 @@ Perfect for:
 - 📸 **Portrait Studios** - Client galleries with download limits
 - 🏢 **Corporate Events** - Internal photo sharing with branding
 - 🎓 **School Photography** - Secure parent access with expiration
+- 📽️ **Live Events** - Put a [Live Slideshow](docs/live-slideshow.md) on the venue projector that updates as you shoot
 
 ## 🏗️ Tech Stack
 
@@ -293,7 +328,12 @@ For local development with a receiver on the same machine or docker network, set
 
 ### Minimum Requirements
 - **CPU**: 2 CPU cores
-- **RAM**: 2GB minimum
+- **RAM**: **4 GB minimum** for a normal photo-upload workload — sharp/libvips
+  decodes the full uncompressed frame before resize, and the default two
+  worker loops at sharp-concurrency 2 can push peak RSS past 1.5 GB on a
+  batch of 20-MP+ photos. On a 2 GB VPS that's enough to OOM-kill the
+  backend mid-batch (surfaces as 503s on thumbnails — see [Low-memory
+  hosts](#low-memory-hosts) below for the recipe to run on 2 GB).
 - **Storage**: 20GB minimum (plus photo storage needs)
 - **OS**: Linux (Ubuntu 20.04+), macOS, or Windows with WSL2
 - **Node.js**: v18.0.0 or higher
@@ -303,6 +343,26 @@ For local development with a receiver on the same machine or docker network, set
 - **Docker**: v20.10.0+
 - **Docker Compose**: v2.0.0+
 
+### Low-memory hosts
+
+Running on 2 GB RAM (e.g. an entry-level VPS) is workable but requires
+tuning the upload-processor concurrency down. The backend auto-detects
+total RAM at startup via `os.totalmem()` — on a host that reports < 3 GB,
+it defaults `UPLOAD_PROCESSOR_CONCURRENCY` to **1** instead of 2 and logs
+a one-shot warning. You can pin the value explicitly in `.env`:
+
+```env
+# Single worker loop — slower batch processing, lower peak RSS
+UPLOAD_PROCESSOR_CONCURRENCY=1
+```
+
+The trade-off is throughput: a single worker processes one photo at a
+time, so a 100-photo batch takes ~2× as long but won't OOM. **Health-check
+note**: if the backend dies under memory pressure, the gallery serves
+`503 Service Unavailable` on thumbnails until Docker's
+`restart: unless-stopped` brings the container back. Persistent 503s
+during/after an upload batch on a low-memory host are almost always this.
+
 ### Video Support Requirements
 When enabling video uploads, consider these additional resources:
 
@@ -336,17 +396,23 @@ See our [Contributing Guide](CONTRIBUTING.md) for details.
 
 ## 📊 Comparison with Alternatives
 
-| Feature | PicPeak | PicDrop | Scrapbook.de |
-|---------|---------|---------|--------------|
-| Self-Hosted | ✅ | ❌ | ❌ |
-| Custom Branding | ✅ Full | Limited | Limited |
-| Monthly Cost | $0 | $29-199 | €19-99 |
-| Storage Limit | Unlimited* | 50-500GB | 100-1000GB |
-| Client Uploads | ✅ | ✅ | ✅ |
-| API Access | ✅ | Paid | ❌ |
-| Open Source | ✅ | ❌ | ❌ |
+| Feature | PicPeak | PicDrop | Scrapbook.de | Pixieset |
+|---------|---------|---------|--------------|----------|
+| Self-Hosted | ✅ | ❌ | ❌ | ❌ |
+| Custom Branding | ✅ Full | Limited | Limited | ✅ (paid) |
+| Monthly Cost | $0* | $29-199 | €19-99 | ~$60 |
+| Storage Limit | Unlimited** | 50-500GB | 100-1000GB | 3GB–Unlimited*** |
+| Client Uploads | ✅ | ✅ | ✅ | Limited |
+| API Access | ✅ | Paid | ❌ | ❌ |
+| Open Source | ✅ | ❌ | ❌ | ❌ |
+| Customer Accounts | ✅ | ❌ | ❌ | ✅ |
+| Quotes / Contracts / Invoices | 🧪 Beta | ❌ | ❌ | ✅ |
+| Incoming Invoices & Accounting | 🧪 Beta | ❌ | ❌ | ❌ |
 
-*Limited only by your server storage
+*You still bring your own server (own hardware or a VPS) and, if you want one, a domain.
+**Limited only by your server storage.
+***Pixieset's "unlimited" is photos only; video is capped by plan (roughly 0–10 h depending on tier).
+🧪 Beta = built but feature-flagged off by default (see [Beta Features](#-beta-features-use-at-your-own-risk)).
 
 ## 🛡️ Security
 
@@ -358,7 +424,7 @@ PicPeak takes security seriously:
 - 📝 Activity logging
 - 🔒 Secure file access
 
-Found a security issue? Please open a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
+Found a security issue? Please open a [security issue](https://github.com/PicPeak/picpeak/issues/new?labels=security) on GitHub
 
 ## 📸 Screenshots
 
@@ -403,6 +469,7 @@ These features are currently in beta testing and may have limited functionality
 
 | Feature | Description | Status |
 |---------|-------------|--------|
+| **CRM & Accounting Module** | Quotes, contracts, invoices (+ Storno), hours logging, calendar, and tax report — plus inbound supplier-invoice capture, internal expenses, and a Treuhänder/Banana (Swiss/LI) accountant-journal export. Feature-flagged off by default. Seeded contract blocks, payment terms, IBAN / QR-bill and tax defaults are **examples only** and need legal / financial / **tax** review before customer-facing use. See [docs.picpeak.app/features/crm](https://docs.picpeak.app/features/crm). | 🧪 Beta |
 | **Simple Deployment Script** | One-click deployment script for quick server setup with automated configuration and dependency installation | 🧪 Beta |
 
 ### 📋 Future Enhancements
@@ -437,6 +504,16 @@ Other ways to support without spending anything: ⭐ star the repo, share it wit
 
 PicPeak is inspired by the best features of commercial platforms while remaining completely open source. Special thanks to all contributors who make this project possible.
 
+### 👥 Contributors
+
+A huge thank you to the people whose code, reports, and feedback have shaped PicPeak:
+
+- [**@the-luap**](https://github.com/the-luap) — creator and lead maintainer. Started the project and built PicPeak's foundation and the entire gallery experience (events, galleries, uploads, sharing, download protection, templates), plus backup & restore, analytics, system health, branding/theming, and WhatsApp notifications — and the architecture every later feature builds on.
+- [**@Luca-Timo**](https://github.com/Luca-Timo) — native Apple Silicon multi-arch images, external-URL toggle for legal CMS pages, the lazy-loaded folder tree picker, the admin-email picker on event creation, the data-driven self-hosted webfont system, the gallery header/banner decoupling, several typed-API refactors, and the CRM + accounting suite (quotes/contracts/invoices, hours logging, calendar, tax report, inbound supplier-invoice capture, expenses, and the Treuhänder/Banana export). Consistently raises the bar with thoughtful PRs.
+- [**@Rekoo-PS**](https://github.com/Rekoo-PS) — sharp-eyed bug reporter and product feedback. Filed the issues that drove the login-loop fix, the gallery-loading skeleton work, the redirection cleanup, the mobile-lightbox overhaul, the admin-events search-counter fix, the photo-count column, and the bulk-delete workflow. Also a [BuyMeACoffee](https://buymeacoffee.com/theluap) supporter — the kind of feedback loop that keeps the project useful for real deployments.
+
+If you've contributed and aren't listed here, please open a PR — this list is meant to grow.
+
 ### 🤖 AI-Assisted Development
 
 This project was generated with the assistance of AI technology, but has been:
@@ -447,6 +524,34 @@ This project was generated with the assistance of AI technology, but has been:
 
 We believe in transparent development practices and the responsible use of AI as a tool to accelerate development while maintaining high standards of quality and security.
 
+## ⚠️ CRM & Accounting disclaimers — examples only, verify locally
+
+The CRM & accounting modules (contracts, invoices, QR-bills, the tax
+report and the accountant exports) ship seeded content and computed
+figures that are intended as a **starting point only**:
+
+- **Contract blocks** (image rights, NDA, model release, cancellation,
+  jurisdiction, …) are written by the maintainer, **not by a lawyer**.
+  Every operator must have their lawyer review and adapt them before
+  sending any contract to a customer.
+- **QR-bills and SEPA EPC payloads** are rendered from the data you
+  typed. Picpeak is open source — please scan a test invoice with your
+  bank's app to check the QR actually works. We are not responsible for
+  any mistakes that come from sending an invoice with bad data on it.
+- **Tax, VAT & accounting figures** (the tax report, VAT-payable, the
+  per-rate breakdown, the Treuhänder / Banana export, etc.) are computed
+  from the data you enter and the defaults you configure. They are
+  **guidance only and jurisdiction-specific** — tax rules, VAT rates,
+  deduction schemes (e.g. the Liechtenstein 20 % Gewinnungskosten flat
+  rate) and filing duties differ by country and change over time. **Every
+  operator must check their own tax / VAT regulations and verify the
+  numbers with their accountant / Treuhänder / tax authority before
+  relying on any figure or export.** Picpeak makes no warranty that the
+  output is correct for your jurisdiction or situation.
+
+Read [`docs/crm-disclaimers.md`](docs/crm-disclaimers.md) before
+enabling the Contracts, Invoices or Accounting features.
+
 ## 📄 License
 
 PicPeak is released under the [MIT License](LICENSE). Use it freely for personal or commercial projects.
@@ -465,7 +570,7 @@ PicPeak is released under the [MIT License](LICENSE). Use it freely for personal
   <br>
   <a href="https://www.picpeak.app">Homepage</a> •
   <a href="https://demo.picpeak.app">Live Demo</a> •
-  <a href="https://github.com/the-luap/picpeak">GitHub</a> •
+  <a href="https://github.com/PicPeak/picpeak">GitHub</a> •
   <a href="https://docs.picpeak.app">Documentation</a> •
-  <a href="https://github.com/the-luap/picpeak/issues">Support</a>
+  <a href="https://github.com/PicPeak/picpeak/issues">Support</a>
 </p>

RELEASING.md

@@ -0,0 +1,99 @@
+# Release Process
+
+This document describes how PicPeak releases are cut. It's the maintainer's reference, not user documentation — for the user-facing channel choice (stable vs pre-release) see the [Release Channels section in README.md](README.md#-release-channels).
+
+## TL;DR
+
+- **`main` branch** receives all merged work (active development). Every push triggers a `release-please` PR that proposes the next `vX.Y.Z-beta.N` pre-release. Merging that PR tags the pre-release and publishes Docker images under the `:main` rolling tag + the version-specific tag.
+- **`stable` branch** holds the curated stable channel. Stable releases are cut from a known-good `main` point via a `release/X.Y.Z-merge-from-main` branch and a manual PR to `stable`. Merging that PR triggers `release-please` to propose the stable release.
+- Target cadence: **a stable release every 4–6 weeks**, or sooner if `main` has been quiet and ready for promotion.
+
+> **Branch model background** — `main` (active dev) was previously called `beta`, and `stable` (curated channel) was previously called `main`. The rename happened with #669 to match the convention every other open-source project uses. The mechanics below all reference the post-rename names.
+
+## Cadence target
+
+4–6 weeks between stable releases is the working target. Reasoning:
+
+- Long enough that each stable carries meaningful changes worth the upgrade burden.
+- Short enough that pre-release users aren't carrying the "real" project alone for months — the stable channel should actually be usable as the recommended channel for new installs.
+- Aligns with how release-please surfaces pre-releases (multiple pre-release points usually accumulate inside a 4–6 week window, which gives natural promotion candidates).
+
+This is a target, not a hard rule. Cut sooner if `main` has been quiet and stable longer than usual. Cut later if `main` is in flux for security or migration reasons.
+
+## Promotion criteria
+
+A `main` tip is eligible for promotion to `stable` when **all** of the following hold:
+
+1. **CI green on the candidate `main` tip.** Specifically: `schema-drift` (`upgrade-from-bootstrap`), `fresh-install`, `Tests` (backend Jest + frontend Vitest), the four `Build and Push Docker Images` arch matrices, and `GitGuardian Security Checks`.
+2. **No open `bug`-labelled issues against the candidate for at least 7 days.** Issues fixed-but-not-yet-closed count as fixed; verify their PR is in the candidate `main` tip before closing them out.
+3. **An upgrade walk has been done on real production-shaped data** — apply the candidate's migration chain to a snapshot of the previous stable's DB and verify no manual intervention is required. CI proves fresh-install works; the upgrade walk is what proves the upgrade path works.
+4. **Operator-time smoke** on the candidate: log in, create event, upload photos, share gallery, open as a customer, log out. Catches binary-incompatibility regressions and UI-level breaks that unit tests don't see.
+
+If any of the four fail, the promotion waits. File any blockers as `bug`-labelled issues and let them bake on `main` before re-evaluating.
+
+## How a stable release is cut
+
+The actual mechanics, in order:
+
+1. **Pick the `main` tip.** Confirm it satisfies the four promotion criteria above. Note the exact SHA — that's what you're promoting.
+
+2. **Create the release branch from the `main` tip.**
+   ```bash
+   git push origin <main-tip-sha>:refs/heads/release/X.Y.Z-merge-from-main
+   ```
+   Naming convention: `release/X.Y.Z-merge-from-main`, where `X.Y.Z` is the stable version you intend to land. release-please will write the actual `X.Y.Z` on merge — the branch name is just a human label.
+
+3. **Open a PR to `stable`.** Title: `chore(release): promote main → stable as vX.Y.Z`. Body should summarise the major themes since the previous stable, the migration count, and any operator notes (e.g. "this release adds 22 migrations; existing installs should snapshot before upgrading"). See PR #568 as a worked example (predates the rename; the mechanics are unchanged).
+
+4. **Resolve conflicts.** `stable` almost always has commits `main` doesn't (security backports, release-please's stable-channel release commits, README rewrites). For each conflicting file, decide deliberately:
+   - **`backend/package.json` / `package-lock.json` + `frontend/package.json` / `package-lock.json`** — usually take `main`'s version (superset), but verify any security-pinned deps (`axios`, `nodemailer`, `i18next-http-backend`, `multer`, `tar`) on `main` are `>=` the pinned versions on `stable`. If `stable` has a newer pinned version (e.g. an emergency CVE backport `main` hasn't picked up), take `stable`'s pin.
+   - **`README.md`** — keep `stable`'s version if it has had a recent rewrite that `main` didn't pick up; otherwise take `main`'s.
+   - **`CHANGELOG.md`** — keep `stable`'s; release-please regenerates entries on its next stable cut from the commits going forward.
+   - **`.release-please-manifest.json`** — keep `stable`'s; release-please owns this file.
+   - Any other auto-merged file — spot-check that the auto-merge produced something sensible, especially for security-sensitive files (`backend/src/middleware/`, `backend/src/utils/tokenUtils.js`).
+
+5. **Wait for CI on the PR.** All ten checks (the original eight plus `merge-backend` and `merge-frontend`) must be green. If anything fails, fix on the release branch (NOT on `main` — `main` has already moved on).
+
+6. **Merge.** Standard merge commit, not squash — the PR's history (the individual feature commits) carries forward into `stable`'s log.
+
+7. **release-please picks it up.** Within minutes, release-please will open a new `chore(stable): release X.Y.Z` PR proposing the stable release. Review the auto-generated CHANGELOG.md entries for accuracy, edit if needed, and merge. That merge creates the `vX.Y.Z` git tag, publishes Docker images on the `:stable` and `:latest` tags, and creates the GitHub Release page.
+
+8. **Close the loop.** Bulk-close any `bug` issues that were fixed-but-not-closed and now appear in the released changelog. Reference the merge commit so reporters know which version contains the fix.
+
+## Hotfix path (backport to current stable)
+
+Regular bug fixes are generally backported automatically from `main` to `stable`. Keep backports focused on the fix, without unrelated features, and resolve conflicts manually when needed.
+
+**Security fixes are always released on both `stable` and `main`.** Do not wait for a full promotion to deliver a security update. A fix first applied to `stable` must also be forward-ported to `main`; a fix first applied to `main` must also reach `stable`. See [SECURITY.md](SECURITY.md) for the support policy.
+
+When a backport needs manual handling:
+
+1. Create a `security/cve-backport-X.Y.Z` or `fix/critical-X.Y.Z` branch off `stable`.
+2. Cherry-pick or hand-write the minimal fix.
+3. Open a PR to `stable` with the smallest possible diff.
+4. After merge, release-please will propose a patch-level stable release (e.g. `v3.55.1`).
+5. **Forward-port the fix to `main`** if it isn't already there. Otherwise the next full promotion will reintroduce the bug.
+6. For security fixes, verify that the fix has been published through **both** release channels; merging the code is only part of delivery.
+
+PR #412 ("backport 18 dependency CVE patches from beta") is a worked example of this path (predates the rename; the mechanics are unchanged).
+
+## Versioning
+
+PicPeak follows [Semantic Versioning](https://semver.org/) with one project-specific convention:
+
+- **MAJOR** bumps are reserved for breaking schema changes that require operator action on upgrade (e.g. a migration that's not safe to auto-apply, an env-var rename that can't be auto-detected).
+- **MINOR** bumps for new features, additive schema changes, and any change to the public HTTP API surface.
+- **PATCH** bumps for bug fixes and operator-invisible internal changes.
+- **Pre-release suffix** (`-beta.N`) for every `main`-channel cut; the `N` counter resets on each new MINOR or MAJOR target. The suffix kept the historical `-beta` literal even after the branch rename — operators were already pinning to `v3.x.y-beta.N` and changing the literal would have broken those pins.
+
+release-please derives all of this from conventional commit prefixes (`feat:`, `fix:`, `BREAKING CHANGE:`, etc.) automatically.
+
+## Things that don't go through this process
+
+- **Documentation-only changes** can land on either `stable` or `main` directly (no release cut needed); release-please will pick them up on the next regular release.
+- **Test-only changes** — same.
+- **CI / workflow changes** — same, but be aware they take effect on the branch they land on, so a CI fix targeting `main` won't fix a broken stable-channel workflow until the next promotion.
+
+## When this doc is wrong
+
+If you find yourself working around something here, update the doc before doing the workaround. The point of a written process is that future-you doesn't have to remember the workaround.

SECURITY.md

@@ -1,88 +1,81 @@
 # Security Policy
 
+## Scope
+
+This policy covers the PicPeak backend, frontend, all-in-one (AIO) image, optional
+ML component, and the Docker images published by the PicPeak project. Other
+PicPeak repositories define their own supported versions and release channels.
+
 ## Supported Versions
 
-We release patches for security vulnerabilities. Currently supported versions:
+Security support follows the current release channels:
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 2.x.x   | :white_check_mark: |
-| < 2.0   | :x:                |
+| Version or channel | Security support |
+| --- | --- |
+| Latest stable release from `stable` | Supported; security fixes are published through this channel |
+| Latest beta release from `main` | Supported; security fixes are published through this channel |
+| Superseded stable or beta releases | Upgrade to the latest release in the same channel; older releases are not maintained separately |
+| 2.x and earlier | No longer supported |
+
+See the [latest stable release](https://github.com/PicPeak/picpeak/releases/latest)
+and [all releases, including betas](https://github.com/PicPeak/picpeak/releases).
+Version numbers differ between channels; each channel receives its own updates.
+
+### Security fixes and bug backports
+
+**Security fixes are always released on both `stable` and `main`.** A fix that
+lands on one branch must also reach the other branch and be published through
+both release channels. Security updates do not wait for the next full
+`main`-to-`stable` promotion.
+
+Regular bug fixes are also generally backported automatically to `stable`.
+Backports remain focused on the fix, without pulling in unrelated features.
+Maintainers resolve conflicts or handle a backport manually when necessary.
+
+The [release process](RELEASING.md) describes backports, forward-ports and
+publication. Operators must apply the published updates to their installations.
 
 ## Reporting a Vulnerability
 
-We take the security of PicPeak seriously. If you have discovered a security vulnerability, please follow these steps:
+**Do not report vulnerabilities in public issues, discussions or pull requests.**
 
-### 1. **Do NOT create a public GitHub issue**
+Report privately through:
 
-### 2. Report the vulnerability privately by:
-- **Preferred:** Use [GitHub Private Vulnerability Reporting](https://github.com/the-luap/picpeak/security/advisories/new)
-- **Alternative:** Email us at **info@picpeak.app** with the details
-- Include:
-  - Description of the vulnerability
-  - Steps to reproduce
-  - Potential impact
-  - Suggested fix (if any)
+- [GitHub Private Vulnerability Reporting](https://github.com/PicPeak/picpeak/security/advisories/new) (preferred).
+- Email **info@picpeak.app** if you cannot use GitHub's private reporting form.
 
-### 3. You can expect:
-- Acknowledgment within 48 hours
-- Regular updates on our progress
-- Credit in the fix announcement (unless you prefer to remain anonymous)
+Include the affected component, version or image tag, deployment method,
+reproduction steps, expected impact and any suggested fix. Share only the
+information needed to reproduce the problem; remove credentials and personal
+data from logs or examples.
 
-## Security Measures
+We aim to acknowledge reports within 48 hours. This is a response target, not a
+guaranteed service level or a promised resolution time. We will provide progress
+updates and coordinate disclosure with the reporter. Reporter credit is optional;
+tell us if you prefer to remain anonymous.
 
-PicPeak implements several security measures:
+## Deployment Security
 
-### Authentication & Authorization
-- JWT-based authentication with secure token storage
-- bcrypt password hashing with configurable rounds
-- Role-based access control for admin functions
-- Session timeout management
+Security depends on both the software and its configuration. Operators should:
 
-### Input Validation
-- All user inputs are validated and sanitized
-- SQL injection prevention through parameterized queries
-- XSS protection via Content Security Policy
-- File upload restrictions and validation
+- Use HTTPS and configure the reverse proxy and trusted proxy settings correctly.
+- Use strong credentials and keep deployment secrets private.
+- Apply updates for the chosen release channel and restrict unnecessary network access.
+- Keep backups and verify that they can be restored.
 
-### Rate Limiting
-- API rate limiting to prevent abuse
-- Brute force protection on authentication endpoints
-- Configurable limits per endpoint
-
-### Data Protection
-- HTTPS enforcement in production
-- Secure cookie settings
-- CORS configuration
-- Sensitive data encryption
-
-### Infrastructure
-- Regular dependency updates
-- Security headers (HSTS, X-Frame-Options, etc.)
-- Activity logging for audit trails
-- Automated backups
-
-## Best Practices for Deployment
-
-1. **Always use HTTPS** in production
-2. **Change default passwords** immediately
-3. **Keep dependencies updated** regularly
-4. **Configure firewall rules** appropriately
-5. **Monitor logs** for suspicious activity
-6. **Backup regularly** and test restoration
+See the deployment guides for [HTTPS](https://docs.picpeak.app/deployment/ssl-certificates),
+[reverse proxies](https://docs.picpeak.app/deployment/reverse-proxy),
+[security settings](https://docs.picpeak.app/guides/admin-settings/security)
+and [backup and restore](https://docs.picpeak.app/guides/backup-restore).
 
 ## Vulnerability Disclosure
 
-We believe in responsible disclosure. Once a vulnerability is fixed:
+We coordinate disclosure with the reporter while preparing fixes. Security fixes
+are published through both supported channels. Advisories and release notes
+identify affected versions, the fixed version in each channel, the impact and
+any required mitigation or upgrade steps. Reporter credit is included with
+permission.
 
-1. We'll publish a security advisory
-2. Credit researchers (with permission)
-3. Detail the impact and mitigation steps
-4. Release patches for all supported versions
-
-## Contact
-
-- Security issues: Email **info@picpeak.app** or use [GitHub Private Vulnerability Reporting](https://github.com/the-luap/picpeak/security/advisories/new)
-- General support: [GitHub Issues](https://github.com/the-luap/picpeak/issues)
-
-Thank you for helping keep PicPeak and its users safe!
+For ordinary bugs and support requests, use
+[GitHub Issues](https://github.com/PicPeak/picpeak/issues) or
+[GitHub Discussions](https://github.com/PicPeak/picpeak/discussions).

SIMPLE_SETUP.md

@@ -8,7 +8,7 @@ This guide provides easy installation instructions for PicPeak on Linux servers
 
 ```bash
 # Download and run the unified setup script
-curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
+curl -fsSL https://raw.githubusercontent.com/PicPeak/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
 chmod +x picpeak-setup.sh && \
 sudo ./picpeak-setup.sh
 ```
@@ -163,6 +163,21 @@ sudo ./picpeak-setup.sh --native --unattended \
 - `picpeak-workers` - Background workers
 - `caddy` - Web server (optional)
 
+## 🔑 First Login — Create Your Admin
+
+If you installed with `picpeak-setup.sh` and gave an `--admin-password`, your admin account already exists — log in at `/admin` with that email and password.
+
+If you started PicPeak **without** setting `ADMIN_PASSWORD` (e.g. a plain `docker compose up`), there's **no admin yet** and you create it in the browser:
+
+1. Open `http://your-server:3000/admin` — you'll land on a setup screen.
+2. Read the **one-time setup token** from the 0600 file the backend writes it to
+   (it is not logged — that would leave a live credential in `docker logs`):
+   ```bash
+   docker compose exec backend cat /app/data/SETUP_TOKEN
+   ```
+   Only if that write fails does the backend log the token instead.
+3. Paste it, set your admin email + password. The token is single-use and the screen closes once an admin exists.
+
 ## 🌐 Access Methods
 
 ### Direct Access (Simplest)
@@ -472,7 +487,7 @@ sudo -u picpeak node scripts/reset-admin-password.js
    - [Deployment Guide](https://docs.picpeak.app/deployment)
 
 3. **Support:**
-   - [GitHub Issues](https://github.com/the-luap/picpeak/issues)
+   - [GitHub Issues](https://github.com/PicPeak/picpeak/issues)
    - Include: Error messages, system info (`uname -a`), installation method
 
 ## 🔒 Security Best Practices
@@ -550,4 +565,4 @@ sudo ./picpeak-setup.sh --native \
 
 ---
 
-**PicPeak Setup v1.0** | [Documentation](https://github.com/the-luap/picpeak) | [Support](https://github.com/the-luap/picpeak/issues)
+**PicPeak Setup v1.0** | [Documentation](https://github.com/PicPeak/picpeak) | [Support](https://github.com/PicPeak/picpeak/issues)

backend/.env.example

@@ -9,19 +9,42 @@ PORT=3001
 # Generate with: openssl rand -base64 32
 JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long-example123456
 
+# Admin 2FA (TOTP) secret encryption key — OPTIONAL.
+# Admin authenticator secrets are encrypted at rest (AES-256-GCM). By default
+# the key is derived from JWT_SECRET, so you do NOT need to set this. Set it
+# only if you want the MFA encryption key decoupled from JWT_SECRET (e.g. so
+# rotating JWT_SECRET doesn't invalidate enrolled authenticators). If you set
+# it, changing/losing it makes existing 2FA secrets undecryptable — recover
+# with: docker compose exec backend node scripts/reset-admin-mfa.js --all --yes
+# Generate with: openssl rand -base64 32
+#MFA_ENCRYPTION_KEY=
+
 # Auth cookie Secure flag
-#   unset  - default: follows NODE_ENV (production=true, dev=false)
-#   true   - always set Secure (HTTPS-only cookies; breaks plain-HTTP access)
+#   unset  - default: 'auto' in production, false in dev (#427)
+#   true   - always set Secure (HTTPS-only cookies; breaks plain-HTTP access —
+#            login appears to succeed but the browser silently drops the
+#            cookie, leaving you in a redirect loop. Only set this if you
+#            ALWAYS reach the site via HTTPS)
 #   false  - never set Secure (allows HTTP; cookies not protected on HTTPS)
-#   auto   - decide per request: Secure on HTTPS, not on HTTP
+#   auto   - decide per request: Secure on HTTPS, not on HTTP. Reads
+#            req.secure from Express which respects X-Forwarded-Proto from a
+#            trusted reverse proxy. This is the default and is the right
+#            choice for most deployments.
 #
-# Use COOKIE_SECURE=auto if your deployment is reachable over both HTTPS
-# (via a reverse proxy like Nginx Proxy Manager, Traefik, Caddy) AND plain
-# HTTP (e.g. LAN access at http://192.168.x.x:3001). The backend reads
-# req.secure from Express, which respects the X-Forwarded-Proto header
-# when the proxy is in the trust list.
+# Why 'auto' is the default in production:
+#   - On real HTTPS (reverse proxy with X-Forwarded-Proto), req.secure is
+#     true → Secure flag is still emitted. No security regression vs. true.
+#   - On plain HTTP (LAN access, first-time install before reverse proxy is
+#     wired up), req.secure is false → Secure flag is omitted → login works
+#     instead of silently looping back to /admin/login.
 #
-# Requirements for auto mode:
+# When you'd set this explicitly:
+#   - COOKIE_SECURE=true → strict HTTPS-only deployments where you want
+#     defense in depth against accidentally serving over HTTP.
+#   - COOKIE_SECURE=false → you intentionally only ever serve over HTTP and
+#     don't want the per-request check (rare).
+#
+# Requirements for 'auto' mode to detect HTTPS correctly:
 #   1. Your reverse proxy MUST send X-Forwarded-Proto: https on HTTPS
 #      requests. Standard configs for NPM/Traefik/Caddy do this by default.
 #   2. The proxy must be on a trusted IP range. By default PicPeak trusts

backend/Dockerfile

@@ -7,7 +7,7 @@ ARG VCS_REF
 ARG VERSION
 
 # Add labels for GitHub Container Registry
-LABEL org.opencontainers.image.source="https://github.com/the-luap/picpeak"
+LABEL org.opencontainers.image.source="https://github.com/PicPeak/picpeak"
 LABEL org.opencontainers.image.description="PicPeak Backend Service"
 LABEL org.opencontainers.image.licenses="MIT"
 
@@ -27,15 +27,60 @@ FROM node:22-alpine
 
 WORKDIR /app
 
+# knexfile.js picks its config block by NODE_ENV, and the `development` block
+# defaults to sqlite3. Leaving NODE_ENV unset here meant every deployment that
+# doesn't go through our compose files — Kubernetes, Helm, plain `docker run` —
+# silently ran on SQLite and ignored DB_HOST/DB_USER/DB_PASSWORD, while
+# wait-for-db.sh (shell, reads DB_HOST directly) reported "PostgreSQL is up" in
+# the same log. The compose files still override this, so nothing changes for
+# compose users. See #1038.
+ENV NODE_ENV=production
+
+# Redeclare CACHEBUST — ARGs don't cross stage boundaries, so the builder
+# stage's declaration never reached this stage. Consuming it in the RUN below
+# busts that layer's cache every CI run (CACHEBUST=github.run_number), so the
+# image always picks up current Alpine security updates instead of reusing a
+# stale cached upgrade layer.
+ARG CACHEBUST=1
+
 # Upgrade all packages to fix security vulnerabilities (OpenSSL, libexpat, BusyBox CVEs)
-RUN apk upgrade --no-cache
+RUN echo "cachebust=${CACHEBUST}" && apk upgrade --no-cache
 
-# Upgrade npm to fix tar, minimatch, brace-expansion CVEs in npm's own deps
-# Pin to 10.x to stay compatible with Node 22 Alpine (npm 11.x has dependency issues)
-RUN npm install -g npm@10
+# Remove the npm CLI from the final image. Nothing runs npm here: the
+# entrypoint is node, runtime deps are COPY'd from the builder stage, and
+# wait-for-db.sh invokes the migration runners via node directly. npm's
+# bundled node_modules kept tripping Trivy (sigstore, tar 7.5.19,
+# brace-expansion 5.0.7 — even npm 12.0.1 still ships the vulnerable
+# copies), so shipping no npm ends that alert class instead of chasing
+# per-release patches. Note: `docker exec … npm run <script>` no longer
+# works in the container — use `node migrations/run-migrations-safe.js`
+# and friends instead.
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
-# Install dumb-init for proper signal handling and postgresql-client for database checks
-RUN apk add --no-cache dumb-init postgresql-client
+# Install dumb-init for proper signal handling, postgresql-client for database
+# checks, ffmpeg for video upload support, and su-exec for the root → nodejs
+# privilege drop in wait-for-db.sh (see #484: container starts as root so it
+# can chown bind-mounted host volumes to UID 1001, then re-execs as nodejs
+# before running the app). Alpine's ffmpeg package ships both `ffmpeg` and
+# `ffprobe` built natively against musl libc — the npm
+# `@ffmpeg-installer/ffmpeg` binary is glibc-built and (a) doesn't reliably
+# run on Alpine and (b) only includes ffmpeg, not ffprobe (which the video
+# pipeline calls via fluent-ffmpeg.ffprobe()).
+# fontconfig is required so `sharp` (librsvg) can rasterise SVG logos that
+# contain live <text> for the CRM PDFs. Without any font installed, librsvg
+# renders text as tofu boxes (□) while the vector artwork still draws — i.e.
+# a "corrupted" logo on invoices/quotes. DejaVu/Liberation provide a broad
+# Unicode fallback; picpeak's own brand fonts (assets/fonts/, the same files
+# PDFKit + the web UI use) are registered with fontconfig further down so the
+# logo's text renders in its actual typeface, not a fallback.
+# poppler-utils provides `pdftoppm`, used to rasterise inbound supplier-invoice
+# PDFs to flat PNGs server-side so the admin UI NEVER renders a raw (possibly
+# malicious) PDF. pdftoppm does not execute embedded JS or fetch remote
+# resources, so it doubles as the SSRF/phone-home guard for untrusted inbound
+# documents (see docs/accounting-inbound-invoices.md).
+RUN apk add --no-cache dumb-init postgresql-client ffmpeg su-exec \
+    fontconfig ttf-dejavu ttf-liberation poppler-utils && \
+    fc-cache -f
 
 # Create non-root user
 RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
@@ -47,13 +92,30 @@ COPY --chown=nodejs:nodejs . .
 # Ensure all source files are readable and wait script is executable
 RUN chmod -R a+r /app && chmod +x wait-for-db.sh
 
+# Register picpeak's bundled brand fonts (assets/fonts/<Family>/*.ttf — the
+# same files PDFKit and the web UI use) with fontconfig, so when sharp/librsvg
+# rasterises an SVG logo its <text> renders in the actual brand typeface
+# rather than a DejaVu/Liberation fallback. fontconfig indexes by each font's
+# internal family name and recurses into the per-family subdirectories.
+RUN printf '<?xml version="1.0"?>\n<!DOCTYPE fontconfig SYSTEM "fonts.dtd">\n<fontconfig>\n  <dir>/app/assets/fonts</dir>\n</fontconfig>\n' > /etc/fonts/conf.d/99-picpeak-fonts.conf && \
+    fc-cache -f /app/assets/fonts
+
 # Create necessary directories
 RUN mkdir -p storage/events/active storage/events/archived storage/thumbnails data logs && \
     chown -R nodejs:nodejs storage data logs
 
-USER nodejs
+# No USER directive — the container starts as root so wait-for-db.sh can
+# chown bind-mounted host directories to UID 1001 before dropping privs
+# via su-exec. See #484 for the fresh-install restart loop this avoids.
 
 EXPOSE 3000
 
+# Healthcheck hits the same /health endpoint already used by the e2e
+# runner and by the docker-compose `depends_on: condition: service_healthy`
+# checks. wget is part of the Alpine base image. Long start-period covers
+# the wait-for-db.sh delay before the Node process starts listening.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1
+
 ENTRYPOINT ["dumb-init", "--"]
 CMD ["./wait-for-db.sh", "node", "server.js"]

backend/Dockerfile.dev

@@ -5,8 +5,10 @@ WORKDIR /app
 # Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
 RUN apk upgrade --no-cache
 
-# Install dumb-init for proper signal handling
-RUN apk add --no-cache dumb-init
+# Install dumb-init for proper signal handling and ffmpeg for video uploads.
+# Alpine's ffmpeg ships both ffmpeg + ffprobe built natively against musl;
+# the npm-bundled binary doesn't run reliably on Alpine. Match production.
+RUN apk add --no-cache dumb-init ffmpeg
 
 # Copy package files
 COPY package*.json ./
@@ -28,5 +30,8 @@ USER nodejs
 
 EXPOSE 3000
 
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1
+
 ENTRYPOINT ["dumb-init", "--"]
 CMD ["npm", "run", "dev"]

backend/__tests__/integration/adminArchives.restoreCategories.test.js

@@ -0,0 +1,498 @@
+/**
+ * Restoring an archive must put the photos back into their categories.
+ *
+ * The archive writer already persists `category_name` per photo in
+ * `photos_manifest.json` — that is why the manifest exists, and the comment
+ * above it says so: "(and category linkage) can't be derived from the
+ * extracted files alone". The restore route then read only
+ * `original_filename` from it and kept deriving the category from the ZIP's
+ * first path segment.
+ *
+ * Archives store photos exactly as they sit on disk, so an event whose photos
+ * live in the gallery root produces a FLAT zip. `path.dirname()` is '.' for
+ * every entry, no category is resolved, and every restored photo lands with
+ * `category_id = null` — silently, with a 200 response.
+ *
+ * These pin the manifest as the source of truth, with the directory as the
+ * fallback that keeps foldered and legacy archives working.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const express = require('express');
+const request = require('supertest');
+
+describe('archive restore restores categories (flat archives included)', () => {
+  let tmpDir; let db; let cleanup; let app; let storagePath;
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-restore-cat-'));
+    storagePath = path.join(tmpDir, 'storage');
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'test.db');
+    process.env.STORAGE_PATH = storagePath;
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    await fs.promises.mkdir(path.join(storagePath, 'archives'), { recursive: true });
+
+    jest.resetModules();
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => { req.admin = { id: 1, username: 'tester' }; next(); },
+    }));
+    jest.doMock('../../src/middleware/permissions', () => ({
+      requirePermission: () => (_req, _res, next) => next(),
+    }));
+    jest.doMock('../../src/middleware/ownership', () => ({
+      requireEventOwnership: (_req, _res, next) => next(),
+    }));
+
+    ({ db, cleanup } = await require('./helpers/crmDb').bootCrmDb());
+    // bootCrmDb points STORAGE_PATH at its own tmp dir; follow it rather than
+    // fighting it, so the archives the tests write are where the route looks.
+    storagePath = process.env.STORAGE_PATH;
+    await fs.promises.mkdir(path.join(storagePath, 'archives'), { recursive: true });
+
+    app = express();
+    app.use(express.json());
+    app.use('/admin/archives', require('../../src/routes/adminArchives'));
+  }, 180000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  beforeEach(async () => {
+    await db('photos').del();
+    await db('photo_categories').del();
+    await db('events').del();
+  });
+
+  /** A one-pixel JPEG is enough; the route only stats the extracted file. */
+  const PIXEL = Buffer.from(
+    '/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0a'
+    + 'HBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/wAALCAABAAEBAREA/8QAFAABAAAAAAAA'
+    + 'AAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/2gAIAQEAAD8AKp//2Q==',
+    'base64',
+  );
+
+  async function writeArchive(name, entries) {
+    // Required lazily: the suite calls jest.resetModules() in beforeAll, and
+    // archiver's readable-stream copy does not survive being split across the
+    // two module registries.
+    const archiver = require('archiver');
+    const archivePath = path.join(storagePath, 'archives', name);
+    await new Promise((resolve, reject) => {
+      const output = fs.createWriteStream(archivePath);
+      const zip = archiver('zip', { zlib: { level: 0 } });
+      output.on('close', resolve);
+      zip.on('error', reject);
+      zip.pipe(output);
+      for (const [entryName, buffer] of Object.entries(entries)) {
+        zip.append(buffer, { name: entryName });
+      }
+      zip.finalize();
+    });
+    return path.join('archives', name);
+  }
+
+  async function seedArchivedEvent(archiveRelPath, slug) {
+    const [row] = await db('events').insert({
+      slug,
+      event_type: 'wedding',
+      event_name: slug,
+      event_date: '2026-06-27',
+      host_email: 'h@example.com',
+      admin_email: 'a@example.com',
+      password_hash: 'x',
+      share_link: `${slug}-share`,
+      expires_at: new Date().toISOString(),
+      is_archived: 1,  // sqlite stores booleans as 0/1, see utils/dbCompat
+      archive_path: archiveRelPath,
+    }).returning('id');
+    return typeof row === 'object' ? row.id : row;
+  }
+
+  const categoryOf = async (filename) => {
+    const photo = await db('photos').where('filename', filename).first();
+    if (!photo || !photo.category_id) return null;
+    const category = await db('photo_categories').where('id', photo.category_id).first();
+    return category ? category.name : null;
+  };
+
+  it('takes the category from the manifest when the archive is flat', async () => {
+    // Exactly the shape a gallery-root event archives to: no directories.
+    const manifest = JSON.stringify([
+      { filename: 'a.jpg', original_filename: 'DSC_0001.jpg', category_name: 'Polterabend' },
+      { filename: 'b.jpg', original_filename: 'DSC_0002.jpg', category_name: 'Ceremony' },
+    ]);
+    const archiveRelPath = await writeArchive('flat.zip', {
+      'a.jpg': PIXEL,
+      'b.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(manifest, 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'flat-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    // The whole bug: both of these used to be null.
+    expect(await categoryOf('a.jpg')).toBe('Polterabend');
+    expect(await categoryOf('b.jpg')).toBe('Ceremony');
+  });
+
+  it('stores a real timestamp on restored photos, not "[object Object]"', async () => {
+    // The jest+sqlite landmine: a Date handed to knex inside jest stores as
+    // the literal string "[object Object]". Production writes ms-numbers and
+    // is unaffected, so this only ever corrupts what tests read back — which
+    // is how it survives unnoticed.
+    const archiveRelPath = await writeArchive('timestamp.zip', {
+      'individual/STAMPED.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'STAMPED.jpg', original_filename: 'STAMPED.jpg', category_name: 'Ceremony' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'timestamp-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    const photo = await db('photos').where({ event_id: eventId, filename: 'STAMPED.jpg' }).first();
+    expect(String(photo.uploaded_at)).not.toBe('[object Object]');
+    expect(Number.isNaN(new Date(photo.uploaded_at).getTime())).toBe(false);
+  });
+
+  it('reuses an existing category row instead of creating a duplicate', async () => {
+    const archiveRelPath = await writeArchive('reuse.zip', {
+      'c.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'c.jpg', original_filename: 'DSC_0003.jpg', category_name: 'Party' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'reuse-event');
+    await db('photo_categories').insert({
+      event_id: eventId, name: 'Party', slug: 'party', created_at: new Date(),
+    });
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    expect(await categoryOf('c.jpg')).toBe('Party');
+    const rows = await db('photo_categories').where({ event_id: eventId, name: 'Party' });
+    expect(rows).toHaveLength(1);
+  });
+
+  it('still falls back to the directory for legacy archives with no manifest', async () => {
+    // No manifest at all — the shape every archive had before the manifest
+    // landed. The directory is the only signal left, and it must keep working.
+    //
+    // `individual/` is what a REAL archive contains: entry names are the
+    // storage key minus `events/active/{slug}`, and that layout is
+    // `individual/` / `collages/`. Categories have never been directories, so
+    // the fallback invents a category with that name — not useful, but better
+    // than losing every category, and this pins what actually happens rather
+    // than a category-shaped folder no archive produces.
+    const archiveRelPath = await writeArchive('foldered.zip', {
+      'individual/d.jpg': PIXEL,
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'foldered-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    expect(await categoryOf('d.jpg')).toBe('individual');
+  });
+
+  it('reuses a GLOBAL category instead of cloning it into the event', async () => {
+    // Seeded categories (Ceremony, Reception, ...) have event_id NULL. An
+    // event-only lookup misses them, so the restore used to create a second
+    // "Ceremony" — and because is_global defaults to TRUE, that duplicate then
+    // appeared in every other event's category list.
+    const [g] = await db('photo_categories').insert({
+      event_id: null, name: 'Ceremony', slug: 'ceremony', is_global: true, created_at: new Date(),
+    }).returning('id');
+    const globalId = typeof g === 'object' ? g.id : g;
+
+    const archiveRelPath = await writeArchive('global.zip', {
+      'individual/gl.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'gl.jpg', original_filename: 'DSC_1.jpg', category_name: 'Ceremony' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'global-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    const photo = await db('photos').where('filename', 'gl.jpg').first();
+    expect(photo.category_id).toBe(globalId);
+    // No clone, global or otherwise.
+    const all = await db('photo_categories').where('name', 'Ceremony');
+    expect(all).toHaveLength(1);
+  });
+
+  it('does not create a GLOBAL category when it has to invent one', async () => {
+    // is_global defaults to true on this column, so an unqualified insert would
+    // leak a restore's category name into every gallery on the instance.
+    const archiveRelPath = await writeArchive('newcat.zip', {
+      'individual/nc.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'nc.jpg', original_filename: 'DSC_2.jpg', category_name: 'Polterabend' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'newcat-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    const created = await db('photo_categories').where('name', 'Polterabend').first();
+    expect(created.event_id).toBe(eventId);
+    expect(created.is_global === false || created.is_global === 0).toBe(true);
+  });
+
+  it('matches the manifest when the ZIP was written with original filenames', async () => {
+    // With general_use_original_filenames_for_downloads on at archive time,
+    // archiveService names entries after the ORIGINAL filename while the
+    // manifest stays keyed by photos.filename. Looking up the extracted
+    // basename missed every entry, so categories were lost on exactly those
+    // archives.
+    const archiveRelPath = await writeArchive('original-names.zip', {
+      'individual/DSC_4242.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'stored_9f8e7d.jpg', original_filename: 'DSC_4242.jpg', category_name: 'Drohne' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'original-names-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    expect(await categoryOf('DSC_4242.jpg')).toBe('Drohne');
+  });
+
+  it('prefers the event-scoped category when a global shares its name', async () => {
+    // The category API permits both. A single OR-lookup with .first() returned
+    // whichever the engine chose, so a photo could be reassigned to the global
+    // row and lose event-local settings such as allow_downloads.
+    const archiveRelPath = await writeArchive('collide.zip', {
+      'individual/co.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'co.jpg', original_filename: 'DSC_3.jpg', category_name: 'Reception' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'collide-event');
+
+    await db('photo_categories').insert({
+      event_id: null, name: 'Reception', slug: 'reception-global', is_global: true, created_at: new Date(),
+    });
+    const [own] = await db('photo_categories').insert({
+      event_id: eventId, name: 'Reception', slug: 'reception-own', is_global: false, created_at: new Date(),
+    }).returning('id');
+    const ownId = typeof own === 'object' ? own.id : own;
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    const photo = await db('photos').where('filename', 'co.jpg').first();
+    expect(photo.category_id).toBe(ownId);
+  });
+
+  it('matches a sanitized original filename, as the ZIP would have written it', async () => {
+    // archiveService runs original names through sanitizeForZipEntry() before
+    // writing the entry, so the emitted name differs from the manifest column.
+    const archiveRelPath = await writeArchive('sanitized.zip', {
+      'individual/od_dr_DSC_5.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'stored_abc.jpg', original_filename: 'od/dr/DSC_5.jpg', category_name: 'Strand' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'sanitized-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    expect(await categoryOf('od_dr_DSC_5.jpg')).toBe('Strand');
+  });
+
+  it('ignores a legacy event-owned row when falling back to globals', async () => {
+    // The bug fixed here left rows behind on upgraded instances: event-owned
+    // AND is_global true, because the column defaults true. Matching on the
+    // flag alone would let one event's leftover be adopted by another event's
+    // restore, tying photos to a category that vanishes with someone else's
+    // gallery.
+    const otherEventId = await seedArchivedEvent('archives/none.zip', 'legacy-owner-event');
+    await db('photo_categories').insert({
+      event_id: otherEventId, name: 'Sunset', slug: 'sunset-legacy',
+      is_global: true, created_at: new Date(),
+    });
+
+    const archiveRelPath = await writeArchive('legacy-global.zip', {
+      'individual/lg.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'lg.jpg', original_filename: 'DSC_6.jpg', category_name: 'Sunset' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'legacy-global-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    const photo = await db('photos').where('filename', 'lg.jpg').first();
+    const cat = await db('photo_categories').where('id', photo.category_id).first();
+    // Its own row, not the other event's leftover.
+    expect(cat.event_id).toBe(eventId);
+  });
+
+  it('drops an ambiguous original-name alias rather than guessing', async () => {
+    // Two photos in different ZIP folders can share an original basename;
+    // archiveService treats the paths as distinct and suffixes neither. Both
+    // would collapse onto one alias, and whichever won would hand the other
+    // photo someone else's category.
+    const archiveRelPath = await writeArchive('ambiguous.zip', {
+      'individual/SHARED.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'a_stored.jpg', original_filename: 'SHARED.jpg', category_name: 'Alpha' },
+        { filename: 'b_stored.jpg', original_filename: 'SHARED.jpg', category_name: 'Beta' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'ambiguous-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    // Falls back to the directory rather than picking Alpha or Beta at random.
+    expect(await categoryOf('SHARED.jpg')).toBe('individual');
+    for (const name of ['Alpha', 'Beta']) {
+      expect(await db('photo_categories').where({ event_id: eventId, name }).first()).toBeFalsy();
+    }
+  });
+
+  it('honours a manifest that says UNCATEGORIZED, instead of inventing one from the directory', async () => {
+    // The case the manifest-first change was for. A real archive puts every
+    // photo under `individual/`, so a photo the manifest records as having no
+    // category used to come back filed under a category called "individual" —
+    // the manifest being authoritative for "category X" but not for "none".
+    const manifest = JSON.stringify([
+      { filename: 'u.jpg', original_filename: 'DSC_7000.jpg', category_name: null },
+    ]);
+    const archiveRelPath = await writeArchive('uncategorized.zip', {
+      'individual/u.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(manifest, 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'uncategorized-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    expect(await categoryOf('u.jpg')).toBeNull();
+    // And no junk category row was created as a side effect.
+    const rows = await db('photo_categories').where({ event_id: eventId });
+    expect(rows).toHaveLength(0);
+  });
+
+  it('drops a canonical filename that two photos claim, rather than guessing', async () => {
+    // photos.filename is not unique within an event: s3AutoImporter takes
+    // path.basename(entry.key) and dedupes by path, so two imported files in
+    // different subfolders both land as IMG_1234.jpg. Both ZIP entries reduce
+    // to the same basename at restore, so keeping the last row seen would give
+    // one photo the other's category.
+    const archiveRelPath = await writeArchive('dup-canonical.zip', {
+      'individual/IMG_1234.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'IMG_1234.jpg', original_filename: 'a.jpg', category_name: 'Alpha' },
+        { filename: 'IMG_1234.jpg', original_filename: 'b.jpg', category_name: 'Beta' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'dup-canonical-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    expect(await categoryOf('IMG_1234.jpg')).toBe('individual');
+    for (const name of ['Alpha', 'Beta']) {
+      expect(await db('photo_categories').where({ event_id: eventId, name }).first()).toBeFalsy();
+    }
+  });
+
+  it("drops a name that one row owns canonically and another claims as an alias", async () => {
+    // Undecidable: with original-filename archiving ON the ZIP entry under
+    // this name is the ALIAS owner's file, with it OFF it is the canonical
+    // owner's, and the manifest does not record which mode was used. The
+    // point of the two-pass split is that this now resolves the same way
+    // every run — the archive query has no ORDER BY, so it used to be a coin
+    // flip between dropping the name and overwriting it.
+    const archiveRelPath = await writeArchive('alias-vs-canonical.zip', {
+      'individual/CANON.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'CANON.jpg', original_filename: 'unrelated.jpg', category_name: 'Canonical' },
+        { filename: 'other_stored.jpg', original_filename: 'CANON.jpg', category_name: 'Aliased' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'alias-vs-canonical-event');
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    // Falls back to the directory rather than guessing either row.
+    expect(await categoryOf('CANON.jpg')).toBe('individual');
+    for (const name of ['Canonical', 'Aliased']) {
+      expect(await db('photo_categories').where({ event_id: eventId, name }).first()).toBeFalsy();
+    }
+  });
+
+  it('picks the lowest id and warns when two categories share a name', async () => {
+    // Allowed: two event-scoped categories with the same display name and
+    // different slugs. .first() used to pick either, so a re-run could move
+    // photos between them and inherit the wrong allow_downloads.
+    const archiveRelPath = await writeArchive('dupe-category.zip', {
+      'individual/DUPE.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'DUPE.jpg', original_filename: 'DUPE.jpg', category_name: 'Ceremony' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'dupe-category-event');
+
+    const [first] = await db('photo_categories').insert({
+      name: 'Ceremony', slug: 'ceremony-a', is_global: 0, event_id: eventId,
+    }).returning('id');
+    await db('photo_categories').insert({
+      name: 'Ceremony', slug: 'ceremony-b', is_global: 0, event_id: eventId,
+    });
+    const firstId = typeof first === 'object' ? first.id : first;
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    // Stable, not arbitrary: the same run twice lands on the same row.
+    const photo = await db('photos').where({ event_id: eventId, filename: 'DUPE.jpg' }).first();
+    expect(photo.category_id).toBe(firstId);
+    // And no third "Ceremony" was invented.
+    expect((await db('photo_categories').where({ event_id: eventId, name: 'Ceremony' })).length)
+      .toBe(2);
+  });
+
+  it('does not invent a category for a photo row that already exists', async () => {
+    // archiveEvent retains photo rows, so a restore can skip every insert.
+    // Resolving categories before that check created one from the stale
+    // manifest name that nothing then used — renaming a category while its
+    // event was archived left the old name behind as an empty duplicate.
+    const archiveRelPath = await writeArchive('existing-rows.zip', {
+      'individual/KEPT.jpg': PIXEL,
+      'photos_manifest.json': Buffer.from(JSON.stringify([
+        { filename: 'KEPT.jpg', original_filename: 'KEPT.jpg', category_name: 'OldName' },
+      ]), 'utf8'),
+    });
+    const eventId = await seedArchivedEvent(archiveRelPath, 'existing-rows-event');
+    await db('photos').insert({
+      event_id: eventId, filename: 'KEPT.jpg', path: 'whatever/KEPT.jpg', type: 'jpg',
+      uploaded_at: new Date().toISOString(),
+    });
+
+    const res = await request(app).post(`/admin/archives/${eventId}/restore`).send({});
+    expect(res.status).toBe(200);
+
+    expect(await db('photo_categories').where({ event_id: eventId, name: 'OldName' }).first())
+      .toBeFalsy();
+  });
+
+});

backend/__tests__/integration/adminBackupCoverage.test.js

@@ -0,0 +1,242 @@
+/**
+ * Integration test for GET /api/admin/system-health/backup-coverage.
+ *
+ * Pins the Stage C diagnostic that tells admins what the next
+ * "Run Backup Now" will include, skip, or silently miss.
+ *
+ * Test surface:
+ *   1. Empty / fresh install → default seed (7 paths), inline mode,
+ *      no DB dump on file yet, no drift
+ *   2. Toggle `include_in_default=false` → coverage flips to
+ *      'skipped-by-toggle'
+ *   3. Feature_flag gating reflects the actual app_settings value
+ *      (events/archived ⇄ backup_include_archived)
+ *   4. Drift detection: a top-level subdir on disk with no
+ *      `backup_paths` row is flagged in `unconfiguredOnDisk`
+ *   5. Allow-list: `backups/` and `tmp/` are never flagged as drift
+ *   6. Scheduled-only mode + recent dump → `database.ok = true`
+ *   7. Scheduled-only mode + stale (>26h) dump → `database.ok = false`
+ *      and `lastDumpStale = true`
+ *
+ * Same auth/permission pass-through strategy as
+ * adminBackupIntegrity.test.js — we exercise the route's logic,
+ * not the auth middleware.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const express = require('express');
+const request = require('supertest');
+
+const { bootCrmDb } = require('./helpers/crmDb');
+
+jest.mock('../../src/middleware/auth', () => ({
+  adminAuth: (req, _res, next) => { req.admin = { id: 1 }; next(); },
+  customerAuth: (_req, _res, next) => next(),
+  galleryAuth: (_req, _res, next) => next(),
+}));
+
+jest.mock('../../src/middleware/permissions', () => ({
+  requirePermission: () => (_req, _res, next) => next(),
+}));
+
+jest.setTimeout(120000);
+
+describe('GET /api/admin/system-health/backup-coverage', () => {
+  let db;
+  let cleanup;
+  let storagePath;
+  let app;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    storagePath = process.env.STORAGE_PATH;
+
+    const route = require('../../src/routes/adminSystemHealth');
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/system-health', route);
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  function mkdir(rel) {
+    fs.mkdirSync(path.join(storagePath, rel), { recursive: true });
+  }
+
+  function rmdir(rel) {
+    fs.rmSync(path.join(storagePath, rel), { recursive: true, force: true });
+  }
+
+  async function restoreDefaultPaths() {
+    await db('backup_paths').del();
+    const { DEFAULT_PATHS } = require('../../migrations/core/109_add_backup_paths');
+    await db('backup_paths').insert(DEFAULT_PATHS.map((row) => ({
+      ...row,
+      created_at: new Date(),
+      updated_at: new Date(),
+    })));
+  }
+
+  beforeEach(async () => {
+    await restoreDefaultPaths();
+    await db('database_backup_runs').del().catch(() => {});
+    await db('app_settings').where('setting_type', 'backup').del().catch(() => {});
+  });
+
+  it('returns the canonical 7 paths + database block on a fresh install', async () => {
+    const res = await request(app).get('/api/admin/system-health/backup-coverage');
+    expect(res.status).toBe(200);
+    expect(res.body).toHaveProperty('report');
+
+    const { report } = res.body;
+    expect(report.paths.map((p) => p.path)).toEqual([
+      'events/active',
+      'events/archived',
+      'thumbnails',
+      'previews',
+      'heroes',
+      'uploads',
+      'business-docs',
+    ]);
+
+    // Default mode is inline — no inline_dump setting present means
+    // "inline is ON" (matches ensureDatabaseDumpForBackup semantics).
+    expect(report.database.mode).toBe('inline');
+    expect(report.database.ok).toBe(true);
+
+    expect(report.summary).toMatchObject({
+      configuredCount: 7,
+      tableMissingFallbackInUse: false,
+    });
+  });
+
+  it('flips a path to skipped-by-toggle when include_in_default=false', async () => {
+    await db('backup_paths').where('path', 'thumbnails').update({
+      include_in_default: false,
+    });
+
+    const res = await request(app).get('/api/admin/system-health/backup-coverage');
+    const thumbnails = res.body.report.paths.find((p) => p.path === 'thumbnails');
+    expect(thumbnails.coverage).toBe('skipped-by-toggle');
+    expect(thumbnails.includeInDefault).toBe(false);
+  });
+
+  it('feature_flag gating reflects app_settings (archived path off vs on)', async () => {
+    // backup_include_archived not set → archived skipped via flag
+    const off = await request(app).get('/api/admin/system-health/backup-coverage');
+    const archivedOff = off.body.report.paths.find((p) => p.path === 'events/archived');
+    expect(archivedOff.coverage).toBe('skipped-by-feature-flag');
+    expect(archivedOff.featureFlag).toBe('backup_include_archived');
+    expect(archivedOff.featureFlagValue).toBe(null); // unset
+
+    // Now set the flag — but path is missing on disk, so coverage
+    // resolves to 'missing-on-disk', proving the flag was honoured.
+    await db('app_settings').insert({
+      setting_key: 'backup_include_archived',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup',
+    }).onConflict('setting_key').merge();
+
+    const on = await request(app).get('/api/admin/system-health/backup-coverage');
+    const archivedOn = on.body.report.paths.find((p) => p.path === 'events/archived');
+    expect(archivedOn.featureFlagValue).toBe(true);
+    // No on-disk dir → 'missing-on-disk' (not 'skipped-by-feature-flag')
+    expect(['missing-on-disk', 'will-scan']).toContain(archivedOn.coverage);
+  });
+
+  it('detects unconfigured top-level subdirs as drift', async () => {
+    mkdir('events/active');           // configured
+    mkdir('plugin-store/cache');      // DRIFT
+    mkdir('shiny-new-feature/data');  // DRIFT
+
+    const res = await request(app).get('/api/admin/system-health/backup-coverage');
+    expect(res.body.report.drift.unconfiguredOnDisk).toEqual(expect.arrayContaining([
+      'plugin-store',
+      'shiny-new-feature',
+    ]));
+    expect(res.body.report.drift.unconfiguredOnDisk).not.toContain('events');
+
+    rmdir('plugin-store');
+    rmdir('shiny-new-feature');
+  });
+
+  it('never flags backups/ or tmp/ as drift (allow-list)', async () => {
+    mkdir('backups');
+    mkdir('tmp');
+
+    const res = await request(app).get('/api/admin/system-health/backup-coverage');
+    expect(res.body.report.drift.unconfiguredOnDisk).not.toContain('backups');
+    expect(res.body.report.drift.unconfiguredOnDisk).not.toContain('tmp');
+    expect(res.body.report.drift.expectedNonBackupDirs).toEqual(
+      expect.arrayContaining(['backups', 'tmp']),
+    );
+
+    rmdir('backups');
+    rmdir('tmp');
+  });
+
+  it('scheduled-only mode + recent dump → database.ok=true, not stale', async () => {
+    await db('app_settings').insert({
+      setting_key: 'backup_database_inline_dump',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup',
+    }).onConflict('setting_key').merge();
+
+    const recentDump = path.join(storagePath, 'backups', 'recent.sql.gz');
+    fs.mkdirSync(path.dirname(recentDump), { recursive: true });
+    fs.writeFileSync(recentDump, 'pretend dump');
+    await db('database_backup_runs').insert({
+      started_at: new Date(),
+      completed_at: new Date(),  // just now
+      status: 'completed',
+      backup_type: 'pg',
+      file_path: recentDump,
+      file_size_bytes: fs.statSync(recentDump).size,
+      destination_path: recentDump,
+    });
+
+    const res = await request(app).get('/api/admin/system-health/backup-coverage');
+    expect(res.body.report.database.mode).toBe('scheduled-only');
+    expect(res.body.report.database.inlineDumpExplicitlyDisabled).toBe(true);
+    expect(res.body.report.database.lastDumpStale).toBe(false);
+    expect(res.body.report.database.ok).toBe(true);
+  });
+
+  it('scheduled-only mode + stale dump → database.ok=false, lastDumpStale=true', async () => {
+    await db('app_settings').insert({
+      setting_key: 'backup_database_inline_dump',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup',
+    }).onConflict('setting_key').merge();
+
+    const oldDump = path.join(storagePath, 'backups', 'old.sql.gz');
+    fs.mkdirSync(path.dirname(oldDump), { recursive: true });
+    fs.writeFileSync(oldDump, 'pretend old dump');
+    // 48 hours ago — well past the 26h staleness threshold. ISO
+    // string instead of a Date object because knex-sqlite's datetime
+    // serialisation has a quirk where some Date instances coerce to
+    // '[object Object]' on insert (the test 6 "recent dump" case
+    // passes only because `new Date()` happens to round-trip safely;
+    // arithmetic Dates don't).
+    const stale = new Date(Date.now() - 48 * 60 * 60 * 1000).toISOString();
+    await db('database_backup_runs').insert({
+      started_at: stale,
+      completed_at: stale,
+      status: 'completed',
+      backup_type: 'pg',
+      file_path: oldDump,
+      file_size_bytes: fs.statSync(oldDump).size,
+      destination_path: oldDump,
+    });
+
+    const res = await request(app).get('/api/admin/system-health/backup-coverage');
+    expect(res.body.report.database.lastDumpStale).toBe(true);
+    expect(res.body.report.database.ok).toBe(false);
+    // Top-level summary reflects the failed DB check.
+    expect(res.body.report.summary.databaseOk).toBe(false);
+    expect(res.body.report.summary.overallOk).toBe(false);
+  });
+});

backend/__tests__/integration/adminBackupIntegrity.test.js

@@ -0,0 +1,140 @@
+/**
+ * Integration test for GET /api/admin/system-health/backup-integrity.
+ *
+ * Auth + permission middleware are mocked to pass-through so the test
+ * focuses on the route's own behaviour: scope-param validation, the
+ * successResponse envelope, and that the underlying service report
+ * surfaces correctly in the JSON body.
+ *
+ * The verifier service itself is exercised against the real schema
+ * (bootCrmDb) and real filesystem — only the auth gate is stubbed.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const express = require('express');
+const request = require('supertest');
+
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+// Pass-through auth so we don't need to mint JWTs.
+jest.mock('../../src/middleware/auth', () => ({
+  adminAuth: (req, _res, next) => { req.admin = { id: 1 }; next(); },
+  customerAuth: (_req, _res, next) => next(),
+  galleryAuth: (_req, _res, next) => next(),
+}));
+
+// Pass-through permissions so settings.view always allows.
+jest.mock('../../src/middleware/permissions', () => ({
+  requirePermission: () => (_req, _res, next) => next(),
+}));
+
+jest.setTimeout(120000);
+
+describe('GET /api/admin/system-health/backup-integrity', () => {
+  let cleanup;
+  let db;
+  let customerId;
+  let app;
+  let storagePath;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    ({ customerId } = await seedMinimal(db));
+    storagePath = process.env.STORAGE_PATH;
+
+    // Mount the route on a minimal Express app. Cold-require after
+    // bootCrmDb so the route's downstream `require('../database/db')`
+    // sees the same db instance.
+    const route = require('../../src/routes/adminSystemHealth');
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/system-health', route);
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  beforeEach(async () => {
+    await db('contracts').del().catch(() => {});
+    await db('invoices').del().catch(() => {});
+    await db('quotes').del().catch(() => {});
+  });
+
+  it('returns a report envelope when nothing references any path', async () => {
+    const res = await request(app).get('/api/admin/system-health/backup-integrity');
+    expect(res.status).toBe(200);
+    expect(res.body).toHaveProperty('report');
+    expect(res.body.report.summary).toMatchObject({
+      totalRows: 0,
+      missingFiles: 0,
+      hashMismatches: 0,
+      verifiedOk: 0,
+      existsButNoHash: 0,
+    });
+    expect(res.body.report.scopes).toEqual(expect.arrayContaining([
+      'quote', 'contract', 'contract-signature', 'invoice',
+    ]));
+  });
+
+  it('surfaces a missing file in the response payload', async () => {
+    await db('contracts').insert({
+      customer_account_id: customerId,
+      contract_number: 'C-B7-MISSING',
+      status: 'sent',
+      issue_date: '2026-01-01',
+      signed_pdf_path: 'business-docs/contract/2026/C-B7-MISSING.pdf',
+      created_at: new Date(),
+    });
+
+    const res = await request(app).get('/api/admin/system-health/backup-integrity');
+    expect(res.status).toBe(200);
+    expect(res.body.report.summary.missingFiles).toBe(1);
+    expect(res.body.report.missing[0]).toMatchObject({
+      table: 'contracts',
+      column: 'signed_pdf_path',
+      expectedPath: 'business-docs/contract/2026/C-B7-MISSING.pdf',
+    });
+  });
+
+  it('honours the ?scope=invoice filter', async () => {
+    // Seed both an invoice and a contract with missing files. With
+    // scope=invoice the contract row must not appear.
+    await db('invoices').insert({
+      customer_account_id: customerId,
+      invoice_number: 'INV-B7-SCOPE',
+      status: 'sent',
+      issue_date: '2026-01-01',
+      due_date: '2026-01-31',
+      pdf_path: 'business-docs/invoice/2026/INV-B7-SCOPE.pdf',
+      created_at: new Date(),
+    });
+    await db('contracts').insert({
+      customer_account_id: customerId,
+      contract_number: 'C-B7-SCOPE',
+      status: 'sent',
+      issue_date: '2026-01-01',
+      signed_pdf_path: 'business-docs/contract/2026/C-B7-SCOPE.pdf',
+      created_at: new Date(),
+    });
+
+    const res = await request(app)
+      .get('/api/admin/system-health/backup-integrity')
+      .query({ scope: 'invoice' });
+    expect(res.status).toBe(200);
+    expect(res.body.report.scopes).toEqual(['invoice']);
+    expect(res.body.report.missing.every((m) => m.table === 'invoices')).toBe(true);
+  });
+
+  it('rejects an unknown scope with 400 + a code', async () => {
+    const res = await request(app)
+      .get('/api/admin/system-health/backup-integrity')
+      .query({ scope: 'gallery' });
+    expect(res.status).toBe(400);
+    expect(res.body.code).toBe('BACKUP_INTEGRITY_UNKNOWN_SCOPE');
+    expect(res.body.validScopes).toEqual(expect.arrayContaining([
+      'quote', 'contract', 'contract-signature', 'invoice',
+    ]));
+  });
+});

backend/__tests__/integration/adminThumbnails.regenerate.test.js

@@ -0,0 +1,246 @@
+/**
+ * POST /admin/thumbnails/regenerate for external/reference photos (#1129).
+ *
+ * STABLE TWIN. Diverges from the main version in one place: stable has no
+ * responsive ?w= tiers (#1095/#1109), so there is no deleteThumbnailTiers call
+ * to assert and the "drops the tiers first" test is absent here. Everything
+ * else — the external rebuild, the thumbnail_path:null contract, video
+ * skipping, per-event scoping and the superseded-key deletion — is identical.
+ *
+ * The route used to resolve every source as `storage/events/active/<path>` and
+ * `fs.access` it. External and reference rows do not live there — their
+ * originals sit under `events.external_path` — so every one of them failed the
+ * check and was counted as an error.
+ *
+ * That alone would be inert. What made it destructive is that the tier
+ * deletion runs FIRST (deliberately, so S3 and external rows are not skipped):
+ * on a reference install the button dropped every ?w= tier and rebuilt
+ * nothing, while the UI reported success — the response is sent before the
+ * background loop starts.
+ *
+ * The background work is fired with setImmediate, so every assertion here has
+ * to wait for it to drain rather than trusting the response.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const express = require('express');
+const request = require('supertest');
+
+describe('admin thumbnail regeneration (#1129)', () => {
+  let tmpDir; let db; let cleanup; let app; let imageProcessor; let storage;
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-regen-'));
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'test.db');
+    process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    await fs.promises.mkdir(process.env.STORAGE_PATH, { recursive: true });
+
+    jest.resetModules();
+
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => { req.admin = { id: 1, username: 'tester' }; next(); },
+    }));
+    jest.doMock('../../src/middleware/permissions', () => ({
+      requirePermission: () => (_req, _res, next) => next(),
+    }));
+    // One instance, not a fresh object per call — the route and the
+    // assertions have to be looking at the same mock.
+    jest.doMock('../../src/services/storage', () => {
+      const instance = { delete: jest.fn().mockResolvedValue(undefined) };
+      return { getStorage: () => instance };
+    });
+    jest.doMock('../../src/services/imageProcessor', () => ({
+      ensureThumbnail: jest.fn().mockResolvedValue('thumbnails/thumb_ext1_shot.jpg'),
+      ensurePreviewImage: jest.fn().mockResolvedValue('previews/p.jpg'),
+      deletePreviewTiers: jest.fn().mockResolvedValue(undefined),
+    }));
+
+    // bootCrmDb, not run-migrations: the latter calls process.exit(0) on
+    // success, which ends the jest worker mid-suite.
+    ({ db, cleanup } = await require('./helpers/crmDb').bootCrmDb());
+
+    imageProcessor = require('../../src/services/imageProcessor');
+    storage = require('../../src/services/storage').getStorage();
+    app = express();
+    app.use(express.json());
+    app.use('/admin/thumbnails', require('../../src/routes/adminThumbnails'));
+  }, 180000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    await db('photos').del();
+    await db('events').del();
+  });
+
+  async function seedEvent() {
+    const [row] = await db('events').insert({
+      slug: 'nas-wedding', event_type: 'wedding', event_name: 'nas',
+      event_date: '2026-01-01', host_email: 'h@example.com', admin_email: 'a@example.com',
+      password_hash: 'x', share_link: 'nas-share', expires_at: new Date().toISOString(),
+      source_mode: 'reference', external_path: 'weddings/2026-08',
+    }).returning('id');
+    return typeof row === 'object' ? row.id : row;
+  }
+
+  async function seedPhoto(eventId, overrides = {}) {
+    const [row] = await db('photos').insert({
+      event_id: eventId, filename: 'shot.jpg', path: 'nas-wedding/shot.jpg',
+      type: 'individual', ...overrides,
+    }).returning('id');
+    return typeof row === 'object' ? row.id : row;
+  }
+
+  /** The work runs in setImmediate; give it room to finish. */
+  const drain = () => new Promise((resolve) => setTimeout(resolve, 150));
+
+  it('rebuilds the canonical thumbnail for an external photo instead of erroring', async () => {
+    const eventId = await seedEvent();
+    await seedPhoto(eventId, {
+      source_origin: 'external',
+      external_relpath: 'shot.jpg',
+      thumbnail_path: 'thumbnails/stale.jpg',
+    });
+
+    const res = await request(app).post('/admin/thumbnails/regenerate').send({});
+    expect(res.status).toBe(200);
+    await drain();
+
+    // The whole bug: this used to be zero calls and one logged
+    // "Original file not found" per photo.
+    expect(imageProcessor.ensureThumbnail).toHaveBeenCalledTimes(1);
+  });
+
+  it('nulls thumbnail_path so the valid-thumbnail short-circuit cannot skip the rebuild', async () => {
+    const eventId = await seedEvent();
+    await seedPhoto(eventId, {
+      source_origin: 'external',
+      external_relpath: 'shot.jpg',
+      thumbnail_path: 'thumbnails/still-on-disk.jpg',
+    });
+
+    await request(app).post('/admin/thumbnails/regenerate').send({});
+    await drain();
+
+    // Without this the endpoint is a no-op whenever the OLD thumbnail is still
+    // readable — which is the normal case after a settings change, and exactly
+    // when the admin pressed the button.
+    const [photoArg] = imageProcessor.ensureThumbnail.mock.calls[0];
+    expect(photoArg.thumbnail_path).toBeNull();
+    expect(photoArg.source_origin).toBe('external');
+    // Carried through so ensureThumbnail can resolve off the mount rather than
+    // under events/active.
+    expect(photoArg.external_relpath).toBe('shot.jpg');
+  });
+
+  it('leaves videos alone rather than handing a container file to Sharp', async () => {
+    const eventId = await seedEvent();
+    await seedPhoto(eventId, { source_origin: 'managed', media_type: 'video', filename: 'clip.mp4' });
+    await seedPhoto(eventId, { source_origin: 'managed', filename: 'still.jpg' });
+
+    const res = await request(app).post('/admin/thumbnails/regenerate').send({});
+    await drain();
+
+    expect(res.body.count).toBe(1);
+    expect(imageProcessor.ensureThumbnail).toHaveBeenCalledTimes(1);
+    expect(imageProcessor.ensureThumbnail.mock.calls[0][0].filename).toBe('still.jpg');
+  });
+
+  /**
+   * On S3, ensureThumbnail downloads the source to a randomly-named temp file,
+   * and for non-RAW input withProcessableImage passes no outputBasename — so
+   * generateThumbnail derives the key from that random name and it differs on
+   * every run. Nulling thumbnail_path hides the old key from everything that
+   * would otherwise clean it up, so each regeneration would strand a full
+   * thumbnail in the bucket, once per photo per run.
+   */
+  describe('superseded canonical renditions', () => {
+    it('removes the old thumbnail when the key moved', async () => {
+      const eventId = await seedEvent();
+      await seedPhoto(eventId, {
+        source_origin: 'managed',
+        thumbnail_path: 'thumbnails/thumb_OLDRANDOM_shot.jpg',
+      });
+      imageProcessor.ensureThumbnail.mockResolvedValueOnce('thumbnails/thumb_NEWRANDOM_shot.jpg');
+
+      await request(app).post('/admin/thumbnails/regenerate').send({});
+      await drain();
+
+      expect(storage.delete).toHaveBeenCalledWith('thumbnails/thumb_OLDRANDOM_shot.jpg');
+    });
+
+    it('does NOT delete when the key is unchanged — that is the new file', async () => {
+      const eventId = await seedEvent();
+      await seedPhoto(eventId, {
+        source_origin: 'managed',
+        thumbnail_path: 'thumbnails/thumb_stable.jpg',
+      });
+      // Local storage resolves to a stable path, so the key is identical.
+      imageProcessor.ensureThumbnail.mockResolvedValueOnce('thumbnails/thumb_stable.jpg');
+
+      await request(app).post('/admin/thumbnails/regenerate').send({});
+      await drain();
+
+      expect(storage.delete).not.toHaveBeenCalled();
+    });
+
+    it.each([
+      ['a Windows-style legacy path', 'thumbnails\\thumb_ext1_shot.jpg'],
+      ['a leading ./', './thumbnails/thumb_ext1_shot.jpg'],
+      ['a doubled separator', 'thumbnails//thumb_ext1_shot.jpg'],
+    ])('does not delete the file it just wrote when the old path is %s', async (_name, stored) => {
+      const eventId = await seedEvent();
+      await seedPhoto(eventId, { source_origin: 'managed', thumbnail_path: stored });
+      // Both storage backends fold these to the same key, so this is the SAME
+      // object — deleting it would remove the freshly generated thumbnail and
+      // leave the row pointing at nothing.
+      imageProcessor.ensureThumbnail.mockResolvedValueOnce('thumbnails/thumb_ext1_shot.jpg');
+
+      await request(app).post('/admin/thumbnails/regenerate').send({});
+      await drain();
+
+      expect(storage.delete).not.toHaveBeenCalled();
+    });
+
+    it('counts the photo as regenerated even if the old object cannot be removed', async () => {
+      const eventId = await seedEvent();
+      await seedPhoto(eventId, {
+        source_origin: 'managed',
+        thumbnail_path: 'thumbnails/thumb_OLD.jpg',
+      });
+      imageProcessor.ensureThumbnail.mockResolvedValueOnce('thumbnails/thumb_NEW.jpg');
+      storage.delete.mockRejectedValueOnce(new Error('bucket said no'));
+
+      await request(app).post('/admin/thumbnails/regenerate').send({});
+      await drain();
+
+      // Losing the old object is untidy; the regeneration itself succeeded.
+      expect(imageProcessor.ensureThumbnail).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  it('scopes to one event when asked', async () => {
+    const a = await seedEvent();
+    await seedPhoto(a, { source_origin: 'external', external_relpath: 'a.jpg' });
+    const [b] = await db('events').insert({
+      slug: 'other', event_type: 'wedding', event_name: 'other', event_date: '2026-01-01',
+      host_email: 'h@example.com', admin_email: 'a@example.com', password_hash: 'x',
+      share_link: 'other-share', expires_at: new Date().toISOString(),
+    }).returning('id');
+    await seedPhoto(typeof b === 'object' ? b.id : b, { source_origin: 'managed' });
+
+    const res = await request(app).post('/admin/thumbnails/regenerate').send({ eventId: a });
+    await drain();
+
+    expect(res.body.count).toBe(1);
+    expect(imageProcessor.ensureThumbnail).toHaveBeenCalledTimes(1);
+  });
+});

