Resolve PUT-2059

2026-11-13 20:12:57 -10:00 · 2026-10-16 01:40:59 -04:00
1578 changed files with 58742 additions and 231121 deletions
@@ -1,106 +0,0 @@
-# This file is machine-generated by `gh actions-lock`.
-# Do not edit by hand; run `gh actions-lock` to update.
-# Docs: https://gh.io/actions-lockfile
-version: 'v0.0.3'
-workflows:
-    '.github/workflows/ai-provider-integration-tests.yaml':
-        - 'actions/[email protected]'
-        - 'actions/[email protected]'
-    '.github/workflows/backend-tests.yaml':
-        - 'actions/[email protected]'
-        - 'actions/[email protected]'
-        - 'actions/[email protected]'
-        - 'actions/[email protected]'
-        - 'davelosert/[email protected]'
-        - 'dorny/[email protected]'
-    '.github/workflows/dependabot-automerge.yml':
-        - 'dependabot/[email protected]'
-    '.github/workflows/docker-image.yaml':
-        - 'actions/[email protected]'
-        - 'docker/[email protected]'
-        - 'docker/[email protected]'
-        - 'docker/[email protected]'
-        - 'docker/[email protected]'
-        - 'docker/[email protected]'
-        - 'peter-evans/[email protected]'
-    '.github/workflows/docs-build.yml':
-        - 'actions/[email protected]'
-        - 'actions/[email protected]'
-    '.github/workflows/notify-dev.yaml': []
-    '.github/workflows/notify-prod.yaml': []
-    '.github/workflows/puterjs-tests.yaml':
-        - 'actions/[email protected]'
-        - 'actions/[email protected]'
-        - 'actions/[email protected]'
-        - 'actions/[email protected]'
-        - 'davelosert/[email protected]'
-        - 'dorny/[email protected]'
-    '.github/workflows/tag-alias.yaml':
-        - 'docker/[email protected]'
-        - 'docker/[email protected]'
-dependencies:
-    'actions/[email protected]':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'actions/[email protected]':
-        ref: 'v8.0.2'
-        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
-        owner_id: 44036562
-        repo_id: 192626254
-    'actions/[email protected]':
-        ref: 'v7.1.0'
-        commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1'
-        owner_id: 44036562
-        repo_id: 189476904
-    'actions/[email protected]':
-        ref: 'v7.0.2'
-        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
-        owner_id: 44036562
-        repo_id: 192625955
-    'davelosert/[email protected]':
-        ref: 'v2.13.2'
-        commit: 'sha1-74c2d9210b4fc44c84d8213f61d7ec99837b7aa0'
-        owner_id: 4287128
-        repo_id: 501176456
-    'dependabot/[email protected]':
-        ref: 'v3.1.0'
-        commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98'
-        owner_id: 27347476
-        repo_id: 371068214
-    'docker/[email protected]':
-        ref: 'v7.4.0'
-        commit: 'sha1-c3c9e263c25d99ce0380d002d59b67737d91b0dc'
-        owner_id: 5429470
-        repo_id: 241092383
-    'docker/[email protected]':
-        ref: 'v4.8.0'
-        commit: 'sha1-8aa5831fb8d48d8f76594c7ddde61ae58019f550'
-        owner_id: 5429470
-        repo_id: 287743349
-    'docker/[email protected]':
-        ref: 'v6.2.0'
-        commit: 'sha1-dc802804100637a589fabce1cb79ff13a1411302'
-        owner_id: 5429470
-        repo_id: 306769011
-    'docker/[email protected]':
-        ref: 'v4.4.1'
-        commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069'
-        owner_id: 5429470
-        repo_id: 288485773
-    'docker/[email protected]':
-        ref: 'v4.4.0'
-        commit: 'sha1-99012661954931238ded8c8b007157a8430204e1'
-        owner_id: 5429470
-        repo_id: 288487894
-    'dorny/[email protected]':
-        ref: 'v4.0.3'
-        commit: 'sha1-ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d'
-        owner_id: 1588572
-        repo_id: 265601040
-    'peter-evans/[email protected]':
-        ref: 'v5.0.0'
-        commit: 'sha1-1b9a80c056b620d92cedb9d9b5a223409c68ddfa'
-        owner_id: 18365890
-        repo_id: 193685475
@@ -17,14 +17,12 @@ jobs:

        steps:
            - name: Checkout repository
-              uses: actions/checkout@v7.0.1
-              with:
-                  persist-credentials: false
+              uses: actions/checkout@v7

            - name: Set up Node.js
-              uses: actions/setup-node@v7.1.0
+              uses: actions/setup-node@v7
              with:
-                  node-version: '26'
+                  node-version: '24'
                  cache: 'npm'

            - name: Install dependencies
@@ -49,13 +47,3 @@ jobs:
                  PUTER_TEST_AI_MOONSHOT_API_KEY: ${{ secrets.PUTER_TEST_AI_MOONSHOT_API_KEY }}
                  PUTER_TEST_AI_ZAI_API_KEY: ${{ secrets.PUTER_TEST_AI_ZAI_API_KEY }}
                  PUTER_TEST_AI_ELEVENLABS_API_KEY: ${{ secrets.PUTER_TEST_AI_ELEVENLABS_API_KEY }}
-
-            # Realtime conversations through the SDK against live OpenAI. Builds
-            # the SDK bundle these tests load itself, so it runs even when the
-            # step above fails; the tests skip themselves without the key.
-            - name: Run live realtime conversation tests
-              if: ${{ !cancelled() }}
-              run: npm run setupExtensions && (cd src/puter-js && npm run build) && npx vitest run --config src/puter-js/tests/api/vitest.config.ts src/puter-js/tests/api/realtime/realtimeLive.test.ts
-              env:
-                  CI: 'true'
-                  PUTER_TEST_AI_OPENAI_API_KEY: ${{ secrets.PUTER_TEST_AI_OPENAI_API_KEY }}
@@ -23,10 +23,8 @@ jobs:
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
    steps:
-      - uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-      - uses: dorny/[email protected]
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
@@ -54,14 +52,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v7

      - name: Set up Node.js
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7
        with:
-          node-version: '26'
+          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
@@ -84,16 +80,15 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@v7
        with:
-          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}

      - name: Set up Node.js
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7
        with:
-          node-version: '26'
+          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
@@ -111,7 +106,7 @@ jobs:

      - name: Upload blob report
        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7
        with:
          name: backend-blob-${{ matrix.shard }}
          path: .vitest-reports/
@@ -151,23 +146,22 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@v7
        with:
-          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}

      - name: Set up Node.js
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7
        with:
-          node-version: '26'
+          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Download blob reports
-        uses: actions/download-artifact@v8.0.2
+        uses: actions/download-artifact@v8
        with:
          pattern: backend-blob-*
          path: .vitest-reports
@@ -179,7 +173,7 @@ jobs:
          CI: 'true'

      - name: Upload coverage artifact
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7
        with:
          name: backend-coverage-${{ github.event_name == 'push' && 'main' || 'pr' }}
          path: src/backend/coverage/
@@ -210,7 +204,7 @@ jobs:

      - name: Report coverage on PR
        if: github.event_name == 'pull_request'
-        uses: davelosert/vitest-coverage-report-action@v2.13.2
+        uses: davelosert/vitest-coverage-report-action@v2
        with:
          json-summary-path: src/backend/coverage/coverage-summary.json
          json-final-path: src/backend/coverage/coverage-final.json
@@ -13,7 +13,7 @@ jobs:
    steps:
      - name: Dependabot metadata
        id: metadata
-        uses: dependabot/fetch-metadata@v3.1.0
+        uses: dependabot/fetch-metadata@v3
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"

@@ -45,32 +45,30 @@ jobs:
                  fi

            - name: Checkout repository
-              uses: actions/checkout@v7.0.1
-              with:
-                  persist-credentials: false
+              uses: actions/checkout@v7

            - name: Log in to GitHub Package Container registry
-              uses: docker/login-action@v4.8.0
+              uses: docker/login-action@v4
              with:
                  registry: ${{ env.REGISTRY }}
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Log in to Docker Hub
-              uses: docker/login-action@v4.8.0
+              uses: docker/login-action@v4
              with:
                  username: ${{ secrets.DOCKERHUB_USERNAME }}
                  password: ${{ secrets.DOCKERHUB_TOKEN }}

            - name: Set up QEMU
-              uses: docker/setup-qemu-action@v4.4.0
+              uses: docker/setup-qemu-action@v4

            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v4.4.1
+              uses: docker/setup-buildx-action@v4

            - name: Extract metadata (tags, labels) for Docker
              id: meta
-              uses: docker/metadata-action@v6.2.0
+              uses: docker/metadata-action@v6
              with:
                  images: |
                      ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -84,7 +82,7 @@ jobs:
                      type=raw,value=main,enable=${{ github.event_name == 'push' || inputs.push_main }}

            - name: Build and push Docker image
-              uses: docker/build-push-action@v7.4.0
+              uses: docker/build-push-action@v7
              with:
                  platforms: linux/amd64,linux/arm64
                  context: .
@@ -97,7 +95,7 @@ jobs:
                  cache-to: type=gha,mode=max

            - name: Sync README to Docker Hub
-              uses: peter-evans/dockerhub-description@v5.0.0
+              uses: peter-evans/dockerhub-description@v5
              with:
                  username: ${{ secrets.DOCKERHUB_USERNAME }}
                  password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -5,23 +5,18 @@ on:
    paths:
      - 'src/docs/**'

-permissions:
-  contents: read
-
 jobs:
  build-docs:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v7

      - name: Set up Node.js
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7
        with:
-          node-version: '26'
+          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
@@ -0,0 +1,40 @@
+name: Maintain Release Merge PR
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  update-release-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Setup Git
+        run: |
+          git config user.name github-actions
+          git config user.email [email protected]
+      - name: Check for existing PR
+        id: find-pr
+        uses: juliangruber/find-pull-request-action@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          branch: release
+      - uses: actions/checkout@v7
+        if: steps.find-pr.outputs.number == ''
+        with:
+          ref: release
+      - name: Reset release branch
+        if: steps.find-pr.outputs.number == ''
+        run: |
+          git fetch origin main:main
+          git reset --hard main
+      - name: Create/Update PR
+        if: steps.find-pr.outputs.number == ''
+        uses: peter-evans/create-pull-request@v8
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: Update release branch
+          title: Merge Release Auto-PR
+          body: Merging this PR will invoke release actions          
+          branch: auto-update/release
@@ -1,48 +0,0 @@
-name: Notify HeyPuter (dev)
-
-on:
-  workflow_dispatch:
-    inputs:
-      puter_ref:
-        description: "puter branch, tag or SHA"
-        type: string
-        default: "main"
-
-permissions:
-  contents: read
-
-jobs:
-  authorize:
-    if: github.repository == 'HeyPuter/puter'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Require maintain or admin
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ACTOR: ${{ github.triggering_actor }}
-        run: |
-          ROLE=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" --jq .role_name)
-          if [ "$ROLE" != "maintain" ] && [ "$ROLE" != "admin" ]; then
-            echo "::error::$ACTOR has role '$ROLE'; maintain or admin required"
-            exit 1
-          fi
-
-  notify:
-    needs: authorize
-    runs-on: ubuntu-latest
-    # Holds HEYPUTER_DISPATCH_TOKEN; limited to main so branch copies of this file can't read it.
-    environment: heyputer-dispatch
-    steps:
-      - name: Trigger heyputer dev deploy
-        env:
-          PUTER_REF: ${{ inputs.puter_ref }}
-          TOKEN: ${{ secrets.HEYPUTER_DISPATCH_TOKEN }}
-        run: |
-          jq -nc --arg ref "$PUTER_REF" \
-            '{event_type: "puter-dev-requested", client_payload: {puter_ref: $ref}}' |
-          curl -fsS -X POST \
-            -H "Authorization: token $TOKEN" \
-            -H "Accept: application/vnd.github.v3+json" \
-            https://api.github.com/repos/HeyPuter/heyputer/dispatches \
-            -d @-
-          echo "Requested \`$PUTER_REF\`" >> "$GITHUB_STEP_SUMMARY"
@@ -5,12 +5,9 @@ on:
    branches:
      - main

-permissions: {}
-
 jobs:
  notify:
    runs-on: ubuntu-latest
-    environment: heyputer-dispatch
    steps:
      - name: Trigger heyputer build
        run: |
@@ -18,4 +15,4 @@ jobs:
            -H "Authorization: token ${{ secrets.HEYPUTER_DISPATCH_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/repos/HeyPuter/heyputer/dispatches \
-            -d '{"event_type":"puter-main-updated","client_payload":{"puter_ref":"main"}}'
+            -d '{"event_type":"puter-main-updated","client_payload":{"puter_ref":"main"}}'
@@ -22,10 +22,8 @@ jobs:
    outputs:
      puterjs: ${{ steps.filter.outputs.puterjs }}
    steps:
-      - uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-      - uses: dorny/[email protected]
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
@@ -54,14 +52,12 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v7

      - name: Set up Node.js
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7
        with:
-          node-version: '26'
+          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
@@ -77,14 +73,12 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v7

      - name: Set up Node.js
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7
        with:
-          node-version: '26'
+          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
@@ -124,29 +118,24 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          # The base branch lives in this repo; for a fork PR, the head
-          # repo's copy of it can be arbitrarily stale.
          - ref: ${{ github.base_ref }}
-            repository: ${{ github.repository }}
            artifact: base
          - ref: ${{ github.head_ref }}
-            repository: ${{ github.event.pull_request.head.repo.full_name }}
            artifact: pr

    steps:
      - name: Checkout ${{ matrix.ref }}
        if: needs.changes.outputs.puterjs == 'true'
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@v7
        with:
-          persist-credentials: false
          ref: ${{ matrix.ref }}
-          repository: ${{ matrix.repository }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Set up Node.js
        if: needs.changes.outputs.puterjs == 'true'
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7
        with:
-          node-version: '26'
+          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
@@ -168,7 +157,7 @@ jobs:

      - name: Upload coverage artifact
        if: needs.changes.outputs.puterjs == 'true' && !cancelled()
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7
        with:
          name: puterjs-coverage-${{ matrix.artifact }}
          path: src/puter-js/coverage/coverage-*.json
@@ -181,15 +170,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v7

-      # Missing when the PR leg failed; `coverage (pr)` already reports that.
      - name: Download PR coverage
-        id: pr-coverage
-        continue-on-error: true
-        uses: actions/[email protected]
+        uses: actions/download-artifact@v8
        with:
          name: puterjs-coverage-pr
          path: src/puter-js/coverage
@@ -198,16 +182,15 @@ jobs:
      # base run) — then report without the comparison column.
      - name: Download base coverage
        id: base-coverage
-        if: steps.pr-coverage.outcome == 'success'
        continue-on-error: true
-        uses: actions/download-artifact@v8.0.2
+        uses: actions/download-artifact@v8
        with:
          name: puterjs-coverage-base
          path: coverage-base

      - name: Report coverage on PR
-        if: steps.pr-coverage.outcome == 'success' && steps.base-coverage.outcome == 'success'
-        uses: davelosert/vitest-coverage-report-action@v2.13.2
+        if: steps.base-coverage.outcome == 'success'
+        uses: davelosert/vitest-coverage-report-action@v2
        with:
          name: puter.js SDK
          json-summary-path: src/puter-js/coverage/coverage-summary.json
@@ -215,8 +198,8 @@ jobs:
          json-summary-compare-path: coverage-base/coverage-summary.json

      - name: Report coverage on PR (no base comparison)
-        if: steps.pr-coverage.outcome == 'success' && steps.base-coverage.outcome != 'success'
-        uses: davelosert/vitest-coverage-report-action@v2.13.2
+        if: steps.base-coverage.outcome != 'success'
+        uses: davelosert/vitest-coverage-report-action@v2
        with:
          name: puter.js SDK
          json-summary-path: src/puter-js/coverage/coverage-summary.json
@@ -0,0 +1,18 @@
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+name: release-please
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: google-github-actions/release-please-action@v4
+        with:
+          release-type: node
@@ -45,14 +45,14 @@ jobs:
          fi

      - name: Log in to GitHub Package Container registry
-        uses: docker/login-action@v4.8.0
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.4.1
+        uses: docker/setup-buildx-action@v4

      - name: Create alias tag
        env:
@@ -159,42 +159,13 @@ The reference has two kinds of page:

 An overview page answers "what is this API and is it what I need?", and a function page answers "how exactly does this call behave?". A change to one function usually only touches that function's page, so a new `kv.list()` option goes in `KV/list.md` without a matching update to `KV.md`. Don't copy a function's options, limits, or edge cases onto the overview page for completeness. Where a detail goes is a judgment call, not a hard rule: update the overview when a change affects how someone would describe the API as a whole.

-When you add a page, add it to [src/docs/src/sidebar.js](src/docs/src/sidebar.js) under its area, or it won't show up in the navigation.
-
-**Sidebar order.** Order the API areas in the sidebar by how often developers use them, most common first. Overview stays first and Objects stays last. Inside an area, order the pages by use too, and keep pages that make up one feature next to each other, such as `share()`, `unshare()`, `listShared()`, and `listSharedByMe()`. A group goes where its most-used page would go. A helper that only supports another function, such as `listModels()` for `chat()`, goes by its own use. Put create, list, get, update, and delete in that order, and constants such as `MAX_KEY_SIZE` last. The function list on the area's overview page uses the sidebar's order. When you add a runnable example, add its HTML to `src/docs/src/playground/examples/<slug>.html`, register the slug in [src/docs/src/examples.js](src/docs/src/examples.js), and link the code block to it by putting the slug after the language with a semicolon (` ```html;kv-set `).
-
-### Function page layout
-
-A function page opens with one sentence that says what the function does, in its own paragraph, such as "Given a prompt, generate an image using AI." Put any more detail in the paragraphs after it.
-
-After the intro, a function page has these `##` sections, in this order:
-
-1. Syntax
-2. Parameters
-3. Return value
-4. Errors, if the function has any
-5. Sections for specific topics, if the page needs them, with `## Model-specific features` last
-6. Examples
-
-[chat.md](src/docs/src/AI/chat.md) follows this layout.
-
- **Options as a table.** Document an options object as a table with Option, Type, and Description columns. Give each option its own row, even when two options go together, such as `width` and `height`. Order the rows by how often developers use them, most common first, without group rows. In chat.md that's the core options, then reasoning, tools, response handling, request control, and output.
- **Common options in the table, model-specific behavior in its own section.** A page whose function works with many models or providers, such as [chat.md](src/docs/src/AI/chat.md) and [txt2img.md](src/docs/src/AI/txt2img.md), splits its options this way:
-  - **The options table** under Parameters lists the options that work with every model, and describes each one the way it works for every model.
-  - **`## Model-specific features`**, the last section before Examples, covers everything else. It has a `###` for each model family or provider, named after it, such as "OpenAI models" or "Cloudflare models". Under it go the options only some models accept, and the common options a model handles differently, such as a narrower range, other allowed values, or an option it ignores.
-  - **Write there only what's different.** A `###` lists an option only when that model or provider adds it or handles it differently. An option that works the same everywhere stays out, even if the provider supports it, and a model or provider with nothing different gets no `###`.
-  - **Model-specific features is the only place for model-specific details.** Every limit, format, allowed value, default, price, or quirk that applies to some models goes there, in that model's or provider's `###`, and nowhere else. The options table and topic sections (such as Image inputs or Video input) describe what's true for every model and link to Model-specific features for the rest. Don't add a table or sentence there that compares providers or repeats a model's limits. Each copy is another source of truth to keep in sync, and copies drift when a model changes.
-  - **Link the two.** Directly under the options table, put `Some models accept additional options or handle these options differently. See [Model-specific features](#model-specific-features).` A row whose option behaves differently on some models can also end with `See [Model-specific features](#model-specific-features).`
- **A long topic gets its own `##` section.** When explaining an option or feature takes more than a sentence or two, such as function calling or output dimensions, give it a section between Errors and Examples and link to it from the options table. This keeps the reference sections short.
- **Usage patterns are examples.** A way of using the API, such as stopping a stream, goes in a runnable example that the relevant section links to ("See the [stop a stream example](/playground/ai-chat-stop-stream/)."), not in a section of its own.
- **Each example has a `###` heading** under `## Examples`, so every example shows in the table of contents.
+When you add a page, add it to [src/docs/src/sidebar.js](src/docs/src/sidebar.js) under its area, or it won't show up in the navigation. When you add a runnable example, add its HTML to `src/docs/src/playground/examples/<slug>.html`, register the slug in [src/docs/src/examples.js](src/docs/src/examples.js), and link the code block to it by putting the slug after the language with a semicolon (` ```html;kv-set `).

 ### Writing docs

 These apply to reference pages and recipes alike.

 - **Document the developer-facing side only.** The reader is building on top of puter.js, so cover what affects their code: signatures, defaults, return shapes, errors, limits, and behavior they can observe. Leave out internal workings (which service handles the call, storage layout, caching, retries) unless they change what the developer has to do. [rate-limits-and-quotas.md](src/docs/src/rate-limits-and-quotas.md) is the exception: it publishes every limit, including timeouts and caps that come from how the backend works.
- **Document Puter as it runs on puter.com.** The docs are for developers building on production Puter. Leave out behavior that only happens on a self-hosted or differently configured server, such as a provider that isn't set up there.
 - **Describe the current state.** Docs aren't a changelog. Write how the API behaves now, without "now", "no longer", "existing code is unaffected", or other wording that compares it to an older version.
 - **Verify before you document.** Run the calls you describe against a running Puter instead of inferring behavior from the source.
 - **Write plainly.** Use the literal words a developer would say out loud, with contractions and everyday words. No idioms or figurative verbs ("walk away from something shared with you" → "remove your own access", "nothing to page through" → "without pagination"). No formal register ("present only while more pages remain" → "includes a `cursor` if there are more pages to load"). Prefer dev terms such as atomic, concurrent, and insertion order.
@@ -202,7 +173,6 @@ These apply to reference pages and recipes alike.
 - **Describe behavior directly.** No quoted inner-voice phrases. Write "`isNew` is `true` when the person did not have access before", not "this tells 'I just gave this to someone' from 'they already had it'".
 - **Keep references easy to follow.** Name what a list or code block belongs to in the sentence directly above it. Name a thing once and keep that name. Introduce an actor as "a user" before giving them a role: "A user can create a team. The user who creates the team becomes its owner."
 - **Sentence mechanics.** Never start a sentence with inline code: write "To store data, use the [`set()`](/KV/set/) method." Link every inline mention of an API to its page, every time. No em dashes, and no colons or semicolons mid-sentence; a colon that introduces a code block is fine.
- **No `##` or `###` headings inside tabs.** The table of contents lists every `##` and `###` heading on the page, including the ones in a hidden tab (an `example-content` block switched by the `example-group` pills), so its links lead to content the reader can't see. Put the heading above the tabs, or use `####` inside a tab, which the table of contents skips.
 - **Show the correct way.** No "don't" and no wrong-way-first examples, in recipes and playground examples alike. Mention a wrong approach only when developers already hit it in practice, and state how it fails as a fact: "`add()` reads a plain object as a path map, so the call rejects with …".

 ### Recipes
@@ -214,12 +184,10 @@ Recipes are tested, copy-pasteable patterns for a task, one layer above the per-
 - **Description.** Written for someone who has never heard of Puter. Start with "Learn how to", put the action first, and say what the reader's app gains: "Learn how to add file sharing to your app with Puter.js, so users can share files in their Puter account with other people." No API names, no mechanism, no list of example cases, and no "not just …" contrast.
 - **Intro.** Explain the situation and why you'd do this, tied to something the reader already knows ("`puter.kv` is your database in Puter.js"). No "Use this when" bullet list.
 - **Structure.** Get to the first working call as early as possible, then add validation, rate limits, and sign-in after it. Explain a Puter concept the first time it appears, such as what `me.puter` is or that `puter.workers.exec()` opens the Puter sign-in window. Split recipes by what the reader needs, not by technique, and give a family of recipes a shared tag.
- **Reading order.** A recipe reads top to bottom. Each code block uses only functions and variables from blocks above it, so the reader never has to search further down the page to understand it. Start with a small version that works, and have each section add one case. When a section changes a function from earlier, show the whole new version of that function there. If the code is built up over several sections, end with a `## Full Code` block that has all of it.
 - **Link to the reference for full option lists.** Mention only the options the recipe uses, then link to the function page for the rest ("All the sort options are listed on [`puter.fs.readdir()`](/FS/readdir/)."). A copied list of options, rules, or scopes goes stale when the reference changes.
- **Limits.** Mention a limit only when it's the reason for a pattern the recipe uses, such as one wildcard subscription instead of one per key, and link to [rate-limits-and-quotas.md](src/docs/src/rate-limits-and-quotas.md) or the function page for the number. Leave out limits that code following the recipe never reaches.
 - **Code.** Platform-neutral: just the code, with top-level `await`. No `<script>` or `<html>` wrapper, no IIFE.
 - **Tradeoffs.** Justify a choice with one scenario the reader can picture right away, in about two short paragraphs, or fold each point into the section where it matters. The description states the benefit only.
- **Notes.** Leave out `## Notes` by default. Use it only to point to an architecturally different approach. A limit the recipe needs goes in the section it applies to, and other facts belong on the linked reference page.
+- **Notes.** Leave out `## Notes` by default. Use it only to point to an architecturally different approach. A limit goes in the section it applies to; other facts belong on the linked reference page.

 ---

@@ -231,6 +199,6 @@ Recipes are tested, copy-pasteable patterns for a task, one layer above the per-

 - **Reuse existing UI primitives before writing new ones.** Windows and dialogs are `UIWindow*` functions in [src/gui/src/UI/](src/gui/src/UI/); generic pieces already exist (`UIAlert`, `UIPrompt`, `UIContextMenu`, `UINotification`, `UIPopover`, widgets in [UI/Components/](src/gui/src/UI/Components/)). A new window should read like its neighbors: an async function taking an options object, composing an HTML string, wiring behavior with jQuery, delegating to `UIWindow(...)`.
 - **Match the visual language.** Use existing CSS classes (`button`, `button-primary`, window chrome, form styles) and copy the layout patterns of neighboring windows; new styles go in [src/gui/src/css/](src/gui/src/css/) following existing conventions. Verify anything positional (menus, overlays, z-index) on both desktop and mobile viewports.
- **i18n every user-facing string.** No hardcoded UI text — use `i18n('key')` and add the key to [src/gui/src/i18n/translations/en.js](src/gui/src/i18n/translations/en.js).
+- **i18n every user-facing string.** No hardcoded UI text — use `i18n('key')` and add the key to [src/gui/src/i18n/translations/en.js](src/gui/src/i18n/translations/en.js). Run `npm run check-translations` before opening the PR.
 - **Shared logic goes in helpers/services.** Reusable non-UI logic belongs in [src/gui/src/helpers/](src/gui/src/helpers/) or [src/gui/src/services/](src/gui/src/services/), not copy-pasted between windows.
 - **Tests.** Vitest is wired for the GUI (`src/**/*.test.js`; see [appOrder.test.js](src/gui/src/UI/Dashboard/appOrder.test.js) for the shape). Extract pure logic into functions and test those. Desktop behavior driven through puter.js (`puter.ui.*`) is covered by the Playwright harness in [src/puter-js/tests/e2e/](src/puter-js/tests/e2e/) — add a spec there when you change how the desktop renders SDK-driven UI.
@@ -17,21 +17,6 @@ Out-of-scope:
 - Denial of Service (DoS), spam, or volumetric attacks.
 - Physical security issues.

-## Eligibility
-
-We pay bounties for issues that threaten user security and privacy, or the security and health of the platform. We appreciate every report, but hardening suggestions and correctness bugs are not eligible, even when we fix them. Please open a GitHub issue for those.
-
-A report must show how an attacker can directly perform the action against another account or the system. It is not eligible if it:
-
- Starts from access the attacker should not already have: a stolen session or token, the victim's password, a root or full-access token, or script execution on `puter.com`.
- Needs the victim to do more than ordinary use (opening a link or an app), such as publishing their own secrets, sending a verification link to an address they don't control, or approving a prompt that accurately states what it grants.
- Gives the attacker nothing they couldn't already get through a supported API.
- Only reproduces in a non-default or development setup (SQLite, a `custom` OIDC provider, an unset outbound proxy, cookies or config planted by hand). Findings in the open-source code must affect `puter.com` or a default self-hosted install.
-
-**Shared state.** Sharing files, KV entries, or cross-app KV access means the sharer trusts the sharee. Exploits that depend on that trust, such as a sharee misusing access the sharer granted, may be treated as hardening or lower severity.
-
-Hardening we ship in a public PR does not make similar code paths vulnerabilities. They are judged by these same rules.
-
 ## Known Non-Issues (Please Check Before Submitting)

 The following have already been reviewed and determined **not to be vulnerabilities**. Reports that only re-describe one of these are **not eligible for a reward** and will be closed as non-issues — even if they include new code references. Please review this list before submitting:
@@ -40,14 +25,13 @@ The following have already been reviewed and determined **not to be vulnerabilit
 - **SSRF via `secureFetch`.** Production routes outbound requests through an isolated proxy that has no access to internal/SSRF-sensitive resources.
 - **Attacks that depend on guessing an `appInstanceID` or app UID.** These are random 128-bit secret values and are not considered guessable.
 - **Apps invoking drivers, creating workers, or using KV.** Applications are intended to do this; worker permissions are scoped to the owning app. This is by design.
- **App metadata or app user-count "leaks".** This information is currently public by design. This covers **private apps** too: private apps are an unreleased, admin-only beta for paid listings in the Puter App Center. Their `index_url` and other metadata are not secret, the flag is not user-settable, and no production app relies on it. Reports that a private app's metadata is reachable through a sibling route (`/get-launch-apps`, `index_url` drift on the hosting gate, etc.) are normalization work, not vulnerabilities.
+- **App metadata or app user-count "leaks".** This information is currently public by design. This covers **private apps** too: private apps are an unreleased, admin-only beta for paid listings in the Puter App Center. Their `index_url` and other metadata are not secret, the flag is not user-settable, and no production app relies on it. Reports that a private app's metadata is reachable through a sibling route (taskbar items, `/get-launch-apps`, `index_url` drift on the hosting gate, etc.) are normalization work, not vulnerabilities.
 - **Worker hot-reload driven by a share recipient.** Sharing a worker's source file with write access is how you let a collaborator change that worker's code and have it deploy live. The redeploy running as the file owner, with the owner's worker credentials, is the intended behavior of that grant — the owner chose to hand out write access to executable code. If you do not want that, do not share the source file with write access.
- **Re-claiming a site or worker name its owner deleted.** A hosted site or worker name that its owner deletes is treated as abandoned by that owner. If one of their apps still points at it, whoever claims the name next serves that app's `index_url` and receives what the app is launched with, and a new app on the same origin may share the old one's identity. Guarding app identities against being recycled this way is ongoing hardening, not a security boundary, so new ways to re-claim an abandoned name, or to inherit an app's tokens or data through one, are not eligible.
 - **Share-mode downgrades that do not cascade.** Demoting a delegate does not retroactively revoke the grants that delegate already issued downstream. Shares are independent grants once issued, not a live-evaluated chain. Revoking the downstream grant is a separate, supported action.
- **Metering, credit-hold, and quota inaccuracies.** Credit holds and quota checks are up-front estimates, and actual usage is billed afterwards. Overspend that is bounded and still billed is a correctness bug, including concurrent requests that exceed a hold or quota by some margin; the per-account concurrency and rate-limit gates are the control we rely on. Report these only if you can use a service without it being billed, or overspend without bound.
- **Existence-only oracles.** A response that tells "exists but forbidden" apart from "not found" for a path or ID the caller already supplied, without revealing anything else about it, is hardening.
+- **Concurrency / TOCTOU overspend of credits or storage quota.** Firing concurrent requests to exceed an AI credit hold or a storage quota by some margin is known and accepted; the per-account concurrency and rate-limit gates are the control we rely on, and the residual overage is bounded and billed. Report these only if you can demonstrate _unbounded_ overspend.
 - **Session and credential lifecycle around 2FA enrollment.** Enrolling in 2FA is not a credential-revocation event: existing authenticated sessions stay valid, and outstanding password-reset links stay valid. Likewise, account-management actions behind the `/user-protected/*` gate are password-gated by design, not TOTP-gated. A recovery code that stops being accepted fails _closed_ — it denies access rather than granting it, so it is a bug report, not a vulnerability.
 - **Group permissions** (`/auth/revoke-user-group` and siblings). The group-permission surface is unfinished and not exposed anywhere in the product. Findings there are not reachable by any user.
+- **Correctness bugs with no security boundary crossed.** For example, an API that reports success while silently leaving data behind. We want these reported — please open a GitHub issue — but they are not bounty-eligible.
 - **Missing Subresource Integrity (SRI) on external scripts/styles.** Accepted as hardening, not as a vulnerability, absent a demonstrated compromise of the CDN in question.
 - **General "token in a URL" / token-lifetime / token-storage designs** — signed directory URLs exposing children, a write signature implying read, app tokens outliving a web session, or the session token being held in `localStorage` on `puter.com`. These are current intended behaviors. Shorter-lived tokens with a refresh flow are on the roadmap; their absence is not a vulnerability on its own. Show a reproducible attack that does not already presuppose script execution on `puter.com`.
 - **Missing PKCE, unverified `id_token` signatures, or other OIDC hardening.** Provider tokens are obtained through a server-to-server authorization-code exchange with the provider's token endpoint over TLS, so the resulting `id_token` / userinfo claims are trusted from that channel rather than from local JWKS signature verification — the callback never accepts a caller-supplied `id_token`. Adding local signature / `aud` / `iss` / `exp` checks is welcome defense-in-depth (please open a GitHub issue/PR), but their absence is not an account-takeover vector on its own.
@@ -68,7 +52,7 @@ To participate, you must:
 3. **Respect availability**: Do not perform denial-of-service attacks or automated scans that degrade service.
 4. **Follow disclosure policy**: Do not publicly disclose vulnerabilities until we have confirmed and patched the issue.
 5. **Act in good faith**: Make every effort to avoid privacy violations, destruction of data, and interruption or degradation of services.
-6. **Check Eligibility and Known Non-Issues**: Reports that fall outside "Eligibility" or match an item in "Known Non-Issues" above are not eligible and will be closed.
+6. **Check the Known Non-Issues list**: Reports matching an item in the "Known Non-Issues" section above are not eligible and will be closed.

 Reports that do not meet these guidelines may not be eligible for a reward.

@@ -79,14 +63,14 @@ Reports **MUST** demonstrate a **working, reproducible exploit with real impact*
 - Exact steps to reproduce, the relevant request/response or code path, and the commit or version you tested.
 - The **observed** result versus the **expected** result.
 - For client-side, UI, or authentication-flow bugs: a short screen recording (≤ 2 minutes) showing the exploit working end-to-end on a real Puter instance.
- For server-side bugs: a runnable proof-of-concept and screenshot or video showing the attack process. A unit test or in-process harness alone does not count; show it against a running instance.
+- For server-side bugs: a runnable proof-of-concept and screenshot or video showing the attack process.

 Reports based solely on reading the source ("source review only, not tested") or unverified AI/LLM-generated reports are the **lowest triage priority and not eligible for bounty**.
-If you used an AI tool to help find an issue, you must personally verify that it actually reproduces before submitting. Reports sent by automated agents are not eligible.
+If you used an AI tool to help find an issue, you must personally verify that it actually reproduces before submitting.

