chore: release v0.10.0

Check in the .vex.toml that enables semantic embeddings, call-graph,
BM25, and auto-update for the vex code-search index.

.claude/docs/entity-relationships.md

@@ -1,8 +1,8 @@
 # Entity Relationships
 
-```
+```text
 ServiceProvider → type: "immich" (inferred capabilities: notifications, commands)
-NotificationTracker → provider_id, collection_ids, scan_interval, batch_duration, enabled
+NotificationTracker → provider_id, collection_ids, scan_interval, adaptive_max_skip, filters, default_tracking_config_id, default_template_config_id, enabled
 NotificationTrackerTarget → notification_tracker_id, target_id, tracking_config_id, template_config_id, quiet_hours, enabled
 TrackingConfig → provider_type, event flags, scheduling rules
 TemplateConfig → provider_type, Jinja2 template slots per event type

.claude/docs/feature-backlog.md

@@ -0,0 +1,177 @@
+# Feature Backlog
+
+Curated feature ideas, narrowed from a brainstorming pass on 2026-05-13.
+Order is **rough sequencing preference**, not strict priority — adjust as we go.
+
+---
+
+## 1. Quiet Hours — close the gaps in the existing system
+
+**Reality check (verified 2026-05-13).** Quiet hours are already shipped under
+the "deferred dispatch" name in v0.8.0. The pipeline lives at
+`packages/server/src/notify_bridge_server/services/deferred_dispatch.py` with
+helpers in `dispatch_helpers.py` and tests in
+`tests/test_deferred_dispatch.py`. What exists:
+
+- Per-tracking-config window: `tracking_config.quiet_hours_enabled`,
+  `quiet_hours_start`, `quiet_hours_end`.
+- Per-link override: `notification_tracker_target.quiet_hours_start`,
+  `quiet_hours_end`.
+- Smart coalescing (asset add + asset remove during a window cancels each
+  other out, set-union merge for repeated adds).
+- Post-window drain via APScheduler one-shot date jobs.
+- Wall-clock event types (`scheduled_message`) drop instead of deferring.
+- Frontend status surface: `deferred`, `deferred_then_dropped`,
+  `deferred_then_failed`, with `deferred_until` and `deferred_for_seconds`
+  fields exposed in the event log.
+
+**What's NOT there (the actual gaps):**
+
+| Gap | Sketch |
+| --- | --- |
+| **Target-level windows** | Today, hours bind to the *watcher* (tracking config / link). Users naturally think of DND at the *destination* ("don't ping my phone at night, regardless of source"). New column on `notification_target` + dispatcher gate. |
+| **Multiple windows per row** | Today is a single HH:MM range. Real schedules want weekday-evening + weekend-all-day. JSON list of windows. |
+| **Days-of-week** | Same window every day. Need `days: ["mon", "tue", ...]` filter per window. |
+| **Per-window timezone** | Uses the global app TZ. Multi-traveller / multi-target setups want per-window TZ. |
+| **Silent mode** | Modes today are defer-or-drop. Telegram `disable_notification=true` ("send but don't ring") is a third useful mode. |
+| **Per-receiver windows** | One bot → multiple chats, each potentially with its own DND. Today it's all-or-nothing per target. |
+
+**Recommended cut for v1 of "extend quiet hours":**
+
+- Add target-level quiet hours (new column `notification_target.quiet_hours_json`
+  = list of `{days, start, end, mode, tz}`).
+- Modes: `drop`, `defer`, `silent`. `defer` reuses the existing
+  deferred-dispatch pipeline (just changes who decides). `silent` maps to
+  `disable_notification=true` for Telegram; other targets fall through to
+  normal send (or we treat `silent` as `defer` for non-Telegram targets — TBD).
+- Dispatcher precedence: target window wins over link/tracking-config window
+  when both are configured. Document this explicitly.
+- Frontend: new "Quiet hours" fieldset in the target editor (Aurora cassette
+  style). Reuses Timezone picker; new day-picker chip row.
+- Skip days-of-week + multi-window in v1 if scope grows — ship the target-level
+  cut first, then iterate.
+
+**Open questions.**
+
+- How exactly do target / link / tracking-config windows combine? Proposal:
+  any window covering "now" wins (drop > defer > silent precedence).
+- Should `silent` for non-Telegram targets degrade to normal send or to
+  defer? Defer is the safer default.
+- Does the event log need a new status (`silenced` / `dropped_by_target_qh`)
+  to make precedence visible?
+
+---
+
+## 2. Immich Smart Actions (expand beyond Auto-Organize)
+
+**What.** Extend the existing Smart Actions pattern (currently:
+**Immich Auto-Organize**) with more rule-driven actions against the Immich API.
+
+**Why.** Auto-Organize already proves the descriptor → rule editor → executor
+pipeline. Adding actions is mostly authoring new executors + small UI rule
+shapes, not new infra.
+
+**Candidates (pick in this order).**
+
+1. **Auto-favorite by person** — when an asset is detected containing person
+   X (or any of a set), mark it favorite.
+2. **Auto-archive by age / album** — assets older than N days in a given
+   album get archived. Pair with a "dry-run shows count" UX like
+   Auto-Organize already has.
+3. **Duplicate cluster nudge** — periodically run Immich's duplicate API and
+   send a digest notification with inline buttons ("review", "ignore for 30d").
+   Depends on inline-button work (see backlog item 4 dependencies).
+4. **Share-link rotation** — for an album, regenerate the share link every N
+   days; notify with the new URL.
+5. **Pending-delete review** — push a weekly digest of trash contents before
+   Immich's auto-purge fires.
+
+**Shape.**
+
+- Reuse the existing **action descriptor** layer
+  (`packages/core/src/notify_bridge_core/providers/actions.py`,
+  `action_executor.py`) and the frontend rule editor used by Auto-Organize.
+- Each new action = (a) executor in core, (b) rule schema in the descriptor,
+  (c) frontend descriptor extension for the rule editor fields.
+- Persist as `provider_actions` rows (already exists for Auto-Organize) with
+  a discriminator + JSON config.
+
+**Open questions.**
+
+- Does "auto-favorite by person" need a confirmation queue or run silently?
+  Default to silent + event_log entry.
+- How do we surface "this action moved/changed X assets" in the dashboard?
+  Probably a per-action stat tile on the provider detail page.
+
+---
+
+## 3. Home Assistant Provider
+
+**Full plan:** [feature-home-assistant.md](feature-home-assistant.md).
+
+**One-line summary.** New WebSocket-based service provider with a 3-phase
+ship: subscribe + dispatch (Phase 1), bot commands (Phase 2), HA service
+calls as Smart Actions (Phase 3). Chosen over webhook ingest because
+Phases 2 + 3 force a long-lived API connection anyway; consolidating on WS
+avoids a refactor.
+
+**Status:** planned, not started.
+
+---
+
+## 4. Block-Based Template Builder
+
+**What.** A visual, drag-and-drop builder for notification and command
+templates that compiles down to Jinja2. Lives alongside (not instead of) the
+current `JinjaEditor`. Author can flip between views.
+
+**Why.** The current Jinja editor is powerful but unforgiving. A block UI
+lowers the floor for new users and provides a discovery surface for the
+variables documented in `template_configs.py`.
+
+**Shape.**
+
+- Frontend-only feature for v1 — compiles to the same Jinja strings the
+  backend already accepts.
+- Blocks: `Text`, `Variable`, `If`, `For`, `Link`, `Image`, `Icon`, `Caption`,
+  `Group` (HTML span/group). Each block knows its serialized Jinja
+  representation.
+- Round-trip: variables, simple `{% if %}` / `{% for %}` blocks, and string
+  literals parse back to blocks; arbitrary Jinja stays in a "Raw" block that
+  the user can edit as text.
+- Variable picker reads `get_template_variables(provider_type, slot)`. This is
+  the same data already shown in the template-help panel.
+- Preview pane unchanged — reuses `services/sample_context.py` server
+  rendering.
+- Toggle in the template editor: **Visual / Code**.
+
+**Open questions.**
+
+- Round-tripping arbitrary Jinja is hard. v1: parseable subset → blocks,
+  anything else → single Raw block. Show a banner explaining.
+- Locale handling: same compiled Jinja, just authored per locale tab.
+- Do we want a marketplace of pre-built block compositions? Out of scope for
+  v1 — bundle import/export is a separate backlog item.
+
+---
+
+## Recommended Sequencing
+
+1. **Quiet Hours per Target** — small, isolated, immediate user value.
+2. **Immich Smart Actions** — incremental on existing pattern; ship one
+   action at a time (start with auto-favorite by person).
+3. **Home Assistant Provider** — multi-file, follows new-provider checklist;
+   biggest user-base expansion.
+4. **Block-Based Template Builder** — largest frontend lift; benefits from
+   the variable-doc work that the other features will exercise.
+
+Dependencies are loose — 1 and 2 are independent of 3 and 4. The block
+builder pairs nicely with Home Assistant because HA's rich context surfaces
+the value of an easier authoring UX.
+
+---
+
+## Decision log
+
+- **2026-05-13** — Backlog seeded with these four items selected from a
+  broader brainstorm. Not started.

.claude/docs/feature-home-assistant.md

@@ -0,0 +1,284 @@
+# Home Assistant Provider — Implementation Plan
+
+> Status: **planned, not started**. Sequencing: third item on the backlog
+> (see [feature-backlog.md](feature-backlog.md)).
+> Last updated: 2026-05-13.
+
+## Decision: WebSocket subscription, not webhook
+
+We considered three ingest modes (webhook automation, WebSocket subscription,
+hybrid). The WebSocket route is chosen as the architectural foundation because
+the medium-term roadmap forces it anyway:
+
+| Phase | Capability | Needs API access? |
+| --- | --- | --- |
+| 1 | Subscribe to events, emit notifications | Read (event stream) |
+| 2 | Bot commands (`/state`, `/entities`, `/areas`) | Read (REST or WS get_states) |
+| 3 | Smart Actions (`light.turn_on`, scene activation) | Write (call_service) |
+
+A webhook-only Phase 1 would still need a REST client by Phase 2 and a write
+path by Phase 3 — net result is two client implementations + one event
+pipeline refactor. WebSocket consolidates all three phases on one connection.
+
+**Tradeoff (be honest):** WebSocket introduces a long-lived-connection pattern
+this codebase does not have yet. Reconnect logic, missed-events-on-restart
+gap, and a new shape on the `ServiceProvider` ABC are real costs. Phase 1 is
+**not** shippable in one short session — plan for a multi-session build.
+
+## Provider abstraction extension
+
+The current `ServiceProvider` ABC
+([packages/core/src/notify_bridge_core/providers/base.py](../../packages/core/src/notify_bridge_core/providers/base.py))
+is poll-oriented: every provider implements `poll(collection_ids, state) →
+(events, new_state)`. Webhook providers (Gitea, Planka, Webhook) satisfy this
+by no-op'ing `poll` and shoving events in via `api/webhooks.py` instead.
+
+Home Assistant fits neither cleanly. The plan:
+
+1. Add an **optional** `async subscribe(emit) → None` method on the base ABC.
+   Default implementation raises `NotImplementedError`. Polling providers do
+   not override it. The scheduler / lifecycle layer (currently `services/watcher.py`)
+   gains a "subscription manager" branch that, for any provider whose class
+   overrides `subscribe`, starts a long-lived task instead of registering
+   a polling job.
+2. `emit` is a callback `(event: ServiceEvent) → None` provided by the
+   subscription manager — it routes events to the dispatcher exactly like the
+   webhook handler does today. Keeping the dispatch path unchanged is the
+   point of this design.
+3. Reconnect lives **inside** `subscribe`: the method is expected to be a
+   `while not cancelled: try connect; on drop, sleep with backoff, retry`
+   loop. The manager cancels the task on shutdown via the cooperative cancel
+   token used elsewhere.
+
+This is a small, additive change to one ABC. No existing provider is
+modified.
+
+## Phase 1 — Subscribe + Dispatch (MVP)
+
+### Scope
+
+- Long-lived WebSocket connection to HA, authenticated with a long-lived
+  access token.
+- Subscribe to the event bus with optional `event_type` filter (defaults to
+  `state_changed`).
+- Translate HA events into `ServiceEvent` and dispatch via the existing
+  pipeline. Notifications go out exactly as they do today for any other
+  provider.
+- Filter UI: entity-id glob list, domain allowlist (e.g. `light.*`,
+  `binary_sensor.*`), event-type allowlist. **Hard-required** to avoid the HA
+  firehose drowning the bridge.
+- Connection test + entity listing via WS `get_states` (no REST client yet —
+  WS gives us both subscribe and read).
+
+### Out of scope for Phase 1
+
+- Bot commands → Phase 2.
+- Service calls → Phase 3.
+- Replay of events missed during disconnect (HA does not support this; we
+  document the gap and surface "reconnected after N seconds" in the event
+  log).
+- Webhook-style ingestion (path-embedded token webhook receiver). If a user
+  prefers webhooks, we add it later as a second ingestion mode on the same
+  provider — out of scope for v1.
+
+### Event types (v1)
+
+| HA event | ServiceEvent type | Notification slot |
+| --- | --- | --- |
+| `state_changed` | `ha_state_changed` | `message_state_changed` |
+| `automation_triggered` | `ha_automation_triggered` | `message_automation_triggered` |
+| `call_service` | `ha_service_called` | `message_service_called` |
+| (custom event types) | `ha_event_fired` | `message_event_fired` |
+
+Default tracking config enables `state_changed` only — the others are loud
+and opt-in.
+
+### Context variables exposed to templates
+
+Pulled directly from HA's `state_changed` payload, normalized:
+
+- `entity_id` — `light.kitchen`
+- `friendly_name` — `attributes.friendly_name` or fallback to `entity_id`
+- `domain` — derived from `entity_id` before the dot
+- `old_state` — `from_state.state`
+- `new_state` — `to_state.state`
+- `attributes` — dict of new-state attributes (raw)
+- `device_class` — `attributes.device_class` if present
+- `area` — `attributes.area_id` if present (best effort; only set if HA
+  exposes it via the area registry, which costs a `get_registry` WS call —
+  see "Open questions")
+- `last_changed`, `last_updated` — ISO timestamps
+- For non-`state_changed` events: `event_type`, `event_data` (full dict)
+
+### File touch map (Phase 1)
+
+**Core** (`packages/core/src/notify_bridge_core/`)
+
+| Path | Action | Notes |
+| --- | --- | --- |
+| `providers/base.py` | Modify | Add optional `subscribe(emit)` ABC method (default `NotImplementedError`); add `HOME_ASSISTANT = "home_assistant"` to `ServiceProviderType` |
+| `providers/capabilities.py` | Modify | Add `HOME_ASSISTANT_CAPABILITIES` + register |
+| `providers/home_assistant/__init__.py` | Create | Export + register template variables |
+| `providers/home_assistant/client.py` | Create | WebSocket client (auth, subscribe, get_states, call_service stub) |
+| `providers/home_assistant/event_parser.py` | Create | HA event dict → `ServiceEvent` |
+| `providers/home_assistant/provider.py` | Create | Class with `connect`, `disconnect`, `subscribe`, `list_collections` (entity list), `get_available_variables`, `get_provider_config_schema`, `test_connection`. `poll` raises NotImplementedError. |
+| `templates/defaults/en/home_assistant_*.jinja2` | Create | 4 slot templates |
+| `templates/defaults/ru/home_assistant_*.jinja2` | Create | 4 slot templates |
+| `templates/defaults/loader.py` | Modify | Add to `PROVIDER_SLOT_FILE_MAP` |
+| `templates/command_defaults/loader.py` | Modify | Stub entry — empty commands list for now |
+| `templates/context.py` | Modify | HA context builder |
+| `templates/validator.py` | Modify | Whitelist HA variable names |
+
+**Server** (`packages/server/src/notify_bridge_server/`)
+
+| Path | Action | Notes |
+| --- | --- | --- |
+| `services/watcher.py` *(or scheduler / lifecycle module that hosts polling)* | Modify | Add subscription-manager branch — for providers whose class overrides `subscribe`, start/stop long-running task instead of polling |
+| `services/scheduler.py` | Verify | Confirm we cancel HA subscription on shutdown (graceful_shutdown_seconds path) |
+| `api/template_configs.py` | Modify | `get_template_variables()` entry |
+| `api/command_template_configs.py` | Modify | Sample ctx (minimal for Phase 1 — no commands) |
+| `services/sample_context.py` | Modify | `_SAMPLE_CONTEXT["home_assistant"]` |
+| `database/seeds.py` | Modify | Seed notification templates + default tracking config |
+
+**Frontend** (`frontend/src/`)
+
+| Path | Action | Notes |
+| --- | --- | --- |
+| `lib/providers/home-assistant.ts` | Create | Descriptor per CLAUDE.md rule 11 |
+| `lib/providers/index.ts` | Modify | Register descriptor |
+| `lib/locales/en.json` | Modify | `providers.typeHomeAssistant`, `gridDesc.providerHomeAssistant` |
+| `lib/locales/ru.json` | Modify | Same |
+
+**Tests**
+
+| Path | Action |
+| --- | --- |
+| `packages/core/tests/providers/test_home_assistant_parser.py` | Create — HA payload → `ServiceEvent` |
+| `packages/core/tests/providers/test_home_assistant_client.py` | Create — WS auth, subscribe, reconnect (use a fake server) |
+| `packages/server/tests/test_home_assistant_subscription.py` | Create — subscription manager lifecycle, event flows through dispatcher |
+
+### Frontend descriptor essentials
+
+```text
+type: "home_assistant"
+defaultName: "Home Assistant"
+icon: "home" (consider Lucide icon; HA logo if a custom asset exists)
+hasUrl: true            // base URL of HA (used to derive WS URL)
+configFields:
+  - url:                http(s)://homeassistant.local:8123
+  - access_token:       long-lived access token (required)
+  - allowed_event_types: comma-separated, defaults to "state_changed"
+eventFields: 4 checkboxes (state_changed, automation_triggered,
+                           call_service, event_fired)
+extraTrackingFields:
+  - entity_glob: tag input ("light.*", "binary_sensor.*_motion")
+  - domain_allowlist: tag input
+collectionMeta: { label: "Entities", icon: "..." }
+webhookBased: false     // we are NOT webhook based
+```
+
+WS URL is derived: `wss://{host}/api/websocket` (or `ws://` for plain http
+HA). Document this in the UI hint.
+
+### Auth model
+
+- **Long-lived access token** from HA (Profile → Long-Lived Access Tokens).
+- Stored encrypted at rest via the same path the other providers use for
+  secrets (the bridge already has a secret-encryption helper — verify the
+  exact module name during implementation).
+- WS auth handshake: connect → server sends `auth_required` → client sends
+  `{type: "auth", access_token: "..."}` → server replies `auth_ok` or
+  `auth_invalid`.
+
+### Risks / open questions (Phase 1)
+
+1. **Reconnect strategy.** Exponential backoff capped at 60s, jittered.
+   On reconnect, log a `connection_restored_after` event so the UI can
+   surface the gap. Document that HA does not support event replay.
+2. **Area registry.** Pulling `area_id` for entities requires a separate
+   `config/area_registry/list` WS call. Decision needed: fetch once on
+   connect and cache, refetch on `area_registry_updated` event, or skip
+   `area` from the context entirely in v1. Recommendation: fetch on
+   connect, refetch on `area_registry_updated`, skip if it fails (best-effort).
+3. **TLS verification for self-signed HA.** Homelab users often have
+   self-signed certs. Need a `verify_tls: bool` config field (default true)
+   and a clear warning when disabled. Same pattern as
+   `NOTIFY_BRIDGE_ALLOW_PRIVATE_URLS` for the SSRF case.
+4. **Backpressure.** HA's `state_changed` can fire hundreds of events per
+   minute in a busy install. The subscription manager must drop or coalesce
+   if the dispatcher backlog grows beyond a threshold. Cheapest cut: a
+   bounded `asyncio.Queue` between WS receiver and dispatch — `put_nowait`
+   with overflow counter visible in the event log.
+5. **Entity filter precedence.** Tracking-config has `collection_ids`
+   (entity_id list) and we want `entity_glob` + `domain_allowlist`. Decision:
+   if both `collection_ids` and globs are set, union them (any match passes).
+   Documented prominently in the tracker UI.
+6. **Library choice.** `hass-client` is a Python WS client maintained by the
+   HA community; alternative is rolling our own with `websockets`. The
+   latter is ~150 LOC and has no external dependency surface. Recommendation:
+   roll our own. Re-evaluate if Phase 3 needs registry-aware service calls.
+
+## Phase 2 — Bot Commands
+
+Adds Telegram bot commands for HA tracking configs.
+
+- `/status` — connection status, subscribed event count
+- `/entities <glob>` — list matching entities + current state
+- `/state <entity_id>` — full state + attributes for one entity
+- `/areas` — area registry summary
+- `/help`
+
+These use the existing WS connection (no new client) via WS commands
+`get_states`, `config/area_registry/list`. Template slots and command
+template configs follow the same pattern as Gitea/Planka — see
+[CLAUDE.md](../../CLAUDE.md) rule 7 / rule 11 for the full set of locations
+that must be updated.
+
+Out-of-scope for Phase 2: any command that mutates HA state.
+
+## Phase 3 — Smart Actions (Service Calls)
+
+A new action descriptor in the existing Smart Actions framework
+([packages/core/src/notify_bridge_core/providers/actions.py](../../packages/core/src/notify_bridge_core/providers/actions.py)).
+
+- Action type: `ha_call_service`
+- Rule: trigger event → service call (e.g. "on motion event in
+  `binary_sensor.front_door` → call `light.turn_on` on `light.porch`")
+- Executor uses the existing WS connection to send `call_service`.
+
+This phase is gated behind explicit per-target authorization in the UI — HA
+service calls can do anything the access token allows, including unlocking
+doors. Default state: **disabled**, with a clear consent flow when enabling.
+
+## Rough effort estimates
+
+These are rough — sub-task discovery during Phase 1 will refine them.
+
+| Phase | Estimate (focused work) |
+| --- | --- |
+| Phase 1 (subscribe + dispatch) | 2–3 sessions |
+| Phase 2 (bot commands) | 1 session |
+| Phase 3 (smart actions) | 1–2 sessions |
+
+## When to start
+
+Phase 1 work order, once you green-light it:
+
+1. ABC extension (`base.py`) + tests for the new `subscribe` shape on a fake
+   provider.
+2. WS client + parser + unit tests against recorded HA fixtures (no live HA
+   needed for these).
+3. Subscription manager in `services/watcher.py` — integration test with the
+   fake provider from step 1.
+4. Templates (en + ru), capabilities entry, validator whitelist.
+5. Server: seeds, sample context, template_configs entry.
+6. Frontend: descriptor, locale keys, i18n.
+7. End-to-end smoke test against a real HA instance (homelab).
+
+Backend restart cadence per the project rule: after **every** change in
+`packages/server/` or `packages/core/`.
+
+## Decision log
+
+- **2026-05-13** — Plan drafted. Ingest mode = WebSocket (chosen over
+  webhook for future-proofing toward Phases 2 + 3). Not started.

.claude/docs/functional-review-2026-05-28.md

@@ -0,0 +1,435 @@
+# Functional Review — Telegram, Immich, Logging (2026-05-28)
+
+Snapshot review of three subsystems, with prioritised improvement candidates.
+Pairs with [feature-backlog.md](feature-backlog.md) — items here are
+infrastructure that unlocks several backlog features.
+
+All citations are from the working tree at commit `85a8f1e` (master). Two
+files (`packages/core/src/notify_bridge_core/notifications/telegram/client.py`,
+`media.py`) had uncommitted changes at review time — see Telegram §
+"In-flight work".
+
+---
+
+## 1. Telegram infrastructure
+
+### Telegram — what works well
+
+- Single chokepoint `TelegramClient`
+  ([packages/core/src/notify_bridge_core/notifications/telegram/client.py](../../packages/core/src/notify_bridge_core/notifications/telegram/client.py))
+  covers text/photo/video/document/media-group, with 429-aware retry,
+  parse-error retry, file_id cache, multi-bot per-token instances,
+  polling + webhook modes, and bot-command registration.
+- CLAUDE.md rule #6 satisfied for the production paths.
+- Caption length, group sizing, parse-mode fallback all enforced.
+
+### In-flight work
+
+Byte-budget sub-chunking for media groups
+(`TELEGRAM_MAX_GROUP_TOTAL_BYTES` in
+[media.py](../../packages/core/src/notify_bridge_core/notifications/telegram/media.py))
+with per-item fallback inside `_send_media_group`. Logic is coherent;
+before commit, verify `_build_media_items` callers still match the new
+signature (caption no longer injected at fetch time).
+
+### Gaps, ranked by user-visible value
+
+1. **No inline keyboards / `callback_query` handlers** — zero infra for
+   "Favorite / Archive / Dismiss" buttons on Immich notifications.
+   Biggest UX unlock; prerequisite for several Immich smart actions.
+2. **No edit-in-place** (`editMessageText` not wrapped). Pairs naturally
+   with deferred dispatch / quiet hours coalescing — 5 separate
+   "asset added" messages become 1 edited message.
+3. **`disable_notification` (silent send) not exposed** — already a
+   Telegram primitive; slots into the quiet-hours `silent` mode the
+   backlog already mentions.
+4. **`message_thread_id` (forum topics)** — single field per receiver;
+   unblocks supergroup-with-topics users.
+5. **Direct `TelegramClient(...)` constructions** in
+   [api/telegram_bots.py:314,394,404,412](../../packages/server/src/notify_bridge_server/api/telegram_bots.py)
+   bypass `get_telegram_client()` — violates CLAUDE.md rule #6 and
+   skips the shared file_id cache.
+6. **Per-command authorization** — `commands_enabled` is all-or-nothing
+   per chat; no per-command allowlist or admin gate.
+7. **Long-message splitting** — `send_message` silently truncates at
+   4096 ([client.py:492](../../packages/core/src/notify_bridge_core/notifications/telegram/client.py)).
+8. **No parse-mode per target** — HTML hardcoded.
+
+---
+
+## 2. Immich
+
+### Immich — what works well
+
+- Mature polling pipeline: incremental delta-fetch via `updatedAfter`,
+  pending-asset tracking, fingerprint fast-path skip, fallback to full
+  fetch on count-decrease
+  ([providers/immich/provider.py](../../packages/core/src/notify_bridge_core/providers/immich/provider.py)).
+- Rich bot commands (status / albums / events / people / search / latest
+  / random / favorites / summary / memory) with full asset context
+  (CLAUDE.md rule #10 satisfied).
+- `auto_organize` action is well-shaped: AND person + smart-query union,
+  exclusions, type/date/favorite filters, 500-asset batched add,
+  idempotent diff against album asset_ids, dry-run, `ActionExecution`
+  log.
+- Three scheduled features wired: periodic summaries, scheduled-asset
+  delivery, Memory/On-This-Day (with native Immich memory API + fallback).
+
+### Highest-leverage candidates
+
+1. **Webhook ingestion** — `webhook_based=False` at
+   [capabilities.py:46](../../packages/core/src/notify_bridge_core/providers/capabilities.py).
+   Sub-second latency vs the current 5-min poll. New
+   `/api/webhooks/immich/{secret}` route + parser + capability flip.
+2. **Share-link expiry monitoring + auto-rotate action** — links
+   silently break today; data is already fetched per event
+   ([provider.py:541-569](../../packages/core/src/notify_bridge_core/providers/immich/provider.py)).
+3. **Duplicate cluster digest** — Immich >= 1.100 `/api/duplicates` is
+   unused; pairs with inline buttons for "merge / ignore 30d".
+4. **Auto-favorite by person** (already in backlog) — smallest delta on
+   the existing `auto_organize` executor.
+5. **Per-person notification subscription** — tracker-config filter,
+   reuses existing `asset.people` data.
+6. **Album auto-curation from Inbox** — date-based target album name,
+   move (not copy); needs the Immich move endpoint (currently we only
+   `add_assets_to_album`).
+7. **Storage / job-queue alerts** — `/api/server/stats` and `/api/jobs`
+   unused; lightweight poll + threshold = "disk full" / "transcoding
+   stalled" notifications.
+8. **Smart-action infra polish** — descriptors are reusable, but the
+   rule editor is JSON-shaped, action-run statistics aren't aggregated,
+   and dry-run shows counts not the asset list. Address before adding 5
+   more action types.
+
+---
+
+## 3. Logging
+
+### What's already in place
+
+In [logging_setup.py](../../packages/server/src/notify_bridge_server/logging_setup.py):
+
+- `dictConfig` with `JsonFormatter` (line-delimited JSON) toggleable via
+  `NOTIFY_BRIDGE_LOG_FORMAT=json`.
+- `SecretMaskingFilter` redacts Telegram bot tokens + Authorization /
+  api_key / password / refresh_token across `msg`, `exc_text`,
+  `stack_info`.
+- ContextVar-driven record factory injects `request_id`, `command`,
+  `chat_id`, `bot_id`, `dispatch_id` on every record. Text format:
+  `[req=- cmd=- bot=- chat=- disp=-]`.
+- Per-module overrides via `NOTIFY_BRIDGE_LOG_LEVELS` env or DB
+  `AppSetting`. Live runtime patch via `apply_log_levels()` — no
+  restart.
+- Noisy libs pre-quieted (sqlalchemy, aiohttp, apscheduler, urllib3,
+  asyncio, httpx, httpcore, PIL, uvicorn.access).
+
+Plus:
+
+- `EventLog` table with structured rows (event_type, status,
+  assets_count, details JSON, FKs to tracker/provider/action/
+  command_tracker/bot), `event_log_retention_days=30` default, daily
+  APScheduler cleanup `_cleanup_old_events`
+  ([scheduler.py:332](../../packages/server/src/notify_bridge_server/services/scheduler.py)).
+- Prometheus counter `notify_bridge_event_log_total{status,event_type}`.
+- Frontend viewer with filters at
+  [api/status.py](../../packages/server/src/notify_bridge_server/api/status.py).
+- `bind_log_context` actually used in: dispatcher (dispatch_id),
+  telegram_poller (bot/chat/command/request_id), webhook commands.
+
+### Gaps, ordered by debug-pain payoff
+
+1. **No FastAPI request-ID middleware.** `request_id_var` is set only
+   in webhook + Telegram poller paths. Every REST call from the SPA
+   logs as `req=-`. Tiny middleware (read `X-Request-Id` or
+   `uuid4()`, bind context, echo header) closes this whole-app blind
+   spot.
+2. **`dispatch_id` is in log lines but NOT persisted on the `EventLog`
+   row.** Means you can find the failed row in the UI but can't grep
+   stderr for the matching `disp=...`. Stash it in `details.dispatch_id`
+   (no migration needed) — biggest cross-surface correlation win.
+3. **HTTP access log is uvicorn default**
+   (`access_log=not _cfg.debug` at
+   [main.py:419](../../packages/server/src/notify_bridge_server/main.py)).
+   Doesn't include `request_id`, latency, user, status as structured
+   fields. Replace with a small `RequestLoggerMiddleware` that emits
+   `method`, `path`, `status`, `latency_ms`, `request_id`.
+4. **Telegram media-group failures log richly but aren't linked to the
+   resulting `EventLog` row.** The dispatcher result-aggregation work
+   in flight is the right place to dump `errors[]` into
+   `EventLog.details.errors`.
+5. **In-browser log access is missing.** EventLog rows are visible, but
+   raw logger output requires container/SSH access. A bounded
+   in-memory ring-buffer endpoint (admin-only, last N lines, filtered
+   by context fields) would mean ~90% of triage stays in the UI.
+6. **No "diagnostic mode" UI.** The runtime `apply_log_levels()` is
+   great but only reachable through the app-settings JSON editor.
+   A "Debug for 15 minutes: `notify_bridge_core.notifications.telegram.client`"
+   button with auto-revert is a few-hours job.
+7. **`EventLog.details` is freeform.** Frontend already destructures
+   `dispatch_status`, `deferred_until`, `deferred_for_seconds`,
+   `original_event_log_id`
+   ([types.ts:238-261](../../frontend/src/lib/types.ts)). Define a
+   typed `EventLogDetails` per `event_type` (Pydantic at the boundary)
+   — prevents drift between providers.
+8. **No log rotation** — `StreamHandler(sys.stderr)` only. Fine in
+   containers, brittle on bare-metal. Optional `RotatingFileHandler`
+   opt-in via env.
+9. **No slow-query / outbound-HTTP timing logs.**
+   `sqlalchemy.engine=WARNING` by default; no per-query duration log.
+   Same for outbound calls to Immich / Telegram. A
+   "duration_ms >= N" threshold logger would surface "why is this
+   dispatch slow" without flipping global DEBUG.
+10. **Action dry-run output is logger-only.** Could be streamed into
+    the action editor.
+11. **Poll-result not persisted.** Webhook payloads are logged
+    ([api/webhook_logs.py](../../packages/server/src/notify_bridge_server/api/webhook_logs.py)),
+    but Immich/Google-Photos poll cycles emit no
+    "last poll: 0 changes / 245ms" row. A lightweight
+    `provider_poll_log` (small table or ring buffer) would answer
+    "is the poller actually running" without reading stderr.
+
+---
+
+## Recommended sequencing
+
+| # | Item | Status | Why first |
+| --- | --- | --- | --- |
+| 1 | Request-ID middleware + persist `dispatch_id` on `EventLog` | **SHIPPED 2026-05-28** | Unlocks the rest of the debug story; ~2 hours combined |
+| 2 | Finish in-flight Telegram byte-budget chunking + write `errors[]` into `EventLog.details` | **SHIPPED 2026-05-28** | Already half-done; aligns with #1 |
+| 3 | Telegram inline keyboards + `callback_query` handler | not started | Prereq for several Immich smart actions |
+| 4 | Telegram `disable_notification` + `message_thread_id` per target | **SHIPPED 2026-05-28** | Small, also feeds the open Quiet Hours v1 backlog item |
+| 5 | Immich webhook ingestion | not started | 5-min → sub-second; biggest user-facing latency win |
+| 6 | Immich share-link expiry + auto-rotate (using #3) | not started | Real silent-breakage today |
+| 7 | Diagnostic-mode UI (live log-level toggle with auto-revert) | **SHIPPED 2026-05-28** | Shifts triage to the browser |
+| 8 | Immich duplicate digest + auto-favorite by person | not started | Both ride on #3 |
+
+Items 1–4 are infrastructure that unlocks 5–8. Items 1, 2, 4 also
+smooth the Quiet Hours v1 / target-level windows that's top of the
+backlog — worth landing before that feature so quiet hours can dispatch
+through edited messages and silent sends from day one.
+
+---
+
+## Decision log
+
+- **2026-05-28** — Review completed. Starting work on item #1
+  (request-id middleware + persist `dispatch_id` on `EventLog`).
+- **2026-05-28** — Item #1 shipped. Summary of the change:
+  - New helpers in
+    [packages/core/src/notify_bridge_core/log_context.py](../../packages/core/src/notify_bridge_core/log_context.py):
+    `ensure_dispatch_id()` (reuse existing or mint a new
+    `disp:<12 hex>`) and `enrich_details_with_correlation(details)`
+    (shallow-copy a details dict and merge active `dispatch_id` /
+    `request_id` from the ContextVar snapshot).
+  - New `RequestContextMiddleware` in
+    [packages/server/src/notify_bridge_server/main.py](../../packages/server/src/notify_bridge_server/main.py)
+    that reads inbound `X-Request-Id` (charset/length validated, `:`
+    excluded so a client can't masquerade as a server-minted id),
+    falls back to `req:<12 hex>`, binds the value via
+    `bind_log_context`, and echoes it back as the response header.
+    Added LAST so it's the outermost middleware.
+  - Outer entry points now bind a `dispatch_id` via a thin wrapper
+    function (`check_tracker`, `dispatch_provider_event`,
+    `dispatch_scheduled_for_tracker`, `_process_row`, `run_action`).
+    All 10 `EventLog(...)` creation sites wrap their `details=`
+    payload in `enrich_details_with_correlation(...)`.
+  - Switched `NotificationDispatcher.dispatch` to use
+    `ensure_dispatch_id()` instead of inline `uuid.uuid4()`.
+  - New tests in
+    [packages/server/tests/test_request_correlation.py](../../packages/server/tests/test_request_correlation.py)
+    (12 tests) covering header echo, charset validation, prefix-
+    masquerade rejection, helper merge semantics. All 239 server
+    tests green.
+  - Reviewed by `python-reviewer` subagent (no CRITICAL/HIGH; 3 MEDIUM
+    and 1 LOW addressed: PEP 8 imports moved to top of main.py;
+    `RequestResponseEndpoint` type added to `dispatch`; `:` dropped
+    from the request-id charset; shallow-copy caveat documented).
+  - Live smoke verified: generated id `req:a9b9821f5aab` on plain
+    request; safe inbound `my-trace-abc123` echoed unchanged;
+    `disp:fake12345678` correctly replaced; watcher tick log lines now
+    show distinct `disp=disp:<hex>` per tracker check.
+- **2026-05-28** — Item #2 shipped. Summary of the change:
+  - Confirmed the in-flight Telegram byte-budget media-group chunking
+    in
+    [telegram/client.py](../../packages/core/src/notify_bridge_core/notifications/telegram/client.py)
+    is complete (15/15 media-group tests pass). Deleted the now-unused
+    `split_media_by_upload_size()` from
+    [telegram/media.py](../../packages/core/src/notify_bridge_core/notifications/telegram/media.py).
+  - New module
+    [services/dispatch_summary.py](../../packages/server/src/notify_bridge_server/services/dispatch_summary.py)
+    with `summarize_dispatch_results()` (aggregator),
+    `attach_summary_in_place()` (in-session) and
+    `record_dispatch_summary_async()` (post-commit). Captures
+    `targets_attempted/succeeded/failed`, per-target `errors`,
+    media-group `media{delivered,skipped,failed}` counts and
+    `media_errors[]` from the new
+    `TelegramClient._send_media_group` partial-failure path.
+    Bounded: 20 errors / 20 media errors / 500-char message cap with
+    explicit `…[truncated]` marker.
+  - Wired at 4 dispatch sites:
+    - `event_dispatch.py`: accumulates per-target results across all
+      tracking-config groups, attaches summary in-session before
+      commit.
+    - `deferred_dispatch.py`: inlines summary into the new EventLog
+      row's `details` for both `delivered_after_quiet_hours` and
+      `deferred_then_failed` paths.
+    - `scheduled_dispatch.py`: inlines summary into the cron-fire
+      EventLog row's `details`.
+    - `watcher.py`: follow-up `record_dispatch_summary_async` in a
+      fresh session because the EventLog row was committed before
+      dispatch.
+  - Frontend type drift fixed:
+    [types.ts](../../frontend/src/lib/types.ts) gets new
+    `DispatchSummary`, `DispatchSummaryError`,
+    `DispatchSummaryMediaError` interfaces plus `dispatch_id` /
+    `request_id` / `dispatch_summary` keys on `EventLog.details`.
+  - New tests in
+    [tests/test_dispatch_summary.py](../../packages/server/tests/test_dispatch_summary.py)
+    (10 tests): empty/all-success/mixed/media-counts/sub-errors/
+    truncation/long-message-trim/in-place attach/no-results no-op/
+    malformed sub-error. All 249 server tests green.
+  - Reviewed by `python-reviewer` subagent (no CRITICAL; 2 HIGH + 3
+    MEDIUM addressed: `asyncio.CancelledError` re-raise in the
+    best-effort catch; late `from .dispatch_summary import …` calls
+    hoisted to top of each file; empty-results contract changed from
+    "zero-count summary attached" to "no key written"; truncation
+    marker upgraded to `…[truncated]` for operator clarity;
+    `flag_modified` comment tightened).
+  - Live smoke: backend restarts cleanly, watcher tick log lines
+    continue showing `disp=disp:<hex>` correlation, no startup
+    errors.
+- **2026-05-28** — Item #4 shipped. Summary of the change:
+  - `TelegramReceiver` dataclass in
+    [receiver.py](../../packages/core/src/notify_bridge_core/notifications/receiver.py)
+    gains `disable_notification: bool = False` and
+    `message_thread_id: int | None = None`. New
+    `_coerce_telegram_thread_id` helper collapses Telegram's "general
+    topic" sentinels (`0`, negatives, blanks, bools) to `None` so the
+    Bot API just omits the field — matches the frontend's `<= 0 → unset`
+    behaviour.
+  - `TelegramClient`
+    ([client.py](../../packages/core/src/notify_bridge_core/notifications/telegram/client.py))
+    gets a frozen `_SendOptions` + `_send_options_var` `ContextVar`
+    pattern for the deep media paths (`_upload_media`,
+    `_post_media_group`, `_send_from_cache`) that can't easily plumb
+    kwargs through. `send_notification` binds the var; the 3 deep
+    builders read it via `_apply_send_opts_to_payload` /
+    `_apply_send_opts_to_form`. `send_message` is a leaf and just
+    inlines its kwargs into the JSON body directly (no ContextVar
+    needed there).
+  - Dispatcher
+    ([dispatcher.py](../../packages/core/src/notify_bridge_core/notifications/dispatcher.py))
+    passes `receiver.disable_notification` / `receiver.message_thread_id`
+    into `client.send_message(...)` and `client.send_notification(...)`.
+  - Frontend: new inline per-Telegram-receiver options panel in
+    [ReceiverSection.svelte](../../frontend/src/routes/targets/ReceiverSection.svelte)
+    triggered by a cog icon. Silent + thread-id indicators (bell-off
+    icon, `#N` badge) on the row when set. `+page.svelte` handlers
+    PUT the merged config to `/api/targets/{id}/receivers/{rid}`.
+    5 new i18n keys in `en.json` / `ru.json`.
+  - New tests in
+    [test_telegram_per_send_options.py](../../packages/server/tests/test_telegram_per_send_options.py)
+    — 19 tests: factory + thread-id coercion table (including bool
+    rejection and `0`/negative collapse), payload/form helper merge
+    semantics, bind/reset under exceptions, concurrent-task isolation
+    via `asyncio.gather`, end-to-end `send_message` payload assertions.
+    All 270 server tests green.
+  - Reviewed by `python-reviewer` subagent (no CRITICAL; 2 HIGH + 1
+    MEDIUM + 1 LOW addressed: dead ContextVar bind in `send_message`
+    removed in favor of inline kwarg injection; re-entrant bind from
+    `send_notification → send_message` auto-resolved by the same fix;
+    `message_thread_id=0` collapse aligns backend with frontend;
+    `_coerce_telegram_thread_id` rejects `bool` input).
+  - Live smoke: backend restarts cleanly, no errors in startup log.
+- **2026-05-28** — Holistic `code-reviewer` pass over the full session
+  diff (Features 1+2+4+7) caught a real HIGH that the per-feature
+  Python-narrow reviews missed: ``summarize_dispatch_results`` in
+  Feature 2 was reading the wrong dict shape. The dispatcher's
+  ``_aggregate_results`` wraps per-receiver dicts under
+  ``result["results"]`` and renames the Telegram media counts to
+  ``media_delivered_count`` / ``media_skipped_count`` /
+  ``media_failed_count``. The summarizer was reading the top-level
+  ``delivered_count``, which is always absent in production aggregated
+  output — meaning the ``dispatch_summary.media`` block was silently
+  zero / missing for every real dispatch, and the ``media_errors``
+  list never populated. The unit tests passed because they
+  hand-constructed leaf-shaped dicts that masked the wrong-shape
+  read. Fixed in
+  [dispatch_summary.py](../../packages/server/src/notify_bridge_server/services/dispatch_summary.py)
+  by drilling into ``result["results"]`` per-receiver leaves and
+  preferring ``media_*_count`` field names with fallback to the
+  top-level names. Receiver index added to ``media_errors`` entries
+  when drilling. New integration tests in
+  [test_dispatch_summary.py](../../packages/server/tests/test_dispatch_summary.py)
+  use the real dispatcher envelope so a future shape regression fails
+  loudly. Also addressed MEDIUM findings: ``attach_summary_in_place``
+  / ``record_dispatch_summary_async`` now skip when a caller has
+  pre-set ``dispatch_summary`` (mirrors the "caller wins" rule in
+  ``enrich_details_with_correlation``); ``ReceiverSection.svelte``
+  props for the Telegram options panel are now optional + gated
+  internally so the component stays portable; TS type for
+  ``editingReceiverOptions.message_thread_id`` is ``number | ''``
+  with proper coercion in ``openEditReceiver``. 294/294 server tests
+  green; backend restarts clean.
+- **2026-05-28** — Item #5 NOT shipped. Reason: Immich has no
+  outbound webhook feature. The closest thing is `POST /sync/stream`
+  (a server-streaming sync API designed for first-party Immich
+  clients), and adopting it would (a) take 1-2 days of new
+  subscription-manager infrastructure, (b) couple us to an API with no
+  third-party stability contract, and (c) deliver 5-min → sub-second
+  latency on photo notifications which is rarely critical. If
+  someone later actually needs lower latency, dropping the default
+  ``scan_interval`` is a 5-minute alternative that gets 80% of the
+  win for 1% of the cost. Skipped in favour of #7.
+- **2026-05-28** — Item #7 shipped. Summary of the change:
+  - New service module
+    [services/diagnostic_mode.py](../../packages/server/src/notify_bridge_server/services/diagnostic_mode.py)
+    with `set_diagnostic` / `revert_diagnostic` / `revert_all` /
+    `list_active`. State is in-memory only — restart wipes overrides
+    (`setup_logging` re-applies the DB baseline at boot). Modules go
+    through an allowlist (`notify_bridge_*`, `sqlalchemy`, `aiohttp`,
+    `apscheduler`, `urllib3`, `httpx`, `httpcore`, `asyncio`, `PIL`,
+    `uvicorn`, `starlette`, `fastapi`) so a button press can't flip
+    root. Duration clamped to `[1, 240]` minutes. Baseline derivation
+    walks the dotted parents so
+    `sqlalchemy.engine.Engine` correctly inherits `sqlalchemy.engine`
+    → WARNING rather than falling through to root.
+  - 3 new admin-only endpoints under `/api/settings/diagnostic-mode`
+    in
+    [api/app_settings.py](../../packages/server/src/notify_bridge_server/api/app_settings.py):
+    `GET` (list active), `POST` (activate, 400 on invalid input),
+    `DELETE /{module:path}` (manual revert, 404 if not active).
+  - Auto-revert uses APScheduler's date trigger with `misfire_grace_time=60`,
+    falling back to a strongly-referenced asyncio task (stored in a
+    module-level set with `add_done_callback(discard)`) when the
+    scheduler isn't running. `_expire_callback` re-reads `log_levels`
+    from the DB at fire time, so an admin who edits overrides mid-window
+    sees the new baseline restored — not a stale snapshot.
+  - `revert_all` is wired into the FastAPI lifespan shutdown in
+    [main.py](../../packages/server/src/notify_bridge_server/main.py)
+    so a clean stop / hot-reload leaves the world tidy.
+  - New frontend
+    [DiagnosticsCassette.svelte](../../frontend/src/routes/settings/DiagnosticsCassette.svelte)
+    sits below `LoggingCassette` in the settings page. Quick-pick
+    module dropdown + custom-text fallback, duration chip group (5m /
+    15m / 30m / 1h / 2h), Activate button. Active list with countdown
+    updated by a 1s ticker; resyncs from the backend every 30s based
+    on elapsed time (not modulo-of-now, which the prior version had
+    wrong). Manual revert via undo-icon button on each row.
+  - 15 new i18n keys in `en.json` / `ru.json`.
+  - 20 new tests in
+    [test_diagnostic_mode.py](../../packages/server/tests/test_diagnostic_mode.py)
+    — service-module unit tests + 4 FastAPI smoke tests via
+    `dependency_overrides[require_admin]` exercising the router /
+    path converter / HTTPException paths. All 290 server tests green.
+  - Reviewed by `python-reviewer` subagent (no CRITICAL; 3 HIGH +
+    3 MEDIUM addressed: fallback task retention in a module-level set
+    to prevent GC; prefix-walk for `_baseline_for` so sub-loggers
+    inherit parent defaults; `revert_all` wired into lifespan
+    shutdown; `list_active` now sweeps expired entries; DB
+    `log_levels` re-read at revert time instead of snapshot at
+    activation; frontend resync uses elapsed time. LOW items
+    addressed: scheduler-unavailable paths log at DEBUG instead of
+    silently passing; test cleanup of dead `_MIN_DURATION_MINUTES`
+    mutation).
+  - Live smoke: backend restarts cleanly, no errors in startup log.

.claude/reviews/README.md

@@ -0,0 +1,89 @@
+# Production-Readiness Review — service-to-notification-bridge v0.8.1
+
+**Date:** 2026-05-22  **Scope:** entire codebase (~70k LOC, 312 files)
+**Branch:** master @ a20635a  **Reviewers:** 6 parallel specialised agents
+
+## Verdict
+
+**Ship-readiness: nearly there.** The product is in materially better shape than a typical pre-1.0 — every security baseline is in place (sandboxed Jinja2, bcrypt+JWT, SSRF guard with DNS-rebinding mitigation, secret masking, signed webhooks, non-root Docker, owner-scoped queries) and the feature set is mature (deferred dispatch, quiet hours, fan-out caps, 429 backoff, Prometheus metrics). No CRITICAL security findings exist.
+
+The work that *should* block shipping to wider users is concentrated in **three buckets**: (1) a handful of correctness defects that surface only under load or restart (duplicate-send class), (2) two secret-handling gaps (HA token returned cleartext, bot tokens/SMTP passwords unencrypted at rest), and (3) the schema-management story (`create_all` on boot + 1880-line hand-rolled migration script with no Alembic).
+
+## Reports
+
+| Axis | File | Findings | Top hit |
+|---|---|---|---|
+| Backend (Python) | [backend-review.md](backend-review.md) | 5C / 15H / 18M / 10L | `asyncio.create_task` GC in HA status logger |
+| Frontend (TS/Svelte) | [frontend-review.md](frontend-review.md) | 2C / 10H / 19M / 7L | JWT access+refresh in `localStorage` |
+| Security | [security-review.md](security-review.md) | 0C / 2H / multiple M | HA `access_token` not masked on `GET /providers/{id}` |
+| Performance + DB | [performance-db-review.md](performance-db-review.md) | 3C / 7H / 10M / 10L | `SQLModel.metadata.create_all` on every boot |
+| Bugs + features | [bugs-features-review.md](bugs-features-review.md) | 3C / 13H / 12M / 3L  + 25 features | Webhook redelivery has no idempotency |
+| UI/UX | [ui-ux-review.md](ui-ux-review.md) | ~33 across 13 axes | Five overlapping glass-card abstractions |
+
+## Ship blockers (must fix before wider rollout)
+
+Cross-cutting top 12 — verified across all six reviews:
+
+1. **HA `access_token` returned in plaintext** on `GET /api/providers/{id}` — not in mask list. *(Security H-1, [providers.py:399-405](packages/server/src/notify_bridge_server/api/providers.py#L399))*
+2. **Secrets unencrypted at rest** — Telegram bot tokens, SMTP passwords, HA tokens, webhook secrets stored as plain text in SQLite. Disk/snapshot/backup theft = full credential set. *(Security H-2)*
+3. **Frontend JWT access + refresh in `localStorage`** — any future XSS exfiltrates the session in one call. Move to httpOnly cookie. *(Frontend C-1)*
+4. **`asyncio.create_task` fire-and-forget** in `ha_subscription._on_status_change` — task may be GC'd before completion. *(Backend C-1, [ha_subscription.py:249](packages/server/src/notify_bridge_server/services/ha_subscription.py#L249))*
+5. **Pre-auth 1 MiB body read** on Gitea + generic webhooks — DoS amplifier. Verify `X-Hub-Signature` before reading body. *(Backend C-3, [webhooks.py:167](packages/server/src/notify_bridge_server/api/webhooks.py#L167) + 449)*
+6. **No webhook idempotency** — Gitea/Planka/generic don't dedupe by `X-Gitea-Delivery` / equivalent. Replays = duplicate sends. *(Bugs C-1)*
+7. **Deferred-dispatch crash window** — `dispatch()` returns before `session.commit()`; restart re-fires. Wrap in idempotent "claim → send → ack" with a unique constraint. *(Bugs C-2)*
+8. **Telegram `_last_update_id` in-memory only** — restart can replay or skip commands. Persist watermark. *(Bugs C-3)*
+9. **`init_db` calls `SQLModel.metadata.create_all` on every boot** — causes schema drift between fresh and upgraded installs. Adopt Alembic. *(Perf C-1)*
+10. **Template-preview endpoints bypass sandbox timeout** — authenticated user can wedge a worker with `{% for i in range(10**8) %}`. *(Security M-1)*
+11. **Telegram webhook handler missing `session.rollback()`** in catch-all — leaves uncommitted writes. *(Backend C-2, [commands/webhook.py:162](packages/server/src/notify_bridge_server/commands/webhook.py#L162))*
+12. **CLAUDE.md rule-8 violation** — `if (provider.type !== 'immich')` in `RuleEditor.svelte` silently disables people/album picker for other providers. *(Frontend C-2, [RuleEditor.svelte:57](frontend/src/routes/actions/RuleEditor.svelte#L57))*
+
+## Next-tier priorities (HIGH — fix in the same release where practical)
+
+13. Audit `backup_schema.PROVIDER_SECRET_FIELDS` so `webhook_secret`, `password`, `client_secret`, `refresh_token` are scrubbed on export. *(Backend C-5)*
+14. Add `asyncio.Lock` around `bridge_self` failure-counter dicts. *(Backend C-4)*
+15. Login rate-limit is per-IP only — slow rotated-source brute force succeeds. Add per-account lockout + raise password floor. *(Security M-2)*
+16. Three frontend CRUD pages copy cache items into local `$state`, breaking the shared-cache invariant and forcing a full refetch per mutation. *(Frontend H-1/H-2)*
+17. Uncancelled `setTimeout` chain in backup restart flow can `window.location.reload()` after navigation. *(Frontend H-5)*
+18. Refresh-token race against `logout()` produces spurious "Unauthorized" toasts. *(Frontend H-6/H-7)*
+19. Dashboard per-provider GROUP-BY aggregate runs unbounded on every refresh, no caching, no covering index. *(Perf H-1/H-2)*
+20. Truncation/parse-mode escaping for Telegram (HTML-aware truncate, `_extract_retry_after` fractional seconds, forum `message_thread_id` routing, 403 "bot blocked" auto-disable). *(Bugs H-various)*
+21. Five overlapping glass-card abstractions + radius drift (22/18/14/12 px) + ~71 legacy `rounded-md text-sm bg-…` form inputs that bypass the global Aurora `input{}` rule. *(UI/UX H-CONSIST-01..04)*
+22. Hardcoded hex colors (`#059669`, `#ef4444`) in Snackbar/ConfirmModal/actions — bypasses theming. *(UI/UX H-CONSIST-03)*
+23. Snackbar has no `aria-live`; nav lacks `aria-current="page"` — invisible to screen readers. *(UI/UX H-NAV-01, A11y)*
+24. DST handling in overnight quiet-hours windows. *(Bugs H)*
+
+## What's working well — keep doing this
+
+- **Sandboxed Jinja2 everywhere** (security agent verified every `Environment()` instantiation is `SandboxedEnvironment`).
+- **`PinnedResolver` SSRF defence** — handles CGNAT, IPv4-mapped IPv6, DNS rebinding.
+- **JWT with `token_version` revocation** — bcrypt offloaded to worker thread, constant-time username probe.
+- **Hardened Docker** — non-root, read-only root FS, `cap_drop: ALL`.
+- **Aurora/Glass design identity** — distinctive (conic-gradient orb, Newsreader italic display serif, lavender/orchid palette, "signal stream"/"on watch"/"wires"/"pulse" editorial labels). Not generic AI admin work.
+- **Frontend type discipline** — `svelte-check` clean, EN/RU exactly 1466 keys each, no `eval`/`innerHTML`/`var`/`==` anywhere.
+- **Most SQL hot paths already batched** — `load_link_data` is fully fan-in/fan-out; partial unique indexes on deferred-dispatch are thoughtful.
+- **Most v0.8.1 production-readiness items shipped** — fan-out caps, 429 backoff, parse_mode fallback, scheduler misfire grace, Prometheus, deep healthcheck, per-receiver render cache.
+
+## Top missing features worth adding next
+
+Pulled from the bugs-features report — full pitches in [bugs-features-review.md](bugs-features-review.md):
+
+- **Template playground** — "send test against last event" + dry-run with sample payload.
+- **Template versioning + rollback** with audit log.
+- **Bulk operations** on targets/templates (currently row-by-row).
+- **User-side snooze/mute via bot command** ("/mute 2h", "/snooze tonight").
+- **Auto-disable receiver on Telegram 403 ("bot blocked")** with admin notification.
+- **Rate-limit per target** (separate from global fan-out cap).
+- **Weekly digest + per-target stats + per-provider error rate**.
+- **Generic webhook provider** and **email / Discord / ntfy.sh / Matrix** channels.
+- **Message dedup window** (kills duplicate sends from redelivery and scheduler misfires).
+- **First-run "Getting Started" checklist** on empty dashboard (UI/UX).
+
+## How to consume this review
+
+Each report has clickable `file:line` markdown links. Recommended sequence:
+
+1. Read this `README.md`.
+2. Skim each report's Executive Summary (top 5-7 bullets).
+3. Triage the **Ship blockers (1-12)** above into the next release branch as individual issues.
+4. Schedule the **HIGH list (13-24)** for the release after.
+5. Treat the feature ideas as a refresh of `.claude/docs/feature-backlog.md`.

.claude/reviews/backend-review.md

@@ -0,0 +1,342 @@
+# Backend Production-Readiness Review
+
+Scope: packages/server/src/notify_bridge_server/ and packages/core/src/notify_bridge_core/ (~44k LOC, Python 3.11, FastAPI + SQLModel async + APScheduler + aiohttp).
+
+## Executive Summary
+
+- **Overall quality is high.** The Jinja2 sandbox is consistently applied (every Environment instantiation is SandboxedEnvironment), JWT auth uses bcrypt offloaded to a worker thread, SSRF guard exists with DNS-rebinding mitigation, secrets are masked in logs via a dedicated filter, and most async/SQL patterns show production-aware design (per-tracker sessions, batched IN-queries, partial unique indexes).
+- **Top correctness risk: a fire-and-forget asyncio.create_task in ha_subscription._on_status_change** (no reference stored, GC can drop the task) plus thread-unsafe in-memory counters in bridge_self. Both bite on chatty HA installs.
+- **Module-level dict caches shared across the event loop have small read-modify-write windows** in services/scheduler.py (adaptive state), services/bridge_self.py (failure counters), commands/handler.py (TTLCache rate limits), and command_sync._dirty_bots. Currently functional under low concurrency; risky under load.
+- **Very large hot-path functions** — services/watcher.py:check_tracker (381 lines), services/dispatch_helpers.py:load_link_data (208 lines), the 1880-line database/migrations.py, and the 1365-line services/scheduler.py — concentrate too much logic in one place.
+- **Provider-type hardcoding** persists in api/providers.py, services/__init__.py, services/action_runner.py, and services/manual_dispatch.py (if provider.type == immich chains). The watchers _POLL_FACTORIES registry is the right model — extend it.
+- **Webhook handlers read the request body BEFORE authenticating** in the Gitea and generic-webhook routes. The Planka route gets it right. Net impact: a peer that knows the URL but not the secret can drive a 1 MiB read per request.
+- **autoescape is inconsistent**: True for runtime templates (renderer.py, commands/handler.py), False for preview / sample-context renders in api/template_configs.py, api/slot_helpers.py, and services/notifier.send_test_template_notification. Lower risk (admin-authored input) but mismatch invites surprise.
+
+---
+
+## CRITICAL
+
+### [C-1] _on_status_change schedules an unstored task (GC + drop risk)
+
+File: [packages/server/src/notify_bridge_server/services/ha_subscription.py:240-260](../../packages/server/src/notify_bridge_server/services/ha_subscription.py#L240)
+
+The task created by asyncio.create_task(_record_ha_status(...)) at line 249 is not held anywhere. Python may garbage-collect a task whose only reference is the create_task return value before it completes (Python docs explicitly warn: save a reference to the result). Result: an HA disconnect/reconnect EventLog row silently disappears under memory pressure.
+
+**Fix:** Module-level set[asyncio.Task], add the new task, remove via task.add_done_callback. ha_subscription.start_all already does this correctly (line 315-320); the pattern is already in-house.
+
+### [C-2] Telegram-webhook handler returns 200 OK on uncommitted writes
+
+File: [packages/server/src/notify_bridge_server/commands/webhook.py:130-169](../../packages/server/src/notify_bridge_server/commands/webhook.py#L130)
+
+The catch-all at line 162 swallows handle_command exceptions and returns OK to Telegram. The request already called await session.commit() at line 96 (after save_chat_from_webhook), and any subsequent writes via the dispatcher use NEW sessions inside the command path. If a downstream session inside handle_command partially commits before raising, the dependency get_session does NOT roll back automatically — the context manager only closes.
+
+**Fix:** Either explicitly session.rollback() in the except block, or wrap the per-request mutations in async with session.begin(): so the implicit transaction guarantees rollback on exception.
+
+### [C-3] Gitea/generic webhook reads body BEFORE verifying secret is configured
+
+File: [packages/server/src/notify_bridge_server/api/webhooks.py:167-178](../../packages/server/src/notify_bridge_server/api/webhooks.py#L167) and line 449-454
+
+The sequence is: read 1 MiB raw_body, then check if webhook_secret is empty. A peer that learned the URL but has no secret drives a 1 MiB body read per request. Plankas handler at line 232+ validates the bearer token BEFORE the body read — that is the correct pattern.
+
+**Fix:** Hoist the "if not webhook_secret" (Gitea) and "if auth_mode == none" short-circuit (generic) above _read_bounded_body. Gitea HMAC still needs the body — but bailing on a missing-config-side error first costs nothing.
+
+### [C-4] bridge_self in-memory counters are not async-safe
+
+File: [packages/server/src/notify_bridge_server/services/bridge_self.py:186-230](../../packages/server/src/notify_bridge_server/services/bridge_self.py#L186)
+
+record_poll_failure does _poll_failure_counts[tracker_id] = _poll_failure_counts.get(tracker_id, 0) + 1. These dicts are accessed concurrently from poll loop, HA push, webhook ingest, and dispatcher target-failure recording. Individual dict ops are atomic, but get + 1 + set is not when interleaved with another coroutine that touches the same key. Symptoms: missed threshold crossings, occasional double-emission. Same pattern in _target_failure_counts and _backlog_above_threshold.
+
+**Fix:** Wrap mutating ops in an asyncio.Lock. The reset-and-re-arm semantics already assume serial access — make it explicit.
+
+### [C-5] PROVIDER_SECRET_FIELDS audit needed for backup exports
+
+File: [packages/server/src/notify_bridge_server/api/providers.py:617-625](../../packages/server/src/notify_bridge_server/api/providers.py#L617) and [services/backup_service.py:84-93](../../packages/server/src/notify_bridge_server/services/backup_service.py#L84)
+
+_apply_secrets_provider redacts only fields named in PROVIDER_SECRET_FIELDS. The webhook flow uses a field called webhook_secret (Gitea, Planka, generic) — verify this is in PROVIDER_SECRET_FIELDS (defined in backup_schema.py). A backup export with secrets_mode=INCLUDE that misses webhook_secret leaks a token that grants webhook-forgery rights.
+
+**Action:** Audit PROVIDER_SECRET_FIELDS. Specifically check it includes: api_key, api_token, access_token, webhook_secret, password, client_secret, refresh_token. The _provider_response mask list at api/providers.py:620 is a good cross-reference — both should be the same constant.
+
+---
+
+## HIGH
+
+### [H-1] _compile_template lru_cache competes across tenants
+
+File: [packages/server/src/notify_bridge_server/commands/handler.py:99-103](../../packages/server/src/notify_bridge_server/commands/handler.py#L99)
+
+lru_cache(maxsize=256) keyed by raw template string. Edited templates remain cached. On a multi-tenant install one tenants 256 distinct templates can evict anothers. No invalidation on template-edit.
+
+**Fix:** Drop the cache (Jinja compile is sub-ms) OR add an invalidation call from the template-edit endpoints. The notification renderer (renderer.py:31) uses 512 slots — same problem; consistent fix.
+
+### [H-2] check_tracker is 381 lines with deep coupling
+
+File: [packages/server/src/notify_bridge_server/services/watcher.py:263-644](../../packages/server/src/notify_bridge_server/services/watcher.py#L263)
+
+Loads tracker, polls, writes state, persists EventLog, evaluates gates, defers, dispatches, records bridge_self — all in one function. Refactor candidates: _poll_phase, _persist_state_and_events, _dispatch_phase. This is the watchers hot path; bugs here affect every tracker tick.
+
+### [H-3] load_link_data returns untyped dict[str, Any]
+
+File: [packages/server/src/notify_bridge_server/services/dispatch_helpers.py:539-747](../../packages/server/src/notify_bridge_server/services/dispatch_helpers.py#L539)
+
+Five call sites consume ld["target_type"], ld.get("link_id"), etc. — no static guarantee against key typos.
+
+**Fix:** Introduce a frozen @dataclass class LinkData. Same for per-receiver entries.
+
+### [H-4] N+1 in _resolve_command_context template-slot loop
+
+File: [packages/server/src/notify_bridge_server/commands/handler.py:200-215](../../packages/server/src/notify_bridge_server/commands/handler.py#L200)
+
+One SELECT per distinct command_template_config_id. Already batched for trackers/configs/providers — finish the job. Single WHERE config_id IN (...) query + Python pivot.
+
+### [H-5] N+1 in backup_service.export_backup receiver loop
+
+File: [packages/server/src/notify_bridge_server/services/backup_service.py:187-189](../../packages/server/src/notify_bridge_server/services/backup_service.py#L187)
+
+50 targets = 51 SELECTs. Batch with WHERE target_id IN (...). Audit other sections of this 941-line file for the same pattern (templates -> slots, command configs -> slots).
+
+### [H-6] _dirty_bots mutated from request and scheduler without a lock
+
+File: [packages/server/src/notify_bridge_server/services/command_sync.py:25-95](../../packages/server/src/notify_bridge_server/services/command_sync.py#L25)
+
+mark_bot_dirty runs in request handlers, _flush_dirty_bots on the scheduler executor. Currently safe (snapshot via ready = [...]) but fragile.
+
+**Fix:** Snapshot under lock, or move to a thread-safe primitive.
+
+### [H-7] HA reconnect cycle has no way for CRUD to short-circuit a stale supervisor
+
+File: [packages/server/src/notify_bridge_server/services/ha_subscription.py:163-175](../../packages/server/src/notify_bridge_server/services/ha_subscription.py#L163)
+
+Reload-on-reconnect means a disabled HA provider keeps trying to reconnect at the 30s/300s cadence until next reconnect attempt. CRUD endpoints should call reload_provider (defined at line 339) — verify wiring.
+
+### [H-8] Cached expunged ORM instances are footguns
+
+File: [packages/server/src/notify_bridge_server/services/event_dispatch.py:75-107](../../packages/server/src/notify_bridge_server/services/event_dispatch.py#L75)
+
+_load_trackers_cached returns expunged NotificationTracker rows. Future maintainer calling session.add(tracker) on a stale cached instance triggers DetachedInstance or silent re-INSERT. Document this strongly, ideally convert to a typed projection.
+
+### [H-9] Pending-restore at startup has no timeout
+
+File: [packages/server/src/notify_bridge_server/main.py:142-143](../../packages/server/src/notify_bridge_server/main.py#L142)
+
+apply_pending_restore_if_any runs in lifespan; a partially-corrupt restore could block startup indefinitely. Container liveness probes then fail after grace.
+
+**Fix:** asyncio.wait_for with a generous timeout, or kick off as background task while app starts.
+
+### [H-10] Jinja2 render watchdog uses daemon thread that can pin a CPU forever
+
+File: [packages/core/src/notify_bridge_core/templates/renderer.py:48-73](../../packages/core/src/notify_bridge_core/templates/renderer.py#L48)
+
+Comment acknowledges the trade-off. Multiple concurrent runaway renders can exhaust CPU cores while callers think they timed out. Add a process-level BoundedSemaphore capping concurrent in-flight renders.
+
+### [H-11] _aggregate drops all but the first error
+
+File: [packages/server/src/notify_bridge_server/services/notifier.py:326-335](../../packages/server/src/notify_bridge_server/services/notifier.py#L326)
+
+When all sends fail, only results[0] is returned. Distinct subsequent errors are lost.
+
+**Fix:** Aggregate all errors into a details field.
+
+### [H-12] Generic-webhook header dict materialised twice
+
+File: [packages/server/src/notify_bridge_server/api/webhooks.py:456](../../packages/server/src/notify_bridge_server/api/webhooks.py#L456) and line 475
+
+dict(request.headers) materialises full headers map, then _filter_headers and _redact_sensitive_body walk the payload. With a malicious peer sending many headers (Starlette default 100), bounded but wasteful.
+
+### [H-13] SSRF redirect-walk has no aggregate wall-clock budget
+
+File: [packages/core/src/notify_bridge_core/notifications/telegram/client.py:232-268](../../packages/core/src/notify_bridge_core/notifications/telegram/client.py#L232)
+
+max_redirects = 3, each with 120s _DOWNLOAD_TIMEOUT. Worst case per request: 480s. _TARGET_TIMEOUT_S = 120s in the dispatcher caps the top-level case, but per-asset preloads inside media groups dont all share that cap.
+
+### [H-14] Backlog recovery logic flips latch for in-flight users
+
+File: [packages/server/src/notify_bridge_server/services/bridge_self.py:544-551](../../packages/server/src/notify_bridge_server/services/bridge_self.py#L544)
+
+Recovery loop iterates all known users and flips to False for any not in counts_by_user. If a user transiently has no user_id set on deferred rows (legacy / orphaned), theyre excluded from the GROUP BY and incorrectly marked recovered.
+
+### [H-15] quiet_hours_status silently returns None on start == end
+
+File: [packages/server/src/notify_bridge_server/services/dispatch_helpers.py:110-111](../../packages/server/src/notify_bridge_server/services/dispatch_helpers.py#L110)
+
+The comment notes this is almost always a user mistake. Silent return means the user wonders why their notifications still arrive at all hours. Surface via WARNING log + UI hint.
+
+---
+
+## MEDIUM
+
+### [M-1] register_commands_with_telegram chat overrides loop is sequential
+
+File: [packages/server/src/notify_bridge_server/commands/handler.py:723-776](../../packages/server/src/notify_bridge_server/commands/handler.py#L723)
+
+50 chats with overrides = 50 sequential Telegram round-trips. Use asyncio.gather with a semaphore as in _refresh_telegram_chat_titles.
+
+### [M-2] _run_provider exception backoff has no escalation
+
+File: [packages/server/src/notify_bridge_server/services/ha_subscription.py:278-283](../../packages/server/src/notify_bridge_server/services/ha_subscription.py#L278)
+
+Persistent bug in _emit reconnects every 30s forever. Add exponential backoff with cap and bridge_self alert after N failures.
+
+### [M-3] database/migrations.py is 1880 lines
+
+File: [packages/server/src/notify_bridge_server/database/migrations.py](../../packages/server/src/notify_bridge_server/database/migrations.py)
+
+Past the 800-line guideline. Split per-migration into database/migrations/<name>.py, list in main.py.
+
+### [M-4] Locale-resolution logic duplicated
+
+File: [packages/server/src/notify_bridge_server/services/dispatch_helpers.py:484-491](../../packages/server/src/notify_bridge_server/services/dispatch_helpers.py#L484) and [services/notifier.py:46](../../packages/server/src/notify_bridge_server/services/notifier.py#L46)
+
+Two implementations of locale priority. One source of truth.
+
+### [M-5] _normalize_locale duplicated across modules
+
+File: [packages/server/src/notify_bridge_server/commands/handler.py:632](../../packages/server/src/notify_bridge_server/commands/handler.py#L632)
+
+Five-line copy; move to commands/command_utils.py.
+
+### [M-6] Provider-type if-chain in _test_provider_connection
+
+File: [packages/server/src/notify_bridge_server/api/providers.py:203-250](../../packages/server/src/notify_bridge_server/api/providers.py#L203)
+
+Same chain in services/__init__.py:_make_collection_provider. Both candidates for a single registry.
+
+### [M-7] Secret masking exposes last 4 chars unconditionally
+
+File: [packages/server/src/notify_bridge_server/api/providers.py:624](../../packages/server/src/notify_bridge_server/api/providers.py#L624) and [services/backup_service.py:81](../../packages/server/src/notify_bridge_server/services/backup_service.py#L81)
+
+Fine for 32-char Immich keys. Returns half the value for short secrets. Use plain "***" for len(value) < 16.
+
+### [M-8] Deprecated validate_outbound_url still imported
+
+File: [packages/core/src/notify_bridge_core/providers/immich/client.py:14](../../packages/core/src/notify_bridge_core/providers/immich/client.py#L14)
+
+The sync version uses blocking socket.getaddrinfo on the event loop. Migrate to avalidate_outbound_url.
+
+### [M-9] Lazy cache init has confusing DCL comment
+
+File: [packages/server/src/notify_bridge_server/services/watcher.py:81-113](../../packages/server/src/notify_bridge_server/services/watcher.py#L81)
+
+Comment about Double-check after acquiring lock implies classic DCL — under asyncio, the unlocked first check is safe because theres no thread context switch, but rename to clarify.
+
+### [M-10] Dispatcher concurrency cap is per-dispatch, not process-wide
+
+File: [packages/core/src/notify_bridge_core/notifications/dispatcher.py:58](../../packages/core/src/notify_bridge_core/notifications/dispatcher.py#L58)
+
+_DISPATCH_CONCURRENCY = 16 is INSIDE dispatch(). HA storm = N events x min(M, 16) sends with no outer cap. Add a process-level semaphore in event_dispatch.py.
+
+### [M-11] success=True returned for partial failures
+
+File: [packages/server/src/notify_bridge_server/services/notifier.py:329-335](../../packages/server/src/notify_bridge_server/services/notifier.py#L329)
+
+A test that fails on 1 of 3 receivers returns success=True with a partial_failures count. Introduce a status: "ok"|"partial"|"fail" field.
+
+### [M-12] Telegram command registration not retried on 429
+
+File: [packages/server/src/notify_bridge_server/commands/handler.py:671-693](../../packages/server/src/notify_bridge_server/commands/handler.py#L671)
+
+set_my_commands/delete_my_commands arent retried. Adopt the retry-after handling that _upload_media has.
+
+### [M-13] event_log_id_by_event keyed on id(event)
+
+File: [packages/server/src/notify_bridge_server/services/watcher.py:417-464](../../packages/server/src/notify_bridge_server/services/watcher.py#L417)
+
+CPython object-address as key works because events are held alive in scope, but a typed key would be safer.
+
+### [M-14] Bcrypt-length error wording could be clearer
+
+File: [packages/server/src/notify_bridge_server/auth/routes.py:69-81](../../packages/server/src/notify_bridge_server/auth/routes.py#L69)
+
+User typing 70 ASCII + emoji gets rejected and doesnt understand why. Clarify the byte-count language.
+
+### [M-15] CSP allows unsafe-inline for script-src
+
+File: [packages/server/src/notify_bridge_server/main.py:186-201](../../packages/server/src/notify_bridge_server/main.py#L186)
+
+Acknowledged. SvelteKit --csp build flag emits hashes; switching unblocks dropping unsafe-inline.
+
+### [M-16] Telegram-webhook body size not capped
+
+File: [packages/server/src/notify_bridge_server/commands/webhook.py:71](../../packages/server/src/notify_bridge_server/commands/webhook.py#L71)
+
+update = await request.json() reads with no cap. Add _read_bounded_body pattern.
+
+### [M-17] _log_command_event swallows DB failures invisibly
+
+File: [packages/server/src/notify_bridge_server/commands/handler.py:353-357](../../packages/server/src/notify_bridge_server/commands/handler.py#L353)
+
+Hard DB failure here is invisible. Add a metrics counter.
+
+### [M-18] apply_tracking_display_filters is a 60-line if-branched function
+
+File: [packages/server/src/notify_bridge_server/services/dispatch_helpers.py:350-405](../../packages/server/src/notify_bridge_server/services/dispatch_helpers.py#L350)
+
+Split into _filter_favorites, _apply_order_and_limit, _strip_details_and_tags.
+
+---
+
+## LOW
+
+### [L-1] from .database.models import * in main.py
+
+File: [packages/server/src/notify_bridge_server/main.py:26](../../packages/server/src/notify_bridge_server/main.py#L26)
+
+Comment is honest about purpose, but explicit imports or a single module import is clearer.
+
+### [L-2] None comparisons
+
+All comparisons verified to use is None via grep — no findings.
+
+### [L-3] Magic numbers
+
+Constants are well-named throughout (_TG_429_MAX_ATTEMPTS, _MAX_PENDING_PER_TRACKER, DEBOUNCE_SECONDS, etc.). Only nit: seconds=30 literal in scheduler.schedule_bot_polling could be promoted.
+
+### [L-4] noqa E712 repeated 8+ times for SQLModel boolean comparisons
+
+Switch to .is_(True) for SQLAlchemy idiom, or add E712 to project ruff config.
+
+### [L-5] _check_same_origin is best-effort by design
+
+Acceptable.
+
+### [L-6] _normalize_host strips IPv6 zone IDs silently
+
+File: [packages/core/src/notify_bridge_core/notifications/ssrf.py:105-106](../../packages/core/src/notify_bridge_core/notifications/ssrf.py#L105)
+
+Debug log when stripping changes the host would help diagnose.
+
+### [L-7] _compute_jitter cap of 30s might be tight on hourly polls
+
+File: [packages/server/src/notify_bridge_server/services/scheduler.py:91-105](../../packages/server/src/notify_bridge_server/services/scheduler.py#L91)
+
+Revisit if jitter-collision becomes a real-world issue.
+
+### [L-8] SmtpConfig repr may leak password
+
+File: [packages/server/src/notify_bridge_server/services/notifier.py:205-213](../../packages/server/src/notify_bridge_server/services/notifier.py#L205)
+
+If SmtpConfig is a vanilla dataclass, repr() will leak the password. Verify in notify_bridge_core.notifications.email.client — add field(repr=False) or a custom __repr__.
+
+### [L-9] noqa BLE001 count is high
+
+49 occurrences across 26 files. Each defensible; consider narrowing where possible.
+
+### [L-10] _normalize_for_json does not handle UUID/Decimal
+
+File: [packages/server/src/notify_bridge_server/services/deferred_dispatch.py:124-133](../../packages/server/src/notify_bridge_server/services/deferred_dispatch.py#L124)
+
+No current consumer emits these, but a fallback str() for unknown types would prevent future breakage.
+
+---
+
+## Approval Verdict
+
+**Block** — CRITICAL findings (C-1 unstored task, C-2 missing rollback, C-3 unauthenticated body read, C-4 racy counters, C-5 secret-mask audit) must be fixed before declaring production-ready. Once those are addressed, the HIGH findings can land in a follow-up.
+
+## Quick Wins (low effort, high value)
+
+1. **Wrap every fire-and-forget asyncio.create_task in a module-level set** — search for asyncio.create_task( with no assignment. Definite hit: ha_subscription.py:249.
+2. **Move webhook-secret check before _read_bounded_body** in Gitea + generic webhook handlers — 5-line move per endpoint, eliminates pre-auth resource exhaustion.
+3. **Add an asyncio.Lock around _poll_failure_counts and _target_failure_counts** mutations — eliminates C-4.
+4. **Split migrations.py** — mechanical refactor, ~1 hour, improves blame/review.
+5. **Batch the receiver query in backup_service.export_backup** — single IN (...) query, ~10x faster.
+6. **Replace from .database.models import \*** with explicit imports — small clarity win.

.claude/reviews/bugs-features-review.md

@@ -0,0 +1,714 @@
+# Bugs + Missing Features — Production-Readiness Review
+
+Repo: `c:\Users\Alexei\Documents\service-to-notification-bridge` (v0.8.1 baseline)
+Date: 2026-05-22
+Scope: full repo (backend Python/FastAPI, Svelte 5 frontend, providers + dispatchers + bot commands)
+
+---
+
+## Executive summary
+
+- **The code is in much better shape than typical pre-1.0 code.** Quiet-hours,
+  SSRF, JWT, secret redaction, rate-limit fan-out caps, partition-by-media-kind,
+  parse_mode retry, scheduler misfire-grace, Prometheus metrics, deep
+  healthcheck, and per-receiver render cache are all already implemented and
+  well-tested.
+- **The single biggest shipping risk is webhook idempotency.** Gitea, Planka,
+  and the generic webhook endpoint all dispatch on every POST regardless of
+  redelivery — there is no `X-Gitea-Delivery` / `X-Hub-Delivery` dedup table.
+  An upstream retry storm sends the same notification N times.
+- **The deferred-dispatch drain has a duplicate-send window** if the process
+  dies between `dispatcher.dispatch()` returning and `session.commit()` —
+  the row stays `pending` and the periodic catch-up scan re-drains it.
+- **Telegram update offset (`_last_update_id`) is in-memory only** — on
+  restart, the bot replays already-handled updates or skips ones Telegram
+  has discarded. Combined with no per-update idempotency, this is a
+  duplicate-command surface.
+- **Several Telegram features are silently unsupported**: forum threads
+  (`message_thread_id`), bot-blocked-by-user detection (403 → keep retrying
+  forever), and inline-button callback queries. None blocks shipping today
+  but each is a near-term ask from any real user.
+- **No template versioning / dry-run / playground** — every template edit is
+  immediately live. There is no way to validate a new template against a
+  sample payload before flipping the switch, and no rollback path.
+- **Frontend lacks bulk operations and import/export of templates+targets.**
+  An operator with 30 trackers cannot bulk-toggle, bulk-edit, or move a
+  template across users.
+
+---
+
+## Part A — Bugs and reliability issues
+
+Severity legend: **CRITICAL** = data loss / duplicate user-visible messages /
+silent stop-shipping; **HIGH** = wrong behavior under realistic conditions;
+**MEDIUM** = degrades UX or operability; **LOW** = polish.
+
+### CRITICAL
+
+#### A1. Webhook redelivery causes duplicate notifications (no idempotency)
+
+**Location**: `packages/server/src/notify_bridge_server/api/webhooks.py:156`
+(`gitea_webhook`), `:225` (`planka_webhook`), `:427` (`generic_webhook`).
+**Scenario**: Gitea retries a webhook after 30s if the bridge returns 5xx,
+times out under load, or if the operator clicks "Test Delivery" twice. Every
+retry produces a fresh notification because the handlers never check
+`X-Gitea-Delivery` (Gitea's per-delivery UUID), nor do they record any
+event_id/hash for `parse_generic_webhook` events.
+**Fix**: Add a `webhook_delivery` table with `(provider_id, delivery_id)`
+unique constraint and `created_at`. Insert before dispatch (`INSERT OR IGNORE`
+on SQLite, `ON CONFLICT DO NOTHING` on Postgres); if the insert is a no-op,
+return `{"ok": true, "skipped": "duplicate"}`. For Gitea use the
+`X-Gitea-Delivery` header; for Planka use a hash of `event_type +
+payload.id + payload.createdAt`; for generic webhooks use a configurable
+JSONPath expression to derive an idempotency key, falling back to a SHA256 of
+the raw body. TTL prune older than 7 days.
+
+#### A2. Deferred-dispatch drain can double-send on process crash
+
+**Location**: `packages/server/src/notify_bridge_server/services/deferred_dispatch.py:721-758`.
+**Scenario**: Inside `_process_row`, `dispatcher.dispatch()` actually
+delivers the Telegram message (HTTP 200 returned, user phone buzzes).
+The function then sets `row.status = "fired"` (line 734) but the surrounding
+`session.commit()` (line 577) hasn't run yet. Process is killed (OOM,
+SIGTERM during deploy, host reboot). On restart, `_run_deferred_drain_catchup`
+re-fetches the still-`pending` row and dispatches it again — **the user gets
+the same album twice**.
+**Fix**: Either (a) record an outbound dedup key per-row before dispatch
+(`row.dispatch_id = uuid4(); session.commit()` first), then ask the channel
+client to send-or-no-op based on that ID; or (b) flip the row to a
+`"in_flight"` state with a short timeout in a pre-dispatch transaction so a
+restart sees it as poisoned and aborts. Option (a) is more correct but
+needs per-channel cooperation; option (b) is the cheap fix.
+
+#### A3. Telegram update offset is in-memory only — restart replays or loses commands
+
+**Location**: `packages/server/src/notify_bridge_server/services/telegram_poller.py:31`
+(`_last_update_id: dict[int, int] = {}`).
+**Scenario**: A user types `/random Family`. Telegram delivers update_id=4711.
+The bridge processes the command, sends back the media, and crashes before
+APScheduler ticks again. On restart, `_last_update_id` is empty, so we call
+`getUpdates(offset=None)` → Telegram returns 4711 again → we send the user
+the same album a second time. Conversely, if Telegram's 24-hour retention
+expired during a long outage, we silently skip pending updates.
+**Fix**: Persist last_update_id in DB (`telegram_bot.last_update_id` column).
+Combine with A2-style command idempotency by inserting
+`(bot_id, update_id)` into a dedup table before processing.
+
+### HIGH
+
+#### A4. Telegram "bot blocked by user" / "chat not found" never short-circuits
+
+**Location**: `packages/core/src/notify_bridge_core/notifications/telegram/client.py`
+(`send_message`, `_upload_media`, etc.). Errors with
+`error_code == 403` (Forbidden, "Bot was blocked by the user") and 400
+"chat not found" / "user is deactivated" are returned as failures but
+never recorded so the receiver gets removed/disabled.
+**Scenario**: A user blocks the bot. Every scheduled "Good morning memory"
+fires a sendMessage that Telegram instantly 403s. Bridge logs an error,
+moves on, repeats forever. The bridge_self target-failure counter eventually
+fires but the underlying receiver is never disabled. With many such chats
+the operator has no easy cleanup path.
+**Fix**: In the dispatcher, on `error_code in (403, 400 with description
+matching "chat not found"/"user is deactivated")`, automatically set
+`TelegramChat.commands_enabled = False` and either flag the receiver as
+`disabled` with reason `blocked_by_user` or surface it via a new
+`/admin/blocked-chats` view. Also stop further retries that round.
+
+#### A5. Telegram forum-thread (topic) routing not supported
+
+**Location**: telegram client never accepts/sends `message_thread_id`.
+**Scenario**: Operator points the bridge at a group's "Releases" forum
+topic. Today every message lands in the General topic instead — there is
+no way to specify the topic. This is a hard requirement for any non-trivial
+group install. Currently `reply_parameters` is the only thread-adjacent
+field used; `message_thread_id` is silently absent.
+**Fix**: Add an optional `message_thread_id` per-receiver (or per-target)
+config, pass through `send_message`, `_upload_media`, and `_post_media_group`.
+Auto-extract from incoming command updates' `message.message_thread_id` so
+the bot can reply into the same topic.
+
+#### A6. `bot.token` read after commit without refresh in webhook flow
+
+**Location**: `packages/server/src/notify_bridge_server/commands/webhook.py:92-97`.
+**Scenario**: The comment acknowledges "AsyncSession expires instances on
+commit" and snapshots `bot_id`/`bot_token` before commit, but `await
+session.refresh(bot)` is also called after the commit. If `session.refresh`
+fails (e.g. row was deleted by an admin concurrently — bot rotation), the
+exception is caught as a warning and the rest of the handler still runs
+using the stale local `bot_id`/`bot_token`. The window is small but real.
+**Fix**: Remove the `session.refresh(bot)` since the snapshot already
+covers everything the handler needs. The refresh adds risk for no gain.
+
+#### A7. Deferred-dispatch coalescing has a JSON-mutation bug under concurrent defers
+
+**Location**: `packages/server/src/notify_bridge_server/services/deferred_dispatch.py:307`
+(`_find_pending_asset_rows`).
+**Scenario**: Two near-simultaneous `assets_added` events for the same
+`(link_id, collection_id)` from two upstream pollers (HA chat-bus +
+periodic Immich). Both call `defer_event` concurrently. The two transactions
+both see "no pending row", both `session.add(new_row)`, and SQLite cheerfully
+inserts two rows. The drain then fires both, sending the same combined media
+twice. Note that the partial UNIQUE index from v0.8.1 protects only the
+`bridge_self` provider row, not the deferred queue.
+**Fix**: Add a partial UNIQUE index `UNIQUE(link_id, collection_id, event_type)
+WHERE status = 'pending'` on `deferred_dispatch`, then convert `defer_event`
+to `INSERT ... ON CONFLICT (link_id, collection_id, event_type) DO UPDATE`
+and merge `event_payload` inside the SQL or in a re-read+retry loop.
+
+#### A8. Quiet-hours overnight window + DST transition can produce wrong fire_at
+
+**Location**: `packages/server/src/notify_bridge_server/services/dispatch_helpers.py:121-128`.
+**Scenario**: User in `Europe/Minsk` (UTC+3, no DST anymore) sets quiet
+hours 22:00-06:00. For a user in a DST-observing zone (e.g.
+`America/New_York`), on the "spring forward" night where 2:00 → 3:00, an
+event arriving at 02:30 local time gets `end_today = now_local.replace(hour=6,
+minute=0)`. But `.replace()` ignores DST adjustments — the resulting
+`datetime` may sit in the skipped hour or have ambiguous DST status. Two
+hours later, the dispatcher sees the quiet window as "still active" or "30
+min ago" depending on the system.
+**Fix**: After `.replace(hour=t_end.hour, minute=t_end.minute, ...)`, pass
+through `tz.localize` (zoneinfo's behavior: re-walk via `astimezone`) and
+explicitly handle the `fold=` parameter. Add tests using
+`zoneinfo.ZoneInfo("America/New_York")` and known DST transition dates.
+
+#### A9. Quiet-hours `start == end` returns None — silently no quiet hours
+
+**Location**: `packages/server/src/notify_bridge_server/services/dispatch_helpers.py:110-111`.
+**Scenario**: User UI submits `quiet_hours_start = "00:00"` and
+`quiet_hours_end = "00:00"`, thinking "all day quiet". The function returns
+`None` (no quiet window) — the user gets pinged at 3am even though the UI
+says "quiet hours enabled". Same code path eats malformed times silently.
+**Fix**: Bubble up `ValueError`/`malformed input` to the API validator on
+write so the user gets a 422 with a specific error message rather than
+silently broken behavior. Define `00:00-00:00` as "always quiet" or reject
+it explicitly with a clear error.
+
+#### A10. Telegram `_truncate` cuts mid-HTML-tag → parse_mode fallback then loses formatting
+
+**Location**: `packages/core/src/notify_bridge_core/notifications/telegram/client.py:144-149`
+(`_truncate`).
+**Scenario**: A template renders to 4090 chars and an
+`<a href="https://...">...</a>` straddles the 4096-byte boundary. The
+truncate function takes a flat string slice, so the final character may be
+inside a tag → Telegram returns 400 "can't parse entities" → the retry
+strips parse_mode → the user sees `<a href="...">` literally in their chat.
+**Fix**: Make `_truncate` HTML-aware: scan from the right and abandon
+truncation at the start of any tag boundary, OR strip incomplete tags after
+truncating. A simpler intermediate fix: pop any unclosed `<a>` /`<b>`/`<i>`
+detected by a regex over the truncated string.
+
+#### A11. JSON-payload depth/size hardened in backup, not in webhooks
+
+**Location**: `packages/server/src/notify_bridge_server/api/webhooks.py:43-71`
+(`_read_bounded_body` only caps total bytes).
+**Scenario**: Generic webhook accepts a 999KB payload (under the 1MB cap)
+but with 50 levels of nesting. `json.loads` succeeds, then
+`parse_generic_webhook` evaluates JSONPath expressions in a loop and the CPU
+spends seconds chasing pointers. Multiple concurrent malicious requests can
+peg the event loop.
+**Fix**: Reuse the depth/node guards from
+`packages/server/src/notify_bridge_server/services/backup_service.py`
+(JSON depth cap 10, node count cap 100k). Either share the helper or
+re-implement around `json.loads(object_pairs_hook=...)`.
+
+#### A12. Generic-webhook `auth_mode="none"` with `acknowledge_unauthenticated` is per-provider, not per-user
+
+**Location**: `packages/server/src/notify_bridge_server/api/webhooks.py:294-323`.
+**Scenario**: v0.8.1 added the `acknowledge_unauthenticated=true` opt-in,
+but it's only stored in `provider.config` JSON. A multi-user install where
+one user accepts unauthenticated and another doesn't would suffice. But
+because anyone with the webhook URL can also infer the token (URLs are not
+secret in real deployments — they end up in upstream config files, logs,
+build artifacts), `auth_mode="none"` is dangerous beyond "explicit opt-in":
+an attacker who guesses the path can DoS the rate limiter by burning the
+60/min budget.
+**Fix**: Refuse to even create a `webhook` provider with `auth_mode="none"`
+in production unless a separate environment guard
+`NOTIFY_BRIDGE_ALLOW_UNAUTHENTICATED_WEBHOOKS` is set; AND drop the rate
+limit to 10/min for `auth_mode="none"` providers.
+
+#### A13. `_extract_retry_after` returns int but Telegram `retry_after` is fractional
+
+**Location**: `packages/core/src/notify_bridge_core/notifications/telegram/client.py:59-78`.
+**Scenario**: Modern Telegram sometimes returns `retry_after` as a float
+(e.g. `1.5`). The current code does `int(group(1))` and `isinstance(ra,
+(int, float))`. Regex `\d+` only matches integers. So a `1.5s` retry-after
+becomes "no retry-after found" → fallback 1s sleep → retry too early → second
+429 → eventually the bounded retry budget runs out.
+**Fix**: Loosen the regex to `\d+(?:\.\d+)?` and `float(m.group(1))`,
+preserve fractional via `await asyncio.sleep(retry_after + 1)` with float.
+
+#### A14. APScheduler date-job collision when two windows end at the exact same second
+
+**Location**: `packages/server/src/notify_bridge_server/services/scheduler.py:1127-1132`
+(`_drain_job_id_for`). The job id is keyed on `YYYYMMDDHHMMSS`. Comment in
+code acknowledges "two trackers... seconds different ... would collide", but
+two windows ending at the exact same second still collide on a single job id
+— `replace_existing=True` silently drops the second.
+**Scenario**: 30 users with quiet_hours_end=`07:00`. All 30 windows end at
+the same wall-clock second. Only one drain job is scheduled. That single
+job fires `drain_deferred_due()` which scans all rows globally so all 30
+get drained — actually fine. **But** if the global drain function ever
+filters by user/tracker (a likely near-term change for multi-tenant), the
+collision becomes silent data loss.
+**Fix**: Either keep the global drain (and document the assumption) or
+add a tracker_id segment to the job_id and let APScheduler dedup naturally.
+
+#### A15. `_handle_webhook_conflict` reclaim races against a parallel admin action
+
+**Location**: `packages/server/src/notify_bridge_server/services/telegram_poller.py:163-218`.
+**Scenario**: Admin clicks "Switch to webhook mode" in the UI, which sets
+`update_mode=webhook` and calls `set_webhook(...)`. Concurrently, the next
+poll tick for the same bot hits the conflict, calls `delete_webhook` → the
+admin's webhook is wiped 1s after they set it. The poll tick checks
+`bot.update_mode != "polling"` *before* the conflict reclaim, but the
+reload is best-effort and the conflict reclaim path runs unconditionally
+once entered.
+**Fix**: Re-check `bot.update_mode == "polling"` inside
+`_handle_webhook_conflict` before calling `delete_webhook`; or take an
+advisory lock on the bot row for the duration of the mode flip.
+
+#### A16. Discord 2000-char split breaks on Unicode codepoint boundaries
+
+**Location**: `packages/core/src/notify_bridge_core/notifications/discord/client.py:60-80`
+(`_split_message`).
+**Scenario**: A template renders to 2050 chars with emoji at position
+1998-1999 (each emoji is 2 surrogates / multi-byte UTF-8). The split uses
+`text.rfind("\n", 0, limit)` and falls back to character index `limit`,
+which is a Python str index → that part is OK in CPython 3, but if the
+content contains a grapheme cluster (emoji + zero-width-joiner + skin tone),
+slicing at `limit` mid-cluster renders as the broken emoji "□" in Discord.
+**Fix**: Use a grapheme-cluster boundary library (e.g. `regex` module with
+`\X`) or at minimum back off to the previous whitespace if `limit` is
+inside a likely cluster.
+
+### MEDIUM
+
+#### A17. Per-target failure counter does not distinguish receivers within a target
+
+**Location**: `packages/server/src/notify_bridge_server/services/event_dispatch.py:311-333`.
+**Scenario**: A target has 10 receivers. 1 chat is blocked, 9 work. Today
+`maybe_emit_target_failure` is called for the target — but the success
+counter (`record_target_success`) is also called for the same target on the
+other 9. Net counter behavior depends on call order. With the
+default-threshold 5, this oscillates.
+**Fix**: Track success/failure per receiver, not per target; or only call
+`maybe_emit_target_failure` when `all` receivers failed for the target.
+
+#### A18. `_cleanup_old_events` does not delete cancelled `DeferredDispatch` rows
+
+**Location**: `packages/server/src/notify_bridge_server/services/scheduler.py:332-364`.
+**Scenario**: The daily cleanup deletes `EventLog`, `WebhookPayloadLog`,
+`ActionExecution`. Cancelled / fired / dropped `DeferredDispatch` rows live
+forever in the DB. Active install with chatty providers accumulates millions
+of rows; eventually the `_load_pending_drain_jobs` query, `_trim_queue_if_needed`,
+and the catch-up scan all degrade.
+**Fix**: Add `delete(DeferredDispatch).where(status.in_(["fired", "dropped",
+"cancelled"]), fired_at < cutoff)` to the cleanup.
+
+#### A19. `random.shuffle(shuffled)` in `_sort_assets` uses non-deterministic seed
+
+**Location**: `packages/server/src/notify_bridge_server/services/dispatch_helpers.py:317-320`.
+**Scenario**: Two identical events arriving in close succession (deferred-
+dispatch merge, then drain re-renders) shuffle into different orders. With
+the deferred-dispatch coalescing logic, this produces a visual "they're not
+the same album" surprise in the chat history.
+**Fix**: Seed `random` with a stable per-event hash
+(`hash(event.event_type.value + event.collection_id + event.timestamp.isoformat())`).
+
+#### A20. `_poll_tracker` swallows exception, drops it at `_LOGGER.error` not `exception`
+
+**Location**: `packages/server/src/notify_bridge_server/services/scheduler.py:657-666`.
+**Scenario**: An exception in `check_tracker` is logged as `_LOGGER.error("Error
+polling tracker %d: %s", tracker_id, e)` — no traceback. Production debugging
+of "why is tracker 42 silently broken since yesterday" requires the stack.
+**Fix**: Change to `_LOGGER.exception("Error polling tracker %d", tracker_id)`.
+
+#### A21. Long bot commands → `/help` reply > 4096 chars truncates without warning
+
+**Location**: `packages/server/src/notify_bridge_server/commands/handler.py:521-532`,
+combined with `send_reply` → `send_telegram_message` → `_truncate` to 4096.
+**Scenario**: A user with 20 enabled commands runs `/help`. Each command +
+description (RU) crosses 250 chars → 5000 chars total → truncated mid-command.
+The user sees a half-list that suggests we forgot half the commands.
+**Fix**: Split `/help` over multiple messages by command category (provider).
+
+#### A22. `parse_command` truncates to 512 chars — long search queries lost
+
+**Location**: `packages/server/src/notify_bridge_server/commands/parser.py:15`.
+**Scenario**: `/search a very long query containing emoji 🎉 and more text that
+the user really meant to send because they pasted a long string from somewhere…`
+gets clipped to 512 chars silently. The trailing count parser then operates
+on the truncated text, possibly extracting a count from mid-query.
+**Fix**: Either reject `>512` with `parse_command` returning a sentinel
+"too_long" tuple, or just stop truncating — the Telegram limit is already
+4096 and we already truncate the response side.
+
+#### A23. Periodic catch-up scan can dispatch a stale event payload
+
+**Location**: `packages/server/src/notify_bridge_server/services/deferred_dispatch.py:628`
+(`_process_row`).
+**Scenario**: An `assets_added` event is deferred at 22:00. At 06:00 the
+quiet window ends, drain re-fetches `link_data`. The assets in `event_payload`
+include URLs and asset metadata. But the user has since deleted those photos
+from Immich. The dispatcher tries to download → 404. Notification shows
+"5 photos added to Album X" but the actual media fails to attach.
+**Fix**: For `assets_added`, re-validate asset existence against the
+provider before dispatch (one batched `getAssets` call). Drop missing IDs
+from the event, mark with "delivered_after_quiet_hours" + extra hint
+`"missing_count": N` in details. For deferred windows >12h this is the
+right behavior; for shorter windows the lookup is wasted work, so gate on
+`(now - deferred_at).hours >= 6`.
+
+#### A24. Watcher / scheduler restart can lose adaptive polling state
+
+**Location**: `packages/server/src/notify_bridge_server/services/scheduler.py:67-88`
+(`_adaptive_state: dict`).
+**Scenario**: Module-level dict resets on restart. A tracker that had ramped
+up to 1-in-4 ticks goes back to every-tick polling. Over a fleet of 50
+trackers in steady-state idle, this triggers a thundering herd of every-tick
+polls right after deploy. Combined with no DB-level rate limiting on the
+upstream Immich/Gitea API, it can rate-limit the operator out of their own
+services for ~5min.
+**Fix**: Either persist the adaptive state in `notification_tracker_state`
+(cheap on shutdown via `atexit`) or stagger the initial ticks via
+APScheduler's `next_run_time` instead of relying on the existing jitter.
+
+#### A25. `defer_event` `return "cancelled"` logic is incorrect in some merge paths
+
+**Location**: `packages/server/src/notify_bridge_server/services/deferred_dispatch.py:444`.
+**Scenario**: The `cancelled` return branch checks `upd_added is None or
+upd_added.status == "cancelled"` AND same for `upd_removed`. But if both
+`upd_added` and `upd_removed` are `None` (i.e. there were no pending rows
+to begin with), `fully_cancelled` is `False` → returns "merged". That's
+fine. But the more subtle issue: an "insert" action with one of the rows
+being cancelled returns "merged" — should be "inserted". The dashboard
+"merged" status confuses the operator looking at why no defer row exists.
+**Fix**: Rewrite as a clearer state machine: distinguish "inserted",
+"merged_into_existing", "fully_cancelled".
+
+#### A26. `_fetch_bytes` and `_safe_get` honor only 3 redirects with no Retry-After awareness
+
+**Location**: `packages/core/src/notify_bridge_core/notifications/telegram/client.py:217-268`.
+**Scenario**: Immich behind a CDN can chain `302 → 302 → 200`. With 4 hops
+it falls through to "Too many redirects". A user complains "old photos
+suddenly missing in notifications".
+**Fix**: Bump to 5 redirects and surface the chain in the error string for
+easier debugging.
+
+#### A27. No structured event log filter UI for "show me all drops in the last hour"
+
+**Location**: `packages/server/src/notify_bridge_server/api/status.py` —
+`event_log` rows have `details.dispatch_status` field but no API filter
+exposes it. The frontend can fetch only via global filter on `event_type`.
+**Scenario**: An operator sees "messages are missing today". They want to
+filter event_log to `dispatch_status in (dropped_quiet_hours_nondeferrable,
+deferred_then_dropped, deferred_then_failed)`. Today they can't.
+**Fix**: Add `dispatch_status` and `dispatched=true|false` as first-class
+event_log columns (denormalized from `details`), plus API + UI filter.
+
+#### A28. `_render_cmd_template` falls back to `"[No template: X]"` user-visible text
+
+**Location**: `packages/server/src/notify_bridge_server/commands/handler.py:111-115`.
+**Scenario**: An operator removes a template slot by mistake. The next user
+who runs `/random` sees `[No template: response_random]` in chat. Not just
+ugly — it leaks internal slot names.
+**Fix**: Show a friendly "Sorry, something went wrong on our side" + log at
+error level. Better: refuse to disable the slot if it's referenced.
+
+### LOW
+
+#### A29. `_truncate`'s ellipsis can land inside a multi-byte char
+
+The marker `"…"` is one Unicode codepoint (3 bytes UTF-8) but the truncate
+counts characters, not bytes. Telegram counts UTF-16 code units, so for a
+4090-char message ending in emoji, the calculation is off by a small constant.
+Won't break sends but messages may end up slightly longer than `TELEGRAM_MAX_TEXT_LENGTH`
+allows. Re-measure in UTF-16 code units (`len(s.encode('utf-16-le')) // 2`).
+
+#### A30. `NotificationDispatcher._render_cache` set to fresh dict on every dispatch — comment says "reuse"
+
+The instance attribute `self._render_cache` is reset to `{}` at the start
+of every `_send_to_target` (line 245). The cache only helps across receivers
+within one target, not across targets. The comment at line 111-115 implies
+broader reuse. Either align comment with reality or actually share across
+targets within one `dispatch()` call.
+
+#### A31. Frontend `entity-cache.svelte.ts` doesn't propagate stale-cache errors
+
+The shared `$state`-based caches return stale data silently if the underlying
+fetch fails after a successful initial load. A user sees old target list
+during an outage and is confused why edits aren't sticking.
+
+---
+
+## Part B — Missing functionality and "cool feature" gaps
+
+Tier legend: **must-have** = blocks prod for any non-trivial install;
+**nice-to-have** = clear value, ship in next minor; **aspirational** = ship
+when v1.0+ slows down.
+Effort: **S** ≈ 1-2 days; **M** ≈ 1 week; **L** ≈ 2+ weeks.
+
+### Already in the backlog (post-v0.8.1 status check)
+
+#### B1. Target-level quiet hours (per-target DND, multi-window, days-of-week, silent mode)
+
+**Status**: Still missing in v0.8.1. The backlog item proposed a v1 cut
+(target-level windows + `silent` mode for Telegram = `disable_notification=True`).
+None of the proposed code paths exist:
+- `notification_target.quiet_hours_json` column — not present.
+- `disable_notification=True` plumbing through `TelegramClient.send_message`
+  — not present.
+- Days-of-week filter — not present.
+
+**Pitch**: Quiet hours bind to the *watcher* (tracking config); users want
+DND at the *destination*. "Don't ping my phone at night, regardless of
+which provider".
+**Who benefits**: Every user. Today they have to recreate per-link windows.
+**Effort**: **M** (1 week — backend dispatcher gate + frontend Aurora-style fieldset).
+**Tier**: **must-have for prod**.
+
+#### B2. Immich Smart Actions expansion (auto-favorite by person, auto-archive, share-link rotation)
+
+**Status**: Auto-Organize exists; no other action descriptors are shipped.
+**Pitch**: Reuse the existing action descriptor pipeline. Auto-favorite-by-person
+is the smallest cut.
+**Effort**: **M** per action (a few days each).
+**Tier**: nice-to-have.
+
+#### B3. Block-based template builder
+
+**Status**: Not started. `JinjaEditor` is unchanged.
+**Effort**: **L** — frontend-only but big.
+**Tier**: aspirational.
+
+### Newly identified — must-have for prod
+
+#### B4. Webhook delivery dedup table + "Test Delivery" replay
+
+**Pitch**: Add the dedup table from A1, plus a `/api/webhooks/{provider_id}/replay/{delivery_id}`
+endpoint that admin can hit to re-dispatch a stored payload without the upstream
+provider needing to resend. Combined with the existing `WebhookPayloadLog`,
+this is "click to retest" in the UI.
+**Who benefits**: Every webhook provider. Replay is invaluable for debugging
+template edits.
+**Effort**: **M**.
+**Tier**: **must-have for prod**.
+
+#### B5. "Send test message" / template playground
+
+**Pitch**: From the template editor, click "Try this template against the
+last received event" → render preview, optionally send to a sandbox chat.
+Bypass dispatch but exercise the full Jinja pipeline.
+**Who benefits**: Every template edit today is a leap of faith — the operator
+modifies the template, waits for the next real event, hopes nothing breaks.
+**Effort**: **S-M**. The preview infrastructure already exists
+(`services/sample_context.py`); add a "send to chat X" button.
+**Tier**: **must-have for prod**.
+
+#### B6. Template versioning + rollback
+
+**Pitch**: Auto-snapshot each template on save (last 10 revisions). UI shows
+diff between version N and N-1, "Restore" button. Same for command templates.
+**Who benefits**: An operator who tweaks a template at midnight and goofs
+the syntax needs an undo button.
+**Effort**: **M**. New `template_revision` table; new endpoints; UI button.
+**Tier**: **must-have for prod**.
+
+#### B7. Bulk operations on trackers / targets / links
+
+**Pitch**: Multi-select in lists → "disable selected", "delete selected",
+"export selected templates as JSON bundle", "move to user X".
+**Who benefits**: Operators with >10 trackers. A common pain point: deploying
+the bridge for a new family member requires N clicks per tracker.
+**Effort**: **M** (frontend-heavy).
+**Tier**: **must-have for prod**.
+
+#### B8. Bot blocked / chat-not-found auto-disable + dashboard
+
+**Pitch**: Detect Telegram 403 / 400 chat-related errors. Mark the receiver
+or `TelegramChat` as `disabled_by_remote`. Surface in a "Stale receivers"
+admin view with a "Try resending invite" / "Delete chat" button.
+**Who benefits**: Every Telegram user. Today the bridge silently sprays
+errors until a human looks.
+**Effort**: **S**.
+**Tier**: **must-have for prod**.
+
+#### B9. Forum-thread (topic) routing for Telegram
+
+**Pitch**: Per-receiver `message_thread_id` field, auto-detected from incoming
+command messages. UI: when adding a chat that's a forum, show a topic
+selector populated via `getForumTopicIconStickers` + `getChat`'s `is_forum`.
+**Who benefits**: Any group install where the user wants notifications in a
+dedicated topic.
+**Effort**: **M**.
+**Tier**: **must-have for prod**.
+
+#### B10. Telegram inline buttons + callback queries
+
+**Pitch**: Templates can declare `{% buttons %}` with action descriptors.
+Bridge listens for `callback_query` updates, dispatches to a registered
+action (e.g. "Mark album as favorite", "Snooze this tracker for 1h", "Run
+HA service light.turn_off").
+**Who benefits**: Power users. Foundation for several other features
+(Immich duplicate-cluster review, HA action button → service call, snooze).
+**Effort**: **L**.
+**Tier**: nice-to-have but unlocks the next 3 items.
+
+#### B11. User snooze / mute via bot command
+
+**Pitch**: `/snooze 1h` mutes the bot's outbound chat for 1h.
+`/mute provider gitea` mutes a whole provider for that chat. `/wake` undoes.
+Implemented as a per-receiver `snoozed_until` column.
+**Effort**: **S-M**.
+**Tier**: **must-have for prod** (user-side relief valve).
+
+### Newly identified — nice-to-have
+
+#### B12. Per-target / per-user rate limit (send-side)
+
+**Pitch**: Cap outbound messages per minute per receiver. Existing 429
+backoff handles Telegram's limit, but a runaway template / event-storm
+provider can still spray the user's phone with 200 messages.
+**Effort**: **S**. Token bucket per chat_id in `_send_telegram`.
+**Tier**: nice-to-have.
+
+#### B13. Message dedup window (idempotency key per outbound message)
+
+**Pitch**: SHA256 of `(target_id, receiver_id, rendered_message,
+event_collection_id)`. If the same key was sent in the last 5min, skip.
+**Effort**: **S**.
+**Tier**: nice-to-have (lots of overlap with A1+A2 but addresses the
+end-of-pipeline dedup, after all coalescing).
+
+#### B14. Weekly digest / per-target stats / per-provider error rate
+
+**Pitch**: Cron-based weekly summary email/Telegram. "Top 5 noisy trackers",
+"Receivers with >X% failure rate", "Top 5 days of the week with the most
+activity". Operator preventive maintenance.
+**Effort**: **M**.
+**Tier**: nice-to-have.
+
+#### B15. Mobile-friendly minimal mode for the SPA
+
+**Pitch**: The Aurora redesign is a lot for mobile. A "manage from phone"
+minimal layout — list of trackers, click to toggle, click to mute. Stops
+operators from needing a desktop to silence a chatty tracker at 1am.
+**Effort**: **M**.
+**Tier**: nice-to-have.
+
+#### B16. Audit log of admin actions
+
+**Pitch**: New `audit_log` table. Every create/update/delete on
+`NotificationTracker`, `NotificationTarget`, `TemplateConfig`, `ServiceProvider`,
+`TelegramBot`, `User`, etc. writes a row with `(user_id, action,
+entity_type, entity_id, before_json, after_json, ip, ua)`. Admin UI tab.
+**Effort**: **M**. SQLAlchemy event listeners on the affected models.
+**Tier**: nice-to-have for multi-admin installs; must-have if any
+compliance requirement.
+
+#### B17. Health → not just /ready, but per-component status page
+
+**Pitch**: `/api/health/components` returns `{providers: [{id, last_ok_at,
+last_error}], targets: [{id, last_ok_at, last_error}], scheduler:
+{job_count, next_fires}}`. Frontend "Status" tab.
+**Effort**: **S-M**. The data is already in `EventLog` / scheduler API.
+**Tier**: nice-to-have.
+
+#### B18. Provider unreachable backoff + escalation
+
+**Pitch**: Today `bridge_self` emits `bridge_self_poll_failures` after N
+consecutive fails. Add (a) exponential backoff on the polling interval after
+M failures so we don't hammer a down host, and (b) recovery notification
+when the provider comes back.
+**Effort**: **S**.
+**Tier**: nice-to-have.
+
+#### B19. RSS provider
+
+**Pitch**: Generic RSS/Atom feed poller. One more provider, reuses event_dispatch.
+Long-tail value (operator wants "notify me when a blog publishes").
+**Effort**: **M**.
+**Tier**: nice-to-have.
+
+#### B20. Mobile push / FCM channel
+
+**Pitch**: A dedicated FCM "Receiver" type so the user can ship their own
+companion app. Today Telegram is the only realtime channel; email is too
+slow; webhook out is for plumbing.
+**Effort**: **L**.
+**Tier**: aspirational.
+
+### Newly identified — aspirational
+
+#### B21. Conversation threading per source (one notification thread per album / repo)
+
+**Pitch**: Use Telegram `reply_parameters` to chain all notifications about
+"Album X" as a single thread that grows over time. Today every notification
+is a top-level message. Threading turns the chat into a navigable history.
+**Effort**: **M**. Store `last_message_id` per `(target_id, collection_id)`,
+pass as `reply_to_message_id`.
+**Tier**: aspirational but a clear differentiator.
+
+#### B22. A/B test variants for templates
+
+**Pitch**: A template config can carry 2 variants. The dispatcher
+hash-routes receivers to A or B; the dashboard shows "variant A's response
+time / click rate / receiver mute rate".
+**Effort**: **L**.
+**Tier**: aspirational.
+
+#### B23. Dark-launch a new template before enabling it
+
+**Pitch**: "Send-to-sandbox-chat-only" toggle on a template config. The new
+template renders against real events but only goes to one operator's chat
+for 1 week. Then promote to production.
+**Effort**: **M**. Builds on template versioning (B6).
+**Tier**: aspirational.
+
+#### B24. Scheduled template changes
+
+**Pitch**: "On 2026-12-25 at 09:00, switch template_config X to draft Y".
+Useful for holiday-themed greetings or batch migrations.
+**Effort**: **M**.
+**Tier**: aspirational.
+
+#### B25. HA service-call from a Telegram inline button
+
+**Pitch**: Building on B10. A template renders `{% button hass:light.turn_off
+target=living_room %}`. User clicks → bridge calls HA `light.turn_off`.
+**Effort**: **M** (after B10).
+**Tier**: aspirational.
+
+---
+
+## Ship-blocker checklist (do not widen user audience without)
+
+Order is rough priority (top first). Most are also called out in Part A.
+
+1. **A1** — Webhook idempotency table (Gitea/Planka/generic). Without this,
+   one upstream retry storm can double-/quadruple-spray every user.
+2. **A2** — Deferred-dispatch crash window. A redeploy mid-drain duplicates
+   every queued notification. Implement either the `dispatch_id`
+   pre-commit OR the `in_flight` state machine.
+3. **A3** — Persist Telegram update offset. Same root cause class as A1/A2;
+   matters less if A1+A2 are fixed but should land together.
+4. **A4 / B8** — Bot blocked / chat-not-found auto-disable. A user blocking
+   the bot must not generate infinite errors.
+5. **A11** — Webhook JSON depth/node cap (mirror the backup guard).
+6. **A9** — Quiet-hours `start == end` confirmation; either accept "always
+   quiet" semantics or reject in the API validator.
+7. **A8** — DST handling in quiet-hours overnight window. Verify with
+   tests that include known transition timestamps.
+8. **B5** — "Send test message" / template playground. Without this, every
+   template edit is a flying blind change against a live system.
+9. **B6** — Template versioning + rollback. Pair with B5.
+10. **A5 / B9** — Forum-thread (topic) routing. Any non-trivial Telegram
+    group install needs this.
+11. **B11** — User snooze / mute via bot command. Relief valve when the
+    bridge gets too chatty.
+12. **B7** — Bulk operations on trackers / targets / links. Operability
+    floor for any install with >10 trackers.
+
+Everything else in Part B is upside, not a blocker.
+