backend/__tests__/integration/backupService.businessDocs.test.js

@@ -0,0 +1,88 @@
+/**
+ * Regression net for the business-docs coverage gap fixed in this PR.
+ *
+ * Prior to the fix, `getFilesToBackupInternal()` enumerated a fixed
+ * list of storage subdirectories (events/active, events/archived,
+ * thumbnails, previews, heroes, uploads) and silently omitted the
+ * entire `business-docs/` tree. That meant every CRM PDF + signature
+ * drawing — quotes, contracts (system-rendered + wet uploads),
+ * invoices, Storno, imported historical invoices, and the customer
+ * signature PNG/JPG drawn on the public signing page — fell outside
+ * the in-app scheduled backup, leaving every `*_path` column on
+ * `quotes` / `contracts` / `invoices` as a broken FK after restore.
+ *
+ * The fix is a single `scanDirectory(business-docs, ...)` call. This
+ * suite pins the contract so a future refactor of the walker cannot
+ * silently drop business-docs again.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { bootCrmDb } = require('./helpers/crmDb');
+
+describe('backupService — business-docs is in the backup walker', () => {
+  let cleanup;
+  let backupService;
+  let storagePath;
+
+  beforeAll(async () => {
+    ({ cleanup } = await bootCrmDb());
+    storagePath = process.env.STORAGE_PATH;
+    // Cold-require after bootCrmDb so backupService picks up the same
+    // db instance + STORAGE_PATH the test harness configured.
+    backupService = require('../../src/services/backupService');
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  function seed(relPath, content = 'dummy bytes for backup test') {
+    const abs = path.join(storagePath, relPath);
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, content);
+  }
+
+  it('does not error when business-docs is absent', async () => {
+    // Fresh harness has no business-docs/ tree at all. The walker
+    // must short-circuit on ENOENT rather than throw — installs that
+    // never used CRM features have to keep backing up fine.
+    await expect(backupService.getFilesToBackup(false)).resolves.toEqual(expect.any(Array));
+  });
+
+  it('picks up every CRM-relevant business-docs subdirectory', async () => {
+    // Seed one file in each of the five subpaths the renderer + import
+    // routes write to. The signature path is the one most prone to be
+    // forgotten — it lives one level deeper than the others (per-
+    // contract subfolder, not per-year).
+    seed('business-docs/quote/2026/Q-001.pdf');
+    seed('business-docs/contract/2026/C-001.pdf');
+    seed('business-docs/contract/signatures/42/customer-1700000000000.png');
+    seed('business-docs/invoice/2026/INV-001.pdf');
+    seed('business-docs/invoice-imports/2026/scan.pdf');
+
+    const files = await backupService.getFilesToBackup(false);
+    const rels = files.map((f) => f.relativePath);
+
+    expect(rels).toEqual(expect.arrayContaining([
+      'business-docs/quote/2026/Q-001.pdf',
+      'business-docs/contract/2026/C-001.pdf',
+      'business-docs/contract/signatures/42/customer-1700000000000.png',
+      'business-docs/invoice/2026/INV-001.pdf',
+      'business-docs/invoice-imports/2026/scan.pdf',
+    ]));
+  });
+
+  it('walks newly-created business-docs files without needing a restart', async () => {
+    // The walker reads the filesystem live on every call; this guards
+    // against a future "cache the scan result at boot" optimisation
+    // that would miss freshly-written PDFs (which is exactly what
+    // happens during normal operation — every send writes a new file).
+    seed('business-docs/invoice/2027/INV-NEW.pdf');
+
+    const files = await backupService.getFilesToBackup(false);
+    const rels = files.map((f) => f.relativePath);
+    expect(rels).toContain('business-docs/invoice/2027/INV-NEW.pdf');
+  });
+});

backend/__tests__/integration/backupService.configurableWalker.test.js

@@ -0,0 +1,379 @@
+/**
+ * Pins the Stage-B refactor that lifted the file-backup walker's
+ * subdirectory list out of hard-coded JS into the `backup_paths`
+ * table seeded by migration 109.
+ *
+ * Scenarios:
+ *   1. Walker reads canonical seed → all 7 default subdirs walked
+ *   2. include_in_default=false on one row → that subdir is skipped
+ *   3. New row inserted at runtime → walker picks it up without restart
+ *   4. feature_flag gating → row only walked when the named app_settings
+ *      boolean is truthy (mirrors historical `includeArchived` behavior)
+ *   5. Empty table → walker falls back to LEGACY_BACKUP_PATHS (defense
+ *      in depth — never silently scans nothing)
+ *
+ * Why not stub `db('backup_paths')`: the whole point of Stage B is
+ * that the walker is now data-driven, so the test has to actually
+ * mutate the table and observe the walker's output change. Stubs
+ * would re-introduce the hard-coding the refactor is meant to remove.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { bootCrmDb } = require('./helpers/crmDb');
+
+jest.setTimeout(120000);
+
+describe('backupService — configurable walker (backup_paths)', () => {
+  let db;
+  let cleanup;
+  let storagePath;
+  let backupService;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    storagePath = process.env.STORAGE_PATH;
+    backupService = require('../../src/services/backupService');
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  function seedFile(relPath, content = 'dummy bytes') {
+    const abs = path.join(storagePath, relPath);
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, content);
+  }
+
+  beforeEach(async () => {
+    // Restore canonical seed before every test. Tests mutate this table
+    // freely; the next test starts from a known state.
+    await db('backup_paths').del();
+    const {
+      DEFAULT_PATHS,
+    } = require('../../migrations/core/109_add_backup_paths');
+    await db('backup_paths').insert(DEFAULT_PATHS.map((row) => ({
+      ...row,
+      created_at: new Date(),
+      updated_at: new Date(),
+    })));
+  });
+
+  it('migration 109 seeds the canonical 7 paths', async () => {
+    const rows = await db('backup_paths').orderBy('display_order', 'asc').select();
+    expect(rows.map((r) => r.path)).toEqual([
+      'events/active',
+      'events/archived',
+      'thumbnails',
+      'previews',
+      'heroes',
+      'uploads',
+      'business-docs',
+    ]);
+    // Only events/archived is gated by a feature flag.
+    expect(rows.filter((r) => r.feature_flag).map((r) => r.path)).toEqual([
+      'events/archived',
+    ]);
+  });
+
+  it('walks every default subdir when files are present', async () => {
+    seedFile('events/active/E1/a.jpg');
+    seedFile('thumbnails/E1/a.jpg');
+    seedFile('previews/E1/a.jpg');
+    seedFile('heroes/E1/hero.jpg');
+    seedFile('uploads/intake/x.bin');
+    seedFile('business-docs/quote/2026/Q-001.pdf');
+    // events/archived is gated — left out of this test; covered below.
+
+    const files = await backupService.getFilesToBackup({ backup_include_archived: true });
+    const rels = files.map((f) => f.relativePath);
+
+    expect(rels).toEqual(expect.arrayContaining([
+      'events/active/E1/a.jpg',
+      'thumbnails/E1/a.jpg',
+      'previews/E1/a.jpg',
+      'heroes/E1/hero.jpg',
+      'uploads/intake/x.bin',
+      'business-docs/quote/2026/Q-001.pdf',
+    ]));
+  });
+
+  it('skips a path when include_in_default is toggled off', async () => {
+    seedFile('thumbnails/E1/thumb.jpg');
+    seedFile('events/active/E1/photo.jpg');
+
+    await db('backup_paths').where('path', 'thumbnails').update({
+      include_in_default: false,
+    });
+
+    const files = await backupService.getFilesToBackup({ backup_include_archived: true });
+    const rels = files.map((f) => f.relativePath);
+
+    expect(rels).toContain('events/active/E1/photo.jpg');
+    expect(rels).not.toContain('thumbnails/E1/thumb.jpg');
+  });
+
+  it('picks up a new path inserted at runtime — no restart needed', async () => {
+    // Simulates a future feature shipping its own subdirectory and
+    // self-healing a `backup_paths` row at boot.
+    await db('backup_paths').insert({
+      path: 'plugin-store',
+      include_in_default: true,
+      feature_flag: null,
+      display_order: 200,
+      description: 'Hypothetical future feature payload',
+      created_at: new Date(),
+      updated_at: new Date(),
+    });
+    seedFile('plugin-store/cache/payload.bin');
+
+    const files = await backupService.getFilesToBackup({ backup_include_archived: true });
+    const rels = files.map((f) => f.relativePath);
+
+    expect(rels).toContain('plugin-store/cache/payload.bin');
+  });
+
+  it('respects feature_flag gating (events/archived ⇄ backup_include_archived)', async () => {
+    seedFile('events/active/E1/active.jpg');
+    seedFile('events/archived/E2/archived.jpg');
+
+    // backup_include_archived=false → archived/ is skipped.
+    const filesOff = await backupService.getFilesToBackup({ backup_include_archived: false });
+    const relsOff = filesOff.map((f) => f.relativePath);
+    expect(relsOff).toContain('events/active/E1/active.jpg');
+    expect(relsOff).not.toContain('events/archived/E2/archived.jpg');
+
+    // backup_include_archived=true → archived/ is included.
+    const filesOn = await backupService.getFilesToBackup({ backup_include_archived: true });
+    const relsOn = filesOn.map((f) => f.relativePath);
+    expect(relsOn).toContain('events/archived/E2/archived.jpg');
+  });
+
+  it('falls back to LEGACY_BACKUP_PATHS when the table is empty', async () => {
+    // Defense in depth: even if seed-and-self-heal both failed, the
+    // walker must still cover the historical set so "Run Backup Now"
+    // cannot silently degrade to no-op.
+    await db('backup_paths').del();
+    seedFile('events/active/E1/photo.jpg');
+    seedFile('business-docs/quote/2026/Q-002.pdf');
+
+    const files = await backupService.getFilesToBackup({ backup_include_archived: true });
+    const rels = files.map((f) => f.relativePath);
+
+    expect(rels).toContain('events/active/E1/photo.jpg');
+    expect(rels).toContain('business-docs/quote/2026/Q-002.pdf');
+  });
+
+  it('legacy boolean call signature still works (backward compat)', async () => {
+    // Existing call sites (and the businessDocs regression test) pass
+    // a boolean for `includeArchived`. Refactor must not break them.
+    seedFile('events/archived/E3/legacy.jpg');
+
+    const filesOff = await backupService.getFilesToBackup(false);
+    expect(filesOff.map((f) => f.relativePath)).not.toContain('events/archived/E3/legacy.jpg');
+
+    const filesOn = await backupService.getFilesToBackup(true);
+    expect(filesOn.map((f) => f.relativePath)).toContain('events/archived/E3/legacy.jpg');
+  });
+
+  // Issue #871 — the "What to Backup" checkboxes were stored but never read.
+  describe('UI opt-out toggles (issue #871)', () => {
+    it('unchecking Thumbnails excludes thumbnails/', async () => {
+      seedFile('thumbnails/E1/thumb.jpg');
+      seedFile('events/active/E1/photo.jpg');
+
+      const files = await backupService.getFilesToBackup({
+        backup_include_thumbnails: false,
+      });
+      const rels = files.map((f) => f.relativePath);
+
+      expect(rels).toContain('events/active/E1/photo.jpg');
+      expect(rels).not.toContain('thumbnails/E1/thumb.jpg');
+    });
+
+    it('unchecking Photos excludes events/active', async () => {
+      seedFile('thumbnails/E1/thumb.jpg');
+      seedFile('events/active/E1/photo.jpg');
+
+      const files = await backupService.getFilesToBackup({
+        backup_include_photos: false,
+      });
+      const rels = files.map((f) => f.relativePath);
+
+      expect(rels).toContain('thumbnails/E1/thumb.jpg');
+      expect(rels).not.toContain('events/active/E1/photo.jpg');
+    });
+
+    it('defaults to including everything when the keys were never saved', async () => {
+      seedFile('thumbnails/E1/thumb.jpg');
+      seedFile('events/active/E1/photo.jpg');
+
+      const files = await backupService.getFilesToBackup({});
+      const rels = files.map((f) => f.relativePath);
+
+      expect(rels).toContain('thumbnails/E1/thumb.jpg');
+      expect(rels).toContain('events/active/E1/photo.jpg');
+    });
+
+    it("accepts the UI's plural backup_include_archives for the archived gate", async () => {
+      seedFile('events/archived/E4/archived.jpg');
+
+      const files = await backupService.getFilesToBackup({
+        backup_include_archives: true,
+      });
+      expect(files.map((f) => f.relativePath)).toContain('events/archived/E4/archived.jpg');
+    });
+
+    it('the UI plural key beats the migration-seeded singular key', async () => {
+      // Migration seeds backup_include_archived=true on every install; the
+      // form only ever writes the plural key, so unchecking Archives must
+      // win over the stale seeded value.
+      seedFile('events/archived/E5/archived.jpg');
+
+      const files = await backupService.getFilesToBackup({
+        backup_include_archived: true,   // seeded default
+        backup_include_archives: false,  // what the admin actually chose
+      });
+      expect(files.map((f) => f.relativePath)).not.toContain('events/archived/E5/archived.jpg');
+    });
+
+    it('rsync gets the de-selected paths and noise filters as --exclude args', async () => {
+      const excluded = await backupService.resolveExcludedBackupPaths({
+        backup_include_thumbnails: false,
+        backup_include_archives: false,
+      });
+      expect(excluded.map((r) => r.path)).toEqual(
+        expect.arrayContaining(['thumbnails', 'events/archived'])
+      );
+
+      const args = backupService.buildRsyncArgs(
+        { backup_rsync_host: 'backup.example.com', backup_rsync_path: '/srv/backups' },
+        excluded.map((r) => `/${r.path}/`)
+      );
+      const excludes = args
+        .map((a, i) => (a === '--exclude' ? args[i + 1] : null))
+        .filter(Boolean);
+      expect(excludes).toEqual(expect.arrayContaining([
+        '.nfs*',
+        '/thumbnails/',
+        '/events/archived/',
+      ]));
+    });
+
+    it('rows toggled off via include_in_default also become rsync excludes', async () => {
+      // The enabled-only loader hides these rows from the walker, but rsync
+      // syncs the whole storage root, so they must still appear as excludes.
+      await db('backup_paths').where('path', 'previews').update({
+        include_in_default: false,
+      });
+
+      const excluded = await backupService.resolveExcludedBackupPaths({});
+      expect(excluded.map((r) => r.path)).toContain('previews');
+    });
+  });
+
+  // Issue #871 — .nfs* silly-rename artifacts were uploaded to S3.
+  it('never backs up filesystem noise (.nfs*, .DS_Store)', async () => {
+    seedFile('thumbnails/E1/.nfs000000000000006600000008');
+    seedFile('events/active/E1/.DS_Store');
+    seedFile('events/active/E1/photo.jpg');
+
+    const files = await backupService.getFilesToBackup({});
+    const rels = files.map((f) => f.relativePath);
+
+    expect(rels).toContain('events/active/E1/photo.jpg');
+    expect(rels.some((r) => r.includes('.nfs'))).toBe(false);
+    expect(rels.some((r) => r.includes('.DS_Store'))).toBe(false);
+  });
+
+  it('the walker honors backup_exclude_patterns (previously rsync-only)', async () => {
+    seedFile('events/active/E1/photo.jpg');
+    seedFile('events/active/E1/scratch.tmp');
+
+    const files = await backupService.getFilesToBackup({
+      backup_exclude_patterns: ['*.tmp'],
+    });
+    const rels = files.map((f) => f.relativePath);
+
+    expect(rels).toContain('events/active/E1/photo.jpg');
+    expect(rels).not.toContain('events/active/E1/scratch.tmp');
+  });
+
+  it('glob patterns are literal outside the star (.nfs* must not eat anfs-…)', async () => {
+    seedFile('events/active/E1/anfs-photo.jpg');
+    seedFile('events/active/E1/notes-tmp');
+
+    const files = await backupService.getFilesToBackup({
+      backup_exclude_patterns: ['*.tmp'],
+    });
+    const rels = files.map((f) => f.relativePath);
+
+    // '.nfs*' used to compile to /^.nfs.*$/ whose dot matched any char;
+    // '*.tmp' used to compile to /^.*.tmp$/ which also matched 'notes-tmp'.
+    expect(rels).toContain('events/active/E1/anfs-photo.jpg');
+    expect(rels).toContain('events/active/E1/notes-tmp');
+  });
+
+  // Issue #871 — weekly schedules silently ran daily, and the dashboard's
+  // "next backup" was a hardcoded "tomorrow 02:00".
+  describe('schedule resolution + next run (issue #871)', () => {
+    it('a named label beats the stray default cron the UI used to send', () => {
+      expect(backupService.resolveScheduleCron({
+        backup_schedule: 'weekly',
+        backup_schedule_cron: '0 3 * * *', // old UI default, sent unconditionally
+      })).toBe('0 3 * * 0');
+    });
+
+    it('custom schedules use the cron field', () => {
+      expect(backupService.resolveScheduleCron({
+        backup_schedule: 'custom',
+        backup_schedule_cron: '15 5 * * 2',
+      })).toBe('15 5 * * 2');
+    });
+
+    it('falls back to the default daily cron', () => {
+      expect(backupService.resolveScheduleCron({})).toBe('0 2 * * *');
+    });
+
+    it('getNextScheduledRun is null when backups are disabled', () => {
+      expect(backupService.getNextScheduledRun(null)).toBeNull();
+      expect(backupService.getNextScheduledRun({ backup_enabled: false })).toBeNull();
+    });
+
+    it('getNextScheduledRun returns the real next weekly fire time', () => {
+      const iso = backupService.getNextScheduledRun({
+        backup_enabled: true,
+        backup_schedule: 'weekly',
+        backup_schedule_cron: '0 3 * * *',
+      });
+      const next = new Date(iso);
+      expect(Number.isNaN(next.getTime())).toBe(false);
+      expect(next.getTime()).toBeGreaterThan(Date.now());
+      expect(next.getDay()).toBe(0);   // Sunday
+      expect(next.getHours()).toBe(3); // 03:00
+    });
+  });
+
+  // Issue #871 — "Backup Size: 167.6 TB": file_size_bytes is a bigInteger
+  // column, node-postgres returns int8 as a string, and the S3 path did
+  // `backedUpSize += size` — string concatenation.
+  it('getDatabaseBackupInfo coerces file_size_bytes to a number', async () => {
+    await db('database_backup_runs').del();
+    await db('database_backup_runs').insert({
+      backup_type: 'full',
+      status: 'completed',
+      file_path: '/backups/db/dump.sql.gz',
+      // Simulate the PG int8-as-string driver behaviour (sqlite stores
+      // whatever it is handed, so the string round-trips).
+      file_size_bytes: '421988',
+      started_at: new Date().toISOString(),
+      completed_at: new Date().toISOString(),
+    });
+
+    const info = await backupService.getDatabaseBackupInfo();
+    expect(typeof info.size).toBe('number');
+    expect(info.size).toBe(421988);
+  });
+});

backend/__tests__/integration/backupService.inlineDbDump.test.js

@@ -0,0 +1,188 @@
+/**
+ * Pins the inline-DB-dump + fail-loud guard added to `runBackupInternal`.
+ *
+ * The previous behaviour was: file-backup looked up an existing dump via
+ * `getDatabaseBackupInfo()` and silently shipped a files-only manifest
+ * when none was found. Admins clicking "Run Backup Now" got an apparent
+ * success that omitted every customer / quote / invoice / contract row —
+ * the data-loss footgun that this commit closes.
+ *
+ * Five scenarios under test:
+ *   1. Default (inline dump enabled), dump succeeds → backup proceeds
+ *   2. Default, dump throws → run aborts, backup_runs row marked failed
+ *   3. Opt-out + recent DB dump available → backup proceeds
+ *   4. Opt-out + no DB dump available → fail loud
+ *   5. Opt-out + DB dump file is 0 bytes on disk → fail loud
+ *
+ * Mocking strategy: the underlying `databaseBackupService.backup()` and
+ * the local-destination writer are stubbed so the test exercises just
+ * the new guard logic without depending on `pg_dump` / `sqlite3` CLI
+ * binaries being available in the test environment.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { bootCrmDb } = require('./helpers/crmDb');
+
+// Set up mocks BEFORE bootCrmDb so backupService picks them up at require time.
+const mockBackupFn = jest.fn();
+jest.mock('../../src/services/databaseBackup', () => ({
+  databaseBackupService: { backup: mockBackupFn },
+  startScheduledBackups: jest.fn(),
+  stopScheduledBackups: jest.fn(),
+  DatabaseBackupService: class {},
+}));
+
+jest.setTimeout(120000);
+
+describe('backupService — inline DB dump + fail-loud guard', () => {
+  let db;
+  let cleanup;
+  let storagePath;
+  let backupService;
+  let dumpFileAbs;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    storagePath = process.env.STORAGE_PATH;
+    backupService = require('../../src/services/backupService');
+
+    // Seed backup destination settings so the run can proceed past the
+    // "destination not configured" guard.
+    const dest = path.join(storagePath, 'backups');
+    fs.mkdirSync(dest, { recursive: true });
+    // getBackupConfigInternal filters by setting_type='backup', so the
+    // tests have to seed with that type or the resolver returns
+    // `{ ... }` with the keys missing — runBackup then sees
+    // `backup_destination_type === undefined` and bails before our
+    // new guard runs.
+    await db('app_settings').insert([
+      { setting_key: 'backup_destination_type',    setting_value: JSON.stringify('local'), setting_type: 'backup' },
+      { setting_key: 'backup_destination_path',    setting_value: JSON.stringify(dest),    setting_type: 'backup' },
+      { setting_key: 'backup_enabled',             setting_value: JSON.stringify(true),    setting_type: 'backup' },
+      { setting_key: 'backup_email_on_failure',    setting_value: JSON.stringify(false),   setting_type: 'backup' },
+    ]).onConflict('setting_key').merge();
+
+    // Pre-create a dump file that getDatabaseBackupInfo can resolve to.
+    // Reused/mutated per-test via the database_backup_runs seed below.
+    dumpFileAbs = path.join(storagePath, 'backups', 'fake-dump.sql.gz');
+    fs.writeFileSync(dumpFileAbs, 'pretend this is a pg_dump'.repeat(100));
+
+    // Neutralise the file-scan step: we don't care which files would
+    // be backed up, just whether the run reaches that stage at all.
+    backupService.getFilesToBackup = jest.fn(async () => []);
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  beforeEach(async () => {
+    mockBackupFn.mockReset();
+    // Default to "dump produced this file with this size" — the per-test
+    // setup overrides as needed.
+    mockBackupFn.mockResolvedValue({
+      success: true,
+      path: dumpFileAbs,
+      size: fs.statSync(dumpFileAbs).size,
+      duration: 1,
+      checksum: 'abc',
+    });
+
+    // Re-seed the database_backup_runs row that getDatabaseBackupInfo
+    // resolves against (its query is `status='completed'` + most recent).
+    await db('database_backup_runs').del();
+    await db('database_backup_runs').insert({
+      started_at: new Date(),
+      completed_at: new Date(),
+      status: 'completed',
+      backup_type: 'pg',
+      file_path: dumpFileAbs,
+      file_size_bytes: fs.statSync(dumpFileAbs).size,
+      destination_path: dumpFileAbs,
+    });
+  });
+
+  it('default behaviour: inline dump runs, then file backup proceeds', async () => {
+    // Inline-dump setting is unset (undefined) — default is ON.
+    await db('app_settings').where('setting_key', 'backup_database_inline_dump').del();
+
+    await backupService.runBackup(true);
+
+    expect(mockBackupFn).toHaveBeenCalledTimes(1);
+
+    const run = await db('backup_runs').orderBy('id', 'desc').first();
+    expect(run.status).toBe('completed');
+    expect(run.error_message).toBeNull();
+  });
+
+  it('aborts the run when the inline dump throws', async () => {
+    await db('app_settings').where('setting_key', 'backup_database_inline_dump').del();
+    mockBackupFn.mockRejectedValueOnce(new Error('pg_dump segfaulted'));
+
+    await backupService.runBackup(true);
+
+    const run = await db('backup_runs').orderBy('id', 'desc').first();
+    expect(run.status).toBe('failed');
+    expect(run.error_message).toMatch(/pg_dump segfaulted/);
+  });
+
+  it('opt-out: skips inline dump but proceeds when a recent dump exists', async () => {
+    await db('app_settings').insert({
+      setting_key: 'backup_database_inline_dump',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup',
+    }).onConflict('setting_key').merge();
+
+    await backupService.runBackup(true);
+
+    expect(mockBackupFn).not.toHaveBeenCalled();
+
+    const run = await db('backup_runs').orderBy('id', 'desc').first();
+    expect(run.status).toBe('completed');
+  });
+
+  it('opt-out + no recent dump: fails loud with a clear error', async () => {
+    await db('app_settings').insert({
+      setting_key: 'backup_database_inline_dump',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup',
+    }).onConflict('setting_key').merge();
+    // Wipe the dump row so getDatabaseBackupInfo returns backupFile=null.
+    await db('database_backup_runs').del();
+
+    await backupService.runBackup(true);
+
+    const run = await db('backup_runs').orderBy('id', 'desc').first();
+    expect(run.status).toBe('failed');
+    expect(run.error_message).toMatch(/No database backup available/);
+  });
+
+  it('opt-out + 0-byte dump file: fails loud', async () => {
+    await db('app_settings').insert({
+      setting_key: 'backup_database_inline_dump',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup',
+    }).onConflict('setting_key').merge();
+
+    const emptyDump = path.join(storagePath, 'backups', 'empty-dump.sql.gz');
+    fs.writeFileSync(emptyDump, '');
+    await db('database_backup_runs').del();
+    await db('database_backup_runs').insert({
+      started_at: new Date(),
+      completed_at: new Date(),
+      status: 'completed',
+      backup_type: 'pg',
+      file_path: emptyDump,
+      file_size_bytes: 0,
+      destination_path: emptyDump,
+    });
+
+    await backupService.runBackup(true);
+
+    const run = await db('backup_runs').orderBy('id', 'desc').first();
+    expect(run.status).toBe('failed');
+    expect(run.error_message).toMatch(/is empty/);
+  });
+});

backend/__tests__/integration/backupService.perPathStats.test.js

@@ -0,0 +1,180 @@
+/**
+ * Per-Stage-B-path tally — Tier 3 of tonight's backup hardening.
+ *
+ * Pins the new `computePerPathStats` logic that the Backup History
+ * "Content Backed Up" pane reads via `backup_runs.statistics.per_path`.
+ *
+ * Three scenarios:
+ *   1. Single file under one path — straightforward attribution
+ *   2. Multiple paths with overlapping prefixes — longest-prefix wins
+ *      (e.g. `events/active/E1/x.jpg` should attribute to
+ *       `events/active`, not `events`)
+ *   3. File outside any configured path — silently dropped, doesn't
+ *      throw or contaminate other buckets
+ *
+ * Tests exercise the EXPORTED side: write a backup_runs row via the
+ * service entry point and assert the statistics JSON shape. We don't
+ * stub `computePerPathStats` directly — the integration view is what
+ * the frontend actually consumes.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { bootCrmDb } = require('./helpers/crmDb');
+
+jest.setTimeout(120000);
+
+describe('backupService — per-Stage-B-path statistics', () => {
+  let db;
+  let cleanup;
+  let storagePath;
+  let backupService;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    storagePath = process.env.STORAGE_PATH;
+    backupService = require('../../src/services/backupService');
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  function mkFile(rel, content = 'x'.repeat(100)) {
+    const abs = path.join(storagePath, rel);
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, content);
+  }
+
+  beforeEach(async () => {
+    // Clean slate of any artefacts from prior tests
+    await db('backup_runs').del();
+    await db('app_settings').where('setting_type', 'backup').del();
+    await db('app_settings').insert([
+      { setting_key: 'backup_destination_type', setting_value: JSON.stringify('local'), setting_type: 'backup' },
+      { setting_key: 'backup_destination_path', setting_value: JSON.stringify(path.join(storagePath, 'destination')), setting_type: 'backup' },
+      { setting_key: 'backup_enabled', setting_value: JSON.stringify(true), setting_type: 'backup' },
+      { setting_key: 'backup_email_on_failure', setting_value: JSON.stringify(false), setting_type: 'backup' },
+      { setting_key: 'backup_include_archived', setting_value: JSON.stringify(true), setting_type: 'backup' },
+    ]).onConflict('setting_key').merge();
+    fs.mkdirSync(path.join(storagePath, 'destination'), { recursive: true });
+
+    // Restore canonical backup_paths from migration 109
+    const { DEFAULT_PATHS } = require('../../migrations/core/109_add_backup_paths');
+    await db('backup_paths').del();
+    await db('backup_paths').insert(DEFAULT_PATHS.map((row) => ({
+      ...row,
+      created_at: new Date(),
+      updated_at: new Date(),
+    })));
+
+    // Wipe leftover files between tests
+    for (const dir of ['events', 'business-docs', 'thumbnails', 'previews', 'heroes', 'uploads']) {
+      const p = path.join(storagePath, dir);
+      if (fs.existsSync(p)) fs.rmSync(p, { recursive: true, force: true });
+    }
+  });
+
+  it('attributes files to their owning backup_paths row', async () => {
+    mkFile('events/active/E1/photo-a.jpg', 'X'.repeat(1000));
+    mkFile('events/active/E1/photo-b.jpg', 'X'.repeat(2000));
+    mkFile('business-docs/quote/2026/Q-1.pdf', 'X'.repeat(500));
+    mkFile('thumbnails/E1/photo-a.jpg', 'X'.repeat(50));
+
+    // Disable the inline DB dump so we don't need pg_dump in tests;
+    // the file walker is what produces per_path.
+    await db('app_settings').insert({
+      setting_key: 'backup_database_inline_dump',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup',
+    }).onConflict('setting_key').merge();
+
+    // Seed a fake DB-backup row so the fail-loud guard is satisfied.
+    const fakeDump = path.join(storagePath, 'destination', 'fake.sql.gz');
+    fs.writeFileSync(fakeDump, 'pretend dump');
+    await db('database_backup_runs').insert({
+      started_at: new Date(),
+      completed_at: new Date(),
+      status: 'completed',
+      backup_type: 'pg',
+      file_path: fakeDump,
+      file_size_bytes: fs.statSync(fakeDump).size,
+      destination_path: fakeDump,
+    });
+
+    await backupService.runBackup(true);
+
+    const run = await db('backup_runs').orderBy('id', 'desc').first();
+    expect(run.status).toBe('completed');
+
+    const statsRaw = typeof run.statistics === 'string'
+      ? JSON.parse(run.statistics)
+      : run.statistics;
+    expect(statsRaw.per_path).toBeDefined();
+
+    // events/active should have 2 files (3000 bytes)
+    expect(statsRaw.per_path['events/active']).toEqual({ count: 2, size: 3000 });
+    // business-docs should have 1 file (500 bytes)
+    expect(statsRaw.per_path['business-docs']).toEqual({ count: 1, size: 500 });
+    // thumbnails should have 1 file (50 bytes)
+    expect(statsRaw.per_path['thumbnails']).toEqual({ count: 1, size: 50 });
+
+    // No spurious buckets for paths that had nothing
+    expect(statsRaw.per_path['previews']).toBeUndefined();
+    expect(statsRaw.per_path['heroes']).toBeUndefined();
+  });
+
+  it('archived path attributed separately from active when both have files', async () => {
+    mkFile('events/active/E1/active.jpg', 'X'.repeat(100));
+    mkFile('events/archived/E2/archived.jpg', 'X'.repeat(200));
+
+    // backup_include_archived already set true in beforeEach so the
+    // archived walker fires; same opt-out for inline DB dump.
+    await db('app_settings').insert({
+      setting_key: 'backup_database_inline_dump',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup',
+    }).onConflict('setting_key').merge();
+    const fakeDump = path.join(storagePath, 'destination', 'fake.sql.gz');
+    fs.writeFileSync(fakeDump, 'pretend dump');
+    await db('database_backup_runs').insert({
+      started_at: new Date(),
+      completed_at: new Date(),
+      status: 'completed',
+      backup_type: 'pg',
+      file_path: fakeDump,
+      file_size_bytes: fs.statSync(fakeDump).size,
+      destination_path: fakeDump,
+    });
+
+    await backupService.runBackup(true);
+
+    const run = await db('backup_runs').orderBy('id', 'desc').first();
+    const statsRaw = typeof run.statistics === 'string'
+      ? JSON.parse(run.statistics)
+      : run.statistics;
+
+    // events/active and events/archived attribute separately —
+    // longest-prefix match prevents `events/active/...` from claiming
+    // an `events/archived/...` file or vice versa.
+    expect(statsRaw.per_path['events/active']).toEqual({ count: 1, size: 100 });
+    expect(statsRaw.per_path['events/archived']).toEqual({ count: 1, size: 200 });
+  });
+});
+
+// NOTE on walker duplication
+//
+// If two `backup_paths` rows overlap (e.g. one row at `events` AND
+// another at `events/active`), the walker scans the same files twice
+// — once via each path. Per-path stats then attribute the file to the
+// longest-prefix-matching path BOTH times, producing inflated counts.
+//
+// The canonical seed in migration 109 contains no overlapping pairs,
+// so this isn't exercised in practice. But an admin who hand-adds a
+// broad row that overlaps an existing nested one will see double
+// counts in their next backup's statistics + the destination will
+// receive duplicate copies (wasting space). Worth flagging if anyone
+// reports it — the fix is to de-dupe `files` in
+// `getFilesToBackupInternal` before returning, OR to skip walking a
+// path if a longer one has already covered it.

backend/__tests__/integration/backupService.smoke.test.js

@@ -0,0 +1,143 @@
+/**
+ * Smoke tests for backupService's config resolution + file-collection
+ * and manifest validation paths — safety net ahead of the god-file
+ * decomposition.
+ *
+ * Uses the same real-SQLite harness as
+ * backupService.configurableWalker.test.js (bootCrmDb + a temp
+ * STORAGE_PATH) rather than the broken deep-mock approach in
+ * backupService.enhanced.test.js.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { bootCrmDb } = require('./helpers/crmDb');
+
+jest.setTimeout(120000);
+
+describe('backupService — config + file collection + manifest (smoke)', () => {
+  let db;
+  let cleanup;
+  let storagePath;
+  let backupService;
+  let backupManifest;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    storagePath = process.env.STORAGE_PATH;
+    backupService = require('../../src/services/backupService');
+    backupManifest = require('../../src/services/backupManifest');
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  beforeEach(async () => {
+    await db('app_settings').del();
+    // Reset the storage tree so each test starts from a pristine walk.
+    await fs.promises.rm(storagePath, { recursive: true, force: true });
+    await fs.promises.mkdir(storagePath, { recursive: true });
+  });
+
+  function seedFile(relPath, content = 'dummy bytes') {
+    const abs = path.join(storagePath, relPath);
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, content);
+    return abs;
+  }
+
+  async function insertBackupSetting(key, value) {
+    await db('app_settings').insert({
+      setting_key: key,
+      setting_value: value,
+      setting_type: 'backup',
+    });
+  }
+
+  describe('getBackupConfig', () => {
+    it('parses booleans, numbers, JSON arrays and plain strings from app_settings', async () => {
+      await insertBackupSetting('backup_enabled', 'true');
+      await insertBackupSetting('backup_include_archived', 'false');
+      await insertBackupSetting('backup_retention_days', '30');
+      await insertBackupSetting('backup_destination_path', '/backups/picpeak');
+      await insertBackupSetting('backup_email_recipients', '["a@example.com","b@example.com"]');
+      // Non-backup settings must not leak into the backup config.
+      await db('app_settings').insert({
+        setting_key: 'general_site_name',
+        setting_value: 'PicPeak',
+        setting_type: 'general',
+      });
+
+      const config = await backupService.getBackupConfig();
+
+      expect(config.backup_enabled).toBe(true);
+      expect(config.backup_include_archived).toBe(false);
+      expect(config.backup_retention_days).toBe(30);
+      expect(config.backup_destination_path).toBe('/backups/picpeak');
+      expect(config.backup_email_recipients).toEqual(['a@example.com', 'b@example.com']);
+      expect(config).not.toHaveProperty('general_site_name');
+      // Raw (unparsed) values are preserved on the non-enumerable __raw.
+      expect(String(config.__raw.backup_retention_days)).toBe('30');
+    });
+
+    it('returns an empty config object (not null) when nothing is configured', async () => {
+      const config = await backupService.getBackupConfig();
+      expect(config).not.toBeNull();
+      expect(Object.keys(config)).toHaveLength(0);
+    });
+  });
+
+  describe('getFilesToBackup', () => {
+    it('returns an empty list on a pristine storage tree', async () => {
+      const files = await backupService.getFilesToBackup({ backup_include_archived: true });
+      expect(files).toEqual([]);
+    });
+
+    it('captures path/relativePath/size/modified metadata for backed-up files', async () => {
+      const content = 'not really a jpeg';
+      const abs = seedFile('events/active/E9/pic.jpg', content);
+
+      const files = await backupService.getFilesToBackup({ backup_include_archived: true });
+      const entry = files.find((f) => f.relativePath === path.join('events/active/E9', 'pic.jpg'));
+
+      expect(entry).toBeDefined();
+      expect(entry.path).toBe(abs);
+      expect(entry.size).toBe(Buffer.byteLength(content));
+      // Not toBeInstanceOf(Date) — fs.stat mtime comes from a different
+      // realm under Jest and fails the cross-realm instanceof check.
+      expect(Object.prototype.toString.call(entry.modified)).toBe('[object Date]');
+    });
+  });
+
+  describe('validateBackupManifest', () => {
+    it('round-trips a generated manifest as valid', async () => {
+      seedFile('events/active/E1/a.jpg', 'aaa');
+      const files = await backupService.getFilesToBackup({ backup_include_archived: true });
+
+      const manifest = await backupManifest.generateManifest({
+        backupType: 'full',
+        backupPath: '/backup/run-1',
+        files,
+      });
+      const manifestPath = path.join(storagePath, 'manifest-smoke.json');
+      await backupManifest.saveManifest(manifest, manifestPath, 'json');
+
+      const result = await backupService.validateBackupManifest(manifestPath);
+      expect(result.valid).toBe(true);
+      expect(result.manifest.backup.type).toBe('full');
+      expect(result.manifest.files.count).toBe(files.length);
+      expect(result.manifest.verification.total_checksum).toBeTruthy();
+    });
+
+    it('flags a manifest missing required sections as invalid', async () => {
+      const badPath = path.join(storagePath, 'manifest-broken.json');
+      fs.writeFileSync(badPath, JSON.stringify({ manifest: { version: '2.0' } }));
+
+      const result = await backupService.validateBackupManifest(badPath);
+      expect(result.valid).toBe(false);
+      expect(result.error).toMatch(/Missing required section/);
+    });
+  });
+});

backend/__tests__/integration/bookingCutover.test.js

@@ -0,0 +1,170 @@
+/**
+ * Booking cutover — prepare_invoice's draft seam. convertToInvoiceOnly({draft})
+ * must create the invoice(s) but leave scheduled_send_at NULL so the scheduler
+ * never auto-sends them before the workflow's review gate + explicit
+ * send_document.
+ */
+const crypto = require('crypto');
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+jest.setTimeout(120000);
+
+describe('booking cutover — draft invoices on hold', () => {
+  let db; let cleanup; let adminId; let customerId; let quoteService;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    ({ adminId, customerId } = await seedMinimal(db));
+    quoteService = require('../../src/services/quoteService');
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  async function acceptedQuote() {
+    const dealUuid = crypto.randomUUID();
+    const [id] = await db('quotes').insert({
+      quote_number: `Q-${dealUuid.slice(0, 8)}`,
+      customer_account_id: customerId,
+      status: 'accepted',
+      currency: 'CHF',
+      issue_date: '2026-01-01',
+      net_amount_minor: 100000, vat_amount_minor: 0, shipping_amount_minor: 0, total_amount_minor: 100000,
+      // A non-delivery installment so the contrast (scheduled date vs null) is meaningful.
+      payment_term_snapshot: JSON.stringify({ installments: [{ percent: 100, trigger: 'quote_accepted', offset_days: 0, label: 'Total' }], net_days: 30 }),
+      deal_uuid: dealUuid,
+      created_by_admin_id: adminId,
+    });
+    return id;
+  }
+
+  it('draft mode creates the invoice with scheduled_send_at = NULL (held), and returns its id', async () => {
+    const quoteId = await acceptedQuote();
+    const res = await quoteService.convertToInvoiceOnly(quoteId, adminId, { draft: true });
+    expect(Array.isArray(res.invoiceIds)).toBe(true);
+    expect(res.invoiceIds.length).toBeGreaterThanOrEqual(1);
+
+    const inv = await db('invoices').where({ id: res.invoiceIds[0] }).first();
+    expect(inv.status).toBe('scheduled');     // editable + sendInvoice can issue it
+    expect(inv.scheduled_send_at == null).toBe(true); // held — scheduler won't auto-send
+  });
+
+  it('without draft, the same installment IS scheduled (scheduled_send_at set)', async () => {
+    const quoteId = await acceptedQuote();
+    const res = await quoteService.convertToInvoiceOnly(quoteId, adminId);
+    const inv = await db('invoices').where({ id: res.invoiceIds[0] }).first();
+    expect(inv.status).toBe('scheduled');
+    expect(inv.scheduled_send_at == null).toBe(false); // normal convert → auto-send date set
+  });
+
+  it('prepare_event path (convertToEvent hold) creates a DRAFT event with held invoices', async () => {
+    const quoteId = await acceptedQuote();
+    const res = await quoteService.convertToEvent(quoteId, adminId, { hold: true });
+    expect(res.eventId).toBeGreaterThanOrEqual(1);
+    expect(Array.isArray(res.invoiceIds)).toBe(true);
+    expect(res.invoiceIds.length).toBeGreaterThanOrEqual(1);
+
+    const ev = await db('events').where({ id: res.eventId }).first();
+    expect(ev.is_draft == true || ev.is_draft === 1).toBe(true); // created as a draft gallery
+
+    // Every invoice the event scheduled is held (no auto-send before the gate).
+    const invs = await db('invoices').whereIn('id', res.invoiceIds);
+    for (const inv of invs) expect(inv.scheduled_send_at == null).toBe(true);
+
+    // Quote is now linked to the event — convertToInvoiceOnly must NOT be called
+    // again for it (the flow's prepare_invoice adopts these ids instead).
+    const q = await db('quotes').where({ id: quoteId }).first();
+    expect(q.converted_event_id).toBe(res.eventId);
+  });
+
+  it('draft mode with the DEFAULT (after_delivery) payment term yields a SENDABLE scheduled invoice, not pending_delivery', async () => {
+    // Reproduces the booking_invoice_only flow on a quote with no explicit
+    // payment timing: the default installment is after_delivery, which would
+    // otherwise be pending_delivery — a status sendInvoice (send_document) rejects.
+    const dealUuid = crypto.randomUUID();
+    const [quoteId] = await db('quotes').insert({
+      quote_number: `Q-${dealUuid.slice(0, 8)}`,
+      customer_account_id: customerId,
+      status: 'accepted',
+      currency: 'CHF',
+      issue_date: '2026-01-01',
+      net_amount_minor: 50000, vat_amount_minor: 0, shipping_amount_minor: 0, total_amount_minor: 50000,
+      // No payment_term_snapshot → spawnInstallmentInvoices falls back to a single
+      // 100% after_delivery installment.
+      deal_uuid: dealUuid,
+      created_by_admin_id: adminId,
+    });
+    const res = await quoteService.convertToInvoiceOnly(quoteId, adminId, { draft: true });
+    const inv = await db('invoices').where({ id: res.invoiceIds[0] }).first();
+    expect(inv.status).toBe('scheduled');            // sendInvoice accepts this
+    expect(inv.scheduled_send_at == null).toBe(true); // still held — no auto-send
+  });
+
+  it('finalizeQuoteResponses only fires once the 15-min response window has locked', async () => {
+    const mk = async (lockOffsetMs) => {
+      const dealUuid = crypto.randomUUID();
+      const [id] = await db('quotes').insert({
+        quote_number: `Q-${dealUuid.slice(0, 8)}`,
+        customer_account_id: customerId,
+        status: 'accepted',
+        currency: 'CHF', issue_date: '2026-01-01',
+        net_amount_minor: 1000, vat_amount_minor: 0, shipping_amount_minor: 0, total_amount_minor: 1000,
+        responded_at: new Date().toISOString(),
+        response_locked_at: new Date(Date.now() + lockOffsetMs).toISOString(),
+        accepted_at: new Date().toISOString(),
+        deal_uuid: dealUuid,
+        created_by_admin_id: adminId,
+      });
+      return id;
+    };
+    const openId = await mk(15 * 60 * 1000);   // still inside the window
+    const lockedId = await mk(-60 * 1000);      // window already closed
+
+    const emitted = await quoteService.finalizeQuoteResponses();
+    expect(emitted).toBeGreaterThanOrEqual(1);
+
+    const open = await db('quotes').where({ id: openId }).first();
+    const locked = await db('quotes').where({ id: lockedId }).first();
+    expect(open.workflow_response_emitted_at == null).toBe(true);   // deferred — not yet fired
+    expect(locked.workflow_response_emitted_at == null).toBe(false); // fired + stamped
+
+    // Idempotent: a second sweep doesn't re-fire the already-stamped one.
+    const again = await db('quotes').where({ id: lockedId })
+      .whereNull('workflow_response_emitted_at').update({ workflow_response_emitted_at: new Date() });
+    expect(again).toBe(0);
+  });
+
+  it('reserve_date path (convertToEvent skipInvoices) creates a draft event with NO invoices', async () => {
+    const quoteId = await acceptedQuote();
+    const res = await quoteService.convertToEvent(quoteId, adminId, { hold: true, skipInvoices: true });
+    expect(res.eventId).toBeGreaterThanOrEqual(1);
+    expect(res.invoiceIds).toEqual([]);
+    const invCount = await db('invoices').where({ event_id: res.eventId }).count({ c: '*' }).first();
+    expect(Number(invCount.c)).toBe(0); // pure date hold — no money documents
+  });
+
+  it('prepare_quote path (duplicateQuote) creates a new DRAFT quote — no in-trx deadlock', async () => {
+    const quoteId = await acceptedQuote();
+    const newId = await quoteService.duplicateQuote(quoteId, adminId);
+    expect(newId).toBeGreaterThanOrEqual(1);
+    expect(newId).not.toBe(quoteId);
+    const q = await db('quotes').where({ id: newId }).first();
+    expect(q.status).toBe('draft');
+  });
+
+  it('registers prepare_gallery / reserve_date / prepare_quote as real actions', () => {
+    const { registry } = require('../../src/services/workflows'); // loads actions.js (side-effect registration)
+    for (const a of ['prepare_gallery', 'reserve_date', 'prepare_quote', 'prepare_event', 'prepare_invoice', 'send_document']) {
+      expect(typeof registry.getAction(a)).toBe('function');
+    }
+  });
+
+  it('prepare_contract path (createFromQuote) completes under SQLite — no in-trx deadlock', async () => {
+    const contractService = require('../../src/services/contractService');
+    const quoteId = await acceptedQuote();
+    const res = await contractService.createFromQuote(quoteId, adminId);
+    expect(res.contractId).toBeGreaterThanOrEqual(1);
+    expect(res.alreadyConverted).toBe(false);
+    const c = await db('contracts').where({ id: res.contractId }).first();
+    expect(c).toBeTruthy();
+  });
+});

backend/__tests__/integration/businessProfileLogoUpload.test.js

@@ -0,0 +1,195 @@
+/**
+ * POST /api/admin/business-profile/logo and PUT /api/admin/business-profile
+ * — GHSA-6wrv-9pr4-hhmw regression coverage.
+ *
+ * The upload route used to take the stored file extension straight from
+ * the client-supplied filename and only checked `file.mimetype` against an
+ * allowlist — a file could declare an image MIME type while carrying a
+ * `.html`/`.js` extension and arbitrary content, land in the same-origin
+ * `/uploads/logos` static mount, and execute as script. The mass-assignable
+ * `logoPath` field on PUT compounded it: an attacker could point the
+ * "logo" at any other uploaded file.
+ *
+ * These tests pin:
+ *   (a) a MIME/extension mismatch is rejected at upload,
+ *   (b) the extension actually written to disk always matches the
+ *       validated MIME type, never the client-supplied filename,
+ *   (c) legitimate PNG/JPEG/SVG uploads still succeed,
+ *   (d) `logoPath` on PUT cannot be set to an arbitrary string pointing at
+ *       another file, only to a path the upload route itself produced.
+ *
+ * Defense-in-depth (not a re-opening of the above): fileFilter only pairs
+ * the claimed MIME type against the extension — it can't see the bytes,
+ * since it runs before multer finishes writing the stream to disk. A file
+ * whose declared MIME/extension pair is valid but whose actual content
+ * doesn't match (e.g. a PNG-declared upload that isn't really a PNG) is
+ * now caught by validateFileContent() (magic-number check) after multer
+ * writes it, closing the gap where declared-vs-actual content diverges.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-bplogo-test-'));
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'db.sqlite');
+process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+fs.mkdirSync(process.env.STORAGE_PATH, { recursive: true });
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'bplogo-route-test-secret';
+
+const request = require('supertest');
+const {
+  bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken, buildRouteApp,
+} = require('./helpers/crmDb');
+
+// Real magic-number-prefixed payloads, for content-sniffing to accept.
+const REAL_PNG_BYTES = Buffer.concat([
+  Buffer.from([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]),
+  Buffer.from('not a real png body, but the header is real'),
+]);
+const REAL_JPEG_BYTES = Buffer.concat([
+  Buffer.from([0xFF, 0xD8, 0xFF]),
+  Buffer.from('not a real jpeg body, but the header is real'),
+]);
+
+describe('business profile — logo upload content/extension validation', () => {
+  let db;
+  let cleanup;
+  let app;
+  let token;
+
+  const uploadLogo = (buffer, filename, mimetype) => request(app)
+    .post('/api/admin/business-profile/logo')
+    .set('Authorization', `Bearer ${token}`)
+    .attach('logo', buffer, { filename, contentType: mimetype });
+
+  const put = (payload) => request(app)
+    .put('/api/admin/business-profile')
+    .set('Authorization', `Bearer ${token}`)
+    .send(payload);
+
+  const get = () => request(app)
+    .get('/api/admin/business-profile')
+    .set('Authorization', `Bearer ${token}`);
+
+  const profileOf = (res) => (res.body.data || res.body).profile;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    const { adminId } = await seedMinimal(db);
+    await assignAdminRole(db, adminId, 'super_admin');
+    token = mintAdminToken(adminId);
+    app = buildRouteApp('/api/admin/business-profile', require('../../src/routes/adminBusinessProfile'));
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  // fileFilter rejections surface via Express's generic error handler
+  // (the pre-existing behaviour of every sibling logo/favicon upload
+  // route in this codebase — none of them special-case multer's
+  // fileFilter `Error` into a 400 either), so the status code itself
+  // can be 400 or 500 depending on environment. What actually matters
+  // for GHSA-6wrv-9pr4-hhmw is that the request never succeeds and
+  // nothing with the dangerous extension is ever written to disk.
+  const logosDirFiles = () => {
+    const logosDir = path.join(process.env.STORAGE_PATH, 'uploads', 'logos');
+    return fs.existsSync(logosDir) ? fs.readdirSync(logosDir) : [];
+  };
+
+  it('rejects an HTML/script payload disguised as an image via mismatched extension', async () => {
+    const evil = Buffer.from('<script>alert(document.domain)</script>');
+    const res = await uploadLogo(evil, 'evil.html', 'image/svg+xml');
+    expect(res.status).not.toBe(200);
+    expect(logosDirFiles().some((f) => f.endsWith('.html'))).toBe(false);
+  });
+
+  it('rejects a .js file disguised with an image MIME type', async () => {
+    const evil = Buffer.from('alert(1)');
+    const res = await uploadLogo(evil, 'evil.js', 'image/png');
+    expect(res.status).not.toBe(200);
+    expect(logosDirFiles().some((f) => f.endsWith('.js'))).toBe(false);
+  });
+
+  it('rejects a disallowed MIME type outright', async () => {
+    const res = await uploadLogo(Buffer.from('whatever'), 'file.pdf', 'application/pdf');
+    expect(res.status).not.toBe(200);
+    expect(logosDirFiles().some((f) => f.endsWith('.pdf'))).toBe(false);
+  });
+
+  it('accepts a legitimate PNG upload and stores it with a .png extension', async () => {
+    const res = await uploadLogo(REAL_PNG_BYTES, 'logo.png', 'image/png');
+    expect(res.status).toBe(200);
+    const logoPath = (res.body.data || res.body).logoPath;
+    expect(logoPath).toMatch(/^\/uploads\/logos\/pdf-logo-\d+\.png$/);
+
+    const onDisk = path.join(process.env.STORAGE_PATH, logoPath.replace(/^\//, ''));
+    expect(fs.existsSync(onDisk)).toBe(true);
+
+    expect(profileOf(await get()).logoPath).toBe(logoPath);
+  });
+
+  it('accepts a legitimate JPEG upload and stores it with a .jpg extension', async () => {
+    const res = await uploadLogo(REAL_JPEG_BYTES, 'logo.jpg', 'image/jpeg');
+    expect(res.status).toBe(200);
+    const logoPath = (res.body.data || res.body).logoPath;
+    expect(logoPath).toMatch(/^\/uploads\/logos\/pdf-logo-\d+\.jpg$/);
+  });
+
+  it('rejects a PNG-declared upload whose bytes are not actually a PNG, and leaves nothing on disk', async () => {
+    const before = logosDirFiles();
+    const res = await uploadLogo(Buffer.from('totally not a png'), 'logo.png', 'image/png');
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/content does not match/i);
+
+    // No new file left behind: the rejected upload's own file was cleaned
+    // up, and every other file on disk (if any) is unchanged.
+    expect(logosDirFiles()).toEqual(before);
+  });
+
+  it('accepts a legitimate SVG upload and always stores it with a .svg extension, even under a spoofed filename', async () => {
+    const svg = Buffer.from('<svg xmlns="http://www.w3.org/2000/svg"><rect width="1" height="1"/></svg>');
+    // Client-declared filename ext is .svg here to pass validateFileType
+    // (mismatched ext is covered by the rejection tests above); the point
+    // of this test is that the ON-DISK extension comes from the MIME type
+    // lookup table, not path.extname(originalname).
+    const res = await uploadLogo(svg, 'vector-logo.svg', 'image/svg+xml');
+    expect(res.status).toBe(200);
+    const logoPath = (res.body.data || res.body).logoPath;
+    expect(logoPath).toMatch(/^\/uploads\/logos\/pdf-logo-\d+\.svg$/);
+  });
+
+  it('rejects logoPath on PUT set to an arbitrary string pointing at another file', async () => {
+    const before = profileOf(await get()).logoPath;
+
+    const res = await put({ logoPath: '/uploads/logos/cms-somepage-1234.png' });
+    expect(res.status).toBe(400);
+
+    expect(profileOf(await get()).logoPath).toBe(before);
+  });
+
+  it('rejects logoPath on PUT with a path-traversal payload', async () => {
+    const res = await put({ logoPath: '/uploads/logos/../../../../etc/passwd' });
+    expect(res.status).toBe(400);
+  });
+
+  it('accepts logoPath on PUT when it matches the pattern this route itself writes', async () => {
+    const upload = await uploadLogo(REAL_PNG_BYTES, 'logo2.png', 'image/png');
+    const uploadedPath = (upload.body.data || upload.body).logoPath;
+
+    // Round-trip: PUT-ing back the exact value the upload endpoint
+    // returned (what the frontend's generic profile save does) must
+    // keep working.
+    const res = await put({ logoPath: uploadedPath });
+    expect(res.status).toBe(200);
+    expect(profileOf(await get()).logoPath).toBe(uploadedPath);
+  });
+
+  it('still allows clearing logoPath with an empty string', async () => {
+    const res = await put({ logoPath: '' });
+    expect(res.status).toBe(200);
+    expect(profileOf(await get()).logoPath).toBe('');
+  });
+});

backend/__tests__/integration/captureDateBackfill.test.js

@@ -0,0 +1,227 @@
+/**
+ * Backfilling captured_at on a library imported before #1172.
+ *
+ * The point of the endpoint, rather than a migration: it resolves originals
+ * through resolvePhotoFilePath, which is the only path that reaches an
+ * external row. The thumbnail regenerator resolves under
+ * storage/events/active/<photo.path>, which never exists for those (#1129) —
+ * so it cannot be the model.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const express = require('express');
+const request = require('supertest');
+const sharp = require('sharp');
+
+describe('capture date backfill (#1172)', () => {
+  let tmpDir; let db; let app; let mediaRoot;
+
+  const writeJpegWithExif = async (abs, iso) => {
+    await fs.promises.mkdir(path.dirname(abs), { recursive: true });
+    const d = new Date(iso);
+    const pad = (n) => String(n).padStart(2, '0');
+    const exifDate = `${d.getUTCFullYear()}:${pad(d.getUTCMonth() + 1)}:${pad(d.getUTCDate())} `
+      + `${pad(d.getUTCHours())}:${pad(d.getUTCMinutes())}:${pad(d.getUTCSeconds())}`;
+    await sharp({ create: { width: 60, height: 40, channels: 3, background: { r: 9, g: 9, b: 9 } } })
+      .withExif({ IFD2: { DateTimeOriginal: exifDate } }).jpeg().toFile(abs);
+  };
+
+  const settle = async () => { for (let i = 0; i < 60; i++) { await new Promise((r) => setTimeout(r, 50)); const s = await status(); if (!s.body.isRunning) return s; } throw new Error('backfill did not settle'); };
+  const status = () => request(app).get('/api/admin/photos/repair-capture-dates/status');
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-capfill-'));
+    mediaRoot = path.join(tmpDir, 'media');
+    await fs.promises.mkdir(mediaRoot, { recursive: true });
+
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'db.sqlite');
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+    process.env.EXTERNAL_MEDIA_ROOT = mediaRoot;
+    process.env.JWT_SECRET = process.env.JWT_SECRET || 'capfill-secret';
+
+    jest.resetModules();
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => { req.admin = { id: 1, username: 'tester', roleName: 'admin' }; next(); },
+    }));
+    jest.doMock('../../src/middleware/permissions', () => ({
+      requirePermission: () => (_req, _res, next) => next(),
+    }));
+    jest.doMock('../../src/utils/logger', () => ({
+      debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(),
+    }));
+
+    ({ db } = await require('./helpers/crmDb').bootCrmDb());
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/photos', require('../../src/routes/adminPhotoDimensions'));
+  }, 180000);
+
+  afterAll(async () => {
+    if (db) await db.destroy?.();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  async function seed({ relpath, exifIso, writeFile = true, archived = false }) {
+    await db('photos').del();
+    await db('events').del();
+    const [e] = await db('events').insert({
+      slug: 'capfill', event_type: 'wedding', event_name: 'capfill', event_date: '2026-01-01',
+      host_email: 'h@example.com', admin_email: 'a@example.com', password_hash: 'x',
+      share_link: `capfill-${Math.random()}`, expires_at: new Date().toISOString(),
+      source_mode: 'reference', external_path: 'trip', is_archived: archived,
+    }).returning('id');
+    const eventId = typeof e === 'object' ? e.id : e;
+    if (writeFile) await writeJpegWithExif(path.join(mediaRoot, 'trip', relpath), exifIso);
+    const [p] = await db('photos').insert({
+      event_id: eventId, filename: path.basename(relpath), path: `capfill/${path.basename(relpath)}`,
+      // Root-relative, as this branch stores it (#1163) — the file lives at
+      // <mediaRoot>/trip/<relpath>.
+      type: 'individual', source_origin: 'external', external_relpath: `trip/${relpath}`,
+      uploaded_at: new Date().toISOString(), captured_at: null,
+    }).returning('id');
+    return { eventId, photoId: typeof p === 'object' ? p.id : p };
+  }
+
+  it('fills captured_at for an external photo the thumbnail regenerator cannot reach', async () => {
+    const { photoId } = await seed({ relpath: 'a.jpg', exifIso: '2026-06-01T09:45:03Z' });
+
+    const res = await request(app).post('/api/admin/photos/repair-capture-dates');
+    expect(res.status).toBe(200);
+    expect(res.body.count).toBe(1);
+    const done = await settle();
+
+    expect(done.body.lastResult.success).toBe(1);
+    expect((await db('photos').where({ id: photoId }).first()).captured_at).toBeTruthy();
+  });
+
+  it('counts a photo with no EXIF separately from a failure', async () => {
+    // "The mount is broken" and "these files carry no date" need different
+    // answers from an operator, so they are not the same number.
+    await db('photos').del(); await db('events').del();
+    const { photoId } = await seed({ relpath: 'plain.jpg', exifIso: '2026-06-01T09:45:03Z', writeFile: false });
+    await sharp({ create: { width: 40, height: 30, channels: 3, background: { r: 1, g: 1, b: 1 } } })
+      .jpeg().toFile(path.join(mediaRoot, 'trip', 'plain.jpg'));
+
+    await request(app).post('/api/admin/photos/repair-capture-dates');
+    const done = await settle();
+
+    expect(done.body.lastResult).toMatchObject({ success: 0, noExif: 1, failed: 0 });
+    expect((await db('photos').where({ id: photoId }).first()).captured_at).toBeNull();
+  });
+
+  it('counts an unreachable original as a failure, not as missing EXIF', async () => {
+    await seed({ relpath: 'gone.jpg', exifIso: '2026-06-01T09:45:03Z', writeFile: false });
+
+    await request(app).post('/api/admin/photos/repair-capture-dates');
+    const done = await settle();
+
+    expect(done.body.lastResult).toMatchObject({ success: 0, noExif: 0, failed: 1 });
+  });
+
+  it('reports nothing to do once every photo has a date', async () => {
+    const { photoId } = await seed({ relpath: 'b.jpg', exifIso: '2026-06-02T09:00:00Z' });
+    await db('photos').where({ id: photoId }).update({ captured_at: new Date().toISOString() });
+
+    const res = await request(app).post('/api/admin/photos/repair-capture-dates');
+
+    expect(res.body.count).toBe(0);
+    expect((await status()).body.withoutCaptureDate).toBe(0);
+  });
+
+  it('skips a watcher-imported video, which carries media_type "image"', async () => {
+    // fileWatcher.processNewPhoto sets type='video' and a video/* mime but
+    // never media_type (fileWatcher.js:128-130), so the row keeps the 'image'
+    // default from migration 048. Filtering on media_type alone queued it every
+    // run: extractCaptureDate returns null for a video, captured_at stays null,
+    // and the backlog never cleared.
+    const { eventId } = await seed({ relpath: 'clip.jpg', exifIso: '2026-06-01T09:45:03Z', writeFile: false });
+    await db('photos').del();
+    await db('photos').insert({
+      event_id: eventId, filename: 'clip.mp4', path: 'capfill/clip.mp4',
+      type: 'video', media_type: 'image', mime_type: 'video/mp4',
+      source_origin: 'external', external_relpath: 'trip/clip.mp4',
+      uploaded_at: new Date().toISOString(), captured_at: null,
+    });
+
+    const res = await request(app).post('/api/admin/photos/repair-capture-dates');
+    expect(res.body.count).toBe(0);
+
+    const s = await status();
+    // And it is not counted as a permanent backlog either.
+    expect(s.body.total).toBe(0);
+    expect(s.body.withoutCaptureDate).toBe(0);
+  });
+
+  it('never reports more dated photos than it has photos', async () => {
+    // Both counts come from one aggregate; as two queries an import committing
+    // between them produced withCaptureDate > total and a negative backlog.
+    const { photoId } = await seed({ relpath: 'counted.jpg', exifIso: '2026-06-05T08:00:00Z' });
+    await db('photos').where({ id: photoId }).update({ captured_at: new Date().toISOString() });
+
+    const s = await status();
+    expect(s.body.total).toBe(1);
+    expect(s.body.withCaptureDate).toBe(1);
+    expect(s.body.withoutCaptureDate).toBe(0);
+    expect(s.body.withoutCaptureDate).toBeGreaterThanOrEqual(0);
+  });
+
+  it('skips archived events instead of failing them on every run', async () => {
+    // Archiving deletes the originals and keeps the rows, so an archived photo
+    // can never get a date. Counting it would fail it every pass and leave the
+    // status endpoint permanently reporting a backlog.
+    await seed({ relpath: 'archived.jpg', exifIso: '2026-06-04T09:00:00Z', archived: true });
+
+    const res = await request(app).post('/api/admin/photos/repair-capture-dates');
+
+    expect(res.body.count).toBe(0);
+    const s = await status();
+    expect(s.body.total).toBe(0);
+    expect(s.body.withoutCaptureDate).toBe(0);
+    expect(s.body.isRunning).toBe(false);
+  });
+
+  it('does not overwrite a date written while it was running', async () => {
+    // whereNull on the update: an import or a replacement finishing mid-run has
+    // already written a better value than this pass would.
+    const { photoId } = await seed({ relpath: 'c.jpg', exifIso: '2026-06-03T09:00:00Z' });
+    const claimed = '2020-01-01T00:00:00.000Z';
+
+    const res = await request(app).post('/api/admin/photos/repair-capture-dates');
+    expect(res.body.count).toBe(1);
+    await db('photos').where({ id: photoId }).update({ captured_at: claimed });
+    const done = await settle();
+
+    expect(new Date((await db('photos').where({ id: photoId }).first()).captured_at).toISOString()).toBe(claimed);
+    expect(done.body.lastResult.success).toBe(0);
+    // Read but not written, so it is accounted for rather than dropped.
+    expect(done.body.lastResult.skipped).toBe(1);
+  });
+
+  it('does not date a row whose file was replaced while it was reading (#1201)', async () => {
+    // replacePhoto swaps a NEW file under an existing row and rewrites
+    // path/filename (reachable from replace_by_name). The replacement carries
+    // no date of its own, so captured_at is still NULL and the whereNull guard
+    // alone would let the previous file's EXIF date land on it. The write is
+    // fenced on the identity that was read, so the row is skipped instead —
+    // and not counted as updated either.
+    const { photoId } = await seed({ relpath: 'orig.jpg', exifIso: '2026-06-03T09:00:00Z' });
+
+    const res = await request(app).post('/api/admin/photos/repair-capture-dates');
+    expect(res.body.count).toBe(1);
+    // Simulate the replacement landing before the loop writes.
+    await db('photos').where({ id: photoId })
+      .update({ path: 'capfill/replaced.jpg', filename: 'replaced.jpg' });
+    const done = await settle();
+
+    expect((await db('photos').where({ id: photoId }).first()).captured_at).toBeNull();
+    expect(done.body.lastResult.success).toBe(0);
+    // Not an error and not "no EXIF" — the date was found, another writer just
+    // got there first. It stays in the backlog for the next run.
+    expect(done.body.lastResult).toMatchObject({ noExif: 0, failed: 0, skipped: 1 });
+  });
+});

