diff --git a/.env.example b/.env.example
index 224dcecc..fd17c2d5 100644
--- a/.env.example
+++ b/.env.example
@@ -28,7 +28,7 @@ ALLOWED_EMAILS=
 # Admin emails (subset of the above) get the admin role.
 ADMIN_EMAILS=
 
-# Logging (E22). LOG_LEVEL is the BOOTSTRAP level — the level a process starts at and the only one
+# Logging. LOG_LEVEL is the BOOTSTRAP level — the level a process starts at and the only one
 # the worker/download child read; the API's running level is the admin Configuration page's
 # `log_level` knob, which takes effect without a restart. TRACE | DEBUG | INFO | WARNING | ERROR, in
 # any letter case; any other value stops the boot with an error. LOG_FORMAT is "json" (one object per
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 90c742a1..81b82d6b 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -2,8 +2,11 @@
 # whole-repo reformatting does not bury the real authorship of each line.
 # Configure once per clone:  git config blame.ignoreRevsFile .git-blame-ignore-revs
 #
-# Prettier one-time repo-wide format pass (R2 S1b, 2026-07-21)
+# Prettier one-time repo-wide format pass (2026-07-21)
 51c36c2071728d2cd7ae580b7bfdf21f6867a347
 
 # ruff format one-time backend + scripts pass (line-length 100, 2026-08-23)
 b1832afd180866b922521148603db447020c57a4
+
+# Plan-code purge from comments, one-time (2026-10-04)
+4aaaaa786017278460e0b4f94cc0d3374e0e37e2
diff --git a/.gitignore b/.gitignore
index d034f201..04718ff8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,3 +42,4 @@ Thumbs.db
 # TypeScript incremental build artifacts — machine-local, absolute-path-bearing, and no gate lane
 # reads or regenerates them, so a committed one is stale from the commit that adds it.
 *.tsbuildinfo
+frontend/e2e/.speed/
diff --git a/.trivyignore.yaml b/.trivyignore.yaml
index 79dbc1c5..93a89011 100644
--- a/.trivyignore.yaml
+++ b/.trivyignore.yaml
@@ -1,4 +1,4 @@
-# The CVE gate's allowlist (E32). The publish gate scans the built image and the committed tree with
+# The CVE gate's allowlist. The publish gate scans the built image and the committed tree with
 # Trivy and fails on any HIGH or CRITICAL finding that has a fix available. A finding that cannot be
 # fixed yet is let through ONLY by an entry here, and every entry carries both:
 #   statement   — why it is acceptable for now (what is exposed, what is not)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4901bb32..ddbf2c08 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,19 @@ edit the release notes and re-run the generator.
 
 Upgrading, pinning a version and rolling back: [docs/self-hosting.md](docs/self-hosting.md#upgrading).
 
+## 0.100.0 — 2026-10-05
+
+### New
+
+- Direct messages are gone: the Messages page, the chat dock and their encryption keys were removed with their stored messages, and the privacy policy no longer describes end-to-end encrypted chat.
+- The shared demo account is gone, with its sign-in entry and its whitelist.
+
+### Fixed
+
+- Sign-in security without email: when a Google sign-in takes over an account someone else registered first, or makes it an admin through the admin list, its password is cleared and its sessions end. The owner sets a new one in Settings.
+- Pressing Back onto a page that no longer exists opens the feed instead of breaking the app.
+- Behind the scenes: tidier checks and comments across the code.
+
 ## 0.99.2 — 2026-10-04
 
 ### Fixed
diff --git a/CLAUDE.md b/CLAUDE.md
index 99230748..87ef68f4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -13,15 +13,15 @@ router-free navigation provider.
 ## The gate — never merge or ship red
 
 The local gate is **ruff (`check` + `format --check`) + basedpyright (backend) + the lock check + typecheck (3 tsc projects) +
-eslint + prettier --check + knip (both modes) + vitest + vite build + pytest + pip-audit + npm audit**, then a coverage report (no threshold). It runs
+eslint + prettier --check + knip + vitest + vite build + pytest + pip-audit + npm audit**. It runs
 before every `release` merges and on every `publish`, which **refuses to build on failure — there is deliberately no `--skip`
 flag**; a release also requires the Playwright suite, and the image must pass a Trivy scan before it is pushed. Run it and get it
 green **before** any merge, release, or handing work to review.
 
 - Full gate: `bash scripts/check.sh` (`lint` for the static lanes only); the private ops dispatcher's `siftlode check` runs the same script. Single lanes: [`docs/development.md`](docs/development.md) § The gate.
 - **There is no CI** (owner, 2026-10-04): this gate, run here, is the only one — green before every hand-over, and `release` refuses to merge without it.
-- **A gate with any real hit is never switched off or narrowed** — not a lint rule, a compiler flag, a lane or a release step. Fix the sites, or suppress each one inline naming its invariant (`-- why`, lint-enforced). What stays narrowed is in [`docs/gates.md`](docs/gates.md), and a contract test fails when a narrowing is missing from it. The effective ESLint config of every file and the gate/lane lines are pinned in `frontend/src/lib/gates.snapshot.json`: a new code file or any gate change fails until you regenerate it (`GATE_SNAPSHOT=update`, see gates.md) — then read that diff as a gate change. A comment saying "X is enforced by Y" is checked by running Y (E32: one such comment hid 95 functions the React Compiler skipped).
-- **The backend type lane runs in the test image, not on the host** — `requirements.lock` cannot be installed on Windows (uvloop), and a type checker without the real packages reports nonsense. It fails on NEW errors only; the pre-existing ones sit in `backend/.basedpyright/baseline.json` and burn down epic by epic. Fixed some? Regenerate with `--writebaseline`.
+- **A gate with any real hit is never switched off or narrowed** — not a lint rule, a compiler flag, a lane or a release step. Fix the sites, or suppress each one inline naming its invariant (`-- why`, lint-enforced). What stays narrowed is in [`docs/gates.md`](docs/gates.md), and a contract test fails when a narrowing is missing from it. The effective ESLint config of every scope and the gate/lane lines are pinned in `frontend/src/lib/gates.snapshot.json`: any gate change fails until you regenerate it (`GATE_SNAPSHOT=update`, see gates.md) — then read that diff as a gate change. A comment saying "X is enforced by Y" is checked by running Y (E32: one such comment hid 95 functions the React Compiler skipped).
+- **The backend type lane runs in the test image, not on the host** — `requirements.lock` cannot be installed on Windows (uvloop), and a type checker without the real packages reports nonsense. It fails on NEW errors only; the pre-existing ones sit in `backend/.basedpyright/baseline.json` (no burn-down mandate, but none was ever triaged: a `reportOptional*` entry in code you touch may be a real bug). A run that fixed some rewrites it — commit that.
 - New DB-backed test? It must actually run, not silently skip — assume `SIFTLODE_TEST_REQUIRE_DB=1`.
 
 ## Workflow
@@ -63,7 +63,7 @@ how it gets built. Concretely:
 
 `routes/*` (HTTP only: validation, auth-dependency, serialization) → domain packages `sync/`, `plex/`,
 `downloads/`, `youtube/`, `issues/` (shared by routes + scheduler + worker) → flat core (`auth`, `quota`,
-`sysconfig`, `state`, `audit`, `notifications`, `userscope`, `realtime`, `ratelimit`, `bodylimit`, `progress`, `collation`,
+`sysconfig`, `state`, `audit`, `notifications`, `userscope`, `ratelimit`, `bodylimit`, `progress`, `collation`,
 `security`, `logs`, `logsink`, `diagnostics`, `debugsession`) → `models/db/config`. **Dependency direction is one-way: core never imports routes.**
 Frontend: `main.tsx` provider tree → `App.tsx` shell → `moduleRegistry` route-chunks → module
 components → the **platform layer `components/ui/`** (domain-free primitives: the popover engine and
@@ -95,17 +95,12 @@ CQRS, a repository/DI framework, a router library, a generic CRUD-router factory
 | Job status word                      | the `downloads/status.py` StrEnum                                                                                                                                                                 | loose `"canceled"`/`"cancelled"` literals                                                                                                               |
 | Current time                         | inline `datetime.now(timezone.utc)`                                                                                                                                                               | new `now_utc`/`_now` helpers                                                                                                                            |
 | FE per-account state                 | `usePref`                                                                                                                                                                                         | raw `readAccount`/`writeAccount` or bespoke hooks                                                                                                       |
-| FE button                            | `ui/Button` (a `SIZES` rung) · `IconButton` · `Pressable` (a clickable card/row) · `Chip` · `DragHandle`                                                                                          | a raw `<button>` or `FocusSafeButton` outside the control primitives (lint-enforced)                                                                    |
 | FE keyboard shortcut                 | a row in `lib/keymap.ts` + `dispatch()`                                                                                                                                                           | a private `keydown` listener with its own key literals                                                                                                  |
 | FE list/grid keys                    | `NavGrid`/`keyboardNav` + `navItemAttrs` + `data-nav-open`                                                                                                                                        | a private arrow-key / roving-tabindex handler                                                                                                           |
 | FE view push (history)               | `rememberNavPosition()` right before `history.pushState`                                                                                                                                          | a push that forgets: Back strands focus on `<body>`                                                                                                     |
-| FE text field / checkbox / slider    | `ui/Input` · `Textarea` · `InnerInput` in a `fieldClass` frame · `Checkbox`/`CheckRow` · `Slider`                                                                                                 | a raw `<input>`/`<textarea>` anywhere but those primitives (lint-enforced)                                                                              |
-| FE glass surface                     | a role: `SURFACE.panel` / `card` / `menu` / `popover` / `tooltip` (`ui/surfaces.ts`)                                                                                                              | a bare `glass`/`glass-card`/`glass-menu` beside a hand-picked radius (lint-enforced)                                                                    |
 | FE static label / button-like link   | `Badge` (flat, no edge) · `LinkButton` / `IconLink`                                                                                                                                               | a glass pill that reads as a chip; an `<a>` hand-painted like a button                                                                                  |
-| FE control                           | `SegmentedToggle`; a long or user's list: `FilterSelect`                                                                                                                                          | a native `<select>` (lint-enforced)                                                                                                                     |
 | FE loading/empty/error               | `QueryState` / `StateMessage`                                                                                                                                                                     | ad-hoc conditionals                                                                                                                                     |
 | FE failed write                      | `meta.failTitle`, else `notifyActionError(err, title)`                                                                                                                                            | a bare `catch {}` or `notify()` with no error attached                                                                                                  |
-| FE network call                      | `req`/`uploadReq`/`beacon`, or `lib/http.ts` `send` (public pages)                                                                                                                                | a bare `fetch`/`XMLHttpRequest`/`WebSocket` (lint-enforced)                                                                                             |
 | FE diagnostics                       | `lib/log.ts` (`log.info("event.code", msg, attrs)`); a filter change → `lib/filterLog.ts`, a player → `lib/mediaLog.ts`                                                                           | `console.*` (lint-enforced); a value only a higher level may carry, logged unguarded                                                                    |
 | FE state that MIRRORS a prop/query   | derive it, or hold a draft (`draft ?? server`)                                                                                                                                                    | a copy an effect re-syncs — that paints the stale value first                                                                                           |
 | FE state reset on a key change       | adjust it DURING render against a remembered key                                                                                                                                                  | `useEffect(() => setX(init), [key])`                                                                                                                    |
@@ -114,6 +109,11 @@ CQRS, a repository/DI framework, a router library, a generic CRUD-router factory
 | FE popover / scroll-fade ref         | destructure it: `const { setReference } = pop.refs`, then `ref={setReference}`                                                                                                                    | `ref={pop.refs.setReference}` / `ref={fade.ref}` — the compiler then treats the whole object as a ref and skips                                         |
 | FE async handler with cleanup        | `try { … } catch { … }`, then the cleanup after it (steps that `return` early go in their own function); a conditional, loop or `?.` the `try` needs goes before it or into a module-level helper | `try/finally`, or a `?:` / `??` / loop / `?.` inside `try` — the React Compiler skips the whole component (and `react-hooks/todo` misses most of these) |
 
+Not repeated here, because a lint rule refuses the wrong one and its message names the right one:
+buttons (`ui/Button`, `IconButton`, `Pressable`, `Chip`, `DragHandle`), text fields and native
+controls (`ui/Input`, `Checkbox`, `Slider`, …), glass surfaces (`SURFACE.*`), a native `<select>`
+(`SegmentedToggle` / `FilterSelect`), and network calls (`req` / `uploadReq` / `beacon`, `lib/http.ts`).
+
 ## House rules that bite (learned from real bugs)
 
 - **A rule stated in a comment must also be enforced in code.** The worst bugs here came from a comment
@@ -125,7 +125,8 @@ CQRS, a repository/DI framework, a router library, a generic CRUD-router factory
   "no results". Reads degrade honestly; writes are conditional (`UPDATE … WHERE status='running'`).
 - **i18n parity.** HU/EN, zero key drift. Every user-facing string is translated.
 - **Comment the "why", keep it current.** This codebase uses comments as its architecture doc; a stale
-  "why" is a liability, so update it when the behavior changes.
+  "why" is a liability, so update it when the behavior changes. Say the why itself, never the plan
+  step that produced it: no epic, sprint or review-round ids in the code (`planCodes.contract.test.ts`).
 
 ---
 
diff --git a/Dockerfile b/Dockerfile
index 2b9f9f77..2a31b361 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -47,13 +47,13 @@ RUN adduser --disabled-password --gecos "" appuser \
     && mkdir -p /downloads \
     && chown appuser /app /downloads
 
-# ffmpeg: merge separate video+audio streams + postprocessing, and the Plex VAAPI transcode (E6 S1).
+# ffmpeg: merge separate video+audio streams + postprocessing, and the Plex VAAPI transcode.
 # intel-media-va-driver (iHD): the VA driver ffmpeg's h264_vaapi needs — libva2 ships in the base but
 # no driver, so without this `vainfo`/`h264_vaapi` fail and transcode silently falls back to libx264.
 # Harmless on hosts with no /dev/dri (the driver just goes unused). Deno: the JavaScript runtime yt-dlp
 # uses to solve YouTube's "n" signature challenge for the web player clients (required alongside the PO
 # token, else only storyboards are offered). yt-dlp auto-detects deno on PATH.
-# `apt-get upgrade` (E32): the base image is a snapshot, and the Debian security fixes released since it
+# `apt-get upgrade`: the base image is a snapshot, and the Debian security fixes released since it
 # was cut are only in the archive — the first Trivy scan found one (pcre2) fixed upstream but not in it.
 ARG DENO_VERSION=v2.9.1
 RUN apt-get update \
@@ -81,7 +81,7 @@ RUN printf 'Types: deb\nURIs: http://deb.debian.org/debian\nSuites: bookworm\nCo
 # Install from the PINNED lock (requirements.lock, generated from requirements.txt) so the image is
 # byte-reproducible and the exact versions are the ones the gate's pip-audit scanned — not whatever
 # floats up from the floor ranges on build day. Regenerate the lock when requirements.txt changes (see its header).
-# pip itself is removed once it has installed the lock (E32): nothing runs it at runtime, and it carries
+# pip itself is removed once it has installed the lock: nothing runs it at runtime, and it carries
 # its own VENDORED copies of urllib3, msgpack and setuptools, which Trivy reports as the image's own —
 # an attack surface and a CVE stream for a tool the running app never calls.
 COPY backend/requirements.lock .
diff --git a/VERSION b/VERSION
index 3b66e07e..897e2158 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.99.2
+0.100.0
diff --git a/backend/.basedpyright/baseline.json b/backend/.basedpyright/baseline.json
index 2a942acc..9ffc4757 100644
--- a/backend/.basedpyright/baseline.json
+++ b/backend/.basedpyright/baseline.json
@@ -824,96 +824,6 @@
                 }
             }
         ],
-        "./app/routes/messages.py": [
-            {
-                "code": "reportCallIssue",
-                "range": {
-                    "startColumn": 11,
-                    "endColumn": 43,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 23,
-                    "endColumn": 27,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportCallIssue",
-                "range": {
-                    "startColumn": 13,
-                    "endColumn": 5,
-                    "lineCount": 7
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 8,
-                    "endColumn": 15,
-                    "lineCount": 5
-                }
-            },
-            {
-                "code": "reportReturnType",
-                "range": {
-                    "startColumn": 15,
-                    "endColumn": 72,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportCallIssue",
-                "range": {
-                    "startColumn": 30,
-                    "endColumn": 48,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 41,
-                    "endColumn": 44,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportOptionalMemberAccess",
-                "range": {
-                    "startColumn": 36,
-                    "endColumn": 38,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportOptionalMemberAccess",
-                "range": {
-                    "startColumn": 71,
-                    "endColumn": 73,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportArgumentType",
-                "range": {
-                    "startColumn": 30,
-                    "endColumn": 39,
-                    "lineCount": 1
-                }
-            },
-            {
-                "code": "reportOptionalMemberAccess",
-                "range": {
-                    "startColumn": 27,
-                    "endColumn": 29,
-                    "lineCount": 1
-                }
-            }
-        ],
         "./app/routes/playlists.py": [
             {
                 "code": "reportOptionalOperand",
diff --git a/backend/alembic/versions/0097_drop_messages.py b/backend/alembic/versions/0097_drop_messages.py
new file mode 100644
index 00000000..a3d56ce2
--- /dev/null
+++ b/backend/alembic/versions/0097_drop_messages.py
@@ -0,0 +1,69 @@
+"""messages: drop direct messaging (the owner's decision, 2026-10-04)
+
+Chat — end-to-end encrypted direct messages plus the server's welcome note — was never used: prod held
+two welcome notes, no message between people, and one key. Its tables go with its code. The rows are
+not migrated anywhere; the nightly backup holds them.
+
+The downgrade restores the schema as it stood (0026 + 0027), empty: a message can't be brought back
+from a migration, and the E2EE key blobs were only ever readable by their owner's browser anyway.
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0097_drop_messages"
+down_revision: str | None = "0096_videos_sort_indexes"
+branch_labels: str | None = None
+depends_on: str | None = None
+
+
+def upgrade() -> None:
+    op.drop_table("message_keys")
+    op.drop_index("ix_messages_created_at", table_name="messages")
+    op.drop_index("ix_messages_recipient_id", table_name="messages")
+    op.drop_index("ix_messages_sender_id", table_name="messages")
+    op.drop_table("messages")
+
+
+def downgrade() -> None:
+    op.create_table(
+        "messages",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "sender_id", sa.Integer(), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=True
+        ),
+        sa.Column(
+            "recipient_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("body", sa.Text(), nullable=True),
+        sa.Column("read_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False
+        ),
+        sa.Column("kind", sa.String(length=16), nullable=False, server_default="user"),
+        sa.Column("ciphertext", sa.Text(), nullable=True),
+        sa.Column("iv", sa.String(length=32), nullable=True),
+    )
+    op.create_index("ix_messages_sender_id", "messages", ["sender_id"])
+    op.create_index("ix_messages_recipient_id", "messages", ["recipient_id"])
+    op.create_index("ix_messages_created_at", "messages", ["created_at"])
+    op.create_table(
+        "message_keys",
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            primary_key=True,
+        ),
+        sa.Column("public_key", sa.Text(), nullable=False),
+        sa.Column("wrapped_private_key", sa.Text(), nullable=False),
+        sa.Column("salt", sa.String(length=64), nullable=False),
+        sa.Column("wrap_iv", sa.String(length=32), nullable=False),
+        sa.Column("key_check", sa.Text(), nullable=False),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False
+        ),
+    )
diff --git a/backend/alembic/versions/0098_drop_demo_account.py b/backend/alembic/versions/0098_drop_demo_account.py
new file mode 100644
index 00000000..d4b26a9b
--- /dev/null
+++ b/backend/alembic/versions/0098_drop_demo_account.py
@@ -0,0 +1,55 @@
+"""demo: drop the shared demo account (the owner's decision, 2026-10-04)
+
+The demo account — one shared user that whitelisted emails entered from the login page, reset on a
+schedule — goes with its code. Prod held the demo user and 10 whitelist rows.
+
+The upgrade deletes the demo user first (its playlists, states and subscriptions cascade; audit and
+quota rows keep their history with the actor nulled, as for any deleted account), then the traces
+that only the demo code could render: its audit rows (whitelist edits, manual resets, and every row
+about the reset job — its runs and its interval changes), the reset job's interval override and its
+completion notices. Nothing is migrated anywhere; the nightly backup holds the rows.
+
+The downgrade restores the schema as it stood (0014), empty: the demo user is created lazily on its
+first sign-in, so an empty `demo_whitelist` is the whole of its state.
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0098_drop_demo_account"
+down_revision: str | None = "0097_drop_messages"
+branch_labels: str | None = None
+depends_on: str | None = None
+
+
+def upgrade() -> None:
+    op.execute("DELETE FROM users WHERE is_demo")
+    op.execute(
+        "DELETE FROM audit_log WHERE action IN ('demo_add', 'demo_remove', 'demo_reset')"
+        " OR (target_type = 'job' AND target_id = 'demo_reset')"
+    )
+    op.execute("DELETE FROM scheduler_settings WHERE job_id = 'demo_reset'")
+    op.execute("DELETE FROM notifications WHERE data->>'job_id' = 'demo_reset'")
+    op.drop_index("ix_demo_whitelist_email", table_name="demo_whitelist")
+    op.drop_table("demo_whitelist")
+    op.drop_index("ix_users_is_demo", table_name="users")
+    op.drop_column("users", "is_demo")
+
+
+def downgrade() -> None:
+    op.add_column(
+        "users",
+        sa.Column("is_demo", sa.Boolean(), nullable=False, server_default=sa.false()),
+    )
+    op.create_index("ix_users_is_demo", "users", ["is_demo"])
+    op.create_table(
+        "demo_whitelist",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column("email", sa.String(length=320), nullable=False),
+        sa.Column("note", sa.Text(), nullable=True),
+        sa.Column("added_by", sa.String(length=320), nullable=True),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False
+        ),
+    )
+    op.create_index("ix_demo_whitelist_email", "demo_whitelist", ["email"], unique=True)
diff --git a/backend/app/README.md b/backend/app/README.md
index b7c885c5..b8cd114c 100644
--- a/backend/app/README.md
+++ b/backend/app/README.md
@@ -1,7 +1,7 @@
 # Backend conventions
 
 The rules below are already followed across `backend/app` — they lived only in a few module
-docstrings (`demo.py`, `userscope.py`, `routes/_common.py`) until this file collected them (E3 S3,
+docstrings (`userscope.py`, `routes/_common.py`) until this file collected them (E3 S3,
 B-core-20). When you add code, match these so the next reader doesn't have to guess "which pattern do
 I copy".
 
@@ -21,7 +21,7 @@ Three layers, by *who* runs the code — not by feature:
    `issues/bundle.py` is the one definition of a bug report's files, for the zip export and the tracker.
 
 3. **Flat `app/*.py` core modules — cross-cutting primitives.** `auth`, `sysconfig`, `quota`, `audit`,
-   `notifications`, `userscope`, `realtime`, `ratelimit`, `progress`, `logs` (the one logging
+   `notifications`, `userscope`, `ratelimit`, `progress`, `logs` (the one logging
    configuration), `logsink` (its `log_events` table), `diagnostics` (a user's consented log
    level), `debugsession` (a recording that tags its user's lines, E16) and `collation` (A→Z in the
    reader's alphabet, E30), … are single-file primitives many layers import. They depend on nothing above them (a core
diff --git a/backend/app/audit.py b/backend/app/audit.py
index 6dfba3d1..14087279 100644
--- a/backend/app/audit.py
+++ b/backend/app/audit.py
@@ -27,7 +27,7 @@ class AuditAction:
     USER_SUSPEND = "user_suspend"
     USER_UNSUSPEND = "user_unsuspend"
     USER_DELETE = "user_delete"
-    # E9.5 S5: an admin let a stuck registrant in, or re-sent their confirmation link. Both are
+    # An admin let a stuck registrant in, or re-sent their confirmation link. Both are
     # recorded because both are the admin acting ON someone's access, not merely reading a list.
     USER_ACTIVATE = "user_activate"
     USER_VERIFY_RESEND = "user_verify_resend"
@@ -36,12 +36,9 @@ class AuditAction:
     INVITE_DENY = "invite_deny"
     INVITE_ADD = "invite_add"
     INVITE_DELETE = "invite_delete"
-    # E9.5 S6: the admin chose to tell someone their address is whitelisted. Adding the address is
+    # The admin chose to tell someone their address is whitelisted. Adding the address is
     # silent, so this is the act that actually reaches a person — and the one worth a record.
     INVITE_SEND = "invite_send"
-    DEMO_ADD = "demo_add"
-    DEMO_REMOVE = "demo_remove"
-    DEMO_RESET = "demo_reset"
     DISCOVERY_PURGE = "discovery_purge"
     # Config
     CONFIG_SET = "config_set"
@@ -58,7 +55,7 @@ class AuditAction:
     DOWNLOAD_CREDENTIAL_DELETE = "download_credential_delete"
     # The log itself was cleared (a single row survives the clear as tamper-evidence)
     AUDIT_CLEAR = "audit_clear"
-    # E16: a user sent a debug session's issue to the tracker — the one act that takes their log
+    # A user sent a debug session's issue to the tracker — the one act that takes their log
     # off this instance, so it is recorded (target = the session, summary = the issue's URL).
     ISSUE_CREATE = "issue_create"
 
diff --git a/backend/app/auth.py b/backend/app/auth.py
index cbee737c..97485bfd 100644
--- a/backend/app/auth.py
+++ b/backend/app/auth.py
@@ -24,8 +24,6 @@ def operator_contact() -> str | None:
     return next(iter(sorted(settings.admin_email_set)), None)
 
 
-DEMO_GOOGLE_SUB = "__demo__"
-DEMO_EMAIL = "demo@siftlode.local"
 MAX_SESSION_ACCOUNTS = 6
 
 # OAuth scope vocabulary — the atoms + the request bundles, kept together as core. has_*_scope check
@@ -69,7 +67,7 @@ def has_write_scope(user: User) -> bool:
 def env_allowed_canonicals() -> set[str]:
     """The env bootstrap allow-list, in CANONICAL form — the only shape it may be compared in.
 
-    S3 canonicalised the Invite branch of `is_allowed` and left this one matching the literal string,
+    Canonicalising only the Invite branch of `is_allowed` left this one matching the literal string,
     which is the 2026-09-03 lockout with a different source of truth: an operator who writes
     `first.last@gmail.com` into ALLOWED_EMAILS is refused when Google answers with the undotted
     primary, and a `+tag`ged entry can never match at all, because a Google account cannot contain a
@@ -129,7 +127,7 @@ def can_activate(db: Session, user: User) -> bool:
     Lives in core so the admin surface and the /api/me badge count answer from ONE definition; a
     button that appears and a number that counts must never disagree about who is stuck.
     """
-    if user.is_demo or user.is_suspended or user.is_active:
+    if user.is_suspended or user.is_active:
         return False
     return is_allowed(db, user.email)
 
@@ -147,7 +145,6 @@ def count_pending_activations(db: Session) -> int:
     rows = (
         db.execute(
             select(User).where(
-                User.is_demo.is_(False),
                 User.is_suspended.is_(False),
                 User.is_active.is_(False),
             )
@@ -188,24 +185,6 @@ def find_user_by_email(db: Session, email: str) -> User | None:
     return candidates[0] if len(candidates) == 1 else None
 
 
-def get_or_create_demo_user(db: Session) -> User:
-    """The one shared demo user, created on first use. No OAuth token / YouTube scope, so
-    has_read_scope/has_write_scope are False and every YouTube-touching path is closed to it."""
-    user = db.query(User).filter(User.is_demo.is_(True)).one_or_none()
-    if user is None:
-        user = User(
-            google_sub=DEMO_GOOGLE_SUB,
-            email=DEMO_EMAIL,
-            display_name="Demo",
-            role="user",
-            is_demo=True,
-            preferences={"language": "en"},
-        )
-        db.add(user)
-        db.commit()
-    return user
-
-
 def revoke_google_token(token: str | None) -> None:
     """Best-effort revocation of a Google OAuth grant at Google's endpoint. Revoking the refresh
     token tears down the whole grant, so a later sign-in starts from a clean consent (no scopes
@@ -278,8 +257,7 @@ ACTIVE_ACCOUNT_HEADER = "x-siftlode-account"
 
 def resolved_user_id(conn: HTTPConnection, *, strict: bool = True) -> tuple[int | None, bool]:
     """Which account this connection acts as, and whether that's the session's default account.
-    Takes any HTTPConnection — an HTTP Request OR a WebSocket — so the WS push channel shares this
-    exact per-tab resolution instead of re-implementing it.
+    Takes an HTTPConnection rather than a Request: it reads only the session and the headers.
 
     The signed cookie holds the *wallet* (`account_ids`, every account signed into this browser)
     plus a default `user_id`. A caller may name its account with the X-Siftlode-Account header (or
@@ -297,8 +275,8 @@ def resolved_user_id(conn: HTTPConnection, *, strict: bool = True) -> tuple[int
     """
     default_id = conn.session.get("user_id")
     wallet = conn.session.get("account_ids") or []
-    # Header for normal XHR; ?account= for contexts that can't set headers (WebSocket, and a
-    # plain <a> file download). Both are wallet-gated below.
+    # Header for normal XHR; ?account= for a context that can't set headers (a plain <a> file
+    # download). Both are wallet-gated below.
     hdr = conn.headers.get(ACTIVE_ACCOUNT_HEADER) or conn.query_params.get("account")
     if hdr:
         try:
@@ -362,12 +340,12 @@ def _session_user(request: Request, db: Session, user_id: int | None, is_default
     if default_id and default_id not in accounts:
         accounts.append(default_id)
         request.session["account_ids"] = accounts[-MAX_SESSION_ACCOUNTS:]
-    # Attribute this request's log lines to the account (E22). Here, not in the request middleware:
+    # Attribute this request's log lines to the account. Here, not in the request middleware:
     # this is the one place a session becomes an account, and the middleware runs outside both the
     # session middleware and this task's context. `request.state` is shared across middleware layers
     # (it lives on the ASGI scope), so the access-log line can read it back. The user's consented
-    # diagnostics level rides along: their requests are logged — and stored — in that detail (S5).
-    # So does a debug session the request names (E16): only the caller's own open one counts, and a
+    # diagnostics level rides along: their requests are logged — and stored — in that detail.
+    # So does a debug session the request names: only the caller's own open one counts, and a
     # header naming anything else is ignored rather than refused — a stale tab must keep working.
     session = debugsession.from_header(db, user, request.headers.get(debugsession.HEADER))
     level, until = debugsession.level_for(user, session)
@@ -403,25 +381,10 @@ def optional_current_user(request: Request, db: Session = Depends(get_db)) -> Us
         return None
 
 
-def require_human(user: User = Depends(current_user)) -> User:
-    """Reject the shared demo account from actions that need a real Google/YouTube identity
-    or spend the shared quota. Most YouTube paths are already closed to it implicitly (it has
-    no token, so has_read_scope/has_write_scope are False); this makes the boundary explicit
-    where there's no scope check to lean on."""
-    if user.is_demo:
-        # Structured, because `req` leaves 403 to the caller and `notifyActionError` only shows a
-        # STRUCTURED detail — a plain string here reached the demo user as their caller's generic
-        # "couldn't do that", with no hint that the demo account is the reason (round 6). Affordances
-        # this gate sits behind are not all UI-gated on `is_demo` (the comfort shelf is not).
-        raise HTTPException(status_code=403, detail={"code": "demo"})
-    return user
-
-
-def require_write_scope(user: User = Depends(require_human)) -> User:
+def require_write_scope(user: User = Depends(current_user)) -> User:
     """Dependency: require the YouTube write scope (subscribe/unsubscribe, playlist export/edit).
     Single source of truth for the write gate — replaces the inline `if not has_write_scope(user)`
-    checks that had drifted into three different 403 messages across channels/playlists. Layers on
-    `require_human` because writing to YouTube needs a real, non-demo identity."""
+    checks that had drifted into three different 403 messages across channels/playlists."""
     if not has_write_scope(user):
         raise refused(403, "youtube_editing_off")
     return user
diff --git a/backend/app/bodylimit.py b/backend/app/bodylimit.py
index 5b4dc3a5..befa1d11 100644
--- a/backend/app/bodylimit.py
+++ b/backend/app/bodylimit.py
@@ -59,9 +59,9 @@ DEFAULT_MAX_BODY_BYTES = 1024 * 1024
 # a say.
 #
 # Both listed routes now satisfy that. The screenshot route always did (`capped_body` streams it,
-# and the owner check resolves first). The upload route did NOT until P1: it declared
+# and the owner check resolves first). The upload route did NOT at first: it declared
 # `file: UploadFile = File(...)`, so an anonymous caller could make the process write the whole
-# per-file allowance to temp before `require_human` refused them — this middleware bounded that
+# per-file allowance to temp before the auth dependency refused them — this middleware bounded that
 # number but could not stop the writing. It now reads its own body from a dependency declared after
 # the auth one, so its in-handler cap measures bytes as they arrive, like everything else here.
 #
@@ -73,12 +73,12 @@ DEFAULT_MAX_BODY_BYTES = 1024 * 1024
 # `POST /api/diagnostics/events` is absent: its `capped_body` limit is 512 KiB, already below the
 # default, so listing it could only widen what it accepts.
 ROUTE_MAX_BODY_BYTES: dict[tuple[str, str], int] = {
-    # Ingesting a local file. The body IS the file since P1 — no multipart envelope to allow for —
+    # Ingesting a local file. The body IS the file now — no multipart envelope to allow for —
     # so this ceiling and the route's own cap count exactly the same bytes. `sysconfig`'s
     # `download_upload_max_bytes` is bounded by this same constant (see sysconfig.SPECS), so an
     # admin can only ever LOWER the route's cap below the edge, never raise it past one.
     #
-    # WHICH LAYER ANSWERS, measured rather than assumed (deep-review round 1):
+    # WHICH LAYER ANSWERS, measured rather than assumed:
     #   * knob LOWERED (an override below the default) — the route's cap is the smaller number, so
     #     `capped_stream_to` trips first and answers 422 `upload_too_large` carrying the admin's own
     #     figure, after draining the rest of the body so the client can read it.
diff --git a/backend/app/collation.py b/backend/app/collation.py
index 846049a2..be993587 100644
--- a/backend/app/collation.py
+++ b/backend/app/collation.py
@@ -1,4 +1,4 @@
-"""Alphabetical order in the reader's language (E30 S3).
+"""Alphabetical order in the reader's language.
 
 Why not the database default: the Postgres image is Alpine, and musl's `en_US.utf8` collation is BYTE
 order — every accented initial sorted after "Z" ("Zorró < Életrajzi < Ötödik"), in every A→Z list the
diff --git a/backend/app/config.py b/backend/app/config.py
index 02ce10d1..b7680444 100644
--- a/backend/app/config.py
+++ b/backend/app/config.py
@@ -146,8 +146,6 @@ class Settings(BaseSettings):
     autotag_interval_minutes: int = 30
     subscriptions_resync_minutes: int = 360
     playlist_sync_minutes: int = 360
-    # How often the shared demo account is auto-reset to a clean baseline (communal sandbox).
-    demo_reset_minutes: int = 720
     # --- Maintenance / validation job ---
     # Runs once a day by default (admin-tunable via the Scheduler dashboard). Grace periods
     # are in days because that's the granularity that matters; the rolling re-validation
@@ -244,7 +242,7 @@ class Settings(BaseSettings):
     download_default_max_bytes: int = 5_368_709_120  # 5 GiB
     download_default_max_concurrent: int = 2
     download_default_max_jobs: int = 50
-    # Per-file cap for local uploads (E7). Unlike a download (whose size is unknown until the worker
+    # Per-file cap for local uploads. Unlike a download (whose size is unknown until the worker
     # finishes), an upload's size is known at ingest, so this bounds a single file directly; the
     # user's overall byte footprint is still governed by download_default_max_bytes.
     # ge=1: this number is also the EDGE ceiling (`bodylimit.ROUTE_MAX_BODY_BYTES`), where 0 is a
@@ -268,7 +266,7 @@ class Settings(BaseSettings):
     # Default SponsorBlock (skip sponsor segments) for new custom profiles.
     sponsorblock_default: bool = False
 
-    # --- Diagnostics / logging (E22) ---
+    # --- Diagnostics / logging ---
     # BOOTSTRAP level only: the running level is the `log_level` admin knob (sysconfig), applied at
     # startup and on change without a restart. This is what a process logs at before it can reach
     # the database — and the only knob the worker/runner children read, since they are short-lived.
@@ -301,7 +299,7 @@ class Settings(BaseSettings):
     plex_path_map: str = ""
     # Which Plex library section keys are exposed (comma-separated). Empty = all enabled sections.
     plex_libraries: str = ""
-    # HU-overlay mapping (E5 S5): comma-separated `huSectionKey:enSectionKey` pairs. Each named HU
+    # HU-overlay mapping: comma-separated `huSectionKey:enSectionKey` pairs. Each named HU
     # section is synced as a non-browsable overlay whose Hungarian metadata is written onto the EN
     # twin section's rows (matched by guid). Empty = no overlays. E.g. "3:4,5:1".
     plex_overlay_map: str = ""
@@ -311,7 +309,7 @@ class Settings(BaseSettings):
     plex_sync_interval_min: int = 360
     # How often the incremental Plex→Siftlode watch-state reconcile runs, in minutes (Phase C):
     # a cheap history + on-deck pull plus a re-push of any states that failed their immediate push.
-    # 15 min (S2): with Plex now the source of truth (prompt write-back on the ~10s checkpoint +
+    # 15 min: with Plex now the source of truth (prompt write-back on the ~10s checkpoint +
     # Plex-authoritative pull), a faster incremental pull keeps Siftlode close to Plex-side changes.
     plex_watch_sync_interval_min: int = 15
     # How often the FULL watch-state reconcile runs, in minutes (Phase C). A whole-section rescan
@@ -326,7 +324,7 @@ class Settings(BaseSettings):
     # each one is a whole segmented copy of the film on the scratch volume, written faster than
     # realtime. One account holds at most two regardless (plex/stream.py `_MAX_SESSIONS_PER_USER`).
     plex_max_sessions: int = 8
-    # --- Transcode (playable="transcode") re-encode tuning (E6 S1) ---
+    # --- Transcode (playable="transcode") re-encode tuning ---
     # Hardware-encoder policy: "auto" = VAAPI (h264_vaapi) when the iGPU render node is present AND the
     # source codec is hardware-decodable, else libx264 software; "on" = force VAAPI wherever the render
     # node exists (skip the decodability gate); "off" = always software. See plex/stream.py `_select_encode`.
@@ -349,7 +347,7 @@ class Settings(BaseSettings):
     # local disk, so the default is fine there.
     plex_hls_dir: str = ""
 
-    # --- TMDB enrichment (E5 S2; optional — enriches the Plex catalog from TMDB) ---
+    # --- TMDB enrichment (optional — enriches the Plex catalog from TMDB) ---
     # TMDB API key (v3 api_key, 32 hex chars). Server-side only; stored encrypted when set via the
     # admin Config page. Empty → the TMDB enrichment job no-ops. Feeds keywords / crew / budget /
     # revenue / TMDb score / recommendations / backdrops onto the mirrored Plex rows, matched by the
@@ -359,7 +357,7 @@ class Settings(BaseSettings):
     # Metadata language for TMDB fetches (keyword/overview locale). Stored EN by default.
     tmdb_language: str = "en-US"
 
-    # --- Bug reports (E16): where a debug session's issue goes. All three empty = no tracker; the
+    # --- Bug reports: where a debug session's issue goes. All three empty = no tracker; the
     # composer still exports a zip. The repository must be PRIVATE — an issue carries the reporter's
     # log — and app/issues/gitea.py refuses a public one. Runtime knobs (sysconfig, admin UI). ---
     issues_gitea_url: str = ""
@@ -369,7 +367,7 @@ class Settings(BaseSettings):
     tmdb_enrich_interval_min: int = 120
     # Titles fetched per TMDB enrichment run (TMDB is fast + generously rate-limited).
     tmdb_enrich_batch: int = 100
-    # How often the people job (E30 S6) fetches a batch of person bios from TMDB and portraits through Plex,
+    # How often the people job fetches a batch of person bios from TMDB and portraits through Plex,
     # in minutes, and how many of each per run: ~18k linked people at 300 per 10 min is about ten hours
     # once, then only the newcomers.
     people_enrich_interval_min: int = 10
diff --git a/backend/app/debugsession.py b/backend/app/debugsession.py
index 0f0aa167..deaa27bc 100644
--- a/backend/app/debugsession.py
+++ b/backend/app/debugsession.py
@@ -1,4 +1,4 @@
-"""Debug sessions (E16): Start → reproduce → Stop, and the evidence a bug report is built from.
+"""Debug sessions: Start → reproduce → Stop, and the evidence a bug report is built from.
 
 While a session is open its user's browser names it in `X-Debug-Session` on every request. The auth
 dependency accepts the header only for the caller's OWN open session (anything else is ignored, never
@@ -269,7 +269,7 @@ def set_delivery(db: Session, session: DebugSession, state: dict, token: str) ->
     every step. It is stamped from `token` here instead, and only after the ROW confirms the claim
     is still ours. Without that check the write is a full-column overwrite with no WHERE: a send
     that lost its lease came back and stomped the take-over send's committed links, then put its
-    own dead token back on an idle session (deep-review round 4). `release_send` has always made
+    own dead token back on an idle session. `release_send` has always made
     the same check; this is the other half of it."""
     if claim_owner(db, session) != token:
         raise SendClaimLost(session.id)
diff --git a/backend/app/demo.py b/backend/app/demo.py
deleted file mode 100644
index 3cb09cd5..00000000
--- a/backend/app/demo.py
+++ /dev/null
@@ -1,82 +0,0 @@
-"""Demo-account service: reset the shared demo sandbox to a clean, seeded baseline.
-
-Shared by the admin's manual reset endpoint (routes/admin.py) and the scheduled demo-reset job
-(scheduler.py). Lives in the service layer, not routes, so the scheduler can call it without an
-`app.routes -> app.scheduler` import cycle (the reason its import used to be lazy).
-"""
-
-from sqlalchemy import delete, func, select
-from sqlalchemy.orm import Session
-
-from app.models import Playlist, PlaylistItem, Subscription, User, Video, VideoState
-
-
-def _seed_demo_playlists(db: Session, demo: User) -> int:
-    """Seed a few sample playlists from the shared catalog so a freshly-reset demo isn't
-    empty — gives visitors something to play with. Best-effort: skips silently if the
-    catalog is too small."""
-    recent = (
-        db.execute(
-            select(Video.id)
-            .where(Video.is_short.is_(False), Video.live_status == "none")
-            .order_by(Video.published_at.desc().nullslast())
-            .limit(60)
-        )
-        .scalars()
-        .all()
-    )
-    if not recent:
-        return 0
-    samples = [
-        ("Fresh picks", recent[0:10]),
-        ("Quick watch", recent[10:18]),
-        ("Saved for later", recent[18:26]),
-    ]
-    created = 0
-    for pos, (name, vids) in enumerate(samples):
-        if not vids:
-            continue
-        pl = Playlist(user_id=demo.id, name=name, position=pos)
-        db.add(pl)
-        db.flush()
-        for ipos, vid in enumerate(vids):
-            db.add(PlaylistItem(playlist_id=pl.id, video_id=vid, position=ipos))
-        created += 1
-    return created
-
-
-def _seed_demo_subscriptions(db: Session, demo: User, n: int = 14) -> int:
-    """Seed the demo with a handful of catalog channels (the ones with the most videos) so its
-    Channel manager isn't empty — gives visitors something to explore and matches the landing-page
-    screenshot. Idempotent: clears the demo's subscriptions first, then re-adds the top N."""
-    db.execute(delete(Subscription).where(Subscription.user_id == demo.id))
-    top = (
-        db.execute(
-            select(Video.channel_id)
-            .where(Video.channel_id.is_not(None))
-            .group_by(Video.channel_id)
-            .order_by(func.count().desc())
-            .limit(n)
-        )
-        .scalars()
-        .all()
-    )
-    for channel_id in top:
-        db.add(Subscription(user_id=demo.id, channel_id=channel_id))
-    return len(top)
-
-
-def reset_demo_state(db: Session, demo: User) -> int:
-    """Wipe the demo account's per-user state (watch/save/hide states, playlists, preferences)
-    back to a clean baseline and re-seed a few sample playlists + channel subscriptions. Returns
-    the seeded playlist count. Shared by the admin's manual reset button and the scheduled demo
-    reset (see scheduler)."""
-    db.execute(delete(VideoState).where(VideoState.user_id == demo.id))
-    # Playlist items cascade on playlist delete (ondelete="CASCADE").
-    db.execute(delete(Playlist).where(Playlist.user_id == demo.id))
-    demo.preferences = {"language": "en"}
-    db.commit()
-    seeded = _seed_demo_playlists(db, demo)
-    _seed_demo_subscriptions(db, demo)
-    db.commit()
-    return seeded
diff --git a/backend/app/diagnostics.py b/backend/app/diagnostics.py
index 38e5adb4..eb483ddb 100644
--- a/backend/app/diagnostics.py
+++ b/backend/app/diagnostics.py
@@ -1,4 +1,4 @@
-"""A user's diagnostics level (E22 S5): what they consented to, and for how long.
+"""A user's diagnostics level: what they consented to, and for how long.
 
 Three levels, named in the UI Alap / Részletes / Teljes:
 
@@ -10,7 +10,6 @@ Three levels, named in the UI Alap / Részletes / Teljes:
 
 A raised level always lapses after `ELEVATION_HOURS`: the expiry is computed HERE at consent time,
 never taken from the client, and an expired level reads as INFO without anything having to clear it.
-The shared demo account cannot raise its level — its log would mix every visitor's session.
 
 Core layer: imports `models` and `sysconfig`.
 """
@@ -27,7 +26,7 @@ DiagnosticsLevel = Literal["INFO", "DEBUG", "TRACE"]
 LEVELS: tuple[str, ...] = get_args(DiagnosticsLevel)
 BASE: DiagnosticsLevel = "INFO"
 ELEVATION_HOURS = 24
-# How long a debug session records at most (E16, app/debugsession.py). Here, beside the other
+# How long a debug session records at most (app/debugsession.py). Here, beside the other
 # consent window, because the start dialog's consent text states it and reads it from `state`.
 SESSION_MINUTES = 60
 
diff --git a/backend/app/discover/__init__.py b/backend/app/discover/__init__.py
index e6f779b7..b73252f2 100644
--- a/backend/app/discover/__init__.py
+++ b/backend/app/discover/__init__.py
@@ -1,4 +1,4 @@
-"""E24 — the read-model behind the Home surface ("Mit nézzek most?").
+"""The read-model behind the Home surface ("Mit nézzek most?").
 
 The anti-paralysis answer layer: one hero suggestion, a cross-source resume rail, and the user's own
 comfort shelf, all served from our own Postgres with no upstream call at serve time (the same rule
diff --git a/backend/app/discover/budget.py b/backend/app/discover/budget.py
index 23e2f558..f5a7a851 100644
--- a/backend/app/discover/budget.py
+++ b/backend/app/discover/budget.py
@@ -1,4 +1,4 @@
-"""The time budget — E24's replacement for "what mood are you in?".
+"""The time budget — the replacement for "what mood are you in?".
 
 `random-gondolatok` 15/D asked for a mood questionnaire before the recommendations. The same file's
 later BA-interview note (#23) says the mood half is not what makes this work: the friction is
diff --git a/backend/app/discover/pins.py b/backend/app/discover/pins.py
index 9b6ede72..c6fca272 100644
--- a/backend/app/discover/pins.py
+++ b/backend/app/discover/pins.py
@@ -46,8 +46,8 @@ def resolve_ref(db: Session, user: User, kind: str, ref: str) -> tuple[str, obje
     translation belongs here rather than in five call sites.
 
     The COLUMN half of every answer comes from `PIN_COLUMNS`; only the LOOKUP differs per kind
-    (a direct `db.get`, a rating-key translation, an int parse plus an ownership check). Before the
-    E24 review the branches spelled the column names out again and `PIN_COLUMNS` had no readers at
+    (a direct `db.get`, a rating-key translation, an int parse plus an ownership check). Before a
+    review the branches spelled the column names out again and `PIN_COLUMNS` had no readers at
     all — a constant that called itself the one vocabulary while nothing spoke it."""
     col = PIN_COLUMNS.get(kind)
     if col is None:
diff --git a/backend/app/downloads/adapters.py b/backend/app/downloads/adapters.py
index 4749adc5..5c8e4150 100644
--- a/backend/app/downloads/adapters.py
+++ b/backend/app/downloads/adapters.py
@@ -156,7 +156,7 @@ class YouTubeAdapter(SourceAdapter):
 
 class FacebookAdapter(SourceAdapter):
     key = "facebook"
-    # Measured (E11.5, yt-dlp 2026.07.04): with the user's cookie, some reels answer a plain request
+    # Measured (yt-dlp 2026.07.04): with the user's cookie, some reels answer a plain request
     # with "Cannot parse data" and parse only when the request looks like Chrome. Impersonation is a
     # SECOND attempt behind that one error, not the default: the links that already download with the
     # cookie keep their proven path, and only the ones stuck at the wall go through curl_cffi. Without
@@ -166,7 +166,7 @@ class FacebookAdapter(SourceAdapter):
     _POST_PAGE_MAX_BYTES = 16 * 1024 * 1024
 
     def resolve_url(self, url: str, ydl_opts: dict) -> str:
-        # Measured (E11.5 S4): given a group post's link, yt-dlp either finds no formats or — worse —
+        # Measured: given a group post's link, yt-dlp either finds no formats or — worse —
         # downloads ANOTHER video from the page's feed data. The post's own video is the one Video node
         # in the page scripts that carry the post id; its watch link downloads (plain first, then the
         # Chrome retry above). Needs the cookie: signed out, the page is the login wall.
@@ -176,7 +176,7 @@ class FacebookAdapter(SourceAdapter):
         with yt_dlp.YoutubeDL(ydl_opts) as ydl:
             raw = ydl.urlopen(url).read(self._POST_PAGE_MAX_BYTES)
         page = raw.decode("utf-8", "replace")
-        # Measured (E11.5 review): a refused or expired cookie gets the login page (~450 KB, a login
+        # Measured: a refused or expired cookie gets the login page (~450 KB, a login
         # form, no post id at all), which is not a post without a video — the user's cookie is the cause.
         if _quoted(post_id) not in page:
             raise StatedFailure(POST_NOT_SHOWN_MESSAGE)
diff --git a/backend/app/downloads/credentials.py b/backend/app/downloads/credentials.py
index bce4ca4c..f7cef6cd 100644
--- a/backend/app/downloads/credentials.py
+++ b/backend/app/downloads/credentials.py
@@ -249,8 +249,8 @@ def usable_cookie(
 
     If (2) fails the asset is the SHARED (unsalted) one — attaching the cookie would poison the
     global cache with a private-group video, so we attach nothing. An unreadable blob (rotated key →
-    InvalidToken) also yields None; the download then fails honestly on the login wall (S3's
-    `login_required`)."""
+    InvalidToken) also yields None; the download then fails honestly on the login wall (the
+    `login_required` category)."""
     host_key = host_key_for_url(url)
     if host_key is None:
         return None
diff --git a/backend/app/downloads/errors.py b/backend/app/downloads/errors.py
index eaa57424..3475d5f2 100644
--- a/backend/app/downloads/errors.py
+++ b/backend/app/downloads/errors.py
@@ -8,7 +8,7 @@ explanation (and decides whether a retry makes sense). The raw text stays availa
 "details" disclosure. This is the same string-matching approach the worker already trusts for
 `_RETRIABLE_MARKERS` — kept here as the single source of truth for "what kind of failure is this".
 