.claude/reviews/frontend-review.md

@@ -0,0 +1,682 @@
+# Frontend Production-Readiness Review
+
+Scope: `frontend/src/**` (~26k lines, Svelte 5 runes + SvelteKit). `npm run check`
+passes with exit code 0. The codebase is in good shape overall - i18n EN/RU keys
+are 1:1 in sync (1466 each), Modal/Snackbar overlays follow the `position:fixed`
++ `z-index:9999` convention, no `eval`, no `innerHTML`, no string-interpolated
+`setTimeout`, and the sanitizer (`lib/sanitize.ts`) is a sound DOMParser-based
+allowlist. The issues below are real production risks layered on top of an
+otherwise clean architecture.
+
+## Executive Summary
+
+- **Auth tokens live in `localStorage`** (`lib/api.ts`). Any XSS that bypasses
+  the (good) `sanitizePreview` allowlist - or sneaks past it via a future code
+  path - exfiltrates both access and refresh tokens. There is no httpOnly-cookie
+  alternative, no token rotation on refresh failure, and `redirectToLogin` only
+  fires once per session (a leaked refresh token can outlive that flag).
+- **One real provider-hardcoding violation** (`routes/actions/RuleEditor.svelte`)
+  breaks the "descriptors only" rule in CLAUDE.md item 8 and silently disables
+  the people/album picker for any non-Immich provider - every other page is
+  clean.
+- **Caches duplicated into local `$state`** on `notification-trackers`,
+  `command-trackers`, and `command-template-configs` pages - the cache is
+  populated but the page never re-reads it, so cross-page mutations (search
+  palette pre-warming) won't update the list and cache `invalidate()` becomes
+  useless. Convention #4 says "always use cache".
+- **Three CRUD pages refetch all entities after every mutation** (full
+  `await load()` after upsert/delete) instead of using `cache.upsert()`/
+  `remove()` - defeats the optimistic-cache design and produces visible flicker
+  on slow connections.
+- **Floating async work + N+1 patterns**: `providers/+page.svelte` fires N
+  parallel health checks without an AbortController (state writes continue
+  after navigation); `bots/TelegramBotTab.svelte` does a sequential
+  `for (const trk of trackers) { await api('/listeners') }` loop.
+- **`backup/+page.svelte` post-restart health poll** keeps recursing for up to
+  120s with no unmount guard - if the user navigates away mid-restart, the
+  recursive `setTimeout` chain keeps calling `fetch('/api/health')` until it
+  reloads the page out from under whatever route they're on.
+- **`api()` 30s timeout is per-request, hard-coded, with no observability** -
+  long-running provider operations (Immich bulk fetch, full backup export) hit
+  it silently and surface as `AbortError` with no telemetry.
+
+---
+
+## CRITICAL
+
+### C1. JWT tokens stored in `localStorage` - XSS-exfiltratable
+
+[lib/api.ts:78-91](frontend/src/lib/api.ts#L78-L91)
+
+```ts
+function getToken(): string | null {
+    return localStorage.getItem('access_token');
+}
+export function setTokens(access: string, refresh: string) {
+    localStorage.setItem('access_token', access);
+    localStorage.setItem('refresh_token', refresh);
+}
+```
+
+Both the short-lived access token and the long-lived refresh token sit in
+`localStorage`. Any successful XSS - including a future template-preview path
+that escapes `sanitizePreview`, a vulnerable third-party CodeMirror extension,
+or a Telegram bot username that ends up unescaped somewhere - reads both with a
+single `localStorage.getItem` call.
+
+**Fix:** Move to httpOnly + Secure + SameSite=Strict cookies set by the backend.
+If a cookie-based session is infeasible for the deployment model, at minimum
+move the refresh token to an httpOnly cookie and keep only the short-lived
+access token in memory (a module-level `let accessToken` is XSS-readable but
+not persistent across reloads, which limits the exfiltration window).
+
+### C2. Provider type hardcoded in `RuleEditor.svelte` (convention violation)
+
+[routes/actions/RuleEditor.svelte:55-67](frontend/src/routes/actions/RuleEditor.svelte#L55-L67)
+
+```ts
+async function loadProviderData() {
+    if (actionType !== 'auto_organize') return;
+    const provider = providersCache.items.find((p: any) => p.id === providerId);
+    if (!provider || provider.type !== 'immich') return;
+    ...
+```
+
+CLAUDE.md item 8 explicitly forbids `if (type === 'immich')` in components -
+this is the canonical example. As written, adding a second provider with
+auto-organize support (Google Photos, future SmugMug, etc.) is a silent no-op:
+the form renders with empty people/album lists and gives no error.
+
+**Fix:** Add an `actionTypes` / `peopleFilter` capability flag to
+`ProviderDescriptor`, or add a `supportsAutoOrganize: boolean` discriminator,
+then check `getDescriptor(provider.type)?.supportsAutoOrganize` instead of the
+literal string.
+
+---
+
+## HIGH
+
+### H1. Caches imported but copied into local `$state` - invalidation no-op
+
+[routes/notification-trackers/+page.svelte:33](frontend/src/routes/notification-trackers/+page.svelte#L33)
+[routes/command-trackers/+page.svelte:27](frontend/src/routes/command-trackers/+page.svelte#L27)
+[routes/command-template-configs/+page.svelte:51](frontend/src/routes/command-template-configs/+page.svelte#L51)
+
+```ts
+// notification-trackers - line 33
+let allNotificationTrackers = $state<Tracker[]>([]);
+// ...
+[allNotificationTrackers] = await Promise.all([
+    api<Tracker[]>('/notification-trackers'),
+    ...
+]);
+```
+
+The cache modules expose `notificationTrackersCache`, `commandTrackersCache`,
+and `commandTemplateConfigsCache` - populated by `+layout.svelte` on mount and
+by the search palette - but these three pages don't read from them. They each
+issue their own `api(...)` call and store the result locally. Side effects:
+
+1. The cache shows stale data on every other page that reads it (dashboard nav
+   counts, search palette).
+2. `commandTemplateConfigsCache.fetch(true)` is called on `command-template-configs`
+   `load()` but the result is then re-assigned from the function return value
+   into `allCmdTplConfigs` - the cache itself is updated, but the page has no
+   reactive link to it.
+3. `cache.upsert()` / `cache.remove()` after mutations would short-circuit a
+   full refetch - but with the local-state copy, every save triggers a full
+   `await load()` (see H2).
+
+**Fix:** Replace `let allX = $state([])` with `let allX = $derived(cache.items)`
+(see how `targets/+page.svelte:147` does it correctly) and remove the parallel
+`api()` call.
+
+### H2. Full refetch after every mutation - cache.upsert/remove not used
+
+[routes/providers/+page.svelte:238-250](frontend/src/routes/providers/+page.svelte#L238-L250)
+[routes/actions/+page.svelte:139](frontend/src/routes/actions/+page.svelte#L139)
+[routes/notification-trackers/+page.svelte:291](frontend/src/routes/notification-trackers/+page.svelte#L291)
+[routes/targets/+page.svelte:476](frontend/src/routes/targets/+page.svelte#L476)
+
+Every save/delete/toggle on these pages calls `cache.invalidate(); await load()`,
+which re-fetches the entire list from the server. The cache exposes
+`upsert(entity)` and `remove(id)` for exactly this case - the server already
+returned the new entity (or 204), so the round-trip is wasted bandwidth and
+produces a visible "list redraws" flash on slow links.
+
+**Fix:** On POST/PUT response, `cache.upsert(savedEntity)`. On DELETE,
+`cache.remove(id)`. Reserve `invalidate()` + `fetch()` for cases where the
+mutation may have changed *other* entities (e.g. broadcast target updates
+affect children).
+
+### H3. Provider health checks fire-and-forget - leak past navigation
+
+[routes/providers/+page.svelte:175-181](frontend/src/routes/providers/+page.svelte#L175-L181)
+
+```ts
+for (const p of allProviders) {
+    health = { ...health, [p.id]: null };
+    api(`/providers/${p.id}/test`, { method: 'POST' })
+        .then((r: any) => { health = { ...health, [p.id]: r.ok }; })
+        .catch(() => { health = { ...health, [p.id]: false }; });
+}
+```
+
+No `AbortController`, no unmount guard. If the user navigates away while N
+slow Immich/Gitea probes are inflight, every probe still resolves and tries to
+write to the (now-detached) `health` `$state`. With Svelte 5 runes this won't
+crash, but it does waste backend connections (Immich health checks call the
+real API) and may trigger duplicate probes on quick back/forward navigation.
+
+**Fix:** Pass `{ signal: controller.signal }` to `api()` (already supported -
+see `lib/api.ts:150`), abort in `onDestroy`. Or use `cache.probeAll()` driven
+from a single store so revisiting the page reuses the previous result.
+
+### H4. Sequential awaits for independent fetches - N+1 in TelegramBotTab
+
+[routes/bots/TelegramBotTab.svelte:215-223](frontend/src/routes/bots/TelegramBotTab.svelte#L215-L223)
+
+```ts
+const trackers = await api<CommandTrackerSummary[]>('/command-trackers');
+const matched: CommandTrackerSummary[] = [];
+for (const trk of trackers) {
+    try {
+        const listeners = await api<ListenerEntry[]>(`/command-trackers/${trk.id}/listeners`);
+        const hasBot = listeners.some(...);
+        if (hasBot) matched.push(trk);
+    } catch (e) { console.warn(...); }
+}
+```
+
+For a deployment with 20 command trackers, opening the listener section on a
+bot triggers 20 serial `GET /command-trackers/{id}/listeners` requests -
+visibly slow over a high-latency link.
+
+**Fix:** Either expose a single backend endpoint
+(`GET /command-trackers/listeners?bot_id=X`) or run the loop through
+`Promise.all(trackers.map(trk => api(...).catch(() => null)))` and filter
+afterwards.
+
+### H5. Post-restart health poll keeps running after unmount
+
+[routes/settings/backup/+page.svelte:117-139](frontend/src/routes/settings/backup/+page.svelte#L117-L139)
+
+```ts
+async function applyAndRestart(): Promise<void> {
+    await api('/backup/apply-restart', { method: 'POST' });
+    restartingOverlay = true;
+    const startedAt = Date.now();
+    let attempts = 0;
+    const poll = async (): Promise<void> => {
+        attempts += 1;
+        try {
+            const res = await fetch('/api/health');
+            if (res.ok && Date.now() - startedAt > 2000) {
+                window.location.reload();
+                return;
+            }
+        } catch { /* still down */ }
+        if (attempts < 120) setTimeout(poll, 1000);
+    };
+    setTimeout(poll, 1500);
+}
+```
+
+The recursive `setTimeout(poll, 1000)` chain has no cancellation. If the user
+navigates to another route between `apply-restart` and the next health probe,
+the chain keeps firing for up to 120s and eventually calls
+`window.location.reload()` from a route the user has since moved away from.
+Side effects:
+
+1. Unauthenticated `fetch('/api/health')` calls keep going while the user is
+   on `/login`.
+2. A user who hit "restart later" on a different tab will still get reloaded
+   from the original tab's poll.
+
+**Fix:** Capture `controller = new AbortController()` and pass to `fetch`,
+`onDestroy(() => controller.abort())`. Also store the timeout handle and
+`clearTimeout` it on destroy.
+
+### H6. Token refresh races with logout in a sneaky edge
+
+[lib/api.ts:97-127](frontend/src/lib/api.ts#L97-L127)
+
+The dedupe via `refreshPromise` is correct *for the refresh itself*, but the
+outer `api()` reads `getToken()` before awaiting `refreshAccessToken()`. Three
+concurrent requests that all 401 will all queue on the same refresh promise,
+then *all* retry - fine. But if the refresh succeeds and an unrelated
+`clearTokens()` (from `logout()`) fires between the refresh resolving and the
+retry running, the retry uses an empty `Authorization: Bearer ` header. The
+result is "ApiError: HTTP 401" surfaced via snackbar even though the redirect
+to `/login` already happened.
+
+**Fix:** Either re-check `isAuthenticated()` immediately before the retry, or
+make `clearTokens()` cancel an inflight `refreshPromise`.
+
+### H7. `AuthRedirectError` is thrown but not consistently caught
+
+[lib/api.ts:165-170](frontend/src/lib/api.ts#L165-L170)
+
+Most pages use the pattern `catch (err: unknown) { snackError(errMsg(err)); }` -
+which catches `AuthRedirectError` too and shows "Unauthorized - redirecting
+to login" in a snackbar that the user sees *as* the route changes. The error
+class exists specifically to be distinguished, but only one or two call sites
+actually check `instanceof AuthRedirectError` before showing a snackbar.
+
+**Fix:** Make `errMsg()` (or a new helper) return `null` for `AuthRedirectError`
+and have snackbar helpers ignore null messages. Or filter in the snackbar
+store.
+
+### H8. `api()` JSON-decode failure path swallowed silently
+
+[lib/api.ts:189](frontend/src/lib/api.ts#L189)
+
+```ts
+return res.json();
+```
+
+When the backend returns a `200 OK` with a non-JSON body (proxy error page,
+HTML 502 from a misconfigured reverse proxy in front), `res.json()` rejects
+with a `SyntaxError: Unexpected token < in JSON at position 0`. The page
+shows the raw parser message in a snackbar, which is confusing UX.
+
+**Fix:** Wrap `res.json()` in try/catch and throw a typed `ApiError("Backend
+returned non-JSON response", 502)` so the UI can show a clean message.
+
+### H9. Email/Matrix bot tabs strip secrets via `as any`
+
+[routes/bots/EmailBotTab.svelte:84](frontend/src/routes/bots/EmailBotTab.svelte#L84)
+[routes/bots/MatrixBotTab.svelte:79](frontend/src/routes/bots/MatrixBotTab.svelte#L79)
+
+```ts
+if (!body.smtp_password) delete (body as any).smtp_password;
+if (editingMatrix && !body.access_token) delete (body as any).access_token;
+```
+
+The `as any` bypass exists because the body type doesn't allow `delete` on a
+required field. The intent - "don't send a blank secret which would overwrite
+the stored one" - is correct, but the cast hides a real risk: if the field
+name ever changes (`smtp_password` -> `smtpPassword`), the `delete` is a no-op
+and the blank field is sent.
+
+**Fix:** Build `body` as `Partial<...>` from the start and only conditionally
+include the secret field.
+
+### H10. `template-configs` hardcodes a slot name
+
+[routes/template-configs/+page.svelte:228](frontend/src/routes/template-configs/+page.svelte#L228)
+
+```ts
+.map(s => ({ key: s.name, label: ..., rows: s.name === 'message_assets_added' ? 10 : 3, isDateFormat: false }))
+```
+
+Special-casing one Immich slot name inside a provider-agnostic component is
+the same pattern CLAUDE.md item 8 forbids for components, scoped to template
+configs. Other providers' "large" slots (Gitea PR descriptions, Planka card
+content) would render in 3-row editors that the author probably didn't intend.
+
+**Fix:** Add a `rows?: number` field to the backend slot definition and read
+it via `notification_slots[].rows`.
+
+---
+
+## MEDIUM
+
+### M1. Three placeholder strings hardcoded English in shared components
+
+[lib/components/EntitySelect.svelte:18](frontend/src/lib/components/EntitySelect.svelte#L18)
+[lib/components/IconGridSelect.svelte:16](frontend/src/lib/components/IconGridSelect.svelte#L16)
+[lib/components/MultiEntitySelect.svelte:16](frontend/src/lib/components/MultiEntitySelect.svelte#L16)
+
+```ts
+placeholder = 'Select...',
+```
+
+These defaults render `Select...` in RU locale when a caller doesn't pass an
+explicit placeholder. The convention (CLAUDE.md item 5) prescribes plain text
+selectors but says nothing about translation - these still need to flow through
+`t()`.
+
+**Fix:** Move the default into the template: `placeholder = $props().placeholder
+?? t('common.selectPlaceholder')`, with `common.selectPlaceholder` added to
+both locales.
+
+### M2. `EntitySelect.noneLabel` defaults to a decorative em-dash literal
+
+[lib/components/EntitySelect.svelte:20](frontend/src/lib/components/EntitySelect.svelte#L20)
+
+```
+noneLabel = (em-dash literal),
+```
+
+CLAUDE.md item 5 calls out decorative dashes specifically. `LinkedTargetsSection`
+already overrides this with `t('common.noneDefault')` (good), but other
+consumers that do not override get the bare em-dash. It also fails the
+localizable smell test.
+
+**Fix:** Default to `t('common.none')`.
+
+### M3. `lib/auth.svelte.ts` logout does a full page reload, losing UX continuity
+
+[lib/auth.svelte.ts:54-61](frontend/src/lib/auth.svelte.ts#L54-L61)
+
+```ts
+export function logout() {
+    clearTokens();
+    clearAllCaches();
+    user = null;
+    if (typeof window !== 'undefined') {
+        window.location.href = '/login';
+    }
+}
+```
+
+`window.location.href` triggers a hard reload - the SvelteKit router exists
+specifically to avoid this. Side effects: any inflight requests get cancelled
+without proper cleanup, the splash-loader flashes between the two pages, and
+the search-palette / overlays do not get a chance to close gracefully.
+
+**Fix:** `goto('/login', { invalidateAll: true, replaceState: true })`.
+
+### M4. `+layout.svelte` auto-expand `$effect` writes during read
+
+[routes/+layout.svelte:336-342](frontend/src/routes/+layout.svelte#L336-L342)
+
+The effect reads `expandedGroups` (via `expandedGroups[entry.key]`) and writes
+to `expandedGroups`. Svelte 5 dedupes the write back to the same set of keys,
+but the pattern is fragile - adding any side effect that re-derives from
+`expandedGroups` here would loop. It also persists to localStorage in
+`toggleGroup` but not from this effect - so auto-expansion stays in memory only.
+
+**Fix:** Compute the next state in a single pass and write once; either
+include the localStorage save, or move the auto-expand into the initial
+hydration block.
+
+### M5. `commandTemplateConfigsCache.fetch(true)` result discarded; cache populated but unused
+
+[routes/command-template-configs/+page.svelte:208](frontend/src/routes/command-template-configs/+page.svelte#L208)
+
+The `Promise.all` destructures `cfgs` from `commandTemplateConfigsCache.fetch(true)`
+but then writes `allCmdTplConfigs = cfgs` instead of $derived-reading the cache.
+The cache is updated (good) but this page never reads it (bad - see H1).
+
+**Fix:** Same fix as H1 - use `$derived(commandTemplateConfigsCache.items)`.
+
+### M6. Dashboard search debounce timeout not cleared on filter change
+
+[routes/+page.svelte:268-272](frontend/src/routes/+page.svelte#L268-L272)
+
+If the user changes the type/provider filter (`applyFilters` runs synchronously
+from the `$effect` at line 249) while a search debounce is pending, the pending
+timeout still fires 300ms later and triggers an identical request. Not a leak,
+just a wasted call.
+
+**Fix:** Clear `searchTimeout` from `applyFilters()` as well.
+
+### M7. Dashboard `Promise.all` destructure uses empty middle slot
+
+[routes/+page.svelte:283-287](frontend/src/routes/+page.svelte#L283-L287)
+
+```ts
+const [statusRes, , chartRes] = await Promise.all([
+    api<DashboardStatus>(`/status?limit=${eventsLimit}`),
+    providersCache.fetch(),
+    api<{ days: ... }>('/status/chart'),
+]);
+```
+
+The empty middle slot is brittle - anyone reordering for readability silently
+swaps `statusRes` and `chartRes`. Trivially avoided.
+
+**Fix:** Either await `providersCache.fetch()` separately (it caches anyway),
+or `const [statusRes, _providers, chartRes] = ...` with an explicit `_providers`
+local.
+
+### M8. `actions/+page.svelte` derives `actionTypes` from a function-in-derived
+
+[routes/actions/+page.svelte:78-81](frontend/src/routes/actions/+page.svelte#L78-L81)
+
+```ts
+let actionTypes = $derived((() => {
+    const caps = capabilitiesCache.items[selectedProviderType];
+    return caps?.action_types || [];
+})());
+```
+
+The IIFE is unnecessary; `$derived` already runs the expression on every
+dependency change. Reads as a refactor leftover.
+
+**Fix:** `let actionTypes = $derived(capabilitiesCache.items[selectedProviderType]?.action_types ?? []);`
+
+### M9. `RuleEditor.svelte` mutates rule object in `toggleRule` then sends to API
+
+[routes/actions/RuleEditor.svelte:105-108](frontend/src/routes/actions/RuleEditor.svelte#L105-L108)
+
+```ts
+async function toggleRule(rule: ActionRule) {
+    rule.enabled = !rule.enabled;
+    await updateRule(rule);
+}
+```
+
+Direct mutation of the prop violates the immutability rule (coding-style.md).
+If the API call fails, the local state is already flipped - the UI shows the
+new value even though the server still has the old one.
+
+**Fix:** `await updateRule({ ...rule, enabled: !rule.enabled })`. After
+successful response, `await loadRules()` (already happens) re-syncs.
+
+### M10. `+layout.svelte` filter functions use `as any[]` four times
+
+[routes/+layout.svelte:145-151](frontend/src/routes/+layout.svelte#L145-L151)
+
+```ts
+notification_trackers: filterById(notificationTrackersCache.items as any[]).length,
+```
+
+The cast exists because `filterById<T extends { provider_id?: number }>` is
+narrower than the cache item types. The proper fix is a single base interface
+`{ provider_id?: number }` on the relevant types so the cast goes away.
+
+### M11. `setLocale` does not update `<html lang>` attr
+
+[lib/i18n/index.svelte.ts:31-36](frontend/src/lib/i18n/index.svelte.ts#L31-L36)
+
+Screen readers and browser translation extensions rely on `<html lang="en">`.
+The app never sets it, so switching to RU leaves accessibility tooling thinking
+the page is still English.
+
+**Fix:** `document.documentElement.lang = locale` in `setLocale`.
+
+### M12. `Modal.svelte` focus restore does not verify element still in DOM
+
+[lib/components/Modal.svelte:43-45](frontend/src/lib/components/Modal.svelte#L43-L45)
+
+If the previously focused element has been removed from the DOM between modal
+open and close (common with optimistic UI updates that rerender the source
+button), `.focus()` is a silent no-op on a detached node. Focus ends up on
+`<body>` and the next Tab restarts from the top of the page.
+
+**Fix:** `if (... && document.contains(previouslyFocused)) previouslyFocused.focus()`,
+else focus a sensible fallback (the trigger that opened the page).
+
+### M13. TimezoneSelector ticks at 1s - wakes the event loop forever
+
+[lib/components/TimezoneSelector.svelte:33-37](frontend/src/lib/components/TimezoneSelector.svelte#L33-L37)
+
+```ts
+let tickHandle: ReturnType<typeof setInterval> | null = null;
+onMount(() => {
+    tickHandle = setInterval(() => { now = new Date(); }, 1000);
+});
+```
+
+A 1Hz tick is fine for visible UI; the issue is it keeps running even when
+the selector dropdown is closed (the time display is only visible when the
+dropdown is open). Battery impact is non-trivial on mobile for what is
+essentially a hidden component.
+
+**Fix:** Start/stop the interval based on `open` state, or use
+`requestAnimationFrame` driven by `IntersectionObserver`.
+
+### M14. Backup file download builds blob from JSON without size guard
+
+[routes/settings/backup/+page.svelte:269-281](frontend/src/routes/settings/backup/+page.svelte#L269-L281)
+
+```ts
+const data = await api(`/backup/files/${filename}`);
+const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+```
+
+For a deployment with hundreds of providers/trackers, the JSON serialization
+of the entire backup happens in-memory in a single string before the Blob
+constructor - wasted memory peak and a frozen tab on slow machines. Worse,
+`api()` parses the JSON and then `JSON.stringify` re-serializes it.
+
+**Fix:** Use `fetchAuth()` for the download path and pipe the response stream
+straight into a Blob (`new Blob([await res.arrayBuffer()])`).
+
+### M15. Modal focus-trap query selector includes disabled inputs
+
+[lib/components/Modal.svelte:62-67](frontend/src/lib/components/Modal.svelte#L62-L67)
+
+Re-querying the DOM on every Tab keystroke is OK but means disabled inputs
+(common in long forms with submit-in-progress) are included in the trap and
+focus can land on them. The selector should add `:not([disabled])`.
+
+### M16. i18n resolve uses any for the recursion accumulator
+
+[lib/i18n/index.svelte.ts:55-62](frontend/src/lib/i18n/index.svelte.ts#L55-L62)
+
+```ts
+function resolve(obj: any, path: string): string | undefined {
+```
+
+`obj: unknown` plus a runtime check would let TS narrow `current` properly and
+catch the case where someone accidentally passes a `string` (returns undefined
+silently today).
+
+### M17. Tracker name auto-set string concat - English-only
+
+[routes/notification-trackers/+page.svelte:82-84](frontend/src/routes/notification-trackers/+page.svelte#L82-L84)
+[routes/command-trackers/+page.svelte:69-71](frontend/src/routes/command-trackers/+page.svelte#L69-L71)
+
+```ts
+form.name = provider ? `${provider.name} Tracker` : 'Tracker';
+form.name = provider ? `${provider.name} Commands` : 'Commands';
+```
+
+Defaults the tracker name to "Provider Name Tracker" / "Provider Name Commands"
+- only English. Russian users get an English suffix on the auto-generated
+name. Inconsistent with the rest of the i18n discipline.
+
+**Fix:** Use `t('notificationTracker.defaultName').replace('{name}', provider.name)`.
+
+### M18. topbar-action store not cleared on auth state change
+
+[routes/providers/+page.svelte:160-167](frontend/src/routes/providers/+page.svelte#L160)
+
+Each page sets a topbar CTA in `onMount` and clears it in `onDestroy`. If
+`logout()` is called from inside the page (via the search palette, etc.), the
+page never destroys cleanly and the topbar action sticks into the login screen.
+Defensive `topbarAction.clear()` in `logout()` would plug this.
+
+### M19. Many `: any` and `as any` types in critical paths
+
+[routes/users/+page.svelte:62](frontend/src/routes/users/+page.svelte#L62)
+[routes/command-trackers/+page.svelte:27](frontend/src/routes/command-trackers/+page.svelte#L27)
+[routes/providers/+page.svelte:179](frontend/src/routes/providers/+page.svelte#L179)
+[lib/providers/types.ts:120](frontend/src/lib/providers/types.ts#L120)
+
+64 occurrences of `: any` / `as any` across 20 files. None are in
+security-sensitive paths, but they remove type safety in exactly the call
+sites that shape API requests (`body: any = { ... }`). Recommended cleanup
+task, not a blocker.
+
+---
+
+## LOW
+
+### L1. +page.svelte event types hardcoded in three parallel maps
+
+[routes/+page.svelte:475-512](frontend/src/routes/+page.svelte#L475-L512)
+
+`eventLabels`, `eventIcons`, and `eventGradients` are three parallel dicts
+keyed by the same set of strings. Adding a new event type requires editing
+three places (plus i18n). A single `EVENT_META` object would be more
+maintainable.
+
+### L2. TestMenu.svelte uses z-index 9998 instead of 9999
+
+[routes/notification-trackers/TestMenu.svelte:25](frontend/src/routes/notification-trackers/TestMenu.svelte#L25)
+
+```svelte
+<div style="position:fixed; top:0; left:0; right:0; bottom:0; z-index:9998;"
+```
+
+The convention says 9999 for overlays. Using 9998 was probably intentional
+(so the menu sits above the backdrop), but the cleaner pattern is to give the
+backdrop a slightly lower stacking context inside the same parent.
+
+### L3. console.warn left in production-bound code
+
+14 `console.warn`/`console.error` occurrences. Most are guarded by a
+"failed to load" + UI fallback - legitimate debug noise. Recommend wiring to
+a structured logger before public release; current state is acceptable for an
+internal tool but spam-prone in DevTools.
+
+### L4. Dashboard setTimeout(animateCount, 200) is uncancelled
+
+[routes/+page.svelte:290-299](frontend/src/routes/+page.svelte#L290-L299)
+
+The 200ms delay before triggering count animations is uncancelled. Navigating
+away during the first 200ms means the count animation `requestAnimationFrame`
+chain still runs against a stale `status` reference. Cosmetic only.
+
+### L5. app.html inline theme bootstrap reads localStorage without try/catch
+
+[src/app.html:12](frontend/src/app.html#L12)
+
+Theme is hydrated synchronously in `<head>` to avoid FOUC - fine - but if
+localStorage is blocked (Safari private mode, some enterprise policies) the
+inline script throws and the rest of the head bootstrap may be skipped.
+
+### L6. EventChart computes activeTypes and hasData from same loop twice
+
+[lib/components/EventChart.svelte:46-49](frontend/src/lib/components/EventChart.svelte#L46-L49)
+
+`hasData` and `activeTypes` traverse the same data twice. Single-pass
+derivation would be cheaper for the rare "many days of events" case.
+
+### L7. Single-letter t shadowing in +layout.svelte
+
+`+layout.svelte:140` uses `for (const t of targets)` inside `navCounts`, which
+shadows the imported i18n function `t`. Svelte 5 does not flag it (inner scope
+wins), but it confuses search/grep and breaks IDE go-to-definition. Several
+other pages use single-letter `t` as iteration var (`actions/+page.svelte`,
+`command-trackers/+page.svelte`, `targets/+page.svelte`). Recommend `target` /
+`tracker` for legibility.
+
+---
+
+## Notes & non-findings
+
+- **Modal overlay convention** (CLAUDE.md #2): Modal.svelte, Snackbar,
+  IconPicker, IconGridSelect, MultiEntitySelect, EntitySelect, TimezoneSelector,
+  EventChart, Hint, SearchPalette, and TestMenu all use `position:fixed` with
+  `z-index: 9999` (or 9998 for the TestMenu backdrop - see L2). Convention
+  upheld.
+- **@html usage** - only three call sites, all pipe through `sanitizePreview`,
+  which is a DOMParser-based allowlist limited to `B`, `I`, `CODE`, `PRE`, `A`,
+  `BR` with `https?://` href validation. Safe.
+- **i18n parity**: EN and RU JSON have the exact same 1466 keys - no orphans.
+- **Selector placeholders**: `LinkedTargetsSection` correctly uses
+  `t('common.noneDefault')`, no em-dash leaks in user-facing flows (only
+  defaults inside shared components - see M1/M2).
+- **svelte-check passes** (exit 0) - no type errors at the strict level the
+  project compiles with.
+- **No eval, new Function, or string-setTimeout**: dynamic code execution
+  surface is clean.
+- **No var declarations**, no `==` (loose equality) outside generated CSS.
+- **AbortController usage**: present in `lib/api.ts` for the canonical fetch
+  wrapper - the rest of the codebase could lean on it more (see H3, H5).

.claude/reviews/performance-db-review.md

@@ -0,0 +1,436 @@
+# Performance & Database Review — `service-to-notification-bridge`
+
+**Scope:** entire repo at `c:\Users\Alexei\Documents\service-to-notification-bridge`
+**Backend:** FastAPI + SQLAlchemy async + SQLModel on SQLite (Postgres-compatible URL, but only SQLite branch is exercised in code).
+**Frontend:** SvelteKit 5 (runes) static build served by the same FastAPI process.
+**Reviewer:** Claude Opus 4.7 (1M context)
+
+---
+
+## Executive summary
+
+1. **Indexing is in good shape.** FK columns and the dashboard/webhook hot paths have explicit composite indexes (`ix_event_log_user_created`, `ix_event_log_user_event_type_created`, `ix_deferred_dispatch_status_fire_at`, partial `ux_deferred_dispatch_pending`). The bulk of the "missing index" risk is already mitigated.
+2. **No real migration tool.** The project runs a hand-rolled, 1880-line, idempotent migration script on every boot. It works, but it's brittle, slow on cold start, has no down-migrations, and the table-rebuild branches lose indexes silently. Move to Alembic before the next major schema change.
+3. **`create_all` is still the source-of-truth for new schemas** (engine.py:63). That's an anti-pattern next to migration tooling: schema drift can silently appear between fresh installs and upgraded installs.
+4. **Two real N+1 risks remain.** `_tracker_response` (notification_trackers.py:286-291) calls `_tt_response` per link, and `_refresh_telegram_chat_titles` (scheduler.py:229) issues per-chat `getChat` calls without bot-level batching guards. The big one in `load_link_data` was already fixed (good).
+5. **SQLite PRAGMAs are mostly right but pool sizing is wrong.** WAL, `synchronous=NORMAL`, FK enforcement, busy_timeout, temp_store=MEMORY are all set. Missing: `cache_size`, `mmap_size`. The async engine uses SQLAlchemy's default pool with multiple writer connections — under WAL that still serializes, but it raises spurious BUSY pressure on long transactions (see #M3).
+6. **Event-log retention exists and is correct** (30-day default, cron at 03:00 UTC), but `retention_days=0` disables it silently and there is no archival, no per-tenant cap, no row-count metric exposed to operators.
+7. **Memory leak risk: `_dirty_bots`, `_last_update_id`, `_last_webhook_reclaim_at`, `_adaptive_state`, `_adaptive_max_skip`** in command_sync.py, telegram_poller.py, scheduler.py are unbounded module-level dicts. In a long-running process they grow without ever shrinking when entities are deleted.
+8. **Frontend has no virtualization on long lists** — dashboard event stream, tracker history, target list. On a tenant with thousands of events the dashboard `{#each status.recent_events}` (with `(event.id)` key) still renders the whole page-set into DOM and re-runs derivations on every refresh.
+
+---
+
+## CRITICAL
+
+### C1. `create_all` is the schema-of-record for new installs ([engine.py:60](packages/server/src/notify_bridge_server/database/engine.py))
+
+```python
+async def init_db() -> None:
+    engine = get_engine()
+    async with engine.begin() as conn:
+        await conn.run_sync(SQLModel.metadata.create_all)
+```
+
+**What's wrong:** `init_db()` runs unconditionally on every boot before the migration script. New installs get the *current* model's CREATE TABLE statements — including FK declarations like `ondelete=SET NULL` — while upgraded installs only get what the (one-way) `migrate_*` scripts manage to inject via `ALTER TABLE`. Several migrations explicitly admit "this only takes effect on freshly created tables" (e.g. `migrate_eventlog_provider_fk` is a documented no-op). That means **the schema drift between a fresh install and a 6-month-old install is real and undocumented.**
+
+**Impact:** stability — subtle bugs that reproduce only on upgraded installs (FK enforcement, cascade behavior, partial UNIQUE indexes); ops — restoring a backup from a fresh install onto an upgraded box, or vice-versa, can change observable behaviour.
+
+**Fix:**
+1. Adopt Alembic with autogenerate-from-models, lock the baseline migration to the current `SQLModel.metadata`, and stop calling `create_all` in production startup.
+2. Keep the hand-rolled `migrate_*` chain as legacy data-migrations only (idempotent, runs once, then removed).
+3. Add a CI check: spin up empty DB → run migrations → diff against `SQLModel.metadata` → fail if non-empty.
+
+---
+
+### C2. `migrate_schema` runs ~30+ idempotent `PRAGMA table_info` + ALTER probes on every cold start ([migrations.py:67-427](packages/server/src/notify_bridge_server/database/migrations.py))
+
+`_has_column` issues a `PRAGMA table_info('<table>')` per check; `migrate_schema` calls it dozens of times serially inside one transaction. On a cold start this is the dominant boot latency. Worse, it forces a write txn on every boot even when nothing changes (because each migration opens `engine.begin()`).
+
+**Impact:** startup cost — visible on Raspberry-Pi / NAS deployments; SQLite WAL checkpoint pressure on every boot when nothing changed; readiness probe grace window must accommodate this.
+
+**Fix:**
+1. Wire `schema_version` (already exists, `CURRENT_SCHEMA_VERSION=1`) as a real short-circuit — at the top of every `migrate_*`, return immediately if `schema_version >= N` for that migration.
+2. Cache `PRAGMA table_info` results within a single migration run.
+3. Better long-term: replace with Alembic; you already have the version table.
+
+---
+
+### C3. `_install_sqlite_pragmas` only fires on engine-pool `connect`, not when SQLAlchemy reuses pooled connections from a different event loop ([engine.py:18-38](packages/server/src/notify_bridge_server/database/engine.py))
+
+The `@event.listens_for(engine.sync_engine, "connect")` hook only runs at connection creation. The default `aiosqlite` pool reuses connections — that's fine — but `connect_args["timeout"]=30` clashes with the in-PRAGMA `busy_timeout=10000` (10 s). Two different timeout settings is confusing and the lower wins.
+
+**Impact:** stability under contention — under sustained writer contention you get `SQLITE_BUSY` *much* sooner than expected. The 30-s connect_args timeout is for connection *open*, the 10-s busy_timeout is what governs lock contention; users see "database is locked" errors after 10 s, not 30.
+
+**Fix:** standardize on busy_timeout (raise to 30 s to match `connect_args`, or drop one and keep the other). Document the chosen value in a constant. Also add:
+
+```python
+cur.execute("PRAGMA cache_size=-65536")   # 64 MiB negative = kibibytes
+cur.execute("PRAGMA mmap_size=268435456") # 256 MiB
+cur.execute("PRAGMA wal_autocheckpoint=1000")
+```
+
+The 100k-asset album write pattern (`asset_ids` JSON blob) benefits significantly from a larger page cache and mmap; current defaults force a lot of SQLite-internal I/O.
+
+---
+
+## HIGH
+
+### H1. Frontend dashboard event-stream lacks virtualization & double-fetches on filter changes ([+page.svelte:739](frontend/src/routes/+page.svelte))
+
+`{#each status.recent_events as event, i (event.id)}` is keyed (good), but the page renders every event row with rich nested components (`EventDetailModal`, `MdiIcon`, etc.) for every paginate-back/forward. There's no row virtualization and the same data fetches re-run on every filter mutation (search input has a 300 ms debounce in `onSearchInput`, but `filterEventType`, `filterProviderId`, `filterSort`, `refreshSeconds` do not).
+
+**Impact:** UX — choppy on tenants with 50+ events/page, perceptible filter-flicker; CPU — derivation cost on every status refresh.
+
+**Fix:**
+1. Wrap the events list in a tiny windowing component (svelte-virtual or a simple offset/limit windowed view — the API already supports it).
+2. Debounce the entire filter-change branch, not just the search input (`$effect(() => { if (settled) { reload() }})` with a 100 ms guard).
+3. The provider count map (`provider_event_counts`) is computed server-side for *all* matching events on every page request; cache it for `(user_id, filters)` in a 30-s in-memory dict server-side (see also #M2).
+
+---
+
+### H2. `provider_event_counts` aggregate query runs unbounded GROUP BY on every dashboard request ([status.py:84-103](packages/server/src/notify_bridge_server/api/status.py))
+
+```python
+provider_counts_query = (
+    select(
+        EventLog.provider_id,
+        EventLog.provider_name,
+        func.sum(func.coalesce(EventLog.assets_count, 1)).label("total"),
+    )
+    .where(EventLog.user_id == user.id)
+    .group_by(EventLog.provider_id, EventLog.provider_name)
+)
+```
+
+Every dashboard load (every 10–60 s by default — see `refreshIntervalItems`) runs `GROUP BY provider_id, provider_name` over *every* event the user ever owned. At 90 days × ~1 event/min/tracker this is hundreds of thousands of rows scanned per refresh per logged-in user.
+
+**Impact:** latency — SQLite forces a full table scan + sort here because the only composite index is `(user_id, event_type, created_at DESC)`; cost — burns CPU on the bridge box for a metric that changes very slowly.
+
+**Fix:**
+1. Add `ix_event_log_user_provider (user_id, provider_id)` so the GROUP BY can be index-only.
+2. Cache the result for `(user_id, filter_signature)` for 30 s in the same in-memory cache as #H1.
+3. Long-term: materialize per-provider counts into an `event_counter` table maintained by triggers or an APScheduler job. The dashboard then reads at most a dozen rows.
+
+---
+
+### H3. `_tracker_response` issues one query per tracker-target link ([notification_trackers.py:286-291](packages/server/src/notify_bridge_server/api/notification_trackers.py))
+
+```python
+async def _tracker_response(session: AsyncSession, t: NotificationTracker) -> dict:
+    result = await session.exec(
+        select(NotificationTrackerTarget).where(NotificationTrackerTarget.tracker_id == t.id)
+    )
+    tracker_targets = [await _tt_response(session, tt) for tt in result.all()]
+```
+
+`_tt_response` (in notification_tracker_targets.py:12 — has 12 distinct `select`/`session.get` references) issues per-link follow-up SELECTs. Called from `create`, `update`, `delete` and `trigger` for a single tracker, so the practical N is small — but `_tt_response` is also called inside the bulk `list_notification_trackers` loop's downstream consumers, and any future bulk endpoint will multiply this badly.
+
+**Impact:** latency on POST/PATCH responses; future regression risk.
+
+**Fix:** rewrite `_tt_response` to accept pre-fetched maps (mirror the pattern in `dispatch_helpers.load_link_data`). Or, simpler: write a single eager-load helper using `selectinload(NotificationTrackerTarget.target)` once `relationship()` mappers are declared on the models.
+
+---
+
+### H4. `load_link_data` does not eagerly load target.config related entities — relies on `dict(target.config)` snapshotting ([dispatch_helpers.py:539-747](packages/server/src/notify_bridge_server/services/dispatch_helpers.py))
+
+The function batch-loads receivers, telegram_chats, email_bots, matrix_bots up-front, but the broadcast-expansion branch in the active_links loop still issues `_resolve_target` per child target (line 715). That `_resolve_target` is called with all the pre-fetched maps, so it doesn't *query* per call — but it does build a fresh `target_config` dict per child. With a broadcast target containing 50 children fanning out 100 events/min this is constant garbage collection pressure.
+
+**Impact:** GC pressure under load; not a correctness problem.
+
+**Fix:** none required short-term. Long-term, add `selectinload` declarations on the relationship model so SQLAlchemy can co-fetch the chain. The code path is already well-batched.
+
+---
+
+### H5. `aiohttp.ClientSession` is constructed per-call inside `NotificationDispatcher._session_ctx` when no shared session is provided ([dispatcher.py:117-123](packages/core/src/notify_bridge_core/notifications/dispatcher.py))
+
+```python
+@contextlib.asynccontextmanager
+async def _session_ctx(self) -> AsyncIterator[aiohttp.ClientSession]:
+    if self._shared_session is not None and not self._shared_session.closed:
+        yield self._shared_session
+        return
+    async with _new_session() as session:
+        yield session
+```
+
+In server-side code paths (watcher, event_dispatch, deferred_dispatch) a shared session is always passed in, so this is harmless. But unit tests, the CLI, and any direct library user that instantiates `NotificationDispatcher` without a session pays the cost. Worse, the per-dispatch session creates a fresh TCP pool, fresh DNS resolver — defeating connection reuse to Telegram / Discord webhook hosts.
+
+**Impact:** test slowness; correctness if a non-server consumer ever ships.
+
+**Fix:** require the `session` parameter (`session: aiohttp.ClientSession` not `| None`). Or have the dispatcher lazily attach to a module-level `_default_session` cached by event loop id.
+
+---
+
+### H6. `WebhookPayloadLog` is pruned per-insert via a sub-select but the prune query has no UNIQUE/partial protection against duplicate inserts ([webhooks.py:404-418](packages/server/src/notify_bridge_server/api/webhooks.py))
+
+The "keep newest `max_count` per provider, delete the rest" pattern uses `select(...).order_by(created_at DESC).limit(max_count)` as a subquery. Under SQLite this materializes the top-N then negates it — fine when max_count is 20. But this runs on every inbound webhook. For a busy Gitea/HA installation that's 60+ writes/min, each with a delete-by-sub-select. The `ix_webhook_payload_log_provider_created` index makes the read cheap, but the DELETE still rewrites pages.
+
+**Impact:** write amplification on busy webhook tenants.
+
+**Fix:** keep the prune but make it probabilistic — only run with `random.random() < 0.1` (10% chance per insert). The cap still holds in steady state, but the per-write cost drops 10×.
+
+---
+
+### H7. No retention/archival for `notification_tracker_state` and `deferred_dispatch` "fired"/"dropped" rows ([scheduler.py:332-364](packages/server/src/notify_bridge_server/services/scheduler.py))
+
+`_cleanup_old_events` deletes `event_log`, `webhook_payload_log`, `action_execution` older than retention days. `deferred_dispatch` rows with `status IN ('fired', 'dropped')` are never deleted. `notification_tracker_state.asset_ids` for an immich tracker watching a deleted collection is also never reaped.
+
+**Impact:** unbounded growth on long-running installs; `asset_ids` JSON blobs can be megabytes per collection.
+
+**Fix:** extend `_cleanup_old_events` to also delete `DeferredDispatch.status != 'pending' AND fired_at < cutoff`. Add a separate housekeeping job that prunes `NotificationTrackerState` rows whose `collection_id` is no longer in `NotificationTracker.collection_ids`.
+
+---
+
+## MEDIUM
+
+### M1. Sentinel value `bot_id=0` is a footgun ([models.py:69-73](packages/server/src/notify_bridge_server/database/models.py))
+
+```python
+# bot_id=0 is a sentinel meaning "Telegram has not yet returned a numeric
+# ID for this bot" (i.e. token never validated). Multiple unverified bots
+# may legitimately carry 0, so we only enforce uniqueness for non-sentinel
+# values via a partial index added in migrate_uniqueness_constraints.
+bot_id: int = Field(default=0, index=True)
+```
+
+Sentinel values on indexed columns hurt index selectivity (every unvalidated bot is the same row from the planner's perspective) and create maintenance burden. Worse, every code path that looks up by `bot_id` must remember to filter `bot_id != 0`.
+
+**Impact:** maintainability; latent bug surface (one missed `!= 0` filter and an unverified bot is silently re-used).
+
+**Fix:** change `bot_id: int | None` defaulting to None, drop the sentinel.
+
+---
+
+### M2. No request-scoped cache for `user.id` lookups inside one request ([api/*.py, throughout](packages/server/src/notify_bridge_server/api/))
+
+The same `get_current_user` dependency runs JWT validation + a `session.get(User, id)` on every request. Many endpoints then do their *own* `user.id`-filtered SELECTs. There is no per-request memoization of the User row.
+
+**Impact:** one extra SELECT per request, mostly noise — but it's free to fix.
+
+**Fix:** in `get_current_user`, cache the User on `request.state.user`. Routes that take `user: User = Depends(...)` are unchanged.
+
+---
+
+### M3. SQLAlchemy async pool defaults serialize SQLite writers but the engine allows multiple connections ([engine.py:41-57](packages/server/src/notify_bridge_server/database/engine.py))
+
+`create_async_engine` for SQLite defaults to a `StaticPool` of size 1 in newer SQLAlchemy versions, but older versions / different `aiosqlite` versions can default to `NullPool` (one connection per request) or a small QueuePool. The code does not pin this explicitly. Under WAL, multiple readers are fine but only one writer can hold the txn at a time — so a slow writer just makes other connections block on `busy_timeout`.
+
+**Impact:** unpredictable behaviour across SQLAlchemy versions; sporadic `SQLITE_BUSY` under load.
+
+**Fix:** explicitly configure the pool:
+
+```python
+from sqlalchemy.pool import StaticPool, AsyncAdaptedQueuePool
+
+_engine = create_async_engine(
+    url,
+    echo=settings.debug,
+    pool_pre_ping=True,
+    connect_args=connect_args,
+    poolclass=AsyncAdaptedQueuePool,
+    pool_size=5,
+    max_overflow=10,
+    pool_recycle=3600,
+)
+```
+
+For Postgres compatibility leave these as-is; for SQLite the right value is `StaticPool` + `connect_args={"check_same_thread": False}` to share one connection across the event loop (this is the supabase/pgbouncer pattern adapted for sqlite-async).
+
+---
+
+### M4. `_refresh_telegram_chat_titles` issues per-chat HTTP without per-bot bucketing ([scheduler.py:229-329](packages/server/src/notify_bridge_server/services/scheduler.py))
+
+The job builds `tasks` as a flat list across all bots and runs them under a global `Semaphore(10)`. A bot with 50 chats and a slow Telegram response (rare but happens) can monopolize all 10 slots, starving every other bot. The semaphore should be per-bot.
+
+**Impact:** the daily refresh can take much longer than intended on a multi-bot install with one degraded bot.
+
+**Fix:** create one semaphore per bot:
+
+```python
+sems = {bot_id: asyncio.Semaphore(_CHAT_SYNC_CONCURRENCY) for bot_id in bot_tokens}
+```
+
+---
+
+### M5. `event_log.collection_name.contains(search)` triggers full table scan on filter ([status.py:69-75](packages/server/src/notify_bridge_server/api/status.py))
+
+The dashboard search input runs four `.contains(search)` clauses ORed together — these become `LIKE '%search%'` and cannot use a regular B-tree index. With 100k+ event_log rows the dashboard search becomes a multi-second operation.
+
+**Impact:** UX — search feels broken on large installs; CPU on the bridge box.
+
+**Fix:**
+1. Limit the search to the most recent N days (e.g. retention/3) — most users only search recent events.
+2. Add a SQLite FTS5 virtual table mirroring event_log's text columns, sync via triggers. Searches use `MATCH 'foo'` which is sub-millisecond on million-row tables.
+
+---
+
+### M6. `DeferredDispatch.event_payload` JSON blob can grow unbounded per row ([models.py:639-659](packages/server/src/notify_bridge_server/database/models.py), [deferred_dispatch.py:188-298](packages/server/src/notify_bridge_server/services/deferred_dispatch.py))
+
+The asset-coalescing union path appends every new asset's full dict (filename, urls, tags, extra metadata) into `event_payload["added_assets"]`. A mass-import that adds 50k photos during a quiet window means one DeferredDispatch row with 50k asset entries.
+
+**Impact:** memory blow-up at drain time (the whole JSON is parsed via `deserialize_event` into a Python list of `MediaAsset` dataclasses); could trip the drain timeout (`_DRAIN_DISPATCH_TIMEOUT_SECONDS=120`) on legitimate workloads.
+
+**Fix:** cap the union at e.g. 500 assets per row; when crossed, emit a "more_truncated" sentinel into `payload["extra"]` so the rendered template can show "+45000 more". The `apply_tracking_display_filters` `max_assets_to_show` does cap it for delivery, but the *stored* payload is uncapped.
+
+---
+
+### M7. Per-tick `await get_app_timezone(session)` reads from the DB on every dispatch ([dispatch_helpers.py:146-150](packages/server/src/notify_bridge_server/services/dispatch_helpers.py))
+
+Each tracker tick, each webhook, each defer evaluation calls `get_app_timezone` which calls `get_setting(session, "timezone")` which is a SELECT. The timezone setting rarely changes (manual setting), but the SELECT runs constantly.
+
+**Impact:** noise on otherwise good caching.
+
+**Fix:** cache the timezone in a module-level `(value, expires_at)` tuple with 60-s TTL, invalidated by `reschedule_cron_jobs_for_timezone_change`.
+
+---
+
+### M8. Unbounded in-memory dictionaries with no TTL or capacity ([scheduler.py:67-72](packages/server/src/notify_bridge_server/services/scheduler.py), [telegram_poller.py:31-35](packages/server/src/notify_bridge_server/services/telegram_poller.py), [command_sync.py:25](packages/server/src/notify_bridge_server/services/command_sync.py))
+
+```python
+_adaptive_state: dict[int, dict[str, int]] = {}
+_adaptive_max_skip: dict[int, int] = {}
+_last_update_id: dict[int, int] = {}
+_last_webhook_reclaim_at: dict[int, float] = {}
+_dirty_bots: dict[int, float] = {}
+```
+
+Each is keyed by tracker_id / bot_id. When a tracker or bot is deleted, the cleanup paths (`unschedule_tracker`, etc.) do remove some entries — but not all. `_last_update_id`, `_last_webhook_reclaim_at` are never cleared on bot deletion.
+
+**Impact:** slow memory leak in long-running processes that create+delete trackers/bots frequently (e.g. test environments).
+
+**Fix:** on tracker/bot deletion, explicitly clear all module dicts that key by that id. Or, simpler, switch each to `weakref.WeakValueDictionary` once the entity has a Python object representation, or to a TTLCache.
+
+---
+
+### M9. Bulk insert pattern in migrations uses one-statement-per-row ([migrations.py:566-588](packages/server/src/notify_bridge_server/database/migrations.py))
+
+`migrate_tracker_targets` issues `INSERT INTO ... VALUES (...)` per row in a Python for-loop. On a tenant with 10k+ legacy rows this is slow even inside a single transaction.
+
+**Impact:** one-shot, but rough on upgrade for big tenants.
+
+**Fix:** use `executemany` / batch INSERTs:
+
+```python
+await conn.execute(text("INSERT INTO ... VALUES (...)"), batch_params)
+```
+
+This is mostly historical (the migration is idempotent and skipped on subsequent runs), but worth fixing if you're touching the file.
+
+---
+
+### M10. Missing index on `notification_tracker_state(notification_tracker_id, collection_id)` ([models.py:454-478](packages/server/src/notify_bridge_server/database/models.py))
+
+`check_tracker` reads state per tracker; the existing `ix_notification_tracker_state.notification_tracker_id` index (declared via `index=True`) supports that. But every state read is `WHERE tracker_id = ? AND collection_id = ?` (implicitly via the resulting dict). A composite would help; SQLite can do index-only scans here.
+
+**Impact:** small. SQLite's index intersection plus the fact that one tracker typically has <20 collections makes this a minor win.
+
+**Fix:** add `(notification_tracker_id, collection_id)` composite index to the `_INDEXES` list.
+
+---
+
+## LOW
+
+### L1. `SELECT *` semantics from `select(Model)` ORM is unavoidable but verbose ([throughout services/, api/])
+
+SQLModel's `select(ModelClass)` is effectively `SELECT all columns`. For wide rows like `TrackingConfig` (~70 columns of boolean flags) that's a lot of bytes per dispatch evaluation. There are no API list endpoints that return `TrackingConfig` from a hot path, so this is mostly cosmetic — but for pages that only need a handful of columns (e.g. `status.py`'s `tracker_id, name` map) the explicit-column form is already used. Continue that pattern.
+
+---
+
+### L2. `EventLog.details` JSON dict is reconstructed on every dashboard read ([status.py:258](packages/server/src/notify_bridge_server/api/status.py))
+
+`details: e.details or {}` serializes the JSON every time. SQLite returns this as a parsed Python dict already (JSON column), so the cost is low; just a note that this is a hot path.
+
+---
+
+### L3. `event_log.collection_id` and `details` have no indexes; some webhook commands filter on them ([commands/immich/events.py:43](packages/server/src/notify_bridge_server/commands/immich/events.py))
+
+The history-by-tracker endpoint uses the composite `ix_event_log_user_event_type_created` plus a hit on `notification_tracker_id` — fine. But `events.py`'s "last assets_added for this collection" queries (`event_type='assets_added' AND collection_id=?`) cannot use any current index optimally.
+
+**Fix:** add `(event_type, collection_id, created_at DESC)` if these queries are called by users frequently (Telegram `/assets <album>` etc.).
+
+---
+
+### L4. JSON column types not declared with `JSONB` semantics ([models.py: many](packages/server/src/notify_bridge_server/database/models.py))
+
+SQLite has only `JSON` (text storage with `json_valid` checks). On Postgres you'd want `JSONB`. The codebase uses `Column(JSON)` from SQLModel which maps to native `JSONB` on Postgres — that's correct. No action needed.
+
+---
+
+### L5. The `setup` lifespan runs migrations *inside* the FastAPI lifespan synchronously ([main.py:62-122](packages/server/src/notify_bridge_server/main.py))
+
+The migrations + seeds + scheduler boot all run before `_READY = True`. On a cold start with a big DB this can take 10+ s during which `/api/ready` returns 503. That's correct, but `/api/health` is also un-reachable because uvicorn hasn't started the workers yet (lifespan blocks startup). For orchestrators that probe `/api/health`, this means startup-grace must be tuned.
+
+**Fix:** start the HTTP listener first, run migrations as a background task, expose readiness flag through `/api/ready` only.
+
+---
+
+### L6. `ServiceProvider.config`, `NotificationTarget.config`, `Tracker.filters` JSON columns store secrets unencrypted ([models.py:42, 349, 399](packages/server/src/notify_bridge_server/database/models.py))
+
+API keys, refresh tokens, webhook secrets, SMTP passwords all live in `config` JSON. Visible to anyone with DB read access. This is a known design trade-off (`backup_secrets_mode` controls export behaviour) but worth flagging.
+
+**Fix:** out of scope for this review; consider an at-rest encryption layer keyed off `secret_key` (Fernet) for `config["api_key"]`, `config["password"]`, `access_token`, etc. — but only if your threat model justifies the operational cost.
+
+---
+
+### L7. Frontend `caches.svelte.ts` has 30-s TTL but no cross-tab invalidation ([entity-cache.svelte.ts:14](frontend/src/lib/stores/entity-cache.svelte.ts))
+
+Two browser tabs editing the same entity will see stale data for up to 30 s in the other tab. No `BroadcastChannel` listener.
+
+**Fix:** add a `BroadcastChannel('notify-bridge-cache')` that calls `cache.invalidate()` on receipt. ~15 lines.
+
+---
+
+### L8. `providersCache.invalidate(); await load()` is two-step ([providers/+page.svelte:238, 250](frontend/src/routes/providers/+page.svelte))
+
+`invalidate()` + immediate `fetch(true)` race against any in-flight request; the deduplication map handles it, but the explicit `await load()` is essentially `fetch(true)` directly. Simpler:
+
+```typescript
+providersCache.set(updatedList);  // or fetch(true)
+```
+
+Cosmetic.
+
+---
+
+### L9. `details["dispatch_status"]` is a string enum but not declared as one ([deferred_dispatch.py:619-624](packages/server/src/notify_bridge_server/services/deferred_dispatch.py))
+
+`dispatch_status` takes values `"deferred"`, `"deferred_then_dropped"`, `"deferred_then_failed"`, `"delivered_after_quiet_hours"`, `"dropped_quiet_hours_nondeferrable"`. They're scattered as string literals. The dashboard renders them.
+
+**Fix:** declare an `Enum` once and import from both server and frontend types.
+
+---
+
+### L10. No DB connection used by `/api/health` ([main.py:270-274](packages/server/src/notify_bridge_server/main.py))
+
+`/api/health` returns instantly without checking the DB. That's correct for a liveness probe but the comment doesn't match common practice ("liveness = process up"). Pair this with #L5: orchestrators using `/api/health` for warm-up will mark the pod ready while migrations are still running.
+
+**Fix:** keep liveness lightweight, document the readiness probe as the warm-up gate.
+
+---
+
+## Notes on what's already good
+
+- Performance indexes (`_INDEXES` list) cover all the right hot paths.
+- Composite `(status, fire_at)` index on `deferred_dispatch` plus partial unique `(link_id, collection_id, event_type) WHERE status='pending'` prevents the worst races.
+- `load_link_data` is fully batched — the most complex hot path in the codebase looks clean.
+- Shared `aiohttp.ClientSession` with DNS-rebinding-safe `PinnedResolver` is production-grade.
+- Pre-migration `VACUUM INTO` snapshot is the right safety net for a hand-rolled migration chain.
+- APScheduler defaults (`coalesce=True`, `misfire_grace_time=300`, `max_instances=1`) are correct production settings.
+- Adaptive polling (skip-N-of-K when idle) with jitter is a thoughtful 4-tier scheduling design.
+- Tracker cache (5-s TTL with explicit invalidation) and rendered-message per-locale cache are good fan-out optimizations.
+- Migration idempotency is genuinely well-handled despite the rough tooling.
+- Frontend `entity-cache` deduplication of in-flight requests is the right pattern.
+
+---
+
+## Priority recommendations (next 30 days)
+
+1. **Adopt Alembic** (C1, C2) — eliminate `create_all` from prod, baseline the current schema, lock down new schema changes through autogenerate.
+2. **Fix the dashboard aggregate query** (H1, H2, M5) — add the missing composite index, server-side cache the per-provider aggregate, virtualize the event list. This is the single biggest user-visible perf win.
+3. **Cap `DeferredDispatch.event_payload` size + add retention for fired/dropped rows** (M6, H7) — closes off the worst-case memory and growth scenarios.
+4. **Cleanup module-level dicts on entity deletion** (M8) — small fix, prevents a slow leak.
+5. **Standardize SQLite PRAGMAs and pool config** (C3, M3) — predictable behaviour, fewer spurious BUSY errors.
+
+---
+
+*Reviewed against codebase at HEAD (`a20635a`).*

.claude/reviews/security-review.md

@@ -0,0 +1,312 @@
+# Security Review — notify-bridge v0.8.1
+
+Reviewer: security-reviewer (Opus 4.7) — 2026-05-22
+Branch: master @ a20635a
+Scope: `packages/server`, `packages/core`, `frontend/src`, `Dockerfile`, `docker-compose.yml`, `.gitea/workflows/`, env handling.
+
+---
+
+## Executive Summary
+
+- **Overall posture is strong.** The project applies many non-obvious controls correctly: Jinja2 `SandboxedEnvironment` on every render path; `bcrypt` with a 72-byte length guard and constant-time login (dummy hash on missing user); JWT with `token_version` revocation; SSRF guard with CGNAT, IPv4-mapped-IPv6 unwrapping, and a `PinnedResolver` that defeats DNS rebinding; secret-masking log filter; path-traversal-safe backup file resolver; security headers + CSP; non-root Docker user; required `SECRET_KEY` >= 32 chars with a rejection list; non-default Telegram webhook secret enforced; HMAC signature checks on Gitea/Generic webhooks; provider-config secret masking on GET; ownership checks (`get_owned_entity`) on every parameterised route I sampled.
+- **HIGH — Home Assistant `access_token` is not masked.** It is stored in `provider.config`, never added to the mask list in `_provider_response`, never added to the placeholder-drop list in `update_provider`. Any logged-in user can `GET /api/providers/{id}` and read their HA token in cleartext, and a partial save will wipe it. Trivial fix.
+- **HIGH — Secrets at rest are plaintext.** Telegram bot tokens (`telegram_bot.token`), provider configs containing `api_key`/`api_token`/`webhook_secret`/`access_token`/SMTP passwords, and email-bot SMTP passwords are stored unencrypted in SQLite. Disk theft, an unrelated read primitive, or any backup leak exposes all credentials. The masking on the API is good UX, but the DB itself has no encryption-at-rest. The exported JSON backup respects a `secrets_mode` flag (good) but the live DB does not.
+- **MEDIUM — Template-preview endpoints bypass the timeout/size watchdog.** `template_configs.preview_config`, `template_configs.preview_raw`, `command_template_configs.preview_raw`, and `notifier.send_test_template_notification` construct fresh `SandboxedEnvironment(autoescape=False)` instances and call `.render(...)` directly. The hardened helper `render_template()` (timeout, source cap, output cap, autoescape) is bypassed. A logged-in user can wedge a worker thread with `{% for i in range(10**8) %}x{% endfor %}`. Single-tenant deployment limits the blast radius, but the renderer should be the single chokepoint.
+- **MEDIUM — Login rate limit is per-IP only.** `POST /api/auth/login @ 5/min` keys on `get_remote_address`. An attacker behind a proxy / NAT, or one that rotates source IPs (cheap on residential / cloud), trivially bypasses it. There is no per-username lockout, no exponential backoff, no captcha. Combined with no MFA, this leaves the admin account vulnerable to a slow online dictionary attack from a single password (8-char minimum, no complexity requirement).
+- **LOW / INFO — Several smaller findings**: webhook payload logs persist source payload (now with key-level redaction, but the redactor is name-based and will miss high-entropy secret values in non-obvious keys); no replay protection on inbound webhooks (no nonce/timestamp window); the `/api/auth/setup` 3/min limit + JWT issuance race window is hardened with a transaction count guard (good), but the dummy bcrypt hash literal used for timing-equalisation is malformed and `bcrypt.checkpw` returns `False` via `ValueError` — the swallowed exception still equalises timing, but a maintainer could regress this; CSP allows `script-src 'unsafe-inline'` (necessary for SvelteKit hydration, acceptable risk acknowledged in code).
+
+---
+
+## Findings
+
+### CRITICAL
+
+_None found._
+
+---
+
+### HIGH
+
+#### H-1. Home Assistant access_token leaked in provider GET responses
+
+- CWE: CWE-522 (Insufficiently Protected Credentials), CWE-200 (Exposure of Sensitive Information)
+- Files:
+  - [`packages/server/src/notify_bridge_server/api/providers.py:616-624`](../../packages/server/src/notify_bridge_server/api/providers.py) — `_provider_response` masks `("api_key", "api_token", "webhook_secret", "password", "client_secret", "refresh_token")` but **not** `access_token`.
+  - [`packages/server/src/notify_bridge_server/api/providers.py:399-405`](../../packages/server/src/notify_bridge_server/api/providers.py) — `update_provider` also omits `access_token` from the placeholder-drop list, so the response masking is consistent here, but if you fix one you must fix the other.
+- Scenario: Any user authenticated to the bridge (any role) calls `GET /api/providers/{id}` for an HA provider they own and the response includes `config.access_token` in cleartext. The HA long-lived token grants full control of the user's Home Assistant instance (lights, locks, cameras, scripts, devices). In a multi-user deployment, even within the same admin account, a stolen JWT exfiltrates the HA token; in a single-user deployment, any read primitive (XSS via a future template feature, an MITM on an HTTPS misconfiguration) gives the same result.
+- Remediation: Add `access_token` to both lists.
+
+```python
+# providers.py:_provider_response
+for secret_field in (
+    "api_key", "api_token", "webhook_secret", "password",
+    "client_secret", "refresh_token", "access_token",  # <-- add
+):
+    ...
+
+# providers.py:update_provider
+for secret_field in (
+    "api_key", "api_token", "webhook_secret", "password",
+    "client_secret", "refresh_token", "access_token",  # <-- add
+):
+    value = incoming.get(secret_field)
+    if isinstance(value, str) and value.startswith("***"):
+        incoming.pop(secret_field, None)
+```
+
+Better still: replace the hand-maintained tuple with a single module-level constant `_PROVIDER_SECRET_FIELDS` referenced from both call sites, plus a unit test that asserts every field declared on the per-provider Pydantic configs whose name appears in a denylist (`token`, `secret`, `password`, `key`, `credential`) is in the set. That prevents the next provider type from re-introducing the same gap.
+
+#### H-2. Secrets stored in plaintext at rest
+
+- CWE: CWE-312 (Cleartext Storage of Sensitive Information), CWE-256 (Plaintext Storage of a Password)
+- Files:
+  - [`packages/server/src/notify_bridge_server/database/models.py:54-84`](../../packages/server/src/notify_bridge_server/database/models.py) — `TelegramBot.token: str`
+  - [`packages/server/src/notify_bridge_server/database/models.py:87-100`](../../packages/server/src/notify_bridge_server/database/models.py) — `MatrixBot` (access_token in config)
+  - `ServiceProvider.config: dict[str, Any]` (JSON column) holds Immich `api_key`, Gitea `webhook_secret` + `api_token`, Google Photos `client_secret` + `refresh_token`, HA `access_token`, etc.
+  - `EmailBot.smtp_password: str` (per [`api/email_bots.py:142`](../../packages/server/src/notify_bridge_server/api/email_bots.py))
+- Scenario: An attacker who can read the SQLite file (compromised host, mis-permissioned backup volume, snapshot artifact in `data_dir/backups/`, leaked debug dump) gets every credential the bridge speaks: Telegram bot tokens (full bot control), Immich/Gitea/Planka API keys (read all photos / repos), Google Photos refresh tokens (long-lived, hard to revoke at scale), HA long-lived tokens (smart-home), SMTP passwords. The pre-migrate VACUUM-INTO snapshots (`packages/server/src/notify_bridge_server/database/snapshot.py`) inherit the same plaintext exposure and live alongside the active DB.
+- Remediation options, in order of effort:
+  1. **Short term**: document the threat in `OPERATIONS.md`, enforce file-system permissions on `/data` (the Dockerfile chowns to appuser already, but the host bind-mount must be `chmod 700`), and ensure backups are encrypted at the storage layer (S3 SSE / Borg / restic).
+  2. **Better**: column-level encryption with a key derived from `NOTIFY_BRIDGE_SECRET_KEY` (or a separate `NOTIFY_BRIDGE_DB_ENCRYPTION_KEY`). Use the `cryptography` library's `Fernet` for each sensitive column; envelope the secret JSON keys, not the whole row, so `WHERE` clauses and existing migrations keep working. Add a one-shot migration that re-encrypts existing rows.
+  3. **Best**: encrypt with a KMS-backed key (HashiCorp Vault Transit, AWS KMS) and rotate per-secret data keys. This is overkill for a homelab homeserver-style deployment but mandatory if the bridge is ever multi-tenant.
+- Skeleton for option 2:
+
+```python
+# new file packages/server/src/notify_bridge_server/security/secretbox.py
+from cryptography.fernet import Fernet, InvalidToken
+from .config import settings
+
+def _key() -> bytes:
+    # Derive a deterministic Fernet key from secret_key. Anyone with secret_key
+    # can decrypt — same threat model as JWT signing — but anyone with the DB
+    # alone cannot.
+    import base64, hashlib
+    h = hashlib.sha256(settings.secret_key.encode()).digest()
+    return base64.urlsafe_b64encode(h)
+
+_fernet = Fernet(_key())
+
+def encrypt_secret(plaintext: str) -> str:
+    return _fernet.encrypt(plaintext.encode()).decode()
+
+def decrypt_secret(ciphertext: str) -> str:
+    return _fernet.decrypt(ciphertext.encode()).decode()
+```
+
+Apply at write time in `update_provider` / `create_provider`, decrypt at read time inside `make_immich_provider`, `make_gitea_provider`, the Telegram client constructor, etc. Add a migration that scans every `ServiceProvider.config` JSON and re-encrypts the listed keys in place.
+
+---
+
+### MEDIUM
+
+#### M-1. Template preview endpoints skip the renderer watchdog
+
+- CWE: CWE-400 (Uncontrolled Resource Consumption), CWE-1333 (Inefficient Regular Expression Complexity — analogous)
+- Files:
+  - [`packages/server/src/notify_bridge_server/api/template_configs.py:608-613`](../../packages/server/src/notify_bridge_server/api/template_configs.py) — `preview_config` calls `SandboxedEnvironment(autoescape=False).from_string(template_body).render(...)` directly.
+  - [`packages/server/src/notify_bridge_server/api/slot_helpers.py:72-90`](../../packages/server/src/notify_bridge_server/api/slot_helpers.py) — `render_template_preview` (used by `/preview-raw` for both notification and command templates).
+  - [`packages/server/src/notify_bridge_server/services/notifier.py:494-499`](../../packages/server/src/notify_bridge_server/services/notifier.py) — `send_test_template_notification`.
+  - The hardened helper [`packages/core/src/notify_bridge_core/templates/renderer.py:48-108`](../../packages/core/src/notify_bridge_core/templates/renderer.py) (with timeout, length caps, output cap) is **not** used here.
+- Scenario: An authenticated admin submits `{% for i in range(10**8) %}x{% endfor %}` to `POST /api/template-configs/preview-raw`. Jinja2 has no built-in timeout. The sandbox blocks attribute access but not CPU. The request blocks the FastAPI event loop's executor thread until the worker oomkills or the client times out. Repeat to DoS the API.
+- Remediation: Route every render through a single, hardened helper.
+
+```python
+# Use the existing core helper consistently
+from notify_bridge_core.templates.renderer import render_template
+rendered = render_template(template_str, context)  # already has timeout + caps
+```
+
+For the strict-undefined two-pass validation in `render_template_preview`, fold the watchdog into the helper itself rather than skipping it.
+
+#### M-2. Login rate limit is per-IP only
+
+- CWE: CWE-307 (Improper Restriction of Excessive Authentication Attempts)
+- Files: [`packages/server/src/notify_bridge_server/auth/routes.py:140-157`](../../packages/server/src/notify_bridge_server/auth/routes.py).
+- Scenario: `@limiter.limit("5/minute")` keyed on `get_remote_address` gives 5 attempts per source IP per minute = ~7,200/day per IP. An attacker rotating across 10 IPs (cheap cloud, residential proxies, even a Tor exit pool) gets 72,000/day. With the 8-character minimum password and no complexity requirement, a 7-char-and-common password is reachable in days, not centuries. There is no per-username lockout, no captcha, no MFA.
+- Remediation:
+  1. Add a per-username sliding-window limiter on top of the per-IP one. Use a second `Limiter` whose `key_func` returns the lower-cased username from the body. Re-check after parsing the body.
+  2. Add an exponential lockout: after N consecutive failures for a username, require a cooldown (record in a `LoginFailure` table or in-memory TTLCache).
+  3. Document and recommend deploying behind a reverse proxy that adds CAPTCHA / WAF rate-limiting for login (Cloudflare Turnstile is cheap).
+  4. Track and log failed logins (auth-event audit trail) with src IP + username + timestamp.
+
+```python
+# Sketch — a second limiter that keys by username from the parsed body.
+async def _check_username_quota(username: str) -> None:
+    # In-memory TTLCache: 10 attempts per username per 15 minutes
+    if _username_attempts[username] >= 10:
+        raise HTTPException(429, "Too many attempts for this account")
+    _username_attempts[username] += 1
+```
+
+#### M-3. Webhook payload log redactor is keyword-based, misses value-based secrets
+
+- CWE: CWE-532 (Insertion of Sensitive Information into Log File)
+- Files: [`packages/server/src/notify_bridge_server/api/webhooks.py:326-358`](../../packages/server/src/notify_bridge_server/api/webhooks.py).
+- Scenario: `_redact_sensitive_body` walks the JSON and redacts values whose **keys** contain `token`, `auth`, `key`, `secret`, etc. A webhook provider that ships secrets under an innocent key (e.g. `"oauth_state": "ya29.a0..."`, `"continuation": "ABCDE..."`, `"x_state": "..."`) leaves the secret in the persisted payload log. The log row is admin-readable and exported in backups.
+- Remediation: Layer a high-entropy value detector on top of the key matcher (e.g. anything matching `[A-Za-z0-9_\-+/=]{32,}` and high Shannon entropy ≥ 3.5). Lower bound: also redact known prefixes (`ya29.`, `xoxb-`, `ghp_`, `glpat_`, `sk-`, `Bearer `).
+
+#### M-4. Webhook ingestion has no replay protection
+
+- CWE: CWE-294 (Authentication Bypass by Capture-replay)
+- Files: [`packages/server/src/notify_bridge_server/api/webhooks.py`](../../packages/server/src/notify_bridge_server/api/webhooks.py) — Gitea/Planka/Generic.
+- Scenario: An attacker who once intercepts a signed Gitea push event (network downgrade, log leak from a proxy, exfil from the Gitea side) can replay it indefinitely. The HMAC stays valid; the bridge has no nonce / timestamp window / delivery-ID cache. With a webhook that fires `assets_added` it's just noise. With a webhook that triggers an action (planka card-created → `/api/actions/{id}/execute` chained logic), it could be more.
+- Remediation: For Gitea, store the last N `X-Gitea-Delivery` UUIDs per provider and reject duplicates; cap with a partial unique index. For the generic webhook, add an optional `replay_window_seconds` + a timestamp-extracting JSONPath in the provider config. Constant-time string compare.
+
+#### M-5. `bcrypt.checkpw` dummy-hash literal is malformed
+
+- CWE: CWE-208 (Observable Timing Discrepancy) — partial.
+- Files: [`packages/server/src/notify_bridge_server/auth/routes.py:147-152`](../../packages/server/src/notify_bridge_server/auth/routes.py).
+- Scenario: When the username doesn't exist, the code calls `_verify_password(body.password, "$2b$12$" + "a" * 53)`. That hash is not a real bcrypt hash; `bcrypt.checkpw` raises `ValueError` which `_verify_password` swallows and returns `False`. The exception path is *faster* than a real bcrypt verify (no key schedule), so timing of "user does not exist" differs from "user exists, wrong password" — a maintainer changing the swallow behaviour later could regress this entirely.
+- Remediation: Cache one valid dummy bcrypt hash at module load time so the verify path actually runs the KDF.
+
+```python
+_DUMMY_BCRYPT_HASH = bcrypt.hashpw(b"x", bcrypt.gensalt()).decode()  # module load
+...
+password_ok = await _verify_password(
+    body.password,
+    user.hashed_password if user else _DUMMY_BCRYPT_HASH,
+)
+```
+
+#### M-6. Setup endpoint relies on `User.id != 0` filter — robust but a single typo breaks it
+
+- CWE: CWE-302 (Authentication Bypass) — defence-in-depth.
+- Files: [`packages/server/src/notify_bridge_server/auth/routes.py:97-119`](../../packages/server/src/notify_bridge_server/auth/routes.py).
+- Scenario: `POST /api/auth/setup` is gated by "no users with id != 0". The `__system__` sentinel is id=0. If a future migration changes the sentinel id, or the `WHERE` clause is dropped during a refactor, setup re-opens silently and an internet-reachable bridge would let an attacker claim the admin account.
+- Remediation: Add a defence-in-depth flag `AppSetting.setup_completed=true` set during the first successful setup, and require it to be unset (in addition to the count check). This bakes the invariant into a single boolean that's easier to audit.
+
+#### M-7. Anonymous Prometheus metrics endpoint leaks operational data
+
+- CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
+- Files: [`packages/server/src/notify_bridge_server/api/metrics.py:138-159`](../../packages/server/src/notify_bridge_server/api/metrics.py).
+- Notes: This is **documented and gated** by `NOTIFY_BRIDGE_METRICS_ENABLED`, and the comment explicitly says scrapers don't authenticate. Acceptable when the API port is firewalled to the scraper. Surface it here as informational so an operator who exposes the API directly to the internet (e.g. via reverse-proxy without an ACL) doesn't accidentally expose dispatch rates, provider names, queue depths.
+- Remediation: keep the env flag, but additionally allow `metrics_basic_auth_user` / `metrics_basic_auth_password` as a soft credential check on the endpoint so a "default enabled, default protected" mode is possible. Document the threat in `OPERATIONS.md` next to the env var.
+
+---
+
+### LOW
+
+#### L-1. CSP allows `'unsafe-inline'` for scripts
+
+- CWE: CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) — adjacent.
+- File: [`packages/server/src/notify_bridge_server/main.py:186-201`](../../packages/server/src/notify_bridge_server/main.py).
+- Notes: Comment explicitly justifies it — SvelteKit static adapter emits an inline bootstrap. Acceptable, but `'strict-dynamic'` with a per-page nonce (or moving the bootstrap into a hashed external module) eliminates the gap entirely. Track as INFO unless future XSS-injection paths emerge.
+
+#### L-2. CSP `style-src 'unsafe-inline'` allows inline-style XSS payloads
+
+- CWE: CWE-79 (Cross-site Scripting) — defence-in-depth.
+- Same file as L-1. Inline styles are not directly executable, but they are a known vector for click-jacking and data-exfil via CSS selectors. Same remediation path: nonce-based CSP.
+
+#### L-3. `frame-ancestors 'none'` but no `X-Frame-Options: DENY` collision (false — it is set)
+
+- INFO only. Both `X-Frame-Options: DENY` and `frame-ancestors 'none'` are set; modern browsers honour CSP, legacy ones honour XFO. Good.
+
+#### L-4. Webhook `_filter_headers` allowlist accepts unknown `X-*` headers
+
+- CWE: CWE-532
+- File: [`packages/server/src/notify_bridge_server/api/webhooks.py:361-374`](../../packages/server/src/notify_bridge_server/api/webhooks.py).
+- Notes: The filter strips known sensitive headers, then accepts any `X-*`. A custom auth header like `X-Custom-Authentication: <token>` would slip past the substring check if the name doesn't contain `auth`/`token`/`key`/`secret`/etc. Low risk because the well-known providers we support don't ship such headers, but a misconfigured generic webhook will leave a credential in the log row.
+- Remediation: invert the policy — explicit allowlist for known-safe `X-*` headers (e.g. `X-Forwarded-For` is also borderline since it can carry PII).
+
+#### L-5. `external_url` setting is not validated against an allow-list
+
+- CWE: CWE-918 (SSRF), CWE-79 (XSS in the rendered Telegram webhook URL).
+- File: [`packages/server/src/notify_bridge_server/api/app_settings.py:329-339`](../../packages/server/src/notify_bridge_server/api/app_settings.py) reads, [`packages/server/src/notify_bridge_server/api/telegram_bots.py:247`](../../packages/server/src/notify_bridge_server/api/telegram_bots.py) writes it into the registered Telegram webhook URL.
+- Notes: An admin can set `external_url` to anything. The value is used to build the URL passed to Telegram in `setWebhook`. Telegram itself enforces an HTTPS-only allow-list, so the actual risk is bounded. Still — validate scheme + host + that it doesn't include credentials or fragments.
+
+#### L-6. Bot token GET endpoint is intentional but worth auditing
+
+- File: [`packages/server/src/notify_bridge_server/api/telegram_bots.py:148-156`](../../packages/server/src/notify_bridge_server/api/telegram_bots.py).
+- Notes: `GET /api/telegram-bots/{bot_id}/token` returns the full Telegram bot token to the owner. Used by the frontend to construct webhook URLs. Limiting to a single short-lived nonce per `register_bot_webhook` flow would be safer than exposing the token directly. Currently INFO; revisit if a multi-user role model lands.
+
+#### L-7. SQLite journal mode + backup snapshot file permissions
+
+- File: [`packages/server/src/notify_bridge_server/database/snapshot.py:60-95`](../../packages/server/src/notify_bridge_server/database/snapshot.py).
+- Notes: Snapshots are written via `VACUUM INTO 'path'`. They land in `data_dir/backups/` with default umask permissions. In the Docker image the dir is owned by `appuser` and only that user runs the process, so this is fine. On a host bind-mount, an operator who forgets to lock down `/data` exposes every credential in every snapshot to anyone with shell access. Document this in `OPERATIONS.md`.
+
+#### L-8. No CSRF token on state-changing endpoints
+
+- CWE: CWE-352
+- Notes: The API uses `Authorization: Bearer <jwt>` exclusively (no cookies). Browsers don't auto-attach `Authorization` headers cross-origin, so this is **not** classical CSRF-exploitable. Combined with strict CORS (`allow_credentials=True`, explicit origin allowlist, wildcard rejected on startup) and the `Origin`/`Referer` same-host check on the backup endpoints, the practical risk is essentially zero. INFO only.
+
+---
+
+### INFO / NEEDS VERIFICATION
+
+#### N-1. Jinja2 `SandboxedEnvironment` is the standard sandbox — confirm it covers your threat model
+
+- The sandbox blocks `__class__`, `__mro__`, etc., but it is well-known that Jinja2's sandbox is not a security boundary against a determined attacker who can author templates. The threat model here is "templates are admin-authored, so we trust them but use the sandbox as defence-in-depth"; that is reasonable. Document explicitly in `OPERATIONS.md` that anyone with template-edit permission has effective RCE on the worker thread (`{{ foo.__init__.__globals__... }}` style escapes have been published in the past; new ones surface periodically).
+- Verification: run `bandit -r packages/` and `safety check` against pinned versions of `jinja2>=3.1`. Latest CVEs against Jinja2 sandbox: track `CVE-2024-34064` and any 2025+ disclosures. As of the review date there is no known unpatched sandbox-escape in `jinja2>=3.1.4`.
+
+#### N-2. `apscheduler<4`
+
+- Notes: The pin `apscheduler>=3.10,<4` keeps the bridge on the 3.x line, which is in maintenance. No known CVEs as of this review. Track when 4.x stabilises and migrate.
+
+#### N-3. `python-multipart>=0.0.9`
+
+- Notes: This package had high-severity bugs prior to 0.0.6. The minimum here is 0.0.9 — good.
+
+#### N-4. No signed-image / SBOM on the container
+
+- Notes: The `release.yml` workflow builds and pushes a multi-tag image but does not sign with cosign or emit an SBOM. For an internet-facing deployment, consider adding `cosign sign` against the image digest, and `syft packages` to emit an SBOM at release time. INFO only.
+
+#### N-5. Frontend dependencies are pinned via caret (`^`) ranges
+
+- Notes: `package.json` uses `^x.y.z`. CI builds `npm ci` from `package-lock.json`, so reproducibility is fine at build time. There is no `npm audit` step in `.gitea/workflows/build.yml`. Add `npm audit --audit-level=high` to the frontend build job.
+
+#### N-6. `NOTIFY_BRIDGE_ALLOW_PRIVATE_URLS=1` is a footgun
+
+- File: [`packages/core/src/notify_bridge_core/notifications/ssrf.py:39-52`](../../packages/core/src/notify_bridge_core/notifications/ssrf.py).
+- Notes: When set, the SSRF guard becomes a no-op. The warning at boot is the only mitigation. Acceptable for the documented homelab use-case; document that the env flag must NEVER be set on an internet-reachable instance, and consider refusing to enable it when `cors_allowed_origins` resolves to a non-loopback host (defence-in-depth interlock).
+
+#### N-7. Verify the auth flow at the WebSocket boundary
+
+- File: [`packages/core/src/notify_bridge_core/providers/home_assistant/client.py:54-83`](../../packages/core/src/notify_bridge_core/providers/home_assistant/client.py).
+- The `_ws_url_from_base` correctly strips userinfo before connecting and `_redact` defangs error messages — verify that `wss://` URLs go through SSRF validation (currently the HA URL is validated by `AnyHttpUrl` at config time but I did not find a call to `avalidate_outbound_url_full` on the HA WS connect path; the resolver would not pin a host the validator never saw).
+- Action: confirm by reading `ha_subscription.py` for explicit validation, or add a check that calls `avalidate_outbound_url_full` against the derived `ws_url` (treating `ws`/`wss` like `http`/`https` for the block-range check) before `ws_connect`.
+
+---
+
+## Prioritised Fix List (Top 10)
+
+1. **HIGH H-1** — Add `access_token` to the secret-mask list in `providers._provider_response` and the placeholder-drop list in `providers.update_provider`. Add a regression test that GETs an HA provider and asserts the response does not contain the cleartext token.
+2. **HIGH H-2** — Implement column-level encryption for `TelegramBot.token`, `MatrixBot` access tokens, `EmailBot.smtp_password`, and the sensitive keys inside `ServiceProvider.config`. Use Fernet with a key derived from `SECRET_KEY`. Write a one-shot migration.
+3. **MEDIUM M-1** — Replace the ad-hoc `SandboxedEnvironment(...).render()` calls in the four preview/test paths with the single hardened `render_template()` helper that already has timeout + size caps.
+4. **MEDIUM M-2** — Add per-username login lockout (TTL cache or DB-backed) on top of the per-IP `5/minute`. Log failed login attempts.
+5. **MEDIUM M-5** — Replace the malformed dummy bcrypt literal in `login()` with a real bcrypt hash computed once at module load so the timing-equalisation actually runs the KDF.
+6. **MEDIUM M-3** — Strengthen `_redact_sensitive_body` with a value-entropy heuristic and well-known token-prefix matching.
+7. **MEDIUM M-4** — Add replay protection on Gitea webhooks via the `X-Gitea-Delivery` header (small table + partial unique index).
+8. **MEDIUM M-7** — Make the metrics endpoint require either a flag or a Basic Auth credential; document in `OPERATIONS.md` that the API port should not be internet-exposed when metrics are on.
+9. **MEDIUM M-6** — Add a defence-in-depth `setup_completed` boolean in `app_setting` and check it in `/api/auth/setup` in addition to the count.
+10. **N-5** — Add `npm audit --audit-level=high` to the frontend build job in `.gitea/workflows/build.yml` so dependency CVEs land in CI.
+
+---
+
+## What was confirmed safe (worth keeping)
+
+- JWT design: HS256 with `iss`/`aud`/`exp`/`type`/`sub`/`ver`; refresh/access split; `token_version` revocation on role change, username change, and password change.
+- bcrypt with 72-byte length guard; CPU-bound work run in a thread.
+- SSRF guard with: scheme allowlist, IPv6-mapped-v4 unwrap, CGNAT block, IDN normalisation, async resolver, `PinnedResolver` to defeat DNS rebinding.
+- SQL access goes through SQLModel/SQLAlchemy with bind parameters; the only `f"..."` SQL is in DDL (column adds, index creates, `VACUUM INTO`) using server-controlled identifiers — sampled and clean.
+- Sandbox is `SandboxedEnvironment` everywhere a user-controllable template is rendered (six locations checked).
+- Frontend `{@html}` is wrapped in `sanitizePreview()` everywhere (`tracking-configs`, `template-configs`, `command-template-configs`).
+- Provider config secrets are masked on GET (except H-1).
+- `_resolve_backup_file` rejects `..`, NUL, separators, and enforces `relative_to(base)`.
+- CORS rejects wildcard with credentials at startup; secret_key default values are rejected with a clear error.
+- Docker: non-root user, `read_only: true`, `tmpfs: /tmp`, `no-new-privileges`, `cap_drop: ALL`, resource limits, healthcheck on `/api/ready`.
+- Logging: `SecretMaskingFilter` masks Telegram bot tokens, `Authorization`, `x-api-key`, `password`, `secret`, `access_token`, `refresh_token` from formatted messages, exception text, and stack traces.
+- Telegram webhook: secret token mandatory, refused on missing config, opaque `webhook_path_id` separate from bot token.
+- Inbound generic webhook: refuses `auth_mode="none"` unless an explicit acknowledgment field is set; auto-generates a strong secret if missing for `bearer_token`/`hmac_sha256`.
+- Inbound payload size capped at 1 MiB with a streaming check that doesn't trust `Content-Length`.
+
+---
+
+## Methodology
+
+- Manual code review of every authentication, authorization, webhook ingestion, template rendering, secret-handling, and outbound HTTP path under `packages/`.
+- Cross-checked CORS / CSP / security headers and rate-limiter configuration in `main.py` + `auth/routes.py`.
+- Sampled API routes for ownership enforcement (`get_owned_entity` / `_get_user_provider` / `_get_user_bot`) — all sampled routes apply it; no IDOR found.
+- Grepped for `Environment(` / `jinja2.Environment` / `f"..."` SQL / `{@html}` / `subprocess` / `eval` / `os.system` / known-bad patterns.
+- Reviewed CI workflows for secret leakage in env blocks and image-signing posture.
+- Reviewed Dockerfile + docker-compose for least-privilege and read-only root.
+- No dynamic testing performed; static review only. Run `pytest` (already gated in CI) + `bandit -r packages/` + `npm audit` in CI to backstop this review.