backend/__tests__/integration/crmSchema.test.js

@@ -0,0 +1,116 @@
+/**
+ * Schema-shape regression net for the CRM consolidated migration.
+ *
+ * Pins the table/column layout that the route + service layer expect
+ * after `migrations/core/107_crm_consolidated.js` runs. The schema-
+ * drift workflow (#530) catches Postgres-only FK ordering bugs (the
+ * forward-reference deferral added in this PR), but it doesn't notice
+ * if a future edit silently drops a column the service code reads —
+ * SQLite would just return undefined and the broken behavior would
+ * land on beta.
+ *
+ * Touches the lineage chain (deal_uuid + back-pointer FKs) explicitly
+ * so a rename or removal there fails the test instead of silently
+ * breaking the lineage card.
+ */
+
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+describe('CRM schema after core migrations', () => {
+  let db;
+  let cleanup;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  describe('table layout', () => {
+    const expectedTables = [
+      'admin_users', 'customer_accounts', 'business_profile', 'business_bank_accounts',
+      'events', 'document_sequences',
+      'quotes', 'quote_line_items', 'quote_line_item_presets', 'quote_action_tokens',
+      'contracts', 'contract_blocks', 'contract_block_inclusions', 'contract_action_tokens',
+      'invoices', 'invoice_line_items', 'invoice_payment_log', 'invoice_payment_check_tokens',
+      'customer_hour_entries',
+      'payment_term_templates', 'payment_net_days_templates', 'payment_timing_templates',
+      'event_payment_plans',
+    ];
+
+    it.each(expectedTables)('has table %s', async (table) => {
+      expect(await db.schema.hasTable(table)).toBe(true);
+    });
+  });
+
+  describe('deal_uuid lineage columns', () => {
+    // Every document in one engagement shares a deal_uuid — the
+    // lineage card joins on it. Drop the column anywhere in the chain
+    // and the card silently returns partial data.
+    it.each(['quotes', 'contracts', 'invoices'])(
+      '%s has deal_uuid column',
+      async (table) => {
+        expect(await db.schema.hasColumn(table, 'deal_uuid')).toBe(true);
+      }
+    );
+
+    // The back-pointer FKs were the source of the schema-drift bug
+    // we fixed in this PR (forward references). Pin them.
+    it('quotes has converted_contract_id back-pointer', async () => {
+      expect(await db.schema.hasColumn('quotes', 'converted_contract_id')).toBe(true);
+    });
+    it('invoices has source_contract_id back-pointer', async () => {
+      expect(await db.schema.hasColumn('invoices', 'source_contract_id')).toBe(true);
+    });
+    it('invoices has source_quote_id back-pointer', async () => {
+      expect(await db.schema.hasColumn('invoices', 'source_quote_id')).toBe(true);
+    });
+  });
+
+  describe('Storno discriminator columns', () => {
+    // kind='storno' + cancels_invoice_id + negative totals are the
+    // shape every aggregate filter relies on (feedback_storno_filter_
+    // everywhere). Pin the columns so a rename doesn't silently break
+    // every revenue report.
+    it('invoices has kind discriminator', async () => {
+      expect(await db.schema.hasColumn('invoices', 'kind')).toBe(true);
+    });
+    it('invoices has cancels_invoice_id self-ref', async () => {
+      expect(await db.schema.hasColumn('invoices', 'cancels_invoice_id')).toBe(true);
+    });
+    it('invoices has replaces_invoice_id self-ref', async () => {
+      expect(await db.schema.hasColumn('invoices', 'replaces_invoice_id')).toBe(true);
+    });
+  });
+
+  describe('Event time columns (migration 137)', () => {
+    // The admin calendar reads these to render timed vs. full-day
+    // tiles. Per the feedback_migration_preserve_visuals rule, the
+    // default has to be `is_full_day=true` so existing rows keep
+    // their pre-migration visual.
+    it('events has event_time_start', async () => {
+      expect(await db.schema.hasColumn('events', 'event_time_start')).toBe(true);
+    });
+    it('events has event_time_end', async () => {
+      expect(await db.schema.hasColumn('events', 'event_time_end')).toBe(true);
+    });
+    it('events has is_full_day', async () => {
+      expect(await db.schema.hasColumn('events', 'is_full_day')).toBe(true);
+    });
+  });
+
+  describe('seed paths', () => {
+    it('admin + customer seed inserts cleanly', async () => {
+      const { adminId, customerId } = await seedMinimal(db);
+      expect(adminId).toBeTruthy();
+      expect(customerId).toBeTruthy();
+
+      const admin = await db('admin_users').where({ id: adminId }).first();
+      const customer = await db('customer_accounts').where({ id: customerId }).first();
+      expect(admin.email).toBe('tester@example.com');
+      expect(customer.email).toBe('customer@example.com');
+    });
+  });
+});

backend/__tests__/integration/discountLineItems.test.js

@@ -0,0 +1,79 @@
+/**
+ * Negative line items (Rabatt / manual discount lines) are accepted
+ * end-to-end as long as the resulting total stays ≥ 0. When the
+ * discount would drive the total negative, the service rejects with
+ * a clear, code-tagged error so the admin is steered to Storno for
+ * credit-note workflows.
+ *
+ * Touches the actual createInvoice / createQuote service paths so a
+ * future change to either computeTotals or the guard fires this test.
+ */
+
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+// Service-level CRM calls cold-require heavy modules (pdfService,
+// nodemailer, etc.) on first use; the global 5 s per-test budget is
+// too tight for that. Bump it for this file only.
+jest.setTimeout(120000);
+
+describe('discount line items (negative unit_price_minor)', () => {
+  let db;
+  let cleanup;
+  let adminId;
+  let customerId;
+  let invoiceService;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    ({ adminId, customerId } = await seedMinimal(db));
+    invoiceService = require('../../src/services/invoiceService');
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  // Quote-side coverage of the symmetric validator + guard is
+  // deliberately omitted: createQuote's init path takes ~30 s under
+  // this harness (something in pdfService / emailProcessor cold-
+  // require), which would push the suite well past CI's per-test
+  // budget. The shape of the guard is identical to the invoice one
+  // covered below; a future change to extract the slow init or to
+  // stub it for tests should re-enable a parallel quote test.
+
+  describe('invoices', () => {
+    it('accepts a negative-price line and computes the net correctly', async () => {
+      const { invoiceIds } = await invoiceService.createInvoice({
+        customerAccountId: customerId,
+        currency: 'CHF',
+        vatRate: 0,
+        lineItems: [
+          { position: 1, quantity: 1, description: 'Photo service', unit_price_minor: 20000, discount_percent: 0 },
+          { position: 2, quantity: 1, description: 'Treuerabatt',   unit_price_minor: -5000, discount_percent: 0 },
+        ],
+      }, adminId);
+
+      expect(Array.isArray(invoiceIds)).toBe(true);
+      expect(invoiceIds.length).toBe(1);
+
+      const row = await db('invoices').where({ id: invoiceIds[0] }).first();
+      expect(row.net_amount_minor).toBe(15000);
+      expect(row.total_amount_minor).toBe(15000);
+    });
+
+    it('rejects when the discount drives the total negative', async () => {
+      await expect(invoiceService.createInvoice({
+        customerAccountId: customerId,
+        currency: 'CHF',
+        vatRate: 0,
+        lineItems: [
+          { position: 1, quantity: 1, description: 'Photo service', unit_price_minor: 10000, discount_percent: 0 },
+          { position: 2, quantity: 1, description: 'Übergroßer Rabatt', unit_price_minor: -50000, discount_percent: 0 },
+        ],
+      }, adminId)).rejects.toMatchObject({
+        code: 'INVOICE_TOTAL_NEGATIVE',
+        statusCode: 400,
+      });
+    });
+  });
+});

backend/__tests__/integration/emailTemplateBoot.test.js

@@ -0,0 +1,98 @@
+/**
+ * Boot-time email-template self-heal:
+ *   1. Seeds the CRM / contract / event-reminder templates on an
+ *      install that's never had them before.
+ *   2. Recovers email_queue rows that previously exhausted their
+ *      retries because their template was missing.
+ *
+ * The failure that triggered this fix (2026-05-27) had Ralf's beta
+ * box failing every `quote_sent` / `invoice_sent` send for ~14h
+ * because crmEmailTemplates.ensureCrmEmailTemplatesSeeded was
+ * defined but never called. After 3 retries the rows sat in
+ * status='pending' forever; nothing in the admin UI signalled the
+ * problem. Both halves of that regression are covered here.
+ */
+
+const { bootCrmDb } = require('./helpers/crmDb');
+
+describe('email template self-heal at boot', () => {
+  let db;
+  let cleanup;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  it('seeds crm/contract/event-reminder templates and recovers stuck queue rows', async () => {
+    // Sanity: a fresh CRM-migrated DB does NOT carry CRM templates —
+    // 107_crm_consolidated documents the deliberate split (templates
+    // are self-healed at runtime, not inserted by the migration).
+    const before = await db('email_templates')
+      .whereIn('template_key', ['quote_sent', 'invoice_sent', 'storno_issued'])
+      .pluck('template_key');
+    expect(before).toEqual([]);
+
+    // Seed a stuck queue row that mirrors what we found on Ralf's box:
+    // quote_sent send attempted 3 times, each time failed because the
+    // template didn't exist, queue processor gave up.
+    const queueRowIds = await db('email_queue').insert({
+      recipient_email: 'customer@example.com',
+      email_type: 'quote_sent',
+      email_data: JSON.stringify({ quote_number: 'Q-2026-0001' }),
+      status: 'pending',
+      retry_count: 3,
+      error_message: "Email template 'quote_sent' not found",
+      created_at: new Date(),
+    }).returning('id');
+    const queueRowId = typeof queueRowIds[0] === 'object' ? queueRowIds[0].id : queueRowIds[0];
+
+    // Also seed an UNRELATED stuck row (different template, NOT one
+    // we're going to insert) to confirm the recovery is targeted —
+    // it must not blanket-reset every retry-exhausted row.
+    const unrelatedIds = await db('email_queue').insert({
+      recipient_email: 'someone@example.com',
+      email_type: 'some_other_template',
+      email_data: JSON.stringify({}),
+      status: 'pending',
+      retry_count: 3,
+      error_message: 'SMTP timeout',
+      created_at: new Date(),
+    }).returning('id');
+    const unrelatedId = typeof unrelatedIds[0] === 'object' ? unrelatedIds[0].id : unrelatedIds[0];
+
+    // The seeders use module-level caches (`_seeded = true`). When
+    // jest runs this test in isolation that cache starts fresh; in
+    // the full suite no other test currently calls these seeders, so
+    // the first call here also runs the real work. Reset the cache
+    // defensively in case a future test changes that.
+    jest.resetModules();
+    const { seedEmailTemplatesAndRecoverQueue } = require('../../src/services/_emailTemplateBoot');
+
+    const result = await seedEmailTemplatesAndRecoverQueue(db, null);
+
+    // Templates landed.
+    expect(result.seeded).toEqual(expect.arrayContaining([
+      'quote_sent', 'invoice_sent', 'storno_issued',
+    ]));
+    const after = await db('email_templates')
+      .whereIn('template_key', ['quote_sent', 'invoice_sent', 'storno_issued'])
+      .pluck('template_key');
+    expect(after.sort()).toEqual(['invoice_sent', 'quote_sent', 'storno_issued']);
+
+    // Stuck quote_sent row was recovered.
+    expect(result.recovered).toBeGreaterThanOrEqual(1);
+    const recoveredRow = await db('email_queue').where({ id: queueRowId }).first();
+    expect(recoveredRow.retry_count).toBe(0);
+    expect(recoveredRow.error_message).toBeNull();
+    expect(recoveredRow.status).toBe('pending'); // ready for the next tick
+
+    // Unrelated stuck row was NOT touched.
+    const unrelatedRow = await db('email_queue').where({ id: unrelatedId }).first();
+    expect(unrelatedRow.retry_count).toBe(3);
+    expect(unrelatedRow.error_message).toBe('SMTP timeout');
+  });
+});

backend/__tests__/integration/eventTypeRename.test.js

@@ -0,0 +1,64 @@
+/**
+ * Renaming an event type's slug_prefix must CASCADE to everything keyed on the
+ * old slug, so a rename behaves like a rename rather than silently detaching
+ * existing events/quotes and orphaning the per-type pre-event reminder template.
+ */
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+// bootCrmDb runs the full core-migration set in beforeAll.
+jest.setTimeout(120000);
+
+describe('event type slug rename cascade', () => {
+  let db;
+  let cleanup;
+  let customerId;
+  let eventTypeService;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    ({ customerId } = await seedMinimal(db));
+    eventTypeService = require('../../src/services/eventTypeService');
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  it('re-points events + quotes + the reminder template from old slug to new', async () => {
+    // A non-system event type with slug 'party'.
+    const [typeId] = await db('event_types').insert({ name: 'Party', slug_prefix: 'party', is_active: true });
+
+    // An authored per-type reminder template + an event + a quote, all on 'party'.
+    await db('email_templates').insert({ template_key: 'event_reminder_party', subject_en: 'Party reminder' });
+    await db('events').insert({
+      event_type: 'party', password_hash: 'x', expires_at: new Date(Date.now() + 9e9).toISOString(),
+      is_active: true, is_archived: false, slug: 'party-ev', share_link: 'party-ev',
+      event_name: 'A party', event_date: '2026-09-01',
+    });
+    await db('quotes').insert({
+      quote_number: 'Q-PARTY-1', customer_account_id: customerId, issue_date: '2026-01-01', event_type: 'party',
+    });
+
+    // Rename the slug.
+    await eventTypeService.updateEventType(typeId, { slug_prefix: 'concert' });
+
+    // Event + quote follow the rename.
+    expect((await db('events').where({ slug: 'party-ev' }).first()).event_type).toBe('concert');
+    expect((await db('quotes').where({ quote_number: 'Q-PARTY-1' }).first()).event_type).toBe('concert');
+    // The authored reminder template moved (subject/body preserved), old key gone.
+    expect(await db('email_templates').where({ template_key: 'event_reminder_party' }).first()).toBeUndefined();
+    const moved = await db('email_templates').where({ template_key: 'event_reminder_concert' }).first();
+    expect(moved).toBeTruthy();
+    expect(moved.subject_en).toBe('Party reminder');
+  });
+
+  it('does not clobber an existing template for the new slug', async () => {
+    const [typeId] = await db('event_types').insert({ name: 'Gala', slug_prefix: 'gala', is_active: true });
+    await db('email_templates').insert({ template_key: 'event_reminder_gala', subject_en: 'old gala' });
+    await db('email_templates').insert({ template_key: 'event_reminder_soiree', subject_en: 'existing soiree' });
+
+    await eventTypeService.updateEventType(typeId, { slug_prefix: 'soiree' });
+
+    // Target already existed → left intact; source not force-merged over it.
+    expect((await db('email_templates').where({ template_key: 'event_reminder_soiree' }).first()).subject_en)
+      .toBe('existing soiree');
+  });
+});

backend/__tests__/integration/externalImportCaptureDate.test.js

@@ -0,0 +1,161 @@
+/**
+ * External imports must record captured_at (#1172).
+ *
+ * Managed uploads get it from photoProcessor, which external media never goes
+ * through — so every externally imported photo carried captured_at NULL, and
+ * the gallery's "Date Taken" sort fell back to uploaded_at through its
+ * COALESCE. On a library imported in two batches that ordered a 12-day trip by
+ * which folder was imported first: the reporter's first two days landed at
+ * positions 4204-5296 of 5555.
+ *
+ * Driven through the real route against real files carrying real EXIF, because
+ * the whole question is whether the import reads the file it already has open.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const express = require('express');
+const request = require('supertest');
+const sharp = require('sharp');
+
+describe('external import capture dates (#1172)', () => {
+  let tmpDir; let db; let app; let mediaRoot;
+
+  /**
+   * A real JPEG carrying DateTimeOriginal.
+   *
+   * IFD2, not IFD0 — DateTimeOriginal lives in the Exif IFD, and exifr does not
+   * see it anywhere else (IFD0 takes plain DateTime, which surfaces as
+   * ModifyDate instead).
+   */
+  const writeJpegWithExif = async (rel, iso) => {
+    const full = path.join(mediaRoot, rel);
+    await fs.promises.mkdir(path.dirname(full), { recursive: true });
+    const d = new Date(iso);
+    const pad = (n) => String(n).padStart(2, '0');
+    const exifDate = `${d.getUTCFullYear()}:${pad(d.getUTCMonth() + 1)}:${pad(d.getUTCDate())} `
+      + `${pad(d.getUTCHours())}:${pad(d.getUTCMinutes())}:${pad(d.getUTCSeconds())}`;
+    await sharp({ create: { width: 60, height: 40, channels: 3, background: { r: 10, g: 20, b: 30 } } })
+      .withExif({ IFD2: { DateTimeOriginal: exifDate } })
+      .jpeg()
+      .toFile(full);
+    return full;
+  };
+
+  const writeJpegNoExif = async (rel) => {
+    const full = path.join(mediaRoot, rel);
+    await fs.promises.mkdir(path.dirname(full), { recursive: true });
+    await sharp({ create: { width: 60, height: 40, channels: 3, background: { r: 200, g: 10, b: 10 } } })
+      .jpeg().toFile(full);
+  };
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-capdate-'));
+    mediaRoot = path.join(tmpDir, 'media');
+    await fs.promises.mkdir(mediaRoot, { recursive: true });
+
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'db.sqlite');
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+    process.env.EXTERNAL_MEDIA_ROOT = mediaRoot;
+    process.env.JWT_SECRET = process.env.JWT_SECRET || 'capdate-secret';
+
+    jest.resetModules();
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => { req.admin = { id: 1, username: 'tester', roleName: 'admin' }; next(); },
+    }));
+    jest.doMock('../../src/middleware/permissions', () => ({
+      requirePermission: () => (_req, _res, next) => next(),
+    }));
+    jest.doMock('../../src/middleware/ownership', () => ({
+      requireEventOwnership: (_req, _res, next) => next(),
+    }));
+    jest.doMock('../../src/services/imageProcessor', () => {
+      const actual = jest.requireActual('../../src/services/imageProcessor');
+      return { ...actual, generateThumbnail: jest.fn(async () => 'thumbnails/mock.jpg'), ensureThumbnail: jest.fn() };
+    });
+    jest.doMock('../../src/utils/logger', () => ({
+      debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(),
+    }));
+
+    ({ db } = await require('./helpers/crmDb').bootCrmDb());
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/external-media', require('../../src/routes/adminExternalMedia'));
+  }, 180000);
+
+  afterAll(async () => {
+    if (db) await db.destroy?.();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  async function seedEvent() {
+    await db('photos').del();
+    await db('events').del();
+    await fs.promises.rm(mediaRoot, { recursive: true, force: true });
+    await fs.promises.mkdir(mediaRoot, { recursive: true });
+    const [e] = await db('events').insert({
+      slug: `capdate-${Math.random().toString(36).slice(2, 8)}`,
+      event_type: 'wedding', event_name: 'capdate', event_date: '2026-01-01',
+      host_email: 'h@example.com', admin_email: 'a@example.com', password_hash: 'x',
+      share_link: `capdate-${Math.random()}`, expires_at: new Date().toISOString(),
+      source_mode: 'reference',
+    }).returning('id');
+    return typeof e === 'object' ? e.id : e;
+  }
+
+  const runImport = (eventId, external_path) => request(app)
+    .post(`/api/admin/external-media/events/${eventId}/import-external`)
+    .send({ external_path, recursive: true });
+
+  it('records the EXIF capture date on import', async () => {
+    const eventId = await seedEvent();
+    await writeJpegWithExif('trip/a.jpg', '2026-06-01T09:45:03Z');
+
+    await runImport(eventId, 'trip');
+
+    const photo = await db('photos').where({ event_id: eventId }).first();
+    expect(photo.captured_at).toBeTruthy();
+    // NOT asserted as an absolute instant. EXIF carries a naive wall-clock
+    // time and exifr resolves it against the HOST timezone, so the stored UTC
+    // value differs between a CEST developer machine and a UTC runner. What
+    // this fix is about is that the field is populated and orders correctly;
+    // that captured_at is not a true instant is a separate, pre-existing
+    // problem shared with managed uploads (#1172's own footnote).
+    expect(new Date(photo.captured_at).getUTCFullYear()).toBe(2026);
+    expect(new Date(photo.captured_at).getUTCMonth()).toBe(5); // June
+  });
+
+  it('imports a photo with no EXIF date rather than failing it', async () => {
+    // Plenty of sources carry none; that must stay an import, not an error.
+    const eventId = await seedEvent();
+    await writeJpegNoExif('trip/plain.jpg');
+
+    const res = await runImport(eventId, 'trip');
+
+    expect(res.body.imported).toBe(1);
+    const photo = await db('photos').where({ event_id: eventId }).first();
+    expect(photo.captured_at).toBeNull();
+  });
+
+  it('orders a two-batch import by capture time, not by batch', async () => {
+    // The reported shape: the FIRST days of the trip imported second. Sorting
+    // on COALESCE(captured_at, uploaded_at) put them after the last days,
+    // because uploaded_at is the import timestamp.
+    const eventId = await seedEvent();
+    await writeJpegWithExif('late/day12.jpg', '2026-06-12T10:00:00Z');
+    await runImport(eventId, 'late');
+    await writeJpegWithExif('early/day01.jpg', '2026-06-01T10:00:00Z');
+    await runImport(eventId, 'early');
+
+    const rows = await db('photos')
+      .where({ event_id: eventId })
+      .orderByRaw('COALESCE(captured_at, uploaded_at) asc')
+      .select('filename');
+
+    expect(rows.map((r) => r.filename)).toEqual(['day01.jpg', 'day12.jpg']);
+  });
+});

backend/__tests__/integration/externalImportConcurrency.test.js

@@ -0,0 +1,205 @@
+/**
+ * Two overlapping external imports insert every file twice (#1162).
+ *
+ * The route checked for an existing external_relpath and then inserted, with
+ * an fs.stat and a `sharp().metadata()` read sitting in between. A reporter
+ * double-clicked a slow import of a 6012-file tree and got 8004 rows.
+ *
+ * Both halves of the fix are driven here through the real route:
+ *
+ *   - the in-flight guard, which turns the second click into a 409 instead of
+ *     a second full walk of the tree;
+ *   - convergence when the guard cannot help (another replica, another
+ *     process), which is the unique index from migration 186 firing and the
+ *     loop counting a skip rather than dying or duplicating.
+ *
+ * The second is exercised by inserting a competing row from inside the mocked
+ * `sharp().metadata()` call — literally inside the window the bug lived in.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const express = require('express');
+const request = require('supertest');
+
+describe('concurrent external imports (#1162)', () => {
+  let tmpDir; let db; let app; let mediaRoot;
+  // When set, the mocked sharp metadata read inserts this row first — the
+  // other run winning the race between our SELECT and our INSERT.
+  let stealDuringMetadata = null;
+  let thumbnailDelayMs = 0;
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-extdup-'));
+    mediaRoot = path.join(tmpDir, 'media');
+    await fs.promises.mkdir(path.join(mediaRoot, 'nas', 'individual'), { recursive: true });
+    for (const name of ['a.jpg', 'b.jpg', 'c.jpg']) {
+      await fs.promises.writeFile(path.join(mediaRoot, 'nas', 'individual', name), 'not-a-real-jpeg');
+    }
+
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'db.sqlite');
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+    process.env.EXTERNAL_MEDIA_ROOT = mediaRoot;
+    process.env.JWT_SECRET = process.env.JWT_SECRET || 'extdup-secret';
+
+    jest.resetModules();
+
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => { req.admin = { id: 1, username: 'tester', roleName: 'admin' }; next(); },
+    }));
+    jest.doMock('../../src/middleware/permissions', () => ({
+      requirePermission: () => (_req, _res, next) => next(),
+    }));
+    jest.doMock('../../src/middleware/ownership', () => ({
+      requireEventOwnership: (_req, _res, next) => next(),
+    }));
+
+    // The window. In production this is a real decode of a NAS-hosted file —
+    // hundreds of milliseconds during which the row we just proved absent can
+    // appear. Standing in for the other run here makes that deterministic.
+    jest.doMock('sharp', () => () => ({
+      metadata: async () => {
+        if (stealDuringMetadata) {
+          const { db: liveDb } = require('../../src/database/db');
+          await liveDb('photos').insert(stealDuringMetadata);
+          stealDuringMetadata = null;
+        }
+        return { width: 100, height: 200 };
+      },
+    }));
+
+    jest.doMock('../../src/services/imageProcessor', () => ({
+      generateThumbnail: jest.fn(async () => {
+        if (thumbnailDelayMs) await new Promise((r) => setTimeout(r, thumbnailDelayMs));
+        return 'thumbnails/mock.jpg';
+      }),
+      ensureThumbnail: jest.fn(),
+    }));
+
+    jest.doMock('../../src/utils/logger', () => ({
+      debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(),
+    }));
+
+    ({ db } = await require('./helpers/crmDb').bootCrmDb());
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/external-media', require('../../src/routes/adminExternalMedia'));
+  }, 180000);
+
+  afterAll(async () => {
+    if (db) await db.destroy?.();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  async function seedEvent() {
+    await db('photos').del();
+    await db('events').del();
+    stealDuringMetadata = null;
+    thumbnailDelayMs = 0;
+    const [e] = await db('events').insert({
+      slug: `extdup-${Math.random().toString(36).slice(2, 8)}`,
+      event_type: 'wedding',
+      event_name: 'extdup',
+      event_date: '2026-01-01',
+      host_email: 'h@example.com',
+      admin_email: 'a@example.com',
+      password_hash: 'x',
+      share_link: `extdup-${Math.random()}`,
+      expires_at: new Date().toISOString(),
+      source_mode: 'reference',
+    }).returning('id');
+    return typeof e === 'object' ? e.id : e;
+  }
+
+  const runImport = (eventId) => request(app)
+    .post(`/api/admin/external-media/events/${eventId}/import-external`)
+    .send({ external_path: 'nas', recursive: true });
+
+  async function relpathCounts(eventId) {
+    const rows = await db('photos').where({ event_id: eventId }).select('external_relpath');
+    const counts = new Map();
+    for (const r of rows) counts.set(r.external_relpath, (counts.get(r.external_relpath) || 0) + 1);
+    return counts;
+  }
+
+  it('rejects a second import while the first is still running', async () => {
+    const eventId = await seedEvent();
+    // Enough to keep the first request inside its loop while the second
+    // arrives — the "slow import looks hung, so I clicked again" case.
+    thumbnailDelayMs = 20;
+
+    const [first, second] = await Promise.all([runImport(eventId), runImport(eventId)]);
+
+    const statuses = [first.status, second.status].sort();
+    expect(statuses).toEqual([200, 409]);
+    const rejected = first.status === 409 ? first : second;
+    expect(rejected.body.error).toMatch(/already running/i);
+  });
+
+  it('leaves exactly one row per file after both runs', async () => {
+    const eventId = await seedEvent();
+    thumbnailDelayMs = 20;
+
+    await Promise.all([runImport(eventId), runImport(eventId)]);
+
+    const counts = await relpathCounts(eventId);
+    expect(counts.size).toBe(3);
+    expect([...counts.values()]).toEqual([1, 1, 1]);
+  });
+
+  it('releases the event once the import finishes, so a re-import still works', async () => {
+    const eventId = await seedEvent();
+
+    expect((await runImport(eventId)).status).toBe(200);
+    // Not 409 — the guard is per run, not a permanent lock on the event.
+    const second = await runImport(eventId);
+    expect(second.status).toBe(200);
+    expect(second.body.imported).toBe(0);
+    expect(second.body.skipped).toBe(3);
+  });
+
+  it('converges when another writer wins the race mid-file', async () => {
+    // The guard is in-process, so it cannot see a second replica. This is what
+    // the unique index is for: the insert bounces, and the file is counted as
+    // skipped rather than duplicated or lost to a 500.
+    const eventId = await seedEvent();
+    stealDuringMetadata = {
+      event_id: eventId,
+      filename: 'a.jpg',
+      path: 'x/a.jpg',
+      type: 'individual',
+      source_origin: 'external',
+      external_relpath: path.join('nas', 'individual', 'a.jpg'),
+    };
+
+    const res = await runImport(eventId);
+
+    expect(res.status).toBe(200);
+    const counts = await relpathCounts(eventId);
+    expect(counts.get(path.join('nas', 'individual', 'a.jpg'))).toBe(1);
+    // Two imported by us, one lost to the other writer and reported honestly.
+    expect(res.body.imported).toBe(2);
+    expect(res.body.skipped).toBe(1);
+  });
+
+  it('does not let one contended file abort the rest of the import', async () => {
+    const eventId = await seedEvent();
+    stealDuringMetadata = {
+      event_id: eventId,
+      filename: 'a.jpg',
+      path: 'x/a.jpg',
+      type: 'individual',
+      source_origin: 'external',
+      external_relpath: path.join('nas', 'individual', 'a.jpg'),
+    };
+
+    await runImport(eventId);
+
+    // All three files present — the contended one via the other writer's row.
+    expect((await relpathCounts(eventId)).size).toBe(3);
+  });
+});

backend/__tests__/integration/externalImportSecondFolder.test.js

@@ -0,0 +1,175 @@
+/**
+ * Importing a second folder must not move the photos already in the event (#1163).
+ *
+ * events.external_path is overwritten by every import, and external_relpath
+ * used to be stored relative to it — so a second import silently rebased every
+ * existing row onto the new folder. The reporter had 7547 of 8004 originals
+ * pointing at files that do not exist, and nothing said so: thumbnails are
+ * written to local storage during the import while the base path is still
+ * correct, so the grid carries on rendering.
+ *
+ * Driven through the real route and the real resolver, against a real
+ * directory tree — the failure is entirely about whether a file is where the
+ * app looks for it.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const express = require('express');
+const request = require('supertest');
+
+describe('a second external import (#1163)', () => {
+  let tmpDir; let db; let app; let mediaRoot; let resolvePhotoFilePath;
+
+  const touch = async (rel) => {
+    const full = path.join(mediaRoot, rel);
+    await fs.promises.mkdir(path.dirname(full), { recursive: true });
+    await fs.promises.writeFile(full, 'not-a-real-jpeg');
+  };
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-ext2nd-'));
+    mediaRoot = path.join(tmpDir, 'media');
+    await fs.promises.mkdir(mediaRoot, { recursive: true });
+
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'db.sqlite');
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+    process.env.EXTERNAL_MEDIA_ROOT = mediaRoot;
+    process.env.JWT_SECRET = process.env.JWT_SECRET || 'ext2nd-secret';
+
+    jest.resetModules();
+
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => { req.admin = { id: 1, username: 'tester', roleName: 'admin' }; next(); },
+    }));
+    jest.doMock('../../src/middleware/permissions', () => ({
+      requirePermission: () => (_req, _res, next) => next(),
+    }));
+    jest.doMock('../../src/middleware/ownership', () => ({
+      requireEventOwnership: (_req, _res, next) => next(),
+    }));
+    jest.doMock('sharp', () => () => ({ metadata: async () => ({ width: 100, height: 200 }) }));
+    jest.doMock('../../src/services/imageProcessor', () => ({
+      generateThumbnail: jest.fn(async () => 'thumbnails/mock.jpg'),
+      ensureThumbnail: jest.fn(),
+    }));
+    jest.doMock('../../src/utils/logger', () => ({
+      debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(),
+    }));
+
+    ({ db } = await require('./helpers/crmDb').bootCrmDb());
+    ({ resolvePhotoFilePath } = require('../../src/services/photoResolver'));
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/external-media', require('../../src/routes/adminExternalMedia'));
+  }, 180000);
+
+  afterAll(async () => {
+    if (db) await db.destroy?.();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  async function seedEvent() {
+    await db('photos').del();
+    await db('events').del();
+    await fs.promises.rm(mediaRoot, { recursive: true, force: true });
+    await fs.promises.mkdir(mediaRoot, { recursive: true });
+    const [e] = await db('events').insert({
+      slug: `ext2nd-${Math.random().toString(36).slice(2, 8)}`,
+      event_type: 'wedding',
+      event_name: 'ext2nd',
+      event_date: '2026-01-01',
+      host_email: 'h@example.com',
+      admin_email: 'a@example.com',
+      password_hash: 'x',
+      share_link: `ext2nd-${Math.random()}`,
+      expires_at: new Date().toISOString(),
+      source_mode: 'reference',
+    }).returning('id');
+    return typeof e === 'object' ? e.id : e;
+  }
+
+  const runImport = (eventId, external_path) => request(app)
+    .post(`/api/admin/external-media/events/${eventId}/import-external`)
+    .send({ external_path, recursive: true });
+
+  /** Where the app would go looking for this photo's original, right now. */
+  async function resolved(eventId, filename) {
+    const event = await db('events').where({ id: eventId }).first();
+    const photo = await db('photos').where({ event_id: eventId, filename }).first();
+    return resolvePhotoFilePath(event, photo);
+  }
+
+  it('stores paths relative to the media root, not to the imported folder', async () => {
+    const eventId = await seedEvent();
+    await touch('Trip/Leknes/old.jpg');
+
+    await runImport(eventId, 'Trip');
+
+    const photo = await db('photos').where({ event_id: eventId }).first();
+    expect(photo.external_relpath).toBe(path.join('Trip', 'Leknes', 'old.jpg'));
+  });
+
+  it('leaves the first folder’s originals reachable after a second import', async () => {
+    const eventId = await seedEvent();
+    await touch('Trip/Leknes/old.jpg');
+    await touch('Trip/Sub/new.jpg');
+
+    await runImport(eventId, 'Trip');
+    const before = await resolved(eventId, 'old.jpg');
+    await runImport(eventId, 'Trip/Sub');
+    const after = await resolved(eventId, 'old.jpg');
+
+    // The regression: `after` used to be <root>/Trip/Sub/Leknes/old.jpg.
+    expect(after).toBe(before);
+    expect(fs.existsSync(after)).toBe(true);
+  });
+
+  it('every original in the event is still on disk afterwards', async () => {
+    const eventId = await seedEvent();
+    await touch('Trip/Leknes/a.jpg');
+    await touch('Trip/Leknes/b.jpg');
+    await touch('Trip/Sub/c.jpg');
+
+    await runImport(eventId, 'Trip');
+    await runImport(eventId, 'Trip/Sub');
+
+    const event = await db('events').where({ id: eventId }).first();
+    const photos = await db('photos').where({ event_id: eventId });
+    expect(photos).toHaveLength(3);
+    for (const photo of photos) {
+      expect(fs.existsSync(resolvePhotoFilePath(event, photo))).toBe(true);
+    }
+  });
+
+  it('does not re-insert a file the first import already took', async () => {
+    // The dedupe check compares stored paths, so it has to be comparing the
+    // same shape the insert writes.
+    const eventId = await seedEvent();
+    await touch('Trip/Sub/c.jpg');
+
+    await runImport(eventId, 'Trip');
+    const second = await runImport(eventId, 'Trip/Sub');
+
+    expect(second.body.imported).toBe(0);
+    expect(second.body.skipped).toBe(1);
+    expect(await db('photos').where({ event_id: eventId }).count('* as c').first()).toEqual({ c: 1 });
+  });
+
+  it('resolves a subfolder that repeats its parent’s name', async () => {
+    // The old resolver stripped the relpath's first segment when it matched the
+    // base path's last one, which broke exactly this layout.
+    const eventId = await seedEvent();
+    await touch('Trip/Trip/x.jpg');
+
+    await runImport(eventId, 'Trip');
+
+    const event = await db('events').where({ id: eventId }).first();
+    const photo = await db('photos').where({ event_id: eventId }).first();
+    expect(resolvePhotoFilePath(event, photo)).toBe(path.join(mediaRoot, 'Trip', 'Trip', 'x.jpg'));
+  });
+});

backend/__tests__/integration/externalRelpathFoldPg.test.js

@@ -0,0 +1,121 @@
+/**
+ * PostgreSQL integration test for the external-path fold (#1163).
+ *
+ * Gated the same way as picpeakRestorePg: runs only when PICPEAK_PG_TEST_URL
+ * points at a throwaway Postgres DB, e.g.
+ *   PICPEAK_PG_TEST_URL="postgres://picpeak:picpeak_secure_pass_2024@127.0.0.1:7102/picpeak_fold_test" \
+ *     npx jest __tests__/integration/externalRelpathFoldPg.test.js
+ *
+ * This exists because of a defect SQLite could not have caught. The two-pass
+ * rewrite parks each row on a temporary value, and that value was first written
+ * with a leading NUL. SQLite stores NUL in TEXT without complaint; Postgres
+ * rejects it outright ("invalid byte sequence for encoding UTF8"), so migration
+ * 187 would have rolled back on exactly the installs needing the repair — and
+ * only on the engine most of them run.
+ *
+ * The staging value is therefore an engine-level contract, not an
+ * implementation detail, and it is pinned here on the engine that constrains it.
+ */
+
+const knex = require('knex');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const PG_URL = process.env.PICPEAK_PG_TEST_URL;
+const maybe = PG_URL ? describe : describe.skip;
+
+maybe('external relpath fold on Postgres', () => {
+  let pgDb; let mediaRoot; let fold;
+
+  const touch = async (rel, bytes) => {
+    const full = path.join(mediaRoot, rel);
+    await fs.promises.mkdir(path.dirname(full), { recursive: true });
+    await fs.promises.writeFile(full, Buffer.alloc(bytes));
+    return bytes;
+  };
+
+  beforeAll(async () => {
+    mediaRoot = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-foldpg-'));
+    process.env.EXTERNAL_MEDIA_ROOT = mediaRoot;
+    jest.resetModules();
+    ({ foldExternalRelpaths: fold } = require('../../src/services/externalRelpathFold'));
+
+    pgDb = knex({ client: 'pg', connection: PG_URL });
+  }, 60000);
+
+  afterAll(async () => {
+    if (pgDb) await pgDb.destroy();
+    await fs.promises.rm(mediaRoot, { recursive: true, force: true }).catch(() => {});
+    delete process.env.EXTERNAL_MEDIA_ROOT;
+  });
+
+  beforeEach(async () => {
+    await pgDb.raw('DROP TABLE IF EXISTS photos, events, app_settings CASCADE');
+    await pgDb.schema.createTable('events', (t) => {
+      t.increments('id');
+      t.text('external_path');
+    });
+    await pgDb.schema.createTable('photos', (t) => {
+      t.increments('id');
+      t.integer('event_id');
+      t.text('external_relpath');
+      t.bigInteger('size_bytes');
+      t.string('source_origin').defaultTo('managed');
+    });
+    await pgDb.schema.createTable('app_settings', (t) => {
+      t.increments('id');
+      t.string('setting_key');
+      t.text('setting_value');
+      t.string('setting_type');
+      t.string('updated_at');
+    });
+    await fs.promises.rm(mediaRoot, { recursive: true, force: true });
+    await fs.promises.mkdir(mediaRoot, { recursive: true });
+  });
+
+  const relpaths = async () =>
+    (await pgDb('photos').orderBy('id').select('external_relpath')).map((r) => r.external_relpath);
+
+  it('completes the two-pass repair that a NUL staging value would abort', async () => {
+    // The exact shape that forces staging: `photo.jpg` repairs up to
+    // `Trip/photo.jpg`, while the row already holding `Trip/photo.jpg` folds
+    // deeper. Every final value is distinct, but a final value equals another
+    // row's current one, so the rewrite has to park first.
+    const a = await touch('Trip/photo.jpg', 11);
+    const b = await touch('Trip/Sub/Trip/photo.jpg', 22);
+    await pgDb('events').insert({ id: 1, external_path: 'Trip/Sub' });
+    await pgDb('photos').insert([
+      { event_id: 1, external_relpath: 'photo.jpg', size_bytes: a, source_origin: 'external' },
+      { event_id: 1, external_relpath: 'Trip/photo.jpg', size_bytes: b, source_origin: 'external' },
+    ]);
+
+    await fold(pgDb);
+
+    expect(await relpaths()).toEqual(['Trip/photo.jpg', 'Trip/Sub/Trip/photo.jpg']);
+  });
+
+  it('leaves no staging value behind', async () => {
+    await touch('Trip/a.jpg', 8);
+    await pgDb('events').insert({ id: 1, external_path: 'Trip' });
+    await pgDb('photos').insert({ event_id: 1, external_relpath: 'a.jpg', size_bytes: 8, source_origin: 'external' });
+
+    await fold(pgDb);
+
+    const rows = await relpaths();
+    expect(rows).toEqual(['Trip/a.jpg']);
+    expect(rows.some((r) => r.includes('staging'))).toBe(false);
+  });
+
+  it('folds and marks in one transaction', async () => {
+    await touch('Trip/a.jpg', 8);
+    await pgDb('events').insert({ id: 1, external_path: 'Trip' });
+    await pgDb('photos').insert({ event_id: 1, external_relpath: 'a.jpg', size_bytes: 8, source_origin: 'external' });
+
+    await fold(pgDb);
+    // Second run is a no-op: the marker committed with the rewrites.
+    await fold(pgDb);
+
+    expect(await relpaths()).toEqual(['Trip/a.jpg']);
+  });
+});

backend/__tests__/integration/galleryFilterFeedbackVisibility.test.js

@@ -0,0 +1,216 @@
+/**
+ * Guest filters must respect show_feedback_to_guests (#1044 follow-up).
+ *
+ * Every filter token on /photos is an OR of two halves: what THIS viewer
+ * marked, and what ANYONE marked. The response fields built from the second
+ * half — like_count, comment_count — are all gated on
+ * show_feedback_to_guests. The FILTER was not.
+ *
+ * So with the setting off, the numbers were hidden but `?filter=liked` still
+ * returned exactly the photos other people had liked: the same information as
+ * a set instead of a count, one token at a time. These tests pin the gate on
+ * every token, and pin that the viewer's own half is never gated — filtering
+ * by what you yourself marked is yours to do regardless.
+ */
+
+const request = require('supertest');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'filter-visibility-secret';
+
+const SLUG = 'filter-visibility-event';
+const ME = 'guest-me-identifier';
+const SOMEONE_ELSE = 'guest-other-identifier';
+
+describe('guest filters and show_feedback_to_guests (#1044)', () => {
+  let db;
+  let cleanup;
+  let app;
+  let eventId;
+  let mine;
+  let theirs;
+  let myGuestRowId;
+
+  const galleryToken = () => jwt.sign(
+    { eventId, eventSlug: SLUG, type: 'gallery' },
+    process.env.JWT_SECRET,
+    { expiresIn: '1h', issuer: 'picpeak-auth' }
+  );
+
+  const setVisibility = (visible) => db('event_feedback_settings')
+    .where({ event_id: eventId })
+    .update({ show_feedback_to_guests: visible });
+
+  // A real verified guest, which is how the viewer's own feedback is actually
+  // identified — NOT the `guest_id` query parameter the frontend invents.
+  const guestToken = () => jwt.sign(
+    { type: 'guest', guestId: myGuestRowId, eventId },
+    process.env.JWT_SECRET,
+    { expiresIn: '1h', issuer: 'picpeak-auth' }
+  );
+
+  const filter = async (token, { as = 'me', claimGuestId } = {}) => {
+    const req = request(app)
+      .get(`/api/gallery/${SLUG}/photos`)
+      .query({ filter: token, ...(claimGuestId ? { guest_id: claimGuestId } : {}) })
+      .set('Authorization', `Bearer ${galleryToken()}`);
+    if (as === 'me') req.set('x-guest-token', guestToken());
+    const res = await req;
+    expect(res.status).toBe(200);
+    const photos = Array.isArray(res.body) ? res.body : res.body.photos;
+    return (photos || []).map((p) => p.id).sort((a, b) => a - b);
+  };
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+
+    const inserted = await db('events').insert({
+      slug: SLUG,
+      event_type: 'wedding',
+      event_name: 'Filter Visibility',
+      event_date: '2026-08-01',
+      host_email: 'host@example.com',
+      admin_email: 'admin@example.com',
+      password_hash: 'x',
+      share_link: `/gallery/${SLUG}/share`,
+      share_token: 'filter-visibility-share',
+      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+      is_active: 1,
+      is_archived: 0,
+      is_draft: 0,
+      created_at: new Date().toISOString(),
+    }).returning('id');
+    eventId = inserted[0]?.id ?? inserted[0];
+
+    const addPhoto = async (name) => {
+      const p = await db('photos').insert({
+        event_id: eventId,
+        filename: name,
+        path: `events/filter/${name}`,
+        type: 'individual',
+        uploaded_at: new Date().toISOString(),
+      }).returning('id');
+      return p[0]?.id ?? p[0];
+    };
+    mine = await addPhoto('mine.jpg');
+    theirs = await addPhoto('theirs.jpg');
+
+    await db('event_feedback_settings').insert({
+      event_id: eventId,
+      feedback_enabled: true,
+      allow_likes: true,
+      allow_comments: true,
+      allow_ratings: true,
+      allow_favorites: true,
+      moderate_comments: false,
+      show_feedback_to_guests: true,
+    });
+
+    const guestRow = await db('gallery_guests').insert({
+      event_id: eventId,
+      name: 'Me',
+      identifier: ME,
+      created_at: new Date().toISOString(),
+      last_seen_at: new Date().toISOString(),
+      is_deleted: false,
+    }).returning('id');
+    myGuestRowId = guestRow[0]?.id ?? guestRow[0];
+
+    const feedback = (photoId, who, type, extra = {}) => db('photo_feedback').insert({
+      photo_id: photoId,
+      event_id: eventId,
+      guest_identifier: who,
+      // Submission links to the per-person guest row when one is present, and
+      // that is the column the viewer's own half resolves through.
+      guest_id: who === ME ? myGuestRowId : null,
+      feedback_type: type,
+      is_approved: true,
+      is_hidden: false,
+      created_at: new Date().toISOString(),
+      ...extra,
+    });
+
+    // Everything on `theirs` belongs to somebody else; `mine` is this viewer's.
+    await feedback(mine, ME, 'like');
+    await feedback(theirs, SOMEONE_ELSE, 'like');
+    await feedback(theirs, SOMEONE_ELSE, 'favorite');
+    await feedback(theirs, SOMEONE_ELSE, 'comment', { comment_text: 'lovely' });
+    await feedback(theirs, SOMEONE_ELSE, 'rating', { rating: 5 });
+
+    // The denormalized counters the aggregate half of the filter reads.
+    await db('photos').where('id', theirs).update({
+      like_count: 1, favorite_count: 1, comment_count: 1, average_rating: 5,
+    });
+    await db('photos').where('id', mine).update({ like_count: 1 });
+
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/gallery', require('../../src/routes/gallery'));
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  describe('with feedback visible to guests', () => {
+    beforeAll(() => setVisibility(true));
+
+    it('shows other people\'s marks through every token, as before', async () => {
+      expect(await filter('liked')).toEqual([mine, theirs].sort((a, b) => a - b));
+      expect(await filter('favorited')).toEqual([theirs]);
+      expect(await filter('rated')).toEqual([theirs]);
+      expect(await filter('commented')).toEqual([theirs]);
+    });
+  });
+
+  describe('with feedback hidden from guests', () => {
+    beforeAll(() => setVisibility(false));
+
+    it('stops every token from selecting on other people\'s marks', async () => {
+      // `theirs` is the photo only other guests marked. It must not come back
+      // through any token — a filter that selects on hidden feedback reports
+      // that feedback just as surely as a count would.
+      expect(await filter('favorited')).toEqual([]);
+      expect(await filter('rated')).toEqual([]);
+      expect(await filter('commented')).toEqual([]);
+    });
+
+    it('still filters by what the viewer marked themselves', async () => {
+      // The viewer's own half is never gated: this is their own action, and
+      // hiding it would break "show me the ones I liked" for no privacy gain.
+      expect(await filter('liked')).toEqual([mine]);
+    });
+
+    it('drops the viewer\'s own feedback once an admin hides it', async () => {
+      // Moderation has to reach the filter too. getPhotoFeedback excludes
+      // hidden rows for the guest's OWN feedback, so a photo matching here
+      // would come back with nothing visible on it to explain why.
+      await db('photo_feedback')
+        .where({ photo_id: mine, guest_id: myGuestRowId, feedback_type: 'like' })
+        .update({ is_hidden: true });
+
+      expect(await filter('liked')).toEqual([]);
+
+      await db('photo_feedback')
+        .where({ photo_id: mine, guest_id: myGuestRowId, feedback_type: 'like' })
+        .update({ is_hidden: false });
+      expect(await filter('liked')).toEqual([mine]);
+    });
+
+    it('ignores a guest_id supplied by the caller', async () => {
+      // The own-half is resolved from the request identity. If it honoured the
+      // query string instead, anyone holding another guest's identifier could
+      // read that guest's hidden memberships one token at a time — straight
+      // back through the gate this file exists to pin.
+      expect(await filter('favorited', { claimGuestId: SOMEONE_ELSE })).toEqual([]);
+      // And an anonymous caller claiming to be me gets nothing of mine.
+      expect(await filter('liked', { as: 'anon', claimGuestId: ME })).toEqual([]);
+    });
+  });
+});

backend/__tests__/integration/galleryShortUrlRoute.test.js

@@ -0,0 +1,231 @@
+/**
+ * HTTP-level tests for the `/s/:shortSlug` public resolver (#699).
+ *
+ * Verifies the contract the public route is expected to honour:
+ *   - Browser UA → 302 to target_path
+ *   - Social crawler UA → 200 with OG <meta>, canonical = /s/<slug>
+ *   - Soft-deleted slug → 410 Gone (intentional-delete signal)
+ *   - Unknown slug → 404 Not Found
+ *   - Hit count increments after successful resolutions (both shapes)
+ *
+ * Mirrors the production server.js wiring but doesn't load the whole
+ * server — the surrounding middleware (CORS, helmet, rate limiters)
+ * isn't part of this route's contract.
+ */
+const express = require('express');
+const request = require('supertest');
+
+const { bootCrmDb } = require('./helpers/crmDb');
+
+jest.setTimeout(120000);
+
+let db; let cleanup; let service; let app;
+
+beforeAll(async () => {
+  ({ db, cleanup } = await bootCrmDb());
+
+  // Persist a business_profile + business_name so buildOgMetadata's
+  // settings-based fields populate consistently.
+  const { upsertAppSetting } = require('../../src/utils/appSettings');
+  await upsertAppSetting('branding_company_name', JSON.stringify('Test Studio'), 'string');
+
+  service = require('../../src/services/galleryShortUrlService');
+  const {
+    isSocialCrawler, buildOgMetadata, renderOgHtml,
+  } = require('../../src/services/galleryOgService');
+
+  app = express();
+  app.get('/s/:shortSlug', async (req, res) => {
+    try {
+      const row = await service.findByShortSlug(req.params.shortSlug);
+      if (!row) return res.status(404).type('text/plain').send('Short URL not found');
+      if (row.deleted_at) return res.status(410).type('text/plain').send('Short URL has been removed');
+
+      if (isSocialCrawler(req.get('user-agent'))) {
+        const event = await db('events').where({ id: row.event_id }).first('slug');
+        if (event?.slug) {
+          const meta = await buildOgMetadata(event.slug, req.originalUrl);
+          const base = (process.env.FRONTEND_URL || 'http://localhost:3000').replace(/\/$/, '');
+          meta.url = `${base}/s/${row.short_slug}`;
+          res.set('Cache-Control', 'public, max-age=300');
+          res.set('Content-Type', 'text/html; charset=utf-8');
+          res.send(renderOgHtml(meta));
+          service.recordHit(row.id).catch(() => {});
+          return;
+        }
+        return res.status(410).type('text/plain').send('Short URL points at a deleted event');
+      }
+
+      service.recordHit(row.id).catch(() => {});
+      return res.redirect(302, row.target_path);
+    } catch (err) {
+      return res.status(500).type('text/plain').send(err.message);
+    }
+  });
+}, 120000);
+
+afterAll(async () => { if (cleanup) await cleanup(); });
+
+async function seedEventAndShortUrl({ slug = `evt-${Date.now()}`, shortSlug }) {
+  const farFuture = new Date(Date.now() + 365 * 86400000).toISOString();
+  const [eventId] = await db('events').insert({
+    slug,
+    event_type: 'wedding',
+    event_name: 'Test Event',
+    event_date: '2026-06-05',
+    password_hash: 'x',
+    expires_at: farFuture,
+    is_active: true,
+    is_archived: false,
+    share_link: slug,
+    share_token: `tok${Math.random().toString(36).slice(2, 12)}`,
+    welcome_message: null,
+  });
+  const row = await service.createShortUrl({
+    eventId, customSlug: shortSlug,
+  });
+  return { eventId, shortUrl: row };
+}
+
+// User-agent strings the production `isSocialCrawler` helper matches.
+// Snapshot known-true samples here so the test stays in sync if the
+// helper's allowlist evolves.
+const BOT_UA_WHATSAPP = 'WhatsApp/2.23.20.0';
+const BOT_UA_FACEBOOK = 'facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)';
+const BROWSER_UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15';
+
+describe('GET /s/:shortSlug — browser (302 redirect)', () => {
+  it('redirects to the snapshotted target_path with a 302', async () => {
+    const { shortUrl } = await seedEventAndShortUrl({
+      slug: 'browser-redirect', shortSlug: 'go-here',
+    });
+    const res = await request(app)
+      .get('/s/go-here')
+      .set('User-Agent', BROWSER_UA);
+    expect(res.status).toBe(302);
+    expect(res.headers.location).toBe(shortUrl.target_path);
+    expect(res.headers.location).toMatch(/^\/gallery\//);
+  });
+
+  it('increments hit_count on a browser hit (fire-and-forget — wait briefly)', async () => {
+    await seedEventAndShortUrl({
+      slug: 'hit-browser', shortSlug: 'hit-from-browser',
+    });
+    await request(app).get('/s/hit-from-browser').set('User-Agent', BROWSER_UA);
+    await new Promise((r) => setTimeout(r, 50));
+    const row = await service.findByShortSlug('hit-from-browser');
+    expect(row.hit_count).toBe(1);
+    expect(row.last_hit_at).toBeTruthy();
+  });
+});
+
+describe('GET /s/:shortSlug — social crawler (OG metadata)', () => {
+  it('returns 200 with OG HTML for WhatsApp UA', async () => {
+    await seedEventAndShortUrl({
+      slug: 'whatsapp-og', shortSlug: 'wa-preview',
+    });
+    const res = await request(app)
+      .get('/s/wa-preview')
+      .set('User-Agent', BOT_UA_WHATSAPP);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toMatch(/text\/html/);
+    expect(res.text).toContain('<meta');
+    expect(res.text).toMatch(/og:title/);
+    expect(res.text).toMatch(/og:url/);
+  });
+
+  it('og:url canonical points at /s/<slug>, not the underlying gallery URL', async () => {
+    await seedEventAndShortUrl({
+      slug: 'canonical-test', shortSlug: 'canonical-short',
+    });
+    const res = await request(app)
+      .get('/s/canonical-short')
+      .set('User-Agent', BOT_UA_FACEBOOK);
+    expect(res.status).toBe(200);
+    // The og:url meta tag must contain the short-URL path, not the
+    // /gallery/<slug> path — this is the cache-key invariant from #699.
+    expect(res.text).toMatch(/property="og:url"\s+content="[^"]*\/s\/canonical-short"/);
+    expect(res.text).not.toMatch(
+      /property="og:url"\s+content="[^"]*\/gallery\/canonical-test"/
+    );
+  });
+
+  it('sets a short cache header so scrapers can re-fetch when admin rotates the preview', async () => {
+    await seedEventAndShortUrl({
+      slug: 'cache-header', shortSlug: 'cache-test',
+    });
+    const res = await request(app)
+      .get('/s/cache-test')
+      .set('User-Agent', BOT_UA_WHATSAPP);
+    expect(res.headers['cache-control']).toMatch(/public/);
+    expect(res.headers['cache-control']).toMatch(/max-age=300/);
+  });
+
+  it('increments hit_count on a crawler hit as well', async () => {
+    await seedEventAndShortUrl({
+      slug: 'hit-bot', shortSlug: 'hit-from-bot',
+    });
+    await request(app).get('/s/hit-from-bot').set('User-Agent', BOT_UA_WHATSAPP);
+    await new Promise((r) => setTimeout(r, 50));
+    const row = await service.findByShortSlug('hit-from-bot');
+    expect(row.hit_count).toBe(1);
+  });
+});
+
+describe('GET /s/:shortSlug — error states', () => {
+  it('404 for an unknown slug', async () => {
+    const res = await request(app)
+      .get('/s/never-existed')
+      .set('User-Agent', BROWSER_UA);
+    expect(res.status).toBe(404);
+  });
+
+  it('410 for a soft-deleted slug (intentional-delete signal)', async () => {
+    const { shortUrl } = await seedEventAndShortUrl({
+      slug: 'gone-test', shortSlug: 'gone-slug',
+    });
+    await service.softDelete(shortUrl.id, null);
+    const res = await request(app)
+      .get('/s/gone-slug')
+      .set('User-Agent', BROWSER_UA);
+    expect(res.status).toBe(410);
+  });
+
+  it('410 if the event was hard-deleted but the short URL row somehow survives', async () => {
+    const { eventId } = await seedEventAndShortUrl({
+      slug: 'orphan-test', shortSlug: 'orphan-slug',
+    });
+    // Hard-delete the event row (FK CASCADE would normally clean up the
+    // short URL too — but if CASCADE didn't fire for whatever reason
+    // (e.g. SQLite foreign_keys pragma off in a particular runtime), the
+    // resolver should still degrade safely).
+    // SQLite's foreign_keys pragma is OFF by default; the migration
+    // doesn't toggle it, so this delete leaves the short URL row.
+    await db('events').where({ id: eventId }).delete();
+    const res = await request(app)
+      .get('/s/orphan-slug')
+      .set('User-Agent', BOT_UA_WHATSAPP);
+    expect(res.status).toBe(410);
+  });
+
+  it('404 for a malformed slug (rejected at validation, no DB hit)', async () => {
+    const res = await request(app)
+      .get('/s/UPPER_CASE')
+      .set('User-Agent', BROWSER_UA);
+    expect(res.status).toBe(404);
+  });
+});
+
+describe('Regression — existing URL paths must still respond the same', () => {
+  // The /s/* namespace is additive: it must NOT shadow /gallery/*
+  // or any of the OG routes. We don't load the whole app here, but we
+  // can at least pin that the route param doesn't accept slashes —
+  // i.e. /s/foo/bar must NOT be matched by our handler.
+  it('the /s/:shortSlug route does not match nested paths', async () => {
+    const res = await request(app)
+      .get('/s/foo/bar')
+      .set('User-Agent', BROWSER_UA);
+    // Express returns its default 404 when no route matches the path.
+    expect(res.status).toBe(404);
+  });
+});

backend/__tests__/integration/galleryShortUrls.test.js

@@ -0,0 +1,282 @@
+/**
+ * Integration tests for the branded short-URL service (#699).
+ *
+ * Exercises createShortUrl + findByShortSlug + listForEvent + softDelete
+ * + recordHit against a real SQLite DB, including the contracts that
+ * matter for production correctness:
+ *
+ *   - Custom slug + collision detection (409 with `suggested`)
+ *   - Auto-generated slug from event slug + year
+ *   - Soft-delete preserves the row (admin can audit)
+ *   - target_path snapshots at create time (toggling the global
+ *     "Use short gallery URLs" setting later doesn't change existing
+ *     short URLs — backward-compat invariant from #699)
+ *   - hit_count increments idempotently
+ *   - findByShortSlug returns soft-deleted rows (caller decides 410 vs 404)
+ *
+ * Boots one DB for the whole file (cheap on SQLite); each test seeds
+ * its own event row to keep scope clean.
+ */
+const { bootCrmDb } = require('./helpers/crmDb');
+
+jest.setTimeout(120000);
+
+let db; let cleanup; let service; let adminId;
+
+beforeAll(async () => {
+  ({ db, cleanup } = await bootCrmDb());
+
+  // Minimal admin for created_by audit.
+  const adminInsert = await db('admin_users').insert({
+    username: 'shorturl-test',
+    email: 'shorturl@example.com',
+    password_hash: 'x',
+    must_change_password: false,
+    created_at: new Date(),
+  }).returning('id');
+  adminId = adminInsert[0]?.id ?? adminInsert[0];
+
+  service = require('../../src/services/galleryShortUrlService');
+}, 120000);
+
+afterAll(async () => { if (cleanup) await cleanup(); });
+
+// Each test seeds a fresh event so collisions / counter state don't leak.
+async function seedEvent(overrides = {}) {
+  const slug = overrides.slug || `evt-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const farFuture = new Date(Date.now() + 365 * 86400000).toISOString();
+  const [id] = await db('events').insert({
+    slug,
+    event_type: 'wedding',
+    event_name: overrides.event_name || 'Test Wedding',
+    event_date: overrides.event_date || '2026-06-05',
+    password_hash: 'x',
+    expires_at: farFuture,
+    is_active: true,
+    is_archived: false,
+    share_link: slug,
+    share_token: overrides.share_token || `tok${Math.random().toString(36).slice(2, 12)}`,
+    welcome_message: null,
+  });
+  const event = await db('events').where({ id }).first();
+  return event;
+}
+
+describe('createShortUrl — custom slug', () => {
+  it('creates with a custom slug', async () => {
+    const event = await seedEvent({ slug: 'sofia-grad-1' });
+    const row = await service.createShortUrl({
+      eventId: event.id,
+      customSlug: 'sofia-graduation-1',
+      createdBy: adminId,
+    });
+    expect(row.short_slug).toBe('sofia-graduation-1');
+    expect(row.target_path).toBe(`/gallery/${event.slug}`);
+    expect(row.event_id).toBe(event.id);
+    expect(row.hit_count).toBe(0);
+  });
+
+  it('lowercases the input — operators pasting mixed-case still get a clean slug', async () => {
+    const event = await seedEvent({ slug: 'sofia-grad-2' });
+    const row = await service.createShortUrl({
+      eventId: event.id,
+      customSlug: 'Sofia-GraduAtion-2',  // mixed case
+      createdBy: adminId,
+    });
+    expect(row.short_slug).toBe('sofia-graduation-2');
+  });
+
+  it('rejects an invalid slug with INVALID_SLUG code', async () => {
+    const event = await seedEvent({ slug: 'invalid-test' });
+    await expect(service.createShortUrl({
+      eventId: event.id,
+      customSlug: 'invalid slug with spaces',
+      createdBy: adminId,
+    })).rejects.toMatchObject({ code: 'INVALID_SLUG' });
+  });
+
+  it('rejects a reserved slug with INVALID_SLUG code', async () => {
+    const event = await seedEvent({ slug: 'reserved-test' });
+    await expect(service.createShortUrl({
+      eventId: event.id,
+      customSlug: 'admin',
+      createdBy: adminId,
+    })).rejects.toMatchObject({ code: 'INVALID_SLUG' });
+  });
+
+  it('rejects a duplicate slug with SLUG_TAKEN + suggested fallback', async () => {
+    const event1 = await seedEvent({ slug: 'dup-test-1' });
+    const event2 = await seedEvent({ slug: 'dup-test-2' });
+    await service.createShortUrl({ eventId: event1.id, customSlug: 'collide-me' });
+    await expect(service.createShortUrl({
+      eventId: event2.id, customSlug: 'collide-me',
+    })).rejects.toMatchObject({
+      code: 'SLUG_TAKEN',
+      suggested: expect.any(String),
+    });
+  });
+
+  it('throws EVENT_NOT_FOUND when the event id does not exist', async () => {
+    await expect(service.createShortUrl({
+      eventId: 9999999, customSlug: 'no-event',
+    })).rejects.toMatchObject({ code: 'EVENT_NOT_FOUND' });
+  });
+});
+
+describe('createShortUrl — auto-generated slug', () => {
+  it('uses event slug + year when no custom slug provided', async () => {
+    const event = await seedEvent({
+      slug: 'autogen-wedding', event_date: '2026-06-05',
+    });
+    const row = await service.createShortUrl({
+      eventId: event.id,
+      createdBy: adminId,
+    });
+    // First-choice candidate is just the slug; takes that.
+    expect(row.short_slug).toBe('autogen-wedding');
+  });
+
+  it('falls back to slug-year when the bare slug is already taken', async () => {
+    // Both events SHARE the same canonical slug so the first-choice
+    // bare-slug candidate is burned, forcing autoGen to try the
+    // year-suffixed variant.
+    const event1 = await seedEvent({
+      slug: 'collide-base', event_date: '2026-07-01',
+    });
+    await service.createShortUrl({
+      eventId: event1.id, customSlug: 'collide-base',
+    });
+    const event2 = await seedEvent({
+      slug: 'collide-base-2', event_date: '2026-07-01',
+    });
+    // Force the bare candidate of event2 to also collide by burning it.
+    await service.createShortUrl({
+      eventId: event1.id, customSlug: 'collide-base-2',
+    });
+    const row = await service.createShortUrl({
+      eventId: event2.id,  // No custom — auto-gen from event2.slug
+    });
+    // Bare candidate `collide-base-2` is taken → year-suffixed picks.
+    expect(row.short_slug).toBe('collide-base-2-2026');
+  });
+});
+
+describe('createShortUrl — target_path snapshotting (#699 backward-compat)', () => {
+  it('uses /gallery/<slug> when the global short-URLs setting is OFF (default)', async () => {
+    const event = await seedEvent({ slug: 'snapshot-off' });
+    const row = await service.createShortUrl({
+      eventId: event.id, customSlug: 'snap-off',
+    });
+    expect(row.target_path).toBe(`/gallery/${event.slug}`);
+  });
+
+  it('uses /gallery/<share_token> when the global setting is ON at create time', async () => {
+    // Persist the setting.
+    const { upsertAppSetting } = require('../../src/utils/appSettings');
+    await upsertAppSetting('general_use_short_gallery_urls', JSON.stringify(true), 'system');
+    try {
+      const event = await seedEvent({ slug: 'snapshot-on', share_token: 'tokenAbc123' });
+      const row = await service.createShortUrl({
+        eventId: event.id, customSlug: 'snap-on',
+      });
+      expect(row.target_path).toBe(`/gallery/${event.share_token}`);
+
+      // CRITICAL backward-compat invariant: now flip the setting OFF.
+      // Existing short URLs must still resolve to the same target_path
+      // they were created with — operator's existing share links don't
+      // silently change behaviour.
+      await upsertAppSetting('general_use_short_gallery_urls', JSON.stringify(false), 'system');
+      const refetched = await service.findByShortSlug('snap-on');
+      expect(refetched.target_path).toBe(`/gallery/${event.share_token}`);
+    } finally {
+      await upsertAppSetting('general_use_short_gallery_urls', JSON.stringify(false), 'system');
+    }
+  });
+});
+
+describe('findByShortSlug + listForEvent', () => {
+  it('returns null for an unknown slug', async () => {
+    expect(await service.findByShortSlug('does-not-exist-xyz')).toBeNull();
+  });
+
+  it('returns null for a malformed slug (no DB hit)', async () => {
+    expect(await service.findByShortSlug('UPPER_CASE')).toBeNull();
+    expect(await service.findByShortSlug('with spaces')).toBeNull();
+    expect(await service.findByShortSlug('')).toBeNull();
+  });
+
+  it('returns soft-deleted rows (caller decides 410 vs 404)', async () => {
+    const event = await seedEvent({ slug: 'softdel-find' });
+    const created = await service.createShortUrl({
+      eventId: event.id, customSlug: 'find-deleted',
+    });
+    await service.softDelete(created.id, adminId);
+    const fetched = await service.findByShortSlug('find-deleted');
+    expect(fetched).not.toBeNull();
+    expect(fetched.deleted_at).toBeTruthy();
+  });
+
+  it('listForEvent excludes soft-deleted rows', async () => {
+    const event = await seedEvent({ slug: 'list-test' });
+    const live = await service.createShortUrl({
+      eventId: event.id, customSlug: 'list-live',
+    });
+    const deleted = await service.createShortUrl({
+      eventId: event.id, customSlug: 'list-deleted',
+    });
+    await service.softDelete(deleted.id, adminId);
+    const list = await service.listForEvent(event.id);
+    const ids = list.map((r) => r.id);
+    expect(ids).toContain(live.id);
+    expect(ids).not.toContain(deleted.id);
+  });
+});
+
+describe('softDelete', () => {
+  it('returns true on first call, false on second (idempotent admin clicks)', async () => {
+    const event = await seedEvent({ slug: 'softdel-idem' });
+    const created = await service.createShortUrl({
+      eventId: event.id, customSlug: 'idem-delete',
+    });
+    expect(await service.softDelete(created.id, adminId)).toBe(true);
+    expect(await service.softDelete(created.id, adminId)).toBe(false);
+  });
+
+  it('returns false for an unknown id (caller maps to 404)', async () => {
+    expect(await service.softDelete(9999999, adminId)).toBe(false);
+  });
+});
+
+describe('createShortUrl after soft-delete — slug rotation', () => {
+  it('re-creating a soft-deleted slug succeeds (purges the deleted row)', async () => {
+    const event = await seedEvent({ slug: 'rotate' });
+    const first = await service.createShortUrl({
+      eventId: event.id, customSlug: 'rotate-me',
+    });
+    await service.softDelete(first.id, adminId);
+    // The slug is now reclaimable for a fresh row.
+    const second = await service.createShortUrl({
+      eventId: event.id, customSlug: 'rotate-me',
+    });
+    expect(second.id).not.toBe(first.id);
+    expect(second.short_slug).toBe('rotate-me');
+  });
+});
+
+describe('recordHit', () => {
+  it('increments hit_count + stamps last_hit_at', async () => {
+    const event = await seedEvent({ slug: 'hit-counter' });
+    const row = await service.createShortUrl({
+      eventId: event.id, customSlug: 'count-me',
+    });
+    await service.recordHit(row.id);
+    await service.recordHit(row.id);
+    const fetched = await service.findByShortSlug('count-me');
+    expect(fetched.hit_count).toBe(2);
+    expect(fetched.last_hit_at).toBeTruthy();
+  });
+
+  it('is fire-and-forget — invalid id does not throw', async () => {
+    await expect(service.recordHit(9999999)).resolves.not.toThrow();
+  });
+});

backend/__tests__/integration/helpers/crmDb.js

@@ -0,0 +1,230 @@
+/**
+ * Test harness for CRM integration tests.
+ *
+ * Boots a temp-SQLite database, runs every `migrations/core/*.up()`
+ * directly (bypassing knex's Migrator — its exclusive write lock
+ * deadlocks 001_init's nested `initializeDatabase()` call), and
+ * exposes a small helper for seeding the minimal row set that the
+ * quote/contract/invoice services need to operate.
+ *
+ * Usage:
+ *
+ *   const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+ *
+ *   beforeAll(async () => {
+ *     ({ db, cleanup } = await bootCrmDb());
+ *     ({ adminId, customerId } = await seedMinimal(db));
+ *   });
+ *   afterAll(async () => { await cleanup(); });
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const bcrypt = require('bcrypt');
+
+async function runCoreMigrations(db) {
+  await db.schema.createTable('migrations', (t) => {
+    t.increments('id').primary();
+    t.string('filename').unique().notNullable();
+    t.timestamp('applied_at').defaultTo(db.fn.now());
+  });
+
+  const coreDir = path.resolve(__dirname, '..', '..', '..', 'migrations', 'core');
+  const files = (await fs.promises.readdir(coreDir))
+    .filter((f) => f.endsWith('.js'))
+    .sort();
+
+  for (const f of files) {
+    const mod = require(path.join(coreDir, f));
+    if (typeof mod.up === 'function') {
+      await mod.up(db);
+    }
+    await db('migrations').insert({ filename: f });
+  }
+}
+
+/**
+ * Boot a clean test DB. Returns { db, cleanup, tmpDir }.
+ * Caller must invoke cleanup() in afterAll to release the SQLite file
+ * and the temp directory.
+ */
+async function bootCrmDb() {
+  const tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-crm-'));
+  process.env.NODE_ENV = 'test';
+  process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'crm.db');
+  process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+  await fs.promises.mkdir(process.env.STORAGE_PATH, { recursive: true });
+
+  // No jest.resetModules() — every service the test later requires
+  // must share THIS db instance. Two module copies on one SQLite file
+  // each open their own knex pool and the SQLite write lock deadlocks
+  // the second one acquiring a connection. Caller is responsible for
+  // setting TEST_DATABASE_PATH before the first require of db.js
+  // (which knexfile reads at module-init time); bootCrmDb only works
+  // when invoked before any service import.
+  const { db } = require('../../../src/database/db');
+
+  await runCoreMigrations(db);
+
+  return {
+    db,
+    tmpDir,
+    cleanup: async () => {
+      try { await db.destroy(); } catch (_) {}
+      try { await fs.promises.rm(tmpDir, { recursive: true, force: true }); } catch (_) {}
+    },
+  };
+}
+
+/**
+ * Seed the minimal row set that quote/contract/invoice services
+ * dereference on creation: an admin user, an active customer, a
+ * business_profile row, and the app_settings keys the services read.
+ *
+ * Returns the ids the caller will pass into service calls.
+ */
+async function seedMinimal(db) {
+  const passwordHash = await bcrypt.hash('test-pass', 4); // low rounds = fast
+
+  const adminInsert = await db('admin_users').insert({
+    username: 'tester', email: 'tester@example.com',
+    password_hash: passwordHash, must_change_password: false,
+    created_at: new Date(),
+  }).returning('id');
+  const adminId = adminInsert[0]?.id ?? adminInsert[0];
+
+  // business_profile is a singleton; the row is seeded by migration 107
+  // for fresh installs. Defensive: insert if missing.
+  const profile = await db('business_profile').first();
+  if (!profile) {
+    await db('business_profile').insert({
+      legal_name: 'Test Studio',
+      default_currency: 'CHF',
+      default_locale: 'de',
+    });
+  }
+
+  const customerInsert = await db('customer_accounts').insert({
+    email: 'customer@example.com',
+    display_name: 'Test Customer',
+    password_hash: passwordHash,
+    preferred_language: 'de',
+    is_active: 1,
+    created_at: new Date(),
+  }).returning('id');
+  const customerId = customerInsert[0]?.id ?? customerInsert[0];
+
+  return { adminId, customerId };
+}
+
+// ---------------------------------------------------------------------
+// Route-test helpers (#570) — building blocks for the CRM HTTP layer
+// tests. Kept here so every supertest suite shares the same minting +
+// app-wiring shape and a refactor lands in one place.
+// ---------------------------------------------------------------------
+
+const crypto = require('crypto');
+const jwt = require('jsonwebtoken');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+
+/**
+ * Promote a seeded admin into a role (default `super_admin`) so
+ * `requirePermission(...)` checks pass. seedMinimal creates an admin
+ * without a role — that's good for negative tests (expect 403) but
+ * happy-path tests need the role assignment.
+ *
+ * Returns the role id the admin was assigned to.
+ */
+async function assignAdminRole(db, adminId, roleName = 'super_admin') {
+  const role = await db('roles').where({ name: roleName }).first();
+  if (!role) {
+    throw new Error(`Role '${roleName}' not seeded — check the test DB`);
+  }
+  await db('admin_users').where({ id: adminId }).update({ role_id: role.id });
+  return role.id;
+}
+
+/**
+ * Mint an admin JWT in the same shape adminAuth middleware expects.
+ * The tests inject this via `Authorization: Bearer <token>`.
+ */
+function mintAdminToken(adminId, { expiresIn = '1h', extraClaims = {} } = {}) {
+  process.env.JWT_SECRET = process.env.JWT_SECRET || 'crm-route-test-secret';
+  return jwt.sign(
+    { id: adminId, type: 'admin', iat: Math.floor(Date.now() / 1000), ...extraClaims },
+    process.env.JWT_SECRET,
+    { expiresIn, issuer: 'picpeak-auth' }
+  );
+}
+
+/**
+ * Insert a row into one of the public-token tables for testing the
+ * loadActionToken guard outcomes. Returns the generated 64-hex token.
+ *
+ * Usage:
+ *   await createPublicToken(db, 'quote_action_tokens', { quote_id: q.id });
+ *   await createPublicToken(db, 'quote_action_tokens', { quote_id: q.id, expires_at: pastDate });
+ *   await createPublicToken(db, 'quote_action_tokens', { quote_id: q.id, used_at: new Date() });
+ *   await createPublicToken(db, 'quote_action_tokens', { quote_id: q.id, expires_at: null });
+ */
+async function createPublicToken(db, tableName, opts = {}) {
+  const token = opts.token || crypto.randomBytes(32).toString('hex');
+  const expiresAt = opts.expires_at === null
+    ? null
+    : (opts.expires_at || new Date(Date.now() + 7 * 24 * 60 * 60 * 1000));
+  // Serialise Date → ISO string. Bare Date objects round-tripped
+  // inconsistently through knex+SQLite — sometimes as epoch ms,
+  // sometimes via .toString() → literal "[object Object]" which then
+  // parses back to NaN and silently defeats the expiry guard.
+  const toStorable = (v) => (v instanceof Date ? v.toISOString() : v);
+  const row = {
+    ...opts,
+    token,
+    expires_at: toStorable(expiresAt),
+    created_at: toStorable(new Date()),
+  };
+  await db(tableName).insert(row);
+  return token;
+}
+
+/**
+ * Build an Express app with the requested route file mounted. Mirrors
+ * the production app's middleware shape (json + cookies) but skips
+ * everything else (CORS, helmet, rate limiters) — route tests pin the
+ * handler's contract, not the surrounding cross-cutting concerns.
+ *
+ * Example:
+ *   const app = buildRouteApp('/api/public/quotes',
+ *     require('../../src/routes/publicQuotes'));
+ */
+function buildRouteApp(mount, router) {
+  const app = express();
+  app.use(express.json());
+  app.use(cookieParser());
+  app.use(mount, router);
+  // Catch-all error handler. Mirrors the real middleware/errorHandler:
+  // AppError subclasses (ValidationError, NotFoundError, etc.) use
+  // `.statusCode` (NOT `.status` — getting that wrong silently maps
+  // every 400 / 404 / 410 to 500 in tests).
+  // eslint-disable-next-line no-unused-vars
+  app.use((err, req, res, next) => {
+    const statusCode = err.statusCode || err.status || 500;
+    res.status(statusCode).json({
+      error: err.message || 'Internal error',
+      code: err.code,
+      ...(err.details ? { details: err.details } : {}),
+    });
+  });
+  return app;
+}
+
+module.exports = {
+  bootCrmDb,
+  seedMinimal,
+  assignAdminRole,
+  mintAdminToken,
+  createPublicToken,
+  buildRouteApp,
+};