 Please submit **one issue per report**.
-Bundled "audit packs" of many speculative findings will not be eligible for bounty; send each confirmed issue separately.
-Additionally please **DO NOT** submit too many issues at once; these will be treated as a bundled report, and will not be eligible for bounty.
+Bundled "audit packs" of many speculative findings will not be elligible for bounty; send each confirmed issue separately.
+Additionally please **DO NOT** submit too many issues at once; these will be treated as a bundled report, and will not be elligible for bounty.

 ## Reporting Process

@@ -99,8 +83,6 @@ Include:
 - Suggested remediation (if available)
 - Paypal id where we can send the bounty (if eligible)

-Send the full report in your first email. We don't reply to messages that only ask whether we run a bounty or where to report.
-
 We aim to acknowledge receipt within **72 hours** and provide a resolution timeline.

 ## Reward Structure
@@ -113,7 +95,7 @@ We offer monetary rewards based on the severity of the vulnerability, as determi
 - **Low: \$50 – \$100**

 Non-security issues, suggestions, and best practices feedback are always welcome, but may not qualify for a reward.
-If multiple researchers report the same issue, the bounty will be awarded to the first eligible report we receive. Issues we already know about, from internal review, an open ticket, or a fix already in a public commit or PR, count as duplicates.
+If multiple researchers report the same issue, the bounty will be awarded to the first eligible report we receive.

 ## Payments Disclaimer

@@ -1 +1 @@
-FOLLOW @AGENTS.md
+FOLLOW ./AGENTS.md
@@ -14,7 +14,7 @@
 # config.default.json, so partial overrides work. Absent file = defaults.

 # ---- Build stage ----
-FROM node:26-bookworm-slim AS build
+FROM node:24-slim AS build

 WORKDIR /opt/puter

@@ -59,7 +59,7 @@ RUN set -e; \
    wait $pjs_pid

 # ---- Runtime stage (slim — no build tools) ----
-FROM node:26-bookworm-slim
+FROM node:24-slim

 WORKDIR /opt/puter

@@ -73,12 +73,6 @@ COPY --from=build --chown=node:node /opt/puter .
 RUN mkdir -p /etc/puter /var/puter && \
    chown -R node:node /etc/puter /var/puter

-# Fix outdated HOME_URL in /etc/os-release (see issue #4329)
-# The base image may contain a reference to the old phoenix repository.
-RUN if [ -f /etc/os-release ]; then \
-      sed -i 's|HOME_URL="https://github.com/HeyPuter/phoenix"|HOME_URL="https://github.com/HeyPuter/puter"|' /etc/os-release; \
-    fi
-
 # Self-hosters mount their override at this exact path. The v2 loader
 # deep-merges it over config.default.json (see backend/index.ts).
 ENV PUTER_CONFIG_PATH=/etc/puter/config.json
@@ -93,4 +87,4 @@ USER node
 HEALTHCHECK --interval=30s --timeout=3s --start-period=30s --retries=3 \
    CMD wget --no-verbose --tries=1 --spider http://puter.localhost:4100/test || exit 1

-CMD ["node", "-r", "./dist/src/backend/telemetry.js", "./dist/src/backend/index.js"]
+CMD ["node", "-r", "./dist/src/backend/telemetry.js", "./dist/src/backend/index.js"]
@@ -7,8 +7,9 @@
    // Each setting lives at exactly one canonical key — there are no fallback
    // aliases. Values shown are illustrative, not production secrets.
    //
-    // Keys consumed only by closed-source / hosted-prod extensions are
-    // intentionally omitted.
+    // Keys consumed only by closed-source / hosted-prod extensions (clickhouse,
+    // cacheUpdateHandler, pages, prodMeteringAndBilling, …) are intentionally
+    // omitted.

    // ── Environment / identity ──────────────────────────────────────────
    "config_name": "template",
@@ -34,7 +35,7 @@
    // Idle keep-alive timeout in ms. Must stay above the idle timeout of any
    // proxy in front, or the proxy reuses connections this server has closed
    // and its clients see 502s.
-    "keep_alive_timeout": 920000,
+    "keep_alive_timeout": 620000,
    "protocol": "http",
    "domain": "puter.localhost",
    // Fully-qualified externally-visible URL. Computed from protocol/domain/
@@ -62,10 +63,6 @@
    // direct socket peer. NEVER set to `true` in prod — it trusts every hop
    // and makes X-Forwarded-For forgeable.
    "trust_proxy": false,
-    // Request header a TLS-terminating proxy in front of the server sets to
-    // the client's TLS fingerprint (JA3/JA4). Only set it when that proxy
-    // overwrites any value the client sends. Unset disables it.
-    // "tlsFingerprintHeader": "x-tls-fingerprint",
    "no_browser_launch": false,

    // ── Dev watcher (devWatcher extension) ──────────────────────────────
@@ -219,9 +216,7 @@
        // "bootstrapTables": true,
        "path": "",
        // Credentials. NOTE: snake_case here, unlike `s3.s3Config` below.
-        // For dynamodb-local, any non-empty values work. On AWS,
-        // `"useCredentialChain": true` uses the default credential chain
-        // instead of keys.
+        // For dynamodb-local, any non-empty values work.
        "aws": {
            "access_key": "",
            "secret_key": "",
@@ -258,16 +253,6 @@
            "user": "",
            "pass": ""
        }
-        // Each send names a stream: "auth", "signup" or "notify". A stream
-        // listed here adds its headers to every message on it, and its "from"
-        // when the sender gives none. Tags are written to "tagsHeader".
-        // "streams": {
-        //     "notify": {
-        //         "from": "\"Puter\" <[email protected]>",
-        //         "headers": { "X-Example-Stream": "notify" },
-        //         "tagsHeader": "X-Example-Tags"
-        //     }
-        // }
    },

    // ── Inbound mail (separate process) ─────────────────────────────────
@@ -329,8 +314,7 @@
    // The tables ship either way and sit inert; this gates whether `/teams`
    // is registered at all, so with it off the paths do not exist rather than
    // existing and refusing. It is also the backout: turning it off removes
-    // the feature without touching data. Teams ships as an extension; on,
-    // the server refuses to boot unless one registers it.
+    // the feature without touching data.
    "teams_enabled": false,
    //
    // Live teams one user may own. Soft-deleted ones do not count, so
@@ -364,9 +348,6 @@
    // not, a row past this is swept. Off by default; any value above 0 arms
    // the sweep.
    // "notificationRetentionDays": 14,
-    //
-    // Ms a live notification waits for open tabs to acknowledge it.
-    // "notificationAckTimeoutMs": 5000,

    // ── Alarms / alerting ───────────────────────────────────────────────
    // Where system alarms go. Severity is the routing decision — each
@@ -450,8 +431,6 @@
        "mistral": { "apiKey": "" },
        "xai": { "apiKey": "" },
        "moonshot": { "apiKey": "" },
-        // MiniMax. One key powers chat and video generation (H3, Hailuo);
-        // video calls go to the same host, beside the chat API's `/v1`.
        "minimax": {
            "apiKey": "",
            "apiBaseUrl": "https://api.minimax.io/v1"
@@ -472,10 +451,6 @@
            "apiKey": "",
            "apiBaseUrl": "https://ark.ap-southeast.bytepluses.com/api/v3"
        },
-        // Kling AI. One API key (not the legacy AccessKey/SecretKey pair)
-        // powers video generation, image generation and TTS; `apiBaseUrl`
-        // defaults to https://api-singapore.klingai.com.
-        "kling": { "apiKey": "" },
        "zai": { "apiKey": "" },
        "alibaba": { "apiKey": "" },
        "hoonify": {
@@ -514,8 +489,6 @@
            "defaultVoiceId": "",
            "speechToSpeechModelId": ""
        },
-        // Both AWS providers also take `"useCredentialChain": true` in place
-        // of keys, like `dynamo.aws`.
        "aws-polly": {
            "access_key": "",
            "secret_key": "",
@@ -45,12 +45,6 @@ Both are supported ways to define an API. **Prefer a controller when you need fi
 - **A specific verified factor:** `requireVerified` (email, and only under `strict_email_verification_required`), `requirePhoneVerified`, `requireCardVerified`. Opt-in, and the factor must actually have been verified, unlike the default-on gate that turns away accounts still carrying a pending verification the abuse harness asked for. `requireAnyVerified: ['phone', 'card']` is the OR of the last two: any listed factor verified at any point passes, as does a paid plan when `card` is listed (a paying account already has a card on file). Otherwise only the factors the deployment can verify are asked for (an SMS provider configured, a card gate an extension reports on); with none verifiable the gate is inert rather than locking the route on a self-hosted install. A denial carries the first verifiable factor's code plus `factors` (the verifiable ones, in the route's order), so a client can lead with one flow and offer the other. `verifiedFactorGate.enabled: false` in config stops every declared gate at once, e.g. during an SMS-provider outage.
 - **Metered spend:** an endpoint that spends metered resources on the caller's behalf (moving file content, object-store requests, anything else the account is billed for) declares `requireCredits: true`, which turns an account with no budget left away with a 402 before the handler runs. Endpoints that only describe or delete things deliberately don't: an account that has run out still has to see what it has, clear it, and reach its billing pages. Drivers have no route options, so they call `assertActorHasCredits` themselves ([src/backend/services/metering/enforcement.ts](../src/backend/services/metering/enforcement.ts)) — see `KVStoreDriver`, which does it once for every method.

-Provider sign-in requires the account's authenticator or a recovery code when 2FA is enabled, including signup callbacks that resolve an existing account. The five-minute challenge uses the same single-use `/login/otp` and `/login/recovery-code` verification as password sign-in. The GUI carries it in a URL fragment and removes it before initialization. A session and successful popup-return proof are issued only after verification; cancelling retains the popup's signed retry context without marking it authenticated.
-
-Disabling 2FA through `/user-protected/disable-2fa` requires both password or OIDC revalidation and either the current six-digit authenticator `code` or an unused recovery code in `code`. Recovery codes are consumed atomically. Missing or incorrect codes leave the secret and remaining recovery codes intact. A team's requirement for 2FA still prevents disabling it.
-
-Email changes through `/user-protected/change-email` require the password or OIDC revalidation cookie, plus a six-digit `code` from the authenticator when 2FA is enabled. Missing or malformed codes return `400 bad_request`; incorrect codes return `401 code_mismatch`. Both include `factor: 'otp'`. Confirmation links are bound to that verified request. A 2FA-enabled account must request a new link if its existing link was issued without second-factor verification.
-
 ### 3. puter.js

 - Add the method to the matching module in [src/puter-js/src/modules/](../src/puter-js/src/modules/), matching the calling conventions of its siblings (promise-returning; positional shortcut plus options form where that's the local pattern).
@@ -1,365 +0,0 @@
-# Embedded app browser
-
-`GET /embed/apps` on the deployment's main GUI origin renders the same app browser
-as the dashboard's Apps tab, without the desktop or dashboard navigation.
-
-It supports search, paging, saved folders, and saved ordering. It uses the same
-installed-app and recommendation data as the dashboard, including the user's
-removed recommendations. Editing, adding, reordering, renaming, and uninstalling
-are disabled. Selecting an app opens it in a new browser tab at its own URL, the
-same way the dashboard does, and the host page stays open. The app's token isn't
-put in the URL: the app's SDK asks the embed for it once the tab loads, so the
-embed must still be open then. If the iframe is removed first, the app falls back
-to its normal sign-in. Apps that need the desktop (built-in and godmode apps,
-private apps the user can't open, or a failed token request) open `/app/<name>`
-on the GUI origin, cut off from the embed. Website shortcuts open their external
-destination with no opener.
-The embed follows the OS's light or dark setting. A host with a fixed theme adds
-`theme=dark` or `theme=light` to the fragment (`#user=<uuid>&theme=dark`), since
-Chromium doesn't pass an iframe's `color-scheme` on to the page inside it.
-Apps opened from the embed carry `utm_source=puter.com&utm_medium=referral&utm_campaign=app_browser_embed`;
-the desktop and dashboard send `utm_campaign=desktop` and `utm_campaign=dashboard`.
-
-## Session and framing
-
-The embed shows the GUI session only to the user the host page is signed in as.
-The host names that user's `uuid` (from `puter.auth.getUser()`) in the iframe
-URL's fragment, as `/embed/apps#user=<uuid>`. The embed reads the session, asks
-`/whoami` which user it belongs to, and shows the signed-out view unless the two
-match. So a host that names no user, a malformed one, or a user other than the
-session's, gets the signed-out view, and so does a session the API refuses. A
-failed `/whoami` check shows the error state. The fragment never reaches the
-server and can only narrow what the embed shows: naming the session's own user
-gives the same view as a direct visit to the GUI. Changing the fragment of a
-loaded embed reloads it.
-
-The embed reads the existing GUI session from local storage on its own origin.
-If that storage holds no session, the embed gets the session from the GUI origin's session cookie through
-`/get-gui-token`. This matters in Safari, which gives a framed origin separate
-local storage under each top-level origin, so even a sibling subdomain's iframe
-can't see the GUI's stored token. The session cookie is still sent, because the
-host is on the same site. The embed doesn't write that token back to storage. It
-does not create accounts, show a login dialog, or accept a token from its parent.
-Being signed in on a subdomain alone does not create a session on the main GUI
-origin.
-
-Without a session it can show, the embed shows the recommended apps (`RecommendedAppsService`)
-that the server put in the page, and nothing else: no installed apps, folders, or
-saved order, and no puter.js. Selecting one opens it at the same URL a signed-in
-launch uses, with no opener and no token on offer, so the app signs in on its own.
-Apps that need the desktop open `/app/<name>`. If the page carries no recommended
-apps, or a load fails, the embed displays an unavailable/error state.
-
-The route's `Content-Security-Policy: frame-ancestors` allows the GUI origin and
-the embedding page's origin when it is exactly one label under `config.domain`
-with the scheme and port from `config.origin`. Subdomains the server answers
-itself (`api`, `dav`, `js`, `www`, the native-app hosts, and the host of
-`api_base_url`) and the user-content hosting domains (`static_hosting_domain`,
-`private_app_hosting_domain`, and their `_alt` variants) are refused. For
-example, `https://puter.com` permits `https://spreadsheet.puter.com` but not
-`https://api.puter.com`, and `http://puter.localhost:4100` permits
-`http://spreadsheet.puter.localhost:4100` but not
-`http://someone.site.puter.localhost:4100`. The embedding page is read from the
-iframe request's referrer, so the host must not suppress it (the browser default
-`strict-origin-when-cross-origin` is enough). All ancestors in a nested iframe
-chain must be allowed. Other GUI routes retain `X-Frame-Options: SAMEORIGIN`.
-
-The embed accepts no query parameters. Requests with a query string redirect to
-the same embed path so SDK bootstrap parameters cannot override the session or API
-origin. The host needs to allow the GUI origin in its own `frame-src` CSP if it
-sets one. If sandboxing the iframe, allow scripts, same-origin storage, popups,
-and popups to escape the sandbox.
-
-## Host integration
-
-A first-party app that signs in with puter.js can place `<puter-user-menu>` from
-the SDK in its header instead (see `src/puter-js/src/ui/components.md`). It opens
-this embed with the signed-in user named and closes it when the app's sign-in
-changes. The rest of this section is for a host that builds the iframe itself.
-
-The iframe can be shown whether or not the user is signed in. Create it when
-“More apps” is opened, naming the signed-in user in its fragment, and remove it
-on close so reopening loads current apps and preferences. Remove it when the
-host's own sign-in changes too, such as on sign-out, so an open embed doesn't
-keep the previous user. The host owns the modal and close control;
-there is no parent messaging API and no app list or credential is sent to it.
-The app browser fills its iframe and responds to its size. It shows a spinner until its apps load.
-
-This example assumes `puterOrigin` comes from the host app's deployment
-settings. Translate the button and frame labels using the host app's
-localization system.
-
-```html
-<button id="more-apps" type="button">More apps</button>
-<dialog id="apps-dialog" aria-label="More apps">
-  <button id="close-apps" type="button">Close</button>
-  <div id="apps-frame"></div>
-</dialog>
-<style>
-  #apps-dialog { padding: 12px; width: min(900px, 90vw); }
-  #apps-frame iframe { width: 100%; height: min(650px, 75vh); border: 0; }
-</style>
-<script type="module">
-  const puterOrigin = 'https://puter.com'; // Use this deployment's configured origin.
-  const dialog = document.querySelector('#apps-dialog');
-  const container = document.querySelector('#apps-frame');
-  const trigger = document.querySelector('#more-apps');
-
-  trigger.addEventListener('click', async () => {
-    const url = new URL('/embed/apps', puterOrigin);
-    // Signed out, the embed shows the recommended apps.
-    const user = puter.auth.isSignedIn() ? await puter.auth.getUser().catch(() => null) : null;
-    if (user) url.hash = `user=${encodeURIComponent(user.uuid)}`;
-    const frame = document.createElement('iframe');
-    frame.title = 'Your apps';
-    frame.src = url.href;
-    container.replaceChildren(frame);
-    dialog.showModal();
-  });
-  document.querySelector('#close-apps').addEventListener('click', () => dialog.close());
-  dialog.addEventListener('close', () => {
-    container.replaceChildren();
-    trigger.focus();
-  });
-</script>
-```
-
-## Implementation
-
-`createAppBrowser` in `src/gui/src/UI/Dashboard/AppBrowser.js` owns the shared UI
-and data behavior; its `guestApps` option is the signed-out list. `TabApps.js`
-injects desktop actions. `appsEmbed.js` supplies new-tab launching through
-`launchAppInTab` (signed in) and `guestAppLaunchUrl` (signed out) in
-`src/gui/src/helpers/appTabLaunch.js`, which build the same app URL as
-`launch_app`, and loads only the embed entry, its SDK, and shared styles. `embedHostUser` in
-`src/gui/src/helpers/embedHostUser.js` reads the host's user from the fragment, and
-`embedHostTheme.js` beside it applies the host's theme.
-The normal GUI webpack build emits `bundle.min.js`, `apps-embed.min.js`, and `feedback-embed.min.js`.
-The `/embed/apps` route puts the recommended list in the page's config as
-`guestApps`. No puter.js API or app-list endpoint changes are needed.
-
-## Feedback dialog
-
-`GET /embed/feedback` is the app feedback dialog (`puter.ui.showFeedbackDialog()`)
-for a first-party page, with the same framing rules, query redirect, and
-host-user binding as `/embed/apps`. It sends the feedback for the framing
-page's origin, which the server reads from the referrer and pins with
-`frame-ancestors`; opened top-level, it does nothing. Its page is transparent
-so the dialog's own scrim covers the host.
-
-puter.js uses it on a page one label under the GUI origin, other than the
-subdomains the server refuses, when the page is signed in, framing it in a
-modal `<dialog>` that stays hidden until the embed is ready. A session check that takes longer than 200ms shows a loading scrim
-with a spinner in its place; Escape or a click on it cancels. The embed posts `{ msg: 'feedbackEmbed', state }` to its parent
-(`loading`, then `ready` or `unavailable`) and finally
-`{ msg: 'feedbackDialogClosed', sent }`. It reports `unavailable` without the
-named user's session, or while that user's email still needs confirming, and
-puter.js then uses the `/action/send-feedback` popup, which can sign in. So does
-a frame that never answers, such as one the host's CSP blocks. `feedbackEmbed.js`
-is the entry, sharing `embedSession` in `src/gui/src/helpers/embedSession.js`
-with the app browser; `showFeedbackEmbed` in `src/puter-js/src/lib/guiEmbed.js`
-is the host side.
-
-## Sign-in and file pickers
-
-`GET /embed/sign-in`, `/embed/show-open-file-picker`, `/embed/show-save-file-picker`
-and `/embed/show-directory-picker` serve the same GUI popups as `/action/<action>`
-for a first-party page, with the same framing rules, query redirect, and
-`no-store` as `/embed/apps`. Any other spelling of the path (another case, a
-trailing slash) redirects to it, since the shell boots the desktop for it. They render the normal GUI shell, which names the
-framing page (read from the referrer, pinned with `frame-ancestors`) as
-`gui_params.embed_host_origin`. The GUI then runs the popup boot unchanged, with
-the framing page as `window.opener`, and `window.close()` asks the page to
-remove the frame (`src/gui/src/helpers/popupFrame.js`). Without a framing page
-to answer (opened top-level, or framed by a refused page) it does nothing. The
-popup's parameters come from the fragment instead of the query: `msg_id`,
-`options` and `request_auth`, plus `user` for a picker.
-
-The frame posts `{ msg: 'puterPopupFrame', state }` to its parent: `loading` as
-soon as the shell boots, `ready` once it shows a window or dialog, `unavailable`
-when the page has to use the popup, `provider` when the user picks a sign-in
-provider (below), and `closed` where a popup would close. Its
-answers (`puter.token`, `fileOpenPicked`, `directoryPicked`, `fileSaved`, the
-cancel messages, `sendMeFileData`) are the popup's.
-
-puter.js uses them on a page one label under the GUI origin, other than the
-subdomains the server refuses, unless the page is cross-origin isolated or in a
-frame of another site (which `frame-ancestors` refuses too).
-`showPopupFrame` in `src/puter-js/src/lib/guiEmbed.js` shows the frame in a box
-the size of the popup window, over a scrim, hidden until `ready` and behind the
-loading spinner after 200ms. Escape closes it, on the page or in the frame. One shows per popup, as each
-popup has its own window name: a second picker request of the same kind
-replaces the one showing, and a `signIn()` call made while a framed sign-in is
-open settles with it. On
-screens up to 600px wide the box fills the screen. A frame that is refused,
-never answers, or reports `unavailable` falls back to the popup, opened through
-a consent dialog when the click that asked for it has expired. A reload or navigation the frame
-starts itself (logging out, a sign-out in another tab) names the frame as its
-referrer, so the server refuses it; the page then shows its spinner and opens
-the frame again, once per `ready`.
-
- **Sign-in** (`puter.auth.signIn()`) has no host-user binding: it is how the
-  page gets a user. The box has a close button, which rejects with
-  `auth_window_closed` as closing the popup does. Providers refuse to be
-  framed, so choosing one posts `{ state: 'provider', url }` with the
-  provider's start URL for this sign-in's `msg_id`, then `unavailable`. The
-  page opens the popup straight at that URL, once it checks the URL is the
-  GUI's `/auth/oidc/<provider>/start` for this `msg_id`, and the provider
-  returns it as this sign-in's popup. `attempt_temp_user_creation` keeps the popup, since
-  only the popup creates a temporary account.
- **Pickers** frame only for a signed-in page. The GUI reports `unavailable`
-  unless its session belongs to the user named in `user`, and the page then uses
-  the popup, which can sign in and switch accounts. The token the GUI sends
-  before a picker's answer isn't adopted, since it is for the page's own user.
-  Dismissing the loading scrim settles the picker as cancelled.
-
-## Upgrade
-
-`GET /embed/upgrade` is the deployment's upgrade dialog for a first-party page,
-served like the popups above: the GUI shell with the same framing rules, query
-redirect, exact-path redirect and `no-store`, naming the framing page as
-`gui_params.embed_host_origin`. It runs only when framed by an allowed page.
-
-puter.js frames it on a signed-in first-party page (the same pages as the
-pickers) for `puter.ui.requestUpgrade(details)`, and for the Upgrade button of
-the usage limit dialog a refused call shows there. Elsewhere both keep their
-behavior: inside an app `requestUpgrade()` asks the desktop, and on any other
-page the usage limit dialog opens the dashboard's upgrade page in a new tab.
-
-The frame covers the page with no box or close button, and the GUI page is
-transparent (`html.popup-frame-transparent`) so the dialog's own scrim covers
-the host. The frame allows `payment` as well as `otp-credentials`. Escape on the
-page is left to the dialog, since one there shouldn't drop a payment in
-progress. Its fragment names `user` (the page's signed-in user) and, when the
-refusal gave them, `reason` (`funds`, `subscription` or `storage`) and `method`.
-
-The GUI reports `unavailable` unless its session belongs to `user`, the account
-has no verification or password change waiting (which the frame couldn't be
-closed from), and the deployment defines `window.UIUpgradeAccount` with
-`UIUpgradeAccount.embeddable === true`. Otherwise it runs:
-
-```js
-new UIUpgradeAccount({ attribution: { appUid, reason, method }, onClose }).open_as_window();
-```
-
-`appUid` is the app the framing page's origin resolves to, never one the
-fragment names. `open_as_window()` resolves once the dialog shows, and the GUI
-then posts `ready`. While the page still hides the frame, which Chromium and
-WebKit lay out at 0x0, the GUI posts `ready` first and opens the dialog once
-the frame has a viewport, so a window it opens doesn't center on 0x0.
-`onClose({ upgraded })` must run exactly once, when the
-dialog closes or when it declines to open for the account; the GUI then posts
-`{ msg: 'puterPopupFrame', state: 'closed', upgraded }` and the page removes
-the frame. If `open_as_window()` rejects, the GUI posts `unavailable` instead. `requestUpgrade()` resolves `{ upgraded }`. A call made while the
-frame shows settles with it rather than replacing it, and a call refused while
-it shows still rejects but opens no usage limit dialog over it.
-
-When the frame can't show the upgrade (refused, never ready, `unavailable`, or
-no user to name), puter.js opens the dashboard's upgrade page in a new tab with
-what was refused, through a consent dialog when the click has expired or the
-tab is blocked, and `requestUpgrade()` resolves `{ upgraded: false }`.
-
-## Top-up
-
-`GET /embed/top-up` is the deployment's top-up dialog, where a user with a plan
-buys add-on credit, served and framed like the upgrade: a transparent GUI page
-covering the host with no box or close button, allowing `payment` and
-`otp-credentials`, with Escape left to the dialog. Its fragment names `user`.
-
-puter.js frames it for the **Add credits** item of `<puter-user-menu>`, which
-shows only when whoami reports `subscribed: true` and no `team` paying for the
-account. On a page that can't frame the GUI, the item opens the dashboard with
-`?topup=` in a new tab instead.
-
-The GUI reports `unavailable` unless its session belongs to `user`, the account
-has no verification or password change waiting, and the deployment defines
-`window.UITopUp` with `UITopUp.embeddable === true`. Otherwise it runs:
-
-```js
-new UITopUp({ onClose }).open();
-```
-
-`open()` resolves once the dialog has loaded the account and shows what it can
-buy, and `onClose({ toppedUp })` must run exactly once, when the dialog closes
-or when it declines to open for the account. The GUI then posts `{ msg: 'puterPopupFrame', state: 'closed', toppedUp }`
-and the page removes the frame. When the frame can't show the top-up, puter.js
-opens the dashboard's top-up in a new tab, as it does the upgrade.
-
-While the top-up shows, a call refused for funds still rejects but opens no
-usage limit dialog over it, and `requestUpgrade()` frames nothing over it: it
-resolves `{ upgraded: false }` once the top-up closes.
-
-## Email confirmation
-
-`GET /embed/request-email-confirmation` walks a first-party page's user through
-confirming their email, served like the upgrade: the GUI shell with the same
-framing rules, redirects and `no-store`, run only when framed by an allowed
-page. puter.js frames it on a signed-in first-party page for
-`puter.ui.requestEmailConfirmation()`. Inside an app the desktop shows the same
-windows over the app instead.
-
-Like the upgrade, the frame covers the page with no box or close button, over a
-transparent GUI page, and its fragment names `user`. Escape closes it, on the
-page or on the save-account or code window. On a window, Escape closes that
-window as its close button does, so a code already sent still answers. The GUI
-reports `unavailable` unless its session belongs to `user` and the account has
-no phone, card or password check waiting.
-An email check is fine: the boot skips its own email gate for this action, so
-the user gets one code window they can close.
-
-The GUI then runs `ensureConfirmedEmail` (`src/gui/src/helpers/ensureConfirmedEmail.js`),
-which the desktop's handler uses too: a temporary account gets the save-account
-window first, then an unconfirmed email gets the code window, each at most
-once. When the page's whoami already reads the email as confirmed,
-`requestEmailConfirmation()` resolves `{ response: true }` without framing
-anything, and a confirmation in the frame marks that whoami confirmed for the
-calls after it. An email the GUI reads as confirmed shows nothing. Before
-opening a window the GUI waits for the frame to have a viewport, as the upgrade
-does. It then posts
-`{ msg: 'puterPopupFrame', state: 'closed', confirmed }`, and
-`requestEmailConfirmation()` resolves `{ response: confirmed }`, the field an
-app reads from the desktop's answer. A call made while the frame shows settles
-with it. A frame that is refused, never ready, or `unavailable` resolves
-`{ response: false }`, since there's no popup to fall back to.
-
-## Custom domains
-
-`GET /embed/attach-custom-domain` is the custom domain dialog of
-`puter.hosting.attach()`, the popup at `/action/attach-custom-domain`, served
-like the upgrade: the GUI shell with the same framing rules, redirects and
-`no-store`, run only when framed by an allowed page. puter.js frames it on a
-signed-in first-party page (the same pages as the pickers).
-
-The frame covers the page with no box or close button, over a transparent GUI
-page, so the dialog floats over the host with its own scrim as it does on the
-desktop. The frame allows `clipboard-write`, for the dialog's copy buttons, as
-well as `otp-credentials`. Escape on the page is left to the dialog, which
-doesn't close while a request is in flight. Its fragment names `user` (the
-page's signed-in user), `subdomain` (the site to attach a domain to) and
-`msg_id`.
-
-The GUI reports `unavailable` unless its session belongs to `user` and the
-account has no verification or password change waiting. It then runs the
-popup's action unchanged, with the framing page as the requester the dialog
-names: it posts `ready` once the dialog is on the page, answers
-`{ msg: 'customDomainAttached', domain, original_msg_id }` once the dialog has
-closed and its exit has played, and then posts `closed`. `domain` is the domain the user chose, or
-null. `attach()` resolves it. A frame that closes without an answer, or a
-loading scrim the user dismisses, resolves null.
-
-A call made while the frame shows resolves null without replacing it, as a
-second call does on the desktop. A frame that is refused, never ready, or
-`unavailable` falls back to the popup, which can sign in, through a consent
-dialog when the click has expired.
-
-## Checks
-
-Run the GUI component/browser tests (with the SDK bundle built and Playwright
-Chromium installed), and the backend route tests:
-
-```sh
-npx vitest run --config src/gui/vitest.config.js src/gui/src/UI/Dashboard/AppBrowser src/feedbackEmbed
-npx vitest run src/puter-js/src/lib/guiEmbed.test.js src/puter-js/src/modules/UI.showFeedbackDialog.test.js src/puter-js/src/modules/Auth.signInFrame.test.js src/puter-js/src/modules/UI.pickerFrame.test.js src/puter-js/src/modules/UI.requestUpgrade.test.js src/puter-js/src/modules/UI.showTopUp.test.js src/puter-js/src/modules/UI.attachCustomDomainFrame.test.js src/puter-js/src/lib/upgradePrompt.test.js src/puter-js/src/modules/UsageLimitDialog.upgrade.test.js
-npx vitest run --config src/gui/vitest.config.js src/gui/src/helpers/popupFrame.test.js
-npx vitest run --config src/backend/vitest.config.ts src/backend/server.test.ts
-```
@@ -51,21 +51,11 @@ two pages can't be decoded into how fast the table grows; `openCursor` still
 reads a plain cursor. What a cursor wraps is an implementation detail per
 store:

- DynamoDB-backed lists wrap `LastEvaluatedKey`. A kv listing of another
-  namespace (cross-app or through a share handle) resumes after the last entry
-  it returned instead, since the scan can stop on a private one, and its cursor
-  is sealed to that listing and padded to one length.
+- DynamoDB-backed lists wrap `LastEvaluatedKey`.
 - SQL-backed lists wrap a keyset position — `(sortValue, id)` of the last
  row — and the query seeks past it (`WHERE (col, id) > (?, ?) ORDER BY col,
  id`). Any SQL list gaining a cursor must have a deterministic `ORDER BY`
  ending in a unique tiebreaker (`id`).
- The notification catch-up (`GET /events/fetch`) holds two keysets in one
-  sealed cursor: the last `id` it returned, and the last `(replaced_at, id)`
-  among rows up to that id. Each is its own indexed read, merged into one
-  page, so a row replaced after a client read it comes back from that cursor.
-  `from=end` with no cursor answers an empty page whose cursor holds the
-  slice's newest `id` and the slice's latest `(replaced_at, id)` as the
-  replacement mark.