.claude/reviews/ui-ux-review.md

@@ -0,0 +1,408 @@
+# UI / UX Design Review — Notify Bridge frontend
+
+**Reviewed**: 2026-05-22
+**Scope**: SvelteKit frontend at `frontend/`, "Aurora / Glass" aesthetic, en + ru locales.
+**Reviewer method**: Read `app.css`, `+layout.svelte`, dashboard, login, setup, providers, targets, users, settings (parent), settings/IdentityCassette, notification-trackers, template-configs, actions, bots, plus shared components (Card, Button, Modal, ConfirmModal, AuthLayout, PageHeader, EmptyState, Loading, Snackbar). Cross-cutting Grep passes for inputs, border-radius, ARIA, sort, hex colors.
+
+---
+
+## Executive summary
+
+- **Aurora design language is real and distinctive.** Newsreader display serif + Geist variable sans + Geist Mono, conic-gradient brand orb, animated radial-gradient aurora background (`body::before` 28s drift), gradient pill chips, glow-pulse dots, and the lavender/orchid/mint/citrus/coral/sky palette together give the product a clear visual identity. This is **not** generic admin-template AI slop — the dashboard hero, signal-stream rows, provider deck, and the `PageHeader` "subpage-hero" pattern all carry intentional character that the user will remember.
+- **Consistency is the weakest axis.** Five overlapping card container abstractions (`.hero-card`, `.panel`, `.glass`, `Card.svelte`, settings `.cassette`/`.identity`) re-implement the same frosted-glass recipe with diverging radius (22 / 18 / 14 / 12 px) and padding (1.25/1.4 vs 1.3/1.4 vs 2/2.4 rem). A `--radius: 1rem` token is declared but unused. Pick one card module + one radius scale (e.g. `--radius-card: 22px`, `--radius-input: 12px`, `--radius-pill: 999px`).
+- **Forms have not been migrated to Aurora.** ~71 occurrences across 17 files still use the legacy raw class string `border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]` instead of the global `input { ... }` rule already in `app.css` (which uses `--color-input-bg`, `--color-rule-strong`, 0.625rem radius, glow focus ring). Result: rounded-md (6px) fields next to rounded-2xl (22px) cards, solid opaque backgrounds inside frosted-glass cards. Removing the override class would auto-restyle every form to match. **HIGH** priority, mostly mechanical.
+- **Hardcoded hex colors leak through.** Snackbar uses `#059669` / `#ef4444` / `#3b82f6` / `#f59e0b` instead of `--color-mint/coral/sky/citrus`. ConfirmModal uses a raw `rgba(239, 68, 68, 0.3)` glow. Actions page uses `#059669` for the enabled dot. All bypass theming — they will look wrong in light theme.
+- **Snackbar is invisible to screen readers.** No `role="status"` / `aria-live="polite"` / `aria-live="assertive"` on the toast container. Critical confirmations (saved, deleted, error) are never announced. **HIGH** accessibility fix, one-line.
+- **No `aria-current="page"` anywhere in the nav** — active state is conveyed only visually (border-radius bar + glow). Active state has no accessible name.
+- **No sortable columns, no multi-select bulk actions, anywhere in the app.** Lists rely entirely on `IconGridSelect` sort widgets (newest / oldest, etc.) and per-row icon buttons. For a notification routing system that may accumulate dozens of trackers / targets / configs, this scales poorly.
+- **Localization parity is solid string-for-string** (en.json = ru.json = 1577 lines). Russian renders the same characters but several places (hero title, brand row with provider name, stat-card label/value flex) have no length-guard for the longer Russian translations — visible truncation/wrapping likely.
+- **Onboarding is a single screen.** After `/setup` lands you on `/` with `0 providers` and a hero saying "all clear" — the most important first-run moment shows nothing to do. No checklist, no empty-dashboard CTA panel, no tour.
+- **Power-user feature standout**: ⌘K SearchPalette is present and wired through the topbar, global provider filter, and reduced-motion media-query support. These three deserve credit and should be more discoverable (no in-app hint they exist).
+
+---
+
+## Findings by area
+
+### 1. Design quality vs generic AI aesthetic
+
+#### F-DESIGN-01 — Aurora identity is strong and self-consistent at the macro level [LOW / commendation]
+
+- **Files**: [`frontend/src/app.css`](frontend/src/app.css), [`frontend/src/routes/+layout.svelte`](frontend/src/routes/+layout.svelte), [`frontend/src/routes/+page.svelte`](frontend/src/routes/+page.svelte)
+- **State**: Newsreader display serif italic with linear-gradient text-clip is used in hero titles, panel titles, modal titles. Conic brand orb is unique. Aurora drift on body::before is a 28s slow loop that's never busy. The "signal" / "wires" / "on watch" / "pulse" / "stream" / "compose" semantic naming on the dashboard is editorial, not generic admin copy.
+- **Verdict**: Keep all of this. Lean *further* into it on the subpages — most list pages currently default back to plain "PageHeader + Card list" without inheriting the dashboard's editorial flavor.
+
+#### F-DESIGN-02 — Italic-serif emphasis loses impact on smaller subpage titles [LOW]
+
+- **Files**: [`frontend/src/lib/components/PageHeader.svelte`](frontend/src/lib/components/PageHeader.svelte) (lines 132–147)
+- **State**: `subpage-hero__title` is 2.15rem with italic emphasis on a gradient. At that size the gradient italic word is legible but loses the editorial drama it has at the 3rem dashboard hero. Russian translations (`em` words like *«операторы»*) sometimes look cramped because letter-spacing -0.025em is shared with the much larger dashboard hero.
+- **Suggestion**: Use a separate letter-spacing scale per font size step, or drop italic emphasis on titles below ~2rem and use color-only emphasis there.
+
+---
+
+### 2. Visual consistency
+
+#### F-CONSIST-01 — Five overlapping card abstractions [HIGH]
+
+- **Files**: [`frontend/src/app.css`](frontend/src/app.css) `.glass`, [`frontend/src/lib/components/Card.svelte`](frontend/src/lib/components/Card.svelte), [`frontend/src/lib/components/PageHeader.svelte`](frontend/src/lib/components/PageHeader.svelte) `.subpage-hero`, [`frontend/src/routes/+page.svelte`](frontend/src/routes/+page.svelte) `.hero-card` / `.panel` / `.stat-card`, [`frontend/src/routes/settings/IdentityCassette.svelte`](frontend/src/routes/settings/IdentityCassette.svelte) `.identity` + `.glass`
+- **State**: Six places re-declare the same recipe: `background: var(--color-glass); backdrop-filter: blur(28px) saturate(160%); border: 1px solid var(--color-border); border-radius: 22px; box-shadow: var(--shadow-card);` followed by an `::after` highlight overlay. Card.svelte even has its own 22px radius next to the global `.glass` 22px radius — they would diverge silently if either gets touched.
+- **Suggestion**: Consolidate into one `<GlassPanel>` component (or `.glass-card` utility) with variants `default | hero | panel | cassette` for padding/radius differences. Delete the duplicated `::after` overlays. The pattern is good — it's just *copy-pasted* 5+ times.
+
+#### F-CONSIST-02 — Border-radius drift, no scale [HIGH]
+
+- **Files**: [`frontend/src/routes/+layout.svelte`](frontend/src/routes/+layout.svelte), [`frontend/src/routes/+page.svelte`](frontend/src/routes/+page.svelte), [`frontend/src/app.css`](frontend/src/app.css)
+- **State**: Radii used: 22, 18, 14, 12, 11, 10, 9, 8, 7, 6, 3, 2 px + 0.3, 0.5, 0.625, 0.85, 1 rem + 9999px. `--radius: 1rem` is declared in the theme but only re-declared — no component reads it.
+- **Suggestion**: Define and *use* `--radius-card: 22px; --radius-panel: 18px; --radius-pill: 999px; --radius-input: 12px; --radius-chip: 8px; --radius-tile: 6px;`. Refactor in passes — start with `Card.svelte`, `Button.svelte`, `Modal.svelte`, `ConfirmModal.svelte`.
+
+#### F-CONSIST-03 — Hardcoded hex colors bypass theming [HIGH]
+
+- **Files**:
+  - [`frontend/src/lib/components/Snackbar.svelte`](frontend/src/lib/components/Snackbar.svelte) lines 26–31: `#059669 / #ef4444 / #3b82f6 / #f59e0b`
+  - [`frontend/src/lib/components/ConfirmModal.svelte`](frontend/src/lib/components/ConfirmModal.svelte) line 70: `box-shadow: 0 0 16px rgba(239, 68, 68, 0.3)`
+  - [`frontend/src/routes/actions/+page.svelte`](frontend/src/routes/actions/+page.svelte) line 379: `style="background: {action.enabled ? '#059669' : 'var(--color-muted-foreground)'}"`
+  - 25 files in `frontend/src/routes/**` contain `#xxx` literals
+- **State**: These colors are NOT the Aurora palette — `#059669` is emerald-600, our mint is `#7ee8c4`. In light theme the user sees green-on-green that wasn't intended.
+- **Suggestion**: Replace all status hexes with `--color-mint/coral/sky/citrus/orchid`. Add a stylelint rule `color-no-hex` scoped to `src/**/*.svelte` to prevent regression.
+
+#### F-CONSIST-04 — Form input styling not migrated to Aurora [HIGH]
+
+- **Files**: 17 routes, ~71 occurrences. Examples: [`frontend/src/routes/users/+page.svelte`](frontend/src/routes/users/+page.svelte) lines 137, 141, 190, 207; [`frontend/src/routes/providers/+page.svelte`](frontend/src/routes/providers/+page.svelte) lines 303, 309, 323, 333; [`frontend/src/routes/notification-trackers/TrackerForm.svelte`](frontend/src/routes/notification-trackers/TrackerForm.svelte); [`frontend/src/routes/targets/TargetForm.svelte`](frontend/src/routes/targets/TargetForm.svelte).
+- **State**: `class="w-full px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]"` is repeated 71+ times. This overrides the global `input { ... }` rule that *already* uses Aurora glass styling.
+- **Suggestion**: Delete the class string in all these places. The global rule kicks in and forms instantly look correct. Cross-check that `Tailwind`'s preflight isn't interfering. Spot-check one page (e.g. `users/+page.svelte`), confirm visually, then mass-delete via Grep/Edit.
+
+#### F-CONSIST-05 — ConfirmModal duplicates Button.svelte logic [MEDIUM]
+
+- **Files**: [`frontend/src/lib/components/ConfirmModal.svelte`](frontend/src/lib/components/ConfirmModal.svelte)
+- **State**: Its `.confirm-btn-cancel` and `.confirm-btn-delete` re-implement what `Button variant="secondary"` and `Button variant="danger"` already provide. The danger button even uses raw `rgba(239,68,68,...)` instead of `--color-error-fg`.
+- **Suggestion**: `<Button variant="secondary" onclick={oncancel}>{cancel}</Button>` and `<Button variant="danger" onclick={onconfirm}>{confirm}</Button>`. Removes ~35 lines of CSS.
+
+#### F-CONSIST-06 — AuthLayout uses a different glass recipe [MEDIUM]
+
+- **Files**: [`frontend/src/lib/components/AuthLayout.svelte`](frontend/src/lib/components/AuthLayout.svelte) (line 68 `.auth-card`)
+- **State**: `border-radius: 1rem`, `padding: 2rem`, `backdrop-filter: blur(8px)` (vs the 28px elsewhere), plus its own auth-bg gradient mesh + 32px-grid background that nothing else in the app uses. Has its own `.auth-input` / `.auth-submit` / `.auth-label` / `.auth-error` design language.
+- **State pt 2**: Login/setup ends up looking *more* like generic SaaS than the dashboard does. The brand orb from the sidebar isn't on the login screen — instead a small lavender mdi-lan icon in a square.
+- **Suggestion**: Reuse the conic brand orb. Use the same glass recipe (28px blur, 22px radius) for `.auth-card`. Either drop the dot-grid `.auth-grid` (it reads as a generic "futuristic SaaS" template) or use it as a deliberate flair on the dashboard hero too.
+
+---
+
+### 3. Information hierarchy
+
+#### F-HIER-01 — Stat cards do triple duty (KPI + nav link + filter context) without ranking [MEDIUM]
+
+- **Files**: [`frontend/src/routes/+page.svelte`](frontend/src/routes/+page.svelte) lines 571–645
+- **State**: All four stat cards have the same visual weight, same accent intensity (`STAT_ACCENTS[idx]`), and rotate accents by index. When the global provider filter is active the first stat card morphs into a "literal value" card showing provider name (1rem font, very different visual). The accent rotation creates a rainbow row that doesn't carry meaning — events `total` has no semantic reason to be orchid vs. providers being lavender.
+- **Suggestion**: Tie accent color to entity type (providers=primary, trackers=mint, targets=sky, throughput=citrus) so the same accent recurs throughout the app for the same concept. Keep the morph behavior but design a distinct "filtered context" stat-card variant — a smaller, narrower chip — so it doesn't compete visually.
+
+#### F-HIER-02 — Hero title and meter compete for attention at desktop width [LOW]
+
+- **Files**: [`frontend/src/routes/+page.svelte`](frontend/src/routes/+page.svelte) lines 1047–1068, 1078–1086
+- **State**: Both the `.hero-title` and `.hero-meter-value` are 3rem 500-weight in two different fonts. Side-by-side they create two focal points.
+- **Suggestion**: Shrink `.hero-meter-value` to 2.4rem and use it as a *secondary* read; let the editorial title be the single dominant element.
+
+#### F-HIER-03 — Pulse chart panel rarely meaningful on first launch [LOW]
+
+- **Files**: [`frontend/src/routes/+page.svelte`](frontend/src/routes/+page.svelte) lines 909–927
+- **State**: On a fresh install the chart is an empty 0-events grid taking 250-400px vertical space. No empty-state copy inside `EventChart`.
+- **Suggestion**: When `chartDays` has all-zero values, replace with a small "No events recorded in the last 30 days — once a tracker fires, the pulse will appear here" inline empty state.
+
+---
+
+### 4. Navigation & wayfinding
+
+#### F-NAV-01 — No `aria-current="page"` on active nav links [HIGH a11y]
+
+- **Files**: [`frontend/src/routes/+layout.svelte`](frontend/src/routes/+layout.svelte) lines 498–533, 591–597, 632–658
+- **State**: Active state is conveyed via `.active` class + a gradient left-bar div. Screen readers cannot announce it. Grep for `aria-current` across the whole frontend: zero matches.
+- **Suggestion**: Add `aria-current={isActive(child.href) ? 'page' : undefined}` to every nav `<a>`.
+
+#### F-NAV-02 — No breadcrumb on subpages [MEDIUM]
+
+- **Files**: [`frontend/src/lib/components/PageHeader.svelte`](frontend/src/lib/components/PageHeader.svelte)
+- **State**: The `crumb` prop only renders a single mono-uppercase tag (e.g. "ROUTING · AUTOMATION") — it's decorative, not navigational. There's no actual breadcrumb chain. For `/template-configs`, `/command-template-configs`, `/tracking-configs`, `/command-configs`, etc., a user landing via deep link has no parent-link to return to.
+- **Suggestion**: Make the crumb a real breadcrumb (≤3 levels: `Notifications → Templates` or `Commands → Configs`). Render the prior level as a clickable `<a>`.
+
+#### F-NAV-03 — Deep linking via `?type=<targetType>` and `?tab=<botType>` doesn't update page title [LOW]
+
+- **State**: `/targets?type=email` and `/bots?tab=matrix` change the active sidebar item but the `<PageHeader>` title for those pages is generic ("Targets" / "Bots").
+- **Suggestion**: When `activeType` is set, derive the title from it: "Email targets" / "Matrix bots". Improves browser tab titles and the in-page title.
+
+#### F-NAV-04 — Collapsed sidebar tooltip wraps for long Russian translations [LOW]
+
+- **State**: Tooltips for collapsed sidebar nav items use the browser-native `title=` attribute, which gives no glass-style chip. They will use the OS tooltip styling, which clashes with the Aurora aesthetic and clips long ru labels.
+- **Suggestion**: Build a small custom tooltip component (or use existing portal helper) for collapsed-sidebar nav. Keep `title` as fallback for `prefers-reduced-motion` users.
+
+---
+
+### 5. Form UX
+
+#### F-FORM-01 — No inline field-level validation, only post-submit error banners [MEDIUM]
+
+- **Files**: [`frontend/src/routes/providers/+page.svelte`](frontend/src/routes/providers/+page.svelte), [`frontend/src/routes/users/+page.svelte`](frontend/src/routes/users/+page.svelte), [`frontend/src/routes/targets/TargetForm.svelte`](frontend/src/routes/targets/TargetForm.svelte)
+- **State**: Forms rely on HTML5 `required` / `minlength` browser validation plus a single `ErrorBanner` shown after submit failure. Native browser validation tooltips are pale and don't match Aurora.
+- **Suggestion**: Add a per-field `<FieldError>` slot below labels for inline validation (URL syntax, email format, port range). The settings page already has a nice pattern (`url-field-valid` class on `IdentityCassette`) — generalize it.
+
+#### F-FORM-02 — Save feedback inconsistent across pages [MEDIUM]
+
+- **Files**: Settings uses a sticky `SaveBar` with dirty tracking ([`frontend/src/routes/settings/+page.svelte`](frontend/src/routes/settings/+page.svelte) lines 77–84, 208–214). Most other forms have inline Save buttons inside the card. Some show snackbar success ("snack.userCreated"), some don't.
+- **Suggestion**: Standardize: (a) inline "Save" inside the card *plus* (b) snackbar success message *plus* (c) optional sticky SaveBar for multi-field admin forms. Document the pattern in `.claude/docs/frontend-architecture.md`.
+
+#### F-FORM-03 — Forms auto-name from descriptor but offer no way to unlock it back to auto-name [LOW]
+
+- **Files**: [`frontend/src/routes/providers/+page.svelte`](frontend/src/routes/providers/+page.svelte) lines 136–141 + 303; [`frontend/src/routes/actions/+page.svelte`](frontend/src/routes/actions/+page.svelte) lines 50–56
+- **State**: Once user types in the Name field, `nameManuallyEdited` becomes true and the auto-fill stops permanently — no way to ask "go back to default name".
+- **Suggestion**: Add a tiny "↺ reset" link next to the name input when `nameManuallyEdited && form.name !== descriptor.defaultName`.
+
+#### F-FORM-04 — No optimistic UI; rows disappear / appear only after server roundtrip [LOW]
+
+- **State**: After delete/create, pages refetch via `cache.fetch(true)`. Visible 200-400ms blank state.
+- **Suggestion**: Optimistic insert/remove in the cache stores, with snackbar undo for destructive ops.
+
+#### F-FORM-05 — Login form omits `autofocus` on username [LOW]
+
+- **Files**: [`frontend/src/routes/login/+page.svelte`](frontend/src/routes/login/+page.svelte) line 99
+- **Suggestion**: Add `autofocus` to the username input. Saves one keystroke on every login.
+
+---
+
+### 6. Modals & overlays
+
+#### F-MODAL-01 — Modal.svelte is well-built [LOW / commendation]
+
+- **Files**: [`frontend/src/lib/components/Modal.svelte`](frontend/src/lib/components/Modal.svelte)
+- **State**: Portal mount, focus trap, focus restoration, Escape, Tab cycling, `aria-modal="true"`, `aria-labelledby`, body scroll containment via `overscroll-behavior: contain`, transition (250ms in/out), 80vh max-height. This is the strongest single component in the codebase.
+- **Verdict**: Reuse as the foundation for every overlay. Currently `BlockedByModal`, `EventDetailModal`, `SharedLinkModal`, `ConfirmModal` all do — good.
+
+#### F-MODAL-02 — Modal backdrop has `role="button"` [LOW]
+
+- **Files**: [`frontend/src/lib/components/Modal.svelte`](frontend/src/lib/components/Modal.svelte) line 96
+- **State**: The backdrop is a `<div>` with `role="button"`, `tabindex="-1"`, and an onclick to close. That's a common pattern to silence Svelte's a11y warnings, but a screen reader announces "Close, button" twice (once for backdrop, once for the explicit X button).
+- **Suggestion**: Drop `role="button"` and `aria-label` from the backdrop; the explicit Close button is enough. Or use `<button class="modal-backdrop">` instead of a div.
+
+#### F-MODAL-03 — Modal panel uses solid `#131520` instead of glass [LOW]
+
+- **Files**: [`frontend/src/lib/components/Modal.svelte`](frontend/src/lib/components/Modal.svelte) lines 150–151
+- **State**: `--modal-solid-bg: #131520;` is a deliberate choice (probably for readability) but it breaks visual consistency with the rest of the app. The Aurora drift behind it is invisible.
+- **Suggestion**: Use `var(--color-glass-elev)` over the blurred backdrop. Or, if the solid choice was deliberate, document why so the next developer doesn't "fix" it.
+
+#### F-MODAL-04 — Confirm-modal "delete" hover uses raw rgba [MEDIUM]
+
+- **Files**: [`frontend/src/lib/components/ConfirmModal.svelte`](frontend/src/lib/components/ConfirmModal.svelte) line 70
+- **State**: `box-shadow: 0 0 16px rgba(239, 68, 68, 0.3);` — not themed.
+- **Suggestion**: Use `box-shadow: 0 0 16px color-mix(in srgb, var(--color-coral) 40%, transparent);`.
+
+---
+
+### 7. Empty / loading / error states
+
+#### F-STATE-01 — `Loading.svelte` is a single shimmer pattern [MEDIUM]
+
+- **Files**: [`frontend/src/lib/components/Loading.svelte`](frontend/src/lib/components/Loading.svelte)
+- **State**: Three or four 4rem shimmer bars. Used as `<Loading />` on virtually every page including hero pages. Doesn't match the actual layout the user will see — looks like a row list even on settings.
+- **Suggestion**: Add layout-aware variants: `<Loading shape="hero" />`, `<Loading shape="grid" cols={4} />`, `<Loading shape="list" rows={5} />`. Reduces layout shift on first paint.
+
+#### F-STATE-02 — `EmptyState.svelte` is plain and undifferentiated [MEDIUM]
+
+- **Files**: [`frontend/src/lib/components/EmptyState.svelte`](frontend/src/lib/components/EmptyState.svelte)
+- **State**: 10-line component: dimmed icon + message. No CTA, no illustration, no flavor. The dashboard's inline `.empty-state` (lines 1300–1319 of `+page.svelte`) is richer (has a CTA link) but isn't reused.
+- **Suggestion**: Extend `EmptyState` to accept a `cta` slot and a `tone` (with subtle gradient blob behind the icon). On `/providers` empty: "No providers yet — connect Immich, Nextcloud, or Home Assistant to start tracking events" with an "+ Add provider" CTA.
+
+#### F-STATE-03 — Many list pages have no error-recovery action [MEDIUM]
+
+- **Files**: Throughout — most pages have a `loadError` state that renders `<Card><ErrorBanner /></Card>` but no "Retry" button.
+- **Suggestion**: `ErrorBanner` should accept an `onRetry` prop and surface a retry button. Standardize across pages.
+
+#### F-STATE-04 — `EventChart` no empty state [LOW]
+
+- See F-HIER-03.
+
+---
+
+### 8. Accessibility
+
+#### F-A11Y-01 — Snackbar has no aria-live [HIGH]
+
+- **Files**: [`frontend/src/lib/components/Snackbar.svelte`](frontend/src/lib/components/Snackbar.svelte) lines 35–63
+- **State**: Snack container is a plain `<div use:portal>`. Success / error toasts never reach screen readers. Three other files have proper aria-live; this critical one doesn't.
+- **Fix**: `<div use:portal class="snackbar-container" role="region" aria-live="polite" aria-label={t('snackbar.region')}>`. Use `aria-live="assertive"` for `snack.type === 'error'`.
+
+#### F-A11Y-02 — No `aria-current="page"` on nav links [HIGH]
+
+- See F-NAV-01.
+
+#### F-A11Y-03 — Custom focus outlines partially overridden [MEDIUM]
+
+- **Files**: [`frontend/src/app.css`](frontend/src/app.css) lines 237–241 (global `button:focus-visible` outline 2px primary + offset 2px), [`frontend/src/routes/+layout.svelte`](frontend/src/routes/+layout.svelte) line 894 (`.nav-link { border-radius: 12px !important }`), [`frontend/src/routes/+page.svelte`](frontend/src/routes/+page.svelte) lines 1351–1354 (`.signal-row--clickable:focus-visible { outline-offset: -2px }`).
+- **State**: Inverted offset `-2px` makes the focus ring sit *inside* the row, which against the glass-strong hover-bg ends up nearly invisible at certain accent positions.
+- **Suggestion**: Use `outline-offset: 2px` consistently with a `box-shadow: 0 0 0 2px var(--color-glass)` ringer if needed for contrast.
+
+#### F-A11Y-04 — `prefers-reduced-motion` is honored — commendation [LOW]
+
+- **Files**: [`frontend/src/app.css`](frontend/src/app.css) lines 484–507, [`frontend/src/routes/+layout.svelte`](frontend/src/routes/+layout.svelte) lines 837–840
+- **State**: Aurora drift, brand-version pulse, stagger entrances, signal-row hover transitions, paginator transitions all gated. Smooth scroll override too. Solid implementation.
+
+#### F-A11Y-05 — Color contrast risk on glass surfaces [MEDIUM]
+
+- **State**: `--color-muted-foreground: #b6b2d4` on `--color-glass: rgba(255,255,255,0.04)` over the aurora gradient. In the brightest hot-spot of the aurora background (where the `#b8a7ff` lavender peaks), `#b6b2d4` may fail WCAG AA (4.5:1 for body text). Hasn't been measured.
+- **Suggestion**: Run a contrast pass with `--color-muted-foreground` against the brightest part of the aurora background. Likely need to bump it to ~`#cfcae8` for dark theme.
+
+#### F-A11Y-06 — Toggle switch has no label association [LOW]
+
+- **Files**: [`frontend/src/app.css`](frontend/src/app.css) lines 513–556
+- **State**: `.toggle-switch` wraps an `<input type="checkbox">` and a visual `.toggle-track` `<span>`. There's no visible label text or `aria-label` requirement in the global utility. Callers may forget to pass one.
+- **Suggestion**: Lift into a `<Toggle>` component requiring a `label` prop.
+
+---
+
+### 9. Responsive design
+
+#### F-RESP-01 — Sidebar collapse breakpoint is fine; mobile bottom nav covers gracefully [LOW / commendation]
+
+- **Files**: [`frontend/src/routes/+layout.svelte`](frontend/src/routes/+layout.svelte) lines 589–668, 1136–1168
+- **State**: Below 767px the desktop sidebar hides and mobile bottom-nav appears with primary 4 keys + search + more. Mobile "More" panel mirrors the full desktop tree. Solid.
+
+#### F-RESP-02 — Hero meter wraps awkwardly between 720–880px [LOW]
+
+- **Files**: [`frontend/src/routes/+page.svelte`](frontend/src/routes/+page.svelte) lines 1119–1130
+- **State**: Below 880px the hero collapses to one column, but the meter row pills wrap to a third row on Russian translations of "providers/targets/armed".
+- **Suggestion**: Add an intermediate breakpoint (`max-width: 1024px`) where pill labels switch from `"5 providers"` to a tooltip-only count.
+
+#### F-RESP-03 — Stat-card grid drops to 1 column at sm: [MEDIUM]
+
+- **Files**: [`frontend/src/routes/+page.svelte`](frontend/src/routes/+page.svelte) line 590 `grid-cols-1 sm:grid-cols-2 lg:grid-cols-4`
+- **State**: Between 640–1024px stat cards are 2-wide. At tablet sizes the cards become huge and dilute the dashboard density.
+- **Suggestion**: Cap stat-card max-width at ~300px or switch to `auto-fit, minmax(200px, 1fr)` so they don't grow uncontrollably.
+
+#### F-RESP-04 — List rows don't gracefully truncate webhook URLs on mobile [LOW]
+
+- **Files**: [`frontend/src/routes/providers/+page.svelte`](frontend/src/routes/providers/+page.svelte) lines 392–410
+- **State**: Secondary text line shows full webhook URL with `break-all` which on very narrow viewports gives a 4-line wrap.
+- **Suggestion**: Use the `shortenUrl()` helper (already defined for the meta-tile path) on the narrow-screen secondary line too.
+
+---
+
+### 10. Onboarding
+
+#### F-ONBOARD-01 — Setup → empty dashboard with no guidance [HIGH]
+
+- **Files**: [`frontend/src/routes/setup/+page.svelte`](frontend/src/routes/setup/+page.svelte), [`frontend/src/routes/+page.svelte`](frontend/src/routes/+page.svelte)
+- **State**: After `/setup` the user lands on `/` with 0 providers, hero says *"all clear"* (literally "Nothing to do"). Wasted first impression.
+- **Suggestion**: First-run detection (`providersCache.items.length === 0 && targetsCache.items.length === 0`) replaces the dashboard hero with a 3-4 step "Getting started" checklist: (1) Add a provider · (2) Connect a bot · (3) Create a target · (4) Wire your first tracker. Each step is a CTA card. Persist completion to localStorage so it disappears once finished.
+
+#### F-ONBOARD-02 — No in-app discovery of ⌘K palette [MEDIUM]
+
+- **Files**: [`frontend/src/routes/+layout.svelte`](frontend/src/routes/+layout.svelte) lines 678–682
+- **State**: Topbar shows `⌘K` / `Ctrl K` chip but only that. No "Press ⌘K to jump to any page" hint anywhere.
+- **Suggestion**: First-visit toast: "Tip: Press ⌘K from anywhere to search providers, trackers, and pages". Dismissible.
+
+#### F-ONBOARD-03 — Login screen has no help / forgot-password / docs link [LOW]
+
+- **Files**: [`frontend/src/routes/login/+page.svelte`](frontend/src/routes/login/+page.svelte)
+- **State**: Plain username + password. For self-hosted users who lost the admin password, there's no link to the recovery docs.
+- **Suggestion**: Small "Need help?" link to docs (the `/docs` route exists).
+
+---
+
+### 11. Microcopy
+
+#### F-COPY-01 — Dashboard hero copy is editorial — commendation [LOW]
+
+- "Live · throughput 24h · armed · providers" reads more like a control-room dashboard than CRUD admin. Keep doing this on the rest of the app.
+
+#### F-COPY-02 — Many subpages use literal entity-name copy [MEDIUM]
+
+- E.g. "Add provider" / "Add target" / "Add tracker" / "Add user". Editorial would be "Connect a provider" / "Define a target" / "Wire a tracker" / "Invite a user". Lean into verbs that match the dashboard's "wires / signals / on watch" vocabulary.
+
+#### F-COPY-03 — Russian translations match en line-count but no length QA visible [LOW]
+
+- File sizes match exactly (1577 lines each). That's just structural parity, not visual parity. Russian tends to be 20-30% longer for the same concept; flagged places likely have layout issues (hero title em, stat-card values, sidebar nav labels).
+- **Suggestion**: Set up a Playwright snapshot test that switches locale=ru and screenshots dashboard + a representative list page to catch overflow visually.
+
+---
+
+### 12. Localization parity
+
+#### F-LOCALE-01 — "Notify Bridge" wordmark stays in English [LOW / correct]
+
+- Brand. Don't translate.
+
+#### F-LOCALE-02 — Provider type label not localized in list rows [LOW]
+
+- **Files**: [`frontend/src/routes/providers/+page.svelte`](frontend/src/routes/providers/+page.svelte) line 391
+- **State**: Type pill shows raw `provider.type` value (e.g. "immich", "nextcloud") — not localized.
+- **Suggestion**: Use `getDescriptor(type).defaultName` or `t(\`providers.type${PascalName}\`)` which exists per project conventions.
+
+#### F-LOCALE-03 — Mixed Cyrillic glitches in source [LOW]
+
+- **Files**: [`frontend/src/routes/login/+page.svelte`](frontend/src/routes/login/+page.svelte) line 42 (`—` instead of em-dash in a comment), [`frontend/src/routes/users/+page.svelte`](frontend/src/routes/users/+page.svelte) line 166 (`В·` instead of `·`)
+- **State**: Encoding-corrupt characters in source comments and one user-facing dot. Pre-existing — files were probably edited with the wrong encoding at some point.
+- **Suggestion**: Grep `вЂ` / `В·` across the repo and fix. Add a pre-commit hook that fails on non-UTF8 chars in `.svelte` / `.ts` / `.json`.
+
+---
+
+### 13. Power-user features
+
+#### F-POWER-01 — No sortable columns anywhere [MEDIUM]
+
+- Confirmed by Grep: no `aria-sort` / `sortable` / `onSort` in the codebase. Lists are sorted by `IconGridSelect` widget (newest / oldest / name).
+- **Suggestion**: For long lists (trackers, targets), add column-header sort affordance. Even minimal: clicking the "Name" or "Provider" header re-sorts. Use cache state so sort persists across nav.
+
+#### F-POWER-02 — No multi-select bulk actions [MEDIUM]
+
+- Grep for `bulkAction` / `selectAll`: only the locale files contain those strings (likely as i18n keys that are never used). No checkbox UI.
+- **Suggestion**: Add a checkbox column on `targets`, `notification-trackers`, `command-trackers`, `actions` pages. Bulk-enable / bulk-delete are the obvious ones.
+
+#### F-POWER-03 — ⌘K palette is the strongest power feature, under-promoted [MEDIUM]
+
+- See F-ONBOARD-02.
+
+#### F-POWER-04 — Sidebar group expand/collapse is persisted but no "expand all / collapse all" [LOW]
+
+- **Files**: [`frontend/src/routes/+layout.svelte`](frontend/src/routes/+layout.svelte) lines 263–269
+- **Suggestion**: Add a right-click menu on a group header, or a tiny "collapse all" icon at the bottom of the nav rail.
+
+#### F-POWER-05 — No keyboard shortcuts beyond ⌘K [LOW]
+
+- **Suggestion**: `n` for new, `g + p` for "go providers", `g + t` for trackers, `?` to show shortcut sheet. Document in the palette.
+
+---
+
+## Production polish checklist (top 15, prioritized)
+
+1. **[HIGH]** Add `role="status" aria-live="polite"` to Snackbar container; `assertive` for error toasts. (F-A11Y-01) — one-line fix.
+2. **[HIGH]** Add `aria-current="page"` to every nav link in `+layout.svelte`. (F-NAV-01, F-A11Y-02)
+3. **[HIGH]** Mass-replace the legacy form-input class (`border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]`) with nothing — let the global `input { ... }` style win. 17 files, ~71 occurrences. (F-CONSIST-04)
+4. **[HIGH]** Replace hardcoded hex colors (`#059669`, `#ef4444`, `#3b82f6`, `#f59e0b`, `rgba(239,68,68,...)`) with Aurora palette tokens in `Snackbar.svelte`, `ConfirmModal.svelte`, `actions/+page.svelte`, and any remaining sites. (F-CONSIST-03)
+5. **[HIGH]** First-run onboarding: when `providersCache.items.length === 0`, replace dashboard hero with a 4-step "Getting started" checklist. (F-ONBOARD-01)
+6. **[HIGH]** Consolidate the 5 glass-card abstractions into a single `<GlassPanel variant=...>` component; delete redundant `::after` overlays. (F-CONSIST-01)
+7. **[HIGH]** Introduce a radius scale (`--radius-card / panel / pill / input / chip / tile`) and refactor `Card.svelte`, `Button.svelte`, `Modal.svelte`, `ConfirmModal.svelte` to use it. (F-CONSIST-02)
+8. **[MEDIUM]** Rewrite `ConfirmModal.svelte` to use `<Button variant="secondary">` and `<Button variant="danger">` instead of its own buttons. (F-CONSIST-05)
+9. **[MEDIUM]** Add layout-aware `<Loading shape="hero|grid|list">` variants to reduce first-paint layout shift. (F-STATE-01)
+10. **[MEDIUM]** Extend `<EmptyState>` with `cta` slot and provider-/tracker-/target-specific copy + a contextual CTA. (F-STATE-02)
+11. **[MEDIUM]** Visual length-QA pass for Russian — at least dashboard hero, providers list, settings hero, stat-cards. Playwright screenshot test. (F-COPY-03, F-LOCALE-02)
+12. **[MEDIUM]** Implement column-header sort on `notification-trackers`, `targets`, `actions`. Persist in cache state. (F-POWER-01)
+13. **[MEDIUM]** Add multi-select bulk actions (enable/disable, delete) to `targets`, `notification-trackers`, `command-trackers`. (F-POWER-02)
+14. **[MEDIUM]** Audit contrast: `--color-muted-foreground` over brightest aurora peak; likely bump dark-theme value from `#b6b2d4` to ~`#cfcae8`. (F-A11Y-05)
+15. **[MEDIUM]** Replace inline browser-native `title=` tooltips on the collapsed sidebar with a custom Aurora-styled tooltip (using the existing portal helper). (F-NAV-04)
+
+### Quick wins (bonus, under an hour each)
+
+- Add `autofocus` to the username input on `/login`. (F-FORM-05)
+- Fix `вЂ"` / `В·` Cyrillic encoding glitches in `login/+page.svelte` and `users/+page.svelte`. (F-LOCALE-03)
+- Drop `role="button"` from Modal backdrop. (F-MODAL-02)
+- Replace `provider.type` raw label in provider list rows with localized descriptor name. (F-LOCALE-02)
+- Add inline empty-state copy to `EventChart` when all `chartDays` values are 0. (F-HIER-03)
+
+---
+
+## What's working — keep doing it
+
+- The conic-gradient brand orb, animated aurora background, Newsreader italic emphasis, gradient pill chips, glow-pulse dots — distinctive identity.
+- `Modal.svelte` (focus trap, restore, portal, escape, scroll containment).
+- `prefers-reduced-motion` honored across every animation surface.
+- Global ⌘K search palette, global provider filter, persisted sidebar state, persisted nav-group expansion.
+- Editorial copy on dashboard (`signal stream`, `on watch`, `pulse`, `wires`, `compose`).
+- Snackbar with detail-toggle expansion for error context.
+- Mobile "More" panel that mirrors the full desktop nav tree.
+- 6-file template-variable sync rule honored by project conventions.
+- `i18n` parity at 1577 lines for both locales.
+
+End of review.

.claude/skills/debug-issue.md

@@ -0,0 +1,27 @@
+---
+name: Debug Issue
+description: Systematically debug issues using graph-powered code navigation
+---
+
+## Debug Issue
+
+Use the knowledge graph to systematically trace and debug issues.
+
+### Steps
+
+1. Use `semantic_search_nodes` to find code related to the issue.
+2. Use `query_graph` with `callers_of` and `callees_of` to trace call chains.
+3. Use `get_flow` to see full execution paths through suspected areas.
+4. Run `detect_changes` to check if recent changes caused the issue.
+5. Use `get_impact_radius` on suspected files to see what else is affected.
+
+### Tips
+
+- Check both callers and callees to understand the full context.
+- Look at affected flows to find the entry point that triggers the bug.
+- Recent changes are the most common source of new issues.
+
+## Token Efficiency Rules
+- ALWAYS start with `get_minimal_context(task="<your task>")` before any other graph tool.
+- Use `detail_level="minimal"` on all calls. Only escalate to "standard" when minimal is insufficient.
+- Target: complete any review/debug/refactor task in ≤5 tool calls and ≤800 total output tokens.

.claude/skills/explore-codebase.md

@@ -0,0 +1,28 @@
+---
+name: Explore Codebase
+description: Navigate and understand codebase structure using the knowledge graph
+---
+
+## Explore Codebase
+
+Use the code-review-graph MCP tools to explore and understand the codebase.
+
+### Steps
+
+1. Run `list_graph_stats` to see overall codebase metrics.
+2. Run `get_architecture_overview` for high-level community structure.
+3. Use `list_communities` to find major modules, then `get_community` for details.
+4. Use `semantic_search_nodes` to find specific functions or classes.
+5. Use `query_graph` with patterns like `callers_of`, `callees_of`, `imports_of` to trace relationships.
+6. Use `list_flows` and `get_flow` to understand execution paths.
+
+### Tips
+
+- Start broad (stats, architecture) then narrow down to specific areas.
+- Use `children_of` on a file to see all its functions and classes.
+- Use `find_large_functions` to identify complex code.
+
+## Token Efficiency Rules
+- ALWAYS start with `get_minimal_context(task="<your task>")` before any other graph tool.
+- Use `detail_level="minimal"` on all calls. Only escalate to "standard" when minimal is insufficient.
+- Target: complete any review/debug/refactor task in ≤5 tool calls and ≤800 total output tokens.

.claude/skills/refactor-safely.md

@@ -0,0 +1,28 @@
+---
+name: Refactor Safely
+description: Plan and execute safe refactoring using dependency analysis
+---
+
+## Refactor Safely
+
+Use the knowledge graph to plan and execute refactoring with confidence.
+
+### Steps
+
+1. Use `refactor_tool` with mode="suggest" for community-driven refactoring suggestions.
+2. Use `refactor_tool` with mode="dead_code" to find unreferenced code.
+3. For renames, use `refactor_tool` with mode="rename" to preview all affected locations.
+4. Use `apply_refactor_tool` with the refactor_id to apply renames.
+5. After changes, run `detect_changes` to verify the refactoring impact.
+
+### Safety Checks
+
+- Always preview before applying (rename mode gives you an edit list).
+- Check `get_impact_radius` before major refactors.
+- Use `get_affected_flows` to ensure no critical paths are broken.
+- Run `find_large_functions` to identify decomposition targets.
+
+## Token Efficiency Rules
+- ALWAYS start with `get_minimal_context(task="<your task>")` before any other graph tool.
+- Use `detail_level="minimal"` on all calls. Only escalate to "standard" when minimal is insufficient.
+- Target: complete any review/debug/refactor task in ≤5 tool calls and ≤800 total output tokens.

.claude/skills/review-changes.md

@@ -0,0 +1,29 @@
+---
+name: Review Changes
+description: Perform a structured code review using change detection and impact
+---
+
+## Review Changes
+
+Perform a thorough, risk-aware code review using the knowledge graph.
+
+### Steps
+
+1. Run `detect_changes` to get risk-scored change analysis.
+2. Run `get_affected_flows` to find impacted execution paths.
+3. For each high-risk function, run `query_graph` with pattern="tests_for" to check test coverage.
+4. Run `get_impact_radius` to understand the blast radius.
+5. For any untested changes, suggest specific test cases.
+
+### Output Format
+
+Provide findings grouped by risk level (high/medium/low) with:
+- What changed and why it matters
+- Test coverage status
+- Suggested improvements
+- Overall merge recommendation
+
+## Token Efficiency Rules
+- ALWAYS start with `get_minimal_context(task="<your task>")` before any other graph tool.
+- Use `detail_level="minimal"` on all calls. Only escalate to "standard" when minimal is insufficient.
+- Target: complete any review/debug/refactor task in ≤5 tool calls and ≤800 total output tokens.

.facts-sync.json

@@ -1,8 +1,8 @@
 {
-  "last_commit": "a31b1cba2a41229f6f6af9701477d24d15efbe9a",
-  "last_sync": "2026-04-21T00:00:00Z",
+  "last_commit": "04fe8124fcc3f783038b9aaac393b6c62c68e22a",
+  "last_sync": "2026-05-16T20:04:00Z",
   "tracked_files": {
-    "gitea-python-ci-cd.md": "sha256:61968058ec30cac954a3b7f9bde2a7db620618482d34e17568d432f680a3b333",
+    "gitea-python-ci-cd.md": "sha256:9f1f57e1b0d909143e20cb3f21ac9c4d75b45f2992ec002645540f94c4920851",
     "gitea-release-workflow.md": "sha256:5eb64789fca062b2138ca7661b942c9fc9c304f63326844ff6f6724e7e05b08c"
   }
 }

.gitea/workflows/build.yml

@@ -1,13 +1,102 @@
-name: Build Docker Image
+name: Build and Test
 
 on:
+  push:
+    branches: [master, main]
+  pull_request:
+    branches: [master, main]
   workflow_dispatch:
 
 jobs:
-  build:
+  test-frontend:
+    if: ${{ !startsWith(gitea.event.head_commit.message, 'chore: release v') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - name: Build Docker image
-        run: docker build -t notify-bridge:dev .
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install deps
+        run: |
+          cd frontend
+          npm ci
+
+      - name: Svelte check
+        run: |
+          cd frontend
+          npm run check
+
+      - name: Build
+        run: |
+          cd frontend
+          npm run build
+
+  test-backend:
+    if: ${{ !startsWith(gitea.event.head_commit.message, 'chore: release v') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # Editable installs of packages/core + packages/server are extremely slow
+      # on the hosted runner — measured 4-6x slower than building wheels first
+      # because hatchling's editable hook re-resolves on every collection. We
+      # build wheels once into an isolated venv, then install them (and only
+      # the test deps). The venv isolation also prevents broken-wheel installs
+      # from leaking dist-info across runs on the persistent Gitea runner
+      # (pip can't uninstall a wheel that landed without a RECORD file). The
+      # wheels themselves are NOT cached because their hashes depend on every
+      # file under packages/ — invalidates on basically every PR. Pip's HTTP
+      # cache for the test deps is enough.
+      - name: Build wheels in isolated venv
+        run: |
+          python -m venv /tmp/venv
+          /tmp/venv/bin/pip install --upgrade pip build
+          mkdir -p /tmp/wheels
+          /tmp/venv/bin/pip wheel --no-deps -w /tmp/wheels packages/core packages/server
+
+      - name: Install backend + test deps
+        run: |
+          # Pin aiohttp <3.14: aioresponses 0.7.8 (latest) doesn't pass the
+          # stream_writer kwarg that aiohttp 3.14 made required on ClientResponse,
+          # breaking every aioresponses-mocked test. Drop once aioresponses ships
+          # an aiohttp-3.14-compatible release.
+          /tmp/venv/bin/pip install /tmp/wheels/*.whl pytest pytest-asyncio httpx aioresponses 'aiohttp<3.14' prometheus_client
+
+      - name: Run pytest
+        env:
+          NOTIFY_BRIDGE_DATA_DIR: /tmp/nb-test-data
+          NOTIFY_BRIDGE_SECRET_KEY: ci-secret-key-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+          NOTIFY_BRIDGE_DEBUG: "false"
+          NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS: "http://localhost:8420"
+        run: |
+          cd packages/server
+          /tmp/venv/bin/pytest tests --tb=short
+
+  build-image:
+    if: ${{ !startsWith(gitea.event.head_commit.message, 'chore: release v') }}
+    needs: [test-frontend, test-backend]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build Docker image (no push)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: false
+          tags: notify-bridge:ci-${{ gitea.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitea/workflows/release.yml

@@ -10,7 +10,47 @@ env:
   IMAGE_NAME: alexei.dolgolyov/notify-bridge
 
 jobs:
+  test-backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # Wheel-first strategy in an isolated venv — editable install is too slow,
+      # and a plain pip install into the toolcache Python leaks state across
+      # runs on the persistent Gitea runner (previous broken wheel installs
+      # leave dist-info dirs that pip can't uninstall: "uninstall-no-record-file").
+      - name: Build wheels in isolated venv
+        run: |
+          python -m venv /tmp/venv
+          /tmp/venv/bin/pip install --upgrade pip build
+          mkdir -p /tmp/wheels
+          /tmp/venv/bin/pip wheel --no-deps -w /tmp/wheels packages/core packages/server
+
+      - name: Install backend + test deps
+        run: |
+          # Pin aiohttp <3.14: aioresponses 0.7.8 (latest) doesn't pass the
+          # stream_writer kwarg that aiohttp 3.14 made required on ClientResponse,
+          # breaking every aioresponses-mocked test. Drop once aioresponses ships
+          # an aiohttp-3.14-compatible release.
+          /tmp/venv/bin/pip install /tmp/wheels/*.whl pytest pytest-asyncio httpx aioresponses 'aiohttp<3.14' prometheus_client
+
+      - name: Run pytest
+        env:
+          NOTIFY_BRIDGE_DATA_DIR: /tmp/nb-test-data
+          NOTIFY_BRIDGE_SECRET_KEY: ci-secret-key-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+          NOTIFY_BRIDGE_DEBUG: "false"
+          NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS: "http://localhost:8420"
+        run: |
+          cd packages/server
+          /tmp/venv/bin/pytest tests --tb=short
+
   release:
+    needs: [test-backend]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
@@ -50,6 +90,7 @@ jobs:
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ gitea.sha }}
             ${{ steps.version.outputs.is_pre == 'false' && format('{0}/{1}:latest', env.REGISTRY, env.IMAGE_NAME) || '' }}
           cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
           cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max

.gitignore

@@ -56,3 +56,5 @@ frontend/.svelte-kit/
 
 # Logs
 *.log
+# Added by code-review-graph
+.code-review-graph/

.mcp.json

@@ -0,0 +1,12 @@
+{
+  "mcpServers": {
+    "code-review-graph": {
+      "command": "uvx",
+      "args": [
+        "code-review-graph",
+        "serve"
+      ],
+      "type": "stdio"
+    }
+  }
+}

.vex.toml

@@ -0,0 +1,65 @@
+# vex configuration — https://github.com/tenatarika/vex
+#
+# Place this file in your project root as .vex.toml
+
+# --- Active settings (maximum capability) ---
+# Semantic embeddings on, call-graph + BM25 on, and auto-refresh the index when
+# stale so queries never run against an out-of-date graph.
+semantic = true
+auto_update = true
+call_graph = true
+bm25 = true
+
+# Glob patterns to exclude from indexing (gitignore syntax, on top of .gitignore)
+# exclude = [
+#     "vendor/**",
+#     "node_modules/**",
+#     "*.generated.go",
+#     "dist/**",
+# ]
+
+# Default output format: "text", "json", or "compact"
+# format = "text"
+
+# Enable semantic embeddings by default (slower indexing, enables meaning-based search)
+# semantic = false
+
+# Automatically run `vex update` before search if the index is stale
+# auto_update = false
+
+# Embedder used for semantic indexing. Known IDs: minilm-l6-v2 (default).
+# Changing the embedder requires a full reindex.
+# embedder = "minilm-l6-v2"
+
+# Cache directory override. Defaults to the platform cache location.
+#   macOS:   ~/Library/Caches/vex
+#   Linux:   $XDG_CACHE_HOME/vex   (fallback: ~/.cache/vex)
+#   Windows: %LOCALAPPDATA%\vex    (fallback: %USERPROFILE%\AppData\Local\vex)
+# Accepts absolute paths, "~/..." or paths relative to this file (e.g. "./.vex/cache").
+# Can also be overridden per-invocation with --cache-dir or $VEX_CACHE_DIR.
+# cache_dir = "./.vex/cache"
+
+# Store the index inside the project as `<project>/.vex_cache/`. Useful when
+# the cache should travel with the project (e.g. on a moved or renamed
+# directory). vex writes a `.gitignore` inside it so contents are not
+# committed. Overridden by `cache_dir`, `--cache-dir`, or $VEX_CACHE_DIR.
+# local_cache = false
+
+# Thread count for parallel indexing (index/update/watch).
+#   * unset  — 80% of available cores, rounded up (default, leaves headroom)
+#   * 0      — use all cores (explicit opt-in to max throughput)
+#   * N      — exactly N workers
+# Overridable per-invocation with `-j/--jobs` or $VEX_JOBS.
+# jobs = 4
+
+# Build the persistent call-graph section. Disabling falls back to live-scan
+# for `vex callers`/`vex callees` (slower per-query, but saves indexing
+# time on large monorepos). The opt-out is persisted in the manifest so
+# `vex update` does not silently re-add the section.
+# Per-invocation override: `vex index --no-call-graph`.
+# call_graph = true
+
+# Build the BM25 channel. Disabling drops the third RRF channel and keeps
+# only structural (+ semantic). Same persistence rules as `call_graph`.
+# Per-invocation override: `vex index --no-bm25`.
+# bm25 = true

CLAUDE.md

@@ -43,3 +43,42 @@ Detailed context is split into focused documents under `.claude/docs/`. Read the
     - Notification preview sample: `packages/server/src/notify_bridge_server/services/sample_context.py` (`_SAMPLE_CONTEXT`)
     - Command preview sample: `packages/server/src/notify_bridge_server/api/command_template_configs.py` (`sample_ctx` in `preview_raw`)
     - Runtime validator whitelist: `packages/core/src/notify_bridge_core/templates/validator.py`
+
+<!-- code-review-graph MCP tools -->
+## MCP Tools: code-review-graph
+
+**IMPORTANT: This project has a knowledge graph. ALWAYS use the
+code-review-graph MCP tools BEFORE using Grep/Glob/Read to explore
+the codebase.** The graph is faster, cheaper (fewer tokens), and gives
+you structural context (callers, dependents, test coverage) that file
+scanning cannot.
+
+### When to use graph tools FIRST
+
+- **Exploring code**: `semantic_search_nodes` or `query_graph` instead of Grep
+- **Understanding impact**: `get_impact_radius` instead of manually tracing imports
+- **Code review**: `detect_changes` + `get_review_context` instead of reading entire files
+- **Finding relationships**: `query_graph` with callers_of/callees_of/imports_of/tests_for
+- **Architecture questions**: `get_architecture_overview` + `list_communities`
+
+Fall back to Grep/Glob/Read **only** when the graph doesn't cover what you need.
+
+### Key Tools
+
+| Tool | Use when |
+|------|----------|
+| `detect_changes` | Reviewing code changes — gives risk-scored analysis |
+| `get_review_context` | Need source snippets for review — token-efficient |
+| `get_impact_radius` | Understanding blast radius of a change |
+| `get_affected_flows` | Finding which execution paths are impacted |
+| `query_graph` | Tracing callers, callees, imports, tests, dependencies |
+| `semantic_search_nodes` | Finding functions/classes by name or keyword |
+| `get_architecture_overview` | Understanding high-level codebase structure |
+| `refactor_tool` | Planning renames, finding dead code |
+
+### Workflow
+
+1. The graph auto-updates on file changes (via hooks).
+2. Use `detect_changes` for code review.
+3. Use `get_affected_flows` to understand impact.
+4. Use `query_graph` pattern="tests_for" to check coverage.

Dockerfile

@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1.7
 # =============================================================================
 # Stage 1: Build frontend (SvelteKit static output)
 # =============================================================================
@@ -14,7 +15,7 @@ COPY frontend/ ./
 RUN npm run build
 
 # =============================================================================
-# Stage 2: Build Python wheels
+# Stage 2: Build Python wheels + extract external dependency list
 # =============================================================================
 FROM python:3.12-slim AS python-build
 
@@ -30,16 +31,59 @@ RUN python -m build packages/core/ --wheel --outdir /wheels
 COPY packages/server/ packages/server/
 RUN python -m build packages/server/ --wheel --outdir /wheels
 
+# Emit /wheels/deps.txt with ONLY external (PyPI) deps — filter out
+# notify-bridge-* siblings, which are installed from local wheels below.
+# This file is the cache key for the external-deps install layer: as long as
+# pyproject.toml dependency lines don't change, the runtime install layer is
+# served from registry buildcache and no wheels are re-downloaded.
+RUN python <<'PY'
+import tomllib
+
+deps: list[str] = []
+for p in ("packages/core/pyproject.toml", "packages/server/pyproject.toml"):
+    with open(p, "rb") as f:
+        data = tomllib.load(f)
+    for d in data["project"].get("dependencies", []):
+        if not d.lstrip().lower().startswith("notify-bridge-"):
+            deps.append(d)
+
+seen: set[str] = set()
+with open("/wheels/deps.txt", "w") as f:
+    for d in deps:
+        if d not in seen:
+            seen.add(d)
+            f.write(d + "\n")
+PY
+
 # =============================================================================
 # Stage 3: Runtime
 # =============================================================================
 FROM python:3.12-slim
 
+# uv — fast pip replacement. Installed from PyPI (Fastly CDN) rather than
+# ghcr.io/astral-sh/uv, because GHCR pulls from this runner crawl at a few
+# hundred KB/s and take longer than the install savings would recoup.
+RUN pip install --no-cache-dir uv==0.11.7
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy
+
 WORKDIR /app
 
-# Install wheels
-COPY --from=python-build /wheels/ /tmp/wheels/
-RUN pip install --no-cache-dir /tmp/wheels/*.whl && rm -rf /tmp/wheels
+# Install external deps first — layer cache key is deps.txt content, which
+# only changes when pyproject.toml dependency lines change (not on version
+# bumps). The cache mount persists downloaded wheels across local rebuilds;
+# in CI, the registry buildcache serves the whole layer when unchanged.
+COPY --from=python-build /wheels/deps.txt /tmp/deps.txt
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv pip install --system -r /tmp/deps.txt \
+    && rm /tmp/deps.txt
+
+# Install local wheels without re-resolving — all external deps are present.
+COPY --from=python-build /wheels/*.whl /tmp/wheels/
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv pip install --system --no-deps /tmp/wheels/*.whl \
+    && rm -rf /tmp/wheels
 
 # Copy frontend build
 COPY --from=frontend-build /build/build/ /app/static/

OPERATIONS.md

@@ -0,0 +1,394 @@
+# Operations Guide
+
+This document covers running, monitoring, and recovering Notify Bridge in
+production. The intended audience is the operator on call when the
+notifications stop firing or when a release upgrade goes sideways.
+
+For developer-focused docs (architecture, conventions, project layout) see
+`CLAUDE.md` and the `.claude/docs/` directory.
+
+## Deployment overview
+
+Notify Bridge ships as a single Docker image. All state lives in a single
+data directory mounted at `/data`.
+
+### Required environment variables
+
+| Variable | Default | Notes |
+| --- | --- | --- |
+| `NOTIFY_BRIDGE_SECRET_KEY` | _(none)_ | **Required.** 32+ random bytes. The server refuses to boot with the default placeholder or any of the known dev literals. |
+| `NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS` | `http://localhost:5175` | Comma-separated list. `*` is rejected because credentials are enabled. |
+| `NOTIFY_BRIDGE_FORWARDED_ALLOW_IPS` | `127.0.0.1` | Trusted proxy IPs whose `X-Forwarded-For` / `X-Forwarded-Proto` headers are honored. Set to your reverse-proxy IP. |
+
+### Useful environment variables
+
+| Variable | Default | Notes |
+| --- | --- | --- |
+| `NOTIFY_BRIDGE_DATA_DIR` | `/data` | Where the SQLite DB, snapshots, and backups live. |
+| `NOTIFY_BRIDGE_DATABASE_URL` | _(derived from data_dir)_ | Override only if you want a non-default DB path. |
+| `NOTIFY_BRIDGE_DEBUG` | `false` | Verbose logging + SQL echo. Do not enable in production. |
+| `NOTIFY_BRIDGE_LOG_FORMAT` | `text` | Set to `json` for one JSON object per line — pipe to a log aggregator. |
+| `NOTIFY_BRIDGE_LOG_LEVEL` | `INFO` | Root logger level. |
+| `NOTIFY_BRIDGE_LOG_LEVELS` | _(empty)_ | Per-module overrides, e.g. `sqlalchemy.engine=WARNING,notify_bridge_core.notifications.telegram.client=DEBUG`. |
+| `NOTIFY_BRIDGE_EVENT_LOG_RETENTION_DAYS` | `30` | Days of `event_log` history kept by the daily cleanup job. `0` disables retention. |
+| `NOTIFY_BRIDGE_PRE_MIGRATE_SNAPSHOT_KEEP` | `5` | Number of pre-migration DB snapshots retained. `0` disables snapshotting. |
+| `NOTIFY_BRIDGE_METRICS_ENABLED` | `true` | Expose `/api/metrics` for Prometheus. Set to `false` if the API port crosses a trust boundary. |
+| `NOTIFY_BRIDGE_GRACEFUL_SHUTDOWN_SECONDS` | `60` | SIGTERM grace period before in-flight requests are killed. |
+| `NOTIFY_BRIDGE_SUPERVISED` | _(auto)_ | Force the supervised flag for `apply-restart`. Use `true` when running under systemd/PM2 outside Docker. |
+
+### Data directory layout
+
+```
+/data/
+  notify_bridge.db          # main SQLite DB (WAL mode)
+  notify_bridge.db-wal      # SQLite write-ahead log
+  notify_bridge.db-shm      # SQLite shared memory file
+  backups/
+    pre-migrate-*.db        # automatic pre-upgrade snapshots
+    backup-*.json           # scheduled / manual config backups
+  snapshots/                # legacy alias retained for older deployments
+  pending_restore.json      # staged restore (consumed at next boot)
+  applied_restores/         # archive of applied restore payloads
+```
+
+Always mount `/data` on a persistent volume. The WAL files MUST live on the
+same filesystem as the main DB — never split them across mounts.
+
+### Docker example
+
+See `docker-compose.yml` at the repo root for the canonical reference. The
+container runs read-only with `tmpfs` for `/tmp`, drops all capabilities,
+and limits memory/CPU. The healthcheck targets `/api/ready` (deep) — see
+the next section.
+
+## Healthchecks
+
+Two endpoints, used for different probe types.
+
+### `GET /api/health` — liveness, shallow
+
+Returns `200 OK` once the ASGI app has started. Does not touch the DB or
+the scheduler. Use this for liveness probes that should only restart the
+process if it stops responding entirely.
+
+```json
+{"status": "ok", "version": "0.8.0"}
+```
+
+### `GET /api/ready` — readiness, deep
+
+Verifies that each critical dependency is reachable:
+
+* **db** — `SELECT 1` against the SQLAlchemy engine, 2-second timeout.
+* **scheduler** — APScheduler `running` flag.
+* **ha** — Home Assistant subscription supervisor task. Reported as
+  `na` when no HA providers are configured, `ok` when at least one
+  supervisor is alive, `degraded` otherwise. **Informational only** —
+  HA degradation does not flip readiness off.
+
+Returns `503` when any required check (db, scheduler) fails.
+
+```json
+{
+  "ready": true,
+  "checks": {"db": "ok", "scheduler": "ok", "ha": "na"},
+  "errors": [],
+  "version": "0.8.0"
+}
+```
+
+### Kubernetes probe example
+
+```yaml
+livenessProbe:
+  httpGet:
+    path: /api/health
+    port: 8420
+  initialDelaySeconds: 10
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+readinessProbe:
+  httpGet:
+    path: /api/ready
+    port: 8420
+  initialDelaySeconds: 15
+  periodSeconds: 15
+  timeoutSeconds: 5
+  failureThreshold: 2
+```
+
+The Docker compose file uses `/api/ready` as its healthcheck so the
+container is only reported healthy after migrations finish.
+
+## Metrics
+
+Notify Bridge exposes Prometheus metrics at `GET /api/metrics` in the
+standard text exposition format. **No authentication** — Prometheus
+scrapers do not authenticate. Disable via `NOTIFY_BRIDGE_METRICS_ENABLED=false`
+when the API port is reachable beyond the trust boundary.
+
+### Prometheus scrape example
+
+```yaml
+scrape_configs:
+  - job_name: notify-bridge
+    metrics_path: /api/metrics
+    static_configs:
+      - targets: ['notify-bridge.internal:8420']
+    scrape_interval: 30s
+```
+
+### Available metrics
+
+| Metric | Type | Labels | Meaning |
+| --- | --- | --- | --- |
+| `notify_bridge_deferred_pending` | Gauge | _(none)_ | Pending rows in `deferred_dispatch`. Refreshed on each scrape. A persistent non-zero value usually means a tracker target is in extended quiet hours. |
+| `notify_bridge_event_log_total` | Counter | `status`, `event_type` | Events written to `event_log`. `status` is the dispatch outcome (`dispatched`, `dropped`, `deferred`, etc.). |
+| `notify_bridge_dispatch_duration_seconds` | Histogram | `channel` | Wall-clock duration of one outbound dispatch (Telegram, Discord, email, …). Useful for latency alerts. |
+| `notify_bridge_provider_poll_failures_total` | Counter | `provider_type` | Polling provider tick failures (Immich poll error, Gitea API down, …). Compare against expected scan interval to compute failure rate. |
+| `notify_bridge_target_send_failures_total` | Counter | `target_type`, `status_code` | Failed sends to a notification channel. `status_code` is the HTTP status (or `0` when no HTTP response was received). |
+
+The metrics module never imports `prometheus_client` outside `api/metrics.py`.
+Other modules record events through the `metrics` singleton — see that
+module's docstring before adding new collectors.
+
+## Backups
+
+Notify Bridge produces three different kinds of backup files. Know which
+one you are looking at before restoring.
+
+| Kind | Location | Format | Trigger |
+| --- | --- | --- | --- |
+| Config backup | `data/backups/backup-*.json` | JSON (BackupFile schema) | Manual via `/api/backup/files` POST or scheduled job |
+| Pre-migration snapshot | `data/backups/pre-migrate-*.db` | SQLite DB file | Automatic on every boot before migrations |
+| Pending restore | `data/pending_restore.json` | JSON | Staged via `/api/backup/prepare-restore`, consumed at next restart |
+
+Config backups capture user configuration (providers, trackers, targets,
+templates, …). They do **not** include `event_log`, `deferred_dispatch`,
+or any other operational table. Pre-migration snapshots are full DB
+copies and contain everything.
+
+### Manual backup
+
+The admin UI has a one-click button under Settings → Backup. Equivalent
+HTTP call:
+
+```bash
+curl -fsS -X POST \
+  -H "Authorization: Bearer $ADMIN_JWT" \
+  "https://notify-bridge.example.com/api/backup/files?secrets_mode=exclude"
+```
+
+The download endpoint produces a downloadable JSON envelope with no
+secrets unless `secrets_mode=include` is passed:
+
+```bash
+curl -fsS -X GET \
+  -H "Authorization: Bearer $ADMIN_JWT" \
+  -OJ "https://notify-bridge.example.com/api/backup/export?secrets_mode=exclude"
+```
+
+### Scheduled backup
+
+Configure under Settings → Backup or via `PUT /api/backup/scheduled` with:
+
+```json
+{
+  "backup_scheduled_enabled": "true",
+  "backup_scheduled_interval_hours": "24",
+  "backup_secrets_mode": "exclude",
+  "backup_retention_count": "5"
+}
+```
+
+Saved files land in `data/backups/`; retention prunes the oldest files
+beyond `backup_retention_count`. Backups can be downloaded individually:
+
+```bash
+curl -fsS -X GET \
+  -H "Authorization: Bearer $ADMIN_JWT" \
+  "https://notify-bridge.example.com/api/backup/files/backup-2026-05-16T12-00-00.json" \
+  -o backup-latest.json
+```
+
+### Cron snippet for off-host backup
+
+```bash
+# /etc/cron.d/notify-bridge-backup
+0 3 * * * www-data \
+  curl -fsS -X POST \
+    -H "Authorization: Bearer $(cat /etc/notify-bridge/admin.token)" \
+    "https://notify-bridge.example.com/api/backup/files?secrets_mode=exclude" \
+    -o /var/backups/notify-bridge/backup-$(date +\%F).json
+```
+
+### Restore procedure
+
+Restoring REPLACES configuration. Always export the current state first.
+
+```bash
+# 1. Stage the backup file (validates and writes to data/pending_restore.json)
+curl -fsS -X POST \
+  -H "Authorization: Bearer $ADMIN_JWT" \
+  -F "file=@backup-2026-05-16T12-00-00.json" \
+  "https://notify-bridge.example.com/api/backup/prepare-restore?conflict_mode=overwrite"
+
+# 2. Trigger graceful restart so startup applies the staged restore.
+#    Same-origin Origin/Referer is enforced — call from the admin UI when
+#    possible, or from the same host. Requires the supervisor to respawn
+#    the process (Docker restart policy, systemd, PM2, etc.).
+curl -fsS -X POST \
+  -H "Origin: https://notify-bridge.example.com" \
+  -H "Referer: https://notify-bridge.example.com/settings/backup" \
+  -H "Authorization: Bearer $ADMIN_JWT" \
+  "https://notify-bridge.example.com/api/backup/apply-restart"
+```
+
+If the process is **not** supervised, `/api/backup/apply-restart` returns
+`409`. Restart the backend manually after staging — startup applies the
+pending restore on the next boot.
+
+To cancel a staged restore before applying:
+
+```bash
+curl -fsS -X DELETE \
+  -H "Authorization: Bearer $ADMIN_JWT" \
+  "https://notify-bridge.example.com/api/backup/pending-restore"
+```
+
+### Recovery from a corrupted DB
+
+If migrations crash on boot or the DB file is unreadable, roll back to a
+pre-migration snapshot:
+
+```bash
+# Stop the backend, then
+cd /var/lib/docker/volumes/notify-bridge-data/_data
+ls -1t backups/pre-migrate-*.db | head -5      # pick the snapshot
+
+cp notify_bridge.db notify_bridge.db.broken    # keep the broken DB for forensics
+cp backups/pre-migrate-2026-05-16T11-58-30.db notify_bridge.db
+rm -f notify_bridge.db-wal notify_bridge.db-shm   # WAL belongs to the broken file
+```
+
+Restart the container. The startup snapshot will run again and capture
+the rolled-back state, so you have a clean recovery point if the next
+boot needs another rollback.
+
+## Logs
+
+* Output goes to **stderr only**. The Docker log driver captures it.
+* Set `NOTIFY_BRIDGE_LOG_FORMAT=json` for line-delimited JSON suitable
+  for Loki, ELK, or CloudWatch.
+* Secret values (bot tokens, API keys, passwords) are masked at the log
+  formatter level — see `notify_bridge_server.logging_setup`.
+* No file rotation is built in. Use the Docker JSON log driver's
+  `max-size`/`max-file` options or send logs to your aggregator.
+
+```yaml
+# docker-compose.yml snippet
+logging:
+  driver: json-file
+  options:
+    max-size: "10m"
+    max-file: "5"
+```
+
+## Common operational scenarios
+
+### "Notifications stopped firing"
+
+1. Hit `/api/ready`. If `scheduler` is `fail`, restart the backend; the
+   scheduler died in a way it cannot recover from.
+2. Check `notify_bridge_deferred_pending`. A non-zero value during quiet
+   hours is normal; a value that grows monotonically across days is a
+   bug — inspect the `deferred_dispatch` table.
+3. Inspect the most recent `event_log` rows in the admin Events page or:
+
+   ```sql
+   SELECT created_at, event_type, dispatch_status, details
+   FROM event_log
+   ORDER BY created_at DESC LIMIT 50;
+   ```
+
+   Look for a `dispatch_status` other than `dispatched`.
+4. If a single tracker is silent, verify the provider's last poll status
+   in the admin UI (Providers page) — `notify_bridge_provider_poll_failures_total`
+   tells you which provider type is failing.
+5. If you've configured a `bridge_self` tracker but never received a
+   self-monitoring alert when something failed, see the next section —
+   `bridge_self` failures are deliberately log-only to prevent recursion.
+
+### Bridge self-monitoring is log-only on its own failures
+
+The built-in `bridge_self` provider emits notifications when polls,
+dispatches, or target sends fail. To prevent infinite-recursion (a
+`bridge_self` notification failing → triggering another `bridge_self`
+notification → ...), failures of `bridge_self` events themselves are
+**not** counted toward target-failure thresholds and are logged only.
+
+If your `bridge_self` notifications stop arriving, it means the
+notification target you wired them to is itself failing. Grep stderr for:
+
+```text
+bridge_self target-failure emission failed
+emit_bridge_self_event failed
+```
+
+The fix is always at the target layer (Telegram bot blocked, Matrix
+homeserver down, SMTP credentials rotated). The bridge cannot tell you
+about its own outbound failure — that's what the operator's external
+monitoring (Prometheus alert on `notify_bridge_target_send_failures_total`)
+is for.
+
+### "Webhook returns 500"
+
+Inspect the `webhook_payload_log` table for the matching request:
+
+```sql
+SELECT received_at, status_code, error_message, payload_excerpt
+FROM webhook_payload_log
+ORDER BY received_at DESC LIMIT 20;
+```
+
+Common causes: payload schema change in the source service, a tracker
+referencing a deleted provider, a Jinja template that errors out (look
+for `template render failed` in logs).
+
+### "Telegram bot rate-limited (429)"
+
+The Telegram client implements exponential backoff with jitter on
+`Retry-After`. No operator action is required for transient throttling.
+If the rate-limit persists, check:
+
+* The bot is being driven by multiple Notify Bridge instances pointing
+  at the same chat (split-brain — only one instance should own a bot).
+* A template is producing very large messages (Telegram limits message
+  size to 4096 chars). Look for `MessageTooLong` in the logs.
+
+### "DB lock contention"
+
+SQLite WAL mode and `busy_timeout=10000` make this rare. If you see
+`SQLITE_BUSY` in logs:
+
+* Check for long-running transactions (most often a stuck migration).
+* Confirm the WAL files are on the same filesystem as the main DB —
+  splitting them across mounts is a known cause.
+* Run `sqlite3 notify_bridge.db "PRAGMA wal_checkpoint(TRUNCATE);"` to
+  flush the WAL. Safe to run while the backend is up.
+
+## Upgrades
+
+1. Pre-migration snapshot is taken automatically before any migration
+   runs. The latest five snapshots are retained by default.
+2. Migrations are idempotent — re-running an upgrade is safe.
+3. If a migration fails, the snapshot from step 1 is the recovery point.
+   See "Recovery from a corrupted DB" above.
+4. Always test major version upgrades in staging first. The upgrade flow
+   is the same in staging: pull the new image, restart the container.
+
+The release tag stream lives at the project Gitea / GitHub releases page.
+Release notes are written to `RELEASE_NOTES.md` for the upcoming version
+and copied into the Gitea release body by the `release.yml` workflow.

README.md

@@ -2,20 +2,21 @@
 
 A generic bridge between service providers and notification targets.
 
-Notify Bridge monitors services (like Immich photo servers) for changes and dispatches
-notifications to configurable targets (Telegram, webhooks) using customizable templates.
+Notify Bridge monitors services (Immich, Gitea, Planka, NUT, Google Photos, generic webhooks,
+and internal scheduler) for changes and dispatches notifications to configurable targets
+(Telegram, Discord, Slack, Matrix, ntfy, email, generic webhooks) using customizable templates.
 
 ## Architecture
 
-- **Service Providers** — Connectors to external services (Immich, more coming)
+- **Service Providers** — Connectors to external services (Immich, Gitea, Planka, NUT, Google Photos, generic Webhook, internal Scheduler)
 - **Trackers** — Monitor specific collections within a provider for changes
 - **Tracking Configs** — Define what events to watch for and scheduling rules
-- **Notification Targets** — Where to send notifications (Telegram chats, webhook URLs)
+- **Notification Targets** — Where to send notifications (Telegram, Discord, Slack, Matrix, ntfy, email, webhook URLs)
 - **Template Configs** — Jinja2 templates that format notifications per provider type
 
 ## Project Structure
 
-```
+```text
 packages/
   core/       — Shared library: providers, models, notifications, templates
   server/     — FastAPI REST server with SQLite database
@@ -31,6 +32,7 @@ docker run -d \
   -p 8420:8420 \
   -v notify-bridge-data:/data \
   -e NOTIFY_BRIDGE_SECRET_KEY=$(openssl rand -hex 32) \
+  -e NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS=http://localhost:8420 \
   git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge:latest
 ```
 
@@ -38,12 +40,59 @@ Then open `http://localhost:8420` in your browser.
 
 ### Environment Variables
 
+Core settings (all prefixed with `NOTIFY_BRIDGE_`):
+
 | Variable | Required | Default | Description |
 | -------- | -------- | ------- | ----------- |
-| `NOTIFY_BRIDGE_SECRET_KEY` | Yes | — | Secret key for JWT tokens (min 32 chars) |
-| `NOTIFY_BRIDGE_PORT` | No | `8420` | Server listen port |
-| `NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS` | No | `*` | Comma-separated allowed CORS origins |
-| `NOTIFY_BRIDGE_DEBUG` | No | `false` | Enable debug logging |
+| `SECRET_KEY` | Yes | — | Secret for JWT signing (min 32 chars). Default placeholders and known dev-only strings are rejected on startup. |
+| `CORS_ALLOWED_ORIGINS` | Recommended | `http://localhost:5175` | Comma-separated browser origins. Wildcard `*` is **rejected** because credentials are enabled. Set this to the URL you load the UI from. |
+| `DATA_DIR` | No | `/data` (in Docker) | Directory for SQLite DB, backups, and caches. Mount a volume here. |
+| `DATABASE_URL` | No | `sqlite+aiosqlite:///<DATA_DIR>/notify_bridge.db` | Override DB connection string. |
+| `HOST` | No | `0.0.0.0` | Bind address. |
+| `PORT` | No | `8420` | Server listen port. |
+| `DEBUG` | No | `false` | Enable debug logging. |
+
+Reverse proxy / network:
+
+| Variable | Default | Description |
+| -------- | ------- | ----------- |
+| `FORWARDED_ALLOW_IPS` | `127.0.0.1` | Trusted proxy IPs whose `X-Forwarded-For` / `X-Forwarded-Proto` headers are honored. Set to your reverse proxy IP (e.g. `172.17.0.1` for the default Docker bridge). Use `*` only when the container is not directly internet-reachable. |
+| `EXTERNAL_URL` | — | Public base URL (e.g. `https://notify.example.com`). Used to build webhook URLs shown in the UI. Also settable from the Settings page. |
+| `ALLOW_PRIVATE_URLS` | unset | Set to `1` to allow requests to RFC1918 / loopback / link-local hosts (homelab scenario: Immich/Gitea on the same LAN). **Do not enable on a publicly exposed instance.** |
+
+Auth & tokens:
+
+| Variable | Default | Description |
+| -------- | ------- | ----------- |
+| `ACCESS_TOKEN_EXPIRE_MINUTES` | `15` | Lifetime of access JWTs. |
+| `REFRESH_TOKEN_EXPIRE_DAYS` | `30` | Lifetime of refresh tokens. |
+| `JWT_ISSUER` | `notify-bridge` | `iss` claim. |
+| `JWT_AUDIENCE` | `notify-bridge-api` | `aud` claim. |
+
+Logging (all are also live-editable in the Settings page, except `log_format`):
+
+| Variable | Default | Description |
+| -------- | ------- | ----------- |
+| `LOG_LEVEL` | `INFO` | Root level: `DEBUG` / `INFO` / `WARNING` / `ERROR`. |
+| `LOG_FORMAT` | `text` | `text` or `json`. Switching requires a restart. |
+| `LOG_LEVELS` | — | Per-module overrides, e.g. `notify_bridge_core.notifications.telegram.client=DEBUG,sqlalchemy.engine=INFO`. |
+
+Retention & maintenance:
+
+| Variable | Default | Description |
+| -------- | ------- | ----------- |
+| `EVENT_LOG_RETENTION_DAYS` | `30` | Days of `event_log` history to keep. `0` disables the retention job. |
+| `PRE_MIGRATE_SNAPSHOT_KEEP` | `5` | Number of pre-migration DB snapshots to keep in `<DATA_DIR>/backups/`. `0` disables snapshotting. |
+| `GRACEFUL_SHUTDOWN_SECONDS` | `60` | Time to wait for in-flight requests / scheduler jobs on SIGTERM before force-killing. |
+
+Integrations & misc:
+
+| Variable | Default | Description |
+| -------- | ------- | ----------- |
+| `TELEGRAM_WEBHOOK_SECRET` | — | Shared secret for Telegram bot webhooks. Also settable from the Settings page. |
+| `TIMEZONE` | `UTC` | IANA timezone (e.g. `Europe/Warsaw`) used by the scheduler. Also settable from the Settings page. |
+| `STATIC_DIR` | `/app/static` (in Docker) | Frontend static files directory. The Docker image sets this; don't override unless you're running outside the image. |
+| `SUPERVISED` | auto-detect | Set to `1` to tell the backup endpoint that an external supervisor will restart the process. |
 
 ### Docker Compose
 
@@ -58,12 +107,50 @@ services:
     volumes:
       - notify-bridge-data:/data
     environment:
-      - NOTIFY_BRIDGE_SECRET_KEY=your-secret-key-min-32-characters
+      # REQUIRED — any 32+ byte random string. `openssl rand -hex 32` is one way.
+      - NOTIFY_BRIDGE_SECRET_KEY=${NOTIFY_BRIDGE_SECRET_KEY:?Set NOTIFY_BRIDGE_SECRET_KEY (min 32 chars)}
+      # Comma-separated list of allowed browser origins. Wildcard `*` is
+      # rejected on startup because credentials are enabled.
+      - NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS=${NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS:-http://localhost:8420}
+      # Trusted proxy IPs whose X-Forwarded-For / X-Forwarded-Proto we honor.
+      # Set this to your reverse proxy's IP (e.g. 172.17.0.1 for the default
+      # docker bridge, or `*` only if the container is NOT reachable from the
+      # public internet).
+      - NOTIFY_BRIDGE_FORWARDED_ALLOW_IPS=${NOTIFY_BRIDGE_FORWARDED_ALLOW_IPS:-127.0.0.1}
+      # Opt-in SSRF bypass for private/loopback/link-local hosts (homelab
+      # scenario — tracking an Immich/Gitea instance on the same LAN). DO NOT
+      # enable on a publicly exposed instance.
+      # - NOTIFY_BRIDGE_ALLOW_PRIVATE_URLS=1
+    healthcheck:
+      # Use /api/ready (not /api/health) so the container is only reported
+      # healthy after migrations and the scheduler finish booting.
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8420/api/ready', timeout=3)"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    read_only: true
+    tmpfs:
+      - /tmp
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    mem_limit: 512m
+    cpus: 1.0
+    pids_limit: 256
 
 volumes:
   notify-bridge-data:
 ```
 