backend/__tests__/integration/hiddenOwnFeedback.test.js

@@ -0,0 +1,245 @@
+/**
+ * Hidden feedback, seen from the guest who left it (#1150).
+ *
+ * Everything in the system treats a hidden row as absent: getPhotoFeedback
+ * drops it even for the guest's own feedback, the /photos filters drop it, and
+ * updatePhotoFeedbackStats does not count it. One place disagreed — the
+ * per-viewer `is_liked` heart — so a like the photographer had hidden still
+ * showed as liked on a photo whose like_count was zero. (The `my_color_label`
+ * badge has the same shape on main; colour labels are not on this branch.)
+ *
+ * Making those two agree exposes the second half: the duplicate check that
+ * powers like/favorite toggling did NOT skip hidden rows, so the now-empty
+ * heart, when clicked, found the hidden row and toggled it OFF. The click
+ * appeared to do nothing and it took two more to get back to a filled heart.
+ *
+ * Hiding a non-comment is deliberate, not an accident of the raw route: #839
+ * and #1044 both ship it, with tests asserting that a hidden reaction or
+ * colour label stops counting. So the fix is to make hidden mean absent
+ * consistently — not to stop admins hiding these.
+ */
+
+const request = require('supertest');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'hidden-feedback-secret';
+
+const SLUG = 'hidden-own-feedback';
+const ME = 'guest-me-identifier';
+
+describe('a guest\'s own hidden feedback (#1150)', () => {
+  let db; let cleanup; let app; let feedbackService;
+  let eventId; let photoId; let myGuestRowId;
+
+  const galleryToken = () => jwt.sign(
+    { eventId, eventSlug: SLUG, type: 'gallery' },
+    process.env.JWT_SECRET,
+    { expiresIn: '1h', issuer: 'picpeak-auth' }
+  );
+  const guestToken = () => jwt.sign(
+    { type: 'guest', guestId: myGuestRowId, eventId },
+    process.env.JWT_SECRET,
+    { expiresIn: '1h', issuer: 'picpeak-auth' }
+  );
+
+  const getPhoto = async () => {
+    const res = await request(app)
+      .get(`/api/gallery/${SLUG}/photos`)
+      .set('Authorization', `Bearer ${galleryToken()}`)
+      .set('x-guest-token', guestToken());
+    expect(res.status).toBe(200);
+    const photos = Array.isArray(res.body) ? res.body : res.body.photos;
+    return (photos || []).find((p) => p.id === photoId);
+  };
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+    feedbackService = require('../../src/services/feedbackService');
+
+    const [ev] = await db('events').insert({
+      slug: SLUG,
+      event_type: 'wedding',
+      event_name: 'Hidden Own Feedback',
+      event_date: '2026-08-01',
+      host_email: 'h@example.com',
+      admin_email: 'a@example.com',
+      password_hash: 'x',
+      share_link: `/gallery/${SLUG}/share`,
+      share_token: 'hidden-own-share',
+      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+      is_active: 1, is_archived: 0, is_draft: 0,
+      created_at: new Date().toISOString(),
+    }).returning('id');
+    eventId = typeof ev === 'object' ? ev.id : ev;
+
+    const [p] = await db('photos').insert({
+      event_id: eventId, filename: 'shot.jpg', path: 'events/hidden/shot.jpg',
+      type: 'individual', uploaded_at: new Date().toISOString(),
+    }).returning('id');
+    photoId = typeof p === 'object' ? p.id : p;
+
+    const [g] = await db('gallery_guests').insert({
+      event_id: eventId, name: 'Me', identifier: ME,
+      created_at: new Date().toISOString(), last_seen_at: new Date().toISOString(),
+      is_deleted: false,
+    }).returning('id');
+    myGuestRowId = typeof g === 'object' ? g.id : g;
+
+    await db('event_feedback_settings').insert({
+      event_id: eventId, feedback_enabled: true, allow_likes: true,
+      moderate_comments: false,
+      show_feedback_to_guests: true,
+    });
+
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/gallery', require('../../src/routes/gallery'));
+    app.use('/api/gallery', require('../../src/routes/galleryFeedback'));
+  }, 180000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  const like = () => db('photo_feedback').insert({
+    photo_id: photoId, event_id: eventId, guest_identifier: ME,
+    guest_id: myGuestRowId, feedback_type: 'like',
+    is_approved: true, is_hidden: false, created_at: new Date().toISOString(),
+  });
+
+  beforeEach(async () => {
+    await db('photo_feedback').where({ photo_id: photoId }).del();
+    await db('photos').where('id', photoId).update({ like_count: 0 });
+  });
+
+  describe('the read surfaces agree with each other', () => {
+    it('un-fills the heart once the like is hidden', async () => {
+      await like();
+      await feedbackService.updatePhotoFeedbackStats(photoId);
+      expect((await getPhoto()).is_liked).toBe(true);
+
+      await db('photo_feedback')
+        .where({ photo_id: photoId, feedback_type: 'like' })
+        .update({ is_hidden: true });
+      await feedbackService.updatePhotoFeedbackStats(photoId);
+
+      const photo = await getPhoto();
+      // like_count already ignored hidden rows, so the heart was the only
+      // thing still claiming this photo was liked.
+      expect(photo.like_count).toBe(0);
+      expect(photo.is_liked).toBe(false);
+    });
+
+  });
+
+  describe('and every other surface agrees', () => {
+    it('keeps a hidden like out of /my-feedback', async () => {
+      await like();
+      await db('photo_feedback')
+        .where({ photo_id: photoId, feedback_type: 'like' })
+        .update({ is_hidden: true });
+
+      const res = await request(app)
+        .get(`/api/gallery/${SLUG}/my-feedback`)
+        .set('Authorization', `Bearer ${galleryToken()}`)
+        .set('x-guest-token', guestToken());
+      expect(res.status).toBe(200);
+
+      // In guest identity mode the Liked/Favorited/Rated chips and their
+      // filters are built from THIS array, not from is_liked — so a hidden
+      // like left an empty heart while the chip still counted it.
+      expect(res.body.filter((f) => f.feedback_type === 'like')).toHaveLength(0);
+    });
+
+    it('does not count a hidden row against the guest cap', async () => {
+      await db('event_feedback_settings')
+        .where({ event_id: eventId }).update({ max_likes_per_guest: 1 });
+      await like();
+      await db('photo_feedback')
+        .where({ photo_id: photoId, feedback_type: 'like' })
+        .update({ is_hidden: true });
+
+      // The hidden row is room, not an occupant: the guest sees an empty
+      // heart, and meeting that click with limit_reached leaves the control
+      // dead until they un-like something they can still see.
+      const result = await feedbackService.submitFeedback(photoId, eventId, {
+        feedback_type: 'like', guest_identifier: ME, guest_id: myGuestRowId,
+      });
+      expect(result.limit_reached).toBeUndefined();
+
+      await db('event_feedback_settings')
+        .where({ event_id: eventId }).update({ max_likes_per_guest: null });
+    });
+
+    it('leaves other anonymous rows alone when there is no identity to scope by', async () => {
+      // With neither guest_id nor guest_identifier the collapse scope degrades
+      // to `guest_identifier IS NULL` — every identifier-less row on the
+      // photo, i.e. other people's.
+      const anon = (extra) => ({
+        photo_id: photoId, event_id: eventId, feedback_type: 'like',
+        is_approved: true, created_at: new Date().toISOString(), ...extra,
+      });
+      const [h] = await db('photo_feedback').insert(anon({ is_hidden: true })).returning('id');
+      const hiddenId = typeof h === 'object' ? h.id : h;
+      await db('photo_feedback').insert(anon({ is_hidden: false }));
+      await db('photo_feedback').insert(anon({ is_hidden: false }));
+
+      await feedbackService.moderateFeedback(hiddenId, 'approve', 1);
+
+      expect(await db('photo_feedback')
+        .where({ photo_id: photoId, feedback_type: 'like', is_hidden: false }))
+        .toHaveLength(3);
+    });
+
+    it('collapses the replacement when an admin unhides the original', async () => {
+      await like();
+      const original = await db('photo_feedback').where({ photo_id: photoId }).first();
+      await db('photo_feedback').where('id', original.id).update({ is_hidden: true });
+
+      await feedbackService.submitFeedback(photoId, eventId, {
+        feedback_type: 'like', guest_identifier: ME, guest_id: myGuestRowId,
+      });
+      expect(await db('photo_feedback').where({ photo_id: photoId })).toHaveLength(2);
+
+      await feedbackService.moderateFeedback(original.id, 'approve', 1);
+
+      // Two visible rows for one guest would double-count in the tallies and
+      // need two toggles to clear, since each deletes a single row.
+      const visible = await db('photo_feedback')
+        .where({ photo_id: photoId, feedback_type: 'like', is_hidden: false });
+      expect(visible).toHaveLength(1);
+      expect(visible[0].id).toBe(original.id);
+    });
+  });
+
+  describe('and clicking still works afterwards', () => {
+    it('re-liking creates a fresh row instead of toggling the hidden one off', async () => {
+      await like();
+      await db('photo_feedback')
+        .where({ photo_id: photoId, feedback_type: 'like' })
+        .update({ is_hidden: true });
+
+      // What the guest sees is an empty heart, so this is an ADD.
+      const result = await feedbackService.submitFeedback(photoId, eventId, {
+        feedback_type: 'like',
+        guest_identifier: ME,
+        guest_id: myGuestRowId,
+      });
+
+      // Before this, the duplicate check found the hidden row and deleted it —
+      // `removed: true` — so the click did nothing visible and the moderation
+      // was silently undone.
+      expect(result.removed).toBeUndefined();
+
+      const visible = await db('photo_feedback')
+        .where({ photo_id: photoId, feedback_type: 'like', is_hidden: false });
+      expect(visible).toHaveLength(1);
+      expect((await getPhoto()).is_liked).toBe(true);
+    });
+  });
+
+});

backend/__tests__/integration/imageProcessor.storage.test.js

@@ -137,6 +137,41 @@ describe.each(backendCases())('imageProcessor through $name', ({ setup }) => {
     expect(await storage.exists(key)).toBe(true);
   });
 
+  test('generatePreviewImage writes to /previews and skips enlargement of small originals', async () => {
+    const src = await makeSourceJpeg(tmpDir, 'preview-source.jpg');
+    const key = await imageProcessor.generatePreviewImage(src);
+    expect(key).toBe('previews/preview_preview-source.jpg');
+    expect(await storage.exists(key)).toBe(true);
+
+    if (storage.kind() === 'local') {
+      const meta = await sharp(storage.resolveLocalPath(key)).metadata();
+      expect(meta.format).toBe('jpeg');
+      // Source is 800x600 and default longEdge is 1920 with
+      // withoutEnlargement: true → preview must NOT be upscaled.
+      expect(meta.width).toBe(800);
+      expect(meta.height).toBe(600);
+    }
+  });
+
+  test('generatePreviewImage shrinks oversized images to fit longEdge while preserving aspect', async () => {
+    const src = await makeSourceJpeg(tmpDir, 'preview-shrink.jpg');
+    const key = await imageProcessor.generatePreviewImage(src, { longEdge: 400 });
+    expect(await storage.exists(key)).toBe(true);
+    if (storage.kind() === 'local') {
+      const meta = await sharp(storage.resolveLocalPath(key)).metadata();
+      // 800x600 → fit:'inside' inside 400×400 → 400×300.
+      expect(meta.width).toBe(400);
+      expect(meta.height).toBe(300);
+    }
+  });
+
+  test('isPreviewValid returns true for a real preview and false for a missing key', async () => {
+    const src = await makeSourceJpeg(tmpDir, 'preview-valid.jpg');
+    const key = await imageProcessor.generatePreviewImage(src);
+    expect(await imageProcessor.isPreviewValid(key)).toBe(true);
+    expect(await imageProcessor.isPreviewValid('previews/does-not-exist.jpg')).toBe(false);
+  });
+
   test('isThumbnailValid returns true for a good thumbnail and false for nothing', async () => {
     const src = await makeSourceJpeg(tmpDir, 'valid-check.jpg');
     const key = await imageProcessor.generateThumbnail(src);

backend/__tests__/integration/incomingInvoiceRebill.test.js

@@ -0,0 +1,211 @@
+/**
+ * Incoming-invoice categorisation + re-bill chain (expenseService) against a
+ * real SQLite schema. Covers the bits unit tests can't: the disposition state
+ * machine, re-categorisation unwind, the per-event PENDING pool + bundling, and
+ * the monthly accumulator immediate-bill — i.e. that categorizeInbound /
+ * billPendingRebills actually mint / amend invoice rows correctly.
+ *
+ * No date-range comparisons are exercised here, so it's safe on SQLite (the
+ * usual PG-vs-SQLite date pitfall — [[feedback_pg_date_columns_serialize]] —
+ * doesn't apply to this path).
+ */
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+// Service-level CRM calls cold-require heavy modules (pdfService, nodemailer)
+// on first use; bump the budget for this file.
+jest.setTimeout(120000);
+
+describe('incoming-invoice categorise / re-bill chain', () => {
+  let db;
+  let cleanup;
+  let adminId;
+  let expenseService;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    // logActivity writes to activity_logs via the GLOBAL db. createInvoice (and
+    // appendToMonthlyDraft) call it INSIDE the transaction we pass them, and a
+    // second write connection deadlocks against the held write lock on
+    // SQLite. It's fire-and-forget audit noise, irrelevant to these
+    // assertions, so stub it BEFORE the services destructure it at require
+    // time. (Production runs Postgres, where the concurrent write is fine.)
+    const dbModule = require('../../src/database/db');
+    dbModule.logActivity = async () => {};
+    ({ adminId } = await seedMinimal(db));
+    expenseService = require('../../src/services/expenseService');
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  const unwrapId = (ins) => (typeof ins[0] === 'object' ? ins[0].id : ins[0]);
+
+  async function captureDoc(overrides = {}) {
+    const ins = await db('inbound_documents').insert({
+      source: 'upload',
+      status: 'unsorted',
+      parse_status: 'pending',
+      parse_method: 'none',
+      supplier_name: 'ACME AG',
+      currency: 'CHF',
+      total_amount_minor: 10000,
+      invoice_date: '2026-06-01',
+      created_at: new Date(),
+      updated_at: new Date(),
+      ...overrides,
+    }).returning('id');
+    return unwrapId(ins);
+  }
+
+  let customerSeq = 0;
+  async function makeCustomer(billingCadence) {
+    customerSeq += 1;
+    const ins = await db('customer_accounts').insert({
+      email: `rebill-${billingCadence || 'event'}-${customerSeq}@example.com`,
+      display_name: `Rebill ${billingCadence || 'event'} ${customerSeq}`,
+      password_hash: 'x',
+      preferred_language: 'de',
+      is_active: 1,
+      billing_cadence: billingCadence || null,
+      created_at: new Date(),
+    }).returning('id');
+    return unwrapId(ins);
+  }
+
+  it('company expense (eigener_aufwand) categorises with no invoice + no customer', async () => {
+    const id = await captureDoc();
+    const doc = await expenseService.categorizeInbound(id, { disposition: 'eigener_aufwand', categoryId: null }, adminId);
+    expect(doc.disposition).toBe('eigener_aufwand');
+    expect(doc.status).toBe('categorized');
+    expect(doc.billedInvoiceId).toBeNull();
+    expect(doc.customerAccountId).toBeNull();
+  });
+
+  it('rebill REQUIRES a customer', async () => {
+    const id = await captureDoc();
+    await expect(expenseService.categorizeInbound(id, { disposition: 'rebill' }, adminId))
+      .rejects.toMatchObject({ code: 'CUSTOMER_REQUIRED' });
+  });
+
+  it('per-event rebill stays PENDING (customer + markup stored, no invoice yet)', async () => {
+    const customerId = await makeCustomer('per_event');
+    const id = await captureDoc({ total_amount_minor: 10000 });
+    const doc = await expenseService.categorizeInbound(id, {
+      disposition: 'rebill', customerAccountId: customerId,
+      markupType: 'percent', markupPercent: 10,
+    }, adminId);
+    expect(doc.disposition).toBe('rebill');
+    expect(doc.customerAccountId).toBe(customerId);
+    expect(doc.billedInvoiceId).toBeNull(); // pending — not billed until bundled
+    expect(doc.markupType).toBe('percent');
+    expect(Number(doc.markupPercent)).toBe(10);
+  });
+
+  it('passthrough never carries a markup, even if one is sent', async () => {
+    const customerId = await makeCustomer('per_event');
+    const id = await captureDoc();
+    const doc = await expenseService.categorizeInbound(id, {
+      disposition: 'durchlaufend', customerAccountId: customerId,
+      markupType: 'percent', markupPercent: 25, // should be ignored
+    }, adminId);
+    expect(doc.disposition).toBe('durchlaufend');
+    expect(doc.customerAccountId).toBe(customerId);
+    expect(doc.markupType).toBe('none');
+    expect(doc.markupPercent).toBeNull();
+    expect(doc.billedInvoiceId).toBeNull();
+  });
+
+  it('billPendingRebills refuses monthly/manual customers (they auto-consolidate)', async () => {
+    const customerId = await makeCustomer('monthly');
+    await expect(expenseService.billPendingRebills(customerId, adminId))
+      .rejects.toMatchObject({ code: 'CADENCE_MISMATCH' });
+  });
+
+  // ── The actual invoice-MINTING paths (billPendingRebills bundling a per-event
+  // customer's pool; monthly-customer immediate-bill onto the running draft)
+  // both call invoiceService.createInvoice INSIDE a db.transaction. createInvoice
+  // claims its sequence number via the global db, which DEADLOCKS against the
+  // held write lock on a SQLite-backed harness (a second write connection blocks
+  // — verified). Production runs Postgres where the concurrent write is fine, so
+  // this is a harness limitation, not a product bug. The line-amount math is
+  // covered by the buildInboundLineItem unit tests, and createInvoice itself by
+  // discountLineItems.test.js. Below we test the UNWIND path against a
+  // hand-crafted billed state so we don't have to mint through createInvoice. ──
+
+  // Build a billed state directly: an invoice with two lines, with the inbound
+  // doc stamped onto the first line as a prior re-bill.
+  async function makeBilledDoc(customerId, { status = 'scheduled', scheduledSendAt = null, isMonthlyDraft = false } = {}) {
+    const invIns = await db('invoices').insert({
+      invoice_number: `R-TEST-${customerSeq}-${Math.floor(Math.random() * 1e9)}`,
+      customer_account_id: customerId,
+      status,
+      scheduled_send_at: scheduledSendAt,
+      is_monthly_draft: isMonthlyDraft,
+      currency: 'CHF',
+      issue_date: '2026-06-01',
+      due_date: '2026-07-01',
+      vat_rate: 0,
+      net_amount_minor: 7000, // 4000 (rebill line) + 3000 (sibling)
+      vat_amount_minor: 0,
+      total_amount_minor: 7000,
+      created_at: new Date(),
+      updated_at: new Date(),
+    }).returning('id');
+    const invoiceId = unwrapId(invIns);
+    const rebillLineIns = await db('invoice_line_items').insert({
+      invoice_id: invoiceId, position: 1, quantity: 1, description: 'Rebill Co (Weiterverrechnung)',
+      unit_price_minor: 4000, discount_percent: 0, line_total_minor: 4000,
+    }).returning('id');
+    const rebillLineId = unwrapId(rebillLineIns);
+    await db('invoice_line_items').insert({
+      invoice_id: invoiceId, position: 2, quantity: 1, description: 'Other line',
+      unit_price_minor: 3000, discount_percent: 0, line_total_minor: 3000,
+    });
+    const id = await captureDoc({ total_amount_minor: 4000, supplier_name: 'Rebill Co' });
+    await db('inbound_documents').where({ id }).update({
+      disposition: 'rebill', status: 'categorized', customer_account_id: customerId,
+      billed_invoice_id: invoiceId, billed_invoice_line_item_id: rebillLineId,
+    });
+    return { id, invoiceId, rebillLineId };
+  }
+
+  it('re-categorising a billed doc UNWINDS its re-bill line + recomputes the (mutable) invoice', async () => {
+    const customerId = await makeCustomer('per_event');
+    const { id, invoiceId, rebillLineId } = await makeBilledDoc(customerId); // scheduled, no send-at → mutable
+
+    const recat = await expenseService.categorizeInbound(id, { disposition: 'eigener_aufwand', categoryId: null }, adminId);
+    expect(recat.disposition).toBe('eigener_aufwand');
+    expect(recat.billedInvoiceId).toBeNull();
+    expect(recat.customerAccountId).toBeNull();
+
+    // The re-bill line is gone; the sibling line remains and net recomputes.
+    expect(await db('invoice_line_items').where({ id: rebillLineId }).first()).toBeUndefined();
+    const after = await db('invoices').where({ id: invoiceId }).first();
+    expect(Number(after.net_amount_minor)).toBe(3000);
+  });
+
+  it('re-categorising a doc billed on an ISSUED invoice is refused (Storno required)', async () => {
+    const customerId = await makeCustomer('per_event');
+    const { id, rebillLineId } = await makeBilledDoc(customerId, { status: 'sent' });
+
+    await expect(expenseService.categorizeInbound(id, { disposition: 'eigener_aufwand' }, adminId))
+      .rejects.toMatchObject({ code: 'INVOICE_LOCKED' });
+    // Nothing was touched — the line survives.
+    expect(await db('invoice_line_items').where({ id: rebillLineId }).first()).toBeDefined();
+  });
+
+  it('re-categorisation moves a pending item between dispositions without a stray invoice', async () => {
+    const customerId = await makeCustomer('per_event');
+    const id = await captureDoc();
+    // passthrough → pending
+    let doc = await expenseService.categorizeInbound(id, { disposition: 'durchlaufend', customerAccountId: customerId }, adminId);
+    expect(doc.customerAccountId).toBe(customerId);
+    expect(doc.billedInvoiceId).toBeNull();
+    // → company expense: customer cleared, still no invoice
+    doc = await expenseService.categorizeInbound(id, { disposition: 'eigener_aufwand' }, adminId);
+    expect(doc.disposition).toBe('eigener_aufwand');
+    expect(doc.customerAccountId).toBeNull();
+    expect(doc.billedInvoiceId).toBeNull();
+  });
+});

backend/__tests__/integration/installFromBackupBoot.test.js

@@ -0,0 +1,214 @@
+/**
+ * Install-from-backup boot hook — pins the trigger-file convention.
+ *
+ * The hook itself depends on `restoreService.restore`, which is hard
+ * to fully exercise in an integration test without a real PG cluster
+ * (sequence resync, DROP/CREATE, etc.). So we stub the actual restore
+ * and verify the BOOT HOOK logic:
+ *
+ *   - No trigger file → no-op, ran=false
+ *   - Empty trigger file → picks newest manifest from manifests/
+ *   - Non-empty trigger file → uses the path inside
+ *   - DB not empty → refuses (no restore call)
+ *   - DB not empty + FORCE env → proceeds
+ *   - Successful restore → deletes trigger file
+ *   - Failed restore → leaves trigger file in place
+ *
+ * These are the surfaces an admin will hit when actually using the
+ * feature — the docker-compose-on-real-PG end-to-end test belongs in
+ * the follow-up CI work captured as task #7 earlier today.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { bootCrmDb } = require('./helpers/crmDb');
+
+// Stub the heavy lifting so the test stays fast + portable.
+const mockRestore = jest.fn();
+jest.mock('../../src/services/restoreService', () => ({
+  restoreService: {
+    restore: (...args) => mockRestore(...args),
+  },
+}));
+
+jest.setTimeout(120000);
+
+describe('installFromBackupBoot', () => {
+  let db;
+  let cleanup;
+  let storagePath;
+  let backupRoot;
+  let manifestsDir;
+  let tryInstallFromBackup;
+  let originalBackupRootEnv;
+  let originalForceEnv;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    storagePath = process.env.STORAGE_PATH;
+    backupRoot = path.join(storagePath, 'backup');
+    manifestsDir = path.join(backupRoot, 'manifests');
+    fs.mkdirSync(manifestsDir, { recursive: true });
+
+    originalBackupRootEnv = process.env.BACKUP_ROOT;
+    originalForceEnv = process.env.INSTALL_FROM_BACKUP_FORCE;
+    process.env.BACKUP_ROOT = backupRoot;
+
+    ({ tryInstallFromBackup } = require('../../src/services/_installFromBackupBoot'));
+  }, 120000);
+
+  afterAll(async () => {
+    if (originalBackupRootEnv === undefined) {
+      delete process.env.BACKUP_ROOT;
+    } else {
+      process.env.BACKUP_ROOT = originalBackupRootEnv;
+    }
+    if (originalForceEnv === undefined) {
+      delete process.env.INSTALL_FROM_BACKUP_FORCE;
+    } else {
+      process.env.INSTALL_FROM_BACKUP_FORCE = originalForceEnv;
+    }
+    if (cleanup) await cleanup();
+  });
+
+  beforeEach(async () => {
+    mockRestore.mockReset();
+    mockRestore.mockResolvedValue({ success: true });
+    delete process.env.INSTALL_FROM_BACKUP_FORCE;
+
+    // Clean trigger files + manifests between tests
+    for (const name of ['RESTORE_ON_INSTALL', 'RESTORE_ON_INSTALL.txt']) {
+      const p = path.join(backupRoot, name);
+      if (fs.existsSync(p)) fs.unlinkSync(p);
+    }
+    for (const f of fs.readdirSync(manifestsDir)) {
+      fs.unlinkSync(path.join(manifestsDir, f));
+    }
+
+    // Reset DB to fresh-install state
+    await db('events').del();
+    // Leave admin_users alone — fresh-install state has 1 row.
+  });
+
+  it('no trigger file → no-op', async () => {
+    const result = await tryInstallFromBackup(db);
+    expect(result.ran).toBe(false);
+    expect(mockRestore).not.toHaveBeenCalled();
+  });
+
+  it('empty trigger file picks the newest manifest from manifests/', async () => {
+    const older = path.join(manifestsDir, 'backup-manifest-001.json');
+    const newer = path.join(manifestsDir, 'backup-manifest-002.json');
+    fs.writeFileSync(older, '{}');
+    // Set the newer file's mtime slightly later so it wins the sort
+    const past = new Date(Date.now() - 60_000);
+    fs.utimesSync(older, past, past);
+    fs.writeFileSync(newer, '{}');
+
+    // Empty trigger
+    fs.writeFileSync(path.join(backupRoot, 'RESTORE_ON_INSTALL'), '');
+
+    const result = await tryInstallFromBackup(db);
+    expect(result.ran).toBe(true);
+    expect(result.manifestPath).toBe(newer);
+    expect(mockRestore).toHaveBeenCalledWith(expect.objectContaining({
+      source: 'local',
+      manifestPath: newer,
+      restoreType: 'full',
+      force: true,
+      skipPreBackup: true,
+    }));
+  });
+
+  it('non-empty trigger file uses the path inside', async () => {
+    const specific = path.join(manifestsDir, 'backup-manifest-specific.json');
+    fs.writeFileSync(specific, '{}');
+
+    // Relative to backupRoot
+    fs.writeFileSync(
+      path.join(backupRoot, 'RESTORE_ON_INSTALL'),
+      'manifests/backup-manifest-specific.json\n',
+    );
+
+    const result = await tryInstallFromBackup(db);
+    expect(result.ran).toBe(true);
+    expect(result.manifestPath).toBe(specific);
+  });
+
+  it('deletes the trigger file after a successful restore', async () => {
+    const manifest = path.join(manifestsDir, 'backup-manifest-001.json');
+    fs.writeFileSync(manifest, '{}');
+    const triggerPath = path.join(backupRoot, 'RESTORE_ON_INSTALL');
+    fs.writeFileSync(triggerPath, '');
+
+    await tryInstallFromBackup(db);
+    expect(fs.existsSync(triggerPath)).toBe(false);
+  });
+
+  it('leaves the trigger file in place when restore throws', async () => {
+    mockRestore.mockRejectedValueOnce(new Error('restore exploded'));
+    const manifest = path.join(manifestsDir, 'backup-manifest-001.json');
+    fs.writeFileSync(manifest, '{}');
+    const triggerPath = path.join(backupRoot, 'RESTORE_ON_INSTALL');
+    fs.writeFileSync(triggerPath, '');
+
+    const result = await tryInstallFromBackup(db);
+    expect(result.ran).toBe(false);
+    expect(result.error).toMatch(/restore exploded/);
+    expect(fs.existsSync(triggerPath)).toBe(true);
+  });
+
+  it('refuses to run when the install already has events', async () => {
+    // Simulate an install with existing data
+    await db('events').insert({
+      slug: 'existing-event',
+      event_name: 'Existing Event',
+      event_type: 'wedding',
+      event_date: new Date(),
+      host_email: 'host@example.com',
+      admin_email: 'host@example.com',
+      expires_at: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+      share_link: 'existing-event-token',
+      password_hash: 'dummy-hash-for-test',
+      created_at: new Date(),
+    });
+
+    const manifest = path.join(manifestsDir, 'backup-manifest-001.json');
+    fs.writeFileSync(manifest, '{}');
+    fs.writeFileSync(path.join(backupRoot, 'RESTORE_ON_INSTALL'), '');
+
+    const result = await tryInstallFromBackup(db);
+    expect(result.ran).toBe(false);
+    expect(result.error).toMatch(/Database not empty/);
+    expect(mockRestore).not.toHaveBeenCalled();
+
+    // Trigger file should NOT be deleted — admin needs to fix + retry
+    expect(fs.existsSync(path.join(backupRoot, 'RESTORE_ON_INSTALL'))).toBe(true);
+  });
+
+  it('proceeds when INSTALL_FROM_BACKUP_FORCE=true even with existing data', async () => {
+    await db('events').insert({
+      slug: 'existing-event-2',
+      event_name: 'Existing Event 2',
+      event_type: 'wedding',
+      event_date: new Date(),
+      host_email: 'host@example.com',
+      admin_email: 'host@example.com',
+      expires_at: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+      share_link: 'existing-event-2-token',
+      password_hash: 'dummy-hash-for-test-2',
+      created_at: new Date(),
+    });
+
+    const manifest = path.join(manifestsDir, 'backup-manifest-001.json');
+    fs.writeFileSync(manifest, '{}');
+    fs.writeFileSync(path.join(backupRoot, 'RESTORE_ON_INSTALL'), '');
+
+    process.env.INSTALL_FROM_BACKUP_FORCE = 'true';
+    const result = await tryInstallFromBackup(db);
+
+    expect(result.ran).toBe(true);
+    expect(mockRestore).toHaveBeenCalled();
+  });
+});

backend/__tests__/integration/invoiceDunning.test.js

@@ -0,0 +1,115 @@
+/**
+ * Dunning / Mahngebühr logic — the tax-sensitive bits added in the dunning
+ * rework. Covers the fee math (flat / percent), the VAT toggle gating
+ * (incl. the "no-op when the org has no VAT rate" requirement), per-reminder
+ * accumulation (2nd = 1×, 3rd = 2×), invoice immutability (the fee never
+ * changes the issued invoice total), and the 3-reminder cap.
+ *
+ * The Mahnung PDF render is stubbed — PDF rendering (fonts) is flaky in CI and
+ * is verified manually; here we assert the data/immutability behaviour.
+ */
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+// bootCrmDb runs the full core-migration set in beforeAll; under full-suite
+// parallel load on a small CI runner that can exceed the 5s default. Match the
+// other migration-heavy CRM suites (discountLineItems, incomingInvoiceRebill).
+jest.setTimeout(120000);
+
+let db;
+let cleanup;
+let invoiceService;
+let ids;
+
+async function setSetting(key, value) {
+  const { upsertAppSetting } = require('../../src/utils/appSettings');
+  await upsertAppSetting(key, JSON.stringify(value), 'crm');
+}
+
+beforeAll(async () => {
+  ({ db, cleanup } = await bootCrmDb());
+  ids = await seedMinimal(db);
+  try { await db('customer_accounts').where({ id: ids.customerId }).update({ feature_bills: true }); } catch (_) {}
+  invoiceService = require('../../src/services/invoiceService');
+  // Stub the (flaky) PDF render so applyReminder exercises its data path.
+  // eslint-disable-next-line global-require
+  const pdfService = require('../../src/services/pdfService');
+  pdfService.renderInvoiceToBuffer = async () => Buffer.from('%PDF-stub');
+});
+
+afterAll(async () => { await cleanup(); });
+
+describe('dunning fee resolvers', () => {
+  test('flat fee, no VAT', async () => {
+    await setSetting('crm_invoices_late_fee_enabled', true);
+    await setSetting('crm_invoices_late_fee_type', 'flat');
+    await setSetting('crm_invoices_late_fee_minor', 2000);
+    await setSetting('crm_invoices_late_fee_vat_enabled', false);
+    const inv = { total_amount_minor: 100000 };
+    expect(await invoiceService.resolveLateFeeNetMinor(inv)).toBe(2000);
+    expect(await invoiceService.resolveLateFeeVatRate()).toBe(0);
+    expect(await invoiceService.resolvePerReminderFeeMinor(inv)).toBe(2000);
+  });
+
+  test('percent fee = % of the invoice gross', async () => {
+    await setSetting('crm_invoices_late_fee_type', 'percent');
+    await setSetting('crm_invoices_late_fee_percent', 5);
+    expect(await invoiceService.resolveLateFeeNetMinor({ total_amount_minor: 100000 })).toBe(5000);
+  });
+
+  test('VAT toggle applies the org rate, but is a NO-OP when the org has no VAT rate', async () => {
+    await setSetting('crm_invoices_late_fee_type', 'flat');
+    await setSetting('crm_invoices_late_fee_minor', 2000);
+    await setSetting('crm_invoices_late_fee_vat_enabled', true);
+
+    await db('business_profile').where({ id: 1 }).update({ vat_rate_default: 8.1 });
+    expect(await invoiceService.resolveLateFeeVatRate()).toBeCloseTo(8.1);
+    expect(await invoiceService.resolvePerReminderFeeMinor({ total_amount_minor: 0 }))
+      .toBe(2000 + Math.round(2000 * 8.1 / 100)); // net + VAT
+
+    // Org doesn't charge VAT → toggle adds nothing (Mara's requirement).
+    await db('business_profile').where({ id: 1 }).update({ vat_rate_default: 0 });
+    expect(await invoiceService.resolveLateFeeVatRate()).toBe(0);
+    expect(await invoiceService.resolvePerReminderFeeMinor({ total_amount_minor: 0 })).toBe(2000);
+  });
+});
+
+describe('applyReminder — dunning-document model', () => {
+  let invoiceId;
+  let originalTotal;
+
+  beforeAll(async () => {
+    await setSetting('crm_invoices_late_fee_enabled', true);
+    await setSetting('crm_invoices_late_fee_type', 'flat');
+    await setSetting('crm_invoices_late_fee_minor', 2000);
+    await setSetting('crm_invoices_late_fee_vat_enabled', false);
+    const res = await invoiceService.createInvoice({
+      customerAccountId: ids.customerId,
+      currency: 'CHF',
+      vatRate: 0,
+      lineItems: [{ description: 'Service', quantity: 1, unit_price_minor: 100000 }],
+    }, ids.adminId);
+    invoiceId = res.invoiceIds[0];
+    originalTotal = Number((await db('invoices').where({ id: invoiceId }).first()).total_amount_minor);
+  });
+
+  test('level 2 tracks one fee and leaves the invoice total immutable', async () => {
+    const data = await invoiceService.getInvoiceById(invoiceId);
+    await invoiceService.applyReminder(data.invoice, data.lineItems, 2, ids.adminId);
+    const inv = await db('invoices').where({ id: invoiceId }).first();
+    expect(inv.reminder_level).toBe(2);
+    expect(Number(inv.late_fee_amount_minor)).toBe(2000);
+    expect(Number(inv.total_amount_minor)).toBe(originalTotal); // never mutated
+  });
+
+  test('level 3 accumulates the fee to 2×, total still immutable', async () => {
+    const data = await invoiceService.getInvoiceById(invoiceId);
+    await invoiceService.applyReminder(data.invoice, data.lineItems, 3, ids.adminId);
+    const inv = await db('invoices').where({ id: invoiceId }).first();
+    expect(Number(inv.late_fee_amount_minor)).toBe(4000);
+    expect(Number(inv.total_amount_minor)).toBe(originalTotal);
+  });
+
+  test('sendReminder refuses to exceed level 3', async () => {
+    await expect(invoiceService.sendReminder(invoiceId, 4, ids.adminId)).rejects.toThrow();
+  });
+});

backend/__tests__/integration/maintenanceJobState.test.js

@@ -0,0 +1,233 @@
+/**
+ * Shared run state for the maintenance sweeps (#1181).
+ *
+ * The behaviour that matters here cannot be observed from one process holding
+ * a module-level flag, which is exactly why the flag moved into the database.
+ * A second replica is simulated the only way that is honest in a single-process
+ * test: by asserting on the shared row itself, and by driving claim() twice —
+ * a second caller getting null is precisely what a second replica gets.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const express = require('express');
+const request = require('supertest');
+
+describe('maintenance job state (#1181)', () => {
+  let tmpDir; let db; let app; let jobs;
+
+  const dimStatus = () => request(app).get('/api/admin/photos/repair-dimensions/status');
+  const capStatus = () => request(app).get('/api/admin/photos/repair-capture-dates/status');
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-mjs-'));
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'db.sqlite');
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+    process.env.JWT_SECRET = process.env.JWT_SECRET || 'mjs-secret';
+
+    jest.resetModules();
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => { req.admin = { id: 1, username: 'tester', roleName: 'admin' }; next(); },
+    }));
+    jest.doMock('../../src/middleware/permissions', () => ({
+      requirePermission: () => (_req, _res, next) => next(),
+    }));
+    jest.doMock('../../src/utils/logger', () => ({
+      debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(),
+    }));
+
+    ({ db } = await require('./helpers/crmDb').bootCrmDb());
+    jobs = require('../../src/services/maintenanceJobState');
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/photos', require('../../src/routes/adminPhotoDimensions'));
+  }, 180000);
+
+  afterAll(async () => {
+    if (db) await db.destroy?.();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  beforeEach(async () => {
+    await db('maintenance_jobs').update({
+      is_running: false, started_at: null, heartbeat_at: null, finished_at: null, last_result: null, owner: null, claim_token: null,
+    });
+  });
+
+  test('the lease table is kept out of .picpeak archives', () => {
+    // It is live state, not data. An archive taken mid-sweep would otherwise
+    // carry is_running = true and a claim token owned by a process on the
+    // SOURCE install; restored inside the staleness window, the target reports
+    // the job as running and refuses new POSTs with no runner to release it.
+    // The importer filters on this same set, so archives written before the
+    // exclusion are skipped on restore too.
+    const { EXCLUDED_TABLES } = require('../../src/services/picpeakExportService');
+    expect(EXCLUDED_TABLES.has('maintenance_jobs')).toBe(true);
+  });
+
+  test('the migration seeds a row for each job', async () => {
+    const names = await db('maintenance_jobs').pluck('job_name');
+    expect(names.sort()).toEqual(['photo_capture_date_backfill', 'photo_dimension_repair']);
+  });
+
+  test('a second claim is refused while the first is alive', async () => {
+    expect(await jobs.claim(jobs.JOB_DIMENSION_REPAIR)).toEqual(expect.any(String));
+    // What a second replica's POST does. Nothing about the first claim lives in
+    // this process, so this is the same question the other replica asks.
+    expect(await jobs.claim(jobs.JOB_DIMENSION_REPAIR)).toBeNull();
+  });
+
+  test('the two jobs claim independently', async () => {
+    expect(await jobs.claim(jobs.JOB_DIMENSION_REPAIR)).toEqual(expect.any(String));
+    expect(await jobs.claim(jobs.JOB_CAPTURE_DATE_BACKFILL)).toEqual(expect.any(String));
+  });
+
+  test('each claim gets a distinct token', async () => {
+    const first = await jobs.claim(jobs.JOB_DIMENSION_REPAIR);
+    await jobs.release(jobs.JOB_DIMENSION_REPAIR, first);
+    const second = await jobs.claim(jobs.JOB_DIMENSION_REPAIR);
+    // Same process, same pid — so an owner string would have collided here and
+    // the fencing below would be worthless.
+    expect(second).not.toBe(first);
+  });
+
+  test('a claim whose heartbeat has gone quiet can be taken over', async () => {
+    expect(await jobs.claim(jobs.JOB_DIMENSION_REPAIR)).toEqual(expect.any(String));
+    expect(await jobs.claim(jobs.JOB_DIMENSION_REPAIR)).toBeNull();
+
+    // The replica holding it was killed: no release, no further heartbeats.
+    const longAgo = new Date(Date.now() - jobs.DEFAULT_STALE_MS - 60000).toISOString();
+    await db('maintenance_jobs').where({ job_name: jobs.JOB_DIMENSION_REPAIR }).update({ heartbeat_at: longAgo });
+
+    expect(await jobs.claim(jobs.JOB_DIMENSION_REPAIR)).toEqual(expect.any(String));
+  });
+
+  test('a superseded runner cannot renew its lease', async () => {
+    const oldToken = await jobs.claim(jobs.JOB_DIMENSION_REPAIR);
+    const longAgo = new Date(Date.now() - jobs.DEFAULT_STALE_MS - 60000).toISOString();
+    await db('maintenance_jobs').where({ job_name: jobs.JOB_DIMENSION_REPAIR }).update({ heartbeat_at: longAgo });
+    const newToken = await jobs.claim(jobs.JOB_DIMENSION_REPAIR);
+    expect(newToken).toEqual(expect.any(String));
+
+    // The old runner is still alive and mid-loop. Its renewal must tell it so,
+    // which is what makes the route loop stop instead of running alongside the
+    // new owner.
+    expect(await jobs.heartbeat(jobs.JOB_DIMENSION_REPAIR, oldToken)).toBe(false);
+    expect(await jobs.heartbeat(jobs.JOB_DIMENSION_REPAIR, newToken)).toBe(true);
+  });
+
+  test('a superseded runner cannot release the new owner\'s claim', async () => {
+    const oldToken = await jobs.claim(jobs.JOB_CAPTURE_DATE_BACKFILL);
+    const longAgo = new Date(Date.now() - jobs.DEFAULT_STALE_MS - 60000).toISOString();
+    await db('maintenance_jobs').where({ job_name: jobs.JOB_CAPTURE_DATE_BACKFILL }).update({ heartbeat_at: longAgo });
+    const newToken = await jobs.claim(jobs.JOB_CAPTURE_DATE_BACKFILL);
+
+    // The old runner finishes late and tries to write its result. Unfenced,
+    // this cleared is_running under the new owner and let a THIRD sweep start.
+    expect(await jobs.release(jobs.JOB_CAPTURE_DATE_BACKFILL, oldToken, { success: 999, noExif: 0, failed: 0 })).toBe(false);
+
+    const state = await jobs.read(jobs.JOB_CAPTURE_DATE_BACKFILL);
+    expect(state.isRunning).toBe(true);
+    expect(state.lastResult).toBeNull();
+    // And the row is still the new owner's to release.
+    expect(await jobs.release(jobs.JOB_CAPTURE_DATE_BACKFILL, newToken, { success: 1, noExif: 0, failed: 0 })).toBe(true);
+  });
+
+  test('a stale run reads as not running, so the button comes back', async () => {
+    await jobs.claim(jobs.JOB_DIMENSION_REPAIR);
+    expect((await jobs.read(jobs.JOB_DIMENSION_REPAIR)).isRunning).toBe(true);
+
+    const longAgo = new Date(Date.now() - jobs.DEFAULT_STALE_MS - 60000).toISOString();
+    await db('maintenance_jobs').where({ job_name: jobs.JOB_DIMENSION_REPAIR }).update({ heartbeat_at: longAgo });
+
+    // is_running is still true in the row — nothing released it — but a status
+    // poll must not leave the operator staring at a job that cannot finish.
+    expect((await db('maintenance_jobs').where({ job_name: jobs.JOB_DIMENSION_REPAIR }).first()).is_running).toBeTruthy();
+    expect((await jobs.read(jobs.JOB_DIMENSION_REPAIR)).isRunning).toBe(false);
+  });
+
+  test('a heartbeat keeps a long run claimed', async () => {
+    const token = await jobs.claim(jobs.JOB_DIMENSION_REPAIR);
+    const longAgo = new Date(Date.now() - jobs.DEFAULT_STALE_MS - 60000).toISOString();
+    await db('maintenance_jobs').where({ job_name: jobs.JOB_DIMENSION_REPAIR }).update({ heartbeat_at: longAgo });
+
+    expect(await jobs.heartbeat(jobs.JOB_DIMENSION_REPAIR, token)).toBe(true);
+
+    expect(await jobs.claim(jobs.JOB_DIMENSION_REPAIR)).toBeNull();
+    expect((await jobs.read(jobs.JOB_DIMENSION_REPAIR)).isRunning).toBe(true);
+  });
+
+  test('release stores the result and read gives it back parsed', async () => {
+    const token = await jobs.claim(jobs.JOB_CAPTURE_DATE_BACKFILL);
+    await jobs.release(jobs.JOB_CAPTURE_DATE_BACKFILL, token, { success: 3, noExif: 2, failed: 1 });
+
+    const state = await jobs.read(jobs.JOB_CAPTURE_DATE_BACKFILL);
+    expect(state.isRunning).toBe(false);
+    expect(state.lastResult).toEqual({ success: 3, noExif: 2, failed: 1 });
+  });
+
+  test('releasing without a result keeps the previous run visible', async () => {
+    const first = await jobs.claim(jobs.JOB_CAPTURE_DATE_BACKFILL);
+    await jobs.release(jobs.JOB_CAPTURE_DATE_BACKFILL, first, { success: 7, noExif: 0, failed: 0 });
+
+    // The "nothing to do" path: claimed, found no candidates, released. It must
+    // not blank the numbers the last real run reported.
+    const second = await jobs.claim(jobs.JOB_CAPTURE_DATE_BACKFILL);
+    await jobs.release(jobs.JOB_CAPTURE_DATE_BACKFILL, second);
+
+    expect((await jobs.read(jobs.JOB_CAPTURE_DATE_BACKFILL)).lastResult).toEqual({ success: 7, noExif: 0, failed: 0 });
+  });
+
+  test('a malformed result does not take the status endpoint down', async () => {
+    await db('maintenance_jobs').where({ job_name: jobs.JOB_DIMENSION_REPAIR }).update({ last_result: 'not json' });
+    const state = await jobs.read(jobs.JOB_DIMENSION_REPAIR);
+    expect(state.lastResult).toBeNull();
+    expect(state.isRunning).toBe(false);
+  });
+
+  test('both status endpoints report the shared row, not process memory', async () => {
+    await jobs.claim(jobs.JOB_DIMENSION_REPAIR);
+    const capToken = await jobs.claim(jobs.JOB_CAPTURE_DATE_BACKFILL);
+    await jobs.release(jobs.JOB_CAPTURE_DATE_BACKFILL, capToken, { success: 1, noExif: 0, failed: 0 });
+
+    // Written straight to the row, exactly as another replica would have.
+    const dim = await dimStatus();
+    expect(dim.status).toBe(200);
+    expect(dim.body.isRunning).toBe(true);
+
+    const cap = await capStatus();
+    expect(cap.status).toBe(200);
+    expect(cap.body.isRunning).toBe(false);
+    expect(cap.body.lastResult).toEqual({ success: 1, noExif: 0, failed: 0 });
+  });
+
+  test('a POST is refused while another replica holds the claim', async () => {
+    // The claim was taken by "another replica" — this process knows nothing
+    // about it beyond the row.
+    await jobs.claim(jobs.JOB_CAPTURE_DATE_BACKFILL);
+
+    const res = await request(app).post('/api/admin/photos/repair-capture-dates');
+    expect(res.status).toBe(409);
+
+    const dimRes = await request(app).post('/api/admin/photos/repair-dimensions');
+    // The other job is untouched by that claim, so it is free to start.
+    expect(dimRes.status).toBe(200);
+  });
+
+  test('the no-op path releases the claim it took', async () => {
+    // No photos at all, so both endpoints take their "nothing to do" exit.
+    await db('photos').del();
+
+    const res = await request(app).post('/api/admin/photos/repair-capture-dates');
+    expect(res.body.count).toBe(0);
+
+    const row = await db('maintenance_jobs').where({ job_name: jobs.JOB_CAPTURE_DATE_BACKFILL }).first();
+    expect(row.is_running).toBeFalsy();
+    // ...and a second POST is therefore accepted rather than 409ing forever.
+    expect((await request(app).post('/api/admin/photos/repair-capture-dates')).status).toBe(200);
+  });
+});

backend/__tests__/integration/maintenanceJobStatePg.test.js

@@ -0,0 +1,102 @@
+/**
+ * PostgreSQL checks for the shared maintenance-job state (#1181).
+ * Gated: runs only when PICPEAK_PG_TEST_URL points at a throwaway database, e.g.
+ *   PICPEAK_PG_TEST_URL="postgres://picpeak:picpeak_secure_pass_2024@127.0.0.1:7102/picpeak_mjs_test" \
+ *     npx jest __tests__/integration/maintenanceJobStatePg.test.js
+ *
+ * What SQLite cannot answer: the claim leans on comparing a `timestamp` column
+ * against an ISO-8601 string, and on an UPDATE ... WHERE guard being atomic
+ * under real concurrent connections. SQLite compares those strings
+ * lexicographically and serialises writes anyway, so it would pass either way —
+ * exactly the shape of divergence that has bitten this repo before.
+ */
+
+const knex = require('knex');
+
+const PG_URL = process.env.PICPEAK_PG_TEST_URL;
+const maybe = PG_URL ? describe : describe.skip;
+
+maybe('maintenance job state on Postgres', () => {
+  let pgDb;
+  let jobs;
+  const JOB = 'photo_dimension_repair';
+
+  beforeAll(async () => {
+    pgDb = knex({ client: 'pg', connection: PG_URL, pool: { min: 0, max: 10 } });
+    await pgDb.raw('DROP TABLE IF EXISTS maintenance_jobs');
+    await require('../../migrations/core/179_maintenance_job_state').up(pgDb);
+
+    jest.resetModules();
+    jest.doMock('../../src/database/db', () => ({ db: pgDb }));
+    jest.doMock('../../src/utils/logger', () => ({
+      debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(),
+    }));
+    jobs = require('../../src/services/maintenanceJobState');
+  }, 60000);
+
+  afterAll(async () => {
+    jest.dontMock('../../src/database/db');
+    if (pgDb) await pgDb.destroy();
+  });
+
+  beforeEach(async () => {
+    await pgDb('maintenance_jobs').update({
+      is_running: false, started_at: null, heartbeat_at: null, finished_at: null, last_result: null, owner: null, claim_token: null,
+    });
+  });
+
+  test('the ISO-string cutoff really compares as a timestamp, not as text', async () => {
+    expect(await jobs.claim(JOB)).toEqual(expect.any(String));
+    expect(await jobs.claim(JOB)).toBeNull();
+
+    await pgDb('maintenance_jobs').where({ job_name: JOB })
+      .update({ heartbeat_at: new Date(Date.now() - jobs.DEFAULT_STALE_MS - 60000).toISOString() });
+
+    // If Postgres had rejected or mis-cast the ISO string this would either
+    // throw or never match.
+    expect(await jobs.claim(JOB)).toEqual(expect.any(String));
+
+    const row = await pgDb('maintenance_jobs').where({ job_name: JOB }).first();
+    expect(row.heartbeat_at).toBeInstanceOf(Date);
+  });
+
+  test('concurrent claims on real connections produce exactly one winner', async () => {
+    // The whole point of the conditional UPDATE. Ten connections race; nine
+    // must lose. SQLite cannot demonstrate this — it serialises writers.
+    const results = await Promise.all(Array.from({ length: 10 }, () => jobs.claim(JOB)));
+    expect(results.filter(Boolean)).toHaveLength(1);
+    // ...and the winner holds a token nobody else can forge.
+    expect(results.find(Boolean)).toEqual(expect.any(String));
+  });
+
+  test('a released job can be re-claimed exactly once again', async () => {
+    const token = await jobs.claim(JOB);
+    await jobs.release(JOB, token, { success: 2, failed: 0 });
+
+    const results = await Promise.all(Array.from({ length: 5 }, () => jobs.claim(JOB)));
+    expect(results.filter(Boolean)).toHaveLength(1);
+    expect((await jobs.read(JOB)).lastResult).toEqual({ success: 2, failed: 0 });
+  });
+
+  test('a superseded runner is fenced out on real Postgres', async () => {
+    const oldToken = await jobs.claim(JOB);
+    await pgDb('maintenance_jobs').where({ job_name: JOB })
+      .update({ heartbeat_at: new Date(Date.now() - jobs.DEFAULT_STALE_MS - 60000).toISOString() });
+    const newToken = await jobs.claim(JOB);
+
+    expect(await jobs.heartbeat(JOB, oldToken)).toBe(false);
+    expect(await jobs.release(JOB, oldToken, { success: 999, failed: 0 })).toBe(false);
+    // The new owner still holds it, with its result unwritten.
+    expect((await jobs.read(JOB)).isRunning).toBe(true);
+    expect(await jobs.release(JOB, newToken, { success: 4, failed: 0 })).toBe(true);
+  });
+
+  test('read() reports a live claim as running and a stale one as not', async () => {
+    await jobs.claim(JOB);
+    expect((await jobs.read(JOB)).isRunning).toBe(true);
+
+    await pgDb('maintenance_jobs').where({ job_name: JOB })
+      .update({ heartbeat_at: new Date(Date.now() - jobs.DEFAULT_STALE_MS - 1000).toISOString() });
+    expect((await jobs.read(JOB)).isRunning).toBe(false);
+  });
+});

backend/__tests__/integration/picpeakCrossEngine.test.js

@@ -0,0 +1,197 @@
+'use strict';
+
+/**
+ * Cross-engine .picpeak restore policy (#1041): a SQLite archive restored onto
+ * a PostgreSQL instance — the official small-install → full-stack upgrade
+ * path — now allowed by validateManifest's direction rule instead of the
+ * former CLI-only allowEngineSwitch flag. The coercion engine itself
+ * (typedColumnsFor / epochToIso / coerceForTargetEngine) landed with #1039;
+ * these tests pin the direction policy and the coercion's cross-engine
+ * value-correctness.
+ *
+ * Ungated: validateManifest direction rules and the pure coercion units.
+ * The reverse direction (pg backup onto a sqlite instance) staying blocked is
+ * pinned by picpeakRoundtrip.test.js, which runs on the real sqlite harness.
+ *
+ * Gated on PICPEAK_PG_TEST_URL (same contract as picpeakRestorePg.test.js):
+ * sqlite-shaped NDJSON rows land in real Postgres with correct stored VALUES,
+ * not just row counts, e.g.
+ *   PICPEAK_PG_TEST_URL="postgres://picpeak:pw@127.0.0.1:7102/picpeak_xengine_test" \
+ *     npx jest __tests__/integration/picpeakCrossEngine.test.js
+ */
+const knexLib = require('knex');
+
+describe('validateManifest cross-engine direction (pg target)', () => {
+  let validateManifest;
+
+  beforeAll(() => {
+    jest.resetModules();
+    jest.doMock('../../knexfile', () => ({ client: 'pg' }));
+    // validateManifest wraps its knex_migrations lookup in try/catch — a
+    // throwing stub simply skips the forward-only check, which is not under
+    // test here.
+    jest.doMock('../../src/database/db', () => ({ db: () => { throw new Error('stub'); } }));
+    ({ validateManifest } = require('../../src/services/picpeakImportService'));
+  });
+
+  afterAll(() => {
+    jest.dontMock('../../src/database/db');
+    jest.dontMock('../../knexfile');
+    jest.resetModules();
+  });
+
+  it('allows a sqlite backup onto a pg instance (upgrade direction)', async () => {
+    const blockers = await validateManifest({
+      kind: 'picpeak-backup', format: 1, database: { engine: 'sqlite' }, tables: {},
+    });
+    expect(blockers.filter((b) => /engine/i.test(b))).toHaveLength(0);
+  });
+
+  it('still allows same-engine pg → pg', async () => {
+    const blockers = await validateManifest({
+      kind: 'picpeak-backup', format: 1, database: { engine: 'pg' }, tables: {},
+    });
+    expect(blockers.filter((b) => /engine/i.test(b))).toHaveLength(0);
+  });
+});
+
+describe('epochToIso (landed with #1039)', () => {
+  let epochToIso;
+
+  beforeAll(() => {
+    jest.resetModules();
+    ({ epochToIso } = require('../../src/services/picpeakImportService'));
+  });
+
+  it('converts epoch milliseconds', () => {
+    expect(epochToIso(1723400000000)).toBe('2024-08-11T18:13:20.000Z');
+  });
+
+  it('converts epoch SECONDS to the same instant, not January 1970', () => {
+    expect(epochToIso(1723400000)).toBe('2024-08-11T18:13:20.000Z');
+  });
+
+  it('converts numeric strings', () => {
+    expect(epochToIso('1723400000000')).toBe('2024-08-11T18:13:20.000Z');
+  });
+
+  it('passes non-numeric values through untouched', () => {
+    expect(epochToIso('2026-08-12 10:00:00')).toBe('2026-08-12 10:00:00');
+  });
+});
+
+describe('coerceForTargetEngine on sqlite-shaped rows', () => {
+  let coerceForTargetEngine;
+
+  beforeAll(() => {
+    jest.resetModules();
+    ({ coerceForTargetEngine } = require('../../src/services/picpeakImportService'));
+  });
+
+  const types = { timestamps: ['created_at', 'expires_at'], booleans: ['is_active'] };
+
+  it('coerces 0/1 booleans and epoch timestamps, leaves date strings alone', () => {
+    const [row] = coerceForTargetEngine(
+      [{ id: 1, is_active: 1, created_at: 1723400000000, expires_at: '2026-09-01 12:00:00' }],
+      types
+    );
+    expect(row.is_active).toBe(true);
+    expect(row.created_at).toBe('2024-08-11T18:13:20.000Z');
+    expect(row.expires_at).toBe('2026-09-01 12:00:00'); // pg parses this natively
+  });
+
+  it('coerces falsy variants and passes null/empty through', () => {
+    const [row] = coerceForTargetEngine(
+      [{ is_active: 0, created_at: null, expires_at: '' }],
+      types
+    );
+    expect(row.is_active).toBe(false);
+    expect(row.created_at).toBeNull();
+    expect(row.expires_at).toBe('');
+  });
+});
+
+// ── Real-Postgres integration (gated) ────────────────────────────────────────
+const PG_URL = process.env.PICPEAK_PG_TEST_URL;
+const maybe = PG_URL ? describe : describe.skip;
+
+maybe('sqlite-shaped rows land correctly in real Postgres', () => {
+  let pgDb;
+  let svc;
+
+  beforeAll(async () => {
+    pgDb = knexLib({ client: 'pg', connection: PG_URL });
+    await pgDb.raw('DROP TABLE IF EXISTS xengine_events, xengine_settings CASCADE');
+    await pgDb.schema.createTable('xengine_events', (t) => {
+      t.increments('id');
+      t.string('slug');
+      t.boolean('is_active').defaultTo(true);
+      t.boolean('allow_downloads').defaultTo(true);
+      t.timestamp('created_at');
+      t.timestamp('expires_at');
+    });
+    await pgDb.schema.createTable('xengine_settings', (t) => {
+      t.increments('id');
+      t.string('setting_key').notNullable().unique();
+      t.jsonb('setting_value');
+    });
+
+    jest.resetModules();
+    jest.doMock('../../knexfile', () => ({ client: 'pg' }));
+    jest.doMock('../../src/database/db', () => ({ db: pgDb }));
+    svc = require('../../src/services/picpeakImportService');
+  });
+
+  afterAll(async () => {
+    jest.dontMock('../../src/database/db');
+    jest.dontMock('../../knexfile');
+    if (pgDb) {
+      await pgDb.raw('DROP TABLE IF EXISTS xengine_events, xengine_settings CASCADE');
+      await pgDb.destroy();
+    }
+  });
+
+  it('typedColumnsFor classifies boolean and timestamp columns via columnInfo()', async () => {
+    const types = await svc.typedColumnsFor(pgDb, 'xengine_events');
+    expect(types.booleans.sort()).toEqual(['allow_downloads', 'is_active']);
+    expect(types.timestamps.sort()).toEqual(['created_at', 'expires_at']);
+  });
+
+  it('inserts a sqlite archive row (0/1 booleans, epoch dates, json text) with correct stored values', async () => {
+    // Exactly what a sqlite-created .picpeak carries: integers for booleans,
+    // epoch numbers for #485-shape timestamps (ms here, seconds covered by the
+    // epochToIso unit), a "YYYY-MM-DD HH:MM:SS" string for clean ones, and
+    // json columns as TEXT (the crossEngine path skips serialiseJsonColumns —
+    // the text is already what pg wants).
+    const epoch = 1723400000000;
+    const eventRows = [
+      { id: 1, slug: 'wedding', is_active: 1, allow_downloads: 0, created_at: epoch, expires_at: '2026-09-01 12:00:00' },
+    ];
+    const settingRows = [{ id: 1, setting_key: 'brand', setting_value: '{"name":"PicPeak","dark":true}' }];
+
+    await pgDb.transaction(async (trx) => {
+      const evTypes = await svc.typedColumnsFor(trx, 'xengine_events');
+      await trx.batchInsert('xengine_events', svc.coerceForTargetEngine(eventRows, evTypes), 100);
+      const stTypes = await svc.typedColumnsFor(trx, 'xengine_settings');
+      await trx.batchInsert('xengine_settings', svc.coerceForTargetEngine(settingRows, stTypes), 100);
+    });
+
+    const ev = await pgDb('xengine_events').where({ id: 1 }).first();
+    expect(ev.is_active).toBe(true);          // 1 → true, not backwards (#1028 class)
+    expect(ev.allow_downloads).toBe(false);   // 0 → false
+    expect(new Date(ev.created_at).getTime()).toBe(epoch);
+    expect(new Date(ev.expires_at).toISOString().slice(0, 10)).toBe('2026-09-01');
+
+    const st = await pgDb('xengine_settings').where({ id: 1 }).first();
+    // jsonb parsed back by the driver — value intact, no double encoding.
+    expect(st.setting_value).toEqual({ name: 'PicPeak', dark: true });
+  });
+
+  it('id sequence works after explicit-id insert + resync (next natural insert)', async () => {
+    await svc.resyncSequences(['xengine_events']);
+    const [next] = await pgDb('xengine_events')
+      .insert({ slug: 'fresh', is_active: true })
+      .returning('id');
+    expect(Number(next.id || next)).toBe(2);
+  });
+});

backend/__tests__/integration/picpeakExport.test.js

@@ -0,0 +1,94 @@
+'use strict';
+
+// Validates the engine-neutral .picpeak export: it must produce a real zip with
+// a manifest + per-table NDJSON, exclude knex bookkeeping, and honour the photo
+// toggle. Uses the shared CRM DB harness (temp SQLite) — no docker needed.
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'test-secret-at-least-32-characters-long!!';
+
+const fs = require('fs');
+const path = require('path');
+const StreamZip = require('node-stream-zip');
+const { bootCrmDb } = require('./helpers/crmDb');
+
+let db;
+let cleanup;
+let tmpDir;
+let createPicpeak;
+
+// bootCrmDb MUST run before requiring the service (which transitively requires
+// db.js) so the export reads this test's DB, not the default path.
+beforeAll(async () => {
+  ({ db, cleanup, tmpDir } = await bootCrmDb());
+  process.env.STORAGE_PATH = tmpDir; // isolate file collection to the temp dir
+  ({ createPicpeak } = require('../../src/services/picpeakExportService'));
+}, 120000);
+
+afterAll(async () => {
+  await cleanup();
+});
+
+async function readZip(filePath) {
+  const zip = new StreamZip.async({ file: filePath });
+  const entries = Object.keys(await zip.entries());
+  const manifest = JSON.parse((await zip.entryData('manifest.json')).toString('utf8'));
+  await zip.close();
+  return { entries, manifest };
+}
+
+describe('picpeak export (.picpeak logical export)', () => {
+  it('produces a .picpeak with a manifest and per-table NDJSON', async () => {
+    const { filePath, manifest } = await createPicpeak({ includePhotos: false });
+    try {
+      expect(filePath.endsWith('.picpeak')).toBe(true);
+      expect(fs.existsSync(filePath)).toBe(true);
+
+      expect(manifest.format).toBe(1);
+      expect(manifest.kind).toBe('picpeak-backup');
+      expect(manifest.database.engine).toBe('sqlite');
+      expect(manifest.options.includePhotos).toBe(false);
+      expect(manifest.contains_secrets).toBe(true);
+      // Migrations seed real tables (e.g. app_settings) — expect several.
+      expect(Object.keys(manifest.tables).length).toBeGreaterThan(0);
+      expect(Object.keys(manifest.tables)).toContain('app_settings');
+
+      const { entries, manifest: zipped } = await readZip(filePath);
+      expect(entries).toContain('manifest.json');
+      expect(entries.some((n) => n.startsWith('data/') && n.endsWith('.ndjson'))).toBe(true);
+      expect(entries).toContain('data/app_settings.ndjson');
+      // Manifest inside the zip matches the returned one.
+      expect(zipped.tables).toEqual(manifest.tables);
+    } finally {
+      fs.rmSync(path.dirname(filePath), { recursive: true, force: true });
+    }
+  });
+
+  it('never exports knex bookkeeping tables', async () => {
+    const { filePath, manifest } = await createPicpeak({ includePhotos: false });
+    try {
+      const names = Object.keys(manifest.tables);
+      expect(names).not.toContain('knex_migrations');
+      expect(names).not.toContain('knex_migrations_lock');
+    } finally {
+      fs.rmSync(path.dirname(filePath), { recursive: true, force: true });
+    }
+  });
+
+  it('row counts in the manifest match the NDJSON line counts', async () => {
+    // Insert a couple of settings so at least one table is non-empty.
+    await db('app_settings')
+      .insert({ setting_key: 'picpeak_export_test_a', setting_value: JSON.stringify('1'), setting_type: 'string' })
+      .onConflict('setting_key').merge();
+
+    const { filePath, manifest } = await createPicpeak({ includePhotos: false });
+    try {
+      const zip = new StreamZip.async({ file: filePath });
+      const buf = await zip.entryData('data/app_settings.ndjson');
+      await zip.close();
+      const lines = buf.toString('utf8').split('\n').filter((l) => l.trim().length > 0);
+      expect(lines.length).toBe(manifest.tables.app_settings.rowCount);
+      expect(manifest.tables.app_settings.rowCount).toBeGreaterThan(0);
+    } finally {
+      fs.rmSync(path.dirname(filePath), { recursive: true, force: true });
+    }
+  });
+});

backend/__tests__/integration/picpeakRoundtrip.test.js

@@ -0,0 +1,180 @@
+'use strict';
+
+// Full .picpeak roundtrip on a temp SQLite DB:
+//   1. seed a "backup" instance (admin A + a marker setting)
+//   2. export → .picpeak
+//   3. simulate a reinstall: wipe, create a DIFFERENT current admin B, mutate data
+//   4. import the backup with currentAdminId = B
+//   5. assert the backup data is restored AND the current account (B) survives,
+//      while the backup's admin (A) is also present (different email → added).
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'test-secret-at-least-32-characters-long!!';
+
+const fs = require('fs');
+const path = require('path');
+const { bootCrmDb } = require('./helpers/crmDb');
+
+let db;
+let cleanup;
+let tmpDir;
+let createPicpeak;
+let importFromPicpeak;
+let validateManifest;
+let superAdminRoleId;
+
+beforeAll(async () => {
+  ({ db, cleanup, tmpDir } = await bootCrmDb());
+  process.env.STORAGE_PATH = tmpDir;
+  ({ createPicpeak } = require('../../src/services/picpeakExportService'));
+  ({ importFromPicpeak, validateManifest } = require('../../src/services/picpeakImportService'));
+  const role = await db('roles').where({ name: 'super_admin' }).first();
+  superAdminRoleId = role.id;
+}, 120000);
+
+afterAll(async () => {
+  await cleanup();
+});
+
+const adminRow = (email, hash) => ({
+  username: email,
+  email,
+  password_hash: hash,
+  role_id: superAdminRoleId,
+  is_active: true,
+  must_change_password: false,
+  created_at: new Date(),
+  updated_at: new Date(),
+});
+
+async function setMarker(value) {
+  await db('app_settings')
+    .insert({ setting_key: 'roundtrip_marker', setting_value: JSON.stringify(value), setting_type: 'string' })
+    .onConflict('setting_key').merge();
+}
+async function getMarker() {
+  const row = await db('app_settings').where({ setting_key: 'roundtrip_marker' }).first();
+  return row ? JSON.parse(row.setting_value) : null;
+}
+
+describe('.picpeak roundtrip (export → import)', () => {
+  it('restores backup data and preserves the current account', async () => {
+    // 1. Seed the "source" instance.
+    await db('admin_users').del();
+    await db('admin_users').insert(adminRow('backup-admin@old.example', 'HASH_A'));
+    await setMarker('from_backup');
+
+    // 2. Export.
+    const { filePath } = await createPicpeak({ includePhotos: false });
+
+    try {
+      // 3. Simulate a reinstall: fresh current admin B, mutated data.
+      await db('admin_users').del();
+      const [bId] = await db('admin_users').insert(adminRow('current-admin@new.example', 'HASH_B')).returning('id');
+      const currentAdminId = typeof bId === 'object' ? bId.id : bId;
+      await setMarker('mutated_after_backup');
+
+      // 4. Import, preserving the current admin.
+      const result = await importFromPicpeak({ filePath: undefined, picpeakPath: filePath, currentAdminId });
+      expect(result.restored).toBe(true);
+      expect(result.tables).toBeGreaterThan(0);
+
+      // 5a. Backup data restored (marker reverted to the backup value).
+      expect(await getMarker()).toBe('from_backup');
+
+      // 5b. The backup's admin is present (different email → added).
+      const a = await db('admin_users').whereRaw('lower(email) = lower(?)', ['backup-admin@old.example']).first();
+      expect(a).toBeTruthy();
+      expect(a.password_hash).toBe('HASH_A');
+
+      // 5c. The current account SURVIVES the override, with its own credentials.
+      const b = await db('admin_users').whereRaw('lower(email) = lower(?)', ['current-admin@new.example']).first();
+      expect(b).toBeTruthy();
+      expect(b.password_hash).toBe('HASH_B');
+    } finally {
+      fs.rmSync(path.dirname(filePath), { recursive: true, force: true });
+    }
+  });
+
+  it('overwrites a backup admin that collides with the current account email', async () => {
+    // Source has an admin at the SAME email the current operator will use.
+    await db('admin_users').del();
+    await db('admin_users').insert(adminRow('shared@example.com', 'OLD_HASH'));
+    await setMarker('collision_case');
+    const { filePath } = await createPicpeak({ includePhotos: false });
+
+    try {
+      // Reinstall: current admin uses the same email but a NEW password.
+      await db('admin_users').del();
+      const [id] = await db('admin_users').insert(adminRow('shared@example.com', 'NEW_HASH')).returning('id');
+      const currentAdminId = typeof id === 'object' ? id.id : id;
+
+      await importFromPicpeak({ picpeakPath: filePath, currentAdminId });
+
+      // Exactly one admin at that email, and it keeps the CURRENT password.
+      const rows = await db('admin_users').whereRaw('lower(email) = lower(?)', ['shared@example.com']);
+      expect(rows).toHaveLength(1);
+      expect(rows[0].password_hash).toBe('NEW_HASH');
+    } finally {
+      fs.rmSync(path.dirname(filePath), { recursive: true, force: true });
+    }
+  });
+
+  it('restores files/ and reports filesRestored', async () => {
+    // A business-doc that lives in storage → travels in the backup.
+    const docDir = path.join(tmpDir, 'business-docs');
+    const marker = path.join(docDir, 'roundtrip-doc.txt');
+    fs.mkdirSync(docDir, { recursive: true });
+    fs.writeFileSync(marker, 'hello');
+    await db('admin_users').del();
+    const [id] = await db('admin_users').insert(adminRow('files@example.com', 'H')).returning('id');
+    const currentAdminId = typeof id === 'object' ? id.id : id;
+
+    const { filePath } = await createPicpeak({ includePhotos: false });
+    try {
+      fs.rmSync(marker); // delete on disk so the restore must bring it back
+      const result = await importFromPicpeak({ picpeakPath: filePath, currentAdminId });
+      expect(result.filesRestored).toBeGreaterThanOrEqual(1);
+      expect(fs.existsSync(marker)).toBe(true);
+      expect(fs.readFileSync(marker, 'utf8')).toBe('hello');
+    } finally {
+      fs.rmSync(path.dirname(filePath), { recursive: true, force: true });
+      fs.rmSync(docDir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('.picpeak manifest validation', () => {
+  it('rejects a database-engine mismatch', async () => {
+    // Harness runs on SQLite, so a pg manifest must be refused.
+    const blockers = await validateManifest({
+      kind: 'picpeak-backup', format: 1, database: { engine: 'pg' }, tables: {},
+    });
+    expect(blockers.some((b) => /engine/i.test(b))).toBe(true);
+  });
+
+  it('rejects a backup from a newer schema (forward-only)', async () => {
+    // validateManifest reads knex_migrations for the target's latest migration;
+    // the harness has none, so create it with an older migration than the backup.
+    await db.schema.createTable('knex_migrations', (t) => {
+      t.increments('id');
+      t.string('name');
+      t.integer('batch');
+      t.timestamp('migration_time');
+    });
+    try {
+      await db('knex_migrations').insert({ name: '100_baseline', batch: 1 });
+      const blockers = await validateManifest({
+        kind: 'picpeak-backup', format: 1,
+        database: { engine: 'sqlite', latest_migration: '999_from_the_future' },
+        tables: {},
+      });
+      expect(blockers.some((b) => /newer/i.test(b))).toBe(true);
+    } finally {
+      await db.schema.dropTableIfExists('knex_migrations');
+    }
+  });
+
+  it('rejects a file that is not a PicPeak backup', async () => {
+    const blockers = await validateManifest({ some: 'random-json' });
+    expect(blockers.length).toBeGreaterThan(0);
+  });
+});