 Cursors that carry a sort also pin it: a request that passes a cursor plus a
 conflicting sort is rejected with 400.
@@ -1,80 +0,0 @@
-# Browser push client
-
-Puter's desktop shows pushes through `/sw.js`. Core shows Settings → Notifications only when the `pushEnabled` gui param is `true`; core never sets it. The worker is registered only when push is turned on in the browser, and a load removes one left without a subscription. A backend extension that delivers pushes sets it with `services.homepage.setGuiParam('pushEnabled', true)` and can load its own code into the worker with `services.homepage.registerServiceWorkerScript(path)`.
-
-Core subscribes the browser to a push service only when the server also publishes `pushWebPushKey` (see [Built-in Web Push client](#built-in-web-push-client)), and it has no `/push/*` routes of its own. The device, app, preference and subscription endpoints below come from that extension. On a deployment without one, such as most self-hosted servers, they answer core's plain 404 (`code: 'not_found'`), which `puter.notifications` reports as `push_unavailable` and the Notifications tab shows as unavailable. A device the extension can't find is `device_not_found`.
-
-## Push payload
-
-`sw.js` reads the push's JSON body. The message is its `puter` field, or `data.puter` for services that only carry string data, as an object or a JSON string:
-
-```ts
-{ uid?: string; title?: string; body?: string; icon?: string; group?: string;
-  target?: { app?: string; path?: string }; data?: unknown; channel?: string;
-  type?: 'challenge'; challenge?: string }
-```
-
-`uid` is the notification's uid, a later push with the same `group` replaces the one showing, and `target` and `data` reach the app when the user taps it.
-
-When the browser replaces the subscription (`pushsubscriptionchange`), `sw.js` keeps the new one, or subscribes again with Puter's stored key when the browser gave none and the event, the receipt or an earlier mark names the subscription that went. It writes `puter:subscription-changed:<scope>` to the `puter-push` IndexedDB as `{ at, oldEndpoint }`, the old endpoint kept from an earlier mark no page handled yet, else taken from the event or from the receipt, forgets the receipt kept for that scope, and posts `{ type: 'puter-push-subscription-changed' }` to every open window on Puter's origin. The worker has no token or session, so an open page runs `helpers/pushSync.js` on that message, after any run already in flight, and a later load does the same through the marker.
-
-## Receipts
-
-Before a notification is pushed, the server asks the open clients whether they received it live. It sends `notif.receipt` with `{ uid }` on the user's sockets for the app that sent it, or on the desktop's sockets for Puter's own notifications. The SDK remembers the uids its page received through `onNotification()`, `onPush()` or the desktop's feed, and answers once its page has that notification, or with `{ received: false }` when it never gets it. The server waits up to 5 seconds (`notificationAckTimeoutMs`).
-
-An answer carries `visibilityState` and `focused` as they were when the page received the notification. Pages never show a browser notification themselves; pushes do.
-
- An answer from a page that was visible and focused stops the push (`handled` on `notif.delivery.settled`). An older client that doesn't send `focused` counts while visible.
- Otherwise the notification is pushed, to every browser the user subscribed. A website's pushes go only to the browsers that subscribed through its own worker, never to Puter's `/sw.js`. An app inside the desktop pushes through `/sw.js`, which shows the app's name and icon.
- A client that can't answer, such as an older puter.js, doesn't hold the push back.
-
-The ask reaches only the sockets in the asking region. So that other regions hear about a page too, a page that receives a notification live while visible and focused also sends `notif.handled` with `{ uid }` on the socket it came on. Core relays it as the node-local `notif.handled` event with the socket's user and app, at most 60 a minute per user; an extension that delivers pushes decides what to do with it.
-
-## Registering
-
-The registry is in [src/gui/src/helpers/pushClient.js](../src/gui/src/helpers/pushClient.js). A service script registers its client like this:
-
-```js
-service_script(async (api) => {
-    api.use()['push.registerPushClient']?.(client);
-});
-```
-
-`use(id)` throws when nothing is registered under `id`, so the form above also runs on a Puter version without the registry and does nothing there. Any script that runs after the GUI bundle can call `use()['push.registerPushClient']?.(client)` the same way. Registering again replaces the client. Registering dispatches `push-client-registered` on `window`, and an open Notifications tab redraws.
-
-With no client registered, the tab says push notifications aren't available in this browser.
-
-### Built-in Web Push client
-
-When the server also sets the `pushWebPushKey` gui param (a VAPID public key), core registers its own client ([webPushClient.js](../src/gui/src/helpers/webPushClient.js)) unless an extension registered one first. It uses `puter.notifications.enable()` / `disable()`, the same standard Web Push flow apps use on their own origins:
-
-1. `GET /push/web/key` for the key, then `pushManager.subscribe()` on the `/sw.js` registration.
-2. `POST /push/web/subscriptions { subscription }`. A subscription the server already has answers `{ status: 'active' }`. A new one answers `{ status: 'pending' }`, and the server sends it a push with `{ type: 'challenge', challenge }`.
-3. The worker shows that push and posts `{ type: 'puter-push-challenge', challenge }` to the origin's windows; the page sends it to `POST /push/web/subscriptions/verify`. The device is registered once the page hands the confirmation back.
-4. `DELETE /push/web/subscriptions { endpoint }` removes it.
-
-Apps on their own origin do the same through `push-sw.js`, which they import into their own worker. A subscription made with an app token is the app's: its pushes are that app's notifications only.
-
-## Interface
-
-```ts
-interface PushClient {
-    enable(options?: { background?: boolean }): Promise<{ deviceUid: string }>;
-    disable(): Promise<void>;
-    status(options?: { cached?: boolean }): Promise<{
-        permission: 'default' | 'granted' | 'denied';
-        registered: boolean;
-        deviceUid?: string;
-    }>;
-}
-```
-
- `enable()` may ask for notification permission, so core calls it from a click: Turn on in the Notifications tab, Allow on a permission prompt that includes `notifications:push` while this browser is off, and the "Turn on notifications" button of the `/action/enable-push` popup and the matching desktop dialog (`UIEnablePushDialog`). Core also calls it without a click, from `helpers/pushSync.js`, when `Notification.permission` is already `granted`, `status()` reports the browser as not registered, the user has not turned push off in this browser, and an app may push to Puter's devices (`puterDevices` in `GET /push/apps`); the browser does not prompt then. That call passes `{ background: true }`: a browser the user removed in Puter stays removed, and the built-in client rejects with code `push_device_removed`, after which core records the browser as turned off. Before a background call the built-in client asks `POST /push/web/subscriptions/status` about every earlier endpoint it knows: the marker's `oldEndpoint` and the last endpoint the server answered `active` for (`puter.push.last-endpoint:<user uuid>` in `localStorage`). On a 429 it registers nothing and rejects with `too_many_requests`, which the sync reports as `later`, keeping the marker for the next run. When any answer is `removed`, it ends the current subscription in the browser, clears the marker and rejects with `push_device_removed`, so a subscription change or a dropped subscription never brings back a browser removed from another device. A click renews it as before. For a click the built-in client runs `puter.notifications.enable()`, which subscribes with the `/sw.js` registration and registers the browser through the Web Push flow above (`platform: 'webpush'`); in the background it runs the same registration without replacing a removed subscription or opening Puter's sign-in. It then resolves the `uid` of this browser's `webpush` device from `listDevices()` and clears the subscription-changed marker. It rejects when permission is refused or the browser wasn't registered.
- `disable()` runs `puter.notifications.disable()`, which sends `DELETE /push/web/subscriptions { endpoint }` and ends the browser's subscription. The tab calls it for Turn off, and for Remove on the device marked as this browser. Remove on any other device is `DELETE /push/devices/:uid`.
- `status()` reports the state without prompting. `permission` is `Notification.permission`. `registered` is true when this browser has a device registered for the signed-in user and `POST /push/web/subscriptions/status` answers `active` for the current subscription's endpoint, and `deviceUid` is that device's `uid`. A server that can't answer leaves the device match alone, and so does an `unknown` for an endpoint `enable()` registered in this page in the last 5 minutes, since that check can trail a registration. While the subscription-changed marker is set, `registered` is false. With `{ cached: true }` a client may answer with the last registered state it read in this page. Core passes it for the silent registration on app launch and for an app's `puter.notifications.status()`; the Notifications tab and the push dialogs read fresh. The built-in client keeps that state in memory for the same user and subscription for up to 5 minutes, from `enable()` or once the server answered `active` for the endpoint, and answers from it without either request. Reads of the same user and endpoint share one real check while it is in flight. It drops it on `disable()`, a failed `enable()`, an unregistered answer, a set subscription-changed marker, and the worker's `puter-push-subscription-changed` message, so a new page load always asks the server. Whether the calling app may push is checked on every call, against a `GET /push/apps` answer the page reuses for 30 seconds and drops on `enable()`, `disable()`, a grant, a revoke and a user change. When it can't be read, or leaves the app out, the grant alone counts.
-
-After `enable()` resolves, the tab calls `POST /push/devices/:uid/test` and asks the user whether a notification showed up.
-
-The tab also reads `GET /push/apps` and `GET`/`POST /push/preferences`.
-
-Core keeps its own record of a browser the user turned off, `puter.push.browser-off:<user uuid>` in `localStorage`, written by Turn off, by Remove on this browser's device, and by a silent registration the server refuses with `push_device_removed`, and cleared when `enable()` resolves. The silent registration above skips a browser with that record, so a device removed here or from another device stays removed until the user turns it on from a click, while a new sign-in in a browser that already allows notifications registers again.
@@ -12,17 +12,7 @@ Generates secrets, writes `.env` + `puter/config/config.json`, downloads `docker

 ## Requirements

- **Docker** with the `compose` plugin. This is the one thing you have to install
-  yourself — the installer checks for it and stops with an explanation rather
-  than installing it for you.
-  - **macOS / Windows:** [Docker Desktop](https://docs.docker.com/get-docker/).
-    Both ship the `compose` plugin.
-  - **Linux:** [Docker Engine](https://docs.docker.com/engine/install/) plus the
-    [`docker-compose-plugin`](https://docs.docker.com/compose/install/) package.
-  - Confirm before running anything else: `docker compose version` should print a
-    version, not `command not found`.
-  - If Docker is installed but the shell can't see it, make sure your user is in
-    the `docker` group (Linux) or that Docker Desktop is actually running.
+- **Docker** with the `compose` plugin.
 - A **domain** with DNS access — you need a wildcard record (`*.your-domain.com` → server IP). Puter routes by subdomain (`api.<domain>`, `site.<domain>`, `app.<domain>`).
 - Optional: **TLS certs** (or `certbot` to grab them — see Step 3).

@@ -326,20 +316,6 @@ Used for password resets, email confirmation, and notifications. Without it thos

 To require email confirmation before login, also set `"strict_email_verification_required": true`.