+A ready-to-use `docker-compose.yml` lives at the repo root.
+
+### Health & Readiness
+
+- `GET /api/health` — process is up. Use for liveness probes.
+- `GET /api/ready` — migrations + scheduler have booted. Use for readiness probes and Docker `HEALTHCHECK` (as the compose example above does).
+
 ## Quick Start (Development)
 
 ```bash
@@ -81,4 +168,48 @@ npm run dev
 
 ## Supported Providers
 
-- **Immich** — Photo/video server with album change detection
+- **Immich** — Photo/video server with album change detection (polling)
+- **Gitea** — Git server with push / issue / PR / release events (webhook)
+- **Planka** — Kanban board with card / list / board events (webhook)
+- **NUT** — Network UPS Tools for battery / power events (polling)
+- **Google Photos** — Album change detection (polling)
+- **Generic Webhook** — Catch arbitrary JSON payloads and route them via templates (webhook)
+- **Scheduler** — Internal provider for time-based scheduled messages
+
+## Supported Notification Targets
+
+- **Telegram** — Bot API with rich formatting, media groups, and inline commands
+- **Discord** — Webhook-based delivery with embeds
+- **Slack** — Incoming webhooks with Block Kit formatting
+- **Matrix** — Homeserver delivery with HTML formatting
+- **ntfy** — Self-hostable push notifications
+- **Email** — SMTP with HTML / plain-text templates
+- **Generic Webhook** — POST custom JSON payloads to any URL
+
+## Bot Commands
+
+Telegram bots can serve interactive commands per provider. All commands use
+Jinja2 templates that you can customize from the **Command Templates** page.
+
+| Provider | Commands |
+| -------- | -------- |
+| Immich | `/status` `/albums` `/events` `/summary` `/latest` `/memory` `/random` `/search` `/find` `/person` `/place` `/favorites` `/people` `/help` |
+| Gitea | `/status` `/repos` `/issues` `/prs` `/commits` `/help` |
+| Planka | `/status` `/boards` `/cards` `/lists` `/help` |
+| NUT | `/status` `/devices` `/battery` `/help` |
+| Google Photos | `/status` `/albums` `/latest` `/search` `/random` `/help` |
+| Generic Webhook | `/status` `/help` |
+
+Every provider also responds to `/start`, and rate-limit / empty-result
+fallback messages are templated as well.
+
+## Smart Actions
+
+Beyond notifications, providers can run **actions** against the source service.
+Currently implemented:
+
+- **Immich — Auto-Organize** — Automatically sort newly-detected assets into
+  albums based on configurable rules. Each rule combines criteria (people in
+  the photo, search query, favorites, date range) with a target album, and can
+  create the album if it doesn't exist. Supports dry-run mode for previewing
+  what would move before committing.

RELEASE_NOTES.md

@@ -1,28 +1,47 @@
-# v0.3.2 (2026-04-22)
+# v0.10.0 (2026-06-05)
 
-Scheduler now honors the app-level timezone. Before this, a cron expression
-like `0 9 * * *` was firing at 09:00 in the server's host-local tz — not
-at 09:00 in the timezone the admin configured under Settings — because
-`CronTrigger.from_crontab` was constructed without a tz. Same fix extends
-to scheduler-provider template rendering so `{{ current_date }}` / `{{ current_time }}`
-match the configured tz, and scheduled firings now show up in the dashboard
-event feed with context.
+Multi-time-point scheduling for Immich. The single comma-separated "times" text box is replaced with an add/remove list of native HH:MM pickers for the **scheduled assets**, **periodic summary**, and **memory** slots — entering several fire times per day is now discoverable, and the read/write path is hardened end to end. This release also pins `aiohttp<3.14` in the backend test environment so the suite stays green against the current `aioresponses`. No breaking changes; no migrations required.
 
-## Bug Fixes
+## User-facing changes
 
-- **Cron triggers honor app timezone** — all tracker and action cron triggers are now built with the configured app tz; `CronTrigger` freezes its tz at construction, so the `PUT /settings` endpoint rebuilds existing cron jobs when the timezone changes. Scheduled messages that were silently firing at host-local time will fire at the intended time after upgrade. ([1024085](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/1024085))
-- **Scheduler template context renders in the app tz** — `current_date`, `current_time`, `current_datetime`, `current_weekday` in scheduler-provider templates are now formatted in the configured timezone instead of UTC/host-local. Custom templates that built date strings in the wrong tz now render correctly. ([1024085](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/1024085))
+### Features
 
-## Features
+- **Immich multi-time scheduling UI.** A new `TimeListEditor` replaces the comma-separated text box with an add/remove list of native HH:MM pickers for the scheduled-assets, periodic-summary, and memory slots. It dedupes and sorts on save, enforces a per-day cap, collapses on-screen duplicates, and gives each row an aria-label. Keyboard entry is no longer clobbered mid-edit — it syncs from the value prop only on external changes via an `untrack` guard ([8065e6e](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/8065e6e))
+- **Per-section save guard.** An enabled feature section (scheduled / periodic / memory) must now have at least one time before it can be saved, enforced in the provider descriptor ([8065e6e](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/8065e6e))
+- **Refreshed copy.** New en/ru i18n keys and updated help text for the editor; the dead `invalidTimeList` string was removed ([8065e6e](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/8065e6e))
 
-- **New `timezone` template variable** — scheduler-provider templates can reference `{{ timezone }}` to display the active IANA tz alongside a date/time. Added across the context builder, variable catalog, sample context, and runtime validator (per the project's 6-file sync rule for template vars). ([1024085](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/1024085))
-- **`scheduled_message` events surface in the dashboard feed** — `EventLog` entries for scheduled firings now carry `schedule_type`, `cron_expression` / `interval_seconds`, `timezone`, and `fire_count`; the dashboard renders them with a dedicated label, icon, and colour so operators can see at a glance when scheduled messages actually fired. ([1024085](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/1024085))
+### Bug Fixes
+
+- **Server-side `*_times` normalization.** The `tracking_configs` API now normalizes `scheduled_times` / `periodic_times` / `memory_times` on every write (validate, dedup, sort, cap at 24), returns **422** on malformed input, and refuses to enable a slot whose times list is empty ([8065e6e](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/8065e6e))
+- **Restored scheduler observability.** The scheduler now warns when an enabled slot has zero or dropped fire times, restoring the visibility that was lost when the old per-call warning was removed ([8065e6e](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/8065e6e))
+
+---
+
+## Development / Internal
+
+### CI/Build
+
+- **Pin `aiohttp<3.14` in the backend test install.** `aioresponses` 0.7.8 (latest) does not pass the `stream_writer` keyword argument that aiohttp 3.14 made required on `ClientResponse`, so every aioresponses-mocked HTTP test failed to construct a response. `notify-bridge-core` declares `aiohttp>=3.9` with no upper bound, so CI floated to 3.14.0 — the pin keeps the test environment reproducible in both `build.yml` and `release.yml` until aioresponses ships an aiohttp-3.14-compatible release ([11593ea](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/11593ea))
+
+### Refactoring
+
+- **Shared time-list service.** A new `services/time_list.py` exposes `normalize_time_list` (raising `TimeListError`) and a lenient `parse_hhmm_list`; the scheduler drops its private parser copy in favour of the shared one ([8065e6e](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/8065e6e))
+
+### Tests
+
+- **Time-list coverage.** New tests for time-list normalization and parsing (including non-ASCII and odd-shaped input) and for the "enabled implies at least one time" validation ([8065e6e](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/8065e6e))
+
+### Chores
+
+- **Checked-in vex config.** A `.vex.toml` enabling semantic embeddings, call-graph, BM25, and auto-update for the vex code-search index ([d01e519](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/d01e519))
 
 ---
 
 <details>
 <summary>All Commits</summary>
 
-- [1024085](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/1024085) — fix(scheduler): honor app timezone for cron triggers and log scheduled events *(alexei.dolgolyov)*
+- [8065e6e](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/8065e6e) — `feat(immich): multi-time-point scheduling for scheduled/periodic/memory` (alexei.dolgolyov)
+- [11593ea](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/11593ea) — `fix(ci): pin aiohttp<3.14 in backend test deps` (alexei.dolgolyov)
+- [d01e519](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/d01e519) — `chore: add vex semantic-search config` (alexei.dolgolyov)
 
 </details>

design-mockups/README.md

@@ -0,0 +1,161 @@
+# Notify Bridge — Redesign Mockups
+
+**Start here:** open [`index.html`](./index.html) for the chooser. Three full directions to pick between, plus a side-by-side comparison table.
+
+**Direction chosen: Aurora / Glass** (2026-04-25). Continuing to mock additional surfaces in this language; original three-way chooser kept for reference.
+
+| File | Option | Mood |
+| --- | --- | --- |
+| [`index.html`](./index.html) | **Chooser** | Compare all three side by side |
+| [`dashboard.html`](./dashboard.html) | A · Bridge / Control Room | Editorial broadcast console — phosphor lime on deep ink, italic Fraunces, hairlines, scanlines |
+| [`dashboard-aurora.html`](./dashboard-aurora.html) | **B · Aurora / Glass** ✓ | Frosted-glass panels over a vivid aurora gradient — visionOS / Stripe-modern |
+| [`dashboard-bento.html`](./dashboard-bento.html) | C · Bento / Modular | Mixed-size colorful tiles in a tight grid — Apple Keynote / Linear blog energy |
+| [`aurora-tracker.html`](./aurora-tracker.html) | **Aurora · Tracker detail** | Form + live preview + event log — stress-tests glass on form-heavy surfaces |
+
+All three are self-contained HTML — no build step. Each has its own theme toggle in the top-right.
+
+---
+
+## Quick comparison
+
+| Trait | A · Bridge | B · Aurora | C · Bento |
+| --- | --- | --- | --- |
+| Mood | Editorial / operator | Premium / atmospheric | Playful / confident |
+| Default theme | Dark (Console) | Dark (Aurora) | Light (Daylight) |
+| Accent | Phosphor lime `#d4ff3a` | Lavender + orchid + mint | Violet · mint · coral · honey |
+| Surface | Hairline-rule modules | Frosted-glass panels | Solid-color tiles |
+| Display font | Fraunces (serif) | Newsreader (serif) | Manrope (sans) |
+| Density | High · for power users | Medium · breathable | Medium · airy |
+| Best for | Pro operators · self-hosters | Showroom · public-facing | Mainstream · cross-audience |
+| Risk | Niche taste · heavy mood | Glass trend may date | Color discipline matters |
+
+---
+
+## What all three share (the UX, not the paint)
+
+These additions are the same across every option — pick a *look*, not a different *product*:
+
+1. **Live ticker / "live" pill** — always-running awareness of the last events without forcing focus
+2. **Stats with deltas + sparklines or trend chart** — numbers always have context
+3. **Editorial hero** with current-state sentence + big throughput readout
+4. **Signal stream with routing trail** — every event shows Tracker → Target → Template inline (today: 3 clicks to find this)
+5. **Provider deck** — throughput, last-seen, pulse status, idle/warn/live indicators
+6. **Pulse chart** (heatmap in A, area waves in B/C) — finally answers "when is this thing busiest?"
+7. **Active wires panel** — Sankey-style Source → Channel routes with live counts
+8. **Compose / new-tracker CTA** — single entry to a 4-step wizard (provider → tracker → template → target)
+9. **Two-theme system** — committed light + dark per option, no lukewarm middle "system"
+
+---
+
+## Implementation cost (rough)
+
+| Option | New deps | New components | Migration risk |
+| --- | --- | --- | --- |
+| A · Bridge | Fraunces + Instrument Sans + JetBrains Mono fonts | Ticker, sparklines, signal-stream-with-trail, heatmap, routes panel | Low — mostly token swap + the 5 new components |
+| B · Aurora | Newsreader + Geist + Geist Mono fonts | Same as A + heavy backdrop-filter / glass system | Medium — `backdrop-filter` perf needs review on long lists; gradient bg can hurt low-end devices |
+| C · Bento | Manrope + JetBrains Mono fonts | Same UX components, but tile-grid layout system + bold-color discipline (color governance matters more) | Low-Medium — tile spans need a discipline, and 8-color palette needs guardrails so devs don't pick colors freely |
+
+All three keep the existing Svelte 5 architecture, $state cache system, and route structure unchanged. **Migration is ~3 weeks** for any one of them to land dashboard + provider list + tracker detail.
+
+---
+
+## What's NOT in any mockup yet
+
+If a direction lands, these surfaces still need design before implementation:
+
+- Tracker detail page (timeline + config editor + live preview)
+- Template editor (Jinja2 sandbox + side-by-side preview)
+- Provider list + provider detail
+- Target detail (channel inbox + delivery history)
+- Bot console (chat-style interaction log for Telegram/Matrix/Email)
+- Setup wizard (first-run experience)
+- Mobile pass — current mockups are desktop-first
+
+---
+
+## Original design rationale (Option A)
+
+Below is the original "Bridge / Control Room" rationale, kept for reference.
+
+### Direction: "Bridge / Control Room"
+
+The product is literally a **signal operator's console** — it listens for events on one side (Immich, Gitea, RSS, GitHub, …) and dispatches them to channels on the other (Telegram, Matrix, Email, ntfy, …). The current UI hides that fact behind generic SaaS-dashboard chrome (teal accent, dot-grid bg, card-with-glow). The redesign leans hard into what the product *is*.
+
+References that were in the room while designing this:
+
+- **Bloomberg Terminal** — dense numerical clarity, monospace numerals, ticker bars
+- **Linear / Vercel** — restraint, hairline rules, type-as-interface
+- **Editorial print** (Bloomberg Businessweek, Fast Company) — italic display serif as a counterpoint to mono data
+- **Broadcast control rooms** — pulsing live indicators, "ON AIR" markers, scanline atmosphere
+- **Phosphor monitors** — the signature lime accent, not the third teal-purple SaaS template
+
+---
+
+## Design language
+
+| Token | Choice | Why |
+| --- | --- | --- |
+| **Display** | Fraunces (variable, italic-capable serif) | Editorial gravitas; italic em-tags inside headlines feel printed, not pasted |
+| **Body** | Instrument Sans | Modern, neutral, slightly geometric — pairs well with a serif without fighting it |
+| **Data** | JetBrains Mono | Tabular numerals everywhere stats appear |
+| **Primary accent** | `#d4ff3a` phosphor lime | Distinctive — far from the SaaS teal/purple gravity well; reads as "signal" |
+| **Secondary signal** | warm coral, calm blue, amber warn, rose error | Used sparingly; one per event class |
+| **Surfaces** | Deep ink `#07080b` → `#161a25` | High-contrast console feel; light theme inverts to "broadsheet" cream |
+| **Hairlines** | 1px borders everywhere instead of shadows | Editorial precision; cards sit *in* the page, not floating over it |
+| **Scanlines + vignette** | Faint overlay | Console atmosphere without crossing into kitsch |
+
+---
+
+## What's actually new (UX, not just paint)
+
+The mockup isn't just a re-skin — these are concrete proposed additions:
+
+1. **"On Air" ticker bar** — a always-running marquee of the last 6–10 events at the very top. Pauses on hover. Keeps you peripherally aware of activity without forcing you to look at the dashboard.
+2. **Stats with sparklines** — every counter shows a 24h trend inline. Numbers without context are useless.
+3. **Editorial hero** — the title is a *sentence about the current state*, not a label. "Tonight, *everything* is flowing" with live numbers in the body. This is opinionated and might feel too much for some — easy to swap to a label-style header.
+4. **Signal stream** — replaces the existing event timeline. Adds the **routing trail** for each event (Tracker → Target → Template) so you can see at a glance where a signal went, not just *that* it happened. This is the killer feature; right now you have to click through three pages to trace one event.
+5. **"On watch" provider deck** — replaces the silent provider list with throughput-per-provider, last-seen, pulse status. Click-to-trace.
+6. **7-day pulse heatmap** — finally answers "when is this thing busiest?". Useful for planning maintenance windows.
+7. **Active wires panel** — Sankey-style "Source → Channel" route summary with throughput counts. Makes the *bridge* visible.
+8. **Compose band** — bottom of dashboard. A single CTA to start a new tracker with a 4-step wizard (provider → tracker → template → target), or paste a webhook URL and let the system infer.
+9. **Live clock + uptime** — pinned in the ticker. Operators know what time it is and how stable they've been.
+10. **Two-theme system** — Console (dark, default for most operators) + Broadsheet (light, warm cream, deep ink). Skips the generic "system theme" three-way; commits to two beautiful options instead of three mediocre ones.
+
+---
+
+## Things to push back on
+
+These are choices I'd specifically want feedback on before implementing:
+
+- **Phosphor lime as primary** — it's bold and very on-brand for "signal," but it's far from the current teal. Worth knowing if you have any brand attachment to teal.
+- **Italic Fraunces inside headlines** — distinctive, but could feel "too magazine" for a self-hosted ops tool. Easy to swap for plain Fraunces or even drop the serif entirely and lean fully on Instrument Sans + JetBrains Mono.
+- **Editorial sentence-style headers** vs. label-style headers — same trade-off as above.
+- **Hairline borders instead of cards-on-cards** — current UI uses elevated cards with glow shadows. The redesign uses flat sectioned modules with 1px rules. Read denser, less "soft."
+- **Sidebar grouping** — I collapsed the current 6-group nav into 3 sections (Overview / Routing / Operators). Some of your nested groups (notification-trackers vs command-trackers) merge into a single "Trackers" entry; click-through reveals tabs. Reduces vertical noise but loses one click of directness.
+- **No emoji / no MDI icon backgrounds** — the current UI uses lots of `mdi*` icon chips. The redesign uses thin custom SVG strokes. Cohesive but more work to maintain (would suggest a curated icon set rather than the full MDI library).
+
+---
+
+## What's NOT in this mockup yet
+
+If the direction lands, these are the next surfaces to design before any implementation:
+
+- **Tracker detail page** — single-tracker timeline + config editor + live preview
+- **Template editor** — code-editor surface with the Jinja2 sandbox preview side-by-side
+- **Provider list / detail** — currently a grid of cards; would become a tabular operator's list
+- **Target detail** — channel inbox view with delivery history per target
+- **Bot console** — Telegram/Matrix/Email bots get a chat-style interaction log
+- **Setup wizard** — first-run experience matching the same aesthetic
+- **Mobile** — current mockup is desktop-only; the design language needs a mobile-first pass before shipping
+
+---
+
+## Implementation notes (if approved)
+
+- Migration is mostly a **CSS token swap** plus selective component refactors. The Svelte 5 architecture and `$state` cache system don't need to change.
+- New fonts: add `@fontsource-variable/fraunces` and `@fontsource-variable/instrument-sans`. Drop `dm-sans`.
+- Replace `app.css` `@theme` block with the new token set.
+- The ticker, sparklines, heatmap, and routes panel are all net-new components — budget those separately.
+- Custom SVG icon set: pick ~30 icons we actually use, ship them as a single sprite. Drop the runtime MDI lookup.
+
+Estimate to first-shippable: **2–3 focused weeks** (one designer-pair sprint) to land dashboard + provider list + tracker detail with the new language. Rest of pages can roll over the following month without breaking the old screens.

design-mockups/index.html

@@ -0,0 +1,565 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Notify Bridge — Redesign Options</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Manrope:wght@300..800&family=JetBrains+Mono:wght@300..600&family=Newsreader:ital,opsz,wght@0,6..72,300..700;1,6..72,300..700&display=swap" rel="stylesheet">
+<style>
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  :root {
+    --bg: #0b0c10;
+    --surface: #14151c;
+    --rule: #232531;
+    --rule-strong: #353846;
+    --fg: #f0eee8;
+    --fg-dim: #b0b3bd;
+    --mute: #6f7280;
+  }
+  html, body { background: var(--bg); color: var(--fg); }
+  body {
+    font-family: 'Manrope', system-ui, sans-serif;
+    -webkit-font-smoothing: antialiased;
+    min-height: 100vh;
+    padding: 56px 32px 80px;
+    background:
+      radial-gradient(40vw 40vw at 18% 10%, rgba(184, 167, 255, 0.12), transparent 60%),
+      radial-gradient(35vw 30vw at 88% 90%, rgba(126, 232, 196, 0.10), transparent 60%),
+      var(--bg);
+  }
+
+  .wrap { max-width: 1240px; margin: 0 auto; }
+
+  .head {
+    display: flex; align-items: center; justify-content: space-between;
+    margin-bottom: 56px;
+    padding-bottom: 28px;
+    border-bottom: 1px solid var(--rule);
+  }
+  .brand {
+    font-family: 'Newsreader', serif;
+    font-weight: 400;
+    font-size: 28px;
+    letter-spacing: -0.02em;
+    line-height: 1;
+  }
+  .brand em {
+    font-style: italic;
+    background: linear-gradient(135deg, #b8a7ff, #ff9ec4);
+    -webkit-background-clip: text; background-clip: text; color: transparent;
+  }
+  .brand small { display: block; margin-top: 6px; color: var(--mute); font-family: 'JetBrains Mono', monospace; font-size: 11px; letter-spacing: 0.15em; text-transform: uppercase; }
+  .meta {
+    text-align: right;
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 11px;
+    color: var(--mute);
+    letter-spacing: 0.13em;
+    text-transform: uppercase;
+  }
+  .meta b { color: var(--fg); font-weight: 500; }
+
+  .intro {
+    max-width: 720px;
+    margin-bottom: 48px;
+  }
+  .intro h1 {
+    font-family: 'Newsreader', serif;
+    font-weight: 400;
+    font-size: 56px;
+    line-height: 1.0;
+    letter-spacing: -0.03em;
+    margin-bottom: 18px;
+  }
+  .intro h1 em {
+    font-style: italic;
+    background: linear-gradient(135deg, #c8f078, #b8a7ff);
+    -webkit-background-clip: text; background-clip: text; color: transparent;
+  }
+  .intro p {
+    font-size: 16px;
+    color: var(--fg-dim);
+    line-height: 1.6;
+    max-width: 560px;
+  }
+
+  .options {
+    display: grid;
+    grid-template-columns: repeat(3, 1fr);
+    gap: 24px;
+  }
+  @media (max-width: 980px) { .options { grid-template-columns: 1fr; } }
+
+  .option {
+    background: var(--surface);
+    border: 1px solid var(--rule);
+    border-radius: 24px;
+    overflow: hidden;
+    transition: transform .25s cubic-bezier(.4,.4,0,1), border-color .25s;
+    text-decoration: none; color: inherit;
+    display: flex; flex-direction: column;
+  }
+  .option:hover {
+    transform: translateY(-4px);
+    border-color: var(--rule-strong);
+  }
+  .option__preview {
+    height: 220px;
+    position: relative;
+    overflow: hidden;
+    border-bottom: 1px solid var(--rule);
+  }
+
+  /* Option A — Bridge / Console */
+  .preview--a {
+    background: #07080b;
+    color: #ece8df;
+  }
+  .preview--a::before {
+    content: '';
+    position: absolute; inset: 0;
+    background-image: repeating-linear-gradient(
+      0deg, rgba(255,255,255,0.018) 0 1px, transparent 1px 3px
+    );
+  }
+  .preview--a .lime {
+    position: absolute; left: 24px; top: 24px;
+    background: #d4ff3a; color: #07080b;
+    padding: 4px 9px;
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 9px; letter-spacing: 0.18em; text-transform: uppercase;
+    font-weight: 700;
+  }
+  .preview--a .num {
+    position: absolute; right: 24px; top: 24px;
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 32px; color: #d4ff3a; font-weight: 500;
+    letter-spacing: -0.02em;
+  }
+  .preview--a .title {
+    position: absolute; left: 24px; bottom: 56px;
+    font-family: 'Newsreader', serif;
+    font-style: italic; font-size: 38px;
+    color: #d4ff3a;
+    letter-spacing: -0.02em;
+    line-height: 0.95;
+  }
+  .preview--a .title b {
+    font-style: normal; color: #ece8df; font-weight: 400;
+  }
+  .preview--a .rule {
+    position: absolute; left: 24px; right: 24px; bottom: 36px;
+    height: 1px; background: rgba(255,255,255,0.12);
+  }
+  .preview--a .stream {
+    position: absolute; left: 24px; bottom: 14px; right: 24px;
+    display: flex; align-items: center; gap: 10px;
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 10px; color: rgba(255,255,255,0.6);
+  }
+  .preview--a .dot {
+    width: 6px; height: 6px; border-radius: 50%;
+    background: #d4ff3a; box-shadow: 0 0 6px #d4ff3a;
+  }
+
+  /* Option B — Aurora */
+  .preview--b {
+    background: #050613;
+    color: #f3f1ff;
+    overflow: hidden;
+  }
+  .preview--b::before {
+    content: '';
+    position: absolute; inset: -20%;
+    background:
+      radial-gradient(40% 40% at 20% 30%, rgba(184, 167, 255, 0.7), transparent 60%),
+      radial-gradient(35% 35% at 80% 25%, rgba(255, 158, 196, 0.6), transparent 60%),
+      radial-gradient(50% 35% at 75% 85%, rgba(126, 232, 196, 0.5), transparent 60%);
+    filter: blur(40px) saturate(140%);
+  }
+  .preview--b .glass {
+    position: absolute; left: 20px; right: 20px; top: 20px; bottom: 20px;
+    background: rgba(255,255,255,0.05);
+    backdrop-filter: blur(20px) saturate(150%);
+    -webkit-backdrop-filter: blur(20px) saturate(150%);
+    border: 1px solid rgba(255,255,255,0.12);
+    border-radius: 18px;
+    overflow: hidden;
+    padding: 22px;
+  }
+  .preview--b .pill {
+    display: inline-flex; align-items: center; gap: 6px;
+    padding: 4px 10px;
+    border-radius: 999px;
+    background: rgba(255,255,255,0.1);
+    font-size: 10px; color: #b8a7ff;
+    font-weight: 500;
+  }
+  .preview--b .pill::before {
+    content: '';
+    width: 6px; height: 6px; border-radius: 50%;
+    background: #7ee8c4; box-shadow: 0 0 6px #7ee8c4;
+  }
+  .preview--b .title {
+    font-family: 'Newsreader', serif;
+    font-style: italic; font-size: 34px;
+    margin-top: 12px;
+    background: linear-gradient(135deg, #ff9ec4, #b8a7ff 60%, #8ec9ff);
+    -webkit-background-clip: text; background-clip: text; color: transparent;
+    letter-spacing: -0.02em;
+    line-height: 1;
+  }
+  .preview--b .title b {
+    font-style: normal; color: #f3f1ff;
+    background: none; -webkit-text-fill-color: #f3f1ff;
+  }
+  .preview--b .row {
+    margin-top: 14px;
+    display: flex; gap: 8px;
+  }
+  .preview--b .chip {
+    padding: 5px 10px;
+    border-radius: 999px;
+    background: rgba(255,255,255,0.08);
+    font-size: 10px;
+    border: 1px solid rgba(255,255,255,0.1);
+    color: rgba(255,255,255,0.85);
+  }
+  .preview--b .chip b { font-weight: 600; }
+
+  /* Option C — Bento */
+  .preview--c {
+    background: #f4f3ef;
+    color: #0c0d11;
+    padding: 14px;
+    display: grid;
+    grid-template-columns: 2fr 1fr 1fr;
+    grid-template-rows: 1fr 1fr;
+    gap: 8px;
+  }
+  .preview--c .b-tile {
+    border-radius: 14px;
+    padding: 12px;
+    display: flex; flex-direction: column;
+    justify-content: space-between;
+    overflow: hidden;
+    position: relative;
+    font-size: 10px;
+  }
+  .preview--c .b-violet { background: #6d4ce6; color: white; grid-row: span 2; }
+  .preview--c .b-mint   { background: #c8f078; color: #1a2e0c; }
+  .preview--c .b-coral  { background: #ff6f5b; color: white; }
+  .preview--c .b-honey  { background: #ffd23a; color: #2a1f00; }
+  .preview--c .b-ink    { background: #0c0d11; color: white; }
+  .preview--c .b-tile .lab {
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 8px; letter-spacing: 0.16em; text-transform: uppercase;
+    opacity: 0.7; font-weight: 500;
+  }
+  .preview--c .b-tile .num {
+    font-size: 28px; font-weight: 700;
+    letter-spacing: -0.04em; line-height: 1;
+  }
+  .preview--c .b-violet .num { font-size: 36px; }
+  .preview--c .b-tile .num small {
+    font-size: 14px; opacity: 0.6;
+  }
+  .preview--c .b-tile .cap {
+    font-size: 9px; opacity: 0.85; line-height: 1.3;
+    margin-top: 2px;
+  }
+
+  /* Option content */
+  .option__body { padding: 24px 26px 26px; flex: 1; display: flex; flex-direction: column; }
+  .option__kicker {
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 10.5px;
+    letter-spacing: 0.18em;
+    text-transform: uppercase;
+    color: var(--mute);
+    margin-bottom: 10px;
+    font-weight: 500;
+    display: flex; align-items: center; gap: 8px;
+  }
+  .option__kicker .badge {
+    background: var(--rule);
+    color: var(--fg);
+    padding: 2px 7px;
+    border-radius: 4px;
+    font-size: 9px;
+    font-weight: 600;
+    letter-spacing: 0.1em;
+  }
+  .option__title {
+    font-family: 'Newsreader', serif;
+    font-weight: 400;
+    font-size: 26px;
+    letter-spacing: -0.02em;
+    line-height: 1.05;
+    margin-bottom: 12px;
+  }
+  .option__title em {
+    font-style: italic;
+    color: var(--fg-dim);
+  }
+  .option__desc {
+    font-size: 13.5px;
+    color: var(--fg-dim);
+    line-height: 1.55;
+    margin-bottom: 18px;
+    flex: 1;
+  }
+  .option__tags {
+    display: flex; gap: 6px; flex-wrap: wrap;
+    margin-bottom: 18px;
+  }
+  .option__tag {
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 10px;
+    color: var(--fg-dim);
+    background: var(--rule);
+    padding: 3px 8px;
+    border-radius: 999px;
+    letter-spacing: 0.04em;
+  }
+  .option__cta {
+    display: inline-flex; align-items: center; gap: 8px;
+    color: var(--fg);
+    font-size: 13px; font-weight: 600;
+    border-top: 1px solid var(--rule);
+    padding-top: 16px;
+  }
+  .option__cta svg { width: 14px; height: 14px; transition: transform .2s; }
+  .option:hover .option__cta svg { transform: translateX(4px); }
+
+  .vs {
+    margin-top: 80px;
+    border-top: 1px solid var(--rule);
+    padding-top: 56px;
+  }
+  .vs h2 {
+    font-family: 'Newsreader', serif;
+    font-weight: 400;
+    font-size: 32px;
+    letter-spacing: -0.02em;
+    margin-bottom: 28px;
+  }
+  .vs h2 em { font-style: italic; color: var(--fg-dim); }
+  .vs__table {
+    width: 100%;
+    border-collapse: collapse;
+    background: var(--surface);
+    border: 1px solid var(--rule);
+    border-radius: 16px;
+    overflow: hidden;
+    font-size: 13px;
+  }
+  .vs__table th, .vs__table td {
+    padding: 14px 18px;
+    text-align: left;
+    border-bottom: 1px solid var(--rule);
+  }
+  .vs__table tr:last-child td { border-bottom: 0; }
+  .vs__table th {
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 10.5px;
+    letter-spacing: 0.16em;
+    text-transform: uppercase;
+    color: var(--mute);
+    font-weight: 500;
+    background: rgba(255,255,255,0.02);
+  }
+  .vs__table td:first-child {
+    font-weight: 600;
+    color: var(--fg);
+  }
+  .vs__table td { color: var(--fg-dim); }
+  .vs__table .a { color: #d4ff3a; }
+  .vs__table .b { color: #b8a7ff; }
+  .vs__table .c { color: #c8f078; }
+
+  .foot {
+    margin-top: 80px;
+    text-align: center;
+    color: var(--mute);
+    font-size: 11.5px;
+    font-family: 'JetBrains Mono', monospace;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+  }
+
+</style>
+</head>
+<body>
+<div class="wrap">
+
+  <header class="head">
+    <div class="brand">
+      Notify <em>Bridge</em>
+      <small>Redesign · 3 directions</small>
+    </div>
+    <div class="meta">
+      Drafted <b>Apr 25, 2026</b><br>
+      For review · pick one
+    </div>
+  </header>
+
+  <section class="intro">
+    <h1>Three directions, one <em>product</em>.</h1>
+    <p>
+      Each option is a real, working dashboard you can open and click around. They share the same data,
+      the same product, and the same set of UX ideas — but commit to different aesthetic universes.
+      Open any, then come back here to compare.
+    </p>
+    <p style="margin-top: 18px; padding: 12px 18px; border-left: 2px solid #b8a7ff; background: rgba(184,167,255,0.08); border-radius: 0 12px 12px 0; font-size: 14px;">
+      <strong style="color:#b8a7ff">Decided · Aurora.</strong>
+      Ongoing surfaces in the chosen language:
+      <a href="aurora-tracker.html" style="color:#b8a7ff;font-weight:600;text-decoration:underline;text-underline-offset:3px;">Tracker detail →</a>
+    </p>
+  </section>
+
+  <section class="options">
+
+    <a class="option" href="dashboard.html">
+      <div class="option__preview preview--a">
+        <span class="lime">● ON AIR</span>
+        <span class="num">2 814</span>
+        <div class="title"><b>Tonight,</b><br>everything is <em>flowing.</em></div>
+        <div class="rule"></div>
+        <div class="stream">
+          <span class="dot"></span><span>02:14 · IMMICH · 14 ASSETS → @FAMILY</span>
+        </div>
+      </div>
+      <div class="option__body">
+        <div class="option__kicker">Option A <span class="badge">existing</span></div>
+        <h3 class="option__title">Bridge <em>· Control Room</em></h3>
+        <p class="option__desc">
+          Editorial broadcast-console. Phosphor-lime accents on deep ink, hairline rules,
+          monospace numerals, italic Fraunces serif against JetBrains Mono. Atmospheric scanlines,
+          live ticker bar. Built for operators who want density and signal-room energy.
+        </p>
+        <div class="option__tags">
+          <span class="option__tag">phosphor-lime</span>
+          <span class="option__tag">Fraunces</span>
+          <span class="option__tag">hairlines</span>
+          <span class="option__tag">dense</span>
+        </div>
+        <div class="option__cta">
+          Open mockup
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 12h14M12 5l7 7-7 7"/></svg>
+        </div>
+      </div>
+    </a>
+
+    <a class="option" href="dashboard-aurora.html">
+      <div class="option__preview preview--b">
+        <div class="glass">
+          <span class="pill">Live · all systems nominal</span>
+          <div class="title"><b>Tonight,</b><br><em>everything</em> flows.</div>
+          <div class="row">
+            <span class="chip"><b>2 814</b> sent</span>
+            <span class="chip"><b>99.7%</b> ok</span>
+          </div>
+        </div>
+      </div>
+      <div class="option__body">
+        <div class="option__kicker">Option B <span class="badge" style="background:#b8a7ff;color:#0a0a0a">new</span></div>
+        <h3 class="option__title">Aurora <em>· Glass</em></h3>
+        <p class="option__desc">
+          Vivid aurora gradient base, frosted-glass panels, soft pastel accents — lavender, orchid,
+          mint, coral. Newsreader serif headlines with gradient italics. Premium, modern, visionOS /
+          Stripe-modern. Rounded, breathable, animated.
+        </p>
+        <div class="option__tags">
+          <span class="option__tag">aurora gradient</span>
+          <span class="option__tag">frosted glass</span>
+          <span class="option__tag">Newsreader</span>
+          <span class="option__tag">premium</span>
+        </div>
+        <div class="option__cta">
+          Open mockup
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 12h14M12 5l7 7-7 7"/></svg>
+        </div>
+      </div>
+    </a>
+
+    <a class="option" href="dashboard-bento.html">
+      <div class="option__preview preview--c">
+        <div class="b-tile b-violet">
+          <span class="lab">Top provider</span>
+          <div>
+            <div class="num">1942</div>
+            <div class="cap">Immich · 8 trackers</div>
+          </div>
+        </div>
+        <div class="b-tile b-mint">
+          <span class="lab">Trackers</span>
+          <div class="num">12<small>/14</small></div>
+        </div>
+        <div class="b-tile b-honey">
+          <span class="lab">Targets</span>
+          <div class="num">19</div>
+        </div>
+        <div class="b-tile b-coral">
+          <span class="lab">Failures</span>
+          <div class="num">02</div>
+        </div>
+        <div class="b-tile b-ink">
+          <span class="lab">Live</span>
+          <div class="num" style="color:#c8f078">●</div>
+        </div>
+      </div>
+      <div class="option__body">
+        <div class="option__kicker">Option C <span class="badge" style="background:#c8f078;color:#1a2e0c">new</span></div>
+        <h3 class="option__title">Bento <em>· Modular</em></h3>
+        <p class="option__desc">
+          Mixed-size colorful tiles in a tight grid. Each module commits to one role and one bold color
+          — violet, mint, coral, honey, cobalt. Manrope sans + JetBrains Mono. Apple Keynote / Linear
+          blog energy. Playful but disciplined. Ships with day + night.
+        </p>
+        <div class="option__tags">
+          <span class="option__tag">bento grid</span>
+          <span class="option__tag">bold color</span>
+          <span class="option__tag">Manrope</span>
+          <span class="option__tag">playful</span>
+        </div>
+        <div class="option__cta">
+          Open mockup
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 12h14M12 5l7 7-7 7"/></svg>
+        </div>
+      </div>
+    </a>
+
+  </section>
+
+  <section class="vs">
+    <h2>Side <em>by side</em></h2>
+    <table class="vs__table">
+      <thead>
+        <tr>
+          <th>Trait</th>
+          <th><span class="a">A · Bridge</span></th>
+          <th><span class="b">B · Aurora</span></th>
+          <th><span class="c">C · Bento</span></th>
+        </tr>
+      </thead>
+      <tbody>
+        <tr><td>Mood</td><td>Editorial / operator</td><td>Premium / atmospheric</td><td>Playful / confident</td></tr>
+        <tr><td>Default theme</td><td>Dark (Console)</td><td>Dark (Aurora)</td><td>Light (Daylight)</td></tr>
+        <tr><td>Accent</td><td>Phosphor lime <code style="background:#d4ff3a;color:#07080b;padding:2px 6px;border-radius:4px;font-family:JetBrains Mono;font-size:11px">#d4ff3a</code></td><td>Lavender + orchid + mint</td><td>Violet · mint · coral · honey</td></tr>
+        <tr><td>Surface</td><td>Hairline-rule modules</td><td>Frosted-glass panels</td><td>Solid-color tiles</td></tr>
+        <tr><td>Display font</td><td>Fraunces (variable serif)</td><td>Newsreader (variable serif)</td><td>Manrope (geometric sans)</td></tr>
+        <tr><td>Data font</td><td>JetBrains Mono</td><td>Geist Mono</td><td>JetBrains Mono</td></tr>
+        <tr><td>Density</td><td>High · for power users</td><td>Medium · breathable</td><td>Medium · airy</td></tr>
+        <tr><td>Risk</td><td>Niche taste · heavy mood</td><td>Trendy glass may date</td><td>Color discipline matters</td></tr>
+        <tr><td>Best for</td><td>Pro operators · self-hosters</td><td>Showroom · public-facing</td><td>Mainstream · cross-audience</td></tr>
+      </tbody>
+    </table>
+  </section>
+
+  <div class="foot">Notify Bridge · v0.5.2 · drafted by Claude</div>
+</div>
+</body>
+</html>

docker-compose.yml

@@ -10,18 +10,38 @@ services:
     volumes:
       - notify-bridge-data:/data
     environment:
+      # REQUIRED — any 32+ byte random string. `openssl rand -hex 32` is one way.
       - NOTIFY_BRIDGE_SECRET_KEY=${NOTIFY_BRIDGE_SECRET_KEY:?Set NOTIFY_BRIDGE_SECRET_KEY (min 32 chars)}
-      - NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS=${NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS:-*}
-      # Homelab target: allow outbound requests to RFC1918 / link-local addresses.
-      # The SSRF guard otherwise rejects 10.*/172.16.*/192.168.*/169.254.* hosts,
-      # which breaks tracking of Immich / Gitea / etc. running on the same LAN.
-      - NOTIFY_BRIDGE_ALLOW_PRIVATE_URLS=1
+      # Comma-separated list of allowed browser origins. Wildcard `*` is
+      # rejected on startup because credentials are enabled.
+      - NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS=${NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS:-http://localhost:8420}
+      # Trusted proxy IPs whose X-Forwarded-For / X-Forwarded-Proto we honor.
+      # Set this to your reverse proxy's IP (e.g. 172.17.0.1 for the default
+      # docker bridge, or `*` only if the container is NOT reachable from the
+      # public internet).
+      - NOTIFY_BRIDGE_FORWARDED_ALLOW_IPS=${NOTIFY_BRIDGE_FORWARDED_ALLOW_IPS:-127.0.0.1}
+      # Opt-in SSRF bypass for private/loopback/link-local hosts (homelab
+      # scenario — tracking an Immich/Gitea instance on the same LAN). DO NOT
+      # enable on a publicly exposed instance.
+      # - NOTIFY_BRIDGE_ALLOW_PRIVATE_URLS=1
     healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8420/api/health')"]
+      # Use /api/ready (not /api/health) so the container is only reported
+      # healthy after migrations and the scheduler finish booting.
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8420/api/ready', timeout=3)"]
       interval: 30s
       timeout: 5s
       retries: 3
-      start_period: 10s
+      start_period: 30s
+    read_only: true
+    tmpfs:
+      - /tmp
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    mem_limit: 512m
+    cpus: 1.0
+    pids_limit: 256
 
 volumes:
   notify-bridge-data:

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "notify-bridge-frontend",
-	"version": "0.1.0",
+	"version": "0.10.0",
 	"lockfileVersion": 2,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "notify-bridge-frontend",
-			"version": "0.1.0",
+			"version": "0.10.0",
 			"dependencies": {
 				"@codemirror/autocomplete": "^6.18.0",
 				"@codemirror/lang-html": "^6.4.11",
@@ -14,8 +14,12 @@
 				"@codemirror/state": "^6.6.0",
 				"@codemirror/theme-one-dark": "^6.1.3",
 				"@codemirror/view": "^6.40.0",
+				"@fontsource-variable/geist": "^5.2.8",
 				"@fontsource/dm-sans": "^5.2.8",
+				"@fontsource/geist-mono": "^5.2.7",
+				"@fontsource/geist-sans": "^5.2.5",
 				"@fontsource/jetbrains-mono": "^5.2.8",
+				"@fontsource/newsreader": "^5.2.10",
 				"@mdi/js": "^7.4.47",
 				"codemirror": "^6.0.2"
 			},
@@ -604,6 +608,14 @@
 			"integrity": "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==",
 			"dev": true
 		},
+		"node_modules/@fontsource-variable/geist": {
+			"version": "5.2.8",
+			"resolved": "https://registry.npmjs.org/@fontsource-variable/geist/-/geist-5.2.8.tgz",
+			"integrity": "sha512-cJ6m9e+8MQ5dCYJsLylfZrgBh6KkG4bOLckB35Tr9J/EqdkEM6QllH5PxqP1dhTvFup+HtMRPuz9xOjxXJggxw==",
+			"funding": {
+				"url": "https://github.com/sponsors/ayuhito"
+			}
+		},
 		"node_modules/@fontsource/dm-sans": {
 			"version": "5.2.8",
 			"resolved": "https://registry.npmjs.org/@fontsource/dm-sans/-/dm-sans-5.2.8.tgz",
@@ -612,6 +624,22 @@
 				"url": "https://github.com/sponsors/ayuhito"
 			}
 		},
+		"node_modules/@fontsource/geist-mono": {
+			"version": "5.2.7",
+			"resolved": "https://registry.npmjs.org/@fontsource/geist-mono/-/geist-mono-5.2.7.tgz",
+			"integrity": "sha512-xVPVFISJg/K0VVd+aQN0Y7X/sw9hUcJPyDWFJ5GpyU3bHELhoRsJkPSRSHXW32mOi0xZCUQDOaPj1sqIFJ1FGg==",
+			"funding": {
+				"url": "https://github.com/sponsors/ayuhito"
+			}
+		},
+		"node_modules/@fontsource/geist-sans": {
+			"version": "5.2.5",
+			"resolved": "https://registry.npmjs.org/@fontsource/geist-sans/-/geist-sans-5.2.5.tgz",
+			"integrity": "sha512-anllOHyJbElRs9fV15TeDRqAeb1IKm4bSknPl6ZMoyPTx1BBy7logudcUwpNjmQLkzn4Q0JGQLRCUKJYoyST6A==",
+			"funding": {
+				"url": "https://github.com/sponsors/ayuhito"
+			}
+		},
 		"node_modules/@fontsource/jetbrains-mono": {
 			"version": "5.2.8",
 			"resolved": "https://registry.npmjs.org/@fontsource/jetbrains-mono/-/jetbrains-mono-5.2.8.tgz",
@@ -620,6 +648,14 @@
 				"url": "https://github.com/sponsors/ayuhito"
 			}
 		},
+		"node_modules/@fontsource/newsreader": {
+			"version": "5.2.10",
+			"resolved": "https://registry.npmjs.org/@fontsource/newsreader/-/newsreader-5.2.10.tgz",
+			"integrity": "sha512-TFaYzoFhDqarUyV2yYjgZZEwT4bpaj6sGBnXSnFknQ/QB8/9LzfY6IO9+inHOX4zzPp87Z7/KuG1OI5gr91Q3A==",
+			"funding": {
+				"url": "https://github.com/sponsors/ayuhito"
+			}
+		},
 		"node_modules/@internationalized/date": {
 			"version": "3.12.0",
 			"resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.12.0.tgz",
@@ -1437,7 +1473,7 @@
 			}
 		},
 		"node_modules/@types/cookie": {
-			"version": "0.6.0",
+			"version": "0.6.1",
 			"resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz",
 			"integrity": "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==",
 			"dev": true
@@ -1560,7 +1596,7 @@
 			}
 		},
 		"node_modules/cookie": {
-			"version": "0.6.0",
+			"version": "0.6.1",
 			"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
 			"integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
 			"dev": true,
@@ -2860,16 +2896,36 @@
 			"integrity": "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==",
 			"dev": true
 		},
+		"@fontsource-variable/geist": {
+			"version": "5.2.8",
+			"resolved": "https://registry.npmjs.org/@fontsource-variable/geist/-/geist-5.2.8.tgz",
+			"integrity": "sha512-cJ6m9e+8MQ5dCYJsLylfZrgBh6KkG4bOLckB35Tr9J/EqdkEM6QllH5PxqP1dhTvFup+HtMRPuz9xOjxXJggxw=="
+		},
 		"@fontsource/dm-sans": {
 			"version": "5.2.8",
 			"resolved": "https://registry.npmjs.org/@fontsource/dm-sans/-/dm-sans-5.2.8.tgz",
 			"integrity": "sha512-tlovG42m9ESG28WiHpLq3F5umAlm64rv0RkqTbYowRn70e9OlRr5a3yTJhrhrY+k5lftR/OFJjPzOLQzk8EfCA=="
 		},
+		"@fontsource/geist-mono": {
+			"version": "5.2.7",
+			"resolved": "https://registry.npmjs.org/@fontsource/geist-mono/-/geist-mono-5.2.7.tgz",
+			"integrity": "sha512-xVPVFISJg/K0VVd+aQN0Y7X/sw9hUcJPyDWFJ5GpyU3bHELhoRsJkPSRSHXW32mOi0xZCUQDOaPj1sqIFJ1FGg=="
+		},
+		"@fontsource/geist-sans": {
+			"version": "5.2.5",
+			"resolved": "https://registry.npmjs.org/@fontsource/geist-sans/-/geist-sans-5.2.5.tgz",
+			"integrity": "sha512-anllOHyJbElRs9fV15TeDRqAeb1IKm4bSknPl6ZMoyPTx1BBy7logudcUwpNjmQLkzn4Q0JGQLRCUKJYoyST6A=="
+		},
 		"@fontsource/jetbrains-mono": {
 			"version": "5.2.8",
 			"resolved": "https://registry.npmjs.org/@fontsource/jetbrains-mono/-/jetbrains-mono-5.2.8.tgz",
 			"integrity": "sha512-6w8/SG4kqvIMu7xd7wt6x3idn1Qux3p9N62s6G3rfldOUYHpWcc2FKrqf+Vo44jRvqWj2oAtTHrZXEP23oSKwQ=="
 		},
+		"@fontsource/newsreader": {
+			"version": "5.2.10",
+			"resolved": "https://registry.npmjs.org/@fontsource/newsreader/-/newsreader-5.2.10.tgz",
+			"integrity": "sha512-TFaYzoFhDqarUyV2yYjgZZEwT4bpaj6sGBnXSnFknQ/QB8/9LzfY6IO9+inHOX4zzPp87Z7/KuG1OI5gr91Q3A=="
+		},
 		"@internationalized/date": {
 			"version": "3.12.0",
 			"resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.12.0.tgz",
@@ -3375,7 +3431,7 @@
 			}
 		},
 		"@types/cookie": {
-			"version": "0.6.0",
+			"version": "0.6.1",
 			"resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz",
 			"integrity": "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==",
 			"dev": true
@@ -3460,7 +3516,7 @@
 			}
 		},
 		"cookie": {
-			"version": "0.6.0",
+			"version": "0.6.1",
 			"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
 			"integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
 			"dev": true

frontend/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "notify-bridge-frontend",
 	"private": true,
-	"version": "0.3.2",
+	"version": "0.10.0",
 	"type": "module",
 	"scripts": {
 		"dev": "vite dev",
@@ -34,8 +34,12 @@
 		"@codemirror/state": "^6.6.0",
 		"@codemirror/theme-one-dark": "^6.1.3",
 		"@codemirror/view": "^6.40.0",
+		"@fontsource-variable/geist": "^5.2.8",
 		"@fontsource/dm-sans": "^5.2.8",
+		"@fontsource/geist-mono": "^5.2.7",
+		"@fontsource/geist-sans": "^5.2.5",
 		"@fontsource/jetbrains-mono": "^5.2.8",
+		"@fontsource/newsreader": "^5.2.10",
 		"@mdi/js": "^7.4.47",
 		"codemirror": "^6.0.2"
 	}

frontend/src/app.css

@@ -1,41 +1,86 @@
-@import '@fontsource/dm-sans/300.css';
-@import '@fontsource/dm-sans/400.css';
-@import '@fontsource/dm-sans/500.css';
-@import '@fontsource/dm-sans/600.css';
-@import '@fontsource/dm-sans/700.css';
-@import '@fontsource/jetbrains-mono/400.css';
-@import '@fontsource/jetbrains-mono/500.css';
-@import '@fontsource/jetbrains-mono/600.css';
+/* Sans: variable Geist ships latin + latin-ext + cyrillic in one woff2,
+   so RU and EN render in the same font instead of falling back to a
+   system sans for Cyrillic. Replaces the legacy ``@fontsource/geist-sans``
+   (latin-only) imports — see --font-sans below for the family rename. */
+@import '@fontsource-variable/geist';
+@import '@fontsource/geist-mono/400.css';
+@import '@fontsource/geist-mono/500.css';
+@import '@fontsource/geist-mono/600.css';
+/* Geist Mono cyrillic subsets — same family name, additional unicode-range
+   declarations so Russian text renders in Geist Mono instead of falling
+   back to Cascadia/Consolas. */
+@import '@fontsource/geist-mono/cyrillic-400.css';
+@import '@fontsource/geist-mono/cyrillic-500.css';
+@import '@fontsource/geist-mono/cyrillic-600.css';
+@import '@fontsource/newsreader/300-italic.css';
+@import '@fontsource/newsreader/400.css';
+@import '@fontsource/newsreader/400-italic.css';
+@import '@fontsource/newsreader/500.css';
+@import '@fontsource/newsreader/500-italic.css';
+@import '@fontsource/newsreader/600.css';
 @import 'tailwindcss';
 
 @theme {
-	--color-background: #f8f9fb;
-	--color-foreground: #1a1a2e;
-	--color-muted: #eef0f4;
-	--color-muted-foreground: #525866;
-	--color-border: #e2e4ea;
-	--color-primary: #0d9488;
-	--color-primary-foreground: #ffffff;
-	--color-accent: #eef0f4;
-	--color-accent-foreground: #1a1a2e;
-	--color-destructive: #ef4444;
-	--color-card: #ffffff;
-	--color-card-foreground: #1a1a2e;
-	--color-success-bg: #ecfdf5;
-	--color-success-fg: #059669;
-	--color-warning-bg: #fffbeb;
-	--color-warning-fg: #d97706;
-	--color-error-bg: #fef2f2;
-	--color-error-fg: #dc2626;
-	--color-glow: rgba(13, 148, 136, 0.15);
-	--color-glow-strong: rgba(13, 148, 136, 0.3);
-	--color-sidebar: #ffffff;
-	--color-sidebar-active: rgba(13, 148, 136, 0.08);
-	--font-sans: 'DM Sans', ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-	--font-mono: 'JetBrains Mono', ui-monospace, 'Cascadia Code', 'Consolas', monospace;
-	--radius: 0.625rem;
-	/* Layered z-index scale — refer to these instead of ad-hoc numbers.
-	   Ordered: base < sticky < dropdown < overlay < modal < tooltip < toast */
+	/* === AURORA: dark default ("Aurora") === */
+	--color-background: #050613;
+	--color-background-deep: #02030a;
+	--color-foreground: #f3f1ff;
+	--color-muted: rgba(255, 255, 255, 0.04);
+	--color-muted-foreground: #b6b2d4;
+	--color-border: rgba(255, 255, 255, 0.08);
+
+	/* Glass surfaces — replace solid card */
+	--color-glass: rgba(255, 255, 255, 0.04);
+	--color-glass-strong: rgba(255, 255, 255, 0.07);
+	--color-glass-elev: rgba(255, 255, 255, 0.10);
+	--color-highlight: rgba(255, 255, 255, 0.14);
+	--color-input-bg: rgba(255, 255, 255, 0.04);
+	--color-rule-strong: rgba(255, 255, 255, 0.16);
+
+	/* Accent palette — soft pastel constellation */
+	--color-primary: #b8a7ff;       /* lavender — main accent */
+	--color-primary-foreground: #02030a;
+	--color-orchid: #ff9ec4;
+	--color-mint:   #7ee8c4;
+	--color-citrus: #f0e16a;
+	--color-coral:  #ff8a78;
+	--color-sky:    #8ec9ff;
+
+	--color-accent: rgba(255, 255, 255, 0.07);
+	--color-accent-foreground: #f3f1ff;
+	--color-destructive: #ff8a78;
+
+	/* Card mapping (kept for backward compat with components that read --color-card) */
+	--color-card: rgba(255, 255, 255, 0.04);
+	--color-card-foreground: #f3f1ff;
+
+	/* Status surfaces */
+	--color-success-bg: rgba(126, 232, 196, 0.12);
+	--color-success-fg: #7ee8c4;
+	--color-warning-bg: rgba(240, 225, 106, 0.12);
+	--color-warning-fg: #f0e16a;
+	--color-error-bg:   rgba(255, 138, 120, 0.12);
+	--color-error-fg:   #ff8a78;
+
+	/* Glow tokens — used for focus rings, hover halos */
+	--color-glow:        rgba(184, 167, 255, 0.20);
+	--color-glow-strong: rgba(184, 167, 255, 0.45);
+
+	/* Sidebar tokens */
+	--color-sidebar: rgba(255, 255, 255, 0.04);
+	--color-sidebar-active: rgba(255, 255, 255, 0.10);
+
+	/* Shadow recipe for floating glass */
+	--shadow-card: 0 1px 0 rgba(255,255,255,0.07) inset, 0 30px 60px -20px rgba(0,0,0,0.6);
+
+	/* Typography */
+	--font-sans: 'Geist Variable', 'Geist', 'Geist Sans', ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+	--font-mono: 'Geist Mono', ui-monospace, 'Cascadia Code', 'Consolas', monospace;
+	--font-display: 'Newsreader', ui-serif, Georgia, serif;
+
+	--radius: 1rem;
+
+	/* z-index scale (unchanged) */
 	--z-base: 1;
 	--z-sticky: 10;
 	--z-dropdown: 30;
@@ -45,30 +90,56 @@
 	--z-toast: 70;
 }
 
-/* Dark theme overrides */
+/* === AURORA: light theme ("Pearl") overrides === */
+[data-theme="light"] {
+	--color-background: #f5f3ff;
+	--color-background-deep: #ede9fe;
+	--color-foreground: #1a1530;
+	--color-muted: rgba(20, 15, 60, 0.04);
+	--color-muted-foreground: #3a3560;
+	--color-border: rgba(20, 15, 60, 0.08);
+
+	--color-glass: rgba(255, 255, 255, 0.55);
+	--color-glass-strong: rgba(255, 255, 255, 0.65);
+	--color-glass-elev: rgba(255, 255, 255, 0.80);
+	--color-highlight: rgba(255, 255, 255, 0.9);
+	--color-input-bg: rgba(255, 255, 255, 0.85);
+	--color-rule-strong: rgba(20, 15, 60, 0.16);
+
+	--color-primary: #6d4ce0;
+	--color-primary-foreground: #ffffff;
+	--color-orchid: #d63384;
+	--color-mint:   #008a64;
+	--color-citrus: #a07a00;
+	--color-coral:  #e0512f;
+	--color-sky:    #1f6fcc;
+
+	--color-accent: rgba(20, 15, 60, 0.04);
+	--color-accent-foreground: #1a1530;
+	--color-destructive: #e0512f;
+
+	--color-card: rgba(255, 255, 255, 0.55);
+	--color-card-foreground: #1a1530;
+
+	--color-success-bg: rgba(0, 138, 100, 0.10);
+	--color-success-fg: #008a64;
+	--color-warning-bg: rgba(160, 122, 0, 0.10);
+	--color-warning-fg: #a07a00;
+	--color-error-bg:   rgba(224, 81, 47, 0.10);
+	--color-error-fg:   #e0512f;
+
+	--color-glow:        rgba(109, 76, 224, 0.18);
+	--color-glow-strong: rgba(109, 76, 224, 0.40);
+
+	--color-sidebar: rgba(255, 255, 255, 0.55);
+	--color-sidebar-active: rgba(255, 255, 255, 0.85);
+
+	--shadow-card: 0 1px 0 rgba(255,255,255,0.5) inset, 0 20px 40px -16px rgba(80, 50, 180, 0.18);
+}
+
+/* Legacy alias — many components still read [data-theme="dark"] */
 [data-theme="dark"] {
-	--color-background: #0c0e14;
-	--color-foreground: #e4e6ed;
-	--color-muted: #1a1d28;
-	--color-muted-foreground: #8b8fa4;
-	--color-border: #252836;
-	--color-primary: #14b8a6;
-	--color-primary-foreground: #0c0e14;
-	--color-accent: #1a1d28;
-	--color-accent-foreground: #e4e6ed;
-	--color-destructive: #f87171;
-	--color-card: #13151e;
-	--color-card-foreground: #e4e6ed;
-	--color-success-bg: #052e16;
-	--color-success-fg: #34d399;
-	--color-warning-bg: #422006;
-	--color-warning-fg: #fbbf24;
-	--color-error-bg: #450a0a;
-	--color-error-fg: #f87171;
-	--color-glow: rgba(20, 184, 166, 0.12);
-	--color-glow-strong: rgba(20, 184, 166, 0.25);
-	--color-sidebar: #10121a;
-	--color-sidebar-active: rgba(20, 184, 166, 0.1);
+	/* defaults already match :root — no overrides needed, declaration kept for color-scheme */
 }
 
 body {
@@ -78,68 +149,146 @@ body {
 	transition: background-color 0.3s ease, color 0.3s ease;
 	-webkit-font-smoothing: antialiased;
 	-moz-osx-font-smoothing: grayscale;
+	letter-spacing: -0.005em;
+	min-height: 100vh;
+	overflow-x: hidden;
 }
 
-/* Subtle background pattern */
+/* === Aurora atmosphere — vivid blurred blobs behind everything === */
 body::before {
+	content: '';
+	position: fixed;
+	inset: -20vh -10vw;
+	background:
+		radial-gradient(40vw 40vw at 12% 18%, rgba(184, 167, 255, 0.55), transparent 60%),
+		radial-gradient(35vw 35vw at 88% 22%, rgba(255, 158, 196, 0.45), transparent 60%),
+		radial-gradient(50vw 35vw at 78% 88%, rgba(126, 232, 196, 0.40), transparent 60%),
+		radial-gradient(40vw 30vw at 6% 92%, rgba(142, 201, 255, 0.42), transparent 60%);
+	filter: blur(60px) saturate(140%);
+	pointer-events: none;
+	z-index: -2;
+	animation: aurora-drift 28s ease-in-out infinite alternate;
+}
+
+body::after {
 	content: '';
 	position: fixed;
 	inset: 0;
 	z-index: -1;
-	opacity: 0.4;
-	background-image: radial-gradient(circle at 1px 1px, var(--color-border) 0.5px, transparent 0);
-	background-size: 32px 32px;
+	background: radial-gradient(circle at 50% 50%, transparent 30%, var(--color-background-deep) 100%);
 	pointer-events: none;
+	opacity: 0.7;
 }
 
-/* Form controls */
+@keyframes aurora-drift {
+	from { transform: translate(0, 0) scale(1); }
+	to   { transform: translate(-2%, 1%) scale(1.05); }
+}
+
+[data-theme="light"] body::before { opacity: 0.85; }
+
+/* Form controls — Aurora-native defaults */
 input, select, textarea {
 	color: var(--color-foreground);
-	background-color: var(--color-background);
-	border-color: var(--color-border);
+	background-color: var(--color-input-bg);
+	border: 1px solid var(--color-rule-strong);
+	border-radius: 0.625rem;
 	font-family: var(--font-sans);
-	transition: border-color 0.2s ease, box-shadow 0.2s ease;
+	transition: border-color 0.2s ease, background-color 0.2s ease, box-shadow 0.2s ease;
+}
+
+/* Default text inputs / search / textarea: comfortable padding.
+   `<input type="checkbox">` and `<input type="radio">` are excluded so
+   they keep their native compact sizing. Any explicit `padding`/`p-*`
+   utility from a callsite still wins. */
+input:not([type="checkbox"]):not([type="radio"]):not([type="range"]):not([type="color"]):not([type="file"]),
+textarea {
+	padding: 0.55rem 0.85rem;
+	font-size: 0.875rem;
+}
+
+select {
+	padding: 0.55rem 2.2rem 0.55rem 0.85rem;
+	font-size: 0.875rem;
+	appearance: none;
+	background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%236f6c92' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'><path d='M6 9l6 6 6-6'/></svg>");
+	background-repeat: no-repeat;
+	background-position: right 0.75rem center;
+	background-size: 12px;
+}
+
+input:hover:not(:focus-visible):not([disabled]),
+select:hover:not(:focus-visible):not([disabled]),
+textarea:hover:not(:focus-visible):not([disabled]) {
+	border-color: var(--color-rule-strong);
+	background-color: var(--color-glass-strong);
 }
 
 input:focus-visible, select:focus-visible, textarea:focus-visible {
 	outline: none;
 	border-color: var(--color-primary);
-	box-shadow: 0 0 0 3px var(--color-glow), 0 0 12px var(--color-glow);
+	box-shadow: 0 0 0 3px var(--color-glow);
 }
 
-button:focus-visible {
+input::placeholder, textarea::placeholder {
+	color: var(--color-muted-foreground);
+}
+
+button:focus-visible, a:focus-visible {
 	outline: 2px solid var(--color-primary);
 	outline-offset: 2px;
-	border-radius: 0.375rem;
+	border-radius: 0.5rem;
 }
 
-a:focus-visible {
-	outline: 2px solid var(--color-primary);
-	outline-offset: 2px;
-	border-radius: 0.375rem;
-}
-
-/* Override browser autofill styles in dark mode */
+/* Override browser autofill in dark mode */
 [data-theme="dark"] input:-webkit-autofill,
 [data-theme="dark"] input:-webkit-autofill:hover,
 [data-theme="dark"] input:-webkit-autofill:focus,
 [data-theme="dark"] select:-webkit-autofill {
-	-webkit-box-shadow: 0 0 0 1000px #13151e inset !important;
-	-webkit-text-fill-color: #e4e6ed !important;
-	caret-color: #e4e6ed;
+	-webkit-box-shadow: 0 0 0 1000px #0d0e1c inset !important;
+	-webkit-text-fill-color: #f3f1ff !important;
+	caret-color: #f3f1ff;
 }
 
-/* Color scheme for native controls */
 [data-theme="dark"] { color-scheme: dark; }
 [data-theme="light"] { color-scheme: light; }
 
 /* Scrollbar styling */
-::-webkit-scrollbar { width: 6px; height: 6px; }
+::-webkit-scrollbar { width: 8px; height: 8px; }
 ::-webkit-scrollbar-track { background: transparent; }
-::-webkit-scrollbar-thumb { background: var(--color-border); border-radius: 3px; }
+::-webkit-scrollbar-thumb { background: var(--color-rule-strong); border-radius: 999px; }
 ::-webkit-scrollbar-thumb:hover { background: var(--color-muted-foreground); }
 
-/* Animations */
+/* === Glass surface utility — used by cards, panels, sidebar === */
+.glass {
+	background: var(--color-glass);
+	backdrop-filter: blur(28px) saturate(160%);
+	-webkit-backdrop-filter: blur(28px) saturate(160%);
+	border: 1px solid var(--color-border);
+	border-radius: 22px;
+	box-shadow: var(--shadow-card);
+	position: relative;
+}
+.glass::after {
+	content: '';
+	position: absolute;
+	inset: 0;
+	border-radius: inherit;
+	pointer-events: none;
+	background: linear-gradient(180deg, var(--color-highlight), transparent 30%);
+	opacity: 0.4;
+}
+.glass-strong {
+	background: var(--color-glass-strong);
+}
+.glass-elev {
+	background: var(--color-glass-elev);
+}
+
+/* Selection */
+::selection { background: var(--color-primary); color: var(--color-primary-foreground); }
+
+/* === Animations === */
 @keyframes fadeSlideIn {
 	from { opacity: 0; }
 	to { opacity: 1; }
@@ -160,6 +309,48 @@ a:focus-visible {
 	to { opacity: 1; }
 }
 
+@keyframes aurora-rise {
+	from { opacity: 0; transform: translateY(14px); }
+	to   { opacity: 1; transform: translateY(0); }
+}
+
+@keyframes aurora-pulse-glow-mint {
+	0%, 100% {
+		box-shadow:
+			0 0 4px color-mix(in srgb, var(--color-mint) 60%, transparent),
+			0 0 0 0 color-mix(in srgb, var(--color-mint) 0%, transparent);
+	}
+	50% {
+		box-shadow:
+			0 0 10px color-mix(in srgb, var(--color-mint) 80%, transparent),
+			0 0 0 4px color-mix(in srgb, var(--color-mint) 25%, transparent);
+	}
+}
+@keyframes aurora-pulse-glow-citrus {
+	0%, 100% {
+		box-shadow:
+			0 0 4px color-mix(in srgb, var(--color-citrus) 60%, transparent),
+			0 0 0 0 color-mix(in srgb, var(--color-citrus) 0%, transparent);
+	}
+	50% {
+		box-shadow:
+			0 0 10px color-mix(in srgb, var(--color-citrus) 80%, transparent),
+			0 0 0 4px color-mix(in srgb, var(--color-citrus) 25%, transparent);
+	}
+}
+@keyframes aurora-pulse-glow-coral {
+	0%, 100% {
+		box-shadow:
+			0 0 4px color-mix(in srgb, var(--color-coral) 60%, transparent),
+			0 0 0 0 color-mix(in srgb, var(--color-coral) 0%, transparent);
+	}
+	50% {
+		box-shadow:
+			0 0 10px color-mix(in srgb, var(--color-coral) 80%, transparent),
+			0 0 0 4px color-mix(in srgb, var(--color-coral) 25%, transparent);
+	}
+}
+
 .animate-fade-slide-in {
 	animation: fadeSlideIn 0.4s ease-out forwards;
 }
@@ -178,10 +369,54 @@ a:focus-visible {
 	animation: countUp 0.5s ease-out both;
 }
 
+.animate-rise {
+	animation: aurora-rise 0.6s cubic-bezier(.2,.7,.2,1) both;
+}
+
 /* Stagger children utility */
 .stagger-children > * {
-	animation: fadeSlideIn 0.4s ease-out forwards;
+	animation: aurora-rise 0.55s cubic-bezier(.2,.7,.2,1) both;
 }
+
+/* === List stack — used by list pages (providers, trackers, configs, etc.) ===
+   Full-bleed rows that stretch to the main column width. Pair with .list-row
+   inside each Card for the 3-zone layout (identity · meta-strip · actions). */
+.list-stack {
+	display: flex;
+	flex-direction: column;
+	gap: 0.75rem;
+}
+
+.list-row {
+	display: flex;
+	align-items: center;
+	gap: 1rem;
+	min-width: 0;
+}
+.list-row__identity {
+	min-width: 0;
+	flex: 0 0 auto;
+	max-width: 28rem;
+}
+@media (max-width: 1023px) {
+	.list-row__identity { flex: 1 1 auto; }
+}
+.list-row__actions {
+	flex-shrink: 0;
+	display: inline-flex;
+	align-items: center;
+	gap: 0.25rem;
+}
+
+/* Secondary text under the name — visible only when meta-strip is hidden
+   (i.e. on narrow screens). On lg+ the meta-strip takes over. */
+.list-row__secondary {
+	display: block;
+}
+@media (min-width: 1024px) {
+	.list-row__secondary { display: none; }
+}
+
 .stagger-children > *:nth-child(1) { animation-delay: 0ms; }
 .stagger-children > *:nth-child(2) { animation-delay: 60ms; }
 .stagger-children > *:nth-child(3) { animation-delay: 120ms; }
@@ -193,10 +428,14 @@ a:focus-visible {
 	font-family: var(--font-mono);
 }
 
+.font-display {
+	font-family: var(--font-display);
+}
+
 /* Card highlight for cross-entity navigation */
 @keyframes cardHighlight {
 	0%, 100% { box-shadow: none; }
-	25%, 75% { box-shadow: 0 0 0 3px var(--color-primary), 0 0 20px color-mix(in srgb, var(--color-primary) 30%, transparent); }
+	25%, 75% { box-shadow: 0 0 0 3px var(--color-primary), 0 0 20px var(--color-glow-strong); }
 }
 
 /* Dim overlay behind highlighted card */
@@ -213,3 +452,105 @@ a:focus-visible {
 .nav-dim-overlay.active {
 	opacity: 1;
 }
+
+/* Live pulse dot — for "live" / armed indicators.
+   Pulse is a self-contained box-shadow glow on the dot. No transform,
+   no pseudo-element — the dot's own bounding box never changes, so
+   ancestors with overflow:hidden can only clip the (decorative) glow,
+   never the dot itself. */
+.aurora-pulse {
+	width: 8px; height: 8px;
+	border-radius: 50%;
+	background: var(--color-mint);
+	display: inline-block;
+	flex-shrink: 0;
+	animation: aurora-pulse-glow-mint 1.6s ease-in-out infinite;
+}
+.aurora-pulse.warn {
+	background: var(--color-citrus);
+	animation-name: aurora-pulse-glow-citrus;
+}
+.aurora-pulse.error {
+	background: var(--color-coral);
+	animation-name: aurora-pulse-glow-coral;
+}
+.aurora-pulse.idle {
+	background: var(--color-muted-foreground);
+	box-shadow: none;
+	opacity: 0.5;
+	animation: none;
+}
+
+/* === Reduced-motion: kill drift, pulses, shimmers, stagger entrances === */
+@media (prefers-reduced-motion: reduce) {
+	body::before { animation: none !important; }
+	.animate-fade-slide-in,
+	.animate-shimmer,
+	.animate-pulse-glow,
+	.animate-count-up,
+	.animate-rise,
+	.stagger-children > *,
+	.aurora-pulse,
+	.aurora-pulse.warn,
+	.aurora-pulse.error {
+		animation: none !important;
+	}
+	.stat-card,
+	.paginator-btn,
+	.signal-row,
+	.provider-row {
+		transition: none !important;
+	}
+	* {
+		scroll-behavior: auto !important;
+	}
+}
+
+/* Shared toggle switch — used by provider config forms, tracking-config
+   extraTrackingFields, and anywhere else we render a boolean field.
+   Kept global so adding a new ConfigField type='toggle' caller doesn't
+   need to copy the CSS into its scoped <style>. */
+.toggle-switch {
+	position: relative;
+	display: inline-flex;
+	align-items: center;
+	cursor: pointer;
+	height: 1.75rem;
+}
+
+.toggle-switch input {
+	position: absolute;
+	opacity: 0;
+	width: 0;
+	height: 0;
+}
+
+.toggle-switch .toggle-track {
+	position: relative;
+	width: 2.5rem;
+	height: 1.375rem;
+	background: var(--color-border);
+	border-radius: 9999px;
+	transition: background 0.2s ease;
+}
+
+.toggle-switch .toggle-track::after {
+	content: '';
+	position: absolute;
+	top: 0.1875rem;
+	left: 0.1875rem;
+	width: 1rem;
+	height: 1rem;
+	background: var(--color-foreground);
+	border-radius: 50%;
+	transition: transform 0.2s ease;
+}
+
+.toggle-switch input:checked + .toggle-track {
+	background: var(--color-primary);
+}
+
+.toggle-switch input:checked + .toggle-track::after {
+	transform: translateX(1.125rem);
+	background: var(--color-primary-foreground);
+}

frontend/src/app.d.ts

@@ -0,0 +1,16 @@
+// Ambient type declarations for SvelteKit + project-level build-time globals.
+
+declare global {
+	/** App version, injected from frontend/package.json at build time. */
+	const __APP_VERSION__: string;
+
+	namespace App {
+		// interface Error {}
+		// interface Locals {}
+		// interface PageData {}
+		// interface PageState {}
+		// interface Platform {}
+	}
+}
+
+export {};

frontend/src/app.html

@@ -5,6 +5,23 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1" />
 		<link rel="icon" type="image/svg+xml" href="/favicon.svg" />
 		<title>Notify Bridge</title>
+		<script>
+			// Resolve theme before first paint to avoid dark→light FOUC on hard reload.
+			(function () {
+				try {
+					var saved = localStorage.getItem('theme');
+					var resolved =
+						saved === 'light' || saved === 'dark'
+							? saved
+							: window.matchMedia('(prefers-color-scheme: dark)').matches
+								? 'dark'
+								: 'light';
+					document.documentElement.setAttribute('data-theme', resolved);
+				} catch (_) {
+					document.documentElement.setAttribute('data-theme', 'light');
+				}
+			})();
+		</script>
 		%sveltekit.head%
 	</head>
 	<body data-sveltekit-preload-data="hover">

frontend/src/lib/api.ts

@@ -2,8 +2,41 @@
  * API client with JWT auth for the Notify Bridge backend.
  */
 
+import { goto } from '$app/navigation';
+
 const API_BASE = '/api';
 
+/**
+ * Thrown when the API client decides to redirect the user to /login (after a
+ * terminal 401). Caller-side `try/catch` blocks can branch on
+ * `instanceof AuthRedirectError` to skip showing an "Unauthorized" snackbar
+ * — the redirect itself is the user-visible signal.
+ */
+export class AuthRedirectError extends Error {
+	constructor() {
+		super('Unauthorized — redirecting to login');
+		this.name = 'AuthRedirectError';
+	}
+}
+
+// Module-level dedupe — a burst of concurrent requests that all get 401 (e.g.
+// the dashboard's parallel cache loads) should only schedule a single
+// `goto('/login')` instead of stacking N navigations.
+let _redirecting = false;
+
+/** Centralised "send the user to /login" path used by both api() and fetchAuth(). */
+function redirectToLogin(): void {
+	if (_redirecting) return;
+	_redirecting = true;
+	clearTokens();
+	if (typeof window !== 'undefined') {
+		// SvelteKit's goto() with replaceState avoids leaving the failed page
+		// in the back-stack (no "back-button to broken view" UX). We don't
+		// reset `_redirecting` — the page about to unmount makes it moot.
+		goto('/login', { replaceState: true });
+	}
+}
+
 /** Normalize a caught error to a user-safe message. */
 export function errMsg(err: unknown, fallback = 'Unexpected error'): string {
 	if (err instanceof Error && err.message) return err.message;
@@ -129,11 +162,11 @@ export async function api<T = any>(
 		}
 
 		if (res.status === 401 && token) {
-			clearTokens();
-			if (typeof window !== 'undefined') {
-				window.location.href = '/login';
-			}
-			throw new Error('Unauthorized');
+			redirectToLogin();
+			// Tagged so the caller's catch can distinguish "we already showed
+			// the user a redirect" from a real authorization failure they
+			// should snackbar.
+			throw new AuthRedirectError();
 		}
 
 		if (res.status === 204) return undefined as T;
@@ -204,9 +237,8 @@ export async function fetchAuth(
 		}
 
 		if (res.status === 401) {
-			clearTokens();
-			if (typeof window !== 'undefined') window.location.href = '/login';
-			throw new ApiError('Unauthorized', 401);
+			redirectToLogin();
+			throw new AuthRedirectError();
 		}
 
 		if (!res.ok) {

frontend/src/lib/components/Button.svelte

@@ -21,10 +21,10 @@
 		class?: string;
 	} = $props();
 
-	const baseClasses = 'inline-flex items-center justify-center gap-1.5 rounded-md text-sm font-medium transition-colors disabled:opacity-50';
+	const baseClasses = 'aurora-btn inline-flex items-center justify-center gap-2 font-medium transition-all disabled:opacity-50 disabled:pointer-events-none';
 	const sizeClasses: Record<string, string> = {
-		sm: 'px-2.5 py-1 text-xs',
-		md: 'px-4 py-2',
+		sm: 'aurora-btn--sm',
+		md: 'aurora-btn--md',
 	};
 	const variantClasses: Record<string, string> = {
 		primary: 'btn-primary',
@@ -49,37 +49,72 @@
 {/if}
 
 <style>
-	.btn-primary {
-		background: var(--color-primary);
-		color: var(--color-primary-foreground);
+	.aurora-btn {
+		border-radius: 12px;
+		letter-spacing: -0.005em;
+		cursor: pointer;
+		font-family: inherit;
+		white-space: nowrap;
 	}
-	.btn-primary:hover:not(:disabled) {
-		opacity: 0.9;
+	.aurora-btn--sm {
+		padding: 0 0.95rem;
+		height: 34px;
+		font-size: 0.82rem;
+	}
+	.aurora-btn--md {
+		padding: 0 1.15rem;
+		height: 40px;
+		font-size: 0.875rem;
 	}
 
+	/* Primary — gradient lavender→orchid pill, the page's main CTA. */
+	.btn-primary {
+		background: linear-gradient(135deg, var(--color-primary), var(--color-orchid));
+		color: white;
+		border: 0;
+		box-shadow:
+			0 6px 20px -8px var(--color-glow-strong),
+			inset 0 1px 0 rgba(255, 255, 255, 0.35);
+		font-weight: 600;
+	}
+	.btn-primary:hover:not(:disabled) {
+		transform: translateY(-1px);
+		box-shadow:
+			0 10px 28px -10px var(--color-glow-strong),
+			inset 0 1px 0 rgba(255, 255, 255, 0.4);
+	}
+	.btn-primary:active:not(:disabled) { transform: translateY(0); }
+
 	.btn-secondary {
-		background: var(--color-muted);
+		background: var(--color-glass-strong);
 		color: var(--color-foreground);
-		border: 1px solid var(--color-border);
+		border: 1px solid var(--color-rule-strong);
 	}
 	.btn-secondary:hover:not(:disabled) {
-		opacity: 0.8;
+		background: var(--color-glass-elev);
+		border-color: var(--color-rule-strong);
 	}
 
 	.btn-danger {
 		background: var(--color-error-fg);
 		color: white;
+		border: 0;
+		font-weight: 600;
+		box-shadow: 0 6px 20px -8px color-mix(in srgb, var(--color-error-fg) 50%, transparent);
 	}
 	.btn-danger:hover:not(:disabled) {
-		opacity: 0.9;
+		transform: translateY(-1px);
+		box-shadow: 0 10px 28px -10px color-mix(in srgb, var(--color-error-fg) 60%, transparent);
 	}
 
 	.btn-ghost {
 		background: transparent;
 		color: var(--color-muted-foreground);
+		border: 1px solid transparent;
 	}
 	.btn-ghost:hover:not(:disabled) {
-		background: var(--color-muted);
+		background: var(--color-glass-strong);
 		color: var(--color-foreground);
+		border-color: var(--color-border);
 	}
 </style>

frontend/src/lib/components/Card.svelte

@@ -1,30 +1,55 @@
 <script lang="ts">
-	let { children, class: className = '', hover = false, entityId = undefined, ...rest } = $props<{
-		children: import('svelte').Snippet;
+	import type { Snippet } from 'svelte';
+
+	interface Props {
+		children: Snippet;
 		class?: string;
 		hover?: boolean;
 		entityId?: number | string;
-		[key: string]: any;
-	}>();
+		[key: string]: unknown;
+	}
+
+	let { children, class: className = '', hover = false, entityId = undefined, ...rest }: Props = $props();
 </script>
 
 <div
 	class="card-component {hover ? 'card-hover' : ''} {className}"
-	style="background: var(--color-card); border: 1px solid var(--color-border); border-radius: 0.75rem; padding: 1.25rem;"
 	data-entity-id={entityId}
 	{...rest}
 >
-	{@render children()}
+	<div class="card-component__inner">
+		{@render children()}
+	</div>
 </div>
 
 <style>
 	.card-component {
-		transition: all 0.25s cubic-bezier(0.4, 0, 0.2, 1);
-		box-shadow: 0 1px 3px rgba(0, 0, 0, 0.04);
+		position: relative;
+		background: var(--color-glass);
+		backdrop-filter: blur(28px) saturate(160%);
+		-webkit-backdrop-filter: blur(28px) saturate(160%);
+		border: 1px solid var(--color-border);
+		border-radius: 22px;
+		box-shadow: var(--shadow-card);
+		transition: transform 0.25s cubic-bezier(0.4, 0, 0.2, 1), border-color 0.25s ease;
+		overflow: hidden;
+	}
+	.card-component::after {
+		content: '';
+		position: absolute;
+		inset: 0;
+		border-radius: inherit;
+		pointer-events: none;
+		background: linear-gradient(180deg, var(--color-highlight), transparent 30%);
+		opacity: 0.4;
+	}
+	.card-component__inner {
+		position: relative;
+		z-index: 1;
+		padding: 1.25rem 1.4rem;
 	}
-
 	.card-hover:hover {
-		border-color: var(--color-primary);
-		box-shadow: 0 4px 16px var(--color-glow), 0 0 0 1px var(--color-glow);
+		border-color: var(--color-rule-strong);
+		transform: translateY(-2px);
 	}
 </style>

frontend/src/lib/components/CollapsibleSlot.svelte

@@ -21,7 +21,7 @@
 	const STATUS_MAP: Record<string, { icon: string; color: string; bg: string }> = {
 		empty: { icon: 'mdiCircleOutline', color: 'var(--color-muted-foreground)', bg: 'transparent' },
 		valid: { icon: 'mdiCheckCircle', color: 'var(--color-success-fg)', bg: 'var(--color-success-bg)' },
-		warning: { icon: 'mdiAlert', color: '#d97706', bg: 'rgba(217, 119, 6, 0.1)' },
+		warning: { icon: 'mdiAlert', color: 'var(--color-warning-fg)', bg: 'var(--color-warning-bg)' },
 		error: { icon: 'mdiAlertCircle', color: 'var(--color-error-fg)', bg: 'var(--color-error-bg)' },
 	};
 	const statusConfig = $derived(STATUS_MAP[status]);

frontend/src/lib/components/EntitySelect.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
 	import MdiIcon from './MdiIcon.svelte';
 	import { t } from '$lib/i18n';
+	import { portal } from '$lib/portal';
 
 	export interface EntityItem {
 		value: string | number;
@@ -19,7 +20,10 @@
 		noneLabel = '—',
 		disabled = false,
 		size = 'default',
+		open = $bindable(false),
+		showTrigger = true,
 		onselect,
+		onclose,
 	}: {
 		items: EntityItem[];
 		value: string | number | null;
@@ -28,14 +32,16 @@
 		noneLabel?: string;
 		disabled?: boolean;
 		size?: 'sm' | 'default';
+		open?: boolean;
+		showTrigger?: boolean;
 		onselect?: (value: string | number | null) => void;
+		onclose?: () => void;
 	} = $props();
 
-	let open = $state(false);
 	let query = $state('');
 	let highlightIdx = $state(0);
-	let inputEl: HTMLInputElement;
-	let listEl: HTMLDivElement;
+	let inputEl = $state<HTMLInputElement | undefined>();
+	let listEl = $state<HTMLDivElement | undefined>();
 
 	const selected = $derived(items.find(i => String(i.value) === String(value)));
 
@@ -51,24 +57,37 @@
 		return [...result, ...matching];
 	});
 
+	// Focus input whenever the palette transitions to open (covers both internal
+	// trigger clicks and external programmatic opening via bind:open).
+	let wasOpen = false;
+	$effect(() => {
+		if (open && !wasOpen) {
+			query = '';
+			highlightIdx = Math.max(0, filtered.findIndex(i => String(i.value) === String(value)));
+			requestAnimationFrame(() => inputEl?.focus());
+		}
+		wasOpen = open;
+	});
+
 	function openPalette() {
 		if (disabled) return;
 		open = true;
-		query = '';
-		highlightIdx = Math.max(0, filtered.findIndex(i => String(i.value) === String(value)));
-		requestAnimationFrame(() => inputEl?.focus());
 	}
 
+	// Called when the user dismisses the palette (overlay click or ESC).
+	// Selection uses its own quiet-close path so onclose stays a true "cancel" signal.
 	function closePalette() {
 		open = false;
 		query = '';
+		onclose?.();
 	}
 
 	function selectItem(item: EntityItem) {
 		if (item.disabled) return;
 		value = item.value || null;
 		onselect?.(value);
-		closePalette();
+		open = false;
+		query = '';
 	}
 
 	function handleKeydown(e: KeyboardEvent) {
@@ -105,71 +124,75 @@
 	});
 </script>
 
-<!-- Trigger button -->
-<button type="button" class="es-trigger" class:es-sm={size === 'sm'} onclick={openPalette}
-	aria-expanded={open}
-	aria-haspopup="listbox"
-	style="opacity: {disabled ? 0.5 : 1}; cursor: {disabled ? 'default' : 'pointer'};">
-	{#if selected}
-		{#if selected.icon}
-			<span class="es-trigger-icon"><MdiIcon name={selected.icon} size={16} /></span>
-		{/if}
-		<span class="es-trigger-label">{selected.label}</span>
-	{:else}
-		<span class="es-trigger-label es-trigger-none">{placeholder}</span>
-	{/if}
-	<span class="es-trigger-arrow"><MdiIcon name="mdiChevronDown" size={14} /></span>
-</button>
-
-<!-- Palette overlay -->
-{#if open}
-	<div class="ep-overlay" onclick={closePalette} role="presentation"></div>
-
-	<div class="ep-container">
-		<div class="ep-search-row">
-			<MdiIcon name="mdiMagnify" size={18} />
-			<input
-				bind:this={inputEl}
-				bind:value={query}
-				placeholder={selected ? selected.label : placeholder}
-				class="ep-input"
-				type="text"
-				autocomplete="off"
-				spellcheck="false"
-				onkeydown={handleKeydown}
-			/>
-			<kbd class="ep-kbd">ESC</kbd>
-		</div>
-
-		<div class="ep-list" bind:this={listEl} role="listbox">
-			{#if filtered.length === 0}
-				<div class="ep-empty">{t('common.noMatches')}</div>
-			{:else}
-				{#each filtered as item, i}
-					<button
-						class="ep-item"
-						class:ep-highlight={i === highlightIdx && !item.disabled}
-						class:ep-current={String(item.value) === String(value)}
-						class:ep-disabled={item.disabled}
-						role="option"
-						aria-selected={String(item.value) === String(value)}
-						aria-disabled={item.disabled || undefined}
-						onclick={() => selectItem(item)}
-						onmouseenter={() => highlightIdx = i}
-						type="button"
-					>
-						{#if item.icon}
-							<span class="ep-item-icon"><MdiIcon name={item.icon} size={18} /></span>
-						{/if}
-						<span class="ep-item-label">{item.label}</span>
-						{#if item.disabled && item.disabledHint}
-							<span class="ep-item-hint">{item.disabledHint}</span>
-						{:else if item.desc}
-							<span class="ep-item-desc">{item.desc}</span>
-						{/if}
-					</button>
-				{/each}
+<!-- Trigger button (hidden when the parent drives `open` via bind:open) -->
+{#if showTrigger}
+	<button type="button" class="es-trigger" class:es-sm={size === 'sm'} onclick={openPalette}
+		aria-expanded={open}
+		aria-haspopup="listbox"
+		style="opacity: {disabled ? 0.5 : 1}; cursor: {disabled ? 'default' : 'pointer'};">
+		{#if selected}
+			{#if selected.icon}
+				<span class="es-trigger-icon"><MdiIcon name={selected.icon} size={16} /></span>
 			{/if}
+			<span class="es-trigger-label">{selected.label}</span>
+		{:else}
+			<span class="es-trigger-label es-trigger-none">{placeholder}</span>
+		{/if}
+		<span class="es-trigger-arrow"><MdiIcon name="mdiChevronDown" size={14} /></span>
+	</button>
+{/if}
+
+<!-- Palette overlay — portalled to <body> to escape backdrop-filter ancestors -->
+{#if open}
+	<div use:portal class="es-portal-root">
+		<div class="ep-overlay" onclick={closePalette} role="presentation"></div>
+
+		<div class="ep-container">
+			<div class="ep-search-row">
+				<MdiIcon name="mdiMagnify" size={18} />
+				<input
+					bind:this={inputEl}
+					bind:value={query}
+					placeholder={selected ? selected.label : placeholder}
+					class="ep-input"
+					type="text"
+					autocomplete="off"
+					spellcheck="false"
+					onkeydown={handleKeydown}
+				/>
+				<kbd class="ep-kbd">ESC</kbd>
+			</div>
+
+			<div class="ep-list" bind:this={listEl} role="listbox">
+				{#if filtered.length === 0}
+					<div class="ep-empty">{t('common.noMatches')}</div>
+				{:else}
+					{#each filtered as item, i}
+						<button
+							class="ep-item"
+							class:ep-highlight={i === highlightIdx && !item.disabled}
+							class:ep-current={String(item.value) === String(value)}
+							class:ep-disabled={item.disabled}
+							role="option"
+							aria-selected={String(item.value) === String(value)}
+							aria-disabled={item.disabled || undefined}
+							onclick={() => selectItem(item)}
+							onmouseenter={() => highlightIdx = i}
+							type="button"
+						>
+							{#if item.icon}
+								<span class="ep-item-icon"><MdiIcon name={item.icon} size={18} /></span>
+							{/if}
+							<span class="ep-item-label">{item.label}</span>
+							{#if item.disabled && item.disabledHint}
+								<span class="ep-item-hint">{item.disabledHint}</span>
+							{:else if item.desc}
+								<span class="ep-item-desc">{item.desc}</span>
+							{/if}
+						</button>
+					{/each}
+				{/if}
+			</div>
 		</div>
 	</div>
 {/if}
@@ -181,23 +204,25 @@
 		align-items: center;
 		gap: 0.5rem;
 		width: 100%;
-		padding: 0.375rem 0.75rem;
-		border: 1px solid var(--color-border);
-		border-radius: 0.375rem;
+		padding: 0.5rem 0.75rem;
+		border: 1px solid var(--color-rule-strong);
+		border-radius: 0.625rem;
 		font-size: 0.875rem;
-		background: var(--color-background);
+		background: var(--color-input-bg);
 		color: var(--color-foreground);
-		transition: border-color 0.15s;
+		transition: border-color 0.15s, background 0.15s;
 		text-align: left;
 		cursor: pointer;
+		font-family: inherit;
 	}
 	.es-trigger.es-sm {
-		padding: 0.25rem 0.5rem;
-		font-size: 0.75rem;
-		gap: 0.375rem;
+		padding: 0.3rem 0.55rem;
+		font-size: 0.8rem;
+		gap: 0.4rem;
 	}
 	.es-trigger:hover {
-		border-color: var(--color-primary);
+		background: var(--color-glass-strong);
+		border-color: var(--color-rule-strong);
 	}
 	.es-trigger-icon {
 		flex-shrink: 0;
@@ -217,41 +242,63 @@
 		color: var(--color-muted-foreground);
 	}
 
-	/* Overlay */
-	.ep-overlay {
+	/* Portal root — escapes any backdrop-filter ancestor */
+	.es-portal-root {
 		position: fixed;
 		inset: 0;
 		z-index: 9998;
-		background: rgba(0, 0, 0, 0.4);
-		backdrop-filter: blur(2px);
+		pointer-events: none;
 	}
 
-	/* Palette container */
+	/* Overlay */
+	.ep-overlay {
+		position: absolute;
+		inset: 0;
+		pointer-events: auto;
+		background: rgba(0, 0, 0, 0.55);
+		backdrop-filter: blur(8px) saturate(120%);
+		-webkit-backdrop-filter: blur(8px) saturate(120%);
+	}
+
+	/* Palette container — high opacity for legibility */
 	.ep-container {
-		position: fixed;
+		pointer-events: auto;
+		position: absolute;
 		top: min(20vh, 120px);
 		left: 50%;
 		transform: translateX(-50%);
-		z-index: 9999;
-		width: min(460px, 90vw);
+		z-index: 1;
+		width: min(480px, 92vw);
 		max-height: 60vh;
-		background: var(--color-card);
-		border: 1px solid var(--color-border);
-		border-radius: 0.75rem;
-		box-shadow: 0 20px 60px rgba(0, 0, 0, 0.4);
+		background: var(--ep-solid-bg);
+		border: 1px solid var(--color-rule-strong);
+		border-radius: 16px;
+		box-shadow: var(--shadow-card), 0 24px 48px -16px rgba(0, 0, 0, 0.55);
 		display: flex;
 		flex-direction: column;
 		overflow: hidden;
+		--ep-solid-bg: #131520;
+	}
+	:global([data-theme="light"]) .ep-container { --ep-solid-bg: #fafafe; }
+	.ep-container::after {
+		content: '';
+		position: absolute; inset: 0;
+		border-radius: inherit;
+		pointer-events: none;
+		background: linear-gradient(180deg, var(--color-highlight), transparent 30%);
+		opacity: 0.4;
 	}
 
 	/* Search row */
 	.ep-search-row {
 		display: flex;
 		align-items: center;
-		gap: 0.5rem;
-		padding: 0.625rem 0.875rem;
+		gap: 0.6rem;
+		padding: 0.85rem 1rem;
 		border-bottom: 1px solid var(--color-border);
 		color: var(--color-muted-foreground);
+		position: relative;
+		z-index: 1;
 	}
 	.ep-input {
 		flex: 1;
@@ -261,25 +308,30 @@
 		font-size: 0.9rem;
 		color: var(--color-foreground);
 		padding: 0;
+		font-family: inherit;
 	}
+	.ep-input::placeholder { color: var(--color-muted-foreground); }
 	.ep-kbd {
-		font-size: 0.55rem;
+		font-size: 0.62rem;
 		font-family: var(--font-mono);
-		padding: 0.1rem 0.3rem;
-		border-radius: 0.2rem;
-		background: var(--color-muted);
-		color: var(--color-muted-foreground);
+		padding: 0.2rem 0.45rem;
+		border-radius: 6px;
+		background: var(--color-glass-strong);
+		color: var(--color-foreground);
 		border: 1px solid var(--color-border);
 	}
 
 	/* List */
 	.ep-list {
 		overflow-y: auto;
+		overscroll-behavior: contain;
 		scrollbar-width: thin;
-		padding: 0.25rem 0;
+		padding: 0.35rem;
+		position: relative;
+		z-index: 1;
 	}
 	.ep-empty {
-		padding: 1rem;
+		padding: 1.25rem;
 		text-align: center;
 		color: var(--color-muted-foreground);
 		font-size: 0.85rem;
@@ -289,20 +341,26 @@
 	.ep-item {
 		display: flex;
 		align-items: center;
-		gap: 0.625rem;
+		gap: 0.65rem;
 		width: 100%;
-		padding: 0.5rem 0.875rem;
-		border: none;
+		padding: 0.55rem 0.75rem;
+		border: 1px solid transparent;
 		background: transparent;
 		color: var(--color-foreground);
-		font-size: 0.875rem;
+		font-size: 0.88rem;
 		cursor: pointer;
 		text-align: left;
-		transition: background 0.1s;
-		border-left: 3px solid transparent;
+		transition: background 0.12s, border-color 0.12s;
+		border-radius: 10px;
+		font-family: inherit;
 	}
 	.ep-item:hover, .ep-item.ep-highlight {
-		background: var(--color-muted);
+		background: rgba(255, 255, 255, 0.06);
+		border-color: var(--color-rule-strong);
+	}
+	:global([data-theme="light"]) .ep-item:hover,
+	:global([data-theme="light"]) .ep-item.ep-highlight {
+		background: rgba(20, 15, 60, 0.05);
 	}
 	.ep-item.ep-disabled {
 		opacity: 0.4;
@@ -310,9 +368,14 @@
 	}
 	.ep-item.ep-disabled:hover {
 		background: transparent;
+		border-color: transparent;
 	}
 	.ep-item.ep-current {
-		border-left-color: var(--color-primary);
+		background: linear-gradient(135deg,
+			color-mix(in srgb, var(--color-primary) 14%, transparent),
+			color-mix(in srgb, var(--color-orchid) 14%, transparent));
+		border-color: color-mix(in srgb, var(--color-primary) 40%, var(--color-border));
+		box-shadow: inset 0 1px 0 var(--color-highlight);
 	}
 	.ep-item-icon {
 		flex-shrink: 0;
@@ -320,19 +383,30 @@
 		align-items: center;
 		justify-content: center;
 		color: var(--color-muted-foreground);
+		width: 28px; height: 28px;
+		border-radius: 8px;
+		background: var(--color-glass-strong);
+		border: 1px solid var(--color-border);
 	}
 	.ep-item.ep-current .ep-item-icon {
 		color: var(--color-primary);
+		background: var(--color-glass-elev);
 	}
 	.ep-item-label {
 		flex: 1;
 		overflow: hidden;
 		text-overflow: ellipsis;
 		white-space: nowrap;
+		font-weight: 500;
 	}
 	.ep-item-desc {
-		font-size: 0.75rem;
+		font-size: 0.7rem;
+		font-family: var(--font-mono);
 		color: var(--color-muted-foreground);
+		padding: 0.12rem 0.5rem;
+		border-radius: 9999px;
+		background: var(--color-glass-strong);
+		border: 1px solid var(--color-border);
 		white-space: nowrap;
 		overflow: hidden;
 		text-overflow: ellipsis;

frontend/src/lib/components/EventChart.svelte

@@ -2,6 +2,7 @@
 	import { t } from '$lib/i18n';
 	import { parseDate } from '$lib/api';
 	import MdiIcon from './MdiIcon.svelte';
+	import { portal } from '$lib/portal';
 
 	interface DayData {
 		date: string;
@@ -13,11 +14,11 @@
 	const EVENT_TYPES = ['assets_added', 'assets_removed', 'collection_renamed', 'collection_deleted', 'sharing_changed'] as const;
 
 	const COLORS: Record<string, string> = {
-		assets_added: '#059669',
-		assets_removed: '#ef4444',
-		collection_renamed: '#6366f1',
-		collection_deleted: '#dc2626',
-		sharing_changed: '#f59e0b',
+		assets_added: 'var(--color-mint)',
+		assets_removed: 'var(--color-coral)',
+		collection_renamed: 'var(--color-primary)',
+		collection_deleted: 'var(--color-error-fg)',
+		sharing_changed: 'var(--color-citrus)',
 	};
 
 	const LABELS: Record<string, string> = {
@@ -128,28 +129,26 @@
 </div>
 
 {#if tooltip}
-	<div
-		class="chart-tooltip"
-		style="position: fixed; left: {tooltip.x}px; top: {tooltip.y}px; z-index: 9999; transform: translate(-50%, -100%) translateY(-8px);"
-	>
-		{#each tooltip.text.split('\n') as line}
-			<div>{line}</div>
-		{/each}
+	<div use:portal>
+		<div
+			class="chart-tooltip"
+			style="position: fixed; left: {tooltip.x}px; top: {tooltip.y}px; z-index: 9999; transform: translate(-50%, -100%) translateY(-8px);"
+		>
+			{#each tooltip.text.split('\n') as line}
+				<div>{line}</div>
+			{/each}
+		</div>
 	</div>
 {/if}
 
 <style>
 	.chart-wrapper {
-		background: var(--color-card);
-		border: 1px solid var(--color-border);
-		border-radius: 0.75rem;
-		padding: 1.25rem;
-		margin-bottom: 1.5rem;
-		transition: border-color 0.2s;
-	}
-	.chart-wrapper:hover {
-		border-color: var(--color-primary);
-		box-shadow: 0 0 16px var(--color-glow);
+		/* Outer chrome lives on the parent panel — keep this transparent so
+		   we don't get a double border / nested card look. */
+		background: transparent;
+		border: 0;
+		padding: 0;
+		margin-bottom: 0;
 	}
 	.chart-header {
 		display: flex;
@@ -248,16 +247,21 @@
 		border-radius: 50%;
 		flex-shrink: 0;
 	}
-	.chart-tooltip {
-		background: var(--color-card);
-		border: 1px solid var(--color-border);
-		border-radius: 0.5rem;
-		padding: 0.5rem 0.75rem;
-		font-size: 0.7rem;
+	/* Tooltip is portalled to <body>, so use :global to make the style
+	   apply regardless of DOM location. */
+	:global(.chart-tooltip) {
+		--ct-solid-bg: #131520;
+		background: var(--ct-solid-bg);
+		color: var(--color-foreground);
+		border: 1px solid var(--color-rule-strong);
+		border-radius: 10px;
+		padding: 0.55rem 0.8rem;
+		font-size: 0.72rem;
 		font-family: var(--font-mono);
-		box-shadow: 0 4px 16px rgba(0, 0, 0, 0.2);
+		box-shadow: var(--shadow-card), 0 8px 24px -8px rgba(0, 0, 0, 0.5);
 		pointer-events: none;
 		white-space: nowrap;
 		line-height: 1.5;
 	}
+	:global([data-theme="light"] .chart-tooltip) { --ct-solid-bg: #fafafe; }
 </style>

frontend/src/lib/components/EventDetailModal.svelte

@@ -0,0 +1,457 @@
+<script lang="ts">
+	import { goto } from '$app/navigation';
+	import { t } from '$lib/i18n';
+	import type { EventLog } from '$lib/types';
+	import { requestHighlight } from '$lib/highlight';
+	import Modal from './Modal.svelte';
+	import MdiIcon from './MdiIcon.svelte';
+
+	interface Props {
+		event: EventLog | null;
+		onclose: () => void;
+	}
+	let { event, onclose }: Props = $props();
+
+	// Retain the last non-null event so the modal body stays populated
+	// while the close transition plays after the parent clears `event`.
+	let displayEvent = $state<EventLog | null>(null);
+	$effect(() => {
+		if (event) displayEvent = event;
+	});
+
+	function fmtDateTime(iso: string): string {
+		try {
+			const d = new Date(iso);
+			return d.toLocaleString();
+		} catch {
+			return iso;
+		}
+	}
+
+	/** Humanize a duration in seconds into ``Xd Yh`` / ``Xh Ym`` / ``Xm`` / ``Xs``.
+	 *
+	 * Used by the deferred-dispatch lifecycle banner to render
+	 * ``deferred_for_seconds`` ("held for 8h 23m") rather than an opaque
+	 * integer that the user has to mentally divide. Keeps two units so
+	 * the magnitude reads correctly across hours-long quiet windows
+	 * without becoming noisy for short ones. */
+	function humanDuration(totalSeconds: number): string {
+		if (!Number.isFinite(totalSeconds) || totalSeconds < 0) return '';
+		if (totalSeconds < 60) return `${Math.floor(totalSeconds)}s`;
+		const minutes = Math.floor(totalSeconds / 60);
+		if (minutes < 60) return `${minutes}m`;
+		const hours = Math.floor(minutes / 60);
+		const remMin = minutes % 60;
+		if (hours < 24) return remMin ? `${hours}h ${remMin}m` : `${hours}h`;
+		const days = Math.floor(hours / 24);
+		const remHours = hours % 24;
+		return remHours ? `${days}d ${remHours}h` : `${days}d`;
+	}
+
+	/** Render an absolute ISO timestamp as a future-relative string.
+	 *
+	 * "in 8h 23m" / "in 12m". Returns an empty string for past times — the
+	 * deferred-until banner shouldn't show a relative offset once the
+	 * window has already ended (a follow-up event_log row marks delivery).
+	 */
+	function timeFromNow(iso: string | undefined): string {
+		if (!iso) return '';
+		try {
+			const target = new Date(iso).getTime();
+			const diff = Math.floor((target - Date.now()) / 1000);
+			if (diff <= 0) return '';
+			return humanDuration(diff);
+		} catch {
+			return '';
+		}
+	}
+
+	function issuerLabel(issuer: { id?: number; username?: string; first_name?: string; last_name?: string } | undefined): string {
+		if (!issuer) return '';
+		if (issuer.username) return '@' + issuer.username;
+		const name = [issuer.first_name, issuer.last_name].filter(Boolean).join(' ');
+		if (name) return name;
+		if (issuer.id) return 'id ' + issuer.id;
+		return '';
+	}
+
+	/** Navigate to a list page and highlight the specific entity card.
+	 *
+	 * The destination page calls ``highlightFromUrl()`` after data loads,
+	 * which scrolls to and pulses the card with ``data-entity-id={id}``.
+	 * Same mechanism CrossLink uses elsewhere — keeps the UX consistent. */
+	function openEntity(path: string, entityId: number | string | null | undefined) {
+		if (entityId != null) requestHighlight(entityId);
+		onclose();
+		goto(path);
+	}
+
+	const issuer = $derived(displayEvent?.details?.issuer as { id?: number; username?: string; first_name?: string; last_name?: string } | undefined);
+	const issuerText = $derived(issuerLabel(issuer));
+
+	const isCommand = $derived(displayEvent?.event_type?.startsWith('command_') ?? false);
+	const isAction = $derived(displayEvent?.event_type?.startsWith('action_') ?? false);
+
+	const detailsJson = $derived.by(() => {
+		if (!displayEvent?.details) return '';
+		try {
+			return JSON.stringify(displayEvent.details, null, 2);
+		} catch {
+			return String(displayEvent.details);
+		}
+	});
+</script>
+
+<Modal open={event !== null} title={displayEvent ? t('events.detailTitle') : ''} {onclose}>
+	{#if displayEvent}
+		<div class="event-detail">
+			<!-- Subject + verb -->
+			<div class="hero-row">
+				<MdiIcon name="mdiBell" size={18} />
+				<div>
+					<div class="hero-subject">{displayEvent.collection_name || displayEvent.event_type}</div>
+					<div class="hero-meta">
+						<span class="event-type">{displayEvent.event_type}</span>
+						<span class="dot">·</span>
+						<span>{fmtDateTime(displayEvent.created_at)}</span>
+					</div>
+				</div>
+			</div>
+
+			<!-- Dispatch lifecycle (only when the event went through the
+			     quiet-hours defer path). Rendered ABOVE the provenance grid
+			     because timing of delivery is more interesting than the
+			     bot/tracker names when the event is held back. -->
+			{#if displayEvent.details?.dispatch_status === 'deferred'}
+				<section class="lifecycle lifecycle--deferred">
+					<MdiIcon name="mdiPauseCircleOutline" size={18} />
+					<div class="lifecycle-body">
+						<div class="lifecycle-title">{t('events.lifecycle.heldTitle')}</div>
+						<div class="lifecycle-detail">
+							{t('events.lifecycle.heldUntil')}
+							<b>{fmtDateTime(displayEvent.details.deferred_until ?? '')}</b>
+							{#if timeFromNow(displayEvent.details.deferred_until)}
+								<span class="lifecycle-rel">· {t('events.lifecycle.inPrefix')} {timeFromNow(displayEvent.details.deferred_until)}</span>
+							{/if}
+						</div>
+						<div class="lifecycle-hint">{t('events.lifecycle.heldHint')}</div>
+					</div>
+				</section>
+			{:else if displayEvent.details?.dispatch_status === 'delivered_after_quiet_hours'}
+				<section class="lifecycle lifecycle--late">
+					<MdiIcon name="mdiClockCheckOutline" size={18} />
+					<div class="lifecycle-body">
+						<div class="lifecycle-title">{t('events.lifecycle.deliveredLateTitle')}</div>
+						{#if displayEvent.details.deferred_for_seconds != null}
+							<div class="lifecycle-detail">
+								{t('events.lifecycle.heldFor')}
+								<b>{humanDuration(displayEvent.details.deferred_for_seconds)}</b>
+							</div>
+						{/if}
+						{#if displayEvent.details.original_event_log_id}
+							<div class="lifecycle-hint">
+								{t('events.lifecycle.originalEvent')} #{displayEvent.details.original_event_log_id}
+							</div>
+						{/if}
+					</div>
+				</section>
+			{:else if displayEvent.details?.dispatch_status === 'deferred_then_dropped'}
+				<section class="lifecycle lifecycle--dropped">
+					<MdiIcon name="mdiCloseCircleOutline" size={18} />
+					<div class="lifecycle-body">
+						<div class="lifecycle-title">{t('events.lifecycle.droppedTitle')}</div>
+						{#if displayEvent.details.reason}
+							<div class="lifecycle-detail">
+								{t('events.lifecycle.reason')}:
+								<code class="lifecycle-reason">{displayEvent.details.reason}</code>
+							</div>
+						{/if}
+						{#if displayEvent.details.original_event_log_id}
+							<div class="lifecycle-hint">
+								{t('events.lifecycle.originalEvent')} #{displayEvent.details.original_event_log_id}
+							</div>
+						{/if}
+					</div>
+				</section>
+			{:else if displayEvent.details?.dispatch_status === 'deferred_then_failed'}
+				<section class="lifecycle lifecycle--dropped">
+					<MdiIcon name="mdiAlertCircleOutline" size={18} />
+					<div class="lifecycle-body">
+						<div class="lifecycle-title">{t('events.lifecycle.failedTitle')}</div>
+						{#if displayEvent.details.reason}
+							<div class="lifecycle-detail">
+								{t('events.lifecycle.reason')}:
+								<code class="lifecycle-reason">{displayEvent.details.reason}</code>
+							</div>
+						{/if}
+						{#if displayEvent.details.original_event_log_id}
+							<div class="lifecycle-hint">
+								{t('events.lifecycle.originalEvent')} #{displayEvent.details.original_event_log_id}
+							</div>
+						{/if}
+					</div>
+				</section>
+			{:else if displayEvent.details?.dispatch_status === 'suppressed_quiet_hours_nondeferrable'}
+				<section class="lifecycle lifecycle--dropped">
+					<MdiIcon name="mdiVolumeOff" size={18} />
+					<div class="lifecycle-body">
+						<div class="lifecycle-title">{t('events.lifecycle.suppressedTitle')}</div>
+						<div class="lifecycle-hint">{t('events.lifecycle.suppressedHint')}</div>
+					</div>
+				</section>
+			{/if}
+
+			<!-- Provenance grid -->
+			<dl class="provenance">
+				{#if displayEvent.bot_name}
+					<dt>{t('events.bot')}</dt>
+					<dd>{displayEvent.bot_name}</dd>
+				{/if}
+				{#if displayEvent.collection_id && isCommand}
+					<dt>{t('events.chat')}</dt>
+					<dd class="font-mono">{displayEvent.collection_id}</dd>
+				{/if}
+				{#if issuerText}
+					<dt>{t('events.issuer')}</dt>
+					<dd>
+						{issuerText}
+						{#if issuer?.id}<span class="muted font-mono">(id {issuer.id})</span>{/if}
+					</dd>
+				{/if}
+				{#if displayEvent.command_tracker_name}
+					<dt>{t('events.commandTracker')}</dt>
+					<dd>{displayEvent.command_tracker_name}</dd>
+				{/if}
+				{#if displayEvent.tracker_name}
+					<dt>{t('events.tracker')}</dt>
+					<dd>{displayEvent.tracker_name}</dd>
+				{/if}
+				{#if displayEvent.action_name}
+					<dt>{t('events.action')}</dt>
+					<dd>{displayEvent.action_name}</dd>
+				{/if}
+				{#if displayEvent.provider_name}
+					<dt>{t('events.provider')}</dt>
+					<dd>{displayEvent.provider_name}</dd>
+				{/if}
+				{#if displayEvent.assets_count > 0}
+					<dt>{t('events.assetsCount')}</dt>
+					<dd class="font-mono">{displayEvent.assets_count}</dd>
+				{/if}
+			</dl>
+
+			<!-- Action buttons — deep-link + highlight the related entity card.
+			     IDs are snapshotted into local consts so the deferred onclick
+			     closures don't lose the narrowed type that the `{#if ...}` gate
+			     proves at template-render time. -->
+			<div class="actions">
+				{#if displayEvent.provider_id}
+					{@const providerId = displayEvent.provider_id}
+					<button type="button" onclick={() => openEntity('/providers', providerId)}>
+						<MdiIcon name="mdiServer" size={14} />
+						{t('events.openProvider')}
+					</button>
+				{/if}
+				{#if displayEvent.telegram_bot_id && isCommand}
+					{@const botId = displayEvent.telegram_bot_id}
+					<button type="button" onclick={() => openEntity('/bots', botId)}>
+						<MdiIcon name="mdiRobotHappy" size={14} />
+						{t('events.openBot')}
+					</button>
+				{/if}
+				{#if displayEvent.command_tracker_id && isCommand}
+					{@const cmdTrackerId = displayEvent.command_tracker_id}
+					<button type="button" onclick={() => openEntity('/command-trackers', cmdTrackerId)}>
+						<MdiIcon name="mdiChat" size={14} />
+						{t('events.openCommandTracker')}
+					</button>
+				{/if}
+				{#if displayEvent.action_id && isAction}
+					{@const actionId = displayEvent.action_id}
+					<button type="button" onclick={() => openEntity('/actions', actionId)}>
+						<MdiIcon name="mdiPlayCircle" size={14} />
+						{t('events.openAction')}
+					</button>
+				{/if}
+				{#if !isCommand && !isAction && displayEvent.tracker_id}
+					{@const trackerId = displayEvent.tracker_id}
+					<button type="button" onclick={() => openEntity('/notification-trackers', trackerId)}>
+						<MdiIcon name="mdiRadar" size={14} />
+						{t('events.openTracker')}
+					</button>
+				{/if}
+			</div>
+
+			<!-- Raw details JSON (always rendered — frequently the most useful piece) -->
+			{#if detailsJson && detailsJson !== '{}'}
+				<details class="raw-details" open={isCommand}>
+					<summary>{t('events.rawDetails')}</summary>
+					<pre>{detailsJson}</pre>
+				</details>
+			{/if}
+		</div>
+	{/if}
+</Modal>
+
+<style>
+	.event-detail {
+		display: flex; flex-direction: column; gap: 1.1rem;
+	}
+	.hero-row {
+		display: flex; align-items: flex-start; gap: 0.75rem;
+	}
+	.hero-subject {
+		font-family: var(--font-display);
+		font-size: 1.05rem;
+		font-weight: 500;
+		color: var(--color-foreground);
+		line-height: 1.3;
+		word-break: break-word;
+	}
+	.hero-meta {
+		font-size: 0.7rem;
+		color: var(--color-muted-foreground);
+		margin-top: 0.25rem;
+		display: flex; align-items: center; gap: 0.4rem;
+	}
+	.event-type {
+		font-family: var(--font-mono);
+		padding: 0.1rem 0.4rem;
+		border-radius: 0.35rem;
+		background: color-mix(in oklab, var(--color-foreground) 6%, transparent);
+		color: var(--color-foreground);
+	}
+	.dot { opacity: 0.5; }
+
+	.provenance {
+		display: grid;
+		grid-template-columns: max-content 1fr;
+		gap: 0.45rem 1rem;
+		margin: 0;
+		padding: 0.85rem 0.95rem;
+		border-radius: 0.7rem;
+		background: color-mix(in oklab, var(--color-foreground) 4%, transparent);
+		font-size: 0.82rem;
+	}
+	.provenance dt {
+		color: var(--color-muted-foreground);
+		font-size: 0.7rem;
+		text-transform: uppercase;
+		letter-spacing: 0.04em;
+		align-self: center;
+	}
+	.provenance dd {
+		margin: 0;
+		color: var(--color-foreground);
+		word-break: break-word;
+	}
+	.muted { color: var(--color-muted-foreground); margin-left: 0.35rem; font-size: 0.75rem; }
+
+	.actions {
+		display: flex; flex-wrap: wrap; gap: 0.5rem;
+	}
+	.actions button {
+		display: inline-flex; align-items: center; gap: 0.4rem;
+		padding: 0.45rem 0.8rem;
+		font-size: 0.78rem;
+		color: var(--color-foreground);
+		background: color-mix(in oklab, var(--color-primary) 10%, transparent);
+		border: 1px solid color-mix(in oklab, var(--color-primary) 25%, transparent);
+		border-radius: 0.55rem;
+		cursor: pointer;
+		transition: background 150ms, border-color 150ms;
+	}
+	.actions button:hover {
+		background: color-mix(in oklab, var(--color-primary) 18%, transparent);
+		border-color: color-mix(in oklab, var(--color-primary) 40%, transparent);
+	}
+
+	.raw-details summary {
+		font-size: 0.75rem;
+		color: var(--color-muted-foreground);
+		cursor: pointer;
+		user-select: none;
+	}