backend/__tests__/integration/publishPasswordPolicy.test.js

@@ -0,0 +1,114 @@
+/**
+ * Publishing must not be a way around the configured gallery password policy.
+ *
+ * `POST /:id/publish` (#627) re-hashes `password_hash` from a plaintext the
+ * admin re-types in the publish dialog, and validated it with nothing but
+ * express-validator's `isLength({ min: 6 })`. So the configured complexity —
+ * moderate by default, meaning 8 characters plus upper, lower and a digit —
+ * governed event creation and password reset, while this door accepted
+ * `aaaaaa` and made it the live gallery password.
+ *
+ * Not an escalation: it needs admin auth plus events.edit, and such an admin
+ * could already set a weak password elsewhere. It is a policy gap — the admin
+ * UI advertises a complexity level this write path did not enforce.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-pubpolicy-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'publish-policy-test-secret';
+process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-pubpolicy-storage-'));
+
+const request = require('supertest');
+const {
+  bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken, buildRouteApp,
+} = require('./helpers/crmDb');
+
+describe('publish enforces the gallery password policy', () => {
+  let db; let cleanup; let app; let token;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    const { adminId } = await seedMinimal(db);
+    await assignAdminRole(db, adminId, 'admin');
+    token = mintAdminToken(adminId);
+    app = buildRouteApp('/admin/events', require('../../src/routes/adminEvents'));
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  async function seedDraft(slug) {
+    const [row] = await db('events').insert({
+      slug,
+      event_type: 'wedding',
+      event_name: `Event ${slug}`,
+      event_date: '2026-09-01',
+      host_email: 'client@example.com',
+      admin_email: 'admin@example.com',
+      password_hash: 'original-hash',
+      require_password: 1,
+      share_link: `/gallery/${slug}/share`,
+      share_token: `${slug}-token`,
+      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+      is_active: 1,
+      is_archived: 0,
+      is_draft: 1,
+      created_at: new Date().toISOString(),
+    }).returning('id');
+    return typeof row === 'object' ? row.id : row;
+  }
+
+  it('refuses a password that misses the configured complexity', async () => {
+    const id = await seedDraft('weak-publish');
+
+    const res = await request(app)
+      .post(`/admin/events/${id}/publish`)
+      .set('Authorization', `Bearer ${token}`)
+      .send({ password: 'aaaaaa' });
+
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/security requirements/i);
+
+    // Rejected BEFORE the write, not after — the gallery must be untouched,
+    // and still a draft.
+    const after = await db('events').where({ id }).first();
+    expect(after.password_hash).toBe('original-hash');
+    expect(after.is_draft === 1 || after.is_draft === true).toBe(true);
+  });
+
+  it('still accepts a password that meets it', async () => {
+    const id = await seedDraft('strong-publish');
+
+    const res = await request(app)
+      .post(`/admin/events/${id}/publish`)
+      .set('Authorization', `Bearer ${token}`)
+      .send({ password: 'Sup3r-Secret' });
+
+    expect(res.status).toBe(200);
+
+    const bcrypt = require('bcrypt');
+    const after = await db('events').where({ id }).first();
+    expect(after.password_hash).not.toBe('original-hash');
+    expect(await bcrypt.compare('Sup3r-Secret', after.password_hash)).toBe(true);
+  });
+
+  it('leaves a publish without a password alone', async () => {
+    // The legacy sentinel path: no password in the body means no rehash, so
+    // the policy has nothing to check and must not block the publish.
+    const id = await seedDraft('no-password-publish');
+
+    const res = await request(app)
+      .post(`/admin/events/${id}/publish`)
+      .set('Authorization', `Bearer ${token}`)
+      .send({});
+
+    expect(res.status).toBe(200);
+    const after = await db('events').where({ id }).first();
+    expect(after.password_hash).toBe('original-hash');
+  });
+});

backend/__tests__/integration/regenerateThumbnailsScript.test.js

@@ -0,0 +1,260 @@
+/**
+ * scripts/regenerate-thumbnails.js against external photos (#1148).
+ *
+ * The same defect #1129 fixed in the admin route, still standing in the CLI
+ * fallback: the script resolved every source as
+ * `storage/events/active/<photo.path>` and fs.access'd it. External and
+ * reference rows do not live there — their originals sit under
+ * `events.external_path` — so every one failed the check and was counted as an
+ * error. On an install where all photos are external the script did nothing at
+ * all, while reporting one error per photo.
+ *
+ * Driven against a REAL file on a REAL external mount with the real
+ * imageProcessor, not a mock: the whole point is that the source resolves off
+ * the mount, and a mocked ensureThumbnail would assert nothing about that.
+ *
+ * Responsive tiers (#1095/#1109) do not exist on this branch, so the tier
+ * backfill in the main twin has nothing to port. Everything else does.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const sharp = require('sharp');
+const { execFile } = require('child_process');
+
+describe('regenerate-thumbnails script (#1148)', () => {
+  let tmpDir; let db; let cleanup; let regenerateThumbnails;
+  let eventId; let externalPhotoId; let videoPhotoId; let watcherVideoId; let repairPhotoId;
+  let vanishingPhotoId;
+  let externalRoot;
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-regen-script-'));
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'test.db');
+    process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+    // External sources are sandboxed under EXTERNAL_MEDIA_ROOT. Rows carry a
+    // path relative to that root (#1163), so the 'wedding/' prefix on each
+    // external_relpath below is the event folder, not decoration.
+    process.env.EXTERNAL_MEDIA_ROOT = path.join(tmpDir, 'media');
+    externalRoot = path.join(process.env.EXTERNAL_MEDIA_ROOT, 'wedding');
+
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    await fs.promises.mkdir(process.env.STORAGE_PATH, { recursive: true });
+    await fs.promises.mkdir(externalRoot, { recursive: true });
+
+    jest.resetModules();
+    ({ db, cleanup } = await require('./helpers/crmDb').bootCrmDb());
+
+    // A real image on the external mount — never under events/active.
+    await sharp({
+      create: { width: 1200, height: 800, channels: 3, background: { r: 10, g: 90, b: 160 } },
+    }).jpeg().toFile(path.join(externalRoot, 'shot.jpg'));
+
+    const [ev] = await db('events').insert({
+      slug: 'regen-script-event',
+      event_type: 'wedding',
+      event_name: 'Regen Script',
+      event_date: '2026-08-01',
+      host_email: 'h@example.com',
+      admin_email: 'a@example.com',
+      password_hash: 'x',
+      share_link: '/gallery/regen-script-event/share',
+      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+      source_mode: 'reference',
+      external_path: 'wedding',
+      created_at: new Date().toISOString(),
+    }).returning('id');
+    eventId = typeof ev === 'object' ? ev.id : ev;
+
+    const [p] = await db('photos').insert({
+      event_id: eventId,
+      filename: 'shot.jpg',
+      // `path` is what the old script joined onto events/active. Left
+      // populated on purpose: the fix must ignore it for an external row.
+      path: 'regen-script-event/shot.jpg',
+      type: 'individual',
+      source_origin: 'external',
+      external_relpath: 'wedding/shot.jpg',
+      uploaded_at: new Date().toISOString(),
+    }).returning('id');
+    externalPhotoId = typeof p === 'object' ? p.id : p;
+
+    const [v] = await db('photos').insert({
+      event_id: eventId,
+      filename: 'clip.mp4',
+      path: 'regen-script-event/clip.mp4',
+      type: 'individual',
+      media_type: 'video',
+      mime_type: 'video/mp4',
+      source_origin: 'external',
+      external_relpath: 'wedding/clip.mp4',
+      uploaded_at: new Date().toISOString(),
+    }).returning('id');
+    videoPhotoId = typeof v === 'object' ? v.id : v;
+
+    // How fileWatcher.processNewPhoto actually writes a video: `type` and
+    // `mime_type` set, media_type left to its 'image' default. A media_type-only
+    // filter lets this through and hands the container to Sharp.
+    //
+    // The file has to EXIST, otherwise the row fails resolution and looks
+    // skipped for the wrong reason — the bug is Sharp being handed a video, not
+    // a missing source. Real MP4 header bytes, no image in sight.
+    await fs.promises.writeFile(
+      path.join(externalRoot, 'watched.mp4'),
+      Buffer.from('00000018667479706d70343200000000', 'hex')
+    );
+    const [wv] = await db('photos').insert({
+      event_id: eventId,
+      filename: 'watched.mp4',
+      path: 'regen-script-event/watched.mp4',
+      type: 'video',
+      mime_type: 'video/mp4',
+      source_origin: 'external',
+      external_relpath: 'wedding/watched.mp4',
+      uploaded_at: new Date().toISOString(),
+    }).returning('id');
+    watcherVideoId = typeof wv === 'object' ? wv.id : wv;
+    expect((await db('photos').where('id', watcherVideoId).first()).media_type).not.toBe('video');
+
+    // A photo whose thumbnail_path points at something that is no longer there.
+    await sharp({
+      create: { width: 900, height: 600, channels: 3, background: { r: 200, g: 40, b: 40 } },
+    }).jpeg().toFile(path.join(externalRoot, 'repair.jpg'));
+    const [rp] = await db('photos').insert({
+      event_id: eventId,
+      filename: 'repair.jpg',
+      path: 'regen-script-event/repair.jpg',
+      type: 'individual',
+      thumbnail_path: 'thumbnails/thumb_ext_missing_repair.jpg',
+      source_origin: 'external',
+      external_relpath: 'wedding/repair.jpg',
+      uploaded_at: new Date().toISOString(),
+    }).returning('id');
+    repairPhotoId = typeof rp === 'object' ? rp.id : rp;
+
+    // A photo whose source is not on the mount at all — an unavailable mount,
+    // which is the failure an operator most needs to hear about.
+    const [vp] = await db('photos').insert({
+      event_id: eventId,
+      filename: 'missing.jpg',
+      path: 'regen-script-event/missing.jpg',
+      type: 'individual',
+      source_origin: 'external',
+      external_relpath: 'missing.jpg',
+      uploaded_at: new Date().toISOString(),
+    }).returning('id');
+    vanishingPhotoId = typeof vp === 'object' ? vp.id : vp;
+
+    ({ regenerateThumbnails } = require('../../scripts/regenerate-thumbnails'));
+  }, 180000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  it('builds a thumbnail for an external photo instead of erroring on events/active', async () => {
+    // The location the old script computed and fs.access'd. Nothing is there,
+    // which is the whole defect — it is not where an external original lives.
+    // (The old script cannot be driven from a test directly: it had no export
+    // and ran on require, calling process.exit. Making it importable is part
+    // of this fix.)
+    const legacyPath = path.join(process.env.STORAGE_PATH, 'events/active', 'regen-script-event/shot.jpg');
+    expect(fs.existsSync(legacyPath)).toBe(false);
+
+    const result = await regenerateThumbnails(eventId);
+
+    // The old script reported an error for this photo and wrote nothing.
+    // The unresolvable row fails; the external photo and the repair row build.
+    expect(result.errorCount).toBe(1);
+    expect(result.successCount).toBe(2);
+
+    const row = await db('photos').where('id', externalPhotoId).first();
+    expect(row.thumbnail_path).toBeTruthy();
+    const onDisk = path.join(process.env.STORAGE_PATH, row.thumbnail_path);
+    expect(fs.existsSync(onDisk)).toBe(true);
+
+    // Named per-photo so two events referencing one NAS basename cannot
+    // clobber each other — the property ensureThumbnail owns and the reason
+    // the script must not build this name itself.
+    expect(path.basename(row.thumbnail_path)).toContain(`ext${externalPhotoId}_`);
+  });
+
+  it('leaves videos alone', async () => {
+    // A video thumbnail is a poster frame from videoProcessor; handing the
+    // container to Sharp produced one error per video row.
+    const row = await db('photos').where('id', videoPhotoId).first();
+    expect(row.thumbnail_path).toBeFalsy();
+  });
+
+  it('leaves a watcher-imported video alone, which carries no media_type', async () => {
+    // fileWatcher writes type + mime_type and lets media_type default to
+    // 'image', so filtering on media_type alone still fed these to Sharp. The
+    // signal is errorCount: the images are already done by now, so the only
+    // NEW thing that could fail this run is a video reaching Sharp. One error
+    // is the deliberately unresolvable row; two would be the video.
+    const result = await regenerateThumbnails(eventId);
+
+    expect(result.errorCount).toBe(1);
+    const row = await db('photos').where('id', watcherVideoId).first();
+    expect(row.thumbnail_path).toBeFalsy();
+  });
+
+  it('is idempotent — a second run skips instead of rebuilding', async () => {
+    const before = await db('photos').where('id', externalPhotoId).first();
+    const result = await regenerateThumbnails(eventId);
+
+    expect(result.errorCount).toBe(1);
+    expect(result.successCount).toBe(0);
+    expect(result.skipCount).toBe(2);
+
+    const after = await db('photos').where('id', externalPhotoId).first();
+    expect(after.thumbnail_path).toBe(before.thumbnail_path);
+  });
+
+  it('counts a repaired thumbnail as generated, not skipped', async () => {
+    // Both images are valid at this point. Destroy ONE thumbnail object while
+    // leaving thumbnail_path pointing at it — the corrupt/missing case.
+    const row = await db('photos').where('id', repairPhotoId).first();
+    const onDisk = path.join(process.env.STORAGE_PATH, row.thumbnail_path);
+    await fs.promises.rm(onDisk);
+
+    const result = await regenerateThumbnails(eventId);
+
+    // On local and external storage the rebuilt key is identical, so inferring
+    // "skipped" from an unchanged path reports this repair as already valid —
+    // the one number an operator running this is actually reading.
+    expect(result.successCount).toBe(1);
+    expect(result.skipCount).toBe(1);
+    expect(result.errorCount).toBe(1);
+    expect(fs.existsSync(onDisk)).toBe(true);
+  });
+
+  /** Run the CLI the way cron does, and hand back its exit status. */
+  const runCli = (args = []) => new Promise((resolve) => {
+    execFile(
+      process.execPath,
+      [path.join(__dirname, '..', '..', 'scripts', 'regenerate-thumbnails.js'), ...args],
+      { env: { ...process.env }, cwd: path.join(__dirname, '..', '..') },
+      (error, stdout, stderr) => resolve({ code: error?.code ?? 0, stdout, stderr })
+    );
+  });
+
+  it('exits nonzero when a photo could not be built', async () => {
+    // Exit status is the only thing a cron job reads, and `missing.jpg` has no
+    // source on the mount.
+    const failed = await runCli([String(eventId)]);
+    expect(failed.code).toBe(1);
+    expect(failed.stderr).toContain('completed with failures');
+  }, 120000);
+
+  it('exits zero when every photo resolves', async () => {
+    // Drop the unresolvable row: a clean run must not cry wolf at automation.
+    await db('photos').where('id', vanishingPhotoId).del();
+    const ok = await runCli([String(eventId)]);
+    expect(ok.code).toBe(0);
+    expect(ok.stdout).toContain('Script completed successfully');
+  }, 120000);
+});

backend/__tests__/integration/resetAdminMfaCli.test.js

@@ -0,0 +1,82 @@
+/**
+ * CLI test for scripts/reset-admin-mfa.js — break-glass MFA reset (#738).
+ *
+ * Boots a temp-SQLite DB, seeds an admin with MFA fully enabled, then runs
+ * the script in a child process (--email <addr> --yes) pointed at the same
+ * DB file, and asserts the four MFA columns are zeroed. The script runs in
+ * its own process with its own knex connection; the parent connection is
+ * idle during the spawn so the SQLite write lock isn't contended.
+ */
+
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const { bootCrmDb } = require('./helpers/crmDb');
+
+jest.setTimeout(120000);
+
+let db;
+let cleanup;
+
+beforeAll(async () => {
+  ({ db, cleanup } = await bootCrmDb());
+}, 120000);
+
+afterAll(async () => {
+  if (cleanup) await cleanup();
+});
+
+const SCRIPT = path.resolve(__dirname, '..', '..', 'scripts', 'reset-admin-mfa.js');
+
+async function seedEnrolledAdmin(email) {
+  const inserted = await db('admin_users').insert({
+    username: email.split('@')[0],
+    email,
+    password_hash: 'x',
+    is_active: true,
+    two_factor_enabled: true,
+    two_factor_secret: 'iv.tag.ct',
+    two_factor_recovery_codes: JSON.stringify(['$2b$10$fakehashfakehashfakehashfa']),
+    two_factor_enrolled_at: new Date(),
+    created_at: new Date(),
+  }).returning('id');
+  return inserted[0]?.id ?? inserted[0];
+}
+
+it('zeroes the four MFA columns for the targeted admin', async () => {
+  const email = 'reset-me@example.com';
+  const id = await seedEnrolledAdmin(email);
+
+  execFileSync('node', [SCRIPT, '--email', email, '--yes'], {
+    env: {
+      ...process.env,
+      NODE_ENV: 'test',
+      TEST_DATABASE_PATH: process.env.TEST_DATABASE_PATH,
+    },
+    stdio: 'pipe',
+  });
+
+  const row = await db('admin_users').where({ id }).first();
+  expect(Number(row.two_factor_enabled)).toBe(0);
+  expect(row.two_factor_secret).toBeNull();
+  expect(row.two_factor_recovery_codes).toBeNull();
+  expect(row.two_factor_enrolled_at).toBeNull();
+});
+
+it('leaves a different admin untouched', async () => {
+  const targetEmail = 'target@example.com';
+  const bystanderEmail = 'bystander@example.com';
+  const targetId = await seedEnrolledAdmin(targetEmail);
+  const bystanderId = await seedEnrolledAdmin(bystanderEmail);
+
+  execFileSync('node', [SCRIPT, '--email', targetEmail, '--yes'], {
+    env: { ...process.env, NODE_ENV: 'test', TEST_DATABASE_PATH: process.env.TEST_DATABASE_PATH },
+    stdio: 'pipe',
+  });
+
+  const target = await db('admin_users').where({ id: targetId }).first();
+  const bystander = await db('admin_users').where({ id: bystanderId }).first();
+  expect(Number(target.two_factor_enabled)).toBe(0);
+  expect(Number(bystander.two_factor_enabled)).toBe(1);
+  expect(bystander.two_factor_secret).toBe('iv.tag.ct');
+});

backend/__tests__/integration/restoreService.pgBranch.test.js

@@ -0,0 +1,261 @@
+/**
+ * Pins the fix for the PR #596 review blocker.
+ *
+ * **The bug**
+ *
+ *   `preservedMeta` was declared with `let` INSIDE the PostgreSQL
+ *   `else` branch of `performDatabaseRestore`, then read AFTER the
+ *   `else` block closed at the shared replay site (~L1030). On every
+ *   real PG restore:
+ *
+ *     ReferenceError: preservedMeta is not defined
+ *
+ *   would fire — psql had already completed the data restore, but
+ *   the operator-meta replay never ran, the trigger file was left
+ *   in place by `_installFromBackupBoot.js` because the restore
+ *   "failed", and `combined.log` got a loud FAILED line even though
+ *   the data was back. Caught on PR #596 review by the maintainer.
+ *
+ * **Why CI missed it**
+ *
+ *   The integration tests around `performFullRestore` only exercise
+ *   the SQLite branch via `this.dbType === 'sqlite'`. The PG branch
+ *   (~L827-984) requires a real PG connection + real `psql` binary,
+ *   neither of which are in the test environment. So the scope leak
+ *   sat untested until the maintainer ran a real DR cycle.
+ *
+ * **What this test does**
+ *
+ *   Reads the source of `restoreService.js` and asserts the scope
+ *   contract: the `preservedMeta` declaration sits ABOVE the
+ *   SQLite/PG branch split, so the replay block at the bottom of the
+ *   try{} can read it on either branch.
+ *
+ *   Source-inspection is uglier than a runtime test but it has two
+ *   advantages here: (a) it doesn't require a real PG cluster + psql
+ *   binary in CI, (b) it pins the EXACT contract — "the declaration
+ *   must be visible to the replay block" — which is the property
+ *   that broke, more directly than a runtime test would.
+ *
+ *   The follow-up "real-PG integration test in CI" (separate task)
+ *   would replace this with an end-to-end exercise, at which point
+ *   this can be deleted.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+describe('restoreService — PG branch scope contract (PR #596 review)', () => {
+  let src;
+  let lines;
+
+  beforeAll(() => {
+    src = fs.readFileSync(
+      path.join(__dirname, '..', '..', 'src', 'services', 'restoreService.js'),
+      'utf8',
+    );
+    lines = src.split(/\r?\n/);
+  });
+
+  /** Return the 1-based line number of the FIRST line matching `re`. */
+  function findFirst(re) {
+    const idx = lines.findIndex((l) => re.test(l));
+    return idx >= 0 ? idx + 1 : -1;
+  }
+
+  /** Return the 1-based line number of the LAST line matching `re`. */
+  function findLast(re) {
+    let last = -1;
+    lines.forEach((l, i) => { if (re.test(l)) last = i + 1; });
+    return last;
+  }
+
+  it('preservedMetaSnapshot lives on `this` and is initialised in the constructor', () => {
+    // PR #596 round 3 moved the snapshot from a block-scoped local to
+    // an instance variable so the replay can happen in `restore()`
+    // AFTER post-restore verification — preventing the replay row
+    // from inflating the row-count check.
+    //
+    // Contract:
+    //   1. The constructor initialises `this.preservedMetaSnapshot = []`
+    //   2. The `restore()` entry point resets it per call (no leak
+    //      across consecutive runs in the singleton service instance)
+    //   3. `performDatabaseRestore` assigns to `this.preservedMetaSnapshot`
+    //      inside the PG branch (must run before DROP)
+    //   4. The replay reads `this.preservedMetaSnapshot` — NOT a bare
+    //      `preservedMeta` local — so a future refactor can't
+    //      accidentally drop the snapshot half on the floor again.
+    const constructorInit = lines.some((l) =>
+      /this\.preservedMetaSnapshot\s*=\s*\[\s*\]/.test(l)
+    );
+    expect(constructorInit).toBe(true);
+
+    const assignmentSites = lines.filter((l) =>
+      /this\.preservedMetaSnapshot\s*=\s*(\[\s*\]|await\s+db)/.test(l)
+    );
+    // Constructor init + restore() per-run reset + the PG-branch
+    // assignment from db query. Three writes.
+    expect(assignmentSites.length).toBeGreaterThanOrEqual(3);
+
+    // No stray bare `preservedMeta` local-scoped declaration in
+    // performDatabaseRestore — would indicate someone re-introduced
+    // the round-1 footgun.
+    const dangerousLocalDecl = lines.filter((l) =>
+      /^\s*(let|const)\s+preservedMeta\s*=/.test(l)
+    );
+    expect(dangerousLocalDecl).toEqual([]);
+  });
+
+  it('every .count() result is coerced to Number before comparison', () => {
+    // PR #596 review caught a second PG-only landmine: pg-driver
+    // returns COUNT(*) as a string ("16" not 16) to preserve bigint
+    // precision. The original code compared `result.count !==
+    // expected.rowCount` and every match flagged as a mismatch on PG.
+    //
+    // The fix coerces with `Number(...)` at every comparison +
+    // interpolation site. This test catches a future regression where
+    // a refactor uses `.count` directly in a `===` / `!==` / `>` /
+    // `<` comparison without coercing.
+    //
+    // Heuristic: find every `.count` access in the file and make sure
+    // the line either:
+    //   (a) wraps it in `Number(...)`, or
+    //   (b) is purely an interpolation that already coerced upstream
+    //       (e.g. `validation.warnings.push(`... ${eventCountN} ...`)`
+    //       where eventCountN is the coerced local), or
+    //   (c) is the docstring/comment line (filtered separately).
+    //
+    // We approximate this by listing every `.count` reference site
+    // and asserting that lines doing comparisons (`===`/`!==`/`>`/
+    // `<`/`>=`/`<=`) on a raw `.count` access without `Number(...)`
+    // around it are zero.
+    const dangerousLines = lines
+      .map((l, i) => ({ line: i + 1, text: l }))
+      // Filter to lines that compare a .count result
+      .filter(({ text }) => {
+        // Skip comments
+        if (/^\s*(\/\/|\*)/.test(text)) return false;
+        // Detect a `.count` (followed by `)` for `?.count` or by space/operator)
+        // being directly compared via ===/!==/>/<.
+        // Match the BAD pattern: `<something>.count <op> <something>`
+        // where <op> is === / !== / > / < / >= / <=
+        const bareCountInComparison = /\w+\??\.count\s*(?:!==|===|>=?|<=?)\s+/;
+        // ALLOW if the .count is preceded by `Number(` in the same line
+        const wrappedInNumber = /Number\(\s*\w+\??\.count/;
+        return bareCountInComparison.test(text) && !wrappedInNumber.test(text);
+      });
+
+    expect(dangerousLines).toEqual([]);
+  });
+
+  it('the completed-restore update sets was_successful=true', () => {
+    // Without this, every successful restore ends up with
+    // status='completed', was_successful=false — the dashboard's
+    // "last successful restore" widget then filters out the row +
+    // any future audit query gating on was_successful misses it.
+    // Caught locally + maintainer PR #596 review.
+    //
+    // Contract: the update payload that writes status='completed' on
+    // the SUCCESS branch ALSO includes was_successful: true. We pin
+    // it by source inspection so any future refactor of the success
+    // payload keeps both fields together.
+    // The success-branch update lives AFTER performPostRestoreVerification.
+    // There's also a `status: 'completed'` in the dry-run / early-return
+    // path (failure handling has its own block too) — we want the
+    // SUCCESS-branch one specifically.
+    const verifyLine = findFirst(/performPostRestoreVerification\s*\(/);
+    expect(verifyLine).toBeGreaterThan(0);
+
+    const completedStatusLineIdx = lines
+      .map((l, i) => ({ line: i + 1, text: l }))
+      .find(({ line, text }) =>
+        line > verifyLine && /status:\s*['"]completed['"]/.test(text)
+      );
+    expect(completedStatusLineIdx).toBeDefined();
+
+    // Look in the next ~10 lines for was_successful: true. The actual
+    // payload is small (no nested objects between status and the
+    // closing })), so a fixed-window search is reliable.
+    const window = lines.slice(
+      completedStatusLineIdx.line - 1,
+      completedStatusLineIdx.line + 10,
+    ).join('\n');
+    expect(window).toMatch(/was_successful:\s*true/);
+  });
+
+  it('the safe migration runner is invoked after the replay in restore()', () => {
+    // Contract from PR #596 round 4: backups taken on older picpeak
+    // versions must restore COMPLETELY on a newer image — even if new
+    // migrations have been added since the backup was taken. The
+    // restore() flow shells out to the safe migration runner AFTER the
+    // operator-meta replay so the schema catches up to the running
+    // code WITHIN the restore boundary (not on the next container
+    // restart). Invoked as `node migrations/run-migrations-safe.js` —
+    // the runtime image ships no npm, so the former `npm run
+    // migrate:safe` would ENOENT into the non-fatal catch.
+    //
+    // Contract:
+    //   1. A run-migrations-safe shell-out exists somewhere in restoreService
+    //   2. It sits AFTER the replay drain — verification → replay →
+    //      migrations is the documented order
+    //   3. It does NOT sit inside performDatabaseRestore (must run
+    //      against the reinit'd pool from the parent restore())
+    const migrateLine = findFirst(/run-migrations-safe\.js/);
+    expect(migrateLine).toBeGreaterThan(0);
+
+    const replayLine = findLast(/this\.preservedMetaSnapshot\.length\s*>\s*0/);
+    expect(replayLine).toBeGreaterThan(0);
+    expect(migrateLine).toBeGreaterThan(replayLine);
+
+    // Must NOT live inside performDatabaseRestore (same scope as the
+    // replay check above).
+    const dbRestoreStart = findFirst(/async\s+performDatabaseRestore\s*\(/);
+    let dbRestoreEnd = -1;
+    for (let i = dbRestoreStart; i < lines.length; i++) {
+      if (/^  \}\s*$/.test(lines[i])) {
+        dbRestoreEnd = i + 1;
+        break;
+      }
+    }
+    expect(migrateLine < dbRestoreStart || migrateLine > dbRestoreEnd).toBe(true);
+  });
+
+  it('the replay site lives in restore() AFTER performPostRestoreVerification', () => {
+    // PR #596 round 3 moved the replay out of performDatabaseRestore
+    // and into the parent restore() method, sequenced AFTER the
+    // post-restore verification. Otherwise the replay's upserted row
+    // count was being flagged as a verification mismatch (e.g.
+    // "expected 190, got 191" because the fresh-install seeded
+    // `restore_allow_force_auto_upgraded` that wasn't in the backup).
+    //
+    // Contract: the line that drains `this.preservedMetaSnapshot`
+    // must come AFTER `performPostRestoreVerification` AND must NOT
+    // sit inside `performDatabaseRestore`.
+    const verificationLine = findFirst(/performPostRestoreVerification\s*\(/);
+    expect(verificationLine).toBeGreaterThan(0);
+
+    const replayLine = findLast(/this\.preservedMetaSnapshot\.length\s*>\s*0/);
+    expect(replayLine).toBeGreaterThan(0);
+    expect(replayLine).toBeGreaterThan(verificationLine);
+
+    // `performDatabaseRestore` must not contain the replay drain.
+    // Find the function bounds + assert no drain line falls inside.
+    const dbRestoreStart = findFirst(/async\s+performDatabaseRestore\s*\(/);
+    expect(dbRestoreStart).toBeGreaterThan(0);
+
+    // Find the closing brace of performDatabaseRestore. Lazy heuristic:
+    // the first `^  \}\s*$` (two-space indent + }) after the function
+    // start. Brittle to indent changes but unambiguous in this codebase.
+    let dbRestoreEnd = -1;
+    for (let i = dbRestoreStart; i < lines.length; i++) {
+      if (/^  \}\s*$/.test(lines[i])) {
+        dbRestoreEnd = i + 1;
+        break;
+      }
+    }
+    expect(dbRestoreEnd).toBeGreaterThan(dbRestoreStart);
+
+    // The replay drain line must be OUTSIDE [dbRestoreStart, dbRestoreEnd].
+    expect(replayLine < dbRestoreStart || replayLine > dbRestoreEnd).toBe(true);
+  });
+});

backend/__tests__/integration/setupService.test.js

@@ -0,0 +1,196 @@
+'use strict';
+
+// First-run bootstrap service. bootCrmDb() must run BEFORE requiring the service
+// so setupService shares this test's db instance (see crmDb.js note).
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'test-secret-at-least-32-characters-long!!';
+
+const fs = require('fs');
+const path = require('path');
+const request = require('supertest');
+const { bootCrmDb, buildRouteApp } = require('./helpers/crmDb');
+
+let db;
+let cleanup;
+let tmpDir;
+let setupService;
+let getAppSetting;
+let upsertAppSetting;
+let app;
+
+const VALID_PW = 'Str0ng-Passw0rd!';
+
+// bootCrmDb MUST run before any require of db.js (directly or transitively via a
+// service/util), or db.js binds to the default path instead of the temp one.
+beforeAll(async () => {
+  ({ db, cleanup, tmpDir } = await bootCrmDb());
+  process.env.DATA_DIR = tmpDir; // isolate the SETUP_TOKEN file to the temp dir
+  setupService = require('../../src/services/setupService');
+  ({ getAppSetting, upsertAppSetting } = require('../../src/utils/appSettings'));
+  app = buildRouteApp('/api/setup', require('../../src/routes/setup'));
+}, 120000);
+
+afterAll(async () => {
+  await cleanup();
+});
+
+beforeEach(async () => {
+  await db('admin_users').del();
+  await db('app_settings').where({ setting_key: 'setup_token' }).del();
+});
+
+describe('setupService (first-run bootstrap)', () => {
+  it('reports needsAdmin while no admin exists', async () => {
+    expect(await setupService.getSetupStatus()).toEqual({ needsAdmin: true, complete: false });
+  });
+
+  it('generates and persists a one-time token while no admin exists', async () => {
+    const token = await setupService.ensureSetupToken();
+    expect(token).toEqual(expect.any(String));
+    expect(token.length).toBeGreaterThan(20);
+    expect(await getAppSetting('setup_token')).toBe(token);
+    // Idempotent — a second call returns the same token, not a fresh one.
+    expect(await setupService.ensureSetupToken()).toBe(token);
+  });
+
+  it('stores the token as valid JSON so the Postgres jsonb column accepts it', async () => {
+    // Regression guard for the SQLite-only miss: a bare token string is rejected
+    // by Postgres jsonb ("invalid input syntax for type json"). The raw column
+    // value must be JSON-parseable and round-trip back to the token.
+    const token = await setupService.ensureSetupToken();
+    const row = await db('app_settings').where({ setting_key: 'setup_token' }).first();
+    expect(() => JSON.parse(row.setting_value)).not.toThrow();
+    expect(JSON.parse(row.setting_value)).toBe(token);
+  });
+
+  it('rejects a wrong token', async () => {
+    await setupService.ensureSetupToken();
+    await expect(
+      setupService.createInitialAdmin({ token: 'nope', email: 'a@b.co', password: VALID_PW })
+    ).rejects.toMatchObject({ statusCode: 400 });
+    expect(await setupService.getSetupStatus()).toEqual({ needsAdmin: true, complete: false });
+  });
+
+  it('rejects a weak password', async () => {
+    const token = await setupService.ensureSetupToken();
+    await expect(
+      setupService.createInitialAdmin({ token, email: 'a@b.co', password: 'weak' })
+    ).rejects.toMatchObject({ statusCode: 400 });
+  });
+
+  it('creates the first admin as super_admin, issues a token, and burns the setup token', async () => {
+    const token = await setupService.ensureSetupToken();
+    const result = await setupService.createInitialAdmin({
+      token, email: 'Owner@Example.com', password: VALID_PW, ip: '203.0.113.7',
+    });
+
+    expect(result.user.email).toBe('owner@example.com'); // normalised
+    expect(result.user.role.name).toBe('super_admin');
+    expect(result.token).toEqual(expect.any(String));
+
+    const row = await db('admin_users').first();
+    const role = await db('roles').where({ name: 'super_admin' }).first();
+    expect(row.role_id).toBe(role.id);
+    expect(row.password_hash).not.toBe(VALID_PW); // hashed
+
+    // One-time: token burned, status now complete.
+    expect(await getAppSetting('setup_token')).toBeFalsy();
+    expect(await setupService.getSetupStatus()).toEqual({ needsAdmin: false, complete: true });
+  });
+
+  it('writes the SETUP_TOKEN file while pending and removes it once setup completes', async () => {
+    const tokenFile = path.join(tmpDir, 'SETUP_TOKEN');
+    const token = await setupService.ensureSetupToken();
+    expect(fs.readFileSync(tokenFile, 'utf8').trim()).toBe(token);
+    await setupService.createInitialAdmin({ token, email: 'owner@example.com', password: VALID_PW });
+    expect(fs.existsSync(tokenFile)).toBe(false); // burned in DB + file removed
+  });
+
+  it('refuses to create a second admin (setup already complete)', async () => {
+    const token = await setupService.ensureSetupToken();
+    await setupService.createInitialAdmin({ token, email: 'first@example.com', password: VALID_PW });
+    await expect(
+      setupService.createInitialAdmin({ token, email: 'second@example.com', password: VALID_PW })
+    ).rejects.toMatchObject({ statusCode: 409 });
+  });
+
+  it('serialises a double-submit — two concurrent valid-token calls create only one admin', async () => {
+    const token = await setupService.ensureSetupToken();
+    const results = await Promise.allSettled([
+      setupService.createInitialAdmin({ token, email: 'a@example.com', password: VALID_PW }),
+      setupService.createInitialAdmin({ token, email: 'b@example.com', password: VALID_PW }),
+    ]);
+    const fulfilled = results.filter((r) => r.status === 'fulfilled');
+    expect(fulfilled).toHaveLength(1); // the atomic token claim lets exactly one win
+    const count = await db('admin_users').count({ c: '*' }).first();
+    expect(Number(count.c)).toBe(1);
+  });
+
+  it('ensureSetupToken clears any stale token once an admin exists', async () => {
+    const token = await setupService.ensureSetupToken();
+    await setupService.createInitialAdmin({ token, email: 'first@example.com', password: VALID_PW });
+    // Simulate a stale token left in settings, then re-run the boot hook.
+    await upsertAppSetting('setup_token', JSON.stringify('stale'), 'string');
+    expect(await setupService.ensureSetupToken()).toBeNull();
+    expect(await getAppSetting('setup_token')).toBeFalsy();
+  });
+});
+
+describe('setup routes', () => {
+  it('GET /api/setup/status reports needsAdmin', async () => {
+    const res = await request(app).get('/api/setup/status');
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ needsAdmin: true, complete: false });
+  });
+
+  it('POST /api/setup/verify-token accepts the right token without burning it (200)', async () => {
+    const token = await setupService.ensureSetupToken();
+    const res = await request(app).post('/api/setup/verify-token').send({ token });
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ valid: true });
+    // Token is NOT consumed — it still works for the actual create.
+    expect(await getAppSetting('setup_token')).toBe(token);
+  });
+
+  it('POST /api/setup/verify-token rejects a wrong token (400, field token)', async () => {
+    await setupService.ensureSetupToken();
+    const res = await request(app).post('/api/setup/verify-token').send({ token: 'nope' });
+    expect(res.status).toBe(400);
+    expect(res.body.field).toBe('token');
+  });
+
+  it('POST /api/setup/verify-token is closed once an admin exists (409)', async () => {
+    const token = await setupService.ensureSetupToken();
+    await setupService.createInitialAdmin({ token, email: 'first@example.com', password: VALID_PW });
+    const res = await request(app).post('/api/setup/verify-token').send({ token });
+    expect(res.status).toBe(409);
+  });
+
+  it('POST /api/setup/admin rejects a wrong token (400)', async () => {
+    await setupService.ensureSetupToken();
+    const res = await request(app)
+      .post('/api/setup/admin')
+      .send({ token: 'nope', email: 'a@b.co', password: VALID_PW });
+    expect(res.status).toBe(400);
+    expect(await setupService.getSetupStatus()).toMatchObject({ needsAdmin: true });
+  });
+
+  it('POST /api/setup/admin creates the first admin + sets the auth cookie (201)', async () => {
+    const token = await setupService.ensureSetupToken();
+    const res = await request(app)
+      .post('/api/setup/admin')
+      .send({ token, email: 'owner@example.com', password: VALID_PW });
+    expect(res.status).toBe(201);
+    expect(res.body.user.role.name).toBe('super_admin');
+    expect((res.headers['set-cookie'] || []).join(';')).toMatch(/admin_token/);
+    expect(await setupService.getSetupStatus()).toEqual({ needsAdmin: false, complete: true });
+  });
+
+  it('POST /api/setup/admin is closed once an admin exists (409)', async () => {
+    const token = await setupService.ensureSetupToken();
+    await setupService.createInitialAdmin({ token, email: 'first@example.com', password: VALID_PW });
+    const res = await request(app)
+      .post('/api/setup/admin')
+      .send({ token, email: 'second@example.com', password: VALID_PW });
+    expect(res.status).toBe(409);
+  });
+});

backend/__tests__/integration/slideshowPhotoSource.test.js

@@ -0,0 +1,150 @@
+/**
+ * Slideshow photo source (#1015).
+ *
+ * The bug: with `lightbox_preview_enabled` off (the default), /photos emitted
+ * `preview_url: null`, so the slideshow's `preview_url || hero_url || url`
+ * chain fell through to `hero_url` — a 1920x1080 `fit: 'cover'` centre crop
+ * meant for gallery header banners. With the "Black Bars (No crop)" fit the
+ * show then letterboxed an already-cropped frame: portrait photos lost their
+ * top and bottom and the setting looked broken.
+ *
+ * The contract pinned here: `slideshow_url` points at the aspect-preserved
+ * preview tier and is emitted for image photos REGARDLESS of the lightbox
+ * toggle, so the slideshow never has a reason to reach for `hero_url`.
+ * `preview_url` itself must stay gated — the lightbox opt-in is unchanged.
+ */
+
+const request = require('supertest');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'slideshow-src-test-secret';
+
+const SLUG = 'slideshow-source-event';
+
+describe('Slideshow photo source (#1015)', () => {
+  let db;
+  let cleanup;
+  let app;
+  let eventId;
+  let imagePhotoId;
+  let videoPhotoId;
+
+  const galleryToken = () => jwt.sign(
+    { eventId, eventSlug: SLUG, type: 'gallery' },
+    process.env.JWT_SECRET,
+    { expiresIn: '1h', issuer: 'picpeak-auth' }
+  );
+
+  const setLightboxPreview = async (on) => {
+    await db('app_settings').where({ setting_key: 'lightbox_preview_enabled' }).del();
+    await db('app_settings').insert({
+      setting_key: 'lightbox_preview_enabled',
+      setting_value: JSON.stringify(on),
+      setting_type: 'general',
+      updated_at: new Date().toISOString(),
+    });
+  };
+
+  const fetchPhotos = async () => {
+    const res = await request(app)
+      .get(`/api/gallery/${SLUG}/photos`)
+      .set('Authorization', `Bearer ${galleryToken()}`)
+      .expect(200);
+    return res.body.photos;
+  };
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+
+    const inserted = await db('events').insert({
+      slug: SLUG,
+      event_type: 'wedding',
+      event_name: 'Slideshow Source Test',
+      event_date: '2026-08-01',
+      host_email: 'host@example.com',
+      admin_email: 'admin@example.com',
+      password_hash: 'x',
+      share_link: `/gallery/${SLUG}/share`,
+      share_token: 'slideshow-source-share',
+      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+      is_active: 1,
+      is_archived: 0,
+      is_draft: 0,
+      created_at: new Date().toISOString(),
+    }).returning('id');
+    eventId = inserted[0]?.id ?? inserted[0];
+
+    const img = await db('photos').insert({
+      event_id: eventId,
+      filename: 'portrait.jpg',
+      path: 'events/slideshow-source/portrait.jpg',
+      type: 'individual',
+      mime_type: 'image/jpeg',
+      uploaded_at: new Date().toISOString(),
+    }).returning('id');
+    imagePhotoId = img[0]?.id ?? img[0];
+
+    const vid = await db('photos').insert({
+      event_id: eventId,
+      filename: 'clip.mp4',
+      path: 'events/slideshow-source/clip.mp4',
+      type: 'individual',
+      media_type: 'video',
+      mime_type: 'video/mp4',
+      uploaded_at: new Date().toISOString(),
+    }).returning('id');
+    videoPhotoId = vid[0]?.id ?? vid[0];
+
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/gallery', require('../../src/routes/gallery'));
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  it('emits slideshow_url for image photos even when lightbox previews are OFF', async () => {
+    await setLightboxPreview(false);
+    const photos = await fetchPhotos();
+    const image = photos.find((p) => p.id === imagePhotoId);
+
+    expect(image.slideshow_url).toBe(`/api/gallery/${SLUG}/preview/${imagePhotoId}`);
+    // The regression: this is what used to be null, pushing the show to hero.
+    expect(image.preview_url).toBeNull();
+  });
+
+  it('leaves preview_url gated so the lightbox opt-in is unchanged', async () => {
+    await setLightboxPreview(true);
+    const photos = await fetchPhotos();
+    const image = photos.find((p) => p.id === imagePhotoId);
+
+    expect(image.preview_url).toBe(`/api/gallery/${SLUG}/preview/${imagePhotoId}`);
+    expect(image.slideshow_url).toBe(image.preview_url);
+  });
+
+  it('never points the slideshow at the cover-cropped hero tier', async () => {
+    await setLightboxPreview(false);
+    const photos = await fetchPhotos();
+    const image = photos.find((p) => p.id === imagePhotoId);
+
+    // hero_url still ships (the gallery header uses it) — it just must not be
+    // what the slideshow resolves to.
+    expect(image.hero_url).toBe(`/api/gallery/${SLUG}/hero/${imagePhotoId}`);
+    expect(image.slideshow_url).not.toBe(image.hero_url);
+  });
+
+  it('emits slideshow_url: null for videos, which have no preview tier', async () => {
+    await setLightboxPreview(false);
+    const photos = await fetchPhotos();
+    const video = photos.find((p) => p.id === videoPhotoId);
+
+    expect(video.slideshow_url).toBeNull();
+  });
+});

backend/__tests__/integration/uncategorizedFilter.test.js

@@ -0,0 +1,107 @@
+/**
+ * The admin photo list's category filter, and the value it answers to (#1211).
+ *
+ * The frontend used to send `category_id=0` for "Uncategorized". This route
+ * skips `'0'` outright — the guard reads `category_id !== '0'` — so no
+ * condition was applied and the whole event came back. Four lines below that
+ * guard sits the branch that does the work, keyed on the literal
+ * `uncategorized`, which nothing was sending.
+ *
+ * Reported in #1209 by someone trying to isolate a few thousand uncategorised
+ * imports. The frontend half is fixed in PhotoFilters; this pins the backend
+ * half of the same contract, because the failure mode was the two ends
+ * disagreeing about a string and neither one being wrong on its own.
+ */
+
+const request = require('supertest');
+const express = require('express');
+
+const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
+
+describe('admin photo list — uncategorized filter (#1211)', () => {
+  let db; let cleanup; let app;
+  let eventId; let categoryId;
+  let uncategorisedIds; let categorisedId;
+
+  const list = async (query = '') => {
+    const res = await request(app).get(`/api/admin/events/${eventId}/photos${query}`);
+    expect(res.status).toBe(200);
+    const photos = Array.isArray(res.body) ? res.body : res.body.photos;
+    return (photos || []).map((p) => p.id).sort((a, b) => a - b);
+  };
+
+  beforeAll(async () => {
+    jest.resetModules();
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => { req.admin = { id: 1, username: 'tester' }; next(); },
+    }));
+    jest.doMock('../../src/middleware/permissions', () => ({
+      requirePermission: () => (_req, _res, next) => next(),
+    }));
+    jest.doMock('../../src/middleware/ownership', () => ({
+      requireEventOwnership: (_req, _res, next) => next(),
+    }));
+    jest.doMock('../../src/utils/logger', () => ({
+      debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn(),
+    }));
+
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+
+    const [ev] = await db('events').insert({
+      slug: 'uncat-filter', event_type: 'wedding', event_name: 'Uncat Filter',
+      event_date: '2026-08-01', host_email: 'h@example.com', admin_email: 'a@example.com',
+      password_hash: 'x', share_link: '/gallery/uncat-filter/share',
+      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+      is_active: 1, is_archived: 0, is_draft: 0, created_at: new Date().toISOString(),
+    }).returning('id');
+    eventId = typeof ev === 'object' ? ev.id : ev;
+
+    const [cat] = await db('photo_categories')
+      .insert({ name: 'Ceremony', slug: 'ceremony', event_id: eventId })
+      .returning('id');
+    categoryId = typeof cat === 'object' ? cat.id : cat;
+
+    const insertPhoto = async (filename, category) => {
+      const [p] = await db('photos').insert({
+        event_id: eventId, filename, path: `events/uncat/${filename}`,
+        type: 'individual', category_id: category,
+        uploaded_at: new Date().toISOString(),
+      }).returning('id');
+      return typeof p === 'object' ? p.id : p;
+    };
+
+    // Two with no category — the shape a plugin upload leaves behind — and one
+    // filed properly, so a filter that does nothing is visibly different from
+    // a filter that works.
+    uncategorisedIds = [await insertPhoto('a.jpg', null), await insertPhoto('b.jpg', null)];
+    categorisedId = await insertPhoto('c.jpg', categoryId);
+    uncategorisedIds.sort((a, b) => a - b);
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/events', require('../../src/routes/adminPhotos'));
+  }, 180000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  it('returns only the photos with no category', async () => {
+    expect(await list('?category_id=uncategorized')).toEqual(uncategorisedIds);
+  });
+
+  it('returns everything when no category filter is given', async () => {
+    expect(await list()).toEqual([...uncategorisedIds, categorisedId].sort((a, b) => a - b));
+  });
+
+  it('still filters by a real category id', async () => {
+    expect(await list(`?category_id=${categoryId}`)).toEqual([categorisedId]);
+  });
+
+  it('treats 0 as no filter at all', async () => {
+    // Pinning the behaviour that made the bug silent rather than loud: '0' is
+    // not "uncategorized" and never was, it simply falls through the guard. A
+    // future change that made 0 mean uncategorized here would be fine too —
+    // but it must be a decision, not an accident, and this test forces it.
+    expect(await list('?category_id=0')).toEqual([...uncategorisedIds, categorisedId].sort((a, b) => a - b));
+  });
+});

backend/__tests__/integration/workflowEngine.test.js

@@ -0,0 +1,661 @@
+/**
+ * Workflow engine — graph execution integration tests.
+ *
+ * Exercises the engine against a real (temp SQLite) DB with migration 142
+ * applied: branching, bounded loops, wait pauses + scheduler-style resume,
+ * gate pauses + confirm/deny resume, dedup idempotency, and step recording.
+ */
+const { bootCrmDb } = require('./helpers/crmDb');
+
+// bootCrmDb runs the full core-migration set in beforeAll; under full-suite
+// parallel load on a small CI runner that can exceed the 5s default. Match the
+// other migration-heavy CRM suites (discountLineItems, incomingInvoiceRebill).
+jest.setTimeout(120000);
+
+let db;
+let cleanup;
+let engine;
+
+async function makeWorkflow({ nodes, edges, trigger = 'test.event', enabled = true }) {
+  const ins = await db('workflows').insert({ name: 'wf', trigger_type: trigger, version: 1, enabled });
+  const workflowId = ins[0];
+  for (const n of nodes) {
+    await db('workflow_nodes').insert({
+      workflow_id: workflowId, version: 1, node_key: n.key, type: n.type,
+      config: JSON.stringify(n.config || {}),
+    });
+  }
+  for (const e of edges) {
+    await db('workflow_edges').insert({
+      workflow_id: workflowId, version: 1, from_node: e.from, from_handle: e.handle || null, to_node: e.to,
+      loop_back: e.loopBack || false,
+    });
+  }
+  return workflowId;
+}
+
+beforeAll(async () => {
+  ({ db, cleanup } = await bootCrmDb());
+  // Engine requires the singleton db — require AFTER bootCrmDb wired the test path.
+  engine = require('../../src/services/workflows');
+  // Enable the workflows flag so emitWorkflowEvent doesn't fail closed.
+  await db('feature_flags').insert({ key: 'workflows', value: true });
+});
+
+afterAll(async () => { await cleanup(); });
+
+describe('workflow engine', () => {
+  test('condition + bounded loop + wait pauses, resumes to completion', async () => {
+    // trigger → set paid=false → condition(paid?) --no--> loop(max2)
+    //   loop --loop--> reminder(noop) → wait → (back to condition)
+    //   loop --exit--> lateFee(noop) → end
+    //   condition --yes--> lateFee (paid path, not taken here)
+    const wfId = await makeWorkflow({
+      nodes: [
+        { key: 'n1', type: 'trigger' },
+        { key: 'n2', type: 'action', config: { action: 'set_context', set: { paid: false } } },
+        { key: 'n3', type: 'condition', config: { condition: 'expr', field: 'paid', op: 'truthy' } },
+        { key: 'n4', type: 'loop', config: { maxIterations: 2 } },
+        { key: 'n5', type: 'action', config: { action: 'noop' } },
+        { key: 'n6', type: 'wait', config: { delayMinutes: 0 } },
+        { key: 'n7', type: 'action', config: { action: 'noop' } },
+      ],
+      edges: [
+        { from: 'n1', to: 'n2' },
+        { from: 'n2', to: 'n3' },
+        { from: 'n3', handle: 'no', to: 'n4' },
+        { from: 'n3', handle: 'yes', to: 'n7' },
+        { from: 'n4', handle: 'loop', to: 'n5' },
+        { from: 'n4', handle: 'exit', to: 'n7' },
+        { from: 'n5', to: 'n6' },
+        { from: 'n6', to: 'n3', loopBack: true },
+      ],
+    });
+
+    const runIds = await engine.emitWorkflowEvent('test.event', { entityType: 'invoice', entityId: 1 });
+    expect(runIds.length).toBe(1);
+    const runId = runIds[0];
+
+    let run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('waiting');     // paused at first wait (loop iter 1)
+    expect(run.current_node).toBe('n6');
+
+    await engine.resumeRun(runId);
+    run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('waiting');     // paused again (loop iter 2)
+
+    await engine.resumeRun(runId);
+    run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('done');        // loop exhausted → exit → end
+
+    const ctx = JSON.parse(run.context);
+    expect(ctx.vars.__loop_n4).toBe(3);     // counter incremented past the cap
+    void wfId;
+
+    const steps = await db('workflow_run_steps').where({ run_id: runId });
+    expect(steps.length).toBeGreaterThan(0);
+  });
+
+  test('emit is idempotent on dedup_key', async () => {
+    await makeWorkflow({
+      trigger: 'dedup.event',
+      nodes: [{ key: 'n1', type: 'trigger' }, { key: 'n2', type: 'action', config: { action: 'noop' } }],
+      edges: [{ from: 'n1', to: 'n2' }],
+    });
+    const first = await engine.emitWorkflowEvent('dedup.event', { entityType: 'x', entityId: 9 });
+    const second = await engine.emitWorkflowEvent('dedup.event', { entityType: 'x', entityId: 9 });
+    expect(first.length).toBe(1);
+    expect(second.length).toBe(0); // same entity → no duplicate run
+  });
+
+  test('gate pauses and resumes via the confirm edge', async () => {
+    const wfId = await makeWorkflow({
+      trigger: 'gate.event',
+      nodes: [
+        { key: 'g1', type: 'trigger' },
+        { key: 'g2', type: 'gate', config: { type: 'payment_confirm' } },
+        { key: 'g3', type: 'action', config: { action: 'noop' } },
+        { key: 'g4', type: 'action', config: { action: 'noop' } },
+      ],
+      edges: [
+        { from: 'g1', to: 'g2' },
+        { from: 'g2', handle: 'confirm', to: 'g3' },
+        { from: 'g2', handle: 'deny', to: 'g4' },
+      ],
+    });
+    // create + start a run directly
+    await db('workflow_runs').insert({
+      workflow_id: wfId, version: 1, trigger_event: 'gate.event', status: 'pending',
+      context: JSON.stringify({ vars: {} }), dedup_key: 'gate-test',
+    });
+    const run0 = await db('workflow_runs').where({ dedup_key: 'gate-test' }).first();
+    await engine.startRun(run0.id);
+
+    let run = await db('workflow_runs').where({ id: run0.id }).first();
+    expect(run.status).toBe('waiting');
+    expect(run.current_node).toBe('g2');
+
+    await engine.resumeRun(run0.id, { decisionHandle: 'confirm' });
+    run = await db('workflow_runs').where({ id: run0.id }).first();
+    expect(run.status).toBe('done');
+  });
+
+  test('runDueWaits resumes only elapsed wait nodes', async () => {
+    await makeWorkflow({
+      trigger: 'wait.event',
+      nodes: [
+        { key: 'w1', type: 'trigger' },
+        { key: 'w2', type: 'wait', config: { delayMinutes: 60 } },
+        { key: 'w3', type: 'action', config: { action: 'noop' } },
+      ],
+      edges: [{ from: 'w1', to: 'w2' }, { from: 'w2', to: 'w3' }],
+    });
+    const runIds = await engine.emitWorkflowEvent('wait.event', { entityType: 'e', entityId: 7 });
+    const runId = runIds[0];
+    let run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('waiting');
+
+    expect(await engine.runDueWaits()).toBe(0); // wake_at ~60min out → not due
+
+    await db('workflow_runs').where({ id: runId }).update({ wake_at: new Date(Date.now() - 1000).toISOString() });
+    const resumed = await engine.runDueWaits();
+    expect(resumed).toBeGreaterThanOrEqual(1);
+    run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('done');
+  });
+
+  test('send_email queues a customer mail with business-hours routing', async () => {
+    await makeWorkflow({
+      trigger: 'mail.event',
+      nodes: [
+        { key: 'm1', type: 'trigger' },
+        { key: 'm2', type: 'action', config: { action: 'send_email', recipientClass: 'customer', emailType: 'workflow_test' } },
+      ],
+      edges: [{ from: 'm1', to: 'm2' }],
+    });
+    const runIds = await engine.emitWorkflowEvent('mail.event', {
+      entityType: 'invoice', entityId: 3, payload: { customerEmail: 'cust@example.com' },
+    });
+    const run = await db('workflow_runs').where({ id: runIds[0] }).first();
+    expect(run.status).toBe('done');
+    const queued = await db('email_queue').where({ recipient_email: 'cust@example.com' }).first();
+    expect(queued).toBeTruthy();
+    const step = await db('workflow_run_steps').where({ run_id: runIds[0], node_key: 'm2' }).first();
+    expect(JSON.parse(step.result).respectBusinessHours).toBe(true);
+  });
+
+  test('invoice_paid condition reads the entity', async () => {
+    const registry = require('../../src/services/workflows/registry');
+    const cond = registry.getCondition('invoice_paid');
+    const makeCtx = (row) => ({ run: { entity_id: 1 }, db: () => ({ where: () => ({ first: async () => row }) }) });
+    expect(await cond(makeCtx({ paid_at: '2026-01-01', status: 'sent' }))).toBe(true);
+    expect(await cond(makeCtx({ paid_at: null, status: 'paid' }))).toBe(true);
+    expect(await cond(makeCtx({ paid_at: null, status: 'sent', paid_amount_minor: 0, total_amount_minor: 1000 }))).toBe(false);
+  });
+
+  test('gate creates a pending approval + admin email, token confirm resumes the run', async () => {
+    await makeWorkflow({
+      trigger: 'approval.event',
+      nodes: [
+        { key: 'a1', type: 'trigger' },
+        { key: 'a2', type: 'gate', config: { type: 'payment_confirm', prompt: 'No payment yet?' } },
+        { key: 'a3', type: 'action', config: { action: 'noop' } }, // confirm path
+        { key: 'a4', type: 'action', config: { action: 'noop' } }, // deny path
+      ],
+      edges: [
+        { from: 'a1', to: 'a2' },
+        { from: 'a2', handle: 'confirm', to: 'a3' },
+        { from: 'a2', handle: 'deny', to: 'a4' },
+      ],
+    });
+    const runIds = await engine.emitWorkflowEvent('approval.event', {
+      entityType: 'invoice', entityId: 42, payload: { adminEmail: 'admin@example.com' },
+    });
+    const runId = runIds[0];
+
+    let run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('waiting');
+    expect(run.current_node).toBe('a2');
+
+    const approval = await db('workflow_approvals').where({ run_id: runId }).first();
+    expect(approval).toBeTruthy();
+    expect(approval.status).toBe('pending');
+
+    const adminMail = await db('email_queue').where({ recipient_email: 'admin@example.com' }).first();
+    expect(adminMail).toBeTruthy();
+
+    // Extract the raw token from the emailed confirm link and act on it.
+    const data = JSON.parse(adminMail.email_data);
+    const rawToken = data.confirm_url.split('/').slice(-2)[0];
+    const res = await engine.actByToken(rawToken, 'confirm');
+    expect(res.ok).toBe(true);
+    expect(res.status).toBe('confirmed');
+
+    run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('done');
+
+    // A second click is idempotent (already recorded).
+    const again = await engine.actByToken(rawToken, 'confirm');
+    expect(again.already).toBe(true);
+  });
+
+  test('seeds the invoice-dunning built-in as the delegation graph (disabled for first beta)', async () => {
+    const { seedBuiltinWorkflowsAtBoot, DUNNING_KEY } = require('../../src/services/_workflowSeedBoot');
+    const noopLogger = { info() {}, warn() {} };
+    await seedBuiltinWorkflowsAtBoot(db, noopLogger);
+
+    const wf = await db('workflows').where({ builtin_key: DUNNING_KEY }).first();
+    expect(wf).toBeTruthy();
+    expect(!!wf.is_builtin).toBe(true);
+    expect(!!wf.enabled).toBe(false); // first beta: ships disabled; legacy ladder runs until enabled
+    expect(JSON.parse(wf.trigger_config).seedVersion).toBe(7);
+
+    const nodes = await db('workflow_nodes').where({ workflow_id: wf.id, version: wf.version });
+    expect(nodes.filter((n) => n.type === 'trigger')).toHaveLength(1);
+    expect(nodes.some((n) => n.type === 'gate')).toBe(false); // payment-check email IS the gate
+    expect(nodes.some((n) => JSON.parse(n.config || '{}').action === 'queue_payment_check')).toBe(true);
+    expect(nodes.some((n) => JSON.parse(n.config || '{}').action === 'escalate_to_collections')).toBe(true);
+
+    await seedBuiltinWorkflowsAtBoot(db, noopLogger); // idempotent at current seed version
+    const all = await db('workflows').where({ builtin_key: DUNNING_KEY });
+    expect(all.length).toBe(1);
+  });
+
+  test('re-seeds a stale built-in on version bump, but never an admin-owned one', async () => {
+    const { seedBuiltinWorkflowsAtBoot, DUNNING_KEY } = require('../../src/services/_workflowSeedBoot');
+    const noopLogger = { info() {}, warn() {} };
+
+    // Simulate an older, never-touched seed (v1, with a legacy gate node).
+    const wf = await db('workflows').where({ builtin_key: DUNNING_KEY }).first();
+    await db('workflows').where({ id: wf.id }).update({ enabled: true, admin_toggled_at: null, trigger_config: JSON.stringify({ seedVersion: 1 }) });
+    await db('workflow_nodes').insert({ workflow_id: wf.id, version: wf.version, node_key: 'legacyGate', type: 'gate', config: '{}', pos_x: 0, pos_y: 0 });
+
+    await seedBuiltinWorkflowsAtBoot(db, noopLogger);
+    const reseeded = await db('workflows').where({ id: wf.id }).first();
+    expect(reseeded.version).toBe(wf.version + 1); // bumped
+    expect(JSON.parse(reseeded.trigger_config).seedVersion).toBe(7);
+    expect(!!reseeded.enabled).toBe(false); // seed default re-applied (not admin-owned → flips enabled→disabled)
+    const newNodes = await db('workflow_nodes').where({ workflow_id: wf.id, version: reseeded.version });
+    expect(newNodes.some((n) => n.type === 'gate')).toBe(false); // legacy graph replaced
+
+    // Admin-owned (admin_toggled_at set) + stale → must NOT be touched.
+    await db('workflows').where({ id: wf.id }).update({ enabled: true, admin_toggled_at: new Date().toISOString(), trigger_config: JSON.stringify({ seedVersion: 1 }) });
+    const before = await db('workflows').where({ id: wf.id }).first();
+    await seedBuiltinWorkflowsAtBoot(db, noopLogger);
+    const after = await db('workflows').where({ id: wf.id }).first();
+    expect(after.version).toBe(before.version); // unchanged
+    expect(!!after.enabled).toBe(true); // admin's choice preserved
+  });
+
+  test('seeds the gallery, pre-event + booking built-ins (all disabled for first beta)', async () => {
+    const { seedBuiltinWorkflowsAtBoot } = require('../../src/services/_workflowSeedBoot');
+    await seedBuiltinWorkflowsAtBoot(db, { info() {}, warn() {} });
+
+    // First beta: cutover flows ship DISABLED (legacy paths run until enabled);
+    // they delegate to the proven send functions once turned on.
+    const expiring = await db('workflows').where({ builtin_key: 'gallery_expiring' }).first();
+    expect(expiring).toBeTruthy();
+    expect(!!expiring.enabled).toBe(false);
+    expect(expiring.trigger_type).toBe('gallery.expiring');
+    const expiringNodes = await db('workflow_nodes').where({ workflow_id: expiring.id, version: expiring.version });
+    expect(expiringNodes.some((n) => JSON.parse(n.config || '{}').action === 'notify_gallery_expiring')).toBe(true);
+
+    const expired = await db('workflows').where({ builtin_key: 'gallery_expired' }).first();
+    expect(expired).toBeTruthy();
+    expect(!!expired.enabled).toBe(false);
+    expect(expired.trigger_type).toBe('gallery.expired');
+    const expiredNodes = await db('workflow_nodes').where({ workflow_id: expired.id, version: expired.version });
+    expect(expiredNodes.some((n) => JSON.parse(n.config || '{}').action === 'notify_gallery_expired')).toBe(true);
+
+    // Invoice-only booking variant (quote → invoice, no gallery).
+    const invoiceOnly = await db('workflows').where({ builtin_key: 'booking_invoice_only' }).first();
+    expect(invoiceOnly).toBeTruthy();
+    expect(!!invoiceOnly.enabled).toBe(false);
+    expect(invoiceOnly.trigger_type).toBe('quote.accepted');
+    const ioNodes = await db('workflow_nodes').where({ workflow_id: invoiceOnly.id, version: invoiceOnly.version });
+    expect(ioNodes.some((n) => n.type === 'wait')).toBe(false); // no event wait — sends on approval
+    expect(ioNodes.some((n) => JSON.parse(n.config || '{}').action === 'prepare_event')).toBe(false); // no gallery
+
+    const bookingFull = await db('workflows').where({ builtin_key: 'booking_full' }).first();
+    expect(bookingFull).toBeTruthy();
+    expect(!!bookingFull.enabled).toBe(false); // illustrative/stub — stays disabled
+    expect(bookingFull.trigger_type).toBe('quote.accepted');
+    const fullNodes = await db('workflow_nodes').where({ workflow_id: bookingFull.id, version: bookingFull.version });
+    expect(fullNodes.some((n) => JSON.parse(n.config || '{}').action === 'prepare_contract')).toBe(true);
+    // Admin review gate guards BOTH document sends (adjust line items, then OK).
+    const fullGateKeys = fullNodes.filter((n) => n.type === 'gate').map((n) => n.node_key);
+    expect(fullGateKeys).toEqual(expect.arrayContaining(['reviewContract', 'reviewInvoice']));
+    const fullEdges = await db('workflow_edges').where({ workflow_id: bookingFull.id, version: bookingFull.version });
+    // reviewContract --confirm--> sendContract. The invoice is prepared + approved
+    // EARLY; reviewInvoice --confirm--> waitEvent, and the wait --> sendInvoice, so
+    // dispatch is held until the event date after the admin's early OK.
+    expect(fullEdges.some((e) => e.from_node === 'reviewContract' && e.from_handle === 'confirm' && e.to_node === 'sendContract')).toBe(true);
+    expect(fullEdges.some((e) => e.from_node === 'reviewInvoice' && e.from_handle === 'confirm' && e.to_node === 'waitEvent')).toBe(true);
+    expect(fullEdges.some((e) => e.from_node === 'waitEvent' && e.to_node === 'sendInvoice')).toBe(true);
+
+    const bookingSimple = await db('workflows').where({ builtin_key: 'booking_simple' }).first();
+    expect(bookingSimple).toBeTruthy();
+    expect(bookingSimple.trigger_type).toBe('quote.accepted');
+    const simpleEdges = await db('workflow_edges').where({ workflow_id: bookingSimple.id, version: bookingSimple.version });
+    expect(simpleEdges.some((e) => e.from_node === 'reviewInvoice' && e.from_handle === 'confirm' && e.to_node === 'waitEvent')).toBe(true);
+    expect(simpleEdges.some((e) => e.from_node === 'waitEvent' && e.to_node === 'sendInvoice')).toBe(true);
+
+    const preEvent = await db('workflows').where({ builtin_key: 'pre_event_email' }).first();
+    expect(preEvent).toBeTruthy();
+    expect(!!preEvent.enabled).toBe(false); // first beta: ships disabled
+    expect(preEvent.trigger_type).toBe('event.date_approaching');
+    expect(JSON.parse(preEvent.trigger_config).daysBefore).toBe(2); // default when global setting unset
+    const preNodes = await db('workflow_nodes').where({ workflow_id: preEvent.id, version: preEvent.version });
+    expect(preNodes.some((n) => JSON.parse(n.config || '{}').action === 'notify_pre_event')).toBe(true);
+  });
+
+  test('emitDueEventReminders starts a run for an event inside the lead window', async () => {
+    const wfId = await makeWorkflow({
+      trigger: 'event.date_approaching',
+      enabled: true,
+      nodes: [{ key: 'pe1', type: 'trigger' }, { key: 'pe2', type: 'action', config: { action: 'noop' } }],
+      edges: [{ from: 'pe1', to: 'pe2' }],
+    });
+    // Park the workflow's trigger window at 5 days so our event (2 days out) is in range.
+    await db('workflows').where({ id: wfId }).update({ trigger_config: JSON.stringify({ daysBefore: 5 }) });
+
+    const inWindow = new Date(Date.now() + 2 * 86400000).toISOString().slice(0, 10);
+    const tooFar = new Date(Date.now() + 30 * 86400000).toISOString().slice(0, 10);
+    const farFuture = new Date(Date.now() + 365 * 86400000).toISOString();
+    const evt = { event_type: 'wedding', password_hash: 'x', expires_at: farFuture, is_active: true, is_archived: false, customer_email: 'c@x.test' };
+    await db('events').insert({ ...evt, slug: 'pe-soon', share_link: 'pe-soon', event_name: 'Soon', event_date: inWindow });
+    await db('events').insert({ ...evt, slug: 'pe-far', share_link: 'pe-far', event_name: 'Far', event_date: tooFar });
+
+    const emitted = await engine.emitDueEventReminders();
+    expect(emitted).toBeGreaterThanOrEqual(1);
+
+    const runs = await db('workflow_runs').where({ workflow_id: wfId, entity_type: 'event' });
+    expect(runs.length).toBe(1); // only the in-window event, not the far one
+
+    // Idempotent: a second pass dedups (no duplicate run for the same event).
+    await engine.emitDueEventReminders();
+    const runs2 = await db('workflow_runs').where({ workflow_id: wfId, entity_type: 'event' });
+    expect(runs2.length).toBe(1);
+  });
+
+  test('notify_pre_event / sendReminderForEvent sends to an event with a direct email (no CRM account)', async () => {
+    // Regression: the reminder query used events.customer_account_id, which does
+    // not exist — so an event with only customer_email/host_email got no mail.
+    const farFuture = new Date(Date.now() + 365 * 86400000).toISOString();
+    await db('events').insert({
+      event_type: 'wedding', password_hash: 'x', expires_at: farFuture,
+      is_active: true, is_archived: false,
+      slug: 'rem-direct', share_link: 'rem-direct', event_name: 'Direct',
+      event_date: new Date(Date.now() + 2 * 86400000).toISOString().slice(0, 10),
+      customer_email: 'direct@x.test', // event-level email, NOT a customer_account
+    });
+    const ev = await db('events').where({ slug: 'rem-direct' }).first();
+
+    const res = await require('../../src/services/eventReminderService').sendReminderForEvent(ev.id);
+    expect(res.sent).toBe(1);
+    const mail = await db('email_queue').where({ event_id: ev.id }).first();
+    expect(mail).toBeTruthy();
+    expect(mail.recipient_email).toBe('direct@x.test');
+    // Idempotent: sent_at stamped → a second call is a no-op.
+    const again = await require('../../src/services/eventReminderService').sendReminderForEvent(ev.id);
+    expect(again.sent).toBe(0);
+    expect(again.reason).toBe('already_sent');
+  });
+
+  test('reminder template resolves per event type within the chosen group, else group default', async () => {
+    const { _internal } = require('../../src/services/eventReminderService');
+    // Per-type template exists within a custom group → used.
+    await db('email_templates').insert({ template_key: 'promo_wedding' });
+    expect(await _internal.resolveTemplateKey('wedding', 'promo')).toBe('promo_wedding');
+    // A type with no authored template (in any group) → the group's default.
+    expect(await _internal.resolveTemplateKey('zzznotype', 'promo')).toBe('promo_default');
+    // Blank group → the default event_reminder group.
+    expect(await _internal.resolveTemplateKey('zzznotype')).toBe('event_reminder_default');
+    // Trailing underscore on the group is tolerated.
+    expect(await _internal.resolveTemplateKey('zzznotype', 'promo_')).toBe('promo_default');
+  });
+
+  test('pre-event payload passes the RAW event_date (processor formats it — no "Invalid Date")', async () => {
+    const { _internal } = require('../../src/services/eventReminderService');
+    const p = _internal.composePayload({
+      event: { id: 1, event_name: 'X', event_date: '2026-06-25', customer_name: 'A' },
+      recipientEmail: 'a@x.test', daysBefore: 2, businessName: 'Biz',
+    });
+    expect(p.event_date).toBe('2026-06-25'); // raw, not pre-formatted DD.MM.YYYY
+    expect(p.event_date).not.toMatch(/invalid/i);
+  });
+
+  test('webhook action enqueues a delivery for a configured subscription (full pipeline)', async () => {
+    const webhook = engine.registry.getAction('webhook');
+    expect(typeof webhook).toBe('function'); // registered — no longer a silent no-op
+    const ctx = (config, vars = {}) => ({
+      run: { id: 1, workflow_id: 1, version: 1, trigger_event: 'invoice.sent', entity_type: 'invoice', entity_id: 5 },
+      node: { config }, vars, db, logger: { warn() {} },
+    });
+    // No webhook selected → observable skip, not a crash.
+    expect(await webhook(ctx({}))).toMatchObject({ skipped: true });
+
+    // A configured, active webhook subscription.
+    const [adminId] = await db('admin_users').insert({ username: 'wfhook', email: 'wf@x.test', password_hash: 'x' });
+    const [whId] = await db('webhooks').insert({
+      name: 'Flow hook', url: 'https://example.com/hook', secret: 'whsec_test',
+      events: JSON.stringify([]), active: true, created_by: adminId,
+    });
+
+    // Dry run does not enqueue.
+    expect(await webhook(ctx({ webhookId: whId }, { __dryRun: true }))).toMatchObject({ dryRun: true, would: 'webhook' });
+    expect(await db('webhook_deliveries').where({ webhook_id: whId }).count('id as c').first()).toMatchObject({ c: 0 });
+
+    // Real run → a pending delivery is enqueued for the worker (which does the
+    // signing + SSRF re-validation + retries).
+    const res = await webhook(ctx({ webhookId: whId }));
+    expect(res.webhook_enqueued).toBe(whId);
+    const del = await db('webhook_deliveries').where({ webhook_id: whId }).first();
+    expect(del).toBeTruthy();
+    expect(del.status).toBe('pending');
+    expect(del.event_type).toBe('workflow.invoice.sent');
+
+    // Inactive / missing subscription → skip.
+    await db('webhooks').where({ id: whId }).update({ active: false });
+    expect((await webhook(ctx({ webhookId: whId }))).skipped).toBe(true);
+  });
+
+  test('pre-event falls back to the assigned customer account when the event has no inline email', async () => {
+    const eventReminderService = require('../../src/services/eventReminderService');
+    const farFuture = new Date(Date.now() + 365 * 86400000).toISOString();
+    const [custId] = await db('customer_accounts').insert({
+      email: 'assigned@x.test', preferred_language: 'en', is_active: true, created_at: new Date(),
+    });
+    // Event with NO inline customer_email / host_email.
+    await db('events').insert({
+      event_type: 'wedding', password_hash: 'x', expires_at: farFuture, is_active: true, is_archived: false,
+      slug: 'rem-assigned', share_link: 'rem-assigned', event_name: 'Assigned',
+      event_date: new Date(Date.now() + 2 * 86400000).toISOString().slice(0, 10),
+    });
+    const ev = await db('events').where({ slug: 'rem-assigned' }).first();
+    await db('event_customer_assignments').insert({ event_id: ev.id, customer_account_id: custId, assigned_at: new Date() });
+
+    const res = await eventReminderService.sendReminderForEvent(ev.id);
+    expect(res.sent).toBe(1);
+    const mail = await db('email_queue').where({ recipient_email: 'assigned@x.test' }).first();
+    expect(mail).toBeTruthy();
+    // Queued WITHOUT event_id so the resolver uses the customer's preferred_language.
+    expect(mail.event_id == null).toBe(true);
+  });
+
+  test('isBuiltinFlowActive reflects the built-in ENABLED state (enabled-based mutex)', async () => {
+    const { seedBuiltinWorkflowsAtBoot } = require('../../src/services/_workflowSeedBoot');
+    await seedBuiltinWorkflowsAtBoot(db, { info() {}, warn() {} });
+    // All built-ins ship disabled → inactive until the admin enables one.
+    expect(await engine.isBuiltinFlowActive('gallery_expiring')).toBe(false);
+    expect(await engine.isBuiltinFlowActive('does_not_exist')).toBe(false);
+    // Enable one → now active.
+    await db('workflows').where({ builtin_key: 'gallery_expiring' }).update({ enabled: true });
+    expect(await engine.isBuiltinFlowActive('gallery_expiring')).toBe(true);
+    await db('workflows').where({ builtin_key: 'gallery_expiring' }).update({ enabled: false }); // restore
+  });
+
+  test('legacy event-reminder pass stands down ONLY when the pre_event_email flow is enabled', async () => {
+    const { seedBuiltinWorkflowsAtBoot } = require('../../src/services/_workflowSeedBoot');
+    await seedBuiltinWorkflowsAtBoot(db, { info() {}, warn() {} }); // pre_event_email seeded DISABLED
+    // crm_event_reminders_enabled must be on to reach the mutex guard.
+    await db('app_settings')
+      .insert({ setting_key: 'crm_event_reminders_enabled', setting_value: JSON.stringify(true), setting_type: 'boolean' })
+      .onConflict('setting_key').merge();
+    const eventReminderService = require('../../src/services/eventReminderService');
+
+    // Flow disabled → guard does NOT fire (legacy pass owns reminders).
+    expect(await engine.isBuiltinFlowActive('pre_event_email')).toBe(false);
+
+    // Flow enabled → the pass stands down before doing any work (byWorkflow).
+    await db('workflows').where({ builtin_key: 'pre_event_email' }).update({ enabled: true });
+    const after = await eventReminderService.runEventReminderPass();
+    expect(after.byWorkflow).toBe(true);
+    expect(after.sent).toBe(0);
+    await db('workflows').where({ builtin_key: 'pre_event_email' }).update({ enabled: false }); // restore
+  });
+
+  test('targetWorkflowId runs only the selected flow, not every matching one', async () => {
+    // Two enabled flows on the same trigger — the quote picks one.
+    const chosen = await makeWorkflow({
+      trigger: 'pick.event', enabled: true,
+      nodes: [{ key: 'c1', type: 'trigger' }, { key: 'c2', type: 'action', config: { action: 'noop' } }],
+      edges: [{ from: 'c1', to: 'c2' }],
+    });
+    const other = await makeWorkflow({
+      trigger: 'pick.event', enabled: true,
+      nodes: [{ key: 'o1', type: 'trigger' }, { key: 'o2', type: 'action', config: { action: 'noop' } }],
+      edges: [{ from: 'o1', to: 'o2' }],
+    });
+
+    const runIds = await engine.emitWorkflowEvent('pick.event', { entityType: 'quote', entityId: 99, targetWorkflowId: chosen });
+    expect(runIds.length).toBe(1);
+    const chosenRuns = await db('workflow_runs').where({ workflow_id: chosen, entity_id: 99 });
+    const otherRuns = await db('workflow_runs').where({ workflow_id: other, entity_id: 99 });
+    expect(chosenRuns.length).toBe(1); // only the selected flow ran
+    expect(otherRuns.length).toBe(0);  // the other matching flow did NOT
+  });
+
+  test('gate decision with no matching edge FAILS the run (not a silent done)', async () => {
+    // Gate has a confirm edge but the deny edge was lost (e.g. a bad import).
+    const wfId = await makeWorkflow({
+      trigger: 'noedge.event', enabled: true,
+      nodes: [
+        { key: 'g0', type: 'trigger' },
+        { key: 'g1', type: 'gate', config: {} },
+        { key: 'g2', type: 'action', config: { action: 'noop' } },
+      ],
+      edges: [
+        { from: 'g0', to: 'g1' },
+        { from: 'g1', handle: 'confirm', to: 'g2' }, // no deny edge
+      ],
+    });
+    const [runId] = await engine.emitWorkflowEvent('noedge.event', { entityType: 'x', entityId: 1 });
+    const approval = await db('workflow_approvals').where({ run_id: runId, status: 'pending' }).first();
+    await engine.actById(approval.id, 'deny'); // deny has no edge
+    const run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('failed'); // loud failure, not a green 'done'
+    expect(run.error).toMatch(/deny.*no matching edge/i);
+  });
+
+  test('admin confirms a gate early; the following wait holds dispatch until its date', async () => {
+    // The booking pattern: prepare → REVIEW GATE → WAIT(event date) → send. The
+    // admin can approve at the gate whenever; the run then parks at the wait and
+    // the scheduler dispatches when the date arrives.
+    const wfId = await makeWorkflow({
+      trigger: 'gatewait.event',
+      nodes: [
+        { key: 'g0', type: 'trigger' },
+        { key: 'g1', type: 'gate', config: { prompt: 'Approve invoice?' } },
+        { key: 'g2', type: 'wait', config: { delayDays: 5 } },
+        { key: 'g3', type: 'action', config: { action: 'noop' } },
+      ],
+      edges: [
+        { from: 'g0', to: 'g1' },
+        { from: 'g1', handle: 'confirm', to: 'g2' },
+        { from: 'g2', to: 'g3' },
+      ],
+    });
+    const [runId] = await engine.emitWorkflowEvent('gatewait.event', { entityType: 'invoice', entityId: 7 });
+    let run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('waiting');
+    expect(run.current_node).toBe('g1'); // parked at the review gate
+
+    // Admin confirms EARLY (before the wait date).
+    const approval = await db('workflow_approvals').where({ run_id: runId, status: 'pending' }).first();
+    await engine.actById(approval.id, 'confirm');
+    run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('waiting');
+    expect(run.current_node).toBe('g2'); // now holding at the wait, not yet dispatched
+
+    // Date arrives → scheduler dispatches.
+    await db('workflow_runs').where({ id: runId }).update({ wake_at: new Date(Date.now() - 1000).toISOString() });
+    await engine.runDueWaits();
+    run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('done');
+  });
+
+  test('recoverStaleRuns resumes a run orphaned mid-flow (crash recovery)', async () => {
+    const wfId = await makeWorkflow({
+      trigger: 'recover.event',
+      nodes: [{ key: 'r1', type: 'trigger' }, { key: 'r2', type: 'action', config: { action: 'noop' } }],
+      edges: [{ from: 'r1', to: 'r2' }],
+    });
+    // Simulate a run left 'running' at r2 with a stale heartbeat (crash mid-flow).
+    await db('workflow_runs').insert({
+      workflow_id: wfId, version: 1, trigger_event: 'recover.event', status: 'running', current_node: 'r2',
+      context: JSON.stringify({ vars: {} }), dedup_key: 'recover-1',
+      updated_at: new Date(Date.now() - 3600000).toISOString(),
+    });
+    const run0 = await db('workflow_runs').where({ dedup_key: 'recover-1' }).first();
+    const n = await engine.recoverStaleRuns({ staleMs: 1000 });
+    expect(n).toBeGreaterThanOrEqual(1);
+    const run = await db('workflow_runs').where({ id: run0.id }).first();
+    expect(run.status).toBe('done');
+  });
+
+  test('recoverStaleRuns abandons a crash-looping run after the attempts cap', async () => {
+    const wfId = await makeWorkflow({
+      trigger: 'crashloop.event',
+      nodes: [{ key: 'c1', type: 'trigger' }, { key: 'c2', type: 'action', config: { action: 'noop' } }],
+      edges: [{ from: 'c1', to: 'c2' }],
+    });
+    await db('workflow_runs').insert({
+      workflow_id: wfId, version: 1, trigger_event: 'crashloop.event', status: 'running', current_node: 'c2',
+      context: JSON.stringify({ vars: {} }), dedup_key: 'crash-1', attempts: 5,
+      updated_at: new Date(Date.now() - 3600000).toISOString(),
+    });
+    const run0 = await db('workflow_runs').where({ dedup_key: 'crash-1' }).first();
+    await engine.recoverStaleRuns({ staleMs: 1000 });
+    const run = await db('workflow_runs').where({ id: run0.id }).first();
+    expect(run.status).toBe('failed');
+  });
+
+  test('testRun dry-run walks the whole flow (waits skipped, gate auto-confirmed, actions mocked)', async () => {
+    const wfId = await makeWorkflow({
+      trigger: 'testfire.event',
+      nodes: [
+        { key: 't', type: 'trigger' },
+        { key: 'w', type: 'wait', config: { delayDays: 14 } },
+        { key: 'g', type: 'gate', config: { type: 'payment_confirm' } },
+        { key: 'a', type: 'action', config: { action: 'send_email', recipientClass: 'customer' } },
+        { key: 'end', type: 'action', config: { action: 'noop' } },
+      ],
+      edges: [
+        { from: 't', to: 'w' },
+        { from: 'w', to: 'g' },
+        { from: 'g', handle: 'confirm', to: 'a' },
+        { from: 'g', handle: 'deny', to: 'end' },
+        { from: 'a', to: 'end' },
+      ],
+    });
+    const runId = await engine.testRun(wfId, { dryRun: true });
+    const run = await db('workflow_runs').where({ id: runId }).first();
+    expect(run.status).toBe('done'); // walked to completion — no parking at the wait/gate
+
+    const steps = await db('workflow_run_steps').where({ run_id: runId });
+    expect(steps.find((s) => s.node_key === 'w').status).toBe('skipped'); // wait passed through
+    const emailStep = steps.find((s) => s.node_key === 'a');
+    expect(JSON.parse(emailStep.result).dryRun).toBe(true); // send_email mocked, no real mail
+  });
+});