-**The failure catalog** (`_CATALOG`, E11.5). A category is generic: "Sign-in required" cannot tell a
+**The failure catalog** (`_CATALOG`). A category is generic: "Sign-in required" cannot tell a
 Facebook user that the cookie they already gave was refused, and yt-dlp words several different
 Facebook walls identically (`Cannot parse data`). A catalog entry is scoped to ONE host and may also
 depend on whether a cookie was attached and on the kind of link, and names a `detail` code the UI has
@@ -49,7 +49,7 @@ from app.downloads.credentials import host_key_for_url
 # "produced no output file" have markers here; the urlguard refusal deliberately has none and
 # classifies as `unknown` — it is a refusal, not a diagnosis, and no category would say more.
 #
-# A source adapter's verdicts on a link (`SourceAdapter.resolve_url`, E11.5 S4) are adapters.py's
+# A source adapter's verdicts on a link (`SourceAdapter.resolve_url`) are adapters.py's
 # constants, imported above; each has a rule below that gives its category back, and a catalog entry
 # that gives the site's sentence.
 QUOTA_FULL_MESSAGE = "Your download storage is full — free up space, then try again."
diff --git a/backend/app/downloads/formats.py b/backend/app/downloads/formats.py
index 22e43f50..a8deef1e 100644
--- a/backend/app/downloads/formats.py
+++ b/backend/app/downloads/formats.py
@@ -13,7 +13,7 @@ spec shape (all keys optional; defaults + browser-playability clamp applied by `
     vcodec         always coerced to null → H.264 selected (see `normalize`); no opt-out
     embed_subs     bool     embed_chapters bool     embed_thumbnail bool     sponsorblock bool
 
-`normalize` clamps container/vcodec/audio_format so EVERY download plays in-browser (E7); the
+`normalize` clamps container/vcodec/audio_format so EVERY download plays in-browser; the
 `container`/`vcodec` keys survive only so an old stored profile deserializes without error.
 """
 
@@ -217,7 +217,7 @@ def normalize(spec: dict) -> dict:
     # Audio-only files can't embed subtitles/thumbnails as video; keep the flags meaningful.
     if s["mode"] == "a":
         s["embed_subs"] = False
-    # Browser-playability guarantee (E7): the Download module exists to download → share → PLAY
+    # Browser-playability guarantee: the Download module exists to download → share → PLAY
     # in-browser, so every output must play in EVERY browser, iOS/Safari/WebKit included. The only
     # universally-safe combo is mp4 + H.264 + AAC/MP3, so we CLAMP the spec to it HERE — the single
     # point every path (picker, stored profile, raw API) flows through — instead of only hiding
@@ -274,7 +274,7 @@ def build_ydl_opts(
     `extractor_args` with the player-client set + bgutil PO-token base_url); it is merged onto the
     generic options below. Everything here is source-agnostic.
 
-    `cookiefile` is the acting user's per-host cookies.txt path (S6), attached ONLY by the worker
+    `cookiefile` is the acting user's per-host cookies.txt path, attached ONLY by the worker
     after the host-scope + private-asset gate in `downloads.credentials`. It is set AFTER the `extra`
     merge so a source adapter can never clobber it.
 
@@ -329,7 +329,7 @@ def build_ydl_opts(
     if max_bytes and max_bytes > 0:
         opts["max_filesize"] = max_bytes
 
-    # The acting user's per-host cookie (S6). AFTER the adapter merge on purpose: an adapter must not
+    # The acting user's per-host cookie. AFTER the adapter merge on purpose: an adapter must not
     # be able to override the authenticated session the worker resolved for this specific user.
     if cookiefile:
         opts["cookiefile"] = cookiefile
diff --git a/backend/app/downloads/pipeline.py b/backend/app/downloads/pipeline.py
index 22c7c1ac..e2554fbe 100644
--- a/backend/app/downloads/pipeline.py
+++ b/backend/app/downloads/pipeline.py
@@ -73,7 +73,7 @@ _YTDLP_TEMP_RE = re.compile(
 
 def _notify_download_done(db, user_id: int | None, title: str | None, job_id, *, kind: str) -> None:
     """Post a best-effort 'ready' notice to the owner's inbox — downloads/edits used to finish
-    silently while scheduler jobs and playlist-push already notified (R11 feedback symmetry). A
+    silently while scheduler jobs and playlist-push already notified (feedback symmetry). A
     notification failure must never mask the completed job, so it is isolated + rolled back (mirrors
     scheduler._notify_done). `kind` ("download"/"edit") lets the inbox pick accurate copy; the
     English title here is only a fallback for an unknown type. `user_id`/`title` are captured by the
@@ -219,7 +219,7 @@ def _ffmpeg_progress_writer(job_id: int, phase: str, *, now=time.monotonic):
     when the whole-percent value changed (the bar shows integers), plus a separate once-per-interval
     heartbeat while the percent is stuck (so a slow re-encode isn't mistaken for a stall)."""
     # Progress writes have their OWN 1/interval budget so a heartbeat can never delay a real write (the
-    # round-1 concern). The heartbeat, in turn, is gated on `last_touch` — the last DB write OR beat —
+    # original concern). The heartbeat, in turn, is gated on `last_touch` — the last DB write OR beat —
     # so a progress write (which already refreshes updated_at) suppresses a redundant heartbeat that
     # same interval, keeping active downloads at ~1 write/interval, not two.
     allow_write = _rate_limiter(_DB_WRITE_INTERVAL_S, now=now)
@@ -341,7 +341,7 @@ def _extract_with_fallback(
     (adapters.POST_*_MESSAGE) instead of letting yt-dlp guess, and a failed page read fails the
     download as itself.
 
-    `cookiefile` (S6) is the acting user's per-host cookies.txt, already gated by
+    `cookiefile` is the acting user's per-host cookies.txt, already gated by
     `credentials.resolve_cookiefile`; passed to every attempt so the fallback stays authenticated.
 
     `max_bytes` (SEC-13) is the owner's remaining storage budget, applied to every attempt."""
@@ -483,7 +483,7 @@ def _download(
                 urlguard.check_url(url)
             except urlguard.BlockedUrl as e:
                 raise StatedFailure(f"Refusing to download from this address ({e.reason}).") from e
-        # S6: attach the acting user's per-host cookie ONLY when it's host-scoped to this URL AND
+        # Attach the acting user's per-host cookie ONLY when it's host-scoped to this URL AND
         # this asset is that user's private, salted identity (the double gate lives in credentials).
         remaining_bytes: int | None = None
         with SessionLocal() as cdb:
diff --git a/backend/app/downloads/upload.py b/backend/app/downloads/upload.py
index 1c91421e..ea565c50 100644
--- a/backend/app/downloads/upload.py
+++ b/backend/app/downloads/upload.py
@@ -1,4 +1,4 @@
-"""Local file ingest for the download center (E7 S5) — the non-yt-dlp path into the media library.
+"""Local file ingest for the download center — the non-yt-dlp path into the media library.
 
 A user-uploaded file joins the SAME library as a downloaded one, so it inherits the whole function
 set already built (metadata chips, share links, and — for media — in-app play/edit). Unlike a
diff --git a/backend/app/email.py b/backend/app/email.py
index 8b92813a..2eeeaacf 100644
--- a/backend/app/email.py
+++ b/backend/app/email.py
@@ -197,7 +197,7 @@ def _next_step(verify_link: str | None, has_account: bool, hours: int, lang: str
 
     Three states, because a mail that guesses wrong sends someone looking for a link that isn't
     coming — or worse, tells them to sign in when their address is still unconfirmed and sign-in will
-    refuse them (E9.5 S4 named that state on screen; the mail must not contradict it).
+    refuse them (the sign-in screen names that state; the mail must not contradict it).
 
     The link branch is the point of the C option: in the common ordering — approve first, the person
     signs up later, or signs up and waits — they would otherwise have to find and open TWO separate
@@ -253,7 +253,7 @@ def send_access_invitation(
     the closing line offers no deadline — nudging is the one thing this mail must not do.
 
     Its language is the one place the app has no signal to read: the admin typed this address in, so
-    nobody has ever told us how to address its owner. That is why the send button asks (E9.5 S7).
+    nobody has ever told us how to address its owner. That is why the send button asks.
     """
     admin, contact = _reply_contact(lang)
     body = mailtext.text(
diff --git a/backend/app/feedquery.py b/backend/app/feedquery.py
index aa84af0e..dfedd76a 100644
--- a/backend/app/feedquery.py
+++ b/backend/app/feedquery.py
@@ -109,7 +109,7 @@ def _tag_visible(user: User):
 # The pseudo-category of a selected tag id no Tag row answers (a saved view or the feed state outlives
 # a deleted tag). It filters like a category whose tags no channel carries — to nothing, in the SQL and
 # in feed_summary's mirror alike — instead of the id being dropped, which showed the WHOLE feed under
-# the view's old name (E32 S2). No real category is called this (language/topic/other).
+# the view's old name. No real category is called this (language/topic/other).
 MISSING_TAG_CATEGORY = "missing"
 
 
@@ -118,7 +118,7 @@ def tags_by_category(db: Session, user: User, tag_ids: list[int]) -> dict[str, l
     shared by the feed's tag WHERE (filtered_query) and the facet/count summary (feed_summary), so the
     two can't disagree on which selected tag belongs to which category. An unknown id lands in
     MISSING_TAG_CATEGORY — and so does another user's private tag: resolving it to its real category
-    told the caller which foreign ids exist (E32 review)."""
+    told the caller which foreign ids exist."""
     if not tag_ids:
         return {}  # skip the pointless `WHERE id IN ()` round-trip on the no-tag-filter hot path
     out: dict[str, list[int]] = {}
@@ -463,7 +463,7 @@ def feed_summary(db: Session, user: User, **params) -> dict:
 
 
 def feed_years(db: Session, user: User, **params) -> list[dict]:
-    """Per-year video counts for the current filter context (item 8 / E8·S2): powers the year control's
+    """Per-year video counts for the current filter context: powers the year control's
     quick chips + the "more…" per-year-counts dialog. Every OTHER filter (tags, channels, content type,
     search, watch state, scope) still applies, but the publish-date narrowing itself is DROPPED —
     published_after/before and max_age_days — so the year list is the full set of years available and
@@ -559,7 +559,7 @@ def sort_keys(sort: str, seed: int, rank_expr=None, lang: str | None = None) ->
     return table.get(sort) or table["newest"]
 
 
-# Relevance ranks only the newest RANK_WINDOW matches (E31): ts_rank reads every match's tsvector, and
+# Relevance ranks only the newest RANK_WINDOW matches: ts_rank reads every match's tsvector, and
 # a broad word matches most of the library ("a" ranked 193k rows in 6.8 s on prod, against 1.1 s to just
 # find them). The rows past the window keep rank 0, so they follow the ranked ones newest first; a word
 # that broad has no meaningful relevance order anyway, and a specific one fits the window whole.
@@ -671,7 +671,7 @@ def encode_cursor(keys: list[dict], row, window: datetime | None = None) -> str:
 def _cursor_dt(v):
     """A cursor's timestamp: aware or refused. The server writes only aware ones (timestamptz), and
     windowed_relevance_rows compares them in Python, where a naive one beside an aware one raises — a
-    500 for a hand-made cursor instead of the 400 (E31 review 2)."""
+    500 for a hand-made cursor instead of the 400."""
     if v is None:
         return None
     dt = datetime.fromisoformat(v)
diff --git a/backend/app/issues/__init__.py b/backend/app/issues/__init__.py
index dd2ed760..afc92b3a 100644
--- a/backend/app/issues/__init__.py
+++ b/backend/app/issues/__init__.py
@@ -1,3 +1,3 @@
-"""Bug reports built from debug sessions (E16): the files an issue carries, and where they go —
-downloaded as a zip, or (S4) sent to a Gitea issue tracker. The session itself — what is recorded
+"""Bug reports built from debug sessions: the files an issue carries, and where they go —
+downloaded as a zip, or sent to a Gitea issue tracker. The session itself — what is recorded
 and tagged — is the core module `app/debugsession.py`."""
diff --git a/backend/app/issues/bundle.py b/backend/app/issues/bundle.py
index 45c9def0..2b316c58 100644
--- a/backend/app/issues/bundle.py
+++ b/backend/app/issues/bundle.py
@@ -5,7 +5,7 @@ Gitea upload, so the two cannot drift apart.
     in their language; the server does not rewrite it);
   * `client.log` / `server.log` — the session's evidence (`debugsession.bundle`) minus the rows the
     user took out, one JSON object per line, browser rows and server rows apart. `.log`, not
-    `.jsonl`: Gitea refuses that extension (measured, plans/e16 S0);
+    `.jsonl`: Gitea refuses that extension (measured);
   * the screenshots, in the order they were taken.
 
 Every row is already redacted twice (at capture, and again when stored), and nothing here adds a
diff --git a/backend/app/issues/gitea.py b/backend/app/issues/gitea.py
index b492de71..12226f14 100644
--- a/backend/app/issues/gitea.py
+++ b/backend/app/issues/gitea.py
@@ -1,5 +1,5 @@
-"""The Gitea issue tracker a debug session's issue goes to (E16 S4) — measured against Gitea 1.27.1
-before a line of this was written (plans/e16-debug-issue.md, S0).
+"""The Gitea issue tracker a debug session's issue goes to — measured against Gitea 1.27.1
+before a line of this was written.
 
 Configured by an admin (sysconfig `issues_gitea_url` / `_repo` / `_token`, the token encrypted at
 rest). The repository must be PRIVATE: an issue carries its reporter's log — page titles, filter
@@ -79,7 +79,7 @@ def target(db: Session) -> dict | None:
 @contextmanager
 def _client(settings: tuple[str, str, str]) -> Iterator[tuple[httpx.Client, str]]:
     # Takes the settings already read, not the session: reading them HERE opened a transaction one
-    # line after `deliver` had ended one, and held it across the calls below (deep-review round 4).
+    # line after `deliver` had ended one, and held it across the calls below.
     url, repo, token = settings
     if not (url and repo and token):
         raise GiteaError("not_configured")
@@ -203,7 +203,7 @@ def deliver(
     # call, so nothing holds a snapshot (and an idle connection) across minutes of tracker I/O.
     # The settings are read HERE and handed to `_client`, not read inside it: reading them there
     # was a SELECT one line after this commit, which reopened the transaction and held it — idle,
-    # with its snapshot pinned — across the repository check and the create (deep-review round 4
+    # with its snapshot pinned — across the repository check and the create (a review
     # measured it in pg_stat_activity). A comment saying otherwise sat right here.
     checkpoint()
     with _client(settings) as (client, repo):
@@ -223,7 +223,7 @@ def deliver(
             )
             # Built ON the state read at the start so nothing already in it is dropped. The claim
             # is NOT among those things, whatever this comment used to say: `set_delivery` strips
-            # any `sending` passed to it and stamps the row's own from `token` (round 4 — removing
+            # any `sending` passed to it and stamps the row's own from `token` (removing
             # the spread left the whole suite green, because the claim never travelled here).
             state = {
                 **state,
diff --git a/backend/app/logs.py b/backend/app/logs.py
index d25d5380..ecafc7d2 100644
--- a/backend/app/logs.py
+++ b/backend/app/logs.py
@@ -10,7 +10,7 @@ the logs were both unjoinable and leaky. `configure_logging()` replaces all four
 Event shape — the OpenTelemetry log data model, without the SDK; one JSON object per line:
     ts · level · sev · source · logger · event · msg · attrs
 plus whatever correlation the context carries (`request_id`, `user_id`, `debug_session_id`,
-`job_id`) and the app version. That shape is what E22.6's admin console filters on and what a Gitea
+`job_id`) and the app version. That shape is what the admin log console filters on and what a Gitea
 issue attachment will carry, so it is deliberately flat and stable.
 
 Call sites stay ordinary stdlib logging:
@@ -106,7 +106,7 @@ class _RequestScope:
         self.user_id: int | None = None
         # The user's consented diagnostics level as a logging number; None at the base level.
         self.level: int | None = None
-        # The user's own open debug session this request named (E16), else None.
+        # The user's own open debug session this request named, else None.
         self.debug_session_id: str | None = None
 
 
@@ -122,11 +122,11 @@ def set_user(
     debug_session: str | None = None,
 ) -> None:
     """Attribute the rest of this request's log lines to `user_id`, and log them at the user's
-    consented diagnostics `level` until `until` (E22 S5; "INFO" = no elevation). Called from the
+    consented diagnostics `level` until `until` ("INFO" = no elevation). Called from the
     auth dependency — the one place the session is actually resolved into an account — rather than
     from the request middleware, which runs OUTSIDE the session middleware.
 
-    `debug_session` tags every line with the user's open debug session (E16). The caller has
+    `debug_session` tags every line with the user's open debug session. The caller has
     already checked it is theirs and open; a session's level arrives here as `level`/`until`.
 
     The root logger's floor is tracked per elevation: a request without the session's header (an
@@ -334,7 +334,7 @@ _RECORD_STANDARD = frozenset(
 class ContextFilter(logging.Filter):
     """Copies the correlation contextvars onto the record. A Filter (not the formatter) so the
     values are captured at emit time, before a QueueHandler can move the record to another
-    thread — the DB sink in S3 depends on that."""
+    thread — the DB sink depends on that."""
 
     def filter(self, record: logging.LogRecord) -> bool:
         for name, var in _CONTEXT_VARS.items():
@@ -355,7 +355,7 @@ class ContextFilter(logging.Filter):
 
 class LevelGate(logging.Filter):
     """The configured level, enforced at the HANDLER, with one exception: the lines of a request
-    whose user raised their diagnostics level (E22 S5).
+    whose user raised their diagnostics level.
 
     The root logger's level cannot do this alone: it is one number for the whole process, and the
     point is to log ONE user's requests in detail while everyone else's stay at the base level. So
@@ -457,7 +457,7 @@ class TextFormatter(logging.Formatter):
 # --- configuration -------------------------------------------------------------------------
 # Third-party loggers that are noisy at our own level. Pinned explicitly so the diagnostics knob can
 # lower the ROOT level to DEBUG/TRACE without drowning the output in SQL statements and HTTP chatter
-# — raising THESE is a deliberate, separate act (E22.6's console).
+# — raising THESE is a deliberate, separate act (the admin log console).
 _THIRD_PARTY_LEVELS = {
     "sqlalchemy": "WARNING",
     "sqlalchemy.engine": "WARNING",
@@ -481,7 +481,7 @@ def get_logger(name: str) -> logging.Logger:
     `siftlode.plex.sync`.
 
     The names were literals before, and 25 of them covered 34 modules — six different Plex modules
-    all called themselves `siftlode.plex`, so neither a level pinned per logger nor E22.6's console
+    all called themselves `siftlode.plex`, so neither a level pinned per logger nor the console's
     filter could tell a sync line from a stream line. Derived from `__name__` there is exactly one
     name per module, it cannot drift from the file it sits in, and `test_logger_names.py` fails if a
     module hand-rolls one again.
@@ -562,12 +562,12 @@ def current_level() -> str:
     return logging.getLevelName(_base_level or logging.getLogger().getEffectiveLevel())
 
 
-# --- per-user elevation (E22 S5) -----------------------------------------------------------
+# --- per-user elevation -----------------------------------------------------------
 # The base level (`LOG_LEVEL`, then the admin knob). NOTSET until configure_logging runs — a unit
 # test, a script — so the gate lets everything through there, as it did before the gate existed.
 _base_level = logging.NOTSET
 # → (level number, expiry) for every elevation this process has seen and not yet expired: a user's
-# own, by user id, and a debug session's (E16), by (user id, session id) — its requests alone carry
+# own, by user id, and a debug session's, by (user id, session id) — its requests alone carry
 # its level, so it is tracked apart from the user's own requests.
 _ElevationKey = int | tuple[int, str]
 _elevations: dict[_ElevationKey, tuple[int, datetime]] = {}
@@ -667,7 +667,7 @@ def current_source() -> str:
 
 
 # --- request logging -----------------------------------------------------------------------
-# A client may supply its own request id so a browser log line and a server line join up (E22 S4).
+# A client may supply its own request id so a browser log line and a server line join up.
 # Accepted only in this shape: it ends up in a log field, and an unbounded header would be a way to
 # write arbitrary text into the log.
 _REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9._-]{8,64}$")
@@ -688,7 +688,6 @@ _POLLED_ROUTES = frozenset(
     {
         "/api/me",
         "/api/me/notifications/unread_count",
-        "/api/messages/unread_count",
         "/api/downloads",
         "/api/downloads/index",
         "/api/downloads/usage",
diff --git a/backend/app/logsink.py b/backend/app/logsink.py
index b07acd1c..c63cea8f 100644
--- a/backend/app/logsink.py
+++ b/backend/app/logsink.py
@@ -1,4 +1,4 @@
-"""The `log_events` sink (E22 S3): the stored copy of the log the diagnostics console reads.
+"""The `log_events` sink: the stored copy of the log the diagnostics console reads.
 
 stdout stays the complete log (docker keeps 3×50 MB of it); this table keeps the part worth querying
 for `log_retention_days`:
@@ -6,7 +6,7 @@ for `log_retention_days`:
   * every WARNING and above,
   * the `http.request` line of every request at INFO or above (not the DEBUG-level health checks and
     static files),
-  * every line of a request whose user raised their diagnostics level (E22 S5 — `logs.LevelGate`
+  * every line of a request whose user raised their diagnostics level (`logs.LevelGate`
     marks them), which is the detail they consented to have kept,
   * nothing a caller marked `extra={logs.PERSIST: False}` — how the request log caps anonymous
     traffic per client.
@@ -347,8 +347,8 @@ def gc(db: Session, retention_days: int) -> int:
 
 
 def serialize(row: LogEvent) -> dict:
-    """A stored row as the API sends it — one shape for every reader: the admin console (E22.6) and
-    a debug session's evidence list (E16)."""
+    """A stored row as the API sends it — one shape for every reader: the admin console and
+    a debug session's evidence list."""
     return {
         "id": row.id,
         "ts": iso(row.ts),
diff --git a/backend/app/mailtext.py b/backend/app/mailtext.py
index 68485609..4b4cba7e 100644
--- a/backend/app/mailtext.py
+++ b/backend/app/mailtext.py
@@ -1,5 +1,5 @@
 """Bilingual text for every outbound mail, and the one resolver that decides which language a
-recipient gets (E9.5 S7).
+recipient gets.
 
 Why a catalog instead of literals in `email.py`: HU/EN parity is a house rule for every user-facing
 string, and a mail is the one user-facing surface the reader CANNOT re-render by switching the UI
@@ -53,7 +53,7 @@ def lang_for_user(user: User | None) -> str:
 
 def lang_for_email(db: Session, email: str) -> str:
     """The language for an address that may not have an account yet: their own account preference,
-    else the language they filled our access-request form in, else English.
+    else the language their access request came in (the locale Google reported), else English.
 
     Matched CANONICALLY like every other identity lookup in this epic, and it walks past rows that
     carry no usable code instead of stopping at the first one — prod really does hold two accounts
@@ -82,8 +82,8 @@ def lang_for_email(db: Session, email: str) -> str:
 # a name, not a translated string, and giving them keys would invite someone to "translate" them.
 MAIL_TEXT: dict[str, dict[str, str]] = {
     # ── How long a link lasts ───────────────────────────────────────────────────────────────
-    # Rendered, not interpolated as a raw hour count: the approval mail's token lives seven days
-    # (E9.5 S6), and "expires in 168 hours" is a unit no reader converts.
+    # Rendered, not interpolated as a raw hour count: the approval mail's token lives seven days,
+    # and "expires in 168 hours" is a unit no reader converts.
     "duration.hours": {"en": "{n} hours", "hu": "{n} óra"},
     "duration.days": {"en": "{n} days", "hu": "{n} nap"},
     # ── Shared closing fragments ────────────────────────────────────────────────────────────────
diff --git a/backend/app/main.py b/backend/app/main.py
index 1376e980..14a2dafa 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -44,7 +44,6 @@ from app.routes import (  # noqa: E402 — logging is configured first
     feed,
     health,
     me,
-    messages,
     notifications,
     playlists,
     plex as plex_routes,
@@ -132,7 +131,7 @@ async def _reap_hls_sessions() -> None:
     A FINISHED session is reaped on the short rule here, not kept for the full idle window: an open
     player checkpoints every 10 s and that route touches the session, so a paused viewer is no longer
     invisible to this pass (see `reap_idle`). Keeping every finished session for ten minutes instead
-    held one whole segmented copy of a film per item on the download volume (round 5)."""
+    held one whole segmented copy of a film per item on the download volume."""
     while True:
         await asyncio.sleep(_HLS_REAP_EVERY_S)
         try:
@@ -188,8 +187,8 @@ async def _nul_in_text(request: Request, exc: DataError) -> JSONResponse:
     NUL in text, so the driver refuses to even send the query — and a `%00` in a query parameter or
     an escaped NUL in a JSON body (a playlist's `contains=`, a reorder's key list, a collection
     search) was a 500 with a traceback wherever it reached a comparison. Guarding each site did not
-    hold: round 3 guarded the by-rating_key lookup and missed the rest. Any other DataError is left
-    alone — re-raised, it stays the 500 it always was."""
+    hold: an earlier fix guarded the by-rating_key lookup and missed the rest. Any other DataError
+    is left alone — re-raised, it stays the 500 it always was."""
     if "NUL (0x00)" not in str(exc.orig):
         raise exc
     return JSONResponse(
@@ -311,7 +310,6 @@ app.include_router(me.router)
 app.include_router(diagnostics_routes.router)
 app.include_router(debug_sessions_routes.router)
 app.include_router(notifications.router)
-app.include_router(messages.router)
 app.include_router(channels.router)
 app.include_router(playlists.router)
 app.include_router(saved_views.router)
diff --git a/backend/app/models.py b/backend/app/models.py
index 2e406a39..608bc46d 100644
--- a/backend/app/models.py
+++ b/backend/app/models.py
@@ -59,7 +59,7 @@ POSITION_MAX_S = 2**31 - 1
 
 class TimestampMixin:
     """Adds a server-defaulted `created_at`. Models that index created_at or order it
-    differently (QuotaEvent, Notification, Message) keep their own column on purpose."""
+    differently (QuotaEvent, Notification) keep their own column on purpose."""
 
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
 
@@ -101,15 +101,15 @@ class User(Base, TimestampMixin, CanonicalEmailMixin):
     # Google sign-in that failed to find it), and a migration must not merge accounts on its own.
     email_canonical: Mapped[str] = mapped_column(String(320), index=True, server_default="")
     # The address Google asserted for this account, recorded at sign-in / link time. NOT the same
-    # thing as `email`: since E9.5 S3 a Google sign-in no longer overwrites the address the user
+    # thing as `email`: a Google sign-in no longer overwrites the address the user
     # registered with, so a deliberate `me+siftlode@gmail.com` survives — and this is where the other
     # half of the truth lives, for the UI to show when the two differ. NULL until the next Google
     # sign-in for accounts linked before this column existed.
     google_email: Mapped[str | None] = mapped_column(String(320))
-    # argon2id hash for email+password login; NULL for Google-only / demo accounts.
+    # argon2id hash for email+password login; NULL for Google-only accounts.
     password_hash: Mapped[str | None] = mapped_column(String(255))
     # When SEC-10 dropped a preset password on Google adoption (see the single caller of
-    # auth.revoke_preset_password_if_unverified; admin approval no longer revokes — E9.5 S1). Without
+    # auth.revoke_untrusted_preset_password; admin approval no longer revokes). Without
     # this trace a revoked account was indistinguishable from a Google-only one, so it failed the
     # password-reset eligibility check and could never be recovered — it could neither sign in nor
     # reset. Set = "had a password, lost it to the guard" -> reset-eligible. Cleared whenever a
@@ -123,7 +123,7 @@ class User(Base, TimestampMixin, CanonicalEmailMixin):
     is_active: Mapped[bool] = mapped_column(Boolean, default=True, server_default="true")
     # Admin-imposed access block, distinct from is_active (approval lifecycle). A suspended
     # account can't sign in by any method and its live sessions are rejected; the user is told
-    # why and pointed at the operator's contact. The demo account is never suspendable.
+    # why and pointed at the operator's contact.
     is_suspended: Mapped[bool] = mapped_column(Boolean, default=False, server_default="false")
     # Server-side session revocation (SA4): a monotonic counter bumped on password reset, password
     # change, or "log out everywhere". A signed session cookie records the epoch it was minted under;
@@ -132,9 +132,9 @@ class User(Base, TimestampMixin, CanonicalEmailMixin):
     session_epoch: Mapped[int] = mapped_column(Integer, default=0, server_default="0")
     # When this account last signed in (Google or password), stamped by the one sign-in path,
     # routes/auth._establish_session. NULL = not since the column existed (0085; no backfill is
-    # possible). The shared demo account is never stamped — its "last login" would mean nobody.
+    # possible).
     last_login_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
-    # The diagnostics level this user consented to (E22 S5) and when it lapses back to the base
+    # The diagnostics level this user consented to and when it lapses back to the base
     # level. Both NULL = base. Written only by `PUT /api/me/diagnostics`, which computes the expiry
     # itself; read through `app.diagnostics.effective_level`, never directly (an expired level is
     # not cleared eagerly — it simply stops counting).
@@ -146,12 +146,6 @@ class User(Base, TimestampMixin, CanonicalEmailMixin):
     # The user's own YouTube channel id, resolved lazily (channels.list?mine=true) and
     # cached. Used to exclude their own channel from playlist discovery. NULL = unresolved.
     yt_channel_id: Mapped[str | None] = mapped_column(String(32))
-    # The single shared "demo" account: signed into without Google OAuth (via a whitelisted
-    # email on the login page), has no OAuth token / YouTube scope, and its per-user state is
-    # shared by everyone who enters this way. Exactly one such row is expected.
-    is_demo: Mapped[bool] = mapped_column(
-        Boolean, default=False, server_default="false", index=True
-    )
     # Free-form UI preferences (theme, color scheme, font scale, default filters…).
     preferences: Mapped[dict | None] = mapped_column(JSON)
 
@@ -218,25 +212,12 @@ class Invite(Base, CanonicalEmailMixin):
     # The language this person asked us in ("en"/"hu"), captured when the request was made: the page
     # their form was on, or the locale Google reported for a refused sign-in. NULL for a row the
     # admin whitelisted by hand — nobody has told us anything about that mailbox, which is exactly
-    # why the invitation send asks (E9.5 S7). Captured rather than derived for the same reason
+    # why the invitation send asks. Captured rather than derived for the same reason
     # `preferences.language` and `google_email` are: the signal exists only in that one moment and
     # cannot be backfilled afterwards.
     lang: Mapped[str | None] = mapped_column(String(8))
 
 
-class DemoWhitelist(Base, TimestampMixin):
-    """Emails that may enter the shared demo account from the login page (no Google OAuth).
-    A hidden, admin-curated list of "keys to the same door" — every entry logs into the one
-    shared demo user. Distinct from Invite (which gates real Google sign-in)."""
-
-    __tablename__ = "demo_whitelist"
-
-    id: Mapped[int] = mapped_column(primary_key=True)
-    email: Mapped[str] = mapped_column(String(320), unique=True, index=True)
-    note: Mapped[str | None] = mapped_column(Text)
-    added_by: Mapped[str | None] = mapped_column(String(320))  # admin email
-
-
 class Channel(Base, TimestampMixin):
     """A YouTube channel. Shared across all users (one channel's videos are the same
     for everyone), so its expensive metadata is fetched and stored only once."""
@@ -586,7 +567,7 @@ class AuditLog(Base):
 
 
 class LogEvent(Base):
-    """One stored log event (E22 S3) — the `log_events` table the diagnostics console reads. Rows are
+    """One stored log event — the `log_events` table the diagnostics console reads. Rows are
     written by app/logsink.py's background writer, never inside a request's transaction, already
     redacted (the same `logs.record_fields` the stdout line is built from).
 
@@ -599,7 +580,7 @@ class LogEvent(Base):
     __tablename__ = "log_events"
     __table_args__ = (
         Index("ix_log_events_user_ts", "user_id", "ts"),
-        # E16: an issue's bundle is `WHERE debug_session_id = …`; nearly every row has none.
+        # An issue's bundle is `WHERE debug_session_id = …`; nearly every row has none.
         Index(
             "ix_log_events_debug_session",
             "debug_session_id",
@@ -625,7 +606,7 @@ class LogEvent(Base):
 
 
 class DebugSession(Base):
-    """One recording: Start → reproduce → Stop (E16, app/debugsession.py). While it is open, every
+    """One recording: Start → reproduce → Stop (app/debugsession.py). While it is open, every
     request of its user that names it (`X-Debug-Session`) is logged at `level` and tagged with `id`,
     and the issue it ends in is built from the rows carrying that tag. `until` is the hard cap the
     server set at Start; an open session past it is over whether or not the sweep has closed it yet.
@@ -650,12 +631,12 @@ class DebugSession(Base):
     # app/debugsession.py `EndReason`: stopped by the user, or past `until`.
     ended_reason: Mapped[str | None] = mapped_column(String(16))
     issue_url: Mapped[str | None] = mapped_column(String(512))
-    # The issue being written from it (E16 S3; app/debugsession.py `save_draft` holds its shape).
+    # The issue being written from it (app/debugsession.py `save_draft` holds its shape).
     draft: Mapped[dict | None] = mapped_column(JSONB)
 
 
 class DebugScreenshot(Base):
-    """A screenshot attached to a debug session (E16) — pasted, dropped, or captured from the pill.
+    """A screenshot attached to a debug session — pasted, dropped, or captured from the pill.
     Stored in the row: bounded per session (app/debugsession.py), and gone with it by cascade."""
 
     __tablename__ = "debug_screenshots"
@@ -814,44 +795,6 @@ class Notification(Base):
     )
 
 
-class Message(Base):
-    """A message in the notification module (phase 2).
-
-    Two kinds share this table:
-      - `kind="user"`: a private, END-TO-END ENCRYPTED direct message between two users. The
-        server only ever stores `ciphertext` + `iv` (base64); it never holds the plaintext or
-        the keys, so not even an admin can read it. A conversation is just the set of messages
-        between two users — no separate thread entity; queries group by the {sender, recipient}
-        pair.
-      - `kind="system"`: a server-authored plaintext message (e.g. the welcome, or future admin
-        announcements). `sender_id` is NULL and `body` holds the text. These are non-private
-        boilerplate, readable without any E2EE key setup, and surface as a "Siftlode" conversation.
-
-    `read_at` is stamped when the recipient opens the thread (NULL = unread, feeds the nav
-    badge). The recipient FK cascades (and sender, for user messages) so a GDPR account erasure
-    removes that user's messages outright."""
-
-    __tablename__ = "messages"
-
-    id: Mapped[int] = mapped_column(primary_key=True)
-    kind: Mapped[str] = mapped_column(String(16), default="user", server_default="user")
-    # NULL for system messages (no human sender).
-    sender_id: Mapped[int | None] = mapped_column(
-        ForeignKey("users.id", ondelete="CASCADE"), index=True
-    )
-    recipient_id: Mapped[int] = mapped_column(
-        ForeignKey("users.id", ondelete="CASCADE"), index=True
-    )
-    # System messages carry plaintext `body`; user messages carry `ciphertext`+`iv` (base64).
-    body: Mapped[str | None] = mapped_column(Text)
-    ciphertext: Mapped[str | None] = mapped_column(Text)
-    iv: Mapped[str | None] = mapped_column(String(32))
-    read_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
-    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), server_default=func.now(), index=True
-    )
-
-
 class MediaAsset(Base, TimestampMixin):
     """A physical downloaded media file — the SHARED cache layer of the download center.
 
@@ -946,8 +889,8 @@ class DownloadJob(Base, TimestampMixin, UpdatedAtMixin):
     """A user's request to download one source — the per-user layer over `MediaAsset`.
 
     The worker claims `queued` jobs with ``FOR UPDATE SKIP LOCKED`` and writes live
-    `progress`/`speed_bps`/`eta_s`/`phase` here (the frontend polls via useLiveQuery — the
-    worker is a separate process and can't reach the in-process WS registry). `profile_snapshot`
+    `progress`/`speed_bps`/`eta_s`/`phase` here (the frontend polls via useLiveQuery: there is
+    no server push channel, and the worker is a separate process anyway). `profile_snapshot`
     freezes the spec at enqueue so later edits/deletion of the profile don't change this job.
     `display_name` is the user's own name for the file (display + the Content-Disposition on
     local download); the on-disk asset is never renamed. `asset_id` links to the shared file
@@ -1094,29 +1037,6 @@ class DownloadCredential(Base, TimestampMixin, UpdatedAtMixin):
     cookies_enc: Mapped[str] = mapped_column(Text)  # Fernet ciphertext — never returned/logged
 
 
-class MessageKey(Base, TimestampMixin):
-    """A user's end-to-end-encryption key material for direct messaging (phase 2).
-
-    One row per user. `public_key` (base64 SPKI, ECDH P-256) is shared with others so they can
-    derive the pairwise conversation key. `wrapped_private_key` is the user's private key
-    encrypted IN THE BROWSER with a key derived (PBKDF2) from a message passphrase the server
-    never sees — so the server stores only an opaque blob it cannot unwrap. `salt`/`wrap_iv`
-    parameterise that derivation; `key_check` is a small ciphertext the client decrypts to
-    verify a passphrase on unlock. The server is purely a key directory + blob store; it can
-    never read any message."""
-
-    __tablename__ = "message_keys"
-
-    user_id: Mapped[int] = mapped_column(
-        ForeignKey("users.id", ondelete="CASCADE"), primary_key=True
-    )
-    public_key: Mapped[str] = mapped_column(Text)
-    wrapped_private_key: Mapped[str] = mapped_column(Text)
-    salt: Mapped[str] = mapped_column(String(64))
-    wrap_iv: Mapped[str] = mapped_column(String(32))
-    key_check: Mapped[str] = mapped_column(Text)
-
-
 # --- Plex integration (optional) -------------------------------------------------------------
 # A dedicated, self-contained catalog mirrored from a locally-reachable Plex server. Playback is
 # from the LOCAL physical file (Plex is metadata only); per-user watch state lives in plex_states
@@ -1137,7 +1057,7 @@ class PlexLibrary(Base, TimestampMixin, UpdatedAtMixin):
     kind: Mapped[str] = mapped_column(String(16))  # "movie" | "show"
     enabled: Mapped[bool] = mapped_column(Boolean, default=True, server_default="true")
     synced_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
-    # HU-overlay support (E5 S5). `metadata_lang` tags the section's metadata language. An OVERLAY
+    # HU-overlay support. `metadata_lang` tags the section's metadata language. An OVERLAY
     # library (overlay_of set) is the Hungarian-metadata twin of another section: it is never browsable
     # on its own — its titles' HU fields are written onto the matched EN rows (paired by `guid`).
     metadata_lang: Mapped[str] = mapped_column(String(8), default="en", server_default="en")
@@ -1166,7 +1086,7 @@ class PlexShow(Base, TimestampMixin, UpdatedAtMixin):
         ForeignKey("plex_libraries.id", ondelete="CASCADE"), index=True
     )
     # Canonical external id (e.g. "tmdb:12345") — the key that pairs this EN row with its HU-overlay
-    # twin during sync (E5 S5). Indexed for the guid->row overlay match.
+    # twin during sync. Indexed for the guid->row overlay match.
     guid: Mapped[str | None] = mapped_column(String(64), index=True)
     title: Mapped[str] = mapped_column(String(512))
     summary: Mapped[str | None] = mapped_column(Text)
@@ -1196,7 +1116,7 @@ class PlexShow(Base, TimestampMixin, UpdatedAtMixin):
     )  # cast+directors, folded into search_vector
     # Set once the show's FULL cast has been rich-fetched by the backfill; NULL = still the listing top-3.
     people_enriched_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
-    # Rich-fetch-only detail fields, persisted by the same backfill that fills the full cast (E5 S5b) so
+    # Rich-fetch-only detail fields, persisted by the same backfill that fills the full cast so
     # the info page serves from this row instead of a live plex.metadata() call. NULL until enriched.
     imdb_rating: Mapped[float | None] = mapped_column(
         Float
@@ -1206,7 +1126,7 @@ class PlexShow(Base, TimestampMixin, UpdatedAtMixin):
     full_cast: Mapped[list | None] = mapped_column(
         JSONB(none_as_null=True)
     )  # ordered [{name, role, thumb}]
-    # --- TMDB enrichment (E5 S2): see the identical block on plex_items for the full rationale. Additive;
+    # --- TMDB enrichment: see the identical block on plex_items for the full rationale. Additive;
     #     served from the row; NULL until enriched. (`budget`/`revenue` stay NULL for shows — TV has none.) ---
     tmdb_id: Mapped[int | None] = mapped_column(Integer)
     tmdb_enriched_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
@@ -1224,10 +1144,10 @@ class PlexShow(Base, TimestampMixin, UpdatedAtMixin):
     production_countries: Mapped[list | None] = mapped_column(JSONB(none_as_null=True))  # [str]
     recommendations: Mapped[list | None] = mapped_column(JSONB(none_as_null=True))
     backdrops: Mapped[list | None] = mapped_column(JSONB(none_as_null=True))
-    # Hungarian-metadata twin fields, written by the overlay sync (E5 S5). NULL = no HU twin matched,
+    # Hungarian-metadata twin fields, written by the overlay sync. NULL = no HU twin matched,
     # so serving falls back to the EN columns. `people_text` is language-neutral, reused for both vectors.
     title_hu: Mapped[str | None] = mapped_column(String(512))
-    tagline_hu: Mapped[str | None] = mapped_column(Text)  # the HU overlay's tagline (E30)
+    tagline_hu: Mapped[str | None] = mapped_column(Text)  # the HU overlay's tagline
     summary_hu: Mapped[str | None] = mapped_column(Text)
     genres_hu: Mapped[list | None] = mapped_column(JSONB(none_as_null=True))
     search_vector: Mapped[object | None] = mapped_column(
@@ -1289,7 +1209,7 @@ class PlexItem(Base, TimestampMixin, UpdatedAtMixin):
     )
     kind: Mapped[str] = mapped_column(String(16), index=True)  # "movie" | "episode"
     # Canonical external id (e.g. "tmdb:12345") — pairs a MOVIE row with its HU-overlay twin during
-    # sync (E5 S5); indexed for the guid->row match. Episodes carry it too but it's unused for them.
+    # sync; indexed for the guid->row match. Episodes carry it too but it's unused for them.
     guid: Mapped[str | None] = mapped_column(String(64), index=True)
     show_id: Mapped[int | None] = mapped_column(
         ForeignKey("plex_shows.id", ondelete="CASCADE"), index=True
@@ -1316,7 +1236,7 @@ class PlexItem(Base, TimestampMixin, UpdatedAtMixin):
     # Browser-playability class from ffprobe: "direct" | "remux" | "transcode" (None = unprobed).
     playable: Mapped[str | None] = mapped_column(String(12), index=True)
     probed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
-    # Transcode HW-capability facet (E7 playback-class filter). NULL for non-transcode items; for a
+    # Transcode HW-capability facet (the playback-class filter). NULL for non-transcode items; for a
     # `playable="transcode"` item: True = the prod iGPU can hardware-transcode it (codec is HW-decodable
     # AND the source is 8-bit SDR), False = software libx264 only (AV1/XviD, or a 10-bit/HDR source that
     # breaks the VAAPI nv12 pipeline — see plex/stream.py). Derived by `plex.sync.transcode_hw_capable`:
@@ -1352,7 +1272,7 @@ class PlexItem(Base, TimestampMixin, UpdatedAtMixin):
     people_text: Mapped[str | None] = mapped_column(Text)
     # Set once the movie's FULL cast has been rich-fetched by the backfill; NULL = still the listing top-3.
     people_enriched_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
-    # Rich-fetch-only detail fields, persisted by the same backfill that fills the full cast (E5 S5b) so
+    # Rich-fetch-only detail fields, persisted by the same backfill that fills the full cast so
     # the info page serves from this row instead of a live plex.metadata() call. NULL until enriched.
     imdb_rating: Mapped[float | None] = mapped_column(
         Float
@@ -1362,7 +1282,7 @@ class PlexItem(Base, TimestampMixin, UpdatedAtMixin):
     full_cast: Mapped[list | None] = mapped_column(
         JSONB(none_as_null=True)
     )  # ordered [{name, role, thumb}]
-    # --- TMDB enrichment (E5 S2): matched by the canonical `guid` ("tmdb:12345"), filled by the TMDB
+    # --- TMDB enrichment: matched by the canonical `guid` ("tmdb:12345"), filled by the TMDB
     #     backfill job, SERVED FROM THIS ROW (never a live TMDB call). Additive — imdb_rating/rating
     #     above stay Plex-sourced; `tmdb_rating` is the distinct TMDb community score. NULL until enriched;
     #     `tmdb_enriched_at` is the "tried" watermark (stamped on a definitive no-match too, so an
@@ -1385,11 +1305,11 @@ class PlexItem(Base, TimestampMixin, UpdatedAtMixin):
     recommendations: Mapped[list | None] = mapped_column(JSONB(none_as_null=True))
     backdrops: Mapped[list | None] = mapped_column(
         JSONB(none_as_null=True)
-    )  # TMDB backdrop file_paths [str] (crossfade pool, S8)
-    # Hungarian-metadata twin fields, written by the overlay sync (E5 S5). NULL = no HU twin matched
+    )  # TMDB backdrop file_paths [str] (crossfade pool)
+    # Hungarian-metadata twin fields, written by the overlay sync. NULL = no HU twin matched
     # (serving falls back to the EN columns). `people_text` is language-neutral, reused for both vectors.
     title_hu: Mapped[str | None] = mapped_column(String(512))
-    tagline_hu: Mapped[str | None] = mapped_column(Text)  # the HU overlay's tagline (E30)
+    tagline_hu: Mapped[str | None] = mapped_column(Text)  # the HU overlay's tagline
     summary_hu: Mapped[str | None] = mapped_column(Text)
     genres_hu: Mapped[list | None] = mapped_column(JSONB(none_as_null=True))
     search_vector: Mapped[object | None] = mapped_column(
@@ -1428,15 +1348,15 @@ class PlexPerson(Base, TimestampMixin, UpdatedAtMixin):
     id: Mapped[int] = mapped_column(primary_key=True)
     name: Mapped[str] = mapped_column(String(255), unique=True, index=True)
     photo_thumb: Mapped[str | None] = mapped_column(Text)  # proxied /person-image URL, or None
-    # TMDB person id, linked by name from a title's TMDB credits (E5 S2 lays the foundation; the /person
-    # biography fetch + person-page render land in S6). NULL until a TMDB-enriched title names this person.
+    # TMDB person id, linked by name from a title's TMDB credits (the /person
+    # biography fetch builds on it). NULL until a TMDB-enriched title names this person.
     tmdb_person_id: Mapped[int | None] = mapped_column(Integer)
-    # --- TMDB person enrichment (E5 S6): fetched from /person/{tmdb_person_id} by the people_enrich job
-    #     (E30 S6), or by the first person-page open the job hasn't reached, then SERVED FROM THE ROW. `tmdb_enriched_at` is the watermark (set even on a
+    # --- TMDB person enrichment: fetched from /person/{tmdb_person_id} by the people_enrich job,
+    #     or by the first person-page open the job hasn't reached, then SERVED FROM THE ROW. `tmdb_enriched_at` is the watermark (set even on a
     #     no-op fetch so it isn't retried every open). `known_for` = top combined-credits [{tmdb_id,
     #     media_type, title}], resolved to library rows by guid at serve time (like recommendations). ---
     biography: Mapped[str | None] = mapped_column(Text)
-    # TMDB's Hungarian biography (E30 S4), from the same request's `translations`; a Hungarian reader is
+    # TMDB's Hungarian biography, from the same request's `translations`; a Hungarian reader is
     # served it, and the instance-language `biography` when TMDB has none. Birthplace, aliases and
     # keywords have no Hungarian on TMDB, so they stay in the instance language.
     biography_hu: Mapped[str | None] = mapped_column(Text)
@@ -1477,7 +1397,7 @@ class PlexCollection(Base, TimestampMixin, UpdatedAtMixin):
 class PlexState(Base, UpdatedAtMixin):
     """Per-user watch state for a Plex item — mirrors VideoState. Lives in Siftlode's own DB so
     it works for users WITHOUT a Plex account (the whole point of the access-layer design).
-    `synced_to_plex` marks whether this state was pushed back to a linked Plex account (P5)."""
+    `synced_to_plex` marks whether this state was pushed back to a linked Plex account."""
 
     __tablename__ = "plex_states"
     __table_args__ = (UniqueConstraint("user_id", "item_id", name="uq_plex_user_item"),)
@@ -1556,7 +1476,7 @@ class PlexPlaylistItem(Base):
 
 
 class ComfortPin(Base, TimestampMixin):
-    """One entry on a user's comfort shelf — the anti-paralysis fallback: "just put on X" (E24).
+    """One entry on a user's comfort shelf — the anti-paralysis fallback: "just put on X".
 