-Account and notification mail is sent on a named stream: `auth` (password, address and 2FA changes), `signup` (address confirmation; a `puter.signup.validate` listener may name another: lowercase letters, digits, `:`, `_` and `-`, up to 64 characters, starting with a letter or digit) and `notify` (share, app feedback and contact form mail). Add `"streams"` inside `"email"` to configure one, for instance to let your mail provider route or report each kind of mail separately:
-
-```json
-"streams": {
-    "notify": {
-        "from": "\"Puter\" <[email protected]>",
-        "headers": { "X-Example-Stream": "notify" },
-        "tagsHeader": "X-Example-Tags"
-    }
-}
-```
-
-`headers` are added to every message on the stream, `from` replaces the default sender, and `tagsHeader` names the header that carries a message's tags as `name=value` pairs joined by `, `. A stream that is not listed adds nothing: the message goes out with the default from address and the caller's headers. `streams` is never handed to the transport.
-
 To read the mail yourself instead of sending it, point the transport at a local SMTP sink — [MailHog](https://github.com/mailhog/MailHog) catches everything and serves it at `http://localhost:8025`. Publish both ports; a container that only exposes them is unreachable from the host:

 ```sh
@@ -681,14 +657,6 @@ Migrations re-apply idempotently across pulls. Volumes are preserved.

 ## Troubleshooting

-**`missing required command: docker` — the installer stops immediately.**
-Docker isn't on your `PATH` yet. Puter self-hosting is a Docker Compose stack, so
-nothing can run without it. Install [Docker Desktop](https://docs.docker.com/get-docker/)
-on macOS/Windows or [Docker Engine](https://docs.docker.com/engine/install/) plus
-`docker-compose-plugin` on Linux, then confirm `docker compose version` works in
-the same shell and re-run the installer. On Linux, a fresh Docker install usually
-needs a new login session before your user picks up the `docker` group.
-
 **Site loads but I get a 502 / "Bad Gateway" from Caddy.**
 The puter container failed to come up. `docker compose logs puter` will tell you which dependency rejected it (most often DB password mismatch between `.env` and `config.json`).

@@ -309,41 +309,4 @@ describe('metering extension — handleMeteringAllCosts', () => {
        // per request).
        expect(costsA).toBe(costsB);
    });
-
-    it('refreshes a warm catalogue at the UTC price boundary', async () => {
-        vi.useFakeTimers({ toFake: ['Date'] });
-        try {
-            vi.setSystemTime(new Date('2026-11-30T23:59:59Z'));
-            const before = makeRes();
-            await handleMeteringAllCosts(makeReq(), before.res);
-            vi.setSystemTime(new Date('2026-12-01T00:00:00Z'));
-            const after = makeRes();
-            await handleMeteringAllCosts(makeReq(), after.res);
-            expect(
-                (after.captured.body as { costs: unknown[] }).costs,
-            ).not.toBe((before.captured.body as { costs: unknown[] }).costs);
-        } finally {
-            vi.useRealTimers();
-        }
-    });
-
-    // A scheduled price change has to reach the catalogue without a restart.
-    it('collects the catalogue again once the cache expires', async () => {
-        vi.useFakeTimers({ toFake: ['Date'] });
-        try {
-            vi.setSystemTime(new Date('2026-12-02T00:00:00Z'));
-            const a = makeRes();
-            const b = makeRes();
-            await handleMeteringAllCosts(makeReq(), a.res);
-            vi.setSystemTime(Date.now() + 10 * 60 * 1000 + 1);
-            await handleMeteringAllCosts(makeReq(), b.res);
-
-            const costsA = (a.captured.body as { costs: unknown[] }).costs;
-            const costsB = (b.captured.body as { costs: unknown[] }).costs;
-            expect(costsB).not.toBe(costsA);
-            expect(costsB).toEqual(costsA);
-        } finally {
-            vi.useRealTimers();
-        }
-    });
 });
@@ -16,11 +16,9 @@ import type { Request, Response } from 'express';
 const services = extension.import('service');
 const stores = extension.import('store');

-// Catalogues change on deploy or on a scheduled price change, so the cache
-// expires rather than living as long as the process.
-const ALL_COSTS_TTL_MS = 10 * 60 * 1000;
+// Cached on first request — the underlying cost catalogues are baked into
+// driver/controller source so they only change on deploy.
 let cachedAllCosts: Record<string, unknown>[] | null = null;
-let allCostsExpireAt = 0;

 function collectAllCosts(): Record<string, unknown>[] {
    const all: Record<string, unknown>[] = [];
@@ -189,14 +187,12 @@ export const handleMeteringGlobalUsage = async (
    res.json(globalUsage);
 };

-// A hit walks the registries when the in-memory cache is missing or expired.
+// First hit walks the registries; subsequent hits serve the in-memory cache.
 export const handleMeteringAllCosts = async (
    _req: Request,
    res: Response,
 ): Promise<void> => {
-    if (!cachedAllCosts || Date.now() >= allCostsExpireAt) {
-        allCostsExpireAt =
-            (Math.floor(Date.now() / ALL_COSTS_TTL_MS) + 1) * ALL_COSTS_TTL_MS;
+    if (!cachedAllCosts) {
        const raw = collectAllCosts();
        const multiplier = creditMultiplierFrom(extension.config);
        // Price the catalogue in the same unit the usage endpoints report:
@@ -314,41 +314,6 @@ describe('thumbnails extension — handleThumbnailRead', () => {
        await server?.shutdown();
    });

-    it('keeps read URLs stable within an hour and rotates them at the next hour', async () => {
-        const key = mintedKey();
-        const signedAt = Date.UTC(2026, 9, 26, 10);
-        const read = async () => {
-            const entry: Record<string, unknown> = {
-                thumbnail: `s3://${BUCKET}/${key}`,
-            };
-            await handleThumbnailRead(entry, {
-                s3,
-                s3Presign,
-                bucketName: BUCKET,
-                bucketEndpoint: BUCKET_ENDPOINT,
-                fsEntry: server.stores.fsEntry,
-            });
-            return entry.thumbnail as string;
-        };
-        vi.useFakeTimers({ toFake: ['Date'] });
-        try {
-            vi.setSystemTime(signedAt + 1000);
-            const first = await read();
-            vi.setSystemTime(signedAt + 3599_000);
-            expect(await read()).toBe(first);
-            expect(new URL(first).searchParams.get('X-Amz-Date')).toBe(
-                '20261026T100000Z',
-            );
-            expect(new URL(first).searchParams.get('X-Amz-Expires')).toBe(
-                '604800',
-            );
-            vi.setSystemTime(signedAt + 3600_000);
-            expect(await read()).not.toBe(first);
-        } finally {
-            vi.useRealTimers();
-        }
-    });
-
    // Thumbnails stored before keys were bound to entries keep displaying.
    it.each([
        ['an entry-bound key', () => mintedKey()],
@@ -307,9 +307,6 @@ export const handleThumbnailRead = async (
    const thumb = entry.thumbnail;
    if (typeof thumb !== 'string' || !thumb) return;
    const presignClient = deps.s3Presign;
-    const signingDate = new Date(
-        Math.floor(Date.now() / 3_600_000) * 3_600_000,
-    );

    if (isStoragePointer(thumb, deps.bucketEndpoint)) {
        const key = resolveThumbnailKey(thumb);
@@ -322,7 +319,7 @@ export const handleThumbnailRead = async (
        entry.thumbnail = await getSignedUrl(
            presignClient,
            new GetObjectCommand({ Bucket: deps.bucketName, Key: key }),
-            { expiresIn: 604800, signingDate },
+            { expiresIn: 604800 },
        );
    } else if (thumb.startsWith('data')) {
        // Move an inline thumbnail into storage. The row only takes the new
@@ -376,7 +373,7 @@ export const handleThumbnailRead = async (
        entry.thumbnail = await getSignedUrl(
            presignClient,
            new GetObjectCommand({ Bucket: deps.bucketName, Key: key }),
-            { expiresIn: 604800, signingDate },
+            { expiresIn: 604800 },
        );
    }
 };
@@ -1,7 +1,13 @@
 import type { Request, Response } from 'express';
-import { installSeatStub } from '@heyputer/backend/testFixtures/seatStub';
 import { v4 as uuidv4 } from 'uuid';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import {
+    afterAll,
+    beforeAll,
+    describe,
+    expect,
+    it,
+    vi,
+} from 'vitest';
 import { makeActor, type Actor } from '../src/backend/core/actor.ts';
 import { runWithContext } from '../src/backend/core/context.ts';
 import { configContainer } from '../src/backend/exports.ts';
@@ -43,6 +49,7 @@ beforeAll(async () => {
            create_shortcut: true,
            payment_bypass: true,
        },
+        teams_enabled: true,
    } as never);
 });

@@ -76,20 +83,21 @@ describe('whoami extension — handleWhoami', () => {
        };

        const seatOf = async (teamName: string) => {
+            const owner = await seedUser();
            const seat = await seedSeat();
-            const team = {
-                uid: `wt-${Math.random().toString(36).slice(2, 9)}`,
+            const team = await server.stores.team.create({
+                ownerUserId: owner.id as number,
                name: teamName,
-            };
-            installSeatStub(server as never, [seat.id as number], {
-                teamUid: team.uid,
-                teamName: team.name,
+                handle: `wt-${Math.random().toString(36).slice(2, 9)}`,
+            });
+            await server.stores.team.addMember(team.uid, seat.id as number, {
+                orgOwned: true,
            });
            return { seat, team };
        };

-        it('names no team where teams is off', async () => {
-            const { seat } = await seatOf('Acme Corp');
+        it('names the team for a seat', async () => {
+            const { seat, team } = await seatOf('Acme Corp');
            const { res, captured } = makeRes();

            await runWithContext(
@@ -97,8 +105,10 @@ describe('whoami extension — handleWhoami', () => {
                () => handleWhoami(makeReq(), res),
            );

-            // Off, so the seat is never looked up.
-            expect((captured.body as { team?: unknown }).team).toBeUndefined();
+            expect((captured.body as { team?: unknown }).team).toEqual({
+                uid: team.uid,
+                name: 'Acme Corp',
+            });
        });

        it('says nothing for an account that is not a seat', async () => {
@@ -160,81 +170,6 @@ describe('whoami extension — handleWhoami', () => {
        expect(captured.body).toEqual({ error: 'User not found' });
    });

-    describe("an app's view of the email", () => {
-        const appActorFor = async (user: { uuid: string; id: unknown }) => {
-            const app = await (
-                server.stores.app.create as unknown as (
-                    fields: Record<string, unknown>,
-                    opts: { ownerUserId: number },
-                ) => Promise<{ uid: string; id: number }>
-            )(
-                {
-                    name: `we-${uuidv4()}`,
-                    title: 'Email reader',
-                    index_url: `https://${uuidv4()}.example/`,
-                },
-                { ownerUserId: user.id as number },
-            );
-            return {
-                app,
-                actor: makeActor({
-                    user: { uuid: user.uuid, id: user.id as number },
-                    app: { uid: app.uid, id: app.id },
-                }),
-            };
-        };
-
-        const whoamiAs = async (actor: Actor) => {
-            const { res, captured } = makeRes();
-            await runWithContext({ actor }, () =>
-                handleWhoami(makeReq(), res),
-            );
-            return captured;
-        };
-
-        it('is withheld until the user grants it, then shown', async () => {
-            const user = await seedUser();
-            const { app, actor } = await appActorFor(user);
-
-            const before = (await whoamiAs(actor)).body as Record<
-                string,
-                unknown
-            >;
-            expect(before).not.toHaveProperty('email');
-            expect(before).not.toHaveProperty('unconfirmed_email');
-
-            await server.services.permission.grantUserAppPermission(
-                makeActor({ user: { uuid: user.uuid, id: user.id as number } }),
-                app.uid,
-                `user:${user.uuid}:email:read`,
-            );
-            const after = (await whoamiAs(actor)).body as Record<
-                string,
-                unknown
-            >;
-            expect(after.email).toBe(user.email);
-            expect(after.unconfirmed_email).toBe(user.email);
-        });
-
-        it('answers 404 for a missing account even when the check fails', async () => {
-            const check = vi
-                .spyOn(server.services.permission, 'check')
-                .mockRejectedValue(new Error('scan failed'));
-            try {
-                const captured = await whoamiAs(
-                    makeActor({
-                        user: { uuid: 'ghost-uuid', id: 99_999_998 },
-                        app: { uid: 'app-ghost', id: 1 },
-                    }),
-                );
-                expect(captured.statusCode).toBe(404);
-                expect(captured.body).toEqual({ error: 'User not found' });
-            } finally {
-                check.mockRestore();
-            }
-        });
-    });
-
    it('returns full user details for a user actor', async () => {
        const user = await seedUser();
        const { res, captured } = makeRes();
@@ -257,41 +192,8 @@ describe('whoami extension — handleWhoami', () => {
        expect(body.created_ts).toBeGreaterThan(0);
        // `directories` is only sent to user actors — confirm it’s present.
        expect(body.directories).toBeDefined();
-    });
-
-    it('leaves out taskbar items saved on the account', async () => {
-        const user = await seedUser();
-        await server.stores.user.update(user.id as number, {
-            taskbar_items: JSON.stringify([{ type: 'app', name: 'editor' }]),
-        });
-        const { res, captured } = makeRes();
-
-        await runWithContext(
-            { actor: { user: { uuid: user.uuid, id: user.id as number } } },
-            () => handleWhoami(makeReq(), res),
-        );
-
-        expect(captured.body).not.toHaveProperty('taskbar_items');
-    });
-
-    it('leaves out a desktop background saved on the account', async () => {
-        const user = await seedUser();
-        await server.stores.user.update(user.id as number, {
-            desktop_bg_url: 'https://cdn.test/wallpaper.png',
-            desktop_bg_color: '#000000',
-            desktop_bg_fit: 'cover',
-        });
-        const { res, captured } = makeRes();
-
-        await runWithContext(
-            { actor: { user: { uuid: user.uuid, id: user.id as number } } },
-            () => handleWhoami(makeReq(), res),
-        );
-
-        const body = captured.body as Record<string, unknown>;
-        expect(body).not.toHaveProperty('desktop_bg_url');
-        expect(body).not.toHaveProperty('desktop_bg_color');
-        expect(body).not.toHaveProperty('desktop_bg_fit');
+        // taskbar_items is only sent to user actors.
+        expect(body).toHaveProperty('taskbar_items');
    });

    it('reports the SMS-to-card fallback only once a send has opened it', async () => {
@@ -355,7 +257,7 @@ describe('whoami extension — handleWhoami', () => {
        expect(flags.payment_bypass).toBeUndefined();
    });

-    it('strips created_ts and human_readable_age fields for app actors', async () => {
+    it('strips desktop_bg_*, created_ts and human_readable_age fields for app actors', async () => {
        const user = await seedUser();
        const { res, captured } = makeRes();

@@ -373,6 +275,9 @@ describe('whoami extension — handleWhoami', () => {
        expect(body.app_name).toBe('app-test-actor');
        // is_user_token is stripped for app actors.
        expect(body.is_user_token).toBeUndefined();
+        expect(body.desktop_bg_url).toBeUndefined();
+        expect(body.desktop_bg_color).toBeUndefined();
+        expect(body.desktop_bg_fit).toBeUndefined();
        expect(body.human_readable_age).toBeUndefined();
        // Account age, in either form, is not exposed to apps.
        expect(body.created_ts).toBeUndefined();
@@ -462,7 +367,7 @@ describe('whoami extension — handleWhoami', () => {
            });
        });

-        it('cannot add directories for an app actor, which core omits', async () => {
+        it('cannot add taskbar_items for an app actor, which core omits', async () => {
            const user = await seedUser();
            const body = await whoamiWithListener(
                makeActor({
@@ -470,11 +375,11 @@ describe('whoami extension — handleWhoami', () => {
                    app: { uid: 'app-test-actor' },
                }),
                (_key, event) => {
-                    event.details.directories = { '/injected': 'uuid' };
+                    event.details.taskbar_items = [{ name: 'injected' }];
                },
            );

-            expect(body).not.toHaveProperty('directories');
+            expect(body).not.toHaveProperty('taskbar_items');
        });
    });

@@ -546,7 +451,9 @@ describe('whoami extension — handleWhoami', () => {
            }),
        ]) {
            const { res, captured } = makeRes();
-            await runWithContext({ actor }, () => handleWhoami(makeReq(), res));
+            await runWithContext({ actor }, () =>
+                handleWhoami(makeReq(), res),
+            );

            const body = captured.body as Record<string, unknown>;
            expect(body.phone).toBeUndefined();
@@ -555,7 +462,7 @@ describe('whoami extension — handleWhoami', () => {
            expect(body.otp_secret).toBeUndefined();
            expect(body.signup_ip).toBeUndefined();
            // Not just absent as a key — the values must not appear anywhere
-            // in the payload (nested under metadata, …).
+            // in the payload (nested under metadata, taskbar items, …).
            const serialized = JSON.stringify(body);
            expect(serialized).not.toContain('5551234567');
            expect(serialized).not.toContain('fp_ABC123');
@@ -1,5 +1,6 @@
 import { Context } from '@heyputer/backend/src/core';
 import { extension } from '@heyputer/backend/src/extensions';
+import { APP_ICON_SIZES } from '@heyputer/backend/src/util/appIcon.js';
 import {
    buildUserDetails,
    scrubSensitive,
@@ -35,28 +36,25 @@ export const handleWhoami = async (
    }

    const isUser = !actor.effectiveApp;
-    const canReadEmail = async (uuid: unknown) => {
-        try {
-            return await services.permission.check(
-                actor,
-                `user:${uuid}:email:read`,
-            );
-        } catch {
-            return false;
-        }
-    };
-    // Started beside the row read: the actor carries the row's uuid.
-    const emailCheck = isUser ? null : canReadEmail(actor.user.uuid);
    const user = await stores.user.getById(actor.user.id);
    if (!user) {
        res.status(404).json({ error: 'User not found' });
        return;
    }

+    const rawIconSize =
+        typeof req.query?.icon_size === 'string'
+            ? Number(req.query.icon_size)
+            : undefined;
+    const iconSize =
+        rawIconSize !== undefined && APP_ICON_SIZES.includes(rawIconSize)
+            ? rawIconSize
+            : undefined;
+
    const details = await buildUserDetails(
        user,
        { config: extension.config, clients, stores, services },
-        { isUser },
+        { isUser, iconSize, noIcons: !iconSize },
    );
    details.human_readable_age = user.timestamp
        ? timeago.format(new Date(user.timestamp as string))
@@ -64,13 +62,16 @@ export const handleWhoami = async (

    // Strip sensitive fields for app actors
    if (!isUser) {
-        const emailReadable = await (user.uuid === actor.user.uuid
-            ? emailCheck
-            : canReadEmail(user.uuid));
-        if (!emailReadable) {
+        const canReadEmail = await services.permission
+            .check(actor, `user:${user.uuid}:email:read`)
+            .catch(() => false);
+        if (!canReadEmail) {
            delete details.email;
            delete details.unconfirmed_email;
        }
+        delete details.desktop_bg_url;
+        delete details.desktop_bg_color;
+        delete details.desktop_bg_fit;
        delete details.human_readable_age;
        delete details.created_ts;
        delete details.is_user_token;
@@ -190,13 +190,6 @@ S3_BUCKET=puter-local
        providers = [ordered]@{
            ollama = [ordered]@{ enabled = $false }
        }
-        # Off because a self-hosted install has no paid plans: every account
-        # is on the free policy, so the plan gates would 402 the surfaces that
-        # declare one (the OpenAI/Anthropic-compatible AI endpoints) for
-        # everybody. Same as install.sh.
-        meteringEnforcement = [ordered]@{
-            subscriptions = $false
-        }
        trust_proxy = 1
    }
    $configJson = $config | ConvertTo-Json -Depth 10
@@ -53,29 +53,9 @@ need() {
    command -v "$1" >/dev/null 2>&1 || die "missing required command: $1"
 }

-check_docker() {
-    if command -v docker >/dev/null 2>&1; then
-        return 0
-    fi
-    echo >&2 ""
-    echo >&2 "[puter-install] missing required command: docker"
-    echo >&2 ""
-    echo >&2 "Docker is required to run Puter self-hosted."
-    echo >&2 ""
-    echo >&2 "Installation instructions:"
-    echo >&2 "  - macOS (Apple Silicon & Intel): https://docs.docker.com/desktop/setup/install/mac-install/"
-    echo >&2 "    (Docker Desktop is recommended. Alternatives: OrbStack, Colima)"
-    echo >&2 "  - Linux: https://docs.docker.com/engine/install/"
-    echo >&2 "  - Windows: https://docs.docker.com/desktop/setup/install/windows-install/"
-    echo >&2 ""
-    echo >&2 "After installing Docker, make sure it's running and try again."
-    echo >&2 ""
-    exit 1
-}
-
 # ── Step 1: dependency check ────────────────────────────────────────
 log "checking dependencies"
-check_docker
+need docker
 need curl
 need openssl
 docker compose version >/dev/null 2>&1 \
@@ -54,6 +54,7 @@
    "dev": "npm start",
    "build": "npm run setupExtensions && npm run build:ts && cd src/gui && node ./build.js && cd ../puter-js && npm run build",
    "build:workerLib": "cd src/puter-js && npm run build && cd ../worker && npm run build",
+    "check-translations": "node tools/check-translations.js",
    "prepare": "husky",
    "build:ts": "tsc -p tsconfig.build.json && node ./tools/write-dist-package-json.mjs",
    "check:puterjs:types": "node tools/checkPuterjsTypes.mjs",
@@ -76,10 +77,9 @@
    "@aws-sdk/s3-request-presigner": "^3.1028.0",
    "dedent": "^1.5.3",
    "javascript-time-ago": "^2.5.11",
-    "libphonenumber-js": "1.13.15",
+    "libphonenumber-js": "1.13.14",
    "miniflare": "^4.20260617.1",
-    "open": "^10.1.0",
-    "sharp": "^0.35.5"
+    "open": "^10.1.0"
  },
  "engines": {
    "node": ">=24.0.0"
@@ -1,134 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import { v4 as uuidv4 } from 'uuid';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-
-import type { PuterServer } from './server.ts';
-import { createTestUser, setupTestServer } from './testUtil.ts';
-
-/**
- * Teams is optional, so core has to work when neither the service nor the store
- * is registered, which is how this test server boots.
- */
-describe('core without a teams registration', () => {
-    let server: PuterServer;
-
-    const makeUser = async (): Promise<{ id: number; username: string }> => {
-        const username = `nt_${Math.random().toString(36).slice(2, 10)}`;
-        const created = (await server.stores.user.create({
-            username,
-            uuid: uuidv4(),
-            password: null,
-            email: `${username}@test.local`,
-        })) as unknown as { id: number };
-        return { id: created.id, username };
-    };
-
-    beforeAll(async () => {
-        server = await setupTestServer({
-            // Without this the allowlist check returns before asking Teams.
-            teams_allowed_email_domains: ['test.local'],
-        } as never);
-    });
-
-    afterAll(async () => {
-        await server?.shutdown();
-    });
-
-    it('has no teams in the registry', () => {
-        expect(server.services.team).toBeUndefined();
-        expect(server.stores.team).toBeUndefined();
-    });
-
-    it('refuses to boot when the config asks for teams', async () => {
-        await expect(
-            setupTestServer({ teams_enabled: true } as never),
-        ).rejects.toThrow(/teams_enabled/);
-    });
-
-    it('deletes an account without asking what it was charged for', async () => {
-        const user = await makeUser();
-        await expect(
-            server.services.userAccount.cascadeDelete(user.id),
-        ).resolves.not.toThrow();
-        expect(await server.stores.user.getById(user.id)).toBeFalsy();
-    });
-
-    it('answers the address-claim question signup asks', async () => {
-        const user = await makeUser();
-        const row = (await server.stores.user.getById(user.id))!;
-        // Nothing is a seat, so the holder is returned as-is.
-        await expect(
-            server.services.signup.signupEmailHolder(row.email as string, {
-                releaseSeat: true,
-            }),
-        ).resolves.toMatchObject({ id: user.id });
-    });
-
-    it('lists what is shared with an account, folding in no team shares', async () => {
-        const user = await makeUser();
-        await expect(
-            server.services.share.listSharedWithMe({
-                user: { id: user.id },
-            } as never),
-        ).resolves.toMatchObject({ items: [] });
-    });
-
-    it('refuses a share aimed at a team, rather than failing', async () => {
-        // A real home directory, so the refusal is the recipient's and not
-        // the entry's.
-        const username = `nt_${Math.random().toString(36).slice(2, 10)}`;
-        const creds = await createTestUser(server, {
-            username,
-            password: 'Nt-Pw-12345!',
-        });
-        const row = (await server.stores.user.getByUsername(username))!;
-        const user = { id: row.id, username };
-        const actor = { user: row } as never;
-        expect(creds).toBeTruthy();
-        // The recipient cannot exist, so this is a 404 and not a crash.
-        await expect(
-            server.services.share.share(actor, {
-                recipient: { teamHandle: 'nobody' },
-                mode: 'read',
-                path: `/${user.username}`,
-            } as never),
-        ).rejects.toMatchObject({ statusCode: 404 });
-    });
-
-    it('serves the homepage shell with the teams tab off', async () => {
-        const user = await makeUser();
-        const row = (await server.stores.user.getById(user.id))!;
-        let html = '';
-        const res = { send: (out: string) => (html = out) };
-        await server.services.homepage.send(
-            {
-                req: { headers: {}, query: {}, get: () => undefined },
-                res,
-                actor: { user: row },
-            } as never,
-            { title: 'Puter' } as never,
-        );
-        const params = JSON.parse(
-            /gui\((\{.*?\})\);/s.exec(html)![1].replaceAll('\\u003c', '<'),
-        );
-        expect(params.teams_ui).toBe(false);
-    });
-});
@@ -108,25 +108,6 @@ describe('AbstractDatabaseClient — unimplemented surface', () => {
 });

 describe('AbstractDatabaseClient — replica-aware reads', () => {
-    it('avoids a primary read when the replica has rows in sequential mode', async () => {
-        const client = new FixtureDatabaseClient([{ id: 1 }], [{ id: 2 }]);
-        expect(
-            await client.tryHardRead('SELECT 1', [], { race: false }),
-        ).toEqual([{ id: 1 }]);
-        expect(client.preads).toEqual([]);
-    });
-
-    it.each([[], new Error('replica unavailable')])(
-        'falls back once in sequential mode',
-        async (replica) => {
-            const client = new FixtureDatabaseClient(replica, [{ id: 2 }]);
-            expect(
-                await client.tryHardRead('SELECT 1', [], { race: false }),
-            ).toEqual([{ id: 2 }]);
-            expect(client.preads).toEqual(['SELECT 1']);
-        },
-    );
-
    it('returns replica rows without waiting on the primary', async () => {
        const client = new FixtureDatabaseClient([{ id: 1 }], [{ id: 2 }]);
        await expect(client.tryHardRead('SELECT 1')).resolves.toEqual([
@@ -167,38 +148,6 @@ describe('AbstractDatabaseClient — replica-aware reads', () => {
        expect(client.reads).toEqual(['SELECT 1']);
        expect(client.preads).toEqual([]);
    });
-
-    describe('tryHardReadAll', () => {
-        const reads = [{ query: 'SELECT 1' }, { query: 'SELECT 2' }];
-
-        it('keeps replica rows without reading the primary', async () => {
-            const client = new FixtureDatabaseClient([{ id: 1 }], [{ id: 2 }]);
-            expect(await client.tryHardReadAll(reads)).toEqual([
-                [{ id: 1 }],
-                [{ id: 1 }],
-            ]);
-            expect(client.preads).toEqual([]);
-        });
-
-        it.each([[], new Error('replica unavailable')])(
-            'reads every query on the primary when the replica has none',
-            async (replica) => {
-                const client = new FixtureDatabaseClient(replica, [{ id: 2 }]);
-                expect(await client.tryHardReadAll(reads)).toEqual([
-                    [{ id: 2 }],
-                    [{ id: 2 }],
-                ]);
-                expect(client.preads).toEqual(['SELECT 1', 'SELECT 2']);
-            },
-        );
-
-        it('issues one read per query when there is no replica', async () => {
-            const client = new FixtureDatabaseClient([], [{ id: 2 }], false);
-            expect(await client.tryHardReadAll(reads)).toEqual([[], []]);
-            expect(client.reads).toEqual(['SELECT 1', 'SELECT 2']);
-            expect(client.preads).toEqual([]);
-        });
-    });
 });

 describe('AbstractDatabaseClient — SQL generation', () => {
@@ -307,28 +256,6 @@ describe('AbstractDatabaseClient — SQL generation', () => {
        expect(postgres().timestampFromUnixSql()).toBe('to_timestamp(?)');
    });

-    it('reads a timestamp column back as unix seconds in each engine', () => {
-        expect(sqlite().unixSecondsSql('`t`')).toBe(
-            "CAST(strftime('%s', `t`) AS INTEGER)",
-        );
-        expect(mysql().unixSecondsSql('`t`')).toBe('UNIX_TIMESTAMP(`t`)');
-        expect(postgres().unixSecondsSql('`t`')).toBe(
-            'EXTRACT(EPOCH FROM `t`)::bigint',
-        );
-    });
-
-    it('reads the database clock as epoch milliseconds in each dialect', () => {
-        expect(sqlite().nowMsExpr()).toBe(
-            "CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)",
-        );
-        expect(mysql().nowMsExpr()).toBe(
-            "(TIMESTAMPDIFF(MICROSECOND, '1970-01-01 00:00:00', UTC_TIMESTAMP(6)) DIV 1000)",
-        );
-        expect(postgres().nowMsExpr()).toBe(
-            'CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)',
-        );
-    });
-
    it('describes a stored timestamp the way each driver reads it back', () => {
        const seconds = Date.UTC(2026, 9, 11, 8, 5, 9) / 1000;
        expect(sqlite().timestampValue(seconds)).toBe('2026-10-11 08:05:09');
@@ -350,13 +277,3 @@ describe('AbstractDatabaseClient — SQL generation', () => {
        );
    });
 });
-
-
-it('builds an insert for batchWrite and shares it with insert', async () => {
-    const client = new FixtureDatabaseClient([]);
-    const entry = client.insertEntry('widget', { name: "reader's", enabled: true });
-    expect(entry.values).toEqual(["reader's", true]);
-    expect(entry.statement).toContain('VALUES (?, ?)');
-    await client.insert('widget', { name: "reader's", enabled: true });
-    expect(client.writes).toEqual([{ query: entry.statement, params: entry.values }]);
-});
@@ -28,12 +28,6 @@ export interface WriteResult {
    insertId: number | bigint;
    affectedRows: number;
    anyRowsAffected: boolean;
-    /**
-     * Warnings the statement raised; nonzero means a value may have been stored
-     * differently from how it was sent. Absent when the engine can't vouch that
-     * a clean insert stored exactly what was sent, on a fresh id.
-     */
-    warningStatus?: number;
 }

 export interface BatchEntry {
@@ -110,23 +104,14 @@ export class AbstractDatabaseClient extends PuterClient {
        tableName: string,
        data: Record<string, unknown>,
    ): Promise<WriteResult> {
-        const entry = this.insertEntry(tableName, data);
-        return this.write(
-            entry.statement + this.returningIdClause(),
-            entry.values,
-        );
-    }
-
-    /** An insert that can join other writes in a transaction. */
-    insertEntry(tableName: string, data: Record<string, unknown>): BatchEntry {
        const cols = Object.keys(data);
-        return {
-            statement:
-                `INSERT INTO ${this.quoteIdentifier(tableName)} ` +
-                `(${cols.map((c) => this.quoteIdentifier(c)).join(', ')}) ` +
-                `VALUES (${cols.map(() => '?').join(', ')})`,
-            values: Object.values(data),
-        };
+        const values = Object.values(data);
+        const sql =
+            `INSERT INTO ${this.quoteIdentifier(tableName)} ` +
+            `(${cols.map((c) => this.quoteIdentifier(c)).join(', ')}) ` +
+            `VALUES (${cols.map(() => '?').join(', ')})` +
+            this.returningIdClause();
+        return this.write(sql, values);
    }

    /** Whether `read()` goes to a separate replica rather than the primary. */
@@ -147,59 +132,29 @@ export class AbstractDatabaseClient extends PuterClient {

    /**
     * Like `read()`, but an empty or failed replica read falls back to the
-     * primary, so replication lag can't hide a row that was just written. By
-     * default the primary read starts alongside the replica one; `race: false`
-     * reads the primary only after the replica returns empty or fails. Without
-     * a replica this is a single `read()`.
+     * primary, so replication lag can't hide a row that was just written. The
+     * primary read starts alongside the replica one rather than after it.
+     * Without a replica this is a single `read()`.
     */
    @Span('db.tryHardRead', (query: string) => ({ 'db.statement': query }))
    async tryHardRead(
        query: string,
        params: unknown[] = [],
-        { race = true }: { race?: boolean } = {},
    ): Promise<Record<string, unknown>[]> {
        if (!this.hasReadReplica()) return this.read(query, params);

-        const primary = race ? settle(this.pread(query, params)) : null;
+        const primary = settle(this.pread(query, params));
        try {
            const rows = await this.replicaRead(query, params);
            if (rows.length > 0) return rows;
        } catch {
            // replica failed — fall through to primary
        }
-        const result = await (primary ?? settle(this.pread(query, params)));
+        const result = await primary;
        if ('error' in result) throw result.error;
        return result.value;
    }

-    /** Reads the primary only when every replica read is empty or fails. */
-    @Span('db.tryHardReadAll', (reads: unknown[]) => ({
-        'db.batch_size': reads.length,
-    }))
-    async tryHardReadAll(
-        reads: { query: string; params?: unknown[] }[],
-    ): Promise<Record<string, unknown>[][]> {
-        if (!this.hasReadReplica()) {
-            return Promise.all(
-                reads.map(({ query, params = [] }) => this.read(query, params)),
-            );
-        }
-        const onReplica = await Promise.all(
-            reads.map(async ({ query, params = [] }) => {
-                try {
-                    return await this.replicaRead(query, params);
-                } catch {
-                    // A failed replica read counts as a miss.
-                    return [];
-                }
-            }),
-        );
-        if (onReplica.some((rows) => rows.length > 0)) return onReplica;
-        return Promise.all(
-            reads.map(({ query, params = [] }) => this.pread(query, params)),
-        );
-    }
-
    /**
     * Apply the `.sql` files named `<engineName>*` in each configured migration
     * directory, in filename order. Files must be idempotent: nothing records
@@ -425,34 +380,6 @@ export class AbstractDatabaseClient extends PuterClient {
        });
    }

-    /**
-     * A timestamp column as unix seconds, computed by the database: the mysql
-     * driver reads a stored UTC timestamp as local time, so parsing it in JS
-     * can be off by the server's UTC offset.
-     */
-    unixSecondsSql(column: string): string {
-        return this.case({
-            postgres: `EXTRACT(EPOCH FROM ${column})::bigint`,
-            mysql: `UNIX_TIMESTAMP(${column})`,
-            otherwise: `CAST(strftime('%s', ${column}) AS INTEGER)`,
-        });
-    }
-
-    /**
-     * The database's own clock as epoch milliseconds, so nodes whose clocks
-     * disagree still agree on it. The mysql form ignores the session time zone,
-     * so a DST change can't shift it.
-     */
-    nowMsExpr(): string {
-        return this.case({
-            sqlite: "CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)",
-            postgres:
-                'CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)',
-            otherwise:
-                "(TIMESTAMPDIFF(MICROSECOND, '1970-01-01 00:00:00', UTC_TIMESTAMP(6)) DIV 1000)",
-        });
-    }
-
    /**
     * What a read of a timestamp column holding `seconds` returns: sqlite gives
     * back the UTC text it stored, mysql2 and pg a `Date` read in node's time
@@ -435,105 +435,6 @@ describe('MySQLDatabaseClient — query interface', () => {
        ]);
    });

-    it.each([
-        { method: 'pread', poolIndex: 0, maxTimeInQueue: 30 },
-        { method: 'read', poolIndex: 1, maxTimeInQueue: 10 },
-    ] as const)(
-        '$method: flushes lone reads at once until 8 are in flight, then waits $maxTimeInQueue ms and coalesces',
-        async ({ method, poolIndex, maxTimeInQueue }) => {
-            const client = await startClient({ replica: { host: 'replica' } });
-            const pool = createdPools[poolIndex];
-            const held: Array<() => void> = [];
-            pool.respond = (sql) =>
-                new Promise((resolve) => {
-                    const sets = sql
-                        .split(';')
-                        .slice(0, -1)
-                        .map((stmt) => [{ stmt }]);
-                    held.push(() => resolve(rowSets(...sets)));
-                });
-            vi.useFakeTimers({
-                toFake: [
-                    'setTimeout',
-                    'clearTimeout',
-                    'setImmediate',
-                    'clearImmediate',
-                ],
-            });
-            try {
-                const reads: Promise<unknown>[] = [];
-                for (let i = 0; i < 8; i++) {
-                    reads.push(client[method](`SELECT ${i}`));
-                    await vi.advanceTimersByTimeAsync(0);
-                }
-                expect(pool.calls).toHaveLength(8);
-
-                reads.push(client[method]('SELECT 8'));
-                await vi.advanceTimersByTimeAsync(maxTimeInQueue - 1);
-                reads.push(client[method]('SELECT 9'));
-                expect(pool.calls).toHaveLength(8);
-                await vi.advanceTimersByTimeAsync(1);
-                expect(pool.calls.map((c) => c.sql).at(-1)).toBe(
-                    'SELECT 8;SELECT 9; SELECT 1',
-                );
-
-                for (const release of held.splice(0)) release();
-                const rows = await Promise.all(reads);
-                expect(rows.at(-2)).toEqual([{ stmt: 'SELECT 8' }]);
-                expect(rows.at(-1)).toEqual([{ stmt: 'SELECT 9' }]);
-            } finally {
-                vi.useRealTimers();
-            }
-        },
-    );
-
-    it.each([
-        { setup: 'single node', replica: undefined, waits: true },
-        { setup: 'replica', replica: { host: 'replica' }, waits: false },
-    ])(
-        '$setup: 8 primary reads in flight hold back a lone read: $waits',
-        async ({ replica, waits }) => {
-            const client = await startClient(replica ? { replica } : {});
-            const held: Array<() => void> = [];
-            for (const pool of createdPools) {
-                pool.respond = (sql) =>
-                    new Promise((resolve) => {
-                        const sets = sql
-                            .split(';')
-                            .slice(0, -1)
-                            .map((stmt) => [{ stmt }]);
-                        held.push(() => resolve(rowSets(...sets)));
-                    });
-            }
-            const sent = () => createdPools.flatMap((pool) => pool.calls);
-            vi.useFakeTimers({
-                toFake: [
-                    'setTimeout',
-                    'clearTimeout',
-                    'setImmediate',
-                    'clearImmediate',
-                ],
-            });
-            try {
-                const reads: Promise<unknown>[] = [];
-                for (let i = 0; i < 8; i++) {
-                    reads.push(client.pread(`SELECT ${i}`));
-                    await vi.advanceTimersByTimeAsync(0);
-                }
-                reads.push(client.read('SELECT 8'));
-                await vi.advanceTimersByTimeAsync(0);
-                expect(sent()).toHaveLength(waits ? 8 : 9);
-                await vi.advanceTimersByTimeAsync(10);
-                expect(sent()).toHaveLength(9);
-
-                for (const release of held.splice(0)) release();
-                await Promise.all(reads);
-            } finally {
-                vi.useRealTimers();
-            }
-        },
-    );
-
    it('sends a write on its own, outside a transaction', async () => {
        const client = await startClient();
        const pool = createdPools[0];
@@ -571,23 +472,6 @@ describe('MySQLDatabaseClient — query interface', () => {
        });
    });

-    it('passes the warning count through, so callers can tell a clean write', async () => {
-        const client = await startClient();
-        createdPools[0].respond = () =>
-            writeHeader({ insertId: 9, affectedRows: 1, warningStatus: 1 });
-
-        await expect(
-            client.write('INSERT IGNORE INTO `user` (`username`) VALUES (?)', [
-                'ada',
-            ]),
-        ).resolves.toEqual({
-            insertId: 9,
-            affectedRows: 1,
-            anyRowsAffected: true,
-            warningStatus: 1,
-        });
-    });
-
    it('reports no rows affected when the header omits the counters', async () => {
        const client = await startClient();
        createdPools[0].respond = () => writeHeader({});
@@ -78,13 +78,8 @@ export class MySQLDatabaseClient extends AbstractDatabaseClient {
        });
        console.log('[mysql] connected to primary');

-        // Read batchers on one pool share the cap on immediate flushes.
-        const primaryReadFlushes = { count: 0 };
        this.db = this.createPrimaryBatcher(this.primaryPool);
-        this.dbPrimaryRead = this.createPrimaryReadBatcher(
-            this.primaryPool,
-            primaryReadFlushes,
-        );
+        this.dbPrimaryRead = this.createPrimaryReadBatcher(this.primaryPool);

        if (dbConf.replica) {
            this.replicaPool = this.createPool(dbConf.replica);
@@ -95,12 +90,7 @@ export class MySQLDatabaseClient extends AbstractDatabaseClient {
            this.configuration = Configuration.SINGLE;
        }

-        this.dbReplica = this.createReplicaBatcher(
-            this.replicaPool,
-            this.configuration === Configuration.SINGLE