backend/__tests__/integration/workflowRoutes.test.js

@@ -0,0 +1,147 @@
+/**
+ * Admin workflow API — route tests (CRUD, versioning, RBAC gate, approvals).
+ */
+const request = require('supertest');
+const {
+  bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken, buildRouteApp,
+} = require('./helpers/crmDb');
+
+// bootCrmDb runs the full core-migration set in beforeAll; under full-suite
+// parallel load on a small CI runner that can exceed the 5s default. Match the
+// other migration-heavy CRM suites (discountLineItems, incomingInvoiceRebill).
+jest.setTimeout(120000);
+
+let db;
+let cleanup;
+let app;
+let token;
+let noPermToken;
+
+const sampleGraph = {
+  name: 'Test flow',
+  trigger_type: 'invoice.sent',
+  enabled: false,
+  nodes: [
+    { node_key: 'n1', type: 'trigger' },
+    { node_key: 'n2', type: 'action', config: { action: 'noop' } },
+  ],
+  edges: [{ from_node: 'n1', to_node: 'n2' }],
+};
+
+beforeAll(async () => {
+  ({ db, cleanup } = await bootCrmDb());
+  const { adminId } = await seedMinimal(db);
+  await assignAdminRole(db, adminId, 'super_admin');
+  token = mintAdminToken(adminId);
+
+  const ins = await db('admin_users').insert({
+    username: 'norole', email: 'nr@example.com', password_hash: 'x',
+    must_change_password: false, created_at: new Date(),
+  }).returning('id');
+  noPermToken = mintAdminToken(ins[0]?.id ?? ins[0]);
+
+  await db('feature_flags').insert({ key: 'workflows', value: true });
+  app = buildRouteApp('/api/admin/workflows', require('../../src/routes/adminWorkflows'));
+});
+
+afterAll(async () => { await cleanup(); });
+
+const auth = (t) => ({ Authorization: `Bearer ${t}` });
+
+describe('admin workflows API', () => {
+  let createdId;
+
+  test('create → 201 with id', async () => {
+    const res = await request(app).post('/api/admin/workflows').set(auth(token)).send(sampleGraph);
+    expect(res.status).toBe(201);
+    expect(res.body.id).toBeGreaterThan(0);
+    createdId = res.body.id;
+  });
+
+  test('rejects a graph without exactly one trigger', async () => {
+    const res = await request(app).post('/api/admin/workflows').set(auth(token))
+      .send({ ...sampleGraph, nodes: [{ node_key: 'x', type: 'action' }], edges: [] });
+    expect(res.status).toBe(400);
+  });
+
+  test('rejects an unknown node type', async () => {
+    const res = await request(app).post('/api/admin/workflows').set(auth(token))
+      .send({ ...sampleGraph, nodes: [{ node_key: 't', type: 'trigger' }, { node_key: 'x', type: 'actoin' }], edges: [] });
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/unknown node type/i);
+  });
+
+  test('refuses to enable a flow that uses an unregistered action', async () => {
+    const create = await request(app).post('/api/admin/workflows').set(auth(token)).send({
+      name: 'Stub flow', trigger_type: 'quote.accepted', enabled: false,
+      nodes: [{ node_key: 't', type: 'trigger' }, { node_key: 'a', type: 'action', config: { action: 'totally_not_a_real_action' } }],
+      edges: [{ from_node: 't', to_node: 'a' }],
+    });
+    expect(create.status).toBe(201);
+    const res = await request(app).patch(`/api/admin/workflows/${create.body.id}/enabled`).set(auth(token)).send({ enabled: true });
+    expect(res.status).toBe(409);
+    expect(res.body.error).toMatch(/not.*implemented|totally_not_a_real_action/i);
+  });
+
+  test('allows enabling a flow using the now-implemented booking invoice actions', async () => {
+    const create = await request(app).post('/api/admin/workflows').set(auth(token)).send({
+      name: 'Invoice-only booking', trigger_type: 'quote.accepted', enabled: false,
+      nodes: [
+        { node_key: 't', type: 'trigger' },
+        { node_key: 'p', type: 'action', config: { action: 'prepare_invoice' } },
+        { node_key: 'g', type: 'gate', config: {} },
+        { node_key: 's', type: 'action', config: { action: 'send_document', document: 'invoice' } },
+      ],
+      edges: [
+        { from_node: 't', to_node: 'p' },
+        { from_node: 'p', to_node: 'g' },
+        { from_node: 'g', from_handle: 'confirm', to_node: 's' },
+      ],
+    });
+    expect(create.status).toBe(201);
+    const res = await request(app).patch(`/api/admin/workflows/${create.body.id}/enabled`).set(auth(token)).send({ enabled: true });
+    expect(res.status).toBe(200);
+    expect(res.body.enabled).toBe(true);
+  });
+
+  test('get one returns the graph', async () => {
+    const res = await request(app).get(`/api/admin/workflows/${createdId}`).set(auth(token));
+    expect(res.status).toBe(200);
+    expect(res.body.nodes).toHaveLength(2);
+    expect(res.body.edges).toHaveLength(1);
+    expect(res.body.version).toBe(1);
+  });
+
+  test('list includes it', async () => {
+    const res = await request(app).get('/api/admin/workflows').set(auth(token));
+    expect(res.status).toBe(200);
+    expect(res.body.some((w) => w.id === createdId)).toBe(true);
+  });
+
+  test('update bumps the version', async () => {
+    const res = await request(app).put(`/api/admin/workflows/${createdId}`).set(auth(token))
+      .send({ ...sampleGraph, name: 'Renamed' });
+    expect(res.status).toBe(200);
+    expect(res.body.version).toBe(2);
+    const get = await request(app).get(`/api/admin/workflows/${createdId}`).set(auth(token));
+    expect(get.body.name).toBe('Renamed');
+    expect(get.body.version).toBe(2);
+  });
+
+  test('enable toggle', async () => {
+    const res = await request(app).patch(`/api/admin/workflows/${createdId}/enabled`).set(auth(token)).send({ enabled: true });
+    expect(res.status).toBe(200);
+    expect(res.body.enabled).toBe(true);
+  });
+
+  test('approvals inbox returns an array', async () => {
+    const res = await request(app).get('/api/admin/workflows/approvals').set(auth(token));
+    expect(res.status).toBe(200);
+    expect(Array.isArray(res.body)).toBe(true);
+  });
+
+  test('a role without workflows.manage is forbidden from writing', async () => {
+    const res = await request(app).post('/api/admin/workflows').set(auth(noPermToken)).send(sampleGraph);
+    expect(res.status).toBe(403);
+  });
+});

backend/__tests__/middleware/adminAuthRoleFallback.test.js

@@ -0,0 +1,111 @@
+/**
+ * The roles-join fallback in adminAuth fabricates `role_name = 'super_admin'`
+ * to keep existing sessions working across the RBAC upgrade window. The catch
+ * around it used to be unconditional, so ANY transient database failure —
+ * connection reset, deadlock, statement timeout, pool exhaustion — took the
+ * same branch and handed the caller super_admin for the duration of the fault.
+ *
+ * `roleName` is the sole discriminator for every ownership check (ownership.js,
+ * adminProjects, adminUsers, adminApiTokens, projectService, ...), so that
+ * inverted the whole authorization model rather than failing the request.
+ * Issue #968. Same treatment apiTokenAuth already got for the v1 surface.
+ */
+
+const jwt = require('jsonwebtoken');
+
+jest.mock('../../src/utils/tokenRevocation', () => ({ isTokenRevoked: jest.fn().mockResolvedValue(false) }));
+jest.mock('../../src/utils/logger', () => ({ warn: jest.fn(), error: jest.fn(), debug: jest.fn(), info: jest.fn() }));
+
+// The joined query throws whatever the test stages; the role-less fallback
+// query (no .leftJoin) always succeeds, which is what made the original bug
+// reachable — it is the cheaper single-table read.
+// `mock`-prefixed so jest's module-factory hoisting allows the reference.
+let mockJoinError = null;
+const mockAdminRow = { id: 7, username: 'scoped', email: 's@example.com', password_changed_at: null };
+
+jest.mock('../../src/database/db', () => ({
+  db: () => ({
+    _joined: false,
+    leftJoin() { this._joined = true; return this; },
+    where() { return this; },
+    select() { return this; },
+    first() {
+      if (this._joined && mockJoinError) return Promise.reject(mockJoinError);
+      return Promise.resolve({ ...mockAdminRow });
+    },
+  }),
+}));
+
+const { adminAuth } = require('../../src/middleware/auth');
+
+const SECRET = 'test-secret-for-admin-auth-fallback';
+
+function makeReq() {
+  const token = jwt.sign(
+    { id: mockAdminRow.id, type: 'admin' },
+    SECRET,
+    { algorithm: 'HS256', issuer: 'picpeak-auth' },
+  );
+  return { headers: { authorization: `Bearer ${token}` }, ip: '127.0.0.1', connection: {} };
+}
+
+function makeRes() {
+  return {
+    statusCode: null,
+    body: null,
+    status(code) { this.statusCode = code; return this; },
+    json(payload) { this.body = payload; return this; },
+  };
+}
+
+describe('adminAuth roles-join fallback (#968)', () => {
+  const OLD_SECRET = process.env.JWT_SECRET;
+  beforeAll(() => { process.env.JWT_SECRET = SECRET; });
+  afterAll(() => { process.env.JWT_SECRET = OLD_SECRET; });
+  beforeEach(() => { mockJoinError = null; });
+
+  it('grants the upgrade-window fallback only for a genuinely missing roles table', async () => {
+    mockJoinError = new Error('SQLITE_ERROR: no such table: roles');
+    const req = makeReq();
+    const res = makeRes();
+    const next = jest.fn();
+
+    await adminAuth(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(req.admin.roleName).toBe('super_admin');
+  });
+
+  it.each([
+    ['connection reset', new Error('Connection terminated unexpectedly')],
+    ['deadlock', new Error('deadlock detected')],
+    ['pool exhaustion', new Error('Knex: Timeout acquiring a connection')],
+    ['statement timeout', new Error('canceling statement due to statement timeout')],
+  ])('does NOT fabricate super_admin on a transient failure (%s)', async (_label, err) => {
+    mockJoinError = err;
+    const req = makeReq();
+    const res = makeRes();
+    const next = jest.fn();
+
+    await adminAuth(req, res, next);
+
+    // Fails closed: request rejected, req.admin never populated. The specific
+    // status is 401 (adminAuth's blanket outer catch) — what matters is that
+    // the caller is not elevated and does not reach the route.
+    expect(next).not.toHaveBeenCalled();
+    expect(req.admin).toBeUndefined();
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('does NOT fabricate super_admin when an unrelated table is missing', async () => {
+    mockJoinError = new Error('SQLITE_ERROR: no such table: admin_sessions');
+    const req = makeReq();
+    const res = makeRes();
+    const next = jest.fn();
+
+    await adminAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(req.admin).toBeUndefined();
+  });
+});

backend/__tests__/middleware/apiTokenRoleFallback.test.js

@@ -0,0 +1,72 @@
+/**
+ * The roles-join fallback in apiTokenAuth grants `super_admin` (upgrade-path
+ * parity with adminAuth). It must therefore fire ONLY when the roles schema is
+ * genuinely absent — a catch-all turns any transient database failure into a
+ * privilege escalation that reopens GHSA-9697 for a demoted token owner.
+ */
+
+const { isMissingRolesSchema } = require('../../src/middleware/apiTokenAuth');
+
+describe('apiTokenAuth roles-schema fallback predicate (GHSA-9697)', () => {
+  it('accepts a genuinely missing roles table on both engines', () => {
+    expect(isMissingRolesSchema(new Error('SQLITE_ERROR: no such table: roles'))).toBe(true);
+    expect(isMissingRolesSchema(
+      Object.assign(new Error('relation "roles" does not exist'), { code: '42P01' }),
+    )).toBe(true);
+    expect(isMissingRolesSchema(
+      Object.assign(new Error('column roles.name does not exist'), { code: '42703' }),
+    )).toBe(true);
+  });
+
+  it('rejects transient failures that must not elevate the caller', () => {
+    expect(isMissingRolesSchema(new Error('Connection terminated unexpectedly'))).toBe(false);
+    expect(isMissingRolesSchema(new Error('deadlock detected'))).toBe(false);
+    expect(isMissingRolesSchema(new Error('Knex: Timeout acquiring a connection'))).toBe(false);
+    expect(isMissingRolesSchema(new Error('canceling statement due to statement timeout'))).toBe(false);
+    expect(isMissingRolesSchema(undefined)).toBe(false);
+  });
+
+  it('rejects a missing-table error for an unrelated table', () => {
+    expect(isMissingRolesSchema(new Error('SQLITE_ERROR: no such table: api_tokens'))).toBe(false);
+  });
+
+  // knex prefixes the failing SQL to err.message, and that SQL always names
+  // `roles` on this join — so the message substring proves nothing about the
+  // error, and only an exact driver phrase (or a SQLSTATE) may be trusted.
+  // These are real knex message shapes, captured from the actual query.
+  describe('with knex\'s SQL prefix on the message (#968)', () => {
+    const withSql = (driverMessage) => new Error(
+      'select `roles`.`name` as `role_name` from `admin_users` '
+      + 'left join `roles` on `roles`.`id` = `admin_users`.`role_id` '
+      + `where \`admin_users\`.\`id\` = 1 limit 1 - ${driverMessage}`,
+    );
+
+    it('accepts both legitimate upgrade-window states', () => {
+      // pre-054: the roles table does not exist yet
+      expect(isMissingRolesSchema(
+        Object.assign(withSql('SQLITE_ERROR: no such table: roles'), { code: 'SQLITE_ERROR' }),
+      )).toBe(true);
+      // post-054, pre-057: roles exists, admin_users.role_id not added yet
+      expect(isMissingRolesSchema(
+        Object.assign(withSql('SQLITE_ERROR: no such column: admin_users.role_id'), { code: 'SQLITE_ERROR' }),
+      )).toBe(true);
+    });
+
+    it('rejects an unrelated "does not exist" fault despite the SQL naming roles', () => {
+      // pgbouncer transaction pooling loses a named prepared statement
+      // (SQLSTATE 26000). Transient — the fallback query would succeed on a
+      // fresh connection, so accepting this would fabricate super_admin.
+      expect(isMissingRolesSchema(
+        Object.assign(withSql('prepared statement "S_1" does not exist'), { code: '26000' }),
+      )).toBe(false);
+      // The DB role/user, not the roles table.
+      expect(isMissingRolesSchema(
+        Object.assign(withSql('role "picpeak" does not exist'), { code: '28000' }),
+      )).toBe(false);
+      expect(isMissingRolesSchema(
+        Object.assign(withSql('database "picpeak" does not exist'), { code: '3D000' }),
+      )).toBe(false);
+      expect(isMissingRolesSchema(withSql('Connection terminated unexpectedly'))).toBe(false);
+    });
+  });
+});

backend/__tests__/middleware/authMustChangePassword.test.js

@@ -0,0 +1,123 @@
+/**
+ * GHSA-h4w8-57xq-53fx enforcement half: `must_change_password` was written
+ * by the admin password-reset flow (userManagementService.resetAdminPassword)
+ * and returned in a few response payloads, but no route-blocking logic ever
+ * checked it — a reset admin could keep using the old/weak password on every
+ * protected route indefinitely. adminAuth() is now the server-side backstop:
+ * a flagged admin gets 403 MUST_CHANGE_PASSWORD on everything except the
+ * routes they need to clear the flag (change-password) or leave (logout).
+ *
+ * Mirrors the mocking shape of adminAuthRoleFallback.test.js — a stub `db`
+ * chain, no real SQLite needed, so this stays a fast unit test.
+ */
+
+const jwt = require('jsonwebtoken');
+
+jest.mock('../../src/utils/tokenRevocation', () => ({ isTokenRevoked: jest.fn().mockResolvedValue(false) }));
+jest.mock('../../src/utils/logger', () => ({ warn: jest.fn(), error: jest.fn(), debug: jest.fn(), info: jest.fn() }));
+
+let mockMustChangePassword = false;
+const mockAdminRow = { id: 7, username: 'scoped', email: 's@example.com', password_changed_at: null, role_id: 1, role_name: 'editor' };
+
+jest.mock('../../src/database/db', () => ({
+  db: () => ({
+    leftJoin() { return this; },
+    where() { return this; },
+    select() { return this; },
+    first: () => Promise.resolve({ ...mockAdminRow, must_change_password: mockMustChangePassword }),
+  }),
+}));
+
+const { adminAuth } = require('../../src/middleware/auth');
+
+const SECRET = 'test-secret-for-must-change-password';
+
+function makeReq(originalUrl) {
+  const token = jwt.sign(
+    { id: mockAdminRow.id, type: 'admin' },
+    SECRET,
+    { algorithm: 'HS256', issuer: 'picpeak-auth' },
+  );
+  return { headers: { authorization: `Bearer ${token}` }, ip: '127.0.0.1', connection: {}, originalUrl };
+}
+
+function makeRes() {
+  return {
+    statusCode: null,
+    body: null,
+    status(code) { this.statusCode = code; return this; },
+    json(payload) { this.body = payload; return this; },
+  };
+}
+
+describe('adminAuth must_change_password enforcement (GHSA-h4w8-57xq-53fx)', () => {
+  const OLD_SECRET = process.env.JWT_SECRET;
+  beforeAll(() => { process.env.JWT_SECRET = SECRET; });
+  afterAll(() => { process.env.JWT_SECRET = OLD_SECRET; });
+  beforeEach(() => { mockMustChangePassword = false; });
+
+  it('blocks an arbitrary protected route with 403 MUST_CHANGE_PASSWORD when the flag is set', async () => {
+    mockMustChangePassword = true;
+    const req = makeReq('/api/admin/dashboard/stats');
+    const res = makeRes();
+    const next = jest.fn();
+
+    await adminAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(403);
+    expect(res.body).toEqual(expect.objectContaining({ code: 'MUST_CHANGE_PASSWORD' }));
+    expect(req.admin).toBeUndefined();
+  });
+
+  it('does not block when the flag is not set', async () => {
+    mockMustChangePassword = false;
+    const req = makeReq('/api/admin/dashboard/stats');
+    const res = makeRes();
+    const next = jest.fn();
+
+    await adminAuth(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(req.admin.mustChangePassword).toBe(false);
+  });
+
+  it.each([
+    ['/api/admin/auth/change-password'],
+    ['/api/admin/auth/logout'],
+  ])('still allows %s through when the flag is set', async (originalUrl) => {
+    mockMustChangePassword = true;
+    const req = makeReq(originalUrl);
+    const res = makeRes();
+    const next = jest.fn();
+
+    await adminAuth(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(req.admin.mustChangePassword).toBe(true);
+    expect(res.statusCode).toBeNull();
+  });
+
+  it('allows the exempt change-password path even with a query string', async () => {
+    mockMustChangePassword = true;
+    const req = makeReq('/api/admin/auth/change-password?foo=bar');
+    const res = makeRes();
+    const next = jest.fn();
+
+    await adminAuth(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+  });
+
+  it('does not exempt a route that merely starts with the change-password path', async () => {
+    mockMustChangePassword = true;
+    const req = makeReq('/api/admin/auth/change-password-history');
+    const res = makeRes();
+    const next = jest.fn();
+
+    await adminAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(403);
+  });
+});

backend/__tests__/middleware/ownership.filterOwnedEventIds.test.js

@@ -0,0 +1,78 @@
+/**
+ * Regression test for the bulk archive/delete ownership bypass.
+ *
+ * bulk-archive and bulk-delete acted on body-supplied event ids with no
+ * ownership filter, so an admin/editor scoped to their own events (the
+ * single-event routes enforce requireEventOwnership) could archive or
+ * cascade-delete ANY event by id. filterOwnedEventIds is the helper those
+ * routes now use to drop foreign/non-existent ids.
+ */
+
+// events owned by admin 7; event 3 owned by someone else; event 4 is
+// ownerless (legacy). The mock models:
+//   whereIn('id', ids).andWhere(created_by IS NULL OR created_by = admin.id)
+const EVENTS = [
+  { id: 1, created_by: 7 },
+  { id: 2, created_by: 7 },
+  { id: 3, created_by: 99 },   // foreign
+  { id: 4, created_by: null }, // ownerless/legacy
+];
+
+jest.mock('../../src/database/db', () => ({
+  db: () => {
+    const q = {
+      _ids: null,
+      _adminId: null,
+      whereIn(_col, ids) { this._ids = ids; return this; },
+      andWhere(cb) {
+        // Emulate the (created_by IS NULL OR created_by = admin.id) builder
+        // by capturing the admin id the callback closes over via a probe.
+        const probe = {
+          _adminId: null,
+          whereNull() { return this; },
+          orWhere(_col, id) { this._adminId = id; return this; },
+        };
+        cb(probe);
+        this._adminId = probe._adminId;
+        return this;
+      },
+      select() {
+        return Promise.resolve(
+          EVENTS
+            .filter((e) => this._ids.includes(e.id))
+            .filter((e) => e.created_by === null || e.created_by === this._adminId)
+            .map((e) => ({ id: e.id }))
+        );
+      },
+    };
+    return q;
+  },
+}));
+
+const { filterOwnedEventIds } = require('../../src/middleware/ownership');
+
+describe('filterOwnedEventIds', () => {
+  it('super_admin gets every id, nothing denied', async () => {
+    const { allowed, denied } = await filterOwnedEventIds(
+      { id: 7, roleName: 'super_admin' }, [1, 3, 4, 999]
+    );
+    expect(allowed).toEqual([1, 3, 4, 999]);
+    expect(denied).toEqual([]);
+  });
+
+  it('non-super_admin keeps owned + ownerless, denies foreign and non-existent', async () => {
+    const { allowed, denied } = await filterOwnedEventIds(
+      { id: 7, roleName: 'admin' }, [1, 2, 3, 4, 999]
+    );
+    expect(allowed.sort()).toEqual([1, 2, 4]);   // owns 1,2; 4 is ownerless
+    expect(denied.sort()).toEqual([3, 999]);      // 3 foreign, 999 missing
+  });
+
+  it('foreign-only request yields empty allowed', async () => {
+    const { allowed, denied } = await filterOwnedEventIds(
+      { id: 7, roleName: 'editor' }, [3]
+    );
+    expect(allowed).toEqual([]);
+    expect(denied).toEqual([3]);
+  });
+});

backend/__tests__/middleware/securityHardeningBatch2.test.js

@@ -0,0 +1,70 @@
+/**
+ * Second security sweep on the same branch as the password-strength DoS fix
+ * (stable port: the maintenance and admin-preview cases do not apply here).
+ * Each block pins one gap the audit found:
+ *
+ *  - the general rate limiter skipped anyone holding ANY verified JWT,
+ *    including a gallery token minted for free on password-less galleries
+ *  - the multipart branch of the CSRF Content-Type gate accepted cross-site
+ *    form posts
+ */
+const jwt = require('jsonwebtoken');
+
+process.env.JWT_SECRET = 'hardening-batch2-secret';
+
+const fake = { maintenance: 'true', revoked: false, beforeCutoff: false, admin: { id: 1, password_changed_at: null } };
+
+jest.mock('../../src/database/db', () => {
+  const db = jest.fn((table) => {
+    const q = {
+      where: jest.fn().mockReturnThis(),
+      select: jest.fn().mockReturnThis(),
+      first: jest.fn(async () => {
+        if (table === 'app_settings') {
+          return { setting_key: 'general_maintenance_mode', setting_value: fake.maintenance };
+        }
+        if (table === 'admin_users') return fake.admin;
+        return null;
+      }),
+    };
+    return q;
+  });
+  return { db, withRetry: (fn) => fn() };
+});
+jest.mock('../../src/utils/logger', () => ({ error: jest.fn(), warn: jest.fn(), info: jest.fn(), debug: jest.fn() }));
+process.env.FRONTEND_URL = 'https://photos.example.com';
+
+const { isAuthenticated } = require('../../src/services/rateLimitService');
+const { multipartOriginAllowed } = require('../../src/utils/requestOrigin');
+
+const iat = Math.floor(Date.now() / 1000) - 10;
+const adminToken = (extra = {}) => jwt.sign({ type: 'admin', id: 1, iat, ...extra }, process.env.JWT_SECRET, { issuer: 'picpeak-auth' });
+const galleryToken = () => jwt.sign({ type: 'gallery', eventId: 1, iat }, process.env.JWT_SECRET, { issuer: 'picpeak-auth' });
+
+describe('general rate limiter skip', () => {
+  const req = (token) => ({ path: '/api/gallery/x/photos', headers: { authorization: `Bearer ${token}` }, cookies: {} });
+  it('is granted to an admin session', () => {
+    expect(isAuthenticated(req(adminToken()))).toBe(true);
+  });
+  it('is NOT granted to a gallery token', () => {
+    expect(isAuthenticated(req(galleryToken()))).toBe(false);
+  });
+});
+
+describe('multipart origin gate', () => {
+  const req = (headers) => ({ headers: { host: 'photos.example.com', ...headers } });
+  it('accepts same-origin, same-site and non-browser requests', () => {
+    expect(multipartOriginAllowed(req({ 'sec-fetch-site': 'same-origin' }))).toBe(true);
+    expect(multipartOriginAllowed(req({ 'sec-fetch-site': 'same-site' }))).toBe(true);
+    expect(multipartOriginAllowed(req({ 'sec-fetch-site': 'none' }))).toBe(true);
+    expect(multipartOriginAllowed(req({}))).toBe(true);
+    expect(multipartOriginAllowed(req({ origin: 'https://photos.example.com' }))).toBe(true);
+    // Same-origin install without FRONTEND_URL: Origin matches the Host.
+    expect(multipartOriginAllowed({ headers: { host: 'gallery.local', origin: 'http://gallery.local' } })).toBe(true);
+  });
+  it('rejects cross-site form posts', () => {
+    expect(multipartOriginAllowed(req({ 'sec-fetch-site': 'cross-site' }))).toBe(false);
+    expect(multipartOriginAllowed(req({ origin: 'https://evil.example' }))).toBe(false);
+    expect(multipartOriginAllowed(req({ origin: 'null' }))).toBe(false);
+  });
+});

backend/__tests__/middleware/sessionTimeout.isSessionExpired.test.js

@@ -0,0 +1,112 @@
+/**
+ * Unit test for the non-mutating isSessionExpired() helper added to
+ * middleware/sessionTimeout.js. Used by GET /auth/session to mirror the
+ * timeout enforcement that sessionTimeoutMiddleware applies to /api/admin
+ * endpoints — closing the asymmetry that surfaced as the redirect-loop
+ * recurrence on v3.39.1-beta.0 (issue #350).
+ *
+ * The helper has two branches:
+ *   1. In-memory `lastActivity` exists for this token  → expired iff
+ *      now - lastActivity > timeout.
+ *   2. No in-memory entry (post-restart, or first request)  → expired
+ *      iff token's iat is older than the timeout (post-restart guard
+ *      that the existing middleware already implements at line ~101).
+ *
+ * Both branches must NOT mutate the in-memory `sessions` Map — the
+ * middleware is the only place that tracks activity. We assert that.
+ */
+
+jest.mock('../../src/database/db', () => ({
+  db: () => ({
+    where: () => ({
+      first: () => ({
+        timeout: () => Promise.resolve(null),
+      }),
+    }),
+  }),
+}));
+
+// Speed up the cached-timeout reads. The module reads
+// `security_session_timeout_minutes` from app_settings and falls back to
+// DEFAULT_SESSION_TIMEOUT (60 min) when the row is null.
+const SIXTY_MINUTES_MS = 60 * 60 * 1000;
+
+const sessionTimeout = require('../../src/middleware/sessionTimeout');
+const { isSessionExpired } = sessionTimeout;
+
+function makeDecodedToken({ id = 1, iatSecondsAgo = 0 } = {}) {
+  return { id, iat: Math.floor((Date.now() - iatSecondsAgo * 1000) / 1000) };
+}
+
+describe('isSessionExpired (sessionTimeout helper)', () => {
+  it('returns false for a freshly-issued token with no in-memory record', async () => {
+    const decoded = makeDecodedToken({ id: 1, iatSecondsAgo: 60 });
+    expect(await isSessionExpired('fresh-token-1', decoded)).toBe(false);
+  });
+
+  it('returns true when iat is older than the timeout (post-restart guard)', async () => {
+    const decoded = makeDecodedToken({
+      id: 2,
+      // 90 minutes > 60 minute default timeout
+      iatSecondsAgo: 90 * 60,
+    });
+    expect(await isSessionExpired('stale-token-2', decoded)).toBe(true);
+  });
+
+  it('returns false / true based on lastActivity when one exists', async () => {
+    // Drive the in-memory map by running the actual middleware once to
+    // record activity for the token, then check the helper.
+    const decoded = makeDecodedToken({ id: 3 });
+
+    // Drive the actual middleware once with a real signed token so it
+    // records this token in the in-memory `sessions` Map. Then check the
+    // helper sees that recent activity and reports "not expired".
+    const res = { status: jest.fn(() => res), json: jest.fn() };
+    const jwt = require('jsonwebtoken');
+    process.env.JWT_SECRET = 'session-timeout-helper-test-secret';
+    const realToken = jwt.sign(decoded, process.env.JWT_SECRET, {
+      issuer: 'picpeak-auth',
+    });
+    const realReq = {
+      headers: { authorization: `Bearer ${realToken}` },
+      cookies: {},
+    };
+    await sessionTimeout.sessionTimeoutMiddleware(realReq, res, () => {});
+
+    const decodedReal = jwt.decode(realToken);
+    // Just-recorded → not expired
+    expect(await isSessionExpired(realToken, decodedReal)).toBe(false);
+  });
+
+  it('returns false when token / decoded is missing (defensive)', async () => {
+    expect(await isSessionExpired(null, { id: 1 })).toBe(false);
+    expect(await isSessionExpired('tok', null)).toBe(false);
+    expect(await isSessionExpired('tok', {})).toBe(false);
+  });
+
+  // Sanity: the helper must not poke the `sessions` Map. Indirectly check
+  // by counting active sessions before/after a call with a never-seen
+  // token — should not change.
+  it('does not mutate the in-memory sessions map', async () => {
+    const before = sessionTimeout.getActiveSessions();
+    await isSessionExpired('never-seen-token-99', makeDecodedToken({ id: 99 }));
+    const after = sessionTimeout.getActiveSessions();
+    expect(after).toBe(before);
+  });
+
+  it('uses the default 60-minute timeout when no DB setting exists', async () => {
+    // 59 minutes → not expired
+    const fresh = makeDecodedToken({ id: 4, iatSecondsAgo: 59 * 60 });
+    expect(await isSessionExpired('fresh-4', fresh)).toBe(false);
+
+    // 61 minutes → expired (just past the default)
+    const stale = makeDecodedToken({ id: 5, iatSecondsAgo: 61 * 60 });
+    expect(await isSessionExpired('stale-5', stale)).toBe(true);
+  });
+
+  // Document the constant the test relies on so a future timeout change
+  // makes this assertion explicit rather than mysterious.
+  it('default timeout is 60 minutes (constant under test)', () => {
+    expect(SIXTY_MINUTES_MS).toBe(60 * 60 * 1000);
+  });
+});

backend/__tests__/migrations/167_projects_created_by.test.js

@@ -0,0 +1,35 @@
+/**
+ * Migration 167 (projects.created_by) — idempotent on re-run, reversible,
+ * and backfills the owner from a project's single linked event (GHSA-wrg5).
+ */
+const path=require('path'), fs=require('fs'), os=require('os');
+process.env.NODE_ENV='test';
+process.env.TEST_DATABASE_PATH=path.join(fs.mkdtempSync(path.join(os.tmpdir(),'picpeak-mig167-')),'db.sqlite');
+process.env.JWT_SECRET='mig';
+const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
+const mig = require('../../migrations/core/167_add_projects_created_by');
+describe('migration 167', () => {
+  let db, cleanup;
+  beforeAll(async()=>{ ({db,cleanup}=await bootCrmDb()); await seedMinimal(db); },120000);
+  afterAll(async()=>{ if(cleanup) await cleanup(); });
+  it('is idempotent on re-run and reversible', async () => {
+    await mig.up(db);            // already applied by boot; must no-op
+    await mig.up(db);            // and again
+    expect(await db.schema.hasColumn('projects','created_by')).toBe(true);
+    await mig.down(db);
+    expect(await db.schema.hasColumn('projects','created_by')).toBe(false);
+    await mig.up(db);            // re-apply cleanly
+    expect(await db.schema.hasColumn('projects','created_by')).toBe(true);
+  });
+  it('backfills created_by from a single linked event owner', async () => {
+    const p = await db('projects').insert({name:'bf',status:'active',created_at:new Date(),updated_at:new Date()}).returning('id');
+    const pid = p[0]?.id ?? p[0];
+    await db('events').insert({slug:'bf-ev',event_type:'wedding',event_name:'bf',event_date:'2026-08-01',
+      host_email:'h@e.com',admin_email:'a@e.com',password_hash:'x',share_token:'t1',share_link:'/g/bf-ev/t1',
+      created_by: 4242, project_id: pid, expires_at:new Date(Date.now()+864e5).toISOString(),
+      is_active:1,is_archived:0,is_draft:0,created_at:new Date().toISOString()});
+    await mig.up(db);
+    const row = await db('projects').where({id:pid}).first();
+    expect(row.created_by).toBe(4242);
+  });
+});

backend/__tests__/migrations/168_fix_expense_activity_event_id.test.js

@@ -0,0 +1,83 @@
+/**
+ * GHSA-jhcf round 3: scoping the activity feed does nothing about the rows
+ * already on disk. expenseService used to pass adminId into logActivity's
+ * `eventId` slot, so upgraded instances carry accounting rows whose event_id
+ * is an ADMIN id — and the scope predicate happily matches those against a
+ * same-numbered event the caller owns.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-mig168-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'mig168-test-secret';
+
+const { bootCrmDb } = require('../integration/helpers/crmDb');
+const migration = require('../../migrations/core/168_fix_expense_activity_event_id');
+
+describe('migration 168 — legacy accounting activity rows (GHSA-jhcf)', () => {
+  let db; let cleanup;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  it('re-attributes the admin id and clears event_id, leaving real rows alone', async () => {
+    await db('activity_logs').insert([
+      // Legacy shape: event_id is really admin #7, no actor recorded.
+      {
+        activity_type: 'expense_created',
+        actor_type: 'system',
+        actor_id: null,
+        event_id: 7,
+        metadata: JSON.stringify({ expenseId: 1 }),
+        created_at: new Date().toISOString(),
+      },
+      {
+        activity_type: 'incoming_invoice_captured',
+        actor_type: 'system',
+        actor_id: null,
+        event_id: 9,
+        metadata: JSON.stringify({ inboundDocumentId: 2 }),
+        created_at: new Date().toISOString(),
+      },
+      // A genuine event-scoped row from another subsystem must survive intact.
+      {
+        activity_type: 'photo_uploaded',
+        actor_type: 'admin',
+        actor_id: 3,
+        event_id: 7,
+        metadata: JSON.stringify({}),
+        created_at: new Date().toISOString(),
+      },
+    ]);
+
+    await migration.up(db);
+
+    const expense = await db('activity_logs').where({ activity_type: 'expense_created' }).first();
+    expect(expense.event_id == null).toBe(true);
+    expect(Number(expense.actor_id)).toBe(7);
+    expect(expense.actor_type).toBe('admin');
+
+    const captured = await db('activity_logs').where({ activity_type: 'incoming_invoice_captured' }).first();
+    expect(captured.event_id == null).toBe(true);
+    expect(Number(captured.actor_id)).toBe(9);
+
+    const photo = await db('activity_logs').where({ activity_type: 'photo_uploaded' }).first();
+    expect(Number(photo.event_id)).toBe(7);
+    expect(Number(photo.actor_id)).toBe(3);
+  });
+
+  it('is idempotent on re-run', async () => {
+    await expect(migration.up(db)).resolves.toBeUndefined();
+    const expense = await db('activity_logs').where({ activity_type: 'expense_created' }).first();
+    expect(Number(expense.actor_id)).toBe(7);
+    expect(expense.event_id == null).toBe(true);
+  });
+});

backend/__tests__/migrations/175_fix_css_template_photo_height.test.js

@@ -0,0 +1,242 @@
+/**
+ * Repairing the bundled templates' fixed image height (#1131).
+ *
+ * The risk in a migration that rewrites user-visible CSS is doing too much,
+ * so most of what is pinned here is what it must NOT touch: the other pixel
+ * heights inside the very same templates (a 1px divider, an 8px scrollbar),
+ * and any rule a user wrote themselves.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+const migration = require('../../migrations/core/175_fix_css_template_photo_height');
+
+const ELEGANT_DARK = `
+.photo-card {
+  border-radius: 12px;
+}
+
+.photo-card img {
+  width: 100%;
+  height: 200px;
+  object-fit: cover;
+  transition: transform 0.3s ease;
+}
+`;
+
+const LIQUID_GLASS_DARK = `
+.gallery-page::after {
+  content: '';
+  height: 1px;
+  background: linear-gradient(90deg, transparent, #fff, transparent);
+}
+
+.photo-card img {
+  width: 100%;
+  height: 240px;
+  object-fit: cover;
+  filter: brightness(0.9);
+}
+
+.gallery-page ::-webkit-scrollbar {
+  width: 8px;
+  height: 8px;
+}
+
+@media (max-width: 640px) {
+  .photo-card img {
+    height: 180px;
+  }
+}
+`;
+
+describe('migration 175 — CSS template image height (#1131)', () => {
+  let knex; let tmpDir;
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-mig175-'));
+    knex = require('knex')({
+      client: 'sqlite3',
+      connection: { filename: path.join(tmpDir, 'db.sqlite') },
+      useNullAsDefault: true,
+    });
+    await knex.schema.createTable('css_templates', (t) => {
+      t.increments('id').primary();
+      t.string('name');
+      t.text('css_content');
+    });
+  });
+
+  afterAll(async () => {
+    if (knex) await knex.destroy();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  beforeEach(async () => { await knex('css_templates').del(); });
+
+  const contentOf = async (name) =>
+    (await knex('css_templates').where({ name }).first()).css_content;
+
+  it('relaxes the default template so the layouts h-full can win', async () => {
+    await knex('css_templates').insert({ name: 'Elegant Dark', css_content: ELEGANT_DARK });
+
+    await migration.up(knex);
+
+    const css = await contentOf('Elegant Dark');
+    expect(css).toContain('height: 100%');
+    expect(css).not.toContain('height: 200px');
+    // Everything else about the rule survives.
+    expect(css).toContain('object-fit: cover');
+    expect(css).toContain('transition: transform 0.3s ease');
+  });
+
+  it('fixes both the base rule and the mobile override of the dark glass template', async () => {
+    await knex('css_templates').insert({ name: 'Liquid Glass Dark', css_content: LIQUID_GLASS_DARK });
+
+    await migration.up(knex);
+
+    const css = await contentOf('Liquid Glass Dark');
+    expect(css).not.toContain('height: 240px');
+    expect(css).not.toContain('height: 180px');
+    expect(css.match(/height: 100%/g)).toHaveLength(2);
+  });
+
+  it('leaves the divider and the scrollbar alone', async () => {
+    await knex('css_templates').insert({ name: 'Liquid Glass Dark', css_content: LIQUID_GLASS_DARK });
+
+    await migration.up(knex);
+
+    // The whole reason this matches full rule bodies rather than every
+    // `height: <n>px`: these are in the same stylesheet and are correct.
+    const css = await contentOf('Liquid Glass Dark');
+    expect(css).toContain('height: 1px');
+    expect(css).toContain('width: 8px');
+    expect(css).toContain('height: 8px');
+  });
+
+  /**
+   * The case that forced the scope wider. `sanitizeCSS` strips control
+   * characters, so any template ever saved through the editor — including a
+   * save that only changed its name — has had every newline REMOVED. An
+   * exact-text migration finds nothing on those installs, is recorded as
+   * applied, and leaves them broken permanently.
+   */
+  it('fixes a template that has been through the editor, newlines and all', async () => {
+    const { sanitizeCSS } = require('../../src/utils/cssSanitizer');
+    const { sanitized } = sanitizeCSS(ELEGANT_DARK);
+    // Precondition: the sanitizer really did flatten it.
+    expect(sanitized).not.toContain('\n');
+    expect(sanitized).toContain('height: 200px');
+    await knex('css_templates').insert({ name: 'Saved Once', css_content: sanitized });
+
+    await migration.up(knex);
+
+    const css = await contentOf('Saved Once');
+    expect(css).not.toContain('200px');
+    expect(css).toContain('height: 100%');
+  });
+
+  it('relaxes a user-authored fixed height too, but only on .photo-card img', async () => {
+    // Deliberately broader than the seeded text — see the migration header. A
+    // pixel height on the image cannot be right under any of the seven
+    // layouts, whoever wrote it; a height anywhere else is none of our
+    // business.
+    const mine = '.photo-card img {\n  height: 220px;\n}\n.hero { height: 400px; }';
+    await knex('css_templates').insert({ name: 'My Own', css_content: mine });
+
+    await migration.up(knex);
+
+    const css = await contentOf('My Own');
+    expect(css).toContain('height: 100%');
+    expect(css).not.toContain('220px');
+    expect(css).toContain('.hero { height: 400px; }');
+  });
+
+  it('does not rewrite other properties that merely end in -height', async () => {
+    // `line-height: 200px` contains `height: 200px` as a substring, so an
+    // unanchored pattern silently rewrites it — in a migration that cannot be
+    // undone.
+    const mine = [
+      '.photo-card img {',
+      '  line-height: 200px;',
+      '  max-height: 300px;',
+      '  min-height: 14px;',
+      '  --tile-height: 220px;',
+      '  height: 200px;',
+      '}',
+    ].join('\n');
+    await knex('css_templates').insert({ name: 'Adjacent Props', css_content: mine });
+
+    await migration.up(knex);
+
+    const css = await contentOf('Adjacent Props');
+    expect(css).toContain('line-height: 200px');
+    expect(css).toContain('max-height: 300px');
+    expect(css).toContain('min-height: 14px');
+    expect(css).toContain('--tile-height: 220px');
+    // Only the real one moved.
+    expect(css).toContain('height: 100%');
+    expect(css).not.toMatch(/(?<![\w-])height:\s*200px/);
+  });
+
+  it('handles a grouped selector list', async () => {
+    // Requiring `{` straight after `img` skipped these entirely — and the
+    // migration is still recorded as applied, so the template kept the bug.
+    const mine = '.photo-card img, .thumbnail img {\n  height: 200px;\n}';
+    await knex('css_templates').insert({ name: 'Grouped', css_content: mine });
+
+    await migration.up(knex);
+
+    const css = await contentOf('Grouped');
+    expect(css).toContain('.photo-card img, .thumbnail img {');
+    expect(css).toContain('height: 100%');
+    expect(css).not.toContain('200px');
+  });
+
+  it('skips a nested rule rather than rewriting the wrong declaration', async () => {
+    // Valid nested CSS that passes the validator. A brace-greedy body would
+    // capture the inner block and rewrite the CAPTION's height, which cannot
+    // be undone. Leaving it untouched is the lesser evil.
+    const mine = '.photo-card img {\n  & + .caption { height: 200px; }\n}';
+    await knex('css_templates').insert({ name: 'Nested', css_content: mine });
+
+    await migration.up(knex);
+
+    expect(await contentOf('Nested')).toBe(mine);
+  });
+
+  it('leaves non-pixel heights on the image alone', async () => {
+    const mine = '.photo-card img { height: 50vh; }\n.photo-card img { height: auto; }';
+    await knex('css_templates').insert({ name: 'Relative', css_content: mine });
+
+    await migration.up(knex);
+
+    expect(await contentOf('Relative')).toBe(mine);
+  });
+
+  it('is idempotent and safe on a row with no CSS', async () => {
+    await knex('css_templates').insert([
+      { name: 'Elegant Dark', css_content: ELEGANT_DARK },
+      { name: 'Empty', css_content: null },
+    ]);
+
+    await migration.up(knex);
+    const once = await contentOf('Elegant Dark');
+    await migration.up(knex);
+
+    expect(await contentOf('Elegant Dark')).toBe(once);
+    expect(await contentOf('Empty')).toBeNull();
+  });
+
+  it('no-ops when the table does not exist yet', async () => {
+    await knex.schema.dropTable('css_templates');
+    await expect(migration.up(knex)).resolves.toBeUndefined();
+    await knex.schema.createTable('css_templates', (t) => {
+      t.increments('id').primary();
+      t.string('name');
+      t.text('css_content');
+    });
+  });
+});

backend/__tests__/migrations/176_external_relpath_unique.test.js

@@ -0,0 +1,546 @@
+/**
+ * One row per external file per event (#1162).
+ *
+ * The migration has two halves and they fail differently: the cleanup can take
+ * out the wrong row of a pair (losing a thumbnail, orphaning an event's hero),
+ * and the index can fail to be created at all — leaving an install that looks
+ * migrated and is still racing. Both are pinned here.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+const migration = require('../../migrations/core/176_external_relpath_unique');
+
+describe('migration 176 — unique (event_id, external_relpath) (#1162)', () => {
+  let knex; let tmpDir;
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-mig186-'));
+    knex = require('knex')({
+      client: 'sqlite3',
+      connection: { filename: path.join(tmpDir, 'db.sqlite') },
+      useNullAsDefault: true,
+    });
+  });
+
+  afterAll(async () => {
+    if (knex) await knex.destroy();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  beforeEach(async () => {
+    for (const table of [
+      'photos', 'events', 'photo_categories', 'photo_feedback',
+      'photo_admin_marks', 'photo_faces', 'image_access_logs', 'transfer_files',
+    ]) {
+      await knex.schema.dropTableIfExists(table);
+    }
+    await knex.schema.createTable('events', (t) => {
+      t.increments('id').primary();
+      t.integer('hero_photo_id');
+      t.string('download_zip_path');
+      t.string('download_zip_generated_at');
+    });
+    await knex.schema.createTable('photo_categories', (t) => {
+      t.increments('id').primary();
+      t.integer('hero_photo_id');
+    });
+    await knex.schema.createTable('photos', (t) => {
+      t.increments('id').primary();
+      t.integer('event_id');
+      t.string('external_relpath');
+      t.string('thumbnail_path');
+      t.string('source_origin').defaultTo('managed');
+      t.integer('feedback_count').defaultTo(0);
+      t.integer('like_count').defaultTo(0);
+      t.decimal('average_rating', 3, 2).defaultTo(0);
+      t.integer('favorite_count').defaultTo(0);
+      t.integer('reaction_count').defaultTo(0);
+      t.integer('color_label_count').defaultTo(0);
+      t.string('face_status');
+      t.integer('view_count').defaultTo(0);
+      t.integer('download_count').defaultTo(0);
+      t.integer('face_count');
+      t.string('face_started_at');
+      t.text('face_error');
+    });
+    // Declared exactly as the real schema declares them — CASCADE and all.
+    // The point of these tables here is that SQLite does NOT enforce any of
+    // it (PicPeak never sets `PRAGMA foreign_keys = ON`), so a bare delete of
+    // the photo row leaves every one of them dangling.
+    await knex.schema.createTable('photo_feedback', (t) => {
+      t.increments('id').primary();
+      t.integer('photo_id').references('id').inTable('photos').onDelete('CASCADE');
+      t.integer('event_id');
+      t.string('feedback_type');
+      t.text('comment_text');
+      t.string('guest_identifier');
+      // Per-person guest identity (migration 078). Nullable: galleries without
+      // guest identity leave it NULL and fall back to guest_identifier.
+      t.integer('guest_id');
+      t.integer('rating');
+      t.boolean('is_hidden').defaultTo(false);
+      t.boolean('is_approved').defaultTo(true);
+    });
+    await knex.schema.createTable('photo_admin_marks', (t) => {
+      t.increments('id').primary();
+      t.integer('photo_id').notNullable().references('id').inTable('photos').onDelete('CASCADE');
+      t.integer('event_id');
+      t.integer('admin_id');
+      t.integer('rating');
+      // Independently writable alongside rating, per photoAdminMarksService.
+      t.string('color_label', 16);
+      t.unique(['photo_id', 'admin_id'], 'photo_admin_marks_photo_admin_uniq');
+    });
+    await knex.schema.createTable('photo_faces', (t) => {
+      t.increments('id').primary();
+      t.integer('photo_id').references('id').inTable('photos').onDelete('CASCADE');
+      t.integer('event_id');
+      // purgePhotoFaces rebuilds the people that lose members, so the cluster
+      // link and the vectors recomputeCentroid reads have to be here for this
+      // to exercise the real path rather than a stub.
+      t.integer('person_id');
+      t.binary('embedding');
+      t.float('det_score');
+    });
+
+    await knex.schema.createTable('image_access_logs', (t) => {
+      t.increments('id').primary();
+      t.integer('photo_id');
+    });
+    await knex.schema.createTable('transfer_files', (t) => {
+      t.increments('id').primary();
+      t.integer('transfer_id');
+      t.integer('photo_id');
+      t.unique(['transfer_id', 'photo_id'], 'transfer_files_unique');
+    });
+  });
+
+  /** Two duplicate rows for the same file: id 1 survives, id 2 is doomed. */
+  const seedPair = async () => {
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'a/x.jpg', thumbnail_path: 't', source_origin: 'external' },
+      { event_id: 1, external_relpath: 'a/x.jpg', thumbnail_path: 't', source_origin: 'external' },
+    ]);
+  };
+
+  const rows = () => knex('photos').orderBy('id', 'asc').select('*');
+
+  it('collapses a duplicated pair to one row and leaves distinct paths alone', async () => {
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'a/x.jpg', thumbnail_path: 't1', source_origin: 'external' },
+      { event_id: 1, external_relpath: 'a/x.jpg', thumbnail_path: 't2', source_origin: 'external' },
+      { event_id: 1, external_relpath: 'a/y.jpg', thumbnail_path: 't3', source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+
+    const after = await rows();
+    expect(after.map((r) => r.external_relpath)).toEqual(['a/x.jpg', 'a/y.jpg']);
+    // Lowest id survives when both sides are equally complete.
+    expect(after[0].id).toBe(1);
+  });
+
+  it('does not collapse the same path across different events', async () => {
+    // The constraint is per event. Two events referencing the same NAS folder
+    // is a supported setup, and treating those as duplicates would delete one
+    // event's entire library.
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'a/x.jpg', source_origin: 'external' },
+      { event_id: 2, external_relpath: 'a/x.jpg', source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await knex('photos').count('* as c').first()).toEqual({ c: 2 });
+  });
+
+  it('never touches managed rows, however many carry NULL', async () => {
+    // Every managed photo has external_relpath NULL. Grouping on it without
+    // the NOT NULL filter would make them all one enormous "duplicate" group
+    // and delete the entire library bar one row.
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: null, source_origin: 'managed' },
+      { event_id: 1, external_relpath: null, source_origin: 'managed' },
+      { event_id: 1, external_relpath: null, source_origin: 'managed' },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await knex('photos').count('* as c').first()).toEqual({ c: 3 });
+  });
+
+  it('keeps the row that has a thumbnail, not merely the lowest id', async () => {
+    // An import killed mid-flight leaves rows without a thumbnail. Dropping
+    // the completed one would blank a tile in the grid for no reason.
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'a/x.jpg', thumbnail_path: null, source_origin: 'external' },
+      { event_id: 1, external_relpath: 'a/x.jpg', thumbnail_path: 'thumb.jpg', source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+
+    const after = await rows();
+    expect(after).toHaveLength(1);
+    expect(after[0].thumbnail_path).toBe('thumb.jpg');
+  });
+
+  it('repoints a hero that pointed at the row being removed', async () => {
+    // events.hero_photo_id is ON DELETE SET NULL, so without this the cleanup
+    // silently strips the event's hero image — a visible regression caused
+    // entirely by the fix.
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'a/x.jpg', thumbnail_path: 't', source_origin: 'external' },
+      { event_id: 1, external_relpath: 'a/x.jpg', thumbnail_path: 't', source_origin: 'external' },
+    ]);
+    await knex('events').insert({ id: 1, hero_photo_id: 2 });
+    await knex('photo_categories').insert({ id: 1, hero_photo_id: 2 });
+
+    await migration.up(knex);
+
+    expect((await knex('events').where({ id: 1 }).first()).hero_photo_id).toBe(1);
+    expect((await knex('photo_categories').where({ id: 1 }).first()).hero_photo_id).toBe(1);
+  });
+
+  it('leaves a hero that pointed at the survivor untouched', async () => {
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'a/x.jpg', thumbnail_path: 't', source_origin: 'external' },
+      { event_id: 1, external_relpath: 'a/x.jpg', thumbnail_path: 't', source_origin: 'external' },
+    ]);
+    await knex('events').insert({ id: 1, hero_photo_id: 1 });
+
+    await migration.up(knex);
+
+    expect((await knex('events').where({ id: 1 }).first()).hero_photo_id).toBe(1);
+  });
+
+  it('makes a second insert of the same path impossible afterwards', async () => {
+    // The whole point. Without this the route is still racing, and the
+    // migration is recorded as applied.
+    await knex('photos').insert({ event_id: 1, external_relpath: 'a/x.jpg', source_origin: 'external' });
+
+    await migration.up(knex);
+
+    await expect(
+      knex('photos').insert({ event_id: 1, external_relpath: 'a/x.jpg', source_origin: 'external' })
+    ).rejects.toThrow(/unique/i);
+  });
+
+  it('still admits managed rows once the index exists', async () => {
+    await migration.up(knex);
+
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: null, source_origin: 'managed' },
+      { event_id: 1, external_relpath: null, source_origin: 'managed' },
+    ]);
+
+    expect(await knex('photos').count('* as c').first()).toEqual({ c: 2 });
+  });
+
+  it('leaves nothing dangling behind the deleted row', async () => {
+    // SQLite never enforces the ON DELETE CASCADE these tables declare, so a
+    // bare delete strands biometric embeddings, feedback and marks pointing at
+    // a photo id that no longer exists — on every SQLite install.
+    await seedPair();
+    await knex('photo_faces').insert({ photo_id: 2, event_id: 1 });
+    await knex('image_access_logs').insert({ photo_id: 2 });
+
+    await migration.up(knex);
+
+    expect(await knex('photo_faces').where('photo_id', 2).first()).toBeUndefined();
+    expect(await knex('image_access_logs').where('photo_id', 2).first()).toBeUndefined();
+  });
+
+  it('does not carry the duplicate\'s faces over to the survivor', async () => {
+    // Both rows were scanned independently, so the survivor already holds its
+    // own embeddings. Moving these would fabricate a second copy of every face
+    // and split the person clusters built from them.
+    await seedPair();
+    await knex('photo_faces').insert([{ photo_id: 1, event_id: 1 }, { photo_id: 2, event_id: 1 }]);
+
+    await migration.up(knex);
+
+    expect(await knex('photo_faces').count('* as c').first()).toEqual({ c: 1 });
+  });
+
+  it('moves a guest comment to the survivor rather than deleting it', async () => {
+    // The duplicates were separate tiles in the grid, so a guest could have
+    // commented on either. Silently dropping that inside a fix for silent data
+    // loss would be its own bug.
+    await seedPair();
+    await knex('photo_feedback').insert({
+      photo_id: 2, event_id: 1, feedback_type: 'comment',
+      comment_text: 'lovely shot', guest_identifier: 'guest-a',
+    });
+
+    await migration.up(knex);
+
+    const rows = await knex('photo_feedback');
+    expect(rows).toHaveLength(1);
+    expect(rows[0].photo_id).toBe(1);
+    expect(rows[0].comment_text).toBe('lovely shot');
+  });
+
+  it('keeps both comments when the same guest commented on both tiles', async () => {
+    await seedPair();
+    await knex('photo_feedback').insert([
+      { photo_id: 1, event_id: 1, feedback_type: 'comment', comment_text: 'one', guest_identifier: 'g' },
+      { photo_id: 2, event_id: 1, feedback_type: 'comment', comment_text: 'two', guest_identifier: 'g' },
+    ]);
+
+    await migration.up(knex);
+
+    const rows = await knex('photo_feedback').orderBy('id');
+    expect(rows.map((r) => r.comment_text)).toEqual(['one', 'two']);
+    expect(rows.every((r) => r.photo_id === 1)).toBe(true);
+  });
+
+  it('does not double-count a like the same guest left on both tiles', async () => {
+    // Unlike comments, a like is a per-guest toggle: moving it would show two
+    // likes from one person.
+    await seedPair();
+    await knex('photo_feedback').insert([
+      { photo_id: 1, event_id: 1, feedback_type: 'like', guest_identifier: 'g' },
+      { photo_id: 2, event_id: 1, feedback_type: 'like', guest_identifier: 'g' },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await knex('photo_feedback').count('* as c').first()).toEqual({ c: 1 });
+  });
+
+  it('moves a like from a guest the survivor has never seen', async () => {
+    await seedPair();
+    await knex('photo_feedback').insert({
+      photo_id: 2, event_id: 1, feedback_type: 'like', guest_identifier: 'other',
+    });
+
+    await migration.up(knex);
+
+    const rows = await knex('photo_feedback');
+    expect(rows).toHaveLength(1);
+    expect(rows[0].photo_id).toBe(1);
+  });
+
+  it('moves an admin mark, and drops it when that admin already marked the survivor', async () => {
+    // photo_admin_marks is UNIQUE(photo_id, admin_id), so a blind move would
+    // throw and abort the migration.
+    await seedPair();
+    await knex('photo_admin_marks').insert([
+      { photo_id: 1, event_id: 1, admin_id: 7, rating: 5 },
+      { photo_id: 2, event_id: 1, admin_id: 7, rating: 2 },
+      { photo_id: 2, event_id: 1, admin_id: 9, rating: 4 },
+    ]);
+
+    await migration.up(knex);
+
+    const rows = await knex('photo_admin_marks').orderBy('admin_id');
+    expect(rows.map((r) => [r.admin_id, r.rating])).toEqual([[7, 5], [9, 4]]);
+    expect(rows.every((r) => r.photo_id === 1)).toBe(true);
+  });
+
+  it('respects the transfer_files uniqueness when moving membership', async () => {
+    await seedPair();
+    await knex('transfer_files').insert([
+      { transfer_id: 3, photo_id: 1 },
+      { transfer_id: 3, photo_id: 2 },
+      { transfer_id: 4, photo_id: 2 },
+    ]);
+
+    await migration.up(knex);
+
+    const rows = await knex('transfer_files').orderBy('transfer_id');
+    expect(rows.map((r) => r.transfer_id)).toEqual([3, 4]);
+    expect(rows.every((r) => r.photo_id === 1)).toBe(true);
+  });
+
+  it('recomputes the survivor\'s feedback totals after reparenting rows', async () => {
+    // photos carries denormalized counters (migration 033). A survivor that
+    // now OWNS the feedback but still renders zero is the visible half of
+    // getting this wrong.
+    await seedPair();
+    await knex('photo_feedback').insert([
+      { photo_id: 2, event_id: 1, feedback_type: 'like', guest_identifier: 'g1' },
+      { photo_id: 2, event_id: 1, feedback_type: 'rating', rating: 4, guest_identifier: 'g1' },
+    ]);
+
+    await migration.up(knex);
+
+    const survivor = await knex('photos').where('id', 1).first();
+    expect(survivor.like_count).toBe(1);
+    expect(Number(survivor.average_rating)).toBe(4);
+    expect(survivor.feedback_count).toBe(1);
+  });
+
+  it('keeps two people who share a device apart', async () => {
+    // guest_identifier is per-device; guest_id is per-person (migration 078),
+    // and feedbackService scopes by guest_id when it is present. Keying on the
+    // identifier alone would read these as one person and delete a rating.
+    await seedPair();
+    await knex('photo_feedback').insert([
+      { photo_id: 1, event_id: 1, feedback_type: 'rating', rating: 5, guest_identifier: 'shared', guest_id: 10 },
+      { photo_id: 2, event_id: 1, feedback_type: 'rating', rating: 2, guest_identifier: 'shared', guest_id: 11 },
+    ]);
+
+    await migration.up(knex);
+
+    const rows = await knex('photo_feedback').orderBy('guest_id');
+    expect(rows.map((r) => [r.guest_id, r.rating])).toEqual([[10, 5], [11, 2]]);
+  });
+
+  it('still dedupes one person voting on both tiles', async () => {
+    await seedPair();
+    await knex('photo_feedback').insert([
+      { photo_id: 1, event_id: 1, feedback_type: 'like', guest_identifier: 'shared', guest_id: 10 },
+      { photo_id: 2, event_id: 1, feedback_type: 'like', guest_identifier: 'shared', guest_id: 10 },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await knex('photo_feedback').count('* as c').first()).toEqual({ c: 1 });
+  });
+
+  it('still clears face rows on a branch that has no face feature', async () => {
+    // DIVERGES FROM MAIN, deliberately. Face recognition (#1090) is main-only:
+    // there is no faceProcessor on this branch, so purgePhotoFaces cannot be
+    // called and there are no event_people counts or centroids to reconcile.
+    // What still matters is the half that is not optional — the rows must not
+    // dangle, because SQLite never enforces the CASCADE that would remove
+    // them. The service reaches for purgePhotoFaces, finds nothing, and falls
+    // back to a plain delete; this pins that fallback.
+    //
+    // If faces are ever backported, main's version of this test comes with
+    // them.
+    await seedPair();
+    await knex('photo_faces').insert({ photo_id: 2, event_id: 1, person_id: 5 });
+
+    await migration.up(knex);
+
+    expect(await knex('photo_faces').count('* as c').first()).toEqual({ c: 0 });
+  });
+
+  it('keeps a hidden moderation record from swallowing the visible replacement', async () => {
+    // feedbackService lets both coexist and counts only the visible one.
+    await seedPair();
+    await knex('photo_feedback').insert([
+      { photo_id: 1, event_id: 1, feedback_type: 'like', guest_identifier: 'g', is_hidden: true },
+      { photo_id: 2, event_id: 1, feedback_type: 'like', guest_identifier: 'g', is_hidden: false },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await knex('photo_feedback').count('* as c').first()).toEqual({ c: 2 });
+  });
+
+  it('merges the independent halves of one admin\'s mark', async () => {
+    // rating and color_label are written independently, so the same admin can
+    // have rated one tile and coloured the other.
+    await seedPair();
+    await knex('photo_admin_marks').insert([
+      { photo_id: 1, event_id: 1, admin_id: 7, rating: 5, color_label: null },
+      { photo_id: 2, event_id: 1, admin_id: 7, rating: null, color_label: 'red' },
+    ]);
+
+    await migration.up(knex);
+
+    const rows = await knex('photo_admin_marks');
+    expect(rows).toHaveLength(1);
+    expect([rows[0].rating, rows[0].color_label]).toEqual([5, 'red']);
+  });
+
+  it('requeues the survivor when the duplicate held the only scan', async () => {
+    // Otherwise the sole embeddings go with the purge and nothing re-queues:
+    // the photo just silently stops having a face.
+    await seedPair();
+    await knex('photo_faces').insert({ photo_id: 2, event_id: 1 });
+
+    await migration.up(knex);
+
+    expect((await knex('photos').where('id', 1).first()).face_status).toBe('pending');
+  });
+
+  it('carries the duplicate\'s views and downloads over', async () => {
+    await seedPair();
+    await knex('photos').where('id', 1).update({ view_count: 2, download_count: 1 });
+    await knex('photos').where('id', 2).update({ view_count: 5, download_count: 3 });
+
+    await migration.up(knex);
+
+    const survivor = await knex('photos').where('id', 1).first();
+    expect([survivor.view_count, survivor.download_count]).toEqual([7, 4]);
+  });
+
+  it('fails loudly rather than recording itself applied without the index', async () => {
+    // Swallowing a failed CREATE INDEX would leave the install permanently
+    // racy — the in-flight guard only covers one process — with nothing to
+    // trigger a retry. Driven through the helper the migration calls, against
+    // a table that still holds duplicates — i.e. what it would face if the
+    // dedupe above had not achieved uniqueness.
+    await seedPair();
+    const { createExternalRelpathIndex } = require('../../src/services/externalPhotoDedupe');
+
+    await expect(createExternalRelpathIndex(knex)).rejects.toThrow(/unique/i);
+  });
+
+  it('invalidates the pre-built download zip for the affected event', async () => {
+    // The cached archive still contains the rows just removed, and every
+    // ordinary photo-deletion path invalidates it for exactly that reason.
+    // getZipInfo treats a cleared record as a miss and rebuilds on request.
+    await seedPair();
+    await knex('events').insert({
+      id: 1, download_zip_path: 'events/active/x/.download-cache/all.zip',
+      download_zip_generated_at: '2026-01-01',
+    });
+
+    await migration.up(knex);
+
+    const ev = await knex('events').where('id', 1).first();
+    expect(ev.download_zip_path).toBeNull();
+    expect(ev.download_zip_generated_at).toBeNull();
+  });
+
+  it('leaves an untouched event\'s zip alone', async () => {
+    await seedPair();
+    await knex('events').insert([
+      { id: 1, download_zip_path: 'a.zip', download_zip_generated_at: '2026-01-01' },
+      { id: 2, download_zip_path: 'b.zip', download_zip_generated_at: '2026-01-01' },
+    ]);
+
+    await migration.up(knex);
+
+    expect((await knex('events').where('id', 2).first()).download_zip_path).toBe('b.zip');
+  });
+
+  it('is idempotent', async () => {
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'a/x.jpg', source_origin: 'external' },
+      { event_id: 1, external_relpath: 'a/x.jpg', source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+    const once = await rows();
+    await migration.up(knex);
+
+    expect(await rows()).toEqual(once);
+  });
+
+  it('rolls back to an unconstrained table', async () => {
+    await migration.up(knex);
+    await migration.down(knex);
+
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'a/x.jpg', source_origin: 'external' },
+      { event_id: 1, external_relpath: 'a/x.jpg', source_origin: 'external' },
+    ]);
+    expect(await knex('photos').count('* as c').first()).toEqual({ c: 2 });
+  });
+
+  it('no-ops before 041 has added the column', async () => {
+    await knex.schema.dropTableIfExists('photos');
+    await knex.schema.createTable('photos', (t) => { t.increments('id').primary(); });
+
+    await expect(migration.up(knex)).resolves.toBeUndefined();
+  });
+});