     Deliberately NOT a boolean on `VideoState`/`PlexState`, and NOT a polymorphic `(kind, ref)` string
     pair. A flag cannot ORDER a shelf and cannot hold a channel or a show — and comfort media is
diff --git a/backend/app/plex/cards.py b/backend/app/plex/cards.py
index 620a964b..4571276f 100644
--- a/backend/app/plex/cards.py
+++ b/backend/app/plex/cards.py
@@ -25,7 +25,7 @@ def norm_lang(lang: str | None) -> str:
     return "hu" if lang == "hu" else "en"
 
 
-# Every card speaks the reader's language (E30): `lang="hu"` serves the HU overlay twin's title and
+# Every card speaks the reader's language: `lang="hu"` serves the HU overlay twin's title and
 # summary, falling back to EN where a row has none — the same rule as browse.unified_library's
 # `title_col`/`summary_col`. These rails once served English to a Hungarian reader.
 def display_title(row: PlexItem | PlexShow, lang: str) -> str:
diff --git a/backend/app/plex/client.py b/backend/app/plex/client.py
index ff83019e..bcdcb605 100644
--- a/backend/app/plex/client.py
+++ b/backend/app/plex/client.py
@@ -2,7 +2,7 @@
 
 Server-side ONLY: uses the admin ``X-Plex-Token`` from sysconfig. Playback never goes through
 this client — Siftlode plays the LOCAL physical file (see app.plex.paths). Plex is used purely for
-metadata, image proxying, and (P5) optional watch-state write-back. Requests JSON via the
+metadata, image proxying, and optional watch-state write-back. Requests JSON via the
 ``Accept: application/json`` header (Plex serves XML by default).
 """
 
@@ -65,7 +65,7 @@ class PlexClient:
         except ValueError as e:
             raise PlexError("Plex returned a non-JSON response") from e
 
-    # --- Connectivity + sections (P0) ---
+    # --- Connectivity + sections ---
     def server_info(self) -> dict:
         """Root identity (friendlyName / version) — used by the admin 'Test connection'."""
         return self._get("/")
@@ -75,7 +75,7 @@ class PlexClient:
         mc = self._get("/library/sections")
         return mc.get("Directory", []) or []
 
-    # --- Catalog mirror (P1) ---
+    # --- Catalog mirror ---
     def section_items(
         self, key: str, item_type: int, start: int = 0, size: int = 200
     ) -> tuple[list[dict], int | None]:
@@ -88,14 +88,14 @@ class PlexClient:
                 "type": item_type,
                 # includeGuids=1 carries each item's Guid array (tmdb/imdb/tvdb ids) in the cheap
                 # listing, so the sync can capture the canonical guid without a per-item rich fetch —
-                # the pairing key for the HU overlay (E5 S5).
+                # the pairing key for the HU overlay.
                 "includeGuids": 1,
                 "X-Plex-Container-Start": start,
                 "X-Plex-Container-Size": size,
             },
         )
         # `totalSize` only: `size` is THIS page's count, and read as the total it made a single
-        # page look like the whole section — "complete" to a prune or a reconcile (E32 review).
+        # page look like the whole section — "complete" to a prune or a reconcile.
         total = mc.get("totalSize")
         return mc.get("Metadata", []) or [], None if total is None else int(total)
 
@@ -137,12 +137,12 @@ class PlexClient:
         mc = self._get(f"/library/collections/{rating_key}/children")
         return mc.get("Metadata", []) or []
 
-    # --- Collection editing (P2 — write-back to Plex; all shared/global, admin-gated in the routes) ---
+    # --- Collection editing (write-back to Plex; all shared/global, admin-gated in the routes) ---
     @property
     def machine_id(self) -> str:
         """Server machineIdentifier — needed in the `uri` of collection add/create calls. Cached.
         Without one the uri would read `server:///…`, a malformed write Plex answers in its own way;
-        it is refused here, by name (E32 S2)."""
+        it is refused here, by name."""
         if not getattr(self, "_machine_id", None):
             mid = self._get("/identity").get("machineIdentifier")
             if not mid:
@@ -206,7 +206,7 @@ class PlexClient:
         items = mc.get("Metadata", []) or []
         return items[0] if items else None
 
-    # --- Watch-state write-back (P5 Phase B — Siftlode→Plex push; acts on the token's account) ---
+    # --- Watch-state write-back (Siftlode→Plex push; acts on the token's account) ---
     _LIBRARY_IDENTIFIER = "com.plexapp.plugins.library"
 
     def scrobble(self, rating_key: str) -> None:
@@ -243,7 +243,7 @@ class PlexClient:
             f"&state={state}&time={int(time_ms)}&duration={int(duration_ms)}",
         )
 
-    # --- Watch-state read for incremental sync (P5 Phase C) ---
+    # --- Watch-state read for incremental sync ---
     def accounts(self) -> list[dict]:
         """Server accounts (the owner + any managed/home users): id, name. Used to resolve the
         owner's accountID so the shared watch-history feed can be filtered to just their views."""
diff --git a/backend/app/plex/detail.py b/backend/app/plex/detail.py
index 7752b7d4..46ed2ac6 100644
--- a/backend/app/plex/detail.py
+++ b/backend/app/plex/detail.py
@@ -1,5 +1,5 @@
 """Parse the "info page" rich metadata out of a full Plex metadata dict, and persist the subset that
-the detail endpoints serve from the DB row (E5 S5b).
+the detail endpoints serve from the DB row.
 
 Shared by the live info-page path (routes.plex.browse) and the background rich re-sync (plex.sync) so
 the two never diverge — the same one-parser rule that keeps `people.py`'s cast handling consistent.
diff --git a/backend/app/plex/genres.py b/backend/app/plex/genres.py
index 2b19cb4a..50dfc2b0 100644
--- a/backend/app/plex/genres.py
+++ b/backend/app/plex/genres.py
@@ -1,4 +1,4 @@
-"""One Hungarian word per Plex genre (E30).
+"""One Hungarian word per Plex genre.
 
 Plex's Hungarian agent returns a MIXED vocabulary: some genres come back translated ("Dráma",
 "Vígjáték"), others stay English ("Action", "Adventure", "Biography"), and a title with no HU twin has
diff --git a/backend/app/plex/imgcache.py b/backend/app/plex/imgcache.py
index 8eed4e1b..bd7f34a0 100644
--- a/backend/app/plex/imgcache.py
+++ b/backend/app/plex/imgcache.py
@@ -26,7 +26,7 @@ _CT_EXT = {ct: ext for ext, ct in _EXT_CT}
 # Target box per variant — Plex resizes to these server-side. The full poster (400px) covers a detail
 # page's ≤224px poster at 2× DPR, the full art (1280px) a hero backdrop. A card is much smaller: a grid
 # poster is ~144px and a shelf's landscape art ~212px, so the `_sm` pair serves those at 1.33× DPR
-# (E31 S4e: cards fetched the 400 poster, 42 KB, and the 1280 art for a 212px picture). The browser
+# (cards used to fetch the 400 poster, 42 KB, and the 1280 art for a 212px picture). The browser
 # picks between a pair itself (`srcset`, built by the frontend's `lib/plexImage` cardImage, whose
 # widths plexImage.contract.test holds to these).
 SIZES = {
diff --git a/backend/app/plex/overlay.py b/backend/app/plex/overlay.py
index 7676a118..20118283 100644
--- a/backend/app/plex/overlay.py
+++ b/backend/app/plex/overlay.py
@@ -1,5 +1,5 @@
-"""The HU overlay: a Hungarian Plex section written onto its English twin's rows (E30), split out of
-`plex/sync.py` (E32 S2), which runs it once per paired section during the full sync.
+"""The HU overlay: a Hungarian Plex section written onto its English twin's rows, split out of
+`plex/sync.py`, which runs it once per paired section during the full sync.
 
 The pairing is admin-configured (`plex_overlay_map`, ``huKey:enKey,...``). An overlay section creates
 no browsable rows of its own; it only fills the `*_hu` columns of the EN rows it matches by guid.
@@ -41,7 +41,7 @@ def sync_overlay(
     """Write an overlay section's Hungarian metadata onto its EN twin's rows, matched by guid. Creates
     NO browsable rows — an overlay library is never listed on its own. Only title/summary/tagline/genres
     differ by language; the language-neutral people_text feeds both search vectors. A show section's
-    episodes are overlaid too (E30): the HU section lists every episode with its Hungarian title and
+    episodes are overlaid too: the HU section lists every episode with its Hungarian title and
     summary, and the episode rows live in the EN show library.
 
     This is a full RECONCILE: after a COMPLETE HU listing every guid-bearing EN row's HU fields are
@@ -141,7 +141,7 @@ def _clear_hu(by_guid: dict, episodes: bool) -> None:
     cheap. The genres are the exception: every row gets Hungarian ones, from its HU twin or, lacking
     one, from its own English list — otherwise the HU genre list mixed "Drama" (no twin) with "Dráma".
     Only after a COMPLETE listing: one a Plex hiccup cut short would clear the HU text of every title
-    it failed to reach, until the next full sync (E32 S2, the watch reconcile's twin)."""
+    it failed to reach, until the next full sync (the watch reconcile's twin)."""
     for group in by_guid.values():
         for row in group:
             row.title_hu = row.summary_hu = None
diff --git a/backend/app/plex/people.py b/backend/app/plex/people.py
index 84c65eb2..df161e9d 100644
--- a/backend/app/plex/people.py
+++ b/backend/app/plex/people.py
@@ -160,7 +160,7 @@ def people_by_credits(
     return [r[0] for r in rows]
 
 
-# --- Portraits (E30 S6) ---------------------------------------------------------------------------
+# --- Portraits ---------------------------------------------------------------------------
 # A Plex CDN headshot is a full-size original (~170 KB on average, measured). Plex's photo transcoder
 # fits it into this box (~13 KB), which covers the largest place a portrait is drawn (the person page's
 # 6rem avatar) at 2x density and a raised text size. The box is part of the cache key, like a poster's:
@@ -226,7 +226,7 @@ _DEAD = frozenset({404, 410})
 
 
 def warm_portraits(db: Session, limit: int) -> dict:
-    """Cache up to `limit` not-yet-cached headshots, the most-credited people first (E30 S6), so a
+    """Cache up to `limit` not-yet-cached headshots, the most-credited people first, so a
     person's face comes from local disk. Needs Plex (the resize) and the Plex module on; without them
     nothing is prefetched — full-size originals for every person would cost gigabytes. A headshot Plex
     answers "not found" for is marked and left for PORTRAIT_RETRY; Plex failing in a row ends the run."""
diff --git a/backend/app/plex/query.py b/backend/app/plex/query.py
index 636d34f1..5cac29eb 100644
--- a/backend/app/plex/query.py
+++ b/backend/app/plex/query.py
@@ -31,9 +31,9 @@ PLEX_SORT_KEYS: tuple[str, ...] = (
     "title",
 )
 
-# --- Language-aware column pickers (E5 S6) ----------------------------------
+# --- Language-aware column pickers ----------------------------------
 #
-# The HU-overlay twin (E5 S5) stores Hungarian metadata in `*_hu` columns on the SAME EN row. When
+# The HU-overlay twin stores Hungarian metadata in `*_hu` columns on the SAME EN row. When
 # the app language is `hu` we serve those, falling back to the EN column where a row has no HU twin.
 # Two flavours of picker, on purpose:
 #   * DISPLAY / FILTER (`title_col`/`genres_col`): `coalesce(*_hu, *)` — an EN fallback so a row with
@@ -41,8 +41,8 @@ PLEX_SORT_KEYS: tuple[str, ...] = (
 #     HU summary directly off the loaded row, so no `summary_col` SQL helper is needed.)
 #   * SEARCH (`vector_col` + `field_recheck`): the raw `*_hu` column coalesced to '' — MIRRORING the
 #     generated `search_vector_hu` definition (which uses `coalesce(title_hu, '')`, NOT an EN
-#     fallback), so the field recheck stays a strict subset of the GIN vector prefilter (the S2
-#     invariant). `people_text` is language-neutral and shared by both vectors.
+#     fallback), so the field recheck stays a strict subset of the GIN vector prefilter (the
+#     field-search invariant). `people_text` is language-neutral and shared by both vectors.
 
 
 def title_col(model, lang: str):
@@ -216,7 +216,7 @@ def meta_filter_conds(model, p: dict, lang: str = "en") -> list:
     stds = split_csv(p.get("studios"))
     if stds:  # OR
         conds.append(model.studio.in_(stds))
-    for kw in split_csv(p.get("keywords")):  # AND — TMDB keyword chips from the detail page (E5 S5)
+    for kw in split_csv(p.get("keywords")):  # AND — TMDB keyword chips from the detail page
         conds.append(model.keywords.contains([kw]))
     csel = split_csv(p.get("collections"))
     if (
@@ -232,7 +232,7 @@ def apply_meta_filters(q, model, p: dict, lang: str = "en"):
     return q.where(*conds) if conds else q
 
 
-# --- Playback-class filter (E7) — MOVIE-ONLY (a show is an aggregate with no single class) ---------
+# --- Playback-class filter — MOVIE-ONLY (a show is an aggregate with no single class) ---------
 # The 4 classes the feed filter + facet expose, derived from the stored `playable` + `transcode_hw`.
 # ONE definition (this SQL CASE) so the filter WHERE and the facet counts can't drift: `playable_conds`
 # filters on it, `facets` groups by it. transcode_hw IS NOT True groups NULL (unprobed) with software.
@@ -278,7 +278,7 @@ class LibraryFilters:
     actors: str | None = None
     actor_mode: str = "any"  # how multiple actors combine: any (OR, default) | all (AND)
     studios: str | None = None
-    keywords: str | None = None  # TMDB keyword chips (E5 S5), CSV; language-neutral
+    keywords: str | None = None  # TMDB keyword chips, CSV; language-neutral
     collections: str | None = None  # CSV of collection rating_keys
     collection_mode: str = "any"  # how multiple collections combine: any (OR, default) | all (AND)
     playable: str | None = None  # CSV of playback classes: direct|remux|transcode_hw|transcode_sw
@@ -311,7 +311,7 @@ class LibraryFilters:
 # watch state. The SAME predicate has to be applied in two places — `unified_library` (the grid) and
 # `facets.wsq` (so the facet counts reflect exactly the visible set) — and they MUST stay identical:
 # a hidden movie kept out of the grid must not inflate the facets either. These helpers are the one
-# home for that predicate so the two call sites can't drift (E3 S1; pinned by test_plex_facets_grid_
+# home for that predicate so the two call sites can't drift (pinned by test_plex_facets_grid_
 # parity). Callers pass the already-joined state expressions, so this module stays model-agnostic:
 #   * movies — `st` is an aliased PlexState outer-joined on (item_id, user_id).
 #   * shows  — `tot`/`wat`/`inp` are the coalesced totals from `rollup.agg_subquery`.
@@ -367,9 +367,9 @@ def apply_show_state_filter(query, tot, wat, inp, show: str):
 def content_libs(db: Session) -> tuple[list[int], list[int]]:
     """The BROWSABLE content libraries, partitioned into (movie_lib_ids, show_lib_ids) — the single
     source of the browse scope. Excludes HU overlay libraries (`overlay_of` set): those are never
-    browsed on their own, they only lend their Hungarian metadata to the EN twin's rows (E5 S5).
+    browsed on their own, they only lend their Hungarian metadata to the EN twin's rows.
 
-    Lives here, in the query layer, rather than in `routes/plex/_shared.py` where it started: E24's
+    Lives here, in the query layer, rather than in `routes/plex/_shared.py` where it started: the
     Home surface needs the same scope, and a domain package importing from `routes/` would invert the
     one-way dependency CLAUDE.md draws. It never touched request state, so nothing was lost by the
     move."""
diff --git a/backend/app/plex/rollup.py b/backend/app/plex/rollup.py
index 7358338b..40dd3f69 100644
--- a/backend/app/plex/rollup.py
+++ b/backend/app/plex/rollup.py
@@ -13,10 +13,10 @@ from app.models import PlexItem, PlexState
 # Sort sentinel for a rail row whose timestamp is missing, so `key=lambda r: r[0] or NO_TS` reads the
 # same at every rail that merges two type-homogeneous lists in Python.
 #
-# It is NOT a crash fix, whatever the E24 commit that introduced it says. The `(ts is not None, ts)`
+# It is NOT a crash fix, whatever the commit that introduced it says. The `(ts is not None, ts)`
 # key it replaced cannot raise: tuple comparison finds the first UNEQUAL element via `==`, so two
 # `(False, None)` keys compare equal and `None < None` is never reached — verified by execution
-# during the E24 epic-end review, over every permutation of null/non-null rows. What the sentinel
+# during a review, over every permutation of null/non-null rows. What the sentinel
 # buys is one idiom instead of two, and a key that says "missing sorts last" outright rather than
 # encoding it in a boolean flag. A BARE `r[0]` would genuinely raise, which is the mutation the
 # rails' tests do guard against.
diff --git a/backend/app/plex/stream.py b/backend/app/plex/stream.py
index f9ac6caa..daf89f94 100644
--- a/backend/app/plex/stream.py
+++ b/backend/app/plex/stream.py
@@ -15,7 +15,7 @@ HLS muxer does the segmentation (the only reliable way to cut a stream-copy at k
 
 Sessions live in this (single) API process; a periodic reaper kills idle ones and frees the temp
 segments. The remux is CPU-light (video copy + a tiny audio transcode), so it runs fine on the
-CPU-only prod host; only P3's full transcode is CPU-heavy.
+CPU-only prod host; only the full transcode is CPU-heavy.
 """
 
 import os
@@ -120,8 +120,8 @@ class HlsSession:
         # Unguessable per-session id, carried in the URLs the client is handed. A seek-restart
         # replaces the viewer's registered session for the item — and the old player's next request
         # for `seg_12.ts`, resolved by (viewer, rating_key) alone, was answered 200 with the NEW session's twelfth segment, produced from a different offset
-        # under `-copyts`. Wrong bytes, not an error, so the client's reclaim never fired on it
-        # (deep-review round 5). A request naming a session that is no longer registered is a 404,
+        # under `-copyts`. Wrong bytes, not an error, so the client's reclaim never fired on it.
+        # A request naming a session that is no longer registered is a 404,
         # which the player recovers from by restarting at the playhead.
         self.id = secrets.token_urlsafe(9)
         self.key = key  # the item's rating_key (what the logs name)
@@ -413,7 +413,7 @@ def _venc_opts(
 def _render_node_present() -> bool:
     """Whether the VAAPI render node is available — i.e. `/dev/dri` was passed into the container.
     Present on prod after the iGPU enablement; absent on the CPU-only dev box and in the localdev
-    Docker. Its own function so the selection is monkeypatchable in tests and one place for S1c's knob."""
+    Docker. Its own function so the selection is monkeypatchable in tests and the one place to change it."""
     return Path(_VAAPI_DEVICE).exists()
 
 
@@ -576,7 +576,7 @@ def _ffmpeg_cmd(
                 entry += ",default:yes"
             var.append(entry)
         # The name patterns come from the vocabulary functions, with ffmpeg's own placeholders passed
-        # through them — so the producer and the parser cannot spell the layout differently (round 7).
+        # through them — so the producer and the parser cannot spell the layout differently.
         args += _HLS_TAIL + [
             "-master_pl_name",
             _MASTER_PL,
@@ -887,7 +887,7 @@ def current_session(user_id: int, key: str) -> HlsSession | None:
 # The names ffmpeg writes into a session directory, in ONE place — and "one place" means the argv
 # BUILDS its patterns from these same functions (`segment_name("%d", "%v")`), not that a comment
 # says so. Getting this wrong is invisible in both directions: a name we failed to anticipate used
-# to fall back to "wait and see" (round 6's HIGH), and now that the rule is positive it falls back
+# to fall back to "wait and see", and now that the rule is positive it falls back
 # to a 404 instead — so the producer and the parser have to be literally the same spelling.
 #
 # MEASURED (ffmpeg 7.1.5 in the API container — the binary that actually writes these files — and
@@ -901,7 +901,7 @@ def current_session(user_id: int, key: str) -> HlsSession | None:
 # SESSION and not to HLS in general: a single-audio session can never write `master.m3u8`,
 # `stream_*.m3u8` or any `seg_<variant>_<n>.ts`, and a multi-audio one can never write `index.m3u8`
 # or `seg_<n>.ts`. Accepting the union meant a hopeless name of the other shape was waited out for
-# the full playlist/segment timeout — the threadpool parking this guard exists to end (round 7).
+# the full playlist/segment timeout — the threadpool parking this guard exists to end.
 _MASTER_PL = "master.m3u8"
 _INDEX_PL = "index.m3u8"
 _SEG_NAME_RE = re.compile(r"^seg_(?:([0-9a-z]{1,4})_)?(\d{1,9})\.ts$")
@@ -953,12 +953,12 @@ def artifact_may_arrive(s: "HlsSession", filename: str) -> bool:
     name belonging to the other shape is as hopeless here as a random string. Reading those as "an
     HLS name, so wait and see" left the whole class reachable — measured through the real route
     against a live single-audio session, `master.m3u8` and `stream_q7z.m3u8` were 404s after 30.0 s
-    and `seg_a0_0.ts` / `seg_zzzz_0.ts` after 20.1 s each (deep-review round 7).
+    and `seg_a0_0.ts` / `seg_zzzz_0.ts` after 20.1 s each.
 
     Saying no at once matters because the route that waits is a SYNC one: it holds a thread off the
     ~40-slot pool, and a pooled DB connection with it, for the whole timeout. An ordinary seek past
     the produced region was enough to park one for 20 s, and forty concurrent requests for a name
-    that will never exist parked the whole API (deep-review round 5). Round 5's guard read only
+    that will never exist parked the whole API. An earlier guard read only
     single-audio segment names, so both halves of that were still fully reachable: every multi-audio
     name fell through, and so did any `.m3u8`/`.vtt` name at all."""
     if filename in playlist_names(s.variants):
@@ -1093,15 +1093,15 @@ def reap_idle(finished_idle_s: float = _FINISHED_IDLE_S) -> int:
     A finished session is also what a PAUSED viewer has: a remux runs far faster than realtime, so
     ffmpeg is done a minute or two in and writes ENDLIST; hls.js then stops asking for the playlist,
     and with its forward buffer full a paused player fetches nothing at all. With the 30 s rule that
-    killed a one-minute pause, and playback died ~30 s after resuming (deep-review round 4).
+    killed a one-minute pause, and playback died ~30 s after resuming.
 
     What makes the short rule safe again is that fetching is no longer the only signal: a player
     parked MID-ITEM checkpoints its position every 10 s, and that route calls `touch_session`, so a
-    viewer who is merely paused says so far more often than this rule asks (round 5). The heartbeat
+    viewer who is merely paused says so far more often than this rule asks. The heartbeat
     stops once the item is finished or before a position is known (`usePlexProgress.flush`) — both
     states where reaping is correct, and where the player's 404 → reclaim recovers a viewer who
-    scrubs back in anyway. Do not restate this as "every 10 s whether or not it is playing": round 6
-    found that claim in two comments and not in the code. Round 4's blanket
+    scrubs back in anyway. Do not restate this as "every 10 s whether or not it is playing":
+    a review found that claim in two comments and not in the code. An earlier blanket
     `reap_abandoned` bought the same safety by keeping every finished session for ten minutes — each
     one a whole segmented copy of the film on a volume shared with the download center."""
     now = time.time()
diff --git a/backend/app/plex/sync.py b/backend/app/plex/sync.py
index c7712cad..9046430a 100644
--- a/backend/app/plex/sync.py
+++ b/backend/app/plex/sync.py
@@ -12,7 +12,7 @@ on a NON-empty listing — a section that returns zero items is left untouched,
 glitch that yields an empty page can't wipe a library (the metadata is cheap to re-sync; an accidental
 mass-delete is the only real risk). Library-level reconcile (dropping a whole removed section, the
 dead `enabled` column) is a separate follow-up. Cast + intro/credit markers are fetched lazily on the
-item-detail/player path (P2), not here.
+item-detail/player path, not here.
 """
 
 from datetime import datetime, timezone
@@ -150,7 +150,7 @@ _GUID_PREFERENCE = ("tmdb", "imdb", "tvdb")
 
 
 def _canonical_guid(meta: dict) -> str | None:
-    """The canonical external id used to pair an EN title with its HU-overlay twin (E5 S5). Reads the
+    """The canonical external id used to pair an EN title with its HU-overlay twin. Reads the
     `Guid` array (present only with includeGuids=1 in the listing), preferring tmdb > imdb > tvdb,
     normalised to '<provider>:<id>' (e.g. 'tmdb:12345'). None when no known provider id is present."""
     found: dict[str, str] = {}
@@ -419,7 +419,7 @@ def _paginate(plex: PlexClient, key: str, item_type: int, progress: dict | None
         # A truthy `total` we reached = a trustworthy complete listing. `total` unknown/zero-with-rows
         # (a Plex that doesn't report totalSize) is treated as NOT complete, so prune stays conservative.
         # `total` itself is kept for a caller to whom a server that SAID 0 is news it can trust (the
-        # watch reconcile); an empty mirror or overlay must not read it so (E32 S2).
+        # watch reconcile); an empty mirror or overlay must not read it so.
         progress["complete"] = bool(total) and start >= total
         progress["total"] = total
 
@@ -447,7 +447,7 @@ def _apply_facet_fields(row, meta: dict) -> None:
     # full cast (up to 24, grown by the rich backfill/info-page enrich), silently breaking the
     # person-page cast filter for names past the top ~20. The watermark gate below (`people_enriched_at
     # is None`) normally protects this, but it is NOT enough on its own: a migration that resets the
-    # watermark re-opens the regression (0065 nulled it, which is exactly how the S5b fix got undone in
+    # watermark re-opens the regression (0065 nulled it, which is exactly how a fix got undone in
     # prod). So guard STRUCTURALLY too, by LENGTH against the listing cap: a stored cast LONGER than the
     # cap can only be an enriched fuller list, so keep it (robust to any watermark reset). A stored cast
     # at or below the cap is itself listing-sourced, so take the fresh listing — which tracks Plex cast
@@ -694,7 +694,7 @@ def resync_collection(db: Session, plex: PlexClient, lib: PlexLibrary, rk: str)
 def _believed_children(plex: PlexClient, rk: str, meta: dict) -> list[dict] | None:
     """A collection's members, or None when the answer is not believed: no members from a collection
     whose own listing counts some (`childCount`) is a glitch, not a collection emptied — the same
-    empty-answer rule as the collection listing's (E32 review). Rebuilding on it showed the
+    empty-answer rule as the collection listing's. Rebuilding on it showed the
     collection empty until the next sync."""
     children = plex.collection_children(rk)
     count = str(meta.get("childCount") or "0")
@@ -745,7 +745,7 @@ def _sync_collections(db: Session, plex: PlexClient, lib: PlexLibrary, stats: di
     if not cols and existing:
         # The catalog's own rule (see the module doc): an empty listing while we hold rows is a Plex
         # glitch, not a library emptied of collections. Reconciling on it dropped every collection
-        # (its user-set `editable` flag with it) and every member's keys (E32 S2).
+        # (its user-set `editable` flag with it) and every member's keys.
         log.warning(
             "Plex listed no collections for a library that has some; keeping them this run",
             extra=logs.event("plex.sync.collections_empty", library=lib.plex_key),
diff --git a/backend/app/plex/tmdb.py b/backend/app/plex/tmdb.py
index 0f0896c9..ad2d9642 100644
--- a/backend/app/plex/tmdb.py
+++ b/backend/app/plex/tmdb.py
@@ -1,4 +1,4 @@
-"""TMDB enrichment for the mirrored Plex catalog (E5 S2).
+"""TMDB enrichment for the mirrored Plex catalog.
 
 A thin synchronous TMDB v3 client plus the parse/persist of the enrichment fields onto plex_items /
 plex_shows, matched by the stored canonical `guid` ("tmdb:12345", or imdb/tvdb resolved via /find).
@@ -134,7 +134,7 @@ class TmdbClient:
         return cast("list[dict] | None", self._get("/configuration/countries"))
 
     def fetch_person(self, person_id: int) -> dict | None:
-        """One person's bio + combined credits (E5 S6) + the bio's translations (E30 S4), in a single
+        """One person's bio + combined credits + the bio's translations, in a single
         append_to_response request."""
         return self._get(
             f"/person/{person_id}", {"append_to_response": "combined_credits,translations"}
@@ -226,7 +226,7 @@ def parse_tmdb(payload: dict, media_type: str) -> dict:
     crew.sort(key=lambda c: priority.get(c["job"], 99))
     crew = crew[:12]
 
-    # name -> tmdb person id, for the plex_people foundation (S6 fetches bios off these ids).
+    # name -> tmdb person id, for the plex_people foundation (bios are fetched off these ids).
     people: list[dict] = []
     for c in (credits.get("cast") or [])[:30]:
         if c.get("name") and c.get("id"):
@@ -266,7 +266,7 @@ def parse_tmdb(payload: dict, media_type: str) -> dict:
             c.get("name") for c in (payload.get("production_companies") or []) if c.get("name")
         ][:8]
         or None,
-        # The ISO code beside TMDB's English name (E30): the client names the country in the reader's
+        # The ISO code beside TMDB's English name: the client names the country in the reader's
         # language from the code; the name is the fallback for a code it cannot name.
         "production_countries": [
             {"code": c.get("iso_3166_1") or None, "name": c["name"]}
@@ -373,14 +373,14 @@ def enrich_batch(db: Session, tmdb: TmdbClient, limit: int) -> int:
 
 
 def _country(c: dict | str) -> dict:
-    """One stored production country as served: `{code, name}`. A row enriched before E30 stored the
+    """One stored production country as served: `{code, name}`. An older row stored the
     bare English name; until `backfill_country_codes` reaches it, it serves with no code (the client
     shows the name)."""
     return c if isinstance(c, dict) else {"code": None, "name": c}
 
 
 def backfill_country_codes(db: Session, tmdb: TmdbClient) -> int:
-    """Give the countries stored before E30 (bare English names) their ISO codes, from TMDB's own
+    """Give the older countries (bare English names) their ISO codes, from TMDB's own
     country list — the names came from that list, so they match it exactly. One request, and only
     while such a row is left: re-fetching each title instead would take the enrichment batch days.
     A name the list does not hold keeps no code. Returns the number of rows rewritten."""
@@ -418,7 +418,7 @@ def run_enrich(db: Session) -> dict:
 
 
 def run_people_enrich(db: Session) -> dict:
-    """Scheduler entry point of people_enrich (E30 S6): a batch of person bios (the most-credited
+    """Scheduler entry point of people_enrich: a batch of person bios (the most-credited
     first) and a batch of portraits. Each half is a no-op — never an error — without its TMDB key /
     without Plex."""
     batch = settings.people_enrich_batch
@@ -475,7 +475,7 @@ def resolve_recs(db: Session, recs: list[dict] | None, *, lang: str) -> list[dic
     """Tag each recommendation with whether it's in OUR library (matched by guid `tmdb:<id>`, bucketed
     by media_type — see resolve_library_guids) and, if so, its rating_key — so the client can deep-link
     the ones we have and merely display the rest. One we have is named as the library names it, in
-    `lang` (E30); one we lack keeps the title TMDB gave."""
+    `lang`; one we lack keeps the title TMDB gave."""
     if not recs:
         return []
     movies, shows = resolve_library_guids(db, recs)
@@ -515,7 +515,7 @@ def serve_block(db: Session, row, *, lang: str) -> dict | None:
     }
 
 
-# --- Person enrichment (E5 S6) -------------------------------------------------------------------
+# --- Person enrichment -------------------------------------------------------------------
 # A person's bio + birth facts + a "Known for" credit pool, fetched once — by the people_enrich job, or
 # by the first person-page open if the job has not reached them yet — and served from the plex_people row. `known_for` stores the top combined-credits ids; the person
 # endpoint resolves them to library rows by guid at serve time (like recommendations).
@@ -525,7 +525,7 @@ def serve_block(db: Session, row, *, lang: str) -> dict | None:
 # credits are often not the 15 a given library holds.
 _KNOWN_FOR_MAX = 40
 # TMDB genre ids of the shows a person visits as a guest (News, Reality, Talk). Ranked by popularity,
-# talk-show visits crowded out the films (Tom Cruise: 14 of 15 were talk shows; E30 S6).
+# talk-show visits crowded out the films (Tom Cruise: 14 of 15 were talk shows).
 _GUEST_GENRES = {10763, 10764, 10767}
 # A credit in which the person plays themselves ("Self", "Himself - Guest", "Herself (archive footage)").
 _SELF_CREDIT = re.compile(r"^\s*(self|himself|herself|themselves)\b", re.IGNORECASE)
@@ -646,7 +646,7 @@ _PEOPLE_FAILS_IN_A_ROW = 3
 
 
 def enrich_people_batch(db: Session, tmdb: TmdbClient, limit: int) -> dict:
-    """Fetch up to `limit` linked, not-yet-enriched people (E30 S6), the most-credited first, so a
+    """Fetch up to `limit` linked, not-yet-enriched people, the most-credited first, so a
     person page reads its bio from the row instead of waiting on TMDB. Each person is committed as it
     lands: a page open during the run already sees it. A failed lookup is skipped (left unstamped for the
     next run); _PEOPLE_FAILS_IN_A_ROW of them in a row end the batch."""
diff --git a/backend/app/plex/watch_sync.py b/backend/app/plex/watch_sync.py
index a632b3bb..6a00db2f 100644
--- a/backend/app/plex/watch_sync.py
+++ b/backend/app/plex/watch_sync.py
@@ -11,7 +11,7 @@ already pages) and upsert them into the owner's `plex_states`. Plex wins on over
 exist only in Siftlode are left untouched (union, Plex-authoritative on the intersection).
 
 Phases B (Siftlode→Plex push via scrobble/timeline) and C (incremental Plex→Siftlode via the watch
-history + onDeck) build on this and land in later ships. As of S2 Plex is the source of truth: the
+history + onDeck) build on this and land in later ships. Plex is now the source of truth: the
 player pushes the resume position back to Plex on the periodic checkpoint (not just the final flush),
 and the incremental pull resolves a genuine divergence to Plex's state (see `_pull_apply`) rather than
 running a last-write-wins comparison.
@@ -81,7 +81,7 @@ def _scan_plex_states(
     The settled keys matter to the reconcile alone: it reads "absent from the scan" as "Plex
     un-watched it", which a walk cut short by a Plex hiccup does not mean (see `_paginate`). Settled
     is decided PER SECTION: one section that never settles (a library emptied on Plex while its
-    mirrored items are kept) must not stop un-watches syncing in all the others (E32 review)."""
+    mirrored items are kept) must not stop un-watches syncing in all the others."""
     item_id_by_rk = _rk_to_id(db)
     wanted = _enabled_section_keys(db)
     # The sections we mirror something from: a total of 0 from one of those contradicts the mirror.
@@ -117,7 +117,7 @@ def _scan_plex_states(
                 out[item_id] = res
         # A section the server SAYS is empty (total 0, nothing listed) settles too. Believed only for
         # a section we mirror nothing from: one whose items we hold answering 0 is a Plex that lost
-        # the library for a moment, not one that un-watched all of it (E32 review) — so it is left
+        # the library for a moment, not one that un-watched all of it — so it is left
         # unsettled, and its rows are not cleared.
         listed = scanned > before
         said_empty = progress.get("total") == 0 and not listed and key not in mirrored
@@ -402,7 +402,7 @@ def _pull_apply(
         if st is not None and not st.synced_to_plex:
             st.synced_to_plex = True  # already matches Plex → just settle the flag, no churn
         return None
-    # Plex-authoritative (S2): on a genuine divergence for an item Plex knows about, Plex wins — no
+    # Plex-authoritative: on a genuine divergence for an item Plex knows about, Plex wins — no
     # last-write-wins tug-of-war. This is safe because prompt write-back (playback.py pushes the resume
     # position to Plex on the ~10s checkpoint, not just on the final flush) keeps Plex current, so a
     # local edit that's "newer" than Plex has almost always already been pushed and matched above by
@@ -620,9 +620,8 @@ def _clear_unwatched(db: Session, user_id: int, plex_states: dict, settled: set[
     """Clear the user's rows Plex no longer has a record for — the mirrored ones (Plex un-watched
     them); hidden and dirty rows stay (a dirty one is re-pushed by `_repush_dirty`). Only rows of the
     sections the scan SETTLED: a walk a Plex hiccup cut short leaves out rows it merely failed to
-    reach, and clearing those un-watched them here until the next complete run (E32 S2); an item of
-    a library the allowlist leaves out is absent from every scan, and was cleared on every run (E32
-    review)."""
+    reach, and clearing those un-watched them here until the next complete run; an item of
+    a library the allowlist leaves out is absent from every scan, and was cleared on every run."""
     n = 0
     rows = db.execute(
         select(PlexState)
diff --git a/backend/app/progress.py b/backend/app/progress.py
index 98126e7b..7aa3b4c3 100644
--- a/backend/app/progress.py
+++ b/backend/app/progress.py
@@ -25,7 +25,7 @@ def report(current: int, total: int | None = None, phase: str | None = None) ->
 
 
 class JobFailed(RuntimeError):
-    """A job's own failure, said so the reader's language can name it (E31): the client reads
+    """A job's own failure, said so the reader's language can name it: the client reads
     `scheduler.failure.<reason>` and interpolates `params` (keep them to values the reader may see —
     numbers, ids, short codes). The message is the English line the log and `last_error` keep. An
     upstream's own error (a timeout, a refused connection) is not one of these: it stays as raised,
diff --git a/backend/app/realtime.py b/backend/app/realtime.py
deleted file mode 100644
index 0f29e086..00000000
--- a/backend/app/realtime.py
+++ /dev/null
@@ -1,68 +0,0 @@
-"""In-process WebSocket connection registry for live server→client push.
-
-Generic groundwork (notification module phase 2 is the first user): connections are kept in
-this process's memory, keyed by user_id, so a request handler can push an event to all of a
-user's open tabs/devices. Single-uvicorn-process assumption — if we ever run multiple workers,
-replace the in-memory map with a Redis pub/sub fan-out behind the same `push()` interface (same
-note as app.ratelimit).
-
-`push()` is intentionally SYNC-callable: ordinary (sync) route handlers run in a threadpool, so
-they schedule the actual send onto the WebSocket event loop via run_coroutine_threadsafe. The
-connect/disconnect/_push coroutines all run on that one loop, so the connection map is only ever
-mutated from a single thread.
-"""
-
-import asyncio
-from collections import defaultdict
-
-from starlette.websockets import WebSocket
-from app import logs
-
-log = logs.get_logger(__name__)
-
-
-class ConnectionManager:
-    def __init__(self) -> None:
-        self._conns: dict[int, set[WebSocket]] = defaultdict(set)
-        self._loop: asyncio.AbstractEventLoop | None = None
-
-    async def connect(self, user_id: int, ws: WebSocket) -> None:
-        self._loop = asyncio.get_running_loop()
-        await ws.accept()
-        self._conns[user_id].add(ws)
-
-    async def disconnect(self, user_id: int, ws: WebSocket) -> None:
-        conns = self._conns.get(user_id)
-        if conns:
-            conns.discard(ws)
-            if not conns:
-                self._conns.pop(user_id, None)
-
-    async def _push(self, user_id: int, payload: dict) -> None:
-        for ws in list(self._conns.get(user_id, ())):
-            try:
-                await ws.send_json(payload)
-            except Exception as exc:  # noqa: BLE001 — one dead socket must not stop the others
-                # Stale socket; it'll be cleaned up by its own disconnect handler. But this is
-                # also where a live update goes missing: the UI simply never changes, and there
-                # is no request behind it whose failure anyone could look up.
-                log.debug(
-                    "a live update could not be pushed to a socket",
-                    extra=logs.event(
-                        "realtime.push_failed", user_id=user_id, reason=type(exc).__name__
-                    ),
-                )
-
-    def push(self, user_id: int, payload: dict) -> None:
-        """Schedule a push onto the WebSocket event loop. Safe to call from a sync route
-        handler (threadpool). No-op if no WebSocket has ever connected (no loop captured)."""
-        loop = self._loop
-        if loop is None:
-            return
-        try:
-            asyncio.run_coroutine_threadsafe(self._push(user_id, payload), loop)
-        except Exception:  # noqa: BLE001 — a closed loop or socket must not fail the caller
-            log.debug("ws push failed", exc_info=True)
-
-
-manager = ConnectionManager()
diff --git a/backend/app/routes/_common.py b/backend/app/routes/_common.py
index 0fe3ff64..9776427a 100644
--- a/backend/app/routes/_common.py
+++ b/backend/app/routes/_common.py
@@ -1,4 +1,4 @@
-"""Route-layer shared helpers for the API contract (R6 S1a).
+"""Route-layer shared helpers for the API contract.
 
 Small, dependency-light guards that several route modules had hand-rolled with subtle
 drift. Keeping them here (imported by the route modules) means the "fetch a row or 404"
@@ -128,7 +128,7 @@ async def capped_stream_to(
 
 
 def issue_refused(exc: gitea.GiteaError) -> HTTPException:
-    """The refusal an issue-tracker failure (E16) answers as — the send, the preview and the
+    """The refusal an issue-tracker failure answers as — the send, the preview and the
     admin's connection test alike. Literal reasons, one per case: the frontend's contract test reads
     them to require a sentence for each in both languages."""
     match exc.reason:
diff --git a/backend/app/routes/admin.py b/backend/app/routes/admin.py
index a24c0326..331a1fdc 100644
--- a/backend/app/routes/admin.py
+++ b/backend/app/routes/admin.py
@@ -1,5 +1,4 @@
-"""Admin-only onboarding: review access requests (Invites), approve/deny, manual add.
-Also the demo-account admin surface: the demo email whitelist + a manual state reset."""
+"""Admin-only onboarding: review access requests (Invites), approve/deny, manual add."""
 
 from collections.abc import Iterable
 from datetime import datetime, timezone
@@ -19,15 +18,12 @@ from app.auth import (
     count_admins,
     env_allowed_canonicals,
     find_user_by_email,
-    get_or_create_demo_user,
     is_allowed,
     operator_contact,
     purge_user,
 )
 from app.db import get_db
-from app.demo import reset_demo_state
 from app.models import (
-    DemoWhitelist,
     Invite,
     User,
 )
@@ -131,7 +127,7 @@ def _welcome_mail_parts(db: Session, email: str) -> tuple[str | None, bool, int]
     """
     hours = int(APPROVAL_VERIFY_TTL.total_seconds() // 3600)
     user = find_user_by_email(db, email)
-    if user is None or user.is_demo:
+    if user is None:
         return None, False, hours
     if user.email_verified or not email_mod.email_enabled(db):
         return None, True, hours
@@ -142,20 +138,21 @@ def _activate_user_by_email(db: Session, email: str) -> None:
     """Approving access activates a matching (e.g. pending password-registration) account so
     it can sign in. No-op if no such user exists yet (a Google user is created at first login).
 
-    E9.5 S1: this path deliberately does NOT revoke a preset password. Revoking here destroyed the
+    This path deliberately does NOT revoke a preset password. Revoking here destroyed the
     password a legitimate registrant had just chosen and made "your password was cleared for
     security" the DEFAULT experience, because approve-before-verify is the normal ordering.
 
-    S1 justified that by saying `password_login` refuses an unverified account BEFORE it looks at
-    `is_active`, so a pre-emptor could not sign in "approved or not". A review of the finished epic
-    showed that argument only holds while the address stays unverified — and S6's approval mail
-    hands the real owner a confirmation link precisely so they will end that state. Nothing replaced
-    the revoke, and that is deliberate: round 2 of the same review tried "the newest registration
-    owns an unverified account" and reverted it, because the rule is symmetric — an attacker can
-    always register last — and it handed anonymous callers a write onto a real account's credential.
-    The owner's recourse is password-reset, which proves the mailbox, rewrites the hash and bumps
-    the session epoch. The residual is logged as SEC-16. The revoke also stays on the Google-adoption path
-    (auth.revoke_preset_password_if_unverified), where ownership is actually attested."""
+    That was once justified by saying `password_login` refuses an unverified account BEFORE it
+    looks at `is_active`, so a pre-emptor could not sign in "approved or not". A review of the
+    finished epic showed that argument only holds while the address stays unverified — and the
+    approval mail hands the real owner a confirmation link precisely so they will end that state.
+    Nothing replaced the revoke, and that is deliberate: the same review later tried "the newest
+    registration owns an unverified account" and reverted it, because the rule is symmetric — an
+    attacker can always register last — and it handed anonymous callers a write onto a real
+    account's credential. The owner's recourse is password-reset, which proves the mailbox, rewrites
+    the hash and bumps the session epoch. The residual is logged as SEC-16. The revoke also stays on
+    the Google-adoption path (auth.revoke_untrusted_preset_password), where ownership is
+    actually attested."""
     # Canonical, with the literal spelling preferred when both exist: approving
     # `npeter83.temu@gmail.com` must activate the account that registered as `npeter83temu@gmail.com`,
     # since Gmail delivers both to one mailbox and the admin decided about the mailbox.
@@ -400,19 +397,18 @@ def _serialize_user(u: User) -> dict:
         "is_active": u.is_active,
         "is_suspended": u.is_suspended,
         "email_verified": u.email_verified,
-        "is_demo": u.is_demo,
         "has_password": u.password_hash is not None,
         # Distinguishes "this account never had a password" (Google-only) from "SEC-10 cleared it" —
         # the same distinction _send_reset_if_eligible needs, and the one an admin has to see before
         # deciding what kind of help someone needs.
         "password_revoked_at": iso(u.password_revoked_at),
         "has_google": u.google_sub is not None,
-        # Only when it DIFFERS from the account address (E9.5 S3): "connected" is not the same
+        # Only when it DIFFERS from the account address: "connected" is not the same
         # statement as "connected as someone else", and the second one is the one that explains a
         # confusing sign-in.
         "google_email": u.google_email if u.google_email != u.email else None,
         "created_at": iso(u.created_at),
-        # NULL = no sign-in since the column existed (0085), or the shared demo account.
+        # NULL = no sign-in since the column existed (0085).
         "last_login_at": iso(u.last_login_at),
     }
 
@@ -435,14 +431,12 @@ def set_user_role(
     admin: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Promote/demote a user. Guards: can't change your own role, can't touch the demo
-    account, and can't remove the last remaining admin. Emails the user when it actually changes."""
+    """Promote/demote a user. Guards: can't change your own role and can't remove the
+    last remaining admin. Emails the user when it actually changes."""
     role = body.role
     if role not in ("user", "admin"):
         raise refused(400, "invalid_role")
     target = get_or_404(db, User, user_id, what="user")
-    if target.is_demo:
-        raise refused(400, "demo_role")
     if target.id == admin.id:
         raise refused(400, "own_role")
     if (
@@ -490,14 +484,11 @@ def set_user_suspended(
     db: Session = Depends(get_db),
 ) -> dict:
     """Suspend or un-suspend an account. A suspended user can't sign in by any method and any
-    live session is dropped on its next request. Guards: can't suspend the demo account, can't
-    suspend yourself, and can't suspend the last active admin (that would lock admin out). On
+    live session is dropped on its next request. Guards: can't suspend yourself, and can't suspend the last active admin (that would lock admin out). On
     un-suspend the user is emailed they can return (suspend is announced reactively, on a blocked
     sign-in)."""
     suspended = body.suspended
     target = get_or_404(db, User, user_id, what="user")
-    if target.is_demo:
-        raise refused(400, "demo_suspend")
     if target.id == admin.id:
         raise refused(400, "own_suspend")
     if (
@@ -538,10 +529,8 @@ def admin_delete_user(
 ) -> dict:
     """Admin-triggered account deletion — the same full erasure a user can perform on themselves
     (cascade delete of all personal data + access-request cleanup + Google-grant revoke). Guards:
-    not the demo account, not yourself (use Settings → Account), and not the last admin."""
+    not yourself (use Settings → Account), and not the last admin."""
     target = get_or_404(db, User, user_id, what="user")
-    if target.is_demo:
-        raise refused(400, "demo_delete")
     if target.id == admin.id:
         raise refused(400, "own_delete")
     if (
@@ -563,10 +552,7 @@ def admin_delete_user(
     return {"deleted": user_id}
 
 
-# --- Demo account: email whitelist + state reset -------------------------------------
-
-
-# --- Stuck sign-ups: the admin lifeline (E9.5 S5, roadmap UX-25) ---------------------------------
+# --- Stuck sign-ups: the admin lifeline -----------------------------------------------------------
 
 
 def _pending_access_rows(db: Session) -> list[User]:
@@ -587,7 +573,6 @@ def _pending_access_rows(db: Session) -> list[User]:
         db.execute(
             select(User)
             .where(
-                User.is_demo.is_(False),
                 User.is_suspended.is_(False),
                 or_(User.is_active.is_(False), User.email_verified.is_(False)),
             )
@@ -625,7 +610,7 @@ def user_access(
     _: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Everything the account panel shows about why this person can or cannot get in (E12 S5).
+    """Everything the account panel shows about why this person can or cannot get in.
 
     Its own endpoint rather than extra columns on /users: `is_allowed` and `can_activate` each run a
     query, and the panel opens for ONE user at a time — folding them into the list would pay that cost
@@ -644,7 +629,7 @@ def create_set_password_link(
     admin: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Mint a one-time link that lets this account set a password, with no email involved (E12 S5).
+    """Mint a one-time link that lets this account set a password, with no email involved.
 