-                ? primaryReadFlushes
-                : { count: 0 },
-        );
+        this.dbReplica = this.createReplicaBatcher(this.replicaPool);

        await this.applyMigrationPaths(
            () => this.primaryPool.promise().getConnection(),
@@ -174,14 +164,12 @@ export class MySQLDatabaseClient extends AbstractDatabaseClient {
        const header = result[0] as {
            insertId?: number;
            affectedRows?: number;
-            warningStatus?: number;
        };
        const affectedRows = header.affectedRows ?? 0;
        return {
            insertId: header.insertId ?? 0,
            affectedRows,
            anyRowsAffected: affectedRows > 0,
-            warningStatus: header.warningStatus,
        };
    }

@@ -217,8 +205,7 @@ export class MySQLDatabaseClient extends AbstractDatabaseClient {
        return this.configuration === Configuration.REPLICA;
    }

-    // No failover: `tryHardRead` falls back to the primary on an empty result
-    // or error (raced alongside by default, after the replica with `race: false`).
+    // No failover: `tryHardRead` already has a primary read in flight.
    protected override async replicaRead(
        query: string,
        params: unknown[],
@@ -287,14 +274,9 @@ export class MySQLDatabaseClient extends AbstractDatabaseClient {
    }

    /** Reads that must see the primary, still coalesced. */
-    private createPrimaryReadBatcher(
-        pool: Pool,
-        inFlight: { count: number },
-    ): SQLBatcher {
+    private createPrimaryReadBatcher(pool: Pool): SQLBatcher {
        return new SQLBatcher(pool, {
            maxTimeInQueue: 30,
-            maxInFlightImmediate: 8,
-            inFlight,
            maxBatchSize: 5,
            poolLabel: 'primary',
            readOnly: true,
@@ -302,14 +284,9 @@ export class MySQLDatabaseClient extends AbstractDatabaseClient {
        });
    }

-    private createReplicaBatcher(
-        pool: Pool,
-        inFlight: { count: number },
-    ): SQLBatcher {
+    private createReplicaBatcher(pool: Pool): SQLBatcher {
        return new SQLBatcher(pool, {
            maxTimeInQueue: 10,
-            maxInFlightImmediate: 8,
-            inFlight,
            maxBatchSize: 5,
            poolLabel: 'replica',
            readOnly: true,
@@ -76,7 +76,6 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 export class SQLBatcher {
    dbPool;
    maxTimeInQueue;
-    maxInFlightImmediate;
    maxBatchSize;
    maxQueueSize;
    failureThreshold;
@@ -85,9 +84,7 @@ export class SQLBatcher {
    readOnly;
    acquireTimeoutMs;
    queue = [];
-    #flushTimer = null;
-    #flushTimerIsImmediate = false;
-    #inFlight;
+    timeouts = [];
    #consecutiveFailures = 0;
    #lastFailureAt = 0;
    #metricAttrs;
@@ -96,11 +93,6 @@ export class SQLBatcher {
     * @param {object} dbPool Mysql2 pool
     * @param {object} [opts]
     * @param {number} [opts.maxTimeInQueue] Ms an item may wait before flush
-     * @param {number} [opts.maxInFlightImmediate] While fewer flushes than this
-     *   are in flight, a lone item flushes on the next turn instead of waiting
-     *   maxTimeInQueue; past it, items wait and coalesce to spare connections
-     * @param {{ count: number }} [opts.inFlight] In-flight flush counter the
-     *   cap reads; batchers sharing a pool can share one
     * @param {number} [opts.maxBatchSize] Items coalesced per flush
     * @param {number} [opts.maxQueueSize] Drop-oldest high-water mark
     * @param {number} [opts.failureThreshold] Consecutive failures to open the
@@ -119,8 +111,6 @@ export class SQLBatcher {
        dbPool,
        {
            maxTimeInQueue = 20,
-            maxInFlightImmediate = 0,
-            inFlight = { count: 0 },
            maxBatchSize = 50,
            maxQueueSize = DEFAULT_MAX_QUEUE_SIZE,
            failureThreshold = DEFAULT_FAILURE_THRESHOLD,
@@ -132,8 +122,6 @@ export class SQLBatcher {
    ) {
        this.dbPool = dbPool;
        this.maxTimeInQueue = maxTimeInQueue;
-        this.maxInFlightImmediate = maxInFlightImmediate;
-        this.#inFlight = inFlight;
        this.maxBatchSize = maxBatchSize;
        this.maxQueueSize = maxQueueSize;
        this.failureThreshold = failureThreshold;
@@ -197,34 +185,17 @@ export class SQLBatcher {

        if (this.queue.length >= this.maxBatchSize) {
            this.flush(this.queue.splice(0, this.maxBatchSize));
-        } else if (this.#flushTimer === null) {
-            this.#armFlushTimer();
+        } else if (this.queue.length === 1) {
+            this.timeouts.push(
+                setTimeout(() => {
+                    this.flush(this.queue.splice(0, this.queue.length));
+                }, this.maxTimeInQueue),
+            );
        }

        return promise;
    }

-    // A lone flush holds a pooled connection for a full round trip, so only
-    // the first maxInFlightImmediate flushes skip the wait.
-    #armFlushTimer() {
-        const run = () => {
-            this.#flushTimer = null;
-            this.flush(this.queue.splice(0, this.queue.length));
-        };
-        this.#flushTimerIsImmediate =
-            this.#inFlight.count < this.maxInFlightImmediate;
-        this.#flushTimer = this.#flushTimerIsImmediate
-            ? setImmediate(run)
-            : setTimeout(run, this.maxTimeInQueue);
-    }
-
-    #clearFlushTimer() {
-        if (this.#flushTimer === null) return;
-        if (this.#flushTimerIsImmediate) clearImmediate(this.#flushTimer);
-        else clearTimeout(this.#flushTimer);
-        this.#flushTimer = null;
-    }
-
    // Bounded wait for a pooled connection. Without a bound, a stalled
    // database turns every flush into an indefinite hang — nothing fails,
    // so neither the breaker nor callers' own timeouts ever engage.
@@ -281,18 +252,12 @@ export class SQLBatcher {
    }

    async flush(batch) {
-        this.#clearFlushTimer();
+        const timeout = this.timeouts.shift();
+        if (timeout && !timeout._destroyed) {
+            clearTimeout(timeout);
+        }
        if (batch.length === 0) return;

-        this.#inFlight.count++;
-        try {
-            await this.#flushBatch(batch);
-        } finally {
-            this.#inFlight.count--;
-        }
-    }
-
-    async #flushBatch(batch) {
        let connection;
        try {
            connection = await this.#acquireConnection();
@@ -69,356 +69,6 @@ const happyBatch = (sql: string) => {
    ];
 };

-// Each query on this connection waits until the test releases it, so its
-// flush stays in flight.
-const makeHeldConnection = () => {
-    const held: Array<() => void> = [];
-    const conn = makeConnection(
-        (sql) =>
-            new Promise((resolve) => {
-                held.push(() => resolve(happyBatch(sql)));
-            }),
-    );
-    const releaseAll = () => {
-        for (const release of held.splice(0)) release();
-    };
-    const sent = () => conn.query.mock.calls.map(([sql]) => sql);
-    return { conn, releaseAll, sent };
-};
-
-const fakeFlushTimers = () =>
-    vi.useFakeTimers({
-        toFake: [
-            'setTimeout',
-            'clearTimeout',
-            'setImmediate',
-            'clearImmediate',
-        ],
-    });
-
-describe('SQLBatcher flush timing', () => {
-    it('flushes a lone query on the next turn while under the in-flight cap', async () => {
-        const conn = makeConnection(happyBatch);
-        const { pool, getConnection } = makePool(conn);
-        const batcher = new SQLBatcher(pool, {
-            readOnly: true,
-            maxTimeInQueue: 60_000,
-            maxInFlightImmediate: 2,
-        });
-
-        const pending = batcher.query('SELECT a', []);
-        expect(getConnection).not.toHaveBeenCalled();
-        await new Promise((resolve) => setImmediate(resolve));
-        expect(getConnection).toHaveBeenCalledTimes(1);
-        expect((await pending)[0]).toEqual([{ n: 0 }]);
-    });
-
-    it('holds a lone query for maxTimeInQueue without an in-flight cap', async () => {
-        fakeFlushTimers();
-        try {
-            const conn = makeConnection(happyBatch);
-            const { pool, getConnection } = makePool(conn);
-            const batcher = new SQLBatcher(pool, {
-                readOnly: true,
-                maxTimeInQueue: 30,
-            });
-
-            const pending = batcher.query('SELECT a', []);
-            await vi.advanceTimersByTimeAsync(29);
-            expect(getConnection).not.toHaveBeenCalled();
-            await vi.advanceTimersByTimeAsync(1);
-            expect(getConnection).toHaveBeenCalledTimes(1);
-            expect((await pending)[0]).toEqual([{ n: 0 }]);
-        } finally {
-            vi.useRealTimers();
-        }
-    });
-
-    it('batches queries from the same turn and sends later ones separately', async () => {
-        const conn = makeConnection(happyBatch);
-        const { pool, getConnection } = makePool(conn);
-        const batcher = new SQLBatcher(pool, {
-            readOnly: true,
-            maxInFlightImmediate: 8,
-        });
-
-        const sameTurn = [
-            batcher.query('SELECT a', []),
-            batcher.query('SELECT b', []),
-            batcher.query('SELECT c', []),
-        ];
-        await new Promise((resolve) => setImmediate(resolve));
-        const nextTurn = batcher.query('SELECT d', []);
-        const results = await Promise.all([...sameTurn, nextTurn]);
-
-        expect(results.map((r) => r[0])).toEqual([
-            [{ n: 0 }],
-            [{ n: 1 }],
-            [{ n: 2 }],
-            [{ n: 0 }],
-        ]);
-        expect(getConnection).toHaveBeenCalledTimes(2);
-        expect(conn.query.mock.calls.map(([sql]) => sql)).toEqual([
-            'SELECT a;SELECT b;SELECT c; SELECT 1',
-            'SELECT d; SELECT 1',
-        ]);
-    });
-
-    it('gives a query enqueued during an in-flight flush its own flush while under the cap', async () => {
-        const { conn, releaseAll, sent } = makeHeldConnection();
-        const { pool } = makePool(conn);
-        const batcher = new SQLBatcher(pool, {
-            readOnly: true,
-            maxInFlightImmediate: 2,
-        });
-        const turn = () => new Promise((resolve) => setImmediate(resolve));
-
-        const a = batcher.query('SELECT a', []);
-        await turn();
-        const b = batcher.query('SELECT b', []);
-        await turn();
-        expect(sent()).toEqual(['SELECT a; SELECT 1', 'SELECT b; SELECT 1']);
-
-        releaseAll();
-        expect((await a)[0]).toEqual([{ n: 0 }]);
-        expect((await b)[0]).toEqual([{ n: 0 }]);
-    });
-
-    it('holds a lone query for maxTimeInQueue at the in-flight cap and coalesces what follows', async () => {
-        fakeFlushTimers();
-        try {
-            const { conn, releaseAll, sent } = makeHeldConnection();
-            const { pool } = makePool(conn);
-            const batcher = new SQLBatcher(pool, {
-                readOnly: true,
-                maxTimeInQueue: 30,
-                maxInFlightImmediate: 1,
-            });
-
-            const a = batcher.query('SELECT a', []);
-            await vi.advanceTimersByTimeAsync(0);
-            expect(sent()).toEqual(['SELECT a; SELECT 1']);
-
-            const b = batcher.query('SELECT b', []);
-            await vi.advanceTimersByTimeAsync(29);
-            const c = batcher.query('SELECT c', []);
-            expect(sent()).toHaveLength(1);
-            await vi.advanceTimersByTimeAsync(1);
-            expect(sent()).toEqual([
-                'SELECT a; SELECT 1',
-                'SELECT b;SELECT c; SELECT 1',
-            ]);
-
-            releaseAll();
-            expect((await a)[0]).toEqual([{ n: 0 }]);
-            expect((await b)[0]).toEqual([{ n: 0 }]);
-            expect((await c)[0]).toEqual([{ n: 1 }]);
-
-            // Settled flushes free the cap again.
-            const d = batcher.query('SELECT d', []);
-            await vi.advanceTimersByTimeAsync(0);
-            expect(sent()).toHaveLength(3);
-            releaseAll();
-            expect((await d)[0]).toEqual([{ n: 0 }]);
-        } finally {
-            vi.useRealTimers();
-        }
-    });
-
-    it('shares the in-flight cap between batchers given one counter', async () => {
-        fakeFlushTimers();
-        try {
-            const { conn, releaseAll, sent } = makeHeldConnection();
-            const { pool } = makePool(conn);
-            const inFlight = { count: 0 };
-            const opts = {
-                readOnly: true,
-                maxTimeInQueue: 30,
-                maxInFlightImmediate: 1,
-                inFlight,
-            };
-            const first = new SQLBatcher(pool, opts);
-            const second = new SQLBatcher(pool, opts);
-            const own = new SQLBatcher(pool, { ...opts, inFlight: undefined });
-
-            const a = first.query('SELECT a', []);
-            await vi.advanceTimersByTimeAsync(0);
-            const b = second.query('SELECT b', []);
-            const c = own.query('SELECT c', []);
-            await vi.advanceTimersByTimeAsync(0);
-            expect(sent()).toEqual([
-                'SELECT a; SELECT 1',
-                'SELECT c; SELECT 1',
-            ]);
-            await vi.advanceTimersByTimeAsync(30);
-            expect(sent()).toHaveLength(3);
-            expect(sent()[2]).toBe('SELECT b; SELECT 1');
-
-            releaseAll();
-            await Promise.all([a, b, c]);
-            expect(inFlight.count).toBe(0);
-        } finally {
-            vi.useRealTimers();
-        }
-    });
-
-    it('counts a flush as in flight until its per-item fallback settles', async () => {
-        const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-        fakeFlushTimers();
-        try {
-            const held: Array<() => void> = [];
-            const conn = makeConnection((sql) => {
-                if (isBatchQuery(sql)) throw makeError('ECONNRESET');
-                return new Promise((resolve) => {
-                    held.push(() => resolve([[{ ok: sql }], undefined]));
-                });
-            });
-            const { pool } = makePool(conn);
-            const sent = () => conn.query.mock.calls.map(([sql]) => sql);
-            const batcher = new SQLBatcher(pool, {
-                readOnly: true,
-                maxTimeInQueue: 30,
-                maxInFlightImmediate: 1,
-                acquireTimeoutMs: 0,
-            });
-
-            const a = batcher.query('SELECT a', []);
-            await vi.advanceTimersByTimeAsync(0);
-            // The batch failed; the per-item retry of `a` is still running.
-            expect(sent()).toEqual(['SELECT a; SELECT 1', 'SELECT a']);
-
-            const b = batcher.query('SELECT b', []);
-            await vi.advanceTimersByTimeAsync(29);
-            expect(sent()).toHaveLength(2);
-            await vi.advanceTimersByTimeAsync(1);
-            expect(sent()).toEqual([
-                'SELECT a; SELECT 1',
-                'SELECT a',
-                'SELECT b; SELECT 1',
-                'SELECT b',
-            ]);
-
-            for (const release of held.splice(0)) release();
-            expect((await a)[0]).toEqual([{ ok: 'SELECT a' }]);
-            expect((await b)[0]).toEqual([{ ok: 'SELECT b' }]);
-        } finally {
-            vi.useRealTimers();
-            warnSpy.mockRestore();
-        }
-    });
-
-    it('flushes a full batch at once past the cap and cancels the armed wait', async () => {
-        fakeFlushTimers();
-        try {
-            const { conn, releaseAll, sent } = makeHeldConnection();
-            const { pool, getConnection } = makePool(conn);
-            const batcher = new SQLBatcher(pool, {
-                readOnly: true,
-                maxBatchSize: 2,
-                maxTimeInQueue: 30,
-                maxInFlightImmediate: 1,
-                acquireTimeoutMs: 0,
-            });
-
-            const a = batcher.query('SELECT a', []);
-            await vi.advanceTimersByTimeAsync(0);
-            const b = batcher.query('SELECT b', []);
-            expect(vi.getTimerCount()).toBe(1);
-            const c = batcher.query('SELECT c', []);
-            expect(getConnection).toHaveBeenCalledTimes(2);
-            expect(vi.getTimerCount()).toBe(0);
-
-            // A later lone query waits its own full maxTimeInQueue.
-            await vi.advanceTimersByTimeAsync(10);
-            const d = batcher.query('SELECT d', []);
-            await vi.advanceTimersByTimeAsync(29);
-            expect(getConnection).toHaveBeenCalledTimes(2);
-            await vi.advanceTimersByTimeAsync(1);
-            expect(getConnection).toHaveBeenCalledTimes(3);
-            expect(sent()).toEqual([
-                'SELECT a; SELECT 1',
-                'SELECT b;SELECT c; SELECT 1',
-                'SELECT d; SELECT 1',
-            ]);
-
-            releaseAll();
-            await Promise.all([a, b, c, d]);
-        } finally {
-            vi.useRealTimers();
-        }
-    });
-
-    it('cancels the pending next-turn flush when a batch fills up', async () => {
-        fakeFlushTimers();
-        try {
-            const conn = makeConnection(happyBatch);
-            const { pool, getConnection } = makePool(conn);
-            const batcher = new SQLBatcher(pool, {
-                maxBatchSize: 2,
-                readOnly: true,
-                maxInFlightImmediate: 8,
-                acquireTimeoutMs: 0,
-            });
-
-            const a = batcher.query('SELECT a', []);
-            expect(vi.getTimerCount()).toBe(1);
-            const b = batcher.query('SELECT b', []);
-            expect(vi.getTimerCount()).toBe(0);
-
-            const c = batcher.query('SELECT c', []);
-            expect(vi.getTimerCount()).toBe(1);
-            await vi.runAllTimersAsync();
-            await Promise.all([a, b, c]);
-
-            expect(vi.getTimerCount()).toBe(0);
-            expect(getConnection).toHaveBeenCalledTimes(2);
-        } finally {
-            vi.useRealTimers();
-        }
-    });
-
-    it('leaves no timer armed after a failed flush, a drop or a breaker rejection', async () => {
-        const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-        fakeFlushTimers();
-        try {
-            const getConnection = vi.fn(async () => {
-                throw makeError('ECONNREFUSED');
-            });
-            const batcher = new SQLBatcher(
-                { promise: () => ({ getConnection }) },
-                {
-                    readOnly: true,
-                    maxQueueSize: 1,
-                    failureThreshold: 1,
-                    cooldownMs: 60_000,
-                    maxInFlightImmediate: 8,
-                },
-            );
-
-            const dropped = expect(
-                batcher.query('SELECT a', []),
-            ).rejects.toMatchObject({ reason: 'queueOverflow' });
-            const failed = expect(
-                batcher.query('SELECT b', []),
-            ).rejects.toMatchObject({ reason: 'connAcquire' });
-            expect(vi.getTimerCount()).toBe(1);
-            await vi.runAllTimersAsync();
-            await dropped;
-            await failed;
-            expect(vi.getTimerCount()).toBe(0);
-
-            await expect(batcher.query('SELECT c', [])).rejects.toMatchObject({
-                reason: 'breakerOpen',
-            });
-            expect(vi.getTimerCount()).toBe(0);
-            expect(batcher.queue).toHaveLength(0);
-        } finally {
-            vi.useRealTimers();
-            warnSpy.mockRestore();
-        }
-    });
-});
-
 describe('SQLBatcher', () => {
    it('resolves each batched item with its own result', async () => {
        const conn = makeConnection(happyBatch);
@@ -27,7 +27,7 @@ import { DatabaseClientFactory } from './index.js';
 import { SqliteDatabaseClient } from './SqliteDatabaseClient.js';

 /** Highest schema version the migration table can reach. */
-const CURRENT_SCHEMA_VERSION = 101;
+const CURRENT_SCHEMA_VERSION = 90;

 /**
 * These suites migrate real files on disk. Idle they finish in well under a
@@ -673,97 +673,6 @@ describe('SqliteDatabaseClient — boot and migrations', { timeout: DISK_MIGRATI
        });
    });

-    it('adds kv_share_handles.notify from 0099, off for every existing share', async () => {
-        const dir = mkdtempSync(join(tmpdir(), 'puter-sqlite-notify-'));
-        const path = join(dir, 'puter.sqlite');
-        try {
-            const before = new SqliteDatabaseClient(
-                sqliteConfig({ inMemory: false, path, targetVersion: 94 }),
-            );
-            await before.onServerStart();
-            await before.write(
-                'INSERT INTO `kv_share_handles` (`handle`, `owner_user_id`, ' +
-                    '`grantee_user_id`, `app_uid`, `key_prefix`, `permission`, ' +
-                    '`created_at`) VALUES (?, 1, 1, ?, ?, ?, 0)',
-                ['kvh-before-notify', 'os-global', 'a:', 'kv-share:x'],
-            );
-            before.onServerShutdown();
-
-            const after = new SqliteDatabaseClient(
-                sqliteConfig({ inMemory: false, path }),
-            );
-            await after.onServerStart();
-            await expect(
-                after.read(
-                    'SELECT `notify` FROM `kv_share_handles` WHERE `handle` = ?',
-                    ['kvh-before-notify'],
-                ),
-            ).resolves.toEqual([{ notify: 0 }]);
-            after.onServerShutdown();
-        } finally {
-            rmSync(dir, { recursive: true, force: true });
-        }
-    });
-
-    it('fills a share row missing its entry owner from 0103, invites left alone', async () => {
-        const dir = mkdtempSync(join(tmpdir(), 'puter-sqlite-share-owner-'));
-        const path = join(dir, 'puter.sqlite');
-        try {
-            const before = new SqliteDatabaseClient(
-                sqliteConfig({ inMemory: false, path }),
-            );
-            await before.onServerStart();
-            const [user] = (await before.read(
-                'SELECT MIN(`id`) AS id FROM `user`',
-            )) as { id: number }[];
-            await before.write(
-                'INSERT INTO `fsentries` (`uuid`, `name`, `user_id`, `modified`) ' +
-                    'VALUES (?, ?, ?, ?)',
-                ['22222222-2222-4222-8222-222222222222', 'owned.txt', user.id, 0],
-            );
-            const [entry] = (await before.read(
-                'SELECT `id` FROM `fsentries` WHERE `uuid` = ?',
-                ['22222222-2222-4222-8222-222222222222'],
-            )) as { id: number }[];
-            await before.write(
-                'INSERT INTO `share` (`uid`, `issuer_user_id`, ' +
-                    '`recipient_email`, `fsentry_id`) VALUES (?, ?, ?, ?)',
-                ['share-no-owner', user.id, '[email protected]', entry.id],
-            );
-            await before.write(
-                'INSERT INTO `share` (`uid`, `issuer_user_id`, ' +
-                    '`recipient_email`) VALUES (?, ?, ?)',
-                ['share-invite', user.id, '[email protected]'],
-            );
-            // The full schema as it stood before 0103, so 0103 reruns; 0104
-            // is undone so it can apply again after it.
-            await before.write('DROP INDEX idx_user_signup_tls_fingerprint');
-            await before.write(
-                'ALTER TABLE `user` DROP COLUMN `signup_tls_fingerprint`',
-            );
-            await before.write('PRAGMA user_version = 98');
-            before.onServerShutdown();
-
-            const after = new SqliteDatabaseClient(
-                sqliteConfig({ inMemory: false, path }),
-            );
-            await after.onServerStart();
-            await expect(
-                after.read(
-                    'SELECT `uid`, `entry_owner_user_id` FROM `share` ' +
-                        'WHERE `uid` IN (?, ?) ORDER BY `uid`',
-                    ['share-invite', 'share-no-owner'],
-                ),
-            ).resolves.toEqual([
-                { uid: 'share-invite', entry_owner_user_id: null },
-                { uid: 'share-no-owner', entry_owner_user_id: user.id },
-            ]);
-            after.onServerShutdown();
-        } finally {
-            rmSync(dir, { recursive: true, force: true });
-        }
-    });
-
    it('indexes notification.created_at for the retention sweep', async () => {
        const rows = await client.read('PRAGMA index_list(`notification`)');
        expect(rows.map((r) => String(r.name))).toContain(
@@ -771,97 +680,6 @@ describe('SqliteDatabaseClient — boot and migrations', { timeout: DISK_MIGRATI
        );
    });

-    it('indexes notification.replaced_at per mailbox slice for catch-up', async () => {
-        const columns = await client.read(
-            'PRAGMA index_info(`idx_notification_replaced`)',
-        );
-        expect(columns.map((c) => String(c.name))).toEqual([
-            'user_id',
-            'audience',
-            'app_uid',
-            'replaced_at',
-        ]);
-    });
-
-    it('keeps notification.send_key unique', async () => {
-        const rows = await client.read('PRAGMA index_list(`notification`)');
-        expect(
-            rows.find((r) => r.name === 'idx_notification_send_key'),
-        ).toMatchObject({ unique: 1 });
-        const columns = await client.read(
-            'PRAGMA index_info(`idx_notification_send_key`)',
-        );
-        expect(columns.map((c) => String(c.name))).toEqual(['send_key']);
-    });
-
-    it('creates event_user_handlers with its unique and holder indexes', async () => {
-        const columns = await client.read(
-            'PRAGMA table_info(`event_user_handlers`)',
-        );
-        expect(columns.map((c) => String(c.name))).toEqual([
-            'id',
-            'app_uid',
-            'holder_user_id',
-            'name',
-            'source',
-            'source_hash',
-            'created_at',
-            'updated_at',
-            'scope_since',
-        ]);
-        const indexes = await client.read(
-            'PRAGMA index_list(`event_user_handlers`)',
-        );
-        expect(
-            indexes.find(
-                (i) => i.name === 'idx_event_user_handlers_app_holder_name',
-            ),
-        ).toMatchObject({ unique: 1 });
-        expect(
-            indexes.find((i) => i.name === 'idx_event_user_handlers_holder_app'),
-        ).toMatchObject({ unique: 0 });
-        const columnsOf = async (index: string) =>
-            (await client.read(`PRAGMA index_info(\`${index}\`)`)).map((c) =>
-                String(c.name),
-            );
-        expect(await columnsOf('idx_event_user_handlers_app_holder_name')).toEqual(
-            ['app_uid', 'holder_user_id', 'name'],
-        );
-        expect(await columnsOf('idx_event_user_handlers_holder_app')).toEqual([
-            'holder_user_id',
-            'app_uid',
-        ]);
-    });
-
-    it('leaves event_handlers as it was', async () => {
-        const columns = await client.read('PRAGMA table_info(`event_handlers`)');
-        expect(columns.map((c) => String(c.name))).toEqual([
-            'id',
-            'app_uid',
-            'name',
-            'source',
-            'source_hash',
-            'created_at',
-            'updated_at',
-        ]);
-    });
-
-    it('adds event_subscriptions.handler_scope, app scope for existing rows', async () => {
-        const columns = await client.read(
-            'PRAGMA table_info(`event_subscriptions`)',
-        );
-        expect(columns.find((c) => c.name === 'handler_scope')).toMatchObject({
-            notnull: 1,
-            dflt_value: '0',
-        });
-        const indexes = await client.read(
-            'PRAGMA index_list(`event_subscriptions`)',
-        );
-        expect(indexes.map((i) => String(i.name))).toContain(
-            'idx_event_subscriptions_holder',
-        );
-    });
-
    it('leaves an already-migrated database untouched on a second boot', async () => {
        const dir = mkdtempSync(join(tmpdir(), 'puter-sqlite-'));
        const path = join(dir, 'nested', 'puter.sqlite');
@@ -1112,7 +930,6 @@ describe('SqliteDatabaseClient — query interface', () => {
            affectedRows: 1,
            anyRowsAffected: true,
        });
-        expect(inserted).not.toHaveProperty('warningStatus');

        const missed = await client.write(
            'UPDATE `widget` SET `name` = ? WHERE `id` = ?',
@@ -129,17 +129,6 @@ const AVAILABLE_MIGRATIONS: [number, string[]][] = [
    [87, ['0092_share-entry-owner.sql']],
    [88, ['0093_fsentries-parent-uid-index.sql']],
    [89, ['0094_deleted-apps.sql']],
-    [90, ['0095_kv-share-handle-levels.sql']],
-    [91, ['0096_kv-share-handle-quota-indexes.sql']],
-    [92, ['0097_user-to-user-holder-permission-index.sql']],
-    [93, ['0098_notification-groups.sql']],
-    [94, ['0099_kv-share-handle-notify.sql']],
-    [95, ['0100_notification-send-key.sql']],
-    [96, ['0101_user-scoped-handlers.sql']],
-    [97, ['0102_notification-scope-id-index.sql']],
-    [98, ['0103_share-entry-owner-backfill.sql']],
-    [99, ['0104_signup-tls-fingerprint.sql']],
-    [100, ['0105_sessions_kind_debug_app.sql']],
 ];

 export class SqliteDatabaseClient extends AbstractDatabaseClient {
@@ -218,9 +207,6 @@ export class SqliteDatabaseClient extends AbstractDatabaseClient {
            insertId: info.lastInsertRowid,
            affectedRows: info.changes,
            anyRowsAffected: info.changes > 0,
-            // No warningStatus: SQLite raises none, but a new row can reuse a
-            // deleted row's rowid that other tables still name, so a clean
-            // insert doesn't prove the row is all the caller sent.
        };
    }

@@ -1,50 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Share levels on `kv_share_handles`. See
-- sqlite/0095_kv-share-handle-levels.sql for the rationale. No per-file
-- applied-state tracking, so every step is guarded and a replay does nothing.
-
-CALL _puter_add_col('kv_share_handles', 'revoked_by', '`revoked_by` varchar(8) DEFAULT NULL');
-CALL _puter_add_col('kv_share_handles', 'label', '`label` varchar(512) DEFAULT NULL');
-
-DROP PROCEDURE IF EXISTS _puter_add_kv_share_handle_indexes;
-DELIMITER //
-CREATE PROCEDURE _puter_add_kv_share_handle_indexes()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_grantee'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_grantee` (`grantee_user_id`, `id`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_app'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_app` (`app_uid`);
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_kv_share_handle_indexes();
-
-DROP PROCEDURE IF EXISTS _puter_add_kv_share_handle_indexes;
@@ -1,72 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Share-handle quota, listing and purge indexes. See
-- sqlite/0096_kv-share-handle-quota-indexes.sql for what each serves. No
-- per-file applied-state tracking, so every index is guarded and a replay does
-- nothing.
-
-DROP PROCEDURE IF EXISTS _puter_add_kv_share_handle_quota_indexes;
-DELIMITER //
-CREATE PROCEDURE _puter_add_kv_share_handle_quota_indexes()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_owner_live'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_owner_live` (`owner_user_id`, `revoked_at`, `app_uid`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_owner_app'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_owner_app` (`owner_user_id`, `app_uid`, `id`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_grantee_app'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_grantee_app` (`grantee_user_id`, `app_uid`, `id`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_pair'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_pair` (`owner_user_id`, `grantee_user_id`, `revoked_at`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_revoked'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_revoked` (`revoked_at`);
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_kv_share_handle_quota_indexes();
-
-DROP PROCEDURE IF EXISTS _puter_add_kv_share_handle_quota_indexes;
@@ -1,38 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Lets a holder's grant check read only the permissions it names. Guarded, so
-- a replay does nothing.
-
-DROP PROCEDURE IF EXISTS _puter_add_u2u_holder_permission_index;
-DELIMITER //
-CREATE PROCEDURE _puter_add_u2u_holder_permission_index()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'user_to_user_permissions'
-      AND INDEX_NAME = 'idx_user_to_user_permissions_holder_permission'
-  ) THEN
-    ALTER TABLE `user_to_user_permissions` ADD INDEX `idx_user_to_user_permissions_holder_permission` (`holder_user_id`, `permission`);
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_u2u_holder_permission_index();
-
-DROP PROCEDURE IF EXISTS _puter_add_u2u_holder_permission_index;
@@ -1,53 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- `notification`.`group_key` and `replaced_at`. See
-- sqlite/0098_notification-groups.sql for the rationale. The key is a hex
-- digest, so ascii and compared byte for byte. No per-file applied-state
-- tracking, so every step is guarded and a replay does nothing.
-
-CALL _puter_add_col('notification', 'group_key', '`group_key` char(64) CHARACTER SET ascii COLLATE ascii_bin DEFAULT NULL');
-CALL _puter_add_col('notification', 'replaced_at', '`replaced_at` bigint DEFAULT NULL');
-
-DROP PROCEDURE IF EXISTS _puter_add_notification_group_indexes;
-DELIMITER //
-CREATE PROCEDURE _puter_add_notification_group_indexes()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'notification'
-      AND INDEX_NAME = 'idx_notification_group'
-  ) THEN
-    ALTER TABLE `notification` ADD INDEX `idx_notification_group`
-      (`user_id`, `app_uid`, `group_key`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'notification'
-      AND INDEX_NAME = 'idx_notification_replaced'
-  ) THEN
-    ALTER TABLE `notification` ADD INDEX `idx_notification_replaced`
-      (`user_id`, `audience`, `app_uid`, `replaced_at`);
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_notification_group_indexes();
-
-DROP PROCEDURE IF EXISTS _puter_add_notification_group_indexes;
@@ -1,23 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Notifications through a share handle. See
-- sqlite/0099_kv-share-handle-notify.sql for the column. No per-file
-- applied-state tracking, so it goes through _puter_add_col and a replay does
-- nothing.
-
-CALL _puter_add_col('kv_share_handles', 'notify', '`notify` tinyint(1) NOT NULL DEFAULT 0');
@@ -1,43 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- `notification`.`send_key`. See sqlite/0100_notification-send-key.sql for the
-- rationale. The key is a uuid, so ascii and compared byte for byte. No
-- per-file applied-state tracking, so every step is guarded and a replay does
-- nothing.
-
-CALL _puter_add_col('notification', 'send_key', '`send_key` char(36) CHARACTER SET ascii COLLATE ascii_bin DEFAULT NULL');
-
-DROP PROCEDURE IF EXISTS _puter_add_notification_send_key_index;
-DELIMITER //
-CREATE PROCEDURE _puter_add_notification_send_key_index()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'notification'
-      AND INDEX_NAME = 'idx_notification_send_key'
-  ) THEN
-    ALTER TABLE `notification` ADD UNIQUE KEY `idx_notification_send_key`
-      (`send_key`), ALGORITHM=INPLACE, LOCK=NONE;
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_notification_send_key_index();
-
-DROP PROCEDURE IF EXISTS _puter_add_notification_send_key_index;
@@ -1,66 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Handlers an app's user published into their own scope, kept apart from
-- `event_handlers` so code that predates them never reads them. See
-- sqlite/0101_user-scoped-handlers.sql for the column rationale.
--
-- Idempotent: `CREATE TABLE IF NOT EXISTS` with the indexes declared inline,
-- and a guarded column add. There is no per-file applied-state tracking, so a
-- replay has to be a no-op.
-
-CREATE TABLE IF NOT EXISTS `event_user_handlers` (
-    `id` bigint unsigned NOT NULL AUTO_INCREMENT,
-    -- Matches `apps`.`uid` exactly, charset included, so an equality against
-    -- one never falls back to a conversion.
-    `app_uid` char(40) CHARACTER SET latin1 COLLATE latin1_swedish_ci NOT NULL,
-    `holder_user_id` int unsigned NOT NULL,
-    `name` varchar(128) NOT NULL,
-    `source` mediumtext NOT NULL,
-    `source_hash` char(64) NOT NULL,
-    `created_at` bigint NOT NULL,
-    `updated_at` bigint NOT NULL,
-    -- When the scope first held a handler; kept across handler churn, so the
-    -- rent sweep sees the scope's age, not its oldest remaining handler's.
-    `scope_since` bigint NOT NULL,
-    PRIMARY KEY (`id`),
-    UNIQUE KEY `idx_event_user_handlers_app_holder_name` (`app_uid`, `holder_user_id`, `name`),
-    KEY `idx_event_user_handlers_holder_app` (`holder_user_id`, `app_uid`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
-- Guarded here rather than through `_puter_add_col`, so the file also applies
-- on its own to a database that never ran the earlier migrations.
-DROP PROCEDURE IF EXISTS _puter_add_event_subscriptions_handler_scope;
-DELIMITER //
-CREATE PROCEDURE _puter_add_event_subscriptions_handler_scope()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.COLUMNS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'event_subscriptions'
-      AND COLUMN_NAME = 'handler_scope'
-  ) THEN
-    ALTER TABLE `event_subscriptions`
-      ADD COLUMN `handler_scope` tinyint unsigned NOT NULL DEFAULT 0,
-      ALGORITHM=INSTANT;
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_event_subscriptions_handler_scope();
-
-DROP PROCEDURE IF EXISTS _puter_add_event_subscriptions_handler_scope;
@@ -1,41 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- `notification` (`user_id`, `audience`, `app_uid`, `id`). See
-- sqlite/0102_notification-scope-id-index.sql for the rationale. No per-file
-- applied-state tracking, so the index is added only when missing and a
-- replay does nothing.
-
-DROP PROCEDURE IF EXISTS _puter_add_notification_scope_id_index;
-DELIMITER //
-CREATE PROCEDURE _puter_add_notification_scope_id_index()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'notification'
-      AND INDEX_NAME = 'idx_notification_scope_id'
-  ) THEN
-    ALTER TABLE `notification` ADD INDEX `idx_notification_scope_id`
-      (`user_id`, `audience`, `app_uid`, `id`), ALGORITHM=INPLACE, LOCK=NONE;
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_notification_scope_id_index();
-
-DROP PROCEDURE IF EXISTS _puter_add_notification_scope_id_index;
@@ -1,25 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Fills `share`.`entry_owner_user_id` on any row that names an entry but was
-- written without the owner. Mirrors SQLite migration 0103. No per-file
-- applied-state tracking; a replay finds nothing to fill.
-
-UPDATE `share` JOIN `fsentries` ON `fsentries`.`id` = `share`.`fsentry_id`
-SET `share`.`entry_owner_user_id` = `fsentries`.`user_id`
-WHERE `share`.`fsentry_id` IS NOT NULL
-  AND `share`.`entry_owner_user_id` IS NULL;
@@ -1,51 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- `user`.`signup_tls_fingerprint`. See
-- sqlite/0104_signup-tls-fingerprint.sql for the rationale. No per-file
-- applied-state tracking, so the column and index are added only when missing
-- and a replay does nothing.
-
-DROP PROCEDURE IF EXISTS _puter_add_user_signup_tls_fingerprint;
-DELIMITER //
-CREATE PROCEDURE _puter_add_user_signup_tls_fingerprint()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.COLUMNS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'user'
-      AND COLUMN_NAME = 'signup_tls_fingerprint'
-  ) THEN
-    ALTER TABLE `user`
-      ADD COLUMN `signup_tls_fingerprint` varchar(64) DEFAULT NULL,
-      ALGORITHM=INSTANT;
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'user'
-      AND INDEX_NAME = 'idx_user_signup_tls_fingerprint'
-  ) THEN
-    ALTER TABLE `user` ADD INDEX `idx_user_signup_tls_fingerprint`
-      (`signup_tls_fingerprint`), ALGORITHM=INPLACE, LOCK=NONE;
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_user_signup_tls_fingerprint();
-
-DROP PROCEDURE IF EXISTS _puter_add_user_signup_tls_fingerprint;
@@ -1,46 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Add 'debug_app' to the `sessions.kind` ENUM: a short-lived app session an
-- operator creates on a user's behalf. Mirrors SQLite migration 0105.
--
-- Idempotent: guarded against COLUMN_TYPE so re-running the directory is a
-- no-op once 'debug_app' is in the ENUM.
-
-DROP PROCEDURE IF EXISTS _puter_sessions_kind_debug_app;
-DELIMITER //
-CREATE PROCEDURE _puter_sessions_kind_debug_app()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.COLUMNS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'sessions'
-      AND COLUMN_NAME = 'kind'
-      AND FIND_IN_SET('debug_app', REPLACE(REPLACE(REPLACE(COLUMN_TYPE, 'enum(', ''), ')', ''), '''', '')) > 0
-  ) THEN
-    ALTER TABLE `sessions`
-      MODIFY COLUMN `kind`
-        ENUM('web', 'app', 'access_token', 'asset', 'worker', 'debug_app')
-        NOT NULL DEFAULT 'web',
-      ALGORITHM=INSTANT;
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_sessions_kind_debug_app();
-
-DROP PROCEDURE IF EXISTS _puter_sessions_kind_debug_app;
@@ -1,29 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Share levels on kv_share_handles. See
-- sqlite/0095_kv-share-handle-levels.sql for the rationale. Idempotent via
-- IF NOT EXISTS; there is no per-file applied-state tracking.
-
-ALTER TABLE kv_share_handles ADD COLUMN IF NOT EXISTS revoked_by VARCHAR(8) DEFAULT NULL;
-ALTER TABLE kv_share_handles ADD COLUMN IF NOT EXISTS label VARCHAR(512) DEFAULT NULL;
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_grantee
-    ON kv_share_handles (grantee_user_id, id);
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_app
-    ON kv_share_handles (app_uid);
@@ -1,35 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Share-handle quota, listing and purge indexes. See
-- sqlite/0096_kv-share-handle-quota-indexes.sql for what each serves.
-- Idempotent via IF NOT EXISTS; there is no per-file applied-state tracking.
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_owner_live
-    ON kv_share_handles (owner_user_id, revoked_at, app_uid);
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_owner_app
-    ON kv_share_handles (owner_user_id, app_uid, id);
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_grantee_app
-    ON kv_share_handles (grantee_user_id, app_uid, id);
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_pair
-    ON kv_share_handles (owner_user_id, grantee_user_id, revoked_at);
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_revoked
-    ON kv_share_handles (revoked_at);
@@ -1,21 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Lets a holder's grant check read only the permissions it names.
-
-CREATE INDEX IF NOT EXISTS idx_user_to_user_permissions_holder_permission
-    ON user_to_user_permissions (holder_user_id, permission);
@@ -1,29 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- notification.group_key and replaced_at. See
-- sqlite/0098_notification-groups.sql for the rationale. Idempotent via IF NOT
-- EXISTS.
-
-ALTER TABLE notification ADD COLUMN IF NOT EXISTS group_key varchar(64) DEFAULT NULL;
-ALTER TABLE notification ADD COLUMN IF NOT EXISTS replaced_at bigint DEFAULT NULL;
-
-CREATE INDEX IF NOT EXISTS idx_notification_group
-    ON notification (user_id, app_uid, group_key);
-
-CREATE INDEX IF NOT EXISTS idx_notification_replaced
-    ON notification (user_id, audience, app_uid, replaced_at);
@@ -1,22 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Notifications through a share handle. See
-- sqlite/0099_kv-share-handle-notify.sql for the column. Idempotent via
-- IF NOT EXISTS; there is no per-file applied-state tracking.
-
-ALTER TABLE kv_share_handles ADD COLUMN IF NOT EXISTS notify smallint NOT NULL DEFAULT 0;
@@ -1,24 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- notification.send_key. See sqlite/0100_notification-send-key.sql for the
-- rationale. Idempotent via IF NOT EXISTS.
-
-ALTER TABLE notification ADD COLUMN IF NOT EXISTS send_key char(36) DEFAULT NULL;
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_notification_send_key