backend/__tests__/migrations/177_external_relpath_from_root.test.js

@@ -0,0 +1,364 @@
+/**
+ * Folding the event's base path into every external row (#1163).
+ *
+ * Two things can go wrong and both are silent, which is why they are pinned
+ * here rather than left to review: folding a path that was ALREADY folded
+ * (every original moves), and "repairing" a healthy install because the media
+ * root happened to be unmounted when the migration ran (every original moves).
+ *
+ * The repair itself is driven against a real temp directory tree, because the
+ * whole mechanism is "is this file actually there" and a mocked fs would only
+ * be testing the mock.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+describe('migration 177 — external_relpath from the media root (#1163)', () => {
+  let knex; let tmpDir; let mediaRoot; let migration;
+
+  /** Writes `bytes` bytes and returns the size, so fixtures can record it the
+   *  way an import would have. */
+  const touch = async (rel, bytes = 8) => {
+    const full = path.join(mediaRoot, rel);
+    await fs.promises.mkdir(path.dirname(full), { recursive: true });
+    await fs.promises.writeFile(full, Buffer.alloc(bytes));
+    return bytes;
+  };
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-mig187-'));
+    mediaRoot = path.join(tmpDir, 'media');
+    await fs.promises.mkdir(mediaRoot, { recursive: true });
+    process.env.EXTERNAL_MEDIA_ROOT = mediaRoot;
+
+    // The service caches the root on first call, so it must not have been
+    // resolved before EXTERNAL_MEDIA_ROOT was set above.
+    jest.resetModules();
+    migration = require('../../migrations/core/177_external_relpath_from_root');
+
+    knex = require('knex')({
+      client: 'sqlite3',
+      connection: { filename: path.join(tmpDir, 'db.sqlite') },
+      useNullAsDefault: true,
+    });
+  });
+
+  afterAll(async () => {
+    if (knex) await knex.destroy();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+    delete process.env.EXTERNAL_MEDIA_ROOT;
+  });
+
+  beforeEach(async () => {
+    await knex.schema.dropTableIfExists('photos');
+    await knex.schema.dropTableIfExists('events');
+    await knex.schema.dropTableIfExists('app_settings');
+    await knex.schema.createTable('events', (t) => {
+      t.increments('id').primary();
+      t.string('external_path');
+    });
+    await knex.schema.createTable('photos', (t) => {
+      t.increments('id').primary();
+      t.integer('event_id');
+      t.string('external_relpath');
+      t.integer('size_bytes');
+      t.string('source_origin').defaultTo('managed');
+    });
+    await knex.schema.createTable('app_settings', (t) => {
+      t.increments('id').primary();
+      t.string('setting_key');
+      t.text('setting_value');
+      t.string('setting_type');
+      t.string('updated_at');
+    });
+    await fs.promises.rm(mediaRoot, { recursive: true, force: true });
+    await fs.promises.mkdir(mediaRoot, { recursive: true });
+  });
+
+  const relpaths = async () =>
+    (await knex('photos').orderBy('id', 'asc').select('external_relpath'))
+      .map((r) => r.external_relpath);
+
+  it('folds the base path into every row of a healthy event', async () => {
+    await touch('Trip/Leknes/a.jpg');
+    await touch('Trip/Leknes/b.jpg');
+    await knex('events').insert({ id: 1, external_path: 'Trip' });
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'Leknes/a.jpg', source_origin: 'external' },
+      { event_id: 1, external_relpath: 'Leknes/b.jpg', source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['Trip/Leknes/a.jpg', 'Trip/Leknes/b.jpg']);
+  });
+
+  it('repairs rows an earlier import had rebased', async () => {
+    // The reported shape: a parent imported first, a child imported second, so
+    // events.external_path is the child and the parent's rows resolve into a
+    // path that does not exist.
+    const oldSize = await touch('Trip/Leknes/old.jpg', 11);   // from the first import
+    const newSize = await touch('Trip/Sub/new.jpg', 22);      // from the second
+    await knex('events').insert({ id: 1, external_path: 'Trip/Sub' });
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'Leknes/old.jpg', size_bytes: oldSize, source_origin: 'external' },
+      { event_id: 1, external_relpath: 'new.jpg', size_bytes: newSize, source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+
+    // The old row is placed where the file actually is; the new one keeps
+    // resolving exactly where it resolved before.
+    expect(await relpaths()).toEqual(['Trip/Leknes/old.jpg', 'Trip/Sub/new.jpg']);
+  });
+
+  it('refuses an ancestor whose file is a different size', async () => {
+    // The dangerous case: the row's own file was simply deleted, and an
+    // UNRELATED file one directory up happens to share its name. Adopting it
+    // would make downloads serve the wrong original — worse than a dead link.
+    await touch('Trip/photo.jpg', 999);
+    await knex('events').insert({ id: 1, external_path: 'Trip/Sub' });
+    await knex('photos').insert({
+      event_id: 1, external_relpath: 'photo.jpg', size_bytes: 42, source_origin: 'external',
+    });
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['Trip/Sub/photo.jpg']);
+  });
+
+  it('refuses an ancestor when the row records no size to check against', async () => {
+    // Nothing to verify provenance with, so the row stays where it resolves
+    // today rather than adopting a same-named stranger.
+    await touch('Trip/photo.jpg', 100);
+    await knex('events').insert({ id: 1, external_path: 'Trip/Sub' });
+    await knex('photos').insert({
+      event_id: 1, external_relpath: 'photo.jpg', size_bytes: null, source_origin: 'external',
+    });
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['Trip/Sub/photo.jpg']);
+  });
+
+  it('leaves nothing folded when a rewrite fails partway', async () => {
+    // Without a transaction, a crash between the first event's UPDATE and the
+    // marker leaves mixed formats behind — and the next run folds the already
+    // folded rows a second time, putting every original one directory deeper.
+    await touch('A/one.jpg');
+    await touch('B/two.jpg');
+    await knex('events').insert([
+      { id: 1, external_path: 'A' },
+      { id: 2, external_path: 'B' },
+    ]);
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'one.jpg', source_origin: 'external' },
+      { event_id: 2, external_relpath: 'two.jpg', source_origin: 'external' },
+    ]);
+    // app_settings is written last, in the same transaction as the rewrites.
+    await knex.schema.dropTableIfExists('app_settings_backup');
+    await knex.raw('CREATE TRIGGER fail_marker BEFORE INSERT ON app_settings '
+      + "BEGIN SELECT RAISE(ABORT, 'boom'); END");
+
+    await expect(migration.up(knex)).rejects.toThrow(/boom/);
+
+    await knex.raw('DROP TRIGGER fail_marker');
+    // Every row still base-relative, and no marker — so a retry is correct.
+    expect(await relpaths()).toEqual(['one.jpg', 'two.jpg']);
+    expect(await knex('app_settings').where('setting_key', 'external_relpath_root_relative').first())
+      .toBeUndefined();
+  });
+
+  it('removes the losing row when two paths converge, instead of stranding it', async () => {
+    // Trip/Sub/c.jpg imported once via `Trip` (as `Sub/c.jpg`) and once via
+    // `Trip/Sub` (as `c.jpg`). Both fold to the same path. Skipping the loser
+    // would leave it base-relative under a root-only resolver — pointing at
+    // <root>/c.jpg — with the marker claiming the conversion is complete.
+    const size = await touch('Trip/Sub/c.jpg', 33);
+    await knex('events').insert({ id: 1, external_path: 'Trip/Sub' });
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'Sub/c.jpg', size_bytes: size, source_origin: 'external' },
+      { event_id: 1, external_relpath: 'c.jpg', size_bytes: size, source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+
+    const rows = await knex('photos').select('external_relpath');
+    expect(rows).toHaveLength(1);
+    expect(rows[0].external_relpath).toBe('Trip/Sub/c.jpg');
+  });
+
+  it('survives a final path that equals another row\'s current path', async () => {
+    // `photo.jpg` repairs to `Trip/photo.jpg` while the row already holding
+    // `Trip/photo.jpg` folds to `Trip/Sub/Trip/photo.jpg`. Every FINAL value is
+    // distinct, but a one-pass rewrite collides halfway through — and on
+    // Postgres that 23505 is misread by the migration runner as "already
+    // applied", leaving everything unconverted.
+    const a = await touch('Trip/photo.jpg', 11);
+    const b = await touch('Trip/Sub/Trip/photo.jpg', 22);
+    await knex('events').insert({ id: 1, external_path: 'Trip/Sub' });
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'photo.jpg', size_bytes: a, source_origin: 'external' },
+      { event_id: 1, external_relpath: 'Trip/photo.jpg', size_bytes: b, source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['Trip/photo.jpg', 'Trip/Sub/Trip/photo.jpg']);
+  });
+
+  it('does not re-prefix a row inserted while the probe was running', async () => {
+    // Phase 1 runs outside the transaction and can take minutes on a cold
+    // mount. An import finishing in that window writes an already
+    // root-relative row, which a `where event_id` bulk update would prefix a
+    // second time with the stale base.
+    await touch('Trip/a.jpg');
+    await knex('events').insert({ id: 1, external_path: 'Trip' });
+    await knex('photos').insert({ event_id: 1, external_relpath: 'a.jpg', source_origin: 'external' });
+
+    const { foldExternalRelpaths } = require('../../src/services/externalRelpathFold');
+    const realStat = fs.promises.stat;
+    let injected = false;
+    jest.spyOn(fs.promises, 'access').mockImplementation(async (...args) => {
+      if (!injected) {
+        injected = true;
+        await knex('photos').insert({
+          event_id: 1, external_relpath: 'Trip/late.jpg', source_origin: 'external',
+        });
+      }
+      return realStat(args[0]).then(() => undefined);
+    });
+
+    await foldExternalRelpaths(knex);
+    fs.promises.access.mockRestore();
+
+    expect((await relpaths()).sort()).toEqual(['Trip/a.jpg', 'Trip/late.jpg']);
+  });
+
+  it('leaves a row it cannot place resolving where it resolves today', async () => {
+    // Never guess below current behaviour: a file that is genuinely gone must
+    // not have its path rewritten to some other file that happens to exist.
+    await touch('Trip/Sub/present.jpg');
+    await knex('events').insert({ id: 1, external_path: 'Trip/Sub' });
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'present.jpg', source_origin: 'external' },
+      { event_id: 1, external_relpath: 'vanished.jpg', source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['Trip/Sub/present.jpg', 'Trip/Sub/vanished.jpg']);
+  });
+
+  it('folds without repairing when the media root is unmounted', async () => {
+    // An unmounted share leaves the mountpoint as an empty directory, so every
+    // file looks missing. Repairing off that signal would move every original
+    // on a perfectly healthy install.
+    await knex('events').insert({ id: 1, external_path: 'Trip/Sub' });
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'Leknes/a.jpg', source_origin: 'external' },
+    ]);
+    // mediaRoot is empty — see beforeEach.
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['Trip/Sub/Leknes/a.jpg']);
+  });
+
+  it('leaves managed rows alone', async () => {
+    await touch('Trip/a.jpg');
+    await knex('events').insert({ id: 1, external_path: 'Trip' });
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: null, source_origin: 'managed' },
+      { event_id: 1, external_relpath: 'a.jpg', source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual([null, 'Trip/a.jpg']);
+  });
+
+  it('leaves an event with no base path alone — its rows are already root-relative', async () => {
+    await touch('a.jpg');
+    await knex('events').insert({ id: 1, external_path: null });
+    await knex('photos').insert({ event_id: 1, external_relpath: 'a.jpg', source_origin: 'external' });
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['a.jpg']);
+  });
+
+  it('folds each event with its own base', async () => {
+    await touch('A/one.jpg');
+    await touch('B/two.jpg');
+    await knex('events').insert([
+      { id: 1, external_path: 'A' },
+      { id: 2, external_path: 'B' },
+    ]);
+    await knex('photos').insert([
+      { event_id: 1, external_relpath: 'one.jpg', source_origin: 'external' },
+      { event_id: 2, external_relpath: 'two.jpg', source_origin: 'external' },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['A/one.jpg', 'B/two.jpg']);
+  });
+
+  it('tolerates a base path with stray slashes', async () => {
+    await touch('Trip/a.jpg');
+    await knex('events').insert({ id: 1, external_path: '/Trip/' });
+    await knex('photos').insert({ event_id: 1, external_relpath: 'a.jpg', source_origin: 'external' });
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['Trip/a.jpg']);
+  });
+
+  it('does not fold twice when run again', async () => {
+    // The failure this guards is total: every original on the install moves one
+    // directory deeper, and there is no undo.
+    await touch('Trip/a.jpg');
+    await knex('events').insert({ id: 1, external_path: 'Trip' });
+    await knex('photos').insert({ event_id: 1, external_relpath: 'a.jpg', source_origin: 'external' });
+
+    await migration.up(knex);
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['Trip/a.jpg']);
+  });
+
+  it('does not fold twice when the base repeats in the relpath', async () => {
+    // The inference this migration deliberately does NOT use: `Trip/x.jpg`
+    // under base `Trip` already "starts with the base", but has not been
+    // folded — it is a subfolder that shares its parent's name.
+    await touch('Trip/Trip/x.jpg');
+    await knex('events').insert({ id: 1, external_path: 'Trip' });
+    await knex('photos').insert({ event_id: 1, external_relpath: 'Trip/x.jpg', source_origin: 'external' });
+
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['Trip/Trip/x.jpg']);
+  });
+
+  it('rollback does not clear the marker, so a re-run cannot double-fold', async () => {
+    await touch('Trip/a.jpg');
+    await knex('events').insert({ id: 1, external_path: 'Trip' });
+    await knex('photos').insert({ event_id: 1, external_relpath: 'a.jpg', source_origin: 'external' });
+
+    await migration.up(knex);
+    await migration.down(knex);
+    await migration.up(knex);
+
+    expect(await relpaths()).toEqual(['Trip/a.jpg']);
+  });
+
+  it('no-ops before 041 has added the column', async () => {
+    await knex.schema.dropTableIfExists('photos');
+    await knex.schema.createTable('photos', (t) => { t.increments('id').primary(); });
+
+    await expect(migration.up(knex)).resolves.toBeUndefined();
+  });
+});

backend/__tests__/migrations/178_reset_legacy_preview_paths.test.js

@@ -0,0 +1,83 @@
+/**
+ * Legacy preview keys must not survive the encoder change.
+ *
+ * The old generator kept the SOURCE basename verbatim while always writing
+ * JPEG, so a `.webp` upload produced `preview_shot.webp` holding a JPEG. The
+ * route now derives Content-Type from the key, and sets `nosniff` — so that
+ * legacy object would be announced as image/webp and render as a broken image.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+const migration = require('../../migrations/core/178_reset_legacy_preview_paths');
+
+describe('migration 178 — legacy preview keys (#1166 follow-up)', () => {
+  let knex; let tmpDir;
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-mig188-'));
+    knex = require('knex')({
+      client: 'sqlite3',
+      connection: { filename: path.join(tmpDir, 'db.sqlite') },
+      useNullAsDefault: true,
+    });
+  });
+
+  afterAll(async () => {
+    if (knex) await knex.destroy();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  beforeEach(async () => {
+    await knex.schema.dropTableIfExists('photos');
+    await knex.schema.createTable('photos', (t) => {
+      t.increments('id').primary();
+      t.string('preview_path');
+      t.string('thumbnail_path');
+    });
+  });
+
+  it('clears the mislabelled .webp keys that would render broken', async () => {
+    await knex('photos').insert({ preview_path: 'previews/preview_shot.webp' });
+
+    await migration.up(knex);
+
+    expect((await knex('photos').first()).preview_path).toBeNull();
+  });
+
+  it('clears .jpg keys too, because a byte-correct one can still be flattened', async () => {
+    // A legacy .jpg key is valid JPEG, but it may be a flattened rendition of a
+    // transparent or animated source, and nothing in the key says so. One lazy
+    // regeneration is cheaper than reasoning about which of them lied.
+    await knex('photos').insert([
+      { preview_path: 'previews/preview_a.jpg' },
+      { preview_path: 'previews/preview_b.png' },
+    ]);
+
+    await migration.up(knex);
+
+    expect(await knex('photos').whereNotNull('preview_path').count('* as c').first()).toEqual({ c: 0 });
+  });
+
+  it('leaves thumbnails alone — they are a different cache', async () => {
+    await knex('photos').insert({ preview_path: 'previews/p.jpg', thumbnail_path: 'thumbnails/t.jpg' });
+
+    await migration.up(knex);
+
+    expect((await knex('photos').first()).thumbnail_path).toBe('thumbnails/t.jpg');
+  });
+
+  it('is idempotent and safe with nothing to clear', async () => {
+    await migration.up(knex);
+    await expect(migration.up(knex)).resolves.toBeUndefined();
+  });
+
+  it('no-ops before 104 has added the column', async () => {
+    await knex.schema.dropTableIfExists('photos');
+    await knex.schema.createTable('photos', (t) => { t.increments('id').primary(); });
+
+    await expect(migration.up(knex)).resolves.toBeUndefined();
+  });
+});

backend/__tests__/routes/adminContractsSignedPdfPathTraversal.test.js

@@ -0,0 +1,126 @@
+/**
+ * Same bug class as GHSA-9q5j-vqfw-32hr (fixed in adminEvents/logo.js) —
+ * the signed-PDF upload's multer `filename` callback built the stored
+ * path directly from `req.params.id` with no integer validation:
+ *
+ *   filename: (req, file, cb) => {
+ *     cb(null, `contract-${req.params.id}-${Date.now()}${ext}`);
+ *   }
+ *
+ * `POST /:id/upload-signed-pdf` declares `param('id').isInt({ min: 1 })`,
+ * but express-validator's check only runs inside the route handler via
+ * validateRequest(req) — AFTER multer has already parsed the multipart
+ * body and invoked the filename callback. A traversal payload in the raw
+ * `:id` URL segment reaches multer completely unvalidated.
+ *
+ * Fixed by rejecting any non-positive-integer id before it is used to
+ * build the filename, independent of the declared-but-too-late
+ * express-validator check.
+ */
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+// ALLOWED_MEDIA_TYPES in fileSecurityUtils.js only defines image/video
+// entries, so the route's real fileFilter (validateFileType(..., ['application/pdf']))
+// rejects every PDF upload with "Only PDF files are allowed" — a
+// separate, pre-existing bug unrelated to the path-traversal fix under
+// test here (also present in publicContracts.js, which is why neither
+// suite exercises a successful upload). Stub validateFileType so this
+// suite can drive the full route, including the filename-callback fix,
+// end-to-end.
+jest.mock('../../src/utils/fileSecurityUtils', () => {
+  const actual = jest.requireActual('../../src/utils/fileSecurityUtils');
+  return {
+    ...actual,
+    validateFileType: (filename, mimetype, allowedTypes) => allowedTypes.includes(mimetype),
+  };
+});
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-contracts-signed-pdf-')), 'db.sqlite'
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'admin-contracts-signed-pdf-test-secret';
+
+const request = require('supertest');
+const {
+  bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken, buildRouteApp,
+} = require('../integration/helpers/crmDb');
+
+describe('POST /api/admin/contracts/:id/upload-signed-pdf — path traversal guard', () => {
+  let db; let cleanup; let app; let adminId; let customerId; let token;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    ({ adminId, customerId } = await seedMinimal(db));
+    await assignAdminRole(db, adminId, 'super_admin');
+    token = mintAdminToken(adminId);
+
+    // Feature flag defaults OFF on a fresh install — the contracts
+    // router 403s every route until it's on.
+    await db('feature_flags').where({ key: 'contracts' }).update({ value: true });
+
+    app = buildRouteApp('/api/admin/contracts', require('../../src/routes/adminContracts'));
+  }, 120000);
+
+  afterAll(async () => { await cleanup(); });
+
+  const auth = (req) => req.set('Authorization', `Bearer ${token}`);
+  const signedDir = () => path.join(process.env.STORAGE_PATH, 'uploads/contracts/signed');
+
+  async function insertContract(over = {}) {
+    const base = {
+      contract_number: `K-TEST-${Math.random().toString(16).slice(2, 8)}`,
+      customer_account_id: customerId,
+      title: 'Test Contract',
+      issue_date: new Date().toISOString().slice(0, 10),
+      status: 'sent',
+      language: 'de',
+      created_at: new Date().toISOString(),
+      ...over,
+    };
+    const inserted = await db('contracts').insert(base).returning('id');
+    return inserted[0]?.id ?? inserted[0];
+  }
+
+  it('rejects a traversal payload in the id param instead of writing outside uploads/contracts/signed', async () => {
+    // '../../../../tmp/pwned' URL-encoded so the raw request path still
+    // has a single segment (matches Express's `:id`), but Express
+    // decodes the param back into literal '../' sequences before the
+    // route sees it.
+    const traversalId = encodeURIComponent('../../../../tmp/pwned');
+
+    const res = await auth(
+      request(app).post(`/api/admin/contracts/${traversalId}/upload-signed-pdf`)
+    ).attach('file', Buffer.from('%PDF-1.4 fake'), 'signed.pdf');
+
+    expect(res.status).toBeGreaterThanOrEqual(400);
+    expect(res.body.error).toMatch(/invalid contract id/i);
+
+    // No file should have been written anywhere — the filename callback
+    // must error out before multer opens a write stream.
+    const escapedFile = path.join(os.tmpdir(), 'pwned');
+    expect(fs.existsSync(escapedFile)).toBe(false);
+    if (fs.existsSync(signedDir())) {
+      expect(fs.readdirSync(signedDir())).toHaveLength(0);
+    }
+  });
+
+  it('still accepts a normal numeric contract id', async () => {
+    const id = await insertContract();
+
+    const res = await auth(
+      request(app).post(`/api/admin/contracts/${id}/upload-signed-pdf`)
+    ).attach('file', Buffer.from('%PDF-1.4 fake'), 'signed.pdf');
+
+    expect(res.status).toBe(200);
+
+    const files = fs.readdirSync(signedDir());
+    expect(files.some((f) => f.startsWith(`contract-${id}-`))).toBe(true);
+
+    const row = await db('contracts').where({ id }).first();
+    expect(row.status).toBe('fully_signed');
+    expect(row.signed_pdf_path).toMatch(new RegExp(`contract-${id}-`));
+  });
+});

backend/__tests__/routes/adminCrmAuth.test.js

@@ -0,0 +1,159 @@
+/**
+ * HTTP route auth-gate tests for the CRM admin surface (P1 / P2 — #570).
+ *
+ * Bundled into one file rather than nine because the contract is the
+ * same for every CRM admin route:
+ *   - No token → 401 (adminAuth at the router level)
+ *   - Valid token, missing permission → 403 (requirePermission middleware)
+ *   - Valid token + super_admin role → 2xx / 404 (resource-based)
+ *
+ * Deeper service-layer behaviour (PDF generation, send, Storno,
+ * countersign, integrity hash) is covered by the existing service
+ * unit tests in __tests__/services/. This file pins the contract
+ * between the HTTP layer and the auth+permission middleware so a
+ * misconfigured route ("forgot requirePermission") can never ship
+ * unnoticed.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-admincrm-test-'));
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'db.sqlite');
+process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+fs.mkdirSync(process.env.STORAGE_PATH, { recursive: true });
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'crm-route-test-secret';
+
+const request = require('supertest');
+const {
+  bootCrmDb, seedMinimal, assignAdminRole,
+  mintAdminToken, buildRouteApp,
+} = require('../integration/helpers/crmDb');
+
+// One row per admin CRM route. `mount` matches server.js's app.use,
+// `loader` is the require()'d router, `getPath` is one path on the
+// router we'll exercise. The path should be a GET-shaped read where
+// possible — listing endpoints (`/`) are safest because they don't
+// require pre-seeded resource ids.
+const ROUTES = [
+  { name: 'adminQuotes',          mount: '/api/admin/quotes',           loader: () => require('../../src/routes/adminQuotes'),          getPath: '/' },
+  { name: 'adminContracts',       mount: '/api/admin/contracts',        loader: () => require('../../src/routes/adminContracts'),       getPath: '/' },
+  { name: 'adminInvoices',        mount: '/api/admin/invoices',         loader: () => require('../../src/routes/adminInvoices'),        getPath: '/' },
+  { name: 'adminCalendar',        mount: '/api/admin/calendar',         loader: () => require('../../src/routes/adminCalendar'),        getPath: '/items?from=2026-01-01&to=2026-12-31' },
+  { name: 'adminDeals',           mount: '/api/admin/deals',            loader: () => require('../../src/routes/adminDeals'),           getPath: '/' },
+  { name: 'adminTaxReport',       mount: '/api/admin/tax-report',       loader: () => require('../../src/routes/adminTaxReport'),       getPath: '/?period=2026-Q1' },
+  { name: 'adminBusinessProfile', mount: '/api/admin/business-profile', loader: () => require('../../src/routes/adminBusinessProfile'), getPath: '/' },
+];
+
+describe('admin CRM routes — auth + permission gate', () => {
+  let db;
+  let cleanup;
+  let adminId;
+  let customerId;
+  let superAdminToken;
+  let invalidToken;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    ({ adminId, customerId } = await seedMinimal(db));
+
+    // Super-admin: assign the seeded super_admin role (created by
+    // migration 057). requirePermission lookups short-circuit because
+    // super_admin role inherits every permission via role_permissions
+    // rows seeded by mig 107 and earlier.
+    await assignAdminRole(db, adminId, 'super_admin');
+    superAdminToken = mintAdminToken(adminId);
+
+    // CRM routes have a feature-flag gate that runs INSIDE the route
+    // handler — even a super-admin gets 403 (`QUOTES_DISABLED` /
+    // similar) when the flag is off. The flag check is independent
+    // of permissions, so for happy-path tests we flip every CRM flag
+    // on. Negative tests (no-token, bad-signature) hit adminAuth
+    // first and never reach the flag check, so they're unaffected.
+    // `accounting` is the master flag the tax-report route now requires
+    // (tax export moved out of CRM into Accounting, independent of bills).
+    const crmFlags = ['quotes', 'bills', 'contracts', 'hoursLogging', 'calendar', 'taxReport', 'clients', 'accounting'];
+    for (const key of crmFlags) {
+      // eslint-disable-next-line no-await-in-loop
+      await db('feature_flags').where({ key }).update({ value: 1 });
+    }
+
+    // Invalid: signed with a different secret. adminAuth must reject.
+    const jwt = require('jsonwebtoken');
+    invalidToken = jwt.sign({ id: adminId, type: 'admin' }, 'WRONG-SECRET', { issuer: 'picpeak-auth' });
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+  });
+
+  describe.each(ROUTES)('$name', ({ mount, loader, getPath }) => {
+    let app;
+
+    beforeAll(() => {
+      app = buildRouteApp(mount, loader());
+    });
+
+    it('returns 401 with no Authorization header', async () => {
+      const res = await request(app).get(`${mount}${getPath}`);
+      expect(res.status).toBe(401);
+    });
+
+    it('returns 401 with an invalid JWT signature', async () => {
+      const res = await request(app)
+        .get(`${mount}${getPath}`)
+        .set('Authorization', `Bearer ${invalidToken}`);
+      expect(res.status).toBe(401);
+    });
+
+    it('returns 2xx (or resource-shaped 4xx) with a valid super-admin token', async () => {
+      const res = await request(app)
+        .get(`${mount}${getPath}`)
+        .set('Authorization', `Bearer ${superAdminToken}`);
+      // 200 if listing succeeds (likely empty list), 400 if a
+      // validator complains about query shape, 404 if the route
+      // doesn't have a list endpoint at `/`. What MUST NOT happen:
+      // 401 (auth gate failed) or 403 (permission gate failed).
+      expect(res.status).not.toBe(401);
+      expect(res.status).not.toBe(403);
+      expect(res.status).toBeLessThan(500);
+    });
+  });
+
+  describe('adminCustomers — CRM additions (hour-entries / bill / trigger-monthly-bill)', () => {
+    let app;
+    beforeAll(() => {
+      app = buildRouteApp('/api/admin/customers', require('../../src/routes/adminCustomers'));
+    });
+
+    it('GET /:id/hour-entries — 401 without token', async () => {
+      const res = await request(app).get(`/api/admin/customers/${customerId}/hour-entries`);
+      expect(res.status).toBe(401);
+    });
+
+    it('GET /:id/hour-entries — 2xx with super-admin token', async () => {
+      const res = await request(app)
+        .get(`/api/admin/customers/${customerId}/hour-entries`)
+        .set('Authorization', `Bearer ${superAdminToken}`);
+      expect(res.status).not.toBe(401);
+      expect(res.status).not.toBe(403);
+      expect(res.status).toBeLessThan(500);
+    });
+
+    it('POST /:id/hour-entries/bill — 401 without token', async () => {
+      const res = await request(app)
+        .post(`/api/admin/customers/${customerId}/hour-entries/bill`)
+        .send({});
+      expect(res.status).toBe(401);
+    });
+
+    it('POST /:id/trigger-monthly-bill — 401 without token', async () => {
+      const res = await request(app)
+        .post(`/api/admin/customers/${customerId}/trigger-monthly-bill`)
+        .send({});
+      expect(res.status).toBe(401);
+    });
+  });
+});

backend/__tests__/routes/adminEvents.smoke.test.js

@@ -0,0 +1,221 @@
+/**
+ * HTTP smoke tests for the core admin event CRUD endpoints:
+ *   POST   /api/admin/events           (create)
+ *   GET    /api/admin/events           (list + pagination)
+ *   GET    /api/admin/events/:id       (detail + stats)
+ *   PUT    /api/admin/events/:id       (update)
+ *   DELETE /api/admin/events/:id       (cascade delete)
+ *
+ * Safety net ahead of the adminEvents.js god-file decomposition —
+ * pins the request/response contracts of the main CRUD paths using
+ * the same real-SQLite harness as slideshowAdmin.test.js.
+ */
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-events-smoke-')), 'db.sqlite'
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'admin-events-test-secret';
+
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const request = require('supertest');
+const { bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken } = require('../integration/helpers/crmDb');
+
+async function insertEvent(db, adminId, over = {}) {
+  const base = {
+    slug: `ev-${Math.random().toString(16).slice(2)}`,
+    event_type: 'wedding',
+    event_name: 'Test Wedding',
+    event_date: '2026-05-29',
+    host_email: 'host@example.com',
+    admin_email: 'admin@example.com',
+    password_hash: 'x',
+    share_link: `/gallery/share-${Math.random().toString(16).slice(2)}`,
+    share_token: `st-${Math.random().toString(16).slice(2)}`,
+    expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+    is_active: 1, is_archived: 0, is_draft: 0,
+    created_by: adminId,
+    created_at: new Date().toISOString(),
+    ...over,
+  };
+  const r = await db('events').insert(base).returning('id');
+  return r[0]?.id ?? r[0];
+}
+
+describe('admin events CRUD endpoints (smoke)', () => {
+  let db; let cleanup; let app; let adminId; let token;
+
+  // bootCrmDb's full migration run intermittently exceeds Jest's default
+  // 5s beforeAll timeout on slower CI runners; raise it.
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    ({ adminId } = await seedMinimal(db));
+    await assignAdminRole(db, adminId, 'super_admin');
+    token = mintAdminToken(adminId);
+
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/admin/events', require('../../src/routes/adminEvents'));
+    // eslint-disable-next-line no-unused-vars
+    app.use((err, req, res, next) => {
+      res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
+    });
+  }, 120000);
+
+  afterAll(async () => { await cleanup(); });
+
+  beforeEach(async () => {
+    await db('email_queue').del();
+    await db('events').del();
+  });
+
+  const auth = (req) => req.set('Authorization', `Bearer ${token}`);
+
+  it('401s without an admin token', async () => {
+    const res = await request(app).get('/api/admin/events');
+    expect(res.status).toBe(401);
+  });
+
+  describe('POST /', () => {
+    it('creates an event, mints slug + share link and persists the row', async () => {
+      const res = await auth(request(app).post('/api/admin/events')).send({
+        event_type: 'wedding',
+        event_name: 'Smoke Wedding',
+        event_date: '2026-09-01',
+        // Field requirements default to ON (getEventFieldRequirements)
+        // so customer + admin contact data must be supplied.
+        customer_name: 'Client Person',
+        customer_email: 'client@example.com',
+        admin_email: 'admin@example.com',
+        require_password: false,
+        is_draft: true,
+      });
+
+      expect(res.status).toBe(200);
+      expect(res.body.id).toBeDefined();
+      expect(res.body.slug).toContain('wedding-smoke-wedding');
+      expect(typeof res.body.share_link).toBe('string');
+      expect(res.body.is_draft).toBe(true);
+
+      const row = await db('events').where({ id: res.body.id }).first();
+      expect(row).toBeDefined();
+      expect(row.event_name).toBe('Smoke Wedding');
+      expect(row.created_by).toBe(adminId);
+
+      // Folder structure is created under STORAGE_PATH/events/active/<slug>.
+      const eventDir = path.join(process.env.STORAGE_PATH, 'events/active', res.body.slug);
+      expect(fs.existsSync(path.join(eventDir, 'collages'))).toBe(true);
+      expect(fs.existsSync(path.join(eventDir, 'individual'))).toBe(true);
+
+      // Draft creates must NOT queue the gallery_created email.
+      const queued = await db('email_queue').where({ event_id: res.body.id });
+      expect(queued).toHaveLength(0);
+    });
+
+    it('400s on an invalid event type', async () => {
+      const res = await auth(request(app).post('/api/admin/events')).send({
+        event_type: 'not-a-real-type',
+        event_name: 'Broken',
+        require_password: false,
+      });
+      expect(res.status).toBe(400);
+      expect(Array.isArray(res.body.errors)).toBe(true);
+    });
+  });
+
+  describe('GET /', () => {
+    it('lists events with pagination metadata and photo counts', async () => {
+      await insertEvent(db, adminId, { event_name: 'Alpha' });
+      await insertEvent(db, adminId, { event_name: 'Beta' });
+
+      const res = await auth(request(app).get('/api/admin/events'));
+      expect(res.status).toBe(200);
+      expect(res.body.events).toHaveLength(2);
+      expect(res.body.pagination).toMatchObject({ page: 1, total: 2, totalPages: 1 });
+      for (const ev of res.body.events) {
+        expect(ev.photo_count).toBe(0);
+      }
+    });
+  });
+
+  describe('GET /:id', () => {
+    it('returns the event with photo/view stats', async () => {
+      const id = await insertEvent(db, adminId, { event_name: 'Detail Event' });
+      const res = await auth(request(app).get(`/api/admin/events/${id}`));
+      expect(res.status).toBe(200);
+      expect(res.body.event_name).toBe('Detail Event');
+      expect(res.body.photo_count).toBe(0);
+      expect(res.body.total_views).toBe(0);
+      expect(res.body.total_downloads).toBe(0);
+      expect(Array.isArray(res.body.recent_photos)).toBe(true);
+    });
+
+    it('404s for an unknown event id', async () => {
+      const res = await auth(request(app).get('/api/admin/events/999999'));
+      expect(res.status).toBe(404);
+    });
+  });
+
+  describe('PUT /:id', () => {
+    it('updates mutable fields and persists them', async () => {
+      const id = await insertEvent(db, adminId, { event_name: 'Before' });
+      const res = await auth(request(app).put(`/api/admin/events/${id}`)).send({
+        event_name: 'After',
+        welcome_message: 'Hello guests',
+      });
+      expect(res.status).toBe(200);
+      const row = await db('events').where({ id }).first();
+      expect(row.event_name).toBe('After');
+      expect(row.welcome_message).toBe('Hello guests');
+    });
+
+    it('404s when updating a missing event', async () => {
+      const res = await auth(request(app).put('/api/admin/events/999999')).send({
+        event_name: 'Ghost',
+      });
+      expect(res.status).toBe(404);
+    });
+
+    // #822 — hero_logo_visible/position are nullable (null = "inherit the global
+    // branding toggle"), but the validator used .optional() without
+    // { nullable: true }, so an explicit null was rejected with 400.
+    it('accepts hero_logo_visible: null and stores NULL (inherit)', async () => {
+      const id = await insertEvent(db, adminId, { hero_logo_visible: 1 });
+      const res = await auth(request(app).put(`/api/admin/events/${id}`)).send({
+        hero_logo_visible: null,
+      });
+      expect(res.status).toBe(200);
+      const row = await db('events').where({ id }).first();
+      expect(row.hero_logo_visible).toBeNull();
+    });
+
+    it('still rejects a non-boolean hero_logo_visible', async () => {
+      const id = await insertEvent(db, adminId);
+      const res = await auth(request(app).put(`/api/admin/events/${id}`)).send({
+        hero_logo_visible: 'maybe',
+      });
+      expect(res.status).toBe(400);
+    });
+  });
+
+  describe('DELETE /:id', () => {
+    it('cascade-deletes the event row', async () => {
+      const id = await insertEvent(db, adminId);
+      const res = await auth(request(app).delete(`/api/admin/events/${id}`));
+      expect(res.status).toBe(200);
+      expect(res.body.message).toMatch(/deleted/i);
+      const row = await db('events').where({ id }).first();
+      expect(row).toBeUndefined();
+    });
+
+    it('404s when deleting a missing event', async () => {
+      const res = await auth(request(app).delete('/api/admin/events/999999'));
+      expect(res.status).toBe(404);
+    });
+  });
+});

backend/__tests__/routes/adminEventsCascadeStorage.test.js

@@ -0,0 +1,223 @@
+/**
+ * Regression test: deleting an event must remove its stored objects.
+ *
+ * deleteEventCascade() cleaned up the local filesystem only (#608). On an
+ * S3/R2 storage backend that cleanup is a no-op, so every deleted gallery
+ * left its originals and derived tiers in the bucket — unreferenced,
+ * invisible in the UI, and billed forever. Measured on a v3.45.16 install
+ * against Cloudflare R2: deleting a 403-photo event changed the bucket
+ * object count by exactly zero.
+ *
+ * The keys must be collected BEFORE the transaction deletes the photo
+ * rows, because afterwards nothing knows which objects were this event's.
+ */
+
+const os = require('os');
+const path = require('path');
+
+// The cascade runs a real `fs.rm(..., { recursive: true })` over
+// {STORAGE_PATH}/events/{active,archived}/{slug}. Point that at a throwaway
+// directory before requiring the module under test — the default resolves
+// into the working tree.
+process.env.STORAGE_PATH = path.join(os.tmpdir(), 'picpeak-cascade-storage-test');
+
+const mockStorage = { delete: jest.fn().mockResolvedValue(undefined) };
+
+const mockEvent = {
+  id: 42,
+  slug: 'other-demo-2026-01-01',
+  event_name: 'Demo',
+  source_mode: 'managed',
+  // Written through the backend by archiveService, so it is a bucket object
+  // and the fs.unlink in the cascade never touched it on S3.
+  archive_path: 'archives/other-demo-2026-01-01.zip',
+  // The pre-built "Download All" zip. Lives under the event prefix, so the
+  // recursive fs.rm covers it on local disk and nothing covers it on S3.
+  download_zip_path: 'events/active/other-demo-2026-01-01/.download-cache/all.zip',
+};
+
+const mockPhotos = [
+  {
+    id: 1,
+    path: 'other-demo-2026-01-01/photo_one.jpg',
+    thumbnail_path: 'thumbnails/thumb_aaa_photo_one.jpg',
+    hero_path: null,
+    preview_path: 'previews/prev_aaa_photo_one.jpg',
+    watermark_path: 'watermarked/wm_aaa_photo_one.jpg',
+    source_origin: 'managed',
+  },
+  {
+    id: 2,
+    path: 'other-demo-2026-01-01/photo_two.jpg',
+    thumbnail_path: 'thumbnails/thumb_bbb_photo_two.jpg',
+    hero_path: null,
+    preview_path: null,
+    watermark_path: null,
+    source_origin: 'managed',
+  },
+  {
+    // External photos live outside the managed backend and must be left alone.
+    id: 3,
+    path: 'ignored.jpg',
+    thumbnail_path: null,
+    hero_path: null,
+    preview_path: null,
+    watermark_path: null,
+    source_origin: 'external',
+  },
+];
+
+let mockPhotoRowsDeleted = false;
+let mockJobRowsDeleted = false;
+
+// Photos in OTHER events that share a canonical derivative key with this one.
+let mockSharedDerivatives = [];
+
+// The shared-derivative probe: db('photos').whereNot(...).where(cb).select(...)
+const sharedProbe = {
+  where: () => sharedProbe,
+  whereIn: () => sharedProbe,
+  orWhereIn: () => sharedProbe,
+  select: async () => mockSharedDerivatives,
+};
+
+function mockMakeDb() {
+  const table = (name) => {
+    const chain = {
+      where: () => chain,
+      first: async () => (name === 'events' ? mockEvent : undefined),
+      whereNotNull: () => chain,
+      whereNot: () => sharedProbe,
+      orWhereIn: () => chain,
+      whereIn: () => chain,
+      select: async () => {
+        if (name === 'photos') {
+          // The whole point: if this runs after the transaction, the rows
+          // are gone and we would collect nothing.
+          return mockPhotoRowsDeleted ? [] : mockPhotos;
+        }
+        return [];
+      },
+      del: async () => {
+        if (name === 'photos') mockPhotoRowsDeleted = true;
+        if (name === 'download_jobs') mockJobRowsDeleted = true;
+        return 1;
+      },
+    };
+    return chain;
+  };
+  // #1132 guards the merge-dismissals delete behind a hasTable check.
+  table.schema = { hasTable: async () => false };
+  table.transaction = async (cb) => cb(table);
+  return table;
+}
+
+jest.mock('../../src/database/db', () => ({
+  db: mockMakeDb(),
+  logActivity: jest.fn().mockResolvedValue(undefined),
+}));
+
+jest.mock('../../src/services/storage', () => ({
+  getStorage: () => mockStorage,
+}));
+
+const { deleteEventCascade } = require('../../src/routes/adminEvents/helpers');
+
+describe('deleteEventCascade — storage cleanup', () => {
+  beforeEach(() => {
+    mockStorage.delete.mockClear();
+    mockPhotoRowsDeleted = false;
+    mockJobRowsDeleted = false;
+    mockSharedDerivatives = [];
+  });
+
+  it('deletes originals and every derived tier from the storage backend', async () => {
+    await deleteEventCascade(42, { id: 1, username: 'admin' });
+
+    const deleted = mockStorage.delete.mock.calls.map(([key]) => key);
+
+    expect(deleted).toEqual(expect.arrayContaining([
+      'events/active/other-demo-2026-01-01/photo_one.jpg',
+      'events/active/other-demo-2026-01-01/photo_two.jpg',
+      'thumbnails/thumb_aaa_photo_one.jpg',
+      'thumbnails/thumb_bbb_photo_two.jpg',
+      'previews/prev_aaa_photo_one.jpg',
+    ]));
+  });
+
+  it('deletes pre-generated watermarks and the archive zip', async () => {
+    await deleteEventCascade(42, { id: 1, username: 'admin' });
+
+    const deleted = mockStorage.delete.mock.calls.map(([key]) => key);
+
+    // Both are storage-backend objects that only fs.unlink ever touched, so
+    // both survived an event delete on S3.
+    expect(deleted).toEqual(expect.arrayContaining([
+      'watermarked/wm_aaa_photo_one.jpg',
+      'archives/other-demo-2026-01-01.zip',
+    ]));
+  });
+
+  it('deletes the Download All cache, which only fs.rm ever covered', async () => {
+    await deleteEventCascade(42, { id: 1, username: 'admin' });
+
+    const deleted = mockStorage.delete.mock.calls.map(([key]) => key);
+
+    // Sits under events/active/{slug}/.download-cache/ — swept by the
+    // recursive fs.rm on local disk, invisible to it on S3 where the prefix
+    // is not a directory. Gallery-sized. (download_jobs is main-only, so the
+    // per-job archives main also sweeps have no counterpart here.)
+    expect(deleted).toContain(
+      'events/active/other-demo-2026-01-01/.download-cache/all.zip'
+    );
+  });
+
+  it('leaves a derivative alone when another event still points at it', async () => {
+    // Canonical thumbnail/hero/preview keys are not event-scoped — the
+    // basename is the photo's filename, and filenames are not unique across
+    // events. Deleting one a surviving gallery still references would blank
+    // its tile.
+    mockSharedDerivatives = [{
+      thumbnail_path: 'thumbnails/thumb_aaa_photo_one.jpg',
+      hero_path: null,
+      preview_path: null,
+      watermark_path: null,
+    }];
+
+    await deleteEventCascade(42, { id: 1, username: 'admin' });
+
+    const deleted = mockStorage.delete.mock.calls.map(([key]) => key);
+    expect(deleted).not.toContain('thumbnails/thumb_aaa_photo_one.jpg');
+    // The originals are slug-scoped and must still go.
+    expect(deleted).toContain('events/active/other-demo-2026-01-01/photo_one.jpg');
+    // So must a derivative nobody else claims.
+    expect(deleted).toContain('thumbnails/thumb_bbb_photo_two.jpg');
+  });
+
+  it('never asks the backend to delete the same key twice', async () => {
+    await deleteEventCascade(42, { id: 1, username: 'admin' });
+
+    const managed = mockStorage.delete.mock.calls
+      .map(([key]) => key)
+      .filter((key) => !key.startsWith('thumbnails/thumb_w') && !key.startsWith('previews/preview_w'));
+
+    expect(managed).toEqual([...new Set(managed)]);
+  });
+
+  it('leaves external/reference photos in place', async () => {
+    await deleteEventCascade(42, { id: 1, username: 'admin' });
+
+    const deleted = mockStorage.delete.mock.calls.map(([key]) => key);
+    expect(deleted).not.toEqual(expect.arrayContaining(['ignored.jpg']));
+    expect(deleted).not.toEqual(expect.arrayContaining(['events/active/ignored.jpg']));
+  });
+
+  it('still completes the delete when the storage backend throws', async () => {
+    mockStorage.delete.mockRejectedValue(new Error('bucket unreachable'));
+
+    await expect(deleteEventCascade(42, { id: 1, username: 'admin' }))
+      .resolves.toEqual({ id: 42, name: 'Demo' });
+
+    mockStorage.delete.mockResolvedValue(undefined);
+  });
+});

backend/__tests__/routes/adminEventsLogoPathTraversal.test.js

@@ -0,0 +1,122 @@
+/**
+ * GHSA-9q5j-vqfw-32hr — the event-logo upload's multer `filename` callback
+ * built the stored path directly from `req.params.id` with no integer
+ * validation:
+ *
+ *   filename: (req, file, cb) => {
+ *     cb(null, `event-${req.params.id}-logo-${Date.now()}${ext}`);
+ *   }
+ *
+ * A traversal payload in the `:id` route param (URL-encoded so it still
+ * matches a single Express path segment, then decoded back into literal
+ * `../` sequences by Express before handlers see it) could escape the
+ * intended uploads/logos/events/ directory. Most directly reachable via a
+ * super_admin session: requireEventOwnership short-circuits with next() and
+ * zero DB lookup for that role (src/middleware/ownership.js), so nothing
+ * upstream of multer validates the id first.
+ *
+ * Fixed by rejecting any non-positive-integer id before it is used to build
+ * the filename, regardless of role or ownership-check ordering.
+ */
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-events-logo-')), 'db.sqlite'
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'admin-events-logo-test-secret';
+
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const request = require('supertest');
+const { bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken } = require('../integration/helpers/crmDb');
+
+async function insertEvent(db, adminId, over = {}) {
+  const base = {
+    slug: `ev-${Math.random().toString(16).slice(2)}`,
+    event_type: 'wedding',
+    event_name: 'Test Wedding',
+    event_date: '2026-05-29',
+    host_email: 'host@example.com',
+    admin_email: 'admin@example.com',
+    password_hash: 'x',
+    share_link: `/gallery/share-${Math.random().toString(16).slice(2)}`,
+    share_token: `st-${Math.random().toString(16).slice(2)}`,
+    expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+    is_active: 1, is_archived: 0, is_draft: 0,
+    created_by: adminId,
+    created_at: new Date().toISOString(),
+    ...over,
+  };
+  const r = await db('events').insert(base).returning('id');
+  return r[0]?.id ?? r[0];
+}
+
+describe('POST /api/admin/events/:id/logo — path traversal guard', () => {
+  let db; let cleanup; let app; let adminId; let token;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    ({ adminId } = await seedMinimal(db));
+    // super_admin: requireEventOwnership short-circuits with no DB lookup
+    // for this role, so it reaches multer with nothing upstream having
+    // validated the id — the exact path GHSA-9q5j-vqfw-32hr exploited.
+    await assignAdminRole(db, adminId, 'super_admin');
+    token = mintAdminToken(adminId);
+
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/admin/events', require('../../src/routes/adminEvents'));
+    // eslint-disable-next-line no-unused-vars
+    app.use((err, req, res, next) => {
+      res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
+    });
+  }, 120000);
+
+  afterAll(async () => { await cleanup(); });
+
+  const auth = (req) => req.set('Authorization', `Bearer ${token}`);
+  const logoDir = () => path.join(process.env.STORAGE_PATH, 'uploads/logos/events');
+
+  it('rejects a traversal payload in the id param instead of writing outside uploads/logos/events', async () => {
+    // '../../../../tmp/pwned' URL-encoded so the raw request path still has
+    // a single segment (matches Express's `:id`), but Express decodes the
+    // param back into literal '../' sequences before the route sees it.
+    const traversalId = encodeURIComponent('../../../../tmp/pwned');
+
+    const res = await auth(
+      request(app).post(`/api/admin/events/${traversalId}/logo`)
+    ).attach('logo', Buffer.from('fake image data'), 'logo.png');
+
+    expect(res.status).toBeGreaterThanOrEqual(400);
+    expect(res.body.error).toMatch(/invalid event id/i);
+
+    // No file should have been written anywhere — the filename callback
+    // must error out before multer opens a write stream.
+    const escapedFile = path.join(os.tmpdir(), 'pwned');
+    expect(fs.existsSync(escapedFile)).toBe(false);
+    if (fs.existsSync(logoDir())) {
+      expect(fs.readdirSync(logoDir())).toHaveLength(0);
+    }
+  });
+
+  it('still accepts a normal numeric event id', async () => {
+    const id = await insertEvent(db, adminId, { event_name: 'Logo Event' });
+
+    const res = await auth(
+      request(app).post(`/api/admin/events/${id}/logo`)
+    ).attach('logo', Buffer.from('fake image data'), 'logo.png');
+
+    expect(res.status).toBe(200);
+    expect(res.body.hero_logo_url).toMatch(new RegExp(`^/uploads/logos/events/event-${id}-logo-`));
+
+    const files = fs.readdirSync(logoDir());
+    expect(files.some((f) => f.startsWith(`event-${id}-logo-`))).toBe(true);
+
+    const row = await db('events').where({ id }).first();
+    expect(row.hero_logo_url).toBe(res.body.hero_logo_url);
+  });
+});

backend/__tests__/routes/adminMfa.test.js

@@ -0,0 +1,558 @@
+/**
+ * HTTP-level tests for the admin TOTP MFA feature (#738).
+ *
+ * Two surfaces:
+ *   1. Enrollment (adminAuth-gated) — POST /mfa/setup, /mfa/enable,
+ *      GET /mfa/status, POST /mfa/disable — mounted like server.js at
+ *      /api/admin/auth (src/routes/adminAuth.js).
+ *   2. Login challenge — POST /admin/login + POST /admin/login/mfa
+ *      (src/routes/auth.js, mounted /api/auth).
+ *
+ * Uses the same real-SQLite harness as the CRM route tests
+ * (bootCrmDb + seedMinimal + mintAdminToken). Valid TOTP codes are
+ * generated in-test via otplib's authenticator against the secret the
+ * /setup endpoint returns in plaintext.
+ *
+ * NOTE: env (TEST_DATABASE_PATH / JWT_SECRET) must be set BEFORE the
+ * first require of db.js — mirror adminCrmAuth.test.js exactly.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-adminmfa-test-'));
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'db.sqlite');
+process.env.STORAGE_PATH = path.join(tmpDir, 'storage');
+fs.mkdirSync(process.env.STORAGE_PATH, { recursive: true });
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'mfa-route-test-secret';
+// reCAPTCHA disabled (default) → verifyRecaptcha returns true, so login
+// tests don't need a token. Be explicit so a leaked env can't flip it on.
+delete process.env.RECAPTCHA_SECRET_KEY;
+
+const request = require('supertest');
+const bcrypt = require('bcrypt');
+const { authenticator } = require('otplib');
+
+const {
+  bootCrmDb, mintAdminToken, buildRouteApp,
+} = require('../integration/helpers/crmDb');
+const mfaService = require('../../src/services/mfaService');
+
+jest.setTimeout(120000);
+
+let db;
+let cleanup;
+let adminApp; // /api/admin/auth  (enrollment)
+let authApp; // /api/auth        (login challenge)
+
+/**
+ * Seed a bare admin (password known) and return its id + login creds.
+ * seedMinimal always creates username 'tester'; we need distinct rows per
+ * scenario, so insert directly with a unique username/email.
+ */
+async function seedAdmin({ username, superAdmin = false } = {}) {
+  const password = 'correct-horse';
+  const passwordHash = await bcrypt.hash(password, 4);
+  const uname = username || `admin-${Math.random().toString(36).slice(2, 8)}`;
+  const row = {
+    username: uname,
+    email: `${uname}@example.com`,
+    password_hash: passwordHash,
+    must_change_password: false,
+    is_active: true,
+    created_at: new Date(),
+  };
+  if (superAdmin) {
+    const role = await db('roles').where({ name: 'super_admin' }).first();
+    if (!role) throw new Error('super_admin role not seeded');
+    row.role_id = role.id;
+  }
+  const inserted = await db('admin_users').insert(row).returning('id');
+  const id = inserted[0]?.id ?? inserted[0];
+  return { id, username: uname, password };
+}
+
+/** Run the full setup→enable enrollment against the live app. Returns
+ * the plaintext TOTP secret (for later login codes) and recovery codes. */
+async function enroll(adminId) {
+  const token = mintAdminToken(adminId);
+  const setup = await request(adminApp)
+    .post('/api/admin/auth/mfa/setup')
+    .set('Authorization', `Bearer ${token}`);
+  expect(setup.status).toBe(200);
+  const secret = setup.body.secret;
+
+  const enable = await request(adminApp)
+    .post('/api/admin/auth/mfa/enable')
+    .set('Authorization', `Bearer ${token}`)
+    .send({ code: authenticator.generate(secret) });
+  expect(enable.status).toBe(200);
+  return { secret, recoveryCodes: enable.body.recoveryCodes, token };
+}
+
+beforeAll(async () => {
+  ({ db, cleanup } = await bootCrmDb());
+  adminApp = buildRouteApp('/api/admin/auth', require('../../src/routes/adminAuth'));
+  authApp = buildRouteApp('/api/auth', require('../../src/routes/auth'));
+}, 120000);
+
+afterAll(async () => {
+  if (cleanup) await cleanup();
+});
+
+describe('MFA enrollment — /api/admin/auth/mfa/*', () => {
+  it('setup returns a secret + otpauth URI + QR and does NOT enable yet', async () => {
+    const admin = await seedAdmin();
+    const token = mintAdminToken(admin.id);
+
+    const res = await request(adminApp)
+      .post('/api/admin/auth/mfa/setup')
+      .set('Authorization', `Bearer ${token}`);
+
+    expect(res.status).toBe(200);
+    expect(res.body.secret).toEqual(expect.any(String));
+    expect(res.body.otpauthUri).toMatch(/^otpauth:\/\/totp\//);
+    expect(res.body.qr).toMatch(/^data:image\/png;base64,/);
+
+    // Not yet enabled: status must still report disabled.
+    const status = await request(adminApp)
+      .get('/api/admin/auth/mfa/status')
+      .set('Authorization', `Bearer ${token}`);
+    expect(status.body.enabled).toBe(false);
+
+    // And the row stores an encrypted secret (not the plaintext one).
+    const row = await db('admin_users').where({ id: admin.id }).first();
+    expect(row.two_factor_secret).toBeTruthy();
+    expect(row.two_factor_secret).not.toBe(res.body.secret);
+    expect(Number(row.two_factor_enabled)).toBe(0);
+  });
+
+  it('full flow: setup → enable(valid TOTP) → status shows enabled + 10 recovery codes', async () => {
+    const admin = await seedAdmin();
+    const { recoveryCodes, token } = await enroll(admin.id);
+
+    expect(Array.isArray(recoveryCodes)).toBe(true);
+    expect(recoveryCodes).toHaveLength(10);
+
+    const status = await request(adminApp)
+      .get('/api/admin/auth/mfa/status')
+      .set('Authorization', `Bearer ${token}`);
+    expect(status.status).toBe(200);
+    expect(status.body.enabled).toBe(true);
+    expect(status.body.recoveryCodesRemaining).toBe(10);
+    expect(status.body.enrolledAt).toBeTruthy();
+  });
+
+  it('enable with a WRONG code is rejected (400) and MFA stays off', async () => {
+    const admin = await seedAdmin();
+    const token = mintAdminToken(admin.id);
+    const setup = await request(adminApp)
+      .post('/api/admin/auth/mfa/setup')
+      .set('Authorization', `Bearer ${token}`);
+    const valid = authenticator.generate(setup.body.secret);
+    const wrong = valid === '000000' ? '111111' : '000000';
+
+    const res = await request(adminApp)
+      .post('/api/admin/auth/mfa/enable')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ code: wrong });
+    expect(res.status).toBe(400);
+
+    const status = await request(adminApp)
+      .get('/api/admin/auth/mfa/status')
+      .set('Authorization', `Bearer ${token}`);
+    expect(status.body.enabled).toBe(false);
+  });
+
+  it('enable before setup is rejected', async () => {
+    const admin = await seedAdmin();
+    const token = mintAdminToken(admin.id);
+    const res = await request(adminApp)
+      .post('/api/admin/auth/mfa/enable')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ code: '123456' });
+    // No provisional secret → ValidationError (400).
+    expect(res.status).toBe(400);
+  });
+
+  it('all enrollment endpoints require a valid admin token (401 without one)', async () => {
+    const noToken = await request(adminApp).get('/api/admin/auth/mfa/status');
+    expect(noToken.status).toBe(401);
+    const setup = await request(adminApp).post('/api/admin/auth/mfa/setup');
+    expect(setup.status).toBe(401);
+  });
+
+  // Regression guard for #735: super_admin used to be blocked from enrolling.
+  // Enrollment operates on req.admin.id and is role-agnostic — assert a
+  // super_admin can complete the full setup→enable flow.
+  it('#735 regression — a super_admin can enroll in MFA', async () => {
+    const admin = await seedAdmin({ superAdmin: true });
+    const { recoveryCodes, token } = await enroll(admin.id);
+    expect(recoveryCodes).toHaveLength(10);
+
+    const status = await request(adminApp)
+      .get('/api/admin/auth/mfa/status')
+      .set('Authorization', `Bearer ${token}`);
+    expect(status.body.enabled).toBe(true);
+  });
+});
+
+describe('MFA disable — /api/admin/auth/mfa/disable', () => {
+  it('requires a valid code; a wrong code is rejected and state persists', async () => {
+    const admin = await seedAdmin();
+    const { token } = await enroll(admin.id);
+
+    const bad = await request(adminApp)
+      .post('/api/admin/auth/mfa/disable')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ code: '000000' });
+    expect(bad.status).toBe(400);
+
+    const stillOn = await request(adminApp)
+      .get('/api/admin/auth/mfa/status')
+      .set('Authorization', `Bearer ${token}`);
+    expect(stillOn.body.enabled).toBe(true);
+  });
+
+  it('a valid TOTP disables MFA and clears the stored secret', async () => {
+    const admin = await seedAdmin();
+    const { secret, token } = await enroll(admin.id);
+
+    const res = await request(adminApp)
+      .post('/api/admin/auth/mfa/disable')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ code: authenticator.generate(secret) });
+    expect(res.status).toBe(200);
+
+    const status = await request(adminApp)
+      .get('/api/admin/auth/mfa/status')
+      .set('Authorization', `Bearer ${token}`);
+    expect(status.body.enabled).toBe(false);
+    expect(status.body.recoveryCodesRemaining).toBe(0);
+
+    const row = await db('admin_users').where({ id: admin.id }).first();
+    expect(row.two_factor_secret).toBeNull();
+    expect(row.two_factor_recovery_codes).toBeNull();
+  });
+
+  // Concurrency regression: a plain UPDATE with no conditional guard let two
+  // requests carrying the same captured code both read the same
+  // two_factor_last_used_step and both persist, defeating replay protection.
+  // The guarded UPDATE (mfaService.persistTotpStep) makes only the first
+  // writer's affected-row count > 0; the loser must be rejected.
+  it('two concurrent disable requests with the SAME captured code: only one succeeds', async () => {
+    const admin = await seedAdmin();
+    const { secret, token } = await enroll(admin.id);
+    const code = authenticator.generate(secret);
+
+    const [r1, r2] = await Promise.all([
+      request(adminApp)
+        .post('/api/admin/auth/mfa/disable')
+        .set('Authorization', `Bearer ${token}`)
+        .send({ code }),
+      request(adminApp)
+        .post('/api/admin/auth/mfa/disable')
+        .set('Authorization', `Bearer ${token}`)
+        .send({ code }),
+    ]);
+
+    expect([r1.status, r2.status].sort()).toEqual([200, 400]);
+
+    const status = await request(adminApp)
+      .get('/api/admin/auth/mfa/status')
+      .set('Authorization', `Bearer ${token}`);
+    expect(status.body.enabled).toBe(false);
+  });
+});
+
+describe('MFA regenerate recovery codes — /api/admin/auth/mfa/recovery-codes', () => {
+  it('a valid TOTP regenerates the recovery codes and persists the step', async () => {
+    const admin = await seedAdmin();
+    const { secret, token } = await enroll(admin.id);
+
+    const res = await request(adminApp)
+      .post('/api/admin/auth/mfa/recovery-codes')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ code: authenticator.generate(secret) });
+
+    expect(res.status).toBe(200);
+    expect(res.body.recoveryCodes).toHaveLength(10);
+  });
+
+  it('a wrong code is rejected (400)', async () => {
+    const admin = await seedAdmin();
+    const { secret, token } = await enroll(admin.id);
+    const valid = authenticator.generate(secret);
+    const wrong = valid === '000000' ? '111111' : '000000';
+
+    const res = await request(adminApp)
+      .post('/api/admin/auth/mfa/recovery-codes')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ code: wrong });
+    expect(res.status).toBe(400);
+  });
+
+  // Concurrency regression (see the disable test above for the mechanism):
+  // this is the endpoint called out as the worst lost-update case, since it
+  // both rotates the recovery codes and (previously) persisted the step in
+  // one unconditional UPDATE.
+  it('two concurrent regenerations with the SAME captured code: only one succeeds', async () => {
+    const admin = await seedAdmin();
+    const { secret, token } = await enroll(admin.id);
+    const code = authenticator.generate(secret);
+
+    const [r1, r2] = await Promise.all([
+      request(adminApp)
+        .post('/api/admin/auth/mfa/recovery-codes')
+        .set('Authorization', `Bearer ${token}`)
+        .send({ code }),
+      request(adminApp)
+        .post('/api/admin/auth/mfa/recovery-codes')
+        .set('Authorization', `Bearer ${token}`)
+        .send({ code }),
+    ]);
+
+    expect([r1.status, r2.status].sort()).toEqual([200, 400]);
+    const winner = r1.status === 200 ? r1 : r2;
+    expect(winner.body.recoveryCodes).toHaveLength(10);
+
+    const row = await db('admin_users').where({ id: admin.id }).first();
+    expect(row.two_factor_last_used_step).not.toBeNull();
+  });
+});
+
+describe('mfaService.persistTotpStep — atomic replay-tracking persist', () => {
+  // Deterministic simulation of the race: two "concurrent" requests that
+  // read the SAME two_factor_last_used_step and computed the SAME totpStep
+  // from the same captured code. Calling persistTotpStep twice in a row with
+  // that identical totpStep reproduces exactly the DB-level outcome of a
+  // true race, without relying on event-loop timing.
+  it('the second writer with the same totpStep affects 0 rows and is rejected', async () => {
+    const admin = await seedAdmin();
+    const { secret } = await enroll(admin.id);
+    const row = await db('admin_users').where({ id: admin.id }).first();
+    const code = authenticator.generate(secret);
+    const totpStep = mfaService.verifyTotpEncryptedStep(code, row.two_factor_secret, null);
+    expect(totpStep).toEqual(expect.any(Number));
+
+    const first = await mfaService.persistTotpStep(db, admin.id, totpStep, { updated_at: new Date() });
+    expect(first).toBe(true);
+
+    // The row's two_factor_last_used_step has now already advanced to
+    // totpStep by the time this "losing" write runs — the guard condition
+    // (whereNull OR < totpStep) is false, so 0 rows are affected.
+    const second = await mfaService.persistTotpStep(db, admin.id, totpStep, { updated_at: new Date() });
+    expect(second).toBe(false);
+
+    const after = await db('admin_users').where({ id: admin.id }).first();
+    expect(Number(after.two_factor_last_used_step)).toBe(totpStep);
+  });
+
+  it('succeeds when the new step advances past the current one', async () => {
+    const admin = await seedAdmin();
+    const { secret } = await enroll(admin.id);
+    const row = await db('admin_users').where({ id: admin.id }).first();
+    const code = authenticator.generate(secret);
+    const totpStep = mfaService.verifyTotpEncryptedStep(code, row.two_factor_secret, null);
+
+    const ok = await mfaService.persistTotpStep(db, admin.id, totpStep, {});
+    expect(ok).toBe(true);
+
+    const nextStepAuthenticator = authenticator.clone({ epoch: Date.now() + 30000 });
+    const nextCode = nextStepAuthenticator.generate(secret);
+    const nextStep = mfaService.verifyTotpEncryptedStep(nextCode, row.two_factor_secret, totpStep);
+    expect(nextStep).toBeGreaterThan(totpStep);
+
+    const advanced = await mfaService.persistTotpStep(db, admin.id, nextStep, {});
+    expect(advanced).toBe(true);
+  });
+});
+
+describe('Admin login challenge — /api/auth/admin/login[/mfa]', () => {
+  it('an enrolled admin gets mfaRequired + mfaToken, NO session cookie', async () => {
+    const admin = await seedAdmin();
+    await enroll(admin.id);
+
+    const res = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+
+    expect(res.status).toBe(200);
+    expect(res.body.mfaRequired).toBe(true);
+    expect(res.body.mfaToken).toEqual(expect.any(String));
+    expect(res.body.user).toBeUndefined(); // no completed session
+    // No admin auth cookie should have been set on the challenge response.
+    const cookies = res.headers['set-cookie'] || [];
+    expect(cookies.join(';')).not.toMatch(/adminToken/i);
+  });
+
+  it('a NON-enrolled admin logs in directly (no mfaRequired)', async () => {
+    const admin = await seedAdmin();
+    const res = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+    expect(res.status).toBe(200);
+    expect(res.body.mfaRequired).toBeUndefined();
+    expect(res.body.user).toBeDefined();
+    expect(res.body.user.username).toBe(admin.username);
+  });
+
+  it('login/mfa with a valid TOTP completes the session', async () => {
+    const admin = await seedAdmin();
+    const { secret } = await enroll(admin.id);
+
+    const challenge = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+    const { mfaToken } = challenge.body;
+
+    const res = await request(authApp)
+      .post('/api/auth/admin/login/mfa')
+      .send({ mfaToken, code: authenticator.generate(secret) });
+
+    expect(res.status).toBe(200);
+    expect(res.body.user).toBeDefined();
+    expect(res.body.user.id).toBe(admin.id);
+  });
+
+  // GHSA-qcwx-r25m-j869: verifyTotp() was stateless, so otplib's window:1
+  // tolerance let the same 6-digit code complete two independent logins
+  // within its ~90s validity window. mfaService now tracks each admin's
+  // last-consumed TOTP step and rejects a code that doesn't advance past it.
+  it('#GHSA-qcwx-r25m-j869 — a TOTP code cannot be replayed into a second login', async () => {
+    const admin = await seedAdmin();
+    const { secret } = await enroll(admin.id);
+    const code = authenticator.generate(secret);
+
+    // First use of the code completes a login.
+    const c1 = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+    const first = await request(authApp)
+      .post('/api/auth/admin/login/mfa')
+      .send({ mfaToken: c1.body.mfaToken, code });
+    expect(first.status).toBe(200);
+    expect(first.body.user).toBeDefined();
+
+    // Replaying the SAME code for an independent second login must fail,
+    // even though otplib's window:1 tolerance still considers it valid.
+    const c2 = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+    const replay = await request(authApp)
+      .post('/api/auth/admin/login/mfa')
+      .send({ mfaToken: c2.body.mfaToken, code });
+    expect(replay.status).toBe(401);
+    expect(replay.body.code).toBe('MFA_INVALID');
+    expect(replay.body.user).toBeUndefined();
+
+    // A freshly generated code for the NEXT TOTP step is not a replay and
+    // succeeds. Generated via a cloned authenticator with a future epoch
+    // rather than mocking Date.now(), so mfaService's own step computation
+    // (real Date.now()) still lands the match one step ahead.
+    const nextStepAuthenticator = authenticator.clone({ epoch: Date.now() + 30000 });
+    const nextCode = nextStepAuthenticator.generate(secret);
+    const c3 = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+    const third = await request(authApp)
+      .post('/api/auth/admin/login/mfa')
+      .send({ mfaToken: c3.body.mfaToken, code: nextCode });
+    expect(third.status).toBe(200);
+    expect(third.body.user).toBeDefined();
+    expect(third.body.user.id).toBe(admin.id);
+  });
+
+  // Concurrency regression: verifyTotpEncryptedStep()'s "does this advance"
+  // check was read against a snapshot taken earlier in the request, then a
+  // PLAIN update persisted the step — two concurrent requests carrying the
+  // SAME captured code could both pass the check and both complete a login
+  // before either write landed. The persist is now a conditional UPDATE
+  // (mfaService.persistTotpStep), so only the first writer's affected-row
+  // count is > 0 and the other is correctly treated as a replay.
+  it('two concurrent login/mfa requests with the SAME captured code: only one completes', async () => {
+    const admin = await seedAdmin();
+    const { secret } = await enroll(admin.id);
+    const code = authenticator.generate(secret);
+
+    const c1 = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+    const c2 = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+
+    const [r1, r2] = await Promise.all([
+      request(authApp).post('/api/auth/admin/login/mfa').send({ mfaToken: c1.body.mfaToken, code }),
+      request(authApp).post('/api/auth/admin/login/mfa').send({ mfaToken: c2.body.mfaToken, code }),
+    ]);
+
+    expect([r1.status, r2.status].sort()).toEqual([200, 401]);
+    const winner = r1.status === 200 ? r1 : r2;
+    const loser = r1.status === 200 ? r2 : r1;
+    expect(winner.body.user).toBeDefined();
+    expect(loser.body.user).toBeUndefined();
+    expect(loser.body.code).toBe('MFA_INVALID');
+  });
+
+  it('login/mfa with a wrong code is 401 MFA_INVALID', async () => {
+    const admin = await seedAdmin();
+    const { secret } = await enroll(admin.id);
+    const challenge = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+
+    const valid = authenticator.generate(secret);
+    const wrong = valid === '000000' ? '111111' : '000000';
+    const res = await request(authApp)
+      .post('/api/auth/admin/login/mfa')
+      .send({ mfaToken: challenge.body.mfaToken, code: wrong });
+
+    expect(res.status).toBe(401);
+    expect(res.body.code).toBe('MFA_INVALID');
+    expect(res.body.user).toBeUndefined();
+  });
+
+  it('a recovery code logs in and is then single-use (second use fails)', async () => {
+    const admin = await seedAdmin();
+    const { recoveryCodes } = await enroll(admin.id);
+    const recovery = recoveryCodes[0];
+
+    // First challenge + recovery-code exchange succeeds.
+    const c1 = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+    const first = await request(authApp)
+      .post('/api/auth/admin/login/mfa')
+      .send({ mfaToken: c1.body.mfaToken, code: recovery });
+    expect(first.status).toBe(200);
+    expect(first.body.user).toBeDefined();
+
+    // recoveryCodesRemaining dropped by one.
+    const status = await request(adminApp)
+      .get('/api/admin/auth/mfa/status')
+      .set('Authorization', `Bearer ${mintAdminToken(admin.id)}`);
+    expect(status.body.recoveryCodesRemaining).toBe(9);
+
+    // Second use of the SAME recovery code must fail.
+    const c2 = await request(authApp)
+      .post('/api/auth/admin/login')
+      .send({ username: admin.username, password: admin.password });
+    const second = await request(authApp)
+      .post('/api/auth/admin/login/mfa')
+      .send({ mfaToken: c2.body.mfaToken, code: recovery });
+    expect(second.status).toBe(401);
+    expect(second.body.code).toBe('MFA_INVALID');
+  });
+
+  it('login/mfa rejects a non-mfa_pending token (e.g. a normal admin JWT)', async () => {
+    const admin = await seedAdmin();
+    await enroll(admin.id);
+    const res = await request(authApp)
+      .post('/api/auth/admin/login/mfa')
+      .send({ mfaToken: mintAdminToken(admin.id), code: '123456' });
+    expect(res.status).toBe(401);
+  });
+});