     The answer to SEC-15, SEC-16 and "no SMTP and someone forgot their password" at once. The admin
     hands the link over by whatever channel they trust; opening it sets a password and signs out
@@ -653,13 +638,8 @@ def create_set_password_link(
     Deliberately NOT gated on the account's state. It is useful for a pre-empted address, for a
     revoked password, for a Google-only account that wants one, and for a plain forgotten password on
     an instance with no mail — narrowing it to one of those would only make the admin's real case the
-    one it refuses. The demo account is the single exception: it is shared, so handing anyone a way to
-    change its password is handing them everyone else's session."""
+    one it refuses."""
     target = get_or_404(db, User, user_id, what="user")
-    if target.is_demo:
-        raise HTTPException(
-            status_code=400, detail={"code": "setpw", "reason": "demo", "email": target.email}
-        )
     url, expires_at = issue_set_password_link(db, target)
     # The URL itself is NOT recorded: the audit log is read by humans and kept long, and a live
     # credential-setting link is the last thing that belongs in it. That the link was issued, by whom,
@@ -692,8 +672,6 @@ def activate_user(
     already do exactly this by re-entering the address in the whitelist box (`add_invite` →
     `_activate_user_by_email`). What was missing was any way to know they had to."""
     target = get_or_404(db, User, user_id, what="user")
-    if target.is_demo:
-        raise refused(400, "demo_activate")
     if target.is_active:
         return _serialize_user(target)  # idempotent: a double click is not an error
     if not is_allowed(db, target.email):
@@ -731,7 +709,7 @@ def resend_user_verification(
     Not rate-limited: an admin is not a threat model to enumerate against, and the deliberate silence
     of the public endpoint is exactly what this exists to escape."""
     target = get_or_404(db, User, user_id, what="user")
-    if target.is_demo or target.email_verified:
+    if target.email_verified:
         raise HTTPException(
             status_code=409,
             detail={"code": "resend", "reason": "not_applicable", "email": target.email},
@@ -757,93 +735,6 @@ def resend_user_verification(
     return {"ok": True, "email": target.email}
 
 
-def _serialize_demo(row: DemoWhitelist) -> dict:
-    return {
-        "id": row.id,
-        "email": row.email,
-        "note": row.note,
-        "added_by": row.added_by,
-        "created_at": iso(row.created_at),
-    }
-
-
-@router.get("/demo/whitelist")
-def list_demo_whitelist(_: User = Depends(admin_user), db: Session = Depends(get_db)) -> list[dict]:
-    rows = (
-        db.execute(select(DemoWhitelist).order_by(DemoWhitelist.created_at.desc())).scalars().all()
-    )
-    return [_serialize_demo(r) for r in rows]
-
-
-class AddDemoWhitelistIn(BaseModel):
-    email: str = ""
-    note: str | None = None
-
-
-@router.post("/demo/whitelist")
-def add_demo_whitelist(
-    body: AddDemoWhitelistIn,
-    admin: User = Depends(admin_user),
-    db: Session = Depends(get_db),
-) -> dict:
-    """Add an email that may enter the shared demo account from the login page (no Google
-    sign-in). Idempotent — re-adding an existing email just returns it."""
-    email = body.email.strip().lower()
-    if not valid_email(email):
-        raise refused(400, "invalid_email")
-    row = db.execute(select(DemoWhitelist).where(DemoWhitelist.email == email)).scalar_one_or_none()
-    if row is None:
-        row = DemoWhitelist(
-            email=email,
-            note=(body.note or "").strip() or None,
-            added_by=admin.email,
-        )
-        db.add(row)
-        audit.record(
-            db, admin.id, AuditAction.DEMO_ADD, target_type="demo", target_id=email, summary=email
-        )
-        db.commit()
-    return _serialize_demo(row)
-
-
-@router.delete("/demo/whitelist/{entry_id}")
-def remove_demo_whitelist(
-    entry_id: int,
-    admin: User = Depends(admin_user),
-    db: Session = Depends(get_db),
-) -> dict:
-    row = db.get(DemoWhitelist, entry_id)
-    if row is not None:
-        audit.record(
-            db,
-            admin.id,
-            AuditAction.DEMO_REMOVE,
-            target_type="demo",
-            target_id=row.email,
-            summary=row.email,
-        )
-        db.delete(row)
-        db.commit()
-    return {"deleted": entry_id}
-
-
-@router.post("/demo/reset")
-def reset_demo(admin: User = Depends(admin_user), db: Session = Depends(get_db)) -> dict:
-    """Manually clean up the shared demo sandbox back to a baseline. A scheduled job does the
-    same automatically (admin-tunable interval); this is the admin's on-demand button."""
-    demo = get_or_create_demo_user(db)
-    seeded = reset_demo_state(db, demo)
-    audit.record(
-        db,
-        admin.id,
-        AuditAction.DEMO_RESET,
-        summary=f"{seeded} sample playlists re-seeded",
-        after={"playlists_seeded": seeded},  # the count as data: named in the reader's language
-    )
-    db.commit()
-    return {"ok": True, "reset": True, "playlists_seeded": seeded}
-
-
 @router.post("/purge-discovery")
 def purge_discovery(admin: User = Depends(admin_user), db: Session = Depends(get_db)) -> dict:
     """Reclaim all un-kept discovery content NOW (ignoring the grace period): live-search result
diff --git a/backend/app/routes/admin_logs.py b/backend/app/routes/admin_logs.py
index 07b4c44f..8202cafd 100644
--- a/backend/app/routes/admin_logs.py
+++ b/backend/app/routes/admin_logs.py
@@ -1,4 +1,4 @@
-"""The admin diagnostics console's read side (E22.6): query `log_events`, the server's stored log.
+"""The admin diagnostics console's read side: query `log_events`, the server's stored log.
 
 Admin-only and read-only — rows leave the table through the retention job (`log_retention_days`),
 never through here. Reading is not audited: it changes nothing, and the console's live tail polls,
diff --git a/backend/app/routes/auth.py b/backend/app/routes/auth.py
index 2fbca25b..7a4ba873 100644
--- a/backend/app/routes/auth.py
+++ b/backend/app/routes/auth.py
@@ -1,6 +1,6 @@
 """Auth HTTP endpoints (OAuth login/callback, register/verify, password, session mgmt).
 
-Split out of app/auth.py (R12 S2); the core auth surface (current_user, scopes, token
+Split out of app/auth.py; the core auth surface (current_user, scopes, token
 helpers) stays in app/auth.py, imported below."""
 
 import secrets
@@ -29,8 +29,8 @@ from app.auth import (
     WRITE_SCOPES,
     current_user,
     env_admin_canonicals,
+    env_allowed_canonicals,
     find_user_by_email,
-    get_or_create_demo_user,
     google_enabled,
     is_allowed,
     log,
@@ -39,7 +39,7 @@ from app.auth import (
 )
 from app.config import settings
 from app.db import SessionLocal, get_db
-from app.models import AuthToken, DemoWhitelist, Invite, OAuthToken, User, display_text
+from app.models import AuthToken, Invite, OAuthToken, User, display_text
 from app.ratelimit import RateLimiter, client_key
 from app.security import encrypt, hash_password, hash_token, verify_password
 from app.utils import canonical_email, valid_email
@@ -53,7 +53,7 @@ VERIFY_TTL = timedelta(hours=24)
 # in and sets no password.
 APPROVAL_VERIFY_TTL = timedelta(days=7)
 RESET_TTL = timedelta(hours=1)
-# An admin-issued set-password link (E12 S5) travels out of band — the admin has to actually reach the
+# An admin-issued set-password link travels out of band — the admin has to actually reach the
 # person and hand it over — so the one-hour reset window is far too short. A day matches VERIFY_TTL and
 # the affordance the admin was shown.
 ADMIN_SETPW_TTL = timedelta(hours=24)
@@ -72,7 +72,6 @@ _reset_limiter = RateLimiter(max_events=5, window_seconds=300)
 # Separate from _reset_limiter on purpose: opening a link must not eat the budget for REQUESTING one.
 _reset_check_limiter = RateLimiter(max_events=10, window_seconds=300)
 _verify_resend_limiter = RateLimiter(max_events=5, window_seconds=300)
-_request_access_limiter = RateLimiter(max_events=5, window_seconds=300)
 _suspend_email_limiter = RateLimiter(max_events=1, window_seconds=3600)
 
 
@@ -92,8 +91,6 @@ def _notify_suspended(background: BackgroundTasks, user: User) -> None:
         )
 
 
-_demo_limiter = RateLimiter(max_events=5, window_seconds=60)
-
 router = APIRouter(prefix="/auth", tags=["auth"])
 
 _oauth = OAuth()
@@ -161,24 +158,12 @@ def notify_admins_of_request(
             background.add_task(email_mod.send_admin_new_request, recipients, lang, requester)
 
 
-def is_demo_allowed(db: Session, email: str) -> bool:
-    """Whether this email may enter the shared demo account (no Google sign-in)."""
-    if not email:
-        return False
-    return (
-        db.execute(
-            select(DemoWhitelist).where(DemoWhitelist.email == email.lower())
-        ).scalar_one_or_none()
-        is not None
-    )
-
-
 class InviteRequest(NamedTuple):
     """What an access request settled on.
 
     `invite` is the row the request now lives under — which is NOT always the address that was just
     typed: one Gmail mailbox spelled two ways settles on whichever row already exists, and that row's
-    address is where mail will go. Callers that tell the user what happened need it (E9.5 S4).
+    address is where mail will go. Callers that tell the user what happened need it.
     `is_new` is the old boolean return in a name: true only when a row was created or a denied one
     reopened, i.e. exactly when admins should hear about it. A repeat request must not re-spam them.
     """
@@ -196,14 +181,14 @@ def upsert_pending_invite(db: Session, email: str, lang: str | None = None) -> I
     not reopen a decision that has already been made for that mailbox. The row is still STORED under
     the address as typed, because that is where mail has to go.
 
-    `lang` is the language of the surface the request came from — the sign-in page, or the locale
-    Google reported for a refused sign-in. The latest one wins: someone who asks again from a
-    Hungarian page is telling us something newer than last time. Anything unsupported is ignored
+    `lang` is the language the request came in — the locale Google reported for a refused sign-in.
+    The latest one wins: someone who asks again under another locale is telling us something newer
+    than last time. Anything unsupported is ignored
     rather than stored, so a forged body cannot put junk in the column.
 
     The commit contract is unchanged: this still commits ONLY when it writes something. Callers rely
     on that — `_register_account` persists its own flushed user precisely because a no-op here
-    commits nothing (E9.5 S6).
+    commits nothing.
     """
     email = (email or "").lower()
     if not valid_email(email):
@@ -215,6 +200,12 @@ def upsert_pending_invite(db: Session, email: str, lang: str | None = None) -> I
         .scalars()
         .all()
     )
+    # An address the env already lets in has nothing to ask for, and a pending row for it would be
+    # worse than nothing: `is_allowed` answers from the invite rows once any exist, so a stranger
+    # registering a sibling spelling (`b.ob@` beside an env-granted `bob@`) would lock the real
+    # owner out of a grant no admin could see.
+    if not rows and canon in env_allowed_canonicals():
+        return InviteRequest(None, False)
     # An approved row wins, so a denied duplicate can't mask an approval. Then a row that is not
     # DENIED, preferring the exact spelling — a denied sibling must never be picked while a pending
     # row exists, or the reopen branch below would fire and put one person in the admin's queue
@@ -254,7 +245,7 @@ def _access_notice_url(kind: str, email: str = "", inv: Invite | None = None) ->
 
     It rides the FRAGMENT, not the query string, for the same reason the verify/reset tokens do
     (SB3): a fragment never reaches the server, a proxy access log or a Referer header — and this
-    notice now carries the user's address. Naming it is the point of E9.5 S4: on 2026-09-03 a
+    notice now carries the user's address. Naming it is the point: on 2026-09-03 a
     registration as `npeter83.temu@` met an OAuth claim of `npeter83temu@`, and a screen that said
     "request recorded" without saying FOR WHAT hid the mismatch for a day.
 
@@ -306,9 +297,10 @@ class EmailPasswordIn(BaseModel):
     password: str | None = None
     # The language the sign-up page was in. Captured at registration because it is the ONLY moment
     # the choice exists anywhere the server can see: it lives in the browser until an account does,
-    # and a preference nobody recorded cannot be backfilled later (the lesson `google_email` taught
-    # in E9.5 S3 — those rows still read NULL until each user signs in again). Nothing reads it yet;
-    # the bilingual mail templates are E9.5 S7.
+    # and a preference nobody recorded cannot be backfilled later (as `google_email` showed: those
+    # rows still read NULL until each user signs in again). It is stored as the account's
+    # `preferences["language"]`, which the UI starts in and every mail to the account is written in
+    # (`mailtext.lang_for_user` / `lang_for_email`).
     lang: str | None = None
 
 
@@ -408,7 +400,7 @@ async def callback(
             return RedirectResponse(url=_access_notice_url("requested", email, req.invite))
         return RedirectResponse(url=_access_notice_url("denied"))
 
-    user = db.query(User).filter(User.google_sub == sub).one_or_none()
+    user = db.execute(select(User).where(User.google_sub == sub)).scalar_one_or_none()
     if user is None:
         # No account carries this Google identity yet. If one already exists for this MAILBOX —
         # e.g. an email+password registration — adopt the Google identity onto it instead of
@@ -421,7 +413,11 @@ async def callback(
         # (ids 13 and 14). Exact spelling still wins when both exist, so an account that already
         # matches literally is never passed over for a canonical sibling.
         canon = canonical_email(email)
-        candidates = db.query(User).filter(User.email_canonical == canon).order_by(User.id).all()
+        candidates = (
+            db.execute(select(User).where(User.email_canonical == canon).order_by(User.id))
+            .scalars()
+            .all()
+        )
         existing = next((u for u in candidates if u.email == email), None) or next(
             iter(candidates), None
         )
@@ -447,9 +443,10 @@ async def callback(
                 return RedirectResponse(url=_access_notice_url("denied"))
             user = existing
             user.google_sub = sub
-            # SEC-10: drop any password pre-set on this account while its email was still unverified,
-            # now that Google attests ownership (bumps the epoch to revoke any session it minted).
-            revoke_preset_password_if_unverified(user)
+            # SEC-10: drop any password nobody proved the mailbox for, now that Google attests
+            # ownership (bumps the epoch to revoke any session it minted). Runs before the
+            # activation below, which is what it reads.
+            revoke_untrusted_preset_password(user)
             # Google verified the email and is_allowed granted access, so finish activating a
             # previously pending password registration (otherwise current_user would bounce it).
             user.email_verified = True
@@ -480,7 +477,16 @@ async def callback(
     # default for a brand-new account (its role attribute is still unset before flush).
     # Canonical, like every other read of the env lists: a dotted or `+tag`ged ADMIN_EMAILS entry
     # would otherwise never bootstrap its admin, because Google answers with the plain primary.
+    #
+    # Becoming admin this way drops any password the account holds, on whichever sign-in it
+    # happens. Nothing here can tell who chose that password: without SMTP registration marks the
+    # address verified with no proof (and SMTP configured later never revisits it), and an admin's
+    # Activate vouches for access, not for the password. So a stranger who registered the address
+    # first, and was let in, would otherwise see their own live session become an admin one. The
+    # real owner, signed in through Google right now, sets a new password in Settings.
     if canonical_email(email) in env_admin_canonicals():
+        if user.role != "admin" and user.password_hash is not None:
+            _revoke_password(user)
         user.role = "admin"
     elif not user.role:
         user.role = "user"
@@ -515,7 +521,7 @@ def _sync_google_email(db: Session, user: User, email: str) -> None:
     of the spelling they chose, because sign-in matches the stored address first. Google returns the
     account's PRIMARY address, which need not be what they registered with — and can never contain a
     `+` at all — so without this guard every plus-tagged registration lost its tag on the first Google
-    sign-in. (E9.5 S3 made that reachable by matching adoption across spellings; the rewrite itself is
+    sign-in. (Matching adoption across spellings made that reachable; the rewrite itself is
     older.)
 
     Never overwrite with an address another account already owns either: that would hit the unique
@@ -525,7 +531,9 @@ def _sync_google_email(db: Session, user: User, email: str) -> None:
         return
     if canonical_email(user.email) == canonical_email(email):
         return  # same mailbox, their spelling — leave it alone
-    clash = db.query(User).filter(User.email == email, User.id != user.id).one_or_none()
+    clash = db.execute(
+        select(User).where(User.email == email, User.id != user.id)
+    ).scalar_one_or_none()
     if clash is None:
         user.email = email
 
@@ -582,9 +590,11 @@ def _complete_link(
     if link_uid != request.session.get("user_id") and link_uid not in accounts:
         return RedirectResponse(url="/?link=error")
     user = db.get(User, link_uid)
-    if user is None or user.is_demo:
+    if user is None:
         return RedirectResponse(url="/?link=error")
-    other = db.query(User).filter(User.google_sub == sub, User.id != user.id).one_or_none()
+    other = db.execute(
+        select(User).where(User.google_sub == sub, User.id != user.id)
+    ).scalar_one_or_none()
     if other is not None:
         return RedirectResponse(url="/?link=conflict")
     if user.google_sub is not None and user.google_sub != sub:
@@ -628,73 +638,12 @@ async def logout(request: Request):
     return JSONResponse({"ok": True, "switched": False})
 
 
-class AccessRequestIn(EmailIn):
-    # The language of the page this request was made from. Same reasoning as registration's `lang`
-    # (and the same shape): it is the ONLY moment this preference exists anywhere the server can
-    # see, since the requester has no account to carry it, and it decides what language the approval
-    # or denial mail is written in.
-    lang: str | None = None
-
-
-@router.post("/request-access")
-async def request_access(
-    body: AccessRequestIn,
-    request: Request,
-    background: BackgroundTasks,
-    db: Session = Depends(get_db),
-) -> dict:
-    """Public: ask for access. Idempotent — repeat requests for the same email don't
-    duplicate or re-spam admins (upsert answers `is_new=False` for an already-pending row).
-
-    Answers a uniform ``"pending"`` for EVERY outcome — already-allowed, newly-pending,
-    already-pending, and rate-limited alike. The old ``"approved"`` reply for an allow-listed
-    address made this a public enumeration oracle for the allow-list (which the rest of the module
-    is careful to avoid, cf. demo_login); an already-allowed user can still just sign in with Google.
-    Rate-limited per client IP like register/login/reset, and a block returns "pending" too so the
-    endpoint can't be probed for throttling either."""
-    email = (body.email or "").strip().lower()
-    if not valid_email(email):
-        raise refused(400, "invalid_email")
-    if not _request_access_limiter.allow(client_key(request)):
-        return {"ok": True, "status": "pending"}
-    if is_allowed(db, email):
-        return {"ok": True, "status": "pending"}  # already allowed — don't reveal it
-    req = upsert_pending_invite(db, email, body.lang)
-    if req.is_new:
-        notify_admins_of_request(db, background, email)
-    return {"ok": True, "status": "pending"}
-
-
-@router.post("/demo")
-def demo_login(body: EmailIn, request: Request, db: Session = Depends(get_db)) -> dict:
-    """Hidden demo entry: a whitelisted email logs straight into the shared demo account,
-    no Google OAuth. The login page fires this quietly (debounced) as the user types/pastes,
-    so there is no visible 'demo login' button. Rate-limited per IP; when blocked it answers
-    exactly like a non-match (authenticated=false) so the field can't be hammered as an
-    enumeration oracle. On a match it sets the session and the client reloads into the app."""
-    if not _demo_limiter.allow(client_key(request)):
-        return {"ok": True, "authenticated": False}
-    email = (body.email or "").strip().lower()
-    if valid_email(email) and is_demo_allowed(db, email):
-        demo = get_or_create_demo_user(db)
-        # Isolate the demo: drop any real-account wallet on this tab first, so the demo session
-        # can't switch to / act as a previously signed-in account via the multi-account header.
-        request.session.clear()
-        request.session["user_id"] = demo.id
-        _remember_epoch(request, demo)
-        # The demo key IS an address, so it is not in the line — see the denied branch above.
-        log.info("signed in", extra=logs.event("auth.login.ok", method="demo", uid=demo.id))
-        return {"ok": True, "authenticated": True}
-    return {"ok": True, "authenticated": False}
-
-
 def _establish_session(request: Request, user: User) -> None:
     """Sign `user` in for this browser session — the ONE sign-in path, shared by the Google callback
     and password login, so both join the same account switcher and both stamp `last_login_at` (the
     caller commits). Multi-session: every account that authenticated in this browser is remembered so
     the user can switch between them; only accounts that actually proved themselves HERE land in that
-    wallet (it is the proof they may be switched to). The demo entry deliberately does not come
-    through here: it clears the wallet instead, and its shared account has no meaningful last login."""
+    wallet (it is the proof they may be switched to)."""
     accounts = [a for a in (request.session.get("account_ids") or []) if a != user.id]
     accounts.append(user.id)
     request.session["account_ids"] = accounts[-MAX_SESSION_ACCOUNTS:]
@@ -784,7 +733,7 @@ def _consume_password_token(db: Session, raw: str | None) -> tuple[User, str] |
 
 
 def issue_set_password_link(db: Session, user: User) -> tuple[str, datetime]:
-    """An admin-issued, single-use link that lets `user` set a password without any email (E12 S5).
+    """An admin-issued, single-use link that lets `user` set a password without any email.
 
     One mechanism answers three things: SEC-15 (on a no-SMTP instance every registration is
     auto-verified, so a pre-empted address cannot be recovered by mail), SEC-16 (a pre-empted address
@@ -866,10 +815,10 @@ def _register_account(email: str, password: str, lang: str | None = None) -> Non
             # for the same input — so it is not a new capability, just the end of a dead end. An
             # account that is already confirmed still gets nothing: there is nothing to confirm.
             #
-            # And a re-send is ALL it does: the submitted password is discarded. E9.5's closing
+            # And a re-send is ALL it does: the submitted password is discarded. A closing
             # review tried "while the address is unverified, the newest registration owns it"
             # (replace the hash, kill the outstanding verify tokens) as a fix for address
-            # pre-emption, and round 2 showed it was worse than the problem — DO NOT REPEAT IT.
+            # pre-emption, and it proved worse than the problem — DO NOT REPEAT IT.
             # The rule is symmetric, and an attacker can always be last: it hands an unauthenticated
             # caller the power to overwrite a real registrant's chosen password and delete the
             # confirmation link already in their inbox, and on a SEC-10-stripped row (password_hash
@@ -878,7 +827,7 @@ def _register_account(email: str, password: str, lang: str | None = None) -> Non
             # primitive: password-reset accepts this account, proves the mailbox, rewrites the hash
             # and bumps the session epoch. The residual is logged as SEC-16.
             user = existing
-            if not user.email_verified and not user.is_demo and email_mod.email_enabled():
+            if not user.email_verified and email_mod.email_enabled():
                 send_verification_link(db, user)
             return
         # Without working SMTP we can't deliver a verification link, so email ownership can't gate
@@ -918,7 +867,7 @@ def _register_account(email: str, password: str, lang: str | None = None) -> Non
         db.commit()
         if email_ok:
             send_verification_link(db, user)
-        # Fired unconditionally, unlike the other two callers which gate on a fresh invite row: for
+        # Fired unconditionally, unlike the Google callback, which gates on a fresh invite row: for
         # an address the admin already approved, nothing lands in the Access-requests queue, so this
         # is the only place the account's existence is announced at all. Delivery is a separate
         # matter — with no working SMTP `_send` drops it, which is why the pre-approved registrant
@@ -928,7 +877,7 @@ def _register_account(email: str, password: str, lang: str | None = None) -> Non
 
 def issue_verification_link(db: Session, user: User, ttl: timedelta | None = None) -> str:
     """A fresh confirmation link for `user`, returned rather than sent — for a mail that carries the
-    link inside a larger message (the branching approval/invitation mails, E9.5 S6).
+    link inside a larger message (the branching approval/invitation mails).
 
     Same token machinery and the same fragment (SB3) as the standalone confirmation mail, so the two
     kinds of link cannot drift apart in shape or in how they are consumed."""
@@ -943,8 +892,8 @@ def send_verification_link(db: Session, user: User) -> bool:
     address is the one its owner chose to be reachable at, and a `+tag` there is usually deliberate.
     The token rides the URL FRAGMENT (#) so it can never reach a proxy/access log or a Referer (SB3).
 
-    One definition, three callers — registration, the self-service resend, and the admin-side resend
-    (E9.5 S5). The link's shape and TTL must not drift between them; a verification mail that differs
+    One definition, three callers — registration, the self-service resend, and the admin-side resend.
+    The link's shape and TTL must not drift between them; a verification mail that differs
     by who triggered it is a bug waiting to be discovered by exactly one user.
 
     Returns whether the mail actually went out, so a caller with a human waiting on the answer (the
@@ -967,8 +916,8 @@ def verify_email_confirm(body: TokenIn, db: Session = Depends(get_db)) -> dict:
     dropped the password this account registered with, so sign-in would answer with the deliberately
     uniform "Invalid email or password" — true, but unreadable to the person who just proved they own
     the mailbox. Saying so leaks nothing: holding a valid single-use verify token for this account
-    already proves that much. Since E9.5 S1 the common source of that state is gone (admin approval no
-    longer revokes), leaving accounts stripped before that change and the Google-adoption path, so this
+    already proves that much. The common source of that state is gone (admin approval no longer
+    revokes), leaving accounts stripped before that change and the Google-adoption path, so this
     flag is rare now — but it must stay, because those users have no other way back in."""
     user = _consume_token(db, body.token, "verify")
     if user is None:
@@ -1012,7 +961,7 @@ def _resend_verify_if_eligible(email: str) -> None:
         return
     with SessionLocal() as db:
         user = find_user_by_email(db, email)
-        if user is not None and not user.email_verified and not user.is_demo:
+        if user is not None and not user.email_verified:
             send_verification_link(db, user)
 
 
@@ -1028,7 +977,7 @@ def _login_refused(status: int, reason: str, user: User | None = None, **extra)
     that proof (`invalid`, `rate_limited`) carry nothing at all, so they stay byte-identical for a
     real account and an unknown one.
 
-    Since E9.5 S1 the two gates are order-independent, so `approved` really can be true while
+    The two gates are order-independent, so `approved` really can be true while
     `email_verified` is false, and vice versa — the SPA renders whichever is actually outstanding
     rather than assuming a sequence.
     """
@@ -1058,11 +1007,11 @@ def password_login(
     email = (body.email or "").strip().lower()
     password = body.password or ""
     user = find_user_by_email(db, email)
-    # Always run the KDF (against a decoy hash for an unknown / passwordless / demo account) so the
+    # Always run the KDF (against a decoy hash for an unknown / passwordless account) so the
     # response time is the same whether or not the email exists — no timing-based enumeration.
-    candidate_hash = user.password_hash if (user and not user.is_demo) else None
+    candidate_hash = user.password_hash if user else None
     password_ok = verify_password(password, candidate_hash or _DECOY_PASSWORD_HASH)
-    if user is None or user.is_demo or not password_ok:
+    if user is None or not password_ok:
         raise _login_refused(401, "invalid")
     if user.is_suspended:
         _notify_suspended(background, user)
@@ -1101,7 +1050,7 @@ def password_reset_request(
 
 def _send_reset_if_eligible(email: str) -> None:
     """Background worker for password_reset_request: issue a reset token + email the link, but ONLY
-    for a real (non-demo) password account. Runs after the response with its own DB session, so the
+    for a password account. Runs after the response with its own DB session, so the
     request's timing never reveals whether the account exists. Token rides the URL FRAGMENT (#) so it
     can't leak into proxy/access logs or a Referer (SB3).
 
@@ -1112,7 +1061,7 @@ def _send_reset_if_eligible(email: str) -> None:
     proves identity through the session rather than by mail."""
     with SessionLocal() as db:
         user = find_user_by_email(db, email)
-        if user is None or user.is_demo:
+        if user is None:
             return
         if user.password_hash or user.password_revoked_at:
             raw = _issue_token(db, user, "reset", RESET_TTL)
@@ -1200,37 +1149,49 @@ def bump_session_epoch(user: User) -> None:
     user.session_epoch = (user.session_epoch or 0) + 1
 
 
-def revoke_preset_password_if_unverified(user: User) -> None:
+def revoke_untrusted_preset_password(user: User) -> None:
     """SEC-10 (account pre-emption): a password set on an account whose email was NEVER verified is
     untrusted — whoever registered the address (to pre-empt the real owner) could have chosen it. When
     the real owner attests ownership through Google, drop that password and bump the epoch to revoke any
-    session it minted; the owner re-sets one via password-reset. No-op for an already-verified account,
-    so a legit no-SMTP registration is unaffected.
+    session it minted; the owner re-sets one via password-reset, or from Settings while the Google
+    session lasts.
 
-    The Google-adoption callback is the ONLY caller (E9.5 S1). Admin approval used to call this too, and
-    dropping it was right for the reason S1 gave — the revoke destroyed the password a legitimate
+    A NEVER-ACTIVATED account is untrusted too, verified or not: without SMTP, registration marks the
+    address verified with no proof at all. For an ADMIN_EMAILS / ALLOWED_EMAILS address no invite row
+    gates the registration, so a stranger who registered it first would otherwise be activated here
+    with their own password still working. (An account the callback makes ADMIN loses its password
+    whatever its state — see the ADMIN_EMAILS block there.)
+
+    The Google-adoption callback is the ONLY caller. Admin approval used to call this too, and
+    dropping it was right for the reason given — the revoke destroyed the password a legitimate
     registrant had just chosen, and since the admin normally decides before the user reads their mail,
     that made the "your password was cleared" detour the DEFAULT path rather than an edge case.
 
-    S1 also claimed the revoke was REDUNDANT there, because `password_login` refuses an unverified
+    The revoke was also called REDUNDANT there, because `password_login` refuses an unverified
     account before it reads `is_active`. That part was wrong, and the epic's own review caught it: the
-    gate holds only while the address is unverified, and S6's approval mail exists to get the real
+    gate holds only while the address is unverified, and the approval mail exists to get the real
     owner to end that state — at which point a pre-emptor's password works. Nothing replaced the
     revoke, and that is deliberate. The review tried "the newest registration owns an unverified
     account" and reverted it: the rule is symmetric, so an attacker can simply register last, and it
     would have handed anonymous callers a write onto a real account's credential. What the owner
     actually has is password-reset, which proves the mailbox, rewrites the hash and bumps the epoch.
     The residual is logged as SEC-16; re-adding a caller here would put "your password was cleared"
-    back in front of every legitimate registrant, which is the whole reason S1 removed it.
+    back in front of every legitimate registrant, which is the whole reason it was removed.
 
     `password_revoked_at` is what makes "the owner re-sets one via password-reset" actually true. The
     revoke leaves `password_hash IS NULL`, which is also what a Google-only account looks like — and
     _send_reset_if_eligible keyed off exactly that, so a revoked account silently got no reset link and
     was locked out for good (it could not sign in either). The stamp separates the two cases."""
-    if not user.email_verified:
-        user.password_hash = None
-        user.password_revoked_at = datetime.now(timezone.utc)
-        bump_session_epoch(user)
+    if not user.email_verified or (not user.is_active and user.password_hash is not None):
+        _revoke_password(user)
+
+
+def _revoke_password(user: User) -> None:
+    """Drop the account's password, stamp why (so password-reset still accepts it) and end every
+    session it signed in."""
+    user.password_hash = None
+    user.password_revoked_at = datetime.now(timezone.utc)
+    bump_session_epoch(user)
 
 
 @router.post("/logout-others")
@@ -1239,9 +1200,7 @@ def logout_others(
 ) -> dict:
     """SA4: sign every OTHER session for this account out — bump the epoch so all existing cookies
     are rejected, then re-stamp THIS cookie so the caller stays signed in. For "I left myself logged
-    in somewhere" / a suspected session compromise. The demo account (shared) is excluded."""
-    if user.is_demo:
-        raise HTTPException(status_code=403, detail={"code": "demo"})
+    in somewhere" / a suspected session compromise."""
     # Commit the bump BEFORE re-stamping this cookie, so a failed commit can't strand the current
     # session at a newer epoch than the DB (see set_password).
     bump_session_epoch(user)
@@ -1260,8 +1219,6 @@ async def link_google(
     """Start linking a Google account to the signed-in (e.g. password) account. Requests only
     the identity scopes — YouTube access is granted separately via /auth/upgrade. The callback
     sees `oauth_link_uid` and attaches the identity instead of creating a new account."""
-    if user.is_demo:
-        return RedirectResponse(url="/")
     client = google_oauth(db)
     if client is None:
         return RedirectResponse(url="/?link=error")
@@ -1287,8 +1244,6 @@ def set_password(
     """Set or change the signed-in account's password. Setting a first password (Google-only
     account) needs no current password — the session already proves identity. Changing an
     existing one requires the current password, so a hijacked session can't silently rotate it."""
-    if user.is_demo:
-        raise HTTPException(status_code=403, detail={"code": "demo"})
     new_password = body.password or ""
     if len(new_password) < PASSWORD_MIN_LEN:
         raise refused(400, "weak_password", min=PASSWORD_MIN_LEN)
@@ -1319,10 +1274,6 @@ async def upgrade(
     (unsubscribe). The shared callback stores whatever Google returns, so `can_read` /
     `can_write` flip on once granted. Anything other than an explicit `write` defaults to
     the least-privileged read scope."""
-    # This is the browser-facing redirect entry point, so the shared demo account is bounced
-    # straight home (no YouTube link is ever attached to it) rather than shown a raw 403.
-    if user.is_demo:
-        return RedirectResponse(url="/")
     client = google_oauth(db)
     if client is None:
         return RedirectResponse(url="/")
diff --git a/backend/app/routes/channels.py b/backend/app/routes/channels.py
index 31147bf5..e30ffcaa 100644
--- a/backend/app/routes/channels.py
+++ b/backend/app/routes/channels.py
@@ -12,7 +12,7 @@ from sqlalchemy.orm import Session
 from app.collation import collated, sorted_words
 from app.mailtext import lang_for_user
 from app import logs, quota
-from app.auth import admin_user, current_user, require_human, require_write_scope
+from app.auth import admin_user, current_user, require_write_scope
 from app.db import get_db
 from app.models import (
     LIVE_OR_UPCOMING,
@@ -67,8 +67,8 @@ def list_channels(user: User = Depends(current_user), db: Session = Depends(get_
 
     # Per-channel aggregates over the shared catalog (channel_aggregates), computed on read rather than
     # denormalised: an Index Only Scan over a ~20 MB index, where it used to read every video's heap page
-    # (681 MB on prod, a 2–6 s first open once something else had pushed it out of memory, E31 S4d).
-    # (The Normal/Shorts/Live breakdown moved to the channel-detail page in R14, so it is no longer
+    # (681 MB on prod, a 2–6 s first open once something else had pushed it out of memory).
+    # (The Normal/Shorts/Live breakdown moved to the channel-detail page, so it is no longer
     # computed here — the manager table dropped its N/S/L column.)
     channel_ids = [c.id for _, c in rows]
     agg: dict[str, dict] = {}
@@ -163,8 +163,8 @@ def discover_channels(
     can judge a channel BEFORE subscribing — but we do NOT pull its videos. Most-present
     channels come first; subscribing is a separate action."""
     # Resolve & cache the user's own channel id so it can be excluded — you don't subscribe
-    # to yourself. Lazy + cached; needs OAuth, so demo / token-less users just skip it.
-    if user.yt_channel_id is None and user.token is not None and not user.is_demo:
+    # to yourself. Lazy + cached; needs OAuth, so token-less users just skip it.
+    if user.yt_channel_id is None and user.token is not None:
         try:
             with (
                 quota.attribute(user.id, quota.QuotaAction.CHANNELS_DISCOVER),
@@ -192,8 +192,7 @@ def discover_channels(
     # (fresh subscriber counts/thumbnails carry through without a re-query). Only the title can
     # change, which affects the tie-break order → re-sort in Python instead of re-hitting the DB.
     need = [ch.id for ch, _, _ in rows if ch.details_synced_at is None][:DISCOVERY_ENRICH_CAP]
-    # Skip the quota-spending enrich for the demo account (it just sees the stub metadata).
-    if need and not user.is_demo:
+    if need:
         try:
             with (
                 quota.attribute(user.id, quota.QuotaAction.CHANNELS_DISCOVER),
@@ -277,7 +276,7 @@ def _channel_detail_dict(
         "explored": explored,
         "blocked": blocked,
         "stored_videos": stored,
-        # Per-type breakdown (Normal / Shorts / Live) — R14 moved it off the manager table onto the
+        # Per-type breakdown (Normal / Shorts / Live) — moved off the manager table onto the
         # channel page. Same aggregation the manager list uses (count_normal = stored − shorts − live).
         "count_normal": count_normal,
         "count_short": count_short,
@@ -311,12 +310,12 @@ def channel_detail(
     Lazily fills the About metadata (view count, join date, banner, links) the first time it's
     needed (a stub) and refreshes it once it is stale (`DETAILS_MAX_AGE`), which is how a channel nobody subscribes to (an explored one, outside the
     subscription import) gets a banner that still resolves. The enrich uses the API key (1 unit,
-    cached after), so it's skipped for the quota-less demo account."""
+    cached after)."""
     channel = get_or_404(db, Channel, channel_id, what="channel")
     # No `published_at is None` sentinel: a terminated channel never gets one, so it re-fetched on
     # every view; rows enriched before that field existed are long past DETAILS_MAX_AGE anyway.
     stale = details_stale(channel, datetime.now(timezone.utc))
-    if stale and not user.is_demo:
+    if stale:
         try:
             with (
                 quota.attribute(user.id, quota.QuotaAction.CHANNELS_DISCOVER),
@@ -350,7 +349,7 @@ def channel_detail(
     )
     blocked = _is_blocked(db, user, channel_id)
     # Stored total + the Normal/Shorts/Live split in one grouped pass (same filters as the manager
-    # list), so the channel page can show the per-type breakdown R14 moved off the table.
+    # list), so the channel page can show the per-type breakdown that moved off the table.
     n_all, n_short, n_live = db.execute(
         select(
             func.count(Video.id),
@@ -389,7 +388,7 @@ def channel_detail(
 def explore_channel(
     channel_id: str,
     page_token: str | None = None,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Open an un-subscribed channel for browsing. Records the exploration (a per-user,
@@ -397,7 +396,7 @@ def explore_channel(
     drives the later cleanup), flags the channel ephemeral unless someone organically follows
     it, then ingests one page of its uploads (newest-first) marked via_explore + enriched.
     Returns the next page token so the page can "load more". Guarded against the shared
-    backfill quota reserve; blocked for the demo account (it spends shared quota)."""
+    backfill quota reserve."""
     channel = get_or_404(db, Channel, channel_id, what="channel")
     if _is_blocked(db, user, channel_id):
         raise refused(403, "channel_blocked")
@@ -493,10 +492,7 @@ def update_channel(
         sub.priority = body.priority
     if body.hidden is not None:
         sub.hidden = body.hidden
-    # The demo account is SHARED, so it must not persist deep_requested (a quota-relevant flag) onto
-    # the shared subscription — skip the write entirely for demo, which also keeps deep_turned_on
-    # False so the immediate backfill below can never fire for it.
-    if body.deep_requested is not None and not user.is_demo:
+    if body.deep_requested is not None:
         # Opt this channel into (or out of) full-history backfill. The deep scheduler
         # picks the flag up on its next run; turning it off won't undo already-fetched
         # videos, it just stops further deep paging if nobody else still wants it.
@@ -507,7 +503,7 @@ def update_channel(
 
     # Opting a channel into full history should give an immediate feed: if we haven't even
     # fetched its recent uploads yet, do that one channel now (cheap) instead of waiting for
-    # the scheduler. (deep_turned_on is only ever True for a non-demo user — see the guard above.)
+    # the scheduler.
     if deep_turned_on and channel is not None and channel.recent_synced_at is None:
         with quota.attribute(user.id, quota.QuotaAction.VIDEOS_BACKFILL_RECENT):
             run_recent_backfill(db, [channel], max_channels=1)
diff --git a/backend/app/routes/config.py b/backend/app/routes/config.py
index e5d82112..e4425ebb 100644
--- a/backend/app/routes/config.py
+++ b/backend/app/routes/config.py
@@ -139,7 +139,7 @@ def test_issue_tracker(
     _: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Check the configured issue tracker (E16): the repository answers with this token, takes
+    """Check the configured issue tracker: the repository answers with this token, takes
     issues, and is PRIVATE — the one it must be, since an issue carries its reporter's log."""
     try:
         return {"ok": True, **gitea.check(db)}
diff --git a/backend/app/routes/debug_sessions.py b/backend/app/routes/debug_sessions.py
index 76345ea1..3154d149 100644
--- a/backend/app/routes/debug_sessions.py
+++ b/backend/app/routes/debug_sessions.py
@@ -1,9 +1,8 @@
-"""Debug sessions (E16): Start → reproduce → Stop, the screenshots, and the evidence under review.
+"""Debug sessions: Start → reproduce → Stop, the screenshots, and the evidence under review.
 
 The session itself — what tags a request, its cap, its level — is `app/debugsession.py`. These routes
 are the user's handle on their OWN sessions only: another user's id 404s (`owned_or_404`), including
-for an admin, who reads everyone's lines in the diagnostics console instead. The shared demo account
-cannot record: its log would interleave every visitor under one account.
+for an admin, who reads everyone's lines in the diagnostics console instead.
 
 Screenshots arrive as a raw image body (`image/png`, `image/jpeg`, `image/webp`), not a multipart
 form — one image per request, capped while it arrives, and kept only if its bytes really are one of
@@ -21,7 +20,7 @@ from sqlalchemy.orm import Session
 
 from app import audit, debugsession, logs, logsink
 from app.audit import AuditAction
-from app.auth import require_human
+from app.auth import current_user
 from app.db import get_db, release_read_connection
 from app.issues import bundle, gitea
 from app.ratelimit import RateLimiter
@@ -51,7 +50,7 @@ _new_sessions = RateLimiter(max_events=20, window_seconds=3600)
 @router.post("")
 def start_session(
     body: StartIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Start recording, or join the recording already running (another tab started it)."""
@@ -79,7 +78,7 @@ def start_session(
 
 @router.post("/{sid}/stop")
 def stop_session(
-    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
+    sid: str, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     session = owned_or_404(db, DebugSession, sid, user, what="debug_session")
     if session.ended_at is None:
@@ -93,7 +92,7 @@ def stop_session(
 
 
 @router.get("")
-def list_sessions(user: User = Depends(require_human), db: Session = Depends(get_db)) -> dict:
+def list_sessions(user: User = Depends(current_user), db: Session = Depends(get_db)) -> dict:
     sessions = db.scalars(
         select(DebugSession)
         .where(DebugSession.user_id == user.id)
@@ -105,14 +104,14 @@ def list_sessions(user: User = Depends(require_human), db: Session = Depends(get
 
 @router.get("/{sid}")
 def get_session(
-    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
+    sid: str, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     return _view(db, owned_or_404(db, DebugSession, sid, user, what="debug_session"))
 
 
 @router.get("/{sid}/events")
 def session_events(
-    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
+    sid: str, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     """The rows an issue from this session would carry — browser and server, in time order."""
     session = owned_or_404(db, DebugSession, sid, user, what="debug_session")
@@ -141,7 +140,7 @@ class DraftIn(BaseModel):
 def save_draft(
     sid: str,
     body: DraftIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     session = owned_or_404(db, DebugSession, sid, user, what="debug_session")
@@ -162,7 +161,7 @@ def save_draft(
 
 @router.get("/{sid}/export")
 def export_session(
-    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
+    sid: str, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> Response:
     """The issue as a zip — the text, the two logs and the screenshots — for an instance without an
     issue tracker, or for sending it by hand. Built from the SAVED draft: what the composer shows is
@@ -182,7 +181,7 @@ def export_session(
     )
 
 
-# --- the issue tracker (S4) -----------------------------------------------------------------
+# --- the issue tracker ----------------------------------------------------------------------
 # Issues a user may open per hour — counted once the tracker is ASKED to open one (an answer that
 # goes missing may still have created it, so an attempt cannot be given back); finishing a half-sent
 # one, or an attempt refused before the tracker was asked, is not counted. The composer sends one at
@@ -208,9 +207,7 @@ def _issues_rate_limited() -> HTTPException:
 
 
 @router.post("/{sid}/issue")
-def send_issue(
-    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
-) -> dict:
+def send_issue(sid: str, user: User = Depends(current_user), db: Session = Depends(get_db)) -> dict:
     """Send the session's issue to the tracker — from the SAVED draft, as the export is built — or
     finish a send that stopped half-way (the issue exists; only what is missing is sent)."""
     session = owned_or_404(db, DebugSession, sid, user, what="debug_session")
@@ -302,7 +299,7 @@ class PreviewIn(BaseModel):
 def preview_issue(
     sid: str,
     body: PreviewIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """The body as the tracker will render it. Gitea sanitises its own output; the composer still
@@ -323,14 +320,14 @@ def _shot_view(shot: DebugScreenshot) -> dict:
 
 @router.get("/{sid}/screenshots")
 def list_screenshots(
-    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
+    sid: str, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     session = owned_or_404(db, DebugSession, sid, user, what="debug_session")
     return {"items": [_shot_view(s) for s in debugsession.screenshots(db, session)]}
 
 
 def _upload_target(
-    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
+    sid: str, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> DebugSession:
     return owned_or_404(db, DebugSession, sid, user, what="debug_session")
 
@@ -393,7 +390,7 @@ def _screenshot_of(db: Session, session: DebugSession, shot_id: int) -> DebugScr
 
 @router.get("/{sid}/screenshots/{shot_id}")
 def get_screenshot(
-    sid: str, shot_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    sid: str, shot_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> Response:
     shot = _session_screenshot(db, sid, shot_id, user)
     # `nosniff`: the type was checked against the bytes at upload, and the browser must not guess.
@@ -406,7 +403,7 @@ def get_screenshot(
 
 @router.delete("/{sid}/screenshots/{shot_id}")
 def delete_screenshot(
-    sid: str, shot_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    sid: str, shot_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     session = owned_or_404(db, DebugSession, sid, user, what="debug_session")
     shot = _screenshot_of(db, session, shot_id)
diff --git a/backend/app/routes/diagnostics.py b/backend/app/routes/diagnostics.py
index 8a7d4ddf..78c881fc 100644
--- a/backend/app/routes/diagnostics.py
+++ b/backend/app/routes/diagnostics.py
@@ -1,4 +1,4 @@
-"""The browser's log, sent while its user has a raised diagnostics level (E22 S5).
+"""The browser's log, sent while its user has a raised diagnostics level.
 
 The client keeps its log in memory (frontend `lib/log.ts`). Only after the user consented to Részletes
 or Teljes in Settings → Diagnosztika does it stream that log here, in batches, and each batch lands in
@@ -14,7 +14,7 @@ Nothing from the body is trusted as-is:
     modified client would not;
   * an event below the consented level is dropped (a Részletes consent does not store what only
     Teljes may carry), and so is the whole batch once the level has lapsed — where an open debug
-    session the request names counts as consent to ITS level (E16), and only its own events keep
+    session the request names counts as consent to ITS level, and only its own events keep
     its tag;
   * the timestamp is clamped to the consent window, so a row cannot dodge the retention job by
     claiming to come from the future.
@@ -63,7 +63,7 @@ class ClientEvent(BaseModel):
     attrs: dict[str, Any] | None = None
     request_id: str | None = Field(default=None, pattern=r"^[A-Za-z0-9._-]{8,64}$")
     tab_id: str | None = Field(default=None, pattern=r"^[A-Za-z0-9_-]{1,32}$")
-    # The debug session the event was captured in (E16); kept only when it is the one this request
+    # The debug session the event was captured in; kept only when it is the one this request
     # names in `X-Debug-Session` and the auth dependency found it the caller's own and open.
     debug_session_id: str | None = Field(default=None, pattern=r"^[0-9a-f]{16}$")
     version: str | None = Field(default=None, max_length=64)
@@ -138,7 +138,7 @@ def ingest_events(
     body: ClientEventsIn = Depends(_parsed_events),
     db: Session = Depends(get_db),
 ) -> dict:
-    # A debug session the request names raises the level for its own events (E16): starting one is
+    # A debug session the request names raises the level for its own events: starting one is
     # the consent to that level for its duration, whatever the user's own level is.
     session = debugsession.from_header(db, user, request.headers.get(debugsession.HEADER))
     level, _ = debugsession.level_for(user, session)
diff --git a/backend/app/routes/discover.py b/backend/app/routes/discover.py
index 0d61f99e..104aea67 100644
--- a/backend/app/routes/discover.py
+++ b/backend/app/routes/discover.py
@@ -1,10 +1,10 @@
-"""E24 · the Home surface's HTTP shell.
+"""The Home surface's HTTP shell.
 
 Thin by construction: every decision — what counts as in progress, what fits a time budget, which
 tier the hero comes from — lives in `app/discover/`, so the scheduler, a future CLI or a test can ask
 the same questions without a request. This file validates, gates and serializes.
 
-The consolidated `GET /api/discover` mirrors the Plex Discover route's one-payload shape (E5 S4): a
+The consolidated `GET /api/discover` mirrors the Plex Discover route's one-payload shape: a
 landing page that fires four requests to answer one question would spend its whole budget on the
 thing it exists to remove.
 """
@@ -17,7 +17,7 @@ from sqlalchemy import select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
-from app.auth import current_user, require_human
+from app.auth import current_user
 from app.db import get_db
 from app.discover import hero as hero_mod
 from app.discover import pins, rails
@@ -72,7 +72,7 @@ def get_discover(
 # never reaches SQL — `hero.pick` uses it only as set membership over an already-bounded candidate
 # pool (the resume rail's `RAIL_LIMIT` rows, the shelf, `SURPRISE_DRAW` surprise draws) — so there is
 # no scan for a crafted URL to unbound, and the set is built in full before this slice anyway. The
-# comment that claimed otherwise was corrected in round 2; the request line's own length is what
+# comment that claimed otherwise was later corrected; the request line's own length is what
 # actually bounds a hostile `exclude`.
 MAX_EXCLUDE = 32
 
@@ -127,15 +127,14 @@ def list_pins(
 @router.post("/pins")
 def add_pin(
     body: PinIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Pin something to the comfort shelf.
 
-    `require_human`, like every other personal-state write: the shared demo account must not be able
-    to curate a communal shelf. Re-pinning something already on the shelf is a no-op that returns the
-    existing pin rather than a 409 — the gesture is "make sure this is on my shelf", and the unique
-    constraint is the mechanism, not the message."""
+    Re-pinning something already on the shelf is a no-op that returns the existing pin rather than
+    a 409 — the gesture is "make sure this is on my shelf", and the unique constraint is the
+    mechanism, not the message."""
     resolved = pins.resolve_ref(db, user, body.kind, body.ref)
     if resolved is None:
         raise not_found("item")
@@ -178,7 +177,7 @@ def add_pin(
 @router.delete("/pins/{pin_id}")
 def remove_pin(
     pin_id: int,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     pin = owned_or_404(db, ComfortPin, pin_id, user, what="pin")
@@ -190,7 +189,7 @@ def remove_pin(
 @router.post("/pins/reorder")
 def reorder_pins(
     body: ReorderIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Rewrite the shelf order from the list of pin ids the client shows.
diff --git a/backend/app/routes/downloads.py b/backend/app/routes/downloads.py
index d9a11554..cb9e3e23 100644
--- a/backend/app/routes/downloads.py
+++ b/backend/app/routes/downloads.py
@@ -1,9 +1,8 @@
 """Download center HTTP API — the per-user surface over the worker/cache/quota layers.
 