+	.raw-details summary:hover { color: var(--color-foreground); }
+	.raw-details pre {
+		margin: 0.55rem 0 0;
+		padding: 0.7rem 0.85rem;
+		font-family: var(--font-mono);
+		font-size: 0.72rem;
+		line-height: 1.5;
+		color: var(--color-foreground);
+		background: color-mix(in oklab, var(--color-foreground) 6%, transparent);
+		border-radius: 0.55rem;
+		overflow-x: auto;
+		white-space: pre-wrap;
+		word-break: break-word;
+	}
+	.font-mono { font-family: var(--font-mono); }
+
+	/* Dispatch lifecycle banner — appears only when the event took the
+	 * quiet-hours defer path. The three colour variants mirror the dashboard
+	 * badge palette: primary glow for "held", success for "delivered late",
+	 * muted/dim for "dropped" / "failed" / "suppressed".
+	 */
+	.lifecycle {
+		display: flex; align-items: flex-start; gap: 0.7rem;
+		padding: 0.75rem 0.95rem;
+		border-radius: 0.7rem;
+		border: 1px solid var(--color-border);
+		background: color-mix(in oklab, var(--color-foreground) 4%, transparent);
+		font-size: 0.82rem;
+	}
+	.lifecycle-body {
+		display: flex; flex-direction: column; gap: 0.2rem;
+		flex: 1; min-width: 0;
+	}
+	.lifecycle-title {
+		font-weight: 600;
+		color: var(--color-foreground);
+	}
+	.lifecycle-detail {
+		color: var(--color-foreground);
+	}
+	.lifecycle-detail b {
+		font-family: var(--font-mono);
+		font-weight: 600;
+	}
+	.lifecycle-rel {
+		color: var(--color-muted-foreground);
+		font-family: var(--font-mono);
+		font-size: 0.75rem;
+		margin-left: 0.25rem;
+	}
+	.lifecycle-hint {
+		color: var(--color-muted-foreground);
+		font-size: 0.72rem;
+	}
+	.lifecycle-reason {
+		font-family: var(--font-mono);
+		font-size: 0.75rem;
+		padding: 0.05rem 0.35rem;
+		border-radius: 0.3rem;
+		background: color-mix(in oklab, var(--color-foreground) 8%, transparent);
+		word-break: break-all;
+	}
+	.lifecycle--deferred {
+		border-color: color-mix(in srgb, var(--color-primary) 35%, transparent);
+		background: color-mix(in srgb, var(--color-primary) 8%, transparent);
+	}
+	.lifecycle--deferred :global(svg) {
+		color: var(--color-primary);
+	}
+	.lifecycle--late {
+		border-color: color-mix(in srgb, var(--color-success, #16a34a) 35%, transparent);
+		background: color-mix(in srgb, var(--color-success, #16a34a) 8%, transparent);
+	}
+	.lifecycle--late :global(svg) {
+		color: var(--color-success, #16a34a);
+	}
+	.lifecycle--dropped {
+		opacity: 0.92;
+	}
+	.lifecycle--dropped :global(svg) {
+		color: var(--color-muted-foreground);
+	}
+</style>

frontend/src/lib/components/Hint.svelte

@@ -1,8 +1,11 @@
 <script lang="ts">
+	import { portal } from '$lib/portal';
+
 	let { text = '' } = $props<{ text: string }>();
 	let visible = $state(false);
 	let tooltipStyle = $state('');
-	let btnEl: HTMLButtonElement;
+	let btnEl = $state<HTMLButtonElement | undefined>();
+	const tooltipId = `hint-${Math.random().toString(36).slice(2, 9)}`;
 
 	function show() {
 		if (!btnEl) return;
@@ -12,7 +15,7 @@
 		let left = rect.left + rect.width / 2 - tooltipWidth / 2;
 		if (left < 8) left = 8;
 		if (left + tooltipWidth > window.innerWidth - 8) left = window.innerWidth - tooltipWidth - 8;
-		tooltipStyle = `position:fixed; z-index:99999; bottom:${window.innerHeight - rect.top + 8}px; left:${left}px; width:${tooltipWidth}px;`;
+		tooltipStyle = `position:fixed; z-index:9999; bottom:${window.innerHeight - rect.top + 8}px; left:${left}px; width:${tooltipWidth}px;`;
 	}
 
 	function hide() {
@@ -21,9 +24,7 @@
 </script>
 
 <button type="button" bind:this={btnEl}
-	class="inline-flex items-center justify-center w-4 h-4 rounded-full text-[11px] font-bold leading-none
-		border border-[var(--color-border)] bg-[var(--color-muted)] text-[var(--color-muted-foreground)]
-		hover:bg-[var(--color-border)] hover:text-[var(--color-foreground)]
+	class="hint-btn inline-flex items-center justify-center w-4 h-4 rounded-full text-[11px] font-bold leading-none
 		focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[var(--color-primary)]
 		transition-colors cursor-help align-middle ml-2 flex-shrink-0"
 	onmouseenter={show}
@@ -31,12 +32,41 @@
 	onfocus={show}
 	onblur={hide}
 	aria-label={text}
+	aria-describedby={visible ? tooltipId : undefined}
 	title={text}
 	tabindex="0"
 >?</button>
 
 {#if visible}
-	<div role="tooltip" style="{tooltipStyle} background:var(--color-card); color:var(--color-foreground); border:1px solid var(--color-border); box-shadow:0 10px 30px rgba(0,0,0,0.3); padding:0.625rem 0.75rem; border-radius:0.5rem; font-size:0.8125rem; white-space:normal; line-height:1.625; pointer-events:none;">
-		{text}
+	<div use:portal>
+		<div id={tooltipId} role="tooltip" style={tooltipStyle} class="hint-tooltip">
+			{text}
+		</div>
 	</div>
 {/if}
+
+<style>
+	.hint-btn {
+		border: 1px solid var(--color-border);
+		background: var(--color-glass-strong);
+		color: var(--color-muted-foreground);
+	}
+	.hint-btn:hover {
+		background: var(--color-glass-elev);
+		color: var(--color-foreground);
+		border-color: var(--color-rule-strong);
+	}
+	.hint-tooltip {
+		background: var(--hint-solid-bg, #131520);
+		color: var(--color-foreground);
+		border: 1px solid var(--color-rule-strong);
+		box-shadow: var(--shadow-card), 0 12px 30px -10px rgba(0, 0, 0, 0.5);
+		padding: 0.7rem 0.85rem;
+		border-radius: 12px;
+		font-size: 0.8125rem;
+		white-space: normal;
+		line-height: 1.55;
+		pointer-events: none;
+	}
+	:global([data-theme="light"]) .hint-tooltip { --hint-solid-bg: #fafafe; }
+</style>

frontend/src/lib/components/IconGridSelect.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
 	import MdiIcon from './MdiIcon.svelte';
 	import { t } from '$lib/i18n';
+	import { portal } from '$lib/portal';
 
 	export interface GridItem {
 		value: string | number;
@@ -16,6 +17,7 @@
 		columns = 2,
 		disabled = false,
 		compact = false,
+		onChange,
 	}: {
 		items: GridItem[];
 		value: string | number | null;
@@ -23,12 +25,19 @@
 		columns?: number;
 		disabled?: boolean;
 		compact?: boolean;
+		/**
+		 * Optional one-way change callback. Fired in addition to updating
+		 * `value` so callers that own state externally (e.g. a global store)
+		 * can avoid the read-modify-write feedback loop that `bind:value` plus
+		 * a sync `$effect` produces.
+		 */
+		onChange?: (value: string | number) => void;
 	} = $props();
 
 	let open = $state(false);
 	let search = $state('');
-	let triggerEl: HTMLButtonElement;
-	let searchEl: HTMLInputElement;
+	let triggerEl = $state<HTMLButtonElement | undefined>();
+	let searchEl = $state<HTMLInputElement | undefined>();
 	let popupStyle = $state('');
 
 	const showSearch = $derived(items.length > 4);
@@ -62,6 +71,7 @@
 		value = item.value;
 		open = false;
 		search = '';
+		onChange?.(item.value);
 	}
 
 	function handleKeydown(e: KeyboardEvent) {
@@ -90,36 +100,39 @@
 </button>
 
 {#if open}
-	<!-- Backdrop -->
-	<div style="position:fixed; top:0; left:0; right:0; bottom:0; z-index:9998;"
-		role="presentation" onclick={() => open = false}></div>
+	<!-- Backdrop + popup are portalled to <body> so they escape any
+	     backdrop-filter / transform ancestor that would otherwise act
+	     as the containing block for `position: fixed`. -->
+	<div use:portal class="icon-grid-portal-root">
+		<div class="icon-grid-backdrop"
+			role="presentation" onclick={() => open = false}></div>
 
-	<!-- Popup grid -->
-	<div style="{popupStyle} width: {columns * 160 + 16}px;"
-		class="icon-grid-popup">
-		{#if showSearch}
-			<input bind:this={searchEl} bind:value={search} placeholder="Filter..."
-				class="icon-grid-search" type="text" autocomplete="off"
-				onkeydown={handleKeydown} />
-		{/if}
-		<div class="icon-grid" style="grid-template-columns: repeat({columns}, 1fr);" role="listbox">
-			{#each filtered as item}
-				<button type="button"
-					class="icon-grid-cell"
-					class:active={String(item.value) === String(value)}
-					role="option"
-					aria-selected={String(item.value) === String(value)}
-					onclick={() => select(item)}>
-					<span class="icon-grid-cell-icon"><MdiIcon name={item.icon} size={22} /></span>
-					<span class="icon-grid-cell-label">{item.label}</span>
-					{#if item.desc}
-						<span class="icon-grid-cell-desc">{item.desc}</span>
-					{/if}
-				</button>
-			{/each}
-			{#if filtered.length === 0}
-				<div class="icon-grid-empty" style="grid-column: 1 / -1; text-align: center; padding: 0.75rem; color: var(--color-muted-foreground); font-size: 0.75rem;">{t('common.noMatches')}</div>
+		<div style="{popupStyle} width: {columns * 160 + 16}px;"
+			class="icon-grid-popup">
+			{#if showSearch}
+				<input bind:this={searchEl} bind:value={search} placeholder="Filter..."
+					class="icon-grid-search" type="text" autocomplete="off"
+					onkeydown={handleKeydown} />
 			{/if}
+			<div class="icon-grid" style="grid-template-columns: repeat({columns}, 1fr);" role="listbox">
+				{#each filtered as item}
+					<button type="button"
+						class="icon-grid-cell"
+						class:active={String(item.value) === String(value)}
+						role="option"
+						aria-selected={String(item.value) === String(value)}
+						onclick={() => select(item)}>
+						<span class="icon-grid-cell-icon"><MdiIcon name={item.icon} size={22} /></span>
+						<span class="icon-grid-cell-label">{item.label}</span>
+						{#if item.desc}
+							<span class="icon-grid-cell-desc">{item.desc}</span>
+						{/if}
+					</button>
+				{/each}
+				{#if filtered.length === 0}
+					<div class="icon-grid-empty">{t('common.noMatches')}</div>
+				{/if}
+			</div>
 		</div>
 	</div>
 {/if}
@@ -132,20 +145,21 @@
 		width: 100%;
 		padding: 0.5rem 0.75rem;
 		border: 1px solid var(--color-border);
-		border-radius: 0.375rem;
+		border-radius: 0.625rem;
 		font-size: 0.875rem;
-		background: var(--color-background);
+		background: var(--color-input-bg);
 		color: var(--color-foreground);
-		transition: border-color 0.15s, box-shadow 0.15s;
+		transition: border-color 0.15s, box-shadow 0.15s, background 0.15s;
 		text-align: left;
 	}
 	.icon-grid-trigger:hover:not(.disabled) {
-		border-color: var(--color-primary);
+		border-color: var(--color-rule-strong);
+		background: var(--color-glass-strong);
 	}
 	.icon-grid-compact {
-		padding: 0.25rem 0.5rem;
+		padding: 0.3rem 0.55rem;
 		gap: 0.3rem;
-		font-size: 0.875rem;
+		font-size: 0.85rem;
 	}
 	.icon-grid-compact .icon-grid-trigger-label {
 		flex: none;
@@ -165,57 +179,94 @@
 		color: var(--color-muted-foreground);
 		transition: transform 0.15s;
 	}
+
+	/* Portal root — drains the popup out of any backdrop-filter ancestor.
+	   Position: fixed isolates the stacking context at the root level. */
+	.icon-grid-portal-root {
+		position: fixed;
+		inset: 0;
+		z-index: 9998;
+		pointer-events: none;
+	}
+	.icon-grid-backdrop {
+		position: absolute;
+		inset: 0;
+		pointer-events: auto;
+	}
 	.icon-grid-popup {
-		background: var(--color-card);
-		border: 1px solid var(--color-border);
-		border-radius: 0.5rem;
-		box-shadow: 0 10px 30px rgba(0,0,0,0.3);
+		pointer-events: auto;
+		/* Solid surface — popups need legibility, not glass translucency. */
+		--igs-solid-bg: #131520;
+		background: var(--igs-solid-bg);
+		border: 1px solid var(--color-rule-strong);
+		border-radius: 14px;
+		box-shadow: var(--shadow-card), 0 24px 48px -16px rgba(0, 0, 0, 0.55);
 		padding: 0.5rem;
 		max-height: 320px;
 		overflow-y: auto;
+		overscroll-behavior: contain;
 		scrollbar-width: thin;
 	}
+	:global([data-theme="light"]) .icon-grid-popup { --igs-solid-bg: #fafafe; }
+	.icon-grid-popup::after {
+		content: '';
+		position: absolute;
+		inset: 0;
+		border-radius: inherit;
+		pointer-events: none;
+		background: linear-gradient(180deg, var(--color-highlight), transparent 30%);
+		opacity: 0.4;
+	}
 	.icon-grid-search {
 		width: 100%;
-		padding: 0.375rem 0.5rem;
-		margin-bottom: 0.375rem;
-		border: none;
-		border-bottom: 1px solid var(--color-border);
-		border-radius: 0;
-		background: transparent;
+		padding: 0.45rem 0.6rem;
+		margin-bottom: 0.4rem;
+		border: 1px solid var(--color-border);
+		border-radius: 8px;
+		background: var(--color-glass-strong);
 		color: var(--color-foreground);
 		font-size: 0.8rem;
 		outline: none;
+		font-family: inherit;
+	}
+	.icon-grid-search:focus {
+		border-color: var(--color-primary);
+		box-shadow: 0 0 0 2px var(--color-glow);
 	}
 	.icon-grid {
 		display: grid;
 		gap: 0.375rem;
+		position: relative;
+		z-index: 1;
 	}
 	.icon-grid-cell {
 		display: flex;
 		flex-direction: column;
 		align-items: center;
-		gap: 0.25rem;
-		padding: 0.625rem 0.375rem;
-		border-radius: 0.375rem;
-		border: 2px solid transparent;
+		gap: 0.3rem;
+		padding: 0.7rem 0.45rem;
+		border-radius: 10px;
+		border: 1px solid transparent;
 		background: transparent;
 		color: var(--color-foreground);
 		cursor: pointer;
 		transition: all 0.15s;
 		text-align: center;
+		font-family: inherit;
 	}
 	.icon-grid-cell:hover {
-		background: var(--color-muted);
-		transform: scale(1.03);
+		background: var(--color-glass-strong);
+		border-color: var(--color-border);
 	}
 	.icon-grid-cell.active {
+		background: linear-gradient(135deg, color-mix(in srgb, var(--color-primary) 18%, transparent), color-mix(in srgb, var(--color-orchid) 18%, transparent));
 		border-color: var(--color-primary);
-		background: color-mix(in srgb, var(--color-primary) 10%, transparent);
+		box-shadow: inset 0 1px 0 var(--color-highlight), 0 0 0 1px color-mix(in srgb, var(--color-primary) 40%, transparent);
 	}
 	.icon-grid-cell-icon {
 		color: var(--color-muted-foreground);
 	}
+	.icon-grid-cell:hover .icon-grid-cell-icon { color: var(--color-foreground); }
 	.icon-grid-cell.active .icon-grid-cell-icon {
 		color: var(--color-primary);
 	}
@@ -229,4 +280,11 @@
 		color: var(--color-muted-foreground);
 		line-height: 1.2;
 	}
+	.icon-grid-empty {
+		grid-column: 1 / -1;
+		text-align: center;
+		padding: 0.85rem;
+		color: var(--color-muted-foreground);
+		font-size: 0.75rem;
+	}
 </style>

frontend/src/lib/components/IconPicker.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { getMdiPath, getAllMdiNames } from '$lib/mdi-lookup.svelte';
+	import { portal } from '$lib/portal';
 
 	let { value = '', onselect } = $props<{
 		value: string;
@@ -34,7 +35,14 @@
 	function toggleOpen() {
 		if (!open && buttonEl) {
 			const rect = buttonEl.getBoundingClientRect();
-			dropdownStyle = `position:fixed; z-index:9999; top:${rect.bottom + 4}px; left:${rect.left}px;`;
+			const popupWidth = 320; // 20rem
+			const popupHeight = 320;
+			const spaceBelow = window.innerHeight - rect.bottom;
+			const top = spaceBelow > popupHeight + 16
+				? rect.bottom + 4
+				: Math.max(8, rect.top - popupHeight - 4);
+			const left = Math.min(rect.left, window.innerWidth - popupWidth - 16);
+			dropdownStyle = `position:fixed; z-index:9999; top:${top}px; left:${Math.max(8, left)}px;`;
 		}
 		open = !open;
 		if (!open) search = '';
@@ -58,36 +66,159 @@
 
 <div class="inline-block">
 	<button type="button" bind:this={buttonEl} onclick={toggleOpen}
-		class="flex items-center justify-center gap-1 px-2 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)] hover:bg-[var(--color-muted)] transition-colors">
+		class="icon-picker-trigger">
 		{#if value && getMdiPath(value)}
 			<svg viewBox="0 0 24 24" width="18" height="18" fill="currentColor"><path d={getMdiPath(value)} /></svg>
 		{:else}
-			<span class="text-[var(--color-muted-foreground)] text-xs">Icon</span>
+			<span class="icon-picker-placeholder">Icon</span>
 		{/if}
-		<span class="text-xs text-[var(--color-muted-foreground)]">▼</span>
+		<span class="icon-picker-caret">▾</span>
 	</button>
 </div>
 
 {#if open}
-	<div style="position:fixed; top:0; left:0; right:0; bottom:0; z-index:9998;"
-		role="presentation"
-		onclick={() => { open = false; search = ''; }}></div>
+	<!-- Portal popup so it escapes any backdrop-filter / transform ancestor
+	     that would otherwise act as the containing block for position:fixed. -->
+	<div use:portal class="ip-portal-root">
+		<div class="ip-backdrop"
+			role="presentation"
+			onclick={() => { open = false; search = ''; }}></div>
 
-	<div style="{dropdownStyle} width: 20rem; background: var(--color-card); border: 1px solid var(--color-border); border-radius: 0.5rem; box-shadow: 0 10px 25px rgba(0,0,0,0.3); padding: 0.75rem;"
-		class="">
-		<input type="text" bind:value={search} placeholder="Search icons..."
-			class="w-full px-2 py-1 mb-2 border border-[var(--color-border)] rounded text-sm bg-[var(--color-background)]" />
-		<div style="display: grid; grid-template-columns: repeat(8, 1fr); gap: 0.25rem; max-height: 14rem; overflow-y: auto; overflow-x: hidden; scrollbar-width: thin;">
-			<button type="button" onclick={() => select('')}
-				class="flex items-center justify-center aspect-square rounded hover:bg-[var(--color-muted)] text-xs text-[var(--color-muted-foreground)]"
-				title="No icon">✕</button>
-			{#each filtered as iconName}
-				<button type="button" onclick={() => select(iconName)}
-					class="flex items-center justify-center aspect-square rounded hover:bg-[var(--color-muted)] {value === iconName ? 'bg-[var(--color-accent)]' : ''}"
-					title={iconName.replace('mdi', '')}>
-					<svg viewBox="0 0 24 24" width="18" height="18" fill="currentColor"><path d={getMdiPath(iconName)} /></svg>
-				</button>
-			{/each}
+		<div style={dropdownStyle} class="ip-popup">
+			<input type="text" bind:value={search} placeholder="Search icons..."
+				class="ip-search" autocomplete="off" />
+			<div class="ip-grid">
+				<button type="button" onclick={() => select('')}
+					class="ip-cell ip-cell--clear"
+					title="No icon">✕</button>
+				{#each filtered as iconName}
+					<button type="button" onclick={() => select(iconName)}
+						class="ip-cell {value === iconName ? 'is-active' : ''}"
+						title={iconName.replace('mdi', '')}>
+						<svg viewBox="0 0 24 24" width="18" height="18" fill="currentColor"><path d={getMdiPath(iconName)} /></svg>
+					</button>
+				{/each}
+			</div>
 		</div>
 	</div>
 {/if}
+
+<style>
+	.icon-picker-trigger {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.35rem;
+		padding: 0.45rem 0.7rem;
+		border-radius: 0.625rem;
+		border: 1px solid var(--color-border);
+		background: var(--color-input-bg);
+		color: var(--color-foreground);
+		font-size: 0.85rem;
+		font-family: inherit;
+		cursor: pointer;
+		transition: all 0.15s;
+	}
+	.icon-picker-trigger:hover {
+		background: var(--color-glass-strong);
+		border-color: var(--color-rule-strong);
+	}
+	.icon-picker-placeholder {
+		color: var(--color-muted-foreground);
+		font-size: 0.78rem;
+	}
+	.icon-picker-caret {
+		color: var(--color-muted-foreground);
+		font-size: 0.7rem;
+	}
+
+	/* Portal root — drains the popup out of any backdrop-filter ancestor */
+	.ip-portal-root {
+		position: fixed;
+		inset: 0;
+		z-index: 9998;
+		pointer-events: none;
+	}
+	.ip-backdrop {
+		position: absolute;
+		inset: 0;
+		pointer-events: auto;
+	}
+	.ip-popup {
+		pointer-events: auto;
+		width: 20rem;
+		--ip-solid-bg: #131520;
+		background: var(--ip-solid-bg);
+		border: 1px solid var(--color-rule-strong);
+		border-radius: 14px;
+		box-shadow: var(--shadow-card), 0 24px 48px -16px rgba(0, 0, 0, 0.55);
+		padding: 0.65rem;
+		position: relative;
+	}
+	:global([data-theme="light"]) .ip-popup { --ip-solid-bg: #fafafe; }
+	.ip-popup::after {
+		content: '';
+		position: absolute; inset: 0;
+		border-radius: inherit;
+		pointer-events: none;
+		background: linear-gradient(180deg, var(--color-highlight), transparent 30%);
+		opacity: 0.4;
+	}
+	.ip-search {
+		width: 100%;
+		padding: 0.45rem 0.6rem;
+		margin-bottom: 0.5rem;
+		border: 1px solid var(--color-border);
+		border-radius: 8px;
+		background: var(--color-glass-strong);
+		color: var(--color-foreground);
+		font-size: 0.82rem;
+		outline: none;
+		font-family: inherit;
+		position: relative;
+		z-index: 1;
+	}
+	.ip-search:focus {
+		border-color: var(--color-primary);
+		box-shadow: 0 0 0 2px var(--color-glow);
+	}
+	.ip-grid {
+		display: grid;
+		grid-template-columns: repeat(8, 1fr);
+		gap: 0.25rem;
+		max-height: 14rem;
+		overflow-y: auto;
+		overflow-x: hidden;
+		overscroll-behavior: contain;
+		scrollbar-width: thin;
+		position: relative;
+		z-index: 1;
+	}
+	.ip-cell {
+		display: flex;
+		align-items: center;
+		justify-content: center;
+		aspect-ratio: 1;
+		border-radius: 8px;
+		border: 1px solid transparent;
+		background: transparent;
+		color: var(--color-foreground);
+		cursor: pointer;
+		transition: all 0.15s;
+	}
+	.ip-cell:hover {
+		background: var(--color-glass-strong);
+		border-color: var(--color-border);
+	}
+	.ip-cell.is-active {
+		background: linear-gradient(135deg,
+			color-mix(in srgb, var(--color-primary) 18%, transparent),
+			color-mix(in srgb, var(--color-orchid) 18%, transparent));
+		border-color: var(--color-primary);
+		color: var(--color-primary);
+		box-shadow: inset 0 1px 0 var(--color-highlight);
+	}
+	.ip-cell--clear {
+		color: var(--color-muted-foreground);
+		font-size: 0.75rem;
+	}
+</style>

frontend/src/lib/components/JinjaEditor.svelte

@@ -84,23 +84,54 @@
 				}
 			}),
 			EditorView.lineWrapping,
-			EditorView.theme({
-				'&': { fontSize: '13px', fontFamily: "'Consolas', 'Monaco', 'Courier New', monospace" },
-				'.cm-content': { minHeight: `${rows * 1.5}em`, padding: '8px' },
-				'.cm-editor': { borderRadius: '0.375rem', border: '1px solid var(--color-border)' },
-				'.cm-focused': { outline: '2px solid var(--color-primary)', outlineOffset: '0px' },
-				'.cm-error-line': { backgroundColor: 'rgba(239, 68, 68, 0.2)', outline: '1px solid rgba(239, 68, 68, 0.4)' },
-				'.ͼc': { color: '#e879f9' },
-				'.ͼd': { color: '#38bdf8' },
-				'.ͼ5': { color: '#6b7280' },
-				'.cm-tooltip-autocomplete': {
-					border: '1px solid var(--color-border)',
-					borderRadius: '0.375rem',
-					fontSize: '12px',
-				},
-			}),
 		];
+		// Apply oneDark first so its syntax-token colors are kept,
+		// then override with our Aurora-aware theme so background,
+		// borders, and gutters match the rest of the design.
 		if (isDark) extensions.push(oneDark);
+		extensions.push(EditorView.theme({
+			'&': {
+				fontSize: '13px',
+				fontFamily: 'var(--font-mono)',
+				backgroundColor: 'var(--color-input-bg) !important',
+				borderRadius: '14px',
+				border: '1px solid var(--color-rule-strong)',
+				color: 'var(--color-foreground)',
+				overflow: 'hidden',
+			},
+			'.cm-editor': { backgroundColor: 'transparent !important', borderRadius: '14px' },
+			'.cm-scroller': { backgroundColor: 'transparent !important' },
+			'.cm-content': { minHeight: `${rows * 1.5}em`, padding: '12px 14px', caretColor: 'var(--color-primary)' },
+			'.cm-gutters': {
+				backgroundColor: 'transparent',
+				color: 'var(--color-muted-foreground)',
+				borderRight: '1px solid var(--color-border)',
+			},
+			'.cm-activeLineGutter': { backgroundColor: 'var(--color-glass-strong)' },
+			'.cm-activeLine': { backgroundColor: 'var(--color-glass-strong)' },
+			'.cm-cursor': { borderLeftColor: 'var(--color-primary)' },
+			'.cm-selectionBackground, ::selection': { backgroundColor: 'var(--color-glass-elev) !important' },
+			'&.cm-focused .cm-selectionBackground': { backgroundColor: 'var(--color-glow) !important' },
+			'.cm-focused': { outline: 'none' },
+			'&.cm-focused': { borderColor: 'var(--color-primary)', boxShadow: '0 0 0 3px var(--color-glow)' },
+			'.cm-error-line': { backgroundColor: 'rgba(255, 138, 120, 0.18)', outline: '1px solid rgba(255, 138, 120, 0.4)' },
+			'.ͼc': { color: 'var(--color-orchid)' },
+			'.ͼd': { color: 'var(--color-sky)' },
+			'.ͼ5': { color: 'var(--color-muted-foreground)' },
+			'.cm-tooltip-autocomplete': {
+				background: 'color-mix(in srgb, var(--color-background) 92%, transparent)',
+				backdropFilter: 'blur(28px) saturate(160%)',
+				border: '1px solid var(--color-rule-strong)',
+				borderRadius: '12px',
+				fontSize: '12px',
+				boxShadow: '0 12px 30px -12px rgba(0,0,0,0.4)',
+				overflow: 'hidden',
+			},
+			'.cm-tooltip-autocomplete > ul > li[aria-selected]': {
+				backgroundColor: 'var(--color-glass-elev)',
+				color: 'var(--color-primary)',
+			},
+		}));
 		if (placeholder) extensions.push(cmPlaceholder(placeholder));
 		return extensions;
 	}

frontend/src/lib/components/LocaleSelector.svelte

@@ -1,48 +1,10 @@
 <script lang="ts">
 	import MdiIcon from './MdiIcon.svelte';
 	import { t } from '$lib/i18n';
+	import { LOCALE_CATALOG, getLocaleMeta, type LocaleMeta } from '$lib/locales';
+	import EntitySelect, { type EntityItem } from './EntitySelect.svelte';
 
-	interface LocaleMeta {
-		code: string;
-		name: string;       // English name
-		native: string;     // Native script
-		rtl?: boolean;
-	}
-
-	const CATALOG: LocaleMeta[] = [
-		{ code: 'en', name: 'English',    native: 'English' },
-		{ code: 'ru', name: 'Russian',    native: 'Русский' },
-		{ code: 'de', name: 'German',     native: 'Deutsch' },
-		{ code: 'fr', name: 'French',     native: 'Français' },
-		{ code: 'es', name: 'Spanish',    native: 'Español' },
-		{ code: 'it', name: 'Italian',    native: 'Italiano' },
-		{ code: 'pt', name: 'Portuguese', native: 'Português' },
-		{ code: 'pl', name: 'Polish',     native: 'Polski' },
-		{ code: 'nl', name: 'Dutch',      native: 'Nederlands' },
-		{ code: 'sv', name: 'Swedish',    native: 'Svenska' },
-		{ code: 'fi', name: 'Finnish',    native: 'Suomi' },
-		{ code: 'no', name: 'Norwegian',  native: 'Norsk' },
-		{ code: 'da', name: 'Danish',     native: 'Dansk' },
-		{ code: 'cs', name: 'Czech',      native: 'Čeština' },
-		{ code: 'hu', name: 'Hungarian',  native: 'Magyar' },
-		{ code: 'ro', name: 'Romanian',   native: 'Română' },
-		{ code: 'el', name: 'Greek',      native: 'Ελληνικά' },
-		{ code: 'tr', name: 'Turkish',    native: 'Türkçe' },
-		{ code: 'uk', name: 'Ukrainian',  native: 'Українська' },
-		{ code: 'be', name: 'Belarusian', native: 'Беларуская' },
-		{ code: 'bg', name: 'Bulgarian',  native: 'Български' },
-		{ code: 'sr', name: 'Serbian',    native: 'Српски' },
-		{ code: 'ar', name: 'Arabic',     native: 'العربية', rtl: true },
-		{ code: 'he', name: 'Hebrew',     native: 'עברית',   rtl: true },
-		{ code: 'fa', name: 'Persian',    native: 'فارسی',   rtl: true },
-		{ code: 'zh', name: 'Chinese',    native: '中文' },
-		{ code: 'ja', name: 'Japanese',   native: '日本語' },
-		{ code: 'ko', name: 'Korean',     native: '한국어' },
-		{ code: 'hi', name: 'Hindi',      native: 'हिन्दी' },
-		{ code: 'vi', name: 'Vietnamese', native: 'Tiếng Việt' },
-		{ code: 'th', name: 'Thai',       native: 'ไทย' },
-		{ code: 'id', name: 'Indonesian', native: 'Bahasa Indonesia' },
-	];
+	const CATALOG: LocaleMeta[] = LOCALE_CATALOG;
 
 	// Locales that ship with default notification & command templates.
 	const SHIPPED = new Set(['en', 'ru']);
@@ -76,11 +38,7 @@
 	}
 
 	function meta(code: string): LocaleMeta {
-		return CATALOG.find(l => l.code === code) ?? {
-			code,
-			name: code.toUpperCase(),
-			native: code.toUpperCase(),
-		};
+		return getLocaleMeta(code);
 	}
 
 	function remove(code: string) {
@@ -109,79 +67,48 @@
 
 	// --- Add flow ----------------------------------------------------------
 
-	let addOpen = $state(false);
-	let addQuery = $state('');
-	let addInputEl = $state<HTMLInputElement | null>(null);
-	let highlightIdx = $state(0);
-
 	// Valid BCP 47-ish: 2–3 letter primary, optional '-' subtag(s) 2-8 chars.
 	const CUSTOM_RE = /^[a-z]{2,3}(-[a-z0-9]{2,8})*$/i;
 
 	const selectedSet = $derived(new Set(codes));
 
-	const suggestions = $derived.by(() => {
-		const q = addQuery.trim().toLowerCase();
-		const available = CATALOG.filter(l => !selectedSet.has(l.code));
-		if (!q) return available;
-		return available.filter(l =>
-			l.code.includes(q)
-			|| l.name.toLowerCase().includes(q)
-			|| l.native.toLowerCase().includes(q),
-		);
-	});
+	/**
+	 * Catalog languages not yet selected, surfaced through EntitySelect.
+	 * Native name is the label so the user sees their own script; the
+	 * English name + code lives in the description for searchability.
+	 */
+	const addItems = $derived<EntityItem[]>(
+		CATALOG
+			.filter(l => !selectedSet.has(l.code))
+			.map(l => ({
+				value: l.code,
+				label: l.native,
+				desc: `${l.name} · ${l.code.toUpperCase()}`,
+			})),
+	);
 
-	const canAddCustom = $derived.by(() => {
-		const q = addQuery.trim().toLowerCase();
-		if (!q) return false;
-		if (!CUSTOM_RE.test(q)) return false;
-		if (selectedSet.has(q)) return false;
-		// Skip "custom" entry when it matches an existing catalog entry exactly.
-		if (CATALOG.some(l => l.code === q)) return false;
+	let customCode = $state('');
+	const customCodeValid = $derived.by(() => {
+		const c = customCode.trim().toLowerCase();
+		if (!c || !CUSTOM_RE.test(c)) return false;
+		if (selectedSet.has(c)) return false;
+		if (CATALOG.some(l => l.code === c)) return false;
 		return true;
 	});
 
-	function openAdd() {
-		addOpen = true;
-		addQuery = '';
-		highlightIdx = 0;
-		requestAnimationFrame(() => addInputEl?.focus());
-	}
-
-	function closeAdd() {
-		addOpen = false;
-		addQuery = '';
-	}
-
-	function addCode(code: string) {
-		const c = code.trim().toLowerCase();
+	function addCode(code: string | number | null) {
+		if (code === null) return;
+		const c = String(code).trim().toLowerCase();
 		if (!c) return;
 		commit([...codes, c]);
-		addQuery = '';
-		highlightIdx = 0;
-		requestAnimationFrame(() => addInputEl?.focus());
 	}
 
-	function onAddKeydown(e: KeyboardEvent) {
-		if (e.key === 'Escape') { closeAdd(); return; }
-		const total = suggestions.length + (canAddCustom ? 1 : 0);
-		if (e.key === 'ArrowDown') {
-			e.preventDefault();
-			highlightIdx = Math.min(highlightIdx + 1, Math.max(0, total - 1));
-		} else if (e.key === 'ArrowUp') {
-			e.preventDefault();
-			highlightIdx = Math.max(highlightIdx - 1, 0);
-		} else if (e.key === 'Enter') {
-			e.preventDefault();
-			if (highlightIdx < suggestions.length) {
-				addCode(suggestions[highlightIdx].code);
-			} else if (canAddCustom) {
-				addCode(addQuery);
-			}
-		}
+	function addCustom() {
+		if (!customCodeValid) return;
+		addCode(customCode);
+		customCode = '';
 	}
 
-	$effect(() => { addQuery; highlightIdx = 0; });
-
 	// --- Drag & drop -------------------------------------------------------
 
 	let dragCode = $state<string | null>(null);
@@ -329,77 +256,39 @@
 		</ul>
 	{/if}
 
-	<!-- Add zone -->
-	<div class="ls-add" class:ls-add-open={addOpen}>
-		{#if !addOpen}
-			<button type="button" class="ls-add-trigger" onclick={openAdd}>
-				<MdiIcon name="mdiPlus" size={14} />
-				<span>{t('locales.add')}</span>
-			</button>
-		{:else}
-			<div class="ls-add-panel">
-				<div class="ls-add-input-row">
-					<MdiIcon name="mdiMagnify" size={14} />
-					<input
-						bind:this={addInputEl}
-						bind:value={addQuery}
-						onkeydown={onAddKeydown}
-						onblur={() => setTimeout(() => { if (addOpen && !addQuery) closeAdd(); }, 150)}
-						placeholder={t('locales.searchPlaceholder')}
-						class="ls-add-input"
-						autocomplete="off"
-						spellcheck="false"
-						type="text"
-					/>
-					<button type="button" class="ls-icon-btn" onclick={closeAdd} aria-label={t('common.cancel')}>
-						<MdiIcon name="mdiClose" size={14} />
-					</button>
-				</div>
-
-				<div class="ls-add-list" role="listbox">
-					{#each suggestions as s, i (s.code)}
-						<button
-							type="button"
-							role="option"
-							aria-selected={i === highlightIdx}
-							class="ls-sugg"
-							class:ls-sugg-hl={i === highlightIdx}
-							onmouseenter={() => highlightIdx = i}
-							onmousedown={(e) => { e.preventDefault(); addCode(s.code); }}
-						>
-							<span class="ls-sugg-native" dir={s.rtl ? 'rtl' : 'ltr'} lang={s.code}>{s.native}</span>
-							<span class="ls-sugg-name">{s.name}</span>
-							<span class="ls-sugg-code">{s.code}</span>
-							{#if SHIPPED.has(s.code)}
-								<span class="ls-sugg-shipped" title={t('locales.shippedHint')}>
-									<MdiIcon name="mdiPackageVariantClosedCheck" size={10} />
-								</span>
-							{/if}
-						</button>
-					{/each}
-
-					{#if canAddCustom}
-						<button
-							type="button"
-							role="option"
-							aria-selected={highlightIdx === suggestions.length}
-							class="ls-sugg ls-sugg-custom"
-							class:ls-sugg-hl={highlightIdx === suggestions.length}
-							onmouseenter={() => highlightIdx = suggestions.length}
-							onmousedown={(e) => { e.preventDefault(); addCode(addQuery); }}
-						>
-							<MdiIcon name="mdiPlusCircleOutline" size={14} />
-							<span class="ls-sugg-custom-label">{t('locales.addCustom')}</span>
-							<span class="ls-sugg-code">{addQuery.trim().toLowerCase()}</span>
-						</button>
-					{/if}
-
-					{#if suggestions.length === 0 && !canAddCustom}
-						<div class="ls-sugg-empty">{t('locales.noSuggestions')}</div>
-					{/if}
-				</div>
+	<!-- Add zone — EntitySelect for catalog languages, separate input for custom BCP-47 codes -->
+	<div class="ls-add">
+		<div class="ls-add-row">
+			<div class="ls-add-picker">
+				<EntitySelect
+					items={addItems}
+					value={null}
+					placeholder={t('locales.add')}
+					size="sm"
+					onselect={addCode}
+				/>
 			</div>
-		{/if}
+			<div class="ls-add-custom">
+				<input
+					type="text"
+					bind:value={customCode}
+					onkeydown={(e) => { if (e.key === 'Enter') { e.preventDefault(); addCustom(); } }}
+					placeholder={t('locales.customPlaceholder')}
+					class="ls-add-custom-input"
+					autocomplete="off"
+					spellcheck="false"
+				/>
+				<button
+					type="button"
+					class="ls-add-custom-btn"
+					disabled={!customCodeValid}
+					onclick={addCustom}
+					title={t('locales.addCustom')}
+				>
+					<MdiIcon name="mdiPlus" size={14} />
+				</button>
+			</div>
+		</div>
 	</div>
 
 	<p class="ls-hint">
@@ -630,125 +519,60 @@
 	.ls-add {
 		margin-top: 0.125rem;
 	}
-	.ls-add-trigger {
-		display: inline-flex;
-		align-items: center;
-		gap: 0.375rem;
-		padding: 0.375rem 0.75rem;
-		font-size: 0.75rem;
-		font-weight: 500;
-		border: 1px dashed var(--color-border);
-		border-radius: 0.375rem;
-		background: transparent;
-		color: var(--color-muted-foreground);
-		cursor: pointer;
-		transition: border-color 0.15s, color 0.15s, background 0.15s;
-	}
-	.ls-add-trigger:hover {
-		border-color: var(--color-primary);
-		border-style: solid;
-		color: var(--color-primary);
-		background: color-mix(in srgb, var(--color-primary) 5%, transparent);
-	}
-
-	.ls-add-panel {
-		border: 1px solid var(--color-border);
-		border-radius: 0.5rem;
-		background: var(--color-background);
-		overflow: hidden;
-		animation: ls-pop 0.15s ease-out;
-	}
-	@keyframes ls-pop {
-		from { opacity: 0; transform: translateY(-2px); }
-		to   { opacity: 1; transform: translateY(0); }
-	}
-	.ls-add-input-row {
+	.ls-add-row {
 		display: flex;
 		align-items: center;
 		gap: 0.5rem;
-		padding: 0.375rem 0.625rem;
-		border-bottom: 1px solid var(--color-border);
-		color: var(--color-muted-foreground);
+		flex-wrap: wrap;
 	}
-	.ls-add-input {
+	.ls-add-picker {
 		flex: 1;
+		min-width: 12rem;
+	}
+	.ls-add-custom {
+		display: flex;
+		align-items: center;
+		gap: 0.25rem;
+		padding: 0.15rem 0.15rem 0.15rem 0.55rem;
+		border: 1px dashed var(--color-border);
+		border-radius: 0.5rem;
+		background: transparent;
+	}
+	.ls-add-custom-input {
+		width: 6rem;
 		border: none;
 		outline: none;
 		background: transparent;
-		font-size: 0.8rem;
-		color: var(--color-foreground);
-		padding: 0.125rem 0;
-		min-width: 0;
-	}
-
-	.ls-add-list {
-		max-height: 14rem;
-		overflow-y: auto;
-		scrollbar-width: thin;
-	}
-	.ls-sugg {
-		display: grid;
-		grid-template-columns: 1fr auto auto auto;
-		align-items: center;
-		gap: 0.625rem;
-		width: 100%;
-		padding: 0.375rem 0.625rem;
-		border: none;
-		background: transparent;
-		color: var(--color-foreground);
-		cursor: pointer;
-		text-align: left;
-		transition: background 0.1s;
-	}
-	.ls-sugg.ls-sugg-hl {
-		background: var(--color-muted);
-	}
-	.ls-sugg-native {
-		font-size: 0.9rem;
-		font-weight: 500;
-		overflow: hidden;
-		text-overflow: ellipsis;
-		white-space: nowrap;
-	}
-	.ls-sugg-name {
-		font-size: 0.7rem;
-		color: var(--color-muted-foreground);
-		text-transform: uppercase;
-		letter-spacing: 0.06em;
-		white-space: nowrap;
-	}
-	.ls-sugg-code {
 		font-family: var(--font-mono);
-		font-size: 0.7rem;
-		padding: 0.05rem 0.375rem;
-		border-radius: 0.25rem;
-		background: var(--color-muted);
+		font-size: 0.75rem;
+		color: var(--color-foreground);
+		padding: 0.25rem 0;
+	}
+	.ls-add-custom-input::placeholder {
 		color: var(--color-muted-foreground);
+		opacity: 0.7;
 	}
-	.ls-sugg.ls-sugg-hl .ls-sugg-code {
-		background: color-mix(in srgb, var(--color-primary) 15%, var(--color-muted));
-	}
-	.ls-sugg-shipped {
+	.ls-add-custom-btn {
 		display: inline-flex;
 		align-items: center;
-		color: var(--color-primary);
-		opacity: 0.85;
-	}
-
-	.ls-sugg-custom {
-		border-top: 1px dashed var(--color-border);
-		color: var(--color-primary);
-	}
-	.ls-sugg-custom-label {
-		font-size: 0.75rem;
-		font-weight: 500;
-	}
-
-	.ls-sugg-empty {
-		padding: 0.75rem;
-		font-size: 0.75rem;
-		text-align: center;
+		justify-content: center;
+		width: 1.5rem;
+		height: 1.5rem;
+		padding: 0;
+		border: none;
+		background: transparent;
+		border-radius: 0.25rem;
 		color: var(--color-muted-foreground);
+		cursor: pointer;
+		transition: background 0.12s, color 0.12s;
+	}
+	.ls-add-custom-btn:hover:not(:disabled) {
+		background: var(--color-muted);
+		color: var(--color-primary);
+	}
+	.ls-add-custom-btn:disabled {
+		opacity: 0.3;
+		cursor: not-allowed;
 	}
 
 	/* ---- Hint --------------------------------------------------------- */

frontend/src/lib/components/MetaStrip.svelte

@@ -0,0 +1,187 @@
+<script lang="ts">
+	import MdiIcon from './MdiIcon.svelte';
+
+	export type MetaTone = 'default' | 'mint' | 'sky' | 'coral' | 'citrus' | 'orchid' | 'lavender';
+
+	export interface MetaTile {
+		icon?: string;
+		label: string;
+		value?: string;
+		hint?: string;
+		tone?: MetaTone;
+		mono?: boolean;
+		href?: string;
+		onclick?: (e: MouseEvent) => void;
+		copyValue?: string;
+	}
+
+	let { tiles, align = 'start' }: {
+		tiles: MetaTile[];
+		align?: 'start' | 'end';
+	} = $props();
+
+	function handleClick(e: MouseEvent, tile: MetaTile) {
+		if (tile.onclick) {
+			e.preventDefault();
+			e.stopPropagation();
+			tile.onclick(e);
+		}
+	}
+</script>
+
+<div class="meta-strip" style="justify-content: {align === 'end' ? 'flex-end' : 'flex-start'};">
+	{#each tiles as tile, i (i)}
+		{#if tile.href}
+			<a
+				class="meta-tile meta-tone-{tile.tone || 'default'} meta-tile--interactive"
+				class:meta-tile--mono={tile.mono}
+				title={tile.hint}
+				href={tile.href}
+				target="_blank"
+				rel="noopener"
+			>
+				{#if tile.icon}
+					<span class="meta-tile__icon"><MdiIcon name={tile.icon} size={14} /></span>
+				{/if}
+				<span class="meta-tile__text">
+					{#if tile.value}<span class="meta-tile__value">{tile.value}</span>{/if}
+					<span class="meta-tile__label">{tile.label}</span>
+				</span>
+			</a>
+		{:else if tile.onclick}
+			<button
+				type="button"
+				class="meta-tile meta-tone-{tile.tone || 'default'} meta-tile--interactive"
+				class:meta-tile--mono={tile.mono}
+				title={tile.hint}
+				onclick={(e: MouseEvent) => handleClick(e, tile)}
+			>
+				{#if tile.icon}
+					<span class="meta-tile__icon"><MdiIcon name={tile.icon} size={14} /></span>
+				{/if}
+				<span class="meta-tile__text">
+					{#if tile.value}<span class="meta-tile__value">{tile.value}</span>{/if}
+					<span class="meta-tile__label">{tile.label}</span>
+				</span>
+			</button>
+		{:else}
+			<div
+				class="meta-tile meta-tone-{tile.tone || 'default'}"
+				class:meta-tile--mono={tile.mono}
+				title={tile.hint}
+			>
+				{#if tile.icon}
+					<span class="meta-tile__icon"><MdiIcon name={tile.icon} size={14} /></span>
+				{/if}
+				<span class="meta-tile__text">
+					{#if tile.value}<span class="meta-tile__value">{tile.value}</span>{/if}
+					<span class="meta-tile__label">{tile.label}</span>
+				</span>
+			</div>
+		{/if}
+	{/each}
+</div>
+
+<style>
+	.meta-strip {
+		display: none;
+		min-width: 0;
+		flex: 1 1 auto;
+		gap: 0.45rem;
+		align-items: center;
+		overflow: hidden;
+		mask-image: linear-gradient(to right, transparent 0, #000 24px, #000 calc(100% - 24px), transparent 100%);
+		-webkit-mask-image: linear-gradient(to right, transparent 0, #000 24px, #000 calc(100% - 24px), transparent 100%);
+		padding: 2px 18px;
+	}
+	@media (min-width: 1024px) {
+		.meta-strip {
+			display: flex;
+		}
+	}
+
+	.meta-tile {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.4rem;
+		padding: 0.3rem 0.7rem;
+		border-radius: 999px;
+		background: var(--color-glass);
+		backdrop-filter: blur(14px) saturate(140%);
+		-webkit-backdrop-filter: blur(14px) saturate(140%);
+		border: 1px solid var(--color-border);
+		font-size: 0.72rem;
+		line-height: 1.1;
+		color: var(--color-muted-foreground);
+		white-space: nowrap;
+		flex-shrink: 0;
+		max-width: 22rem;
+		min-width: 0;
+		text-decoration: none;
+		font-family: inherit;
+		transition: border-color 0.2s ease, color 0.2s ease, background 0.2s ease, transform 0.2s ease;
+	}
+
+	.meta-tile__icon {
+		display: inline-flex;
+		align-items: center;
+		color: currentColor;
+		opacity: 0.9;
+		flex-shrink: 0;
+	}
+
+	.meta-tile__text {
+		display: inline-flex;
+		align-items: baseline;
+		gap: 0.4rem;
+		min-width: 0;
+		overflow: hidden;
+	}
+
+	.meta-tile__value {
+		font-size: 0.85rem;
+		font-weight: 600;
+		color: var(--color-foreground);
+		letter-spacing: -0.01em;
+		font-variant-numeric: tabular-nums;
+	}
+
+	.meta-tile__label {
+		font-size: 0.72rem;
+		color: var(--color-muted-foreground);
+		overflow: hidden;
+		text-overflow: ellipsis;
+		min-width: 0;
+	}
+
+	.meta-tile--mono .meta-tile__label,
+	.meta-tile--mono .meta-tile__value {
+		font-family: var(--font-mono);
+		letter-spacing: -0.02em;
+		font-size: 0.7rem;
+	}
+
+	.meta-tile--interactive {
+		cursor: pointer;
+	}
+	.meta-tile--interactive:hover {
+		border-color: var(--color-rule-strong);
+		background: var(--color-glass-strong);
+		transform: translateY(-1px);
+	}
+
+	/* Tone variants — applied to the dot/icon and accent border on hover */
+	.meta-tone-mint     { box-shadow: inset 2px 0 0 var(--color-mint); }
+	.meta-tone-sky      { box-shadow: inset 2px 0 0 var(--color-sky); }
+	.meta-tone-coral    { box-shadow: inset 2px 0 0 var(--color-coral); }
+	.meta-tone-citrus   { box-shadow: inset 2px 0 0 var(--color-citrus); }
+	.meta-tone-orchid   { box-shadow: inset 2px 0 0 var(--color-orchid); }
+	.meta-tone-lavender { box-shadow: inset 2px 0 0 var(--color-primary); }
+
+	.meta-tone-mint     .meta-tile__icon { color: var(--color-mint); }
+	.meta-tone-sky      .meta-tile__icon { color: var(--color-sky); }
+	.meta-tone-coral    .meta-tile__icon { color: var(--color-coral); }
+	.meta-tone-citrus   .meta-tile__icon { color: var(--color-citrus); }
+	.meta-tone-orchid   .meta-tile__icon { color: var(--color-orchid); }
+	.meta-tone-lavender .meta-tile__icon { color: var(--color-primary); }
+</style>

frontend/src/lib/components/Modal.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
-	import { onMount } from 'svelte';
 	import MdiIcon from './MdiIcon.svelte';
 	import { t } from '$lib/i18n';
+	import { portal } from '$lib/portal';
 
 	let { open = false, title = '', onclose, children } = $props<{
 		open: boolean;
@@ -11,14 +11,22 @@
 	}>();
 
 	let visible = $state(false);
-	let panelEl: HTMLDivElement;
+	let mounted = $state(false);
+	let panelEl = $state<HTMLDivElement | undefined>();
 	let previouslyFocused: HTMLElement | null = null;
+	let closeTimer: ReturnType<typeof setTimeout> | null = null;
 
 	const uniqueId = `modal-${Math.random().toString(36).slice(2, 9)}`;
+	const TRANSITION_MS = 250;
 
 	$effect(() => {
 		if (open) {
+			if (closeTimer) {
+				clearTimeout(closeTimer);
+				closeTimer = null;
+			}
 			previouslyFocused = document.activeElement as HTMLElement | null;
+			mounted = true;
 			requestAnimationFrame(() => {
 				visible = true;
 				// Focus first focusable element inside the modal
@@ -29,13 +37,18 @@
 					focusable?.focus();
 				});
 			});
-		} else {
+		} else if (mounted) {
 			visible = false;
 			// Restore focus to the previously focused element
 			if (previouslyFocused && typeof previouslyFocused.focus === 'function') {
 				previouslyFocused.focus();
 				previouslyFocused = null;
 			}
+			if (closeTimer) clearTimeout(closeTimer);
+			closeTimer = setTimeout(() => {
+				mounted = false;
+				closeTimer = null;
+			}, TRANSITION_MS);
 		}
 	});
 
@@ -73,87 +86,145 @@
 
 <svelte:window onkeydown={open ? handleKeydown : undefined} />
 
-{#if open}
-	<div
-		class="modal-backdrop"
-		class:visible
-		style="position: fixed; top: 0; left: 0; right: 0; bottom: 0; z-index: 9999; display: flex; align-items: center; justify-content: center;"
-		onclick={onclose}
-		onkeydown={handleBackdropKeydown}
-		role="presentation"
-	>
+{#if mounted}
+	<div use:portal class="modal-portal-root">
 		<div
-			bind:this={panelEl}
-			class="modal-panel"
+			class="modal-backdrop"
 			class:visible
-			role="dialog"
-			aria-modal="true"
-			aria-labelledby="modal-title-{uniqueId}"
-			style="background: var(--color-card); border: 1px solid var(--color-border); border-radius: 1rem; width: 100%; max-width: 32rem; max-height: 80vh; margin: 1rem; display: flex; flex-direction: column;"
-			onclick={(e) => e.stopPropagation()}
+			onclick={onclose}
+			onkeydown={handleBackdropKeydown}
+			role="button"
+			tabindex="-1"
+			aria-label={t('common.close')}
 		>
-			<div style="display: flex; align-items: center; justify-content: space-between; padding: 1.5rem 1.5rem 1rem;">
-				<h3 id="modal-title-{uniqueId}" style="font-size: 1.125rem; font-weight: 600;">{title}</h3>
-				<button class="modal-close" onclick={onclose} aria-label={t('common.close')}>
-					<MdiIcon name="mdiClose" size={18} />
-				</button>
-			</div>
-			<div style="padding: 0 1.5rem 1.5rem; overflow-y: auto;">
-				{@render children()}
+			<!-- svelte-ignore a11y_click_events_have_key_events -->
+			<div
+				bind:this={panelEl}
+				class="modal-panel"
+				class:visible
+				role="dialog"
+				tabindex="-1"
+				aria-modal="true"
+				aria-labelledby="modal-title-{uniqueId}"
+				onclick={(e) => e.stopPropagation()}
+			>
+				<div class="modal-head">
+					<h3 id="modal-title-{uniqueId}" class="modal-title">{title}</h3>
+					<button class="modal-close" onclick={onclose} aria-label={t('common.close')}>
+						<MdiIcon name="mdiClose" size={18} />
+					</button>
+				</div>
+				<div class="modal-body">
+					{@render children()}
+				</div>
 			</div>
 		</div>
 	</div>
 {/if}
 
 <style>
+	.modal-portal-root {
+		position: fixed;
+		inset: 0;
+		z-index: 9999;
+	}
+
 	.modal-backdrop {
+		position: absolute;
+		inset: 0;
+		display: flex;
+		align-items: center;
+		justify-content: center;
 		background: rgba(0, 0, 0, 0);
 		backdrop-filter: blur(0px);
 		transition: background 0.25s ease, backdrop-filter 0.25s ease;
 	}
 
 	.modal-backdrop.visible {
-		background: rgba(0, 0, 0, 0.5);
-		backdrop-filter: blur(4px);
+		background: rgba(0, 0, 0, 0.55);
+		backdrop-filter: blur(8px) saturate(120%);
+		-webkit-backdrop-filter: blur(8px) saturate(120%);
 	}
 
 	.modal-panel {
+		--modal-solid-bg: #131520;
+		background: var(--modal-solid-bg);
+		border: 1px solid var(--color-rule-strong);
+		border-radius: 18px;
+		width: 100%;
+		max-width: 32rem;
+		max-height: 80vh;
+		margin: 1rem;
+		display: flex;
+		flex-direction: column;
 		opacity: 0;
 		transform: translateY(12px) scale(0.97);
 		transition: opacity 0.25s ease, transform 0.25s ease;
 		box-shadow:
-			0 8px 32px rgba(0, 0, 0, 0.12),
-			0 0 0 1px rgba(255, 255, 255, 0.05) inset;
+			var(--shadow-card),
+			0 30px 80px -20px rgba(0, 0, 0, 0.6);
+		position: relative;
+		overflow: hidden;
+	}
+	.modal-panel::after {
+		content: '';
+		position: absolute; inset: 0;
+		border-radius: inherit;
+		pointer-events: none;
+		background: linear-gradient(180deg, var(--color-highlight), transparent 30%);
+		opacity: 0.4;
 	}
 
-	:global([data-theme="dark"]) .modal-panel {
-		box-shadow:
-			0 8px 32px rgba(0, 0, 0, 0.4),
-			0 0 48px var(--color-glow),
-			0 0 0 1px rgba(255, 255, 255, 0.03) inset;
-	}
+	:global([data-theme="light"]) .modal-panel { --modal-solid-bg: #fafafe; }
 
 	.modal-panel.visible {
 		opacity: 1;
 		transform: translateY(0) scale(1);
 	}
 
+	.modal-head {
+		position: relative;
+		z-index: 1;
+		display: flex;
+		align-items: center;
+		justify-content: space-between;
+		padding: 1.4rem 1.5rem 1rem;
+	}
+
+	.modal-title {
+		font-family: var(--font-display);
+		font-weight: 400;
+		font-size: 1.4rem;
+		letter-spacing: -0.02em;
+		color: var(--color-foreground);
+		margin: 0;
+	}
+
+	.modal-body {
+		position: relative;
+		z-index: 1;
+		padding: 0 1.5rem 1.5rem;
+		overflow-y: auto;
+		overscroll-behavior: contain;
+	}
+
 	.modal-close {
 		display: flex;
 		align-items: center;
 		justify-content: center;
-		width: 2rem;
-		height: 2rem;
-		border-radius: 0.5rem;
-		border: none;
+		width: 2.5rem;
+		height: 2.5rem;
+		border-radius: 10px;
+		border: 1px solid transparent;
 		background: transparent;
 		color: var(--color-muted-foreground);
 		cursor: pointer;
-		transition: all 0.2s ease;
+		transition: all 0.15s ease;
 	}
 
 	.modal-close:hover {
-		background: var(--color-muted);
+		background: var(--color-glass-strong);
+		border-color: var(--color-border);
 		color: var(--color-foreground);
 	}
 </style>

frontend/src/lib/components/MultiEntitySelect.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
 	import MdiIcon from './MdiIcon.svelte';
 	import { t } from '$lib/i18n';
+	import { portal } from '$lib/portal';
 
 	export interface MultiEntityItem {
 		value: string;
@@ -26,8 +27,8 @@
 	let open = $state(false);
 	let query = $state('');
 	let highlightIdx = $state(0);
-	let inputEl: HTMLInputElement;
-	let listEl: HTMLDivElement;
+	let inputEl = $state<HTMLInputElement | undefined>();
+	let listEl = $state<HTMLDivElement | undefined>();
 
 	const selectedItems = $derived(items.filter(i => (values || []).includes(i.value)));
 
@@ -110,56 +111,58 @@
 	</button>
 </div>
 
-<!-- Palette overlay -->
+<!-- Palette overlay — portalled to <body> to escape backdrop-filter ancestors -->
 {#if open}
-	<div class="mes-overlay" onclick={closePalette} role="presentation"></div>
+	<div use:portal class="mes-portal-root">
+		<div class="mes-overlay" onclick={closePalette} role="presentation"></div>
 
-	<div class="mes-container">
-		<div class="mes-search-row">
-			<MdiIcon name="mdiMagnify" size={18} />
-			<input
-				bind:this={inputEl}
-				bind:value={query}
-				placeholder={t('common.search')}
-				class="mes-input"
-				type="text"
-				autocomplete="off"
-				spellcheck="false"
-				onkeydown={handleKeydown}
-			/>
-			<span class="mes-count">{(values || []).length}/{items.length}</span>
-			<kbd class="mes-kbd">ESC</kbd>
-		</div>
+		<div class="mes-container">
+			<div class="mes-search-row">
+				<MdiIcon name="mdiMagnify" size={18} />
+				<input
+					bind:this={inputEl}
+					bind:value={query}
+					placeholder={t('common.search')}
+					class="mes-input"
+					type="text"
+					autocomplete="off"
+					spellcheck="false"
+					onkeydown={handleKeydown}
+				/>
+				<span class="mes-count">{(values || []).length}/{items.length}</span>
+				<kbd class="mes-kbd">ESC</kbd>
+			</div>
 
-		<div class="mes-list" bind:this={listEl} role="listbox">
-			{#if filtered.length === 0}
-				<div class="mes-empty">{t('common.noMatches')}</div>
-			{:else}
-				{#each filtered as item, i}
-					{@const checked = (values || []).includes(item.value)}
-					<button
-						class="mes-item"
-						class:mes-highlight={i === highlightIdx}
-						class:mes-checked={checked}
-						role="option"
-						aria-selected={checked}
-						onclick={() => toggleItem(item)}
-						onmouseenter={() => highlightIdx = i}
-						type="button"
-					>
-						<span class="mes-item-check">
-							<MdiIcon name={checked ? 'mdiCheckboxMarked' : 'mdiCheckboxBlankOutline'} size={16} />
-						</span>
-						{#if item.icon}
-							<span class="mes-item-icon"><MdiIcon name={item.icon} size={18} /></span>
-						{/if}
-						<span class="mes-item-label">{item.label}</span>
-						{#if item.desc}
-							<span class="mes-item-desc">{item.desc}</span>
-						{/if}
-					</button>
-				{/each}
-			{/if}
+			<div class="mes-list" bind:this={listEl} role="listbox">
+				{#if filtered.length === 0}
+					<div class="mes-empty">{t('common.noMatches')}</div>
+				{:else}
+					{#each filtered as item, i}
+						{@const checked = (values || []).includes(item.value)}
+						<button
+							class="mes-item"
+							class:mes-highlight={i === highlightIdx}
+							class:mes-checked={checked}
+							role="option"
+							aria-selected={checked}
+							onclick={() => toggleItem(item)}
+							onmouseenter={() => highlightIdx = i}
+							type="button"
+						>
+							<span class="mes-item-check">
+								<MdiIcon name={checked ? 'mdiCheckboxMarked' : 'mdiCheckboxBlankOutline'} size={16} />
+							</span>
+							{#if item.icon}
+								<span class="mes-item-icon"><MdiIcon name={item.icon} size={18} /></span>
+							{/if}
+							<span class="mes-item-label">{item.label}</span>
+							{#if item.desc}
+								<span class="mes-item-desc">{item.desc}</span>
+							{/if}
+						</button>
+					{/each}
+				{/if}
+			</div>
 		</div>
 	</div>
 {/if}
@@ -233,32 +236,42 @@
 		flex-shrink: 0;
 	}
 
-	/* Overlay */
-	.mes-overlay {
+	/* Portal root */
+	.mes-portal-root {
 		position: fixed;
 		inset: 0;
 		z-index: 9998;
-		background: rgba(0, 0, 0, 0.4);
-		backdrop-filter: blur(2px);
+		pointer-events: none;
+	}
+	.mes-overlay {
+		position: absolute;
+		inset: 0;
+		pointer-events: auto;
+		background: rgba(0, 0, 0, 0.55);
+		backdrop-filter: blur(8px) saturate(120%);
+		-webkit-backdrop-filter: blur(8px) saturate(120%);
 	}
 
-	/* Palette container */
+	/* Palette container — solid background for legibility */
 	.mes-container {
-		position: fixed;
+		pointer-events: auto;
+		position: absolute;
 		top: min(20vh, 120px);
 		left: 50%;
 		transform: translateX(-50%);
-		z-index: 9999;
-		width: min(460px, 90vw);
+		z-index: 1;
+		width: min(480px, 92vw);
 		max-height: 60vh;
-		background: var(--color-card);
-		border: 1px solid var(--color-border);
-		border-radius: 0.75rem;
-		box-shadow: 0 20px 60px rgba(0, 0, 0, 0.4);
+		background: var(--mes-solid-bg);
+		border: 1px solid var(--color-rule-strong);
+		border-radius: 16px;
+		box-shadow: var(--shadow-card), 0 24px 48px -16px rgba(0, 0, 0, 0.55);
 		display: flex;
 		flex-direction: column;
 		overflow: hidden;
+		--mes-solid-bg: #131520;
 	}
+	:global([data-theme="light"]) .mes-container { --mes-solid-bg: #fafafe; }
 
 	.mes-search-row {
 		display: flex;
@@ -294,6 +307,7 @@
 
 	.mes-list {
 		overflow-y: auto;
+		overscroll-behavior: contain;
 		scrollbar-width: thin;
 		padding: 0.25rem 0;
 	}
@@ -319,7 +333,11 @@
 		transition: background 0.1s;
 	}
 	.mes-item:hover, .mes-item.mes-highlight {
-		background: var(--color-muted);
+		background: rgba(255, 255, 255, 0.06);
+	}
+	:global([data-theme="light"]) .mes-item:hover,
+	:global([data-theme="light"]) .mes-item.mes-highlight {
+		background: rgba(20, 15, 60, 0.05);
 	}
 	.mes-item-check {
 		flex-shrink: 0;

frontend/src/lib/components/NavIcon.svelte

@@ -0,0 +1,92 @@
+<script lang="ts">
+	/**
+	 * Thin-stroke SVG icon set for navigation surfaces.
+	 *
+	 * Mirrors the visual language of the Aurora design mockups — soft outline
+	 * glyphs at 1.6px stroke. Falls back to MdiIcon for any name we don't
+	 * have a hand-drawn version of, so the existing navEntries config keeps
+	 * working unchanged.
+	 */
+	import MdiIcon from './MdiIcon.svelte';
+
+	interface Props {
+		name: string;
+		size?: number;
+	}
+
+	const { name, size = 18 }: Props = $props();
+</script>
+
+{#if name === 'mdiViewDashboard'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M3 12h4l3-9 4 18 3-9h4"/></svg>
+{:else if name === 'mdiServer'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7" rx="1.5"/><rect x="14" y="3" width="7" height="7" rx="1.5"/><rect x="3" y="14" width="7" height="7" rx="1.5"/><rect x="14" y="14" width="7" height="7" rx="1.5"/></svg>
+{:else if name === 'mdiBellOutline' || name === 'mdiBell'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M6 8a6 6 0 0 1 12 0c0 7 3 9 3 9H3s3-2 3-9"/><path d="M10 21a2 2 0 0 0 4 0"/></svg>
+{:else if name === 'mdiConsoleLine'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="4" width="18" height="16" rx="2"/><path d="M7 9l3 3-3 3M13 15h4"/></svg>
+{:else if name === 'mdiRobotOutline' || name === 'mdiRobot'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><rect x="4" y="6" width="16" height="14" rx="3"/><circle cx="9" cy="12" r="1.2"/><circle cx="15" cy="12" r="1.2"/><path d="M8 17c1.5 1 6.5 1 8 0M12 3v3"/></svg>
+{:else if name === 'mdiTarget'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="9"/><path d="M3 12h18M12 3a14 14 0 0 1 0 18M12 3a14 14 0 0 0 0 18"/></svg>
+{:else if name === 'mdiCogOutline' || name === 'mdiCog'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.7 1.7 0 0 0 .3 1.8l.1.1a2 2 0 1 1-2.8 2.8l-.1-.1a1.7 1.7 0 0 0-1.8-.3 1.7 1.7 0 0 0-1 1.5V21a2 2 0 1 1-4 0v-.1a1.7 1.7 0 0 0-1.1-1.5 1.7 1.7 0 0 0-1.8.3l-.1.1a2 2 0 1 1-2.8-2.8l.1-.1a1.7 1.7 0 0 0 .3-1.8 1.7 1.7 0 0 0-1.5-1H3a2 2 0 1 1 0-4h.1a1.7 1.7 0 0 0 1.5-1.1 1.7 1.7 0 0 0-.3-1.8l-.1-.1a2 2 0 1 1 2.8-2.8l.1.1a1.7 1.7 0 0 0 1.8.3H9a1.7 1.7 0 0 0 1-1.5V3a2 2 0 1 1 4 0v.1a1.7 1.7 0 0 0 1 1.5 1.7 1.7 0 0 0 1.8-.3l.1-.1a2 2 0 1 1 2.8 2.8l-.1.1a1.7 1.7 0 0 0-.3 1.8V9a1.7 1.7 0 0 0 1.5 1H21a2 2 0 1 1 0 4h-.1a1.7 1.7 0 0 0-1.5 1z"/></svg>
+{:else if name === 'mdiRadar'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><circle cx="12" cy="12" r="8"/><path d="M12 4v3M12 17v3M4 12h3M17 12h3"/></svg>
+{:else if name === 'mdiFileDocumentEdit'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2v-8"/><path d="M14 2v6h6"/><path d="M18 14l3 3-5 5h-3v-3z"/></svg>
+{:else if name === 'mdiCodeBracesBox'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="18" height="18" rx="2"/><path d="M9 8a2 2 0 0 0-2 2v1.5a1 1 0 0 1-1 1 1 1 0 0 1 1 1V15a2 2 0 0 0 2 2M15 8a2 2 0 0 1 2 2v1.5a1 1 0 0 0 1 1 1 1 0 0 0-1 1V15a2 2 0 0 1-2 2"/></svg>
+{:else if name === 'mdiPlayCircleOutline'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="9"/><path d="M10 9l5 3-5 3z" fill="currentColor"/></svg>
+{:else if name === 'mdiSendCircle' || name === 'mdiSend'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M22 2L11 13M22 2l-7 20-4-9-9-4z"/></svg>
+{:else if name === 'mdiEmailOutline'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="5" width="18" height="14" rx="2"/><path d="M3 7l9 7 9-7"/></svg>
+{:else if name === 'mdiMatrix'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="3" height="18"/><rect x="18" y="3" width="3" height="18"/><path d="M6 6h2M6 18h2M16 6h2M16 18h2"/></svg>
+{:else if name === 'mdiWebhook'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><circle cx="6" cy="18" r="3"/><circle cx="18" cy="18" r="3"/><circle cx="12" cy="5" r="3"/><path d="M12 8l-4 7M15 18H9M16 8l4 7"/></svg>
+{:else if name === 'mdiChat'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/></svg>
+{:else if name === 'mdiSlack'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><rect x="9" y="3" width="3" height="9" rx="1.5"/><rect x="14" y="9" width="7" height="3" rx="1.5"/><rect x="12" y="14" width="3" height="7" rx="1.5"/><rect x="3" y="12" width="7" height="3" rx="1.5"/></svg>
+{:else if name === 'mdiBullhorn'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M3 11v3a1 1 0 0 0 1 1h3l5 4V6L7 10H4a1 1 0 0 0-1 1z"/><path d="M16 8a5 5 0 0 1 0 8M19 5a9 9 0 0 1 0 14"/></svg>
+{:else if name === 'mdiBackupRestore'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M3 12a9 9 0 1 0 3-6.7"/><path d="M3 4v5h5"/><path d="M12 7v5l3 2"/></svg>
+{:else if name === 'mdiAccountGroup'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><circle cx="9" cy="8" r="3.5"/><path d="M2 21a7 7 0 0 1 14 0"/><circle cx="17" cy="6" r="3"/><path d="M22 18a5 5 0 0 0-5-5"/></svg>
+{:else if name === 'mdiChevronRight'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M9 6l6 6-6 6"/></svg>
+{:else if name === 'mdiChevronLeft'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M15 6l-6 6 6 6"/></svg>
+{:else if name === 'mdiChevronDown'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M6 9l6 6 6-6"/></svg>
+{:else if name === 'mdiMagnify'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="7"/><path d="M21 21l-4.3-4.3"/></svg>
+{:else if name === 'mdiLogout'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4M16 17l5-5-5-5M21 12H9"/></svg>
+{:else if name === 'mdiKeyVariant'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><circle cx="8" cy="15" r="4"/><path d="M11 13l9-9 2 2-2 2 2 2-3 3-2-2"/></svg>
+{:else if name === 'mdiApi'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="18" height="18" rx="3"/><path d="M7 16V9a2 2 0 1 1 4 0v7M7 13h4M14 9v7M17 9v7"/></svg>
+{:else if name === 'mdiWeatherNight'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12.8A9 9 0 1 1 11.2 3a7 7 0 0 0 9.8 9.8z"/></svg>
+{:else if name === 'mdiWeatherSunny'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="4"/><path d="M12 3v2M12 19v2M3 12h2M19 12h2M5.6 5.6l1.4 1.4M17 17l1.4 1.4M5.6 18.4L7 17M17 7l1.4-1.4"/></svg>
+{:else if name === 'mdiDesktopTowerMonitor'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><rect x="2" y="4" width="14" height="10" rx="1"/><path d="M9 14v3M6 17h6"/><rect x="18" y="4" width="4" height="16" rx="1"/></svg>
+{:else if name === 'mdiFilterOff'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M3 3l18 18M22 3H6l3.4 4.4M14 13v8l-4-2v-4"/></svg>
+{:else if name === 'mdiDotsHorizontal'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="currentColor"><circle cx="6" cy="12" r="1.6"/><circle cx="12" cy="12" r="1.6"/><circle cx="18" cy="12" r="1.6"/></svg>
+{:else if name === 'mdiPulse'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M3 12h4l3-9 4 18 3-9h4"/></svg>
+{:else if name === 'mdiPlus'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 5v14M5 12h14"/></svg>
+{:else if name === 'mdiArrowRight'}
+	<svg viewBox="0 0 24 24" width={size} height={size} fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M5 12h14M12 5l7 7-7 7"/></svg>
+{:else}
+	<MdiIcon {name} {size} />
+{/if}

frontend/src/lib/components/PageHeader.svelte

@@ -1,21 +1,222 @@
 <script lang="ts">
-	let { title, description = '', children } = $props<{
+	import type { Snippet } from 'svelte';
+
+	export interface HeaderPill {
+		label: string;
+		tone?: 'mint' | 'sky' | 'orchid' | 'coral' | 'citrus' | 'primary';
+		icon?: string;
+	}
+
+	interface Props {
 		title: string;
+		/** Italic-emphasized word(s) appended to the title with a gradient. */
+		emphasis?: string;
+		/** Body text under the title. */
 		description?: string;
-		children?: import('svelte').Snippet;
-	}>();
+		/** Small label above the title (breadcrumb / section). */
+		crumb?: string;
+		/** Right-side count meter — e.g. "12 providers". */
+		count?: number | string;
+		/** Label under the count, e.g. "providers". */
+		countLabel?: string;
+		/** Status pills shown beneath the description. */
+		pills?: HeaderPill[];
+		/** Primary actions (buttons) — rendered top-right next to the meter. */
+		children?: Snippet;
+	}
+
+	let {
+		title,
+		emphasis = '',
+		description = '',
+		crumb = '',
+		count,
+		countLabel = '',
+		pills = [],
+		children,
+	}: Props = $props();
+
+	const toneColors: Record<NonNullable<HeaderPill['tone']>, string> = {
+		mint: 'var(--color-mint)',
+		sky: 'var(--color-sky)',
+		orchid: 'var(--color-orchid)',
+		coral: 'var(--color-coral)',
+		citrus: 'var(--color-citrus)',
+		primary: 'var(--color-primary)',
+	};
 </script>
 
-<div class="flex items-center justify-between mb-8">
-	<div class="animate-fade-slide-in">
-		<h2 class="text-2xl font-semibold tracking-tight">{title}</h2>
-		{#if description}
-			<p class="text-sm mt-1.5" style="color: var(--color-muted-foreground);">{description}</p>
-		{/if}
-	</div>
-	{#if children}
-		<div class="animate-fade-slide-in" style="animation-delay: 60ms;">
-			{@render children()}
+<section class="subpage-hero">
+	<div class="subpage-hero__row">
+		<div class="subpage-hero__main">
+			{#if crumb}
+				<div class="subpage-hero__crumb">{crumb}</div>
+			{/if}
+			<h2 class="subpage-hero__title">
+				{title}{#if emphasis}&nbsp;<em>{emphasis}</em>{/if}
+			</h2>
+			{#if description}
+				<p class="subpage-hero__sub">{description}</p>
+			{/if}
+			{#if pills.length > 0}
+				<div class="subpage-hero__pills">
+					{#each pills as p}
+						<span class="subpage-hero__pill">
+							<span class="subpage-hero__pill-dot" style="background: {toneColors[p.tone ?? 'primary']}"></span>
+							{p.label}
+						</span>
+					{/each}
+				</div>
+			{/if}
 		</div>
-	{/if}
-</div>
+
+		<div class="subpage-hero__side">
+			{#if count !== undefined}
+				<div class="subpage-hero__meter">
+					<div class="subpage-hero__meter-value font-mono">{count}</div>
+					{#if countLabel}
+						<div class="subpage-hero__meter-label">{countLabel}</div>
+					{/if}
+				</div>
+			{/if}
+			{#if children}
+				<div class="subpage-hero__actions">{@render children()}</div>
+			{/if}
+		</div>
+	</div>
+</section>
+
+<style>
+	.subpage-hero {
+		position: relative;
+		background: var(--color-glass);
+		backdrop-filter: blur(28px) saturate(160%);
+		-webkit-backdrop-filter: blur(28px) saturate(160%);
+		border: 1px solid var(--color-border);
+		border-radius: 22px;
+		box-shadow: var(--shadow-card);
+		padding: 1.4rem 1.6rem 1.5rem;
+		margin-bottom: 1.5rem;
+		overflow: hidden;
+	}
+	.subpage-hero::after {
+		content: '';
+		position: absolute;
+		inset: 0;
+		border-radius: inherit;
+		pointer-events: none;
+		background: linear-gradient(180deg, var(--color-highlight), transparent 30%);
+		opacity: 0.4;
+	}
+	.subpage-hero__row {
+		position: relative;
+		z-index: 1;
+		display: flex;
+		align-items: stretch;
+		justify-content: space-between;
+		gap: 1.5rem;
+		flex-wrap: wrap;
+		min-height: 100%;
+	}
+	.subpage-hero__main { min-width: 0; flex: 1; }
+
+	.subpage-hero__crumb {
+		font-family: var(--font-mono);
+		font-size: 0.62rem;
+		color: var(--color-muted-foreground);
+		letter-spacing: 0.18em;
+		text-transform: uppercase;
+		margin-bottom: 0.55rem;
+		font-weight: 500;
+	}
+	.subpage-hero__title {
+		font-family: var(--font-display);
+		font-weight: 400;
+		font-size: 2.15rem;
+		line-height: 1.05;
+		letter-spacing: -0.025em;
+		color: var(--color-foreground);
+		margin: 0;
+	}
+	.subpage-hero__title em {
+		font-style: italic;
+		background: linear-gradient(135deg, var(--color-orchid), var(--color-primary) 60%, var(--color-sky));
+		-webkit-background-clip: text;
+		background-clip: text;
+		color: transparent;
+	}
+	.subpage-hero__sub {
+		font-size: 0.88rem;
+		color: var(--color-muted-foreground);
+		margin: 0.55rem 0 0;
+		line-height: 1.55;
+		max-width: 60ch;
+	}
+	.subpage-hero__pills {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.4rem;
+		margin-top: 0.85rem;
+	}
+	.subpage-hero__pill {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.35rem;
+		padding: 0.22rem 0.65rem;
+		border-radius: 999px;
+		background: var(--color-glass-strong);
+		border: 1px solid var(--color-border);
+		font-size: 0.7rem;
+		color: var(--color-muted-foreground);
+		font-weight: 500;
+	}
+	.subpage-hero__pill-dot {
+		width: 6px;
+		height: 6px;
+		border-radius: 50%;
+	}
+
+	.subpage-hero__side {
+		display: flex;
+		flex-direction: column;
+		align-items: flex-end;
+		flex-shrink: 0;
+	}
+	.subpage-hero__meter {
+		text-align: right;
+		display: flex;
+		flex-direction: column;
+		align-items: flex-end;
+		justify-content: center;
+	}
+	.subpage-hero__actions {
+		margin-top: auto;
+		padding-top: 0.95rem;
+		display: flex;
+		gap: 0.5rem;
+		align-items: center;
+	}
+	.subpage-hero__meter-value {
+		font-size: 2.15rem;
+		font-weight: 500;
+		color: var(--color-foreground);
+		font-variant-numeric: tabular-nums;
+		line-height: 1;
+		letter-spacing: -0.025em;
+	}
+	.subpage-hero__meter-label {
+		font-size: 0.62rem;
+		text-transform: uppercase;
+		letter-spacing: 0.16em;
+		color: var(--color-muted-foreground);
+		margin-top: 0.4rem;
+		font-weight: 500;
+	}
+
+	@media (max-width: 640px) {
+		.subpage-hero { padding: 1.1rem 1.2rem 1.25rem; }
+		.subpage-hero__title { font-size: 1.7rem; }
+		.subpage-hero__row { flex-direction: column; align-items: stretch; }
+		.subpage-hero__side { justify-content: space-between; }
+	}
+</style>

frontend/src/lib/components/SearchPalette.svelte

@@ -26,7 +26,9 @@
 	let query = $state('');
 	let activeIndex = $state(0);
 	let loading = $state(false);
-	let inputEl: HTMLInputElement;
+	let inputEl = $state<HTMLInputElement | undefined>();
+	const listboxId = 'sp-listbox';
+	const optionId = (idx: number) => `sp-option-${idx}`;
 
 	// Expose openPalette to parent via callback
 	$effect(() => { onopen?.(openPalette); });
@@ -206,7 +208,7 @@
 
 {#if open}
 	<!-- Backdrop -->
-	<div class="sp-backdrop" onclick={closePalette} role="presentation"></div>
+	<div class="sp-backdrop" onclick={closePalette} onkeydown={(e) => { if (e.key === 'Escape') closePalette(); }} role="button" tabindex="-1" aria-label={t('searchPalette.close')}></div>
 
 	<!-- Palette -->
 	<div class="sp-container">
@@ -218,11 +220,16 @@
 				placeholder={t('searchPalette.placeholder')}
 				class="sp-input"
 				type="text"
+				role="combobox"
+				aria-expanded={flatResults.length > 0}
+				aria-controls={listboxId}
+				aria-activedescendant={flatResults.length > 0 ? optionId(activeIndex) : undefined}
+				aria-autocomplete="list"
 			/>
 			<kbd class="sp-kbd">ESC</kbd>
 		</div>
 
-		<div class="sp-results">
+		<div class="sp-results" id={listboxId} role="listbox">
 			{#if loading}
 				<div class="sp-empty">
 					<div class="w-4 h-4 rounded-full border-2 border-[var(--color-primary)] border-t-transparent animate-spin"></div>
@@ -239,9 +246,12 @@
 						<MdiIcon name={group.icon} size={14} />
 						{group.label}
 					</div>
-					{#each group.items as item, i}
+					{#each group.items as item}
 						{@const flatIdx = flatIndexMap.get(item) ?? -1}
 						<button
+							id={optionId(flatIdx)}
+							role="option"
+							aria-selected={flatIdx === activeIndex}
 							class="sp-item"
 							class:sp-active={flatIdx === activeIndex}
 							onclick={() => navigateTo(item)}
@@ -271,129 +281,176 @@
 		position: fixed;
 		top: 0; left: 0; right: 0; bottom: 0;
 		z-index: 9998;
-		background: rgba(0, 0, 0, 0.5);
-		backdrop-filter: blur(4px);
+		background: rgba(0, 0, 0, 0.55);
+		backdrop-filter: blur(8px) saturate(120%);
+		-webkit-backdrop-filter: blur(8px) saturate(120%);
 	}
 	.sp-container {
 		position: fixed;
-		top: 20vh;
+		top: 18vh;
 		left: 50%;
 		transform: translateX(-50%);
 		z-index: 9999;
-		width: min(500px, 90vw);
-		background: var(--color-card);
-		border: 1px solid var(--color-border);
-		border-radius: 0.75rem;
-		box-shadow: 0 20px 60px rgba(0, 0, 0, 0.4);
+		width: min(640px, 92vw);
+		--sp-solid-bg: #131520;
+		background: var(--sp-solid-bg);
+		border: 1px solid var(--color-rule-strong);
+		border-radius: 18px;
+		box-shadow: var(--shadow-card), 0 30px 80px -20px rgba(0, 0, 0, 0.6);
 		overflow: hidden;
 	}
+	:global([data-theme="light"]) .sp-container { --sp-solid-bg: #fafafe; }
+	.sp-container::after {
+		content: '';
+		position: absolute;
+		inset: 0;
+		border-radius: inherit;
+		pointer-events: none;
+		background: linear-gradient(180deg, var(--color-highlight), transparent 30%);
+		opacity: 0.4;
+	}
 	.sp-input-row {
 		display: flex;
 		align-items: center;
-		gap: 0.5rem;
-		padding: 0.75rem 1rem;
+		gap: 0.65rem;
+		padding: 0.95rem 1.15rem;
 		border-bottom: 1px solid var(--color-border);
 		color: var(--color-muted-foreground);
+		position: relative;
+		z-index: 1;
 	}
 	.sp-input {
 		flex: 1;
 		border: none;
 		outline: none;
 		background: transparent;
-		font-size: 0.9rem;
+		font-size: 0.95rem;
 		color: var(--color-foreground);
+		font-family: var(--font-sans);
+		letter-spacing: -0.005em;
 	}
+	.sp-input::placeholder { color: var(--color-muted-foreground); }
 	.sp-kbd {
-		font-size: 0.6rem;
+		font-size: 0.62rem;
 		font-family: var(--font-mono);
-		padding: 0.15rem 0.35rem;
-		border-radius: 0.25rem;
-		background: var(--color-muted);
-		color: var(--color-muted-foreground);
+		padding: 0.2rem 0.45rem;
+		border-radius: 6px;
+		background: var(--color-glass-strong);
+		color: var(--color-foreground);
 		border: 1px solid var(--color-border);
 	}
 	.sp-results {
-		max-height: 50vh;
+		max-height: 52vh;
 		overflow-y: auto;
+		overscroll-behavior: contain;
 		scrollbar-width: thin;
-		padding: 0.25rem;
+		padding: 0.35rem;
+		position: relative;
+		z-index: 1;
 	}
 	.sp-empty {
 		display: flex;
 		align-items: center;
 		justify-content: center;
-		gap: 0.5rem;
-		padding: 2rem;
+		gap: 0.55rem;
+		padding: 2.5rem 2rem;
 		color: var(--color-muted-foreground);
 		font-size: 0.85rem;
 	}
 	.sp-group-header {
 		display: flex;
 		align-items: center;
-		gap: 0.375rem;
-		padding: 0.375rem 0.75rem;
-		font-size: 0.65rem;
+		gap: 0.45rem;
+		padding: 0.6rem 0.85rem 0.35rem;
+		font-size: 0.6rem;
 		font-weight: 600;
 		text-transform: uppercase;
-		letter-spacing: 0.04em;
+		letter-spacing: 0.16em;
 		color: var(--color-muted-foreground);
 		font-family: var(--font-mono);
-		margin-top: 0.25rem;
+	}
+	.sp-group-header::after {
+		content: '';
+		flex: 1;
+		height: 1px;
+		background: var(--color-border);
+		margin-left: 0.35rem;
 	}
 	.sp-item {
 		display: flex;
 		align-items: center;
-		gap: 0.5rem;
+		gap: 0.65rem;
 		width: 100%;
-		padding: 0.5rem 0.75rem;
-		border-radius: 0.375rem;
-		border: none;
+		padding: 0.55rem 0.85rem;
+		border-radius: 10px;
+		border: 1px solid transparent;
 		background: transparent;
 		color: var(--color-foreground);
-		font-size: 0.85rem;
+		font-size: 0.88rem;
 		cursor: pointer;
 		text-align: left;
-		transition: background 0.1s;
+		transition: background 0.12s, border-color 0.12s;
+		font-family: var(--font-sans);
 	}
 	.sp-item:hover, .sp-item.sp-active {
-		background: var(--color-muted);
+		background: var(--color-glass-strong);
+		border-color: var(--color-border);
+	}
+	.sp-item.sp-active {
+		background: linear-gradient(135deg,
+			color-mix(in srgb, var(--color-primary) 14%, transparent),
+			color-mix(in srgb, var(--color-orchid) 14%, transparent));
+		border-color: color-mix(in srgb, var(--color-primary) 40%, var(--color-border));
+		box-shadow: inset 0 1px 0 var(--color-highlight);
 	}
 	.sp-item-icon {
 		flex-shrink: 0;
 		color: var(--color-muted-foreground);
+		width: 28px; height: 28px;
+		display: grid; place-items: center;
+		border-radius: 8px;
+		background: var(--color-glass-strong);
+		border: 1px solid var(--color-border);
 	}
 	.sp-item.sp-active .sp-item-icon {
 		color: var(--color-primary);
+		background: var(--color-glass-elev);
 	}
 	.sp-item-name {
 		flex: 1;
 		overflow: hidden;
 		text-overflow: ellipsis;
 		white-space: nowrap;
+		font-weight: 500;
 	}
 	.sp-item-detail {
 		font-size: 0.7rem;
 		font-family: var(--font-mono);
 		color: var(--color-muted-foreground);
-		padding: 0.1rem 0.35rem;
+		padding: 0.12rem 0.5rem;
 		border-radius: 9999px;
-		background: var(--color-muted);
+		background: var(--color-glass-strong);
+		border: 1px solid var(--color-border);
 		white-space: nowrap;
 	}
 	.sp-footer {
 		display: flex;
 		gap: 1rem;
-		padding: 0.5rem 1rem;
+		padding: 0.6rem 1.15rem;
 		border-top: 1px solid var(--color-border);
 		font-size: 0.65rem;
 		color: var(--color-muted-foreground);
+		position: relative;
+		z-index: 1;
+		background: var(--color-glass-strong);
 	}
 	.sp-footer kbd {
 		font-family: var(--font-mono);
-		padding: 0.05rem 0.25rem;
-		border-radius: 0.2rem;
-		background: var(--color-muted);
+		padding: 0.1rem 0.35rem;
+		border-radius: 5px;
+		background: var(--color-glass);
 		border: 1px solid var(--color-border);
-		font-size: 0.6rem;
+		font-size: 0.62rem;
+		color: var(--color-foreground);
 	}
 </style>

frontend/src/lib/components/Snackbar.svelte

@@ -3,6 +3,7 @@
 	import { getSnacks, removeSnack, type Snack } from '$lib/stores/snackbar.svelte';
 	import MdiIcon from '$lib/components/MdiIcon.svelte';
 	import { t } from '$lib/i18n';
+	import { portal } from '$lib/portal';
 
 	const snacks = $derived(getSnacks());
 
@@ -31,15 +32,15 @@
 </script>
 
 {#if snacks.length > 0}
-	<div
-		style="position: fixed; left: 50%; transform: translateX(-50%); z-index: 9999; display: flex; flex-direction: column; gap: 0.5rem; width: 90%; max-width: 26rem; pointer-events: none;"
-		class="snackbar-container"
-	>
+	<div use:portal class="snackbar-container" role="region" aria-label={t('snackbar.region')}>
 		{#each snacks as snack (snack.id)}
 			<div
 				in:fly={{ y: 40, duration: 300 }}
 				out:fade={{ duration: 200 }}
 				class="snack-item"
+				role={snack.type === 'error' ? 'alert' : 'status'}
+				aria-live={snack.type === 'error' ? 'assertive' : 'polite'}
+				aria-atomic="true"
 				style="--snack-accent: {accentMap[snack.type]};"
 			>
 				<span class="snack-icon" style="color: {accentMap[snack.type]};">
@@ -66,6 +67,16 @@
 
 <style>
 	.snackbar-container {
+		position: fixed;
+		left: 50%;
+		transform: translateX(-50%);
+		z-index: 9999;
+		display: flex;
+		flex-direction: column;
+		gap: 0.5rem;
+		width: 90%;
+		max-width: 26rem;
+		pointer-events: none;
 		bottom: 5rem;
 	}
 	@media (min-width: 768px) {
@@ -75,20 +86,21 @@
 	}
 
 	.snack-item {
+		--snack-solid-bg: #131520;
 		pointer-events: auto;
 		display: flex;
 		align-items: flex-start;
 		gap: 0.625rem;
-		padding: 0.75rem 1rem;
-		border-radius: 0.75rem;
+		padding: 0.85rem 1rem;
+		border-radius: 14px;
 		border-left: 3px solid var(--snack-accent);
-		background: var(--color-card);
-		border-top: 1px solid var(--color-border);
-		border-right: 1px solid var(--color-border);
-		border-bottom: 1px solid var(--color-border);
-		box-shadow: 0 8px 24px rgba(0, 0, 0, 0.12), 0 0 0 1px rgba(255, 255, 255, 0.03) inset;
-		backdrop-filter: blur(12px);
+		background: var(--snack-solid-bg);
+		border-top: 1px solid var(--color-rule-strong);
+		border-right: 1px solid var(--color-rule-strong);
+		border-bottom: 1px solid var(--color-rule-strong);
+		box-shadow: var(--shadow-card), 0 12px 30px -10px rgba(0, 0, 0, 0.4);
 	}
+	:global([data-theme="light"]) .snack-item { --snack-solid-bg: #fafafe; }
 
 	:global([data-theme="dark"]) .snack-item {
 		box-shadow: 0 8px 24px rgba(0, 0, 0, 0.4), 0 0 16px color-mix(in srgb, var(--snack-accent) 10%, transparent);

frontend/src/lib/components/TagInput.svelte

@@ -0,0 +1,154 @@
+<script lang="ts">
+	/**
+	 * Free-text chip input. Bind a string[] of values; commit a new chip on
+	 * Enter, comma, or blur. Backspace on empty input deletes the last chip
+	 * for parity with native chip-input UX.
+	 *
+	 * Used by ProviderDescriptor.userFilters with inputMode === 'tags' for
+	 * free-text filter keys like Home Assistant's entity_glob and
+	 * domain_allowlist. Distinct from MultiEntitySelect, which renders a
+	 * picker dropdown sourced from an enumerable list.
+	 */
+	import MdiIcon from './MdiIcon.svelte';
+
+	interface Props {
+		values: string[];
+		onchange: (values: string[]) => void;
+		placeholder?: string;
+		icon?: string;
+		/** Strip / reject anything matching this regex on each entry. */
+		sanitize?: (raw: string) => string | null;
+	}
+
+	let { values, onchange, placeholder = '', icon, sanitize }: Props = $props();
+
+	let draft = $state('');
+
+	function addRaw(raw: string): void {
+		const trimmed = raw.trim();
+		if (!trimmed) return;
+		const cleaned = sanitize ? sanitize(trimmed) : trimmed;
+		if (!cleaned) return;
+		if (values.includes(cleaned)) return;
+		onchange([...values, cleaned]);
+	}
+
+	function commitDraft(): void {
+		if (!draft.trim()) return;
+		// Allow comma-separated paste — split on commas and add each.
+		for (const piece of draft.split(',')) {
+			addRaw(piece);
+		}
+		draft = '';
+	}
+
+	function removeAt(index: number): void {
+		onchange(values.filter((_, i) => i !== index));
+	}
+
+	function onKey(e: KeyboardEvent): void {
+		if (e.key === 'Enter' || e.key === ',') {
+			e.preventDefault();
+			commitDraft();
+		} else if (e.key === 'Backspace' && draft === '' && values.length > 0) {
+			e.preventDefault();
+			removeAt(values.length - 1);
+		}
+	}
+</script>
+
+<div class="tag-input">
+	{#each values as value, i (`${i}-${value}`)}
+		<span class="tag-chip">
+			{#if icon}<MdiIcon name={icon} size={12} />{/if}
+			<span class="tag-text">{value}</span>
+			<button
+				type="button"
+				aria-label="Remove"
+				class="tag-remove"
+				onclick={() => removeAt(i)}
+			>×</button>
+		</span>
+	{/each}
+	<input
+		type="text"
+		bind:value={draft}
+		onkeydown={onKey}
+		onblur={commitDraft}
+		placeholder={values.length === 0 ? placeholder : ''}
+		class="tag-draft"
+		autocomplete="off"
+		spellcheck="false"
+	/>
+</div>
+
+<style>
+	.tag-input {
+		display: flex;
+		flex-wrap: wrap;
+		align-items: center;
+		gap: 0.375rem;
+		padding: 0.375rem 0.5rem;
+		min-height: 2.5rem;
+		border: 1px solid var(--color-border);
+		border-radius: 0.375rem;
+		background: var(--color-background);
+		cursor: text;
+	}
+
+	.tag-input:focus-within {
+		border-color: var(--color-primary);
+	}
+
+	.tag-chip {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.25rem;
+		padding: 0.1875rem 0.5rem;
+		background: var(--color-muted);
+		border-radius: 9999px;
+		font-size: 0.75rem;
+		line-height: 1;
+		color: var(--color-foreground);
+	}
+
+	.tag-text {
+		font-family: var(--font-mono, monospace);
+	}
+
+	.tag-remove {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		width: 1rem;
+		height: 1rem;
+		padding: 0;
+		font-size: 0.875rem;
+		line-height: 1;
+		background: transparent;
+		border: none;
+		color: var(--color-muted-foreground);
+		cursor: pointer;
+		border-radius: 9999px;
+	}
+
+	.tag-remove:hover {
+		background: var(--color-border);
+		color: var(--color-foreground);
+	}
+
+	.tag-draft {
+		flex: 1;
+		min-width: 8rem;
+		border: none;
+		outline: none;
+		background: transparent;
+		font-size: 0.875rem;
+		color: var(--color-foreground);
+		padding: 0.125rem 0;
+	}
+
+	.tag-draft::placeholder {
+		color: var(--color-muted-foreground);
+	}
+</style>

frontend/src/lib/components/TimeListEditor.svelte

@@ -0,0 +1,252 @@
+<script lang="ts">
+	/**
+	 * Multi-time-point editor — an add/remove list of native HH:MM pickers.
+	 *
+	 * Used in the tracking-configs form for the Immich scheduled / periodic /
+	 * memory slots, which fire at one or more wall-clock times per day. The
+	 * value crosses the wire as a single comma-separated string ("09:00,18:30")
+	 * matching the backend `normalize_time_list`: each emitted value is
+	 * de-duplicated and sorted ascending.
+	 *
+	 * Internally `rows` is the rendering source of truth and preserves the
+	 * user's current edit state (including a blank, not-yet-filled row) so the
+	 * list never jumps around mid-edit. Normalisation is applied only to the
+	 * emitted value, not to what's on screen; the on-screen order re-settles to
+	 * sorted form on the next external load.
+	 */
+	import { untrack } from 'svelte';
+	import MdiIcon from './MdiIcon.svelte';
+	import { t } from '$lib/i18n';
+
+	interface Props {
+		/** Comma-separated HH:MM list, e.g. "09:00,18:30". */
+		value: string;
+		/** Called with a normalised (deduped, sorted) comma-separated string. */
+		onchange: (value: string) => void;
+		/** Maximum number of distinct times allowed. */
+		max?: number;
+		/** Placeholder forwarded to each native time input. */
+		placeholder?: string;
+	}
+
+	let { value, onchange, max = 24, placeholder = '' }: Props = $props();
+
+	let rows = $state<string[]>([]);
+
+	// The exact string we last synced-from or emitted. The resync effect below
+	// compares against this so it fires ONLY for genuine external `value` changes
+	// (form reset, config switch) — never for the user's own keystrokes. Without
+	// this guard the effect re-ran on every `bind:value` mutation while `value`
+	// still held the old committed string, clobbering the row being typed in (the
+	// native picker reset just as the user reached the AM/PM segment).
+	let lastValue = '';
+
+	function parse(raw: string): string[] {
+		return (raw ?? '').split(',').map((s) => s.trim()).filter(Boolean);
+	}
+
+	/** Distinct, non-blank times, in first-seen order. */
+	function distinct(list: string[]): string[] {
+		const seen = new Set<string>();
+		for (const r of list) {
+			const v = r.trim();
+			if (v) seen.add(v);
+		}
+		return [...seen];
+	}
+
+	// Populate on mount and re-sync on external `value` changes only. `value` is
+	// the sole reactive dependency; `rows` is read/written inside `untrack`, so
+	// editing a row never re-triggers this and can't clobber an in-progress edit.
+	// `$effect.pre` runs before the first paint, so initial rows show without a
+	// flash of the empty state. HH:MM is zero-padded, so a lexical sort is
+	// chronological.
+	$effect.pre(() => {
+		const incoming = value ?? '';
+		untrack(() => {
+			if (incoming !== lastValue) {
+				rows = parse(incoming);
+				lastValue = incoming;
+			}
+		});
+	});
+
+	function emit(): void {
+		const next = distinct(rows).sort().join(',');
+		// Record before emitting so the value round-trip back through the parent
+		// isn't mistaken for an external change and used to reset `rows`.
+		lastValue = next;
+		onchange(next);
+	}
+
+	// Fired when a row's picker changes. Collapse any on-screen duplicate of an
+	// already-present time (keeping the first occurrence and any blank
+	// in-progress row) so the displayed rows match what's persisted — emit()
+	// dedups the saved value, and without this the screen would keep showing two
+	// identical rows. Then emit the canonical value.
+	function onRowChange(): void {
+		const seen = new Set<string>();
+		const next: string[] = [];
+		for (const r of rows) {
+			const v = r.trim();
+			if (!v) { next.push(r); continue; }
+			if (seen.has(v)) continue;
+			seen.add(v);
+			next.push(r);
+		}
+		if (next.length !== rows.length) rows = next;
+		emit();
+	}
+
+	const filledCount = $derived(distinct(rows).length);
+	const hasBlankRow = $derived(rows.some((r) => !r.trim()));
+	const atMax = $derived(filledCount >= max);
+	// Block adding while a blank row is open (fill it first) or the cap is hit —
+	// keeps the list from stacking empty rows and respects the per-day limit.
+	const canAdd = $derived(!atMax && !hasBlankRow);
+
+	function addRow(): void {
+		if (!canAdd) return;
+		rows = [...rows, ''];
+	}
+
+	function removeRow(index: number): void {
+		rows = rows.filter((_, i) => i !== index);
+		emit();
+	}
+</script>
+
+<div class="time-list">
+	{#each rows as _, i (i)}
+		<div class="time-row">
+			<input
+				type="time"
+				bind:value={rows[i]}
+				onchange={onRowChange}
+				{placeholder}
+				aria-label={t('trackingConfig.timeRowLabel').replace('{n}', String(i + 1))}
+				class="time-input"
+			/>
+			<button
+				type="button"
+				class="time-remove"
+				aria-label={t('trackingConfig.removeTime')}
+				onclick={() => removeRow(i)}
+			>
+				<MdiIcon name="mdiClose" size={14} />
+			</button>
+		</div>
+	{/each}
+
+	{#if rows.length === 0}
+		<p class="time-empty">
+			<MdiIcon name="mdiClockOutline" size={12} />
+			<span>{t('trackingConfig.noTimes')}</span>
+		</p>
+	{/if}
+
+	{#if atMax}
+		<p class="time-cap">{t('trackingConfig.maxTimesReached').replace('{n}', String(max))}</p>
+	{:else}
+		<button type="button" class="time-add" disabled={!canAdd} onclick={addRow}>
+			<MdiIcon name="mdiPlus" size={14} />
+			<span>{t('trackingConfig.addTime')}</span>
+		</button>
+	{/if}
+</div>
+
+<style>
+	.time-list {
+		display: flex;
+		flex-direction: column;
+		gap: 0.375rem;
+	}
+
+	.time-row {
+		display: flex;
+		align-items: center;
+		gap: 0.375rem;
+	}
+
+	.time-input {
+		flex: 1;
+		min-width: 0;
+		padding: 0.3125rem 0.5rem;
+		border: 1px solid var(--color-border);
+		border-radius: 0.375rem;
+		background: var(--color-background);
+		color: var(--color-foreground);
+		font-size: 0.875rem;
+		line-height: 1.25;
+		font-variant-numeric: tabular-nums;
+	}
+
+	.time-input:focus {
+		outline: none;
+		border-color: var(--color-primary);
+		box-shadow: 0 0 0 1px var(--color-primary);
+	}
+
+	.time-remove {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		flex-shrink: 0;
+		width: 1.75rem;
+		height: 1.75rem;
+		padding: 0;
+		border: 1px solid transparent;
+		border-radius: 0.375rem;
+		background: transparent;
+		color: var(--color-muted-foreground);
+		cursor: pointer;
+		transition: color 0.12s ease, background 0.12s ease;
+	}
+
+	.time-remove:hover {
+		background: var(--color-muted);
+		color: var(--color-error-fg);
+	}
+
+	.time-add {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		gap: 0.3125rem;
+		width: 100%;
+		padding: 0.3125rem 0.5rem;
+		border: 1px dashed var(--color-border);
+		border-radius: 0.375rem;
+		background: transparent;
+		color: var(--color-muted-foreground);
+		font-size: 0.8125rem;
+		line-height: 1.25;
+		cursor: pointer;
+		transition: color 0.12s ease, border-color 0.12s ease, background 0.12s ease;
+	}
+
+	.time-add:hover:not(:disabled) {
+		border-color: var(--color-primary);
+		color: var(--color-primary);
+		background: var(--color-muted);
+	}
+
+	.time-add:disabled {
+		opacity: 0.5;
+		cursor: default;
+	}
+
+	.time-empty {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.25rem;
+		font-size: 0.6875rem;
+		color: var(--color-muted-foreground);
+	}
+
+	.time-cap {
+		font-size: 0.6875rem;
+		color: var(--color-muted-foreground);
+		text-align: center;
+	}
+</style>

frontend/src/lib/components/TimezoneSelector.svelte

@@ -2,6 +2,7 @@
 	import { onMount, onDestroy } from 'svelte';
 	import MdiIcon from './MdiIcon.svelte';
 	import { t } from '$lib/i18n';
+	import { portal } from '$lib/portal';
 
 	let {
 		value = $bindable<string>('UTC'),
@@ -172,18 +173,12 @@
 
 	$effect(() => { query; highlightIdx = 0; });
 
-	// Close on outside click
-	function onDocClick(e: MouseEvent) {
-		if (!open) return;
-		const target = e.target as Node;
-		if (panelEl && !panelEl.contains(target)) closePicker();
-	}
-	onMount(() => {
-		document.addEventListener('mousedown', onDocClick);
-	});
-	onDestroy(() => {
-		document.removeEventListener('mousedown', onDocClick);
-	});
+	/**
+	 * The panel is portalled to <body> to escape Card's overflow:hidden +
+	 * backdrop-filter (which would otherwise clip and stacking-trap the
+	 * dropdown). Outside-click is detected via the dedicated overlay div
+	 * rather than a document listener, so we don't need a global handler.
+	 */
 </script>
 
 <div class="tz-root">
@@ -217,83 +212,87 @@
 	</button>
 
 	{#if open}
-		<div class="tz-panel" bind:this={panelEl} role="listbox">
-			<!-- Search -->
-			<div class="tz-search-row">
-				<MdiIcon name="mdiMagnify" size={14} />
-				<input
-					bind:this={inputEl}
-					bind:value={query}
-					onkeydown={onKeydown}
-					placeholder={t('timezone.searchPlaceholder')}
-					class="tz-search"
-					autocomplete="off"
-					spellcheck="false"
-					type="text"
-				/>
-				<kbd class="tz-kbd">ESC</kbd>
-			</div>
+		<div use:portal class="tz-portal-root">
+			<div class="tz-overlay" onclick={closePicker} role="presentation"></div>
 
-			<!-- Quick picks -->
-			{#if !query}
-				<div class="tz-quick">
-					<button
-						type="button"
-						class="tz-quick-btn"
-						class:tz-quick-active={value === detectedTz}
-						onclick={() => selectTz(detectedTz)}
-					>
-						<MdiIcon name="mdiCrosshairsGps" size={12} />
-						<span class="tz-quick-label">{t('timezone.detect')}</span>
-						<span class="tz-quick-val">{detectedTz}</span>
-					</button>
-					<button
-						type="button"
-						class="tz-quick-btn"
-						class:tz-quick-active={value === 'UTC' || value === 'Etc/UTC'}
-						onclick={() => selectTz('UTC')}
-					>
-						<MdiIcon name="mdiEarth" size={12} />
-						<span class="tz-quick-label">{t('timezone.utc')}</span>
-						<span class="tz-quick-val">UTC+00</span>
-					</button>
+			<div class="tz-panel" bind:this={panelEl} role="listbox">
+				<!-- Search -->
+				<div class="tz-search-row">
+					<MdiIcon name="mdiMagnify" size={14} />
+					<input
+						bind:this={inputEl}
+						bind:value={query}
+						onkeydown={onKeydown}
+						placeholder={t('timezone.searchPlaceholder')}
+						class="tz-search"
+						autocomplete="off"
+						spellcheck="false"
+						type="text"
+					/>
+					<kbd class="tz-kbd">ESC</kbd>
 				</div>
-			{/if}
 
-			<!-- Grouped list -->
-			<div class="tz-list">
-				{#if filtered.length === 0}
-					<div class="tz-empty">{t('timezone.noMatches')}</div>
-				{:else}
-					{#each groups as g (g.region)}
-						<div class="tz-group">
-							<div class="tz-group-head">
-								<span class="tz-group-name">{g.region}</span>
-								<span class="tz-group-count">{g.items.length}</span>
-							</div>
-							{#each g.items as tz (tz)}
-								{@const parts = splitTz(tz)}
-								{@const idx = flat.indexOf(tz)}
-								{@const hl = idx === highlightIdx}
-								{@const sel = tz === value}
-								<button
-									type="button"
-									role="option"
-									aria-selected={sel}
-									class="tz-opt"
-									class:tz-opt-hl={hl}
-									class:tz-opt-sel={sel}
-									onmouseenter={() => (highlightIdx = idx)}
-									onclick={() => selectTz(tz)}
-								>
-									<span class="tz-opt-city">{parts.city}</span>
-									<span class="tz-opt-iana">{tz}</span>
-									<span class="tz-opt-offset">{fmtOffset(tz)}</span>
-								</button>
-							{/each}
-						</div>
-					{/each}
+				<!-- Quick picks -->
+				{#if !query}
+					<div class="tz-quick">
+						<button
+							type="button"
+							class="tz-quick-btn"
+							class:tz-quick-active={value === detectedTz}
+							onclick={() => selectTz(detectedTz)}
+						>
+							<MdiIcon name="mdiCrosshairsGps" size={12} />
+							<span class="tz-quick-label">{t('timezone.detect')}</span>
+							<span class="tz-quick-val">{detectedTz}</span>
+						</button>
+						<button
+							type="button"
+							class="tz-quick-btn"
+							class:tz-quick-active={value === 'UTC' || value === 'Etc/UTC'}
+							onclick={() => selectTz('UTC')}
+						>
+							<MdiIcon name="mdiEarth" size={12} />
+							<span class="tz-quick-label">{t('timezone.utc')}</span>
+							<span class="tz-quick-val">UTC+00</span>
+						</button>
+					</div>
 				{/if}
+
+				<!-- Grouped list -->
+				<div class="tz-list">
+					{#if filtered.length === 0}
+						<div class="tz-empty">{t('timezone.noMatches')}</div>
+					{:else}
+						{#each groups as g (g.region)}
+							<div class="tz-group">
+								<div class="tz-group-head">
+									<span class="tz-group-name">{g.region}</span>
+									<span class="tz-group-count">{g.items.length}</span>
+								</div>
+								{#each g.items as tz (tz)}
+									{@const parts = splitTz(tz)}
+									{@const idx = flat.indexOf(tz)}
+									{@const hl = idx === highlightIdx}
+									{@const sel = tz === value}
+									<button
+										type="button"
+										role="option"
+										aria-selected={sel}
+										class="tz-opt"
+										class:tz-opt-hl={hl}
+										class:tz-opt-sel={sel}
+										onmouseenter={() => (highlightIdx = idx)}
+										onclick={() => selectTz(tz)}
+									>
+										<span class="tz-opt-city">{parts.city}</span>
+										<span class="tz-opt-iana">{tz}</span>
+										<span class="tz-opt-offset">{fmtOffset(tz)}</span>
+									</button>
+								{/each}
+							</div>
+						{/each}
+					{/if}
+				</div>
 			</div>
 		</div>
 	{/if}
@@ -408,35 +407,66 @@
 		align-items: center;
 	}
 
-	/* ---- Panel -------------------------------------------------------- */
-	.tz-panel {
+	/* ---- Portal + overlay (escapes Card's overflow:hidden / backdrop-filter) ---- */
+	.tz-portal-root {
+		position: fixed;
+		inset: 0;
+		z-index: 9998;
+		pointer-events: none;
+	}
+	.tz-overlay {
 		position: absolute;
-		top: calc(100% + 0.375rem);
-		left: 0;
-		right: 0;
-		z-index: 20;
-		background: var(--color-card, var(--color-background));
-		border: 1px solid var(--color-border);
-		border-radius: 0.625rem;
-		box-shadow: 0 18px 40px rgba(0, 0, 0, 0.35);
+		inset: 0;
+		pointer-events: auto;
+		background: rgba(0, 0, 0, 0.55);
+		backdrop-filter: blur(8px) saturate(120%);
+		-webkit-backdrop-filter: blur(8px) saturate(120%);
+	}
+
+	/* ---- Panel (centered modal palette) -------------------------------- */
+	.tz-panel {
+		pointer-events: auto;
+		position: absolute;
+		top: min(20vh, 120px);
+		left: 50%;
+		transform: translateX(-50%);
+		z-index: 1;
+		width: min(540px, 92vw);
+		max-height: min(60vh, 30rem);
+		background: var(--tz-solid-bg);
+		border: 1px solid var(--color-rule-strong, var(--color-border));
+		border-radius: 16px;
+		box-shadow: var(--shadow-card, 0 18px 40px rgba(0, 0, 0, 0.35)),
+		            0 24px 48px -16px rgba(0, 0, 0, 0.55);
 		overflow: hidden;
 		display: flex;
 		flex-direction: column;
-		max-height: 26rem;
 		animation: tz-pop 0.15s ease-out;
+		--tz-solid-bg: #131520;
+	}
+	:global([data-theme="light"]) .tz-panel { --tz-solid-bg: #fafafe; }
+	.tz-panel::after {
+		content: '';
+		position: absolute; inset: 0;
+		border-radius: inherit;
+		pointer-events: none;
+		background: linear-gradient(180deg, var(--color-highlight, transparent), transparent 30%);
+		opacity: 0.4;
 	}
 	@keyframes tz-pop {
-		from { opacity: 0; transform: translateY(-3px); }
-		to   { opacity: 1; transform: translateY(0); }
+		from { opacity: 0; transform: translate(-50%, -3px); }
+		to   { opacity: 1; transform: translate(-50%, 0); }
 	}
 
 	.tz-search-row {
 		display: flex;
 		align-items: center;
 		gap: 0.5rem;
-		padding: 0.5rem 0.75rem;
+		padding: 0.85rem 1rem;
 		border-bottom: 1px solid var(--color-border);
 		color: var(--color-muted-foreground);
+		position: relative;
+		z-index: 1;
 	}
 	.tz-search {
 		flex: 1;
@@ -464,6 +494,8 @@
 		padding: 0.5rem 0.625rem;
 		border-bottom: 1px solid var(--color-border);
 		flex-wrap: wrap;
+		position: relative;
+		z-index: 1;
 	}
 	.tz-quick-btn {
 		display: inline-flex;
@@ -498,8 +530,14 @@
 
 	.tz-list {
 		overflow-y: auto;
-		padding: 0.25rem 0;
+		overscroll-behavior: contain;
+		/* No top padding — the sticky group head is at top:0 of the
+		   scroll container, so any padding-top would let scrolling
+		   items leak into the gap above the sticky header. */
+		padding: 0 0 0.25rem;
 		scrollbar-width: thin;
+		position: relative;
+		z-index: 1;
 	}
 	.tz-empty {
 		padding: 1rem;
@@ -523,7 +561,7 @@
 		color: var(--color-muted-foreground);
 		position: sticky;
 		top: 0;
-		background: var(--color-card, var(--color-background));
+		background: var(--tz-solid-bg);
 		border-bottom: 1px solid color-mix(in srgb, var(--color-border) 60%, transparent);
 		z-index: 1;
 	}

frontend/src/lib/grid-items.ts

@@ -73,6 +73,22 @@ export const localeItems = (): GridItem[] => [
 	{ value: 'ru', icon: 'mdiAlphabeticalVariant', label: 'Русский', desc: t('gridDesc.localeRu') },
 ];
 
+// --- Log level ---
+
+export const logLevelItems = (): GridItem[] => [
+	{ value: 'DEBUG', icon: 'mdiBugOutline', label: 'DEBUG', desc: t('gridDesc.logLevelDebug') },
+	{ value: 'INFO', icon: 'mdiInformationOutline', label: 'INFO', desc: t('gridDesc.logLevelInfo') },
+	{ value: 'WARNING', icon: 'mdiAlertOutline', label: 'WARNING', desc: t('gridDesc.logLevelWarning') },
+	{ value: 'ERROR', icon: 'mdiAlertOctagonOutline', label: 'ERROR', desc: t('gridDesc.logLevelError') },
+];
+
+// --- Log format ---
+
+export const logFormatItems = (): GridItem[] => [
+	{ value: 'text', icon: 'mdiFormatText', label: 'text', desc: t('gridDesc.logFormatText') },
+	{ value: 'json', icon: 'mdiCodeJson', label: 'json', desc: t('gridDesc.logFormatJson') },
+];
+
 // --- Response mode ---
 
 export const responseModeItems = (tFn: typeof t): GridItem[] => [
@@ -92,6 +108,9 @@ export const eventTypeFilterItems = (): GridItem[] => [
 	{ value: 'action_success', icon: 'mdiPlayCircle', label: t('dashboard.filterActionSuccess'), desc: t('gridDesc.actionSuccess') },
 	{ value: 'action_partial', icon: 'mdiAlertCircle', label: t('dashboard.filterActionPartial'), desc: t('gridDesc.actionPartial') },
 	{ value: 'action_failed', icon: 'mdiCloseCircle', label: t('dashboard.filterActionFailed'), desc: t('gridDesc.actionFailed') },
+	{ value: 'command_handled', icon: 'mdiChat', label: t('dashboard.filterCommandHandled'), desc: t('gridDesc.commandHandled') },
+	{ value: 'command_rate_limited', icon: 'mdiTimerSandPaused', label: t('dashboard.filterCommandRateLimited'), desc: t('gridDesc.commandRateLimited') },
+	{ value: 'command_failed', icon: 'mdiAlertCircle', label: t('dashboard.filterCommandFailed'), desc: t('gridDesc.commandFailed') },
 ];
 
 // --- Sort filter (dashboard) ---
@@ -101,6 +120,29 @@ export const sortFilterItems = (): GridItem[] => [
 	{ value: 'oldest', icon: 'mdiSortClockAscending', label: t('dashboard.oldestFirst'), desc: t('gridDesc.oldestFirst') },
 ];
 
+// --- Provider stats scope (dashboard "On watch" deck) ---
+//
+// Toggles whether the provider deck stats reflect only the events visible
+// on the current page or aggregate across all events matching the filters.
+
+export const providerStatsModeItems = (): GridItem[] => [
+	{ value: 'page', icon: 'mdiFileDocumentOutline', label: t('dashboard.statsModePage'), desc: t('gridDesc.statsModePage') },
+	{ value: 'all',  icon: 'mdiInfinity',            label: t('dashboard.statsModeAll'),  desc: t('gridDesc.statsModeAll') },
+];
+
+// --- Auto-refresh interval (dashboard events list) ---
+//
+// Values are seconds (0 = off). Keep these in sync with REFRESH_OPTIONS
+// in routes/+page.svelte if you add or remove cadences.
+
+export const refreshIntervalItems = (): GridItem[] => [
+	{ value: 0,   icon: 'mdiPause',         label: t('dashboard.refreshOff'), desc: t('gridDesc.refreshOff') },
+	{ value: 10,  icon: 'mdiTimerSand',     label: t('dashboard.refresh10s'), desc: t('gridDesc.refresh10s') },
+	{ value: 30,  icon: 'mdiTimerOutline',  label: t('dashboard.refresh30s'), desc: t('gridDesc.refresh30s') },
+	{ value: 60,  icon: 'mdiTimer',         label: t('dashboard.refresh60s'), desc: t('gridDesc.refresh60s') },
+	{ value: 300, icon: 'mdiClockOutline',  label: t('dashboard.refresh5m'),  desc: t('gridDesc.refresh5m') },
+];
+
 // --- Chat action (Telegram targets) ---
 
 export const chatActionItems = (): GridItem[] => [
@@ -143,6 +185,19 @@ export const providerTypeFilterItems = (): GridItem[] => [
 	...allDescriptors().map(descriptorToGridItem),
 ];
 
+/** Provider types the user is allowed to create from the "new provider" wizard.
+ *
+ * Excludes ``bridge_self`` because it's auto-created exactly once per user
+ * (see ``packages/server/.../seeds.py``). Letting users pick it from the
+ * wizard would either duplicate the row or surface a confusing 409.
+ */
+const _USER_CREATABLE_PROVIDER_TYPES = (): string[] =>
+	allDescriptors()
+		.filter((d) => d.type !== 'bridge_self')
+		.map((d) => d.type);
+
 /** Provider type selector (no "All" option). */
 export const providerTypeItems = (): GridItem[] =>
-	allDescriptors().map(descriptorToGridItem);
+	allDescriptors()
+		.filter((d) => _USER_CREATABLE_PROVIDER_TYPES().includes(d.type))
+		.map(descriptorToGridItem);

frontend/src/lib/i18n/en.json

@@ -3,7 +3,22 @@
 		"name": "Notify Bridge",
 		"tagline": "Service notifications"
 	},
+	"crumbs": {
+		"routingNotification": "Routing · Notification",
+		"routingCommands": "Routing · Commands",
+		"routingTargets": "Routing · Targets",
+		"routingAutomation": "Routing · Automation",
+		"operatorsBots": "Operators · Bots",
+		"systemAccess": "System · Access",
+		"systemConfiguration": "System · Configuration",
+		"systemMaintenance": "System · Maintenance",
+		"serviceConnections": "Service · Connections"
+	},
 	"nav": {
+		"sectionOverview": "Overview",
+		"sectionRouting": "Routing",
+		"sectionOperators": "Operators",
+		"sectionSystem": "System",
 		"dashboard": "Dashboard",
 		"providers": "Providers",
 		"notificationTrackers": "Notif. Trackers",
@@ -55,7 +70,8 @@
 		"passwordTooShort": "Password must be at least 8 characters",
 		"or": "or",
 		"loginFailed": "Login failed",
-		"setupFailed": "Setup failed"
+		"setupFailed": "Setup failed",
+		"backendUnreachable": "Cannot reach the server. Check that it's running and try again."
 	},
 	"dashboard": {
 		"title": "Dashboard",
@@ -82,6 +98,15 @@
 		"actionSuccess": "action run",
 		"actionPartial": "action partial",
 		"actionFailed": "action failed",
+		"commandHandled": "command handled",
+		"commandRateLimited": "rate limited",
+		"commandFailed": "command failed",
+		"autoRefreshTitle": "Auto-refresh interval for the events list",
+		"refreshOff": "Off",
+		"refresh10s": "10s",
+		"refresh30s": "30s",
+		"refresh60s": "1m",
+		"refresh5m": "5m",
 		"searchEvents": "Search events...",
 		"allEvents": "All Events",
 		"filterAssetsAdded": "Assets Added",
@@ -92,21 +117,102 @@
 		"filterActionSuccess": "Action Success",
 		"filterActionPartial": "Action Partial",
 		"filterActionFailed": "Action Failed",
+		"filterCommandHandled": "Command Handled",
+		"filterCommandRateLimited": "Rate Limited",
+		"filterCommandFailed": "Command Failed",
 		"allProviders": "All Providers",
 		"newestFirst": "Newest first",
 		"oldestFirst": "Oldest first",
 		"loadingEvents": "Loading events...",
+		"heldUntil": "held until",
+		"deferredTitle": "Quiet hours suppressed this notification; it will dispatch when the window ends.",
+		"deliveredLate": "delivered late",
+		"deliveredLateTitle": "This notification fired after the quiet-hours window ended.",