-    ON notification (send_key);
@@ -1,39 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Handlers an app's user published into their own scope. See
-- sqlite/0101_user-scoped-handlers.sql for the column rationale.
-- Idempotent via IF NOT EXISTS.
-
-CREATE TABLE IF NOT EXISTS event_user_handlers (
-    id BIGSERIAL PRIMARY KEY,
-    app_uid VARCHAR(40) NOT NULL,
-    holder_user_id INTEGER NOT NULL,
-    name VARCHAR(128) NOT NULL,
-    source TEXT NOT NULL,
-    source_hash VARCHAR(64) NOT NULL,
-    created_at BIGINT NOT NULL,
-    updated_at BIGINT NOT NULL,
-    scope_since BIGINT NOT NULL
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_event_user_handlers_app_holder_name
-    ON event_user_handlers (app_uid, holder_user_id, name);
-CREATE INDEX IF NOT EXISTS idx_event_user_handlers_holder_app
-    ON event_user_handlers (holder_user_id, app_uid);
-
-ALTER TABLE event_subscriptions ADD COLUMN IF NOT EXISTS handler_scope smallint NOT NULL DEFAULT 0;
@@ -1,23 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- notification (user_id, audience, app_uid, id). See
-- sqlite/0102_notification-scope-id-index.sql for the rationale. Idempotent via
-- IF NOT EXISTS.
-
-CREATE INDEX IF NOT EXISTS idx_notification_scope_id
-    ON notification (user_id, audience, app_uid, id);
@@ -1,27 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Fills "share".entry_owner_user_id on any row that names an entry but was
-- written without the owner. Mirrors SQLite migration 0103. No per-file
-- applied-state tracking; a replay finds nothing to fill.
-
-UPDATE "share"
-SET entry_owner_user_id = f.user_id
-FROM fsentries f
-WHERE f.id = "share".fsentry_id
-  AND "share".fsentry_id IS NOT NULL
-  AND "share".entry_owner_user_id IS NULL;
@@ -1,22 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- "user".signup_tls_fingerprint. Mirrors SQLite migration 0104. Idempotent
-- via IF NOT EXISTS.
-
-ALTER TABLE "user" ADD COLUMN IF NOT EXISTS signup_tls_fingerprint varchar(64);
-CREATE INDEX IF NOT EXISTS idx_user_signup_tls_fingerprint ON "user" (signup_tls_fingerprint);
@@ -1,24 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Add 'debug_app' to the `sessions.kind` CHECK constraint: a short-lived app
-- session an operator creates on a user's behalf. Mirrors SQLite migration
-- 0105. Drop-then-add keeps it idempotent across directory replays.
-
-ALTER TABLE sessions DROP CONSTRAINT IF EXISTS sessions_kind_check;
-ALTER TABLE sessions ADD CONSTRAINT sessions_kind_check
-    CHECK (kind IN ('web', 'app', 'access_token', 'asset', 'worker', 'debug_app'));
@@ -1,35 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- What share levels need from `kv_share_handles`. The level itself is not a
-- column: it is the root of the stored `permission`.
--
--   - `revoked_by` : `owner`, `holder` or `system` (the namespace app was
--                    deleted). Null while live, and on rows retired before
--                    this existed.
--   - `label`      : optional owner-set text the holder is shown.
--   - the grantee index serves the holder's listing and their unshare, and
--     the app index retiring a deleted app's handles.
-
-ALTER TABLE `kv_share_handles` ADD COLUMN `revoked_by` TEXT DEFAULT NULL;
-ALTER TABLE `kv_share_handles` ADD COLUMN `label` TEXT DEFAULT NULL;
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_grantee`
-    ON `kv_share_handles` (`grantee_user_id`, `id`);
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_app`
-    ON `kv_share_handles` (`app_uid`);
@@ -1,42 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Indexes behind the share-handle quotas, the app-filtered listings and the
-- retention purge on `kv_share_handles`.
--
--   - owner_live  : the owner's live count, in total and per app, read off
--                   the index alone.
--   - owner_app   : the owner's listing narrowed to one app, in id order.
--   - grantee_app : the holder's listing narrowed to one app, in id order.
--   - pair        : live handles one owner holds out to one holder, counted at
--                   mint and walked on revoke and unshare.
--   - revoked     : retired rows past retention, for the purge.
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_owner_live`
-    ON `kv_share_handles` (`owner_user_id`, `revoked_at`, `app_uid`);
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_owner_app`
-    ON `kv_share_handles` (`owner_user_id`, `app_uid`, `id`);
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_grantee_app`
-    ON `kv_share_handles` (`grantee_user_id`, `app_uid`, `id`);
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_pair`
-    ON `kv_share_handles` (`owner_user_id`, `grantee_user_id`, `revoked_at`);
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_revoked`
-    ON `kv_share_handles` (`revoked_at`);
@@ -1,21 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Lets a holder's grant check read only the permissions it names.
-
-CREATE INDEX IF NOT EXISTS `idx_user_to_user_permissions_holder_permission`
-    ON `user_to_user_permissions` (`holder_user_id`, `permission`);
@@ -1,38 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- What app message groups need from `notification`:
--
--   - `group_key`   : a sha256 hex digest of an app message's `group`, so the
--                     notification a newer one replaces is found by index.
--                     Null on every other row, and on rows written before
--                     this, which therefore never match.
--   - `replaced_at` : epoch milliseconds of the last replacement, null for a
--                     row never replaced. Live and fetched copies carry it as
--                     their version, so a client can tell a replacement from a
--                     copy it already has. Indexed per mailbox slice, so a
--                     catch-up reads the rows replaced since its cursor
--                     without scanning the ones that never were.
-
-ALTER TABLE `notification` ADD COLUMN `group_key` TEXT DEFAULT NULL;
-ALTER TABLE `notification` ADD COLUMN `replaced_at` INTEGER DEFAULT NULL;
-
-CREATE INDEX IF NOT EXISTS `idx_notification_group`
-    ON `notification` (`user_id`, `app_uid`, `group_key`);
-
-CREATE INDEX IF NOT EXISTS `idx_notification_replaced`
-    ON `notification` (`user_id`, `audience`, `app_uid`, `replaced_at`);
@@ -1,23 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Whether the two parties of a share may send each other notifications through
-- its handle. Off by default, so every existing share reads as not allowing
-- them.
-
-ALTER TABLE `kv_share_handles`
-    ADD COLUMN `notify` INTEGER NOT NULL DEFAULT 0;
@@ -1,27 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- `notification`.`send_key`: the key of the delayed send (a `deferred`
-- schedule) that wrote this row or last replaced it, derived from the
-- schedule and its slot. Unique, so one slot can never write two rows, and a
-- send that crashed after writing finds its row again by it. Null on every row
-- a delayed send never touched.
-
-ALTER TABLE `notification` ADD COLUMN `send_key` TEXT DEFAULT NULL;
-
-CREATE UNIQUE INDEX IF NOT EXISTS `idx_notification_send_key`
-    ON `notification` (`send_key`);
@@ -1,48 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Handlers an app's user published into their own scope, in a table of their
-- own so `event_handlers` stays the app owner's set. Same columns as
-- `event_handlers` (see 0076_event-handlers.sql) plus the holder.
--
--   - `holder_user_id` : the user whose scope this is. A name is unique per
--                        (app, holder), so the same name can live in the app's
--                        set and in each holder's.
--   - `(holder_user_id, app_uid)` : a holder's scopes, for listing and for the
--                        rent count.
--
-- `event_subscriptions.handler_scope` says which table a row's `handler_name`
-- refers to: 0 the app's set, 1 the row holder's scope.
-
-CREATE TABLE IF NOT EXISTS `event_user_handlers` (
-    "id" INTEGER PRIMARY KEY AUTOINCREMENT,
-    "app_uid" TEXT NOT NULL,
-    "holder_user_id" INTEGER NOT NULL,
-    "name" TEXT NOT NULL,
-    "source" TEXT NOT NULL,
-    "source_hash" TEXT NOT NULL,
-    "created_at" INTEGER NOT NULL,    -- unix seconds
-    "updated_at" INTEGER NOT NULL,
-    "scope_since" INTEGER NOT NULL    -- unix seconds; the scope's first handler, kept across churn
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS `idx_event_user_handlers_app_holder_name`
-    ON `event_user_handlers` (`app_uid`, `holder_user_id`, `name`);
-CREATE INDEX IF NOT EXISTS `idx_event_user_handlers_holder_app`
-    ON `event_user_handlers` (`holder_user_id`, `app_uid`);
-
-ALTER TABLE `event_subscriptions` ADD COLUMN `handler_scope` INTEGER NOT NULL DEFAULT 0;
@@ -1,22 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Index a mailbox slice by row id, so a fetch finds the newest row of a slice,
-- and pages forward through one, with a seek rather than a scan of the slice.
-
-CREATE INDEX IF NOT EXISTS `idx_notification_scope_id`
-    ON `notification` (`user_id`, `audience`, `app_uid`, `id`);
@@ -1,27 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Fills `share`.`entry_owner_user_id` on any row that names an entry but was
-- written without the owner, so reads can rely on the column alone. Rows that
-- name no entry (invites) keep a NULL owner. A replay finds nothing to fill.
-
-UPDATE `share`
-SET `entry_owner_user_id` = (
-        SELECT `user_id` FROM `fsentries` WHERE `fsentries`.`id` = `share`.`fsentry_id`
-    )
-WHERE `fsentry_id` IS NOT NULL
-  AND `entry_owner_user_id` IS NULL;
@@ -1,22 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- `user`.`signup_tls_fingerprint`: the TLS fingerprint of the request that
-- created the account, when a fronting proxy supplies one. Indexed so the
-- accounts created from one TLS stack can be listed.
-ALTER TABLE `user` ADD COLUMN `signup_tls_fingerprint` varchar(64) DEFAULT NULL;
-CREATE INDEX IF NOT EXISTS idx_user_signup_tls_fingerprint ON `user` (`signup_tls_fingerprint`);
@@ -1,89 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Add 'debug_app' to the `kind` CHECK constraint on `sessions`. Mirrors the
-- MySQL ENUM extension in mysql_mig_59.
--
-- SQLite cannot ALTER a CHECK constraint in place, so we follow the same
-- table-rebuild as migration 0056: create `sessions_new` with the corrected
-- constraint, copy rows, drop the old table, rename, then recreate every
-- index that lived on the original.
-
-CREATE TABLE `sessions_new` (
-    "id" INTEGER PRIMARY KEY AUTOINCREMENT,
-    "user_id" INTEGER NOT NULL,
-    "uuid" TEXT NOT NULL,
-    "meta" JSON DEFAULT NULL,
-    "created_at" INTEGER DEFAULT 0,
-    "last_activity" INTEGER DEFAULT 0,
-    "kind" TEXT NOT NULL DEFAULT 'web'
-        CHECK (`kind` IN ('web', 'app', 'access_token', 'asset', 'worker', 'debug_app')),
-    "label" TEXT,
-    "parent_session_id" TEXT,
-    "last_ip" TEXT,
-    "last_user_agent" TEXT,
-    "revoked_at" INTEGER,
-    "expires_at" INTEGER,
-    "app_uid" TEXT,
-    "legacy_token_uid" TEXT,
-    "created_via" TEXT,
-    "auth_id" TEXT,
-    "access_token_uid" TEXT,
-    FOREIGN KEY("user_id") REFERENCES "user" ("id") ON DELETE CASCADE ON UPDATE CASCADE
-);
-
-INSERT INTO `sessions_new` (
-    `id`, `user_id`, `uuid`, `meta`, `created_at`, `last_activity`,
-    `kind`, `label`, `parent_session_id`, `last_ip`, `last_user_agent`,
-    `revoked_at`, `expires_at`, `app_uid`, `legacy_token_uid`,
-    `created_via`, `auth_id`, `access_token_uid`
-)
-SELECT
-    `id`, `user_id`, `uuid`, `meta`, `created_at`, `last_activity`,
-    `kind`, `label`, `parent_session_id`, `last_ip`, `last_user_agent`,
-    `revoked_at`, `expires_at`, `app_uid`, `legacy_token_uid`,
-    `created_via`, `auth_id`, `access_token_uid`
-FROM `sessions`;
-
-DROP TABLE `sessions`;
-
-ALTER TABLE `sessions_new` RENAME TO `sessions`;
-
-CREATE INDEX IF NOT EXISTS `idx_sessions_user_revoked`
-    ON `sessions` (`user_id`, `revoked_at`);
-
-CREATE INDEX IF NOT EXISTS `idx_sessions_parent`
-    ON `sessions` (`parent_session_id`);
-
-CREATE UNIQUE INDEX IF NOT EXISTS `idx_sessions_user_app_active`
-    ON `sessions` (`user_id`, `app_uid`)
-    WHERE `kind` = 'app' AND `revoked_at` IS NULL;
-
-CREATE UNIQUE INDEX IF NOT EXISTS `idx_sessions_legacy_token_active`
-    ON `sessions` (`legacy_token_uid`)
-    WHERE `legacy_token_uid` IS NOT NULL AND `revoked_at` IS NULL;
-
-CREATE INDEX IF NOT EXISTS `idx_sessions_kind_user`
-    ON `sessions` (`kind`, `user_id`);
-
-CREATE INDEX IF NOT EXISTS `idx_sessions_access_token_uid`
-    ON `sessions` (`access_token_uid`)
-    WHERE `access_token_uid` IS NOT NULL;
-
-CREATE UNIQUE INDEX IF NOT EXISTS `idx_sessions_user_worker_active`
-    ON `sessions` (`user_id`, IFNULL(`app_uid`, ''), json_extract(`meta`, '$.worker_name'))
-    WHERE `kind` = 'worker' AND `revoked_at` IS NULL;
@@ -188,47 +188,6 @@ describe('DDBClient — item operations', () => {
        ).toBeUndefined();
    });

-    it('puts only while its condition holds', async () => {
-        const absent = {
-            expression: 'attribute_not_exists(#pk)',
-            names: { '#pk': 'pk' },
-        };
-        await client.put(
-            TABLE,
-            { pk: 'u7', sk: 'once', v: 1 },
-            {
-                condition: absent,
-            },
-        );
-        await expect(
-            client.put(
-                TABLE,
-                { pk: 'u7', sk: 'once', v: 2 },
-                {
-                    condition: absent,
-                },
-            ),
-        ).rejects.toMatchObject({ name: 'ConditionalCheckFailedException' });
-        expect(
-            (await client.get(TABLE, { pk: 'u7', sk: 'once' })).Item?.v,
-        ).toBe(1);
-
-        await client.put(
-            TABLE,
-            { pk: 'u7', sk: 'once', v: 3 },
-            {
-                condition: {
-                    expression: '#v = :held',
-                    names: { '#v': 'v' },
-                    values: { ':held': 1 },
-                },
-            },
-        );
-        expect(
-            (await client.get(TABLE, { pk: 'u7', sk: 'once' })).Item?.v,
-        ).toBe(3);
-    });
-
    it('fetches keys from several tables in one batch', async () => {
        await client.put(TABLE, { pk: 'b1', sk: 'a', v: 1 });
        await client.put(TABLE, { pk: 'b1', sk: 'b', v: 2 });
@@ -542,19 +501,6 @@ describe('DDBClient — credentialled configuration', () => {
        ).toThrow('requires both `access_key` and `secret_key`');
    });

-    it('accepts the credential chain in place of keys', async () => {
-        const client = new DDBClient({
-            port: 0,
-            extensions: [],
-            dynamo: {
-                aws: { useCredentialChain: true, region: 'us-west-2' },
-                endpoint: 'http://127.0.0.1:1',
-            },
-        } as unknown as IConfig);
-
-        await expect(client.recreateClient()).resolves.toBeUndefined();
-    });
-
    it('skips table creation on a managed deployment', async () => {
        const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
        const client = new DDBClient({
@@ -43,10 +43,6 @@ import { once } from 'node:events';
 import { Agent as httpsAgent } from 'node:https';
 import { HttpError } from '../../core/http';
 import type { IConfig, IDynamoConfig } from '../../types';
-import {
-    awsCredentialsFrom,
-    type AwsCredentials,
-} from '../../util/awsCredentials.js';
 import { BoundedTtlMap } from '../../util/boundedTtlMap.js';
 import { runWithConcurrencyLimitSettled } from '../../util/concurrency.js';
 import { Span } from '../../util/span.js';
@@ -252,19 +248,7 @@ export class DDBClient extends PuterClient {
    }

    @Span('ddb.put', (table: string) => ({ 'db.table': table }))
-    async put<T extends Record<string, unknown>>(
-        table: string,
-        item: T,
-        opts?: {
-            /** Refused (`ConditionalCheckFailedException`) unless it holds. */
-            condition?: {
-                expression: string;
-                names?: Record<string, string>;
-                values?: Record<string, unknown>;
-            };
-        },
-    ) {
-        const condition = opts?.condition;
+    async put<T extends Record<string, unknown>>(table: string, item: T) {
        const client = await this.#getDocumentClient();
        return sendRepairingValues(
            item,
@@ -274,23 +258,6 @@ export class DDBClient extends PuterClient {
                        TableName: table,
                        Item: itemToWrite,
                        ReturnConsumedCapacity: 'TOTAL',
-                        ...(condition
-                            ? {
-                                  ConditionExpression: condition.expression,
-                                  ...(condition.names
-                                      ? {
-                                            ExpressionAttributeNames:
-                                                condition.names,
-                                        }
-                                      : {}),
-                                  ...(condition.values
-                                      ? {
-                                            ExpressionAttributeValues:
-                                                condition.values,
-                                        }
-                                      : {}),
-                              }
-                            : {}),
                    }),
                ),
            () => `a put to ${table}`,
@@ -534,8 +501,6 @@ export class DDBClient extends PuterClient {
            scanIndexForward?: boolean;
            beginsWith?: { key: string; value: string };
            select?: 'COUNT';
-            /** Attributes to return instead of the whole item. */
-            projection?: string[];
            filter?: {
                expression: string;
                values?: Record<string, unknown>;
@@ -576,10 +541,6 @@ export class DDBClient extends PuterClient {
            Object.assign(expressionAttributeValues, options.filter.values);
            Object.assign(expressionAttributeNames, options.filter.names);
        }
-        const projection = (options?.projection ?? []).map((name) => {
-            expressionAttributeNames[`#p_${name}`] = name;
-            return `#p_${name}`;
-        });

        const command = new QueryCommand({
            TableName: table,
@@ -594,9 +555,6 @@ export class DDBClient extends PuterClient {
                ? { FilterExpression: options.filter.expression }
                : {}),
            ...(options?.select ? { Select: options.select } : {}),
-            ...(projection.length > 0
-                ? { ProjectionExpression: projection.join(', ') }
-                : {}),
            ...(options?.scanIndexForward !== undefined
                ? { ScanIndexForward: options.scanIndexForward }
                : {}),
@@ -730,15 +688,17 @@ export class DDBClient extends PuterClient {
    }

    #bindAwsClient() {
-        const credentials = awsCredentialsFrom(this.#ddbConfig.aws);
-        if (!credentials) {
+        const accessKeyId = this.#ddbConfig.aws?.access_key;
+        const secretAccessKey = this.#ddbConfig.aws?.secret_key;
+
+        if (!accessKeyId || !secretAccessKey) {
            throw new Error(
-                'DynamoDB aws config requires both `access_key` and `secret_key`, or `useCredentialChain`',
+                'DynamoDB aws config requires both `access_key` and `secret_key`',
            );
        }

        this.#bindClient({
-            credentials,
+            credentials: { accessKeyId, secretAccessKey },
            region: this.#ddbConfig.aws?.region || 'us-west-2',
            endpoint: this.#ddbConfig.endpoint,
        });
@@ -760,7 +720,7 @@ export class DDBClient extends PuterClient {
        region,
        endpoint,
    }: {
-        credentials: AwsCredentials;
+        credentials: { accessKeyId: string; secretAccessKey: string };
        region: string;
        endpoint?: string;
    }) {
@@ -168,204 +168,6 @@ describe('EmailClient — sending', () => {
    });
 });

-describe('EmailClient — streams', () => {
-    const STREAMS = {
-        notify: {
-            from: '"Notices" <[email protected]>',
-            headers: { 'X-Example-Stream': 'notify', 'X-Example-Kind': 'n' },
-            tagsHeader: 'X-Example-Tags',
-        },
-        plain: { headers: { 'X-Example-Stream': 'plain' } },
-    };
-    const streamClient = () =>
-        startClient({
-            email: { jsonTransport: true, from: FROM, streams: STREAMS },
-        } as unknown as Partial<IConfig>);
-    const base = { to: '[email protected]', subject: 's', text: 't' };
-
-    it('adds the stream headers and from address to the message', async () => {
-        const info = await streamClient().sendRaw({
-            ...base,
-            stream: 'notify',
-        });
-
-        const message = sentMessage(info);
-        expect(message.headers).toMatchObject({
-            'X-Example-Stream': 'notify',
-            'X-Example-Kind': 'n',
-        });
-        expect(message.from.address).toBe('[email protected]');
-    });
-
-    it('lets caller headers and from win over the stream', async () => {
-        const info = await streamClient().sendRaw({
-            ...base,
-            stream: 'notify',
-            from: '[email protected]',
-            headers: { 'x-example-stream': 'mine' },
-        });
-
-        const message = sentMessage(info);
-        expect(message.from.address).toBe('[email protected]');
-        expect(message.headers?.['x-example-stream']).toBe('mine');
-        expect(message.headers).not.toHaveProperty('X-Example-Stream');
-        expect(message.headers?.['X-Example-Kind']).toBe('n');
-    });
-
-    it('keeps the default from address for a stream without one', async () => {
-        const info = await streamClient().sendRaw({ ...base, stream: 'plain' });
-        expect(sentMessage(info).from.address).toBe('[email protected]');
-    });
-
-    it('leaves the message unchanged for an unknown or missing stream', async () => {
-        const client = streamClient();
-        for (const stream of ['nope', undefined]) {
-            const message = sentMessage(
-                await client.sendRaw({ ...base, stream, tags: { a: 'b' } }),
-            );
-            expect(message.from.address).toBe('[email protected]');
-            expect(message.headers ?? {}).toEqual({});
-        }
-    });
-
-    it('renders valid tags into the stream tags header and drops the rest', async () => {
-        const info = await streamClient().sendRaw({
-            ...base,
-            stream: 'notify',
-            tags: {
-                kind: 'share',
-                'app.id': 'a-1:x',
-                'bad key': 'v',
-                ok: 'bad value',
-                long: 'x'.repeat(129),
-            },
-        });
-        expect(sentMessage(info).headers?.['X-Example-Tags']).toBe(
-            'kind=share, app.id=a-1:x',
-        );
-    });
-
-    it('keeps a tags header the caller set', async () => {
-        const info = await streamClient().sendRaw({
-            ...base,
-            stream: 'notify',
-            headers: { 'X-Example-Tags': 'own=1' },
-            tags: { kind: 'share' },
-        });
-        expect(sentMessage(info).headers?.['X-Example-Tags']).toBe('own=1');
-    });
-
-    it('sends no tags header when the stream names none or no tag survives', async () => {
-        const client = streamClient();
-        const plain = sentMessage(
-            await client.sendRaw({
-                ...base,
-                stream: 'plain',
-                tags: { kind: 'share' },
-            }),
-        );
-        expect(plain.headers).toEqual({ 'X-Example-Stream': 'plain' });
-
-        const dropped = sentMessage(
-            await client.sendRaw({
-                ...base,
-                stream: 'notify',
-                tags: { 'bad key': 'v' },
-            }),
-        );
-        expect(dropped.headers).not.toHaveProperty('X-Example-Tags');
-    });
-
-    it('does not hand stream or tags to the transport', async () => {
-        const info = await streamClient().sendRaw({
-            ...base,
-            stream: 'notify',
-            tags: { kind: 'share' },
-        });
-        const raw = JSON.parse((info as { message: string }).message);
-        expect(raw).not.toHaveProperty('stream');
-        expect(raw).not.toHaveProperty('tags');
-    });
-
-    it('keeps streams out of the transport options', async () => {
-        const nodemailer = (await import('nodemailer')).default;
-        const create = vi.spyOn(nodemailer, 'createTransport');
-        try {
-            streamClient();
-            expect(create).toHaveBeenCalledTimes(1);
-            const [options] = create.mock.calls[0] as [Record<string, unknown>];
-            expect(options).not.toHaveProperty('streams');
-            expect(options).not.toHaveProperty('from');
-            expect(options).toMatchObject({ jsonTransport: true });
-        } finally {
-            create.mockRestore();
-        }
-    });
-
-    it('forwards the template send options to sendRaw', async () => {
-        const client = streamClient();
-        const sendRaw = vi.spyOn(client, 'sendRaw').mockResolvedValue(null);
-
-        await client.send(
-            '[email protected]',
-            'email_verification_code',
-            { code: '1' },
-            { stream: 'notify', replyTo: '[email protected]' },
-        );
-
-        expect(sendRaw).toHaveBeenCalledWith(
-            expect.objectContaining({
-                stream: 'notify',
-                replyTo: '[email protected]',
-            }),
-        );
-    });
-
-    it('applies the stream from address to a template send', async () => {
-        const info = await streamClient().send(
-            '[email protected]',
-            'email_verification_code',
-            { code: '1' },
-            { stream: 'notify' },
-        );
-        expect(sentMessage(info).from.address).toBe('[email protected]');
-    });
-
-    it('reads a stream only from its own config entry', async () => {
-        const inherited = Object.create({
-            base: { from: '[email protected]', headers: { 'X-Example-B': '1' } },
-        });
-        const client = startClient({
-            email: { jsonTransport: true, from: FROM, streams: inherited },
-        } as unknown as Partial<IConfig>);
-        const message = sentMessage(
-            await client.sendRaw({ ...base, stream: 'base' }),
-        );
-        expect(message.from.address).toBe('[email protected]');
-        expect(message.headers ?? {}).toEqual({});
-    });
-
-    it('prints the stream name and no tags when no transport is configured', async () => {
-        const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-        try {
-            const client = new EmailClient({
-                port: 0,
-                extensions: [],
-            } as unknown as IConfig);
-            await client.sendRaw({
-                ...base,
-                stream: 'notify',
-                tags: { kind: 'share' },
-            });
-            const printed = warn.mock.calls[0][1] as Record<string, unknown>;
-            expect(printed).not.toHaveProperty('tags');
-            expect(printed.stream).toBe('notify');
-        } finally {
-            warn.mockRestore();
-        }
-    });
-});
-
 describe('EmailClient — template rendering', () => {
    it('renders the code into both subject and body', async () => {
        const client = startClient();
@@ -69,50 +69,14 @@ export interface SendMailOptions {
    attachments?: EmailAttachment[];
    /** Extra message headers (e.g. List-Unsubscribe), passed to the transport. */
    headers?: Record<string, string>;
-    /** Names the `email.streams` entry whose from address and headers apply. */
-    stream?: string;
-    /** Rendered into the stream's `tagsHeader`; ignored when it has none. */
-    tags?: Record<string, string>;
 }

-/** Options a templated {@link EmailClient.send} forwards to `sendRaw`. */
-export type SendTemplateOptions = Pick<SendMailOptions, 'replyTo' | 'stream'>;
-
-const TAG_PART = /^[A-Za-z0-9_.:-]{1,128}$/;
-
 interface CompiledTemplate {
    subject: ReturnType<typeof template>;
    html: ReturnType<typeof template>;
    text?: ReturnType<typeof template>;
 }

-/** Pairs whose key or value falls outside `TAG_PART` are dropped. */
-const renderTags = (tags: Record<string, string> | undefined): string =>
-    Object.entries(tags ?? {})
-        .filter(([name, value]) => TAG_PART.test(name) && TAG_PART.test(value))
-        .map(([name, value]) => `${name}=${value}`)
-        .join(', ');
-
-const hasHeader = (
-    headers: Record<string, string> | undefined,
-    name: string,
-): boolean =>
-    Object.keys(headers ?? {}).some(
-        (key) => key.toLowerCase() === name.toLowerCase(),
-    );
-
-// Header names are case-insensitive: `x-a` from `over` replaces `X-A` in `base`.
-const mergeHeaders = (
-    base: Record<string, string> | undefined,
-    over: Record<string, string> | undefined,
-): Record<string, string> => {
-    const merged: Record<string, string> = {};
-    for (const [key, value] of Object.entries(base ?? {})) {
-        if (!hasHeader(over, key)) merged[key] = value;
-    }
-    return { ...merged, ...over };
-};
-
 // -- EmailClient ------------------------------------------------------

 /**
@@ -147,8 +111,7 @@ export class EmailClient extends PuterClient {
            return;
        }

-        const { streams: _streams, from: _from, ...transportConf } = emailConf;
-        this.transport = nodemailer.createTransport(transportConf);
+        this.transport = nodemailer.createTransport(emailConf);
        console.log('[email] transport configured');
    }

@@ -162,8 +125,7 @@ export class EmailClient extends PuterClient {
    /**
     * Render a template and send it to `to`. `options.replyTo` sets the
     * Reply-To header (e.g. so a recipient can respond to the originator of the
-     * message rather than the no-reply From address); `options.stream` is
-     * passed to {@link sendRaw}.
+     * message rather than the no-reply From address).
     *
     * Returns the transport's send result, or `null` when none is configured —
     * {@link sendRaw} drops the message instead of throwing. A caller that
@@ -173,7 +135,7 @@ export class EmailClient extends PuterClient {
        to: string,
        template: T,
        values: Record<string, unknown> = {},
-        options: SendTemplateOptions = {},
+        options: { replyTo?: string } = {},
    ) {
        const compiled = this.compiledTemplates[template];
        if (!compiled) {
@@ -181,12 +143,12 @@ export class EmailClient extends PuterClient {
        }

        return await this.sendRaw({
+            from: this.defaultFrom(),
            to,
            subject: compiled.subject(values),
            html: compiled.html(values),
            ...(compiled.text ? { text: compiled.text(values) } : {}),
            ...(options.replyTo ? { replyTo: options.replyTo } : {}),
-            ...(options.stream ? { stream: options.stream } : {}),
        });
    }

@@ -197,38 +159,19 @@ export class EmailClient extends PuterClient {
     * Returns the transport's send result, or `null` when no transport is
     * configured (the send is a no-op in that case — callers that must not
     * silently drop mail should check `config.email` before composing, or the
-     * `null` return after). A configured `stream` supplies the from address
-     * when the caller gives none, and headers the caller's own override.
+     * `null` return after).
     */
    async sendRaw(options: SendMailOptions) {
-        const { stream: streamName, tags, ...message } = options;
        if (!this.transport) {
            console.warn(
                '[email] attempted to send email without transport. If you need to send email, configure an SMTP transport in your config file (see docs for details). Email content:',
-                { ...message, ...(streamName ? { stream: streamName } : {}) },
+                options,
            );
            return null;
        }
-        const streams = this.config.email?.streams;
-        const stream =
-            streamName && streams && Object.hasOwn(streams, streamName)
-                ? streams[streamName]
-                : undefined;
-        let headers = mergeHeaders(stream?.headers, message.headers);
-        const tagsValue = stream?.tagsHeader ? renderTags(tags) : '';
-        if (
-            stream?.tagsHeader &&
-            tagsValue &&
-            !hasHeader(message.headers, stream.tagsHeader)
-        ) {
-            headers = mergeHeaders(headers, {
-                [stream.tagsHeader]: tagsValue,
-            });
-        }
        return await this.transport.sendMail({
-            ...message,
-            ...(Object.keys(headers).length > 0 ? { headers } : {}),
-            from: message.from ?? stream?.from ?? this.defaultFrom(),
+            ...options,
+            from: options.from ?? this.defaultFrom(),
        });
    }

@@ -1,9 +1,3 @@
-import { trace } from '@opentelemetry/api';
-import {
-    BasicTracerProvider,
-    InMemorySpanExporter,
-    SimpleSpanProcessor,
-} from '@opentelemetry/sdk-trace-base';
 import {
    afterAll,
    afterEach,
@@ -213,122 +207,6 @@ describe('EventClient', () => {
            await target.emitAndWait(`${key}.child`, {}, {});
            expect(resolved).toBe(true);
        });
-
-        describe('tracing', () => {
-            const exporter = new InMemorySpanExporter();
-            const provider = new BasicTracerProvider({
-                spanProcessors: [new SimpleSpanProcessor(exporter)],
-            });
-            const spansFor = (eventKey: string) =>
-                exporter
-                    .getFinishedSpans()
-                    .filter(
-                        (s) =>
-                            s.name === 'event.emitAndWait' &&
-                            s.attributes['event.key'] === eventKey,
-                    );
-
-            beforeAll(() => {
-                trace.setGlobalTracerProvider(provider);
-            });
-
-            afterAll(async () => {
-                await provider.shutdown();
-                trace.disable();
-            });
-
-            it('resolves without a span when nothing listens', async () => {
-                const meta: { listener_failed?: boolean } = {};
-                await expect(
-                    target.emitAndWait(`${key}.child`, {}, meta),
-                ).resolves.toBeUndefined();
-                expect(meta).toEqual({});
-                expect(spansFor(`${key}.child`)).toHaveLength(0);
-            });
-
-            it('spans the wait whenever a listener matches, wildcards included', async () => {
-                target.on(`${key}.*`, vi.fn());
-                await expect(
-                    target.emitAndWait(`${key}.child`, {}, {}),
-                ).resolves.toBeUndefined();
-                expect(spansFor(`${key}.child`)).toHaveLength(1);
-
-                extensionStore.events[`${key}.ext`] = [vi.fn()];
-                try {
-                    await target.emitAndWait(`${key}.ext`, {}, {});
-                } finally {
-                    delete extensionStore.events[`${key}.ext`];
-                }
-                expect(spansFor(`${key}.ext`)).toHaveLength(1);
-            });
-        });
-    });
-
-    describe('emitAndWaitConcurrently', () => {
-        it('runs every listener at once, wildcards included, and awaits them all', async () => {
-            let inFlight = 0;
-            let peak = 0;
-            const contribute =
-                (share: number) => async (_k: string, data: unknown) => {
-                    inFlight++;
-                    peak = Math.max(peak, inFlight);
-                    await new Promise((r) => setTimeout(r, 10));
-                    inFlight--;
-                    (data as { total: number }).total += share;
-                };
-            target.on(`${key}.*`, contribute(1));
-            target.on(`${key}.child`, contribute(10));
-            target.on(`${key}.child`, contribute(100));
-
-            const data = { total: 0 };
-            await target.emitAndWaitConcurrently(`${key}.child`, data, {});
-
-            expect(peak).toBe(3);
-            expect(data.total).toBe(111);
-        });
-
-        it('flags a failed exact-key listener and still awaits the rest', async () => {
-            const errSpy = vi
-                .spyOn(console, 'error')
-                .mockImplementation(() => {});
-            let finished = false;
-            target.on(key, () => {
-                throw new Error('boom');
-            });
-            target.on(key, async () => {
-                await new Promise((r) => setTimeout(r, 5));
-                finished = true;
-            });
-            const meta: Record<string, unknown> = {};
-            await target.emitAndWaitConcurrently(key, {}, meta);
-            expect(finished).toBe(true);
-            expect(meta.listener_failed).toBe(true);
-            expect(errSpy).toHaveBeenCalledWith(
-                'Error in event listener for event',
-                key,
-                expect.any(Error),
-            );
-            errSpy.mockRestore();
-        });
-
-        it('leaves the flag alone when only a wildcard listener fails', async () => {
-            const errSpy = vi
-                .spyOn(console, 'error')
-                .mockImplementation(() => {});
-            target.on(`${key}.*`, () => {
-                throw new Error('observer');
-            });
-            const meta: Record<string, unknown> = {};
-            await target.emitAndWaitConcurrently(`${key}.child`, {}, meta);
-            expect(meta.listener_failed).toBeUndefined();
-            errSpy.mockRestore();
-        });
-
-        it('resolves at once with nobody listening', async () => {
-            await expect(
-                target.emitAndWaitConcurrently(`${key}.nobody`, {}, {}),
-            ).resolves.toBeUndefined();
-        });
    });

    describe('off', () => {
@@ -94,7 +94,6 @@ export class EventClient extends PuterClient {
        data: EventMap[T],
        meta: EventMetadata,
    ) {
-        if (!this.hasListeners(key)) return;
        // Spanned because callers block on listeners — this is where time
        // spent in extension hooks (e.g. `ip.validate`) gets attributed.
        return withSpan('event.emitAndWait', { 'event.key': key }, async () => {
@@ -119,43 +118,6 @@ export class EventClient extends PuterClient {
        });
    }

-    /**
-     * Like `emitAndWait`, but every matched listener runs at once, so none sees
-     * another's mutation of `data` before all have finished. Only for events
-     * whose listeners each add an independent share, written after their own
-     * awaits (`const v = await x; data.n += v`).
-     */
-    async emitAndWaitConcurrently<T extends keyof EventMap>(
-        key: T,
-        data: EventMap[T],
-        meta: EventMetadata,
-    ) {
-        const matched = this.#matchKeys(key).flatMap((matchKey) =>
-            this.#listenersFor(matchKey).map((listener) => ({
-                listener,
-                // A wildcard listener observes the event; it does not implement it.
-                isExact: matchKey === key,
-            })),
-        );
-        if (matched.length === 0) return;
-        return withSpan('event.emitAndWait', { 'event.key': key }, async () => {
-            await Promise.all(
-                matched.map(async ({ listener, isExact }) => {
-                    try {
-                        await listener(key, data, meta);
-                    } catch (e) {
-                        if (isExact) meta.listener_failed = true;
-                        console.error(
-                            'Error in event listener for event',
-                            key,
-                            e,
-                        );
-                    }
-                }),
-            );
-        });
-    }
-
    /**
     * Whether anything would run if `key` were emitted, wildcards included.
     *
@@ -20,7 +20,6 @@ import type {
    Response as ExpressResponse,
 } from 'express';
 import { Actor } from '../../core';
-import type { EmailTemplateName } from '../email/templates';
 import type { UsageInput } from '../../services/metering/types';
 import { FSEntry } from '../../stores/fs/FSEntry';

@@ -76,15 +75,6 @@ export type EventMap = {
    serverStart: Record<string, never>;
    serverPrepareShutdown: Record<string, never>;
    serverShutdown: Record<string, never>;
-    /**
-     * Emitted by a host extension that knows this server will restart soon.
-     * Long-lived connections ask their clients to reconnect; nothing is refused
-     * or closed, so a false alarm is harmless.
-     */
-    serverRestartAnnounced: {
-        /** How long until the server stops, when known. */
-        closeInMs?: number;
-    };

    // ---- AI ----
    'ai.prompt.validate': {
@@ -118,7 +108,7 @@ export type EventMap = {
        model_used: string;
        service_used: string;
        intended_service: string;
-        model_details?: {
+        model_details: {
            id: string;
            provider: string;
            input_cost_key: string;
@@ -147,17 +137,6 @@ export type EventMap = {
    };
    'app.new-icon': { app_uid: string; data_url: string };
    'app.opened': { app_uid: string; user_id: number; ts: number };
-    /**
-     * A user removed an app: its grants and worker sessions are gone. With
-     * `deleteData`, the user asked for the app's data in their account to go
-     * too. Awaited by the emitter.
-     */
-    'app.uninstalled': {
-        userId: number;
-        userUuid: string;
-        appUid: string;
-        deleteData: boolean;
-    };
    'app.rename': {
        app_uid: string;
        old_name: string;
@@ -201,16 +180,6 @@ export type EventMap = {
    };

    // ---- Auth / signup ----
-    /**
-     * Which signup methods are open, emitted via `emitAndWait` before every
-     * signup and whenever the GUI reads the provider list. A listener sets
-     * `oidcOnly` to refuse form and temp signups, leaving OIDC and team
-     * provisioning open; `message` is what a refused form signup is told.
-     */
-    'puter.signup.policy': {
-        oidcOnly: boolean;
-        message: string | null;
-    };
    'puter.signup.validate': {
        allow: boolean;
        email?: string;
@@ -228,7 +197,7 @@ export type EventMap = {
         */
        is_temp?: boolean;
        ip?: string | null;
-        source?: 'oidc' | 'team_provision';
+        source?: 'oidc';
        req?: unknown;
        data?: unknown;
        abuse?: unknown;
@@ -241,8 +210,6 @@ export type EventMap = {
        trail_id?: string;
        /** Device signal forwarded verbatim from the signup request body. */
        fingerprint?: string | null;
-        /** TLS fingerprint of the signup request, when a proxy supplies one. */
-        tls_fingerprint?: string | null;
        /**
         * Set by the abuse harness — require SMS phone verification
         * post-signup.
@@ -250,12 +217,6 @@ export type EventMap = {
        requires_phone_verification?: boolean;
        /** Set by the abuse harness — require card verification post-signup. */
        requires_card_verification?: boolean;
-        /**
-         * The email stream the confirmation message is sent on: lowercase
-         * letters, digits, `:`, `_` and `-`, up to 64 characters, starting with
-         * a letter or digit. Any other value is ignored.
-         */
-        email_stream?: string | null;
        [key: string]: unknown;
    };
    'puter.signup.success': {
@@ -296,7 +257,7 @@ export type EventMap = {
        ip?: string | null;
        fingerprint?: string | null;
        reputation?: number | null;
-        source?: 'oidc' | 'team_provision';
+        source?: 'oidc';
        requires_phone_verification: boolean;
        requires_card_verification: boolean;
        accepted: boolean;
@@ -307,8 +268,6 @@ export type EventMap = {
        message: string | null;
        [key: string]: unknown;