-All routes are behind `require_human` (the shared demo account can't spend server disk / needs a
-real identity). Admin routes add `admin_user`. Live job state is polled by the frontend (the
-worker is a separate process); this module never downloads — it enqueues, manages job state,
-serves finished files (range-aware, with the user's custom display name), and shares them.
+All routes are behind `current_user`; admin routes add `admin_user`. Live job state is polled by the
+frontend (the worker is a separate process); this module never downloads — it enqueues, manages job
+state, serves finished files (range-aware, with the user's custom display name), and shares them.
 """
 
 import os
@@ -24,7 +23,7 @@ from sqlalchemy.orm import Session
 from app.mailtext import lang_for_user
 from app.collation import collated
 from app import audit, sysconfig
-from app.auth import admin_user, require_human
+from app.auth import admin_user, current_user
 from app.config import settings
 from app.db import get_db, release_read_connection
 from app.downloads import credentials as dlcreds
@@ -212,7 +211,7 @@ def _serialize_profile(p: DownloadProfile) -> dict:
 
 
 @router.get("/profiles")
-def list_profiles(user: User = Depends(require_human), db: Session = Depends(get_db)) -> list[dict]:
+def list_profiles(user: User = Depends(current_user), db: Session = Depends(get_db)) -> list[dict]:
     rows = (
         db.execute(
             select(DownloadProfile)
@@ -234,7 +233,7 @@ class CreateProfileIn(BaseModel):
 
 @router.post("/profiles")
 def create_profile(
-    body: CreateProfileIn, user: User = Depends(require_human), db: Session = Depends(get_db)
+    body: CreateProfileIn, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     name = body.name.strip()
     spec = body.spec
@@ -262,7 +261,7 @@ class UpdateProfileIn(BaseModel):
 def update_profile(
     profile_id: int,
     body: UpdateProfileIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     p = db.get(DownloadProfile, profile_id)
@@ -284,7 +283,7 @@ def update_profile(
 
 @router.delete("/profiles/{profile_id}")
 def delete_profile(
-    profile_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    profile_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     p = db.get(DownloadProfile, profile_id)
     if p is None or p.is_builtin or p.user_id != user.id:
@@ -300,7 +299,7 @@ def delete_profile(
 
 
 @router.get("/credentials")
-def list_credentials(user: User = Depends(require_human), db: Session = Depends(get_db)) -> dict:
+def list_credentials(user: User = Depends(current_user), db: Session = Depends(get_db)) -> dict:
     return {"hosts": dlcreds.status_list(db, user.id)}
 
 
@@ -312,7 +311,7 @@ class SetCredentialIn(BaseModel):
 def set_credential(
     host_key: str,
     body: SetCredentialIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Store (encrypted) this user's cookies.txt for one supported host. Write-only: the value is
@@ -337,7 +336,7 @@ def set_credential(
 
 @router.delete("/credentials/{host_key}")
 def delete_credential(
-    host_key: str, user: User = Depends(require_human), db: Session = Depends(get_db)
+    host_key: str, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     if not dlcreds.is_supported_host(host_key):
         raise not_found("host")
@@ -388,7 +387,7 @@ class EnqueueDownloadIn(BaseModel):
 
 @router.post("")
 def enqueue_download(
-    body: EnqueueDownloadIn, user: User = Depends(require_human), db: Session = Depends(get_db)
+    body: EnqueueDownloadIn, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     source_kind, source_ref = resolve_source(body.source)
     # SEC-12: a non-YouTube source is a raw URL the worker will fetch server-side, so refuse the
@@ -413,8 +412,8 @@ def enqueue_download(
 
 # The upload's filename and display name travel as HEADERS, not as multipart parts. That is not a
 # style choice: a DECLARED body parameter (`file: UploadFile = File(...)`) is read and spooled by
-# FastAPI *before the first dependency runs*, so `require_human` could not gate it and an anonymous
-# caller could make the process write the whole per-file allowance to temp, per request (P1; SEC-20
+# FastAPI *before the first dependency runs*, so the auth dependency could not gate it and an anonymous
+# caller could make the process write the whole per-file allowance to temp, per request (SEC-20
 # bounded the number but could not stop the writing). Reading the body ourselves, from a dependency
 # declared AFTER the auth one, is the only shape that closes it — the same one
 # `POST /api/debug-sessions/{sid}/screenshots` uses, and `test_body_limit.py` now enforces it for
@@ -454,13 +453,13 @@ def _header_text(request: Request, name: str) -> str:
 
 async def spool_upload(
     request: Request,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> AsyncIterator[SpooledUpload]:
     """Stream the request body to a staging temp file, enforcing the per-file cap as it arrives.
 
     `user` is taken but unused: it is the whole point. Dependencies resolve in declaration order, so
-    naming `require_human` here makes the auth check a precondition of reading the body at all — a
+    naming `current_user` here makes the auth check a precondition of reading the body at all — a
     stranger is refused before a byte moves. The `yield` shape owns the temp file's life: ingest
     MOVES it into place on success (the unlink is then a no-op), and on any other exit — cap hit,
     empty, quota, probe or move error, a client that vanished mid-upload — it is removed."""
@@ -499,7 +498,7 @@ def upload_download(
     upload: SpooledUpload = Depends(spool_upload),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Ingest a local file into the caller's library (E7 S5). Any file type is accepted; media
+    """Ingest a local file into the caller's library. Any file type is accepted; media
     (video/audio) gets the full function set, a generic file is download-only. The body IS the file
     (see the header note above); `spool_upload` has already authenticated the caller and streamed it
     to a temp path under the download volume, so what is left here is the non-yt-dlp ingest which
@@ -532,7 +531,7 @@ class EnqueueEditIn(BaseModel):
 
 @router.post("/edit")
 def enqueue_edit(
-    body: EnqueueEditIn, user: User = Depends(require_human), db: Session = Depends(get_db)
+    body: EnqueueEditIn, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     """Queue a phase-2 editor derivative (trim/crop) of a download this user can access.
 
@@ -560,9 +559,7 @@ def _quota_detail(e: quota.QuotaExceeded) -> dict:
 
 
 @router.get("")
-def list_downloads(
-    user: User = Depends(require_human), db: Session = Depends(get_db)
-) -> list[dict]:
+def list_downloads(user: User = Depends(current_user), db: Session = Depends(get_db)) -> list[dict]:
     jobs = (
         db.execute(
             select(DownloadJob)
@@ -578,7 +575,7 @@ def list_downloads(
 
 
 @router.get("/usage")
-def my_usage(user: User = Depends(require_human), db: Session = Depends(get_db)) -> dict:
+def my_usage(user: User = Depends(current_user), db: Session = Depends(get_db)) -> dict:
     """The caller's download quota, plus the per-file upload cap.
 
     The cap rides here rather than in `quota.usage` because it is not a quota value — it is a
@@ -600,7 +597,7 @@ _INDEX_RANK = {"done": 4, "running": 3, "paused": 2, "queued": 1}
 
 
 @router.get("/index")
-def my_download_index(user: User = Depends(require_human), db: Session = Depends(get_db)) -> dict:
+def my_download_index(user: User = Depends(current_user), db: Session = Depends(get_db)) -> dict:
     """source_ref -> best active status, for the feed's per-card "downloaded / queued" badge.
     Small + cheap so the feed can poll it without loading the full job list."""
     rows = db.execute(
@@ -617,9 +614,7 @@ def my_download_index(user: User = Depends(require_human), db: Session = Depends
 
 
 @router.get("/shared")
-def shared_with_me(
-    user: User = Depends(require_human), db: Session = Depends(get_db)
-) -> list[dict]:
+def shared_with_me(user: User = Depends(current_user), db: Session = Depends(get_db)) -> list[dict]:
     jobs = (
         db.execute(
             select(DownloadJob)
@@ -679,7 +674,7 @@ class UpdateDownloadMetaIn(BaseModel):
 def update_download_meta(
     job_id: int,
     body: UpdateDownloadMetaIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Update a download's display metadata: title, channel name + link, and extra reference URLs.
@@ -702,7 +697,7 @@ def update_download_meta(
 
 @router.post("/{job_id}/pause")
 def pause_download(
-    job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    job_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     job = _own_job_for_update(db, user, job_id)
     service.pause(db, job)
@@ -711,7 +706,7 @@ def pause_download(
 
 @router.post("/{job_id}/resume")
 def resume_download(
-    job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    job_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     job = _own_job_for_update(db, user, job_id)
     service.resume(db, job)
@@ -720,7 +715,7 @@ def resume_download(
 
 @router.post("/{job_id}/redownload")
 def redownload_download(
-    job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    job_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     """Force a fresh re-download of a finished (or failed) job, rebuilding the file + Plex tree.
 
@@ -747,7 +742,7 @@ def redownload_download(
 
 @router.post("/{job_id}/cancel")
 def cancel_download(
-    job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    job_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     job = _own_job_for_update(db, user, job_id)
     service.cancel(db, job)
@@ -756,7 +751,7 @@ def cancel_download(
 
 @router.delete("/{job_id}")
 def delete_download(
-    job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    job_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     job = _own_job_for_update(db, user, job_id)
     service.delete(db, job)
@@ -786,7 +781,7 @@ def _accessible_job(db: Session, user: User, job_id: int) -> DownloadJob:
 def download_file(
     job_id: int,
     request: Request,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ):
     job = _accessible_job(db, user, job_id)
@@ -825,7 +820,7 @@ def download_file(
 
 @router.get("/{job_id}/storyboard")
 def storyboard_meta(
-    job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    job_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     """Filmstrip geometry for the editor's scrub track, generating the sprite on first use.
 
@@ -850,7 +845,7 @@ def storyboard_meta(
 
 
 @router.get("/{job_id}/poster.jpg")
-def poster_image(job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)):
+def poster_image(job_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)):
     """The locally-generated poster frame for a download whose source had no thumbnail."""
     job = _accessible_job(db, user, job_id)
     asset = db.get(MediaAsset, job.asset_id) if job.asset_id else None
@@ -864,7 +859,7 @@ def poster_image(job_id: int, user: User = Depends(require_human), db: Session =
 
 @router.get("/{job_id}/storyboard.jpg")
 def storyboard_image(
-    job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    job_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ):
     job = _accessible_job(db, user, job_id)
     asset = db.get(MediaAsset, job.asset_id) if job.asset_id else None
@@ -887,7 +882,7 @@ class ShareDownloadIn(BaseModel):
 def share_download(
     job_id: int,
     body: ShareDownloadIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     job = owned_or_404(db, DownloadJob, job_id, user, what="download")
@@ -899,7 +894,7 @@ def share_download(
     recipient = db.execute(
         select(User).where(func.lower(User.email) == target)
     ).scalar_one_or_none()
-    # Uniform "no user" for a missing OR non-messageable (demo/suspended/deactivated) target, so
+    # Uniform "no user" for a missing OR non-messageable (suspended/deactivated) target, so
     # sharing can't be used to probe which addresses exist or to reach a suspended account.
     if not is_messageable_user(recipient):
         raise not_found("recipient")
@@ -919,7 +914,7 @@ def share_download(
             user_id=recipient.id,
             type="download_shared",
             title=(job.display_name or "A download") + " was shared with you",
-            # The client names the notice in the reader's language from `data` (E30); the title is the
+            # The client names the notice in the reader's language from `data`; the title is the
             # English fallback only.
             data={
                 "kind": "download_shared",
@@ -937,7 +932,7 @@ def share_download(
 def unshare_download(
     job_id: int,
     email: str,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     owned_or_404(
@@ -961,7 +956,7 @@ def unshare_download(
 
 @router.delete("/shared/{job_id}")
 def remove_shared_with_me(
-    job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    job_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     """Remove a download that was shared WITH this user from their 'Shared with me' list. Deletes
     only the recipient's share grant — the owner's job and the physical file are untouched (this is
@@ -982,10 +977,10 @@ def remove_shared_with_me(
 
 @router.get("/recipients")
 def share_recipients(
-    user: User = Depends(require_human), db: Session = Depends(get_db)
+    user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> list[dict]:
     """Registered users this user can share a download with (excludes self + any non-messageable
-    account — demo, suspended, or deactivated — so the picker never leaks those addresses)."""
+    account — suspended or deactivated — so the picker never leaks those addresses)."""
     rows = (
         db.execute(
             select(User)
@@ -1021,7 +1016,7 @@ def _link_expiry(days: int | None) -> datetime | None:
 
 @router.get("/{job_id}/links")
 def list_links(
-    job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    job_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> list[dict]:
     owned_or_404(db, DownloadJob, job_id, user, what="download")
     rows = (
@@ -1038,7 +1033,7 @@ def list_links(
 
 class CreateLinkIn(BaseModel):
     password: str = ""
-    # D1 (E7 S3): a newly shared download is downloadable by default — the common intent is "let the
+    # D1: a newly shared download is downloadable by default — the common intent is "let the
     # recipient have the file", not stream-only. Forward-only: this only sets the default for links
     # minted from now on; existing links keep whatever `allow_download` they were created with (the
     # column default stays False, so no back-catalogue link silently flips). The owner can still
@@ -1051,7 +1046,7 @@ class CreateLinkIn(BaseModel):
 def create_link(
     job_id: int,
     body: CreateLinkIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     job = owned_or_404(db, DownloadJob, job_id, user, what="download")
@@ -1082,7 +1077,7 @@ class UpdateLinkIn(BaseModel):
 def update_link(
     link_id: int,
     body: UpdateLinkIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     link = _own_link(db, user, link_id)
@@ -1103,7 +1098,7 @@ def update_link(
 
 @router.delete("/links/{link_id}")
 def revoke_link(
-    link_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
+    link_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     link = _own_link(db, user, link_id)
     db.delete(link)
diff --git a/backend/app/routes/feed.py b/backend/app/routes/feed.py
index 46c62601..031e2870 100644
--- a/backend/app/routes/feed.py
+++ b/backend/app/routes/feed.py
@@ -235,7 +235,7 @@ def get_feed_years(
     user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Per-year video counts for the year control (item 8 / E8·S2): the quick recent-year chips and the
+    """Per-year video counts for the year control: the quick recent-year chips and the
     "more…" per-year-counts dialog. Every filter EXCEPT the publish-date narrowing applies, so picking a
     year re-queries the feed but not this list. Response: {"years": [{"year": <int>, "count": <int>}]},
     newest year first."""
@@ -419,11 +419,7 @@ def get_video_detail(
             "duration_seconds": v.duration_seconds,
         }
 
-    # The DB path above is free; the off-catalog YouTube lookup below spends a quota unit, so the
-    # demo account can't reach it — it just sees "unknown" for a video we don't already store.
-    if user.is_demo:
-        raise not_found("video")
-
+    # The DB path above is free; the off-catalog YouTube lookup below spends a quota unit.
     try:
         with (
             quota.attribute(user.id, quota.QuotaAction.VIDEOS_LOOKUP),
diff --git a/backend/app/routes/me.py b/backend/app/routes/me.py
index 52cd8f3f..e6b79e35 100644
--- a/backend/app/routes/me.py
+++ b/backend/app/routes/me.py
@@ -1,6 +1,6 @@
 from typing import Any
 
-from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Request
+from fastapi import APIRouter, BackgroundTasks, Depends, Request
 from pydantic import BaseModel, RootModel
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
@@ -40,7 +40,7 @@ def my_accounts(
     """The accounts that have authenticated in this browser session (switchable without a
     new Google sign-in). The active one is flagged."""
     ids = request.session.get("account_ids") or [user.id]
-    rows = {u.id: u for u in db.query(User).filter(User.id.in_(ids)).all()}
+    rows = {u.id: u for u in db.execute(select(User).where(User.id.in_(ids))).scalars()}
     out = []
     for uid in ids:  # preserve recency order from the session
         u = rows.get(uid)
@@ -131,7 +131,6 @@ def get_me(
         "display_name": user.display_name,
         "avatar_url": user.avatar_url,
         "role": user.role,
-        "is_demo": user.is_demo,
         "has_google": user.google_sub is not None,
         # The address Google answers with, when it DIFFERS from the account's own. Same string for
         # most people, and then this is None so no surface has to decide whether to show it — the
@@ -141,7 +140,7 @@ def get_me(
         ),
         "has_password": user.password_hash is not None,
         # The account's latest sign-in on any device — shown in Settings → Account, so a sign-in the
-        # user does not recognise is something they can see (null: none since 0.88, or the demo).
+        # user does not recognise is something they can see (null: none since 0.88).
         "last_login_at": iso(user.last_login_at),
         # Instance-wide: whether Google sign-in / YouTube connect is available at all (the UI hides
         # YouTube-access affordances and the onboarding nudge when it isn't configured).
@@ -159,12 +158,12 @@ def get_me(
         "pending_activations": pending_activations,
         "email_configured": email_configured,
         "preferences": user.preferences or {},
-        # The consented diagnostics level in force and when it lapses (E22 S5). The client applies
+        # The consented diagnostics level in force and when it lapses. The client applies
         # it to its own log and streams that log while it is raised.
         "diagnostics": diagnostics.state(db, user),
-        # The live debug session, if one is recording (E16) — a reload resumes it.
+        # The live debug session, if one is recording — a reload resumes it.
         "debug_session": _live_session(db, user),
-        # Where a bug report goes (E16 S4): the tracker's repository, or None — download only.
+        # Where a bug report goes: the tracker's repository, or None — download only.
         "issues": gitea.target(db),
     }
 
@@ -184,15 +183,8 @@ def delete_my_account(
     """GDPR self-service erasure: permanently delete the signed-in account and ALL its personal
     data — OAuth tokens, subscriptions, tags, watch/save/hide states, playlists, notifications —
     which all cascade on the users row. Quota-audit events are kept but anonymised (FK SET NULL).
-    The shared demo account can't be deleted, and the last remaining admin can't delete itself
-    (that would lock everyone out of the admin surfaces)."""
-    # Structured, like the other three demo refusals: `req` leaves 403 to the caller and
-    # `notifyActionError` discards a plain-string detail in favour of the caller's translated
-    # fallback, so a hand-written English sentence here reaches a Hungarian UI as a generic
-    # "couldn't do that" — or, on this affordance, as nothing at all. `reason` distinguishes it
-    # from the other sites' bare `{code: "demo"}` so the UI can say what specifically is refused.
-    if user.is_demo:
-        raise HTTPException(status_code=403, detail={"code": "demo", "reason": "delete_account"})
+    The last remaining admin can't delete itself (that would lock everyone out of the admin
+    surfaces)."""
     if user.role == "admin" and count_admins(db) <= 1:
         raise refused(400, "only_admin_delete")
     user_id = user.id
@@ -242,10 +234,7 @@ def update_diagnostics(
 ) -> dict:
     """Raise the diagnostics level (the user consented in Settings → Diagnosztika) or return to the
     base. The expiry is the server's: a raised level always lapses after
-    `diagnostics.ELEVATION_HOURS`, whatever the client asks. The shared demo account cannot raise
-    it — its log would interleave every visitor's session under one account."""
-    if user.is_demo and body.level != diagnostics.BASE:
-        raise HTTPException(status_code=403, detail={"code": "demo", "reason": "diagnostics"})
+    `diagnostics.ELEVATION_HOURS`, whatever the client asks."""
     diagnostics.set_level(user, body.level)
     db.commit()
     # The rest of THIS request, and the process's elevation registry, follow the new level now.
diff --git a/backend/app/routes/messages.py b/backend/app/routes/messages.py
deleted file mode 100644
index 28270603..00000000
--- a/backend/app/routes/messages.py
+++ /dev/null
@@ -1,479 +0,0 @@
-"""Direct messaging (notification module, phase 2): end-to-end encrypted user-to-user chat
-plus server-authored system messages, with live WebSocket delivery.
-
-E2EE model: every private message is encrypted IN THE BROWSER under a key both parties derive
-from ECDH(their private key, the other's public key). The server only ever stores ciphertext +
-iv and acts as a key directory (public keys) and an opaque blob store (each user's private key,
-wrapped client-side with a passphrase the server never sees). So not even an admin can read a
-user-to-user conversation. `kind="system"` messages (the welcome; future announcements) are
-plain server boilerplate — non-private, readable without any key setup, shown as a "Siftlode"
-conversation.
-
-Every endpoint is gated by `require_human` (the shared demo account can't message). Metadata
-(who messaged whom, when, read state) is NOT encrypted — standard for E2EE and needed for
-routing and unread counts.
-"""
-
-from datetime import datetime, timezone
-
-from fastapi import APIRouter, Depends, WebSocket, WebSocketDisconnect
-from pydantic import BaseModel
-from sqlalchemy import and_, case, delete, func, or_, select
-from sqlalchemy.orm import Session
-
-from app.mailtext import lang_for_user
-from app.collation import collated
-from app.auth import require_human, resolved_user_id
-from app.db import SessionLocal, get_db
-from app.models import Message, MessageKey, User
-from app.ratelimit import RateLimiter
-from app.realtime import manager
-from app.security import verify_password
-from app.userscope import is_messageable_user, messageable_clauses
-from app.utils import iso
-from app.refusal import refused
-from app.routes._common import not_found
-
-router = APIRouter(prefix="/api/messages", tags=["messages"])
-
-MAX_CIPHERTEXT = 8000  # base64 of a generous plaintext + AES-GCM overhead
-SYSTEM_PARTNER_ID = 0  # synthetic conversation partner for system messages
-SYSTEM_NAME = "Siftlode"
-_send_limiter = RateLimiter(max_events=30, window_seconds=60)
-_reset_key_limiter = RateLimiter(max_events=5, window_seconds=300)
-
-# The welcome is rendered server-side at creation time, so it carries its own translations
-# (one per supported UI language). Kept short and non-private (every new user gets the same text).
-WELCOME = {
-    "en": (
-        "Welcome to Siftlode! 👋\n\n"
-        "This is your private message inbox. Conversations with other members are end-to-end "
-        "encrypted — only you and the person you're chatting with can read them, not even an "
-        "admin. To start messaging someone, set up secure messaging with a passphrase first.\n\n"
-        "Enjoy your Feed!"
-    ),
-    "hu": (
-        "Üdv a Siftlode-on! 👋\n\n"
-        "Ez a privát üzenet-postafiókod. A többi taggal folytatott beszélgetések végpontig "
-        "titkosítottak — csak te és a beszélgetőpartnered olvashatja őket, még az admin sem. "
-        "Ha üzenni szeretnél valakinek, előbb állítsd be a biztonságos üzenetküldést egy "
-        "jelszóval.\n\n"
-        "Jó böngészést!"
-    ),
-}
-
-
-class KeySetupIn(BaseModel):
-    public_key: str
-    wrapped_private_key: str
-    salt: str
-    wrap_iv: str
-    key_check: str
-
-
-class KeyResetIn(BaseModel):
-    # Present only for password accounts; a Google-only account has no password to re-verify.
-    current_password: str | None = None
-
-
-class SendIn(BaseModel):
-    recipient_id: int
-    ciphertext: str
-    iv: str
-
-
-def _user_label(u: User) -> str:
-    return u.display_name or u.email.split("@")[0]
-
-
-def _serialize_user(u: User) -> dict:
-    return {"id": u.id, "name": _user_label(u), "avatar_url": u.avatar_url}
-
-
-def _system_partner() -> dict:
-    return {"id": SYSTEM_PARTNER_ID, "name": SYSTEM_NAME, "avatar_url": None}
-
-
-# The welcome's opening line in every language — how a stored copy is recognised. It was rendered
-# once, in the language of the day it was created, so an account that later switched language kept
-# reading it in the old one (E31 S1: the owner's, in English). Recognised here, it is served in the
-# reader's language instead. Derived from WELCOME itself, so a change to an OPENING line, or a
-# language taken out of WELCOME, orphans the copies already stored: they are served as stored. The
-# one retired language (German, 2026-07) left none on prod (checked 2026-10-02).
-_WELCOME_OPENINGS = {text.partition("\n")[0] for text in WELCOME.values()}
-
-
-def _system_body(body: str | None, lang: str | None) -> str | None:
-    """A system message's text for a reader of `lang`: the welcome in their language, any other as
-    stored."""
-    if body is None or lang is None or body.partition("\n")[0] not in _WELCOME_OPENINGS:
-        return body
-    return WELCOME.get(lang, WELCOME["en"])
-
-
-def _serialize_msg(m: Message, lang: str | None = None) -> dict:
-    """`lang`: the reader's language, for a system message's text (a user message is ciphertext)."""
-    return {
-        "id": m.id,
-        "kind": m.kind,
-        "sender_id": m.sender_id,
-        "recipient_id": m.recipient_id,
-        "body": _system_body(m.body, lang) if m.kind == "system" else m.body,
-        "ciphertext": m.ciphertext,
-        "iv": m.iv,
-        "read_at": iso(m.read_at),
-        "created_at": iso(m.created_at),
-    }
-
-
-def ensure_welcome(db: Session, user: User) -> None:
-    """Create the one-time system welcome message for a (human) user the first time it's needed.
-    Idempotent: guarded on whether any system message already exists for them."""
-    if user.is_demo:
-        return
-    exists = db.scalar(
-        select(Message.id).where(Message.recipient_id == user.id, Message.kind == "system").limit(1)
-    )
-    if exists:
-        return
-    lang = (user.preferences or {}).get("language")
-    body = WELCOME.get(lang, WELCOME["en"])
-    m = Message(kind="system", sender_id=None, recipient_id=user.id, body=body)
-    db.add(m)
-    db.commit()
-    db.refresh(m)
-    manager.push(user.id, {"type": "message", "message": _serialize_msg(m, lang_for_user(user))})
-
-
-# --- E2EE key directory / blob store -----------------------------------------
-
-
-@router.get("/keys/me")
-def my_key(user: User = Depends(require_human), db: Session = Depends(get_db)) -> dict:
-    """My own key bundle. `configured` says whether secure messaging is set up; if so the
-    wrapped blob + params are returned so this device can unlock with the passphrase."""
-    k = db.get(MessageKey, user.id)
-    if k is None:
-        return {"configured": False}
-    return {
-        "configured": True,
-        "public_key": k.public_key,
-        "wrapped_private_key": k.wrapped_private_key,
-        "salt": k.salt,
-        "wrap_iv": k.wrap_iv,
-        "key_check": k.key_check,
-    }
-
-
-@router.post("/keys")
-def setup_keys(
-    payload: KeySetupIn,
-    user: User = Depends(require_human),
-    db: Session = Depends(get_db),
-) -> dict:
-    """Store this user's public key + passphrase-wrapped private key. Set-once: changing the
-    key would orphan every existing conversation key, so re-setup is rejected here."""
-    if db.get(MessageKey, user.id) is not None:
-        raise refused(409, "messaging_set_up")
-    db.add(
-        MessageKey(
-            user_id=user.id,
-            public_key=payload.public_key,
-            wrapped_private_key=payload.wrapped_private_key,
-            salt=payload.salt,
-            wrap_iv=payload.wrap_iv,
-            key_check=payload.key_check,
-        )
-    )
-    db.commit()
-    return {"ok": True, "configured": True}
-
-
-@router.post("/keys/reset")
-def reset_keys(
-    payload: KeyResetIn,
-    user: User = Depends(require_human),
-    db: Session = Depends(get_db),
-) -> dict:
-    """Forgotten-passphrase escape hatch: drop this user's secure-messaging key so they can set a
-    NEW passphrase (the set-once guard in setup_keys otherwise makes a lost passphrase a permanent
-    wall). Destroys the user's entire E2EE history BY DESIGN — every conversation key is derived
-    from this keypair, so replacing it orphans every stored ciphertext in both directions. Those
-    now-undecryptable `user` messages are deleted here (a clean slate for both parties) rather than
-    left as permanent "can't decrypt" clutter; `system` messages (plaintext) are untouched.
-
-    An account WITH a password must re-authenticate: a hijacked session must not be able to silently
-    reset messaging and then read the victim's future messages under a new passphrase. A password-
-    less (Google-only) account has nothing to re-verify, so it relies on its live session plus the
-    client-side danger confirmation."""
-    if not _reset_key_limiter.allow(str(user.id)):
-        raise refused(429, "too_many_attempts")
-    if user.password_hash and not verify_password(
-        payload.current_password or "", user.password_hash
-    ):
-        raise refused(403, "wrong_password")
-    # Delete the now-dead ciphertext first (both directions), then the wrapped keypair itself so a
-    # fresh setup is allowed. Order doesn't matter (no FK between them), but do it in one commit.
-    db.execute(
-        delete(Message).where(
-            Message.kind == "user",
-            or_(Message.sender_id == user.id, Message.recipient_id == user.id),
-        )
-    )
-    key = db.get(MessageKey, user.id)
-    if key is not None:
-        db.delete(key)
-    db.commit()
-    return {"ok": True, "configured": False}
-
-
-@router.get("/keys/{user_id}")
-def public_key(
-    user_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
-) -> dict:
-    """A member's public key, for deriving the pairwise conversation key. MB2 (like get_thread):
-    resolve the target only if they're messageable OR we already share a thread, else the same
-    "User not found" as a non-existent id — so this can't be probed to enumerate user_ids or to
-    fetch keys for suspended/deactivated/demo accounts."""
-    cond = and_(
-        Message.kind == "user",
-        or_(
-            and_(Message.sender_id == user.id, Message.recipient_id == user_id),
-            and_(Message.sender_id == user_id, Message.recipient_id == user.id),
-        ),
-    )
-    p = db.get(User, user_id)
-    has_history = db.scalar(select(Message.id).where(cond).limit(1))
-    if p is None or (not is_messageable_user(p) and not has_history):
-        raise not_found("user")
-    k = db.get(MessageKey, user_id)
-    if k is None:
-        raise refused(404, "no_messaging")
-    return {"user_id": user_id, "public_key": k.public_key}
-
-
-# --- directory + conversations -----------------------------------------------
-
-
-@router.get("/users")
-def list_recipients(
-    user: User = Depends(require_human), db: Session = Depends(get_db)
-) -> list[dict]:
-    """Member directory for the recipient picker: messageable members (except me) who have set
-    up secure messaging (so a conversation key can be derived)."""
-    rows = (
-        db.execute(
-            select(User)
-            .join(MessageKey, MessageKey.user_id == User.id)
-            .where(User.id != user.id, *messageable_clauses())
-            .order_by(collated(func.coalesce(User.display_name, User.email), lang_for_user(user)))
-        )
-        .scalars()
-        .all()
-    )
-    return [_serialize_user(u) for u in rows]
-
-
-@router.get("/conversations")
-def list_conversations(user: User = Depends(require_human), db: Session = Depends(get_db)) -> dict:
-    """One entry per conversation: each user partner (E2EE) plus the system "Siftlode" thread,
-    with the latest message + my unread count, newest first. Lazily creates the welcome on the
-    first open. User-message previews are ciphertext — the client decrypts them."""
-    ensure_welcome(db, user)
-    # The conversation partner for a message, from this user's perspective (system → 0).
-    partner_expr = case(
-        (Message.kind == "system", SYSTEM_PARTNER_ID),
-        (Message.sender_id == user.id, Message.recipient_id),
-        else_=Message.sender_id,
-    )
-    mine = or_(Message.sender_id == user.id, Message.recipient_id == user.id)
-    # Latest message per conversation in ONE query (DISTINCT ON, Postgres) instead of loading the
-    # user's whole message history into Python — bounded by the number of conversations.
-    latest = (
-        db.execute(
-            select(Message)
-            .where(mine)
-            .distinct(partner_expr)
-            .order_by(partner_expr, Message.created_at.desc())
-        )
-        .scalars()
-        .all()
-    )
-    # Unread incoming, grouped per conversation.
-    unread = dict(
-        db.execute(
-            select(partner_expr, func.count())
-            .where(mine, Message.recipient_id == user.id, Message.read_at.is_(None))
-            .group_by(partner_expr)
-        ).all()
-    )
-
-    def _pid(m: Message) -> int:
-        if m.kind == "system":
-            return SYSTEM_PARTNER_ID
-        return m.recipient_id if m.sender_id == user.id else m.sender_id
-
-    user_ids = [_pid(m) for m in latest if m.kind != "system"]
-    partners = {}
-    if user_ids:
-        partners = {
-            u.id: u for u in db.execute(select(User).where(User.id.in_(user_ids))).scalars().all()
-        }
-    items = []
-    for m in latest:
-        pid = _pid(m)
-        if pid == SYSTEM_PARTNER_ID:
-            partner = _system_partner()
-        elif pid in partners:
-            partner = _serialize_user(partners[pid])
-        else:
-            continue
-        items.append(
-            {
-                "partner": partner,
-                "last_message": _serialize_msg(m, lang_for_user(user)),
-                "unread": int(unread.get(pid, 0)),
-            }
-        )
-    items.sort(key=lambda x: x["last_message"]["created_at"] or "", reverse=True)
-    return {"items": items}
-
-
-@router.get("/conversations/{partner_id}")
-def get_thread(
-    partner_id: int,
-    mark_read: bool = True,
-    user: User = Depends(require_human),
-    db: Session = Depends(get_db),
-) -> dict:
-    """Full thread with a partner (or the system thread when partner_id == 0), oldest first.
-    Stamps unread incoming messages read unless mark_read=false."""
-    if partner_id == SYSTEM_PARTNER_ID:
-        ensure_welcome(db, user)
-        partner = _system_partner()
-        cond = and_(Message.recipient_id == user.id, Message.kind == "system")
-    else:
-        p = db.get(User, partner_id)
-        cond = and_(
-            Message.kind == "user",
-            or_(
-                and_(Message.sender_id == user.id, Message.recipient_id == partner_id),
-                and_(Message.sender_id == partner_id, Message.recipient_id == user.id),
-            ),
-        )
-        # MB2: don't leak arbitrary user identities. Resolve a partner only if they're messageable
-        # OR we already share a thread (so a conversation with a since-suspended/deactivated user
-        # still opens). Otherwise the same 404 as a non-existent id → no enumeration oracle.
-        has_history = db.scalar(select(Message.id).where(cond).limit(1))
-        if p is None or (not is_messageable_user(p) and not has_history):
-            raise not_found("user")
-        partner = _serialize_user(p)
-    msgs = (
-        db.execute(select(Message).where(cond).order_by(Message.created_at.asc())).scalars().all()
-    )
-    if mark_read:
-        now = datetime.now(timezone.utc)
-        changed = False
-        for m in msgs:
-            if m.recipient_id == user.id and m.read_at is None:
-                m.read_at = now
-                changed = True
-        if changed:
-            db.commit()
-            # MB3: ping this user's OTHER tabs/devices that their unread dropped so the badge
-            # refreshes live instead of waiting for the next 20s poll. The client re-fetches the
-            # count on this signal, so no number is carried here.
-            manager.push(user.id, {"type": "unread"})
-    return {"partner": partner, "items": [_serialize_msg(m, lang_for_user(user)) for m in msgs]}
-
-
-@router.post("")
-def send_message(
-    payload: SendIn,
-    user: User = Depends(require_human),
-    db: Session = Depends(get_db),
-) -> dict:
-    """Send an end-to-end-encrypted message. The server stores only the ciphertext the client
-    produced, then pushes it live to the recipient (and the sender's other devices)."""
-    if not _send_limiter.allow(f"msg:{user.id}"):
-        raise refused(429, "message_rate")
-    ct = (payload.ciphertext or "").strip()
-    iv = (payload.iv or "").strip()
-    if not ct or not iv:
-        raise refused(400, "message_empty")
-    if len(ct) > MAX_CIPHERTEXT:
-        raise refused(400, "message_too_long")
-    if payload.recipient_id == user.id:
-        raise refused(400, "message_self")
-    recipient = db.get(User, payload.recipient_id)
-    if not is_messageable_user(recipient):
-        raise not_found("recipient")
-    if db.get(MessageKey, recipient.id) is None:
-        raise refused(404, "no_messaging")
-    m = Message(kind="user", sender_id=user.id, recipient_id=recipient.id, ciphertext=ct, iv=iv)
-    db.add(m)
-    db.commit()
-    db.refresh(m)
-    # Carry both parties so each recipient can open/flash the right dock window (the partner is
-    # whichever of from/to isn't them).
-    event = {
-        "type": "message",
-        "message": _serialize_msg(m),
-        "from": _serialize_user(user),
-        "to": _serialize_user(recipient),
-    }
-    manager.push(recipient.id, event)
-    manager.push(user.id, event)  # the sender's other open devices
-    return _serialize_msg(m)
-
-
-@router.get("/unread_count")
-def unread_count(user: User = Depends(require_human), db: Session = Depends(get_db)) -> dict:
-    n = db.scalar(
-        select(func.count())
-        .select_from(Message)
-        .where(Message.recipient_id == user.id, Message.read_at.is_(None))
-    )
-    return {"count": n or 0}
-
-
-# --- live delivery -----------------------------------------------------------
-
-
-@router.websocket("/ws")
-async def messages_ws(ws: WebSocket) -> None:
-    """Live push channel: authenticated by the session cookie, registers the connection so
-    sent messages reach this user's open tabs instantly. We don't consume client→server frames
-    (sending goes through POST /api/messages); the receive loop only detects disconnect."""
-    # Which signed-in account this socket acts as — the SHARED per-tab resolution (a wallet-gated
-    # ?account=, the session default when none is named, nobody for an account no longer signed in
-    # here). A browser WebSocket can't send the X-Siftlode-Account header, so resolved_user_id falls
-    # through to the ?account= query param.
-    uid, _ = resolved_user_id(ws)
-    if not uid:
-        await ws.close(code=1008)
-        return
-    db = SessionLocal()
-    try:
-        user = db.get(User, uid)
-        # SA4: honour server-side session revocation on the live channel too — reject a cookie whose
-        # recorded epoch is behind the account's current one (mirrors current_user). Without this a
-        # copied cookie could keep receiving pushes after a password reset / "log out everywhere".
-        epochs = ws.session.get("epochs") or {}
-        epoch_ok = user is not None and int(epochs.get(str(uid), 0)) == (user.session_epoch or 0)
-        ok = epoch_ok and is_messageable_user(user)
-    finally:
-        db.close()
-    if not ok:
-        await ws.close(code=1008)
-        return
-    await manager.connect(uid, ws)
-    try:
-        while True:
-            await ws.receive_text()
-    # silent-ok: the ordinary way a chat socket ends — a closed tab. The `finally` below is the
-    # whole handling, and nothing failed.
-    except WebSocketDisconnect:
-        pass
-    finally:
-        await manager.disconnect(uid, ws)
diff --git a/backend/app/routes/notifications.py b/backend/app/routes/notifications.py
index 33fb61d4..52d3a24e 100644
--- a/backend/app/routes/notifications.py
+++ b/backend/app/routes/notifications.py
@@ -1,9 +1,5 @@
 """Per-user notification inbox (phase 1): the durable, server-backed center that coexists
-with the client-side transient bell. Read-only listing plus read/dismiss/clear mutations.
-
-All endpoints use `current_user` (not `require_human`): notifications and their read/dismiss
-state are personal UI state with no quota or YouTube involvement, so the shared demo account
-manages its own inbox normally."""
+with the client-side transient bell. Read-only listing plus read/dismiss/clear mutations."""
 
 from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select, update
diff --git a/backend/app/routes/plex/__init__.py b/backend/app/routes/plex/__init__.py
index ce713a10..d930cfaa 100644
--- a/backend/app/routes/plex/__init__.py
+++ b/backend/app/routes/plex/__init__.py
@@ -1,10 +1,10 @@
 """Plex route package — assembles the admin/browse/playback sub-routers.
 
-Read endpoints (libraries/browse/show/image) are available to ANY authenticated user (demo +
-pure-Siftlode included) — this is an access layer to the Plex library WITHOUT requiring a plex.tv
+Read endpoints (libraries/browse/show/image) are available to ANY authenticated user
+(pure-Siftlode included) — this is an access layer to the Plex library WITHOUT requiring a plex.tv
 account, and playback is a local file. Admin endpoints test the connection and run the catalog sync.
 
-Split out of the former single routes/plex.py (R12 S1). `router` keeps the same shape the app
+Split out of the former single routes/plex.py. `router` keeps the same shape the app
 wiring expects (`plex_routes.router`), so main.py is unchanged.
 """
 
diff --git a/backend/app/routes/plex/browse.py b/backend/app/routes/plex/browse.py
index 16acda1b..2277a1a2 100644
--- a/backend/app/routes/plex/browse.py
+++ b/backend/app/routes/plex/browse.py
@@ -285,7 +285,7 @@ def unified_library(
     episodes = []
     if tsq is not None and want_shows and field in ("all", "episode"):
         ep_st = aliased(PlexState)
-        # In HU an episode is found by its Hungarian title too (E30: the overlay now fills it) — and
+        # In HU an episode is found by its Hungarian title too (the overlay fills it) — and
         # still by its English one, like `vector_match` does for the grid.
         if field == "episode":
             ep_vec = func.to_tsvector(TS_CONFIG, func.coalesce(PlexItem.title, ""))
@@ -360,8 +360,8 @@ def facets(
 
     # The shows that pass the watch-state scope, asked ONCE. The per-user episode rollup behind it is a
     # full pass over the user's episodes (~10 ms on a prod-sized library), and each of the show groups
-    # (genres, ratings, studios, years, rating max) asked it again: half of a filtered facets call
-    # (E31 S4e). The same filter on the same rows, so the counts do not change
+    # (genres, ratings, studios, years, rating max) asked it again: half of a filtered facets call.
+    # The same filter on the same rows, so the counts do not change
     # (test_plex_facets_grid_parity).
     shows_in_scope: list[int] | None = None
     if show_ids and show in ("watched", "in_progress", "unwatched"):
@@ -545,7 +545,7 @@ def facets(
     for c in split_csv(f.playable):
         if c in PLAYBACK_CLASSES:
             playable_counts.setdefault(c, 0)
-    # Names in the reader's alphabet: the genres are Hungarian words for a Hungarian reader (E30 S1).
+    # Names in the reader's alphabet: the genres are Hungarian words for a Hungarian reader.
     alpha = {w: i for i, w in enumerate(sorted_words(db, [*genre_counts, *studio_counts], lang))}
     return {
         "genres": [
diff --git a/backend/app/routes/plex/detail.py b/backend/app/routes/plex/detail.py
index fe2a9aee..94318d1d 100644
--- a/backend/app/routes/plex/detail.py
+++ b/backend/app/routes/plex/detail.py
@@ -153,7 +153,7 @@ def show_detail(
         all_cards.append(card)
     show_roll = rollup.rollup(all_cards)
 
-    # Cast + IMDb + tagline are served from the DB row (persisted by the cast backfill, E5 S5b). The one
+    # Cast + IMDb + tagline are served from the DB row (persisted by the cast backfill). The one
     # remaining live call is `related` — a Plex recommendation hub we don't mirror — which also carries
     # the metadata used to lazily fill a not-yet-enriched show. Any live failure just drops `related` and
     # the lazy fill; the row-served detail below still renders (outage-resilient).
@@ -213,7 +213,7 @@ def show_detail(
             "first": show_roll["first"],
             "episode_count": show_roll["episode_count"],
             "collection_keys": sh.collection_keys or [],
-            # TMDB enrichment (E5 S2), served from the row.
+            # TMDB enrichment, served from the row.
             "tmdb": plex_tmdb.serve_block(db, sh, lang=lang),
         },
         "seasons": [_season_block(se, by_season.get(se.id, [])) for se in seasons],
@@ -353,7 +353,7 @@ _TRACK_TAIL = re.compile(r"\(([^()]+)\)\s*$")
 
 
 def _track_naming(s: dict) -> dict:
-    """What the player names a track from (E30). Plex's `displayTitle` is in the SERVER's language
+    """What the player names a track from. Plex's `displayTitle` is in the SERVER's language
     ("English (AC3 5.1)", "magyar Forced", "中文 (EAC3 Stereo)"), so it is sent only as the fallback
     `label`; the client builds the name in the reader's language from the language tag, the
     forced / SDH flags and the codec tail. No title and no language → no label (the client numbers it)."""
@@ -538,6 +538,6 @@ def item_detail(
         "prev_id": prev_id,
         "next_id": next_id,
         "collections": _collection_strips(db, it, user.id, lang),
-        # TMDB enrichment (E5 S2), served from the row — movies only (episodes aren't enriched).
+        # TMDB enrichment, served from the row — movies only (episodes aren't enriched).
         "tmdb": plex_tmdb.serve_block(db, it, lang=lang) if it.kind == "movie" else None,
     }
diff --git a/backend/app/routes/plex/discover.py b/backend/app/routes/plex/discover.py
index 84c79c96..1201c01c 100644
--- a/backend/app/routes/plex/discover.py
+++ b/backend/app/routes/plex/discover.py
@@ -1,11 +1,11 @@
-"""Plex Discover: the rail-surface read-model (E5 S4).
+"""Plex Discover: the rail-surface read-model.
 
 A consolidated payload for the dedicated Discover landing — a stack of horizontal rails:
 Continue watching · Recently added · Browse-by-genre tiles · Because you watched X — plus a
 separate, reshuffling Surprise-me sample. Serve-from-DB only: the recommendation rail reads the
-recs the S2 TMDB engine already persisted (`PlexItem.recommendations`), never a live TMDB call, and
+recs the TMDB engine already persisted (`PlexItem.recommendations`), never a live TMDB call, and
 every card comes from the same `movie_card`/`show_card` serializers the grid uses (so rails inherit
-S1's `art` + S3's rating/summary for free). The rails carry EN metadata (like the other non-grid
+their `art` + rating/summary for free). The rails carry EN metadata (like the other non-grid
 card paths); the HU overlay coalesces only in the main grid.
 
 The sidebar metadata filters (genre / rating / year / collection / …) narrow EVERY rail too, so the
@@ -114,8 +114,8 @@ def _recently_added(
         else []
     )
     # Merge the two type-homogeneous lists by added_at, then serialize each side in one batch so the
-    # per-card state lookups stay batched (no N+1). Same `or NO_TS` key as the two rails below — the
-    # E24 review found this one still on the older `(is not None, value)` form, i.e. one rule in two
+    # per-card state lookups stay batched (no N+1). Same `or NO_TS` key as the two rails below — a
+    # review found this one still on the older `(is not None, value)` form, i.e. one rule in two
     # spellings, with the two comments explaining it differently.
     tagged = [(m.added_at, "movie", m) for m in movies] + [(s.added_at, "show", s) for s in shows]
     tagged.sort(key=lambda t: t[0] or rollup.NO_TS, reverse=True)
diff --git a/backend/app/routes/plex/people.py b/backend/app/routes/plex/people.py
index 2b4440b2..0902511b 100644
--- a/backend/app/routes/plex/people.py
+++ b/backend/app/routes/plex/people.py
@@ -176,10 +176,10 @@ def person_detail(
     people who share a name share a page. Each section is capped at _PERSON_SECTION_MAX. An unknown name
     simply returns empty sections.
 
-    E5 S6: the first time a page is opened, the person's TMDB bio + "Known for" credits are lazily
-    fetched (from the S2-linked `tmdb_person_id`) and persisted, then served from the row on every open.
+    The first time a page is opened, the person's TMDB bio + "Known for" credits are lazily
+    fetched (from the linked `tmdb_person_id`) and persisted, then served from the row on every open.
     The fetch runs OFF the request path (a background task); the first open serves whatever's in the row
-    with `enriching` set, and the page asks again until the bio lands. E30 S6: the people_enrich job
+    with `enriching` set, and the page asks again until the bio lands. The people_enrich job
     fetches everyone ahead of time, so this lazy path is only for a person the job hasn't reached yet.
     """
     lang = norm_lang(lang)
@@ -187,7 +187,7 @@ def person_detail(
     # Lazy one-time bio enrich, scheduled AFTER the response so the TMDB call is never on the serve path.
     # Gated by a per-person cooldown so concurrent/rapid opens (or repeated opens while TMDB is degraded)
     # can't pile background tasks onto the shared threadpool.
-    # `enriching` tells the page the bio is on its way (E30 S6): it asks again shortly instead of showing
+    # `enriching` tells the page the bio is on its way: it asks again shortly instead of showing
     # an empty page until the next open. True while a fetch is pending, including one an earlier open
     # already reserved.
     enriching = (
diff --git a/backend/app/routes/plex/playback.py b/backend/app/routes/plex/playback.py
index f819f043..92fafd99 100644
--- a/backend/app/routes/plex/playback.py
+++ b/backend/app/routes/plex/playback.py
@@ -169,7 +169,7 @@ _PROGRESS_MIN_S = 5
 
 _FINISH_MARGIN_S = 30
 
-# S2 write-back throttle: the resume position is now pushed to Plex on the periodic (non-final)
+# Write-back throttle: the resume position is now pushed to Plex on the periodic (non-final)
 # checkpoint too — not only on the final pause/unmount flush — so Plex (the source of truth) stays
 # current in near-real-time. To keep a single watch from spraying `/:/timeline` calls, a push is
 # rate-limited to at most one per item per user every _PUSH_THROTTLE_S seconds; a `final` checkpoint
@@ -360,7 +360,7 @@ def item_progress(
 ) -> dict:
     """Checkpoint the resume position while playing (near the end → mark watched + clear it).
 
-    S2 write-back: the resume position is mirrored to Plex (the source of truth) on the periodic
+    Write-back: the resume position is mirrored to Plex (the source of truth) on the periodic
     checkpoint too, not only on the final flush — throttled to ≥_PUSH_THROTTLE_S per item (see
     `_should_push_resume`). `final` (sent on pause / seek / pagehide / unmount) pushes immediately and
     resets the throttle window, so Plex sees a settled position the instant the user pauses or seeks."""
@@ -696,7 +696,7 @@ def stream_hls_file(
     (viewer, rating_key) and a seek-restart replaces the viewer's registered one, while the DIRECTORY
     is per (key, viewer, offset, tag) — so resolving by the key alone handed the old player the new
     session's `seg_12.ts`, produced from a different offset under `-copyts`: wrong
-    bytes with a 200, which the player has no way to notice (deep-review round 5). A request for a
+    bytes with a 200, which the player has no way to notice. A request for a
     session that is no longer the registered one is a 404, and the player reclaims at the playhead.
 