+		"deferredThenDropped": "dropped after defer",
+		"deferredThenDroppedTitle": "Held by quiet hours, then dropped — the target or link was removed before the window ended.",
+		"deferredThenFailed": "failed after defer",
+		"suppressedQuietHours": "suppressed (quiet hours)",
+		"suppressedNondeferrableTitle": "Wall-clock event suppressed by quiet hours. Scheduled/periodic/memory dispatches drop rather than defer.",
 		"asset": "asset",
 		"assets": "assets",
 		"eventActivity": "Event Activity",
 		"last14days": "Last 14 days",
 		"event": "event",
 		"events": "events",
-		"noChartData": "No event data yet"
+		"noChartData": "No event data yet",
+		"live": "Live",
+		"attention": "Attention",
+		"heroPrefix": "Tonight,",
+		"heroEmphasis": "everything",
+		"heroSuffix": "is flowing.",
+		"heroSummary": "{providers} providers listening, {armed} of {total} trackers armed, {throughput} events dispatched across {targets} targets in 24h.",
+		"throughput24h": "throughput · 24h",
+		"eventsShort": "events",
+		"armedShort": "armed",
+		"providersShort": "providers",
+		"targetsShort": "targets",
+		"trackersShort": "trackers",
+		"streamTitle": "Signal",
+		"streamEmphasis": "stream",
+		"eventsLabel": "events",
+		"onWatchTitle": "On",
+		"onWatchEmphasis": "watch",
+		"statsModeTitle": "Provider deck stats scope",
+		"statsModePage": "Page",
+		"statsModeAll": "All",
+		"noProviders": "No providers yet.",
+		"addProvider": "Add provider",
+		"addProviderHint": "Connect a service to start tracking",
+		"pulseTitle": "Pulse",
+		"pulseEmphasis": "· last 14 days",
+		"pulseSub": "Events grouped by day",
+		"wiresTitle": "Active",
+		"wiresEmphasis": "wires",
+		"wiresSub": "routes",
+		"composeTitle": "Pick a source. Choose a channel.",
+		"composeEmphasis": "Compose the wire.",
+		"composeSub": "Walk from provider → tracker → template → target. Or paste a webhook URL and we'll infer the rest.",
+		"viewTrackers": "View trackers",
+		"newTracker": "New tracker",
+		"eventsTotal": "Events"
+	},
+	"events": {
+		"detailTitle": "Event details",
+		"bot": "Bot",
+		"chat": "Chat",
+		"issuer": "Issued by",
+		"commandTracker": "Command tracker",
+		"tracker": "Tracker",
+		"action": "Action",
+		"provider": "Provider",
+		"assetsCount": "Assets",
+		"openProvider": "Open provider",
+		"openBot": "Open bot",
+		"openCommandTracker": "Open command tracker",
+		"openAction": "Open action",
+		"openTracker": "Open tracker",
+		"rawDetails": "Raw details",
+		"lifecycle": {
+			"heldTitle": "Held by quiet hours",
+			"heldUntil": "Will dispatch at",
+			"heldFor": "Held for",
+			"heldHint": "Notifications during quiet hours wait until the window ends. Add/remove pairs cancel out automatically.",
+			"inPrefix": "in",
+			"deliveredLateTitle": "Delivered after quiet hours",
+			"originalEvent": "Original event",
+			"droppedTitle": "Dropped after defer",
+			"failedTitle": "Failed after defer",
+			"reason": "Reason",
+			"suppressedTitle": "Suppressed by quiet hours",
+			"suppressedHint": "Scheduled, periodic, and memory dispatches are wall-clock — they drop instead of deferring so a 'good morning' message doesn't arrive in the afternoon."
+		}
 	},
 	"providers": {
-		"title": "Providers",
-		"description": "Manage service provider connections",
+		"title": "Service",
+		"titleEmphasis": "providers",
+		"description": "Connect to external services and webhooks. Each provider feeds events into trackers, which dispatch notifications across your channels.",
+		"typeSingular": "type",
+		"typePlural": "types",
 		"addProvider": "Add Provider",
 		"cancel": "Cancel",
 		"type": "Provider Type",
@@ -129,6 +235,20 @@
 		"typeNut": "NUT (UPS)",
 		"typeGooglePhotos": "Google Photos",
 		"typeWebhook": "Generic Webhook",
+		"typeHomeAssistant": "Home Assistant",
+		"typeBridgeSelf": "Bridge Self-Monitoring",
+		"bridgeSelfPollThreshold": "Tracker poll failure threshold",
+		"bridgeSelfPollThresholdHint": "Notify after this many consecutive poll failures for any tracker.",
+		"bridgeSelfDeferredThreshold": "Deferred backlog threshold",
+		"bridgeSelfDeferredThresholdHint": "Notify when pending deferred-dispatch rows exceed this count.",
+		"bridgeSelfTargetThreshold": "Target send failure threshold",
+		"bridgeSelfTargetThresholdHint": "Notify after this many consecutive 5xx/network failures for any target.",
+		"haAccessToken": "Long-Lived Access Token",
+		"haAccessTokenKeep": "Long-Lived Access Token (leave empty to keep current)",
+		"haAccessTokenHint": "Create one in HA → Profile → Long-Lived Access Tokens. Required for WebSocket subscription.",
+		"haAccessTokenRequired": "Home Assistant access token is required.",
+		"haVerifyTls": "Verify TLS certificate",
+		"haVerifyTlsHint": "Disable only for self-signed HA on a trusted LAN. Keep enabled for any internet-reachable instance.",
 		"loadError": "Failed to load providers.",
 		"externalDomain": "External Domain",
 		"optional": "optional",
@@ -152,7 +272,8 @@
 		"apiToken": "API Token",
 		"apiTokenHint": "Optional. Needed for connection testing and repository listing.",
 		"webhookUrl": "Webhook URL",
-		"webhookUrlHint": "Set this as the Target URL in Gitea webhook settings (relative to your bridge host).",
+		"webhookUrlHint": "Set this as the Target URL in Gitea webhook settings. The full URL is shown when an external base URL is configured in Settings; otherwise it is relative to your bridge host.",
+		"webhookUrlCopyTitle": "Click to copy",
 		"nutHost": "NUT Server Host",
 		"nutHostPlaceholder": "192.168.1.100 or ups.local",
 		"nutPort": "NUT Server Port",
@@ -191,7 +312,10 @@
 		"cleared": "Payload history cleared"
 	},
 	"notificationTracker": {
-		"title": "Notification Trackers",
+		"title": "Notification",
+		"titleEmphasis": "trackers",
+		"armed": "armed",
+		"paused": "paused",
 		"description": "Monitor albums for changes",
 		"newTracker": "New Tracker",
 		"cancel": "Cancel",
@@ -203,10 +327,20 @@
 		"selectAlbums": "Select albums...",
 		"repositories": "Repositories",
 		"selectRepositories": "Select repositories...",
+		"userAllowlist": "Only from users",
+		"userBlocklist": "Exclude users",
+		"selectUsers": "Pick users...",
 		"boards": "Boards",
 		"selectBoards": "Select boards...",
 		"upsDevices": "UPS Devices",
 		"selectUpsDevices": "Select UPS devices...",
+		"entities": "Entities",
+		"selectEntities": "Select entities...",
+		"entities_count": "entity(ies)",
+		"haEntityGlob": "Entity glob filter",
+		"haEntityGlobPlaceholder": "light.*, binary_sensor.*_motion",
+		"haDomainAllowlist": "Domain allowlist",
+		"haDomainAllowlistPlaceholder": "light, switch, binary_sensor",
 		"eventTypes": "Event Types",
 		"notificationTargets": "Notification Targets",
 		"scanInterval": "Scan Interval (seconds)",
@@ -249,7 +383,8 @@
 		"descending": "Descending",
 		"quietHoursStart": "Quiet hours start",
 		"quietHoursEnd": "Quiet hours end",
-		"batchDuration": "Batch duration (seconds)",
+		"adaptiveMaxSkip": "Adaptive polling cap",
+		"adaptiveMaxSkipPlaceholder": "Off (blank or 0)",
 		"defaultTrackingConfig": "Default tracking config",
 		"defaultTemplateConfig": "Default template config",
 		"linkedTargets": "targets",
@@ -261,7 +396,15 @@
 		"testPeriodic": "Test periodic summary",
 		"testScheduled": "Test scheduled assets",
 		"testMemory": "Test memory / On This Day",
+		"testDisabledHint": "Enable this feature in the tracker's default Tracking Config first.",
 		"checkingLinks": "Checking links...",
+		"featureDiscovery": "Configure periodic summaries, scheduled photo picks, memories, and quiet hours in the default Tracking Config.",
+		"openTrackingConfig": "Open Tracking Config",
+		"openTemplateConfig": "Open Template Config",
+		"linkReplace": "Replace",
+		"linkReplacing": "Replacing...",
+		"linkReplaceFailed": "Failed to replace link for \"{name}\"",
+		"linkPasswordProtectedNote": "Telegram users can't open password-protected links without the password. Remove the password in Immich or replace the link.",
 		"missingLinksTitle": "Albums Missing Public Links",
 		"missingLinksDesc": "The following albums don't have public shared links. Without links, notification recipients won't be able to view photos.",
 		"expired": "Expired",
@@ -295,6 +438,11 @@
 		"albumDeleted": "Album deleted"
 	},
 	"targets": {
+		"titleEmphasis": "channel",
+		"titleEmphasisAll": "channels",
+		"receiver": "receiver",
+		"receivers": "receivers",
+		"channelsCount": "channels",
 		"title": "Targets",
 		"description": "Notification delivery destinations",
 		"descTelegram": "Telegram chat destinations for notifications",
@@ -332,6 +480,7 @@
 		"videoWarning": "Video size warning",
 		"disableUrlPreview": "Disable link previews",
 		"sendLargeAsDocuments": "Send large photos as documents",
+		"sendLargeVideosAsDocuments": "Send oversized videos as documents (bypass 50 MB limit)",
 		"chatAction": "Chat action",
 		"chatActionNone": "None (no action)",
 		"chatActionTyping": "Typing",
@@ -360,11 +509,25 @@
 		"receiverUpdated": "Receiver updated",
 		"confirmDeleteReceiver": "Delete this receiver?",
 		"receiverEnabled": "Receiver enabled",
-		"receiverDisabled": "Receiver disabled"
+		"receiverDisabled": "Receiver disabled",
+		"telegramOptions": "Telegram options",
+		"telegramOptionsSaved": "Telegram options saved",
+		"telegramDisableNotification": "Send silently (no sound / vibration)",
+		"telegramThreadId": "Forum topic ID",
+		"telegramThreadIdPlaceholder": "Leave empty for general topic",
+		"groupNoBot": "No bot linked",
+		"groupDirect": "Direct delivery",
+		"groupBotMissing": "Unknown bot",
+		"target": "target",
+		"targetsLower": "targets",
+		"openBot": "Open bot"
 	},
 	"users": {
+		"titleEmphasis": "& access",
+		"countLabel": "users",
 		"title": "Users",
 		"description": "Manage user accounts (admin only)",
+		"you": "you",
 		"addUser": "Add User",
 		"cancel": "Cancel",
 		"username": "Username",
@@ -380,6 +543,8 @@
 		"noUsers": "No users found"
 	},
 	"telegramBot": {
+		"titleEmphasis": "telegram",
+		"countLabel": "bots",
 		"title": "Telegram Bots",
 		"description": "Register and manage Telegram bots",
 		"addBot": "Add Bot",
@@ -412,6 +577,7 @@
 		"noCommandsForProvider": "This provider type does not support bot commands.",
 		"syncCommands": "Sync Commands",
 		"discoverChats": "Discover chats from Telegram",
+		"discoveringChats": "Discovering chats…",
 		"clickToCopy": "Click to copy chat ID",
 		"chatsDiscovered": "Chats discovered",
 		"chatDeleted": "Chat removed",
@@ -432,6 +598,8 @@
 		"webhookRegistered": "Webhook registered",
 		"webhookUnregistered": "Webhook unregistered",
 		"updateMode": "Update mode",
+		"none": "None",
+		"noneActive": "Listener disabled",
 		"polling": "Polling",
 		"webhook": "Webhook",
 		"webhookStatus": "Webhook status",
@@ -454,6 +622,8 @@
 		"webhookFailed": "Failed to register webhook"
 	},
 	"trackingConfig": {
+		"titleEmphasis": "configs",
+		"countLabel": "configs",
 		"title": "Tracking Configs",
 		"description": "Define what events and assets to react to",
 		"newConfig": "New Config",
@@ -501,6 +671,14 @@
 		"upsOverload": "UPS overloaded",
 		"scheduledMessage": "Scheduled message",
 		"webhookReceived": "Webhook received",
+		"haStateChanged": "Entity state changed",
+		"haAutomationTriggered": "Automation triggered",
+		"haServiceCalled": "Service called",
+		"haEventFired": "Other HA event (catch-all)",
+		"haEventFiredHint": "Fires for any HA event type not covered by the boxes above. Useful for custom integrations; expect high volume.",
+		"bridgeSelfPollFailures": "Tracker poll failures",
+		"bridgeSelfDeferredBacklog": "Deferred backlog crossed threshold",
+		"bridgeSelfTargetFailures": "Target send failures",
 		"trackImages": "Track images",
 		"trackVideos": "Track videos",
 		"favoritesOnly": "Favorites only",
@@ -549,11 +727,26 @@
 		"renamed": "renamed",
 		"deleted": "deleted",
 		"providerType": "Provider Type",
-		"sortRandom": "Random"
+		"sortRandom": "Random",
+		"timesInlineHelp": "One or more times per day",
+		"addTime": "Add time",
+		"removeTime": "Remove time",
+		"timeRowLabel": "Time {n}",
+		"noTimes": "No times set — add at least one",
+		"maxTimesReached": "Maximum {n} times reached",
+		"timesRequiredFor": "Add at least one time for \"{slot}\"",
+		"previewTemplate": "Preview template",
+		"previewSampleNote": "Rendered with sample data — not your real assets. Shows the shipped default template.",
+		"editTemplate": "Edit template",
+		"quietHoursZero": "Quiet period is 0 minutes — adjust times",
+		"nextDay": "next day"
 	},
 	"templateConfig": {
+		"titleEmphasis": "templates",
+		"countLabel": "templates",
 		"title": "Template Configs",
 		"description": "Define how notification messages are formatted",
+		"language": "Language",
 		"providerType": "Service Provider Type",
 		"newConfig": "New Config",
 		"name": "Name",
@@ -595,7 +788,14 @@
 		"confirmDelete": "Delete this template config?",
 		"invalidFormat": "Invalid format string",
 		"filterSlots": "Filter slots...",
-		"slots": "slots"
+		"slots": "slots",
+		"resetToDefault": "Reset to default",
+		"resetAllToDefaults": "Reset all to defaults",
+		"resetSlotConfirm": "Replace this slot's {locale} template with the shipped default? Your current edits will be lost.",
+		"resetAllConfirm": "Replace every slot's {locale} template with the shipped defaults? All your {locale} edits will be lost.",
+		"resetNoDefault": "No shipped default for this slot.",
+		"resetApplied": "Reset to default (not saved yet — click Save to persist)",
+		"deepLinkNoConfig": "No template config found for this provider. Create one first."
 	},
 	"templateVars": {
 		"message_assets_added": {
@@ -664,6 +864,7 @@
 		"album_shared": "Whether album is shared"
 	},
 	"settings": {
+		"titleEmphasis": "options",
 		"title": "Settings",
 		"description": "Global application settings",
 		"general": "General",
@@ -695,7 +896,115 @@
 		"locales": "Template Languages",
 		"supportedLocales": "Supported Locales",
 		"supportedLocalesHint": "Languages available when authoring notification and command templates. Built-in defaults ship for English and Russian; other languages start empty.",
-		"saved": "Settings saved"
+		"logging": "Logging",
+		"logLevel": "Log Level",
+		"logLevelHint": "Root log level for the server. Raise to DEBUG while investigating; keep at INFO in production. WARNING/ERROR hide per-command progress lines.",
+		"logFormat": "Log Format",
+		"logFormatHint": "Output format. 'text' is human-readable; 'json' emits one object per line for log aggregators (Loki, ELK). Changing this requires a server restart.",
+		"logLevels": "Per-Module Overrides",
+		"logLevelsHint": "Comma-separated 'module=LEVEL' pairs to silence noisy modules or drill into one area. Example: sqlalchemy.engine=WARNING,notify_bridge_core.notifications.telegram.client=DEBUG",
+		"saved": "Settings saved",
+		"identity": "Identity",
+		"identityHeadline": "How this instance presents itself to bots, webhooks, and recipients",
+		"telegramHeadline": "Webhook authentication and media cache tuning",
+		"loggingHeadline": "Verbosity, output format, and per-module overrides",
+		"diagnostics": "Diagnostics",
+		"diagnosticsHeadline": "Temporary DEBUG for one module, auto-reverted",
+		"diagnosticsHint": "Use to investigate a specific dispatch failure without flooding stderr. The chosen module flips to DEBUG immediately and reverts to its baseline (your per-module overrides or the noisy-library defaults) when the window ends. Restarts also reset.",
+		"diagModuleQuick": "Module (quick pick)",
+		"diagModuleCustom": "Or a custom module name",
+		"diagModuleCustomPlaceholder": "e.g. notify_bridge_server.services.deferred_dispatch",
+		"diagModuleRequired": "Pick a module first",
+		"diagDuration": "Duration",
+		"diagActivate": "Activate DEBUG",
+		"diagActivated": "Diagnostic mode activated",
+		"diagActivateFailed": "Failed to activate diagnostic mode",
+		"diagActive": "Active overrides",
+		"diagRevertsIn": "Reverts in",
+		"diagRevertNow": "Revert now",
+		"diagReverted": "Diagnostic mode reverted",
+		"diagRevertFailed": "Failed to revert diagnostic mode",
+		"heroNoUrl": "External URL not set",
+		"heroNoLocales": "no locales",
+		"copy": "Copy",
+		"urlCopied": "URL copied",
+		"openExternal": "Open",
+		"show": "Show",
+		"hide": "Hide",
+		"secretSet": "Verified",
+		"secretUnset": "Not configured",
+		"cacheConfig": "Cache",
+		"cacheTtlShort": "TTL",
+		"cacheMaxShort": "Max entries",
+		"cacheMaxFootnote": "per bucket (LRU)",
+		"hoursShort": "hrs",
+		"entriesShort": "max",
+		"ttlNoExpiry": "no expiry",
+		"cacheCapacity": "Cache capacity",
+		"cacheCapacityCap": "of {n} cap",
+		"logModulePlaceholder": "module.path",
+		"addOverride": "Add override",
+		"removeOverride": "Remove",
+		"editAsText": "Edit as text",
+		"editAsChips": "Edit as chips",
+		"logPreviewLabel": "ACTIVE",
+		"unsavedChanges": "Unsaved changes",
+		"unsaved": "UNSAVED",
+		"changedOne": "1 setting changed",
+		"changedMany": "{n} settings changed",
+		"discard": "Discard",
+		"saveChanges": "Save changes",
+		"release": {
+			"eyebrow": "Releases",
+			"headline": "Stay current with upstream",
+			"provider": "Provider",
+			"providerHint": "Where to check for new versions. Gitea is the only active backend today; GitHub will follow.",
+			"comingSoon": "Coming soon",
+			"disabled": "Disabled",
+			"repository": "Repository",
+			"repositoryHint": "Public repository URL and owner/name (e.g. alexei.dolgolyov/notify-bridge).",
+			"options": "Options",
+			"includePrereleases": "Include pre-releases",
+			"prereleasesHint": "When off, release candidates and betas are ignored even if they're newer than your installed version.",
+			"interval": "Check interval",
+			"intervalHint": "How often the background job probes upstream. Manual checks are always available.",
+			"intervalRange": "1–168 hrs",
+			"hoursUnit": "hrs",
+			"testConnection": "Test connection",
+			"checkNow": "Check now",
+			"checkDone": "Release check complete",
+			"checkFailed": "Release check failed",
+			"testOk": "Provider reachable",
+			"testFailed": "Provider unreachable",
+			"testFound": "Provider returned",
+			"viewRelease": "View v{v} release",
+			"statusUpToDate": "You're up to date",
+			"statusUpdate": "Update available",
+			"statusDisabled": "Release checks disabled",
+			"statusError": "Last check failed",
+			"statusUnknown": "Not checked yet",
+			"heroAvailable": "available",
+			"updateAvailableTooltip": "v{v} available — open Settings",
+			"lastChecked": "Last checked",
+			"never": "never",
+			"justNow": "just now",
+			"minutesAgo": "{n} min ago",
+			"hoursAgo": "{n} hr ago",
+			"daysAgo": "{n} d ago",
+			"error": {
+				"disabled": "Release checks are disabled",
+				"misconfigured": "Provider not fully configured",
+				"provider_changed": "Provider changed — awaiting next check",
+				"no_release_found": "No matching release found upstream",
+				"network_error": "Upstream unreachable",
+				"http_error": "Upstream returned an error",
+				"parse_error": "Upstream response could not be parsed",
+				"unsafe_url": "URL rejected by safety check",
+				"not_implemented": "Provider not implemented yet",
+				"unknown_error": "Unknown error",
+				"error": "Last check failed"
+			}
+		}
 	},
 	"hints": {
 		"periodicSummary": "Sends a scheduled summary of all tracked albums at specified times. Great for daily/weekly digests.",
@@ -705,9 +1014,12 @@
 		"quietHours": "Suppress all notifications during this HH:MM window (interpreted in the app timezone). Overnight windows like 22:00–07:00 are supported.",
 		"favoritesOnly": "Only include assets marked as favorites.",
 		"maxAssets": "Maximum number of asset details to include in a single notification message.",
-		"periodicStartDate": "The reference date for calculating periodic intervals. Summaries are sent every N days from this date.",
-		"times": "Time(s) of day to send notifications, in HH:MM format. Use commas for multiple times: 09:00,18:00",
+		"periodicStartDate": "Reference date in the app timezone. The first summary fires at the next configured HH:MM on/after this date, then every N days.",
+		"intervalDays": "Days between successive summaries. 1 = daily, 7 = weekly.",
+		"times": "Time(s) of day to send notifications. Add as many time points per day as you need.",
 		"albumMode": "Per album: separate notification per album. Combined: one notification with all albums. Random: pick one album randomly.",
+		"scheduledAlbumMode": "How albums are grouped in scheduled deliveries. Default: Per album (one notification per tracked album).",
+		"memoryAlbumMode": "How albums are grouped in memory deliveries. Default: Combined (a single notification aggregating matches from all tracked albums).",
 		"minRating": "Only include assets with at least this star rating (0 = no filter).",
 		"eventMessages": "Templates for real-time event notifications. Use {variables} for dynamic content.",
 		"assetFormatting": "How individual assets are formatted within notification messages.",
@@ -721,15 +1033,21 @@
 		"trackingConfig": "Controls which events trigger notifications and how assets are filtered.",
 		"templateConfig": "Controls the message format. Uses default templates if not set.",
 		"scanInterval": "How often to poll the provider for changes, in seconds. Lower = faster detection but more API calls.",
-		"batchDuration": "Time to accumulate changes before dispatching notifications. 0 = send immediately.",
+		"adaptiveMaxSkip": "Reduces polling when the tracker is idle, to save load on the upstream server. Leave blank or set to 0 for snappy notifications — every tick runs at the configured interval. Set to 2 to allow up to 2× slower polling after ~5 min of silence, or 4 for up to 4× slower polling after ~15 min. Activity resets back to the base rate immediately.",
 		"defaultTrackingConfig": "Applied to all linked targets unless overridden per target.",
 		"defaultTemplateConfig": "Applied to all linked targets unless overridden per target.",
 		"defaultCount": "How many results to return when the user doesn't specify a count (1-20).",
 		"responseMode": "Media: send actual photos. Text: send filenames/links only. Media mode uses more bandwidth.",
 		"botLocale": "Language for command descriptions in Telegram's menu and bot response messages.",
-		"rateLimits": "Cooldown in seconds between uses of each command category per chat. 0 = no limit."
+		"rateLimits": "Cooldown in seconds between uses of each command category per chat. 0 = no limit.",
+		"commandResponses": "Reply templates for each /command. Use {variables} to inject dynamic data.",
+		"commandErrors": "Fallback messages shown when a command can't run (rate-limited) or returns nothing.",
+		"commandDescriptions": "Short menu blurbs Telegram shows next to each /command in the chat command picker.",
+		"commandUsage": "Example invocations rendered inside /help to show users how to call each command."
 	},
 	"matrixBot": {
+		"titleEmphasis": "matrix",
+		"countLabel": "bots",
 		"title": "Matrix Bots",
 		"description": "Matrix homeserver connections for room notifications",
 		"addBot": "Add Matrix Bot",
@@ -746,6 +1064,8 @@
 		"operationFailed": "Operation failed"
 	},
 	"emailBot": {
+		"titleEmphasis": "email",
+		"countLabel": "accounts",
 		"title": "Email Bots",
 		"description": "SMTP email senders for notifications",
 		"addBot": "Add Email Bot",
@@ -765,6 +1085,8 @@
 		"operationFailed": "Operation failed"
 	},
 	"cmdTemplateConfig": {
+		"titleEmphasis": "templates",
+		"countLabel": "templates",
 		"title": "Command Templates",
 		"description": "Customize command response messages with Jinja2 templates",
 		"newConfig": "New Config",
@@ -774,10 +1096,15 @@
 		"noConfigs": "No command template configs yet.",
 		"confirmDelete": "Delete this command template config?",
 		"commandResponses": "Command Responses",
-		"commandResponsesHint": "Leave a slot empty to use the default hardcoded response."
+		"commandErrors": "Error Messages",
+		"commandDescriptions": "Command Descriptions",
+		"commandUsage": "Usage Examples"
 	},
 	"commandConfig": {
+		"titleEmphasis": "configs",
+		"countLabel": "configs",
 		"title": "Command Configs",
+		"noCommandsForProvider": "No commands available for this provider type.",
 		"description": "Define command settings for Telegram bot interactions",
 		"newConfig": "New Config",
 		"name": "Name",
@@ -799,6 +1126,7 @@
 		"noTemplate": "Default (hardcoded)"
 	},
 	"commandTracker": {
+		"titleEmphasis": "trackers",
 		"title": "Command Trackers",
 		"description": "Manage command trackers and their listeners",
 		"newTracker": "New Tracker",
@@ -826,9 +1154,22 @@
 		"scopeInherit": "Inherit: derive from notification routing",
 		"noCollections": "No albums available."
 	},
+	"commands": {
+		"bridgeSelf": {
+			"status": "Bridge status",
+			"statusDesc": "Show current bridge health counters",
+			"thresholds": "Bridge thresholds",
+			"thresholdsDesc": "Show configured alert thresholds",
+			"reset": "Reset counter",
+			"resetDesc": "Manually reset a failure counter",
+			"health": "Bridge health",
+			"healthDesc": "Terse one-line health summary"
+		}
+	},
 	"snackbar": {
 		"showDetails": "Show details",
-		"hideDetails": "Hide details"
+		"hideDetails": "Hide details",
+		"region": "Notifications"
 	},
 	"timezone": {
 		"searchPlaceholder": "Search cities or IANA codes…",
@@ -837,9 +1178,12 @@
 		"noMatches": "No timezones match"
 	},
 	"locales": {
+		"label": "language",
+		"labelPlural": "languages",
 		"empty": "No languages selected. Add one below to start authoring templates.",
 		"add": "Add language",
 		"searchPlaceholder": "Search or type a code (e.g. de-CH)…",
+		"customPlaceholder": "or de-CH",
 		"addCustom": "Add custom code",
 		"noSuggestions": "No matches. Type a valid locale code (2–3 letters).",
 		"primary": "Primary",
@@ -905,6 +1249,7 @@
 	},
 	"common": {
 		"loading": "Loading...",
+		"auto": "Auto",
 		"save": "Save",
 		"cancel": "Cancel",
 		"delete": "Delete",
@@ -912,6 +1257,8 @@
 		"edit": "Edit",
 		"description": "Description",
 		"close": "Close",
+		"hide": "Hide",
+		"show": "Show",
 		"confirm": "Confirm",
 		"cannotDelete": "Cannot delete",
 		"blockedByIntro": "Referenced by:",
@@ -1019,6 +1366,12 @@
 		"memorySourceNative": "Use Immich native memories API",
 		"localeEn": "English interface",
 		"localeRu": "Russian interface",
+		"logLevelDebug": "Verbose — show every step",
+		"logLevelInfo": "Default — high-level events",
+		"logLevelWarning": "Warnings and errors only",
+		"logLevelError": "Errors only — quietest",
+		"logFormatText": "Human-readable plain text",
+		"logFormatJson": "One JSON object per line",
 		"modeMedia": "Send actual photo/video files",
 		"modeText": "Send file names and links only",
 		"allEvents": "Show all event types",
@@ -1030,6 +1383,16 @@
 		"actionSuccess": "Scheduled action completed",
 		"actionPartial": "Scheduled action partially succeeded",
 		"actionFailed": "Scheduled action failed",
+		"commandHandled": "Bot command served",
+		"commandRateLimited": "Bot command throttled",
+		"commandFailed": "Bot command crashed",
+		"refreshOff": "Auto-refresh disabled",
+		"refresh10s": "Refresh every 10 seconds",
+		"refresh30s": "Refresh every 30 seconds",
+		"refresh60s": "Refresh every minute",
+		"refresh5m": "Refresh every 5 minutes",
+		"statsModePage": "Count only events on the current page",
+		"statsModeAll": "Count all events matching the current filters",
 		"newestFirst": "Most recent events on top",
 		"oldestFirst": "Oldest events on top",
 		"chatActionNone": "No indicator shown",
@@ -1052,7 +1415,9 @@
 		"providerScheduler": "Time-based scheduled messages",
 		"providerNut": "Network UPS monitoring",
 		"providerGooglePhotos": "Google Photos albums & shared libraries",
-		"providerWebhook": "Receive events via HTTP POST"
+		"providerWebhook": "Receive events via HTTP POST",
+		"providerHomeAssistant": "Home Assistant event bus over WebSocket",
+		"providerBridgeSelf": "Internal health alerts when polling, dispatch, or sends fail"
 	},
 	"webhookLogs": {
 		"title": "Recent Payloads",
@@ -1081,6 +1446,8 @@
 		"close": "close"
 	},
 	"actions": {
+		"titleEmphasis": "automations",
+		"countLabel": "actions",
 		"title": "Actions",
 		"description": "Scheduled mutations on external services",
 		"addAction": "Add Action",
@@ -1138,6 +1505,7 @@
 		"triggerScheduled": "scheduled"
 	},
 	"backup": {
+		"titleEmphasis": "& restore",
 		"title": "Backup & Restore",
 		"description": "Export and import your configuration, or set up automatic backups",
 		"export": "Export Configuration",
@@ -1209,6 +1577,30 @@
 		"applyLater": "Apply later",
 		"restartNow": "Restart now",
 		"restartingTitle": "Restarting backend…",
-		"restartingDescription": "The page will reload once the server is back online."
+		"restartingDescription": "The page will reload once the server is back online.",
+		"countLabel": "backups",
+		"scheduleOn": "Auto · every {h}h",
+		"scheduleOff": "Auto backup off",
+		"lastBackup": "Last {ago}",
+		"never": "no backups yet",
+		"totalSize": "{size} total",
+		"dropZone": "Drop a JSON backup here, or click to choose",
+		"dropZoneActive": "Release to load",
+		"changeFile": "Change file",
+		"catGroupIdentity": "Identity & Routing",
+		"catGroupNotif": "Notifications",
+		"catGroupCmd": "Commands",
+		"catGroupSystem": "System",
+		"stepCategories": "What to include",
+		"stepSecrets": "Secrets handling",
+		"stepDownload": "Download",
+		"stepFile": "Choose a file",
+		"stepValidate": "Validate contents",
+		"stepConflict": "On conflict",
+		"stepApply": "Apply",
+		"tagScheduled": "scheduled",
+		"tagManual": "manual",
+		"tagSecrets": "with secrets",
+		"validateFirst": "Validate the file first to enable import"
 	}
 }

frontend/src/lib/i18n/ru.json

@@ -3,7 +3,22 @@
 		"name": "Notify Bridge",
 		"tagline": "Уведомления о сервисах"
 	},
+	"crumbs": {
+		"routingNotification": "Маршрутизация · Уведомления",
+		"routingCommands": "Маршрутизация · Команды",
+		"routingTargets": "Маршрутизация · Цели",
+		"routingAutomation": "Маршрутизация · Автоматизация",
+		"operatorsBots": "Операторы · Боты",
+		"systemAccess": "Система · Доступ",
+		"systemConfiguration": "Система · Настройки",
+		"systemMaintenance": "Система · Обслуживание",
+		"serviceConnections": "Сервис · Подключения"
+	},
 	"nav": {
+		"sectionOverview": "Обзор",
+		"sectionRouting": "Маршрутизация",
+		"sectionOperators": "Операторы",
+		"sectionSystem": "Система",
 		"dashboard": "Главная",
 		"providers": "Провайдеры",
 		"notificationTrackers": "Трекеры увед.",
@@ -55,7 +70,8 @@
 		"passwordTooShort": "Пароль должен быть не менее 8 символов",
 		"or": "или",
 		"loginFailed": "Ошибка входа",
-		"setupFailed": "Ошибка настройки"
+		"setupFailed": "Ошибка настройки",
+		"backendUnreachable": "Не удалось подключиться к серверу. Убедитесь, что он запущен, и повторите попытку."
 	},
 	"dashboard": {
 		"title": "Главная",
@@ -82,6 +98,15 @@
 		"actionSuccess": "действие выполнено",
 		"actionPartial": "действие частично",
 		"actionFailed": "действие провалено",
+		"commandHandled": "команда обработана",
+		"commandRateLimited": "ограничение частоты",
+		"commandFailed": "команда упала",
+		"autoRefreshTitle": "Интервал авто-обновления списка событий",
+		"refreshOff": "Выкл",
+		"refresh10s": "10с",
+		"refresh30s": "30с",
+		"refresh60s": "1м",
+		"refresh5m": "5м",
 		"searchEvents": "Поиск событий...",
 		"allEvents": "Все события",
 		"filterAssetsAdded": "Добавление файлов",
@@ -92,21 +117,102 @@
 		"filterActionSuccess": "Действие выполнено",
 		"filterActionPartial": "Действие частично",
 		"filterActionFailed": "Действие провалено",
+		"filterCommandHandled": "Команда обработана",
+		"filterCommandRateLimited": "Ограничение частоты",
+		"filterCommandFailed": "Команда упала",
 		"allProviders": "Все провайдеры",
 		"newestFirst": "Сначала новые",
 		"oldestFirst": "Сначала старые",
 		"loadingEvents": "Загрузка событий...",
+		"heldUntil": "ожидает до",
+		"deferredTitle": "Тихий режим задержал уведомление; оно будет отправлено после окончания окна.",
+		"deliveredLate": "доставлено позже",
+		"deliveredLateTitle": "Уведомление отправлено после окончания тихих часов.",
+		"deferredThenDropped": "отброшено после задержки",
+		"deferredThenDroppedTitle": "Задержано тихими часами, затем отброшено — цель или связь были удалены до окончания окна.",
+		"deferredThenFailed": "ошибка после задержки",
+		"suppressedQuietHours": "подавлено (тихие часы)",
+		"suppressedNondeferrableTitle": "Событие по расписанию подавлено тихими часами. Запланированные/периодические/воспоминания отбрасываются, а не откладываются.",
 		"asset": "файл",
 		"assets": "файлов",
 		"eventActivity": "Активность событий",
 		"last14days": "Последние 14 дней",
 		"event": "событие",
 		"events": "событий",
-		"noChartData": "Нет данных о событиях"
+		"noChartData": "Нет данных о событиях",
+		"live": "В эфире",
+		"attention": "Внимание",
+		"heroPrefix": "Сегодня",
+		"heroEmphasis": "всё",
+		"heroSuffix": "идёт по плану.",
+		"heroSummary": "{providers} провайдеров на связи, {armed} из {total} трекеров активны, {throughput} событий доставлено в {targets} каналов за сутки.",
+		"throughput24h": "пропускная способность · 24ч",
+		"eventsShort": "событий",
+		"armedShort": "активны",
+		"providersShort": "провайдеров",
+		"targetsShort": "каналов",
+		"trackersShort": "трекеров",
+		"streamTitle": "Поток",
+		"streamEmphasis": "сигналов",
+		"eventsLabel": "событий",
+		"onWatchTitle": "На",
+		"onWatchEmphasis": "слежении",
+		"statsModeTitle": "Область статистики провайдеров",
+		"statsModePage": "Страница",
+		"statsModeAll": "Все",
+		"noProviders": "Пока нет провайдеров.",
+		"addProvider": "Добавить",
+		"addProviderHint": "Подключите сервис, чтобы начать слежение",
+		"pulseTitle": "Пульс",
+		"pulseEmphasis": "· 14 дней",
+		"pulseSub": "События по дням",
+		"wiresTitle": "Активные",
+		"wiresEmphasis": "линии",
+		"wiresSub": "маршрутов",
+		"composeTitle": "Выберите источник, выберите канал.",
+		"composeEmphasis": "Свяжите.",
+		"composeSub": "Проведите путь от провайдера → трекер → шаблон → цель. Или вставьте webhook URL — остальное мы определим сами.",
+		"viewTrackers": "К трекерам",
+		"newTracker": "Новый трекер",
+		"eventsTotal": "Событий"
+	},
+	"events": {
+		"detailTitle": "Детали события",
+		"bot": "Бот",
+		"chat": "Чат",
+		"issuer": "Отправитель",
+		"commandTracker": "Командный трекер",
+		"tracker": "Трекер",
+		"action": "Действие",
+		"provider": "Провайдер",
+		"assetsCount": "Файлов",
+		"openProvider": "Открыть провайдера",
+		"openBot": "Открыть бота",
+		"openCommandTracker": "Открыть командный трекер",
+		"openAction": "Открыть действие",
+		"openTracker": "Открыть трекер",
+		"rawDetails": "Сырые данные",
+		"lifecycle": {
+			"heldTitle": "Задержано тихими часами",
+			"heldUntil": "Будет отправлено в",
+			"heldFor": "Задержано на",
+			"heldHint": "Уведомления в тихие часы ждут окончания окна. Пары добавление/удаление отменяются автоматически.",
+			"inPrefix": "через",
+			"deliveredLateTitle": "Доставлено после тихих часов",
+			"originalEvent": "Исходное событие",
+			"droppedTitle": "Отброшено после задержки",
+			"failedTitle": "Ошибка после задержки",
+			"reason": "Причина",
+			"suppressedTitle": "Подавлено тихими часами",
+			"suppressedHint": "Запланированные, периодические и воспоминания привязаны ко времени — они отбрасываются, а не откладываются, чтобы «доброе утро» не пришло днём."
+		}
 	},
 	"providers": {
-		"title": "Провайдеры",
-		"description": "Управление подключениями к сервисам",
+		"title": "Сервисные",
+		"titleEmphasis": "провайдеры",
+		"description": "Подключения к внешним сервисам и вебхукам. Каждый провайдер кормит трекеры событиями, которые рассылаются по вашим каналам.",
+		"typeSingular": "тип",
+		"typePlural": "типов",
 		"addProvider": "Добавить провайдер",
 		"cancel": "Отмена",
 		"type": "Тип провайдера",
@@ -129,6 +235,20 @@
 		"typeNut": "NUT (ИБП)",
 		"typeGooglePhotos": "Google Фото",
 		"typeWebhook": "Универсальный вебхук",
+		"typeHomeAssistant": "Home Assistant",
+		"typeBridgeSelf": "Самомониторинг моста",
+		"bridgeSelfPollThreshold": "Порог сбоев опроса трекера",
+		"bridgeSelfPollThresholdHint": "Уведомлять после стольких подряд сбоев опроса любого трекера.",
+		"bridgeSelfDeferredThreshold": "Порог очереди отложенной отправки",
+		"bridgeSelfDeferredThresholdHint": "Уведомлять, когда количество ожидающих записей deferred_dispatch превысит это значение.",
+		"bridgeSelfTargetThreshold": "Порог сбоев отправки в адресат",
+		"bridgeSelfTargetThresholdHint": "Уведомлять после стольких подряд сбоев 5xx/сети при отправке в любой адресат.",
+		"haAccessToken": "Долгоживущий токен доступа",
+		"haAccessTokenKeep": "Долгоживущий токен (оставьте пустым для сохранения)",
+		"haAccessTokenHint": "Создайте в HA → Профиль → Long-Lived Access Tokens. Нужен для WebSocket-подписки.",
+		"haAccessTokenRequired": "Токен доступа Home Assistant обязателен.",
+		"haVerifyTls": "Проверять TLS-сертификат",
+		"haVerifyTlsHint": "Отключайте только для самоподписанного HA в доверенной локальной сети. Оставляйте включённым для любого экземпляра, доступного из интернета.",
 		"loadError": "Не удалось загрузить провайдеры.",
 		"externalDomain": "Внешний домен",
 		"optional": "необязательно",
@@ -152,7 +272,8 @@
 		"apiToken": "API токен",
 		"apiTokenHint": "Необязательно. Нужен для проверки подключения и получения списка репозиториев.",
 		"webhookUrl": "URL вебхука",
-		"webhookUrlHint": "Укажите этот URL в настройках вебхука Gitea (относительно хоста bridge).",
+		"webhookUrlHint": "Укажите этот URL в настройках вебхука Gitea. Полный URL показывается, если в настройках задан внешний адрес; иначе путь указан относительно хоста bridge.",
+		"webhookUrlCopyTitle": "Нажмите, чтобы скопировать",
 		"nutHost": "Хост NUT-сервера",
 		"nutHostPlaceholder": "192.168.1.100 или ups.local",
 		"nutPort": "Порт NUT-сервера",
@@ -191,6 +312,9 @@
 		"cleared": "История запросов очищена"
 	},
 	"notificationTracker": {
+		"titleEmphasis": "трекеры",
+		"armed": "активны",
+		"paused": "на паузе",
 		"title": "Трекеры уведомлений",
 		"description": "Отслеживание изменений в альбомах",
 		"newTracker": "Новый трекер",
@@ -203,10 +327,20 @@
 		"selectAlbums": "Выберите альбомы...",
 		"repositories": "Репозитории",
 		"selectRepositories": "Выберите репозитории...",
+		"userAllowlist": "Только от пользователей",
+		"userBlocklist": "Исключить пользователей",
+		"selectUsers": "Выберите пользователей...",
 		"boards": "Доски",
 		"selectBoards": "Выберите доски...",
 		"upsDevices": "ИБП устройства",
 		"selectUpsDevices": "Выберите ИБП...",
+		"entities": "Сущности",
+		"selectEntities": "Выберите сущности...",
+		"entities_count": "сущность(ей)",
+		"haEntityGlob": "Фильтр по entity (glob)",
+		"haEntityGlobPlaceholder": "light.*, binary_sensor.*_motion",
+		"haDomainAllowlist": "Разрешённые домены",
+		"haDomainAllowlistPlaceholder": "light, switch, binary_sensor",
 		"eventTypes": "Типы событий",
 		"notificationTargets": "Получатели уведомлений",
 		"scanInterval": "Интервал проверки (секунды)",
@@ -249,7 +383,8 @@
 		"descending": "По убыванию",
 		"quietHoursStart": "Тихие часы начало",
 		"quietHoursEnd": "Тихие часы конец",
-		"batchDuration": "Длительность пакета (секунды)",
+		"adaptiveMaxSkip": "Предел адаптивного опроса",
+		"adaptiveMaxSkipPlaceholder": "Выкл. (пусто или 0)",
 		"defaultTrackingConfig": "Конфигурация отслеживания по умолчанию",
 		"defaultTemplateConfig": "Шаблон уведомлений по умолчанию",
 		"linkedTargets": "получатели",
@@ -261,7 +396,15 @@
 		"testPeriodic": "Тест периодической сводки",
 		"testScheduled": "Тест запланированных фото",
 		"testMemory": "Тест воспоминаний",
+		"testDisabledHint": "Сначала включите эту функцию в привязанной конфигурации отслеживания.",
 		"checkingLinks": "Проверка ссылок...",
+		"featureDiscovery": "Периодические сводки, запланированные подборки, воспоминания и тихие часы настраиваются в привязанной конфигурации отслеживания.",
+		"openTrackingConfig": "Открыть конфигурацию отслеживания",
+		"openTemplateConfig": "Открыть конфигурацию шаблона",
+		"linkReplace": "Пересоздать",
+		"linkReplacing": "Пересоздание...",
+		"linkReplaceFailed": "Не удалось пересоздать ссылку для «{name}»",
+		"linkPasswordProtectedNote": "Получатели в Telegram не смогут открыть защищённую паролем ссылку без пароля. Снимите пароль в Immich или пересоздайте ссылку.",
 		"missingLinksTitle": "Альбомы без публичных ссылок",
 		"missingLinksDesc": "У следующих альбомов нет публичных ссылок. Без ссылок получатели уведомлений не смогут просматривать фото.",
 		"expired": "Истёк",
@@ -295,6 +438,11 @@
 		"albumDeleted": "Альбом удалён"
 	},
 	"targets": {
+		"titleEmphasis": "канал",
+		"titleEmphasisAll": "каналы",
+		"receiver": "получатель",
+		"receivers": "получателей",
+		"channelsCount": "каналов",
 		"title": "Получатели",
 		"description": "Адреса доставки уведомлений",
 		"descTelegram": "Чаты Telegram для доставки уведомлений",
@@ -332,6 +480,7 @@
 		"videoWarning": "Предупреждение о размере видео",
 		"disableUrlPreview": "Отключить превью ссылок",
 		"sendLargeAsDocuments": "Отправлять большие фото как документы",
+		"sendLargeVideosAsDocuments": "Отправлять видео сверх лимита как документы (обход 50 МБ)",
 		"chatAction": "Действие в чате",
 		"chatActionNone": "Нет (без действия)",
 		"chatActionTyping": "Печатает",
@@ -360,11 +509,25 @@
 		"receiverUpdated": "Получатель обновлён",
 		"confirmDeleteReceiver": "Удалить этого получателя?",
 		"receiverEnabled": "Получатель включён",
-		"receiverDisabled": "Получатель отключён"
+		"receiverDisabled": "Получатель отключён",
+		"telegramOptions": "Параметры Telegram",
+		"telegramOptionsSaved": "Параметры Telegram сохранены",
+		"telegramDisableNotification": "Отправлять без звука и вибрации",
+		"telegramThreadId": "ID темы форума",
+		"telegramThreadIdPlaceholder": "Оставьте пустым для общей темы",
+		"groupNoBot": "Без привязки к боту",
+		"groupDirect": "Прямая доставка",
+		"groupBotMissing": "Неизвестный бот",
+		"target": "получатель",
+		"targetsLower": "получателей",
+		"openBot": "Открыть бота"
 	},
 	"users": {
+		"titleEmphasis": "и доступ",
+		"countLabel": "пользователей",
 		"title": "Пользователи",
 		"description": "Управление аккаунтами (только админ)",
+		"you": "вы",
 		"addUser": "Добавить пользователя",
 		"cancel": "Отмена",
 		"username": "Имя пользователя",
@@ -380,6 +543,8 @@
 		"noUsers": "Пользователи не найдены"
 	},
 	"telegramBot": {
+		"titleEmphasis": "telegram",
+		"countLabel": "ботов",
 		"title": "Telegram боты",
 		"description": "Регистрация и управление Telegram ботами",
 		"addBot": "Добавить бота",
@@ -412,6 +577,7 @@
 		"noCommandsForProvider": "Этот тип провайдера не поддерживает команды бота.",
 		"syncCommands": "Синхр. команды",
 		"discoverChats": "Обнаружить чаты из Telegram",
+		"discoveringChats": "Поиск чатов…",
 		"clickToCopy": "Нажмите, чтобы скопировать ID чата",
 		"chatsDiscovered": "Чаты обнаружены",
 		"chatDeleted": "Чат удалён",
@@ -432,6 +598,8 @@
 		"webhookRegistered": "Вебхук зарегистрирован",
 		"webhookUnregistered": "Вебхук удалён",
 		"updateMode": "Режим обновлений",
+		"none": "Откл.",
+		"noneActive": "Приём обновлений отключён",
 		"polling": "Опрос",
 		"webhook": "Вебхук",
 		"webhookStatus": "Статус вебхука",
@@ -454,6 +622,8 @@
 		"webhookFailed": "Не удалось зарегистрировать webhook"
 	},
 	"trackingConfig": {
+		"titleEmphasis": "конфигурации",
+		"countLabel": "конфигураций",
 		"title": "Конфигурации отслеживания",
 		"description": "Определите, на какие события и файлы реагировать",
 		"newConfig": "Новая конфигурация",
@@ -501,6 +671,14 @@
 		"upsOverload": "Перегрузка ИБП",
 		"scheduledMessage": "Запланированное сообщение",
 		"webhookReceived": "Вебхук получен",
+		"haStateChanged": "Состояние сущности изменилось",
+		"haAutomationTriggered": "Сработала автоматизация",
+		"haServiceCalled": "Вызвана служба",
+		"haEventFired": "Прочее событие HA (catch-all)",
+		"haEventFiredHint": "Срабатывает на любые типы событий HA, не охваченные чекбоксами выше. Полезно для пользовательских интеграций; ожидайте большой объём.",
+		"bridgeSelfPollFailures": "Сбои опроса трекера",
+		"bridgeSelfDeferredBacklog": "Очередь отложенной отправки превысила порог",
+		"bridgeSelfTargetFailures": "Сбои отправки в адресат",
 		"trackImages": "Фото",
 		"trackVideos": "Видео",
 		"favoritesOnly": "Только избранные",
@@ -549,11 +727,26 @@
 		"renamed": "переименование",
 		"deleted": "удалён",
 		"providerType": "Тип провайдера",
-		"sortRandom": "Случайный"
+		"sortRandom": "Случайный",
+		"timesInlineHelp": "Одно или несколько значений времени в день",
+		"addTime": "Добавить время",
+		"removeTime": "Удалить время",
+		"timeRowLabel": "Время {n}",
+		"noTimes": "Время не задано — добавьте хотя бы одно",
+		"maxTimesReached": "Достигнут максимум: {n}",
+		"timesRequiredFor": "Добавьте хотя бы одно время для «{slot}»",
+		"previewTemplate": "Предпросмотр шаблона",
+		"previewSampleNote": "Отрисовано на демо-данных, не на ваших реальных фото. Показан шаблон по умолчанию.",
+		"editTemplate": "Редактировать шаблон",
+		"quietHoursZero": "Тихий период 0 минут — скорректируйте время",
+		"nextDay": "след. день"
 	},
 	"templateConfig": {
+		"titleEmphasis": "шаблоны",
+		"countLabel": "шаблонов",
 		"title": "Конфигурации шаблонов",
 		"description": "Определите формат уведомлений",
+		"language": "Язык",
 		"providerType": "Тип сервис-провайдера",
 		"newConfig": "Новая конфигурация",
 		"name": "Название",
@@ -595,7 +788,14 @@
 		"confirmDelete": "Удалить эту конфигурацию шаблона?",
 		"invalidFormat": "Некорректная строка формата",
 		"filterSlots": "Фильтр слотов...",
-		"slots": "слотов"
+		"slots": "слотов",
+		"resetToDefault": "Сбросить к умолчанию",
+		"resetAllToDefaults": "Сбросить все к умолчаниям",
+		"resetSlotConfirm": "Заменить шаблон этого слота ({locale}) на исходный по умолчанию? Ваши правки будут потеряны.",
+		"resetAllConfirm": "Заменить шаблоны всех слотов ({locale}) на исходные по умолчанию? Все ваши правки для {locale} будут потеряны.",
+		"resetNoDefault": "Для этого слота нет шаблона по умолчанию.",
+		"resetApplied": "Сброшено к умолчанию (ещё не сохранено — нажмите «Сохранить»)",
+		"deepLinkNoConfig": "Не найдено конфигурации шаблонов для этого провайдера. Сначала создайте её."
 	},
 	"templateVars": {
 		"message_assets_added": {
@@ -664,6 +864,7 @@
 		"album_shared": "Общий альбом"
 	},
 	"settings": {
+		"titleEmphasis": "параметры",
 		"title": "Настройки",
 		"description": "Глобальные настройки приложения",
 		"general": "Общие",
@@ -695,7 +896,115 @@
 		"locales": "Языки шаблонов",
 		"supportedLocales": "Поддерживаемые локали",
 		"supportedLocalesHint": "Языки, доступные для редактирования шаблонов уведомлений и команд. Встроенные шаблоны поставляются для английского и русского; другие языки начинают с пустых.",
-		"saved": "Настройки сохранены"
+		"logging": "Логирование",
+		"logLevel": "Уровень логов",
+		"logLevelHint": "Уровень логирования сервера. Поднимайте до DEBUG при отладке; оставляйте INFO в продакшене. WARNING/ERROR скрывают пошаговые строки по командам.",
+		"logFormat": "Формат логов",
+		"logFormatHint": "Формат вывода. 'text' — читаемый человеком; 'json' — по одному объекту в строке для агрегаторов (Loki, ELK). Смена требует перезапуска сервера.",
+		"logLevels": "Переопределения по модулям",
+		"logLevelsHint": "Пары 'модуль=УРОВЕНЬ' через запятую, чтобы приглушить шумные модули или углубиться в один. Пример: sqlalchemy.engine=WARNING,notify_bridge_core.notifications.telegram.client=DEBUG",
+		"saved": "Настройки сохранены",
+		"identity": "Идентификация",
+		"identityHeadline": "Как этот сервер представляется ботам, вебхукам и получателям",
+		"telegramHeadline": "Аутентификация вебхуков и настройка медиакэша",
+		"loggingHeadline": "Подробность, формат вывода и переопределения по модулям",
+		"diagnostics": "Диагностика",
+		"diagnosticsHeadline": "Временный DEBUG для одного модуля с авто-возвратом",
+		"diagnosticsHint": "Включите, чтобы разобраться в конкретной ошибке отправки без заливания stderr. Выбранный модуль немедленно переходит в DEBUG и возвращается к базовому уровню (вашим переопределениям или умолчаниям для шумных библиотек) по истечении окна. При перезапуске сервера всё сбрасывается.",
+		"diagModuleQuick": "Модуль (быстрый выбор)",
+		"diagModuleCustom": "Или произвольное имя модуля",
+		"diagModuleCustomPlaceholder": "напр. notify_bridge_server.services.deferred_dispatch",
+		"diagModuleRequired": "Сначала выберите модуль",
+		"diagDuration": "Длительность",
+		"diagActivate": "Включить DEBUG",
+		"diagActivated": "Режим диагностики включён",
+		"diagActivateFailed": "Не удалось включить режим диагностики",
+		"diagActive": "Активные переопределения",
+		"diagRevertsIn": "Вернётся через",
+		"diagRevertNow": "Вернуть сейчас",
+		"diagReverted": "Режим диагностики отменён",
+		"diagRevertFailed": "Не удалось отменить режим диагностики",
+		"heroNoUrl": "Внешний URL не задан",
+		"heroNoLocales": "нет локалей",
+		"copy": "Копировать",
+		"urlCopied": "URL скопирован",
+		"openExternal": "Открыть",
+		"show": "Показать",
+		"hide": "Скрыть",
+		"secretSet": "Задан",
+		"secretUnset": "Не настроен",
+		"cacheConfig": "Кэш",
+		"cacheTtlShort": "TTL",
+		"cacheMaxShort": "Макс. записей",
+		"cacheMaxFootnote": "на корзину (LRU)",
+		"hoursShort": "ч",
+		"entriesShort": "макс",
+		"ttlNoExpiry": "без срока",
+		"cacheCapacity": "Заполненность кэша",
+		"cacheCapacityCap": "из {n}",
+		"logModulePlaceholder": "путь.модуля",
+		"addOverride": "Добавить",
+		"removeOverride": "Удалить",
+		"editAsText": "Редактировать как текст",
+		"editAsChips": "Редактировать как чипы",
+		"logPreviewLabel": "АКТИВНО",
+		"unsavedChanges": "Несохранённые изменения",
+		"unsaved": "НЕ СОХРАНЕНО",
+		"changedOne": "Изменена 1 настройка",
+		"changedMany": "Изменено настроек: {n}",
+		"discard": "Отменить",
+		"saveChanges": "Сохранить",
+		"release": {
+			"eyebrow": "Релизы",
+			"headline": "Следите за обновлениями",
+			"provider": "Источник",
+			"providerHint": "Где искать новые версии. Сейчас доступен только Gitea; GitHub появится позже.",
+			"comingSoon": "Скоро",
+			"disabled": "Отключено",
+			"repository": "Репозиторий",
+			"repositoryHint": "URL публичного репозитория и owner/name (например, alexei.dolgolyov/notify-bridge).",
+			"options": "Опции",
+			"includePrereleases": "Учитывать пре-релизы",
+			"prereleasesHint": "Если выключено, кандидаты в релизы и бета-версии игнорируются, даже если они новее установленной.",
+			"interval": "Интервал проверки",
+			"intervalHint": "Как часто фоновая задача опрашивает источник. Ручная проверка всегда доступна.",
+			"intervalRange": "1–168 ч",
+			"hoursUnit": "ч",
+			"testConnection": "Проверить связь",
+			"checkNow": "Проверить сейчас",
+			"checkDone": "Проверка релизов завершена",
+			"checkFailed": "Не удалось проверить релизы",
+			"testOk": "Источник доступен",
+			"testFailed": "Источник недоступен",
+			"testFound": "Найдена версия",
+			"viewRelease": "Открыть релиз v{v}",
+			"statusUpToDate": "Актуальная версия",
+			"statusUpdate": "Доступно обновление",
+			"statusDisabled": "Проверка релизов отключена",
+			"statusError": "Ошибка последней проверки",
+			"statusUnknown": "Ещё не проверялось",
+			"heroAvailable": "доступна",
+			"updateAvailableTooltip": "Доступна версия v{v} — открыть Настройки",
+			"lastChecked": "Последняя проверка",
+			"never": "никогда",
+			"justNow": "только что",
+			"minutesAgo": "{n} мин назад",
+			"hoursAgo": "{n} ч назад",
+			"daysAgo": "{n} д назад",
+			"error": {
+				"disabled": "Проверка релизов отключена",
+				"misconfigured": "Источник настроен не полностью",
+				"provider_changed": "Источник изменён — ожидание следующей проверки",
+				"no_release_found": "Подходящий релиз на источнике не найден",
+				"network_error": "Источник недоступен",
+				"http_error": "Источник вернул ошибку",
+				"parse_error": "Не удалось разобрать ответ источника",
+				"unsafe_url": "URL отклонён проверкой безопасности",
+				"not_implemented": "Источник пока не реализован",
+				"unknown_error": "Неизвестная ошибка",
+				"error": "Ошибка последней проверки"
+			}
+		}
 	},
 	"hints": {
 		"periodicSummary": "Отправляет плановую сводку по всем отслеживаемым альбомам в указанное время. Подходит для ежедневных/еженедельных дайджестов.",
@@ -705,9 +1014,12 @@
 		"quietHours": "Подавляет все уведомления в указанном HH:MM окне (по часовому поясу приложения). Поддерживаются окна через полночь, например 22:00–07:00.",
 		"favoritesOnly": "Включать только ассеты, отмеченные как избранные.",
 		"maxAssets": "Максимальное количество ассетов в одном уведомлении.",
-		"periodicStartDate": "Опорная дата для расчёта интервалов. Сводки отправляются каждые N дней от этой даты.",
-		"times": "Время отправки уведомлений в формате ЧЧ:ММ. Для нескольких значений через запятую: 09:00,18:00",
+		"periodicStartDate": "Опорная дата в часовом поясе приложения. Первая сводка отправится в ближайшее заданное время ЧЧ:ММ, начиная с этой даты, затем каждые N дней.",
+		"intervalDays": "Период между сводками в днях. 1 = ежедневно, 7 = еженедельно.",
+		"times": "Время отправки уведомлений. Добавьте сколько угодно значений времени в день.",
 		"albumMode": "По альбому: отдельное уведомление для каждого. Объединённый: одно уведомление со всеми. Случайный: выбирается один альбом.",
+		"scheduledAlbumMode": "Как альбомы группируются в запланированных отправках. По умолчанию: По альбому (одно уведомление на каждый отслеживаемый альбом).",
+		"memoryAlbumMode": "Как альбомы группируются в воспоминаниях. По умолчанию: Объединённый (одно уведомление со всеми совпадениями из всех альбомов).",
 		"minRating": "Включать только ассеты с рейтингом не ниже указанного (0 = без фильтра).",
 		"eventMessages": "Шаблоны уведомлений о событиях в реальном времени. Используйте {переменные} для динамического контента.",
 		"assetFormatting": "Форматирование отдельных ассетов в сообщениях уведомлений.",
@@ -721,15 +1033,21 @@
 		"trackingConfig": "Управляет тем, какие события вызывают уведомления и как фильтруются ассеты.",
 		"templateConfig": "Управляет форматом сообщений. Используются шаблоны по умолчанию, если не задано.",
 		"scanInterval": "Как часто опрашивать провайдер на предмет изменений (в секундах). Меньше = быстрее обнаружение, но больше запросов к API.",
-		"batchDuration": "Время накопления изменений перед отправкой уведомлений. 0 = отправлять сразу.",
+		"adaptiveMaxSkip": "Снижает частоту опроса, когда отслеживание простаивает — уменьшает нагрузку на сервер-источник. Оставьте пустым или 0, чтобы уведомления приходили без задержки: каждый тик выполняется с заданным интервалом. Значение 2 позволит замедлять опрос до 2× после ~5 мин простоя, а 4 — до 4× после ~15 мин. Любая активность сразу возвращает базовую частоту.",
 		"defaultTrackingConfig": "Применяется ко всем привязанным получателям, если не переопределено.",
 		"defaultTemplateConfig": "Применяется ко всем привязанным получателям, если не переопределено.",
 		"defaultCount": "Сколько результатов возвращать, если пользователь не указал количество (1-20).",
 		"responseMode": "Медиа: отправка фото. Текст: только имена файлов/ссылки. Медиа-режим использует больше трафика.",
 		"botLocale": "Язык описаний команд в меню Telegram и ответов бота.",
-		"rateLimits": "Кулдаун в секундах между использованиями команд в каждом чате. 0 = без ограничений."
+		"rateLimits": "Кулдаун в секундах между использованиями команд в каждом чате. 0 = без ограничений.",
+		"commandResponses": "Шаблоны ответов на каждую /команду. Используйте {переменные} для динамических данных.",
+		"commandErrors": "Резервные сообщения, когда команда не может выполниться (превышен лимит) или ничего не возвращает.",
+		"commandDescriptions": "Короткие подписи в меню команд Telegram, которые показываются рядом с каждой /командой.",
+		"commandUsage": "Примеры вызовов, отображаемые в /help, чтобы показать пользователям как вызывать каждую команду."
 	},
 	"matrixBot": {
+		"titleEmphasis": "matrix",
+		"countLabel": "ботов",
 		"title": "Matrix боты",
 		"description": "Подключения к Matrix серверам для уведомлений в комнаты",
 		"addBot": "Добавить Matrix бот",
@@ -746,6 +1064,8 @@
 		"operationFailed": "Операция не удалась"
 	},
 	"emailBot": {
+		"titleEmphasis": "email",
+		"countLabel": "учётных записей",
 		"title": "Email боты",
 		"description": "SMTP отправители для уведомлений по email",
 		"addBot": "Добавить Email бот",
@@ -765,6 +1085,8 @@
 		"operationFailed": "Операция не удалась"
 	},
 	"cmdTemplateConfig": {
+		"titleEmphasis": "шаблоны",
+		"countLabel": "шаблонов",
 		"title": "Шаблоны команд",
 		"description": "Настройте ответы команд с помощью Jinja2 шаблонов",
 		"newConfig": "Новый шаблон",
@@ -774,10 +1096,15 @@
 		"noConfigs": "Шаблонов команд пока нет.",
 		"confirmDelete": "Удалить этот шаблон команд?",
 		"commandResponses": "Ответы команд",
-		"commandResponsesHint": "Оставьте слот пустым, чтобы использовать ответ по умолчанию."
+		"commandErrors": "Сообщения об ошибках",
+		"commandDescriptions": "Описания команд",
+		"commandUsage": "Примеры использования"
 	},
 	"commandConfig": {
+		"titleEmphasis": "конфигурации",
+		"countLabel": "конфигураций",
 		"title": "Конфигурации команд",
+		"noCommandsForProvider": "Для этого типа провайдера нет доступных команд.",
 		"description": "Настройки команд для взаимодействия с Telegram-ботами",
 		"newConfig": "Новая конфигурация",
 		"name": "Название",
@@ -799,6 +1126,7 @@
 		"noTemplate": "По умолчанию (встроенный)"
 	},
 	"commandTracker": {
+		"titleEmphasis": "трекеры",
 		"title": "Трекеры команд",
 		"description": "Управление трекерами команд и их слушателями",
 		"newTracker": "Новый трекер",
@@ -826,9 +1154,22 @@
 		"scopeInherit": "Наследовать: вычислить из маршрутизации уведомлений",
 		"noCollections": "Нет доступных альбомов."
 	},
+	"commands": {
+		"bridgeSelf": {
+			"status": "Состояние моста",
+			"statusDesc": "Показать счётчики состояния моста",
+			"thresholds": "Пороги моста",
+			"thresholdsDesc": "Показать настроенные пороги оповещений",
+			"reset": "Сбросить счётчик",
+			"resetDesc": "Вручную сбросить счётчик сбоев",
+			"health": "Здоровье моста",
+			"healthDesc": "Краткая однострочная сводка состояния"
+		}
+	},
 	"snackbar": {
 		"showDetails": "Показать детали",
-		"hideDetails": "Скрыть детали"
+		"hideDetails": "Скрыть детали",
+		"region": "Уведомления"
 	},
 	"timezone": {
 		"searchPlaceholder": "Поиск по городам или IANA-кодам…",
@@ -837,9 +1178,12 @@
 		"noMatches": "Нет совпадений"
 	},
 	"locales": {
+		"label": "язык",
+		"labelPlural": "языков",
 		"empty": "Языки не выбраны. Добавьте язык ниже, чтобы начать редактирование шаблонов.",
 		"add": "Добавить язык",
 		"searchPlaceholder": "Найти или ввести код (например de-CH)…",
+		"customPlaceholder": "или de-CH",
 		"addCustom": "Добавить свой код",
 		"noSuggestions": "Ничего не найдено. Введите код локали (2–3 буквы).",
 		"primary": "Основной",
@@ -905,6 +1249,7 @@
 	},
 	"common": {
 		"loading": "Загрузка...",
+		"auto": "Авто",
 		"save": "Сохранить",
 		"cancel": "Отмена",
 		"delete": "Удалить",
@@ -912,6 +1257,8 @@
 		"edit": "Редактировать",
 		"description": "Описание",
 		"close": "Закрыть",
+		"hide": "Скрыть",
+		"show": "Показать",
 		"confirm": "Подтвердить",
 		"cannotDelete": "Невозможно удалить",
 		"blockedByIntro": "На объект ссылаются:",
@@ -1019,6 +1366,12 @@
 		"memorySourceNative": "Использовать API воспоминаний Immich",
 		"localeEn": "Английский интерфейс",
 		"localeRu": "Русский интерфейс",
+		"logLevelDebug": "Подробный — каждый шаг",
+		"logLevelInfo": "По умолчанию — ключевые события",
+		"logLevelWarning": "Только предупреждения и ошибки",
+		"logLevelError": "Только ошибки — самый тихий",
+		"logFormatText": "Читаемый человеком текст",
+		"logFormatJson": "Один JSON-объект на строку",
 		"modeMedia": "Отправка файлов фото/видео",
 		"modeText": "Только имена файлов и ссылки",
 		"allEvents": "Показать все типы событий",
@@ -1030,6 +1383,16 @@
 		"actionSuccess": "Запланированное действие выполнено",
 		"actionPartial": "Запланированное действие выполнено частично",
 		"actionFailed": "Запланированное действие провалено",
+		"commandHandled": "Команда бота обработана",
+		"commandRateLimited": "Команда бота ограничена по частоте",
+		"commandFailed": "Команда бота вызвала ошибку",
+		"refreshOff": "Автообновление выключено",
+		"refresh10s": "Обновлять каждые 10 секунд",
+		"refresh30s": "Обновлять каждые 30 секунд",
+		"refresh60s": "Обновлять каждую минуту",
+		"refresh5m": "Обновлять каждые 5 минут",
+		"statsModePage": "Учитывать только события на текущей странице",
+		"statsModeAll": "Учитывать все события под текущими фильтрами",
 		"newestFirst": "Сначала новые события",
 		"oldestFirst": "Сначала старые события",
 		"chatActionNone": "Индикатор не показывается",
@@ -1052,7 +1415,9 @@
 		"providerScheduler": "Запланированные сообщения по расписанию",
 		"providerNut": "Мониторинг ИБП через NUT",
 		"providerGooglePhotos": "Альбомы и общие библиотеки Google Фото",
-		"providerWebhook": "Приём событий через HTTP POST"
+		"providerWebhook": "Приём событий через HTTP POST",
+		"providerHomeAssistant": "Шина событий Home Assistant по WebSocket",
+		"providerBridgeSelf": "Внутренние оповещения о сбоях опроса, отправки или диспатча"
 	},
 	"webhookLogs": {
 		"title": "Последние запросы",
@@ -1081,6 +1446,8 @@
 		"close": "закрыть"
 	},
 	"actions": {
+		"titleEmphasis": "автоматизации",
+		"countLabel": "действий",
 		"title": "Действия",
 		"description": "Запланированные операции над внешними сервисами",
 		"addAction": "Добавить действие",
@@ -1138,6 +1505,7 @@
 		"triggerScheduled": "по расписанию"
 	},
 	"backup": {
+		"titleEmphasis": "и восстановление",
 		"title": "Резервное копирование",
 		"description": "Экспорт и импорт конфигурации, настройка автоматических бэкапов",
 		"export": "Экспорт конфигурации",
@@ -1209,6 +1577,30 @@
 		"applyLater": "Применить позже",
 		"restartNow": "Перезапустить сейчас",
 		"restartingTitle": "Перезапуск бэкенда…",
-		"restartingDescription": "Страница перезагрузится, как только сервер снова будет доступен."
+		"restartingDescription": "Страница перезагрузится, как только сервер снова будет доступен.",
+		"countLabel": "бэкапов",
+		"scheduleOn": "Авто · каждые {h}ч",
+		"scheduleOff": "Авто-бэкап выключен",
+		"lastBackup": "Последний {ago}",
+		"never": "ещё нет бэкапов",
+		"totalSize": "всего {size}",
+		"dropZone": "Перетащите JSON-бэкап сюда или нажмите для выбора",
+		"dropZoneActive": "Отпустите для загрузки",
+		"changeFile": "Сменить файл",
+		"catGroupIdentity": "Идентичность и маршрутизация",
+		"catGroupNotif": "Уведомления",
+		"catGroupCmd": "Команды",
+		"catGroupSystem": "Система",
+		"stepCategories": "Что включить",
+		"stepSecrets": "Обработка секретов",
+		"stepDownload": "Скачать",
+		"stepFile": "Выберите файл",
+		"stepValidate": "Проверить содержимое",
+		"stepConflict": "При конфликте",
+		"stepApply": "Применить",
+		"tagScheduled": "по расписанию",
+		"tagManual": "вручную",
+		"tagSecrets": "с секретами",
+		"validateFirst": "Сначала проверьте файл, чтобы включить импорт"
 	}
 }

frontend/src/lib/locales.ts

@@ -0,0 +1,55 @@
+/**
+ * Shared locale catalog used by LocaleSelector (settings) and the
+ * template editors (notification & command). Single source of truth so
+ * native names and metadata stay consistent across pickers.
+ */
+
+export interface LocaleMeta {
+	code: string;
+	name: string;       // English name
+	native: string;     // Native script
+	rtl?: boolean;
+}
+
+export const LOCALE_CATALOG: LocaleMeta[] = [
+	{ code: 'en', name: 'English',    native: 'English' },
+	{ code: 'ru', name: 'Russian',    native: 'Русский' },
+	{ code: 'de', name: 'German',     native: 'Deutsch' },
+	{ code: 'fr', name: 'French',     native: 'Français' },
+	{ code: 'es', name: 'Spanish',    native: 'Español' },
+	{ code: 'it', name: 'Italian',    native: 'Italiano' },
+	{ code: 'pt', name: 'Portuguese', native: 'Português' },
+	{ code: 'pl', name: 'Polish',     native: 'Polski' },
+	{ code: 'nl', name: 'Dutch',      native: 'Nederlands' },
+	{ code: 'sv', name: 'Swedish',    native: 'Svenska' },
+	{ code: 'fi', name: 'Finnish',    native: 'Suomi' },
+	{ code: 'no', name: 'Norwegian',  native: 'Norsk' },
+	{ code: 'da', name: 'Danish',     native: 'Dansk' },
+	{ code: 'cs', name: 'Czech',      native: 'Čeština' },
+	{ code: 'hu', name: 'Hungarian',  native: 'Magyar' },
+	{ code: 'ro', name: 'Romanian',   native: 'Română' },
+	{ code: 'el', name: 'Greek',      native: 'Ελληνικά' },
+	{ code: 'tr', name: 'Turkish',    native: 'Türkçe' },
+	{ code: 'uk', name: 'Ukrainian',  native: 'Українська' },
+	{ code: 'be', name: 'Belarusian', native: 'Беларуская' },
+	{ code: 'bg', name: 'Bulgarian',  native: 'Български' },
+	{ code: 'sr', name: 'Serbian',    native: 'Српски' },
+	{ code: 'ar', name: 'Arabic',     native: 'العربية', rtl: true },
+	{ code: 'he', name: 'Hebrew',     native: 'עברית',   rtl: true },
+	{ code: 'fa', name: 'Persian',    native: 'فارسی',   rtl: true },
+	{ code: 'zh', name: 'Chinese',    native: '中文' },
+	{ code: 'ja', name: 'Japanese',   native: '日本語' },
+	{ code: 'ko', name: 'Korean',     native: '한국어' },
+	{ code: 'hi', name: 'Hindi',      native: 'हिन्दी' },
+	{ code: 'vi', name: 'Vietnamese', native: 'Tiếng Việt' },
+	{ code: 'th', name: 'Thai',       native: 'ไทย' },
+	{ code: 'id', name: 'Indonesian', native: 'Bahasa Indonesia' },
+];
+
+export function getLocaleMeta(code: string): LocaleMeta {
+	return LOCALE_CATALOG.find(l => l.code === code) ?? {
+		code,
+		name: code.toUpperCase(),
+		native: code.toUpperCase(),
+	};
+}

frontend/src/lib/portal.ts

@@ -0,0 +1,35 @@
+/**
+ * Svelte action that re-parents a node to document.body (or any selector).
+ *
+ * Use this for popups / dropdowns / tooltips that rely on
+ * `position: fixed` positioning. Any ancestor with `backdrop-filter`,
+ * `transform`, `filter`, `perspective`, `contain: paint`, or
+ * `will-change: transform` becomes the containing block for fixed
+ * descendants — which silently breaks viewport-relative positioning.
+ *
+ * Portalling sidesteps that by detaching the node from the component
+ * tree and appending it to a target outside any such ancestor.
+ *
+ * Usage:
+ *   <div use:portal>...</div>          // → document.body
+ *   <div use:portal={'#root'}>...</div> // → custom selector
+ */
+export type PortalTarget = string | HTMLElement;
+
+export function portal(node: HTMLElement, target: PortalTarget = 'body') {
+	function attach(t: PortalTarget) {
+		const el = typeof t === 'string' ? document.querySelector(t) : t;
+		if (el instanceof HTMLElement) el.appendChild(node);
+	}
+
+	attach(target);
+
+	return {
+		update(newTarget: PortalTarget) {
+			attach(newTarget);
+		},
+		destroy() {
+			node.parentNode?.removeChild(node);
+		},
+	};
+}

frontend/src/lib/providers/bridge-self.ts

@@ -0,0 +1,98 @@
+import type { ProviderDescriptor } from './types';
+
+/**
+ * Bridge self-monitoring provider descriptor.
+ *
+ * The bridge_self provider has no remote URL and no credentials. The only
+ * configuration surface is the three thresholds below, used by the server
+ * to decide when an internal failure deserves a notification.
+ *
+ * Exactly one bridge_self provider exists per user, auto-seeded on user
+ * creation (see ``packages/server/src/notify_bridge_server/database/seeds.py``).
+ */
+export const bridgeSelfDescriptor: ProviderDescriptor = {
+	type: 'bridge_self',
+	defaultName: 'Bridge Self-Monitoring',
+	icon: 'mdiAlertCircleOutline',
+	hasUrl: false,
+
+	configFields: [
+		{
+			key: 'poll_failure_threshold',
+			configKey: 'poll_failure_threshold',
+			label: 'providers.bridgeSelfPollThreshold',
+			type: 'number',
+			optional: true,
+			min: 1,
+			defaultValue: 3,
+			hint: 'providers.bridgeSelfPollThresholdHint',
+		},
+		{
+			key: 'deferred_backlog_threshold',
+			configKey: 'deferred_backlog_threshold',
+			label: 'providers.bridgeSelfDeferredThreshold',
+			type: 'number',
+			optional: true,
+			min: 1,
+			defaultValue: 100,
+			hint: 'providers.bridgeSelfDeferredThresholdHint',
+		},
+		{
+			key: 'target_failure_threshold',
+			configKey: 'target_failure_threshold',
+			label: 'providers.bridgeSelfTargetThreshold',
+			type: 'number',
+			optional: true,
+			min: 1,
+			defaultValue: 5,
+			hint: 'providers.bridgeSelfTargetThresholdHint',
+		},
+	],
+
+	buildConfig(form) {
+		const toInt = (raw: unknown, fallback: number): number => {
+			const n = typeof raw === 'number' ? raw : parseInt(String(raw ?? ''), 10);
+			return Number.isFinite(n) && n >= 1 ? n : fallback;
+		};
+		return {
+			config: {
+				poll_failure_threshold: toInt(form.poll_failure_threshold, 3),
+				deferred_backlog_threshold: toInt(form.deferred_backlog_threshold, 100),
+				target_failure_threshold: toInt(form.target_failure_threshold, 5),
+			},
+		};
+	},
+
+	hasConfigChanged(form, existing) {
+		const toInt = (raw: unknown, fallback: number): number => {
+			const n = typeof raw === 'number' ? raw : parseInt(String(raw ?? ''), 10);
+			return Number.isFinite(n) && n >= 1 ? n : fallback;
+		};
+		return (
+			toInt(form.poll_failure_threshold, 3) !== toInt(existing.poll_failure_threshold, 3) ||
+			toInt(form.deferred_backlog_threshold, 100) !== toInt(existing.deferred_backlog_threshold, 100) ||
+			toInt(form.target_failure_threshold, 5) !== toInt(existing.target_failure_threshold, 5)
+		);
+	},
+
+	eventFields: [
+		{
+			key: 'track_bridge_self_poll_failures',
+			label: 'trackingConfig.bridgeSelfPollFailures',
+			default: true,
+		},
+		{
+			key: 'track_bridge_self_deferred_backlog',
+			label: 'trackingConfig.bridgeSelfDeferredBacklog',
+			default: true,
+		},
+		{
+			key: 'track_bridge_self_target_failures',
+			label: 'trackingConfig.bridgeSelfTargetFailures',
+			default: true,
+		},
+	],
+
+	collectionMeta: null,
+	webhookBased: false,
+};

frontend/src/lib/providers/gitea.ts

@@ -56,5 +56,20 @@ export const giteaDescriptor: ProviderDescriptor = {
 		desc: () => '',
 	},
 
+	userFilters: [
+		{
+			key: 'senders',
+			label: 'notificationTracker.userAllowlist',
+			placeholder: 'notificationTracker.selectUsers',
+			icon: 'mdiAccountCheck',
+		},
+		{
+			key: 'exclude_senders',
+			label: 'notificationTracker.userBlocklist',
+			placeholder: 'notificationTracker.selectUsers',
+			icon: 'mdiAccountOff',
+		},
+	],
+
 	webhookUrlPattern: '/api/webhooks/gitea/{token}',
 };

frontend/src/lib/providers/home-assistant.ts

@@ -0,0 +1,96 @@
+import type { ProviderDescriptor } from './types';
+
+export const homeAssistantDescriptor: ProviderDescriptor = {
+	type: 'home_assistant',
+	defaultName: 'Home Assistant',
+	icon: 'mdiHomeAssistant',
+	hasUrl: true,
+	urlPlaceholder: 'http://homeassistant.local:8123',
+
+	configFields: [
+		{
+			key: 'access_token', configKey: 'access_token',
+			label: 'providers.haAccessToken', editLabel: 'providers.haAccessTokenKeep',
+			type: 'password', required: 'create-only', hint: 'providers.haAccessTokenHint',
+		},
+		{
+			key: 'verify_tls', configKey: 'verify_tls',
+			label: 'providers.haVerifyTls',
+			type: 'toggle', optional: true, hint: 'providers.haVerifyTlsHint',
+			defaultValue: true,
+		},
+	],
+
+	buildConfig(form, editing) {
+		const config: Record<string, unknown> = { url: form.url };
+		if (form.access_token) config.access_token = form.access_token;
+		// Coerce truthy/falsy form values to a real boolean. The toggle
+		// control binds to `checked`, so this is normally already a bool,
+		// but legacy form state may carry the string defaults.
+		config.verify_tls = form.verify_tls === false || form.verify_tls === 'false' ? false : true;
+		if (!editing && !form.access_token) {
+			return { config, error: 'providers.haAccessTokenRequired' };
+		}
+		return { config };
+	},
+
+	hasConfigChanged(form, existing) {
+		const existingVerify = existing.verify_tls !== false;
+		const formVerify = !(form.verify_tls === false || form.verify_tls === 'false');
+		return (
+			form.url !== (existing.url || '') ||
+			!!form.access_token ||
+			existingVerify !== formVerify
+		);
+	},
+
+	eventFields: [
+		{ key: 'track_ha_state_changed', label: 'trackingConfig.haStateChanged', default: true },
+		{ key: 'track_ha_automation_triggered', label: 'trackingConfig.haAutomationTriggered', default: false },
+		{ key: 'track_ha_service_called', label: 'trackingConfig.haServiceCalled', default: false },
+		{
+			key: 'track_ha_event_fired',
+			label: 'trackingConfig.haEventFired',
+			default: false,
+			hint: 'trackingConfig.haEventFiredHint',
+		},
+	],
+
+	// entity_glob / domain_allowlist tag-style filters. Stored on the
+	// tracker's `filters` JSON column (not the flat form root) — the
+	// TrackerForm reads `inputMode: 'tags'` to render a chip input rather
+	// than a picker, and `filterKey` routes the value into
+	// `tracker.filters[filterKey]` at save time.
+	userFilters: [
+		{
+			key: 'entity_glob',
+			filterKey: 'entity_glob',
+			inputMode: 'tags',
+			label: 'notificationTracker.haEntityGlob',
+			placeholder: 'notificationTracker.haEntityGlobPlaceholder',
+			icon: 'mdiAsterisk',
+		},
+		{
+			key: 'domain_allowlist',
+			filterKey: 'domain_allowlist',
+			inputMode: 'tags',
+			label: 'notificationTracker.haDomainAllowlist',
+			placeholder: 'notificationTracker.haDomainAllowlistPlaceholder',
+			icon: 'mdiTagOutline',
+		},
+	],
+
+	collectionMeta: {
+		label: 'notificationTracker.entities',
+		icon: 'mdiViewList',
+		placeholder: 'notificationTracker.selectEntities',
+		countLabel: 'notificationTracker.entities_count',
+		desc: (col: { state?: string; domain?: string; entity_id?: string; id?: string }) => {
+			const parts: string[] = [];
+			if (col.domain) parts.push(col.domain);
+			if (col.state) parts.push(col.state);
+			if (parts.length === 0) return col.entity_id || col.id || '';
+			return parts.join(' · ');
+		},
+	},
+};

frontend/src/lib/providers/immich.ts

@@ -1,11 +1,19 @@
 import type { ProviderDescriptor } from './types';
 
+/**
+ * Today's date in ISO (YYYY-MM-DD) — used as the default for
+ * `periodic_start_date` so new configs anchor to "today" rather than a
+ * hardcoded date that gets further into the past on every release.
+ */
+const todayIso = (): string => new Date().toISOString().slice(0, 10);
+
 export const immichDescriptor: ProviderDescriptor = {
 	type: 'immich',
 	defaultName: 'Immich',
 	icon: 'mdiImageMultiple',
 	hasUrl: true,
 	urlPlaceholder: undefined, // uses generic i18n placeholder
+	supportsAutoOrganize: true,
 
 	configFields: [
 		{
@@ -48,7 +56,7 @@ export const immichDescriptor: ProviderDescriptor = {
 	],
 
 	extraTrackingFields: [
-		{ key: 'max_assets_to_show', label: 'trackingConfig.maxAssets', type: 'number', min: 0, max: 50, defaultValue: 5, hint: 'hints.maxAssets' },
+		{ key: 'max_assets_to_show', label: 'trackingConfig.maxAssets', type: 'number', min: 0, max: 50, defaultValue: 10, hint: 'hints.maxAssets' },
 		{ key: 'assets_order_by', label: 'trackingConfig.sortBy', type: 'grid-select', gridItems: 'sortByItems', gridColumns: 2, defaultValue: 'none' },
 		{ key: 'assets_order', label: 'trackingConfig.sortOrder', type: 'grid-select', gridItems: 'sortOrderItems', gridColumns: 2, defaultValue: 'descending' },
 	],
@@ -58,17 +66,17 @@ export const immichDescriptor: ProviderDescriptor = {
 			key: 'periodic', legend: 'trackingConfig.periodicSummary', legendHint: 'hints.periodicSummary',
 			enabledField: 'periodic_enabled', enabledDefault: false,
 			fields: [
-				{ key: 'periodic_interval_days', label: 'trackingConfig.intervalDays', type: 'number', min: 1, defaultValue: 1 },
-				{ key: 'periodic_start_date', label: 'trackingConfig.startDate', type: 'number', defaultValue: '2025-01-01' }, // rendered as date input
-				{ key: 'periodic_times', label: 'trackingConfig.times', type: 'number', defaultValue: '12:00' }, // rendered as text input
+				{ key: 'periodic_interval_days', label: 'trackingConfig.intervalDays', type: 'number', min: 1, defaultValue: 1, hint: 'hints.intervalDays' },
+				{ key: 'periodic_start_date', label: 'trackingConfig.startDate', type: 'date', defaultValue: todayIso, hint: 'hints.periodicStartDate' },
+				{ key: 'periodic_times', label: 'trackingConfig.times', type: 'time-list', defaultValue: '12:00', hint: 'hints.times', inlineHelp: 'trackingConfig.timesInlineHelp' },
 			],
 		},
 		{
 			key: 'scheduled', legend: 'trackingConfig.scheduledAssets', legendHint: 'hints.scheduledAssets',
 			enabledField: 'scheduled_enabled', enabledDefault: false,
 			fields: [
-				{ key: 'scheduled_times', label: 'trackingConfig.times', type: 'number', defaultValue: '09:00' },
-				{ key: 'scheduled_collection_mode', label: 'trackingConfig.albumMode', type: 'grid-select', gridItems: 'albumModeItems', gridColumns: 3, defaultValue: 'per_collection' },
+				{ key: 'scheduled_times', label: 'trackingConfig.times', type: 'time-list', defaultValue: '09:00', hint: 'hints.times', inlineHelp: 'trackingConfig.timesInlineHelp' },
+				{ key: 'scheduled_collection_mode', label: 'trackingConfig.albumMode', type: 'grid-select', gridItems: 'albumModeItems', gridColumns: 3, defaultValue: 'per_collection', hint: 'hints.scheduledAlbumMode' },
 				{ key: 'scheduled_limit', label: 'trackingConfig.maxAssets', type: 'number', min: 1, max: 100, defaultValue: 10, hint: 'hints.maxAssets' },
 				{ key: 'scheduled_asset_type', label: 'trackingConfig.assetType', type: 'grid-select', gridItems: 'assetTypeItems', gridColumns: 3, defaultValue: 'all' },
 				{ key: 'scheduled_min_rating', label: 'trackingConfig.minRating', type: 'number', min: 0, max: 5, defaultValue: 0, hint: 'hints.minRating' },
@@ -79,21 +87,21 @@ export const immichDescriptor: ProviderDescriptor = {
 			key: 'memory', legend: 'trackingConfig.memoryMode', legendHint: 'hints.memoryMode',
 			enabledField: 'memory_enabled', enabledDefault: false,
 			fields: [
-				{ key: 'memory_times', label: 'trackingConfig.times', type: 'number', defaultValue: '09:00' },
-				{ key: 'memory_collection_mode', label: 'trackingConfig.albumMode', type: 'grid-select', gridItems: 'albumModeItems', gridColumns: 3, defaultValue: 'combined' },
-				{ key: 'memory_limit', label: 'trackingConfig.maxAssets', type: 'number', min: 1, max: 100, defaultValue: 10 },
+				{ key: 'memory_times', label: 'trackingConfig.times', type: 'time-list', defaultValue: '09:00', hint: 'hints.times', inlineHelp: 'trackingConfig.timesInlineHelp' },
+				{ key: 'memory_collection_mode', label: 'trackingConfig.albumMode', type: 'grid-select', gridItems: 'albumModeItems', gridColumns: 3, defaultValue: 'combined', hint: 'hints.memoryAlbumMode' },
+				{ key: 'memory_limit', label: 'trackingConfig.maxAssets', type: 'number', min: 1, max: 100, defaultValue: 10, hint: 'hints.maxAssets' },
 				{ key: 'memory_asset_type', label: 'trackingConfig.assetType', type: 'grid-select', gridItems: 'assetTypeItems', gridColumns: 3, defaultValue: 'all' },
-				{ key: 'memory_min_rating', label: 'trackingConfig.minRating', type: 'number', min: 0, max: 5, defaultValue: 0 },
+				{ key: 'memory_min_rating', label: 'trackingConfig.minRating', type: 'number', min: 0, max: 5, defaultValue: 0, hint: 'hints.minRating' },
 				{ key: 'memory_favorite_only', label: 'trackingConfig.favoritesOnly', type: 'toggle', defaultValue: false, hint: 'hints.favoritesOnly' },
-				{ key: 'memory_source', label: 'trackingConfig.memorySource', type: 'grid-select', gridItems: 'memorySourceItems', gridColumns: 2, defaultValue: 'albums' },
+				{ key: 'memory_source', label: 'trackingConfig.memorySource', type: 'grid-select', gridItems: 'memorySourceItems', gridColumns: 2, defaultValue: 'albums', hint: 'hints.memorySource' },
 			],
 		},
 		{
 			key: 'quietHours', legend: 'trackingConfig.quietHours', legendHint: 'hints.quietHours',
 			enabledField: 'quiet_hours_enabled', enabledDefault: false,
 			fields: [
-				{ key: 'quiet_hours_start', label: 'trackingConfig.quietHoursStart', type: 'number', defaultValue: '22:00' },
-				{ key: 'quiet_hours_end', label: 'trackingConfig.quietHoursEnd', type: 'number', defaultValue: '07:00' },
+				{ key: 'quiet_hours_start', label: 'trackingConfig.quietHoursStart', type: 'time', defaultValue: '22:00' },
+				{ key: 'quiet_hours_end', label: 'trackingConfig.quietHoursEnd', type: 'time', defaultValue: '07:00' },
 			],
 		},
 	],
@@ -106,6 +114,17 @@ export const immichDescriptor: ProviderDescriptor = {
 		desc: (col) => `${col.assetCount ?? col.asset_count ?? 0} assets`,
 	},
 
+	// Periodic summaries / scheduled picks / memories / quiet hours all live on
+	// the linked tracking & template configs — surface that connection on the
+	// tracker form so users don't need to read docs to find them.
+	featureDiscoveryHint: {
+		messageKey: 'notificationTracker.featureDiscovery',
+		ctas: [
+			{ href: '/tracking-configs?edit={tracking_config_id}', labelKey: 'notificationTracker.openTrackingConfig', icon: 'mdiArrowRight' },
+			{ href: '/template-configs?edit={template_config_id}', labelKey: 'notificationTracker.openTemplateConfig', icon: 'mdiArrowRight' },
+		],
+	},
+
 	async onBeforeSave({ form, previousCollectionIds, collections, api: apiFn }) {
 		const newIds = (form.collection_ids as string[]).filter(id => !previousCollectionIds.includes(id));
 		if (newIds.length === 0) return { proceed: true };
@@ -114,7 +133,9 @@ export const immichDescriptor: ProviderDescriptor = {
 		const warnings: { id: string; name: string; issue: string }[] = [];
 
 		// Run shared-link checks in parallel with a concurrency cap so a large
-		// album set doesn't stall the save button for seconds.
+		// album set doesn't stall the save button for seconds. Cap of 6 keeps
+		// the save dialog responsive for users with 50+ albums while staying
+		// well under typical Immich per-IP rate limits.
 		const CONCURRENCY = 6;
 		async function checkOne(albumId: string): Promise<void> {
 			try {

frontend/src/lib/providers/index.ts

@@ -13,6 +13,8 @@ import { schedulerDescriptor } from './scheduler';
 import { nutDescriptor } from './nut';
 import { googlePhotosDescriptor } from './google-photos';
 import { webhookDescriptor } from './webhook';
+import { homeAssistantDescriptor } from './home-assistant';
+import { bridgeSelfDescriptor } from './bridge-self';
 
 const REGISTRY: ReadonlyMap<string, ProviderDescriptor> = new Map([
 	['immich', immichDescriptor],
@@ -22,6 +24,8 @@ const REGISTRY: ReadonlyMap<string, ProviderDescriptor> = new Map([
 	['nut', nutDescriptor],
 	['google_photos', googlePhotosDescriptor],
 	['webhook', webhookDescriptor],
+	['home_assistant', homeAssistantDescriptor],
+	['bridge_self', bridgeSelfDescriptor],
 ]);
 
 /** Look up a provider descriptor by type. Returns null for unknown types. */
@@ -47,17 +51,20 @@ export function allProviderTypes(): string[] {
  */
 export function buildTrackingFormDefaults(): Record<string, any> {
 	const defaults: Record<string, any> = {};
+	// `defaultValue` may be a function (for time-sensitive defaults like
+	// today's date) so the computed value is fresh each time the form resets.
+	const resolve = (v: unknown): unknown => (typeof v === 'function' ? (v as () => unknown)() : v);
 	for (const desc of REGISTRY.values()) {
 		for (const field of desc.eventFields) {
 			defaults[field.key] = field.default;
 		}
 		for (const extra of desc.extraTrackingFields ?? []) {
-			defaults[extra.key] = extra.defaultValue ?? '';
+			defaults[extra.key] = resolve(extra.defaultValue) ?? '';
 		}
 		for (const section of desc.featureSections ?? []) {
 			defaults[section.enabledField] = section.enabledDefault;
 			for (const f of section.fields) {
-				defaults[f.key] = f.defaultValue ?? '';
+				defaults[f.key] = resolve(f.defaultValue) ?? '';
 			}
 			for (const cb of section.checkboxes ?? []) {
 				defaults[cb.key] = cb.default;

frontend/src/lib/providers/types.ts

@@ -20,7 +20,7 @@ export interface ConfigField {
 	configKey?: string;
 	/** i18n key for the field label. */
 	label: string;
-	type: 'text' | 'password' | 'number' | 'grid-select';
+	type: 'text' | 'password' | 'number' | 'grid-select' | 'toggle';
 	/** Grid-select item source function name from grid-items.ts. */
 	gridItems?: string;
 	gridColumns?: number;
@@ -60,14 +60,30 @@ export interface EventTrackingField {
 export interface ExtraTrackingField {
 	key: string;
 	label: string;
-	type: 'number' | 'grid-select' | 'toggle';
+	/**
+	 * Control kind:
+	 * - `number`       — numeric spinner
+	 * - `grid-select`  — icon-grid chooser (requires `gridItems`)
+	 * - `toggle`       — on/off switch
+	 * - `date`         — HTML date picker (YYYY-MM-DD)
+	 * - `time`         — HTML time picker (HH:MM)
+	 * - `time-list`    — add/remove list of HH:MM pickers (TimeListEditor),
+	 *                    serialized as a comma-separated string
+	 */
+	type: 'number' | 'grid-select' | 'toggle' | 'date' | 'time' | 'time-list';
 	/** Grid-select item source function name from grid-items.ts. */
 	gridItems?: string;
 	gridColumns?: number;
 	hint?: string;
+	/** Inline helper text rendered under the input (not a tooltip). */
+	inlineHelp?: string;
 	min?: number;
 	max?: number;
-	defaultValue?: string | number | boolean;
+	/**
+	 * Default value. Can be a function for dynamic values (e.g. today's date)
+	 * evaluated each time the form is reset.
+	 */
+	defaultValue?: string | number | boolean | (() => string | number | boolean);
 }
 
 /** A feature section like periodic summary, scheduled assets, memory mode. */
@@ -103,6 +119,38 @@ export interface CollectionMeta {
 	desc: (col: any) => string;
 }
 
+// ── User-identity filters (TrackerForm) ──────────────────────────────
+
+/**
+ * Declares a filter rendered on the tracker form. Two input modes:
+ *
+ * * ``picker`` (default) — populated from the provider's ``/users``
+ *   endpoint, rendered as a ``MultiEntitySelect``. Used for sender
+ *   allowlists / blocklists where the valid values are known.
+ * * ``tags`` — free-text chip input. Used for glob patterns and other
+ *   filter values that aren't enumerable in advance.
+ *
+ * Either way the picked values are stored as ``string[]`` under
+ * ``tracker.filters[filterKey ?? key]``.
+ */
+export interface UserFilterMeta {
+	/** Form field key — used internally for binding. */
+	key: string;
+	/**
+	 * Filter key inside ``tracker.filters``. Defaults to ``key`` when
+	 * omitted (backward compat with the original sender allowlist usage).
+	 */
+	filterKey?: string;
+	/** ``picker`` (default) or ``tags`` for free-text chip input. */
+	inputMode?: 'picker' | 'tags';
+	/** i18n key for the label rendered above the input. */
+	label: string;
+	/** i18n key for the placeholder (picker dropdown or chip input). */
+	placeholder: string;
+	/** MDI icon shown on chips and dropdown rows. */
+	icon: string;
+}
+
 // ── Main descriptor ──────────────────────────────────────────────────
 
 export interface ProviderDescriptor {
@@ -136,6 +184,8 @@ export interface ProviderDescriptor {
 	// ── Collections / Trackers ──
 	/** Null means this provider has no collections (e.g. scheduler). */
 	collectionMeta: CollectionMeta | null;
+	/** Sender allowlist / blocklist pickers shown on the tracker form. */
+	userFilters?: UserFilterMeta[];
 	/** Whether this provider is webhook-based (hides scan_interval). */
 	webhookBased?: boolean;
 
@@ -145,6 +195,31 @@ export interface ProviderDescriptor {
 	/** Whether this provider stores incoming payload history for debugging. */
 	payloadHistory?: boolean;
 
+	// ── Capability flags ──
+	/**
+	 * True when the provider exposes asset/people/album endpoints that the
+	 * Auto-Organize action rule editor needs to render its people / album
+	 * pickers (currently only Immich). Used in place of `type === 'immich'`
+	 * checks per CLAUDE.md rule 8.
+	 */
+	supportsAutoOrganize?: boolean;
+
+	// ── Tracker-form discovery hint ──
+	/**
+	 * Optional info banner shown on the TrackerForm to point users at related
+	 * configuration pages they would otherwise have to discover from docs.
+	 *
+	 * The hint is rendered as a single i18n message followed by zero or more
+	 * call-to-action links. ``ctas[].href`` may include ``{tracking_config_id}``
+	 * / ``{template_config_id}`` placeholders that the form substitutes from
+	 * the tracker's currently selected default-config IDs (or omits the
+	 * ``?edit=...`` query when the value is 0).
+	 */
+	featureDiscoveryHint?: {
+		messageKey: string;
+		ctas?: Array<{ href: string; labelKey: string; icon?: string }>;
+	};
+
 	// ── Provider-specific hooks ──
 	/**
 	 * Called after collection selection changes (before save).

frontend/src/lib/stores/caches.svelte.ts

@@ -20,6 +20,7 @@ import type {
 	CommandTemplateConfig,
 	CommandTracker,
 	Action,
+	ReleaseStatus,
 } from '$lib/types';
 
 /** Service providers — used by Dashboard, Trackers, Command Trackers, Providers page. */
@@ -112,6 +113,74 @@ export const capabilitiesCache = (() => {
 	};
 })();
 
+/** Configured external base URL — used to render absolute webhook URLs.
+ *  Available to all authenticated users. Empty string when unset. */
+export const externalUrlCache = (() => {
+	let data = $state<string>('');
+	let fetchedAt = $state(0);
+	let inflight: Promise<string> | null = null;
+	const TTL = 300_000;
+	return {
+		get value() { return data; },
+		invalidate() { fetchedAt = 0; },
+		async fetch(force = false): Promise<string> {
+			if (!force && fetchedAt > 0 && Date.now() - fetchedAt < TTL) return data;
+			if (inflight) return inflight;
+			inflight = (async () => {
+				try {
+					const res = await api<{ external_url: string }>('/settings/external-url');
+					data = (res?.external_url || '').replace(/\/+$/, '');
+					fetchedAt = Date.now();
+					return data;
+				} finally {
+					inflight = null;
+				}
+			})();
+			return inflight;
+		},
+	};
+})();
+
+/** Upstream release status — drives the sidebar badge and Settings cassette. */
+export const releaseStatusCache = (() => {
+	let data = $state<ReleaseStatus | null>(null);
+	let fetchedAt = $state(0);
+	let inflight: Promise<ReleaseStatus | null> | null = null;
+	// 5 min TTL — fresh enough that "Check now" feels instant on revisit,
+	// long enough that route changes don't hammer the endpoint.
+	const TTL = 300_000;
+	return {
+		get value() { return data; },
+		invalidate() { fetchedAt = 0; },
+		clear() {
+			data = null;
+			fetchedAt = 0;
+			inflight = null;
+		},
+		set(next: ReleaseStatus | null) {
+			data = next;
+			fetchedAt = Date.now();
+		},
+		async fetch(force = false): Promise<ReleaseStatus | null> {
+			if (!force && fetchedAt > 0 && Date.now() - fetchedAt < TTL) return data;
+			if (inflight) return inflight;
+			inflight = (async () => {
+				try {
+					data = await api<ReleaseStatus>('/settings/release');
+					fetchedAt = Date.now();
+					return data;
+				} catch {
+					// Swallow — the badge falls back to its default "no status" state.
+					return data;
+				} finally {
+					inflight = null;
+				}
+			})();
+			return inflight;
+		},
+	};
+})();
+
 /** Supported template locales — fetched from app settings. */
 export const supportedLocalesCache = (() => {
 	let data = $state<string[]>(['en', 'ru']);
@@ -164,7 +233,13 @@ export async function fetchAllCaches(): Promise<void> {
 
 /**
  * Invalidate all entity caches. Useful on logout.
+ *
+ * Singleton state caches (release status, external URL, supported locales)
+ * live outside `allCaches` because their shape differs from entity caches —
+ * we clear them explicitly so a returning user as a different role can't
+ * briefly see the previous user's cached payload.
  */
 export function clearAllCaches(): void {
 	Object.values(allCaches).forEach(c => c.clear());
+	releaseStatusCache.clear();
 }

frontend/src/lib/stores/entity-cache.svelte.ts

@@ -16,8 +16,19 @@ const DEFAULT_TTL_MS = 30_000; // 30 seconds
 export interface EntityCache<T extends { id: number }> {
 	/** Reactive list of cached entities. */
 	readonly items: T[];
-	/** True only during the very first fetch (no cached data yet). */
+	/**
+	 * True only during the very first fetch — when there is no cached data
+	 * to show yet. Background re-fetches keep `loading` false so consumers
+	 * keep rendering the previous list and don't flash a spinner; observe
+	 * `refreshing` instead if a subtle indicator is needed.
+	 */
 	readonly loading: boolean;
+	/**
+	 * True during any non-first fetch (cached items already populated).
+	 * Lets consumers distinguish "show skeleton" (loading) from "show subtle
+	 * shimmer/disabled state" (refreshing) without sharing one flag.
+	 */
+	readonly refreshing: boolean;
 	/** Timestamp of last successful fetch. */
 	readonly fetchedAt: number;
 	/** Fetch entities — returns cached data if fresh, else hits network. */
@@ -43,6 +54,7 @@ export function createEntityCache<T extends { id: number }>(
 ): EntityCache<T> {
 	let _items = $state<T[]>([]);
 	let _loading = $state(false);
+	let _refreshing = $state(false);
 	let _fetchedAt = $state(0);
 
 	function isFresh(): boolean {
@@ -56,8 +68,12 @@ export function createEntityCache<T extends { id: number }>(
 		const existing = inflightRequests.get(endpoint);
 		if (existing) return existing;
 
+		// First-load vs background-refresh state. We split these so consumers
+		// can keep the previous list visible during a re-fetch (refreshing)
+		// instead of flashing a spinner placeholder (loading).
 		const isFirstLoad = _fetchedAt === 0;
 		if (isFirstLoad) _loading = true;
+		else _refreshing = true;
 
 		const request = api<T[]>(endpoint)
 			.then((data) => {
@@ -67,6 +83,7 @@ export function createEntityCache<T extends { id: number }>(
 			})
 			.finally(() => {
 				_loading = false;
+				_refreshing = false;
 				inflightRequests.delete(endpoint);
 			});
 
@@ -104,6 +121,7 @@ export function createEntityCache<T extends { id: number }>(
 	return {
 		get items() { return _items; },
 		get loading() { return _loading; },
+		get refreshing() { return _refreshing; },
 		get fetchedAt() { return _fetchedAt; },
 		fetch,
 		invalidate,

frontend/src/lib/stores/provider-filter.svelte.ts

@@ -26,15 +26,14 @@ function loadFromStorage(): void {
 loadFromStorage();
 
 export const globalProviderFilter = {
-	get id() {
-		// If providers are loaded and the stored ID doesn't match any, auto-clear
-		if (_providerId != null && providersCache.items.length > 0 &&
-			!providersCache.items.some(p => p.id === _providerId)) {
-			globalProviderFilter.clear();
-			return null;
-		}
-		return _providerId;
-	},
+	/**
+	 * Pure getter — returns whatever was last stored, never mutates. Stale-ID
+	 * reconciliation against `providersCache` is the responsibility of a
+	 * one-time `$effect` in `+layout.svelte` (see `reconcileStaleProviderId`),
+	 * because writing during read inside a `$state`-derived getter triggers
+	 * Svelte 5's `state_unsafe_mutation` warning.
+	 */
+	get id() { return _providerId; },
 	get initialized() { return _initialized; },
 
 	set(id: number | null) {
@@ -52,9 +51,24 @@ export const globalProviderFilter = {
 		this.set(null);
 	},
 
+	/**
+	 * Drop the stored provider ID if it no longer matches any item in the
+	 * providers cache. Safe to call from a `$effect` after the cache has been
+	 * fetched. Returns true when reconciliation actually changed state, so the
+	 * caller can short-circuit follow-up work.
+	 */
+	reconcileWithCache(): boolean {
+		if (_providerId != null && providersCache.items.length > 0 &&
+			!providersCache.items.some(p => p.id === _providerId)) {
+			this.clear();
+			return true;
+		}
+		return false;
+	},
+
 	/** The currently selected provider object (reactive). */
 	get provider() {
-		const id = this.id; // triggers stale-ID auto-clear
+		const id = _providerId;
 		if (id == null) return null;
 		return providersCache.items.find(p => p.id === id) ?? null;
 	},

frontend/src/lib/stores/topbar-action.svelte.ts

@@ -0,0 +1,35 @@
+/**
+ * Page-scoped primary action for the global topbar CTA.
+ *
+ * Each route declares its own primary action ("Add Provider",
+ * "New Tracker", etc.) by calling `topbarAction.set({...})`
+ * inside its `onMount`, and clears it on teardown. The layout
+ * reads `topbarAction.current` and renders the button.
+ *
+ * Falls back to the default "New tracker" CTA when no action is
+ * registered (set by the layout itself).
+ */
+export interface TopbarAction {
+	/** Visible label, e.g. "Add Provider". */
+	label: string;
+	/** Optional href — renders as <a>. Mutually exclusive with onclick. */
+	href?: string;
+	/** Optional click handler — renders as <button>. */
+	onclick?: () => void;
+	/** Optional MDI/NavIcon name for the leading glyph (default: mdiPlus). */
+	icon?: string;
+}
+
+let action = $state<TopbarAction | null>(null);
+
+export const topbarAction = {
+	get current(): TopbarAction | null {
+		return action;
+	},
+	set(next: TopbarAction | null) {
+		action = next;
+	},
+	clear() {
+		action = null;
+	},
+};

frontend/src/lib/types.ts

@@ -80,7 +80,7 @@ export interface Tracker {
 	provider_id: number;
 	collection_ids: string[];
 	scan_interval: number;
-	batch_duration: number;
+	adaptive_max_skip: number | null;
 	default_tracking_config_id: number | null;
 	default_template_config_id: number | null;
 	enabled: boolean;
@@ -106,6 +106,7 @@ export interface NotificationTarget {
 	name: string;
 	icon: string;
 	config: Record<string, any>;
+	chat_action?: string | null;
 	chat_name?: string;
 	receiver_count: number;
 	receivers: TargetReceiver[];
@@ -211,16 +212,83 @@ export interface TemplateConfig {
 	created_at: string;
 }
 
+/**
+ * Lifecycle marker the backend stores in ``EventLog.details.dispatch_status``
+ * when a notification doesn't take the immediate-deliver happy path.
+ *
+ * * ``deferred`` — held back by quiet hours; ``deferred_until`` carries the
+ *   UTC ISO datetime at which a drain job will fire.
+ * * ``delivered_after_quiet_hours`` — a drain successfully dispatched the
+ *   originally-deferred event. ``original_event_log_id`` points back at the
+ *   row from when the event was first detected.
+ * * ``deferred_then_dropped`` — drain time arrived but the link/target was
+ *   removed, disabled, or otherwise unsendable. See ``reason`` for detail.
+ * * ``deferred_then_failed`` — drain dispatched but the target returned an
+ *   error; ``reason`` carries the truncated provider error.
+ * * ``suppressed_quiet_hours_nondeferrable`` — wall-clock event type (e.g.
+ *   ``scheduled_message``) caught by quiet hours, dropped on principle.
+ */
+export type DispatchStatus =
+	| 'deferred'
+	| 'delivered_after_quiet_hours'
+	| 'deferred_then_dropped'
+	| 'deferred_then_failed'
+	| 'suppressed_quiet_hours_nondeferrable';
+
+export interface DispatchSummaryError {
+	index: number;
+	error: string;
+}
+
+export interface DispatchSummaryMediaError {
+	target_index: number;
+	kind?: string;
+	chunk?: number;
+	item_index?: number;
+	error?: string;
+	code?: number;
+}
+
+export interface DispatchSummary {
+	targets_attempted: number;
+	targets_succeeded: number;
+	targets_failed: number;
+	errors?: DispatchSummaryError[];
+	errors_truncated?: number;
+	media?: {
+		delivered: number;
+		skipped: number;
+		failed: number;
+	};
+	media_errors?: DispatchSummaryMediaError[];
+	media_errors_truncated?: number;
+}
+
 export interface EventLog {
 	id: number;
 	event_type: string;
 	collection_id: string;
 	collection_name: string;
+	tracker_id?: number | null;
 	tracker_name: string;
 	provider_name: string;
 	provider_id: number | null;
+	action_id?: number | null;
+	action_name?: string;
+	command_tracker_id?: number | null;
+	command_tracker_name?: string;
+	telegram_bot_id?: number | null;
+	bot_name?: string;
 	assets_count: number;
-	details: Record<string, any>;
+	details: Record<string, any> & {
+		dispatch_status?: DispatchStatus;
+		deferred_until?: string;
+		original_event_log_id?: number | null;
+		deferred_for_seconds?: number;
+		dispatch_id?: string;
+		request_id?: string;
+		dispatch_summary?: DispatchSummary;
+	};
 	created_at: string;
 }
 
@@ -336,4 +404,38 @@ export interface DashboardStatus {
 	total_events: number;
 	recent_events: EventLog[];
 	command_trackers?: number;
+	/** Provider name → total event count across ALL events matching the
+	 *  current filters (ignores pagination). Powers the "On watch" deck
+	 *  when the user opts out of page-scoped stats. */
+	provider_event_counts?: Record<string, number>;
+}
+
+export type ReleaseProviderKind = 'disabled' | 'gitea' | 'github';
+
+export interface ReleaseStatus {
+	provider: ReleaseProviderKind;
+	current: string;
+	latest: string | null;
+	latest_tag: string | null;
+	latest_url: string | null;
+	latest_name: string | null;
+	latest_body: string | null;
+	latest_published_at: string | null;
+	latest_prerelease: boolean;
+	checked_at: string | null;
+	update_available: boolean;
+	error: string | null;
+}
+
+export interface ReleaseTestResult {
+	ok: boolean;
+	info: {
+		tag: string;
+		version: string;
+		name: string | null;
+		url: string | null;
+		published_at: string | null;
+		prerelease: boolean;
+	} | null;
+	error: string | null;
 }

frontend/src/routes/actions/+page.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
 	import { slide } from 'svelte/transition';
-	import { api } from '$lib/api';
+	import { api , errMsg} from '$lib/api';
 	import { t } from '$lib/i18n';
 	import { actionsCache, providersCache, capabilitiesCache } from '$lib/stores/caches.svelte';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -22,6 +22,7 @@
 	import ExecutionHistory from './ExecutionHistory.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import Button from '$lib/components/Button.svelte';
+	import MetaStrip, { type MetaTile } from '$lib/components/MetaStrip.svelte';
 	import type { Action, ActionRule } from '$lib/types';
 
 	let allActions = $derived(actionsCache.items);
@@ -40,7 +41,19 @@
 		schedule_type: 'interval', schedule_interval: 3600, schedule_cron: '',
 		enabled: false,
 	});
+	let nameManuallyEdited = $state(false);
 	let error = $state('');
+
+	function actionTypeLabel(at: string): string {
+		return at.replace(/_/g, ' ').replace(/\b\w/g, c => c.toUpperCase());
+	}
+	$effect(() => {
+		if (showForm && !nameManuallyEdited && !editing) {
+			const provider = providers.find((p: any) => p.id === form.provider_id);
+			const at = actionTypeLabel(form.action_type || '');
+			form.name = provider ? `${provider.name} ${at}`.trim() : at || 'Action';
+		}
+	});
 	let loadError = $state('');
 	let submitting = $state(false);
 	let loaded = $state(false);
@@ -68,6 +81,16 @@
 	})());
 
 	onMount(load);
+
+	const headerPills = $derived.by(() => {
+		const pills: Array<{ label: string; tone: 'mint' | 'citrus' }> = [];
+		const enabled = actions.filter((a: Action) => a.enabled).length;
+		const disabled = actions.length - enabled;
+		if (enabled > 0) pills.push({ label: `${enabled} ${t('notificationTracker.armed')}`, tone: 'mint' });
+		if (disabled > 0) pills.push({ label: `${disabled} ${t('notificationTracker.paused')}`, tone: 'citrus' });
+		return pills;
+	});
+
 	async function load() {
 		try {
 			await Promise.all([
@@ -76,8 +99,8 @@
 				capabilitiesCache.fetch(),
 			]);
 			loadError = '';
-		} catch (err: any) {
-			loadError = err.message || t('actions.loadError');
+		} catch (err: unknown) {
+			loadError = errMsg(err, t('actions.loadError'));
 		} finally { loaded = true; highlightFromUrl(); }
 	}
 
@@ -88,6 +111,7 @@
 			config: {}, schedule_type: 'interval', schedule_interval: 3600, schedule_cron: '',
 			enabled: false,
 		};
+		nameManuallyEdited = false;
 		editing = null; showForm = true;
 	}
 
@@ -99,6 +123,7 @@
 			schedule_interval: action.schedule_interval,
 			schedule_cron: action.schedule_cron, enabled: action.enabled,
 		};
+		nameManuallyEdited = true;
 		editing = action.id; showForm = true;
 	}
 
@@ -113,7 +138,7 @@
 			}
 			showForm = false; editing = null; actionsCache.invalidate(); await load();
 			snackSuccess(t('actions.saved'));
-		} catch (err: any) { error = err.message; snackError(err.message); }
+		} catch (err: unknown) { const __m = errMsg(err); error = __m; snackError(__m); }
 		submitting = false;
 	}
 
@@ -126,7 +151,7 @@
 			await api(`/actions/${id}`, { method: 'DELETE' });
 			actionsCache.invalidate(); await load();
 			snackSuccess(t('actions.deleted'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
 	async function executeAction(id: number, dryRun = false) {
@@ -140,7 +165,7 @@
 				: `${t('actions.execute')}: ${affected} ${t('actions.affected')}`;
 			snackSuccess(msg);
 			actionsCache.invalidate(); await load();
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		executing = { ...executing, [id]: false };
 	}
 
@@ -169,9 +194,62 @@
 		if (status === 'failed') return 'var(--color-error-fg)';
 		return 'var(--color-muted-foreground)';
 	}
+
+	function statusTone(status: string | undefined): MetaTile['tone'] {
+		if (status === 'success') return 'mint';
+		if (status === 'partial') return 'citrus';
+		if (status === 'failed') return 'coral';
+		return 'default';
+	}
+
+	function actionTiles(action: Action): MetaTile[] {
+		const tiles: MetaTile[] = [];
+		tiles.push(action.enabled
+			? { icon: 'mdiCheckCircle', label: t('commandTracker.enabled'), tone: 'mint' }
+			: { icon: 'mdiPauseCircleOutline', label: t('commandTracker.disabled'), tone: 'default' });
+		tiles.push({
+			icon: 'mdiServer',
+			label: getProviderName(action.provider_id),
+			tone: 'lavender',
+		});
+		tiles.push({
+			icon: 'mdiTagOutline',
+			label: action.action_type,
+			tone: 'sky',
+			mono: true,
+		});
+		tiles.push({
+			icon: action.schedule_type === 'cron' ? 'mdiClockOutline' : 'mdiTimerOutline',
+			label: formatSchedule(action),
+			tone: 'orchid',
+			mono: true,
+		});