backend/__tests__/routes/adminPhotoContentType.test.js

@@ -0,0 +1,238 @@
+/**
+ * Admin photo view route Content-Type (#908).
+ *
+ * The route built `image/<ext>` from the filename, producing invalid
+ * types like image/mp4 for videos. AdminAuthenticatedVideo fetches this
+ * URL into a blob whose type inherits the header, and browsers refuse to
+ * play a <video> blob labeled image/* — blank/grey admin video preview.
+ *
+ * Pins (incl. external-review hardening):
+ *  - the header is ALWAYS image/* or video/*: a stored non-media MIME
+ *    (chunked uploads store the client-sent type unvalidated) is never
+ *    echoed — text/html inline under the app origin would be XSS
+ *  - stored video/ MIME wins; MIME-less videos map from the extension
+ *    (.mov → video/quicktime), unknown video extensions get video/mp4
+ *  - images IGNORE the stored MIME (migration 039 backfilled image/jpeg
+ *    onto every legacy row, PNGs included) and use the extension,
+ *    normalized (jpg → image/jpeg); extensionless files get image/jpeg
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-admin-ct-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'admin-ct-test-secret';
+process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-admin-ct-storage-'));
+
+const request = require('supertest');
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
+
+const SLUG = 'admin-ct-test-event';
+
+describe('admin photo view Content-Type (#908)', () => {
+  let db;
+  let cleanup;
+  let app;
+  let eventId;
+  let adminToken;
+
+  const addPhoto = async (filename, extra = {}) => {
+    const dir = path.join(process.env.STORAGE_PATH, 'events/active', SLUG);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, filename), Buffer.from(`bytes-${filename}`));
+    const r = await db('photos').insert({
+      event_id: eventId,
+      filename,
+      path: `${SLUG}/${filename}`,
+      type: 'individual',
+      uploaded_at: new Date().toISOString(),
+      ...extra,
+    }).returning('id');
+    return r[0]?.id ?? r[0];
+  };
+
+  const getPhotoRes = (photoId) => request(app)
+    .get(`/api/admin/photos/${eventId}/photo/${photoId}`)
+    .set('Authorization', `Bearer ${adminToken}`);
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+
+    const inserted = await db('events').insert({
+      slug: SLUG,
+      event_type: 'wedding',
+      event_name: 'Admin CT Test',
+      event_date: '2026-08-01',
+      host_email: 'host@example.com',
+      admin_email: 'admin@example.com',
+      password_hash: 'x',
+      share_link: `/gallery/${SLUG}/share`,
+      share_token: 'admin-ct-share',
+      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+      is_active: 1,
+      is_archived: 0,
+      is_draft: 0,
+      created_at: new Date().toISOString(),
+    }).returning('id');
+    eventId = inserted[0]?.id ?? inserted[0];
+
+    const superRole = await db('roles').where({ name: 'super_admin' }).first();
+    const [rootId] = await db('admin_users').insert({
+      username: 'admin-ct-admin',
+      email: 'admin-ct-admin@example.com',
+      password_hash: await bcrypt.hash('AdminCt123', 4),
+      role_id: superRole.id,
+      is_active: 1,
+      created_at: new Date(),
+      updated_at: new Date(),
+    }).returning('id').then((r) => [r[0]?.id || r[0]]);
+    adminToken = jwt.sign(
+      { id: rootId, username: 'admin-ct-admin', type: 'admin', role: 'super_admin', loginTime: Date.now() },
+      process.env.JWT_SECRET,
+      { expiresIn: '1h', issuer: 'picpeak-auth' }
+    );
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/photos', require('../../src/routes/adminPhotos'));
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  it('serves a video with its stored mime_type, not image/<ext>', async () => {
+    const id = await addPhoto('clip.mp4', { media_type: 'video', mime_type: 'video/mp4' });
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('video/mp4');
+  });
+
+  it('maps MIME-less videos from their extension (.mov → video/quicktime)', async () => {
+    const id = await addPhoto('clip-nomime.mov', { media_type: 'video' });
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('video/quicktime');
+  });
+
+  it('falls back to video/mp4 for a video with an unknown extension', async () => {
+    const id = await addPhoto('clip-unknown.xyz', { media_type: 'video' });
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('video/mp4');
+  });
+
+  it('rejects malformed video/ MIME values that would break setHeader', async () => {
+    // Header-invalid chars in the stored value must not 500 the route —
+    // fall back to the extension map instead.
+    const id = await addPhoto('crlf.mp4', {
+      media_type: 'video',
+      mime_type: 'video/mp4\r\nX-Evil: 1',
+    });
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('video/mp4');
+    expect(res.headers['x-evil']).toBeUndefined();
+
+    const bare = await addPhoto('bare.webm', { media_type: 'video', mime_type: 'video/' });
+    const res2 = await getPhotoRes(bare);
+    expect(res2.status).toBe(200);
+    expect(res2.headers['content-type']).toBe('video/webm');
+  });
+
+  it('preserves an auto-imported avif via the safe stored-MIME allowlist', async () => {
+    // .avif isn't in EXTENSION_TO_MIME; s3AutoImporter stores image/avif.
+    // Map-only would mislabel it image/jpeg — the allowlist keeps it.
+    const id = await addPhoto('imported.avif', { mime_type: 'image/avif' });
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('image/avif');
+  });
+
+  it('preserves other importer raster types too (apng, x-icon)', async () => {
+    const apng = await addPhoto('anim.apng', { mime_type: 'image/apng' });
+    expect((await getPhotoRes(apng)).headers['content-type']).toBe('image/apng');
+    const ico = await addPhoto('fav.ico', { mime_type: 'image/x-icon' });
+    expect((await getPhotoRes(ico)).headers['content-type']).toBe('image/x-icon');
+  });
+
+  it('does NOT honor a stored scriptable image type (image/svg+xml)', async () => {
+    // svg is inline-scriptable and must never be echoed — allowlist excludes it.
+    const id = await addPhoto('vector.svg', { mime_type: 'image/svg+xml' });
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('image/jpeg');
+  });
+
+  it('never echoes a stored non-media MIME type (inline XSS guard)', async () => {
+    const id = await addPhoto('evil.png', { mime_type: 'text/html' });
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('image/png');
+  });
+
+  it('ignores the migration-039 image/jpeg backfill on legacy PNG rows', async () => {
+    const id = await addPhoto('legacy.png', { mime_type: 'image/jpeg' });
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('image/png');
+  });
+
+  it('normalizes jpg to the canonical image/jpeg', async () => {
+    const id = await addPhoto('shot.jpg');
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('image/jpeg');
+  });
+
+  it('keeps the extension fallback for images without a stored mime_type', async () => {
+    const id = await addPhoto('shot.png');
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('image/png');
+  });
+
+  it('handles Object.prototype key extensions without a 500 (.constructor)', async () => {
+    // The extension-to-MIME lookup must be own-property only — a raw
+    // index access returns an inherited function for these keys and the
+    // downstream startsWith throws. Serve image/jpeg instead of 500.
+    const id = await addPhoto('payload.constructor');
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('image/jpeg');
+
+    const id2 = await addPhoto('payload.__proto__', { media_type: 'video' });
+    const res2 = await getPhotoRes(id2);
+    expect(res2.status).toBe(200);
+    expect(res2.headers['content-type']).toBe('video/mp4');
+  });
+
+  it('does not synthesize types from unmapped image extensions', async () => {
+    // Raw interpolation would produce image/svg+xml (scriptable inline)
+    // or arbitrary strings from client-controlled filenames — the shared
+    // map is the allowlist, everything else is served as image/jpeg.
+    const svg = await addPhoto('vector.svg+xml');
+    const res = await getPhotoRes(svg);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('image/jpeg');
+
+    const weird = await addPhoto('weird.xyz');
+    const res2 = await getPhotoRes(weird);
+    expect(res2.status).toBe(200);
+    expect(res2.headers['content-type']).toBe('image/jpeg');
+  });
+
+  it('extensionless files get image/jpeg, never a bare image/', async () => {
+    const id = await addPhoto('noext');
+    const res = await getPhotoRes(id);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toBe('image/jpeg');
+  });
+});

backend/__tests__/routes/adminShortUrlOwnership.test.js

@@ -0,0 +1,151 @@
+/**
+ * GHSA-9h7q-2jpf-vj85 — DELETE /api/admin/short-urls/:id only checked
+ * `events.edit` permission, with no ownership scoping. GET and POST for an
+ * event's short URLs both chain requireEventOwnership; DELETE takes the
+ * short URL row's own :id (not :eventId), so any admin holding events.edit
+ * could delete another admin's branded gallery short URL. The route now
+ * resolves the short URL's event first and applies the same ownership
+ * predicate requireEventOwnership uses. super_admin keeps global access.
+ */
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-suown-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'suown-test-secret';
+process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-suown-storage-'));
+
+const request = require('supertest');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const { bootCrmDb, assignAdminRole, mintAdminToken } = require('../integration/helpers/crmDb');
+
+describe('short URL delete ownership scoping', () => {
+  let db; let cleanup; let app; let service;
+  let superTok; let ownerTok; let foreignTok;
+  let ownerId;
+  let foreignShortUrlId;
+
+  const auth = (req, tok) => req.set('Authorization', `Bearer ${tok}`);
+
+  async function seedEvent(createdBy, slugSuffix) {
+    const farFuture = new Date(Date.now() + 365 * 86400000).toISOString();
+    const [id] = await db('events').insert({
+      slug: `suown-${slugSuffix}`,
+      event_type: 'wedding',
+      event_name: 'Test Event',
+      event_date: '2026-08-01',
+      host_email: 'h@e.com',
+      admin_email: 'a@e.com',
+      password_hash: 'x',
+      share_link: `suown-${slugSuffix}`,
+      share_token: `suown-share-${slugSuffix}`,
+      expires_at: farFuture,
+      is_active: true,
+      is_archived: false,
+      created_by: createdBy,
+      created_at: new Date().toISOString(),
+    });
+    return db('events').where({ id }).first();
+  }
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    service = require('../../src/services/galleryShortUrlService');
+
+    const superIns = await db('admin_users').insert({
+      username: 'suown-super', email: 'suown-super@example.com',
+      password_hash: 'x', must_change_password: false, created_at: new Date(),
+    }).returning('id');
+    const superId = superIns[0]?.id ?? superIns[0];
+    await assignAdminRole(db, superId, 'super_admin');
+    superTok = mintAdminToken(superId);
+
+    const ownerIns = await db('admin_users').insert({
+      username: 'suown-owner', email: 'suown-owner@example.com',
+      password_hash: 'x', must_change_password: false, created_at: new Date(),
+    }).returning('id');
+    ownerId = ownerIns[0]?.id ?? ownerIns[0];
+    await assignAdminRole(db, ownerId, 'editor');
+    ownerTok = mintAdminToken(ownerId);
+
+    const foreignIns = await db('admin_users').insert({
+      username: 'suown-foreign', email: 'suown-foreign@example.com',
+      password_hash: 'x', must_change_password: false, created_at: new Date(),
+    }).returning('id');
+    const foreignId = foreignIns[0]?.id ?? foreignIns[0];
+    await assignAdminRole(db, foreignId, 'editor');
+    foreignTok = mintAdminToken(foreignId);
+
+    // Event owned by `owner`, NOT `foreign`.
+    await seedEvent(ownerId, 'owned');
+
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/admin', require('../../src/routes/adminShortUrls'));
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  beforeEach(async () => {
+    // Fresh short URL per DELETE test so earlier deletes don't interfere.
+    const event = await db('events').where({ created_by: ownerId }).first();
+    const row = await service.createShortUrl({
+      eventId: event.id,
+      customSlug: `suown-target-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
+      createdBy: ownerId,
+    });
+    foreignShortUrlId = row.id;
+  });
+
+  it('an admin who does not own the event cannot delete its short URL (403, row survives)', async () => {
+    const res = await auth(
+      request(app).delete(`/api/admin/short-urls/${foreignShortUrlId}`),
+      foreignTok,
+    );
+    expect(res.status).toBe(403);
+    const row = await db('gallery_short_urls').where({ id: foreignShortUrlId }).first();
+    expect(row).toBeDefined();
+    expect(row.deleted_at).toBeFalsy();
+  });
+
+  it('the owning admin can delete its own short URL', async () => {
+    const res = await auth(
+      request(app).delete(`/api/admin/short-urls/${foreignShortUrlId}`),
+      ownerTok,
+    );
+    expect(res.status).toBe(204);
+    const row = await db('gallery_short_urls').where({ id: foreignShortUrlId }).first();
+    expect(row.deleted_at).toBeTruthy();
+  });
+
+  it('super_admin can delete any short URL', async () => {
+    const res = await auth(
+      request(app).delete(`/api/admin/short-urls/${foreignShortUrlId}`),
+      superTok,
+    );
+    expect(res.status).toBe(204);
+    const row = await db('gallery_short_urls').where({ id: foreignShortUrlId }).first();
+    expect(row.deleted_at).toBeTruthy();
+  });
+
+  it('deleting a nonexistent short URL id returns 404', async () => {
+    const res = await auth(
+      request(app).delete('/api/admin/short-urls/9999999'),
+      superTok,
+    );
+    expect(res.status).toBe(404);
+  });
+
+  it('deleting a nonexistent short URL id as a non-owner also returns 404 (existence check runs first)', async () => {
+    const res = await auth(
+      request(app).delete('/api/admin/short-urls/9999999'),
+      foreignTok,
+    );
+    expect(res.status).toBe(404);
+  });
+});

backend/__tests__/routes/adminThumbnails.previewColumns.test.js

@@ -0,0 +1,42 @@
+/**
+ * Source-inspection contract test for #1078.
+ *
+ * POST /api/admin/thumbnails/regenerate-previews hands its selected rows to
+ * ensurePreviewImage, which branches on `source_origin` (and then reads
+ * `external_relpath` / `filename`) to reach an external/reference photo on its
+ * media mount. When the select list omitted those columns, every external row
+ * looked managed, resolvePhotoStorageKey returned null, and the endpoint
+ * reported success while silently generating nothing for reference galleries.
+ */
+const fs = require('fs');
+const path = require('path');
+
+describe('regenerate-previews selects the columns ensurePreviewImage branches on (#1078)', () => {
+  const src = fs.readFileSync(
+    path.join(__dirname, '..', '..', 'src', 'routes', 'adminThumbnails.js'),
+    'utf8',
+  );
+
+  // The select feeding the regenerate-previews handler, from the route
+  // declaration to the end of that statement.
+  const selectStatement = (() => {
+    const routeIdx = src.indexOf('/regenerate-previews');
+    expect(routeIdx).toBeGreaterThan(-1);
+    const selectIdx = src.indexOf('.select(', routeIdx);
+    expect(selectIdx).toBeGreaterThan(-1);
+    return src.slice(selectIdx, src.indexOf(';', selectIdx));
+  })();
+
+  it.each(['source_origin', 'external_relpath', 'filename'])(
+    'selects %s',
+    (column) => {
+      expect(selectStatement).toContain(`'${column}'`);
+    }
+  );
+
+  it('still selects the columns the managed path needs', () => {
+    for (const column of ['id', 'event_id', 'path', 'media_type', 'mime_type', 'preview_path']) {
+      expect(selectStatement).toContain(`'${column}'`);
+    }
+  });
+});

backend/__tests__/routes/adminUsers.dateNormalize.test.js

@@ -0,0 +1,123 @@
+/**
+ * Pin the date-field normalisation in adminUsers transformer (#485).
+ *
+ * The Users page crashed on native/SQLite installs because Postgres
+ * returned ISO strings while SQLite returned epoch-millisecond
+ * integers, and the frontend `parseISO()` blew up on numbers with
+ * "e.split is not a function". The transformer now coerces every
+ * shape to an ISO 8601 string before serialising.
+ *
+ * These tests guard the contract so a future refactor can't quietly
+ * regress and re-break the same page on the same DB.
+ */
+
+const adminUsersRoute = require('../../src/routes/adminUsers');
+const { toIso, transformUser, transformInvitation } = adminUsersRoute.__test;
+
+describe('toIso', () => {
+  it('passes null and undefined through unchanged', () => {
+    expect(toIso(null)).toBeNull();
+    expect(toIso(undefined)).toBeUndefined();
+    // Empty string also short-circuits — important so an unset
+    // last_login renders as "Never" instead of 1970-01-01T00:00:00Z.
+    expect(toIso('')).toBe('');
+  });
+
+  it('coerces an integer epoch (SQLite shape) to an ISO 8601 string', () => {
+    // 2026-05-14T10:00:00.000Z, in epoch ms.
+    const epochMs = 1778752800000;
+    expect(toIso(epochMs)).toBe('2026-05-14T10:00:00.000Z');
+  });
+
+  it('coerces a stringified large integer to an ISO 8601 string', () => {
+    // Some SQLite drivers stringify large integers because they
+    // overflow JS safe-integer in the driver's serialiser. Re-coerce
+    // so the frontend doesn't try to parseISO('1778752800000').
+    expect(toIso('1778752800000')).toBe('2026-05-14T10:00:00.000Z');
+  });
+
+  it('coerces a Date instance via toISOString', () => {
+    const d = new Date('2026-01-01T12:34:56.000Z');
+    expect(toIso(d)).toBe('2026-01-01T12:34:56.000Z');
+  });
+
+  it('passes an existing ISO string through unchanged', () => {
+    const iso = '2026-05-14T10:00:00.000Z';
+    expect(toIso(iso)).toBe(iso);
+  });
+
+  it('passes a non-numeric short string (e.g. truncated date) through unchanged', () => {
+    // Defensive: anything that isn't a 10+ digit integer string is
+    // treated as already-stringified — the date library will surface
+    // the failure cleanly if it's malformed, rather than the
+    // transformer silently rewriting it.
+    expect(toIso('2026-05-14')).toBe('2026-05-14');
+  });
+});
+
+describe('transformUser', () => {
+  it('normalises last_login, created_at, updated_at coming from SQLite', () => {
+    const sqliteRow = {
+      id: 1,
+      username: 'admin',
+      email: 'admin@example.com',
+      is_active: 1,
+      last_login: 1778752800000,            // epoch ms
+      last_login_ip: '127.0.0.1',
+      created_at: 1778751144600,            // epoch ms
+      updated_at: 1778751242320,            // epoch ms
+      role_id: 1,
+      role_name: 'super_admin',
+      role_display_name: 'Super Admin',
+      created_by_username: null,
+    };
+
+    const out = transformUser(sqliteRow);
+
+    expect(out.lastLogin).toBe('2026-05-14T10:00:00.000Z');
+    expect(out.createdAt).toMatch(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/);
+    expect(out.updatedAt).toMatch(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/);
+    // Other fields untouched.
+    expect(out.username).toBe('admin');
+    expect(out.lastLoginIp).toBe('127.0.0.1');
+  });
+
+  it('leaves Postgres ISO strings intact', () => {
+    const pgRow = {
+      id: 2,
+      username: 'second',
+      email: 'second@example.com',
+      is_active: true,
+      last_login: '2026-05-14T10:00:00.000Z',
+      created_at: '2026-05-13T08:00:00.000Z',
+      updated_at: '2026-05-14T09:00:00.000Z',
+    };
+    const out = transformUser(pgRow);
+    expect(out.lastLogin).toBe('2026-05-14T10:00:00.000Z');
+    expect(out.createdAt).toBe('2026-05-13T08:00:00.000Z');
+    expect(out.updatedAt).toBe('2026-05-14T09:00:00.000Z');
+  });
+
+  it('keeps last_login null when the user has never logged in', () => {
+    const out = transformUser({
+      id: 3, username: 'fresh', email: 'fresh@example.com',
+      is_active: 1, last_login: null,
+    });
+    expect(out.lastLogin).toBeNull();
+  });
+});
+
+describe('transformInvitation', () => {
+  it('normalises expires_at and created_at from SQLite epoch-ms', () => {
+    const out = transformInvitation({
+      id: 9,
+      email: 'invitee@example.com',
+      expires_at: 1779357600000,
+      created_at: 1778752800000,
+      role_name: 'admin',
+      invited_by: 'admin',
+    });
+    expect(out.expiresAt).toMatch(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/);
+    expect(out.createdAt).toBe('2026-05-14T10:00:00.000Z');
+  });
+});

backend/__tests__/routes/authSession.symmetry.test.js

@@ -0,0 +1,445 @@
+/**
+ * Regression test for the /admin/login → /admin/dashboard → /admin/login
+ * redirect loop reported on v3.32.4-beta.0.
+ *
+ * Cause: GET /auth/session was less strict than the adminAuth middleware.
+ * The session endpoint accepted tokens that the protected endpoints
+ * subsequently rejected with 401, which the frontend's interceptor
+ * translated into a hard redirect to /admin/login. /auth/session then
+ * said "valid: true" again on the next page load and the cycle closed.
+ *
+ * /auth/session must reject the same admin tokens adminAuth would
+ * reject, specifically: deactivated admin user, deleted admin user,
+ * password changed since iat. Same for gallery: archived event.
+ */
+
+const express = require('express');
+const request = require('supertest');
+const jwt = require('jsonwebtoken');
+
+process.env.JWT_SECRET = 'session-symmetry-test-secret';
+
+const fakeDb = {
+  adminUsers: [],
+  events: [],
+  revokedTokens: [],
+};
+
+jest.mock('../../src/database/db', () => {
+  const formatBoolean = (v) => (v ? 1 : 0);
+  void formatBoolean;
+  function dbFn(table) {
+    if (table === 'admin_users') {
+      let rowFilter = () => true;
+      return {
+        where(criteria) {
+          rowFilter = (row) => {
+            return Object.entries(criteria).every(([k, v]) => {
+              if (k === 'is_active') return Boolean(row.is_active) === Boolean(v);
+              return row[k] === v;
+            });
+          };
+          return this;
+        },
+        select(...cols) {
+          this._cols = cols;
+          return this;
+        },
+        async first() {
+          const row = fakeDb.adminUsers.find(rowFilter);
+          if (!row) return undefined;
+          if (!this._cols) return row;
+          const out = {};
+          for (const c of this._cols) out[c] = row[c];
+          return out;
+        },
+      };
+    }
+    if (table === 'events') {
+      let rowFilter = () => true;
+      return {
+        where(criteria) {
+          rowFilter = (row) =>
+            Object.entries(criteria).every(([k, v]) => {
+              if (k === 'is_active') return Boolean(row.is_active) === Boolean(v);
+              if (k === 'is_archived') return Boolean(row.is_archived) === Boolean(v);
+              return row[k] === v;
+            });
+          return this;
+        },
+        async first() {
+          return fakeDb.events.find(rowFilter);
+        },
+      };
+    }
+    throw new Error(`Unexpected table: ${table}`);
+  }
+  return { db: dbFn, formatBoolean: () => 1 };
+});
+
+jest.mock('../../src/utils/dbCompat', () => ({
+  formatBoolean: (v) => (v ? 1 : 0),
+}));
+
+jest.mock('../../src/utils/tokenRevocation', () => ({
+  isTokenRevoked: jest.fn(async (decoded) => fakeDb.revokedTokens.includes(decoded.id)),
+  revokeToken: jest.fn(),
+}));
+
+jest.mock('../../src/utils/tokenUtils', () => ({
+  getAdminTokenFromRequest: (req) => {
+    const auth = req.headers.authorization;
+    if (auth && auth.startsWith('Bearer ')) return auth.slice(7);
+    return null;
+  },
+  getGalleryTokenFromRequest: () => null,
+  setAdminAuthCookie: jest.fn(),
+  setGalleryAuthCookies: jest.fn(),
+  clearAdminAuthCookie: jest.fn(),
+  clearGalleryAuthCookies: jest.fn(),
+  buildCookieOptionsWithExpiry: () => ({}),
+}));
+
+jest.mock('../../src/services/recaptcha', () => ({ verifyRecaptcha: () => Promise.resolve(true) }));
+// Mock sessionTimeout's isSessionExpired so each test controls the return.
+// Default: not expired (so existing tests keep passing without setup).
+jest.mock('../../src/middleware/sessionTimeout', () => ({
+  endSession: jest.fn(),
+  isSessionExpired: jest.fn(() => Promise.resolve(false)),
+}));
+jest.mock('../../src/utils/logger', () => ({
+  info: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  debug: jest.fn(),
+}));
+
+const authRouter = require('../../src/routes/auth');
+
+function makeApp() {
+  const app = express();
+  app.use(express.json());
+  app.use('/auth', authRouter);
+  return app;
+}
+
+function signAdminToken({ id = 1, username = 'admin', iat, exp }) {
+  const issuedAt = iat ?? Math.floor(Date.now() / 1000);
+  // Note: do NOT pass noTimestamp:true here — that strips iat from the
+  // payload entirely, defeating the password-change comparison. Provide
+  // iat (and exp) via the payload directly instead.
+  return jwt.sign(
+    { id, username, type: 'admin', iat: issuedAt, exp: exp ?? issuedAt + 3600 },
+    process.env.JWT_SECRET,
+    { issuer: 'picpeak-auth' }
+  );
+}
+
+function signGalleryToken({ eventId = 100, eventSlug = 'wedding', ...extra } = {}) {
+  return jwt.sign(
+    { eventId, eventSlug, type: 'gallery', ...extra },
+    process.env.JWT_SECRET,
+    { expiresIn: '1h', issuer: 'picpeak-auth' }
+  );
+}
+
+describe('GET /auth/session — symmetry with protected middleware', () => {
+  beforeEach(() => {
+    fakeDb.adminUsers = [];
+    fakeDb.events = [];
+    fakeDb.revokedTokens = [];
+  });
+
+  it('returns valid:true for an active admin token', async () => {
+    fakeDb.adminUsers.push({
+      id: 1,
+      username: 'admin',
+      email: 'a@b.com',
+      is_active: true,
+      password_changed_at: null,
+    });
+    const token = signAdminToken({ id: 1 });
+
+    const res = await request(makeApp())
+      .get('/auth/session')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(200);
+    expect(res.body.valid).toBe(true);
+    expect(res.body.type).toBe('admin');
+  });
+
+  it('returns valid:false when the admin user has been deactivated', async () => {
+    fakeDb.adminUsers.push({
+      id: 1,
+      username: 'admin',
+      email: 'a@b.com',
+      is_active: false,
+      password_changed_at: null,
+    });
+    const token = signAdminToken({ id: 1 });
+
+    const res = await request(makeApp())
+      .get('/auth/session')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(200);
+    expect(res.body.valid).toBe(false);
+  });
+
+  it('returns valid:false when the admin user no longer exists', async () => {
+    // adminUsers is empty
+    const token = signAdminToken({ id: 999 });
+
+    const res = await request(makeApp())
+      .get('/auth/session')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(200);
+    expect(res.body.valid).toBe(false);
+  });
+
+  it('returns valid:false when password was changed after the token was issued', async () => {
+    // iat must be in the past, exp must be in the future so jwt.verify
+    // doesn't reject the token before /auth/session even gets to look
+    // at password_changed_at.
+    const tokenIssuedAt = Math.floor(Date.now() / 1000) - 60; // 1 min ago
+    const tokenExp = tokenIssuedAt + 86400;
+    fakeDb.adminUsers.push({
+      id: 1,
+      username: 'admin',
+      email: 'a@b.com',
+      is_active: true,
+      password_changed_at: new Date((tokenIssuedAt + 30) * 1000), // 30s after iat
+    });
+    const token = signAdminToken({ id: 1, iat: tokenIssuedAt, exp: tokenExp });
+
+    const res = await request(makeApp())
+      .get('/auth/session')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(200);
+    expect(res.body.valid).toBe(false);
+  });
+
+  it('returns valid:true when password was changed BEFORE the token was issued', async () => {
+    const tokenIssuedAt = Math.floor(Date.now() / 1000) - 60;
+    const tokenExp = tokenIssuedAt + 86400;
+    fakeDb.adminUsers.push({
+      id: 1,
+      username: 'admin',
+      email: 'a@b.com',
+      is_active: true,
+      password_changed_at: new Date((tokenIssuedAt - 3600) * 1000), // 1h before iat
+    });
+    const token = signAdminToken({ id: 1, iat: tokenIssuedAt, exp: tokenExp });
+
+    const res = await request(makeApp())
+      .get('/auth/session')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(200);
+    expect(res.body.valid).toBe(true);
+  });
+
+  it('returns valid:false for a gallery token whose event is archived', async () => {
+    fakeDb.events.push({
+      id: 100,
+      slug: 'wedding',
+      is_active: true,
+      is_archived: true,
+      expires_at: null,
+    });
+    const token = signGalleryToken();
+
+    const res = await request(makeApp())
+      .get('/auth/session?slug=wedding')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(200);
+    expect(res.body.valid).toBe(false);
+  });
+
+  it('returns valid:false for a gallery token whose event is expired', async () => {
+    fakeDb.events.push({
+      id: 100,
+      slug: 'wedding',
+      is_active: true,
+      is_archived: false,
+      expires_at: new Date(Date.now() - 86400_000),
+    });
+    const token = signGalleryToken();
+
+    const res = await request(makeApp())
+      .get('/auth/session?slug=wedding')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(200);
+    expect(res.body.valid).toBe(false);
+  });
+
+  it('returns valid:true for an active gallery token', async () => {
+    fakeDb.events.push({
+      id: 100,
+      slug: 'wedding',
+      is_active: true,
+      is_archived: false,
+      expires_at: new Date(Date.now() + 86400_000),
+    });
+    const token = signGalleryToken();
+
+    const res = await request(makeApp())
+      .get('/auth/session?slug=wedding')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(200);
+    expect(res.body.valid).toBe(true);
+  });
+
+  /**
+   * What KIND of gallery session this is (#1149).
+   *
+   * The frontend used to keep this in sessionStorage, which is per-TAB while
+   * the cookie is per-browser: a gallery reopened in a second tab lost
+   * 'client' even though the backend still served it as one, and the UI hid
+   * the only control that clears the privileged cookie. Reported from the
+   * token so a restored session knows what it actually is.
+   */
+  describe('gallery session kind', () => {
+    beforeEach(() => {
+      fakeDb.events.push({
+        id: 100,
+        slug: 'wedding',
+        is_active: true,
+        is_archived: false,
+        expires_at: new Date(Date.now() + 86400_000),
+      });
+    });
+
+    it('reports a PIN-client session as client', async () => {
+      const res = await request(makeApp())
+        .get('/auth/session?slug=wedding')
+        .set('Authorization', `Bearer ${signGalleryToken({ accessLevel: 'client' })}`);
+      expect(res.body.valid).toBe(true);
+      expect(res.body.accessLevel).toBe('client');
+      expect(res.body.viaCustomer).toBe(false);
+    });
+
+    it('reports a customer-portal session, which looks like a guest', async () => {
+      const res = await request(makeApp())
+        .get('/auth/session?slug=wedding')
+        .set('Authorization', `Bearer ${signGalleryToken({ via: 'customer', customerId: 7 })}`);
+      expect(res.body.valid).toBe(true);
+      expect(res.body.accessLevel).toBe('guest');
+      expect(res.body.viaCustomer).toBe(true);
+    });
+
+    it('reports a plain guest as neither', async () => {
+      // The flags have to discriminate, or they would just hand every visitor
+      // a Logout button back.
+      const res = await request(makeApp())
+        .get('/auth/session?slug=wedding')
+        .set('Authorization', `Bearer ${signGalleryToken()}`);
+      expect(res.body.valid).toBe(true);
+      expect(res.body.accessLevel).toBe('guest');
+      expect(res.body.viaCustomer).toBe(false);
+    });
+  });
+
+  it('returns valid:false when the token is revoked', async () => {
+    fakeDb.adminUsers.push({
+      id: 1,
+      username: 'admin',
+      is_active: true,
+      password_changed_at: null,
+    });
+    fakeDb.revokedTokens.push(1);
+    const token = signAdminToken({ id: 1 });
+
+    const res = await request(makeApp())
+      .get('/auth/session')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(401);
+    expect(res.body.valid).toBe(false);
+  });
+
+  // Session-timeout symmetry — issue #350 recurrence on v3.39.1-beta.0.
+  // sessionTimeoutMiddleware (mounted on /api/admin) rejects idle/old-iat
+  // tokens with 401 SESSION_TIMEOUT, but /auth/session previously didn't.
+  // The new isSessionExpired helper closes that asymmetry.
+  describe('session-timeout symmetry', () => {
+    const { isSessionExpired } = require('../../src/middleware/sessionTimeout');
+
+    beforeEach(() => {
+      isSessionExpired.mockReset();
+      // Default to "active session" so the other admin checks above also
+      // pass when this branch runs.
+      isSessionExpired.mockResolvedValue(false);
+    });
+
+    it('returns valid:false when isSessionExpired reports the token has timed out', async () => {
+      fakeDb.adminUsers.push({
+        id: 1,
+        username: 'admin',
+        is_active: true,
+        password_changed_at: null,
+      });
+      isSessionExpired.mockResolvedValue(true);
+      const token = signAdminToken({ id: 1 });
+
+      const res = await request(makeApp())
+        .get('/auth/session')
+        .set('Authorization', `Bearer ${token}`);
+      expect(res.status).toBe(200);
+      expect(res.body.valid).toBe(false);
+      expect(res.body.error).toBe('Session expired');
+    });
+
+    it('returns valid:true for an active admin token (helper says not expired)', async () => {
+      fakeDb.adminUsers.push({
+        id: 1,
+        username: 'admin',
+        is_active: true,
+        password_changed_at: null,
+      });
+      isSessionExpired.mockResolvedValue(false);
+      const token = signAdminToken({ id: 1 });
+
+      const res = await request(makeApp())
+        .get('/auth/session')
+        .set('Authorization', `Bearer ${token}`);
+      expect(res.status).toBe(200);
+      expect(res.body.valid).toBe(true);
+      expect(isSessionExpired).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not call isSessionExpired for gallery tokens', async () => {
+      fakeDb.events.push({
+        id: 100,
+        slug: 'wedding',
+        is_active: true,
+        is_archived: false,
+        expires_at: new Date(Date.now() + 86400_000),
+      });
+      const token = signGalleryToken();
+
+      const res = await request(makeApp())
+        .get('/auth/session?slug=wedding')
+        .set('Authorization', `Bearer ${token}`);
+      expect(res.status).toBe(200);
+      expect(res.body.valid).toBe(true);
+      expect(isSessionExpired).not.toHaveBeenCalled();
+    });
+
+    it('falls through (treats as valid) if the helper itself throws', async () => {
+      // Defensive: the require() in auth.js is wrapped in try/catch so a
+      // missing/broken helper doesn't fail-closed during early bootstrap.
+      fakeDb.adminUsers.push({
+        id: 1,
+        username: 'admin',
+        is_active: true,
+        password_changed_at: null,
+      });
+      isSessionExpired.mockRejectedValue(new Error('boom'));
+      const token = signAdminToken({ id: 1 });
+
+      const res = await request(makeApp())
+        .get('/auth/session')
+        .set('Authorization', `Bearer ${token}`);
+      expect(res.status).toBe(200);
+      expect(res.body.valid).toBe(true);
+    });
+  });
+});

backend/__tests__/routes/authShareLoginPassword.test.js

@@ -0,0 +1,127 @@
+/**
+ * Regression test for GHSA-9hmx-68vc-qpqw — share-link login must not bypass
+ * the gallery password.
+ *
+ * POST /auth/gallery/share-login validates only the share token. For a
+ * password-protected gallery it previously minted a full `type:'gallery'`
+ * access token on the share token alone, letting anyone holding the share URL
+ * read the gallery without the password. The fix: when the gallery requires a
+ * password, return `{ requires_password: true }` with NO token and NO cookie.
+ */
+
+const express = require('express');
+const request = require('supertest');
+
+process.env.JWT_SECRET = 'share-login-test-secret';
+
+const events = [];
+
+jest.mock('../../src/database/db', () => {
+  function dbFn(table) {
+    if (table === 'events') {
+      let filter = () => true;
+      return {
+        where(criteria) {
+          filter = (row) => Object.entries(criteria).every(([k, v]) => {
+            if (k === 'is_active') return Boolean(row.is_active) === Boolean(v);
+            if (k === 'is_archived') return Boolean(row.is_archived) === Boolean(v);
+            return row[k] === v;
+          });
+          return this;
+        },
+        async first() { return events.find(filter); },
+      };
+    }
+    return { where() { return this; }, async first() { return undefined; } };
+  }
+  dbFn.raw = async () => {};
+  return { db: dbFn, logActivity: async () => {} };
+});
+
+// Share token is stored plainly on the fake event row.
+jest.mock('../../src/services/shareLinkService', () => ({
+  getEventShareToken: (event) => event.share_token,
+  resolveShareIdentifier: async () => ({ event: null }),
+}));
+
+const mockSetGalleryAuthCookies = jest.fn();
+jest.mock('../../src/utils/tokenUtils', () => ({
+  setGalleryAuthCookies: (...args) => mockSetGalleryAuthCookies(...args),
+  clearGalleryAuthCookies: jest.fn(),
+  getGalleryTokenFromRequest: jest.fn(),
+  setAdminAuthCookies: jest.fn(),
+}));
+
+jest.mock('../../src/utils/authSecurity', () => ({
+  trackFailedAttempt: jest.fn(async () => {}),
+  trackSuccessfulLogin: jest.fn(async () => {}),
+  checkAccountLockout: jest.fn(async () => ({ isLocked: false })),
+  resetLockout: jest.fn(async () => {}),
+}));
+
+// Collaborators the router imports at load but the share-login path doesn't hit.
+jest.mock('../../src/services/recaptcha', () => ({ verifyRecaptcha: async () => true }));
+jest.mock('../../src/services/mfaService', () => ({}));
+jest.mock('../../src/middleware/sessionTimeout', () => ({ endSession: jest.fn(), sessionTimeoutMiddleware: (req, res, next) => next() }));
+jest.mock('../../src/utils/tokenRevocation', () => ({ revokeToken: jest.fn(async () => {}), isTokenRevoked: async () => false }));
+
+const authRouter = require('../../src/routes/auth');
+
+function makeApp() {
+  const app = express();
+  app.use(express.json());
+  app.use('/auth', authRouter);
+  return app;
+}
+
+const SHARE_TOKEN = 'a'.repeat(64);
+
+beforeEach(() => {
+  events.length = 0;
+  mockSetGalleryAuthCookies.mockClear();
+});
+
+describe('POST /auth/gallery/share-login password enforcement', () => {
+  it('does NOT mint a token for a password-protected gallery', async () => {
+    events.push({
+      id: 1, slug: 'private-gallery', is_active: 1, is_archived: 0,
+      require_password: 1, share_token: SHARE_TOKEN, event_name: 'Private',
+    });
+    const res = await request(makeApp())
+      .post('/auth/gallery/share-login')
+      .send({ slug: 'private-gallery', token: SHARE_TOKEN });
+
+    expect(res.status).toBe(200);
+    expect(res.body.requires_password).toBe(true);
+    expect(res.body.token).toBeUndefined();
+    expect(mockSetGalleryAuthCookies).not.toHaveBeenCalled();
+  });
+
+  it('mints a token for a public (no-password) gallery', async () => {
+    events.push({
+      id: 2, slug: 'public-gallery', is_active: 1, is_archived: 0,
+      require_password: false, share_token: SHARE_TOKEN, event_name: 'Public',
+    });
+    const res = await request(makeApp())
+      .post('/auth/gallery/share-login')
+      .send({ slug: 'public-gallery', token: SHARE_TOKEN });
+
+    expect(res.status).toBe(200);
+    expect(typeof res.body.token).toBe('string');
+    expect(res.body.event).toBeDefined();
+    expect(mockSetGalleryAuthCookies).toHaveBeenCalledTimes(1);
+  });
+
+  it('rejects a wrong share token regardless of password setting', async () => {
+    events.push({
+      id: 3, slug: 'public-gallery', is_active: 1, is_archived: 0,
+      require_password: false, share_token: SHARE_TOKEN, event_name: 'Public',
+    });
+    const res = await request(makeApp())
+      .post('/auth/gallery/share-login')
+      .send({ slug: 'public-gallery', token: 'b'.repeat(64) });
+
+    expect(res.status).toBe(401);
+    expect(mockSetGalleryAuthCookies).not.toHaveBeenCalled();
+  });
+});

backend/__tests__/routes/authzPermissionGaps.test.js

@@ -0,0 +1,211 @@
+/**
+ * Authorization / ownership gaps (GHSA permission cluster):
+ *  - jm7j: API-token list must scope to the caller (non-super sees only own)
+ *  - gprq: API-token revoke must be owner-or-super_admin
+ *  - 3rqx: event update must not mass-assign identity/secret columns
+ *  - j2f4: category hero must belong to that category
+ */
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-authz-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'authz-test-secret';
+process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-authz-storage-'));
+
+const request = require('supertest');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const bcrypt = require('bcrypt');
+const {
+  bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken,
+} = require('../integration/helpers/crmDb');
+
+describe('authorization / ownership gaps', () => {
+  let db; let cleanup; let app;
+  let superId; let superTok; let adminId; let adminTok;
+
+  const grantPermissionToRole = async (roleName, permName) => {
+    const role = await db('roles').where({ name: roleName }).first();
+    const perm = await db('permissions').where({ name: permName }).first();
+    const exists = await db('role_permissions')
+      .where({ role_id: role.id, permission_id: perm.id }).first();
+    if (!exists) {
+      await db('role_permissions').insert({ role_id: role.id, permission_id: perm.id });
+    }
+  };
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    ({ adminId: superId } = await seedMinimal(db));
+    await assignAdminRole(db, superId, 'super_admin');
+    superTok = mintAdminToken(superId);
+
+    const pass = await bcrypt.hash('x', 4);
+    const ins = await db('admin_users').insert({
+      username: 'plain-admin', email: 'plain@example.com',
+      password_hash: pass, must_change_password: false, created_at: new Date(),
+    }).returning('id');
+    adminId = ins[0]?.id ?? ins[0];
+    await assignAdminRole(db, adminId, 'admin');
+    // Grant settings.edit to the admin role BEFORE any request populates the
+    // 60s permission cache, so the revoke test exercises the ownership check
+    // (404) rather than the missing-permission gate (403). This models a
+    // custom role that carries settings.edit — the scenario GHSA-gprq needs.
+    await grantPermissionToRole('admin', 'settings.edit');
+    adminTok = mintAdminToken(adminId);
+
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/admin/api-tokens', require('../../src/routes/adminApiTokens'));
+    app.use('/api/admin/events', require('../../src/routes/adminEvents'));
+    app.use('/api/admin/categories', require('../../src/routes/adminCategories'));
+    // eslint-disable-next-line no-unused-vars
+    app.use((err, req, res, next) => {
+      res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
+    });
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  const auth = (req, tok) => req.set('Authorization', `Bearer ${tok}`);
+
+  describe('API tokens (jm7j / gprq)', () => {
+    let superTokenId;
+
+    beforeAll(async () => {
+      const res = await auth(request(app).post('/api/admin/api-tokens'), superTok)
+        .send({ name: 'super-token', scopes: ['read'] });
+      expect(res.status).toBe(201);
+      superTokenId = res.body.id;
+    });
+
+    it('non-super admin does not see another admin\'s tokens in the list', async () => {
+      const res = await auth(request(app).get('/api/admin/api-tokens'), adminTok);
+      expect(res.status).toBe(200);
+      expect(res.body.find((t) => t.id === superTokenId)).toBeUndefined();
+    });
+
+    it('super_admin sees all tokens', async () => {
+      const res = await auth(request(app).get('/api/admin/api-tokens'), superTok);
+      expect(res.status).toBe(200);
+      expect(res.body.find((t) => t.id === superTokenId)).toBeDefined();
+    });
+
+    it('a non-owner (with settings.edit) cannot revoke another admin\'s token', async () => {
+      const res = await auth(request(app).delete(`/api/admin/api-tokens/${superTokenId}`), adminTok);
+      expect(res.status).toBe(404);
+      const row = await db('api_tokens').where({ id: superTokenId }).first();
+      expect(row.revoked_at).toBeFalsy();
+    });
+
+    it('the owner can revoke their own token', async () => {
+      const res = await auth(request(app).delete(`/api/admin/api-tokens/${superTokenId}`), superTok);
+      expect(res.status).toBe(200);
+    });
+  });
+
+  describe('event update mass-assignment (3rqx)', () => {
+    it('ignores identity/secret columns in the request body', async () => {
+      const seedShareToken = 'orig-share-token';
+      const ins = await db('events').insert({
+        slug: 'authz-mass-assign', event_type: 'wedding', event_name: 'Before',
+        event_date: '2026-08-01', host_email: 'h@example.com', admin_email: 'a@example.com',
+        password_hash: 'orig-hash', share_link: '/gallery/authz/share', share_token: seedShareToken, expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
+        is_active: 1, is_archived: 0, is_draft: 0, created_by: superId,
+        created_at: new Date().toISOString(),
+      }).returning('id');
+      const eventId = ins[0]?.id ?? ins[0];
+
+      const res = await auth(request(app).put(`/api/admin/events/${eventId}`), superTok).send({
+        event_name: 'After',
+        created_by: 99999,
+        slug: 'hijacked-slug',
+        share_token: 'hijacked-token',
+        password_hash: 'hijacked-hash',
+        is_archived: 1,
+        archive_path: '/hijacked/archive/path',
+        hero_logo_path: '/etc/passwd',
+        is_draft: 1,
+        project_id: 99999,
+        // Case-variant keys — SQLite matches columns case-insensitively.
+        Password_Hash: 'case-hijack-hash',
+        Created_By: 88888,
+      });
+      expect(res.status).toBe(200);
+
+      const row = await db('events').where({ id: eventId }).first();
+      expect(row.event_name).toBe('After');        // legit field applied
+      expect(row.created_by).toBe(superId);         // ownership untouched (+ case-variant)
+      expect(row.slug).toBe('authz-mass-assign');   // routing identity untouched
+      expect(row.share_token).toBe(seedShareToken); // secret untouched
+      expect(row.password_hash).toBe('orig-hash');  // secret untouched (+ case-variant)
+      expect(row.is_archived).toBeFalsy();          // archive lifecycle untouched
+      expect(row.archive_path).toBeFalsy();         // forged archive path rejected
+      expect(row.hero_logo_path).toBeFalsy();       // fs.unlink primitive blocked
+      expect(row.is_draft).toBeFalsy();             // publish workflow not bypassed
+      expect(row.project_id).toBeFalsy();           // server-managed relationship untouched
+    });
+
+    it('returns 200 (no-op) when the body contains only protected fields', async () => {
+      const ins = await db('events').insert({
+        slug: 'authz-empty-update', event_type: 'wedding', event_name: 'Keep',
+        event_date: '2026-08-01', host_email: 'h@example.com', admin_email: 'a@example.com',
+        password_hash: 'x', share_link: '/gallery/authz-empty/share', share_token: 'authz-empty-share',
+        expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
+        is_active: 1, is_archived: 0, is_draft: 0, created_by: superId,
+        created_at: new Date().toISOString(),
+      }).returning('id');
+      const id = ins[0]?.id ?? ins[0];
+      // Body reduces to {} after the denylist — must not 500 (Knex rejects
+      // .update({})).
+      const res = await auth(request(app).put(`/api/admin/events/${id}`), superTok)
+        .send({ created_by: 1, slug: 'x', is_archived: 1 });
+      expect(res.status).toBe(200);
+      const row = await db('events').where({ id }).first();
+      expect(row.event_name).toBe('Keep');
+    });
+  });
+
+  describe('category hero cross-category (j2f4)', () => {
+    it('rejects a hero photo that is not in the category', async () => {
+      const evIns = await db('events').insert({
+        slug: 'authz-cat', event_type: 'wedding', event_name: 'Cat Event',
+        event_date: '2026-08-01', host_email: 'h@example.com', admin_email: 'a@example.com',
+        password_hash: 'x', share_link: '/gallery/authz-cat/share', share_token: 'authz-cat-share', expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
+        is_active: 1, is_archived: 0, is_draft: 0, created_by: superId,
+        created_at: new Date().toISOString(),
+      }).returning('id');
+      const evId = evIns[0]?.id ?? evIns[0];
+
+      const mkCat = async (name) => {
+        const c = await db('photo_categories').insert({
+          event_id: evId, name, slug: name.toLowerCase(), created_at: new Date().toISOString(),
+        }).returning('id');
+        return c[0]?.id ?? c[0];
+      };
+      const cat1 = await mkCat('Cat1');
+      const cat2 = await mkCat('Cat2');
+
+      const pIns = await db('photos').insert({
+        event_id: evId, filename: 'p.jpg', path: 'authz-cat/p.jpg', type: 'individual',
+        category_id: cat1, uploaded_at: new Date().toISOString(),
+      }).returning('id');
+      const photoInCat1 = pIns[0]?.id ?? pIns[0];
+
+      // Pointing cat2's hero at a photo that lives in cat1 must be refused.
+      const bad = await auth(request(app).put(`/api/admin/categories/${cat2}/hero`), superTok)
+        .send({ hero_photo_id: photoInCat1 });
+      expect(bad.status).toBe(404);
+
+      // The photo's own category accepts it.
+      const ok = await auth(request(app).put(`/api/admin/categories/${cat1}/hero`), superTok)
+        .send({ hero_photo_id: photoInCat1 });
+      expect(ok.status).toBe(200);
+    });
+  });
+});

backend/__tests__/routes/backupExportSuperadmin.test.js

@@ -0,0 +1,95 @@
+/**
+ * Full-instance export is super_admin only (GHSA-pv6w-rj34-wj9v).
+ *
+ * GET /api/admin/backup/picpeak/export dumps every table unredacted (bcrypt
+ * hashes, 2FA, SMTP/SSO/WhatsApp/webhook/S3 secrets). It was gated only by
+ * requirePermission('backup.create'), which the built-in `admin` role holds —
+ * so any non-super_admin admin could download the whole database. Pins that
+ * `admin` now gets 403 and `super_admin` passes the gate.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-bkexport-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'bkexport-test-secret';
+
+// The export otherwise walks the whole DB and writes a zip — stub it so the
+// super_admin happy path is fast and deterministic; the gate is what's tested.
+// The route deletes path.dirname(filePath) recursively after download, so the
+// stub MUST live in its own dir — a bare os.tmpdir() file would make the route
+// wipe the whole temp root (and other jest workers' DB files).
+const mockExportDir = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-export-stub-'));
+const mockExportPath = path.join(mockExportDir, 'export.picpeak');
+fs.writeFileSync(mockExportPath, 'stub');
+jest.mock('../../src/services/picpeakExportService', () => ({
+  createPicpeak: jest.fn(async () => ({ filePath: mockExportPath })),
+}));
+
+const request = require('supertest');
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
+
+describe('backup export super_admin gate (GHSA-pv6w)', () => {
+  let db;
+  let cleanup;
+  let app;
+  let adminToken; let superToken;
+
+  const mkUser = async (username, roleName) => {
+    const role = await db('roles').where({ name: roleName }).first();
+    const r = await db('admin_users').insert({
+      username,
+      email: `${username}@example.com`,
+      password_hash: await bcrypt.hash('Passw0rd!', 4),
+      role_id: role.id,
+      is_active: 1,
+      created_at: new Date(),
+      updated_at: new Date(),
+    }).returning('id');
+    const id = r[0]?.id ?? r[0];
+    return jwt.sign(
+      { id, username, type: 'admin', role: roleName, loginTime: Date.now() },
+      process.env.JWT_SECRET,
+      { expiresIn: '1h', issuer: 'picpeak-auth' },
+    );
+  };
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+    adminToken = await mkUser('limited-admin', 'admin');
+    superToken = await mkUser('root-admin', 'super_admin');
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/backup', require('../../src/routes/adminBackup'));
+  }, 120000);
+
+  afterAll(async () => {
+    if (cleanup) await cleanup();
+    fs.rmSync(mockExportDir, { recursive: true, force: true });
+  });
+
+  it('denies the built-in admin role (was: full DB dump)', async () => {
+    const res = await request(app)
+      .get('/api/admin/backup/picpeak/export')
+      .set('Authorization', `Bearer ${adminToken}`);
+    expect(res.status).toBe(403);
+  });
+
+  it('allows super_admin', async () => {
+    const res = await request(app)
+      .get('/api/admin/backup/picpeak/export')
+      .set('Authorization', `Bearer ${superToken}`);
+    expect(res.status).not.toBe(403);
+    expect(res.status).toBeLessThan(500);
+  });
+});

backend/__tests__/routes/dashboardScope.test.js

@@ -0,0 +1,233 @@
+/**
+ * Dashboard endpoints must not leak other admins' data to event-scoped
+ * editors — GHSA-c2jj (/stats), GHSA-gqx7 (/analytics), GHSA-jhcf (/activity).
+ *
+ * All three are gated only by `analytics.view`, which the `editor` role holds.
+ * But the events LIST restricts editors to their own rows
+ * (adminEvents/crud.js: roleName === 'editor' → created_by = admin.id), so an
+ * editor saw instance-wide totals — and, via /analytics topGalleries, other
+ * admins' gallery names and SLUGS (the public gallery URL component) — for
+ * events invisible to them everywhere else.
+ *
+ * Scoping deliberately keys on `editor` to mirror the events list exactly, so
+ * the `admin` role's dashboard is unchanged.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-dashscope-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'dashscope-test-secret';
+
+const request = require('supertest');
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
+
+describe('dashboard scoping (GHSA-c2jj / gqx7 / jhcf)', () => {
+  let db; let cleanup; let app;
+  let editorToken; let superToken;
+  let ownEventId; let foreignEventId;
+
+  const mkAdmin = async (username, roleName) => {
+    const role = await db('roles').where({ name: roleName }).first();
+    const r = await db('admin_users').insert({
+      username,
+      email: `${username}@example.com`,
+      password_hash: await bcrypt.hash('Passw0rd!', 4),
+      role_id: role.id,
+      is_active: 1,
+      created_at: new Date(),
+      updated_at: new Date(),
+    }).returning('id');
+    const id = r[0]?.id ?? r[0];
+    const token = jwt.sign(
+      { id, username, type: 'admin', role: roleName, loginTime: Date.now() },
+      process.env.JWT_SECRET,
+      { expiresIn: '1h', issuer: 'picpeak-auth' },
+    );
+    return { id, token };
+  };
+
+  const mkEvent = async (slug, createdBy) => {
+    const r = await db('events').insert({
+      slug,
+      event_type: 'wedding',
+      event_name: `${slug}-name`,
+      event_date: '2026-08-01',
+      host_email: 'h@example.com',
+      admin_email: 'a@example.com',
+      password_hash: 'x',
+      share_token: `tok-${slug}`,
+      share_link: `/gallery/${slug}/tok-${slug}`,
+      created_by: createdBy,
+      expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
+      is_active: 1, is_archived: 0, is_draft: 0,
+      created_at: new Date().toISOString(),
+    }).returning('id');
+    return r[0]?.id ?? r[0];
+  };
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+
+    const editor = await mkAdmin('scoped-editor', 'editor');
+    const sup = await mkAdmin('root-admin', 'super_admin');
+    editorToken = editor.token;
+    superToken = sup.token;
+
+    ownEventId = await mkEvent('own-gallery', editor.id);
+    foreignEventId = await mkEvent('foreign-gallery', sup.id);
+
+    // One photo + one view per event so the aggregates are non-zero.
+    for (const [eventId, name] of [[ownEventId, 'own'], [foreignEventId, 'foreign']]) {
+      await db('photos').insert({
+        event_id: eventId,
+        filename: `${name}.jpg`,
+        path: `events/active/${name}.jpg`,
+        type: 'individual',
+        size_bytes: 1000,
+        uploaded_at: new Date().toISOString(),
+      });
+      await db('access_logs').insert({
+        event_id: eventId,
+        action: 'view',
+        ip_address: `10.0.0.${eventId}`,
+        user_agent: 'Mozilla/5.0',
+        timestamp: new Date().toISOString(),
+      });
+      await db('activity_logs').insert({
+        activity_type: 'photo_viewed',
+        actor_type: 'admin',
+        actor_name: `${name}-actor`,
+        event_id: eventId,
+        created_at: new Date().toISOString(),
+      });
+    }
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/dashboard', require('../../src/routes/adminDashboard'));
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  it('/stats counts only the editor\'s own events and photos', async () => {
+    const res = await request(app)
+      .get('/api/admin/dashboard/stats')
+      .set('Authorization', `Bearer ${editorToken}`);
+
+    expect(res.status).toBe(200);
+    expect(Number(res.body.totalEvents)).toBe(1);
+    expect(Number(res.body.totalPhotos)).toBe(1);
+    // The catalogued original bytes — this is what carries the per-event
+    // scoping, and what `storageUsed` reported before #1164.
+    expect(Number(res.body.catalogedBytes)).toBe(1000);
+  });
+
+  it('/stats reports disk usage unscoped, because disk is not per-event', async () => {
+    // storageUsed is a measurement of the storage root (#1164), so it is the
+    // same number for every admin by design. Pinned so a future reviewer
+    // reading "everything on this endpoint is scoped" does not turn it into a
+    // sum of this editor's photos again — which is the bug that was fixed.
+    const res = await request(app)
+      .get('/api/admin/dashboard/stats')
+      .set('Authorization', `Bearer ${editorToken}`);
+
+    expect(res.status).toBe(200);
+    expect(res.body.storageUsed).not.toBe(1000);
+    expect(res.body).toHaveProperty('storageBreakdown');
+  });
+
+  it('/stats reports the catalogued figure on an S3 backend, not a near-zero disk walk', async () => {
+    // STORAGE_PATH holds only incidental local files when objects live in a
+    // bucket, so walking it would report near-zero and drag the soft-limit
+    // recommendation with it.
+    const prev = process.env.STORAGE_BACKEND;
+    process.env.STORAGE_BACKEND = 's3';
+    try {
+      const res = await request(app)
+        .get('/api/admin/dashboard/stats')
+        .set('Authorization', `Bearer ${editorToken}`);
+
+      expect(res.status).toBe(200);
+      expect(res.body.storageUsed).toBeNull();
+      expect(res.body.storageMeasurement).toBe('catalog');
+      expect(Number(res.body.catalogedBytes)).toBe(1000);
+    } finally {
+      if (prev === undefined) delete process.env.STORAGE_BACKEND;
+      else process.env.STORAGE_BACKEND = prev;
+    }
+  });
+
+  it('/analytics does not expose a foreign gallery name or slug', async () => {
+    const res = await request(app)
+      .get('/api/admin/dashboard/analytics?days=7')
+      .set('Authorization', `Bearer ${editorToken}`);
+
+    expect(res.status).toBe(200);
+    const body = JSON.stringify(res.body);
+    expect(body).not.toContain('foreign-gallery');
+    expect(body).not.toContain('foreign-gallery-name');
+    expect(res.body.topGalleries.map((g) => g.slug)).toEqual(['own-gallery']);
+  });
+
+  it('/activity does not surface a foreign event\'s entries', async () => {
+    const res = await request(app)
+      .get('/api/admin/dashboard/activity')
+      .set('Authorization', `Bearer ${editorToken}`);
+
+    expect(res.status).toBe(200);
+    const actors = res.body.map((a) => a.actorName);
+    expect(actors).toContain('own-actor');
+    expect(actors).not.toContain('foreign-actor');
+  });
+
+  it('leaves super_admin unscoped across all three', async () => {
+    const stats = await request(app)
+      .get('/api/admin/dashboard/stats')
+      .set('Authorization', `Bearer ${superToken}`);
+    expect(Number(stats.body.totalEvents)).toBe(2);
+
+    const analytics = await request(app)
+      .get('/api/admin/dashboard/analytics?days=7')
+      .set('Authorization', `Bearer ${superToken}`);
+    expect(analytics.body.topGalleries.map((g) => g.slug).sort())
+      .toEqual(['foreign-gallery', 'own-gallery']);
+
+    const activity = await request(app)
+      .get('/api/admin/dashboard/activity')
+      .set('Authorization', `Bearer ${superToken}`);
+    expect(activity.body.map((a) => a.actorName)).toContain('foreign-actor');
+  });
+});
+
+/**
+ * Codex round 2: the /activity filter trusts `activity_logs.event_id`, but
+ * expenseService was passing `adminId` into logActivity's third positional
+ * parameter — which is `eventId`. Admin and event id sequences overlap, so a
+ * foreign admin's expense metadata could surface under an editor's event.
+ * Those writers now pass the actor instead, leaving event_id NULL.
+ */
+describe('activity writers do not put admin ids in event_id (GHSA-jhcf)', () => {
+  it('expenseService passes the actor, not adminId, as the event id', () => {
+    const fs2 = require('fs');
+    const src = fs2.readFileSync(
+      require('path').join(__dirname, '../../src/services/expenseService.js'), 'utf8',
+    );
+    // No logActivity call may end with a bare `, adminId)` — that slot is eventId.
+    const offenders = src.split('\n').filter(
+      (l) => l.includes('logActivity(') && /,\s*adminId\s*\)/.test(l),
+    );
+    expect(offenders).toEqual([]);
+    // And the actor form must actually be in use.
+    expect(src).toContain("{ type: 'admin', id: adminId }");
+  });
+});

backend/__tests__/routes/databaseBackupConfigDestination.test.js

@@ -0,0 +1,122 @@
+/**
+ * PUT /api/admin/database-backup/config must reject a
+ * database_backup_destination_path that resolves inside a publicly served
+ * directory (GHSA-jw8m-43r2-jqrm class, #1365).
+ *
+ * Before #1365, database_backup_destination_path was silently ignored by
+ * databaseBackupService.backup() (a destructuring bug always fell back to
+ * the hardcoded /backup/database), so this setting being freely writable by
+ * any backup.create holder — the built-in `admin` role has it without
+ * settings.edit or backup.restore — was harmless. Making the setting
+ * actually take effect reopens the exact exfiltration path GHSA-jw8m fixed
+ * for the per-request override, through the persisted setting instead.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-dbbackup-config-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'dbbackup-config-test-secret';
+process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-dbbackup-storage-'));
+
+const request = require('supertest');
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
+
+describe('database backup destination-path config guard (GHSA-jw8m class, #1365)', () => {
+  let db; let cleanup; let app; let adminToken;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+
+    const role = await db('roles').where({ name: 'admin' }).first();
+    const r = await db('admin_users').insert({
+      username: 'limited-admin',
+      email: 'limited-admin-config@example.com',
+      password_hash: await bcrypt.hash('Passw0rd!', 4),
+      role_id: role.id,
+      is_active: 1,
+      created_at: new Date(),
+      updated_at: new Date(),
+    }).returning('id');
+    const id = r[0]?.id ?? r[0];
+    adminToken = jwt.sign(
+      { id, username: 'limited-admin', type: 'admin', role: 'admin', loginTime: Date.now() },
+      process.env.JWT_SECRET,
+      { expiresIn: '1h', issuer: 'picpeak-auth' },
+    );
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/database-backup', require('../../src/routes/adminDatabaseBackup'));
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  it('rejects a destination inside the public uploads/logos mount', async () => {
+    const res = await request(app)
+      .put('/api/admin/database-backup/config')
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ database_backup_destination_path: path.join(process.env.STORAGE_PATH, 'uploads', 'logos') });
+
+    expect(res.status).toBe(400);
+
+    // The seeded default must survive untouched — the rejected value never lands.
+    const row = await db('app_settings').where({ setting_key: 'database_backup_destination_path' }).first();
+    expect(JSON.parse(row.setting_value)).toBe('/backup/database');
+  });
+
+  it('rejects a destination inside the public fonts mount', async () => {
+    const res = await request(app)
+      .put('/api/admin/database-backup/config')
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ database_backup_destination_path: path.join(process.env.STORAGE_PATH, 'fonts') });
+
+    expect(res.status).toBe(400);
+  });
+
+  it('accepts a destination outside any public mount', async () => {
+    const safePath = path.join(process.env.STORAGE_PATH, 'db-backups');
+    const res = await request(app)
+      .put('/api/admin/database-backup/config')
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ database_backup_destination_path: safePath });
+
+    expect(res.status).toBe(200);
+
+    const row = await db('app_settings').where({ setting_key: 'database_backup_destination_path' }).first();
+    expect(JSON.parse(row.setting_value)).toBe(safePath);
+  });
+
+  // A retention of 0 or less pushes cleanupOldBackups' cutoff to today or
+  // the future, deleting every completed backup on the next scheduled run
+  // — a backup.create holder achieving what backup.delete gates on /cleanup.
+  it.each([-1, 0])('rejects database_backup_retention_days=%s', async (bad) => {
+    const res = await request(app)
+      .put('/api/admin/database-backup/config')
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ database_backup_retention_days: bad });
+
+    expect(res.status).toBe(400);
+  });
+
+  it('accepts a positive database_backup_retention_days', async () => {
+    const res = await request(app)
+      .put('/api/admin/database-backup/config')
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ database_backup_retention_days: 90 });
+
+    expect(res.status).toBe(200);
+
+    const row = await db('app_settings').where({ setting_key: 'database_backup_retention_days' }).first();
+    expect(JSON.parse(row.setting_value)).toBe(90);
+  });
+});

backend/__tests__/routes/databaseBackupDestination.test.js

@@ -0,0 +1,120 @@
+/**
+ * Manual database backup must not honour a caller-supplied destination
+ * (GHSA-jw8m-43r2-jqrm).
+ *
+ * POST /api/admin/database-backup/backup forwarded req.body straight into
+ * databaseBackupService.backup(), which merges options over its config:
+ *   const { destinationPath = '/backup/database', ... } = { ...config, ...options }
+ * `destinationPath` is not a persistable setting (the /config allowlist only
+ * accepts `database_backup_*` keys), so the request body was its ONLY source.
+ *
+ * The `admin` role holds backup.create but neither settings.edit nor
+ * backup.restore — so it could aim a full DB dump (bcrypt hashes, gallery
+ * password hashes, encrypted SMTP creds) at the PUBLIC /uploads static mount
+ * (server.js mounts it with no auth middleware) and fetch it unauthenticated.
+ *
+ * Pins that destinationPath from the body is ignored, while the legitimate
+ * knobs still pass through.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-dbbackup-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'dbbackup-test-secret';
+
+// Capture what the route hands the service; never run a real backup.
+const mockBackup = jest.fn(async () => ({ success: true }));
+jest.mock('../../src/services/databaseBackup', () => ({
+  databaseBackupService: {
+    get isRunning() { return false; },
+    backup: (...args) => mockBackup(...args),
+  },
+}));
+
+const request = require('supertest');
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
+
+describe('manual database backup destination (GHSA-jw8m)', () => {
+  let db; let cleanup; let app; let adminToken;
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+
+    const role = await db('roles').where({ name: 'admin' }).first();
+    const r = await db('admin_users').insert({
+      username: 'limited-admin',
+      email: 'limited-admin@example.com',
+      password_hash: await bcrypt.hash('Passw0rd!', 4),
+      role_id: role.id,
+      is_active: 1,
+      created_at: new Date(),
+      updated_at: new Date(),
+    }).returning('id');
+    const id = r[0]?.id ?? r[0];
+    adminToken = jwt.sign(
+      { id, username: 'limited-admin', type: 'admin', role: 'admin', loginTime: Date.now() },
+      process.env.JWT_SECRET,
+      { expiresIn: '1h', issuer: 'picpeak-auth' },
+    );
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/database-backup', require('../../src/routes/adminDatabaseBackup'));
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  beforeEach(() => mockBackup.mockClear());
+
+  it('ignores a caller-supplied destinationPath', async () => {
+    const res = await request(app)
+      .post('/api/admin/database-backup/backup')
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ destinationPath: '/app/storage/uploads' });
+
+    expect(res.status).toBe(200);
+    // Give the fire-and-forget call a tick to land.
+    await new Promise((resolve) => setImmediate(resolve));
+    expect(mockBackup).toHaveBeenCalled();
+    const opts = mockBackup.mock.calls[0][0];
+    expect(opts).not.toHaveProperty('destinationPath');
+    expect(JSON.stringify(opts)).not.toContain('uploads');
+  });
+
+  it('still forwards the legitimate backup knobs', async () => {
+    const res = await request(app)
+      .post('/api/admin/database-backup/backup')
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ compress: false, validateIntegrity: false, destinationPath: '/tmp/evil' });
+
+    expect(res.status).toBe(200);
+    await new Promise((resolve) => setImmediate(resolve));
+    const opts = mockBackup.mock.calls[0][0];
+    expect(opts.compress).toBe(false);
+    expect(opts.validateIntegrity).toBe(false);
+    expect(opts).not.toHaveProperty('destinationPath');
+  });
+
+  it('omits absent knobs entirely so service/config defaults still apply', async () => {
+    const res = await request(app)
+      .post('/api/admin/database-backup/backup')
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({});
+
+    expect(res.status).toBe(200);
+    await new Promise((resolve) => setImmediate(resolve));
+    // An explicit `{compress: undefined}` would override config on spread —
+    // absent keys must simply not be present.
+    expect(mockBackup.mock.calls[0][0]).toEqual({});
+  });
+});