     That reclaim is also why a request with no live session is no longer auto-started here: the
@@ -728,7 +728,7 @@ def stream_hls_file(
     # `proc` so a session whose ffmpeg has already exited answers at once instead of polling out the
     # whole timeout: this is a SYNC route on the ~40-slot threadpool, holding a pooled DB connection
     # with it, so every such wait is a worker (and a connection) parked for 20 s — an ordinary seek
-    # past the produced region was enough to do it (round 5).
+    # past the produced region was enough to do it.
     if not plex_stream.wait_for(path, timeout, proc=s.proc):
         raise refused(404, "not_ready")
     try:
diff --git a/backend/app/routes/plex/playlists.py b/backend/app/routes/plex/playlists.py
index 7d9d4a27..ad2356b2 100644
--- a/backend/app/routes/plex/playlists.py
+++ b/backend/app/routes/plex/playlists.py
@@ -296,7 +296,7 @@ def _items_by_rks(db: Session, rks: list) -> list[PlexItem]:
 
 
 class PlexItemAddBulkIn(PlexItemKeysIn):
-    # Where each key goes back (E28 S3e2, the list page's "Undo" of a removal): an index over the
+    # Where each key goes back (the list page's "Undo" of a removal): an index over the
     # ORDERED rows, one per key. The two-call shape (append, then send the whole order) leaves the rows
     # at the end whenever the second call fails, and the order it sends would overwrite anything
     # another tab changed in between.
diff --git a/backend/app/routes/public.py b/backend/app/routes/public.py
index fa2a2107..90bd0a4d 100644
--- a/backend/app/routes/public.py
+++ b/backend/app/routes/public.py
@@ -1,6 +1,6 @@
 """Public, login-free surface for shared download links (the `/watch/{token}` player page).
 
-These routes are deliberately OUTSIDE the auth/`require_human` gate — the unguessable token IS the
+These routes are deliberately OUTSIDE the auth gate — the unguessable token IS the
 credential (a capability URL). They only ever expose one file's stream + minimal metadata, never
 the app or any account data. Password-protected links exchange the password once at `/unlock` for
 a short-lived signed grant that the media URL carries (a `<video src>` can't send a header).
diff --git a/backend/app/routes/saved_views.py b/backend/app/routes/saved_views.py
index c4691d73..cdc9d23f 100644
--- a/backend/app/routes/saved_views.py
+++ b/backend/app/routes/saved_views.py
@@ -4,15 +4,14 @@ from sqlalchemy import func, select, update
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
-from app.auth import require_human
+from app.auth import current_user
 from app.db import get_db
 from app.models import SavedView, User
 from app.routes._common import owned_or_404
 from app.refusal import refused
 
 # Saved "smart views": per-user named snapshots of a module's filters (feed or plex, keyed by
-# `source`). Gated behind require_human so the shared demo account can't pollute a communal list
-# (mirrors how other personal-state writes are scoped).
+# `source`).
 router = APIRouter(prefix="/api/saved-views", tags=["saved-views"])
 
 # The modules that own saved views. A view is scoped to exactly one; the default is "feed" so a caller
@@ -37,7 +36,7 @@ def _serialize(v: SavedView) -> dict:
 @router.get("")
 def list_views(
     source: str = "feed",
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> list[dict]:
     source = _norm_source(source)
@@ -55,7 +54,7 @@ def list_views(
 
 # A feed view's tag pick is read by more than the feed: the autotag job keeps every tag a view names
 # (sync/autotag.py). Held here to the shape the feed sends — a list of tag ids, at most this many — so
-# a hand-made body (`"tags": 5`, or 60k ids) can't break that job for every user (E32 review).
+# a hand-made body (`"tags": 5`, or 60k ids) can't break that job for every user.
 _MAX_VIEW_TAGS = 500
 
 
@@ -81,7 +80,7 @@ class CreateViewIn(BaseModel):
 @router.post("")
 def create_view(
     body: CreateViewIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     name = body.name.strip()
@@ -124,7 +123,7 @@ class UpdateViewIn(BaseModel):
 def update_view(
     view_id: int,
     body: UpdateViewIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     view = owned_or_404(db, SavedView, view_id, user, what="view")
@@ -163,7 +162,7 @@ def update_view(
 @router.delete("/{view_id}")
 def delete_view(
     view_id: int,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     view = owned_or_404(db, SavedView, view_id, user, what="view")
@@ -179,7 +178,7 @@ class ReorderViewsIn(BaseModel):
 @router.post("/reorder")
 def reorder_views(
     body: ReorderViewsIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     ids = body.ids
diff --git a/backend/app/routes/search.py b/backend/app/routes/search.py
index 50d284f0..0073384b 100644
--- a/backend/app/routes/search.py
+++ b/backend/app/routes/search.py
@@ -5,8 +5,8 @@ with the normal feed cards + in-app player and gain per-user state (watch / save
 source is admin-selectable (``search_source``): **scrape** (InnerTube, the website's own
 endpoint, zero API quota — the default) or **api** (search.list, **100 quota units per page**).
 Either way it's gated behind a per-user daily cap, the API source additionally behind a budget
-pre-check, and only real users (never the shared demo account) may call it. The result ids are
-enriched through the cheap shared videos.list path (1 unit / 50) regardless of source.
+pre-check. The result ids are enriched through the cheap shared videos.list path (1 unit / 50)
+regardless of source.
 
 Ingested results are flagged (videos.via_search / channels.from_search) so the Library can hide
 this search-discovered "noise" by default. Shorts and currently-live/upcoming videos are never
@@ -23,7 +23,7 @@ from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.orm import Session, aliased
 
 from app import logs, quota, sysconfig
-from app.auth import require_human
+from app.auth import current_user
 from app.db import get_db
 from app.models import (
     LIVE_OR_UPCOMING,
@@ -251,7 +251,7 @@ def search_youtube(
     q: str | None = None,
     cursor: str | None = None,
     limit: int = 20,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Live YouTube search results materialised into the catalog. `limit` is how many results to
@@ -402,7 +402,7 @@ class ClearSearchIn(BaseModel):
 @router.post("/clear")
 def clear_search(
     body: ClearSearchIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Discard the given live-search results "as if never added": drop this user's search-finds
diff --git a/backend/app/routes/setup.py b/backend/app/routes/setup.py
index 6ce2c20b..cddbfcec 100644
--- a/backend/app/routes/setup.py
+++ b/backend/app/routes/setup.py
@@ -71,10 +71,10 @@ def setup_admin(body: SetupAdminIn, db: Session = Depends(require_setup)) -> dic
         raise refused(400, "invalid_email")
     if len(password) < PASSWORD_MIN_LEN:
         raise refused(400, "weak_password", min=PASSWORD_MIN_LEN)
-    # Resolve canonically, not by the literal string (DX-17). The wizard can be re-run, and E9.5's
-    # whole point is that two spellings of one Gmail mailbox are one person — matching literally here
-    # would let a second run under the other spelling create the DUPLICATE admin row the epic exists
-    # to prevent. Every other lookup went canonical in S3; this one was outside that diff.
+    # Resolve canonically, not by the literal string (DX-17). The wizard can be re-run, and the
+    # whole point of canonical email is that two spellings of one Gmail mailbox are one person —
+    # matching literally here would let a second run under the other spelling create the DUPLICATE
+    # admin row it exists to prevent. Every other lookup was canonical already; this one was missed.
     user = db.execute(
         select(User).where(User.email_canonical == canonical_email(email))
     ).scalar_one_or_none()
diff --git a/backend/app/routes/sync.py b/backend/app/routes/sync.py
index e413c484..f4a04f95 100644
--- a/backend/app/routes/sync.py
+++ b/backend/app/routes/sync.py
@@ -4,7 +4,7 @@ from sqlalchemy.orm import Session
 
 from app import audit, quota, state
 from app.audit import AuditAction
-from app.auth import admin_user, current_user, has_read_scope, require_human
+from app.auth import admin_user, current_user, has_read_scope
 from app.db import get_db
 from app.models import Channel, Subscription, User, Video
 from app.routes._common import youtube_refusal
@@ -26,7 +26,7 @@ _sync_limiter = RateLimiter(max_events=3, window_seconds=600)
 
 
 @router.post("/subscriptions")
-def sync_subscriptions(user: User = Depends(require_human), db: Session = Depends(get_db)) -> dict:
+def sync_subscriptions(user: User = Depends(current_user), db: Session = Depends(get_db)) -> dict:
     if not has_read_scope(user):
         # No YouTube read grant yet — the onboarding wizard hasn't been completed.
         raise refused(403, "youtube_read_scope")
@@ -37,7 +37,7 @@ def sync_subscriptions(user: User = Depends(require_human), db: Session = Depend
             result = import_subscriptions(db, user)
     except YouTubeError as exc:
         # The onboarding wizard's first call: an unguarded failure here was a raw 500 and the
-        # blocking "Server error" dialog, with nothing the user could act on (E9 F1).
+        # blocking "Server error" dialog, with nothing the user could act on.
         db.rollback()
         raise youtube_refusal(exc) from exc
     result["quota_used_estimate"] = m.used
@@ -138,7 +138,7 @@ def my_status(user: User = Depends(current_user), db: Session = Depends(get_db))
 
 @router.post("/deep-all")
 def deep_all(
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
     on: bool = True,
 ) -> dict:
diff --git a/backend/app/scheduler.py b/backend/app/scheduler.py
index e49f5aa6..8b4e9b15 100644
--- a/backend/app/scheduler.py
+++ b/backend/app/scheduler.py
@@ -13,9 +13,8 @@ from app import audit, debugsession, logs, logsink, progress, quota
 from app.audit import AuditAction
 from app.config import settings
 from app.db import SessionLocal
-from app.demo import reset_demo_state
 from app.downloads.gc import run_download_gc
-from app.models import SchedulerSetting, User
+from app.models import SchedulerSetting
 from app.plex.sync import sync as run_plex_sync
 from app.plex.tmdb import run_enrich as run_tmdb_enrich
 from app.plex.tmdb import run_people_enrich
@@ -63,7 +62,6 @@ JOB_INTERVALS: dict[str, int] = {
     "subscriptions": settings.subscriptions_resync_minutes,
     "playlist_sync": settings.playlist_sync_minutes,
     "maintenance": settings.maintenance_interval_minutes,
-    "demo_reset": settings.demo_reset_minutes,
     "explore_cleanup": settings.explore_cleanup_minutes,
     "download_gc": settings.download_gc_minutes,
     "plex_sync": settings.plex_sync_interval_min,
@@ -108,10 +106,6 @@ def apply_interval(db, job_id: str, minutes: int) -> int:
     return minutes
 
 
-def _now_iso() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
 def _record(name: str, **fields) -> None:
     with _activity_lock:
         _activity.setdefault(name, {}).update(fields)
@@ -139,8 +133,7 @@ def _notify_done(
 def _run_changed(result) -> bool:
     """Did an automatic job run actually do something worth an audit row? (No-op polls don't.)
     A "change" = a truthy NUMERIC count; status-string dicts like {"skipped": "disabled"} (Plex
-    off — the default) or {"skipped": "no demo account"} are no-ops, not changes, so they don't
-    flood the trail every interval."""
+    off — the default) are no-ops, not changes, so they don't flood the trail every interval."""
     if result is None:
         return False
     if isinstance(result, dict):
@@ -161,7 +154,7 @@ def _audit_run(db, actor_id, job_id, status, summary, result) -> None:
     they changed something, so routine no-op polls don't spam the trail. Best-effort."""
     if actor_id is None and status == "ok" and not _run_changed(result):
         return
-    # The result as data too (E30): the audit log names it in the reader's language, as the inbox
+    # The result as data too: the audit log names it in the reader's language, as the inbox
     # does; `summary` stays the English line of the row's own summary column.
     data = _result_data(result)
     try:
@@ -190,7 +183,7 @@ def _job(name: str, fn) -> None:
     db = SessionLocal()
     actor_id = _manual_actor.get()  # set only for a manual "run now" trigger
     _record(
-        name, last_started=_now_iso(), last_error=None, progress=None
+        name, last_started=datetime.now(timezone.utc).isoformat(), last_error=None, progress=None
     )  # running already claimed
 
     def sink(current, total, phase):
@@ -202,7 +195,7 @@ def _job(name: str, fn) -> None:
             _record(
                 name,
                 status="skipped",
-                last_finished=_now_iso(),
+                last_finished=datetime.now(timezone.utc).isoformat(),
                 last_result="paused",
                 result=_PAUSED,
                 progress=None,
@@ -219,7 +212,7 @@ def _job(name: str, fn) -> None:
         _record(
             name,
             status="ok",
-            last_finished=_now_iso(),
+            last_finished=datetime.now(timezone.utc).isoformat(),
             last_result=summary,
             result=data,
             progress=None,
@@ -239,7 +232,7 @@ def _job(name: str, fn) -> None:
         _record(
             name,
             status="error",
-            last_finished=_now_iso(),
+            last_finished=datetime.now(timezone.utc).isoformat(),
             last_error=err,
             result=failure,
             progress=None,
@@ -259,7 +252,7 @@ _PAUSED = {"skipped": "sync paused"}
 
 
 def _result_data(result) -> dict | None:
-    """A job's result as the client names it in the reader's language (E30): the dict itself (counts,
+    """A job's result as the client names it in the reader's language: the dict itself (counts,
     a `skipped` / `reason` word, a nested dict per phase), `enrich`'s bare count as one. The one-line
     `_summarize` is the English fallback."""
     if isinstance(result, dict):
@@ -370,17 +363,6 @@ def _maintenance_job() -> None:
     _job("maintenance", work)
 
 
-def _demo_reset_job() -> None:
-    # Auto-clean the shared demo sandbox. No-op (and never creates one) if there's no demo account.
-    def work(db):
-        demo = db.query(User).filter(User.is_demo.is_(True)).one_or_none()
-        if demo is None:
-            return {"skipped": "no demo account"}
-        return {"playlists_seeded": reset_demo_state(db, demo)}
-
-    _job("demo_reset", work)
-
-
 def _explore_cleanup_job() -> None:
     # Reclaim un-kept ephemeral discovery content (explored channels + live-search results) after
     # their grace periods. 0 quota (pure DB), so no quota attribution.
@@ -419,7 +401,7 @@ def _tmdb_enrich_job() -> None:
 
 
 def _people_enrich_job() -> None:
-    # Make the people local (E30 S6): a batch of person bios from TMDB and a batch of portraits resized
+    # Make the people local: a batch of person bios from TMDB and a batch of portraits resized
     # through Plex, so a person page and a cast strip never wait on an outside service.
     _job("people_enrich", run_people_enrich)
 
@@ -446,7 +428,7 @@ def _log_gc_job() -> None:
 
         days = sysconfig.get_int(db, "log_retention_days")
         reaped = logsink.gc(db, days)
-        # Debug sessions (E16) go with the rows they bundle; an open one past its cap is closed.
+        # Debug sessions go with the rows they bundle; an open one past its cap is closed.
         closed = debugsession.sweep(db)
         sessions = debugsession.gc(db, days)
         db.commit()
@@ -466,7 +448,6 @@ JOB_FUNCS: dict[str, Callable[[], None]] = {
     "subscriptions": _subscriptions_job,
     "playlist_sync": _playlist_sync_job,
     "maintenance": _maintenance_job,
-    "demo_reset": _demo_reset_job,
     "explore_cleanup": _explore_cleanup_job,
     "download_gc": _download_gc_job,
     "plex_sync": _plex_sync_job,
diff --git a/backend/app/sync/autotag.py b/backend/app/sync/autotag.py
index 7f3aa788..ce2965a9 100644
--- a/backend/app/sync/autotag.py
+++ b/backend/app/sync/autotag.py
@@ -116,7 +116,7 @@ _TOPIC_SLUGS = {
     "Fashion": "Fashion & Beauty",
     "Physical_attractiveness": "Fashion & Beauty",
     # YouTube links the British page (…/wiki/Humour); the key was "Humor", so no channel ever got Comedy
-    # from its topic (E30).
+    # from its topic.
     "Humour": "Comedy",
     "Entertainment": "Entertainment",
     "Film": "Film",
@@ -300,11 +300,11 @@ def _cleanup_orphan_system_tags(db: Session) -> int:
     """Delete system tags that no longer link to any channel (e.g. after a mapping change) — but not
     one a saved feed view filters on. Views hold tag IDS, and a deleted tag comes back under a new id
     when a channel earns it again, so the view's filter would point at nothing; the feed drops an
-    unknown id, and the view showed the whole feed under its old name (E32 S2).
+    unknown id, and the view showed the whole feed under its old name.
 
     The views are read defensively, and the kept ids are filtered here rather than in SQL: a view
     stored before its route checked the shape (or written around it) must not raise for everyone's
-    job, nor push a `NOT IN` past the driver's bind-parameter limit (E32 review)."""
+    job, nor push a `NOT IN` past the driver's bind-parameter limit."""
     in_views = {
         t
         for (filters,) in db.execute(select(SavedView.filters).where(SavedView.source == "feed"))
diff --git a/backend/app/sync/explore.py b/backend/app/sync/explore.py
index f9bcc0b6..1a4172c8 100644
--- a/backend/app/sync/explore.py
+++ b/backend/app/sync/explore.py
@@ -8,7 +8,7 @@ stay private to users who explored (or subscribe to) the channel — the feed qu
 otherwise the cleanup job hard-deletes the channel and its untouched ephemeral videos after a
 grace period (mirrors the maintenance job's grace-then-delete safety)."""
 
-from datetime import timedelta
+from datetime import datetime, timedelta, timezone
 
 from sqlalchemy import delete, or_, select
 from sqlalchemy.orm import Session
@@ -24,7 +24,6 @@ from app.models import (
     VideoState,
 )
 from app.sync.videos import insert_stubs, stub_from_playlist_item, apply_video_details
-from app.utils import now_utc as _now
 from app.youtube.client import YouTubeClient, YouTubeError, is_playlist_gone
 
 log = logs.get_logger(__name__)
@@ -59,7 +58,7 @@ def _enrich_new(db: Session, yt: YouTubeClient, video_ids: list[str]) -> int:
     if not videos:
         return 0
     items = {it["id"]: it for it in yt.get_videos([v.id for v in videos])}
-    now = _now()
+    now = datetime.now(timezone.utc)
     for video in videos:
         item = items.get(video.id)
         if item is None:
@@ -115,7 +114,7 @@ def purge_unkept_explored(db: Session) -> dict:
         or surfaced by the user's own search (SearchFind) — these survive even if the channel goes.
     A channel row is dropped only once it holds no videos at all. 0 quota."""
     grace_days = sysconfig.get_int(db, "explore_grace_days")
-    cutoff = _now() - timedelta(days=grace_days)
+    cutoff = datetime.now(timezone.utc) - timedelta(days=grace_days)
 
     expired = db.execute(
         delete(ExploredChannel).where(ExploredChannel.created_at < cutoff)
@@ -166,7 +165,7 @@ def purge_unkept_search(db: Session, grace_days: int | None = None) -> dict:
     SearchFinds. `grace_days=0` purges immediately (the admin "purge now" path); None uses config.
     0 quota."""
     grace = sysconfig.get_int(db, "search_grace_days") if grace_days is None else grace_days
-    cutoff = _now() - timedelta(days=grace)
+    cutoff = datetime.now(timezone.utc) - timedelta(days=grace)
     state_exists = select(VideoState.id).where(VideoState.video_id == Video.id).exists()
     pl_exists = select(PlaylistItem.id).where(PlaylistItem.video_id == Video.id).exists()
     sub_exists = select(Subscription.id).where(Subscription.channel_id == Video.channel_id).exists()
diff --git a/backend/app/sync/maintenance.py b/backend/app/sync/maintenance.py
index caebde45..fa1c2602 100644
--- a/backend/app/sync/maintenance.py
+++ b/backend/app/sync/maintenance.py
@@ -20,7 +20,7 @@ Quota: phase 1 costs ~(flagged / 50) units, phase 2 ~(batch / 50). Both respect
 backfill reserve as the other jobs so interactive syncs never starve.
 """
 
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, timezone
 
 from sqlalchemy import or_, select
 from sqlalchemy.orm import Session
@@ -31,7 +31,6 @@ from app.models import Playlist, PlaylistItem, Video
 from app.notifications import create_notification
 from app.sync.runner import get_service_user
 from app.sync.videos import apply_video_details, parse_dt
-from app.utils import now_utc as _now
 from app.youtube.client import YouTubeClient
 
 log = logs.get_logger(__name__)
@@ -60,7 +59,7 @@ def _is_abandoned_upcoming(item: dict) -> bool:
     scheduled = parse_dt(live.get("scheduledStartTime"))
     if scheduled is None:
         return False
-    return _now() - scheduled > timedelta(days=2)
+    return datetime.now(timezone.utc) - scheduled > timedelta(days=2)
 
 
 def _evaluate(video: Video, item: dict | None) -> str | None:
@@ -191,7 +190,7 @@ def _revalidate_rolling(db: Session, yt: YouTubeClient, now: datetime) -> dict:
                 .where(Video.unavailable_since.is_(None))
                 # Not one this run already checked: with fewer available videos than the batch, the
                 # loop used to wrap around and re-fetch the same ones until `checked` reached the
-                # batch, spending quota on answers it already had (E32 S2).
+                # batch, spending quota on answers it already had.
                 .where(or_(Video.last_checked_at.is_(None), Video.last_checked_at < now))
                 # NULLS FIRST = never-checked first, then least-recently-checked; equivalent to the old
                 # `(last_checked_at IS NULL) DESC, last_checked_at ASC` but in the exact shape of the
@@ -225,7 +224,7 @@ def run_maintenance(db: Session) -> dict:
         return {"reason": "no service user"}
     # One `now` for the whole run: each phase taking its own let a video phase 1 had just recovered
     # (stamped with phase 1's) pass phase 2's "not checked this run" test and be fetched twice.
-    now = _now()
+    now = datetime.now(timezone.utc)
     with YouTubeClient(db, user) as yt:
         phase1 = _recheck_flagged(db, yt, now)
         phase2 = (
diff --git a/backend/app/sync/playlists.py b/backend/app/sync/playlists.py
index eff61053..cac99c2d 100644
--- a/backend/app/sync/playlists.py
+++ b/backend/app/sync/playlists.py
@@ -168,7 +168,7 @@ def _load_baseline(pl: Playlist) -> tuple[list[str] | None, set[str]]:
 
 def parse_baseline(pl: Playlist) -> list[str] | None:
     """The last-synced ordered id set, or None when no baseline has been recorded yet (a fresh
-    export, or a link created before S7). None makes the first merge union losslessly."""
+    export, or an older link). None makes the first merge union losslessly."""
     return _load_baseline(pl)[0]
 
 
@@ -209,7 +209,7 @@ def _set_baseline_under_lock(
     meanwhile — lock the list and derive `dirty` from what is there, or the edit would read as
     synced and never reach YouTube. The name too: the lock re-reads a rename made meanwhile, and a
     baseline taken over THAT name matched it, so the list read clean with YouTube's title still the
-    old one (E28 review round 4)."""
+    old one."""
     _lock_or_gone(db, pl)
     _set_baseline(pl, ids, unavailable, name=name)
     recompute_dirty(db, pl)
@@ -322,7 +322,7 @@ def user_sync_claim(db: Session, user_id: int) -> AbstractContextManager[bool]:
 def _mirror_listing(yt: YouTubeClient, ytid: str, count: object, pl_id: int) -> list[str] | None:
     """A mirror's video ids from YouTube, or None when there is nothing to believe: the list was
     deleted between the pull's listing and this read (the next pull drops the mirror as vanished —
-    not a reason to fail every other list, E32 review round 2), or YouTube listed no items for a
+    not a reason to fail every other list), or YouTube listed no items for a
     list it counts as non-empty (`blank_listing`)."""
     try:
         ids = list(yt.iter_my_playlist_video_ids(ytid))
diff --git a/backend/app/sync/runner.py b/backend/app/sync/runner.py
index 19292ad1..c13c0875 100644
--- a/backend/app/sync/runner.py
+++ b/backend/app/sync/runner.py
@@ -187,7 +187,7 @@ def run_rss_poll(db: Session, channels: list[Channel] | None = None) -> dict[str
         # "fix this subscription"; `Connection refused` says "the egress is down".
         # The fallback's count rides along: a red card during an RSS outage should still say
         # whether the uploads are arriving another way.
-        # As data too (E31): the audit log and the inbox say it in the reader's language, the first
+        # As data too: the audit log and the inbox say it in the reader's language, the first
         # failure as its channel and its reason code (`http_404` vs `transport` is that difference).
         first_channel, first_reason = first_failure or ("", "error")
         raise progress.JobFailed(
diff --git a/backend/app/sync/subscriptions.py b/backend/app/sync/subscriptions.py
index b950566e..d715f677 100644
--- a/backend/app/sync/subscriptions.py
+++ b/backend/app/sync/subscriptions.py
@@ -123,7 +123,7 @@ def should_prune(fetched_count: int, existing_count: int) -> bool:
 def vanished[K, V](existing: dict[K, V], listed: Collection[K]) -> list[V]:
     """The local mirrors whose key the remote listing no longer has — none at all when the listing
     is an empty answer that contradicts them (`should_prune`). The YouTube playlist mirrors use it:
-    without it, one blip dropped every mirror (E32 S2)."""
+    without it, one blip dropped every mirror."""
     if not should_prune(len(listed), len(existing)):
         return []
     return [row for key, row in existing.items() if key not in listed]
@@ -132,7 +132,7 @@ def vanished[K, V](existing: dict[K, V], listed: Collection[K]) -> list[V]:
 def blank_listing(listed: Collection, count: object) -> bool:
     """The same rule one level down: no members from a container whose own listing counts some (a
     playlist's `itemCount`) is a blip, not a list emptied. Replacing or merging on it deleted every
-    mirrored item and reset the merge baseline (E32 review)."""
+    mirrored item and reset the merge baseline."""
     return not listed and isinstance(count, int) and count > 0
 
 
diff --git a/backend/app/sync/videos.py b/backend/app/sync/videos.py
index d725df3f..ee3355ed 100644
--- a/backend/app/sync/videos.py
+++ b/backend/app/sync/videos.py
@@ -22,10 +22,6 @@ log = logs.get_logger(__name__)
 _DURATION_RE = re.compile(r"P(?:(\d+)D)?T(?:(\d+)H)?(?:(\d+)M)?(?:(\d+)S)?", re.IGNORECASE)
 
 
-def _now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
 def parse_iso8601_duration(value: str | None) -> int | None:
     if not value:
         return None
@@ -80,7 +76,7 @@ def apply_rss_feed(db: Session, channel: Channel, entries: list[dict]) -> int:
     time. DB-only — must run on the session's own thread; the network fetch
     (fetch_channel_feed) is kept separate so callers like run_rss_poll can parallelise it."""
     inserted = insert_stubs(db, entries)
-    channel.last_rss_at = _now()
+    channel.last_rss_at = datetime.now(timezone.utc)
     db.add(channel)
     db.commit()
     return inserted
@@ -96,7 +92,9 @@ def stub_from_playlist_item(item: dict, channel_id: str) -> dict | None:
     # published_at is NOT NULL (migration 0068); fall back to now() for the rare item that carries no
     # date at all, so the bulk stub insert never writes a NULL. The enrich pass replaces it if the
     # video's own snippet later yields a real publish date.
-    published = parse_dt(content.get("videoPublishedAt") or snippet.get("publishedAt")) or _now()
+    published = parse_dt(
+        content.get("videoPublishedAt") or snippet.get("publishedAt")
+    ) or datetime.now(timezone.utc)
     return {
         "id": video_id,
         "channel_id": channel_id,
@@ -109,7 +107,7 @@ def stub_from_playlist_item(item: dict, channel_id: str) -> dict | None:
 def _uploads_page(yt: YouTubeClient, channel_id: str, uploads: str, page_token: str | None) -> dict:
     """One page of the channel's uploads. YouTube answers the uploads list of a channel with no
     uploads at all as not found: an empty back-catalogue, so an empty last page — not a failure
-    that left `recent_synced_at` unstamped and charged the channel again on every run (E32 review).
+    that left `recent_synced_at` unstamped and charged the channel again on every run.
     Any other failure raises."""
     try:
         return yt.get_playlist_items(uploads, page_token)
@@ -124,12 +122,14 @@ def backfill_channel_recent(db: Session, yt: YouTubeClient, channel: Channel) ->
     """First pass: newest videos up to the configured count or age cutoff. Records a
     resume cursor for the later deep backfill."""
     if not channel.uploads_playlist_id:
-        channel.recent_synced_at = _now()
+        channel.recent_synced_at = datetime.now(timezone.utc)
         db.add(channel)
         db.commit()
         return 0
 
-    cutoff = _now() - timedelta(days=sysconfig.get_int(db, "backfill_recent_max_days"))
+    cutoff = datetime.now(timezone.utc) - timedelta(
+        days=sysconfig.get_int(db, "backfill_recent_max_days")
+    )
     collected: list[dict] = []
     page_token: str | None = None
     next_cursor: str | None = None
@@ -164,7 +164,7 @@ def backfill_channel_recent(db: Session, yt: YouTubeClient, channel: Channel) ->
             break
         next_cursor = page_token  # whole page consumed, more pages remain
 
-    channel.recent_synced_at = _now()
+    channel.recent_synced_at = datetime.now(timezone.utc)
     channel.backfill_cursor = next_cursor
     channel.backfill_done = done
     inserted = insert_stubs(db, collected)
@@ -264,7 +264,7 @@ def apply_video_details(video: Video, item: dict) -> None:
     if snippet_published:
         video.published_at = snippet_published
     elif not video.published_at:
-        video.published_at = _now()
+        video.published_at = datetime.now(timezone.utc)
     video.thumbnail_url = best_thumbnail(snippet.get("thumbnails")) or video.thumbnail_url
     video.duration_seconds = parse_iso8601_duration(content.get("duration"))
     video.view_count = int(stats["viewCount"]) if stats.get("viewCount") else None
@@ -296,7 +296,7 @@ def _apply_video_batch(
     if not videos:
         return 0
     items = {it["id"]: it for it in yt.get_videos([v.id for v in videos])}
-    now = _now()
+    now = datetime.now(timezone.utc)
     applied = 0
     for video in videos:
         item = items.get(video.id)
@@ -312,7 +312,7 @@ def _apply_video_batch(
 
 def _mark_enriched(video: Video) -> None:
     # Unavailable (deleted/private): stamp so we don't keep retrying.
-    video.enriched_at = _now()
+    video.enriched_at = datetime.now(timezone.utc)
 
 
 def enrich_pending(db: Session, yt: YouTubeClient, limit: int | None = None) -> int:
diff --git a/backend/app/sysconfig.py b/backend/app/sysconfig.py
index 0822fad1..daf8b1ce 100644
--- a/backend/app/sysconfig.py
+++ b/backend/app/sysconfig.py
@@ -140,7 +140,7 @@ SPECS: tuple[ConfigSpec, ...] = (
         max=100_000,
     ),
     # min=1, NOT 0: a stored 0 used to read as "no per-file cap" (the cap was enforced as
-    # `if cap and size > cap`, so a falsy value disabled it). Since P1 the route passes this number
+    # `if cap and size > cap`, so a falsy value disabled it). Now the route passes this number
     # straight to `capped_stream_to`, where 0 would refuse every upload instead — the opposite
     # failure, and the reason `config.download_upload_max_bytes` carries its own `ge=1`. Either way
     # a stored 0 is wrong, so it is floored at 1; the overall footprint is separately bounded by the
@@ -181,7 +181,7 @@ SPECS: tuple[ConfigSpec, ...] = (
     # --- Audit log ---
     # Days to keep admin audit-log rows before the audit_gc job prunes them (0 = keep forever).
     ConfigSpec("audit_retention_days", "int", "audit", "audit_retention_days", min=0, max=3650),
-    # --- Diagnostics (E22) ---
+    # --- Diagnostics ---
     # Runtime log level for the API process. Applied without a restart — see routes/config.py and
     # main.py's lifespan.
     ConfigSpec("log_level", "choice", "diagnostics", "log_level"),
@@ -198,7 +198,7 @@ SPECS: tuple[ConfigSpec, ...] = (
     # (plex_sync_interval_min is tuned from the Scheduler dashboard, not here — it's a scheduler job.)
     ConfigSpec("plex_max_transcodes", "int", "plex", "plex_max_transcodes", min=0, max=16),
     ConfigSpec("plex_max_sessions", "int", "plex", "plex_max_sessions", min=1, max=64),
-    # Transcode re-encode tuning (E6 S1). The libx264 knobs apply only to the software fallback.
+    # Transcode re-encode tuning. The libx264 knobs apply only to the software fallback.
     # crf 0–51 (x264 range); max_height 0 = source.
     ConfigSpec("plex_transcode_hw", "choice", "plex", "plex_transcode_hw"),
     ConfigSpec("plex_transcode_preset", "choice", "plex", "plex_transcode_preset"),
@@ -210,10 +210,10 @@ SPECS: tuple[ConfigSpec, ...] = (
     ConfigSpec("plex_audio_loudnorm", "bool", "plex", "plex_audio_loudnorm"),
     # NOTE: plex_watch_sync_interval_min is a config.py default read by the watch-sync scheduler job
     # (scheduler.py); it is intentionally NOT a runtime admin knob, so it stays out of SPECS.
-    # --- TMDB enrichment (E5 S2; optional) — the API key is the only secret ---
+    # --- TMDB enrichment (optional) — the API key is the only secret ---
     ConfigSpec("tmdb_api_key", "str", "tmdb", "tmdb_api_key", secret=True),
     ConfigSpec("tmdb_language", "str", "tmdb", "tmdb_language"),
-    # --- Bug reports (E16): the Gitea issue tracker a debug session's issue goes to ---
+    # --- Bug reports: the Gitea issue tracker a debug session's issue goes to ---
     ConfigSpec("issues_gitea_url", "str", "issues", "issues_gitea_url"),
     ConfigSpec("issues_gitea_repo", "str", "issues", "issues_gitea_repo"),
     ConfigSpec("issues_gitea_token", "str", "issues", "issues_gitea_token", secret=True),
@@ -221,7 +221,7 @@ SPECS: tuple[ConfigSpec, ...] = (
     # is a config.py default — both stay out of SPECS, like plex_sync_interval_min.)
 )
 
-# The admin page's sections (E31, the owner's pick): sixteen groups as tabs wrapped to three rows at 133%
+# The admin page's sections (the owner's pick): sixteen groups as tabs wrapped to three rows at 133%
 # zoom, so they are a vertical list under four headings, in this order. Every group of SPECS sits in
 # exactly one section (test-held), so a new group cannot fall off the page.
 SECTIONS: tuple[tuple[str, tuple[str, ...]], ...] = (
@@ -275,7 +275,7 @@ def _coerce(s: ConfigSpec, raw: str):
     if s.type == "int":
         # Bounds are checked on READ, not only in `set_value`. Bounds get ADDED to a spec
         # (download_upload_max_bytes gained a `max` when SEC-20 started enforcing the same number at
-        # the edge; its `min` went 0 → 1 during E7) and env defaults get LOWERED, and either leaves
+        # the edge; its `min` went 0 → 1) and env defaults get LOWERED, and either leaves
         # a stored value that was legal when it was written. Serving it is how one layer ends up
         # acting on a number another layer refuses, with the admin page showing a value outside the
         # range it renders.
@@ -430,7 +430,7 @@ def describe(db: Session) -> dict:
     only whether an override is set and whether an env default exists."""
     groups: dict[str, list[dict]] = {}
     # Every override in one query: a db.get per key was one round trip each (two for a key with no
-    # row, which the session cannot cache), ~40 ms of the page's ~55 on prod (E31 S4d).
+    # row, which the session cannot cache), ~40 ms of the page's ~55 on prod.
     rows = {r.key: r for r in db.scalars(select(SystemConfig))}
     for s in SPECS:
         row = rows.get(s.key)
diff --git a/backend/app/userscope.py b/backend/app/userscope.py
index 86ecf76d..745c3c0b 100644
--- a/backend/app/userscope.py
+++ b/backend/app/userscope.py
@@ -1,23 +1,22 @@
-"""Shared "who is a real, active, non-suspended human" predicate.
+"""Shared "who is an active, non-suspended account" predicate.
 
-Used wherever a user must be filtered out of a directory / recipient list or rejected as a target:
-the messaging directory AND the download share-by-email / recipient-picker endpoints. Kept in one
-place so the two forms (SQL clauses for a query, Python check for a loaded row) can't drift apart,
-and so a route module doesn't have to import another route module just to reuse the rule.
+Used wherever a user must be filtered out of a recipient list or rejected as a target: the download
+share-by-email and recipient-picker endpoints. Kept in one place so the two forms (SQL clauses for a
+query, Python check for a loaded row) can't drift apart, and so a route module doesn't have to import
+another route module just to reuse the rule.
 """
 
 from app.models import User
 
 
 def messageable_clauses() -> list:
-    """SQL clauses for "a real, active, non-suspended human" — splat into a directory/recipient query."""
+    """SQL clauses for "an active, non-suspended account" — splat into a recipient query."""
     return [
-        User.is_demo.is_(False),
         User.is_active.is_(True),
         User.is_suspended.is_(False),
     ]
 
 
 def is_messageable_user(u: User | None) -> bool:
-    """Python mirror of `messageable_clauses()` for an already-loaded row (WS auth, send recipient)."""
-    return bool(u and not u.is_demo and u.is_active and not u.is_suspended)
+    """Python mirror of `messageable_clauses()` for an already-loaded row (a share recipient)."""
+    return bool(u and u.is_active and not u.is_suspended)
diff --git a/backend/app/utils.py b/backend/app/utils.py
index 9dc90251..21332c33 100644
--- a/backend/app/utils.py
+++ b/backend/app/utils.py
@@ -1,7 +1,7 @@
 """Small cross-cutting helpers shared across modules (kept dependency-light on purpose)."""
 
 import re
-from datetime import date, datetime, timezone
+from datetime import date
 
 
 def iso(dt: date | None) -> str | None:
@@ -13,7 +13,7 @@ def iso(dt: date | None) -> str | None:
 
 
 # Single source of truth for "looks like an email" — used by every endpoint that accepts an
-# address (auth register/reset/demo, admin invites + demo whitelist, the setup wizard). Keep
+# address (auth register/reset, admin invites, the setup wizard). Keep
 # the strictness in one place so routes don't drift between this and a looser "@"-in check.
 _EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
 
@@ -55,14 +55,9 @@ def canonical_email(value: str | None) -> str:
     return f"{local}@gmail.com" if local else email
 
 
-def now_utc() -> datetime:
-    """Current time as a timezone-aware UTC datetime."""
-    return datetime.now(timezone.utc)
-
-
 # The shortest last word that is prefix-matched. A 1–2 letter prefix matches a large share of the
 # library and ts_rank then scores every match: "m" took ~5–8 s on prod against ~100 ms for a whole
-# word (E31 S4e). A shorter last word is matched whole instead ("tv", "4k" still find themselves).
+# word. A shorter last word is matched whole instead ("tv", "4k" still find themselves).
 MIN_PREFIX_LEN = 3
 
 
diff --git a/backend/app/worker.py b/backend/app/worker.py
index 4536cb04..20c48d76 100644
--- a/backend/app/worker.py
+++ b/backend/app/worker.py
@@ -11,7 +11,7 @@ Design:
     instantly (no re-download); a fresh asset is claimed pending→downloading by exactly one
     worker (a DB compare-and-set), so two jobs for the same video+format never double-download.
   * Live progress is written to the job row (short-lived sessions, throttled ~1/s) — the
-    frontend polls it; the worker can't reach the API's in-process WebSocket registry.
+    frontend polls it (the worker is a separate process with no channel to the browser).
   * Pause/cancel are cooperative: the progress hook re-reads the job status and aborts the
     yt-dlp download if it's no longer `running`.
   * Crash-safe: on startup, orphaned `running` jobs are requeued and `downloading` assets reset.
diff --git a/backend/app/youtube/client.py b/backend/app/youtube/client.py
index 400ea78c..b7c549e0 100644
--- a/backend/app/youtube/client.py
+++ b/backend/app/youtube/client.py
@@ -135,7 +135,7 @@ def refusal_reason(exc: YouTubeError, *, playlist: bool = False) -> YouTubeRefus
     `playlist`: the action was on ONE playlist the user picked, so a missing playlist is that list,
     gone (deleted on YouTube) — neither a retry nor a reconnect helps. Anywhere else the playlist
     is one the user never named (a channel's uploads, one list of a bulk pull), and "this playlist
-    no longer exists" would describe nothing on their screen (E32 review round 2)."""
+    no longer exists" would describe nothing on their screen."""
     if is_quota_refusal(exc):
         return "quota"
     if playlist and is_playlist_gone(exc):
diff --git a/backend/app/youtube/search_scrape.py b/backend/app/youtube/search_scrape.py
index 391416c8..95dc1b89 100644
--- a/backend/app/youtube/search_scrape.py
+++ b/backend/app/youtube/search_scrape.py
@@ -73,7 +73,7 @@ def _get_config(client: httpx.Client) -> tuple[str, str]:
     The fallback pair is never cached: it used to be, so one failed fetch (or a consent page with no
     keys on it) at the wrong moment pinned every later search to a hard-coded key and version for
     the life of the process — and when those went stale, search returned nothing, with no error
-    anywhere (E32 S2). Now the next search simply tries the live pair again."""
+    anywhere. Now the next search simply tries the live pair again."""
     global _config
     if _config is not None:
         return _config
diff --git a/backend/docker-compose.test.yml b/backend/docker-compose.test.yml
index 4ce8ae39..e3d18c67 100644
--- a/backend/docker-compose.test.yml
+++ b/backend/docker-compose.test.yml
@@ -1,7 +1,8 @@
-# DB-backed pytest lane (R6 S3b): an ephemeral Postgres + the test image, wired together so the
+# DB-backed pytest lane: an ephemeral Postgres + the test image, wired together so the
 # `db` fixture (tests/conftest.py) has a real database. The whole thing is throwaway — the pg data
-# lives in tmpfs (RAM) and nothing is persisted. The pure-logic lane still runs WITHOUT this file
-# (plain `docker run … python -m pytest` — DB tests skip when no Postgres is reachable).
+# lives in tmpfs (RAM) and nothing is persisted. A pure-logic run without this file is possible but
+# must say so: `docker run -e SIFTLODE_TEST_REQUIRE_DB=0 … python -m pytest` (without it, a missing
+# Postgres fails the run instead of skipping the DB tests).
 #
 #   docker compose -f backend/docker-compose.test.yml up --build --abort-on-container-exit \
 #     --exit-code-from test
@@ -35,9 +36,5 @@ services:
     volumes:
       - ./:/app
     working_dir: /app
-    # The suite, then the coverage total (E32 D4: reported, no threshold). pytest's exit code is the
-    # lane's — the report is printed either way and never decides it.
-    command:
-      - sh
-      - -c
-      - 'python -m pytest --cov=app --cov-report= ; rc=$$?; echo ">> backend coverage (app/) $$(python -m coverage report --format=total)% of lines"; exit $$rc'
+    # Coverage is on demand, not in the gate: see docs/development.md.
+    command: ["python", "-m", "pytest"]
diff --git a/backend/pyrightconfig.json b/backend/pyrightconfig.json
index e034ee46..c0ec0838 100644
--- a/backend/pyrightconfig.json
+++ b/backend/pyrightconfig.json
@@ -1,4 +1,4 @@
-// The backend type-check lane (E27 S3) — the gate's ninth lane, and the first thing that has ever
+// The backend type-check lane — the gate's ninth lane, and the first thing that has ever
 // type-checked the ~36k lines of `app/`. Read as JSONC: pyright accepts comments here.
 //
 // basedpyright, not mypy: measured on this tree with the dependencies actually installed, both land
@@ -13,8 +13,8 @@
 // image installs — so the lane's version IS the pin, with no host-vs-pin check to drift.
 //
 // `pythonVersion` is not free-standing: `/.python-version` is the single source of truth and
-// `tests/test_python_engine_contract.py` fails this gate if this file, the two Dockerfiles, the CI
-// container or ruff's target-version disagree with it.
+// `tests/test_python_engine_contract.py` (with its host half, pythonEngine.contract.test.ts) fails
+// this gate if this file, the two Dockerfiles or ruff's target-version disagree with it.
 //
 // `include` covers `alembic` for the same reason the ruff lane was widened to it: migrations run on
 // every container start, so one that raises there crash-loops prod, and "it is generated code" is
diff --git a/backend/pytest.ini b/backend/pytest.ini
index f92aa790..cc36472b 100644
--- a/backend/pytest.ini
+++ b/backend/pytest.ini
@@ -3,7 +3,7 @@
 # import it as `app.*`, matching runtime. Most of the suite is pure-logic; the DB-backed lane opts in
 # via the `db` fixture and runs in the compose test image. `-rs` reports skip REASONS so a silently
 # skipped lane is visible (and conftest makes a missing DB/ffmpeg a hard error unless
-# SIFTLODE_TEST_REQUIRE_DB=0). `--strict-markers` (E32): a misspelt `@pytest.mark.skipiff` is an error,
+# SIFTLODE_TEST_REQUIRE_DB=0). `--strict-markers`: a misspelt `@pytest.mark.skipiff` is an error,
 # not an unknown marker that quietly does nothing.
 testpaths = tests
 pythonpath = .
diff --git a/backend/requirements-dev.txt b/backend/requirements-dev.txt
index 6480647e..e681a5f8 100644
--- a/backend/requirements-dev.txt
+++ b/backend/requirements-dev.txt
@@ -4,11 +4,11 @@
 # backend lint lane runs on the host (the gate fails when the host's ruff is not this one). httpx2:
 # Starlette 1.x's TestClient is built on it (`import httpx2 as httpx`) and only falls back to the
 # app's own httpx with a deprecation warning on every run.
-# basedpyright: the backend type-check lane (E27 S3). Pinned like everything else here — a type
+# basedpyright: the backend type-check lane. Pinned like everything else here — a type
 # checker whose version floats silently changes what "clean" means, and the ratchet baseline it
 # writes is keyed to the diagnostics THIS version produces.
-# pytest-cov: the coverage REPORT the gate prints (E32 D4) — a number to read, deliberately with no
-# threshold; "every regression test seen red" is the bar, not a percentage.
+# pytest-cov: the on-demand coverage report (docs/development.md) — a number to read, deliberately
+# with no threshold; "every regression test seen red" is the bar, not a percentage.
 # pip-audit: the gate's audit of requirements.lock (scripts/check.sh), blocking at any severity.
 basedpyright==1.40.1
 pytest==8.4.2
diff --git a/backend/requirements.lock b/backend/requirements.lock
index 2611fa16..de7bbd57 100644
--- a/backend/requirements.lock
+++ b/backend/requirements.lock
@@ -2,9 +2,9 @@
 # Source of truth is requirements.txt (the floor ranges); regenerate after editing it with:
 #   docker run --rm -v "$PWD":/b python:3.12-slim sh -c 'pip install -q -r /b/requirements.txt && pip freeze --exclude pip --exclude setuptools --exclude wheel' | sort
 # The prod Dockerfile + Dockerfile.test install THIS file; the gate's pip-audit (scripts/check.sh)
-# scans it, blocking since E32. A security fix may be ONE pin bumped in place instead of a full
+# scans it, blocking. A security fix may be ONE pin bumped in place instead of a full
 # regeneration, which would move every other package too — then `pip install -r requirements.lock && pip check` must
-# pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177, E32).
+# pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177).
 APScheduler==3.11.3
 Authlib==1.7.2
 Mako==1.4.1
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 6622eaf2..d8049a9d 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -19,8 +19,8 @@ argon2-cffi>=23.1,<26
 # keep the floor loose and bump it when extraction breaks.
 yt-dlp[default]>=2025.5.22
 # Browser impersonation (`impersonate`) for Facebook downloads made with the user's cookie: some
-# links answer a signed-in plain request with "Cannot parse data" and only parse as Chrome (E11.5,
-# measured). The range is YT-DLP's, not ours — yt-dlp 2026.07.04 imports curl_cffi only in
+# links answer a signed-in plain request with "Cannot parse data" and only parse as Chrome
+# (measured). The range is YT-DLP's, not ours — yt-dlp 2026.07.04 imports curl_cffi only in
 # 0.10.x–0.15.x and silently reports every target "unavailable" outside it. Move it when bumping
 # yt-dlp; `tests/test_facebook_impersonation.py::test_the_locked_curl_cffi_can_impersonate_chrome`
 # fails the gate if the locked pair can no longer impersonate.
diff --git a/backend/ruff.toml b/backend/ruff.toml
index 57145a40..b5274832 100644
--- a/backend/ruff.toml
+++ b/backend/ruff.toml
@@ -1,7 +1,7 @@
 # Ruff config for the Siftlode backend. Keeps ruff's default rule set (E4/E7/E9 + F = the
 # high-signal pyflakes/pycodestyle checks that catch real dead code + bugs), all of it on. E402 was
-# ignored for main.py's logging setup; the ignore had let 11 incidental late imports in elsewhere
-# (E32 review), so it is on now and main.py marks each deliberate one (`# noqa: E402 — <why>`).
+# ignored for main.py's logging setup; the ignore had let 11 incidental late imports in elsewhere,
+# so it is on now and main.py marks each deliberate one (`# noqa: E402 — <why>`).
 # `scripts/e2e_seed.py` edits `sys.path` before its imports, which E402 itself allows.
 #
 # line-length 100 (ruff's default is 88): matches the frontend prettier printWidth so both halves of
@@ -14,7 +14,7 @@ line-length = 100
 target-version = "py312"
 
 [lint]
-# Beyond the default set, the rules that hold a LOG LINE to what E22.5 makes of it:
+# Beyond the default set, the rules that hold a LOG LINE to what the log pipeline makes of it:
 #   LOG     — stdlib logging misuse (`.warn()`, a logger built by hand, `exc_info` on `.exception`)
 #   G       — the call's shape: %-style args, never an f-string the level filter cannot skip, and
 #             never `str(exc)` where `exc_info` would carry the traceback
@@ -32,11 +32,11 @@ target-version = "py312"
 # The wider rule these two enforce lives in tests/test_swallowed_exceptions.py: a handler that
 # neither logs nor re-raises says `# silent-ok: <why>`. Ruff sees only the two narrow shapes.
 #
-# E32 (gate integrity) added three more, each measured before it went on and with every hit fixed:
+# Gate integrity added three more, each measured before it went on and with every hit fixed:
 #   RUF100  — a `# noqa` that suppresses nothing. A stale one is a claim with no rule behind it, and
 #             it stays armed for the day the line changes (24 were removed). A comment that merely
 #             explains a noqa below it names the rule as `# TRY400: …`, never `# noqa TRY400`.
-#   PLW1510 — `subprocess.run` without an explicit `check=`. Found the real E32 bug: three ffprobe
+#   PLW1510 — `subprocess.run` without an explicit `check=`. Found a real bug: three ffprobe
 #             probes read the output of a probe that had FAILED and took it for the file's truth.
 #   B       — flake8-bugbear: loop-variable capture, `raise` without `from` inside `except`, a
 #             `zip` that silently truncates (each one is `strict=True` now — the lengths are an
diff --git a/backend/tests/conftest.py b/backend/tests/conftest.py
index 05c88c34..d4d142af 100644
--- a/backend/tests/conftest.py
+++ b/backend/tests/conftest.py
@@ -1,4 +1,4 @@
-"""Pytest fixtures for the DB-backed integration lane (R6 S3b).
+"""Pytest fixtures for the DB-backed integration lane.
 