    };
-    /** Before notification emails; a listener clears `allow` per recipient. */
-    'email.notify.validate': EmailNotifyValidateEvent;
    // Inbound mail to a feedback address (`abuse@`, `fbl@`, ...), emitted via
    // `emitAndWait`. A listener that takes it sets `handled` and it reaches no
    // mailbox; otherwise it is routed like any other message.
@@ -344,8 +303,6 @@ export type EventMap = {
        // the abuse extension cap sends per device (across accounts) so a
        // device farm can't dodge the per-account cap with fresh signups.
        device_fingerprint: string | null;
-        // Browser-signals dispatch id the client sent, or null.
-        dispatch_id: string | null;
        allowed: boolean;
        reason: string | null;
        // With `allowed` false, offer the card fallback in place of SMS. Only
@@ -431,14 +388,7 @@ export type EventMap = {
        old_username: string;
        new_username: string;
    };
-    'user.email-changed': {
-        user_id: number;
-        old_email: string | null;
-        new_email: string;
-    };
-    /** An account was suspended, or its suspension lifted. Local events. */
-    'user.suspended': { userId: number };
-    'user.unsuspended': { userId: number };
+    'user.email-changed': { user_id: number; new_email: string };
    // Fired after an account is torn down (self-serve, admin, or temp-user
    // logout cleanup). Listeners purge external state tied to the account —
    // e.g. the marketplace extension cancels the user's Stripe subscriptions.
@@ -447,8 +397,6 @@ export type EventMap = {
        user_id: number;
        user_uuid?: string;
        stripe_customer_id?: string | null;
-        /** Apps the account owned, which cascaded away with it. */
-        appUids?: string[];
    };

    // ---- Team billing ---- the trigger, never the charge ----
@@ -511,11 +459,7 @@ export type EventMap = {
            [key: string]: unknown;
        };
    };
-    /**
-     * Bytes to add to a user's storage allowance. Listeners run concurrently:
-     * add to `extra` after your own awaits, never `extra += await x`.
-     */
-    'storage.quota.bonus': { userId: number; userUuid?: string; extra: number };
+    'storage.quota.bonus': { userId: number; extra: number };

    // ---- Key-value ----
    /**
@@ -542,43 +486,15 @@ export type EventMap = {
        noShareKeys?: string[];
        /** Events handler runs behind the write; see `Actor.handlerDepth`. */
        handlerDepth?: number;
-        /**
-         * The user who made the change. Differs from `userId` when a share
-         * holder wrote into the owner's namespace.
-         */
-        actingUserId?: number;
-        /** Made by a worker session or an events handler; see `viaWorkerOf`. */
-        viaWorker?: true;
    };
    /**
     * A whole namespace was emptied. Namespace-level on purpose: `flush`'s own
     * key enumeration is truncated for a large namespace, so the keys it saw
     * are not the keys it removed.
     */
-    'kv.flushed': {
-        namespace: string;
-        userId: number;
-        actingUserId?: number;
-        viaWorker?: true;
-    };
-    /**
-     * Share handles stopped being addresses, whoever retired them. `userId` is
-     * one user who could have subscribed through them, their owner or their
-     * holder. Listeners end what was made through them even where another grant
-     * still covers the region. Local, like `permission.revoked`: one region
-     * settling covers every other.
-     */
-    'kv.share.retired': { handles: string[]; userId: number };
+    'kv.flushed': { namespace: string; userId: number };

    // ---- Notifications ----
-    /** An app message was acknowledged after its state committed. */
-    'notif.acknowledged': {
-        userId: number;
-        uid: string;
-        type: string;
-        audience: string;
-        appUid: string;
-    };
    /**
     * A notification row exists. Emitted after the insert commits — nothing
     * pushes a uid before there is a row to name — and carries the scope tuple
@@ -593,32 +509,9 @@ export type EventMap = {
        appUid: string | null;
        value: Record<string, unknown>;
        createdAt: number;
-        /** An earlier notification replaced in place; `createdAt` is when. */
-        replaced?: true;
        /** Events handler runs behind whatever created it. */
        handlerDepth?: number;
    };
-    /**
-     * Every non-silent write or update, only on the node that wrote it. The
-     * value is the listener's own copy of what the socket carries.
-     */
-    'notif.written': {
-        userId: number;
-        uid: string;
-        type: string;
-        audience: string;
-        /** The row's app; null when it names none or an update could not tell. */
-        appUid: string | null;
-        value: Record<string, unknown>;
-        /** An earlier notification rewritten in place. */
-        updated?: true;
-        /** Replaced an earlier notification in its group. */
-        replaced?: true;
-        /** Names this one send, for a receipt asked about it. */
-        sendId: string;
-        /** The same `sendId` may be emitted again, as a delayed send is. */
-        replayable?: true;
-    };
    /**
     * One notification, addressed at whatever sockets each region holds for the
     * recipient. `outer.*` reaches peer regions and never sibling nodes, so
@@ -627,43 +520,9 @@ export type EventMap = {
     */
    'outer.notif.delivery': {
        userId: number;
-        wire: 'notif.message' | 'notif.unreads' | 'notif.ack' | 'notif.removed';
+        wire: 'notif.message' | 'notif.unreads' | 'notif.ack';
        response: unknown;
    };
-    /**
-     * How one live notification went, on the node that asked for its receipt:
-     * from the desktop's sockets, or with `appUid` the app's own.
-     */
-    'notif.delivery.settled': {
-        sendId?: string;
-        uid: string;
-        userId: number;
-        type: string;
-        /** The app whose own sockets were asked; absent for the desktop's. */
-        appUid?: string;
-        outcome: NotifDeliveryOutcome;
-        /** A socket in this region acknowledges the receipt. */
-        ackCapable: boolean;
-        /** No socket here is an older client that acknowledges nothing. */
-        everySocketAcks: boolean;
-        /** Every node here answered the ask, not just this one. */
-        complete: boolean;
-        /** A peer region holds a socket for the user. */
-        peerRegions: boolean;
-        responders: NotifDeliveryResponder[];
-        /** A page here got it live while visible and focused. */
-        handled: boolean;
-    };
-    /**
-     * A page reported that it got a notification live while visible and
-     * focused. Node-local; `appUid` is the reporting socket's app, absent for
-     * the desktop.
-     */
-    'notif.handled': {
-        userId: number;
-        appUid?: string;
-        uid: string;
-    };

    // ---- Metering ----
    // Recurring charges are pure mechanism here: the metering service knows
@@ -713,18 +572,9 @@ export type EventMap = {
    // and going away (1→0, whether by removing the last handler or by the
    // destroy route). `actor.user` is the app's owner, not the caller — a
    // developer session publishing for an app it owns is the common case, but
-    // billing follows ownership. For `scope: 'user'` the unit is one user's
-    // handlers in one app instead, and `actor.user` is that user.
-    'events.worker.create': {
-        actor: Actor;
-        appUid: string;
-        scope: 'app' | 'user';
-    };
-    'events.worker.destroy': {
-        actor: Actor;
-        appUid: string;
-        scope: 'app' | 'user';
-    };
+    // billing follows ownership.
+    'events.worker.create': { actor: Actor; appUid: string };
+    'events.worker.destroy': { actor: Actor; appUid: string };

    // ---- Outer / GUI broadcast ----
    'outer.cacheUpdate': {
@@ -747,8 +597,6 @@ export type EventMap = {
    'outer.permission.flatInvalidated': {
        entries: Array<{ holderUserId: number; permission: string }>;
    };
-    /** Links on these nodes were removed; read them from the primary. */
-    'outer.share.linksRevoked': { fsentryIds: number[]; uuids: string[] };
    /**
     * A user's subscription set changed, so every process must drop its cached
     * "does this user have any subscriptions" answer. Carries the counter the
@@ -791,13 +639,6 @@ export type EventMap = {
     * reason as the events generation bump: a per-process cache.
     */
    'outer.pubsub.share.ownerShared': { ownerUserId: number };
-    /**
-     * Share handles were retired or changed, so every process must drop its
-     * cached copy. `outer.pubsub.*` because the cache is a per-process map.
-     */
-    'outer.pubsub.kv.share.forget': { handles: string[] };
-    /** The same, for every cached handle one owner holds out. */
-    'outer.pubsub.kv.share.forgetOwner': { ownerUserId: number };
    'outer.fs.write-hash': { hash: string; uuid: string };
    /**
     * Cache keys the KV read cache must stop serving, because the entries
@@ -816,7 +657,6 @@ export type EventMap = {
    'outer.gui.item.renamed': GuiEvent;
    'outer.gui.notif.ack': GuiEvent<{ uid: string }>;
    'outer.gui.notif.message': GuiEvent<{ uid: string; notification: unknown }>;
-    'outer.gui.notif.removed': GuiEvent<{ uid: string }>;
    'outer.gui.notif.unreads': GuiEvent<{
        unreads: { uid: string; notification: unknown }[];
    }>;
@@ -824,7 +664,7 @@ export type EventMap = {
    // ---- Subdomains ----
    // `uid` is the row uuid — for `delete` it is the only surviving handle a
    // listener can use to find state keyed to the row after it is gone.
-    'subdomain.delete': { subdomain: string; uid?: string; userId: number };
+    'subdomain.delete': { subdomain: string; uid?: string };
    'subdomain.update': { subdomain: string; uid?: string };
    'site.htmlServed': {
        subdomain: string;
@@ -835,10 +675,6 @@ export type EventMap = {
        requestHash?: string;
        mime: string;
    };
-    // Asked for a request whose host is outside every configured domain. A
-    // listener that recognises the host sets `result.subdomain` to the site
-    // it serves; an unclaimed host is answered with a 404.
-    'site.resolveHost': { host: string; result: { subdomain: string | null } };
    // Asked before a hosted file is streamed. A listener that owns the site
    // sets `result.allowed = false` to withhold the entry; the visitor then
    // sees the same 404 as for a missing file.
@@ -887,17 +723,8 @@ export type EventMap = {
        session_uids: string[];
    };

-    /**
-     * One access token was revoked; only its own connections should drop.
-     * `outer.*` for the same reason as `outer.auth.sessions.revoked`.
-     */
-    'outer.auth.access-token.revoked': { token_uid: string };
-
-    /** Same-cluster eviction for raw realtime WebSockets. */
-    'pubsub.realtime.auth-revoked': {
-        sessionUids?: string[];
-        tokenUid?: string;
-    };
+    /** One access token was revoked; only its own connections should drop. */
+    'auth.access-token.revoked': { token_uid: string };

    /**
     * A grant was withdrawn, so whatever was standing on it has to be settled
@@ -990,21 +817,6 @@ export type EventMap = {
    'outer.pubsub.metering.credits-changed': { userUuid: string };
 } & IExtensionEventMap;

-/** A union of `Names`, each of which has to be an email template. */
-type TemplateNames<Names extends EmailTemplateName> = Names;
-
-/** The emails that ask `email.notify.validate`, by template name. */
-export type EmailNotifyKind = TemplateNames<
-    'file_shared_with_you' | 'file_shared_invite' | 'app-user-feedback'
->;
-
-/** Payload for `email.notify.validate`: one kind of mail, all its recipients. */
-export type EmailNotifyValidateEvent = {
-    kind: EmailNotifyKind;
-    /** `to` is the address as it will be sent; `allow` starts true. */
-    recipients: Array<{ to: string; allow: boolean }>;
-};
-
 /** Payload for `subscription.gate.<surface>` events. */
 export type SubscriptionGateEvent = {
    actor: Actor;
@@ -1036,9 +848,6 @@ export type AiCostFactorEvent = {
 */
 export type LifecyclePhase = 'before' | 'after' | 'error' | 'reject';

-/** Status a vetoing `before` listener may answer with. */
-export type LifecycleRejectStatus = 403 | 429;
-
 /**
 * Payload for `driver.<iface>.<method>.<phase>` events.
 *
@@ -1068,8 +877,6 @@ export type DriverMethodLifecycleEvent = {
    allow?: boolean;
    /** Optional human-readable reason surfaced to the caller when vetoed. */
    rejectReason?: string;
-    /** Status for a veto: 403 (default) or 429 for a throttle. */
-    rejectStatus?: LifecycleRejectStatus;
 };

 /**
@@ -1104,8 +911,6 @@ export type RouteLifecycleEvent = {
    allow?: boolean;
    /** Optional human-readable reason surfaced to the caller when vetoed. */
    rejectReason?: string;
-    /** Status for a veto: 403 (default) or 429 for a throttle. */
-    rejectStatus?: LifecycleRejectStatus;
 };

 export type EventKey = keyof EventMap & string;
@@ -1126,17 +931,6 @@ export type MatchingEvents<P extends ListenKey> = P extends `${infer Prefix}.*`
    ? Extract<EventKey, `${Prefix}.${string}`>
    : P & EventKey;

-/** Acked, not acked, no socket anywhere, or sockets only in a peer region. */
-export type NotifDeliveryOutcome =
-    'received' | 'unreceived' | 'no-socket' | 'remote-only';
-
-/** One socket's receipt for a live notification. */
-export interface NotifDeliveryResponder {
-    visibilityState: 'visible' | 'hidden' | 'unknown';
-    /** The page's window has focus. Absent from older clients. */
-    focused?: boolean;
-}
-
 export type EventMetadata = {
    from_outside?: boolean;
    /** Set by `emitAndWait` when a listener threw, so a verdict hook can refuse. */
@@ -132,28 +132,6 @@ describe('PreludeClient', () => {
        });
    });

-    it('forwards a JA4 TLS fingerprint and drops any other shape', async () => {
-        fetchMock.mockResolvedValue(okJson({ id: 'v', status: 'success' }));
-        const client = makeClient('sk_test');
-        const ja4 = 't13d1516h2_8daaf6152771_02713d6af862';
-
-        await client.createVerification('+14155550123', {
-            tls_fingerprint: ja4,
-        });
-        await client.createVerification('+14155550123', {
-            ip: '203.0.113.7',
-            // A JA3 hash.
-            tls_fingerprint: 'e7d705a3286e19ea42f587b344ee6865',
-        });
-
-        expect(JSON.parse(fetchMock.mock.calls[0][1].body).signals).toEqual({
-            ja4_fingerprint: ja4,
-        });
-        expect(JSON.parse(fetchMock.mock.calls[1][1].body).signals).toEqual({
-            ip: '203.0.113.7',
-        });
-    });
-
    it('omits the signals object entirely when none are supplied', async () => {
        fetchMock.mockResolvedValue(okJson({ id: 'v', status: 'success' }));
        const client = makeClient('sk_test');
@@ -25,8 +25,6 @@ const PRELUDE_API_BASE = 'https://api.prelude.dev/v2';
 const REQUEST_TIMEOUT_MS = 8000;
 /** OTP length — matches the 6-box code UI. Prelude allows 4–8. */
 const PRELUDE_CODE_SIZE = 6;
-const JA4_SHAPE =
-    /^[tqd][0-9a-z]{2}[di]\d{4}[0-9a-z]{2}_[0-9a-f]{12}_[0-9a-f]{12}$/;
 /**
 * Channel Prelude prioritizes for delivery. RCS is far cheaper than SMS, so we
 * prefer it by default; Prelude routes to the next reachable channel (SMS) when
@@ -136,8 +134,6 @@ export class PreludeClient extends PuterClient {
            ip?: string;
            device_id?: string;
            user_agent?: string;
-            /** Forwarded only when it is a JA4 value. */
-            tls_fingerprint?: string;
            dispatch_id?: string;
        } = {},
    ): Promise<{
@@ -172,8 +168,6 @@ export class PreludeClient extends PuterClient {
        if (signals.ip) sig.ip = signals.ip;
        if (signals.device_id) sig.device_id = signals.device_id;
        if (signals.user_agent) sig.user_agent = signals.user_agent;
-        if (signals.tls_fingerprint && JA4_SHAPE.test(signals.tls_fingerprint))
-            sig.ja4_fingerprint = signals.tls_fingerprint;
        if (Object.keys(sig).length > 0) body.signals = sig;
        // dispatch_id is a top-level field, not a member of `signals`.
        if (signals.dispatch_id) body.dispatch_id = signals.dispatch_id;
@@ -3,31 +3,28 @@
 *
 * This file is part of Puter.
 *
- * Puter is free software: you can redistribute it and/or modify it under the
- * terms of the GNU Affero General Public License as published by the Free
- * Software Foundation, either version 3 of the License, or (at your option) any
- * later version.
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
 *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
- * details.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
- * along with this program. If not, see
- * [https://www.gnu.org/licenses/](https://www.gnu.org/licenses/).
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

 import { GetObjectCommand } from '@aws-sdk/client-s3';
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { existsSync } from 'node:fs';
-import { createServer, type Server } from 'node:http';
-import type { AddressInfo } from 'node:net';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import type { IConfig } from '../../types';
-import { S3Client, withPresignHeadroom } from './S3Client';
+import { S3Client } from './S3Client';

 const LOCAL_BUCKET = 'puter-local';

@@ -202,77 +199,6 @@ describe('S3Client — remote endpoint configuration', () => {
    });
 });

-describe('S3Client — bucket in another region', () => {
-    let server: Server;
-    let client: S3Client;
-    let signedRegions: string[];
-
-    // Answers like a bucket that lives in us-west-2: a request signed for any
-    // other region gets S3's 301 naming the bucket's region.
-    beforeEach(async () => {
-        signedRegions = [];
-        server = createServer((req, res) => {
-            const region =
-                /Credential=[^/]+\/\d{8}\/([^/]+)\//.exec(
-                    req.headers.authorization ?? '',
-                )?.[1] ?? '';
-            signedRegions.push(region);
-            if (region !== 'us-west-2') {
-                res.writeHead(301, {
-                    'content-type': 'application/xml',
-                    'x-amz-bucket-region': 'us-west-2',
-                });
-                res.end(
-                    '<?xml version="1.0" encoding="UTF-8"?><Error><Code>PermanentRedirect</Code><Message>The bucket you are attempting to access must be addressed using the specified endpoint.</Message></Error>',
-                );
-                return;
-            }
-            res.writeHead(200, {
-                'content-type': 'text/plain',
-                'content-length': '5',
-            });
-            res.end('hello');
-        });
-        await new Promise<void>((resolve) =>
-            server.listen(0, '127.0.0.1', resolve),
-        );
-        const { port } = server.address() as AddressInfo;
-        client = new S3Client({
-            port: 0,
-            extensions: [],
-            s3: {
-                s3Config: {
-                    endpoint: `http://127.0.0.1:${port}`,
-                    accessKeyId: 'fakeAccessKeyId',
-                    secretAccessKey: 'fakeSecretAccessKey',
-                    forcePathStyle: true,
-                },
-            },
-        } as unknown as IConfig);
-        await client.onServerStart();
-    });
-
-    afterEach(async () => {
-        await client.onServerShutdown();
-        server.closeAllConnections();
-        await new Promise<void>((resolve) => server.close(() => resolve()));
-    });
-
-    it("retries a read in the bucket's region when S3 redirects it", async () => {
-        const result = await client
-            .get('ap-northeast-2')
-            .send(
-                new GetObjectCommand({
-                    Bucket: 'other-bucket',
-                    Key: 'index.html',
-                }),
-            );
-
-        expect(await result.Body?.transformToString()).toBe('hello');
-        expect(signedRegions).toEqual(['ap-northeast-2', 'us-west-2']);
-    });
-});
-
 describe('S3Client — legacy storage migration', () => {
    let client: S3Client;
    let dir: string;
@@ -561,54 +487,3 @@ describe('S3Client — short reads during multipart', () => {
        expect(parts).toEqual([10, 10]);
    });
 });
-
-describe('withPresignHeadroom', () => {
-    const HOUR = 60 * 60 * 1000;
-    const creds = (msLeft?: number, id = 'a') => ({
-        accessKeyId: id,
-        secretAccessKey: 's',
-        ...(msLeft === undefined
-            ? {}
-            : { expiration: new Date(Date.now() + msLeft) }),
-    });
-
-    it('reports expiry an hour early so the SDK refreshes while an hour remains', async () => {
-        const chain = vi.fn(async () => creds(5 * HOUR));
-        const identity = await withPresignHeadroom(chain)();
-
-        expect(chain).toHaveBeenCalledTimes(1);
-        const left = identity.expiration!.getTime() - Date.now();
-        expect(left).toBeGreaterThan(4 * HOUR - 1000);
-        expect(left).toBeLessThanOrEqual(4 * HOUR);
-    });
-
-    it('force-refreshes credentials that are inside the presign window', async () => {
-        const chain = vi.fn(async (options?: { forceRefresh?: boolean }) =>
-            options?.forceRefresh
-                ? creds(6 * HOUR, 'fresh')
-                : creds(30 * 60 * 1000, 'stale'),
-        );
-        const identity = await withPresignHeadroom(chain)();
-
-        expect(chain).toHaveBeenLastCalledWith(
-            expect.objectContaining({ forceRefresh: true }),
-        );
-        expect(identity.accessKeyId).toBe('fresh');
-    });
-
-    it('leaves long-lived credentials alone', async () => {
-        const chain = vi.fn(async () => creds(undefined));
-        const identity = await withPresignHeadroom(chain)();
-
-        expect(chain).toHaveBeenCalledTimes(1);
-        expect(identity.expiration).toBeUndefined();
-    });
-
-    it('never reports an expiry inside the SDK refresh margin', async () => {
-        const chain = vi.fn(async () => creds(20 * 60 * 1000));
-        const identity = await withPresignHeadroom(chain)();
-
-        const left = identity.expiration!.getTime() - Date.now();
-        expect(left).toBeGreaterThan(5 * 60 * 1000);
-    });
-});
@@ -43,43 +43,6 @@ const DEFAULT_MULTIPART_PART_SIZE_BYTES = 5 * 1024 * 1024;
 const FAUXQS_SAFE_PUT_OBJECT_LIMIT_BYTES = 10 * 1024 * 1024;
 const LEGACY_STORAGE_BUCKET = 'puter-local';

-// A presigned URL stops working when the credentials that signed it expire.
-// Presigns last up to an hour, but the SDK only refreshes temporary
-// credentials five minutes before expiry.
-const PRESIGN_MAX_LIFETIME_MS = 60 * 60 * 1000;
-const SDK_REFRESH_MARGIN_MS = 5 * 60 * 1000;
-
-type CredentialChain = ReturnType<typeof fromNodeProviderChain>;
-
-/**
- * Keeps temporary credentials at least an hour from expiry when they sign. The
- * SDK is handed each identity with its expiration moved an hour early, so its
- * own refresh comes back here while an hour remains, and a credential already
- * inside that window is force-refreshed from the chain.
- */
-export function withPresignHeadroom(chain: CredentialChain): CredentialChain {
-    return async (options) => {
-        let identity = await chain(options);
-        const remaining = (i: typeof identity) =>
-            i.expiration ? i.expiration.getTime() - Date.now() : Infinity;
-        if (
-            remaining(identity) <
-            PRESIGN_MAX_LIFETIME_MS + SDK_REFRESH_MARGIN_MS
-        ) {
-            identity = await chain({ ...options, forceRefresh: true });
-        }
-        if (!identity.expiration) return identity;
-        // If even fresh credentials are short-lived, report an expiry just past
-        // the SDK's margin rather than one in the past, which would make it
-        // re-resolve on every request.
-        const reported = Math.max(
-            identity.expiration.getTime() - PRESIGN_MAX_LIFETIME_MS,
-            Date.now() + SDK_REFRESH_MARGIN_MS + 60 * 1000,
-        );
-        return { ...identity, expiration: new Date(reported) };
-    };
-}
-
 type S3CommandSender = Pick<AwsS3Client, 'send'>;

 export class S3Client extends PuterClient {
@@ -120,9 +83,7 @@ export class S3Client extends PuterClient {

            if (useCredentialChain) {
                this.useProviderChain = true;
-                this.awsConfig = {
-                    credentials: withPresignHeadroom(fromNodeProviderChain()),
-                };
+                this.awsConfig = { credentials: fromNodeProviderChain() };
                this.partSize = 64 * 1024 * 1024;
                this.maxSingleUploadSize = 128 * 1024 * 1024;
            } else {
@@ -235,9 +196,6 @@ export class S3Client extends PuterClient {

        const client = new AwsS3Client({
            region,
-            // Rows without a stored region are read with the server's own, so
-            // retry where S3's 301 says the bucket actually lives.
-            followRegionRedirects: true,
            requestStreamBufferSize: 32 * 1024,
            requestHandler: new NodeHttpHandler({
                socketTimeout: 5000,
@@ -52,8 +52,8 @@ const APP_READ_LIMIT = {
 /**
 * Unauthenticated icon serving; no actor to key on, so the bucket is the
 * address — and an address is a NAT, a campus or a carrier gateway that can
- * hold hundreds of desktops. Each dashboard load pulls its app icons at once,
- * so a single burst from one network is already thousands of requests.
+ * hold hundreds of desktops. Each desktop boot pulls the taskbar's icons at
+ * once, so a single burst from one network is already thousands of requests.
 * Responses are publicly cacheable and usually a redirect, so the ceiling is
 * not protecting bandwidth; it is there so a client looping on a broken icon
 * can't spin unbounded.
@@ -523,7 +523,7 @@ export class AppController extends PuterController {
        };

        // Icons are <img src> targets from the GUI (root) AND resolved via
-        // api_base_url in app summaries. Register on both so either origin
+        // api_base_url in taskbar payloads. Register on both so either origin
        // works without a cross-subdomain redirect.
        router.get(
            '/app-icon/:app_uid',
@@ -1271,7 +1271,7 @@ describe('AppController app-icon rate limit', () => {
    it('sizes the icon bucket for a whole network rather than one desktop', () => {
        // Icons are unauthenticated `<img src>` targets, so the only key is
        // the address — which one NAT shares across every desktop behind it,
-        // and each dashboard load pulls its app icons in a burst.
+        // and each boot pulls the taskbar's icons in a burst.
        for (const path of ['/app-icon/:app_uid', '/app-icon/:app_uid/:size']) {
            const route = router.routes.find(
                (r) => r.method === 'get' && r.path === path,
@@ -1,85 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { setupPuterTestEnv, type PuterTestEnv } from '../../testUtil.js';
-
-describe('auth elevation cookies over HTTP', () => {
-    let env: PuterTestEnv;
-
-    beforeAll(async () => {
-        env = await setupPuterTestEnv();
-    }, 120_000);
-
-    afterAll(async () => {
-        await env?.shutdown();
-    });
-
-    it.each(['bearer', 'cookie'])(
-        'API host returns a usable token without setting cookies (%s auth)',
-        async (credential) => {
-            const { token, password, username } = env.users.user;
-            const res = await fetch(new URL('/auth/elevate', env.apiOrigin), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    ...(credential === 'cookie'
-                        ? { cookie: `puter_auth_token=${token}` }
-                        : { authorization: `Bearer ${token}` }),
-                },
-                body: JSON.stringify({ password }),
-            });
-            expect(res.status).toBe(200);
-            expect(res.headers.get('set-cookie')).toBeNull();
-            const body = (await res.json()) as {
-                elevated: boolean;
-                token: string;
-            };
-            expect(body.elevated).toBe(true);
-            expect(typeof body.token).toBe('string');
-            const user = await env.server.stores.user.getByUsername(username);
-            const { verifyStepUpSession } =
-                await import('../../core/http/middleware/stepUpSession.js');
-            expect(
-                verifyStepUpSession(
-                    {
-                        headers: { 'x-puter-elevation': body.token },
-                        actor: { user: { uuid: user!.uuid } },
-                    } as never,
-                    { tokenService: env.server.services.token },
-                ),
-            ).toBe(true);
-        },
-    );
-
-    it('GUI host sets the elevation cookie and omits the raw token for cookie auth', async () => {
-        const { token, password } = env.users.user;
-        const res = await fetch(new URL('/auth/elevate', env.origin), {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                cookie: `puter_auth_token=${token}`,
-            },
-            body: JSON.stringify({ password }),
-        });
-        expect(res.status).toBe(200);
-        expect(res.headers.get('set-cookie')).toContain('puter_elevated=');
-        expect(await res.json()).toEqual({ elevated: true });
-    });
-});
@@ -18,18 +18,17 @@
 */

 import { TOTP } from 'otpauth';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { makeActor } from '../../core/actor.js';
 import { runWithContext } from '../../core/context.js';
 import { createSecret as otpCreateSecret } from '../../services/auth/OTPUtil.js';
 import { FULL_API_ACCESS } from '../../services/permission/consts.js';
-import { tokenClaimsDigest } from '../../../gui/src/helpers/guiToken.js';
 import {
    createTestUser,
-    lagReadReplica,
    setupPuterTestEnv,
    type PuterTestEnv,
 } from '../../testUtil.js';
+import type { IConfig } from '../../types';

 /**
 * HTTP-level coverage for `/auth/revoke-own-access-token` — the route that
@@ -352,98 +351,6 @@ describe('revoke-own-access-token over HTTP', () => {
        expect(await tokenReadStatus(file.uid, readToken)).not.toBe(200);
    });

-    const ACCESS_TOKEN_QUERIES =
-        /FROM `access_token_permissions`|`access_token_uid` = \?/;
-    const tokenUidOf = (token: string) =>
-        (
-            env.server.services.token.verify('auth', token) as {
-                token_uid: string;
-            }
-        ).token_uid;
-
-    it('serves a read URL fetched right after minting while the replica lags', async () => {
-        const owner = env.users.user;
-        const file = await makeFile(owner);
-        const replica = await lagReadReplica(env.server, ACCESS_TOKEN_QUERIES);
-        try {
-            const readToken = await mintReadToken(owner.token, file.uid);
-            expect(await tokenReadStatus(file.uid, readToken)).toBe(200);
-            const cached = await env.server.clients.redis.get(
-                `perms:token:${tokenUidOf(readToken)}`,
-            );
-            expect(cached).toBe(JSON.stringify([`fs:${file.uid}:read`]));
-        } finally {
-            replica.catchUp();
-        }
-    });
-
-    it('mints from a just-created personal API token while the replica lags', async () => {
-        const owner = env.users.user;
-        const file = await makeFile(owner);
-        const replica = await lagReadReplica(env.server, ACCESS_TOKEN_QUERIES);
-        try {
-            const pat = await mintPersonalToken(owner);
-            const readToken = await mintReadToken(pat, file.uid);
-            expect(await tokenReadStatus(file.uid, readToken)).toBe(200);
-        } finally {
-            replica.catchUp();
-        }
-    });
-
-    it('revokes a just-created token by its uuid while the replica lags', async () => {
-        const owner = env.users.user;
-        const file = await makeFile(owner);
-        const { actor } = await env.server.services.auth.authenticate(
-            owner.token,
-        );
-        const replica = await lagReadReplica(env.server, ACCESS_TOKEN_QUERIES);
-        let readToken: string;
-        try {
-            readToken = await mintReadToken(owner.token, file.uid);
-            await env.server.services.auth.revokeAccessToken(
-                actor!,
-                tokenUidOf(readToken),
-            );
-            expect(await tokenReadStatus(file.uid, readToken)).not.toBe(200);
-        } finally {
-            replica.catchUp();
-        }
-        expect(await tokenReadStatus(file.uid, readToken)).not.toBe(200);
-        expect(await whoamiStatus(readToken)).toBe(401);
-    });
-
-    it('keeps a revoked token dead while the replica still shows it live', async ({
-        skip,
-    }) => {
-        // The frozen replica is a sqlite copy.
-        skip(process.env.PUTER_TEST_DB_ENGINE?.toLowerCase() === 'postgres');
-        const owner = env.users.user;
-        const file = await makeFile(owner);
-        const { actor } = await env.server.services.auth.authenticate(
-            owner.token,
-        );
-        const readToken = await mintReadToken(owner.token, file.uid);
-        const tokenUid = tokenUidOf(readToken);
-        const replica = await lagReadReplica(env.server, ACCESS_TOKEN_QUERIES, {
-            mode: 'frozen',
-        });
-        try {
-            await env.server.services.auth.revokeAccessToken(actor!, tokenUid);
-            expect(await tokenReadStatus(file.uid, readToken)).not.toBe(200);
-            expect(
-                await env.server.stores.permission.listAccessTokenPerms(
-                    tokenUid,
-                ),
-            ).toEqual([]);
-            expect(
-                await env.server.clients.redis.get(`perms:token:${tokenUid}`),
-            ).toBeNull();
-        } finally {
-            replica.catchUp();
-        }
-        expect(await whoamiStatus(readToken)).toBe(401);
-    });
-
    // These three run last in the file's shared `env.users.user`: each one
    // revokes a session belonging to `owner.token` / `owner.workerToken`, so
    // later tests can't rely on those credentials still being live.
@@ -487,10 +394,7 @@ describe('revoke-own-access-token over HTTP', () => {

    it('a revoked GUI session still gets a reauth_token', async () => {
        const owner = env.users.user;
-        const decoded = env.server.services.token.verify(
-            'auth',
-            owner.token,
-        ) as {
+        const decoded = env.server.services.token.verify('auth', owner.token) as {
            session_uid: string;
        };
        await env.server.stores.session.removeByUuid(decoded.session_uid);
@@ -520,7 +424,7 @@ describe('2FA enrollment over HTTP', () => {
    let env: PuterTestEnv;

    beforeAll(async () => {
-        env = await setupPuterTestEnv();
+        env = await setupPuterTestEnv({ teams_enabled: true } as IConfig);
    }, 120_000);

    afterAll(async () => {
@@ -656,6 +560,57 @@ describe('2FA enrollment over HTTP', () => {
        expect(enabled.status).toBe(200);
        expect((await otpState(account.userId)).enabled).toBe(true);
    });
+
+    it('lets a seat its team holds for 2FA enroll through the same gate', async () => {
+        const owner = await makeAccount();
+        // The rule can only be turned on by an owner who has 2FA.
+        await env.server.stores.user.update(owner.userId, { otp_enabled: 1 });
+        await env.server.stores.user.invalidateById(owner.userId);
+        const team = await env.server.services.team.createTeam(owner.userId, {
+            name: 'Acme',
+        });
+        const seatName = `seat_${uniq()}`;
+        const { userId, temporaryPassword } =
+            await env.server.services.team.provisionAccount(
+                team.uid,
+                owner.userId,
+                { username: seatName },
+            );
+        await env.server.services.team.updateTeam(team.uid, owner.userId, {
+            require2fa: true,
+        });
+        const { token } = await env.server.services.auth.createSessionToken(
+            (await env.server.stores.user.getById(userId))!,
+        );
+
+        // First sign-in replaces the temporary password.
+        const changed = await protectedPost(
+            '/user-protected/change-password',
+            token,
+            { password: temporaryPassword, new_pass: 'seat-own-password' },
+        );
+        expect(changed.status).toBe(200);
+
+        const held = await fetch(new URL('/teams', env.apiOrigin), {
+            headers: { authorization: `Bearer ${token}` },
+        });
+        expect(held.status).toBe(403);
+        expect(await held.text()).toContain('two_factor_required');
+
+        const res = await setup(token, { password: 'seat-own-password' });
+        expect(res.status).toBe(200);
+        const { secret } = (await res.json()) as { secret: string };
+        const enabled = await configure(token, 'enable', {
+            code: liveTotp(seatName, secret),
+        });
+        expect(enabled.status).toBe(200);
+        expect((await otpState(userId)).enabled).toBe(true);
+
+        const released = await fetch(new URL('/teams', env.apiOrigin), {
+            headers: { authorization: `Bearer ${token}` },
+        });
+        expect(released.status).toBe(200);
+    });
 });

 /**
@@ -725,152 +680,3 @@ describe('temp-account reauth over HTTP', () => {
        expect(who.status).toBe(200);
    });
 });
-
-describe('session token helpers over HTTP', () => {
-    let env: PuterTestEnv;
-
-    beforeAll(async () => {
-        env = await setupPuterTestEnv();
-    }, 120_000);
-
-    afterAll(async () => {
-        await env?.shutdown();
-    }, 120_000);
-
-    const signupTemp = async () => {
-        const res = await fetch(new URL('/signup', env.origin), {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ is_temp: true }),
-        });
-        expect(res.status).toBe(200);
-        return (await res.json()) as { token: string; user: { uuid: string } };
-    };
-
-    const get = (path: string, token: string) =>
-        fetch(new URL(path, env.origin), {
-            headers: { authorization: `Bearer ${token}` },
-        });
-
-    const claims = (token: string) =>
-        env.server.services.token.verify('auth', token) as {
-            type: string;
-            user_uid: string;
-            session_uid: string;
-        };
-
-    it('mint tokens for the session the request authenticated with', async () => {
-        const { token, user } = await signupTemp();
-        const session = claims(token);
-        const row = await env.server.stores.user.getByUuid(user.uuid);
-        const getById = vi.spyOn(env.server.stores.user, 'getById');
-        try {
-            const gui = await get('/get-gui-token', token);
-            expect(gui.status).toBe(200);
-            const { token: guiToken } = (await gui.json()) as {
-                token: string;
-            };
-            expect(claims(guiToken)).toMatchObject({
-                type: 'gui',
-                user_uid: user.uuid,
-                session_uid: session.session_uid,
-            });
-
-            const sync = await get('/session/sync-cookie', token);
-            expect(sync.status).toBe(204);
-            const cookie = sync.headers.get('set-cookie') ?? '';
-            const cookieToken = /puter_auth_token=([^;]+)/.exec(cookie)?.[1];
-            expect(claims(cookieToken!)).toMatchObject({
-                type: 'session',
-                user_uid: user.uuid,
-                session_uid: session.session_uid,
-            });
-
-            // The user is the row token auth already read.
-            expect(getById.mock.calls.filter(([id]) => id === row!.id)).toEqual(
-                [],
-            );
-        } finally {
-            getById.mockRestore();
-        }
-    });
-
-    it("refuse a deleted account's session before either handler runs", async () => {
-        const { token, user } = await signupTemp();
-        const row = await env.server.stores.user.getByUuid(user.uuid);
-        await env.server.clients.db.write('DELETE FROM `user` WHERE `id` = ?', [
-            row!.id,
-        ]);
-        await env.server.stores.user.markDeleted(row!);
-
-        expect((await get('/get-gui-token', token)).status).toBe(401);
-        const sync = await get('/session/sync-cookie', token);
-        expect(sync.status).toBe(401);
-        expect(sync.headers.get('set-cookie') ?? '').not.toContain(
-            'puter_auth_token=',
-        );
-    });
-
-    describe("the shell's guiTokenDigest", () => {
-        /** The session cookie `/session/sync-cookie` sets for `token`. */
-        const sessionCookie = async (token: string) => {
-            const sync = await get('/session/sync-cookie', token);
-            expect(sync.status).toBe(204);
-            const value = /puter_auth_token=([^;]+)/.exec(
-                sync.headers.get('set-cookie') ?? '',
-            )?.[1];
-            expect(value).toBeTruthy();
-            return `puter_auth_token=${value}`;
-        };
-
-        /** What the shell at `path` renders for `guiTokenDigest`. */
-        const shellDigest = async (path: string, cookie?: string) => {
-            const res = await fetch(new URL(path, env.origin), {
-                headers: cookie ? { cookie } : {},
-            });
-            expect(res.status).toBe(200);
-            const html = await res.text();
-            const match = /"guiTokenDigest":(null|"[0-9a-f]{32}")/.exec(html);
-            if (!match) {
-                expect(html).not.toContain('guiTokenDigest');
-                return undefined;
-            }
-            return JSON.parse(match[1]) as string | null;
-        };
-
-        it("names the token /get-gui-token hands over for the session cookie", async () => {
-            const { token } = await signupTemp();
-            const cookie = await sessionCookie(token);
-
-            const gui = await fetch(new URL('/get-gui-token', env.origin), {
-                headers: { cookie },
-            });
-            expect(gui.status).toBe(200);
-            const { token: guiToken } = (await gui.json()) as { token: string };
-
-            const digest = await shellDigest('/', cookie);
-            expect(digest).toBe(await tokenClaimsDigest(guiToken));
-            // The token the browser stored at sign-up is for the same session.
-            expect(await tokenClaimsDigest(token)).toBe(digest);
-        });
-
-        it('is null without a session cookie, even with a token in the URL', async () => {
-            const { token } = await signupTemp();
-            expect(await shellDigest('/')).toBe(null);
-            expect(
-                await shellDigest(`/?auth_token=${encodeURIComponent(token)}`),
-            ).toBe(null);
-        });
-
-        it('is left out when the session cookie does not resolve to a session', async () => {
-            const { token } = await signupTemp();
-            const cookie = await sessionCookie(token);
-            await env.server.services.auth.revokeSession(claims(token).session_uid);
-
-            expect(await shellDigest('/', cookie)).toBe(undefined);
-            expect(await shellDigest('/', 'puter_auth_token=garbage')).toBe(
-                undefined,
-            );
-        });
-    });
-});
@@ -1,371 +0,0 @@
-import { TOTP } from 'otpauth';
-import { v4 as uuidv4 } from 'uuid';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import {
-    createTestUser,
-    setupPuterTestEnv,
-    type PuterTestEnv,
-} from '../../testUtil.js';
-import { installSeatStub } from '../../testFixtures/seatStub.js';
-
-describe('account change second-factor verification', () => {
-    let env: PuterTestEnv;
-    const password = 'email-change-password';
-    const links = new Map<string, string>();
-
-    beforeAll(async () => {
-        env = await setupPuterTestEnv();
-        vi.spyOn(env.server.clients.email, 'send').mockImplementation(
-            async (to, template, values) => {
-                if (template === 'email_verification_link')
-                    links.set(to, String(values?.link));
-                return null;