+		tiles.push({
+			icon: 'mdiFormatListBulleted',
+			value: String(action.rules?.length || 0),
+			label: t('actions.rules'),
+			tone: (action.rules?.length || 0) > 0 ? 'sky' : 'default',
+		});
+		if (action.last_run_status) {
+			tiles.push({
+				icon: 'mdiHistory',
+				label: action.last_run_status,
+				tone: statusTone(action.last_run_status),
+			});
+		}
+		return tiles;
+	}
 </script>
 
-<PageHeader title={t('actions.title')} description={t('actions.description')}>
+<PageHeader
+	title={t('actions.title')}
+	emphasis={t('actions.titleEmphasis')}
+	description={t('actions.description')}
+	crumb={t('crumbs.routingAutomation')}
+	count={actions.length}
+	countLabel={t('actions.countLabel')}
+	pills={headerPills}
+>
 	<Button size="sm" onclick={() => { showForm ? (showForm = false, editing = null) : openNew(); }}>
 		{showForm ? t('common.cancel') : t('actions.addAction')}
 	</Button>
@@ -196,14 +274,14 @@
 		{#if error}<ErrorBanner message={error} />{/if}
 		<form onsubmit={save} class="space-y-3">
 			<div>
-				<label class="block text-sm font-medium mb-1">{t('actions.provider')}</label>
+				<div class="block text-sm font-medium mb-1">{t('actions.provider')}</div>
 				<EntitySelect items={providerItems} bind:value={form.provider_id}
 					placeholder={t('actions.selectProvider')} disabled={!!editing} />
 			</div>
 
 			{#if actionTypes.length > 0}
 			<div>
-				<label class="block text-sm font-medium mb-1">{t('actions.actionType')}</label>
+				<div class="block text-sm font-medium mb-1">{t('actions.actionType')}</div>
 				{#if !editing}
 					<div class="space-y-1">
 						{#each actionTypes as at}
@@ -227,13 +305,13 @@
 				<label for="act-name" class="block text-sm font-medium mb-1">{t('actions.name')}</label>
 				<div class="flex gap-2">
 					<IconPicker value={form.icon} onselect={(v: string) => form.icon = v} />
-					<input id="act-name" bind:value={form.name} required
+					<input id="act-name" bind:value={form.name} oninput={() => nameManuallyEdited = true} required
 						class="flex-1 px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
 				</div>
 			</div>
 
 			<div>
-				<label class="block text-sm font-medium mb-1">{t('actions.schedule')}</label>
+				<div class="block text-sm font-medium mb-1">{t('actions.schedule')}</div>
 				<div class="flex gap-2 items-center mb-2">
 					<label class="flex items-center gap-1 text-sm">
 						<input type="radio" name="schedule_type" value="interval" bind:group={form.schedule_type} class="accent-[var(--color-primary)]" />
@@ -291,32 +369,35 @@
 		<EmptyState icon="mdiFilterOff" message={t('common.noFilterResults')} />
 	</Card>
 {:else if !showForm}
-	<div class="space-y-3 stagger-children">
+	<div class="list-stack stagger-children">
 		{#each actions as action}
 			<Card hover entityId={action.id}>
-				<div class="flex items-center justify-between">
-					<div class="flex items-center gap-3">
-						<div class="w-2.5 h-2.5 rounded-full flex-shrink-0"
-							style="background: {action.enabled ? '#059669' : 'var(--color-muted-foreground)'}"></div>
-						<span style="color: var(--color-primary);"><MdiIcon name={action.icon || 'mdiPlayCircleOutline'} size={20} /></span>
-						<div>
-							<div class="flex items-center gap-2">
-								<p class="font-medium">{action.name}</p>
-								<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)]">{action.action_type}</span>
-							</div>
-							<div class="flex items-center gap-3 text-xs text-[var(--color-muted-foreground)]">
-								<CrossLink href="/providers" icon={providerDefaultIcon(getProvider(action.provider_id) || {})} label={getProviderName(action.provider_id)} entityId={action.provider_id} />
-								<span>{formatSchedule(action)}</span>
-								<span>{action.rules?.length || 0} {t('actions.rules')}</span>
-								{#if action.last_run_status}
-									<span style="color: {statusColor(action.last_run_status)}">
-										{action.last_run_status}
-									</span>
-								{/if}
+				<div class="list-row">
+					<div class="list-row__identity">
+						<div class="flex items-center gap-3 min-w-0">
+							<div class="w-2.5 h-2.5 rounded-full flex-shrink-0"
+								style="background: {action.enabled ? '#059669' : 'var(--color-muted-foreground)'}"></div>
+							<span style="color: var(--color-primary);" class="shrink-0"><MdiIcon name={action.icon || 'mdiPlayCircleOutline'} size={20} /></span>
+							<div class="min-w-0">
+								<div class="flex items-center gap-2 min-w-0">
+									<p class="font-medium truncate">{action.name}</p>
+									<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)] shrink-0">{action.action_type}</span>
+								</div>
+								<div class="flex items-center gap-3 text-xs text-[var(--color-muted-foreground)] list-row__secondary">
+									<CrossLink href="/providers" icon={providerDefaultIcon(getProvider(action.provider_id) || {})} label={getProviderName(action.provider_id)} entityId={action.provider_id} />
+									<span>{formatSchedule(action)}</span>
+									<span>{action.rules?.length || 0} {t('actions.rules')}</span>
+									{#if action.last_run_status}
+										<span style="color: {statusColor(action.last_run_status)}">
+											{action.last_run_status}
+										</span>
+									{/if}
+								</div>
 							</div>
 						</div>
 					</div>
-					<div class="flex items-center gap-1">
+					<MetaStrip tiles={actionTiles(action)} />
+					<div class="list-row__actions">
 						<IconButton icon="mdiPlay" title={t('actions.execute')}
 							onclick={() => executeAction(action.id)}
 							disabled={executing[action.id]} />

frontend/src/routes/actions/RuleEditor.svelte

@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { api } from '$lib/api';
+	import { api , errMsg} from '$lib/api';
 	import { t } from '$lib/i18n';
 	import { providersCache } from '$lib/stores/caches.svelte';
 	import { snackSuccess, snackError } from '$lib/stores/snackbar.svelte';
@@ -7,6 +7,7 @@
 	import IconButton from '$lib/components/IconButton.svelte';
 	import EntitySelect from '$lib/components/EntitySelect.svelte';
 	import MultiEntitySelect from '$lib/components/MultiEntitySelect.svelte';
+	import { getDescriptor } from '$lib/providers';
 	import type { ActionRule } from '$lib/types';
 
 	let { actionId, actionType, providerId }: { actionId: number; actionType: string; providerId: number } = $props();
@@ -47,14 +48,16 @@
 		loading = true;
 		try {
 			rules = await api<ActionRule[]>(`/actions/${actionId}/rules`);
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		loading = false;
 	}
 
 	async function loadProviderData() {
 		if (actionType !== 'auto_organize') return;
 		const provider = providersCache.items.find((p: any) => p.id === providerId);
-		if (!provider || provider.type !== 'immich') return;
+		if (!provider) return;
+		const descriptor = getDescriptor(provider.type);
+		if (!descriptor?.supportsAutoOrganize) return;
 		try {
 			const [p, a] = await Promise.all([
 				api<any>(`/providers/${providerId}/people`),
@@ -79,7 +82,7 @@
 			resetNewRule();
 			await loadRules();
 			snackSuccess(t('actions.ruleSaved'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		submitting = false;
 	}
 
@@ -91,7 +94,7 @@
 			});
 			await loadRules();
 			snackSuccess(t('actions.ruleSaved'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
 	async function deleteRule(ruleId: number) {
@@ -99,7 +102,7 @@
 			await api(`/actions/${actionId}/rules/${ruleId}`, { method: 'DELETE' });
 			await loadRules();
 			snackSuccess(t('actions.ruleDeleted'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
 	async function toggleRule(rule: ActionRule) {
@@ -153,8 +156,8 @@
 	{#if showAddForm}
 		<div class="border border-[var(--color-border)] rounded-md p-3 space-y-2 bg-[var(--color-muted)]/30">
 			<div>
-				<label class="block text-xs font-medium mb-1">{t('actions.ruleName')}</label>
-				<input bind:value={newRule.name} placeholder={t('actions.ruleNamePlaceholder')}
+				<label for="rule-name-new" class="block text-xs font-medium mb-1">{t('actions.ruleName')}</label>
+				<input id="rule-name-new" bind:value={newRule.name} placeholder={t('actions.ruleNamePlaceholder')}
 					class="w-full px-2 py-1.5 border border-[var(--color-border)] rounded text-sm bg-[var(--color-background)]" />
 			</div>
 
@@ -189,8 +192,8 @@
 			{#if expandedRule === rule.id}
 				<div class="mt-2 pt-2 border-t border-[var(--color-border)] space-y-2">
 					<div>
-						<label class="block text-xs font-medium mb-1">{t('actions.ruleName')}</label>
-						<input bind:value={rule.name}
+						<label for="rule-name-{rule.id}" class="block text-xs font-medium mb-1">{t('actions.ruleName')}</label>
+						<input id="rule-name-{rule.id}" bind:value={rule.name}
 							class="w-full px-2 py-1.5 border border-[var(--color-border)] rounded text-sm bg-[var(--color-background)]" />
 					</div>
 
@@ -219,7 +222,7 @@
 		<!-- Person selector -->
 		{#if personItems.length > 0}
 		<div>
-			<label class="block text-xs font-medium mb-1">{t('actions.persons')}</label>
+			<div class="block text-xs font-medium mb-1">{t('actions.persons')}</div>
 			<MultiEntitySelect items={personItems}
 				bind:values={ruleConfig.criteria.person_ids}
 				placeholder={t('actions.addPerson')}
@@ -231,7 +234,7 @@
 
 		<!-- Person excludes -->
 		<div>
-			<label class="block text-xs font-medium mb-1">{t('actions.excludePersons')}</label>
+			<div class="block text-xs font-medium mb-1">{t('actions.excludePersons')}</div>
 			<MultiEntitySelect items={personItems}
 				bind:values={ruleConfig.criteria.exclude_person_ids}
 				placeholder={t('actions.addExcludePerson')}
@@ -244,14 +247,14 @@
 
 		<!-- Smart search query -->
 		<div>
-			<label class="block text-xs font-medium mb-1">{t('actions.searchQuery')}</label>
+			<div class="block text-xs font-medium mb-1">{t('actions.searchQuery')}</div>
 			<input bind:value={ruleConfig.criteria.query} placeholder={t('actions.searchQueryPlaceholder')}
 				class="w-full px-2 py-1.5 border border-[var(--color-border)] rounded text-sm bg-[var(--color-background)]" />
 		</div>
 
 		<!-- Asset type -->
 		<div class="flex items-center gap-3">
-			<label class="text-xs font-medium">{t('actions.assetType')}:</label>
+			<span class="text-xs font-medium">{t('actions.assetType')}:</span>
 			{#each ['all', 'image', 'video'] as at}
 				<label class="flex items-center gap-1 text-xs">
 					<input type="radio"
@@ -266,12 +269,12 @@
 		<!-- Date range -->
 		<div class="flex gap-2">
 			<div class="flex-1">
-				<label class="block text-xs font-medium mb-1">{t('actions.dateFrom')}</label>
+				<div class="block text-xs font-medium mb-1">{t('actions.dateFrom')}</div>
 				<input type="date" bind:value={ruleConfig.criteria.date_from}
 					class="w-full px-2 py-1.5 border border-[var(--color-border)] rounded text-sm bg-[var(--color-background)]" />
 			</div>
 			<div class="flex-1">
-				<label class="block text-xs font-medium mb-1">{t('actions.dateTo')}</label>
+				<div class="block text-xs font-medium mb-1">{t('actions.dateTo')}</div>
 				<input type="date" bind:value={ruleConfig.criteria.date_to}
 					class="w-full px-2 py-1.5 border border-[var(--color-border)] rounded text-sm bg-[var(--color-background)]" />
 			</div>
@@ -290,7 +293,7 @@
 
 		{#if albumItems.length > 0}
 		<div>
-			<label class="block text-xs font-medium mb-1">{t('actions.selectAlbum')}</label>
+			<div class="block text-xs font-medium mb-1">{t('actions.selectAlbum')}</div>
 			<MultiEntitySelect items={albumItems}
 				bind:values={ruleConfig.target_album_ids}
 				placeholder={t('actions.selectAlbumPlaceholder')}
@@ -301,7 +304,7 @@
 		</div>
 		{:else}
 		<div>
-			<label class="block text-xs font-medium mb-1">{t('actions.albumId')}</label>
+			<div class="block text-xs font-medium mb-1">{t('actions.albumId')}</div>
 			<input bind:value={ruleConfig.target_album_id}
 				class="w-full px-2 py-1.5 border border-[var(--color-border)] rounded text-sm bg-[var(--color-background)] font-mono" />
 		</div>
@@ -314,7 +317,7 @@
 
 		{#if ruleConfig.create_album_if_missing}
 		<div>
-			<label class="block text-xs font-medium mb-1">{t('actions.newAlbumName')}</label>
+			<div class="block text-xs font-medium mb-1">{t('actions.newAlbumName')}</div>
 			<input bind:value={ruleConfig.create_album_name}
 				class="w-full px-2 py-1.5 border border-[var(--color-border)] rounded text-sm bg-[var(--color-background)]" />
 		</div>

frontend/src/routes/bots/+page.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
 	import { page } from '$app/state';
-	import { api } from '$lib/api';
+	import { api , errMsg} from '$lib/api';
 	import { t } from '$lib/i18n';
 	import { telegramBotsCache, emailBotsCache, matrixBotsCache } from '$lib/stores/caches.svelte';
 	import Loading from '$lib/components/Loading.svelte';
@@ -29,7 +29,7 @@
 				emailBotsCache.fetch(true),
 				matrixBotsCache.fetch(true),
 			]);
-		} catch (err: any) { error = err.message || t('common.loadError'); snackError(error); }
+		} catch (err: unknown) { error = errMsg(err, t('common.loadError')); snackError(error); }
 		finally { loaded = true; highlightFromUrl(); }
 	}
 </script>

frontend/src/routes/bots/EmailBotTab.svelte

@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { api, getBlockedBy, type BlockedByDetail } from '$lib/api';
+	import { api, getBlockedBy, type BlockedByDetail , errMsg} from '$lib/api';
 	import BlockedByModal from '$lib/components/BlockedByModal.svelte';
 	import { t, getLocale } from '$lib/i18n';
 	import { emailBotsCache } from '$lib/stores/caches.svelte';
@@ -13,6 +13,7 @@
 	import { snackSuccess, snackError } from '$lib/stores/snackbar.svelte';
 	import Button from '$lib/components/Button.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import MetaStrip, { type MetaTile } from '$lib/components/MetaStrip.svelte';
 	import type { EmailBot } from '$lib/types';
 
 	let { onreload }: { onreload: () => Promise<void> } = $props();
@@ -30,8 +31,40 @@
 		smtp_username: '', smtp_password: '', smtp_use_tls: true,
 	});
 	let emailForm = $state(defaultEmailForm());
+	let nameManuallyEdited = $state(false);
 
-	function openNewEmail() { emailForm = defaultEmailForm(); editingEmail = null; showEmailForm = true; }
+	const DEFAULT_BOT_NAME = 'Email Bot';
+	$effect(() => {
+		if (showEmailForm && !nameManuallyEdited && !editingEmail) {
+			emailForm.name = DEFAULT_BOT_NAME;
+		}
+	});
+
+	function emailBotTiles(bot: EmailBot): MetaTile[] {
+		const tiles: MetaTile[] = [];
+		tiles.push({
+			icon: 'mdiEmailOutline',
+			label: bot.email,
+			tone: 'lavender',
+			mono: true,
+		});
+		tiles.push({
+			icon: 'mdiServerNetwork',
+			label: `${bot.smtp_host}:${bot.smtp_port}`,
+			tone: 'sky',
+			mono: true,
+		});
+		if (bot.smtp_use_tls) {
+			tiles.push({
+				icon: 'mdiLockOutline',
+				label: 'TLS',
+				tone: 'mint',
+			});
+		}
+		return tiles;
+	}
+
+	function openNewEmail() { emailForm = defaultEmailForm(); nameManuallyEdited = false; editingEmail = null; showEmailForm = true; }
 	function editEmailBot(bot: EmailBot) {
 		emailForm = {
 			name: bot.name, icon: bot.icon || '', email: bot.email,
@@ -39,6 +72,7 @@
 			smtp_username: bot.smtp_username, smtp_password: '',
 			smtp_use_tls: bot.smtp_use_tls,
 		};
+		nameManuallyEdited = true;
 		editingEmail = bot.id; showEmailForm = true;
 	}
 
@@ -54,8 +88,8 @@
 				await api('/email-bots', { method: 'POST', body: JSON.stringify(body) });
 				snackSuccess(t('snack.emailBotCreated'));
 			}
-			emailForm = defaultEmailForm(); showEmailForm = false; editingEmail = null; await onreload();
-		} catch (err: any) { error = err.message; snackError(err.message); }
+			emailForm = defaultEmailForm(); nameManuallyEdited = false; showEmailForm = false; editingEmail = null; await onreload();
+		} catch (err: unknown) { const __m = errMsg(err); error = __m; snackError(__m); }
 		finally { emailSubmitting = false; }
 	}
 
@@ -65,10 +99,10 @@
 			id,
 			onconfirm: async () => {
 				try { await api(`/email-bots/${id}`, { method: 'DELETE' }); await onreload(); snackSuccess(t('snack.emailBotDeleted')); }
-				catch (err: any) {
+				catch (err: unknown) {
 					const bb = getBlockedBy(err);
 					if (bb) { blockedBy = bb; return; }
-					error = err.message; snackError(err.message);
+					const m = errMsg(err); error = m; snackError(m);
 				}
 				finally { confirmDeleteEmail = null; }
 			}
@@ -81,12 +115,19 @@
 			const res = await api(`/email-bots/${botId}/test?locale=${getLocale()}`, { method: 'POST' });
 			if (res.success) snackSuccess(t('snack.emailBotTestSent'));
 			else snackError(res.error || t('emailBot.operationFailed'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		emailTesting = { ...emailTesting, [botId]: false };
 	}
 </script>
 
-<PageHeader title={t('emailBot.title')} description={t('emailBot.description')}>
+<PageHeader
+	title={t('emailBot.title')}
+	emphasis={t('emailBot.titleEmphasis')}
+	description={t('emailBot.description')}
+	crumb={t('crumbs.operatorsBots')}
+	count={emailBots.length}
+	countLabel={t('emailBot.countLabel')}
+>
 	<Button size="sm" onclick={() => { showEmailForm ? (showEmailForm = false, editingEmail = null) : openNewEmail(); }}>
 		{showEmailForm ? t('common.cancel') : t('emailBot.addBot')}
 	</Button>
@@ -100,7 +141,7 @@
 				<label for="ebot-name" class="block text-sm font-medium mb-1">{t('emailBot.name')}</label>
 				<div class="flex gap-2">
 					<IconPicker value={emailForm.icon} onselect={(v: string) => emailForm.icon = v} />
-					<input id="ebot-name" bind:value={emailForm.name} required placeholder={t('emailBot.namePlaceholder')}
+					<input id="ebot-name" bind:value={emailForm.name} oninput={() => nameManuallyEdited = true} required placeholder={t('emailBot.namePlaceholder')}
 						class="flex-1 px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
 				</div>
 			</div>
@@ -149,16 +190,16 @@
 		<EmptyState icon="mdiEmailOutline" message={t('emailBot.noBots')} />
 	</Card>
 {:else}
-	<div class="space-y-3 stagger-children">
+	<div class="list-stack stagger-children">
 		{#each emailBots as bot}
 			<Card hover entityId={bot.id}>
-				<div class="flex items-center justify-between">
-					<div>
-						<div class="flex items-center gap-2">
-							<span style="color: var(--color-primary);"><MdiIcon name={bot.icon || 'mdiEmailOutline'} size={20} /></span>
-							<p class="font-medium">{bot.name}</p>
+				<div class="list-row">
+					<div class="list-row__identity">
+						<div class="flex items-center gap-2 min-w-0">
+							<span style="color: var(--color-primary);" class="shrink-0"><MdiIcon name={bot.icon || 'mdiEmailOutline'} size={20} /></span>
+							<p class="font-medium truncate">{bot.name}</p>
 						</div>
-						<div class="flex items-center gap-2 mt-1 flex-wrap">
+						<div class="flex items-center gap-2 mt-1 flex-wrap list-row__secondary">
 							<span class="text-xs text-[var(--color-muted-foreground)] font-mono">{bot.email}</span>
 							<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)]">{bot.smtp_host}:{bot.smtp_port}</span>
 							{#if bot.smtp_use_tls}
@@ -166,7 +207,8 @@
 							{/if}
 						</div>
 					</div>
-					<div class="flex items-center gap-1">
+					<MetaStrip tiles={emailBotTiles(bot)} />
+					<div class="list-row__actions">
 						<IconButton icon="mdiSend" title={t('emailBot.testConnection')} onclick={() => testEmailBot(bot.id)} disabled={emailTesting[bot.id]} />
 						<IconButton icon="mdiPencil" title={t('common.edit')} onclick={() => editEmailBot(bot)} />
 						<IconButton icon="mdiDelete" title={t('common.delete')} onclick={() => removeEmail(bot.id)} variant="danger" />

frontend/src/routes/bots/MatrixBotTab.svelte

@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { api, getBlockedBy, type BlockedByDetail } from '$lib/api';
+	import { api, getBlockedBy, type BlockedByDetail , errMsg} from '$lib/api';
 	import BlockedByModal from '$lib/components/BlockedByModal.svelte';
 	import { t, getLocale } from '$lib/i18n';
 	import { matrixBotsCache } from '$lib/stores/caches.svelte';
@@ -13,6 +13,7 @@
 	import { snackSuccess, snackError } from '$lib/stores/snackbar.svelte';
 	import Button from '$lib/components/Button.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import MetaStrip, { type MetaTile } from '$lib/components/MetaStrip.svelte';
 	import type { MatrixBot } from '$lib/types';
 
 	let { onreload }: { onreload: () => Promise<void> } = $props();
@@ -29,14 +30,45 @@
 		name: '', icon: '', homeserver_url: '', access_token: '', display_name: '',
 	});
 	let matrixForm = $state(defaultMatrixForm());
+	let nameManuallyEdited = $state(false);
 
-	function openNewMatrix() { matrixForm = defaultMatrixForm(); editingMatrix = null; showMatrixForm = true; }
+	const DEFAULT_BOT_NAME = 'Matrix Bot';
+	$effect(() => {
+		if (showMatrixForm && !nameManuallyEdited && !editingMatrix) {
+			matrixForm.name = DEFAULT_BOT_NAME;
+		}
+	});
+
+	function matrixBotTiles(bot: MatrixBot): MetaTile[] {
+		const tiles: MetaTile[] = [];
+		let host = bot.homeserver_url;
+		try { host = new URL(bot.homeserver_url).host; } catch { /* keep raw */ }
+		tiles.push({
+			icon: 'mdiServerNetwork',
+			label: host,
+			hint: bot.homeserver_url,
+			href: bot.homeserver_url,
+			tone: 'lavender',
+			mono: true,
+		});
+		if (bot.display_name) {
+			tiles.push({
+				icon: 'mdiAccountCircleOutline',
+				label: bot.display_name,
+				tone: 'sky',
+			});
+		}
+		return tiles;
+	}
+
+	function openNewMatrix() { matrixForm = defaultMatrixForm(); nameManuallyEdited = false; editingMatrix = null; showMatrixForm = true; }
 	function editMatrixBot(bot: MatrixBot) {
 		matrixForm = {
 			name: bot.name, icon: bot.icon || '',
 			homeserver_url: bot.homeserver_url, access_token: '',
 			display_name: bot.display_name || '',
 		};
+		nameManuallyEdited = true;
 		editingMatrix = bot.id; showMatrixForm = true;
 	}
 
@@ -52,8 +84,8 @@
 				await api('/matrix-bots', { method: 'POST', body: JSON.stringify(body) });
 				snackSuccess(t('snack.matrixBotCreated'));
 			}
-			matrixForm = defaultMatrixForm(); showMatrixForm = false; editingMatrix = null; await onreload();
-		} catch (err: any) { error = err.message; snackError(err.message); }
+			matrixForm = defaultMatrixForm(); nameManuallyEdited = false; showMatrixForm = false; editingMatrix = null; await onreload();
+		} catch (err: unknown) { const __m = errMsg(err); error = __m; snackError(__m); }
 		finally { matrixSubmitting = false; }
 	}
 
@@ -63,10 +95,10 @@
 			id,
 			onconfirm: async () => {
 				try { await api(`/matrix-bots/${id}`, { method: 'DELETE' }); await onreload(); snackSuccess(t('snack.matrixBotDeleted')); }
-				catch (err: any) {
+				catch (err: unknown) {
 					const bb = getBlockedBy(err);
 					if (bb) { blockedBy = bb; return; }
-					error = err.message; snackError(err.message);
+					const m = errMsg(err); error = m; snackError(m);
 				}
 				finally { confirmDeleteMatrix = null; }
 			}
@@ -79,12 +111,19 @@
 			const res = await api(`/matrix-bots/${botId}/test?locale=${getLocale()}`, { method: 'POST' });
 			if (res.success) snackSuccess(t('snack.matrixBotTestOk'));
 			else snackError(res.error || t('matrixBot.operationFailed'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		matrixTesting = { ...matrixTesting, [botId]: false };
 	}
 </script>
 
-<PageHeader title={t('matrixBot.title')} description={t('matrixBot.description')}>
+<PageHeader
+	title={t('matrixBot.title')}
+	emphasis={t('matrixBot.titleEmphasis')}
+	description={t('matrixBot.description')}
+	crumb={t('crumbs.operatorsBots')}
+	count={matrixBots.length}
+	countLabel={t('matrixBot.countLabel')}
+>
 	<Button size="sm" onclick={() => { showMatrixForm ? (showMatrixForm = false, editingMatrix = null) : openNewMatrix(); }}>
 		{showMatrixForm ? t('common.cancel') : t('matrixBot.addBot')}
 	</Button>
@@ -98,7 +137,7 @@
 				<label for="mbot-name" class="block text-sm font-medium mb-1">{t('matrixBot.name')}</label>
 				<div class="flex gap-2">
 					<IconPicker value={matrixForm.icon} onselect={(v: string) => matrixForm.icon = v} />
-					<input id="mbot-name" bind:value={matrixForm.name} required placeholder={t('matrixBot.namePlaceholder')}
+					<input id="mbot-name" bind:value={matrixForm.name} oninput={() => nameManuallyEdited = true} required placeholder={t('matrixBot.namePlaceholder')}
 						class="flex-1 px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
 				</div>
 			</div>
@@ -132,23 +171,24 @@
 		<EmptyState icon="mdiMatrix" message={t('matrixBot.noBots')} />
 	</Card>
 {:else}
-	<div class="space-y-3 stagger-children">
+	<div class="list-stack stagger-children">
 		{#each matrixBots as bot}
 			<Card hover entityId={bot.id}>
-				<div class="flex items-center justify-between">
-					<div>
-						<div class="flex items-center gap-2">
-							<span style="color: var(--color-primary);"><MdiIcon name={bot.icon || 'mdiMatrix'} size={20} /></span>
-							<p class="font-medium">{bot.name}</p>
+				<div class="list-row">
+					<div class="list-row__identity">
+						<div class="flex items-center gap-2 min-w-0">
+							<span style="color: var(--color-primary);" class="shrink-0"><MdiIcon name={bot.icon || 'mdiMatrix'} size={20} /></span>
+							<p class="font-medium truncate">{bot.name}</p>
 						</div>
-						<div class="flex items-center gap-2 mt-1 flex-wrap">
+						<div class="flex items-center gap-2 mt-1 flex-wrap list-row__secondary">
 							<span class="text-xs text-[var(--color-muted-foreground)] font-mono">{bot.homeserver_url}</span>
 							{#if bot.display_name}
 								<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)]">{bot.display_name}</span>
 							{/if}
 						</div>
 					</div>
-					<div class="flex items-center gap-1">
+					<MetaStrip tiles={matrixBotTiles(bot)} />
+					<div class="list-row__actions">
 						<IconButton icon="mdiConnection" title={t('matrixBot.testConnection')} onclick={() => testMatrixBot(bot.id)} disabled={matrixTesting[bot.id]} />
 						<IconButton icon="mdiPencil" title={t('common.edit')} onclick={() => editMatrixBot(bot)} />
 						<IconButton icon="mdiDelete" title={t('common.delete')} onclick={() => removeMatrix(bot.id)} variant="danger" />

frontend/src/routes/bots/TelegramBotTab.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
-	import { slide } from 'svelte/transition';
-	import { api, getBlockedBy, type BlockedByDetail } from '$lib/api';
+	import { slide, fade } from 'svelte/transition';
+	import { flip } from 'svelte/animate';
+	import { api, errMsg, getBlockedBy, type BlockedByDetail } from '$lib/api';
 	import BlockedByModal from '$lib/components/BlockedByModal.svelte';
 	import { t, getLocale } from '$lib/i18n';
 	import { telegramBotsCache } from '$lib/stores/caches.svelte';
@@ -15,6 +16,7 @@
 	import { snackSuccess, snackError, snackInfo } from '$lib/stores/snackbar.svelte';
 	import Button from '$lib/components/Button.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import MetaStrip, { type MetaTile } from '$lib/components/MetaStrip.svelte';
 	import type { TelegramBot, TelegramChat } from '$lib/types';
 
 	interface CommandTrackerSummary { id: number; name: string; icon?: string; enabled: boolean }
@@ -28,13 +30,25 @@
 	let showForm = $state(false);
 	let editing = $state<number | null>(null);
 	let form = $state({ name: '', icon: '', token: '' });
+	let nameManuallyEdited = $state(false);
 	let error = $state('');
 	let submitting = $state(false);
 	let confirmDelete = $state<{ id: number; onconfirm: () => Promise<void> } | null>(null);
 
+	const DEFAULT_BOT_NAME = 'Telegram Bot';
+	$effect(() => {
+		if (showForm && !nameManuallyEdited && !editing) {
+			form.name = DEFAULT_BOT_NAME;
+		}
+	});
+
 	// Per-bot expandable sections
 	let chats = $state<Record<number, TelegramChat[]>>({});
 	let chatsLoading = $state<Record<number, boolean>>({});
+	// Distinct from chatsLoading: refresh keeps the existing list visible
+	// instead of swapping it for a placeholder, avoiding the disorienting
+	// "everything disappears" flash during Discover.
+	let chatsRefreshing = $state<Record<number, boolean>>({});
 	let expandedSection = $state<Record<number, string>>({});
 
 	// Webhook status per bot
@@ -47,8 +61,38 @@
 	let botListenerStatus = $state<Record<number, CommandTrackerSummary[]>>({});
 	let botListenerLoading = $state<Record<number, boolean>>({});
 
-	function openNew() { form = { name: '', icon: '', token: '' }; editing = null; showForm = true; }
-	function editBot(bot: TelegramBot) { form = { name: bot.name, icon: bot.icon || '', token: '' }; editing = bot.id; showForm = true; }
+	function telegramBotTiles(bot: TelegramBot): MetaTile[] {
+		const tiles: MetaTile[] = [];
+		const mode = bot.update_mode || 'none';
+		const modeTone: MetaTile['tone'] = mode === 'webhook' ? 'lavender' : mode === 'polling' ? 'mint' : 'default';
+		const modeLabel = mode === 'webhook' ? t('telegramBot.webhook') : mode === 'polling' ? t('telegramBot.polling') : t('telegramBot.none');
+		tiles.push({
+			icon: mode === 'webhook' ? 'mdiWebhook' : mode === 'polling' ? 'mdiSync' : 'mdiPowerOff',
+			label: modeLabel,
+			tone: modeTone,
+		});
+		if (bot.bot_username) {
+			tiles.push({
+				icon: 'mdiAt',
+				label: bot.bot_username,
+				tone: 'sky',
+				mono: true,
+			});
+		}
+		const chatCount = chats[bot.id]?.length;
+		if (chatCount !== undefined) {
+			tiles.push({
+				icon: 'mdiChat',
+				value: String(chatCount),
+				label: t('telegramBot.chats'),
+				tone: chatCount > 0 ? 'orchid' : 'default',
+			});
+		}
+		return tiles;
+	}
+
+	function openNew() { form = { name: '', icon: '', token: '' }; nameManuallyEdited = false; editing = null; showForm = true; }
+	function editBot(bot: TelegramBot) { form = { name: bot.name, icon: bot.icon || '', token: '' }; nameManuallyEdited = true; editing = bot.id; showForm = true; }
 
 	async function saveBot(e: SubmitEvent) {
 		e.preventDefault(); error = ''; submitting = true;
@@ -60,8 +104,8 @@
 				await api('/telegram-bots', { method: 'POST', body: JSON.stringify(form) });
 				snackSuccess(t('snack.botRegistered'));
 			}
-			form = { name: '', icon: '', token: '' }; showForm = false; editing = null; await onreload();
-		} catch (err: any) { error = err.message; snackError(err.message); }
+			form = { name: '', icon: '', token: '' }; nameManuallyEdited = false; showForm = false; editing = null; await onreload();
+		} catch (err: unknown) { const m = errMsg(err); error = m; snackError(m); }
 		finally { submitting = false; }
 	}
 
@@ -71,10 +115,10 @@
 			id,
 			onconfirm: async () => {
 				try { await api(`/telegram-bots/${id}`, { method: 'DELETE' }); await onreload(); snackSuccess(t('snack.botDeleted')); }
-				catch (err: any) {
+				catch (err: unknown) {
 					const bb = getBlockedBy(err);
 					if (bb) { blockedBy = bb; return; }
-					error = err.message; snackError(err.message);
+					const m = errMsg(err); error = m; snackError(m);
 				}
 				finally { confirmDelete = null; }
 			}
@@ -98,12 +142,13 @@
 	}
 
 	async function discoverChats(botId: number) {
-		chatsLoading = { ...chatsLoading, [botId]: true };
+		if (chatsRefreshing[botId]) return;
+		chatsRefreshing = { ...chatsRefreshing, [botId]: true };
 		try {
 			chats = { ...chats, [botId]: await api<TelegramChat[]>(`/telegram-bots/${botId}/chats/discover`, { method: 'POST' }) };
 			snackSuccess(t('telegramBot.chatsDiscovered'));
-		} catch (err: any) { snackError(err.message); }
-		chatsLoading = { ...chatsLoading, [botId]: false };
+		} catch (err: unknown) { snackError(errMsg(err)); }
+		chatsRefreshing = { ...chatsRefreshing, [botId]: false };
 	}
 
 	async function deleteChat(botId: number, chatDbId: number) {
@@ -111,11 +156,15 @@
 			await api(`/telegram-bots/${botId}/chats/${chatDbId}`, { method: 'DELETE' });
 			chats[botId] = (chats[botId] || []).filter((c) => c.id !== chatDbId);
 			snackSuccess(t('telegramBot.chatDeleted'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
-	const LANG_ITEMS = [
-		{ value: '', label: '—', icon: 'mdiTranslate', desc: 'Auto' },
+	// `desc` is the only locale-sensitive field — language *names* are intentionally
+	// shown in their own language (English under EN, Русский under RU, …) so users
+	// recognise them regardless of the current UI locale. Only the "Auto" sentinel
+	// for the no-override row is translated.
+	let LANG_ITEMS = $derived([
+		{ value: '', label: '—', icon: 'mdiTranslate', desc: t('common.auto') },
 		{ value: 'en', label: 'EN', icon: 'mdiAlphaECircle', desc: 'English' },
 		{ value: 'ru', label: 'RU', icon: 'mdiAlphaRCircle', desc: 'Русский' },
 		{ value: 'uk', label: 'UK', icon: 'mdiAlphaUCircle', desc: 'Українська' },
@@ -132,7 +181,7 @@
 		{ value: 'tr', label: 'TR', icon: 'mdiAlphaTCircle', desc: 'Türkçe' },
 		{ value: 'ar', label: 'AR', icon: 'mdiAlphaACircle', desc: 'العربية' },
 		{ value: 'hi', label: 'HI', icon: 'mdiAlphaHCircle', desc: 'हिन्दी' },
-	];
+	]);
 
 	async function updateChatLanguage(botId: number, chat: TelegramChat, lang: string) {
 		try {
@@ -144,7 +193,7 @@
 				c.id === chat.id ? { ...c, language_override: lang } : c
 			);
 			snackSuccess(t('telegramBot.languageUpdated'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
 	async function toggleChatCommands(botId: number, chat: TelegramChat) {
@@ -157,7 +206,7 @@
 			chats[botId] = (chats[botId] || []).map(c =>
 				c.id === chat.id ? { ...c, commands_enabled: newVal } : c
 			);
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
 	async function loadListenerStatus(botId: number) {
@@ -187,7 +236,7 @@
 					t.id === trk.id ? { ...t, enabled: !t.enabled } : t
 				),
 			};
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
 	async function syncCommands(botId: number) {
@@ -196,7 +245,7 @@
 			const res = await api<ApiResult>(`/telegram-bots/${botId}/sync-commands`, { method: 'POST' });
 			if (res.success) snackSuccess(t('telegramBot.commandsSynced'));
 			else snackError(res.error || t('telegramBot.saveFailed'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		modeChanging = { ...modeChanging, [botId]: false };
 	}
 
@@ -209,7 +258,7 @@
 				await loadWebhookStatus(botId);
 			}
 			snackSuccess(t('snack.botUpdated'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		modeChanging = { ...modeChanging, [botId]: false };
 	}
 
@@ -229,7 +278,7 @@
 			} else {
 				snackError(res.error || t('telegramBot.webhookFailed'));
 			}
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		modeChanging = { ...modeChanging, [botId]: false };
 	}
 
@@ -239,7 +288,7 @@
 			const res = await api<ApiResult>(`/telegram-bots/${botId}/webhook/unregister`, { method: 'POST' });
 			if (res.success) { snackSuccess(t('telegramBot.webhookUnregistered')); await loadWebhookStatus(botId); }
 			else snackError(res.error || t('telegramBot.saveFailed'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		modeChanging = { ...modeChanging, [botId]: false };
 	}
 
@@ -270,7 +319,7 @@
 			const res = await api<ApiResult>(`/telegram-bots/${botId}/chats/${chatId}/test?locale=${getLocale()}`, { method: 'POST' });
 			if (res.success) snackSuccess(t('snack.targetTestSent'));
 			else snackError(res.error || t('telegramBot.saveFailed'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		chatTesting = { ...chatTesting, [key]: false };
 	}
 
@@ -285,7 +334,14 @@
 	}
 </script>
 
-<PageHeader title={t('telegramBot.title')} description={t('telegramBot.description')}>
+<PageHeader
+	title={t('telegramBot.title')}
+	emphasis={t('telegramBot.titleEmphasis')}
+	description={t('telegramBot.description')}
+	crumb={t('crumbs.operatorsBots')}
+	count={bots.length}
+	countLabel={t('telegramBot.countLabel')}
+>
 	<Button size="sm" onclick={() => { showForm ? (showForm = false, editing = null) : openNew(); }}>
 		{showForm ? t('common.cancel') : t('telegramBot.addBot')}
 	</Button>
@@ -299,7 +355,7 @@
 				<label for="bot-name" class="block text-sm font-medium mb-1">{t('telegramBot.name')}</label>
 				<div class="flex gap-2">
 					<IconPicker value={form.icon} onselect={(v: string) => form.icon = v} />
-					<input id="bot-name" bind:value={form.name} required placeholder={t('telegramBot.namePlaceholder')}
+					<input id="bot-name" bind:value={form.name} oninput={() => nameManuallyEdited = true} required placeholder={t('telegramBot.namePlaceholder')}
 						class="flex-1 px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
 				</div>
 			</div>
@@ -322,27 +378,31 @@
 		<EmptyState icon="mdiRobot" message={t('telegramBot.noBots')} />
 	</Card>
 {:else}
-	<div class="space-y-3 stagger-children">
+	<div class="list-stack stagger-children">
 		{#each bots as bot}
 			<Card hover entityId={bot.id}>
-				<div class="flex items-center justify-between gap-2 flex-wrap">
-					<div class="min-w-0">
-						<div class="flex items-center gap-2 flex-wrap">
-							<span style="color: var(--color-primary);"><MdiIcon name={bot.icon || 'mdiRobot'} size={20} /></span>
-							<p class="font-medium">{bot.name}</p>
+				<div class="list-row">
+					<div class="list-row__identity">
+						<div class="flex items-center gap-2 flex-wrap min-w-0">
+							<span style="color: var(--color-primary);" class="shrink-0"><MdiIcon name={bot.icon || 'mdiRobot'} size={20} /></span>
+							<p class="font-medium truncate">{bot.name}</p>
 							{#if bot.bot_username}
-								<span class="text-xs text-[var(--color-muted-foreground)]">@{bot.bot_username}</span>
+								<span class="text-xs text-[var(--color-muted-foreground)] shrink-0">@{bot.bot_username}</span>
 							{/if}
-							<!-- Mode badge -->
-							<span class="text-xs px-1.5 py-0.5 rounded font-mono {bot.update_mode === 'webhook'
-								? 'bg-[var(--color-primary)]/10 text-[var(--color-primary)]'
-								: 'bg-[var(--color-success-bg)] text-[var(--color-success-fg)]'}">
-								{bot.update_mode === 'webhook' ? t('telegramBot.webhook') : t('telegramBot.polling')}
-							</span>
 						</div>
-						<p class="text-xs text-[var(--color-muted-foreground)] font-mono">{bot.token_preview}</p>
+						<div class="list-row__secondary mt-0.5 flex items-center gap-2 flex-wrap">
+							<span class="text-xs px-1.5 py-0.5 rounded font-mono {(bot.update_mode || 'none') === 'webhook'
+								? 'bg-[var(--color-primary)]/10 text-[var(--color-primary)]'
+								: (bot.update_mode || 'none') === 'polling'
+									? 'bg-[var(--color-success-bg)] text-[var(--color-success-fg)]'
+									: 'bg-[var(--color-muted)] text-[var(--color-muted-foreground)]'}">
+								{(bot.update_mode || 'none') === 'webhook' ? t('telegramBot.webhook') : (bot.update_mode || 'none') === 'polling' ? t('telegramBot.polling') : t('telegramBot.none')}
+							</span>
+							<p class="text-xs text-[var(--color-muted-foreground)] font-mono">{bot.token_preview}</p>
+						</div>
 					</div>
-					<div class="flex items-center gap-1 flex-shrink-0 flex-wrap">
+					<MetaStrip tiles={telegramBotTiles(bot)} />
+					<div class="list-row__actions flex-wrap justify-end">
 						<IconButton icon="mdiPencil" title={t('common.edit')} onclick={() => editBot(bot)} />
 						<button onclick={() => toggleSection(bot.id, 'chats')}
 							disabled={chatsLoading[bot.id]}
@@ -362,66 +422,84 @@
 				<!-- Chats section -->
 				{#if expandedSection[bot.id] === 'chats'}
 					<div class="mt-3 border-t border-[var(--color-border)] pt-3" in:slide>
-						{#if chatsLoading[bot.id]}
+						{#if chatsLoading[bot.id] && !chats[bot.id]}
 							<p class="text-xs text-[var(--color-muted-foreground)]">{t('common.loading')}</p>
-						{:else if (chats[bot.id] || []).length === 0}
+						{:else if (chats[bot.id] || []).length === 0 && !chatsRefreshing[bot.id]}
 							<p class="text-xs text-[var(--color-muted-foreground)]">{t('telegramBot.noChats')}</p>
 						{:else}
 							{@const gridStyle = "display:grid; grid-template-columns:1fr 80px 40px 100px 50px 130px 60px; align-items:center; gap:0.5rem;"}
-							<!-- Header -->
-							<div style="{gridStyle} padding:0.25rem 0.5rem; border-bottom:1px solid var(--color-border);"
-								class="text-[0.65rem] font-semibold uppercase tracking-wide text-[var(--color-muted-foreground)]">
-								<span>{t('telegramBot.chatName')}</span>
-								<span style="text-align:center">{t('telegramBot.chatType')}</span>
-								<span style="text-align:center">{t('telegramBot.chatLang')}</span>
-								<span style="text-align:center">{t('telegramBot.langOverride')}</span>
-								<span style="text-align:center">{t('telegramBot.cmds')}</span>
-								<span style="text-align:center">{t('telegramBot.chatId')}</span>
-								<span></span>
-							</div>
-							<!-- Rows -->
-							{#each chats[bot.id] as chat}
-								<div style={gridStyle}
-									class="text-sm px-2 py-1.5 rounded hover:bg-[var(--color-muted)] cursor-pointer"
-									onclick={(e: MouseEvent) => copyChatId(e, chat.chat_id)}
-									onkeydown={(e: KeyboardEvent) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); copyChatId(e as unknown as MouseEvent, chat.chat_id); } }}
-									title={t('telegramBot.clickToCopy')}
-									aria-label={t('telegramBot.clickToCopy')}
-									role="button" tabindex="0">
-									<span class="font-medium truncate">{chat.title || chat.username || t('common.unknown')}</span>
-									<span style="text-align:center" class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)]">{chatTypeLabel(chat.type)}</span>
-									<span style="text-align:center" class="text-xs text-[var(--color-muted-foreground)]">{(chat.language_code || '—').toUpperCase()}</span>
-									<div style="justify-self:center" role="presentation" onclick={(e: MouseEvent) => e.stopPropagation()} onkeydown={(e: KeyboardEvent) => e.stopPropagation()}>
-										<EntitySelect
-											items={LANG_ITEMS}
-											value={chat.language_override || ''}
-											size="sm"
-											onselect={(val) => updateChatLanguage(bot.id, chat, String(val ?? ''))}
-										/>
-									</div>
-									<div style="justify-self:center" role="presentation" onclick={(e: MouseEvent) => e.stopPropagation()} onkeydown={(e: KeyboardEvent) => e.stopPropagation()}>
-										<button
-											style="width:28px; height:16px; border-radius:8px; position:relative; transition:background-color 0.2s; background-color:{chat.commands_enabled ? 'var(--color-primary)' : 'var(--color-border)'};"
-											title={t('telegramBot.commandsToggle')}
-											onclick={() => toggleChatCommands(bot.id, chat)}>
-											<span style="position:absolute; top:2px; width:12px; height:12px; border-radius:50%; transition:left 0.2s; left:{chat.commands_enabled ? '14px' : '2px'}; background:{chat.commands_enabled ? 'white' : 'var(--color-muted-foreground)'};" ></span>
-										</button>
-									</div>
-									<span style="text-align:center" class="text-xs text-[var(--color-muted-foreground)] font-mono">{chat.chat_id}</span>
-									<div style="justify-self:end" class="flex items-center gap-1">
-										<IconButton icon="mdiSend" title={t('common.test')} size={14}
-											onclick={(e: MouseEvent) => testChat(e, bot.id, chat.chat_id)}
-											disabled={chatTesting[`${bot.id}_${chat.chat_id}`]} />
-										<IconButton icon="mdiDelete" title={t('common.delete')} size={14}
-											onclick={(e: MouseEvent) => { e.stopPropagation(); deleteChat(bot.id, chat.id); }} variant="danger" />
-									</div>
+							<div class="chat-list-wrap" class:is-refreshing={chatsRefreshing[bot.id]}>
+								{#if chatsRefreshing[bot.id]}
+									<div class="chat-shimmer" aria-hidden="true" transition:fade={{ duration: 180 }}></div>
+								{/if}
+								<!-- Header -->
+								<div style="{gridStyle} padding:0.25rem 0.5rem; border-bottom:1px solid var(--color-border);"
+									class="text-[0.65rem] font-semibold uppercase tracking-wide text-[var(--color-muted-foreground)]">
+									<span>{t('telegramBot.chatName')}</span>
+									<span style="text-align:center">{t('telegramBot.chatType')}</span>
+									<span style="text-align:center">{t('telegramBot.chatLang')}</span>
+									<span style="text-align:center">{t('telegramBot.langOverride')}</span>
+									<span style="text-align:center">{t('telegramBot.cmds')}</span>
+									<span style="text-align:center">{t('telegramBot.chatId')}</span>
+									<span></span>
 								</div>
-							{/each}
+								<!-- Rows -->
+								{#each (chats[bot.id] || []) as chat (chat.id)}
+									<div style={gridStyle}
+										class="chat-row text-sm px-2 py-1.5 rounded hover:bg-[var(--color-muted)] cursor-pointer"
+										animate:flip={{ duration: 280 }}
+										in:fade={{ duration: 220, delay: 60 }}
+										out:fade={{ duration: 140 }}
+										onclick={(e: MouseEvent) => copyChatId(e, chat.chat_id)}
+										onkeydown={(e: KeyboardEvent) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); copyChatId(e as unknown as MouseEvent, chat.chat_id); } }}
+										title={t('telegramBot.clickToCopy')}
+										aria-label={t('telegramBot.clickToCopy')}
+										role="button" tabindex="0">
+										<span class="font-medium truncate">{chat.title || chat.username || t('common.unknown')}</span>
+										<span style="text-align:center" class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)]">{chatTypeLabel(chat.type)}</span>
+										<span style="text-align:center" class="text-xs text-[var(--color-muted-foreground)]">{(chat.language_code || '—').toUpperCase()}</span>
+										<div style="justify-self:center" role="presentation" onclick={(e: MouseEvent) => e.stopPropagation()} onkeydown={(e: KeyboardEvent) => e.stopPropagation()}>
+											<EntitySelect
+												items={LANG_ITEMS}
+												value={chat.language_override || ''}
+												size="sm"
+												onselect={(val) => updateChatLanguage(bot.id, chat, String(val ?? ''))}
+											/>
+										</div>
+										<div style="justify-self:center" role="presentation" onclick={(e: MouseEvent) => e.stopPropagation()} onkeydown={(e: KeyboardEvent) => e.stopPropagation()}>
+											<button
+												type="button"
+												role="switch"
+												aria-checked={chat.commands_enabled}
+												aria-label={t('telegramBot.commandsToggle')}
+												style="width:28px; height:16px; border-radius:8px; position:relative; transition:background-color 0.2s; background-color:{chat.commands_enabled ? 'var(--color-primary)' : 'var(--color-border)'};"
+												title={t('telegramBot.commandsToggle')}
+												onclick={() => toggleChatCommands(bot.id, chat)}>
+												<span style="position:absolute; top:2px; width:12px; height:12px; border-radius:50%; transition:left 0.2s; left:{chat.commands_enabled ? '14px' : '2px'}; background:{chat.commands_enabled ? 'white' : 'var(--color-muted-foreground)'};" ></span>
+											</button>
+										</div>
+										<span style="text-align:center" class="text-xs text-[var(--color-muted-foreground)] font-mono">{chat.chat_id}</span>
+										<div style="justify-self:end" class="flex items-center gap-1">
+											<IconButton icon="mdiSend" title={t('common.test')} size={14}
+												onclick={(e: MouseEvent) => testChat(e, bot.id, chat.chat_id)}
+												disabled={chatTesting[`${bot.id}_${chat.chat_id}`]} />
+											<IconButton icon="mdiDelete" title={t('common.delete')} size={14}
+												onclick={(e: MouseEvent) => { e.stopPropagation(); deleteChat(bot.id, chat.id); }} variant="danger" />
+										</div>
+									</div>
+								{/each}
+								{#if chatsRefreshing[bot.id] && (chats[bot.id] || []).length === 0}
+									<p class="text-xs text-[var(--color-muted-foreground)] py-2 px-2">{t('telegramBot.discoveringChats')}</p>
+								{/if}
+							</div>
 						{/if}
 						<button onclick={() => discoverChats(bot.id)}
-							class="text-xs text-[var(--color-primary)] hover:underline mt-2 flex items-center gap-1">
-							<MdiIcon name="mdiSync" size={14} />
-							{t('telegramBot.discoverChats')}
+							disabled={chatsRefreshing[bot.id]}
+							class="discover-btn text-xs text-[var(--color-primary)] hover:underline mt-2 flex items-center gap-1 disabled:opacity-70 disabled:cursor-default disabled:no-underline">
+							<span class="discover-icon" class:is-spinning={chatsRefreshing[bot.id]}>
+								<MdiIcon name="mdiSync" size={14} />
+							</span>
+							{chatsRefreshing[bot.id] ? t('telegramBot.discoveringChats') : t('telegramBot.discoverChats')}
 						</button>
 					</div>
 				{/if}
@@ -441,6 +519,10 @@
 											<a href="/command-trackers" class="font-medium text-[var(--color-primary)] hover:underline">{trk.name}</a>
 										</div>
 										<button
+											type="button"
+											role="switch"
+											aria-checked={trk.enabled}
+											aria-label={trk.enabled ? t('notificationTracker.pause') : t('notificationTracker.resume')}
 											style="width:28px; height:16px; border-radius:8px; position:relative; transition:background-color 0.2s; background-color:{trk.enabled ? 'var(--color-primary)' : 'var(--color-border)'};"
 											title={trk.enabled ? t('notificationTracker.pause') : t('notificationTracker.resume')}
 											onclick={() => toggleListenerEnabled(bot.id, trk)}>
@@ -456,6 +538,14 @@
 							<p class="text-xs font-medium mb-2">{t('telegramBot.updateMode')}</p>
 							<div class="flex items-center gap-3 flex-wrap">
 								<div class="flex items-center rounded-md border border-[var(--color-border)] overflow-hidden">
+									<button onclick={() => switchMode(bot.id, 'none')}
+										disabled={modeChanging[bot.id] || (bot.update_mode || 'none') === 'none'}
+										class="px-3 py-1 text-xs transition-colors {(bot.update_mode || 'none') === 'none'
+											? 'bg-[var(--color-primary)] text-[var(--color-primary-foreground)]'
+											: 'hover:bg-[var(--color-muted)]'} disabled:opacity-70">
+										<MdiIcon name="mdiBellOff" size={14} />
+										{t('telegramBot.none')}
+									</button>
 									<button onclick={() => switchMode(bot.id, 'polling')}
 										disabled={modeChanging[bot.id] || bot.update_mode === 'polling'}
 										class="px-3 py-1 text-xs transition-colors {bot.update_mode === 'polling'
@@ -474,6 +564,13 @@
 									</button>
 								</div>
 
+								{#if (bot.update_mode || 'none') === 'none'}
+									<span class="text-xs text-[var(--color-muted-foreground)] flex items-center gap-1">
+										<MdiIcon name="mdiBellOff" size={14} />
+										{t('telegramBot.noneActive')}
+									</span>
+								{/if}
+
 								{#if bot.update_mode === 'polling'}
 									<span class="text-xs text-[var(--color-success-fg)] flex items-center gap-1">
 										<MdiIcon name="mdiCheckCircle" size={14} />
@@ -529,3 +626,72 @@
 
 <BlockedByModal open={!!blockedBy} detail={blockedBy} onclose={() => blockedBy = null} />
 
+<style>
+	/* Chat list — smooth refresh state.
+	   The list stays mounted during Discover; we only dim it slightly
+	   and run a thin shimmer bar across the top so the user sees
+	   "refreshing" instead of "everything vanished and came back". */
+	.chat-list-wrap {
+		position: relative;
+		transition: opacity 0.25s ease, filter 0.25s ease;
+	}
+	.chat-list-wrap.is-refreshing {
+		opacity: 0.78;
+		filter: saturate(0.9);
+	}
+	.chat-list-wrap.is-refreshing .chat-row {
+		pointer-events: none;
+	}
+	.chat-shimmer {
+		position: absolute;
+		top: 0;
+		left: 0;
+		right: 0;
+		height: 2px;
+		overflow: hidden;
+		border-radius: 2px;
+		background: color-mix(in srgb, var(--color-primary) 12%, transparent);
+		z-index: 2;
+	}
+	.chat-shimmer::after {
+		content: '';
+		position: absolute;
+		inset: 0;
+		background: linear-gradient(
+			90deg,
+			transparent 0%,
+			color-mix(in srgb, var(--color-primary) 70%, transparent) 50%,
+			transparent 100%
+		);
+		transform: translateX(-100%);
+		animation: chat-shimmer-sweep 1.15s ease-in-out infinite;
+	}
+	@keyframes chat-shimmer-sweep {
+		0%   { transform: translateX(-100%); }
+		100% { transform: translateX(100%); }
+	}
+
+	.discover-icon {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		transition: transform 0.2s ease;
+	}
+	.discover-icon.is-spinning {
+		animation: discover-spin 1s linear infinite;
+	}
+	@keyframes discover-spin {
+		to { transform: rotate(-360deg); }
+	}
+
+	@media (prefers-reduced-motion: reduce) {
+		.chat-shimmer::after,
+		.discover-icon.is-spinning {
+			animation: none;
+		}
+		.chat-list-wrap {
+			transition: none;
+		}
+	}
+</style>
+

frontend/src/routes/command-configs/+page.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { api, getBlockedBy, type BlockedByDetail } from '$lib/api';
+	import { api, getBlockedBy, type BlockedByDetail , errMsg} from '$lib/api';
 	import BlockedByModal from '$lib/components/BlockedByModal.svelte';
 	import { t } from '$lib/i18n';
 	import { commandConfigsCache, commandTemplateConfigsCache, capabilitiesCache } from '$lib/stores/caches.svelte';
@@ -21,6 +21,8 @@
 	import { highlightFromUrl } from '$lib/highlight';
 	import { globalProviderFilter } from '$lib/stores/provider-filter.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import { getDescriptor } from '$lib/providers';
+	import MetaStrip, { type MetaTile } from '$lib/components/MetaStrip.svelte';
 	import type { CommandConfig } from '$lib/types';
 
 	function templateName(id: number | null): string {
@@ -69,6 +71,14 @@
 		command_template_config_id: null as number | null,
 	});
 	let form = $state(defaultForm());
+	let nameManuallyEdited = $state(false);
+
+	$effect(() => {
+		if (showForm && !nameManuallyEdited && !editing) {
+			const desc = getDescriptor(form.provider_type);
+			form.name = desc ? `${desc.defaultName} Commands` : 'Commands';
+		}
+	});
 
 	let allCapabilities = $derived(capabilitiesCache.items);
 	let providerCommands = $derived<{key: string, icon: string}[]>(
@@ -80,6 +90,14 @@
 	let hasCommands = $derived(providerCommands.length > 0);
 
 	onMount(load);
+
+	const headerPills = $derived.by(() => {
+		const pills: Array<{ label: string; tone: 'sky' }> = [];
+		const types = new Set(configs.map(c => c.provider_type)).size;
+		if (types > 0) pills.push({ label: `${types} ${types === 1 ? t('providers.typeSingular') : t('providers.typePlural')}`, tone: 'sky' });
+		return pills;
+	});
+
 	async function load() {
 		try {
 			await Promise.all([
@@ -87,10 +105,46 @@
 				commandTemplateConfigsCache.fetch(),
 				capabilitiesCache.fetch(),
 			]);
-		} catch (err: any) { error = err.message || t('common.loadError'); snackError(error); }
+		} catch (err: unknown) { error = errMsg(err, t('common.loadError')); snackError(error); }
 		finally { loaded = true; highlightFromUrl(); }
 	}
 
+	function commandConfigTiles(cfg: CommandConfig): MetaTile[] {
+		const tiles: MetaTile[] = [];
+		tiles.push({
+			icon: 'mdiServer',
+			label: cfg.provider_type,
+			tone: 'lavender',
+			mono: true,
+		});
+		const cmdCount = (cfg.enabled_commands || []).length;
+		tiles.push({
+			icon: 'mdiSlashForward',
+			value: String(cmdCount),
+			label: t('commandConfig.commands'),
+			tone: cmdCount > 0 ? 'mint' : 'coral',
+		});
+		tiles.push({
+			icon: cfg.response_mode === 'media' ? 'mdiImageOutline' : 'mdiTextBoxOutline',
+			label: cfg.response_mode === 'media' ? t('commandConfig.modeMedia') : t('commandConfig.modeText'),
+			tone: 'sky',
+		});
+		tiles.push({
+			icon: 'mdiNumeric',
+			value: String(cfg.default_count),
+			label: t('commandConfig.defaultCount'),
+			tone: 'citrus',
+		});
+		if (cfg.command_template_config_id) {
+			tiles.push({
+				icon: 'mdiCodeBracesBox',
+				label: templateName(cfg.command_template_config_id),
+				tone: 'orchid',
+			});
+		}
+		return tiles;
+	}
+
 	function openNew() {
 		form = defaultForm();
 		// Auto-select first provider type with commands
@@ -99,9 +153,31 @@
 		// Auto-select first matching template for the chosen provider_type
 		const match = cmdTemplateConfigs.find((c) => c.provider_type === form.provider_type);
 		if (match) form.command_template_config_id = match.id;
+		nameManuallyEdited = false;
 		editing = null;
 		showForm = true;
 	}
+
+	// Re-pick the command-template config when the provider type changes.
+	// The previously-selected id may belong to a different provider type and
+	// would no longer appear in the filtered EntitySelect, leaving it empty.
+	let _prevProviderType = $state('');
+	$effect(() => {
+		if (showForm && form.provider_type && form.provider_type !== _prevProviderType) {
+			_prevProviderType = form.provider_type;
+			if (editing === null) {
+				const currentTpl = cmdTemplateConfigs.find(
+					(c) => c.id === form.command_template_config_id,
+				);
+				if (!currentTpl || currentTpl.provider_type !== form.provider_type) {
+					const first = cmdTemplateConfigs.find(
+						(c) => c.provider_type === form.provider_type,
+					);
+					form.command_template_config_id = first?.id ?? null;
+				}
+			}
+		}
+	});
 	function editConfig(cfg: CommandConfig) {
 		form = {
 			name: cfg.name,
@@ -113,6 +189,7 @@
 			rate_limits: { search: cfg.rate_limits?.search ?? 30, default: cfg.rate_limits?.default ?? 10 },
 			command_template_config_id: cfg.command_template_config_id ?? null,
 		};
+		nameManuallyEdited = true;
 		editing = cfg.id;
 		showForm = true;
 	}
@@ -136,8 +213,8 @@
 				await api('/command-configs', { method: 'POST', body });
 				snackSuccess(t('snack.commandConfigSaved'));
 			}
-			form = defaultForm(); showForm = false; editing = null; await load();
-		} catch (err: any) { error = err.message; snackError(err.message); }
+			form = defaultForm(); nameManuallyEdited = false; showForm = false; editing = null; await load();
+		} catch (err: unknown) { const __m = errMsg(err); error = __m; snackError(__m); }
 		finally { submitting = false; }
 	}
 
@@ -150,10 +227,10 @@
 					await api(`/command-configs/${cfg.id}`, { method: 'DELETE' });
 					await load();
 					snackSuccess(t('snack.commandConfigDeleted'));
-				} catch (err: any) {
+				} catch (err: unknown) {
 					const bb = getBlockedBy(err);
 					if (bb) { blockedBy = bb; return; }
-					snackError(err.message);
+					snackError(errMsg(err));
 				}
 				finally { confirmDelete = null; }
 			}
@@ -161,7 +238,15 @@
 	}
 </script>
 
-<PageHeader title={t('commandConfig.title')} description={t('commandConfig.description')}>
+<PageHeader
+	title={t('commandConfig.title')}
+	emphasis={t('commandConfig.titleEmphasis')}
+	description={t('commandConfig.description')}
+	crumb={t('crumbs.routingCommands')}
+	count={configs.length}
+	countLabel={t('commandConfig.countLabel')}
+	pills={headerPills}
+>
 	<Button size="sm" onclick={() => { showForm ? (showForm = false, editing = null) : openNew(); }}>
 		{showForm ? t('common.cancel') : t('commandConfig.newConfig')}
 	</Button>
@@ -177,13 +262,13 @@
 				<label for="cfg-name" class="block text-sm font-medium mb-1">{t('commandConfig.name')}</label>
 				<div class="flex gap-2">
 					<IconPicker value={form.icon} onselect={(v: string) => form.icon = v} />
-					<input id="cfg-name" bind:value={form.name} required placeholder={t('commandConfig.namePlaceholder')}
+					<input id="cfg-name" bind:value={form.name} oninput={() => nameManuallyEdited = true} required placeholder={t('commandConfig.namePlaceholder')}
 						class="flex-1 px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
 				</div>
 			</div>
 
 			<div>
-				<label class="block text-sm font-medium mb-1">{t('commandConfig.providerType')}</label>
+				<div class="block text-sm font-medium mb-1">{t('commandConfig.providerType')}</div>
 				{#if !editing}
 					<IconGridSelect items={providerTypeItems()} bind:value={form.provider_type} columns={2} />
 				{:else}
@@ -208,30 +293,30 @@
 			</div>
 
 			<div>
-				<label class="block text-sm font-medium mb-1">{t('commandConfig.responseTemplate')}</label>
+				<div class="block text-sm font-medium mb-1">{t('commandConfig.responseTemplate')}</div>
 				<EntitySelect items={templateItems} bind:value={form.command_template_config_id} placeholder={t('commandConfig.responseTemplate')} />
 			</div>
 
 			<div class="grid grid-cols-2 sm:grid-cols-3 gap-3">
 				<div>
-					<label class="block text-xs mb-1">{t('commandConfig.responseMode')}</label>
+					<div class="block text-xs mb-1">{t('commandConfig.responseMode')}</div>
 					<IconGridSelect items={responseModeItems(t)} bind:value={form.response_mode} columns={2} compact />
 				</div>
 				<div>
-					<label class="block text-xs mb-1">{t('commandConfig.defaultCount')}</label>
-					<input type="number" bind:value={form.default_count} min="1" max="20"
+					<label for="cfg-default-count" class="block text-xs mb-1">{t('commandConfig.defaultCount')}</label>
+					<input id="cfg-default-count" type="number" bind:value={form.default_count} min="1" max="20"
 						class="w-full px-2 py-1.5 text-sm border border-[var(--color-border)] rounded-md bg-[var(--color-background)]" />
 				</div>
 				<div>
-					<label class="block text-xs mb-1">{t('commandConfig.searchCooldown')}</label>
-					<input type="number" bind:value={form.rate_limits.search} min="0" max="300"
+					<label for="cfg-search-cooldown" class="block text-xs mb-1">{t('commandConfig.searchCooldown')}</label>
+					<input id="cfg-search-cooldown" type="number" bind:value={form.rate_limits.search} min="0" max="300"
 						class="w-full px-2 py-1.5 text-sm border border-[var(--color-border)] rounded-md bg-[var(--color-background)]" />
 				</div>
 			</div>
 
 			<div class="w-1/2 sm:w-1/4">
-				<label class="block text-xs mb-1">{t('commandConfig.defaultCooldown')}</label>
-				<input type="number" bind:value={form.rate_limits.default} min="0" max="300"
+				<label for="cfg-default-cooldown" class="block text-xs mb-1">{t('commandConfig.defaultCooldown')}</label>
+				<input id="cfg-default-cooldown" type="number" bind:value={form.rate_limits.default} min="0" max="300"
 					class="w-full px-2 py-1.5 text-sm border border-[var(--color-border)] rounded-md bg-[var(--color-background)]" />
 			</div>
 			{:else}
@@ -268,22 +353,20 @@
 		<EmptyState icon="mdiFilterOff" message={t('common.noFilterResults')} />
 	</Card>
 {:else}
-	<div class="space-y-3 stagger-children">
+	<div class="list-stack stagger-children">
 		{#each configs as cfg}
 			<Card hover entityId={cfg.id}>
-				<div class="flex items-center justify-between">
-					<div>
-						<div class="flex items-center gap-2">
-							<span style="color: var(--color-primary);"><MdiIcon name={cfg.icon || 'mdiConsoleLine'} size={20} /></span>
-							<p class="font-medium">{cfg.name}</p>
-							<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)] font-mono">{cfg.provider_type}</span>
-							<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-success-bg)] text-[var(--color-success-fg)] font-mono">
-								{(cfg.enabled_commands || []).length} {t('commandConfig.commands')}
-							</span>
+				<div class="list-row">
+					<div class="list-row__identity">
+						<div class="flex items-center gap-2 min-w-0">
+							<span style="color: var(--color-primary);" class="shrink-0"><MdiIcon name={cfg.icon || 'mdiConsoleLine'} size={20} /></span>
+							<p class="font-medium truncate">{cfg.name}</p>
+							<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)] font-mono shrink-0">{cfg.provider_type}</span>
 						</div>
-						<div class="flex items-center gap-2 mt-0.5">
+						<div class="flex items-center gap-2 mt-0.5 list-row__secondary">
 							<span class="text-xs text-[var(--color-muted-foreground)]">
-								{t('commandConfig.responseMode')}: {cfg.response_mode === 'media' ? t('commandConfig.modeMedia') : t('commandConfig.modeText')}
+								{(cfg.enabled_commands || []).length} {t('commandConfig.commands')}
+								&middot; {t('commandConfig.responseMode')}: {cfg.response_mode === 'media' ? t('commandConfig.modeMedia') : t('commandConfig.modeText')}
 								&middot; {t('commandConfig.defaultCount')}: {cfg.default_count}
 							</span>
 							{#if cfg.command_template_config_id}
@@ -291,7 +374,8 @@
 							{/if}
 						</div>
 					</div>
-					<div class="flex items-center gap-1">
+					<MetaStrip tiles={commandConfigTiles(cfg)} />
+					<div class="list-row__actions">
 						<IconButton icon="mdiPencil" title={t('common.edit')} onclick={() => editConfig(cfg)} />
 						<IconButton icon="mdiDelete" title={t('common.delete')} onclick={() => remove(cfg)} variant="danger" />
 					</div>

frontend/src/routes/command-template-configs/+page.svelte

@@ -1,12 +1,13 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
 	import { slide } from 'svelte/transition';
-	import { api, getBlockedBy, type BlockedByDetail } from '$lib/api';
+	import { api, getBlockedBy, type BlockedByDetail , errMsg} from '$lib/api';
 	import BlockedByModal from '$lib/components/BlockedByModal.svelte';
 	import { t } from '$lib/i18n';
 	import { sanitizePreview } from '$lib/sanitize';
 	import { commandTemplateConfigsCache, supportedLocalesCache } from '$lib/stores/caches.svelte';
 	import PageHeader from '$lib/components/PageHeader.svelte';
+	import Button from '$lib/components/Button.svelte';
 	import Card from '$lib/components/Card.svelte';
 	import Loading from '$lib/components/Loading.svelte';
 	import IconPicker from '$lib/components/IconPicker.svelte';
@@ -19,9 +20,14 @@
 	import Modal from '$lib/components/Modal.svelte';
 	import JinjaEditor from '$lib/components/JinjaEditor.svelte';
 	import CollapsibleSlot from '$lib/components/CollapsibleSlot.svelte';
+	import Hint from '$lib/components/Hint.svelte';
+	import EntitySelect, { type EntityItem } from '$lib/components/EntitySelect.svelte';
+	import { getLocaleMeta } from '$lib/locales';
 	import { snackSuccess, snackError } from '$lib/stores/snackbar.svelte';
 	import { highlightFromUrl } from '$lib/highlight';
 	import { globalProviderFilter } from '$lib/stores/provider-filter.svelte';
+	import { getDescriptor } from '$lib/providers';
+	import MetaStrip, { type MetaTile } from '$lib/components/MetaStrip.svelte';
 
 	interface CmdTemplateConfig {
 		id: number;
@@ -40,6 +46,7 @@
 	}
 
 	let LOCALES = $derived(supportedLocalesCache.items);
+	let primaryLocale = $derived(LOCALES[0] || 'en');
 
 	let allCmdTplConfigs = $state<CmdTemplateConfig[]>([]);
 	let filterText = $state('');
@@ -54,6 +61,11 @@
 	let editing = $state<number | null>(null);
 	let error = $state('');
 	let confirmDelete = $state<{ id: number; onconfirm: () => Promise<void> } | null>(null);
+	let confirmReset = $state<{
+		kind: 'slot' | 'all';
+		slotKey?: string;
+		message: string;
+	} | null>(null);
 	let slotPreview = $state<Record<string, string>>({});
 	let slotErrors = $state<Record<string, string>>({});
 	let slotErrorLines = $state<Record<string, number | null>>({});
@@ -67,7 +79,18 @@
 	});
 	let varsRef = $state<Record<string, any>>({});
 	let showVarsFor = $state<string | null>(null);
-	let activeLocale = $state<string>('en');
+	let activeLocale = $state<string>('');
+	const localeItems = $derived<EntityItem[]>(LOCALES.map((code, i) => {
+		const m = getLocaleMeta(code);
+		return {
+			value: code,
+			label: m.native,
+			desc: i === 0 ? `${code.toUpperCase()} · ${t('locales.primary')}` : code.toUpperCase(),
+		};
+	}));
+	$effect(() => {
+		if (!activeLocale && LOCALES.length > 0) activeLocale = primaryLocale;
+	});
 	let expandedSlots = $state<Set<string>>(new Set());
 	let slotFilter = $state('');
 	let showPreviewFor = $state<Set<string>>(new Set());
@@ -99,6 +122,14 @@
 		slots: {} as Record<string, Record<string, string>>,
 	});
 	let form = $state(defaultForm());
+	let nameManuallyEdited = $state(false);
+
+	$effect(() => {
+		if (showForm && !nameManuallyEdited && !editing) {
+			const desc = getDescriptor(form.provider_type);
+			form.name = desc ? `${desc.defaultName} Command Templates` : 'Command Templates';
+		}
+	});
 
 	// Provider capabilities
 	let allCapabilities = $state<Record<string, any>>({});
@@ -106,11 +137,40 @@
 	let commandSlots = $derived<SlotDef[]>(
 		allCapabilities[form.provider_type]?.command_slots || []
 	);
-	let filteredCmdSlots = $derived(
-		slotFilter
-			? commandSlots.filter(s => s.name.toLowerCase().includes(slotFilter.toLowerCase()) || s.description.toLowerCase().includes(slotFilter.toLowerCase()))
-			: commandSlots
-	);
+
+	const ERROR_SLOTS = new Set(['rate_limited', 'no_results']);
+
+	/**
+	 * Group command slots by purpose so the form mirrors how notification
+	 * templates are split (event vs scheduled vs settings).
+	 *
+	 *   commandResponses  — primary reply templates (/start, /help, /status, data slots)
+	 *   commandErrors     — fallback messages (rate_limited, no_results)
+	 *   commandDescriptions — desc_* slots: short menu blurbs in Telegram's command picker
+	 *   commandUsage      — usage_* slots: invocation examples shown by /help
+	 */
+	let commandSlotGroups = $derived([
+		{
+			group: 'commandResponses',
+			slots: commandSlots.filter(s =>
+				!s.name.startsWith('desc_') &&
+				!s.name.startsWith('usage_') &&
+				!ERROR_SLOTS.has(s.name)
+			),
+		},
+		{
+			group: 'commandErrors',
+			slots: commandSlots.filter(s => ERROR_SLOTS.has(s.name)),
+		},
+		{
+			group: 'commandDescriptions',
+			slots: commandSlots.filter(s => s.name.startsWith('desc_')),
+		},
+		{
+			group: 'commandUsage',
+			slots: commandSlots.filter(s => s.name.startsWith('usage_')),
+		},
+	]);
 
 	/** Get slot template for current locale, with fallback. */
 	function getSlotValue(slotName: string): string {
@@ -135,6 +195,13 @@
 
 	onMount(load);
 
+	const headerPills = $derived.by(() => {
+		const pills: Array<{ label: string; tone: 'sky' }> = [];
+		const types = new Set(configs.map(c => c.provider_type)).size;
+		if (types > 0) pills.push({ label: `${types} ${types === 1 ? t('providers.typeSingular') : t('providers.typePlural')}`, tone: 'sky' });
+		return pills;
+	});
+
 	async function load() {
 		try {
 			const [cfgs, caps, vars] = await Promise.all([
@@ -146,8 +213,8 @@
 			allCmdTplConfigs = cfgs;
 			allCapabilities = caps;
 			varsRef = vars;
-		} catch (err: any) {
-			error = err.message || t('common.loadError');
+		} catch (err: unknown) {
+			error = errMsg(err, t('common.loadError'));
 			snackError(error);
 		} finally {
 			loaded = true;
@@ -196,13 +263,52 @@
 		}
 	}
 
+	function cmdTemplateConfigTiles(config: CmdTemplateConfig): MetaTile[] {
+		const tiles: MetaTile[] = [];
+		tiles.push({
+			icon: 'mdiServer',
+			label: config.provider_type,
+			tone: 'lavender',
+			mono: true,
+		});
+		const slotCount = Object.keys(config.slots || {}).length;
+		tiles.push({
+			icon: 'mdiViewGridOutline',
+			value: String(slotCount),
+			label: t('templateConfig.slots'),
+			tone: slotCount > 0 ? 'sky' : 'default',
+		});
+		const locales = new Set<string>();
+		for (const s of Object.values(config.slots || {})) {
+			for (const loc of Object.keys(s || {})) locales.add(loc);
+		}
+		if (locales.size > 0) {
+			tiles.push({
+				icon: 'mdiTranslate',
+				value: String(locales.size),
+				label: locales.size === 1 ? t('locales.label') : t('locales.labelPlural'),
+				hint: [...locales].sort().join(', '),
+				tone: 'mint',
+			});
+		}
+		if (config.user_id === 0) {
+			tiles.push({
+				icon: 'mdiShieldStarOutline',
+				label: t('common.system'),
+				tone: 'orchid',
+			});
+		}
+		return tiles;
+	}
+
 	function openNew() {
 		form = defaultForm();
 		const typesWithCmdSlots = providerTypes.filter(t => (allCapabilities[t]?.command_slots?.length || 0) > 0);
 		if (typesWithCmdSlots.length > 0) form.provider_type = typesWithCmdSlots[0];
+		nameManuallyEdited = false;
 		editing = null;
 		showForm = true;
-		activeLocale = 'en';
+		activeLocale = primaryLocale;
 		slotPreview = {};
 		slotErrors = {};
 		expandedSlots = new Set();
@@ -223,9 +329,10 @@
 			icon: c.icon || '',
 			slots: slotsCopy,
 		};
+		nameManuallyEdited = true;
 		editing = c.id;
 		showForm = true;
-		activeLocale = 'en';
+		activeLocale = primaryLocale;
 		slotPreview = {};
 		slotErrors = {};
 		expandedSlots = new Set();
@@ -247,9 +354,62 @@
 			editing = null;
 			await load();
 			snackSuccess(t('snack.cmdTemplateSaved'));
-		} catch (err: any) {
-			error = err.message;
-			snackError(err.message);
+		} catch (err: unknown) {
+			const m = errMsg(err);
+			error = m;
+			snackError(m);
+		}
+	}
+
+	function resetSlotToDefault(slotKey: string) {
+		if (!form.provider_type) return;
+		confirmReset = {
+			kind: 'slot',
+			slotKey,
+			message: t('templateConfig.resetSlotConfirm').replace('{locale}', activeLocale.toUpperCase()),
+		};
+	}
+
+	function resetAllToDefaults() {
+		if (!form.provider_type) return;
+		confirmReset = {
+			kind: 'all',
+			message: t('templateConfig.resetAllConfirm').replace(/\{locale\}/g, activeLocale.toUpperCase()),
+		};
+	}
+
+	async function performReset() {
+		if (!confirmReset || !form.provider_type) return;
+		const { kind, slotKey } = confirmReset;
+		confirmReset = null;
+		try {
+			if (kind === 'slot' && slotKey) {
+				const res = await api<Record<string, Record<string, string>>>(
+					`/command-template-configs/defaults?provider_type=${encodeURIComponent(form.provider_type)}&slot_name=${encodeURIComponent(slotKey)}&locale=${encodeURIComponent(activeLocale)}`,
+				);
+				const text = res?.[slotKey]?.[activeLocale];
+				if (!text) {
+					snackError(t('templateConfig.resetNoDefault'));
+					return;
+				}
+				setSlotValue(slotKey, text);
+				validateSlot(slotKey, text, true);
+			} else {
+				const res = await api<Record<string, Record<string, string>>>(
+					`/command-template-configs/defaults?provider_type=${encodeURIComponent(form.provider_type)}&locale=${encodeURIComponent(activeLocale)}`,
+				);
+				const nextSlots = { ...form.slots };
+				for (const [key, localeMap] of Object.entries(res || {})) {
+					const text = localeMap?.[activeLocale];
+					if (text === undefined) continue;
+					nextSlots[key] = { ...(nextSlots[key] || {}), [activeLocale]: text };
+				}
+				form.slots = nextSlots;
+				refreshAllPreviews();
+			}
+			snackSuccess(t('templateConfig.resetApplied'));
+		} catch (err: unknown) {
+			snackError(errMsg(err));
 		}
 	}
 
@@ -267,7 +427,7 @@
 		};
 		editing = null;
 		showForm = true;
-		activeLocale = 'en';
+		activeLocale = primaryLocale;
 		slotPreview = {};
 		slotErrors = {};
 		expandedSlots = new Set();
@@ -285,11 +445,12 @@
 					await api(`/command-template-configs/${id}`, { method: 'DELETE' });
 					await load();
 					snackSuccess(t('snack.cmdTemplateDeleted'));
-				} catch (err: any) {
+				} catch (err: unknown) {
 					const bb = getBlockedBy(err);
 					if (bb) { blockedBy = bb; return; }
-					error = err.message;
-					snackError(err.message);
+					const m = errMsg(err);
+					error = m;
+					snackError(m);
 				} finally {
 					confirmDelete = null;
 				}
@@ -298,11 +459,18 @@
 	}
 </script>
 
-<PageHeader title={t('cmdTemplateConfig.title')} description={t('cmdTemplateConfig.description')}>
-	<button onclick={() => { showForm ? (showForm = false, editing = null) : openNew(); }}
-		class="px-3 py-1.5 bg-[var(--color-primary)] text-[var(--color-primary-foreground)] rounded-md text-sm font-medium hover:opacity-90">
+<PageHeader
+	title={t('cmdTemplateConfig.title')}
+	emphasis={t('cmdTemplateConfig.titleEmphasis')}
+	description={t('cmdTemplateConfig.description')}
+	crumb={t('crumbs.routingCommands')}
+	count={configs.length}
+	countLabel={t('cmdTemplateConfig.countLabel')}
+	pills={headerPills}
+>
+	<Button size="sm" onclick={() => { showForm ? (showForm = false, editing = null) : openNew(); }}>
 		{showForm ? t('common.cancel') : t('cmdTemplateConfig.newConfig')}
-	</button>
+	</Button>
 </PageHeader>
 
 {#if !loaded}<Loading />{:else}
@@ -316,7 +484,7 @@
 			<label for="ct-name" class="block text-sm font-medium mb-1">{t('cmdTemplateConfig.name')}</label>
 			<div class="flex gap-2">
 				<IconPicker value={form.icon} onselect={(v: string) => form.icon = v} />
-				<input id="ct-name" bind:value={form.name} required placeholder={t('cmdTemplateConfig.namePlaceholder')}
+				<input id="ct-name" bind:value={form.name} oninput={() => nameManuallyEdited = true} required placeholder={t('cmdTemplateConfig.namePlaceholder')}
 					class="flex-1 px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
 			</div>
 		</div>
@@ -328,7 +496,7 @@
 
 		{#if !editing}
 		<div>
-			<label class="block text-sm font-medium mb-1">{t('templateConfig.providerType')}</label>
+			<div class="block text-sm font-medium mb-1">{t('templateConfig.providerType')}</div>
 			<IconGridSelect items={providerTypeItemsFn()} bind:value={form.provider_type} columns={2} />
 		</div>
 		{:else}
@@ -338,76 +506,98 @@
 		</div>
 		{/if}
 
-		<fieldset class="border border-[var(--color-border)] rounded-md p-3">
-			<legend class="text-sm font-medium px-1">{t('cmdTemplateConfig.commandResponses')}</legend>
-			<p class="text-xs text-[var(--color-muted-foreground)] mb-2">{t('cmdTemplateConfig.commandResponsesHint')}</p>
-
-			<!-- Locale tabs -->
-			<div class="flex gap-1 mb-3 border-b border-[var(--color-border)]">
-				{#each LOCALES as loc}
-					<button type="button"
-						class="px-3 py-1.5 text-xs font-medium rounded-t-md transition-colors {activeLocale === loc ? 'bg-[var(--color-primary)] text-[var(--color-primary-foreground)]' : 'text-[var(--color-muted-foreground)] hover:bg-[var(--color-muted)]'}"
-						onclick={() => { activeLocale = loc; refreshAllPreviews(); }}>
-						{loc.toUpperCase()}
-					</button>
-				{/each}
-			</div>
-
-			<!-- Slot filter -->
-			{#if commandSlots.length > 4}
-			<div class="mb-3">
-				<input type="text" bind:value={slotFilter} placeholder={t('templateConfig.filterSlots')}
-					class="w-full px-3 py-1.5 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
+		<!-- Language picker -->
+		<div class="flex items-center gap-2 mb-3">
+			<span class="text-xs font-medium text-[var(--color-muted-foreground)] shrink-0">
+				{t('templateConfig.language')}
+			</span>
+			<div class="flex-1 max-w-xs">
+				<EntitySelect
+					items={localeItems}
+					value={activeLocale}
+					size="sm"
+					onselect={(v) => { activeLocale = (v as string) || primaryLocale; refreshAllPreviews(); }}
+				/>
 			</div>
+			{#if form.provider_type}
+				<button type="button" onclick={resetAllToDefaults}
+					title={t('templateConfig.resetAllToDefaults')}
+					class="ml-auto flex items-center gap-1 text-xs px-2 py-1 rounded-md border border-[var(--color-border)] text-[var(--color-muted-foreground)] hover:bg-[var(--color-muted)]">
+					<MdiIcon name="mdiRefresh" size={12} />
+					{t('templateConfig.resetAllToDefaults')}
+				</button>
 			{/if}
+		</div>
 
-			<div class="space-y-2">
-				{#each filteredCmdSlots as slot}
-					<CollapsibleSlot
-						label={slot.name}
-						description="/{slot.name} — {slot.description}"
-						expanded={expandedSlots.has(slot.name)}
-						status={getSlotStatus(slot.name)}
-						ontoggle={() => toggleSlot(slot.name)}
-					>
-						<div class="flex items-center justify-end gap-2 mb-2">
-							{#if slotPreview[slot.name] && !slotErrors[slot.name]}
-								<button type="button" onclick={() => togglePreview(slot.name)}
-									class="text-xs px-2 py-0.5 rounded-md transition-colors {showPreviewFor.has(slot.name) ? 'bg-[var(--color-primary)] text-[var(--color-primary-foreground)]' : 'text-[var(--color-muted-foreground)] hover:bg-[var(--color-muted)]'}">
-									{t('templateConfig.preview')}
+		<!-- Slot filter -->
+		{#if commandSlots.length > 4}
+		<div>
+			<input type="text" bind:value={slotFilter} placeholder={t('templateConfig.filterSlots')}
+				class="w-full px-3 py-1.5 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
+		</div>
+		{/if}
+
+		{#each commandSlotGroups.filter(g => g.slots.length > 0) as group}
+			{@const filteredSlots = slotFilter ? group.slots.filter(s => s.name.toLowerCase().includes(slotFilter.toLowerCase()) || s.description.toLowerCase().includes(slotFilter.toLowerCase())) : group.slots}
+			{#if filteredSlots.length > 0}
+			<fieldset class="border border-[var(--color-border)] rounded-md p-3">
+				<legend class="text-sm font-medium px-1">
+					{t(`cmdTemplateConfig.${group.group}`)}<Hint text={t(`hints.${group.group}`)} />
+				</legend>
+				<div class="space-y-2 mt-2">
+					{#each filteredSlots as slot}
+						<CollapsibleSlot
+							label={slot.name}
+							description="/{slot.name} — {slot.description}"
+							expanded={expandedSlots.has(slot.name)}
+							status={getSlotStatus(slot.name)}
+							ontoggle={() => toggleSlot(slot.name)}
+						>
+							<div class="flex items-center justify-end gap-2 mb-2">
+								{#if slotPreview[slot.name] && !slotErrors[slot.name]}
+									<button type="button" onclick={() => togglePreview(slot.name)}
+										class="text-xs px-2 py-0.5 rounded-md transition-colors {showPreviewFor.has(slot.name) ? 'bg-[var(--color-primary)] text-[var(--color-primary-foreground)]' : 'text-[var(--color-muted-foreground)] hover:bg-[var(--color-muted)]'}">
+										{t('templateConfig.preview')}
+									</button>
+								{/if}
+								{#if getVarsFor(slot.name)}
+									<button type="button" onclick={() => showVarsFor = slot.name}
+										class="text-xs text-[var(--color-muted-foreground)] hover:underline">{t('templateConfig.variables')}</button>
+								{/if}
+								<button type="button" onclick={() => resetSlotToDefault(slot.name)}
+									title={t('templateConfig.resetToDefault')}
+									class="text-xs text-[var(--color-muted-foreground)] hover:underline">
+									{t('templateConfig.resetToDefault')}
 								</button>
-							{/if}
-							{#if getVarsFor(slot.name)}
-								<button type="button" onclick={() => showVarsFor = slot.name}
-									class="text-xs text-[var(--color-muted-foreground)] hover:underline">{t('templateConfig.variables')}</button>
-							{/if}
-						</div>
-
-						{#if showPreviewFor.has(slot.name) && slotPreview[slot.name] && !slotErrors[slot.name]}
-							<div class="p-2 bg-[var(--color-muted)] rounded text-sm mb-2">
-								<pre class="whitespace-pre-wrap text-xs">{@html sanitizePreview(slotPreview[slot.name])}</pre>
 							</div>
-						{:else}
-							<JinjaEditor
-								value={getSlotValue(slot.name)}
-								onchange={(v: string) => { setSlotValue(slot.name, v); validateSlot(slot.name, v); }}
-								rows={3}
-								errorLine={slotErrorLines[slot.name] || null}
-								variables={getVarsFor(slot.name) || undefined}
-							/>
-						{/if}
 
-						{#if slotErrors[slot.name]}
-							{#if slotErrorTypes[slot.name] === 'undefined'}
-								<p class="mt-1 text-xs" style="color: #d97706;">⚠ {t('common.undefinedVar')}: {slotErrors[slot.name]}</p>
+							{#if showPreviewFor.has(slot.name) && slotPreview[slot.name] && !slotErrors[slot.name]}
+								<div class="p-2 bg-[var(--color-muted)] rounded text-sm mb-2">
+									<pre class="whitespace-pre-wrap text-xs">{@html sanitizePreview(slotPreview[slot.name])}</pre>
+								</div>
 							{:else}
-								<p class="mt-1 text-xs" style="color: var(--color-error-fg);">✕ {t('common.syntaxError')}: {slotErrors[slot.name]}{slotErrorLines[slot.name] ? ` (${t('common.line')} ${slotErrorLines[slot.name]})` : ''}</p>
+								<JinjaEditor
+									value={getSlotValue(slot.name)}
+									onchange={(v: string) => { setSlotValue(slot.name, v); validateSlot(slot.name, v); }}
+									rows={3}
+									errorLine={slotErrorLines[slot.name] || null}
+									variables={getVarsFor(slot.name) || undefined}
+								/>
 							{/if}
-						{/if}
-					</CollapsibleSlot>
-				{/each}
-			</div>
-		</fieldset>
+
+							{#if slotErrors[slot.name]}
+								{#if slotErrorTypes[slot.name] === 'undefined'}
+									<p class="mt-1 text-xs" style="color: var(--color-warning-fg);">⚠ {t('common.undefinedVar')}: {slotErrors[slot.name]}</p>
+								{:else}
+									<p class="mt-1 text-xs" style="color: var(--color-error-fg);">вњ• {t('common.syntaxError')}: {slotErrors[slot.name]}{slotErrorLines[slot.name] ? ` (${t('common.line')} ${slotErrorLines[slot.name]})` : ''}</p>
+								{/if}
+							{/if}
+						</CollapsibleSlot>
+					{/each}
+				</div>
+			</fieldset>
+			{/if}
+		{/each}
 
 		<button type="submit" class="px-4 py-2 bg-[var(--color-primary)] text-[var(--color-primary-foreground)] rounded-md text-sm font-medium hover:opacity-90">
 			{editing ? t('common.save') : t('common.create')}
@@ -438,25 +628,25 @@
 		<EmptyState icon="mdiFilterOff" message={t('common.noFilterResults')} />
 	</Card>
 {:else}
-	<div class="space-y-3 stagger-children">
+	<div class="list-stack stagger-children">
 		{#each configs as config}
 			<Card hover entityId={config.id}>
-				<div class="flex items-start justify-between">
-					<div class="flex-1">
-						<div class="flex items-center gap-2">
-							<span style="color: var(--color-primary);"><MdiIcon name={config.icon || 'mdiConsoleLine'} size={20} /></span>
-							<p class="font-medium">{config.name}</p>
-							<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)]">{config.provider_type}</span>
+				<div class="list-row">
+					<div class="list-row__identity">
+						<div class="flex items-center gap-2 min-w-0">
+							<span style="color: var(--color-primary);" class="shrink-0"><MdiIcon name={config.icon || 'mdiConsoleLine'} size={20} /></span>
+							<p class="font-medium truncate">{config.name}</p>
+							<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)] shrink-0">{config.provider_type}</span>
 							{#if config.user_id === 0}
-								<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)]">{t('common.system')}</span>
+								<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)] shrink-0">{t('common.system')}</span>
 							{/if}
-							<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)]">{Object.keys(config.slots).length} {t('templateConfig.slots')}</span>
 						</div>
 						{#if config.description}
-							<p class="text-sm text-[var(--color-muted-foreground)] mt-1">{config.description}</p>
+							<p class="text-sm text-[var(--color-muted-foreground)] mt-1 list-row__secondary">{config.description}</p>
 						{/if}
 					</div>
-					<div class="flex items-center gap-1 ml-4">
+					<MetaStrip tiles={cmdTemplateConfigTiles(config)} />
+					<div class="list-row__actions">
 						<IconButton icon="mdiContentCopy" title={t('common.clone')} onclick={() => clone(config)} />
 						<IconButton icon="mdiPencil" title={t('common.edit')} onclick={() => edit(config)} />
 						<IconButton icon="mdiDelete" title={t('common.delete')} onclick={() => remove(config.id)} variant="danger" />
@@ -472,6 +662,14 @@
 <ConfirmModal open={confirmDelete !== null} message={t('cmdTemplateConfig.confirmDelete')}
 	onconfirm={() => confirmDelete?.onconfirm()} oncancel={() => confirmDelete = null} />
 
+<ConfirmModal open={confirmReset !== null}
+	title={t('templateConfig.resetToDefault')}
+	message={confirmReset?.message || ''}
+	confirmLabel={confirmReset?.kind === 'all' ? t('templateConfig.resetAllToDefaults') : t('templateConfig.resetToDefault')}
+	confirmIcon="mdiRefresh"
+	onconfirm={performReset}
+	oncancel={() => confirmReset = null} />
+
 <BlockedByModal open={!!blockedBy} detail={blockedBy} onclose={() => blockedBy = null} />
 
 <!-- Variables reference modal -->

frontend/src/routes/command-trackers/+page.svelte

@@ -1,7 +1,8 @@
 <script lang="ts">
-	import { onMount } from 'svelte';
+	import { onMount, onDestroy } from 'svelte';
 	import { slide } from 'svelte/transition';
-	import { api } from '$lib/api';
+	import { api , errMsg} from '$lib/api';
+	import { topbarAction } from '$lib/stores/topbar-action.svelte';
 	import { t } from '$lib/i18n';
 	import { providersCache, telegramBotsCache, commandConfigsCache } from '$lib/stores/caches.svelte';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -20,6 +21,7 @@
 	import { globalProviderFilter } from '$lib/stores/provider-filter.svelte';
 	import { providerDefaultIcon } from '$lib/grid-items';
 	import Button from '$lib/components/Button.svelte';
+	import MetaStrip, { type MetaTile } from '$lib/components/MetaStrip.svelte';
 	import type { ServiceProvider, TelegramBot } from '$lib/types';
 
 	let allCmdTrackers = $state<any[]>([]);
@@ -60,6 +62,14 @@
 		enabled: true,
 	});
 	let form = $state(defaultForm());
+	let nameManuallyEdited = $state(false);
+
+	$effect(() => {
+		if (showForm && !nameManuallyEdited && !editing) {
+			const provider = providers.find(p => p.id === form.provider_id);
+			form.name = provider ? `${provider.name} Commands` : 'Commands';
+		}
+	});
 
 	// Filter command configs by selected provider's type
 	let filteredConfigs = $derived.by(() => {
@@ -72,7 +82,24 @@
 		.filter((c: any) => !globalProviderFilter.providerType || c.provider_type === globalProviderFilter.providerType)
 		.map((c: any) => ({ value: c.id, label: c.name, icon: c.icon || 'mdiCog', desc: c.provider_type })));
 
-	onMount(load);
+	onMount(() => {
+		topbarAction.set({
+			label: t('commandTracker.newTracker'),
+			onclick: () => { showForm ? (showForm = false, editing = null) : openNew(); },
+		});
+		load();
+	});
+	onDestroy(() => topbarAction.clear());
+
+	const headerPills = $derived.by(() => {
+		const pills: Array<{ label: string; tone: 'mint' | 'sky' | 'citrus' }> = [];
+		const armed = trackers.filter((tr: { enabled?: boolean }) => tr.enabled).length;
+		const paused = trackers.length - armed;
+		if (armed > 0) pills.push({ label: `${armed} ${t('notificationTracker.armed')}`, tone: 'mint' });
+		if (paused > 0) pills.push({ label: `${paused} ${t('notificationTracker.paused')}`, tone: 'citrus' });
+		return pills;
+	});
+
 	async function load() {
 		try {
 			[allCmdTrackers] = await Promise.all([
@@ -80,7 +107,7 @@
 				providersCache.fetch(), commandConfigsCache.fetch(),
 				telegramBotsCache.fetch(),
 			]);
-		} catch (err: any) { error = err.message || t('common.loadError'); snackError(error); }
+		} catch (err: unknown) { error = errMsg(err, t('common.loadError')); snackError(error); }
 		finally { loaded = true; highlightFromUrl(); }
 	}
 
@@ -92,9 +119,30 @@
 			const firstCfg = commandConfigs.find(c => c.provider_type === ptype);
 			if (firstCfg) form.command_config_id = firstCfg.id;
 		}
+		nameManuallyEdited = false;
 		editing = null;
 		showForm = true;
 	}
+
+	// Re-pick the command config when the provider changes. The previously
+	// selected id may belong to a different provider type and would no longer
+	// appear in the filtered EntitySelect, leaving the selector empty.
+	let _prevProviderId = $state(0);
+	$effect(() => {
+		if (showForm && form.provider_id && form.provider_id !== _prevProviderId) {
+			_prevProviderId = form.provider_id;
+			if (editing === null) {
+				const ptype = providers.find(p => p.id === form.provider_id)?.type || '';
+				if (ptype) {
+					const currentCfg = commandConfigs.find(c => c.id === form.command_config_id);
+					if (!currentCfg || currentCfg.provider_type !== ptype) {
+						const first = commandConfigs.find(c => c.provider_type === ptype);
+						form.command_config_id = first?.id ?? 0;
+					}
+				}
+			}
+		}
+	});
 	function editTracker(trk: any) {
 		form = {
 			name: trk.name,
@@ -103,6 +151,7 @@
 			command_config_id: trk.command_config_id,
 			enabled: trk.enabled,
 		};
+		nameManuallyEdited = true;
 		editing = trk.id;
 		showForm = true;
 	}
@@ -118,8 +167,8 @@
 				await api('/command-trackers', { method: 'POST', body });
 				snackSuccess(t('snack.commandTrackerCreated'));
 			}
-			form = defaultForm(); showForm = false; editing = null; await load();
-		} catch (err: any) { error = err.message; snackError(err.message); }
+			form = defaultForm(); nameManuallyEdited = false; showForm = false; editing = null; await load();
+		} catch (err: unknown) { const __m = errMsg(err); error = __m; snackError(__m); }
 		finally { submitting = false; }
 	}
 
@@ -131,7 +180,7 @@
 					await api(`/command-trackers/${trk.id}`, { method: 'DELETE' });
 					await load();
 					snackSuccess(t('snack.commandTrackerDeleted'));
-				} catch (err: any) { snackError(err.message); }
+				} catch (err: unknown) { snackError(errMsg(err)); }
 				finally { confirmDelete = null; }
 			}
 		};
@@ -144,7 +193,7 @@
 			await api(`/command-trackers/${trk.id}/${endpoint}`, { method: 'POST' });
 			snackSuccess(trk.enabled ? t('snack.commandTrackerDisabled') : t('snack.commandTrackerEnabled'));
 			await load();
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		toggling = { ...toggling, [trk.id]: false };
 	}
 
@@ -177,7 +226,7 @@
 			snackSuccess(t('snack.listenerAdded'));
 			await loadListeners(trkId);
 			newListenerBotId = { ...newListenerBotId, [trkId]: 0 };
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		addingListener = { ...addingListener, [trkId]: false };
 	}
 
@@ -186,7 +235,7 @@
 			await api(`/command-trackers/${trkId}/listeners/${listenerId}`, { method: 'DELETE' });
 			snackSuccess(t('snack.listenerRemoved'));
 			await loadListeners(trkId);
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
 	// Per-listener album scope editing
@@ -215,7 +264,7 @@
 			snackSuccess(t('snack.listenerScopeSaved'));
 			await loadListeners(scopeEditor.trkId);
 			scopeEditor = null;
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
 	function providerName(id: number): string {
@@ -224,9 +273,43 @@
 	function configName(id: number): string {
 		return commandConfigs.find(c => c.id === id)?.name || '?';
 	}
+
+	function commandTrackerTiles(trk: any): MetaTile[] {
+		const tiles: MetaTile[] = [];
+		tiles.push(trk.enabled
+			? { icon: 'mdiCheckCircle', label: t('commandTracker.enabled'), tone: 'mint' }
+			: { icon: 'mdiCloseCircle', label: t('commandTracker.disabled'), tone: 'coral' });
+		tiles.push({
+			icon: 'mdiServer',
+			label: providerName(trk.provider_id),
+			tone: 'lavender',
+		});
+		tiles.push({
+			icon: 'mdiCog',
+			label: configName(trk.command_config_id),
+			tone: 'sky',
+		});
+		if (trk.listener_count !== undefined) {
+			tiles.push({
+				icon: 'mdiAccountMultipleOutline',
+				value: String(trk.listener_count),
+				label: t('commandTracker.listeners').toLowerCase(),
+				tone: trk.listener_count > 0 ? 'orchid' : 'default',
+			});
+		}
+		return tiles;
+	}
 </script>
 
-<PageHeader title={t('commandTracker.title')} description={t('commandTracker.description')}>
+<PageHeader
+	title={t('commandTracker.title')}
+	emphasis={t('commandTracker.titleEmphasis')}
+	description={t('commandTracker.description')}
+	crumb={t('crumbs.routingCommands')}
+	count={trackers.length}
+	countLabel={t('dashboard.trackersShort')}
+	pills={headerPills}
+>
 	<Button size="sm" onclick={() => { showForm ? (showForm = false, editing = null) : openNew(); }}>
 		{showForm ? t('common.cancel') : t('commandTracker.newTracker')}
 	</Button>
@@ -242,18 +325,18 @@
 				<label for="trk-name" class="block text-sm font-medium mb-1">{t('commandTracker.name')}</label>
 				<div class="flex gap-2">
 					<IconPicker value={form.icon} onselect={(v: string) => form.icon = v} />
-					<input id="trk-name" bind:value={form.name} required placeholder={t('commandTracker.namePlaceholder')}
+					<input id="trk-name" bind:value={form.name} oninput={() => nameManuallyEdited = true} required placeholder={t('commandTracker.namePlaceholder')}
 						class="flex-1 px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
 				</div>
 			</div>
 
 			<div>
-				<label class="block text-sm font-medium mb-1">{t('commandTracker.provider')}</label>
+				<div class="block text-sm font-medium mb-1">{t('commandTracker.provider')}</div>
 				<EntitySelect items={providerItems} bind:value={form.provider_id} placeholder={t('commandTracker.selectProvider')} />
 			</div>
 
 			<div>
-				<label class="block text-sm font-medium mb-1">{t('commandTracker.commandConfig')}</label>
+				<div class="block text-sm font-medium mb-1">{t('commandTracker.commandConfig')}</div>
 				<EntitySelect items={configItems} bind:value={form.command_config_id} placeholder={t('commandTracker.selectCommandConfig')} />
 			</div>
 
@@ -285,34 +368,37 @@
 		<EmptyState icon="mdiFilterOff" message={t('common.noFilterResults')} />
 	</Card>
 {:else}
-	<div class="space-y-3 stagger-children">
+	<div class="list-stack stagger-children">
 		{#each trackers as trk}
 			<Card hover entityId={trk.id}>
-				<div class="flex items-center justify-between">
-					<div>
-						<div class="flex items-center gap-2">
-							<span style="color: var(--color-primary);"><MdiIcon name={trk.icon || 'mdiConsoleLine'} size={20} /></span>
-							<p class="font-medium">{trk.name}</p>
-							<CrossLink href="/providers" icon="mdiServer" label={providerName(trk.provider_id)} entityId={trk.provider_id} />
-							<CrossLink href="/command-configs" icon="mdiCog" label={configName(trk.command_config_id)} entityId={trk.command_config_id} />
-							<span class="text-xs px-1.5 py-0.5 rounded font-mono {trk.enabled
+				<div class="list-row">
+					<div class="list-row__identity">
+						<div class="flex items-center gap-2 min-w-0">
+							<span style="color: var(--color-primary);" class="shrink-0"><MdiIcon name={trk.icon || 'mdiConsoleLine'} size={20} /></span>
+							<p class="font-medium truncate">{trk.name}</p>
+							<span class="text-xs px-1.5 py-0.5 rounded font-mono shrink-0 {trk.enabled
 								? 'bg-[var(--color-success-bg)] text-[var(--color-success-fg)]'
 								: 'bg-[var(--color-error-bg)] text-[var(--color-error-fg)]'}">
 								{trk.enabled ? t('commandTracker.enabled') : t('commandTracker.disabled')}
 							</span>
 						</div>
-						{#if trk.listener_count !== undefined}
-							<p class="text-xs text-[var(--color-muted-foreground)] mt-0.5">
-								{trk.listener_count} {t('commandTracker.listeners').toLowerCase()}
-							</p>
-						{/if}
+						<div class="list-row__secondary mt-0.5 flex items-center gap-2 flex-wrap">
+							<CrossLink href="/providers" icon="mdiServer" label={providerName(trk.provider_id)} entityId={trk.provider_id} />
+							<CrossLink href="/command-configs" icon="mdiCog" label={configName(trk.command_config_id)} entityId={trk.command_config_id} />
+							{#if trk.listener_count !== undefined}
+								<span class="text-xs text-[var(--color-muted-foreground)]">
+									{trk.listener_count} {t('commandTracker.listeners').toLowerCase()}
+								</span>
+							{/if}
+						</div>
 					</div>
-					<div class="flex items-center gap-1">
+					<MetaStrip tiles={commandTrackerTiles(trk)} />
+					<div class="list-row__actions flex-wrap justify-end">
 						<IconButton icon="mdiPencil" title={t('common.edit')} onclick={() => editTracker(trk)} />
 						<IconButton icon={trk.enabled ? 'mdiPause' : 'mdiPlay'} title={trk.enabled ? t('notificationTracker.pause') : t('notificationTracker.resume')} onclick={() => toggleEnabled(trk)} disabled={toggling[trk.id]} />
 						<button onclick={() => toggleListeners(trk.id)}
 							class="text-xs text-[var(--color-muted-foreground)] hover:underline px-2 py-1">
-							{t('commandTracker.listeners')} {expandedTracker === trk.id ? '▲' : '▼'}
+							{t('commandTracker.listeners')} {expandedTracker === trk.id ? 'в–І' : 'в–ј'}
 						</button>
 						<IconButton icon="mdiDelete" title={t('common.delete')} onclick={() => remove(trk)} variant="danger" />
 					</div>
@@ -387,7 +473,7 @@
 							onclick={() => { if (scopeEditor) scopeEditor.selectedIds = scopeEditor.collections.map((c: any) => c.id); }}>
 							{t('backup.selectAll')}
 						</button>
-						<span aria-hidden="true">·</span>
+						<span aria-hidden="true">В·</span>
 						<button type="button" class="underline hover:text-[var(--color-primary)]"
 							onclick={() => { if (scopeEditor) scopeEditor.selectedIds = []; }}>
 							{t('backup.deselectAll')}

frontend/src/routes/login/+page.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { goto } from '$app/navigation';
 	import { onMount } from 'svelte';
-	import { api } from '$lib/api';
+	import { api , errMsg} from '$lib/api';
 	import { login } from '$lib/auth.svelte';
 	import { t, getLocale, setLocale } from '$lib/i18n';
 	import { initTheme, getTheme, setTheme, type Theme } from '$lib/theme.svelte';
@@ -15,13 +15,32 @@
 	let submitting = $state(false);
 	let mounted = $state(false);
 
+	let backendDown = $state(false);
+
 	onMount(async () => {
 		initTheme();
 		mounted = true;
+		// If the user is already signed in (valid access token in storage),
+		// there is no reason to show them the login form. loadUser() runs in
+		// the root layout; we just check the resolved state after a short tick.
+		const { isAuthenticated } = await import('$lib/api');
+		if (isAuthenticated()) {
+			try {
+				await api('/auth/me');
+				goto('/');
+				return;
+			} catch {
+				// Token was stale; fall through to the login form.
+			}
+		}
 		try {
 			const res = await api<{ needs_setup: boolean }>('/auth/needs-setup');
 			if (res.needs_setup) goto('/setup');
-		} catch { /* ignore */ }
+		} catch {
+			// The backend is unreachable — surface that distinctly so the user
+			// doesn't blame the login form for a network/backend problem.
+			backendDown = true;
+		}
 	});
 
 	async function handleSubmit(e: SubmitEvent) {
@@ -31,8 +50,8 @@
 		try {
 			await login(username, password);
 			window.location.href = '/';
-		} catch (err: any) {
-			error = err.message || t('auth.loginFailed');
+		} catch (err: unknown) {
+			error = errMsg(err, t('auth.loginFailed'));
 		}
 		submitting = false;
 	}
@@ -62,7 +81,12 @@
 		<p class="text-sm mt-1" style="color: var(--color-muted-foreground);">{t('auth.signInTitle')}</p>
 	</div>
 
-	{#if error}
+	{#if backendDown}
+		<div class="auth-error animate-fade-slide-in">
+			<MdiIcon name="mdiAlertCircle" size={16} />
+			{t('auth.backendUnreachable')}
+		</div>
+	{:else if error}
 		<div class="auth-error animate-fade-slide-in">
 			<MdiIcon name="mdiAlertCircle" size={16} />
 			{error}

frontend/src/routes/notification-trackers/+page.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
-	import { onMount } from 'svelte';
-	import { api, parseDate } from '$lib/api';
+	import { onMount, onDestroy } from 'svelte';
+	import { api, parseDate , errMsg} from '$lib/api';
+	import { topbarAction } from '$lib/stores/topbar-action.svelte';
 	import { t, getLocale } from '$lib/i18n';
 	import { providersCache, targetsCache, trackingConfigsCache, templateConfigsCache, capabilitiesCache } from '$lib/stores/caches.svelte';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -21,6 +22,7 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import type { Tracker, TrackerTarget, TrackingConfig, TemplateConfig, NotificationTarget } from '$lib/types';
 
+	import MetaStrip, { type MetaTile } from '$lib/components/MetaStrip.svelte';
 	import TrackerForm from './TrackerForm.svelte';
 	import LinkedTargetsSection from './LinkedTargetsSection.svelte';
 	import SharedLinkModal from './SharedLinkModal.svelte';
@@ -45,6 +47,7 @@
 	let trackingConfigs = $derived(trackingConfigsCache.items);
 	let templateConfigs = $derived(templateConfigsCache.items);
 	let collections = $state<Record<string, any>[]>([]);
+	let users = $state<{ id: string; name: string }[]>([]);
 	let showForm = $state(false);
 	let editing = $state<number | null>(null);
 	let collectionFilter = $state('');
@@ -62,16 +65,25 @@
 	// Tracker form
 	const defaultForm = () => ({
 		name: '', icon: '', provider_id: 0, collection_ids: [] as string[],
-		scan_interval: 60, batch_duration: 0,
+		scan_interval: 60,
+		adaptive_max_skip: null as number | null,
 		default_tracking_config_id: 0, default_template_config_id: 0,
 		filters: {} as Record<string, any>,
 	});
 	let form = $state(defaultForm());
+	let nameManuallyEdited = $state(false);
 	let selectedProviderType = $derived(
 		providers.find(p => p.id === form.provider_id)?.type || ''
 	);
 	let error = $state('');
 
+	$effect(() => {
+		if (showForm && !nameManuallyEdited && !editing) {
+			const provider = providers.find(p => p.id === form.provider_id);
+			form.name = provider ? `${provider.name} Tracker` : 'Tracker';
+		}
+	});
+
 	// Linked targets management
 	let expandedTracker = $state<number | null>(null);
 	let addingTarget = $state<Record<number, boolean>>({});
@@ -84,17 +96,23 @@
 	let testMenuStyle = $state('');
 
 	// Test types: basic is always available; periodic/scheduled/memory only for providers
-	// that have those notification slots in their capabilities
-	const allTestTypes: Record<string, { key: string; icon: string; labelKey: string; requiredSlot?: string }> = {
+	// that have those notification slots in their capabilities AND have the feature
+	// enabled on the tracker's default TrackingConfig. A disabled feature on the
+	// default config means cron dispatch won't fire it in production either — so
+	// the test button would just surface a silent skip.
+	const allTestTypes: Record<string, {
+		key: string; icon: string; labelKey: string;
+		requiredSlot?: string; enabledField?: string;
+	}> = {
 		basic: { key: 'basic', icon: 'mdiSend', labelKey: 'notificationTracker.testBasic' },
-		periodic: { key: 'periodic', icon: 'mdiCalendarClock', labelKey: 'notificationTracker.testPeriodic', requiredSlot: 'periodic_summary_message' },
-		scheduled: { key: 'scheduled', icon: 'mdiCalendarCheck', labelKey: 'notificationTracker.testScheduled', requiredSlot: 'scheduled_assets_message' },
-		memory: { key: 'memory', icon: 'mdiHistory', labelKey: 'notificationTracker.testMemory', requiredSlot: 'memory_mode_message' },
+		periodic: { key: 'periodic', icon: 'mdiCalendarClock', labelKey: 'notificationTracker.testPeriodic', requiredSlot: 'periodic_summary_message', enabledField: 'periodic_enabled' },
+		scheduled: { key: 'scheduled', icon: 'mdiCalendarCheck', labelKey: 'notificationTracker.testScheduled', requiredSlot: 'scheduled_assets_message', enabledField: 'scheduled_enabled' },
+		memory: { key: 'memory', icon: 'mdiHistory', labelKey: 'notificationTracker.testMemory', requiredSlot: 'memory_mode_message', enabledField: 'memory_enabled' },
 	};
 
 	let testMenuTrackerId = $state<number | null>(null);
 	let testTypes = $derived.by(() => {
-		const base = [allTestTypes.basic];
+		const base: { key: string; icon: string; labelKey: string; disabledReason?: string }[] = [allTestTypes.basic];
 		if (!testMenuTrackerId) return base;
 		const tracker = notificationTrackers.find(t => t.id === testMenuTrackerId);