 The bulk of the suite is pure-logic and needs no database. This adds an OPT-IN `db` fixture
 that hands a test a real session against a throwaway Postgres (the app's own engine, bound to
@@ -38,8 +38,8 @@ from app.models import User
 _MISSING = object()
 
 # A would-be silent skip (no DB, or no ffmpeg) is a hard error unless the run says otherwise — the
-# suite must not print green while the DB-backed / ffmpeg tests were quietly not run. ON by default
-# since E32: as an opt-in only the compose lane set, a hand-run `pytest` skipped ~60 DB tests
+# suite must not print green while the DB-backed / ffmpeg tests were quietly not run. ON by default:
+# as an opt-in only the compose lane set, a hand-run `pytest` skipped ~60 DB tests
 # and still passed. `SIFTLODE_TEST_REQUIRE_DB=0` is the explicit "pure-logic only" run.
 _REQUIRE_FULL = os.getenv("SIFTLODE_TEST_REQUIRE_DB", "1") != "0"
 
@@ -117,7 +117,7 @@ def _request_dep(db, unfinished: list[str]):
     savepoint released inside the handler commits nothing. The test's own staged rows are flushed before the request starts — they are the
     test's business, not the handler's. A request that raises is rolled back, as production's
     `close()` rolls it back: without that, what a failing handler flushed but never committed stayed
-    readable to the rest of the test — the one state production cannot be in (E16: an issue created
+    readable to the rest of the test — the one state production cannot be in (an issue created
     on the tracker before a failed upload was kept only by an explicit commit, and nothing saw it
     missing)."""
 
@@ -254,7 +254,7 @@ def as_user(db, override_dep, _configured):
 
 @pytest.fixture
 def upload_headers():
-    """Build the headers `POST /api/downloads/upload` takes since P1.
+    """Build the headers `POST /api/downloads/upload` takes (the file is the raw body).
 
     Shared, because two test modules drive that route and a second copy of this is exactly the drift
     that lets the wire shape change in one place only. The body IS the file now; the names ride as
diff --git a/backend/tests/fixtures/log_redaction_cases.json b/backend/tests/fixtures/log_redaction_cases.json
index c89a7cc2..12ac0a0f 100644
--- a/backend/tests/fixtures/log_redaction_cases.json
+++ b/backend/tests/fixtures/log_redaction_cases.json
@@ -31,7 +31,7 @@
       }
     },
     {
-      "name": "E2EE material and cookies",
+      "name": "ciphertext, passphrases and cookies",
       "key": "",
       "value": {
         "ciphertext": "AAAA",
diff --git a/backend/tests/test_abuse_limits.py b/backend/tests/test_abuse_limits.py
index 0593cacb..f9ec8303 100644
--- a/backend/tests/test_abuse_limits.py
+++ b/backend/tests/test_abuse_limits.py
@@ -1,4 +1,4 @@
-"""E12 · S3 — the route-level halves of SEC-12 and SEC-14.
+"""The route-level halves of SEC-12 and SEC-14.
 
 `test_urlguard.py` pins the address judgement itself; this pins that the ENQUEUE route actually
 consults it and answers in the structured `{code, reason}` shape the frontend localizes, and that a
@@ -38,7 +38,7 @@ def test_a_public_url_gets_past_the_guard(db, as_user, make_user, monkeypatch):
     )
     # An inline spec, so nothing ELSE refuses it: without one the request stopped at the
     # profile lookup (400 no_profile) and "not url_blocked" held for a request the guard never
-    # had to wave through (E32 S2).
+    # had to wave through.
     r = as_user(user).post(
         "/api/downloads", json={"source": "https://example.com/v", "spec": {"format": "best"}}
     )
@@ -56,7 +56,7 @@ def test_youtube_sources_never_consult_the_guard(db, as_user, make_user, monkeyp
     db.commit()
     monkeypatch.setattr(urlguard.socket, "getaddrinfo", boom)
     # The job must actually be created: a request refused for any other reason would never reach
-    # the guard either, and the test would pass without proving anything (E32 S2).
+    # the guard either, and the test would pass without proving anything.
     r = as_user(user).post(
         "/api/downloads", json={"source": "dQw4w9WgXcQ", "spec": {"format": "best"}}
     )
diff --git a/backend/tests/test_admin_logs.py b/backend/tests/test_admin_logs.py
index 87660e41..7277108c 100644
--- a/backend/tests/test_admin_logs.py
+++ b/backend/tests/test_admin_logs.py
@@ -1,4 +1,4 @@
-"""The admin diagnostics console's query API (E22.6 S1), DB-lane."""
+"""The admin diagnostics console's query API, DB-lane."""
 
 from datetime import datetime, timedelta, timezone
 
diff --git a/backend/tests/test_admin_pending_access.py b/backend/tests/test_admin_pending_access.py
index c4cedd87..536d3dd2 100644
--- a/backend/tests/test_admin_pending_access.py
+++ b/backend/tests/test_admin_pending_access.py
@@ -1,4 +1,4 @@
-"""The admin lifeline for a sign-up that is stuck outside (E9.5 S5, roadmap UX-25), DB-lane.
+"""The admin lifeline for a sign-up that is stuck outside, DB-lane.
 
 Approve an address BEFORE the person registers and their sign-up produces no queue row at all —
 `_decide` only takes a still-pending invite — so the Access-requests screen stayed empty while they
@@ -133,7 +133,7 @@ def test_an_unconfirmed_account_is_listed_and_can_be_sent_a_fresh_link(
         lambda to, lang, link, **kw: sent.append((to, link)) is None,
     )
     admin = make_user(email="admin@example.com", role="admin")
-    # Active but unconfirmed — a real state since E9.5 S1 made the two gates order-independent. It is
+    # Active but unconfirmed — a real state now that the two gates are order-independent. It is
     # not the admin's to decide, but the mail may simply never have arrived, so it is theirs to help
     # with. The approved invite is what puts them on this screen at all: the list is "the address may
     # sign in, this account still can't", so an undecided request stays with the queue that owns it.
diff --git a/backend/tests/test_audit_count_rows.py b/backend/tests/test_audit_count_rows.py
index 1cf7f433..cdf47d6b 100644
--- a/backend/tests/test_audit_count_rows.py
+++ b/backend/tests/test_audit_count_rows.py
@@ -1,4 +1,4 @@
-"""E30: an admin action that counts something keeps the count as data in its audit row's `after`, under
+"""An admin action that counts something keeps the count as data in its audit row's `after`, under
 the key the audit log names in the reader's language (`scheduler.result.<key>`, frontend
 auditColumns.tsx) — not only in the English `summary`. A renamed key would fall back to the raw word.
 DB lane (Postgres).
@@ -22,12 +22,6 @@ def test_clearing_the_audit_log_keeps_the_count_as_data(as_user, db, make_user):
     assert _after(db, "audit_clear") == {"cleared": 2}
 
 
-def test_a_demo_reset_keeps_the_count_as_data(as_user, db, make_user):
-    admin = make_user(email="boss@example.com", role="admin")
-    seeded = as_user(admin).post("/api/admin/demo/reset").json()["playlists_seeded"]
-    assert _after(db, "demo_reset") == {"playlists_seeded": seeded}
-
-
 def test_a_discovery_purge_keeps_its_counts_as_data(as_user, db, make_user):
     admin = make_user(email="boss@example.com", role="admin")
     body = as_user(admin).post("/api/admin/purge-discovery").json()
diff --git a/backend/tests/test_auth_session.py b/backend/tests/test_auth_session.py
index 040fd48f..cc91d987 100644
--- a/backend/tests/test_auth_session.py
+++ b/backend/tests/test_auth_session.py
@@ -168,17 +168,17 @@ def test_reset_confirm_is_single_use_and_kills_existing_sessions(client, make_us
 
 
 def test_approving_an_unverified_account_keeps_its_password(db, make_user):
-    # E9.5 S1, inverting an earlier rule. Approval used to drop a password set while the email was
+    # This inverts an earlier rule. Approval used to drop a password set while the email was
     # unverified (SEC-10, account pre-emption). It was dropped because it destroyed the password a
     # legitimate registrant had just chosen, in what is the NORMAL ordering — the admin decides
     # before the user reads their mail — making "your password was cleared for security" the default
     # experience.
     #
-    # S1 ALSO argued the revoke was redundant, because password_login refuses an unverified account
-    # before it reads is_active. The epic's closing review refuted that: the gate holds only while
-    # the address is unverified, and S6's approval mail exists to get the real owner to end that
-    # state. Do not restore that reasoning from this comment — the residual is SEC-16, and round 2
-    # of the review tried and reverted a guard for it (see test_review_round.py).
+    # It was ALSO argued that the revoke was redundant, because password_login refuses an
+    # unverified account before it reads is_active. The epic's closing review refuted that: the gate
+    # holds only while the address is unverified, and the approval mail exists to get the real
+    # owner to end that state. Do not restore that reasoning from this comment — the residual is
+    # SEC-16, and the same review tried and reverted a guard for it (see test_review_round.py).
     from app.routes.admin import _activate_user_by_email
 
     user = make_user(
@@ -245,7 +245,7 @@ def test_verifying_afterwards_lets_the_original_password_in(client, db, make_use
 
 def test_activating_a_verified_account_keeps_its_password(db, make_user):
     # The no-SMTP shape: registration marks such an account verified up front, so it was never in
-    # scope for the SEC-10 guard even before E9.5 S1. Kept as the other half of the pair.
+    # scope for the SEC-10 guard even back then. Kept as the other half of the pair.
     from app.routes.admin import _activate_user_by_email
 
     user = make_user(
@@ -354,7 +354,7 @@ def test_an_admin_can_activate_a_pre_approved_registrant(db, monkeypatch):
 
     db.expire_all()
     assert user.is_active is True
-    assert user.password_hash is not None  # approval never touches the password (E9.5 S1)
+    assert user.password_hash is not None  # approval never touches the password
 
 
 def test_registration_of_an_unknown_email_still_persists_account_and_pending_invite(
@@ -483,7 +483,7 @@ def test_register_route_is_refused_when_registration_is_closed(client, db, monke
 # was a deliberately uniform "ok"/401. `password_revoked_at` is the trace that tells the two apart;
 # these pin each step of the way back in.
 #
-# E9.5 S1 removed the admin-approval caller, so Google adoption is the only path that still produces
+# The admin-approval caller is gone, so Google adoption is the only path that still produces
 # this state — plus every account stripped on prod before that change, which is why the whole recovery
 # route below must keep working. These tests manufacture the state through the surviving producer.
 
@@ -491,9 +491,9 @@ def test_register_route_is_refused_when_registration_is_closed(client, db, monke
 def _revoke_as_google_adoption(db, user) -> None:
     """Put an account into the SEC-10-revoked state the way the ONLY remaining producer does: the
     Google callback adopting an account whose email was never verified."""
-    from app.routes.auth import revoke_preset_password_if_unverified
+    from app.routes.auth import revoke_untrusted_preset_password
 
-    revoke_preset_password_if_unverified(user)
+    revoke_untrusted_preset_password(user)
     db.commit()
 
 
diff --git a/backend/tests/test_autotag_orphans.py b/backend/tests/test_autotag_orphans.py
index a9eb5605..76e01810 100644
--- a/backend/tests/test_autotag_orphans.py
+++ b/backend/tests/test_autotag_orphans.py
@@ -1,4 +1,4 @@
-"""sync/autotag's orphan cleanup (E32 S2: the module was 32% covered).
+"""sync/autotag's orphan cleanup (the module was 32% covered).
 
 A system tag no channel carries any more is deleted — unless a saved feed view filters on it. The
 views hold tag ids; a deleted tag returns under a NEW id when a channel earns it again, and the feed
@@ -38,7 +38,7 @@ def test_an_orphan_system_tag_goes_but_one_a_saved_view_filters_on_stays(db, mak
 
 def test_a_malformed_saved_view_cannot_break_the_cleanup(db, make_user):
     """A view stored around the route's shape check (or before it) must not raise for everyone's job
-    — `"tags": 5` raised TypeError — and `True` is not tag id 1 (E32 review)."""
+    — `"tags": 5` raised TypeError — and `True` is not tag id 1."""
     user = make_user()
     orphan = Tag(user_id=None, name="Cooking", category="topic")
     db.add(orphan)
diff --git a/backend/tests/test_body_limit.py b/backend/tests/test_body_limit.py
index 905537e7..4d55c4e7 100644
--- a/backend/tests/test_body_limit.py
+++ b/backend/tests/test_body_limit.py
@@ -120,7 +120,7 @@ def test_a_raised_ceiling_is_still_a_ceiling():
     """The difference between this and an exemption, and the reason the list is a mapping: a route
     that needs more bytes does not thereby get unlimited bytes. Left uncounted, the upload route
     would let an ANONYMOUS caller stream without bound — FastAPI parses a declared body before the
-    first dependency, so `require_human` has not run yet when the bytes land."""
+    first dependency, so the auth dependency has not run yet when the bytes land."""
     over = b"x" * (BIG[("POST", "/api/things/{tid}/blob")] + 1)
     r = _client(routes=BIG).post("/api/things/abc/blob", content=over)
     assert r.status_code == 413
@@ -209,12 +209,12 @@ def test_the_default_ceiling_clears_the_largest_body_a_default_route_takes():
 # its route is not in ROUTE_MAX_BODY_BYTES, this middleware refuses a request the route would have
 # taken — silently, in production, on a path nobody tested. The point of the list is the third entry.
 #
-# BOTH helpers, not just `capped_body`: P1 added `capped_stream_to` as its sibling and the registry
+# BOTH helpers, not just `capped_body`: `capped_stream_to` was added later and the registry
 # did not follow, so the upload route — the one this whole invariant was written for — was the one
-# site the drift guard could not see (deep-review round 1). The names come from `_common.py` itself
+# site the drift guard could not see. The names come from `_common.py` itself
 # below, so a THIRD sibling cannot be added without this list noticing either — and a route that
 # skips the helpers altogether and awaits `request.body()` lands here as `<no ceiling declared>`
-# rather than vanishing (round 3).
+# rather than vanishing.
 #
 # The module is the path relative to `app/routes/`, so a site under `plex/` is spelled
 # `plex/admin.py` and cannot collide with the top-level `admin.py`.
@@ -255,7 +255,7 @@ def test_the_registry_covers_every_body_reading_helper():
 # they are blind to the shape `_common.py` itself is written in. A route spelling `await
 # request.body()` inline declares no ceiling, hands no connection back, and would be invisible to
 # all three — reading as "no new sites" rather than as a failure, which is the exact way a drift
-# guard dies quietly (deep-review round 3).
+# guard dies quietly.
 RAW_BODY_READS = {"body", "stream", "form", "json"}
 
 
@@ -476,7 +476,7 @@ def test_the_upload_ceiling_and_the_admin_knob_cannot_drift_apart():
     constant. If the knob could be set above the edge, an admin raising it would silently start
     getting 413s from a layer the admin page never mentions.
 
-    Since P1 the two count the SAME bytes — the body is the file, with no multipart envelope
+    Now the two count the SAME bytes — the body is the file, with no multipart envelope
     wrapped round it — so the old allowance is gone and the edge is the knob's own maximum,
     exactly. A gap reappearing means someone re-wrapped the upload in an envelope without saying so.
 
@@ -509,13 +509,13 @@ def _route_objects(root):
 
 @pytest.mark.parametrize(("method", "template"), sorted(bodylimit.ROUTE_MAX_BODY_BYTES))
 def test_no_route_with_a_raised_ceiling_declares_a_body_parameter(method, template):
-    """P1's invariant, and the reason this is a test rather than a comment.
+    """The upload fix's invariant, and the reason this is a test rather than a comment.
 
     A raised ceiling is only honest when the route's own cap applies to the bytes AS THEY ARRIVE.
     FastAPI reads and spools a DECLARED body (`= File(...)`, `= Form(...)`, a Pydantic model)
     BEFORE the first dependency resolves — so on such a route this middleware's ceiling is the only
-    thing between an anonymous caller and the whole allowance, `require_human` never gets a say, and
-    the route's in-handler cap measures bytes that have already landed. That is exactly what P1
+    thing between an anonymous caller and the whole allowance, the auth dependency never gets a say, and
+    the route's in-handler cap measures bytes that have already landed. That is exactly what a fix
     closed on the upload route, which sat in `ROUTE_MAX_BODY_BYTES` with a 500 MiB ceiling and a
     `file: UploadFile = File(...)` body for one release.
 
@@ -529,7 +529,7 @@ def test_no_route_with_a_raised_ceiling_declares_a_body_parameter(method, templa
     itself consults when it decides to read the body. Measured on the pinned FastAPI: a body declared
     inside a sub-dependency leaves `body_params` EMPTY while the body is still read in full before
     auth, so the first version of this test was green over a reproduction of the very defect it
-    exists to forbid (deep-review round 1). The upload route's own idiom — a body read from a
+    exists to forbid. The upload route's own idiom — a body read from a
     `yield` dependency — is exactly the shape that would have slipped through."""
     from app.main import app
 
@@ -546,7 +546,7 @@ def test_no_route_with_a_raised_ceiling_declares_a_body_parameter(method, templa
 
 def test_a_stored_override_outside_the_bounds_falls_back_on_READ(db):
     """`set_value` refuses an out-of-range int, but neither bound has always been what it is now —
-    the upload knob had no `max` before SEC-20 and its `min` was 0 before E7 — so a value that was
+    the upload knob had no `max` before SEC-20 and its `min` used to be 0 — so a value that was
     legal when it was written can be sitting in the database. Served as-is it is exactly the drift
     the test above forbids: the route would accept bytes the edge refuses.
 
diff --git a/backend/tests/test_canonical_patterns.py b/backend/tests/test_canonical_patterns.py
new file mode 100644
index 00000000..6f330793
--- /dev/null
+++ b/backend/tests/test_canonical_patterns.py
@@ -0,0 +1,52 @@
+"""Two rows of CLAUDE.md's canonical-patterns table, held in code.
+
+Both had drifted while the table said otherwise: seven `db.query(...)` calls stood beside the
+`select()` the table names, and four modules carried a private `_now` / `now_utc` helper (nine uses)
+where the table says inline `datetime.now(timezone.utc)`. A rule only prose holds drifts; ruff cannot
+ban a method call on an instance or a function's name, so this reads the AST of every app module.
+Pure-logic: no DB.
+"""
+
+import ast
+import pathlib
+import re
+
+import app
+
+APP = pathlib.Path(app.__file__).resolve().parent
+NOW_HELPER = re.compile(r"_?now(_\w+)?|now_utc|utcnow")
+
+
+def _modules() -> list[tuple[str, ast.Module]]:
+    return [
+        (p.relative_to(APP.parent).as_posix(), ast.parse(p.read_text(encoding="utf-8")))
+        for p in sorted(APP.rglob("*.py"))
+    ]
+
+
+def test_queries_use_select_not_the_legacy_query_api():
+    found = [
+        f"{path}:{node.lineno}"
+        for path, tree in _modules()
+        for node in ast.walk(tree)
+        if isinstance(node, ast.Call)
+        and isinstance(node.func, ast.Attribute)
+        and node.func.attr == "query"
+    ]
+    assert found == [], "use db.execute(select(...)) — SQLAlchemy 2.0 — not db.query(...)"
+
+
+def test_the_current_time_is_inline_not_a_helper():
+    found = [
+        f"{path}:{node.lineno} {node.name}"
+        for path, tree in _modules()
+        for node in ast.walk(tree)
+        if isinstance(node, ast.FunctionDef | ast.AsyncFunctionDef)
+        and NOW_HELPER.fullmatch(node.name)
+    ]
+    assert found == [], "write datetime.now(timezone.utc) inline, not a now()/_now() helper"
+
+
+def test_the_scan_sees_the_app():
+    # a scan that reads nothing is green over nothing
+    assert len(_modules()) > 50
diff --git a/backend/tests/test_channel_backfill.py b/backend/tests/test_channel_backfill.py
index 10fc90c1..7e651605 100644
--- a/backend/tests/test_channel_backfill.py
+++ b/backend/tests/test_channel_backfill.py
@@ -1,5 +1,5 @@
-"""R14 backend coverage: the channel-detail Normal/Shorts/Live counts (moved off the manager table),
-the update_channel -> immediate-backfill wiring (incl. the demo guard), and the interactive
+"""Backend coverage: the channel-detail Normal/Shorts/Live counts (moved off the manager table),
+the update_channel -> immediate-backfill wiring, and the interactive
 "get full history" guard that keeps it from racing the scheduler's cursor or draining the budget."""
 
 from datetime import datetime, timezone
@@ -54,7 +54,7 @@ def test_channel_detail_returns_normal_shorts_live_counts(db, monkeypatch, overr
 
 @pytest.mark.parametrize("hidden", [True, False])
 def test_channel_detail_surfaces_subscription_hidden_flag(db, monkeypatch, hidden, override_dep):
-    # S6: the detail GET must expose the per-subscription `hidden` flag so the channel page can offer
+    # The detail GET must expose the per-subscription `hidden` flag so the channel page can offer
     # the same Unhide toggle the manager has (the flag was previously omitted from the detail dict).
     ch = Channel(id="UC_hid", title="Hidden?", published_at=_PUB)
     db.add(ch)
@@ -89,7 +89,7 @@ def test_channel_detail_hidden_defaults_false_when_not_subscribed(db, monkeypatc
     assert resp.json()["hidden"] is False
 
 
-def _setup_channel_and_sub(db, *, email, is_demo=False):
+def _setup_channel_and_sub(db, *, email):
     ch = Channel(
         id="UC_wire",
         title="Wire",
@@ -98,7 +98,7 @@ def _setup_channel_and_sub(db, *, email, is_demo=False):
         uploads_playlist_id="UU_wire",
     )
     db.add(ch)
-    user = User(email=email, is_demo=is_demo)
+    user = User(email=email)
     db.add(user)
     db.flush()
     db.add(Subscription(user_id=user.id, channel_id=ch.id, deep_requested=False))
@@ -117,7 +117,7 @@ def _patch_deep_requested(db, monkeypatch, override_dep, user):
     return resp, calls
 
 
-def test_deep_request_schedules_immediate_backfill_for_non_demo(db, monkeypatch, override_dep):
+def test_deep_request_schedules_immediate_backfill(db, monkeypatch, override_dep):
     ch, me = _setup_channel_and_sub(db, email="wire@example.com")
     resp, calls = _patch_deep_requested(db, monkeypatch, override_dep, me)
     assert resp.status_code == 200, resp.text
@@ -126,16 +126,6 @@ def test_deep_request_schedules_immediate_backfill_for_non_demo(db, monkeypatch,
     assert calls == [(ch.id, me.id)]
 
 
-def test_deep_request_does_not_schedule_immediate_backfill_for_demo(db, monkeypatch, override_dep):
-    # The SHARED demo account must not be able to kick immediate full backfills (budget drain).
-    _ch, demo = _setup_channel_and_sub(db, email="demo@example.com", is_demo=True)
-    resp, calls = _patch_deep_requested(db, monkeypatch, override_dep, demo)
-    assert resp.status_code == 200, resp.text
-    assert calls == [], "demo must not schedule an immediate backfill"
-    # …and deep_requested is not persisted on the shared demo subscription either.
-    assert resp.json()["deep_requested"] is False
-
-
 class TestImmediateBackfillGuard:
     """backfill_channel_now coordinates with the paced scheduler through _backfill_in_progress (per-
     channel mutual exclusion, both directions) + _immediate_running (a cap on interactive runs so a
diff --git a/backend/tests/test_channel_list_index_only.py b/backend/tests/test_channel_list_index_only.py
index cdcbd72b..670b153c 100644
--- a/backend/tests/test_channel_list_index_only.py
+++ b/backend/tests/test_channel_list_index_only.py
@@ -1,4 +1,4 @@
-"""The channel manager's sums and the feed sidebar's counts read the index alone (E31 S4d).
+"""The channel manager's sums and the feed sidebar's counts read the index alone.
 
 `GET /api/channels` counts each subscribed channel's videos and sums their durations; `/feed/summary`
 and `/feed/years` count the reader's videos per channel and per year under the default filters. They
diff --git a/backend/tests/test_channel_tags.py b/backend/tests/test_channel_tags.py
index 1bd3a531..375673e7 100644
--- a/backend/tests/test_channel_tags.py
+++ b/backend/tests/test_channel_tags.py
@@ -1,4 +1,4 @@
-"""DB-backed regression (R8 Part 2): GET /api/channels/{id} returns exactly THIS user's personal
+"""DB-backed regression: GET /api/channels/{id} returns exactly THIS user's personal
 tag links for the channel — not another user's, and not the auto/system links (user_id NULL) —
 so the channel detail page can reuse the manager's tag editor. Would ship broken if the tag_ids
 query ever dropped its user_id filter.
diff --git a/backend/tests/test_collation.py b/backend/tests/test_collation.py
index 2558be23..84f9a1e8 100644
--- a/backend/tests/test_collation.py
+++ b/backend/tests/test_collation.py
@@ -1,4 +1,4 @@
-"""E30 S3: every A→Z list the server orders is in the reader's alphabet. The database image is Alpine,
+"""Every A→Z list the server orders is in the reader's alphabet. The database image is Alpine,
 whose `en_US.utf8` is BYTE order: "Életrajzi" and "Ötödik" sorted after "Zorró" in the feed, the channel
 list, the Plex grid, the genre list. Hungarian puts "Ö" after "O" and "Cs" after "Cu". Needs the DB."""
 
@@ -209,7 +209,7 @@ def test_channel_discovery_keeps_that_order_after_enriching(db, monkeypatch, ove
     assert [c["title"] for c in r.json()] == HU
 
 
-# --- The other lists the server puts in the reader's alphabet (E30 review): each call site, once. ---
+# --- The other lists the server puts in the reader's alphabet: each call site, once. ---
 
 
 def _others(db, n_offset: int = 0) -> list[User]:
@@ -221,30 +221,13 @@ def _others(db, n_offset: int = 0) -> list[User]:
     return users
 
 
-def test_the_share_and_message_recipients_are_in_the_readers_alphabet(
-    db, monkeypatch, override_dep
-):
-    from app.models import MessageKey
-
+def test_the_share_recipients_are_in_the_readers_alphabet(db, monkeypatch, override_dep):
     user = _user(db, "hu")
-    others = _others(db)
-    db.add_all(
-        MessageKey(
-            user_id=u.id,
-            public_key="k",
-            wrapped_private_key="w",
-            salt="s",
-            wrap_iv="i",
-            key_check="c",
-        )
-        for u in others
-    )
+    _others(db)
     db.commit()
     client = _client(db, user, monkeypatch, override_dep)
     emails = [r["email"] for r in client.get("/api/downloads/recipients").json()]
     assert emails == [f"{w.lower()}@example.com" for w in HU]
-    names = [r["name"] for r in client.get("/api/messages/users").json()]
-    assert names == HU
 
 
 def test_the_blocked_channels_are_in_the_readers_alphabet(db, monkeypatch, override_dep):
diff --git a/backend/tests/test_config_commit_ownership.py b/backend/tests/test_config_commit_ownership.py
index da035e58..e65a0033 100644
--- a/backend/tests/test_config_commit_ownership.py
+++ b/backend/tests/test_config_commit_ownership.py
@@ -1,4 +1,4 @@
-"""E3 S3 (B-core-10): the config/state mutators flush but do NOT self-commit, so the caller owns the
+"""The config/state mutators flush but do NOT self-commit, so the caller owns the
 transaction and a change lands together with its audit row. These lock that contract — a rollback
 before the caller commits discards the change (proving no hidden internal commit), while a same-session
 read still sees it (flush visibility). DB lane (`db` fixture) — skipped without Postgres.
diff --git a/backend/tests/test_db_lane.py b/backend/tests/test_db_lane.py
index c144a13a..7e2e0711 100644
--- a/backend/tests/test_db_lane.py
+++ b/backend/tests/test_db_lane.py
@@ -1,6 +1,6 @@
-"""Smoke test proving the DB-backed lane works (R6 S3b): a real commit round-trips, and each
+"""Smoke test proving the DB-backed lane works: a real commit round-trips, and each
 test starts from a clean database (TRUNCATE isolation), which is what lets the transaction-
-ownership tests (R6 S2) trust what they commit."""
+ownership tests trust what they commit."""
 
 from sqlalchemy import func, select
 
diff --git a/backend/tests/test_debug_sessions.py b/backend/tests/test_debug_sessions.py
index 30f20bc8..3972be56 100644
--- a/backend/tests/test_debug_sessions.py
+++ b/backend/tests/test_debug_sessions.py
@@ -1,8 +1,8 @@
-"""E16 S1 — debug sessions: Start → reproduce → Stop, the tag on every line, the screenshots.
+"""Debug sessions: Start → reproduce → Stop, the tag on every line, the screenshots.
 
 Four parts:
   * the session's life: one open per user, a second Start joins it, a Stop ends it, the cap ends it
-    on its own, the demo account cannot record, nobody reaches another user's session (DB lane);
+    on its own, nobody reaches another user's session (DB lane);
   * the tag: a request naming the caller's own open session is logged at its level with every line
     tagged, while a header naming anything else is ignored (a real sign-in through `_session_user`);
   * the browser's batches: a session counts as consent to its level, and only its own events keep
@@ -71,11 +71,6 @@ def test_only_the_two_raised_levels_can_be_recorded(db, make_user, as_user):
         assert client.post("/api/debug-sessions", json={"level": bogus}).status_code == 422
 
 
-def test_the_demo_account_cannot_record(db, make_user, as_user):
-    r = as_user(make_user(is_demo=True)).post("/api/debug-sessions", json={"level": "DEBUG"})
-    assert r.status_code == 403 and r.json()["detail"]["code"] == "demo"
-
-
 def test_stop_ends_it_and_me_stops_reporting_it(db, client, make_user):
     _signed_in(client, make_user)
     sid = _start(client)["id"]
@@ -779,11 +774,11 @@ def test_the_export_is_the_saved_draft_the_evidence_and_the_screenshots(db, make
     assert z.read("screenshot-1.png") == _PNG
 
 
-# --- the issue tracker (S4) -----------------------------------------------------------------
+# --- the issue tracker ----------------------------------------------------------------------
 
 
 class FakeGitea:
-    """Gitea 1.27 as measured (plans/e16 S0): a private repository, one file per asset upload, and
+    """Gitea 1.27 as measured: a private repository, one file per asset upload, and
     a way to make one upload fail."""
 
     def __init__(self):
diff --git a/backend/tests/test_demo_refusal_detail.py b/backend/tests/test_demo_refusal_detail.py
deleted file mode 100644
index 1a933508..00000000
--- a/backend/tests/test_demo_refusal_detail.py
+++ /dev/null
@@ -1,92 +0,0 @@
-"""The shared demo account's refusal says WHY, in the reader's language (deep-review round 6).
-
-`require_human` answered `403 "Not available in the demo account."` — a plain string. `req` leaves
-403 to the caller, and round 5 taught `notifyActionError` to discard a plain-string detail in favour
-of the caller's already-translated fallback, so from that commit on the demo user got a generic
-"couldn't do that" and no hint that the demo account was the reason. Not every affordance behind
-this gate is UI-gated on `is_demo` either — the comfort shelf is not, so the pin button is live.
-
-A structured `{code: "demo"}` is what `localizeDetail` can turn into `errors.demo` in both locales.
-Pinned at every site: the shared dependency, the two auth routes that hand-roll the same check,
-the account-delete route in `routes/me.py` — which round 6 missed while its docstring claimed
-all the sites were covered, so the next reader had no reason to look (round 7). An asymmetric fix is
-the smell this repo bans, and a docstring asserting symmetry it does not have is worse than none.
-
-The list is derived from the source, not typed out: `test_every_is_demo_refusal_is_on_the_list`
-below fails when a fifth `is_demo` 403 appears anywhere in `app/`, so this file cannot fall behind
-the code the way round 6's did. (E22 S5 added the fifth: raising the diagnostics level.) Needs the DB.
-"""
-
-import re
-from pathlib import Path
-
-from app.models import User
-
-
-def test_every_demo_refusal_carries_the_same_structured_reason(db, make_user, as_user):
-    demo = make_user(email="demo@example.com", is_demo=True)
-    client = as_user(demo)
-    for method, url, body in [
-        # `require_human` itself, through an affordance the UI does NOT gate on is_demo.
-        ("post", "/api/discover/pins", {"kind": "video", "ref": "v1"}),
-        # The three routes that repeat the check inline rather than depending on the gate.
-        ("post", "/auth/logout-others", None),
-        ("post", "/auth/set-password", {"password": "a long enough password"}),
-        ("delete", "/api/me/account", None),
-        # E22 S5: the shared account's log would interleave every visitor's session.
-        ("put", "/api/me/diagnostics", {"level": "DEBUG"}),
-    ]:
-        r = getattr(client, method)(url, **({"json": body} if body is not None else {}))
-        assert r.status_code == 403, (url, r.text)
-        detail = r.json()["detail"]
-        # Every one of them is a dict whose `code` the frontend can localize; the delete route adds
-        # a `reason` so its refusal can be worded specifically.
-        assert isinstance(detail, dict), (url, detail)
-        assert detail["code"] == "demo", (url, detail)
-
-
-def test_every_is_demo_refusal_is_on_the_list():
-    """A fifth site must not be able to appear unnoticed.
-
-    Round 6 converted three of four `is_demo` 403s and wrote a docstring saying it had converted
-    them all; the fourth kept answering a bare English string for another round because nothing
-    counted them. So count them here: every `is_demo`-guarded 403 in `app/` has to raise a
-    structured detail, and the number of them has to match what this file exercises."""
-    app_dir = Path(__file__).resolve().parents[1] / "app"
-    sites = []
-    for path in sorted(app_dir.rglob("*.py")):
-        lines = path.read_text(encoding="utf-8").splitlines()
-        for i, line in enumerate(lines):
-            # `if user.is_demo:` / `if u.is_demo and …:` — the hand-rolled gate, not the ORM
-            # filters (`User.is_demo.is_(False)`) and not the column definition.
-            if not re.search(r"^\s*if\s+\w+\.is_demo\b[^:]*:", line):
-                continue
-            block = "\n".join(lines[i : i + 6])
-            if "403" not in block:
-                continue
-            sites.append(f"{path.relative_to(app_dir)}:{i + 1}")
-            assert 'detail={"code": "demo"' in block, (
-                f"{path.relative_to(app_dir)}:{i + 1} refuses the demo account with an "
-                f"unstructured detail — the frontend cannot localize it:\n{block}"
-            )
-    # auth.py's shared gate + routes/auth.py's two + routes/me.py's delete and diagnostics level. A
-    # new one is welcome, but it has to be added to the loop above in the same commit.
-    assert len(sites) == 5, sites
-
-
-def test_a_real_account_is_not_refused_by_the_gate(db, make_user, as_user):
-    """The other half: the structured detail must not come from having broken the gate open the
-    other way. A non-demo account gets past `require_human` and fails (or succeeds) on its own
-    merits — anything but a 403 demo refusal."""
-    client = as_user(make_user(email="real@example.com"))
-    r = client.post("/auth/logout-others")
-    assert r.status_code == 200, r.text
-    assert not isinstance(r.json().get("detail"), dict)
-
-
-def test_the_gate_reads_the_flag_and_not_the_email(db):
-    """`is_demo` is a column, not a convention about the address — a real account that happens to
-    be called demo@ must not be refused."""
-    from app.auth import require_human
-
-    assert require_human(User(email="demo@example.com", is_demo=False)) is not None
diff --git a/backend/tests/test_diagnostics.py b/backend/tests/test_diagnostics.py
index 93ea40ce..9a10cd9d 100644
--- a/backend/tests/test_diagnostics.py
+++ b/backend/tests/test_diagnostics.py
@@ -1,8 +1,8 @@
-"""E22 S5 — a user's consented diagnostics level, and the browser log it lets in.
+"""A user's consented diagnostics level, and the browser log it lets in.
 
 Three parts:
-  * the level itself: the server computes its expiry, a lapsed one reads as the base, the demo
-    account cannot raise it (DB lane, through the real routes);
+  * the level itself: the server computes its expiry, a lapsed one reads as the base (DB lane,
+    through the real routes);
   * `POST /api/diagnostics/events`: refused at the base level, and nothing in a batch is trusted —
     the account comes from the session, everything is redacted again, events under the consented
     level are dropped, sizes and pace are capped (DB lane);
@@ -93,13 +93,6 @@ def test_only_the_three_levels_can_be_chosen(db, make_user, as_user):
         assert client.put("/api/me/diagnostics", json={"level": bogus}).status_code == 422
 
 
-def test_the_demo_account_can_return_to_the_base_but_never_raise_it(db, make_user, as_user):
-    client = as_user(make_user(is_demo=True))
-    r = client.put("/api/me/diagnostics", json={"level": "TRACE"})
-    assert r.status_code == 403 and r.json()["detail"]["code"] == "demo"
-    assert client.put("/api/me/diagnostics", json={"level": "INFO"}).status_code == 200
-
-
 def test_preferences_must_be_a_json_object(db, make_user, as_user):
     client = as_user(make_user())
     assert client.put("/api/me/preferences", json=["not", "an", "object"]).status_code == 422
diff --git a/backend/tests/test_discover.py b/backend/tests/test_discover.py
index a798393f..d40ee832 100644
--- a/backend/tests/test_discover.py
+++ b/backend/tests/test_discover.py
@@ -1,4 +1,4 @@
-"""E24 S1 — the Home surface's read-model.
+"""The Home surface's read-model.
 
 Covers the four things that can silently rot here: the time-budget bands (pure), the cross-source
 resume rail's merge order, the hero's tier ladder, and the comfort shelf (its schema-level one-of
@@ -632,7 +632,7 @@ def test_a_pinned_video_survives_leaving_the_feed_scope(db):
 
 def test_the_plex_surprise_obeys_the_time_budget(db):
     """The one control on the page has to mean what it says: a 100-minute film is not an answer to
-    "10 perc". The YouTube half of this rule has had its own test since S1; the Plex half's duration
+    "10 perc". The YouTube half of this rule has long had its own test; the Plex half's duration
     bounds could be deleted with the whole suite still green, because every test that reached
     `plex_surprise` passed budget="any"."""
     user, _ = _seed_yt(db)
@@ -923,7 +923,7 @@ def test_pinning_a_plex_show_resolves_to_the_episode_that_would_play(db, as_user
 
 def test_pinning_a_plex_movie_plays_itself_without_a_cycle(db, as_user):
     """The self-reference that once 500'd the whole shelf, on the other leaf kind: `next` has to be a
-    distinct dict, not the tile aliased into itself. Covered for a video since S1, never for a movie."""
+    distinct dict, not the tile aliased into itself. Long covered for a video, never for a movie."""
     user, _ = _seed_yt(db)
     _seed_plex(db, user)
     _enable_plex(db)
@@ -941,7 +941,7 @@ def test_the_reroll_endpoint_parses_its_whole_exclusion_list_and_its_press_count
     hero comes back.
 
     NOT the `MAX_EXCLUDE` clamp, which this sends three keys against a cap of 32 and cannot see. The
-    docstring used to claim it did (round 2). The clamp is deliberately left unpinned: it guards
+    docstring used to claim it did. The clamp is deliberately left unpinned: it guards
     nothing the route would otherwise do — see the constant's own comment — and a test that sent 33
     keys could only assert that the request still answers, which the comma split already proves."""
     user, _ = _seed_yt(db)
@@ -975,7 +975,7 @@ def test_pinning_something_that_does_not_exist_is_a_404(db, as_user):
 
 def test_a_pin_whose_target_vanishes_mid_request_is_a_404_not_a_500(db, as_user, monkeypatch):
     """`add_pin`'s `except IntegrityError` arm was reached by no test at all, so the 500→404
-    narrowing could be reverted with the whole suite green (round 2). The 404 above comes from the
+    narrowing could be reverted with the whole suite green. The 404 above comes from the
     `resolve_ref` PRE-CHECK, a different branch that returns before the INSERT.
 
     The race the arm exists for — a Plex sync dropping the row between `resolve_ref` confirming it
@@ -1091,7 +1091,7 @@ def test_two_overlapping_reorders_never_share_a_slot(db, as_user):
     row — two pins on one slot (deep review, debt burn). Locked, the second waits for the first and
     deals from its result: here a partial list (a tab with Plex off, one pin hidden), whose left-out
     pin must stay where the FIRST reorder put it — a lock taken in position order handed the waiter
-    fresh rows in its stale order, and it dealt that pin back to its old slot (round 2)."""
+    fresh rows in its stale order, and it dealt that pin back to its old slot."""
     import threading
 
     from app.db import SessionLocal
diff --git a/backend/tests/test_download_credentials.py b/backend/tests/test_download_credentials.py
index 3cc8af39..33314592 100644
--- a/backend/tests/test_download_credentials.py
+++ b/backend/tests/test_download_credentials.py
@@ -1,4 +1,4 @@
-"""S6 — per-user, per-host download cookies: host-scope, cache privacy, encryption, write-only API.
+"""Per-user, per-host download cookies: host-scope, cache privacy, encryption, write-only API.
 
 The two load-bearing security properties are covered as behaviour, not prose:
   * **cache privacy** — a cookie-authed download is a PRIVATE, salted asset; a second user without a
@@ -283,7 +283,7 @@ class TestResolveCookiefile:
 
 
 # --- Retry / Re-download take a cookie added later (DB) -----------------------------------------
-# Measured on dev (E11.5): a Facebook reel failed on the login wall, the user added their cookie as
+# Measured on dev: a Facebook reel failed on the login wall, the user added their cookie as
 # the failure copy tells them to, pressed Retry — and it failed again, because the job still held the
 # shared asset the worker never attaches a cookie to. Re-download forked a salt the gate could not
 # recognise, so even a job downloaded WITH a cookie rebuilt without it.
diff --git a/backend/tests/test_download_deprioritize.py b/backend/tests/test_download_deprioritize.py
index cfd769f1..0264a4c5 100644
--- a/backend/tests/test_download_deprioritize.py
+++ b/backend/tests/test_download_deprioritize.py
@@ -1,4 +1,4 @@
-"""Worker-child resource de-prioritization (S4): the encoder thread cap, the `-threads` flag on the
+"""Worker-child resource de-prioritization: the encoder thread cap, the `-threads` flag on the
 browser-safe re-encode, and the child's startup renice/ionice/OMP handicap. These keep a CPU-heavy
 transcode from pegging every core on the box it shares with the API, Postgres, and Plex playback."""
 
diff --git a/backend/tests/test_download_errors.py b/backend/tests/test_download_errors.py
index c97b55f2..285a5c5f 100644
--- a/backend/tests/test_download_errors.py
+++ b/backend/tests/test_download_errors.py
@@ -1,4 +1,4 @@
-"""Category classification of raw yt-dlp / ffmpeg download-failure strings (S2)."""
+"""Category classification of raw yt-dlp / ffmpeg download-failure strings."""
 
 from app.downloads import adapters
 from app.downloads import errors as dlerrors
@@ -71,7 +71,7 @@ def test_the_redacted_network_text_classifies_back_to_network():
     assert classify(dlerrors.NETWORK_REDACTED_MESSAGE) == "network"
 
 
-# Verbatim yt-dlp 2026.07.04 output from prod jobs, measured on dev 2026-09-13 (E11.5).
+# Verbatim yt-dlp 2026.07.04 output from prod jobs, measured on dev 2026-09-13.
 _FB_PARSE = (
     "ERROR: [facebook] 1736360027626346: Cannot parse data; please report this issue on  "
     "https://github.com/yt-dlp/yt-dlp/issues?q= , filling out the appropriate issue template."
@@ -196,7 +196,7 @@ def test_our_post_not_shown_verdict_is_the_refused_cookie():
 
 
 def test_our_post_without_a_video_verdict_names_the_group_link():
-    # The adapter's own text when the post page holds no single video (S4): the message and its rule and
+    # The adapter's own text when the post page holds no single video: the message and its rule and
     # catalog entry are pinned together, or an edit to the wording orphans the copy.
     msg = adapters.POST_WITHOUT_VIDEO_MESSAGE
     assert classify(msg) == "format_unavailable"
diff --git a/backend/tests/test_download_failure_catalog.py b/backend/tests/test_download_failure_catalog.py
index ae7341ab..ed585e64 100644
--- a/backend/tests/test_download_failure_catalog.py
+++ b/backend/tests/test_download_failure_catalog.py
@@ -1,4 +1,4 @@
-"""DB-backed tests for the download failure catalog (E11.5 S1) at the places a failure is WRITTEN.
+"""DB-backed tests for the download failure catalog at the places a failure is WRITTEN.
 
 `test_download_errors` pins which entry a message matches; these pin that every writer hands the
 matcher what it needs — the link and whether the user's cookie went with it — and that a stored entry
@@ -8,7 +8,7 @@ never outlives the failure it describes:
 - Retry / Re-download, which requeue the job;
 - the `0084` backfill of the rows that failed before the catalog existed;
 - the downloads list, which is how the entry reaches the UI.
-It also holds the one success-path check of the same child: the duration it stores (E11.5 S3).
+It also holds the one success-path check of the same child: the duration it stores.
 """
 
 import shutil
@@ -226,7 +226,7 @@ def test_the_downloads_list_carries_the_catalog_entry(db, as_user):
 
 @pytest.mark.skipif(shutil.which("ffmpeg") is None, reason="ffmpeg not available")
 def test_a_download_yt_dlp_gave_no_duration_stores_the_files_duration(db, monkeypatch, tmp_path):
-    # Facebook reel 257 (E11.5): yt-dlp's info had no duration, the asset stored NULL, and the Library
+    # Facebook reel 257: yt-dlp's info had no duration, the asset stored NULL, and the Library
     # row lost its trim action. Through the real finalize, with a real 3-second file.
     u = _user(db, "fb-duration@example.com")
     a, j = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
diff --git a/backend/tests/test_download_job_locks.py b/backend/tests/test_download_job_locks.py
index f55dbf13..a4f13d6c 100644
--- a/backend/tests/test_download_job_locks.py
+++ b/backend/tests/test_download_job_locks.py
@@ -1,4 +1,4 @@
-"""Overlapping requests on ONE job (E11.5 review) — DB-backed, two real sessions.
+"""Overlapping requests on ONE job — DB-backed, two real sessions.
 
 The routes that move a job's asset ref count (resume, cancel, delete, redownload) used to decide on an
 unlocked read: two overlapping requests for one job (a double-click, a second tab, a replay after a
diff --git a/backend/tests/test_download_limits.py b/backend/tests/test_download_limits.py
index ce216652..2237dbd3 100644
--- a/backend/tests/test_download_limits.py
+++ b/backend/tests/test_download_limits.py
@@ -1,4 +1,4 @@
-"""DB-backed tests for R12 · S5 backend residue — the two download limits:
+"""DB-backed tests for the two download limits:
 
 - **#2 claim fairness** (`worker._claim_job`): users already AT their per-user concurrency limit
   are excluded IN THE SQL, so one user flooding the queue past the fetch window can't starve
@@ -173,7 +173,7 @@ def test_list_downloads_is_capped(db, monkeypatch):
     assert len(rows) == 2  # bounded by the cap, not the 3 rows on disk
 
 
-# --- E12 · S3 · the worker-side max_bytes remainder ------------------------------------------
+# --- the worker-side max_bytes remainder ----------------------------------------------------------
 
 
 def _sized_asset(db, size_bytes, ref):
diff --git a/backend/tests/test_download_ref_count.py b/backend/tests/test_download_ref_count.py
index f2fced9e..3b8a52ae 100644
--- a/backend/tests/test_download_ref_count.py
+++ b/backend/tests/test_download_ref_count.py
@@ -1,4 +1,4 @@
-"""E3 S2 characterization net — MediaAsset.ref_count enqueue/release accounting (B-sub-5).
+"""Characterization net — MediaAsset.ref_count enqueue/release accounting.
 
 `ref_count` tracks how many DownloadJobs still hold a shared cache asset; when it hits zero a READY
 asset's file + row are freed. Enqueue +1's it and release_asset -1's it. Today those are Python
diff --git a/backend/tests/test_download_share_notice.py b/backend/tests/test_download_share_notice.py
index 39fab1cc..85c12376 100644
--- a/backend/tests/test_download_share_notice.py
+++ b/backend/tests/test_download_share_notice.py
@@ -1,4 +1,4 @@
-"""E30: the "shared with you" notice carries the download's title in its data, so the client can name
+"""The "shared with you" notice carries the download's title in its data, so the client can name
 the notice in the reader's language. Its stored title is an English sentence ("Cats was shared with
 you") — the only place the title lived, so a Hungarian reader got the English. Needs the DB."""
 
diff --git a/backend/tests/test_download_transitions.py b/backend/tests/test_download_transitions.py
index bb1ae4c7..67aab12f 100644
--- a/backend/tests/test_download_transitions.py
+++ b/backend/tests/test_download_transitions.py
@@ -1,4 +1,4 @@
-"""E3 S2 characterization net — download job state transitions (B-sub-8).
+"""Characterization net — download job state transitions.
 
 pause / resume / cancel / delete / redownload currently live inline in the routes, each hand-rolling
 the asset bookkeeping (release, error-reset, fresh-asset rebuild). This pins their OBSERVABLE HTTP
diff --git a/backend/tests/test_email_canonical.py b/backend/tests/test_email_canonical.py
index 4b3fed24..0a3c49f1 100644
--- a/backend/tests/test_email_canonical.py
+++ b/backend/tests/test_email_canonical.py
@@ -1,4 +1,4 @@
-"""One mailbox, many spellings — the canonical-email identity rule (E9.5 S3).
+"""One mailbox, many spellings — the canonical-email identity rule.
 