-            },
-        );
-    }, 120_000);
-    afterAll(async () => {
-        await env?.shutdown();
-    });
-
-    const account = async (enabled = true, oidcOnly = false) => {
-        const username = `email2fa_${uuidv4().slice(0, 8)}`;
-        const credentials = await createTestUser(env.server, {
-            username,
-            password,
-        });
-        const user = (await env.server.stores.user.getByUsername(username))!;
-        const otp = new TOTP({
-            issuer: 'puter.com',
-            label: username,
-            algorithm: 'SHA1',
-            digits: 6,
-        });
-        await env.server.stores.user.update(user.id, {
-            email: `${username}@example.com`,
-            email_confirmed: true,
-            otp_enabled: enabled,
-            otp_secret: otp.secret.base32,
-            ...(oidcOnly ? { password: null } : {}),
-        });
-        return { ...credentials, id: user.id, uuid: user.uuid, otp };
-    };
-
-    const change = (
-        token: string,
-        body: Record<string, unknown>,
-        revalidation?: string,
-        path = '/user-protected/change-email',
-    ) =>
-        fetch(new URL(path, env.origin), {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                cookie: `puter_auth_token=${token}${revalidation ? `; puter_revalidation=${revalidation}` : ''}`,
-            },
-            body: JSON.stringify(body),
-        });
-
-    it.each([undefined, 'invalid-code', 123456, {}])(
-        'rejects an enabled account with code %j before staging a change',
-        async (code) => {
-            const user = await account();
-            const response = await change(user.token, {
-                password,
-                new_email: '[email protected]',
-                code,
-            });
-            expect(response.status).toBeGreaterThanOrEqual(400);
-            expect(response.status).toBeLessThan(500);
-            expect(await response.json()).toMatchObject({ factor: 'otp' });
-            const after = await env.server.stores.user.getById(user.id, {
-                force: true,
-            });
-            expect(after!.change_email_confirm_token).toBeFalsy();
-            expect(after!.unconfirmed_change_email).toBeFalsy();
-        },
-    );
-
-    it('rejects an incorrect six-digit code without staging the address', async () => {
-        const user = await account();
-        const code = ['000000', '000001', '000002', '000003'].find(
-            (token) => user.otp.validate({ token, window: 1 }) === null,
-        );
-        const response = await change(user.token, {
-            password,
-            new_email: '[email protected]',
-            code,
-        });
-        expect(response.status).toBe(401);
-        expect(await response.json()).toMatchObject({
-            code: 'code_mismatch',
-            factor: 'otp',
-        });
-        expect(
-            (await env.server.stores.user.getById(user.id, { force: true }))!
-                .change_email_confirm_token,
-        ).toBeFalsy();
-    });
-
-    it('refuses a change when the enabled account secret is unavailable', async () => {
-        const user = await account();
-        await env.server.stores.user.update(user.id, {
-            otp_secret: 'invalid!',
-        });
-        expect(
-            (
-                await change(user.token, {
-                    password,
-                    new_email: '[email protected]',
-                    code: '000000',
-                })
-            ).status,
-        ).toBe(401);
-    });
-
-    it('requires a code even after OIDC revalidation', async () => {
-        const user = await account(true, true);
-        const proof = env.server.services.token.sign(
-            'oidc-state',
-            {
-                user_uuid: user.uuid,
-                purpose: 'revalidate',
-            },
-            { expiresIn: '5m' },
-        );
-        expect(
-            (
-                await change(
-                    user.token,
-                    { new_email: '[email protected]' },
-                    proof,
-                )
-            ).status,
-        ).toBe(400);
-        expect(
-            (
-                await change(
-                    user.token,
-                    {
-                        new_email: '[email protected]',
-                        code: user.otp.generate(),
-                    },
-                    proof,
-                )
-            ).status,
-        ).toBe(200);
-    });
-
-    it.each([true, false])(
-        'completes the change with the required factors (2FA enabled: %s)',
-        async (enabled) => {
-            const user = await account(enabled);
-            const newEmail = `${uuidv4()}@example.com`;
-            expect(
-                (
-                    await change(user.token, {
-                        password,
-                        new_email: newEmail,
-                        ...(enabled ? { code: user.otp.generate() } : {}),
-                    })
-                ).status,
-            ).toBe(200);
-            const link = links.get(newEmail)!;
-            expect(link).toBeTruthy();
-            expect((await fetch(link, { redirect: 'manual' })).status).toBe(
-                200,
-            );
-            expect(
-                (await env.server.stores.user.getById(user.id, {
-                    force: true,
-                }))!.email,
-            ).toBe(newEmail);
-        },
-    );
-
-    it('requires a new request if 2FA is enabled after the link was issued', async () => {
-        const user = await account(false);
-        const newEmail = `${uuidv4()}@example.com`;
-        expect(
-            (await change(user.token, { password, new_email: newEmail }))
-                .status,
-        ).toBe(200);
-        await env.server.stores.user.update(user.id, { otp_enabled: true });
-        expect(
-            (await fetch(links.get(newEmail)!, { redirect: 'manual' })).status,
-        ).toBe(400);
-        expect(
-            (await env.server.stores.user.getById(user.id, { force: true }))!
-                .email,
-        ).not.toBe(newEmail);
-    });
-
-    it('refuses an existing confirmation link that never verified 2FA', async () => {
-        const user = await account();
-        const token = uuidv4();
-        await env.server.stores.user.update(user.id, {
-            change_email_confirm_token: token,
-            unconfirmed_change_email: '[email protected]',
-        });
-        const link = env.server.services.token.sign(
-            'otp',
-            {
-                token,
-                user_id: user.id,
-                purpose: 'change-email',
-            },
-            { expiresIn: '1h' },
-        );
-        const response = await fetch(
-            new URL(`/change_email/confirm?token=${link}`, env.origin),
-            { redirect: 'manual' },
-        );
-        expect(response.status).toBe(400);
-        expect(
-            (await env.server.stores.user.getById(user.id, { force: true }))!
-                .email,
-        ).toBe(`${user.username}@example.com`);
-    });
-    describe('disabling 2FA', () => {
-        it.each([undefined, 'invalid-code', 123456, {}])(
-            'refuses code %j and retains the second-factor configuration',
-            async (code) => {
-                const user = await account();
-                await env.server.stores.user.update(user.id, {
-                    otp_recovery_codes: 'one,two,three',
-                });
-                const response = await change(
-                    user.token,
-                    { password, code },
-                    undefined,
-                    '/user-protected/disable-2fa',
-                );
-                expect(response.status).toBe(400);
-                expect(await response.json()).toMatchObject({ factor: 'otp' });
-                const after = await env.server.stores.user.getById(user.id, {
-                    force: true,
-                });
-                expect(after!.otp_enabled).toBeTruthy();
-                expect(after!.otp_secret).toBe(user.otp.secret.base32);
-                expect(after!.otp_recovery_codes).toBe('one,two,three');
-            },
-        );
-
-        it('rejects an incorrect six-digit code', async () => {
-            const user = await account();
-            const code = ['000000', '000001', '000002', '000003'].find(
-                (token) => user.otp.validate({ token, window: 1 }) === null,
-            );
-            const response = await change(
-                user.token,
-                { password, code },
-                undefined,
-                '/user-protected/disable-2fa',
-            );
-            expect(response.status).toBe(401);
-            expect(await response.json()).toMatchObject({
-                code: 'code_mismatch',
-                factor: 'otp',
-            });
-            expect(
-                (await env.server.stores.user.getById(user.id, {
-                    force: true,
-                }))!.otp_enabled,
-            ).toBeTruthy();
-        });
-
-        it.each([false, true])(
-            'accepts a current code after proving identity (OIDC-only: %s)',
-            async (oidcOnly) => {
-                const user = await account(true, oidcOnly);
-                const proof = oidcOnly
-                    ? env.server.services.token.sign(
-                          'oidc-state',
-                          {
-                              user_uuid: user.uuid,
-                              purpose: 'revalidate',
-                          },
-                          { expiresIn: '5m' },
-                      )
-                    : undefined;
-                const missing = await change(
-                    user.token,
-                    oidcOnly ? {} : { password },
-                    proof,
-                    '/user-protected/disable-2fa',
-                );
-                expect(missing.status).toBe(400);
-                const response = await change(
-                    user.token,
-                    {
-                        ...(oidcOnly ? {} : { password }),
-                        code: user.otp.generate(),
-                    },
-                    proof,
-                    '/user-protected/disable-2fa',
-                );
-                expect(response.status).toBe(200);
-                const after = await env.server.stores.user.getById(user.id, {
-                    force: true,
-                });
-                expect(after!.otp_enabled).toBeFalsy();
-                expect(after!.otp_secret).toBeNull();
-                expect(after!.otp_recovery_codes).toBeNull();
-            },
-        );
-
-        it('does not accept a code without password or OIDC revalidation', async () => {
-            const user = await account();
-            const response = await change(
-                user.token,
-                { code: user.otp.generate() },
-                undefined,
-                '/user-protected/disable-2fa',
-            );
-            expect(response.status).toBe(403);
-            expect(await response.json()).toMatchObject({
-                code: 'password_required',
-            });
-            expect(
-                (await env.server.stores.user.getById(user.id, {
-                    force: true,
-                }))!.otp_enabled,
-            ).toBeTruthy();
-        });
-
-        it('does not let a valid code override a team requirement for 2FA', async () => {
-            const member = await account(true, true);
-            installSeatStub(env.server as never, [member.id], {
-                require2fa: true,
-            });
-            const proof = env.server.services.token.sign('oidc-state', {
-                user_uuid: member.uuid, purpose: 'revalidate',
-            }, { expiresIn: '5m' });
-            const response = await change(
-                member.token,
-                { code: member.otp.generate() },
-                proof,
-                '/user-protected/disable-2fa',
-            );
-            expect(response.status).toBe(409);
-            expect(
-                (await env.server.stores.user.getById(member.id, {
-                    force: true,
-                }))!.otp_enabled,
-            ).toBeTruthy();
-        });
-
-        it('remains idempotent for an account with 2FA already disabled', async () => {
-            const user = await account(false);
-            expect(
-                (
-                    await change(
-                        user.token,
-                        { password },
-                        undefined,
-                        '/user-protected/disable-2fa',
-                    )
-                ).status,
-            ).toBe(200);
-        });
-    });
-});
@@ -1,282 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import type { IConfig } from '../../types.js';
-import { setupPuterTestEnv, type PuterTestEnv } from '../../testUtil.js';
-
-const PAGE = 'https://desk.first-party.test';
-// Seeded with godmode on.
-const DEV_CENTER = 'app-0b37f054-07d4-4627-8765-11bd23e889d4';
-
-/**
- * One of the deployment's own pages, served apart from the GUI, signs in with a
- * `web` session of its own under the user's sign-in.
- */
-describe('first-party page sessions', () => {
-    let env: PuterTestEnv;
-    let userId = 0;
-
-    beforeAll(async () => {
-        env = await setupPuterTestEnv({
-            first_party_session_origins: [`${PAGE}/`],
-        } as IConfig);
-        const row = await env.server.stores.user.getByUsername(
-            env.users.user.username,
-        );
-        userId = row!.id;
-    }, 120_000);
-
-    afterAll(async () => {
-        await env?.shutdown();
-    });
-
-    const call = (
-        method: string,
-        path: string,
-        token: string,
-        body?: unknown,
-        headers: Record<string, string> = {},
-    ) =>
-        fetch(new URL(path, env.apiOrigin), {
-            method,
-            headers: {
-                'content-type': 'application/json',
-                authorization: `Bearer ${token}`,
-                ...headers,
-            },
-            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-        });
-
-    /** A sign-in of its own, so revoking it leaves the shared one up. */
-    const signIn = async () => {
-        const user = await env.server.stores.user.getById(userId);
-        const { gui_token, session } =
-            await env.server.services.auth.createSessionToken(user!);
-        return { token: gui_token, uuid: session.uuid as string };
-    };
-
-    const mint = async (token: string, origin = PAGE) => {
-        const res = await call('POST', '/auth/first-party-session', token, {
-            origin,
-        });
-        expect(res.status).toBe(200);
-        return ((await res.json()) as { token: string }).token;
-    };
-
-    const actorOf = async (token: string) =>
-        (await env.server.services.auth.authenticate(token)).actor;
-
-    const sessions = async (token: string) => {
-        const res = await call('GET', '/auth/list-sessions', token);
-        expect(res.status).toBe(200);
-        return (await res.json()) as Array<Record<string, unknown>>;
-    };
-
-    it('hands the page a session of its own under the sign-in', async () => {
-        const root = await signIn();
-        const token = await mint(root.token);
-
-        const actor = await actorOf(token);
-        expect(actor?.app ?? null).toBeNull();
-        expect(actor?.accessToken ?? null).toBeNull();
-        expect(actor?.session).toMatchObject({
-            kind: 'web',
-            parentUid: root.uuid,
-        });
-        expect(actor?.session?.uid).not.toBe(root.uuid);
-
-        const row = (await sessions(root.token)).find(
-            (s) => s.uuid === actor!.session!.uid,
-        );
-        expect(row).toMatchObject({
-            kind: 'web',
-            parent_session_id: root.uuid,
-            first_party_origin: PAGE,
-            current: false,
-        });
-    });
-
-    it('reuses the session on a second ask', async () => {
-        const root = await signIn();
-        const first = await actorOf(await mint(root.token));
-        const second = await actorOf(await mint(root.token));
-        expect(second?.session?.uid).toBe(first?.session?.uid);
-    });
-
-    it('acts as the account: launches apps, godmode ones included', async () => {
-        const root = await signIn();
-        const token = await mint(root.token);
-
-        const res = await call('POST', '/auth/get-user-app-token', token, {
-            app_uid: DEV_CENTER,
-        });
-        expect(res.status).toBe(200);
-        expect(await res.json()).toMatchObject({ godmode: true });
-    });
-
-    it('refuses an origin that is not listed', async () => {
-        const root = await signIn();
-        const res = await call(
-            'POST',
-            '/auth/first-party-session',
-            root.token,
-            {
-                origin: 'https://elsewhere.test',
-            },
-        );
-        expect(res.status).toBe(403);
-    });
-
-    it('refuses a page on another origin, the listed page included', async () => {
-        const root = await signIn();
-        for (const origin of [PAGE, 'https://elsewhere.test']) {
-            const res = await call(
-                'POST',
-                '/auth/first-party-session',
-                root.token,
-                { origin: PAGE },
-                { origin },
-            );
-            expect(res.status).toBe(403);
-        }
-    });
-
-    it('refuses app tokens, access tokens and a first-party session', async () => {
-        const root = await signIn();
-        const page = await mint(root.token);
-        const app = (await (
-            await call('POST', '/auth/get-user-app-token', root.token, {
-                origin: 'https://some-app.test',
-            })
-        ).json()) as { token: string };
-        const godmode = (await (
-            await call('POST', '/auth/get-user-app-token', root.token, {
-                app_uid: DEV_CENTER,
-            })
-        ).json()) as { token: string };
-
-        for (const token of [page, app.token, godmode.token]) {
-            const res = await call('POST', '/auth/first-party-session', token, {
-                origin: PAGE,
-            });
-            expect(res.status).toBe(403);
-        }
-    });
-
-    it('never gets a session cookie', async () => {
-        const root = await signIn();
-        const page = await mint(root.token);
-
-        const syncCookie = (token: string) =>
-            fetch(new URL('/session/sync-cookie', env.origin), {
-                headers: { authorization: `Bearer ${token}` },
-            });
-        expect((await syncCookie(root.token)).status).toBe(204);
-
-        const res = await syncCookie(page);
-        expect(res.status).toBe(403);
-        expect(res.headers.get('set-cookie')).toBeNull();
-    });
-
-    it('ends with the sign-in it was handed out under', async () => {
-        const root = await signIn();
-        const page = await mint(root.token);
-        expect(await actorOf(page)).toBeDefined();
-
-        await env.server.services.auth.revokeSession(root.uuid);
-        const result = await env.server.services.auth.authenticate(page);
-        expect(result.actor).toBeUndefined();
-        expect(result.reauth?.reason).toBe('session_revoked');
-    });
-
-    it('takes the tokens minted under it along when its sign-in ends', async () => {
-        const root = await signIn();
-        const page = await mint(root.token);
-        const godmode = (await (
-            await call('POST', '/auth/get-user-app-token', page, {
-                app_uid: DEV_CENTER,
-            })
-        ).json()) as { token: string };
-        const scoped = (await (
-            await call('POST', '/auth/create-access-token', godmode.token, {
-                permissions: ['service:foo:ii:read'],
-                expiresIn: '7d',
-            })
-        ).json()) as { token: string };
-        expect(await actorOf(scoped.token)).toBeDefined();
-
-        await env.server.services.auth.revokeSession(root.uuid);
-        for (const token of [godmode.token, scoped.token]) {
-            expect(
-                (await env.server.services.auth.authenticate(token)).actor,
-            ).toBeUndefined();
-        }
-    });
-
-    it('is revoked on its own without ending the sign-in', async () => {
-        const root = await signIn();
-        const page = await mint(root.token);
-        const pageUuid = (await actorOf(page))!.session!.uid;
-
-        await env.server.services.auth.revokeSession(pageUuid);
-        expect(
-            (await env.server.services.auth.authenticate(page)).actor,
-        ).toBeUndefined();
-        expect(await actorOf(root.token)).toBeDefined();
-    });
-
-    it('keeps the whole current sign-in when revoking all others', async () => {
-        const root = await signIn();
-        const page = await mint(root.token);
-        const other = await signIn();
-        const otherPage = await mint(other.token);
-
-        // Asked from the page: its sign-in stays, and so does the page.
-        await env.server.services.auth.revokeAllSessions(
-            (await actorOf(page))!,
-        );
-        expect(await actorOf(page)).toBeDefined();
-        expect(await actorOf(root.token)).toBeDefined();
-        expect(
-            (await env.server.services.auth.authenticate(other.token)).actor,
-        ).toBeUndefined();
-        expect(
-            (await env.server.services.auth.authenticate(otherPage)).actor,
-        ).toBeUndefined();
-
-        // Asked from the sign-in: the page under it stays too.
-        await env.server.services.auth.revokeAllSessions(
-            (await actorOf(root.token))!,
-        );
-        expect(await actorOf(page)).toBeDefined();
-    });
-
-    it('is not counted as a sign-in', async () => {
-        const root = await signIn();
-        const before = await env.server.stores.session.listSignIns(userId, {
-            limit: 100,
-        });
-        await mint(root.token);
-        const after = await env.server.stores.session.listSignIns(userId, {
-            limit: 100,
-        });
-        expect(after.length).toBe(before.length);
-    });
-});
@@ -1,93 +0,0 @@
-import crypto from 'node:crypto';
-import type { Response } from 'express';
-import { HttpError } from '../../core/http/HttpError.js';
-import type { OIDCService } from '../../services/auth/OIDCService.js';
-import type { UserRow } from '../../stores/user/UserStore.js';
-import type { IConfig } from '../../types.js';
-import { sessionCookieFlags } from '../../util/cookieFlags.js';
-
-export const OIDC_POPUP_RETURN_COOKIE_NAME = 'puter_oidc_popup_return';
-export const OIDC_POPUP_RETURN_EXPIRY_SEC = 300;
-
-export interface OidcLoginContinuation {
-    userUuid: string;
-    redirectUri: string;
-    embeddedInPopup: boolean;
-    openerOrigin: string | null;
-    messageId: string | null;
-}
-
-interface OidcReturnDeps {
-    config: IConfig;
-    oidc: OIDCService;
-}
-
-/** Bind an attested popup return to the browser that completed sign-in. */
-export function mintOidcPopupReturn(
-    res: Response,
-    payload: Record<string, unknown>,
-    deps: OidcReturnDeps,
-): string {
-    const nonce = crypto.randomBytes(32).toString('base64url');
-    res.cookie(OIDC_POPUP_RETURN_COOKIE_NAME, nonce, {
-        ...sessionCookieFlags(deps.config, { crossSite: false }),
-        httpOnly: true,
-        maxAge: OIDC_POPUP_RETURN_EXPIRY_SEC * 1000,
-        path: '/',
-    });
-    return deps.oidc.signPopupReturn({ action: 'sign-in', ...payload, nonce });
-}
-
-/** Call only after both the provider and the account's second factor succeed. */
-export function completeOidcLoginReturn(
-    res: Response,
-    user: Pick<UserRow, 'uuid'>,
-    continuation: unknown,
-    deps: OidcReturnDeps,
-): string {
-    if (!continuation || typeof continuation !== 'object') {
-        throw new HttpError(400, 'Invalid login continuation.', {
-            legacyCode: 'bad_request',
-        });
-    }
-    const data = continuation as OidcLoginContinuation;
-    if (
-        data.userUuid !== user.uuid ||
-        typeof data.redirectUri !== 'string' ||
-        typeof data.embeddedInPopup !== 'boolean' ||
-        (data.openerOrigin !== null && typeof data.openerOrigin !== 'string') ||
-        (data.messageId !== null && typeof data.messageId !== 'string')
-    ) {
-        throw new HttpError(400, 'Invalid login continuation.', {
-            legacyCode: 'bad_request',
-        });
-    }
-    const origin = (deps.config.origin ?? '').replace(/\/$/, '');
-    let target = data.redirectUri || origin || '/';
-    try {
-        if (origin && new URL(target).origin !== new URL(origin).origin)
-            target = origin;
-    } catch {
-        target = origin || '/';
-    }
-    const append = (key: string, value: string) => {
-        target += `${target.includes('?') ? '&' : '?'}${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
-    };
-    if (data.embeddedInPopup) {
-        append('oidc_login', 'true');
-        append(
-            'opener_state',
-            mintOidcPopupReturn(
-                res,
-                {
-                    opener_origin: data.openerOrigin,
-                    msg_id: data.messageId,
-                    oidc_login: true,
-                    user_uuid: user.uuid,
-                },
-                deps,
-            ),
-        );
-    }
-    return target;
-}
@@ -1,139 +0,0 @@
-import { v4 as uuidv4 } from 'uuid';
-import {
-    afterAll,
-    afterEach,
-    beforeAll,
-    describe,
-    expect,
-    it,
-    vi,
-} from 'vitest';
-import { hashRecoveryCode } from '../../services/auth/OTPUtil.js';
-import {
-    createTestUser,
-    setupPuterTestEnv,
-    type PuterTestEnv,
-} from '../../testUtil.js';
-
-describe('recovery code consumption', () => {
-    let env: PuterTestEnv;
-    const password = 'recovery-code-password';
-
-    beforeAll(async () => {
-        env = await setupPuterTestEnv();
-    }, 120_000);
-    afterAll(async () => {
-        await env?.shutdown();
-    });
-    afterEach(() => {
-        vi.restoreAllMocks();
-    });
-
-    // Hold the same cached snapshot until every concurrent request has read it.
-    const overlapReads = (userUuid: string, count: number) => {
-        const redis = env.server.clients.redis;
-        const get = redis.get.bind(redis);
-        const ready = Promise.withResolvers<void>();
-        let reads = 0;
-        vi.spyOn(redis, 'get').mockImplementation(async (key: string) => {
-            const value = await get(key);
-            if (key.includes(userUuid) && reads < count) {
-                if (++reads === count) ready.resolve();
-                await ready.promise;
-            }
-            return value;
-        });
-    };
-
-    const post = async (path: string, body: Record<string, unknown>) => {
-        const response = await fetch(new URL(path, env.origin), {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify(body),
-        });
-        return { response, body: await response.json() };
-    };
-
-    const account = async (codes: string[]) => {
-        const username = `recovery_${uuidv4().slice(0, 8)}`;
-        await createTestUser(env.server, { username, password });
-        const user = (await env.server.stores.user.getByUsername(username))!;
-        await env.server.stores.user.update(user.id, {
-            otp_enabled: true,
-            otp_secret: 'TESTSECRETBASE32',
-            otp_recovery_codes: codes.map(hashRecoveryCode).join(','),
-        });
-        const challenge = async () => {
-            const { response, body } = await post('/login', {
-                username,
-                password,
-            });
-            expect(response.status).toBe(202);
-            expect(body.next_step).toBe('otp');
-            return body.otp_jwt_token as string;
-        };
-        return { user, challenge };
-    };
-
-    it('allows only one concurrent redemption of the same code', async () => {
-        const { user, challenge } = await account(['RECOVER1', 'RECOVER2']);
-        const tokens = await Promise.all([challenge(), challenge()]);
-        overlapReads(user.uuid, tokens.length);
-        const results = await Promise.all(
-            tokens.map((token) =>
-                post('/login/recovery-code', { token, code: 'RECOVER1' }),
-            ),
-        );
-        expect(
-            results.filter((result) => result.body.next_step === 'complete'),
-        ).toHaveLength(1);
-        expect(
-            results.filter((result) => result.body.proceed === false),
-        ).toHaveLength(1);
-        const after = await env.server.stores.user.getById(user.id, {
-            force: true,
-        });
-        expect(after!.otp_recovery_codes).toBe(hashRecoveryCode('RECOVER2'));
-    });
-
-    it('consumes different concurrent codes without restoring either one', async () => {
-        const codes = ['RECOVER1', 'RECOVER2', 'RECOVER3'];
-        const { user, challenge } = await account(codes);
-        const tokens = await Promise.all(codes.map(() => challenge()));
-        overlapReads(user.uuid, tokens.length);
-        const results = await Promise.all(
-            codes.map((code, index) =>
-                post('/login/recovery-code', { token: tokens[index], code }),
-            ),
-        );
-        expect(
-            results.every((result) => result.body.next_step === 'complete'),
-        ).toBe(true);
-        const after = await env.server.stores.user.getById(user.id, {
-            force: true,
-        });
-        expect(after!.otp_recovery_codes).toBe('');
-        const replay = await post('/login/recovery-code', {
-            token: tokens[0],
-            code: codes[0],
-        });
-        expect(replay.body).toMatchObject({ proceed: false });
-    });
-
-    it.each([{ code: 123456 }, { code: {} }, { code: [] }])(
-        'rejects a non-string recovery code $code without consuming a code',
-        async ({ code }) => {
-            const { user, challenge } = await account(['RECOVER1']);
-            const result = await post('/login/recovery-code', {
-                token: await challenge(),
-                code,
-            });
-            expect(result.response.status).toBe(400);
-            expect(
-                (await env.server.stores.user.getById(user.id, {
-                    force: true,
-                }))!.otp_recovery_codes,
-            ).toBe(hashRecoveryCode('RECOVER1'));
-        },
-    );
-});
@@ -1,89 +0,0 @@
-import { v4 as uuidv4 } from 'uuid';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { hashRecoveryCode } from '../../services/auth/OTPUtil.js';
-import {
-    createTestUser,
-    setupPuterTestEnv,
-    type PuterTestEnv,
-} from '../../testUtil.js';
-
-describe('2FA after signing in with a recovery code', () => {
-    let env: PuterTestEnv;
-    const password = 'lost-authenticator-password';
-
-    beforeAll(async () => {
-        env = await setupPuterTestEnv();
-    }, 120_000);
-    afterAll(async () => {
-        await env?.shutdown();
-    });
-
-    const post = (
-        path: string,
-        body: Record<string, unknown>,
-        cookie?: string,
-    ) =>
-        fetch(new URL(path, env.origin), {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                ...(cookie ? { cookie } : {}),
-            },
-            body: JSON.stringify(body),
-        });
-
-    it('allows an unused recovery code to disable 2FA after password revalidation', async () => {
-        const username = `lost2fa_${uuidv4().slice(0, 8)}`;
-        await createTestUser(env.server, { username, password });
-        const user = (await env.server.stores.user.getByUsername(username))!;
-        await env.server.stores.user.update(user.id, {
-            email: `${username}@example.com`,
-            email_confirmed: true,
-            otp_enabled: true,
-            otp_secret: 'TESTSECRETBASE32',
-            otp_recovery_codes: ['RECOVER1', 'RECOVER2', 'RECOVER3']
-                .map(hashRecoveryCode)
-                .join(','),
-        });
-
-        // Sign in with a recovery code: works, and yields a web session.
-        const login = await post('/login', { username, password });
-        expect(login.status).toBe(202);
-        const { otp_jwt_token } = await login.json();
-        const recovered = await post('/login/recovery-code', {
-            token: otp_jwt_token,
-            code: 'RECOVER1',
-        });
-        expect((await recovered.json()).next_step).toBe('complete');
-        const cookie = recovered.headers
-            .getSetCookie()
-            .find((value) => value.startsWith('puter_auth_token='))!
-            .split(';')[0]!;
-
-        const reused = await post(
-            '/user-protected/disable-2fa',
-            { password, code: 'RECOVER1' },
-            cookie,
-        );
-        expect(reused.status).toBe(401);
-        expect(
-            (await env.server.stores.user.getById(user.id, { force: true }))!
-                .otp_enabled,
-        ).toBeTruthy();
-
-        const disable = await post(
-            '/user-protected/disable-2fa',
-            { password, code: 'RECOVER2' },
-            cookie,
-        );
-        expect(disable.status).toBe(200);
-        expect(await disable.json()).toMatchObject({ success: true });
-
-        const after = await env.server.stores.user.getById(user.id, {
-            force: true,
-        });
-        expect(after!.otp_enabled).toBeFalsy();
-        expect(after!.otp_secret).toBeNull();
-        expect(after!.otp_recovery_codes).toBeNull();
-    });
-});
@@ -19,7 +19,6 @@

 import type { Request, Response } from 'express';
 import { Controller, Post } from '../../core/http/decorators.js';
-import { schedulesUnavailable } from '../../core/schedules.js';
 import type { BroadcastService } from '../../services/broadcast/BroadcastService.js';
 import type { ForwardBatch } from '../../services/events/forwardQueue.js';
 import { PuterController } from '../types.js';
@@ -109,42 +108,6 @@ export class BroadcastController extends PuterController {
        );
        res.status(200).json({ ok: true, ...reply });
    }
-
-    /**
-     * Schedule changes a region made for schedules this one owns, handed to
-     * `services.schedules`; `events_disabled` on a server without it.
-     */
-    @Post('/events/schedules', { subdomain: '*' })
-    async schedules(req: Request, res: Response): Promise<void> {
-        const broadcast = this.services.broadcast as unknown as
-            BroadcastService | undefined;
-        if (!broadcast) {
-            res.status(503).json({
-                error: { message: 'Broadcast service not registered' },
-            });
-            return;
-        }
-
-        const verified = await broadcast.verifySignedRequest(
-            req.rawBody,
-            broadcastHeaders(req),
-        );
-        if (!verified.ok) {
-            res.status(verified.status ?? 400).json({
-                error: { message: verified.message ?? 'Bad request' },
-            });
-            return;
-        }
-        if (verified.info?.ignored) {
-            res.status(200).json({ ok: true, ...verified.info });
-            return;
-        }
-
-        const schedules = this.services.schedules;
-        if (!schedules) throw schedulesUnavailable();
-        const reply = await schedules.receivePeerChanges(req.body);
-        res.status(200).json({ ok: true, ...reply });
-    }
 }

 const broadcastHeaders = (req: Request) => {
@@ -0,0 +1,253 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { HttpError } from '../../core/http/HttpError.js';
+import { PuterController } from '../types.js';
+
+const ALLOWED_LAYOUTS = ['icons', 'details', 'list'];
+const ALLOWED_SORT_BY = ['name', 'size', 'modified', 'type'];
+const ALLOWED_SORT_ORDER = ['asc', 'desc'];
+
+/**
+ * Desktop/UI preference routes.
+ *
+ * Two categories:
+ *
+ * - User-level: desktop background, taskbar items (UserStore)
+ * - Folder-level: layout, sort_by/sort_order (fsentries table)
+ */
+/**
+ * Desktop preference writes — background, taskbar, layout, sort order. All four
+ * persist to the user row on every call, and the GUI fires them on direct user
+ * action, so a per-minute ceiling well above human speed is enough to catch a
+ * stuck client.
+ */
+const PREFERENCE_WRITE_LIMIT = {
+    scope: 'desktop-preference',
+    limit: 120,
+    window: 60_000,
+    key: 'user',
+};
+
+export class DesktopController extends PuterController {
+    registerRoutes(router) {
+        // -- Desktop background --------------------------------------
+
+        router.post(
+            '/set-desktop-bg',
+            {
+                subdomain: 'api',
+                requireUserActor: true,
+                allowFullAccessToken: true,
+                rateLimit: PREFERENCE_WRITE_LIMIT,
+            },
+            async (req, res) => {
+                const { url, color, fit } = req.body ?? {};
+
+                const patch = {};
+                if (url !== undefined) {
+                    if (url !== null && typeof url !== 'string') {
+                        throw new HttpError(
+                            400,
+                            '`url` must be a string or null',
+                            { legacyCode: 'bad_request' },
+                        );
+                    }
+                    patch.desktop_bg_url = url;
+                }
+                if (color !== undefined) {
+                    if (color !== null && typeof color !== 'string') {
+                        throw new HttpError(
+                            400,
+                            '`color` must be a string or null',
+                            { legacyCode: 'bad_request' },
+                        );
+                    }
+                    patch.desktop_bg_color = color;
+                }
+                if (fit !== undefined) {
+                    if (fit !== null && typeof fit !== 'string') {
+                        throw new HttpError(
+                            400,
+                            '`fit` must be a string or null',
+                            { legacyCode: 'bad_request' },
+                        );
+                    }
+                    patch.desktop_bg_fit = fit;
+                }
+
+                if (Object.keys(patch).length === 0) {
+                    throw new HttpError(400, 'No fields provided', {
+                        legacyCode: 'bad_request',
+                    });
+                }
+
+                await this.stores.user.update(req.actor.user.id, patch);
+                res.json({});
+            },
+        );
+
+        // -- Taskbar items -------------------------------------------
+
+        router.post(
+            '/update-taskbar-items',
+            {
+                subdomain: 'api',
+                requireUserActor: true,
+                allowFullAccessToken: true,
+                rateLimit: PREFERENCE_WRITE_LIMIT,
+            },
+            async (req, res) => {
+                const { items } = req.body ?? {};
+                if (!Array.isArray(items)) {
+                    throw new HttpError(
+                        400,
+                        'Missing or invalid `items` array',
+                        { legacyCode: 'bad_request' },
+                    );
+                }
+
+                await this.stores.user.update(req.actor.user.id, {
+                    taskbar_items: JSON.stringify(items),
+                });
+                res.json({});
+            },
+        );
+
+        // -- Folder layout -------------------------------------------
+
+        router.post(
+            '/set_layout',
+            {
+                subdomain: 'api',
+                requireUserActor: true,
+                allowFullAccessToken: true,
+                rateLimit: PREFERENCE_WRITE_LIMIT,
+            },
+            async (req, res) => {
+                const { item_uid, item_path, layout } = req.body ?? {};
+                if (!layout || !ALLOWED_LAYOUTS.includes(layout)) {
+                    throw new HttpError(
+                        400,
+                        `\`layout\` must be one of: ${ALLOWED_LAYOUTS.join(', ')}`,
+                        { legacyCode: 'bad_request' },
+                    );
+                }
+                await this.#updateFSEntry(
+                    req.actor,
+                    { item_uid, item_path },
+                    { layout },
+                );
+                res.json({});
+            },
+        );
+
+        // -- Folder sort ---------------------------------------------
+
+        router.post(
+            '/set_sort_by',
+            {
+                subdomain: 'api',
+                requireUserActor: true,
+                allowFullAccessToken: true,
+                rateLimit: PREFERENCE_WRITE_LIMIT,
+            },
+            async (req, res) => {
+                const { item_uid, item_path, sort_by, sort_order } =
+                    req.body ?? {};
+                if (!sort_by || !ALLOWED_SORT_BY.includes(sort_by)) {
+                    throw new HttpError(
+                        400,
+                        `\`sort_by\` must be one of: ${ALLOWED_SORT_BY.join(', ')}`,
+                        { legacyCode: 'bad_request' },
+                    );
+                }
+                const resolvedOrder = sort_order ?? 'asc';
+                if (!ALLOWED_SORT_ORDER.includes(resolvedOrder)) {
+                    throw new HttpError(
+                        400,
+                        `\`sort_order\` must be one of: ${ALLOWED_SORT_ORDER.join(', ')}`,
+                        { legacyCode: 'bad_request' },
+                    );
+                }
+                await this.#updateFSEntry(
+                    req.actor,
+                    { item_uid, item_path },
+                    {
+                        sort_by,
+                        sort_order: resolvedOrder,
+                    },
+                );
+                res.json({});
+            },
+        );
+    }
+
+    // -- Helpers ------------------------------------------------------
+
+    /**
+     * Update columns on an actor-owned fsentry. Accepts either `item_uid` (fast
+     * path) or `item_path` (path lookups in FSEntryStore now have a
+     * recursive-CTE fallback for legacy rows with a NULL `path` column, so this
+     * works for old accounts too).
+     *
+     * Ownership: `entry.user_id === actor.user.id`. Kept as added validation
+     * against bad paths — the previous "drop user_id entirely" theory turned
+     * out to be wrong (the actual legacy issue was NULL paths, not user_id
+     * drift), so this filter doesn't lock out old accounts in practice.
+     */
+    async #updateFSEntry(actor, { item_uid, item_path }, patch) {
+        if (!item_uid && !item_path) {
+            throw new HttpError(400, 'Missing `item_uid` or `item_path`', {
+                legacyCode: 'bad_request',
+            });
+        }
+
+        const entry = item_uid
+            ? await this.stores.fsEntry.getEntryByUuid(item_uid)
+            : await this.stores.fsEntry.getEntryByPath(item_path);
+        if (!entry) {
+            throw new HttpError(404, 'Item not found', {
+                legacyCode: 'not_found',
+            });
+        }
+
+        const actorUserId = actor?.user?.id;
+        if (typeof actorUserId !== 'number' || entry.userId !== actorUserId) {
+            throw new HttpError(403, 'Not allowed to update this item', {
+                legacyCode: 'forbidden',
+            });
+        }
+
+        const keys = Object.keys(patch);
+        const setClause = keys.map((k) => `\`${k}\` = ?`).join(', ');
+        const values = keys.map((k) => patch[k]);
+
+        await this.clients.db.write(
+            `UPDATE \`fsentries\` SET ${setClause} WHERE \`id\` = ?`,
+            [...values, entry.id],
+        );
+
+        await this.stores.fsEntry.invalidateEntryCacheByUuid(entry.uuid);
+    }
+
+    onServerStart() {}
+    onServerPrepareShutdown() {}
+    onServerShutdown() {}
+}