 		if (!tracker) return base;
@@ -103,13 +121,41 @@
 		const caps = allCapabilities[provider.type];
 		if (!caps) return base;
 		const slotNames = new Set((caps.notification_slots || []).map((s: any) => s.name));
+		const defaultTc = trackingConfigs.find(c => c.id === tracker.default_tracking_config_id);
 		for (const tt of [allTestTypes.periodic, allTestTypes.scheduled, allTestTypes.memory]) {
-			if (tt.requiredSlot && slotNames.has(tt.requiredSlot)) base.push(tt);
+			if (!tt.requiredSlot || !slotNames.has(tt.requiredSlot)) continue;
+			const enabled = !!defaultTc && !!tt.enabledField && !!(defaultTc as any)[tt.enabledField];
+			base.push({
+				key: tt.key, icon: tt.icon, labelKey: tt.labelKey,
+				// When surfaced, the button still renders but is disabled and
+				// shows *why* — users who land here via the test menu without
+				// having toggled the feature on Tracking Config see a clear
+				// pointer to the missing setting instead of a silent failure.
+				disabledReason: enabled ? undefined : 'notificationTracker.testDisabledHint',
+			});
 		}
 		return base;
 	});
 
-	onMount(load);
+	onMount(() => {
+		topbarAction.set({
+			label: t('notificationTracker.newTracker'),
+			onclick: () => { showForm ? (showForm = false, editing = null) : openNew(); },
+		});
+		load();
+	});
+	onDestroy(() => topbarAction.clear());
+
+	const headerPills = $derived.by(() => {
+		const pills: Array<{ label: string; tone: 'mint' | 'sky' | 'coral' | 'citrus' }> = [];
+		const armed = notificationTrackers.filter(t => t.enabled).length;
+		const paused = notificationTrackers.length - armed;
+		if (armed > 0) pills.push({ label: `${armed} ${t('notificationTracker.armed')}`, tone: 'mint' });
+		if (paused > 0) pills.push({ label: `${paused} ${t('notificationTracker.paused')}`, tone: 'citrus' });
+		const providerCount = new Set(notificationTrackers.map(t => t.provider_id)).size;
+		if (providerCount > 0) pills.push({ label: `${providerCount} ${providerCount === 1 ? t('providers.typeSingular') : t('providers.typePlural')}`, tone: 'sky' });
+		return pills;
+	});
 
 	async function load() {
 		loadError = '';
@@ -120,8 +166,8 @@
 				trackingConfigsCache.fetch(), templateConfigsCache.fetch(),
 				capabilitiesCache.fetch(),
 			]);
-		} catch (err: any) {
-			loadError = err.message || t('common.loadFailed');
+		} catch (err: unknown) {
+			loadError = errMsg(err, t('common.loadFailed'));
 			snackError(loadError);
 		} finally { loaded = true; highlightFromUrl(); }
 	}
@@ -131,22 +177,38 @@
 		try { collections = await api(`/providers/${form.provider_id}/collections`); } catch (e) { console.warn('Failed to load collections:', e); collections = []; }
 	}
 
+	async function loadUsers() {
+		if (!form.provider_id) { users = []; return; }
+		// Skip the fetch when the descriptor has no user filters — saves a
+		// pointless round-trip for providers like Immich/Scheduler.
+		const desc = getDescriptor(selectedProviderType);
+		if (!desc?.userFilters || desc.userFilters.length === 0) { users = []; return; }
+		try { users = await api(`/providers/${form.provider_id}/users`); }
+		catch (e) { console.warn('Failed to load users:', e); users = []; }
+	}
+
 	let _prevProviderId = $state(0);
 	$effect(() => {
 		if (showForm && form.provider_id && form.provider_id !== _prevProviderId) {
 			_prevProviderId = form.provider_id;
 			loadCollections();
-			// Auto-select first available tracking/template config for this provider when creating
+			loadUsers();
+			// Re-pick tracking/template configs for the new provider type. The
+			// previously-selected ids may belong to a different provider type
+			// and therefore no longer appear in the filtered EntitySelect list,
+			// which would render the selector as empty.
 			if (editing === null) {
 				const ptype = providers.find(p => p.id === form.provider_id)?.type || '';
 				if (ptype) {
-					if (!form.default_tracking_config_id) {
+					const currentTc = trackingConfigs.find(c => c.id === form.default_tracking_config_id);
+					if (!currentTc || currentTc.provider_type !== ptype) {
 						const first = trackingConfigs.find(c => c.provider_type === ptype);
-						if (first) form.default_tracking_config_id = first.id;
+						form.default_tracking_config_id = first?.id ?? 0;
 					}
-					if (!form.default_template_config_id) {
+					const currentTpl = templateConfigs.find(c => c.id === form.default_template_config_id);
+					if (!currentTpl || currentTpl.provider_type !== ptype) {
 						const first = templateConfigs.find(c => c.provider_type === ptype);
-						if (first) form.default_template_config_id = first.id;
+						form.default_template_config_id = first?.id ?? 0;
 					}
 				}
 			}
@@ -157,21 +219,26 @@
 		form = defaultForm();
 		// Auto-select first provider if any
 		if (providers.length > 0) form.provider_id = providers[0].id;
-		editing = null; showForm = true; collections = []; previousCollectionIds = [];
+		nameManuallyEdited = false;
+		editing = null; showForm = true; collections = []; users = []; previousCollectionIds = [];
 	}
 
 	async function edit(trk: Tracker) {
 		form = {
 			name: trk.name, icon: trk.icon || '', provider_id: trk.provider_id,
 			collection_ids: [...(trk.collection_ids || [])],
-			scan_interval: trk.scan_interval, batch_duration: trk.batch_duration ?? 0,
+			scan_interval: trk.scan_interval,
+			adaptive_max_skip: trk.adaptive_max_skip ?? null,
 			default_tracking_config_id: trk.default_tracking_config_id ?? 0,
 			default_template_config_id: trk.default_template_config_id ?? 0,
 			filters: trk.filters || {},
 		};
 		previousCollectionIds = [...(trk.collection_ids || [])];
+		nameManuallyEdited = true;
 		editing = trk.id; showForm = true;
-		if (form.provider_id) await loadCollections();
+		if (form.provider_id) {
+			await Promise.all([loadCollections(), loadUsers()]);
+		}
 	}
 
 	async function save(e: SubmitEvent) {
@@ -207,6 +274,12 @@
 				...form,
 				default_tracking_config_id: form.default_tracking_config_id || null,
 				default_template_config_id: form.default_template_config_id || null,
+				// Empty string, 0, or null all mean "disable adaptive polling".
+				// Coerce to null so the DB column stays NULL rather than 0.
+				adaptive_max_skip:
+					form.adaptive_max_skip && form.adaptive_max_skip > 1
+						? form.adaptive_max_skip
+						: null,
 			};
 			if (editing) {
 				await api(`/notification-trackers/${editing}`, { method: 'PUT', body: JSON.stringify(payload) });
@@ -216,7 +289,7 @@
 				snackSuccess(t('snack.trackerCreated'));
 			}
 			showForm = false; editing = null; linkWarning = null; await load();
-		} catch (err: any) { error = err.message; snackError(err.message); } finally { submitting = false; }
+		} catch (err: unknown) { const __m = errMsg(err); error = __m; snackError(__m); } finally { submitting = false; }
 	}
 
 	async function autoCreateLinks() {
@@ -228,8 +301,8 @@
 				try {
 					await api(`/providers/${linkWarning.providerId}/albums/${album.id}/shared-links`, { method: 'POST' });
 					created++;
-				} catch (err: any) {
-					snackError(`Failed to create link for "${album.name}": ${err.message}`);
+				} catch (err: unknown) {
+					snackError(`Failed to create link for "${album.name}": ${errMsg(err)}`);
 				}
 			}
 		}
@@ -251,7 +324,7 @@
 			await api(`/notification-trackers/${tracker.id}`, { method: 'PUT', body: JSON.stringify({ enabled: !tracker.enabled }) });
 			await load();
 			snackSuccess(tracker.enabled ? t('snack.trackerPaused') : t('snack.trackerResumed'));
-		} catch (err: any) { snackError(err.message); } finally { toggling = { ...toggling, [tracker.id]: false }; }
+		} catch (err: unknown) { snackError(errMsg(err)); } finally { toggling = { ...toggling, [tracker.id]: false }; }
 	}
 
 	function startDelete(tracker: Tracker) { confirmDelete = tracker; }
@@ -262,7 +335,7 @@
 			await api(`/notification-trackers/${confirmDelete.id}`, { method: 'DELETE' });
 			await load();
 			snackSuccess(t('snack.trackerDeleted'));
-		} catch (err: any) { error = err.message; snackError(err.message); }
+		} catch (err: unknown) { const __m = errMsg(err); error = __m; snackError(__m); }
 		confirmDelete = null;
 	}
 
@@ -302,6 +375,54 @@
 		return desc?.collectionMeta ? t(desc.collectionMeta.countLabel) : t('notificationTracker.collections_count');
 	}
 
+	/**
+	 * Meta tiles for a tracker row. Visible on lg+ in the dead middle space
+	 * between identity and actions. Mirrors the secondary text shown on narrow
+	 * screens, but as live tiles users can scan at a glance.
+	 */
+	function trackerTiles(tracker: Tracker): MetaTile[] {
+		const tiles: MetaTile[] = [];
+		const trkDesc = getDescriptor(getProviderType(tracker));
+		// Status — armed/paused with color tone
+		tiles.push(tracker.enabled
+			? { icon: 'mdiPulse', label: t('notificationTracker.armed'), tone: 'mint' }
+			: { icon: 'mdiPauseCircleOutline', label: t('notificationTracker.paused'), tone: 'citrus' });
+		// Provider
+		tiles.push({
+			icon: 'mdiServer',
+			label: getProviderName(tracker.provider_id),
+			tone: 'lavender',
+		});
+		// Collections — count + label (varies per provider descriptor)
+		const collCount = (tracker.collection_ids || []).length;
+		if (collCount > 0 || !trkDesc?.webhookBased) {
+			tiles.push({
+				icon: 'mdiFolderMultipleOutline',
+				value: String(collCount),
+				label: getCollectionLabel(tracker),
+				tone: 'sky',
+			});
+		}
+		// Scan interval — only meaningful for polling trackers
+		if (!trkDesc?.webhookBased) {
+			tiles.push({
+				icon: 'mdiTimerOutline',
+				value: `${tracker.scan_interval}s`,
+				label: t('notificationTracker.every').trim(),
+				tone: 'orchid',
+			});
+		}
+		// Linked targets
+		const tgtCount = (tracker.tracker_targets || []).length;
+		tiles.push({
+			icon: 'mdiTarget',
+			value: String(tgtCount),
+			label: t('notificationTracker.linkedTargets'),
+			tone: tgtCount > 0 ? 'mint' : 'coral',
+		});
+		return tiles;
+	}
+
 	function configsForTracker(tracker: Tracker, configs: (TrackingConfig | TemplateConfig)[]): (TrackingConfig | TemplateConfig)[] {
 		const pt = getProviderType(tracker);
 		return pt ? configs.filter((c) => c.provider_type === pt) : configs;
@@ -330,7 +451,7 @@
 			newLinkTemplateConfigId[trackerId] = 0;
 			await load();
 			snackSuccess(t('snack.targetLinked'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 		addingTarget = { ...addingTarget, [trackerId]: false };
 	}
 
@@ -339,7 +460,7 @@
 			await api(`/notification-trackers/${trackerId}/targets/${ttId}`, { method: 'DELETE' });
 			await load();
 			snackSuccess(t('snack.targetUnlinked'));
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
 	async function updateTargetLink(trackerId: number, tt: TrackerTarget, field: string, value: string | number | boolean | null) {
@@ -349,7 +470,7 @@
 				body: JSON.stringify({ [field]: value }),
 			});
 			await load();
-		} catch (err: any) { snackError(err.message); }
+		} catch (err: unknown) { snackError(errMsg(err)); }
 	}
 
 	async function testTrackerTarget(trackerId: number, ttId: number, testType: string) {
@@ -371,8 +492,8 @@
 			} else {
 				snackSuccess(t('snack.targetTestSent'));
 			}
-		} catch (err: any) {
-			snackError(err.message);
+		} catch (err: unknown) {
+			snackError(errMsg(err));
 		} finally {
 			ttTesting = { ...ttTesting, [key]: '' };
 		}
@@ -392,7 +513,15 @@
 	}
 </script>
 
-<PageHeader title={t('notificationTracker.title')} description={t('notificationTracker.description')}>
+<PageHeader
+	title={t('notificationTracker.title')}
+	emphasis={t('notificationTracker.titleEmphasis')}
+	description={t('notificationTracker.description')}
+	crumb={t('crumbs.routingNotification')}
+	count={notificationTrackers.length}
+	countLabel={t('dashboard.trackersShort')}
+	pills={headerPills}
+>
 	<Button size="sm" onclick={() => { showForm ? (showForm = false, editing = null) : openNew(); }}>
 		{showForm ? t('notificationTracker.cancel') : t('notificationTracker.newTracker')}
 	</Button>
@@ -409,6 +538,7 @@
 		bind:form
 		{providerItems}
 		{collections}
+		{users}
 		bind:collectionFilter
 		trackingConfigItems={trackingConfigs.filter(c => !selectedProviderType || c.provider_type === selectedProviderType).map(c => ({ value: c.id, label: c.name, icon: (c as any).icon || 'mdiCog' }))}
 		templateConfigItems={templateConfigs.filter(c => !selectedProviderType || c.provider_type === selectedProviderType).map(c => ({ value: c.id, label: c.name, icon: (c as any).icon || 'mdiFileDocumentEdit' }))}
@@ -420,6 +550,7 @@
 		onsave={save}
 		ontoggleCollection={toggleCollection}
 		{formatDate}
+		onnameinput={() => nameManuallyEdited = true}
 	/>
 {/if}
 
@@ -446,24 +577,30 @@
 		<EmptyState icon="mdiFilterOff" message={t('common.noFilterResults')} />
 	</Card>
 {:else if !showForm}
-	<div class="space-y-3 stagger-children">
+	<div class="list-stack stagger-children">
 		{#each notificationTrackers as tracker (tracker.id)}
+			{@const trkDesc = getDescriptor(getProviderType(tracker))}
 			<Card hover entityId={tracker.id}>
-				<div class="flex items-center justify-between">
-					<div>
-						<div class="flex items-center gap-2">
-							<span style="color: var(--color-primary);"><MdiIcon name={tracker.icon || 'mdiRadar'} size={20} /></span>
-							<p class="font-medium">{tracker.name}</p>
-							<span class="text-xs px-1.5 py-0.5 rounded {tracker.enabled ? 'bg-[var(--color-success-bg)] text-[var(--color-success-fg)]' : 'bg-[var(--color-muted)] text-[var(--color-muted-foreground)]'}">
+				<div class="list-row">
+					<div class="list-row__identity">
+						<div class="flex items-center gap-2 min-w-0">
+							<span style="color: var(--color-primary);" class="shrink-0"><MdiIcon name={tracker.icon || 'mdiRadar'} size={20} /></span>
+							<p class="font-medium truncate">{tracker.name}</p>
+							<span class="text-xs px-1.5 py-0.5 rounded shrink-0 {tracker.enabled ? 'bg-[var(--color-success-bg)] text-[var(--color-success-fg)]' : 'bg-[var(--color-muted)] text-[var(--color-muted-foreground)]'}">
 								{tracker.enabled ? t('notificationTracker.active') : t('notificationTracker.paused')}
 							</span>
-						<CrossLink href="/providers" icon="mdiServer" label={getProviderName(tracker.provider_id)} entityId={tracker.provider_id} />
 						</div>
-						<p class="text-sm text-[var(--color-muted-foreground)]">
-							{(tracker.collection_ids || []).length} {getCollectionLabel(tracker)} · {t('notificationTracker.every')} {tracker.scan_interval}s · {(tracker.tracker_targets || []).length} {t('notificationTracker.linkedTargets')}
-						</p>
+						<div class="list-row__secondary mt-0.5">
+							<CrossLink href="/providers" icon="mdiServer" label={getProviderName(tracker.provider_id)} entityId={tracker.provider_id} />
+							<p class="text-sm text-[var(--color-muted-foreground)]">
+								{(tracker.collection_ids || []).length} {getCollectionLabel(tracker)} ·
+								{#if !trkDesc?.webhookBased}{t('notificationTracker.every')} {tracker.scan_interval}s ·{/if}
+								{(tracker.tracker_targets || []).length} {t('notificationTracker.linkedTargets')}
+							</p>
+						</div>
 					</div>
-					<div class="flex items-center gap-1 flex-wrap justify-end">
+					<MetaStrip tiles={trackerTiles(tracker)} />
+					<div class="list-row__actions flex-wrap justify-end">
 						<IconButton icon="mdiPencil" title={t('common.edit')} onclick={() => edit(tracker)} />
 						<IconButton icon={tracker.enabled ? 'mdiPause' : 'mdiPlay'} title={tracker.enabled ? t('notificationTracker.pause') : t('notificationTracker.resume')} onclick={() => toggle(tracker)} disabled={toggling[tracker.id]} />
 						<button onclick={() => toggleExpand(tracker.id)}
@@ -516,6 +653,15 @@
 	onclose={() => { linkWarning = null; }}
 	onautoCreate={autoCreateLinks}
 	ondismiss={dismissLinkWarning}
+	onupdate={(remaining) => {
+		if (!linkWarning) return;
+		if (remaining.length === 0) {
+			linkWarning = null;
+			doSave();
+		} else {
+			linkWarning = { ...linkWarning, albums: remaining };
+		}
+	}}
 />
 
 <ConfirmModal

frontend/src/routes/notification-trackers/LinkedTargetsSection.svelte

@@ -129,13 +129,13 @@
 					<div class="px-2.5 pb-2.5" in:slide={{ duration: 150 }}>
 						<div class="grid grid-cols-2 gap-2">
 							<div>
-								<label class="block text-xs text-[var(--color-muted-foreground)] mb-1">{t('trackingConfig.title')}</label>
+								<div class="block text-xs text-[var(--color-muted-foreground)] mb-1">{t('trackingConfig.title')}</div>
 								<EntitySelect items={trackingConfigItems} value={tt.tracking_config_id}
 									placeholder={t('common.noneDefault')} size="sm" allowNone noneLabel={t('common.noneDefault')}
 									onselect={(v) => onupdateLink(tt, 'tracking_config_id', Number(v) || null)} />
 							</div>
 							<div>
-								<label class="block text-xs text-[var(--color-muted-foreground)] mb-1">{t('templateConfig.title')}</label>
+								<div class="block text-xs text-[var(--color-muted-foreground)] mb-1">{t('templateConfig.title')}</div>
 								<EntitySelect items={templateConfigItems} value={tt.template_config_id}
 									placeholder={t('common.noneDefault')} size="sm" allowNone noneLabel={t('common.noneDefault')}
 									onselect={(v) => onupdateLink(tt, 'template_config_id', Number(v) || null)} />

frontend/src/routes/notification-trackers/SharedLinkModal.svelte

@@ -1,17 +1,50 @@
 <script lang="ts">
 	import { t } from '$lib/i18n';
+	import { api , errMsg} from '$lib/api';
+	import { snackError, snackSuccess } from '$lib/stores/snackbar.svelte';
 	import Modal from '$lib/components/Modal.svelte';
 	import MdiIcon from '$lib/components/MdiIcon.svelte';
 
+	interface AlbumIssue { id: string; name: string; issue: string }
+
 	interface Props {
-		linkWarning: { albums: any[]; providerId: number } | null;
+		linkWarning: { albums: AlbumIssue[]; providerId: number } | null;
 		linkCreating: boolean;
 		onclose: () => void;
 		onautoCreate: () => void;
 		ondismiss: () => void;
+		/** Called with the updated warning list after a per-row replace. */
+		onupdate?: (albums: AlbumIssue[]) => void;
 	}
 
-	let { linkWarning, linkCreating, onclose, onautoCreate, ondismiss }: Props = $props();
+	let { linkWarning, linkCreating, onclose, onautoCreate, ondismiss, onupdate }: Props = $props();
+
+	/** Per-row loading state for the "Replace" button. */
+	let replacing = $state<Record<string, boolean>>({});
+
+	/**
+	 * Expired and password-protected links can't be repaired in place — the
+	 * Immich API has no "reset" endpoint. The only remedy is to recreate the
+	 * link (which the backend does by POSTing a new one and returning it).
+	 * We surface the action per-row so users don't have to leave the form.
+	 */
+	async function replaceOne(album: AlbumIssue) {
+		if (!linkWarning) return;
+		replacing = { ...replacing, [album.id]: true };
+		try {
+			await api(`/providers/${linkWarning.providerId}/albums/${album.id}/shared-links`, {
+				method: 'POST',
+				body: JSON.stringify({ replace: true }),
+			});
+			snackSuccess(t('notificationTracker.createdLinks').replace('{count}', '1'));
+			const remaining = linkWarning.albums.filter(a => a.id !== album.id);
+			if (onupdate) onupdate(remaining);
+		} catch (err: unknown) {
+			snackError(t('notificationTracker.linkReplaceFailed').replace('{name}', album.name) + ': ' + errMsg(err));
+		} finally {
+			replacing = { ...replacing, [album.id]: false };
+		}
+	}
 </script>
 
 <Modal open={linkWarning !== null} title={t('notificationTracker.missingLinksTitle')} onclose={onclose}>
@@ -19,13 +52,26 @@
 		<p class="text-sm mb-3" style="color: var(--color-muted-foreground);">
 			{t('notificationTracker.missingLinksDesc')}
 		</p>
-		<div class="space-y-1.5 mb-4 max-h-40 overflow-y-auto">
+		<div class="space-y-1.5 mb-4 max-h-60 overflow-y-auto">
 			{#each linkWarning.albums as album}
-				<div class="flex items-center justify-between text-sm px-2 py-1.5 rounded bg-[var(--color-muted)]/30">
-					<span class="font-medium">{album.name}</span>
-					<span class="text-xs px-1.5 py-0.5 rounded {album.issue === 'expired' ? 'bg-[var(--color-error-bg)] text-[var(--color-error-fg)]' : album.issue === 'password-protected' ? 'bg-[var(--color-warning-bg)] text-[var(--color-warning-fg)]' : 'bg-[var(--color-muted)] text-[var(--color-muted-foreground)]'}">
+				<div class="flex items-center justify-between gap-2 text-sm px-2 py-1.5 rounded bg-[var(--color-muted)]/30">
+					<div class="flex-1 min-w-0">
+						<span class="font-medium truncate block">{album.name}</span>
+						{#if album.issue === 'password-protected'}
+							<span class="text-[10px] block" style="color: var(--color-muted-foreground);">
+								{t('notificationTracker.linkPasswordProtectedNote')}
+							</span>
+						{/if}
+					</div>
+					<span class="text-xs px-1.5 py-0.5 rounded shrink-0 {album.issue === 'expired' ? 'bg-[var(--color-error-bg)] text-[var(--color-error-fg)]' : album.issue === 'password-protected' ? 'bg-[var(--color-warning-bg)] text-[var(--color-warning-fg)]' : 'bg-[var(--color-muted)] text-[var(--color-muted-foreground)]'}">
 						{album.issue === 'expired' ? t('notificationTracker.expired') : album.issue === 'password-protected' ? t('notificationTracker.passwordProtected') : t('notificationTracker.noLink')}
 					</span>
+					{#if album.issue === 'expired' || album.issue === 'password-protected'}
+						<button type="button" onclick={() => replaceOne(album)} disabled={replacing[album.id]}
+							class="text-xs px-2 py-1 rounded border border-[var(--color-border)] hover:bg-[var(--color-muted)] disabled:opacity-50 shrink-0">
+							{replacing[album.id] ? t('notificationTracker.linkReplacing') : t('notificationTracker.linkReplace')}
+						</button>
+					{/if}
 				</div>
 			{/each}
 		</div>

frontend/src/routes/notification-trackers/TestMenu.svelte

@@ -6,7 +6,13 @@
 		testMenuOpen: string | null;
 		testMenuStyle: string;
 		ttTesting: Record<string, string>;
-		testTypes: { key: string; icon: string; labelKey: string }[];
+		/**
+		 * When `disabledReason` is set, the button is rendered greyed out with a
+		 * tooltip pointing the user at the missing setting (e.g. "Enable Periodic
+		 * Summary in Tracking Config first"). Clicking is blocked — clicking an
+		 * unconfigured test would have surfaced as a silent server-side skip.
+		 */
+		testTypes: { key: string; icon: string; labelKey: string; disabledReason?: string }[];
 		ontest: (ttId: number, testType: string) => void;
 		onclose: () => void;
 	}
@@ -20,18 +26,27 @@
 		onclick={onclose}
 		onkeydown={(e) => { if (e.key === 'Escape') onclose(); }}>
 	</div>
-	<div style="{testMenuStyle} background:var(--color-card); border:1px solid var(--color-border); border-radius:0.5rem; box-shadow:0 10px 25px rgba(0,0,0,0.3); padding:0.25rem; min-width:10rem;">
+	<div style="{testMenuStyle} background:var(--color-card); border:1px solid var(--color-border); border-radius:0.5rem; box-shadow:0 10px 25px rgba(0,0,0,0.3); padding:0.25rem; min-width:12rem;">
 		{#each testTypes as tt}
+			{@const busy = !!ttTesting[`${testMenuOpen}_${tt.key}`]}
+			{@const blocked = !!tt.disabledReason}
 			<button
-				onclick={() => ontest(Number(testMenuOpen), tt.key)}
-				disabled={!!ttTesting[`${testMenuOpen}_${tt.key}`]}
+				onclick={() => { if (!blocked) ontest(Number(testMenuOpen), tt.key); }}
+				disabled={busy || blocked}
+				title={blocked ? t(tt.disabledReason!) : ''}
 				class="flex items-center gap-2 w-full px-3 py-1.5 text-sm rounded hover:bg-[var(--color-muted)] transition-colors disabled:opacity-50 text-left">
 				<MdiIcon name={tt.icon} size={14} />
 				{t(tt.labelKey)}
-				{#if ttTesting[`${testMenuOpen}_${tt.key}`]}
+				{#if blocked}
+					<MdiIcon name="mdiLock" size={12} />
+				{/if}
+				{#if busy}
 					<span class="ml-auto text-xs text-[var(--color-muted-foreground)]">...</span>
 				{/if}
 			</button>
+			{#if blocked}
+				<p class="px-3 pb-1 text-[10px]" style="color: var(--color-muted-foreground);">{t(tt.disabledReason!)}</p>
+			{/if}
 		{/each}
 	</div>
 {/if}

frontend/src/routes/notification-trackers/TrackerForm.svelte

@@ -4,8 +4,10 @@
 	import Card from '$lib/components/Card.svelte';
 	import IconPicker from '$lib/components/IconPicker.svelte';
 	import Hint from '$lib/components/Hint.svelte';
+	import MdiIcon from '$lib/components/MdiIcon.svelte';
 	import EntitySelect from '$lib/components/EntitySelect.svelte';
 	import MultiEntitySelect from '$lib/components/MultiEntitySelect.svelte';
+	import TagInput from '$lib/components/TagInput.svelte';
 	import { getDescriptor } from '$lib/providers';
 
 	interface Props {
@@ -15,13 +17,14 @@
 			provider_id: number;
 			collection_ids: string[];
 			scan_interval: number;
-			batch_duration: number;
+			adaptive_max_skip: number | null;
 			default_tracking_config_id: number;
 			default_template_config_id: number;
 			filters: Record<string, any>;
 		};
 		providerItems: { value: number; label: string; icon: string; desc: string }[];
 		collections: any[];
+		users?: { id: string; name: string }[];
 		collectionFilter?: string;
 		trackingConfigItems?: { value: number; label: string; icon: string }[];
 		templateConfigItems?: { value: number; label: string; icon: string }[];
@@ -33,12 +36,14 @@
 		onsave: (e: SubmitEvent) => void;
 		ontoggleCollection?: (collectionId: string) => void;
 		formatDate?: (dateStr: string) => string;
+		onnameinput?: () => void;
 	}
 
 	let {
 		form = $bindable(),
 		providerItems,
 		collections,
+		users = [],
 		collectionFilter = $bindable(),
 		trackingConfigItems = [],
 		templateConfigItems = [],
@@ -50,12 +55,40 @@
 		onsave,
 		ontoggleCollection,
 		formatDate,
+		onnameinput,
 	}: Props = $props();
 
 	let descriptor = $derived(getDescriptor(providerType));
-	let isScheduler = $derived(providerType === 'scheduler');
-	let isWebhook = $derived(descriptor?.webhookBased ?? false);
 	let colMeta = $derived(descriptor?.collectionMeta);
+	// Providers without a collection (currently just the scheduler) drive the
+	// scheduler-specific form layout. Reading from the descriptor keeps the
+	// branch out of the component and lets a future provider opt in by
+	// declaring `collectionMeta: null`.
+	let isScheduler = $derived(colMeta == null);
+	let isWebhook = $derived(descriptor?.webhookBased ?? false);
+
+	/**
+	 * Resolve `{tracking_config_id}` / `{template_config_id}` placeholders in a
+	 * descriptor-declared CTA href. When the corresponding form field is unset
+	 * (value 0), strip the entire `?edit=...` query so the link still goes to
+	 * the list page. Centralising this here avoids per-provider href logic
+	 * leaking back into the template.
+	 */
+	function resolveHintHref(href: string): string {
+		const tcId = form.default_tracking_config_id;
+		const tplId = form.default_template_config_id;
+		if (href.includes('{tracking_config_id}')) {
+			return tcId
+				? href.replace('{tracking_config_id}', String(tcId))
+				: href.split('?')[0];
+		}
+		if (href.includes('{template_config_id}')) {
+			return tplId
+				? href.replace('{template_config_id}', String(tplId))
+				: href.split('?')[0];
+		}
+		return href;
+	}
 
 	// Custom variable management for scheduler
 	function addVariable() {
@@ -92,16 +125,16 @@
 			<label for="trk-name" class="block text-sm font-medium mb-1">{t('notificationTracker.name')}</label>
 			<div class="flex gap-2">
 				<IconPicker value={form.icon} onselect={(v: string) => form.icon = v} />
-				<input id="trk-name" bind:value={form.name} required placeholder={t('notificationTracker.namePlaceholder')} class="flex-1 px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
+				<input id="trk-name" bind:value={form.name} oninput={() => onnameinput?.()} required placeholder={t('notificationTracker.namePlaceholder')} class="flex-1 px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
 			</div>
 		</div>
 		<div>
-			<label class="block text-sm font-medium mb-1">{t('notificationTracker.server')}</label>
+			<div class="block text-sm font-medium mb-1">{t('notificationTracker.server')}</div>
 			<EntitySelect items={providerItems} bind:value={form.provider_id} placeholder={t('notificationTracker.selectServer')} />
 		</div>
 		{#if !isScheduler && colMeta && collections.length > 0}
 			<div>
-				<label class="block text-sm font-medium mb-1">{t(colMeta.label)}</label>
+				<div class="block text-sm font-medium mb-1">{t(colMeta.label)}</div>
 				<MultiEntitySelect
 					items={collections.map(col => ({
 						value: col.id,
@@ -115,6 +148,31 @@
 			</div>
 		{/if}
 
+		{#if descriptor?.userFilters && descriptor.userFilters.length > 0}
+			{@const userItems = users.map(u => ({ value: u.id, label: u.name }))}
+			{#each descriptor.userFilters as uf (uf.key)}
+				{@const filterKey = uf.filterKey ?? uf.key}
+				<div>
+					<div class="block text-sm font-medium mb-1">{t(uf.label)}</div>
+					{#if uf.inputMode === 'tags'}
+						<TagInput
+							values={form.filters[filterKey] || []}
+							onchange={(vals) => form.filters = { ...form.filters, [filterKey]: vals }}
+							placeholder={t(uf.placeholder)}
+							icon={uf.icon}
+						/>
+					{:else}
+						<MultiEntitySelect
+							items={userItems.map(i => ({ ...i, icon: uf.icon }))}
+							values={form.filters[filterKey] || []}
+							onchange={(vals) => form.filters = { ...form.filters, [filterKey]: vals }}
+							placeholder={t(uf.placeholder)}
+						/>
+					{/if}
+				</div>
+			{/each}
+		{/if}
+
 		{#if isScheduler}
 			<!-- Schedule type -->
 			<fieldset class="border border-[var(--color-border)] rounded-md p-3">
@@ -167,19 +225,19 @@
 					class="text-xs text-[var(--color-primary)] hover:underline mt-1">+ {t('notificationTracker.addVariable')}</button>
 			</fieldset>
 		{:else}
+		{#if !isWebhook}
 		<div class="grid grid-cols-2 gap-3">
-			{#if !isWebhook}
 			<div>
 				<label for="trk-interval" class="block text-sm font-medium mb-1">{t('notificationTracker.scanInterval')}<Hint text={t('hints.scanInterval')} /></label>
 				<input id="trk-interval" type="number" bind:value={form.scan_interval} min="10" max="3600" class="w-full px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
 			</div>
-			{/if}
 			<div>
-				<label for="trk-batch" class="block text-sm font-medium mb-1">{t('notificationTracker.batchDuration')}<Hint text={t('hints.batchDuration')} /></label>
-				<input id="trk-batch" type="number" bind:value={form.batch_duration} min="0" max="3600" class="w-full px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
+				<label for="trk-adaptive" class="block text-sm font-medium mb-1">{t('notificationTracker.adaptiveMaxSkip')}<Hint text={t('hints.adaptiveMaxSkip')} /></label>
+				<input id="trk-adaptive" type="number" bind:value={form.adaptive_max_skip} min="0" max="10" placeholder={t('notificationTracker.adaptiveMaxSkipPlaceholder')} class="w-full px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
 			</div>
 		</div>
 		{/if}
+		{/if}
 
 		<!-- Default configs -->
 		{#if trackingConfigItems.length > 0 || templateConfigItems.length > 0}
@@ -199,6 +257,32 @@
 		</div>
 		{/if}
 
+		<!-- Feature discovery: the periodic/scheduled/memory/quiet-hours controls
+		     live on the tracking config, not on the tracker itself. The hint
+		     content (message + CTAs) is declared on the provider descriptor so
+		     each provider can surface its own discoverability links without
+		     embedding `if (type === 'xyz')` here. -->
+		{#if descriptor?.featureDiscoveryHint}
+		{@const hint = descriptor.featureDiscoveryHint}
+		<div class="flex items-start gap-2 rounded-md border border-[var(--color-border)] bg-[var(--color-muted)]/30 px-3 py-2">
+			<span style="color: var(--color-primary);"><MdiIcon name="mdiInformationOutline" size={16} /></span>
+			<div class="flex-1 text-xs">
+				<p style="color: var(--color-muted-foreground);">{t(hint.messageKey)}</p>
+				{#if hint.ctas && hint.ctas.length > 0}
+					<div class="flex flex-wrap gap-x-4 gap-y-1 mt-1">
+						{#each hint.ctas as cta}
+							<a href={resolveHintHref(cta.href)}
+								class="inline-flex items-center gap-1 text-[var(--color-primary)] hover:underline">
+								<MdiIcon name={cta.icon ?? 'mdiArrowRight'} size={12} />
+								{t(cta.labelKey)}
+							</a>
+						{/each}
+					</div>
+				{/if}
+			</div>
+		</div>
+		{/if}
+
 		<button type="submit" disabled={submitting || linkCheckLoading} class="px-4 py-2 bg-[var(--color-primary)] text-[var(--color-primary-foreground)] rounded-md text-sm font-medium hover:opacity-90 disabled:opacity-50">
 			{#if linkCheckLoading}{t('notificationTracker.checkingLinks')}{:else}{editing ? t('common.save') : t('notificationTracker.createTracker')}{/if}
 		</button>

frontend/src/routes/providers/+page.svelte

@@ -1,9 +1,9 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
 	import { slide } from 'svelte/transition';
-	import { api, getBlockedBy, type BlockedByDetail } from '$lib/api';
+	import { api, getBlockedBy, type BlockedByDetail , errMsg} from '$lib/api';
 	import { t } from '$lib/i18n';
-	import { providersCache } from '$lib/stores/caches.svelte';
+	import { providersCache, externalUrlCache } from '$lib/stores/caches.svelte';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import Card from '$lib/components/Card.svelte';
 	import Loading from '$lib/components/Loading.svelte';
@@ -19,10 +19,13 @@
 
 	const gridItemSources: Record<string, () => any[]> = { webhookAuthModeItems };
 	import { globalProviderFilter } from '$lib/stores/provider-filter.svelte';
-	import { snackSuccess, snackError } from '$lib/stores/snackbar.svelte';
+	import { topbarAction } from '$lib/stores/topbar-action.svelte';
+	import { onDestroy } from 'svelte';
+	import { snackSuccess, snackError, snackInfo } from '$lib/stores/snackbar.svelte';
 	import { highlightFromUrl } from '$lib/highlight';
 	import { getDescriptor, buildProviderFormDefaults } from '$lib/providers';
 	import Button from '$lib/components/Button.svelte';
+	import MetaStrip, { type MetaTile } from '$lib/components/MetaStrip.svelte';
 	import WebhookPayloadHistory from './WebhookPayloadHistory.svelte';
 	import type { ServiceProvider } from '$lib/types';
 
@@ -43,6 +46,91 @@
 	let confirmDelete = $state<ServiceProvider | null>(null);
 
 	let descriptor = $derived(getDescriptor(form.type));
+	let externalUrl = $derived(externalUrlCache.value);
+
+	function buildWebhookUrl(pattern: string, token: string): string {
+		const path = pattern.replace('{token}', token ?? '');
+		return externalUrl ? `${externalUrl}${path}` : path;
+	}
+
+	/**
+	 * Build meta tiles for a provider row. Filled into the dead middle space
+	 * on wide displays; on narrow screens the secondary text line takes over.
+	 */
+	function providerTiles(provider: ServiceProvider): MetaTile[] {
+		const tiles: MetaTile[] = [];
+		const h = health[provider.id];
+		const provDesc = getDescriptor(provider.type);
+		// Status — first tile, color-coded
+		if (h === true) {
+			tiles.push({ icon: 'mdiCheckCircle', label: t('providers.online'), tone: 'mint' });
+		} else if (h === false) {
+			tiles.push({ icon: 'mdiCloseCircle', label: t('providers.offline'), tone: 'coral' });
+		} else {
+			tiles.push({ icon: 'mdiTimerSand', label: t('providers.checking'), tone: 'citrus' });
+		}
+		// Type / connection address
+		const cfg = provider.config as Record<string, any> | undefined;
+		if (cfg?.url) {
+			tiles.push({
+				icon: 'mdiLinkVariant',
+				label: shortenUrl(cfg.url),
+				hint: cfg.url,
+				href: cfg.url,
+				tone: 'sky',
+				mono: true,
+			});
+		} else if (cfg?.host) {
+			tiles.push({
+				icon: 'mdiServer',
+				label: `${cfg.host}:${cfg.port || 3493}`,
+				tone: 'sky',
+				mono: true,
+			});
+		}
+		// Webhook URL (copy to clipboard)
+		if (provDesc?.webhookUrlPattern) {
+			const webhookUrl = buildWebhookUrl(provDesc.webhookUrlPattern, provider.webhook_token);
+			tiles.push({
+				icon: 'mdiContentCopy',
+				label: t('providers.webhookUrl'),
+				hint: webhookUrl,
+				tone: 'orchid',
+				onclick: (e) => copyWebhookUrl(e, webhookUrl),
+			});
+		}
+		return tiles;
+	}
+
+	/** Trim the visible URL so it fits a meta tile; keep host + first path segment. */
+	function shortenUrl(url: string): string {
+		try {
+			const u = new URL(url);
+			const segments = u.pathname.split('/').filter(Boolean);
+			const tail = segments.length ? `/${segments[0]}${segments.length > 1 ? '/…' : ''}` : '';
+			return `${u.host}${tail}`;
+		} catch {
+			return url.length > 32 ? `${url.slice(0, 30)}…` : url;
+		}
+	}
+
+	function copyWebhookUrl(e: Event, url: string) {
+		e.preventDefault();
+		e.stopPropagation();
+		if (navigator.clipboard?.writeText) {
+			navigator.clipboard.writeText(url);
+		} else {
+			const ta = document.createElement('textarea');
+			ta.value = url;
+			ta.style.position = 'fixed';
+			ta.style.opacity = '0';
+			document.body.appendChild(ta);
+			ta.select();
+			document.execCommand('copy');
+			document.body.removeChild(ta);
+		}
+		snackInfo(`${t('snack.copied')}: ${url}`);
+	}
 
 	// Auto-update name when provider type changes (unless user manually edited)
 	$effect(() => {
@@ -54,13 +142,35 @@
 
 	let health = $state<Record<number, boolean | null>>({});
 
-	onMount(load);
+	// Status pill row for the page header — derived from health probes.
+	const headerPills = $derived.by(() => {
+		const onlineCount = Object.values(health).filter(v => v === true).length;
+		const offlineCount = Object.values(health).filter(v => v === false).length;
+		const checkingCount = Math.max(0, providers.length - onlineCount - offlineCount);
+		const typeCount = new Set(providers.map(p => p.type)).size;
+		const pills: Array<{ label: string; tone: 'mint' | 'sky' | 'coral' | 'citrus' }> = [];
+		if (onlineCount > 0) pills.push({ label: `${onlineCount} ${t('providers.online')}`, tone: 'mint' });
+		if (offlineCount > 0) pills.push({ label: `${offlineCount} ${t('providers.offline')}`, tone: 'coral' });
+		if (checkingCount > 0 && providers.length > 0) pills.push({ label: `${checkingCount} ${t('providers.checking')}`, tone: 'citrus' });
+		if (typeCount > 0) pills.push({ label: `${typeCount} ${typeCount === 1 ? t('providers.typeSingular') : t('providers.typePlural')}`, tone: 'sky' });
+		return pills;
+	});
+
+	onMount(() => {
+		topbarAction.set({
+			label: t('providers.addProvider'),
+			onclick: () => { showForm ? (showForm = false, editing = null) : openNew(); },
+		});
+		load();
+		externalUrlCache.fetch().catch(() => { /* fall back to relative URLs */ });
+	});
+	onDestroy(() => topbarAction.clear());
 	async function load() {
 		try {
 			await providersCache.fetch(true);
 			loadError = '';
-		} catch (err: any) {
-			loadError = err.message || t('providers.loadError');
+		} catch (err: unknown) {
+			loadError = errMsg(err, t('providers.loadError'));
 		} finally { loaded = true; highlightFromUrl(); }
 		// Ping all providers in background (use unfiltered list)
 		for (const p of allProviders) {
@@ -127,7 +237,7 @@
 			}
 			showForm = false; editing = null; providersCache.invalidate(); await load();
 			snackSuccess(t('snack.providerSaved'));
-		} catch (err: any) { error = err.message; snackError(err.message); }
+		} catch (err: unknown) { const __m = errMsg(err); error = __m; snackError(__m); }
 		submitting = false;
 	}
 
@@ -138,15 +248,23 @@
 		const id = confirmDelete.id;
 		confirmDelete = null;
 		try { await api(`/providers/${id}`, { method: 'DELETE' }); providersCache.invalidate(); await load(); snackSuccess(t('snack.providerDeleted')); }
-		catch (err: any) {
+		catch (err: unknown) {
 			const bb = getBlockedBy(err);
 			if (bb) { blockedBy = bb; return; }
-			error = err.message; snackError(err.message);
+			const m = errMsg(err); error = m; snackError(m);
 		}
 	}
 </script>
 
-<PageHeader title={t('providers.title')} description={t('providers.description')}>
+<PageHeader
+	title={t('providers.title')}
+	emphasis={t('providers.titleEmphasis')}
+	description={t('providers.description')}
+	crumb={t('crumbs.serviceConnections')}
+	count={providers.length}
+	countLabel={t('dashboard.providersShort')}
+	pills={headerPills}
+>
 	<Button size="sm" onclick={() => { showForm ? (showForm = false, editing = null) : openNew(); }}>
 		{showForm ? t('providers.cancel') : t('providers.addProvider')}
 	</Button>
@@ -166,12 +284,12 @@
 {/if}
 
 {#if showForm}
-	<div in:slide={{ duration: 200 }}>
+	<div in:slide={{ duration: 200 }} class="list-stack">
 	<Card class="mb-6">
 		<ErrorBanner message={error} />
 		<form onsubmit={save} class="space-y-3">
 			<div>
-				<label class="block text-sm font-medium mb-1">{t('providers.type')}</label>
+				<div class="block text-sm font-medium mb-1">{t('providers.type')}</div>
 				{#if !editing}
 					<IconGridSelect items={providerTypeItems()} bind:value={form.type} columns={2} />
 				{:else}
@@ -203,6 +321,11 @@
 					<input id="prv-{field.key}" type="number" bind:value={form[field.key]}
 						min={field.min} max={field.max}
 						class="w-full px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
+				{:else if field.type === 'toggle'}
+					<label class="toggle-switch">
+						<input id="prv-{field.key}" type="checkbox" bind:checked={form[field.key]} />
+						<span class="toggle-track"></span>
+					</label>
 				{:else}
 					<input id="prv-{field.key}" type={field.type} bind:value={form[field.key]}
 						required={field.required === true || (field.required === 'create-only' && !editing)}
@@ -215,9 +338,15 @@
 			</div>
 			{/each}
 			{#if descriptor?.webhookUrlPattern && editing}
+			{@const editingWebhookUrl = buildWebhookUrl(descriptor.webhookUrlPattern, providers.find(p => p.id === editing)?.webhook_token ?? '')}
 			<div class="bg-[var(--color-muted)] rounded-md p-3">
-				<label class="block text-sm font-medium mb-1">{t('providers.webhookUrl')}</label>
-				<code class="text-xs select-all break-all">{descriptor.webhookUrlPattern.replace('{token}', providers.find(p => p.id === editing)?.webhook_token ?? '')}</code>
+				<div class="block text-sm font-medium mb-1">{t('providers.webhookUrl')}</div>
+				<button type="button"
+					onclick={(e) => copyWebhookUrl(e, editingWebhookUrl)}
+					title={t('providers.webhookUrlCopyTitle')}
+					class="text-xs break-all text-left hover:text-[var(--color-primary)] cursor-pointer font-mono w-full">
+					<code class="bg-transparent">{editingWebhookUrl}</code>
+				</button>
 				<p class="text-xs text-[var(--color-muted-foreground)] mt-1">{t('providers.webhookUrlHint')}</p>
 			</div>
 			{/if}
@@ -230,9 +359,11 @@
 {/if}
 
 {#if !showForm && allProviders.length > 0}
-<div class="flex items-center gap-2 mb-3">
-	<input type="text" bind:value={filterText} placeholder={t('common.filterByName')}
-		class="flex-1 px-3 py-1.5 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
+<div class="list-stack mb-3">
+	<div class="flex items-center gap-2">
+		<input type="text" bind:value={filterText} placeholder={t('common.filterByName')}
+			class="flex-1 px-3 py-1.5 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
+	</div>
 </div>
 {/if}
 
@@ -245,30 +376,43 @@
 		<EmptyState icon="mdiFilterOff" message={t('common.noFilterResults')} />
 	</Card>
 {:else}
-	<div class="space-y-3 stagger-children">
+	<div class="list-stack stagger-children">
 		{#each providers as provider}
 			{@const provDesc = getDescriptor(provider.type)}
 			<Card hover entityId={provider.id}>
-				<div class="flex items-center justify-between">
-					<div class="flex items-center gap-3">
-						<div class="health-dot {health[provider.id] === true ? 'online' : health[provider.id] === false ? 'offline' : 'checking'}"></div>
-						<span style="color: var(--color-primary);"><MdiIcon name={providerDefaultIcon(provider)} size={20} /></span>
-						<div>
-							<div class="flex items-center gap-2">
-								<p class="font-medium">{provider.name}</p>
-								<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)]">{provider.type}</span>
+				<div class="list-row">
+					<div class="list-row__identity">
+						<div class="flex items-center gap-3">
+							<div class="health-dot {health[provider.id] === true ? 'online' : health[provider.id] === false ? 'offline' : 'checking'}"></div>
+							<span style="color: var(--color-primary);"><MdiIcon name={providerDefaultIcon(provider)} size={20} /></span>
+							<div class="min-w-0">
+								<div class="flex items-center gap-2 min-w-0">
+									<p class="font-medium truncate">{provider.name}</p>
+									<span class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)] shrink-0">{provider.type}</span>
+								</div>
+								<!-- Narrow-screen secondary line (hidden on lg+ where MetaStrip takes over) -->
+								<div class="list-row__secondary">
+									{#if provider.config?.url}
+										<a href={provider.config.url} target="_blank" rel="noopener" class="text-xs text-[var(--color-muted-foreground)] font-mono hover:text-[var(--color-primary)] hover:underline break-all">{provider.config.url}</a>
+									{:else if provider.config?.host}
+										<p class="text-xs text-[var(--color-muted-foreground)] font-mono">{provider.config.host}:{provider.config.port || 3493}</p>
+									{/if}
+									{#if provDesc?.webhookUrlPattern}
+										{@const webhookUrl = buildWebhookUrl(provDesc.webhookUrlPattern, provider.webhook_token)}
+										<p class="text-xs text-[var(--color-muted-foreground)] font-mono mt-0.5">
+											{t('providers.webhookUrl')}:
+											<button type="button"
+												onclick={(e) => copyWebhookUrl(e, webhookUrl)}
+												title={t('providers.webhookUrlCopyTitle')}
+												class="hover:text-[var(--color-primary)] cursor-pointer break-all text-left">{webhookUrl}</button>
+										</p>
+									{/if}
+								</div>
 							</div>
-							{#if provider.config?.url}
-								<a href={provider.config.url} target="_blank" rel="noopener" class="text-xs text-[var(--color-muted-foreground)] font-mono hover:text-[var(--color-primary)] hover:underline">{provider.config.url}</a>
-							{:else if provider.config?.host}
-								<p class="text-xs text-[var(--color-muted-foreground)] font-mono">{provider.config.host}:{provider.config.port || 3493}</p>
-							{/if}
-							{#if provDesc?.webhookUrlPattern}
-								<p class="text-xs text-[var(--color-muted-foreground)] font-mono mt-0.5">{t('providers.webhookUrl')}: <span class="select-all">{provDesc.webhookUrlPattern.replace('{token}', provider.webhook_token)}</span></p>
-							{/if}
 						</div>
 					</div>
-					<div class="flex items-center gap-1">
+					<MetaStrip tiles={providerTiles(provider)} />
+					<div class="list-row__actions">
 						<IconButton icon="mdiPencil" title={t('common.edit')} onclick={() => edit(provider)} />
 						<IconButton icon="mdiDelete" title={t('common.delete')} onclick={() => startDelete(provider)} variant="danger" />
 					</div>

frontend/src/routes/providers/new/+page.svelte

@@ -78,7 +78,7 @@
 <Card>
 	<div class="space-y-4">
 		<div>
-			<label class="block text-sm font-medium mb-1">{t('providers.type')}</label>
+			<div class="block text-sm font-medium mb-1">{t('providers.type')}</div>
 			<IconGridSelect items={providerTypeItems()} bind:value={form.type} columns={2} />
 		</div>
 		<div>
@@ -107,6 +107,11 @@
 				{:else if field.type === 'number'}
 					<input id="prv-{field.key}" type="number" bind:value={form[field.key]} min={field.min} max={field.max}
 						class="w-full px-3 py-2 border border-[var(--color-border)] rounded-md text-sm bg-[var(--color-background)]" />
+				{:else if field.type === 'toggle'}
+					<label class="toggle-switch">
+						<input id="prv-{field.key}" type="checkbox" bind:checked={form[field.key]} />
+						<span class="toggle-track"></span>
+					</label>
 				{:else}
 					<input id="prv-{field.key}" type={field.type} bind:value={form[field.key]}
 						required={field.required === true || field.required === 'create-only'}

frontend/src/routes/settings/+page.svelte

@@ -2,17 +2,20 @@
 	import { onMount } from 'svelte';
 	import { api } from '$lib/api';
 	import { t } from '$lib/i18n';
-	import PageHeader from '$lib/components/PageHeader.svelte';
-	import Card from '$lib/components/Card.svelte';
 	import Loading from '$lib/components/Loading.svelte';
-	import MdiIcon from '$lib/components/MdiIcon.svelte';
-	import Hint from '$lib/components/Hint.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
-	import Button from '$lib/components/Button.svelte';
 	import ConfirmModal from '$lib/components/ConfirmModal.svelte';
-	import LocaleSelector from '$lib/components/LocaleSelector.svelte';
-	import TimezoneSelector from '$lib/components/TimezoneSelector.svelte';
 	import { snackSuccess, snackError } from '$lib/stores/snackbar.svelte';
+	import { externalUrlCache, releaseStatusCache } from '$lib/stores/caches.svelte';
+
+	import SettingsHero from './SettingsHero.svelte';
+	import IdentityCassette from './IdentityCassette.svelte';
+	import TelegramCassette from './TelegramCassette.svelte';
+	import ReleaseCassette from './ReleaseCassette.svelte';
+	import CacheLedger from './CacheLedger.svelte';
+	import LoggingCassette from './LoggingCassette.svelte';
+	import DiagnosticsCassette from './DiagnosticsCassette.svelte';
+	import SaveBar from './SaveBar.svelte';
 
 	interface CacheBucketStats {
 		count: number;
@@ -25,22 +28,65 @@
 		asset: CacheBucketStats;
 	}
 
-	let loaded = $state(false);
-	let saving = $state(false);
-	let clearingCache = $state(false);
-	let confirmClearCache = $state(false);
-	let error = $state('');
-	let settings = $state({
+	interface Settings {
+		external_url: string;
+		telegram_webhook_secret: string;
+		telegram_cache_ttl_hours: string;
+		telegram_asset_cache_max_entries: string;
+		supported_locales: string;
+		timezone: string;
+		log_level: string;
+		log_format: string;
+		log_levels: string;
+		release_provider_kind: string;
+		release_provider_url: string;
+		release_provider_repo: string;
+		release_include_prereleases: string;
+		release_check_interval_hours: string;
+	}
+
+	const EMPTY: Settings = {
 		external_url: '',
 		telegram_webhook_secret: '',
 		telegram_cache_ttl_hours: '720',
 		telegram_asset_cache_max_entries: '5000',
 		supported_locales: 'en,ru',
 		timezone: 'UTC',
-	});
+		log_level: 'INFO',
+		log_format: 'text',
+		log_levels: '',
+		release_provider_kind: 'gitea',
+		release_provider_url: 'https://git.dolgolyov-family.by',
+		release_provider_repo: 'alexei.dolgolyov/notify-bridge',
+		release_include_prereleases: '0',
+		release_check_interval_hours: '12',
+	};
+
+	let loaded = $state(false);
+	let saving = $state(false);
+	let clearingCache = $state(false);
+	let confirmClearCache = $state(false);
+	let error = $state('');
+
+	let settings = $state<Settings>({ ...EMPTY });
+	// Snapshot of the last server-known state, used for dirty tracking.
+	let baseline = $state<Settings>({ ...EMPTY });
 	let cacheStats = $state<CacheStats | null>(null);
 
-	async function loadCacheStats() {
+	// --- Dirty tracking -----------------------------------------------------
+
+	const dirtyKeys = $derived.by<Array<keyof Settings>>(() => {
+		const out: Array<keyof Settings> = [];
+		for (const key of Object.keys(settings) as Array<keyof Settings>) {
+			if (settings[key] !== baseline[key]) out.push(key);
+		}
+		return out;
+	});
+	const dirty = $derived(dirtyKeys.length > 0);
+
+	// --- Data loading -------------------------------------------------------
+
+	async function loadCacheStats(): Promise<void> {
 		try {
 			cacheStats = await api<CacheStats>('/settings/telegram-cache/stats');
 		} catch { cacheStats = null; }
@@ -48,172 +94,153 @@
 
 	onMount(async () => {
 		try {
-			settings = await api('/settings');
+			const fetched = await api<Settings>('/settings');
+			settings = { ...EMPTY, ...fetched };
+			baseline = { ...settings };
 			await loadCacheStats();
-		} catch (err: any) { error = err.message; snackError(err.message); }
-		finally { loaded = true; }
+			// Warm the release status so the cassette renders the strip on first paint.
+			await releaseStatusCache.fetch();
+		} catch (err: unknown) {
+			const msg = err instanceof Error ? err.message : 'Failed to load settings';
+			error = msg;
+			snackError(msg);
+		} finally {
+			loaded = true;
+		}
 	});
 
-	function formatBytes(bytes: number): string {
-		if (!bytes) return '0 B';
-		const units = ['B', 'KB', 'MB', 'GB'];
-		let i = 0;
-		let v = bytes;
-		while (v >= 1024 && i < units.length - 1) { v /= 1024; i++; }
-		return `${v.toFixed(v < 10 && i > 0 ? 1 : 0)} ${units[i]}`;
-	}
+	// --- Actions ------------------------------------------------------------
 
-	function formatTs(iso: string | null): string {
-		if (!iso) return '—';
-		const d = new Date(iso.endsWith('Z') || /[+-]\d{2}:?\d{2}$/.test(iso) ? iso : iso + 'Z');
-		return isNaN(d.getTime()) ? iso : d.toLocaleString();
-	}
-
-	async function save() {
-		saving = true; error = '';
+	async function save(): Promise<void> {
+		saving = true;
+		error = '';
 		try {
-			settings = await api('/settings', { method: 'PUT', body: JSON.stringify(settings) });
+			const next = await api<Settings>('/settings', {
+				method: 'PUT',
+				body: JSON.stringify(settings),
+			});
+			settings = { ...EMPTY, ...next };
+			baseline = { ...settings };
+			externalUrlCache.invalidate();
+			// Release config may have changed → drop the cached status and
+			// refetch so the sidebar badge + cassette strip reflect the
+			// freshly-rescheduled probe without waiting for the next route
+			// change to trigger another read.
+			releaseStatusCache.invalidate();
+			void releaseStatusCache.fetch(true);
 			snackSuccess(t('settings.saved'));
-		} catch (err: any) { error = err.message; snackError(err.message); }
-		saving = false;
+		} catch (err: unknown) {
+			const msg = err instanceof Error ? err.message : 'Save failed';
+			error = msg;
+			snackError(msg);
+		} finally {
+			saving = false;
+		}
 	}
 
-	async function clearTelegramCache() {
+	function discard(): void {
+		settings = { ...baseline };
+	}
+
+	async function clearTelegramCache(): Promise<void> {
 		confirmClearCache = false;
 		clearingCache = true;
 		try {
 			await api('/settings/telegram-cache/clear', { method: 'POST' });
 			snackSuccess(t('settings.clearCacheDone'));
 			await loadCacheStats();
-		} catch (err: any) { snackError(err.message); }
-		clearingCache = false;
+		} catch (err: unknown) {
+			const msg = err instanceof Error ? err.message : 'Clear cache failed';
+			snackError(msg);
+		} finally {
+			clearingCache = false;
+		}
 	}
+
+	const cacheMaxEntriesNum = $derived(
+		Math.max(0, Number(settings.telegram_asset_cache_max_entries || '0')),
+	);
 </script>
 
-<PageHeader title={t('settings.title')} description={t('settings.description')} />
+<SettingsHero {settings} />
 
 {#if !loaded}
 	<Loading />
 {:else}
 	<ErrorBanner message={error} />
-	<div class="space-y-6">
-		<!-- General section -->
-		<Card>
-			<h3 class="text-sm font-semibold mb-4 flex items-center gap-2">
-				<MdiIcon name="mdiCog" size={18} />
-				{t('settings.general')}
-			</h3>
-			<div class="space-y-3">
-				<div>
-					<label class="block text-xs font-medium mb-1">{t('settings.externalUrl')}<Hint text={t('settings.externalUrlHint')} /></label>
-					<input bind:value={settings.external_url} placeholder="https://notify.example.com"
-						class="w-full max-w-md px-3 py-1.5 text-sm border border-[var(--color-border)] rounded-md bg-[var(--color-background)] font-mono" />
-				</div>
-				<div>
-					<label class="block text-xs font-medium mb-2">{t('settings.timezone')}<Hint text={t('settings.timezoneHint')} /></label>
-					<TimezoneSelector bind:value={settings.timezone} />
-				</div>
-			</div>
-		</Card>
 
-		<!-- Telegram section -->
-		<Card>
-			<h3 class="text-sm font-semibold mb-4 flex items-center gap-2">
-				<MdiIcon name="mdiSend" size={18} />
-				{t('settings.telegram')}
-			</h3>
-			<div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
-				<div>
-					<label class="block text-xs font-medium mb-1">{t('settings.webhookSecret')}<Hint text={t('settings.webhookSecretHint')} /></label>
-					<form onsubmit={(e) => e.preventDefault()} autocomplete="off">
-						<input bind:value={settings.telegram_webhook_secret} type="password" autocomplete="off" placeholder={t('providers.optional')}
-							class="w-full px-3 py-1.5 text-sm border border-[var(--color-border)] rounded-md bg-[var(--color-background)] font-mono" />
-					</form>
-				</div>
-				<div>
-					<label class="block text-xs font-medium mb-1">{t('settings.cacheTtl')}<Hint text={t('settings.cacheTtlHint')} /></label>
-					<input bind:value={settings.telegram_cache_ttl_hours} type="number" min="0" max="8760"
-						class="w-full px-3 py-1.5 text-sm border border-[var(--color-border)] rounded-md bg-[var(--color-background)]" />
-				</div>
-				<div>
-					<label class="block text-xs font-medium mb-1">{t('settings.cacheMaxEntries')}<Hint text={t('settings.cacheMaxEntriesHint')} /></label>
-					<input bind:value={settings.telegram_asset_cache_max_entries} type="number" min="100" max="100000"
-						class="w-full px-3 py-1.5 text-sm border border-[var(--color-border)] rounded-md bg-[var(--color-background)]" />
-				</div>
-			</div>
-			<div class="mt-4 pt-4 border-t border-[var(--color-border)]">
-				<div class="text-xs font-medium mb-2 flex items-center" style="color: var(--color-muted-foreground);">
-					{t('settings.cacheStats')}<Hint text={t('settings.cacheStatsHint')} />
-				</div>
-				<div class="grid grid-cols-1 sm:grid-cols-2 gap-2 mb-3">
-					{#each [
-						{ label: t('settings.cacheStatsUrl'), data: cacheStats?.url },
-						{ label: t('settings.cacheStatsAsset'), data: cacheStats?.asset },
-					] as bucket}
-						<div class="px-3 py-2 rounded-md border border-[var(--color-border)] bg-[var(--color-background)] text-xs">
-							<div class="flex items-baseline justify-between gap-2">
-								<span class="font-medium">{bucket.label}</span>
-								{#if bucket.data && bucket.data.count > 0}
-									<span>
-										<span class="font-mono">{bucket.data.count}</span>
-										<span style="color: var(--color-muted-foreground);"> {t('settings.cacheStatsEntries')}</span>
-										{#if bucket.data.total_size_bytes > 0}
-											<span style="color: var(--color-muted-foreground);"> · </span>
-											<span class="font-mono">{formatBytes(bucket.data.total_size_bytes)}</span>
-										{/if}
-									</span>
-								{:else}
-									<span style="color: var(--color-muted-foreground);">{t('settings.cacheStatsEmpty')}</span>
-								{/if}
-							</div>
-							{#if bucket.data && bucket.data.count > 0 && (bucket.data.oldest || bucket.data.newest)}
-								<div class="mt-1 flex flex-wrap gap-x-3 gap-y-0.5" style="color: var(--color-muted-foreground);">
-									{#if bucket.data.oldest}
-										<span>{t('settings.cacheStatsOldest')}: <span class="font-mono">{formatTs(bucket.data.oldest)}</span></span>
-									{/if}
-									{#if bucket.data.newest}
-										<span>{t('settings.cacheStatsNewest')}: <span class="font-mono">{formatTs(bucket.data.newest)}</span></span>
-									{/if}
-								</div>
-							{/if}
-						</div>
-					{/each}
-				</div>
-				<div class="flex items-center gap-3 flex-wrap">
-					<button type="button" onclick={() => confirmClearCache = true} disabled={clearingCache}
-						class="inline-flex items-center gap-1.5 px-3 py-1.5 text-sm rounded-md border border-[var(--color-border)] bg-[var(--color-background)] hover:bg-[var(--color-muted)] disabled:opacity-50">
-						<MdiIcon name="mdiDeleteSweep" size={16} />
-						{clearingCache ? t('common.loading') : t('settings.clearCache')}
-					</button>
-					<span class="text-xs" style="color: var(--color-muted-foreground);">{t('settings.clearCacheHint')}</span>
-				</div>
-			</div>
-		</Card>
+	<div class="settings-page stagger-children">
+		<IdentityCassette
+			bind:externalUrl={settings.external_url}
+			bind:timezone={settings.timezone}
+			bind:supportedLocales={settings.supported_locales}
+		/>
 
-		<!-- Locales section -->
-		<Card>
-			<h3 class="text-sm font-semibold mb-4 flex items-center gap-2">
-				<MdiIcon name="mdiTranslate" size={18} />
-				{t('settings.locales')}
-			</h3>
-			<div class="space-y-3">
-				<div>
-					<label class="block text-xs font-medium mb-2">{t('settings.supportedLocales')}<Hint text={t('settings.supportedLocalesHint')} /></label>
-					<LocaleSelector bind:value={settings.supported_locales} />
-				</div>
-			</div>
-		</Card>
+		<div class="telegram-deck">
+			<TelegramCassette
+				bind:webhookSecret={settings.telegram_webhook_secret}
+				bind:cacheTtlHours={settings.telegram_cache_ttl_hours}
+				bind:cacheMaxEntries={settings.telegram_asset_cache_max_entries}
+			/>
+			<CacheLedger
+				stats={cacheStats}
+				clearing={clearingCache}
+				maxEntries={cacheMaxEntriesNum}
+				onRefresh={loadCacheStats}
+				onClear={() => (confirmClearCache = true)}
+			/>
+		</div>
 
-		<Button onclick={save} disabled={saving}>
-			{saving ? t('common.loading') : t('common.save')}
-		</Button>
+		<ReleaseCassette
+			bind:providerKind={settings.release_provider_kind}
+			bind:providerUrl={settings.release_provider_url}
+			bind:providerRepo={settings.release_provider_repo}
+			bind:includePrereleases={settings.release_include_prereleases}
+			bind:checkIntervalHours={settings.release_check_interval_hours}
+		/>
+
+		<LoggingCassette
+			bind:logLevel={settings.log_level}
+			bind:logFormat={settings.log_format}
+			bind:logLevels={settings.log_levels}
+		/>
+
+		<DiagnosticsCassette />
 	</div>
 
-	<ConfirmModal open={confirmClearCache}
-		title={t('settings.clearCacheConfirmTitle')}
-		message={t('settings.clearCacheConfirm')}
-		confirmLabel={t('settings.clearCacheConfirmBtn')}
-		confirmIcon="mdiDeleteSweep"
-		onconfirm={clearTelegramCache}
-		oncancel={() => confirmClearCache = false} />
+	<SaveBar
+		{dirty}
+		{saving}
+		changedCount={dirtyKeys.length}
+		onSave={save}
+		onDiscard={discard}
+	/>
 {/if}
+
+<ConfirmModal
+	open={confirmClearCache}
+	title={t('settings.clearCacheConfirmTitle')}
+	message={t('settings.clearCacheConfirm')}
+	confirmLabel={t('settings.clearCacheConfirmBtn')}
+	confirmIcon="mdiDeleteSweep"
+	onconfirm={clearTelegramCache}
+	oncancel={() => (confirmClearCache = false)}
+/>
+
+<style>
+	.settings-page {
+		display: flex;
+		flex-direction: column;
+		gap: 1.5rem;
+	}
+
+	.telegram-deck {
+		display: grid;
+		grid-template-columns: 1fr;
+		gap: 1.25rem;
+		align-items: stretch;
+	}
+	@media (min-width: 960px) {
+		.telegram-deck { grid-template-columns: 1fr 1fr; }
+	}
+</style>

frontend/src/routes/settings/CacheLedger.svelte

@@ -0,0 +1,406 @@
+<script lang="ts">
+	import { t } from '$lib/i18n';
+	import MdiIcon from '$lib/components/MdiIcon.svelte';
+	import Button from '$lib/components/Button.svelte';
+	import Hint from '$lib/components/Hint.svelte';
+
+	type Tone = 'mint' | 'sky' | 'citrus' | 'coral';
+
+	interface CacheBucketStats {
+		count: number;
+		total_size_bytes: number;
+		oldest: string | null;
+		newest: string | null;
+	}
+	interface CacheStats {
+		url: CacheBucketStats;
+		asset: CacheBucketStats;
+	}
+
+	interface Props {
+		stats: CacheStats | null;
+		clearing: boolean;
+		maxEntries: number;
+		onRefresh: () => void;
+		onClear: () => void;
+	}
+
+	let { stats, clearing, maxEntries, onRefresh, onClear }: Props = $props();
+
+	function formatBytes(bytes: number): string {
+		if (!bytes) return '0 B';
+		const units = ['B', 'KB', 'MB', 'GB'];
+		let i = 0;
+		let v = bytes;
+		while (v >= 1024 && i < units.length - 1) { v /= 1024; i++; }
+		return `${v.toFixed(v < 10 && i > 0 ? 1 : 0)} ${units[i]}`;
+	}
+
+	function parseDate(iso: string | null): Date | null {
+		if (!iso) return null;
+		const d = new Date(iso.endsWith('Z') || /[+-]\d{2}:?\d{2}$/.test(iso) ? iso : iso + 'Z');
+		return isNaN(d.getTime()) ? null : d;
+	}
+
+	function relativeTime(iso: string | null): string {
+		const date = parseDate(iso);
+		if (!date) return '';
+		const diffSec = Math.max(0, (Date.now() - date.getTime()) / 1000);
+		if (diffSec < 60) return t('dashboard.justNow');
+		const min = Math.floor(diffSec / 60);
+		if (min < 60) return t('dashboard.minutesAgo').replace('{n}', String(min));
+		const hr = Math.floor(min / 60);
+		if (hr < 24) return t('dashboard.hoursAgo').replace('{n}', String(hr));
+		const day = Math.floor(hr / 24);
+		return t('dashboard.daysAgo').replace('{n}', String(day));
+	}
+
+	function ageTone(iso: string | null): Tone {
+		const date = parseDate(iso);
+		if (!date) return 'mint';
+		const hours = (Date.now() - date.getTime()) / 3_600_000;
+		if (hours < 48) return 'mint';
+		if (hours < 24 * 7) return 'sky';
+		if (hours < 24 * 30) return 'citrus';
+		return 'coral';
+	}
+
+	interface BucketRow {
+		key: 'url' | 'asset';
+		labelKey: string;
+		icon: string;
+		data: CacheBucketStats | null;
+	}
+
+	const buckets = $derived<BucketRow[]>([
+		{ key: 'url', labelKey: 'settings.cacheStatsUrl', icon: 'mdiLinkVariant', data: stats?.url ?? null },
+		{ key: 'asset', labelKey: 'settings.cacheStatsAsset', icon: 'mdiImageMultipleOutline', data: stats?.asset ?? null },
+	]);
+
+	const totalCount = $derived(
+		(stats?.url.count ?? 0) + (stats?.asset.count ?? 0),
+	);
+	const totalBytes = $derived(
+		(stats?.url.total_size_bytes ?? 0) + (stats?.asset.total_size_bytes ?? 0),
+	);
+	const fillPct = $derived.by(() => {
+		const max = Math.max(1, maxEntries);
+		const each = totalCount / 2; // two buckets share the cap conceptually; use whichever is fuller
+		const top = Math.max(stats?.url.count ?? 0, stats?.asset.count ?? 0);
+		void each; // explicit ack we considered both
+		return Math.min(100, Math.round((top / max) * 100));
+	});
+</script>
+
+<section class="ledger glass">
+	<header class="ledger-head">
+		<div class="ledger-summary">
+			<div class="ledger-eyebrow">
+				<MdiIcon name="mdiDatabaseClockOutline" size={12} />
+				<span>{t('settings.cacheStats')}</span>
+			</div>
+			<div class="ledger-numbers">
+				<span class="ledger-count font-mono">{totalCount.toLocaleString()}</span>
+				<span class="ledger-count-label">{t('settings.cacheStatsEntries')}</span>
+				{#if totalBytes > 0}
+					<span class="ledger-sep">·</span>
+					<span class="ledger-bytes font-mono">{formatBytes(totalBytes)}</span>
+					<Hint text={t('settings.cacheStatsHint')} />
+				{/if}
+			</div>
+		</div>
+		<div class="ledger-actions">
+			<button
+				type="button"
+				class="icon-btn"
+				onclick={onRefresh}
+				aria-label={t('common.refresh', 'Refresh')}
+				title={t('common.refresh', 'Refresh')}
+			>
+				<MdiIcon name="mdiRefresh" size={16} />
+			</button>
+		</div>
+	</header>
+
+	<!-- Capacity meter (peak bucket vs configured cap) -->
+	{#if maxEntries > 0}
+		<div class="meter" aria-label={t('settings.cacheCapacity')}>
+			<div class="meter-track">
+				<div class="meter-fill" style="width: {fillPct}%"></div>
+			</div>
+			<span class="meter-text font-mono">
+				{fillPct}% · {t('settings.cacheCapacityCap').replace('{n}', maxEntries.toLocaleString())}
+			</span>
+		</div>
+	{/if}
+
+	<!-- Bucket rows -->
+	<ol class="ledger-list">
+		{#each buckets as bucket (bucket.key)}
+			{@const data = bucket.data}
+			{@const empty = !data || data.count === 0}
+			{@const tone = empty ? 'mint' : ageTone(data?.oldest ?? null)}
+			<li class="row" data-tone={tone} class:row-empty={empty}>
+				<span class="row-edge" aria-hidden="true"></span>
+				<span class="row-icon" aria-hidden="true">
+					<MdiIcon name={bucket.icon} size={16} />
+				</span>
+				<div class="row-text">
+					<span class="row-name">{t(bucket.labelKey)}</span>
+					{#if empty}
+						<span class="row-meta">{t('settings.cacheStatsEmpty')}</span>
+					{:else if data}
+						<span class="row-meta">
+							<span>
+								<span class="font-mono">{data.count.toLocaleString()}</span>
+								{t('settings.cacheStatsEntries')}
+							</span>
+							{#if data.total_size_bytes > 0}
+								<span class="row-sep">·</span>
+								<span class="font-mono">{formatBytes(data.total_size_bytes)}</span>
+							{/if}
+							{#if data.oldest}
+								<span class="row-sep">·</span>
+								<span>{t('settings.cacheStatsOldest')} {relativeTime(data.oldest)}</span>
+							{/if}
+						</span>
+					{/if}
+				</div>
+				<span class="row-dot" aria-hidden="true"></span>
+			</li>
+		{/each}
+	</ol>
+
+	<footer class="ledger-foot">
+		<Button size="sm" variant="secondary" onclick={onClear} disabled={clearing || totalCount === 0}>
+			{#if clearing}
+				<MdiIcon name="mdiLoading" size={14} />
+			{:else}
+				<MdiIcon name="mdiDeleteSweep" size={14} />
+			{/if}
+			{clearing ? t('common.loading') : t('settings.clearCache')}
+		</Button>
+		<span class="foot-hint">{t('settings.clearCacheHint')}</span>
+	</footer>
+</section>
+
+<style>
+	.ledger {
+		padding: 1.4rem 1.5rem 1.25rem;
+		display: flex;
+		flex-direction: column;
+		gap: 1rem;
+		min-height: 100%;
+	}
+	.ledger-head {
+		position: relative;
+		z-index: 1;
+		display: flex;
+		align-items: flex-end;
+		justify-content: space-between;
+		gap: 1rem;
+		flex-wrap: wrap;
+	}
+	.ledger-summary { min-width: 0; }
+	.ledger-eyebrow {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.35rem;
+		font-family: var(--font-mono);
+		font-size: 0.6rem;
+		text-transform: uppercase;
+		letter-spacing: 0.18em;
+		color: var(--color-muted-foreground);
+		margin-bottom: 0.4rem;
+	}
+	.ledger-numbers {
+		display: flex;
+		align-items: baseline;
+		gap: 0.45rem;
+		line-height: 1;
+		flex-wrap: wrap;
+	}
+	.ledger-count {
+		font-size: 1.7rem;
+		font-weight: 500;
+		letter-spacing: -0.025em;
+		color: var(--color-foreground);
+		font-variant-numeric: tabular-nums;
+	}
+	.ledger-count-label {
+		font-size: 0.62rem;
+		text-transform: uppercase;
+		letter-spacing: 0.16em;
+		color: var(--color-muted-foreground);
+	}
+	.ledger-sep { color: var(--color-muted-foreground); opacity: 0.5; }
+	.ledger-bytes {
+		font-size: 0.78rem;
+		color: var(--color-muted-foreground);
+	}
+	.ledger-actions {
+		display: flex;
+		align-items: center;
+		gap: 0.4rem;
+	}
+
+	.icon-btn {
+		width: 30px; height: 30px;
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		border-radius: 8px;
+		background: transparent;
+		border: 1px solid transparent;
+		color: var(--color-muted-foreground);
+		cursor: pointer;
+		transition: background 0.15s, color 0.15s, border-color 0.15s;
+	}
+	.icon-btn:hover:not(:disabled) {
+		background: var(--color-glass-strong);
+		color: var(--color-foreground);
+		border-color: var(--color-border);
+	}
+
+	/* --- Capacity meter --- */
+	.meter {
+		position: relative;
+		z-index: 1;
+		display: flex;
+		align-items: center;
+		gap: 0.65rem;
+	}
+	.meter-track {
+		flex: 1;
+		height: 6px;
+		border-radius: 999px;
+		background: var(--color-glass-strong);
+		border: 1px solid var(--color-border);
+		overflow: hidden;
+		position: relative;
+	}
+	.meter-fill {
+		height: 100%;
+		background: linear-gradient(90deg, var(--color-mint), var(--color-sky));
+		border-radius: inherit;
+		transition: width 0.4s cubic-bezier(.2,.7,.2,1);
+		box-shadow: 0 0 8px color-mix(in srgb, var(--color-sky) 40%, transparent);
+	}
+	.meter-text {
+		font-size: 0.62rem;
+		color: var(--color-muted-foreground);
+		letter-spacing: 0.04em;
+		white-space: nowrap;
+	}
+
+	/* --- Bucket rows --- */
+	.ledger-list {
+		position: relative;
+		z-index: 1;
+		list-style: none;
+		padding: 0;
+		margin: 0;
+		display: flex;
+		flex-direction: column;
+		gap: 0.4rem;
+	}
+	.row {
+		position: relative;
+		display: grid;
+		grid-template-columns: auto 1fr auto;
+		align-items: center;
+		gap: 0.85rem;
+		padding: 0.7rem 0.95rem 0.7rem 1.1rem;
+		border-radius: 14px;
+		border: 1px solid var(--color-border);
+		background: var(--color-glass-strong);
+		transition: transform 0.18s, border-color 0.18s, background 0.18s;
+		overflow: hidden;
+	}
+	.row:hover {
+		transform: translateY(-1px);
+		border-color: var(--color-rule-strong);
+		background: var(--color-glass-elev);
+	}
+	.row.row-empty { opacity: 0.78; }
+
+	.row-edge {
+		position: absolute;
+		left: 0; top: 0; bottom: 0;
+		width: 3px;
+		opacity: 0.85;
+	}
+	.row[data-tone="mint"] .row-edge   { background: var(--color-mint); }
+	.row[data-tone="sky"] .row-edge    { background: var(--color-sky); }
+	.row[data-tone="citrus"] .row-edge { background: var(--color-citrus); }
+	.row[data-tone="coral"] .row-edge  { background: var(--color-coral); }
+
+	.row-icon {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		width: 30px; height: 30px;
+		border-radius: 9px;
+		background: var(--color-glass);
+		color: var(--color-foreground);
+	}
+	.row[data-tone="mint"] .row-icon   { color: var(--color-mint); }
+	.row[data-tone="sky"] .row-icon    { color: var(--color-sky); }
+	.row[data-tone="citrus"] .row-icon { color: var(--color-citrus); }
+	.row[data-tone="coral"] .row-icon  { color: var(--color-coral); }
+
+	.row-text {
+		display: flex;
+		flex-direction: column;
+		gap: 0.15rem;
+		min-width: 0;
+	}
+	.row-name {
+		font-size: 0.85rem;
+		font-weight: 500;
+		color: var(--color-foreground);
+		letter-spacing: -0.005em;
+	}
+	.row-meta {
+		font-size: 0.7rem;
+		color: var(--color-muted-foreground);
+		display: inline-flex;
+		flex-wrap: wrap;
+		gap: 0.35rem;
+	}
+	.row-sep { opacity: 0.45; }
+
+	.row-dot {
+		width: 8px; height: 8px;
+		border-radius: 50%;
+		flex-shrink: 0;
+	}
+	.row[data-tone="mint"] .row-dot   { background: var(--color-mint); box-shadow: 0 0 8px color-mix(in srgb, var(--color-mint) 50%, transparent); }
+	.row[data-tone="sky"] .row-dot    { background: var(--color-sky); box-shadow: 0 0 8px color-mix(in srgb, var(--color-sky) 50%, transparent); }
+	.row[data-tone="citrus"] .row-dot { background: var(--color-citrus); box-shadow: 0 0 8px color-mix(in srgb, var(--color-citrus) 50%, transparent); }
+	.row[data-tone="coral"] .row-dot  { background: var(--color-coral); box-shadow: 0 0 8px color-mix(in srgb, var(--color-coral) 50%, transparent); }
+
+	/* --- Footer --- */
+	.ledger-foot {
+		position: relative;
+		z-index: 1;
+		display: flex;
+		align-items: center;
+		gap: 0.85rem;
+		flex-wrap: wrap;
+		padding-top: 0.4rem;
+		margin-top: auto;
+	}
+	.foot-hint {
+		font-size: 0.7rem;
+		color: var(--color-muted-foreground);
+		flex: 1;
+		min-width: 12rem;
+		line-height: 1.4;
+	}
+
+	@media (prefers-reduced-motion: reduce) {
+		.row, .meter-fill { transition: none !important; }
+		.row:hover { transform: none !important; }
+	}
+</style>

frontend/src/routes/settings/DiagnosticsCassette.svelte

@@ -0,0 +1,424 @@
+<script lang="ts">
+	import { onMount, onDestroy } from 'svelte';
+	import { slide } from 'svelte/transition';
+	import { api } from '$lib/api';
+	import { t } from '$lib/i18n';
+	import MdiIcon from '$lib/components/MdiIcon.svelte';
+	import IconButton from '$lib/components/IconButton.svelte';
+	import IconGridSelect from '$lib/components/IconGridSelect.svelte';
+	import { snackSuccess, snackError } from '$lib/stores/snackbar.svelte';
+
+	interface ActiveOverride {
+		module: string;
+		baseline_level: string;
+		current_level: string;
+		activated_at: string;
+		expires_at: string;
+		remaining_seconds: number;
+	}
+
+	// Modules ship with shortcuts; users can also type a freeform name
+	// matching the backend allowlist (notify_bridge_*, sqlalchemy.*, etc.).
+	// Icons let the IconGridSelect render each entry as a visual chip
+	// instead of a bare text list — same pattern as the surrounding
+	// log-level / log-format selectors.
+	const QUICK_MODULES: { value: string; icon: string; label: string; desc?: string }[] = [
+		{ value: 'notify_bridge_core.notifications.telegram.client', icon: 'mdiSend', label: 'Telegram client' },
+		{ value: 'notify_bridge_core.notifications.dispatcher', icon: 'mdiCallSplit', label: 'Dispatcher' },
+		{ value: 'notify_bridge_core.providers.immich', icon: 'mdiImageMultiple', label: 'Immich provider' },
+		{ value: 'notify_bridge_server.services.watcher', icon: 'mdiEyeOutline', label: 'Watcher' },
+		{ value: 'notify_bridge_server.services.deferred_dispatch', icon: 'mdiClockOutline', label: 'Deferred dispatch' },
+		{ value: 'notify_bridge_server.services.scheduled_dispatch', icon: 'mdiCalendarClock', label: 'Scheduled dispatch' },
+		{ value: 'sqlalchemy.engine', icon: 'mdiDatabase', label: 'SQLAlchemy engine (SQL)' },
+		{ value: 'aiohttp.client', icon: 'mdiWeb', label: 'aiohttp client' },
+	];
+
+	const DURATION_PRESETS: { minutes: number; label: string }[] = [
+		{ minutes: 5, label: '5m' },
+		{ minutes: 15, label: '15m' },
+		{ minutes: 30, label: '30m' },
+		{ minutes: 60, label: '1h' },
+		{ minutes: 120, label: '2h' },
+	];
+
+	let active = $state<ActiveOverride[]>([]);
+	let pickedModule = $state(QUICK_MODULES[0].value);
+	let customModule = $state('');
+	let pickedMinutes = $state(30);
+	let submitting = $state(false);
+	let tickHandle: ReturnType<typeof setInterval> | null = null;
+	// Resync from the backend every N seconds so a server-side auto-revert
+	// is reflected even if we missed a tick. Tracked as elapsed-time so the
+	// 1s ticker can drift without breaking the cadence.
+	const RESYNC_EVERY_SECONDS = 30;
+	let lastResyncAt = Date.now();
+
+	async function refresh(): Promise<void> {
+		try {
+			const data = await api<{ active: ActiveOverride[] }>(
+				'/settings/diagnostic-mode',
+				{ method: 'GET' },
+			);
+			active = data.active || [];
+		} catch (err: unknown) {
+			// Surface non-401 errors only; settings page already shows a banner
+			// when the API is unreachable.
+		}
+	}
+
+	function tick(): void {
+		// Cheap local countdown so the UI doesn't poll the server every second
+		// to render a clock. The full refresh happens every 30s OR on action.
+		if (active.length === 0) return;
+		const now = Date.now();
+		active = active
+			.map(a => ({
+				...a,
+				remaining_seconds: Math.max(
+					0,
+					Math.floor((new Date(a.expires_at).getTime() - now) / 1000),
+				),
+			}))
+			.filter(a => a.remaining_seconds > 0);
+	}
+
+	function startTicker(): void {
+		if (tickHandle != null) return;
+		tickHandle = setInterval(() => {
+			tick();
+			const now = Date.now();
+			if (now - lastResyncAt >= RESYNC_EVERY_SECONDS * 1000) {
+				lastResyncAt = now;
+				void refresh();
+			}
+		}, 1000);
+	}
+
+	function stopTicker(): void {
+		if (tickHandle != null) {
+			clearInterval(tickHandle);
+			tickHandle = null;
+		}
+	}
+
+	onMount(() => {
+		lastResyncAt = Date.now();
+		void refresh();
+		startTicker();
+	});
+
+	onDestroy(() => {
+		stopTicker();
+	});
+
+	function effectiveModule(): string {
+		return (customModule.trim() || pickedModule).trim();
+	}
+
+	async function activate(): Promise<void> {
+		const mod = effectiveModule();
+		if (!mod) {
+			snackError(t('settings.diagModuleRequired'));
+			return;
+		}
+		submitting = true;
+		try {
+			const entry = await api<ActiveOverride>('/settings/diagnostic-mode', {
+				method: 'POST',
+				body: JSON.stringify({ module: mod, duration_minutes: pickedMinutes }),
+			});
+			// Replace any existing row for this module with the new schedule.
+			active = [
+				...active.filter(a => a.module !== entry.module),
+				entry,
+			];
+			customModule = '';
+			snackSuccess(t('settings.diagActivated'));
+		} catch (err: unknown) {
+			const msg = err instanceof Error ? err.message : String(err);
+			snackError(msg || t('settings.diagActivateFailed'));
+		} finally {
+			submitting = false;
+		}
+	}
+
+	async function revert(module: string): Promise<void> {
+		try {
+			await api(`/settings/diagnostic-mode/${encodeURIComponent(module)}`, {
+				method: 'DELETE',
+			});
+			active = active.filter(a => a.module !== module);
+			snackSuccess(t('settings.diagReverted'));
+		} catch (err: unknown) {
+			const msg = err instanceof Error ? err.message : String(err);
+			snackError(msg || t('settings.diagRevertFailed'));
+		}
+	}
+
+	function formatRemaining(seconds: number): string {
+		if (seconds <= 0) return '0s';
+		const mins = Math.floor(seconds / 60);
+		const secs = seconds % 60;
+		if (mins >= 60) {
+			const hours = Math.floor(mins / 60);
+			const remMins = mins % 60;
+			return `${hours}h ${remMins}m`;
+		}
+		if (mins > 0) return `${mins}m ${secs}s`;
+		return `${secs}s`;
+	}
+</script>
+
+<section class="diag glass">
+	<header class="diag-head">
+		<div class="diag-eyebrow">
+			<MdiIcon name="mdiBugOutline" size={12} />
+			<span>{t('settings.diagnostics')}</span>
+		</div>
+		<h3 class="diag-title">{t('settings.diagnosticsHeadline')}</h3>
+		<p class="diag-sub">{t('settings.diagnosticsHint')}</p>
+	</header>
+
+	<!-- Compose new override -->
+	<div class="diag-compose">
+		<div class="diag-label">
+			<span>{t('settings.diagModuleQuick')}</span>
+			<IconGridSelect items={QUICK_MODULES} bind:value={pickedModule} columns={2} compact />
+		</div>
+
+		<label class="diag-label">
+			<span>{t('settings.diagModuleCustom')}</span>
+			<input
+				bind:value={customModule}
+				type="text"
+				autocomplete="off"
+				spellcheck="false"
+				placeholder={t('settings.diagModuleCustomPlaceholder')}
+				class="diag-input"
+			/>
+		</label>
+
+		<div class="diag-label">
+			<span>{t('settings.diagDuration')}</span>
+			<div class="diag-duration-chips">
+				{#each DURATION_PRESETS as preset (preset.minutes)}
+					<button
+						type="button"
+						class="diag-chip"
+						class:diag-chip-active={pickedMinutes === preset.minutes}
+						onclick={() => (pickedMinutes = preset.minutes)}
+					>
+						{preset.label}
+					</button>
+				{/each}
+			</div>
+		</div>
+
+		<button
+			type="button"
+			onclick={activate}
+			disabled={submitting}
+			class="diag-activate"
+		>
+			<MdiIcon name="mdiPlay" size={14} />
+			<span>{submitting ? t('common.loading') : t('settings.diagActivate')}</span>
+		</button>
+	</div>
+
+	<!-- Active overrides list -->
+	{#if active.length > 0}
+		<div class="diag-active" in:slide={{ duration: 180 }}>
+			<div class="diag-active-head">
+				<MdiIcon name="mdiTimerSandComplete" size={12} />
+				<span>{t('settings.diagActive')}</span>
+			</div>
+			{#each active as ov (ov.module)}
+				<div class="diag-row">
+					<div class="diag-row-info">
+						<code class="diag-row-module">{ov.module}</code>
+						<span class="diag-row-meta">
+							{t('settings.diagRevertsIn')} <strong>{formatRemaining(ov.remaining_seconds)}</strong>
+							<span class="diag-row-baseline">→ {ov.baseline_level}</span>
+						</span>
+					</div>
+					<IconButton
+						icon="mdiUndoVariant"
+						title={t('settings.diagRevertNow')}
+						onclick={() => revert(ov.module)}
+						size={16}
+					/>
+				</div>
+			{/each}
+		</div>
+	{/if}
+</section>
+
+<style>
+	.diag {
+		padding: 1.5rem 1.6rem 1.4rem;
+		display: flex;
+		flex-direction: column;
+		gap: 1.15rem;
+	}
+	.diag-head {
+		position: relative;
+		z-index: 1;
+	}
+	.diag-eyebrow {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.35rem;
+		font-family: var(--font-mono);
+		font-size: 0.62rem;
+		text-transform: uppercase;
+		letter-spacing: 0.18em;
+		color: var(--color-muted-foreground);
+		margin-bottom: 0.45rem;
+	}
+	.diag-title {
+		margin: 0;
+		font-family: var(--font-display);
+		font-style: italic;
+		font-weight: 400;
+		font-size: 1.15rem;
+		line-height: 1.35;
+		letter-spacing: -0.015em;
+		color: var(--color-foreground);
+		max-width: 38ch;
+	}
+	.diag-sub {
+		margin: 0.45rem 0 0 0;
+		font-size: 0.78rem;
+		color: var(--color-muted-foreground);
+		max-width: 56ch;
+	}
+	.diag-compose {
+		position: relative;
+		z-index: 1;
+		display: flex;
+		flex-direction: column;
+		gap: 0.7rem;
+		padding-top: 0.4rem;
+		border-top: 1px solid var(--color-border);
+	}
+	.diag-label {
+		display: flex;
+		flex-direction: column;
+		gap: 0.32rem;
+	}
+	.diag-label > span {
+		font-size: 0.74rem;
+		font-weight: 500;
+		color: var(--color-foreground);
+	}
+	.diag-input {
+		width: 100%;
+		font-family: var(--font-mono);
+		font-size: 0.78rem;
+		padding: 0.45rem 0.7rem;
+		border: 1px solid var(--color-border);
+		border-radius: 8px;
+		background: var(--color-glass);
+		color: var(--color-foreground);
+	}
+	.diag-duration-chips {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.35rem;
+	}
+	.diag-chip {
+		padding: 0.32rem 0.75rem;
+		border-radius: 999px;
+		border: 1px solid var(--color-border);
+		background: transparent;
+		color: var(--color-muted-foreground);
+		font-family: var(--font-mono);
+		font-size: 0.72rem;
+		cursor: pointer;
+		transition: background 0.15s, color 0.15s, border-color 0.15s;
+	}
+	.diag-chip:hover {
+		background: var(--color-glass-strong);
+		color: var(--color-foreground);
+	}
+	.diag-chip-active {
+		background: color-mix(in srgb, var(--color-primary) 12%, transparent);
+		color: var(--color-primary);
+		border-color: color-mix(in srgb, var(--color-primary) 45%, var(--color-border));
+	}
+	.diag-activate {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		gap: 0.4rem;
+		align-self: flex-start;
+		padding: 0.55rem 1.1rem;
+		border-radius: 10px;
+		border: 1px solid color-mix(in srgb, var(--color-primary) 45%, var(--color-border));
+		background: color-mix(in srgb, var(--color-primary) 12%, transparent);
+		color: var(--color-primary);
+		font-family: var(--font-display);
+		font-style: italic;
+		font-size: 0.85rem;
+		cursor: pointer;
+		transition: background 0.15s, color 0.15s, border-color 0.15s;
+	}
+	.diag-activate:hover {
+		background: color-mix(in srgb, var(--color-primary) 18%, transparent);
+		border-color: color-mix(in srgb, var(--color-primary) 65%, var(--color-border));
+	}
+	.diag-activate:disabled {
+		opacity: 0.5;
+		cursor: not-allowed;
+	}
+
+	.diag-active {
+		display: flex;
+		flex-direction: column;
+		gap: 0.4rem;
+		padding-top: 0.55rem;
+		border-top: 1px solid var(--color-border);
+	}
+	.diag-active-head {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.3rem;
+		font-family: var(--font-mono);
+		font-size: 0.58rem;
+		text-transform: uppercase;
+		letter-spacing: 0.18em;
+		color: var(--color-muted-foreground);
+	}
+	.diag-row {
+		display: flex;
+		align-items: center;
+		justify-content: space-between;
+		gap: 0.6rem;
+		padding: 0.5rem 0.65rem;
+		border-radius: 10px;
+		border: 1px solid var(--color-border);
+		background: var(--color-glass-strong);
+	}
+	.diag-row-info {
+		display: flex;
+		flex-direction: column;
+		gap: 0.2rem;
+		min-width: 0;
+	}
+	.diag-row-module {
+		font-family: var(--font-mono);
+		font-size: 0.78rem;
+		color: var(--color-foreground);
+		word-break: break-all;
+	}
+	.diag-row-meta {
+		font-size: 0.72rem;
+		color: var(--color-muted-foreground);
+	}
+	.diag-row-baseline {
+		font-family: var(--font-mono);
+		font-size: 0.7rem;
+		margin-left: 0.4rem;
+		opacity: 0.7;
+	}
+</style>

frontend/src/routes/settings/IdentityCassette.svelte

@@ -0,0 +1,277 @@
+<script lang="ts">
+	import { t } from '$lib/i18n';
+	import MdiIcon from '$lib/components/MdiIcon.svelte';
+	import Hint from '$lib/components/Hint.svelte';
+	import LocaleSelector from '$lib/components/LocaleSelector.svelte';
+	import TimezoneSelector from '$lib/components/TimezoneSelector.svelte';
+	import { snackSuccess } from '$lib/stores/snackbar.svelte';
+
+	interface Props {
+		externalUrl: string;
+		timezone: string;
+		supportedLocales: string;
+	}
+
+	let {
+		externalUrl = $bindable(),
+		timezone = $bindable(),
+		supportedLocales = $bindable(),
+	}: Props = $props();
+
+	let copied = $state(false);
+	let copyTimer: ReturnType<typeof setTimeout> | null = null;
+
+	function copyUrl(): void {
+		if (!externalUrl) return;
+		try {
+			navigator.clipboard.writeText(externalUrl);
+			copied = true;
+			snackSuccess(t('settings.urlCopied'));
+			if (copyTimer) clearTimeout(copyTimer);
+			copyTimer = setTimeout(() => { copied = false; }, 1600);
+		} catch { /* ignore */ }
+	}
+
+	function isReachable(url: string): boolean {
+		if (!url) return false;
+		try { new URL(url); return true; } catch { return false; }
+	}
+
+	const urlValid = $derived(isReachable(externalUrl));
+</script>
+
+<section class="identity glass">
+	<header class="identity-head">
+		<div class="identity-eyebrow">
+			<MdiIcon name="mdiAccountNetworkOutline" size={12} />
+			<span>{t('settings.identity')}</span>
+		</div>
+		<h3 class="identity-title">{t('settings.identityHeadline')}</h3>
+	</header>
+
+	<div class="identity-body">
+		<!-- External URL row -->
+		<div class="row">
+			<div class="row-label">
+				<span class="row-num">01</span>
+				<label for="settings-external-url" class="row-name">
+					{t('settings.externalUrl')}
+					<Hint text={t('settings.externalUrlHint')} />
+				</label>
+			</div>
+			<div class="row-control">
+				<div class="url-field" class:url-field-valid={urlValid && !!externalUrl}>
+					<span class="url-leading" aria-hidden="true">
+						<MdiIcon name={urlValid ? 'mdiEarth' : 'mdiEarthOff'} size={14} />
+					</span>
+					<input
+						id="settings-external-url"
+						bind:value={externalUrl}
+						placeholder="https://notify.example.com"
+						class="url-input"
+						type="url"
+						autocomplete="off"
+						spellcheck="false"
+					/>
+					{#if externalUrl}
+						<button
+							type="button"
+							class="url-action"
+							onclick={copyUrl}
+							aria-label={t('settings.copy')}
+							title={t('settings.copy')}
+						>
+							<MdiIcon name={copied ? 'mdiCheck' : 'mdiContentCopy'} size={13} />
+						</button>
+						{#if urlValid}
+							<a
+								href={externalUrl}
+								target="_blank"
+								rel="noopener noreferrer"
+								class="url-action"
+								aria-label={t('settings.openExternal')}
+								title={t('settings.openExternal')}
+							>
+								<MdiIcon name="mdiOpenInNew" size={13} />
+							</a>
+						{/if}
+					{/if}
+				</div>
+			</div>
+		</div>
+
+		<!-- Timezone row -->
+		<div class="row">
+			<div class="row-label">
+				<span class="row-num">02</span>
+				<span class="row-name">
+					{t('settings.timezone')}
+					<Hint text={t('settings.timezoneHint')} />
+				</span>
+			</div>
+			<div class="row-control">
+				<TimezoneSelector bind:value={timezone} />
+			</div>
+		</div>
+
+		<!-- Locales row -->
+		<div class="row">
+			<div class="row-label">
+				<span class="row-num">03</span>
+				<span class="row-name">
+					{t('settings.supportedLocales')}
+					<Hint text={t('settings.supportedLocalesHint')} />
+				</span>
+			</div>
+			<div class="row-control">
+				<LocaleSelector bind:value={supportedLocales} />
+			</div>
+		</div>
+	</div>
+</section>
+
+<style>
+	.identity {
+		padding: 1.5rem 1.6rem 1.4rem;
+		display: flex;
+		flex-direction: column;
+		gap: 1.2rem;
+	}
+
+	.identity-head {
+		position: relative;
+		z-index: 1;
+	}
+	.identity-eyebrow {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.35rem;
+		font-family: var(--font-mono);
+		font-size: 0.62rem;
+		text-transform: uppercase;
+		letter-spacing: 0.18em;
+		color: var(--color-muted-foreground);
+		margin-bottom: 0.45rem;
+	}
+	.identity-title {
+		margin: 0;
+		font-family: var(--font-display);
+		font-weight: 400;
+		font-style: italic;
+		font-size: 1.25rem;
+		line-height: 1.3;
+		letter-spacing: -0.015em;
+		color: var(--color-foreground);
+		max-width: 42ch;
+	}
+
+	.identity-body {
+		position: relative;
+		z-index: 1;
+		display: flex;
+		flex-direction: column;
+	}
+
+	.row {
+		display: grid;
+		grid-template-columns: 11rem 1fr;
+		gap: 1.4rem;
+		padding: 1rem 0;
+		border-top: 1px solid var(--color-border);
+	}
+	.row:first-child { border-top: 0; padding-top: 0.4rem; }
+	.row:last-child { padding-bottom: 0.1rem; }
+
+	.row-label {
+		display: flex;
+		flex-direction: column;
+		gap: 0.3rem;
+		padding-top: 0.15rem;
+	}
+	.row-num {
+		font-family: var(--font-mono);
+		font-size: 0.62rem;
+		letter-spacing: 0.18em;
+		color: var(--color-muted-foreground);
+	}
+	.row-name {
+		font-size: 0.78rem;
+		font-weight: 500;
+		color: var(--color-foreground);
+		letter-spacing: -0.005em;
+		display: inline-flex;
+		align-items: center;
+	}
+	.row-control {
+		min-width: 0;
+	}
+
+	/* --- URL field with leading icon and trailing actions --- */
+	.url-field {
+		display: flex;
+		align-items: center;
+		gap: 0.25rem;
+		max-width: 34rem;
+		padding: 0.15rem 0.35rem 0.15rem 0.7rem;
+		border: 1px solid var(--color-rule-strong);
+		border-radius: 0.625rem;
+		background: var(--color-input-bg);
+		transition: border-color 0.18s, box-shadow 0.18s, background 0.18s;
+	}
+	.url-field:focus-within {
+		border-color: var(--color-primary);
+		box-shadow: 0 0 0 3px var(--color-glow);
+	}
+	.url-field-valid {
+		border-color: color-mix(in srgb, var(--color-mint) 35%, var(--color-rule-strong));
+	}
+	.url-leading {
+		color: var(--color-muted-foreground);
+		display: inline-flex;
+		flex-shrink: 0;
+	}
+	.url-field-valid .url-leading { color: var(--color-mint); }
+	.url-input {
+		flex: 1;
+		background: transparent;
+		border: 0;
+		outline: 0;
+		padding: 0.5rem 0.4rem;
+		font-family: var(--font-mono);
+		font-size: 0.82rem;
+		color: var(--color-foreground);
+		min-width: 0;
+	}
+	.url-input::placeholder { color: var(--color-muted-foreground); }
+	.url-action {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		width: 28px;
+		height: 28px;
+		border-radius: 8px;
+		background: transparent;
+		border: 0;
+		color: var(--color-muted-foreground);
+		cursor: pointer;
+		text-decoration: none;
+		transition: background 0.15s, color 0.15s;
+	}
+	.url-action:hover {
+		background: var(--color-glass-strong);
+		color: var(--color-foreground);
+	}
+
+	@media (max-width: 720px) {
+		.row {
+			grid-template-columns: 1fr;
+			gap: 0.55rem;
+			padding: 0.95rem 0;
+		}
+		.row-label { padding-top: 0; }
+	}
+
+	@media (prefers-reduced-motion: reduce) {
+		.url-field, .url-action { transition: none !important; }
+	}
+</style>

frontend/src/routes/settings/LoggingCassette.svelte

@@ -0,0 +1,448 @@
+<script lang="ts">
+	import { t } from '$lib/i18n';
+	import MdiIcon from '$lib/components/MdiIcon.svelte';
+	import Hint from '$lib/components/Hint.svelte';
+	import IconGridSelect from '$lib/components/IconGridSelect.svelte';
+	import { logLevelItems, logFormatItems } from '$lib/grid-items';
+
+	type Level = 'DEBUG' | 'INFO' | 'WARNING' | 'ERROR';
+
+	interface Override {
+		module: string;
+		level: Level;
+	}
+
+	interface Props {
+		logLevel: string;
+		logFormat: string;
+		logLevels: string;
+	}
+
+	let {
+		logLevel = $bindable(),
+		logFormat = $bindable(),
+		logLevels = $bindable(),
+	}: Props = $props();
+
+	const LEVELS: Level[] = ['DEBUG', 'INFO', 'WARNING', 'ERROR'];
+	const LEVEL_TONE: Record<Level, string> = {
+		DEBUG: 'sky',
+		INFO: 'mint',
+		WARNING: 'citrus',
+		ERROR: 'coral',
+	};
+
+	let rawMode = $state(false);
+
+	// Parse the comma-separated `module=LEVEL,...` string into structured rows.
+	function parse(csv: string): Override[] {
+		if (!csv) return [];
+		const out: Override[] = [];
+		const seen = new Set<string>();
+		for (const raw of csv.split(',')) {
+			const piece = raw.trim();
+			if (!piece) continue;
+			const eq = piece.indexOf('=');
+			if (eq < 0) continue;
+			const module = piece.slice(0, eq).trim();
+			const lvlRaw = piece.slice(eq + 1).trim().toUpperCase();
+			if (!module || seen.has(module)) continue;
+			const level = (LEVELS.includes(lvlRaw as Level) ? lvlRaw : 'INFO') as Level;
+			seen.add(module);
+			out.push({ module, level });
+		}
+		return out;
+	}
+
+	function serialize(rows: Override[]): string {
+		return rows
+			.filter(r => r.module.trim().length > 0)
+			.map(r => `${r.module.trim()}=${r.level}`)
+			.join(',');
+	}
+
+	let rows = $state<Override[]>(parse(logLevels));
+	let lastEmitted = $state(logLevels);
+
+	// Re-parse when the upstream string changes from outside (e.g. fetch / reset).
+	$effect(() => {
+		if (logLevels !== lastEmitted) {
+			rows = parse(logLevels);
+			lastEmitted = logLevels;
+		}
+	});
+
+	function commit(next: Override[]): void {
+		rows = next;
+		const serialized = serialize(next);
+		lastEmitted = serialized;
+		logLevels = serialized;
+	}
+
+	function addRow(): void {
+		commit([...rows, { module: '', level: 'INFO' }]);
+	}
+
+	function removeRow(i: number): void {
+		commit(rows.filter((_, idx) => idx !== i));
+	}
+
+	function updateModule(i: number, value: string): void {
+		const next = rows.map((r, idx) => (idx === i ? { ...r, module: value } : r));
+		commit(next);
+	}
+
+	function updateLevel(i: number, level: Level): void {
+		const next = rows.map((r, idx) => (idx === i ? { ...r, level } : r));
+		commit(next);
+	}
+
+	const previewLine = $derived.by(() => {
+		const root = (logLevel || 'INFO').toUpperCase();
+		if (rows.length === 0) return `root=${root}`;
+		return `root=${root}, ${rows.map(r => `${r.module || '?'}=${r.level}`).join(', ')}`;
+	});
+</script>
+
+<section class="logging glass">
+	<header class="log-head">
+		<div class="log-eyebrow">
+			<MdiIcon name="mdiTextBoxOutline" size={12} />
+			<span>{t('settings.logging')}</span>
+		</div>
+		<h3 class="log-title">{t('settings.loggingHeadline')}</h3>
+	</header>
+
+	<!-- Level + format -->
+	<div class="log-row">
+		<div class="log-cell">
+			<span class="log-label">
+				{t('settings.logLevel')}
+				<Hint text={t('settings.logLevelHint')} />
+			</span>
+			<IconGridSelect items={logLevelItems()} bind:value={logLevel} columns={2} />
+		</div>
+		<div class="log-cell">
+			<span class="log-label">
+				{t('settings.logFormat')}
+				<Hint text={t('settings.logFormatHint')} />
+			</span>
+			<IconGridSelect items={logFormatItems()} bind:value={logFormat} columns={2} />
+		</div>
+	</div>
+
+	<!-- Per-module overrides -->
+	<div class="overrides">
+		<div class="overrides-head">
+			<span class="log-label">
+				{t('settings.logLevels')}
+				<Hint text={t('settings.logLevelsHint')} />
+			</span>
+			<button
+				type="button"
+				class="mode-toggle"
+				onclick={() => (rawMode = !rawMode)}
+				title={rawMode ? t('settings.editAsChips') : t('settings.editAsText')}
+			>
+				<MdiIcon name={rawMode ? 'mdiViewList' : 'mdiCodeBraces'} size={12} />
+				<span>{rawMode ? t('settings.editAsChips') : t('settings.editAsText')}</span>
+			</button>
+		</div>
+
+		{#if rawMode}
+			<input
+				bind:value={logLevels}
+				placeholder="sqlalchemy.engine=WARNING,notify_bridge_core.notifications.telegram.client=DEBUG"
+				class="raw-input"
+			/>
+		{:else}
+			<div class="chip-stack">
+				{#each rows as row, i (i)}
+					{@const tone = LEVEL_TONE[row.level]}
+					<div class="chip" data-tone={tone}>
+						<span class="chip-edge" aria-hidden="true"></span>
+						<input
+							value={row.module}
+							oninput={(e) => updateModule(i, (e.currentTarget as HTMLInputElement).value)}
+							placeholder={t('settings.logModulePlaceholder')}
+							class="chip-input"
+							autocomplete="off"
+							spellcheck="false"
+						/>
+						<span class="chip-sep" aria-hidden="true">=</span>
+						<select
+							value={row.level}
+							onchange={(e) => updateLevel(i, (e.currentTarget as HTMLSelectElement).value as Level)}
+							class="chip-level"
+							aria-label={t('settings.logLevel')}
+						>
+							{#each LEVELS as lvl}
+								<option value={lvl}>{lvl}</option>
+							{/each}
+						</select>
+						<button
+							type="button"
+							class="chip-remove"
+							onclick={() => removeRow(i)}
+							aria-label={t('settings.removeOverride')}
+							title={t('settings.removeOverride')}
+						>
+							<MdiIcon name="mdiClose" size={13} />
+						</button>
+					</div>
+				{/each}
+
+				<button type="button" class="chip-add" onclick={addRow}>
+					<MdiIcon name="mdiPlus" size={13} />
+					<span>{t('settings.addOverride')}</span>
+				</button>
+			</div>
+		{/if}
+
+		<!-- Live preview -->
+		<div class="preview" role="status">
+			<span class="preview-eyebrow">{t('settings.logPreviewLabel')}</span>
+			<code class="preview-text">{previewLine}</code>
+		</div>
+	</div>
+</section>
+
+<style>
+	.logging {
+		padding: 1.5rem 1.6rem 1.4rem;
+		display: flex;
+		flex-direction: column;
+		gap: 1.15rem;
+	}
+	.log-head {
+		position: relative;
+		z-index: 1;
+	}
+	.log-eyebrow {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.35rem;
+		font-family: var(--font-mono);
+		font-size: 0.62rem;
+		text-transform: uppercase;
+		letter-spacing: 0.18em;
+		color: var(--color-muted-foreground);
+		margin-bottom: 0.45rem;
+	}
+	.log-title {
+		margin: 0;
+		font-family: var(--font-display);
+		font-style: italic;
+		font-weight: 400;
+		font-size: 1.15rem;
+		line-height: 1.35;
+		letter-spacing: -0.015em;
+		color: var(--color-foreground);
+		max-width: 38ch;
+	}
+
+	.log-row {
+		position: relative;
+		z-index: 1;
+		display: grid;
+		grid-template-columns: 1fr;
+		gap: 0.85rem;
+	}
+	@media (min-width: 720px) {
+		.log-row { grid-template-columns: 1fr 1fr; gap: 1.4rem; }
+	}
+	.log-cell {
+		display: flex;
+		flex-direction: column;
+		gap: 0.4rem;
+	}
+	.log-label {
+		font-size: 0.75rem;
+		font-weight: 500;
+		color: var(--color-foreground);
+		display: inline-flex;
+		align-items: center;
+	}
+
+	/* --- Overrides editor --- */
+	.overrides {
+		position: relative;
+		z-index: 1;
+		display: flex;
+		flex-direction: column;
+		gap: 0.55rem;
+		padding-top: 0.5rem;
+		border-top: 1px solid var(--color-border);
+	}
+	.overrides-head {
+		display: flex;
+		align-items: center;
+		justify-content: space-between;
+		gap: 0.5rem;
+		flex-wrap: wrap;
+	}
+	.mode-toggle {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.3rem;
+		padding: 0.25rem 0.55rem;
+		border-radius: 999px;
+		background: transparent;
+		border: 1px solid var(--color-border);
+		color: var(--color-muted-foreground);
+		font-family: var(--font-mono);
+		font-size: 0.6rem;
+		text-transform: uppercase;
+		letter-spacing: 0.12em;
+		cursor: pointer;
+		transition: background 0.15s, color 0.15s, border-color 0.15s;
+	}
+	.mode-toggle:hover {
+		background: var(--color-glass-strong);
+		color: var(--color-foreground);
+		border-color: var(--color-rule-strong);
+	}
+
+	.raw-input {
+		width: 100%;
+		font-family: var(--font-mono);
+		font-size: 0.78rem;
+		padding: 0.6rem 0.85rem;
+	}
+
+	.chip-stack {
+		display: flex;
+		flex-direction: column;
+		gap: 0.4rem;
+	}
+	.chip {
+		position: relative;
+		display: grid;
+		grid-template-columns: 1fr auto auto auto;
+		align-items: center;
+		gap: 0.3rem;
+		padding: 0.35rem 0.4rem 0.35rem 0.95rem;
+		border-radius: 12px;
+		border: 1px solid var(--color-border);
+		background: var(--color-glass-strong);
+		overflow: hidden;
+		transition: border-color 0.18s, background 0.18s;
+	}
+	.chip:hover {
+		border-color: var(--color-rule-strong);
+		background: var(--color-glass-elev);
+	}
+	.chip-edge {
+		position: absolute;
+		left: 0; top: 0; bottom: 0;
+		width: 3px;
+		opacity: 0.85;
+	}
+	.chip[data-tone="sky"] .chip-edge    { background: var(--color-sky); }
+	.chip[data-tone="mint"] .chip-edge   { background: var(--color-mint); }
+	.chip[data-tone="citrus"] .chip-edge { background: var(--color-citrus); }
+	.chip[data-tone="coral"] .chip-edge  { background: var(--color-coral); }
+
+	.chip-input {
+		width: 100%;
+		background: transparent;
+		border: 0;
+		outline: 0;
+		padding: 0.35rem 0;
+		font-family: var(--font-mono);
+		font-size: 0.78rem;
+		color: var(--color-foreground);
+		min-width: 0;
+	}
+	.chip-input::placeholder { color: var(--color-muted-foreground); opacity: 0.7; }
+
+	.chip-sep {
+		font-family: var(--font-mono);
+		color: var(--color-muted-foreground);
+		opacity: 0.5;
+		padding: 0 0.15rem;
+	}
+
+	.chip-level {
+		font-family: var(--font-mono);
+		font-size: 0.7rem;
+		font-weight: 500;
+		padding: 0.3rem 1.6rem 0.3rem 0.6rem;
+		border-radius: 8px;
+		border: 1px solid var(--color-border);
+		background: var(--color-glass);
+		color: var(--color-foreground);
+		min-width: 7.2rem;
+		letter-spacing: 0.08em;
+		text-transform: uppercase;
+	}
+	.chip[data-tone="sky"]    .chip-level { color: var(--color-sky); border-color: color-mix(in srgb, var(--color-sky) 35%, var(--color-border)); }
+	.chip[data-tone="mint"]   .chip-level { color: var(--color-mint); border-color: color-mix(in srgb, var(--color-mint) 35%, var(--color-border)); }
+	.chip[data-tone="citrus"] .chip-level { color: var(--color-citrus); border-color: color-mix(in srgb, var(--color-citrus) 35%, var(--color-border)); }
+	.chip[data-tone="coral"]  .chip-level { color: var(--color-coral); border-color: color-mix(in srgb, var(--color-coral) 35%, var(--color-border)); }
+
+	.chip-remove {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		width: 26px; height: 26px;
+		border-radius: 8px;
+		background: transparent;
+		border: 0;
+		color: var(--color-muted-foreground);
+		cursor: pointer;
+		transition: background 0.15s, color 0.15s;
+	}
+	.chip-remove:hover {
+		background: color-mix(in srgb, var(--color-error-fg) 12%, var(--color-glass-strong));
+		color: var(--color-error-fg);
+	}
+
+	.chip-add {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.35rem;
+		align-self: flex-start;
+		padding: 0.35rem 0.85rem;
+		border-radius: 999px;
+		border: 1px dashed var(--color-rule-strong);
+		background: transparent;
+		color: var(--color-muted-foreground);
+		font-family: inherit;
+		font-size: 0.72rem;
+		cursor: pointer;
+		transition: background 0.15s, color 0.15s, border-color 0.15s;
+	}
+	.chip-add:hover {
+		background: color-mix(in srgb, var(--color-primary) 8%, transparent);
+		color: var(--color-primary);
+		border-style: solid;
+		border-color: color-mix(in srgb, var(--color-primary) 45%, var(--color-rule-strong));
+	}
+
+	/* --- Live preview --- */
+	.preview {
+		display: flex;
+		flex-direction: column;
+		gap: 0.3rem;
+		padding: 0.65rem 0.85rem;
+		border-radius: 12px;
+		background: color-mix(in srgb, var(--color-background-deep, #02030a) 30%, var(--color-glass-strong));
+		border: 1px solid var(--color-border);
+		overflow: hidden;
+	}
+	.preview-eyebrow {
+		font-family: var(--font-mono);
+		font-size: 0.55rem;
+		text-transform: uppercase;
+		letter-spacing: 0.18em;
+		color: var(--color-muted-foreground);
+	}
+	.preview-text {
+		font-family: var(--font-mono);
+		font-size: 0.72rem;
+		color: var(--color-foreground);
+		word-break: break-all;
+		line-height: 1.45;
+	}
+</style>