 Gmail delivers `x.y@gmail.com`, `xy@gmail.com` and `xy+tag@gmail.com` to ONE inbox. The invite gate
 used to compare literal strings, so on 2026-09-03 an approved user's Google sign-in became a silent
@@ -351,9 +351,9 @@ def test_me_reports_the_google_address_only_when_it_differs(client, db, make_use
 
 
 def test_rerunning_the_wizard_with_another_gmail_spelling_updates_the_same_admin(db):
-    """The wizard can be re-run, and E9.5's premise is that two spellings of one Gmail mailbox are one
+    """The wizard can be re-run, and the premise is that two spellings of one Gmail mailbox are one
     person. Resolving by the literal string here would create a SECOND admin row — exactly the
-    duplicate the epic exists to prevent. This site was outside S3's sweep (DX-17).
+    duplicate canonical email exists to prevent. This site was missed by the first sweep (DX-17).
 
     Calls the handler directly: `require_setup` is an instance-state gate, not the behaviour under
     test, and the test fixtures present an already-configured instance."""
diff --git a/backend/tests/test_empty_listing_guards.py b/backend/tests/test_empty_listing_guards.py
index 57a2c92d..0fcb44d1 100644
--- a/backend/tests/test_empty_listing_guards.py
+++ b/backend/tests/test_empty_listing_guards.py
@@ -1,11 +1,11 @@
-"""An empty answer is not an emptied library (E32 S2).
+"""An empty answer is not an emptied library.
 
 Every mirror here reconciles: what the remote no longer lists is removed locally. The catalog
 (`_prune_stale`) and the subscriptions (`should_prune`) had long refused to do that on an empty
 listing that contradicts what we hold — a 200 with no items is a blip far more often than a user
 who removed everything. Two mirrors did not: the Plex collections (a row carries the user-set
 `editable` flag, and every member its keys) and the YouTube playlist mirrors. These hold both — and,
-one level down (E32 review), a collection's members and a playlist's items: an empty answer that
+one level down, a collection's members and a playlist's items: an empty answer that
 contradicts the remote's own count is not believed either.
 """
 
@@ -174,7 +174,7 @@ class _YTOneGone(_YT):
 
 def test_a_list_deleted_mid_pull_is_skipped_and_the_rest_still_sync(db, make_user, monkeypatch):
     # Not "this playlist no longer exists" for a bulk pull the user never named a list in, and not
-    # a failure for every other list either (E32 review round 2): the next pull drops the mirror.
+    # a failure for every other list either: the next pull drops the mirror.
     user = make_user()
     db.commit()
     listing = [
diff --git a/backend/tests/test_facebook_impersonation.py b/backend/tests/test_facebook_impersonation.py
index 86b4fb83..fc5c7840 100644
--- a/backend/tests/test_facebook_impersonation.py
+++ b/backend/tests/test_facebook_impersonation.py
@@ -1,13 +1,13 @@
-"""E11.5 S3 + S4 — the Facebook download path with the user's cookie.
+"""The Facebook download path with the user's cookie.
 
-S3, measured on dev (yt-dlp 2026.07.04, the owner's cookie): reel 806379462330494 fails with the cookie
+Measured on dev (yt-dlp 2026.07.04, the owner's cookie): reel 806379462330494 fails with the cookie
 alone and extracts 2560p with `--impersonate chrome`; the reels that already download with the cookie
 keep their plain first attempt. These pin the attempt order through the real download loop
 (`pipeline._extract_with_fallback`, with yt-dlp faked at the `YoutubeDL` boundary), and that the
 LOCKED curl_cffi can actually impersonate — the pair only works inside yt-dlp's own version range, and
 outside it every target silently reports "unavailable".
 
-S4, measured on dev and in the owner's Chrome: given a group post's link, yt-dlp finds no formats or
+Measured on dev and in the owner's Chrome: given a group post's link, yt-dlp finds no formats or
 downloads another video from the page's feed. The post's own video is the single Video node in the
 page scripts that carry the post id (prod posts 66, 145, 140, 143, 221; text posts have none while the
 page holds ~10 other videos), and its watch link downloads.
@@ -139,7 +139,7 @@ def test_other_facebook_failures_are_not_retried_as_chrome(ydl, tmp_path):
     assert len(seen) == 1 and "impersonate" not in seen[0]
 
 
-# --- S4: a group post downloads ITS video, or fails saying it has none ----------------------------
+# --- a group post downloads ITS video, or fails saying it has none --------------------------------
 
 
 def test_a_cookie_group_post_downloads_the_posts_own_video(ydl, tmp_path):
@@ -174,7 +174,7 @@ def test_a_group_post_without_a_single_video_fails_saying_so(ydl, tmp_path):
 
 
 def test_a_group_post_page_without_the_post_is_the_refused_cookie(ydl, tmp_path):
-    # Measured with a refused cookie (E11.5 review): Facebook answers the post link with its login page —
+    # Measured with a refused cookie: Facebook answers the post link with its login page —
     # a login form, no post id anywhere. Saying "this post has no video" would blame the post.
     _, _, web = ydl
     web["page"] = '<html><title>ChatGPT magyarul</title><form id="login_form"></form></html>'
diff --git a/backend/tests/test_failure_lines.py b/backend/tests/test_failure_lines.py
index 80b1f6b4..431fc8d8 100644
--- a/backend/tests/test_failure_lines.py
+++ b/backend/tests/test_failure_lines.py
@@ -1,4 +1,4 @@
-"""E22.5 review round 1: a failure is reported once, with its code, and a repeating one is not a
+"""A failure is reported once, with its code, and a repeating one is not a
 flood.
 
 Each case here is a place where the first sweep got the line wrong in one of two directions: a
diff --git a/backend/tests/test_feed_relevance_window.py b/backend/tests/test_feed_relevance_window.py
index 396d37b6..bd1b1dee 100644
--- a/backend/tests/test_feed_relevance_window.py
+++ b/backend/tests/test_feed_relevance_window.py
@@ -1,4 +1,4 @@
-"""Relevance ranks only the newest RANK_WINDOW matches (E31), DB-lane.
+"""Relevance ranks only the newest RANK_WINDOW matches, DB-lane.
 
 A broad word ("a") matched most of the prod library and ts_rank read every match's tsvector: 6.8 s a page.
 The ranking now covers the newest RANK_WINDOW matches and the rest follow newest first. The window's start
@@ -126,7 +126,7 @@ def test_cursor_walk_matches_the_unpaged_order(db, as_user, monkeypatch, window,
 )
 def test_a_hand_made_relevance_cursor_is_refused_not_a_crash(db, as_user, payload):
     # The page halves compare the cursor's timestamp with the window's in Python: a null or a naive
-    # one raised there, past the route's 400 — a 500 (E31 review 2).
+    # one raised there, past the route's 400 — a 500.
     client = as_user(_seed(db))
     cursor = base64.urlsafe_b64encode(json.dumps(payload).encode()).decode()
     resp = client.get(f"/api/feed?q=foo&sort=relevance&limit=2&cursor={cursor}")
diff --git a/backend/tests/test_feed_sort_indexes.py b/backend/tests/test_feed_sort_indexes.py
index 1184c68e..d0f5943a 100644
--- a/backend/tests/test_feed_sort_indexes.py
+++ b/backend/tests/test_feed_sort_indexes.py
@@ -1,4 +1,4 @@
-"""Every feed sort on a videos column rides an index, and an ICU upgrade rebuilds the title ones (E31 S4e).
+"""Every feed sort on a videos column rides an index, and an ICU upgrade rebuilds the title ones.
 
 Without an index in the exact ORDER BY, each feed page read the whole videos heap and kept a top-N
 (prod: 350 ms a page for views/duration, 550–780 ms for title). Migration 0096 adds one per direction
diff --git a/backend/tests/test_feed_views.py b/backend/tests/test_feed_views.py
index ec8d8c78..46f35401 100644
--- a/backend/tests/test_feed_views.py
+++ b/backend/tests/test_feed_views.py
@@ -1,4 +1,4 @@
-"""Feed search + watch-state views (E2 S3), DB-lane.
+"""Feed search + watch-state views, DB-lane.
 
 Regression nets for two query rewrites that must stay behaviour-equivalent:
 - PERF-12: the search channel-name branch moved from an ORed `unaccent(channels.title) ILIKE` (which
@@ -178,7 +178,7 @@ _SUMMARY_CASES = [
 
 def test_a_deleted_tags_id_filters_to_nothing_not_to_everything(db, as_user, make_user):
     """A saved view or the feed's filter state keeps a tag id after the tag is deleted. The feed used
-    to drop an unknown id, so that view silently showed the WHOLE feed under its old name (E32 S2).
+    to drop an unknown id, so that view silently showed the WHOLE feed under its old name.
     A filter on a tag that no longer exists matches nothing; the chip says the tag is gone."""
     user, tag_ids = _seed_tagged(db, make_user)
     client = as_user(user)
@@ -196,8 +196,8 @@ def test_a_deleted_tags_id_filters_to_nothing_not_to_everything(db, as_user, mak
 
 def test_another_users_private_tag_answers_like_one_that_does_not_exist(db, as_user, make_user):
     """The category split resolved any tag id, so a foreign PRIVATE tag landed in its real category
-    and the summary's facets differed from a non-existent id's: an oracle for which foreign ids exist
-    (E32 review). Both must now read as "missing"."""
+    and the summary's facets differed from a non-existent id's: an oracle for which foreign ids exist.
+    Both must now read as "missing"."""
     user, tag_ids = _seed_tagged(db, make_user)
     stranger = make_user(email="stranger@example.com")
     private = Tag(user_id=stranger.id, name="Secret", category="language")
@@ -247,7 +247,7 @@ def test_untagged_filter_keeps_only_channels_the_user_has_not_tagged(db, as_user
 def test_feed_years_counts_ignore_the_date_narrowing_but_honour_other_filters(
     db, as_user, make_user
 ):
-    """The year facet (item 8 / E8·S2): `/api/feed/years` returns a per-year video count, newest first,
+    """The year facet: `/api/feed/years` returns a per-year video count, newest first,
     with the publish-date narrowing DROPPED (so switching years stays a drill-down) but every other
     filter still applied (here: a channel pick)."""
     user = make_user(email="years@example.com")
diff --git a/backend/tests/test_formats.py b/backend/tests/test_formats.py
index c49cb97b..abf79b1c 100644
--- a/backend/tests/test_formats.py
+++ b/backend/tests/test_formats.py
@@ -1,7 +1,7 @@
-"""build_ydl_opts: EVERY download is clamped to the mp4/H.264 compat profile (E7 browser-
+"""build_ydl_opts: EVERY download is clamped to the mp4/H.264 compat profile (the browser-
 playability guarantee) and must SELECT H.264 (not merely prefer it), so shared downloads play in
 every browser incl. iOS/Safari. Non-mp4 containers and non-H.264 vcodecs are coerced, not honoured.
-See the iPad AV1 broken-player fix + E7 format narrowing."""
+See the iPad AV1 broken-player fix + the format narrowing."""
 
 from app.downloads import edit as editmod
 from app.downloads import formats
@@ -58,7 +58,7 @@ def test_max_height_caps_every_branch():
 
 
 def test_explicit_vcodec_is_clamped_to_the_compat_selector():
-    # E7 browser-playability guarantee: a non-H.264 vcodec no longer opts out — normalize() coerces
+    # Browser-playability guarantee: a non-H.264 vcodec no longer opts out — normalize() coerces
     # vcodec→None, so the avc1 selector (and mp4 merge) is used regardless of what was requested.
     opts = _opts({"mode": "av", "container": "mp4", "vcodec": "vp9"})
     assert opts["format"].startswith("bestvideo[vcodec^=avc1]")
diff --git a/backend/tests/test_google_callback.py b/backend/tests/test_google_callback.py
new file mode 100644
index 00000000..bb863a5e
--- /dev/null
+++ b/backend/tests/test_google_callback.py
@@ -0,0 +1,260 @@
+"""The Google callback's account-matching branches, through the real route, DB-lane.
+
+Each `select()` here was rewritten from a `.query()` without a test that drove it, and one branch —
+adopting an existing row — is where a no-SMTP squat of an env-allowed address turned into an admin
+account with the squatter's password. These pin the adoption (and what it revokes), its two refusals,
+the refused sign-in that doubles as an access request, and the link flow's conflict answers.
+"""
+
+import pytest
+from sqlalchemy import select
+from starlette.responses import RedirectResponse
+
+from app.config import settings
+from app.models import Invite, User
+from app.routes import auth as auth_routes
+
+_PW = "correct horse battery"
+
+
+class _FakeGoogle:
+    """authlib's client, reduced to the two calls the routes make: the redirect out to Google and
+    the token exchange when Google redirects back."""
+
+    def __init__(self, userinfo: dict):
+        self.userinfo = userinfo
+
+    async def authorize_redirect(self, _request, _redirect_uri, **_kw):
+        return RedirectResponse(url="/fake-google")
+
+    async def authorize_access_token(self, _request):
+        return {"userinfo": self.userinfo, "access_token": "at", "scope": "openid email profile"}
+
+
+@pytest.fixture
+def google(monkeypatch):
+    from cryptography.fernet import Fernet
+
+    from app import security
+
+    # The callback stores the OAuth grant encrypted; a throwaway key stands in for TOKEN_ENCRYPTION_KEY.
+    monkeypatch.setattr(security, "_fernet", Fernet(Fernet.generate_key()))
+    fake = _FakeGoogle({})
+    monkeypatch.setattr(auth_routes, "google_oauth", lambda _db: fake)
+    return fake
+
+
+def _sign_in(client, google, **userinfo):
+    google.userinfo = {"email_verified": True, **userinfo}
+    return client.get("/auth/callback", follow_redirects=False)
+
+
+def _rows(db, model, column, value):
+    db.expire_all()
+    return db.execute(select(model).where(column == value)).scalars().all()
+
+
+def test_a_no_smtp_squat_of_an_admin_address_loses_its_password(client, db, google, monkeypatch):
+    # A stranger registers the ADMIN_EMAILS address (a sibling spelling will do) before its owner
+    # does. Without SMTP the row is marked verified, and an env-allowed address gets no invite row
+    # to gate it — so the owner's first Google sign-in activates THIS row as admin. The squatter's
+    # password must not survive that.
+    monkeypatch.setattr(auth_routes.email_mod, "email_enabled", lambda db=None: False)
+    monkeypatch.setattr(auth_routes, "notify_admins_of_request", lambda *_a, **_k: None)
+    monkeypatch.setattr(settings, "admin_emails", "bob@gmail.com")
+    auth_routes._register_account("b.ob@gmail.com", "the squatter's own")
+    [squat] = _rows(db, User, User.email, "b.ob@gmail.com")
+    assert squat.email_verified is True and squat.is_active is False
+
+    r = _sign_in(client, google, sub="sub-bob", email="bob@gmail.com")
+
+    assert r.headers["location"] == "/"
+    [owner] = _rows(db, User, User.email_canonical, squat.email_canonical)
+    assert (owner.id, owner.role, owner.is_active) == (squat.id, "admin", True)
+    assert owner.password_hash is None and owner.password_revoked_at is not None
+    assert (
+        client.post(
+            "/auth/password-login",
+            json={"email": "b.ob@gmail.com", "password": "the squatter's own"},
+        ).status_code
+        == 401
+    )
+
+
+def test_an_activated_squat_loses_its_password_when_the_sign_in_makes_it_admin(
+    client, db, google, make_user, monkeypatch
+):
+    # The same squat after an admin clicked Activate on it: activation vouches for access, not for
+    # who chose the password, and without SMTP nothing else ever proved the mailbox. ADMIN_EMAILS
+    # must not raise the squatter's live session to admin.
+    monkeypatch.setattr(auth_routes.email_mod, "email_enabled", lambda db=None: False)
+    monkeypatch.setattr(settings, "admin_emails", "bob@gmail.com")
+    squat = make_user(email="b.ob@gmail.com", password="the squatter's own", is_active=True)
+    squatter = client.__class__(client.app)
+    assert (
+        squatter.post(
+            "/auth/password-login",
+            json={"email": "b.ob@gmail.com", "password": "the squatter's own"},
+        ).status_code
+        == 200
+    )
+
+    _sign_in(client, google, sub="sub-bob", email="bob@gmail.com")
+
+    db.refresh(squat)
+    assert squat.role == "admin"
+    assert squat.password_hash is None and squat.password_revoked_at is not None
+    assert squatter.get("/api/me").json() == {"authenticated": False}
+
+
+def test_with_smtp_too_an_account_made_admin_loses_its_password(
+    client, db, google, make_user, monkeypatch
+):
+    # SMTP configured now says nothing about a row verified before it was: the rule does not ask.
+    monkeypatch.setattr(auth_routes.email_mod, "email_enabled", lambda db=None: True)
+    monkeypatch.setattr(settings, "admin_emails", "own@example.com")
+    user = make_user(email="own@example.com", password=_PW, is_active=True)
+
+    _sign_in(client, google, sub="sub-own", email="own@example.com")
+
+    db.refresh(user)
+    assert user.role == "admin" and user.password_hash is None
+    # …and the owner, signed in through Google, is not thrown out by the epoch bump.
+    assert client.get("/api/me").json()["id"] == user.id
+
+
+def test_a_later_sign_in_that_makes_the_account_admin_drops_its_password(
+    client, db, google, make_user, monkeypatch
+):
+    # Adopted while the address was only allowed (the password kept: nothing promoted it), then
+    # added to ADMIN_EMAILS: the promotion happens on a sign-in matched by Google identity.
+    user = make_user(email="later@example.com", password=_PW, is_active=True, google_sub="sub-l")
+    monkeypatch.setattr(settings, "admin_emails", "later@example.com")
+
+    _sign_in(client, google, sub="sub-l", email="later@example.com")
+
+    db.refresh(user)
+    assert user.role == "admin"
+    assert user.password_hash is None and user.password_revoked_at is not None
+
+
+def test_an_admin_sign_in_keeps_an_admin_password(client, db, google, make_user, monkeypatch):
+    # Only the promotion drops it: an account that is already admin signs in as before.
+    user = make_user(email="boss@example.com", password=_PW, role="admin", google_sub="sub-b")
+    monkeypatch.setattr(settings, "admin_emails", "boss@example.com")
+
+    _sign_in(client, google, sub="sub-b", email="boss@example.com")
+
+    db.refresh(user)
+    assert user.password_hash is not None
+
+
+def test_adopting_an_account_already_let_in_keeps_its_password(
+    client, db, google, make_user, monkeypatch
+):
+    # The revoke is for passwords nobody vouched for; an active, verified account that this sign-in
+    # does not make admin keeps its own.
+    monkeypatch.setattr(auth_routes.email_mod, "email_enabled", lambda db=None: False)
+    user = make_user(email="kept@example.com", password=_PW, is_active=True)
+    monkeypatch.setattr(settings, "allowed_emails", "kept@example.com")
+
+    _sign_in(client, google, sub="sub-kept", email="kept@example.com")
+
+    db.refresh(user)
+    assert user.google_sub == "sub-kept"
+    assert user.password_hash is not None and user.password_revoked_at is None
+
+
+def test_adoption_matches_the_mailbox_not_the_spelling(client, db, google, make_user, monkeypatch):
+    user = make_user(email="pair.one@gmail.com", is_active=True)
+    monkeypatch.setattr(settings, "admin_emails", "pairone@gmail.com")
+
+    _sign_in(client, google, sub="sub-pair", email="pairone@gmail.com")
+
+    assert [u.id for u in _rows(db, User, User.email_canonical, user.email_canonical)] == [user.id]
+    db.refresh(user)
+    assert user.google_sub == "sub-pair"
+
+
+def test_a_different_google_identity_on_the_address_is_refused(
+    client, db, google, make_user, monkeypatch
+):
+    user = make_user(email="held@example.com", google_sub="sub-first", is_active=True)
+    monkeypatch.setattr(settings, "admin_emails", "held@example.com")
+
+    r = _sign_in(client, google, sub="sub-second", email="held@example.com")
+
+    assert "access=denied" in r.headers["location"]
+    db.refresh(user)
+    assert user.google_sub == "sub-first"
+
+
+def test_an_unverified_google_address_does_not_adopt(client, db, google, make_user, monkeypatch):
+    user = make_user(email="pending@example.com", is_active=False, email_verified=False)
+    monkeypatch.setattr(settings, "admin_emails", "pending@example.com")
+
+    google.userinfo = {"sub": "sub-unv", "email": "pending@example.com", "email_verified": False}
+    r = client.get("/auth/callback", follow_redirects=False)
+
+    assert "access=denied" in r.headers["location"]
+    db.refresh(user)
+    assert (user.google_sub, user.is_active) == (None, False)
+
+
+def test_a_refused_sign_in_records_a_request_in_the_reported_language(
+    client, db, google, monkeypatch
+):
+    notified: list[str] = []
+    monkeypatch.setattr(
+        auth_routes, "notify_admins_of_request", lambda _db, _bg, email: notified.append(email)
+    )
+
+    r = _sign_in(client, google, sub="sub-new", email="new@example.com", locale="hu-HU")
+
+    assert "access=requested" in r.headers["location"]
+    [invite] = _rows(db, Invite, Invite.email, "new@example.com")
+    assert (invite.status, invite.lang) == ("pending", "hu")
+    assert notified == ["new@example.com"]
+    assert _rows(db, User, User.email, "new@example.com") == []
+
+
+def _start_link(client, email: str):
+    assert (
+        client.post("/auth/password-login", json={"email": email, "password": _PW}).status_code
+        == 200
+    )
+    assert client.get("/auth/link", follow_redirects=False).headers["location"] == "/fake-google"
+
+
+def test_linking_an_identity_another_account_holds_is_a_conflict(client, db, google, make_user):
+    me = make_user(email="me@example.com")
+    make_user(email="them@example.com", google_sub="sub-theirs")
+    _start_link(client, "me@example.com")
+
+    r = _sign_in(client, google, sub="sub-theirs", email="them@example.com")
+
+    assert r.headers["location"] == "/?link=conflict"
+    db.refresh(me)
+    assert me.google_sub is None
+
+
+def test_linking_a_second_identity_is_a_mismatch(client, db, google, make_user):
+    me = make_user(email="me2@example.com", google_sub="sub-mine")
+    _start_link(client, "me2@example.com")
+
+    r = _sign_in(client, google, sub="sub-other", email="other@example.com")
+
+    assert r.headers["location"] == "/?link=mismatch"
+    db.refresh(me)
+    assert me.google_sub == "sub-mine"
+
+
+def test_linking_a_free_identity_attaches_it(client, db, google, make_user):
+    me = make_user(email="me3@example.com")
+    _start_link(client, "me3@example.com")
+
+    r = _sign_in(client, google, sub="sub-free", email="me3.google@example.com")
+
+    assert r.headers["location"] == "/?link=ok"
+    db.refresh(me)
+    assert (me.google_sub, me.google_email) == ("sub-free", "me3.google@example.com")
diff --git a/backend/tests/test_hls_reaper.py b/backend/tests/test_hls_reaper.py
index 50babeae..6b88dea9 100644
--- a/backend/tests/test_hls_reaper.py
+++ b/backend/tests/test_hls_reaper.py
@@ -2,15 +2,15 @@
 
 plex/stream.py promises "a periodic reaper kills idle ones", but `reap_idle` ran only inside
 POST /session: after the last playback, an abandoned session (its ffmpeg still working through the
-film, its directory a whole segmented copy of it) lived until somebody pressed play again
-(deep-review round 4).
+film, its directory a whole segmented copy of it) lived until somebody pressed play again.
 
 And it must not take a PAUSED viewer's session: a remux finishes long before the film does, and a
 paused player with a full buffer fetches nothing, so "finished and unfetched for 30 s" does not mean
-"abandoned". Round 4 bought that safety by keeping EVERY finished session for the full ten-minute
-idle window — one segmented copy of a film per item, on the volume the download center shares. Round
-5 replaced the blanket retention with the signal that already existed: an open player checkpoints its
-position every 10 s whether or not it is playing, and that route says "still here".
+"abandoned". An earlier fix bought that safety by keeping EVERY finished session for the full
+ten-minute idle window — one segmented copy of a film per item, on the volume the download center
+shares. Its successor replaced the blanket retention with the signal that already existed: a player
+parked mid-item checkpoints its position every 10 s, paused or not, and that route says "still
+here" (it stops once the item is finished, where reaping is correct).
 
 Both call sites are pinned here, because the bug each time was that only one of them moved: the
 periodic pass, and the fact that starting a session no longer sweeps OTHER viewers' sessions at all.
@@ -174,7 +174,7 @@ def test_starting_a_session_leaves_another_viewers_paused_one_alone(
 ):
     """The opportunistic sweep this route used to run was not scoped to the key being started: it
     walked the WHOLE registry with the 30 s finished rule, so pressing play on any item killed a
-    paused viewer's session — the very case round 4 set out to protect (found in round 5)."""
+    paused viewer's session — the very case the retention fix set out to protect."""
     monkeypatch.setattr(state, "_configured_cache", True)
     monkeypatch.setattr(plex_paths, "local_media_path", lambda db_, fp: "/local/a.mkv")
     started = _library_item(db, "starting")
diff --git a/backend/tests/test_last_login.py b/backend/tests/test_last_login.py
index 9b27aaff..2ee163e0 100644
--- a/backend/tests/test_last_login.py
+++ b/backend/tests/test_last_login.py
@@ -1,15 +1,14 @@
-"""`users.last_login_at` (E22 S1), DB-lane.
+"""`users.last_login_at`, DB-lane.
 
 The roadmap assumed stamping it in `_establish_session` would cover Google and password alike. It
 would not have: only password login called it, and the Google callback carried its own copy of the
-same four lines. So these pin BOTH doors through the real routes — plus the two that must not stamp
-(a refused password, the shared demo account) and the admin list that shows it.
+same four lines. So these pin BOTH doors through the real routes — plus the one that must not stamp
+(a refused password) and the admin list that shows it.
 """
 
 from datetime import datetime, timedelta, timezone
 
 from app.config import settings
-from app.models import DemoWhitelist
 from app.routes import auth as auth_routes
 
 _PW = "correct horse battery"
@@ -73,18 +72,6 @@ def test_a_google_sign_in_stamps_last_login(client, db, make_user, monkeypatch):
     assert client.get("/api/me").json()["id"] == user.id
 
 
-def test_the_demo_entry_does_not_stamp_the_shared_account(client, db):
-    db.add(DemoWhitelist(email="visitor@example.com"))
-    db.commit()
-
-    r = client.post("/auth/demo", json={"email": "visitor@example.com"})
-
-    assert r.json() == {"ok": True, "authenticated": True}
-    demo = auth_routes.get_or_create_demo_user(db)
-    db.refresh(demo)
-    assert demo.last_login_at is None
-
-
 def test_the_admin_user_list_carries_last_login(as_user, db, make_user):
     admin = make_user(email="boss@example.com", role="admin")
     never = make_user(email="never@example.com")
diff --git a/backend/tests/test_links.py b/backend/tests/test_links.py
index 0dd5460c..78c18096 100644
--- a/backend/tests/test_links.py
+++ b/backend/tests/test_links.py
@@ -99,7 +99,7 @@ class TestPublicMetaAudioFlag:
 
 
 class TestCreateLinkDefault:
-    """D1 (E7 S3): a newly minted share link is downloadable by default. The one-click Share relies on
+    """D1: a newly minted share link is downloadable by default. The one-click Share relies on
     this — it POSTs no `allow_download`, so the API default decides. Forward-only lives here (the API
     default), NOT in a migration: the DownloadLink column default stays False, so no existing back-
     catalogue link silently flips to downloadable."""
diff --git a/backend/tests/test_log_pii.py b/backend/tests/test_log_pii.py
index fe523eb9..13309d35 100644
--- a/backend/tests/test_log_pii.py
+++ b/backend/tests/test_log_pii.py
@@ -1,4 +1,4 @@
-"""E22.5 S1 — what a log line may NOT carry.
+"""What a log line may NOT carry.
 
 `logs.redact_text` is a safety net over addresses and credential params, and it was doing the whole
 job: every one of these call sites was putting user content into a line and relying on the net to
diff --git a/backend/tests/test_logger_names.py b/backend/tests/test_logger_names.py
index 033e2c1d..a671703a 100644
--- a/backend/tests/test_logger_names.py
+++ b/backend/tests/test_logger_names.py
@@ -1,9 +1,9 @@
-"""E22.5 S2 — every module's logger is named after the module.
+"""Every module's logger is named after the module.
 
 The names used to be literals, and 25 of them covered 34 modules: `plex/client.py`, `plex/stream.py`,
 `plex/subtitles.py`, `plex/sync.py` and two route modules all called themselves `siftlode.plex`, and
 `downloads/pipeline.py` called itself `siftlode.worker`. A level pinned per logger could not separate
-them, and neither can E22.6's console filter — the `logger` field is in every stored row precisely so
+them, and neither can the console's filter — the `logger` field is in every stored row precisely so
 it can be filtered on.
 
 So the name is derived, not written: `logs.get_logger(__name__)`. These cases pin the derivation and
diff --git a/backend/tests/test_login_states.py b/backend/tests/test_login_states.py
index 9b243853..b705e132 100644
--- a/backend/tests/test_login_states.py
+++ b/backend/tests/test_login_states.py
@@ -1,10 +1,10 @@
-"""What a refused sign-in SAYS (E9.5 S4), DB-lane.
+"""What a refused sign-in SAYS, DB-lane.
 
 The states behind a 403 were true and useless: "Your account is awaiting admin approval." never
 revealed WHICH mailbox the account was on. On 2026-09-03 a registration as `npeter83.temu@gmail.com`
 met a Google claim of `npeter83temu@gmail.com`, and that missing address hid the mismatch for a day.
-So these pin the DETAIL, not just the status code — the address, and both gates, since E9.5 S1 made
-the two order-independent and the screen must report whichever is actually outstanding.
+So these pin the DETAIL, not just the status code — the address, and both gates, since the two are
+order-independent and the screen must report whichever is actually outstanding.
 
 The two refusals that answer BEFORE the password is proven carry nothing, and that is the security
 half of the same contract: `invalid` must stay byte-identical for a real account and an unknown one.
@@ -34,7 +34,7 @@ def test_pending_approval_names_the_address_the_account_is_on(client, make_user)
 
 
 def test_an_already_approved_account_still_reports_its_missing_verification(client, make_user):
-    # S1 made the gates order-independent, so this really happens: approved, not yet verified. A
+    # The gates are order-independent, so this really happens: approved, not yet verified. A
     # screen that assumed a sequence would tell this user to wait for an admin who already decided.
     make_user(
         email="approved.first@example.com", password=_PW, email_verified=False, is_active=True
diff --git a/backend/tests/test_logs.py b/backend/tests/test_logs.py
index 0d77f296..b28ea20c 100644
--- a/backend/tests/test_logs.py
+++ b/backend/tests/test_logs.py
@@ -1,4 +1,4 @@
-"""E22 S2 — the one logging configuration, its redaction, and the request line that replaced
+"""The one logging configuration, its redaction, and the request line that replaced
 uvicorn's access log.
 
 Redaction is the part worth guarding hardest: it is applied at the HANDLER, so these cases are the
@@ -148,7 +148,7 @@ def test_every_line_carries_the_agreed_fields(sink):
 
 
 def test_a_plain_log_call_still_produces_a_well_formed_line(sink):
-    """An event code is optional — 125 existing call sites have none yet (E22.5 adds them), and they
+    """An event code is optional — 125 existing call sites have none yet, and they
     must not be worse off than before this module."""
     logging.getLogger("siftlode.test").warning("just a message")
     payload = sink.objects()[-1]
@@ -219,11 +219,11 @@ def _client() -> TestClient:
             raise HTTPException(status_code=400, detail={"code": "bad_cursor"})
         return {"ok": True}
 
-    @app.get("/api/messages/unread_count")
+    @app.get("/api/me/notifications/unread_count")
     def _unread():
         return {"count": 0}
 
-    @app.post("/api/messages/unread_count")
+    @app.post("/api/me/notifications/unread_count")
     def _unread_write():
         return {"ok": True}
 
@@ -337,11 +337,11 @@ def test_a_polled_read_is_debug_a_write_to_the_same_route_is_not(sink):
     http = logging.getLogger("siftlode.http")
     http.setLevel(logs.TRACE)
     client = _client()
-    r = client.get("/api/messages/unread_count")
+    r = client.get("/api/me/notifications/unread_count")
     assert sink.objects()[-1]["level"] == "DEBUG"
     # ...and says so, for the browser's copy of the line (frontend lib/http.ts).
     assert r.headers["X-Log-Quiet"] == "1"
-    r = client.post("/api/messages/unread_count")
+    r = client.post("/api/me/notifications/unread_count")
     assert sink.objects()[-1]["level"] == "INFO"
     assert "X-Log-Quiet" not in r.headers
     assert client.get("/api/videos/abc").status_code == 200
diff --git a/backend/tests/test_logsink.py b/backend/tests/test_logsink.py
index f0965c9f..d2dc11c0 100644
--- a/backend/tests/test_logsink.py
+++ b/backend/tests/test_logsink.py
@@ -1,4 +1,4 @@
-"""E22 S3 — the `log_events` sink: what reaches the table, in what shape, and what it refuses to do.
+"""The `log_events` sink: what reaches the table, in what shape, and what it refuses to do.
 
 The sink is driven synchronously (`write_pending()` on the test's own thread) so nothing here waits on
 a timer. It is attached to a private logger rather than the root, for the same reason test_logs.py's
diff --git a/backend/tests/test_mail_language.py b/backend/tests/test_mail_language.py
index f5ef1b7d..3ecf928e 100644
--- a/backend/tests/test_mail_language.py
+++ b/backend/tests/test_mail_language.py
@@ -1,4 +1,4 @@
-"""E9.5 S7 — every outbound mail is written in the reader's language.
+"""Every outbound mail is written in the reader's language.
 
 Two halves. The first is the catalog invariant: HU/EN parity with identical placeholders, enforced
 here because a mail is the one user-facing surface nobody can re-render by switching the UI language
@@ -131,6 +131,12 @@ def test_the_lookup_is_canonical_like_every_other_identity_match(db, make_user):
 # --- capturing the signal at the one moment it exists ---------------------------------------------
 
 
+def _ask(db, lang: str) -> None:
+    """A pending request carrying the language it was made in — what a refused Google sign-in records
+    (with the locale Google reported), through the one function every entry point shares."""
+    auth_routes.upsert_pending_invite(db, "asking@example.com", lang)
+
+
 def test_registration_records_the_language_of_the_sign_up_page(db, client):
     r = client.post(
         "/auth/register", json={"email": "signup@example.com", "password": _PW, "lang": "hu"}
@@ -141,46 +147,26 @@ def test_registration_records_the_language_of_the_sign_up_page(db, client):
     assert (user.preferences or {}).get("language") == "hu"
 
 
-def test_an_access_request_records_the_language_it_was_made_in(db, client):
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
-        ).status_code
-        == 200
-    )
+def test_an_access_request_records_the_language_it_was_made_in(db):
+    _ask(db, "hu")
 
     inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
     assert inv.lang == "hu"
 
 
-def test_asking_again_from_another_language_updates_the_row(db, client):
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "en"}
-        ).status_code
-        == 200
-    )
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
-        ).status_code
-        == 200
-    )
+def test_asking_again_from_another_language_updates_the_row(db):
+    _ask(db, "en")
+    _ask(db, "hu")
 
     db.expire_all()
     inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
-    # The newest thing they told us wins — and there is still exactly one row (S3's canonical upsert).
+    # The newest thing they told us wins — and there is still exactly one row (the canonical upsert).
     assert inv.lang == "hu"
     assert db.execute(select(Invite)).scalars().all() == [inv]
 
 
-def test_an_unsupported_language_is_ignored_rather_than_stored(db, client):
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "../../etc"}
-        ).status_code
-        == 200
-    )
+def test_an_unsupported_language_is_ignored_rather_than_stored(db):
+    _ask(db, "../../etc")
 
     inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
     assert inv.lang is None
@@ -222,21 +208,15 @@ def test_the_confirmation_mail_is_written_in_the_accounts_language(db, client, m
 
 
 def test_the_approval_mail_answers_in_the_language_the_request_was_made_in(
-    db, client, make_user, as_user, monkeypatch
+    db, make_user, as_user, monkeypatch
 ):
     from app import email as email_mod
 
     monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: True)
     sent = _bodies(monkeypatch)
     admin = make_user(email="admin@example.com", role="admin")
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
-        ).status_code
-        == 200
-    )
+    _ask(db, "hu")
     inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
-    sent.clear()  # drop the admin notification; this test is about the reply to the requester
 
     r = as_user(admin).post(f"/api/admin/invites/{inv.id}/approve")
 
@@ -246,18 +226,13 @@ def test_the_approval_mail_answers_in_the_language_the_request_was_made_in(
     assert subject == mailtext.MAIL_TEXT["access_approved.subject"]["hu"]
 
 
-def test_a_denial_answers_in_that_language_too(db, client, make_user, as_user, monkeypatch):
+def test_a_denial_answers_in_that_language_too(db, make_user, as_user, monkeypatch):
     from app import email as email_mod
 
     monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: True)
     sent = _bodies(monkeypatch)
     admin = make_user(email="admin@example.com", role="admin")
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
-        ).status_code
-        == 200
-    )
+    _ask(db, "hu")
     inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
     sent.clear()
 
diff --git a/backend/tests/test_maintenance_lifecycle.py b/backend/tests/test_maintenance_lifecycle.py
index 5973065e..af16ab04 100644
--- a/backend/tests/test_maintenance_lifecycle.py
+++ b/backend/tests/test_maintenance_lifecycle.py
@@ -1,4 +1,4 @@
-"""sync/maintenance — the job that HARD-DELETES videos (E32 S2: 19% covered).
+"""sync/maintenance — the job that HARD-DELETES videos (it was 19% covered).
 
 Its lifecycle: a video missing from videos.list is flagged and hidden; after the grace period a
 still-missing one is deleted (cascading to every playlist that held it) and each affected user
@@ -7,14 +7,13 @@ trigger, and an upcoming premiere that never went live is. YouTube is a fake tha
 videos.list from a dict.
 """
 
-from datetime import timedelta
+from datetime import datetime, timedelta, timezone
 
 import pytest
 from sqlalchemy import select
 
 from app.models import Channel, Notification, Playlist, PlaylistItem, Video
 from app.sync import maintenance
-from app.utils import now_utc
 
 
 class _YT:
@@ -41,11 +40,14 @@ def channel(db):
 
 def test_a_flagged_video_that_answers_again_is_unhidden(db, channel):
     v = Video(
-        id="v1", channel_id=channel.id, unavailable_since=now_utc(), unavailable_reason="removed"
+        id="v1",
+        channel_id=channel.id,
+        unavailable_since=datetime.now(timezone.utc),
+        unavailable_reason="removed",
     )
     db.add(v)
     db.commit()
-    out = maintenance._recheck_flagged(db, _YT({"v1": _item("v1")}), now_utc())
+    out = maintenance._recheck_flagged(db, _YT({"v1": _item("v1")}), datetime.now(timezone.utc))
     db.refresh(v)
     assert v.unavailable_since is None and v.unavailable_reason is None
     assert out == {"checked": 1, "recovered": 1, "deleted": 0, "notified": 0}
@@ -55,12 +57,13 @@ def test_a_video_still_missing_inside_its_grace_period_is_kept_hidden(db, channe
     v = Video(
         id="v1",
         channel_id=channel.id,
-        unavailable_since=now_utc() - timedelta(days=maintenance.DEFAULT_GRACE_DAYS - 1),
+        unavailable_since=datetime.now(timezone.utc)
+        - timedelta(days=maintenance.DEFAULT_GRACE_DAYS - 1),
         unavailable_reason="removed",
     )
     db.add(v)
     db.commit()
-    out = maintenance._recheck_flagged(db, _YT({}), now_utc())
+    out = maintenance._recheck_flagged(db, _YT({}), datetime.now(timezone.utc))
     assert db.get(Video, "v1") is not None
     assert out["deleted"] == 0
 
@@ -69,7 +72,7 @@ def test_past_the_grace_period_it_is_deleted_and_each_user_who_kept_it_told_once
     db, channel, make_user
 ):
     a, b = make_user(), make_user()
-    gone_since = now_utc() - timedelta(days=maintenance.DEFAULT_GRACE_DAYS + 1)
+    gone_since = datetime.now(timezone.utc) - timedelta(days=maintenance.DEFAULT_GRACE_DAYS + 1)
     for vid in ("v1", "v2"):
         db.add(
             Video(
@@ -92,7 +95,7 @@ def test_past_the_grace_period_it_is_deleted_and_each_user_who_kept_it_told_once
         ]
     )
     db.commit()
-    out = maintenance._recheck_flagged(db, _YT({}), now_utc())
+    out = maintenance._recheck_flagged(db, _YT({}), datetime.now(timezone.utc))
     db.expire_all()
     assert db.get(Video, "v1") is None and db.get(Video, "v2") is None
     assert db.execute(select(PlaylistItem)).scalars().all() == []  # the cascade
@@ -118,7 +121,7 @@ def test_rolling_revalidation_flags_the_missing_and_keeps_a_live_stream(db, chan
     )
     db.commit()
     yt = _YT({"ok": _item("ok"), "live": _item("live", liveBroadcastContent="live")})
-    out = maintenance._revalidate_rolling(db, yt, now_utc())
+    out = maintenance._revalidate_rolling(db, yt, datetime.now(timezone.utc))
     db.expire_all()
     assert db.get(Video, "gone").unavailable_reason == "removed"
     assert db.get(Video, "ok").unavailable_since is None
@@ -150,7 +153,7 @@ def test_a_run_asks_youtube_about_each_video_once(db, channel, monkeypatch, make
             Video(
                 id="v1",
                 channel_id=channel.id,
-                unavailable_since=now_utc(),
+                unavailable_since=datetime.now(timezone.utc),
                 unavailable_reason="removed",
             ),
             Video(id="v2", channel_id=channel.id),
@@ -163,8 +166,8 @@ def test_a_run_asks_youtube_about_each_video_once(db, channel, monkeypatch, make
 
 
 def test_an_upcoming_premiere_counts_as_abandoned_only_when_it_never_went_live():
-    past = (now_utc() - timedelta(days=3)).isoformat()
-    soon = (now_utc() - timedelta(days=1)).isoformat()
+    past = (datetime.now(timezone.utc) - timedelta(days=3)).isoformat()
+    soon = (datetime.now(timezone.utc) - timedelta(days=1)).isoformat()
 
     def item(**live):
         return {"snippet": {"liveBroadcastContent": "upcoming"}, "liveStreamingDetails": live}
diff --git a/backend/tests/test_messages_welcome.py b/backend/tests/test_messages_welcome.py
deleted file mode 100644
index 8d279450..00000000
--- a/backend/tests/test_messages_welcome.py
+++ /dev/null
@@ -1,53 +0,0 @@
-"""E31 S1: the welcome message is rendered once, when the account is created, in the language of that day.
-An account that switched language afterwards kept reading it in the old one (the owner's: English under a
-Hungarian UI). It is served in the reader's language now; any other system message stays as stored.
-Needs the DB."""
-
-from fastapi.testclient import TestClient
-
-import app.state as state
-from app.auth import current_user
-from app.db import get_db
-from app.main import app
-from app.models import Message, User
-from app.routes.messages import WELCOME
-
-
-def _client(db, user, monkeypatch, override_dep) -> TestClient:
-    monkeypatch.setattr(state, "_configured_cache", True)
-    override_dep(get_db, db.info["request"])
-    override_dep(current_user, lambda: user)
-    return TestClient(app)
-
-
-def _user_with_english_welcome(db) -> User:
-    """An account whose welcome was written in English, then switched to Hungarian."""
-    user = User(email="welcome-hu@example.com", preferences={"language": "hu"})
-    db.add(user)
-    db.flush()
-    db.add(Message(kind="system", sender_id=None, recipient_id=user.id, body=WELCOME["en"]))
-    db.commit()
-    return user
-
-
-def test_the_welcome_is_read_in_the_readers_language(db, monkeypatch, override_dep):
-    user = _user_with_english_welcome(db)
-    client = _client(db, user, monkeypatch, override_dep)
-
-    thread = client.get("/api/messages/conversations/0").json()["items"]
-    assert [m["body"] for m in thread] == [WELCOME["hu"]]
-
-    convs = client.get("/api/messages/conversations").json()["items"]
-    assert [c["last_message"]["body"] for c in convs if c["partner"]["id"] == 0] == [WELCOME["hu"]]
-
-
-def test_another_system_message_is_served_as_stored(db, monkeypatch, override_dep):
-    user = _user_with_english_welcome(db)
-    db.add(
-        Message(kind="system", sender_id=None, recipient_id=user.id, body="Maintenance tonight.")
-    )
-    db.commit()
-    client = _client(db, user, monkeypatch, override_dep)
-
-    bodies = [m["body"] for m in client.get("/api/messages/conversations/0").json()["items"]]
-    assert bodies == [WELCOME["hu"], "Maintenance tonight."]
diff --git a/backend/tests/test_migration_0098.py b/backend/tests/test_migration_0098.py
new file mode 100644
index 00000000..578f8ee0
--- /dev/null
+++ b/backend/tests/test_migration_0098.py
@@ -0,0 +1,35 @@
+"""Migration 0098's data cleanup, DB-lane.
+
+The schema half of every migration is checked by test_migrations.py; this one also deletes rows, and
+a delete that misses a row is invisible there. Its own file so the removed-features guard can name it.
+"""
+
+from alembic import command
+from alembic.config import Config
+from sqlalchemy import text
+
+from app.db import engine
+
+
+def test_dropping_the_demo_takes_every_audit_row_about_its_reset_job(db):
+    # The reset job's interval could be changed from the scheduler page like any job's; once its
+    # name is gone from the UI, a left-behind row would render as a raw job id.
+    cfg = Config("alembic.ini")
+    command.downgrade(cfg, "0097_drop_messages")
+    try:
+        with engine.begin() as conn:
+            conn.execute(
+                text(
+                    "INSERT INTO audit_log (action, target_type, target_id, created_at) VALUES"
+                    " ('job_run', 'job', 'demo_reset', now()),"
+                    " ('scheduler_interval', 'job', 'demo_reset', now()),"
+                    " ('scheduler_interval', 'job', 'sync_feed', now())"
+                )
+            )
+    finally:
+        command.upgrade(cfg, "head")
+    with engine.connect() as conn:
+        left = conn.execute(
+            text("SELECT action, target_id FROM audit_log WHERE target_type = 'job' ORDER BY id")
+        ).all()
+    assert [tuple(r) for r in left] == [("scheduler_interval", "sync_feed")]
diff --git a/backend/tests/test_migration_rerun_invalid_index.py b/backend/tests/test_migration_rerun_invalid_index.py
index 6d419755..6653c7ac 100644
--- a/backend/tests/test_migration_rerun_invalid_index.py
+++ b/backend/tests/test_migration_rerun_invalid_index.py
@@ -1,4 +1,4 @@
-"""A concurrent index build that failed part-way, then re-run (E31 S5 review), DB-lane.
+"""A concurrent index build that failed part-way, then re-run, DB-lane.
 
 CREATE INDEX CONCURRENTLY that fails leaves an INVALID index under its name, and alembic_version is not
 stamped, so the next start runs the migration again. `IF NOT EXISTS` matched the name and kept the
diff --git a/backend/tests/test_not_found_detail.py b/backend/tests/test_not_found_detail.py
index b7e9645e..0351d71e 100644
--- a/backend/tests/test_not_found_detail.py
+++ b/backend/tests/test_not_found_detail.py
@@ -1,4 +1,4 @@
-"""A row that is gone answers with a reason the bilingual UI can translate (deep-review round 3).
+"""A row that is gone answers with a reason the bilingual UI can translate.
 
 The 404 a user actually meets is the one for something deleted in another tab or on another device.
 `owned_or_404` / `get_or_404` sent it as a bare English string ("Unknown view", "Not found"), and the
@@ -24,8 +24,8 @@ def test_a_gone_view_tag_or_pin_says_what_is_gone(db, make_user, as_user):
 
 
 def test_a_gone_channel_video_or_user_says_what_is_gone(db, make_user, as_user):
-    """The siblings that still hand-wrote `db.get(...) is None → 404 "Unknown …"` (deep-review
-    round 4): the same gone row, but the Hungarian UI showed the English."""
+    """The siblings that still hand-wrote `db.get(...) is None → 404 "Unknown …"`: the same
+    gone row, but the Hungarian UI showed the English."""
     admin = make_user(role="admin")
     client = as_user(admin)
     for method, url, body, what in [
@@ -45,12 +45,12 @@ def test_a_gone_channel_video_or_user_says_what_is_gone(db, make_user, as_user):
 
 
 def test_every_gone_channel_route_says_it_the_same_way(db, make_user, as_user, override_dep):
-    """The round-4 sweep converted ONE of the five `db.get(Channel, …) is None -> 404 "Unknown
+    """An earlier sweep converted ONE of the five `db.get(Channel, …) is None -> 404 "Unknown
     channel"` sites (block), and shipped the HU/EN string with it — so the Hungarian UI said it in
-    Hungarian on the Block button and in English on the four beside it (deep-review round 5). The
+    Hungarian on the Block button and in English on the four beside it. The
     asymmetric fix is the smell this repo bans, so all five are pinned together.
 
-    Literally all five: round 6 found this loop issuing three requests under a docstring claiming
+    Literally all five: a review found this loop issuing three requests under a docstring claiming
     five, with explore silently absent and subscribe excused as "covered by the tags route" — which
     reaches `_user_subscription`, a different site answering `reason: subscription`. Reverting
     either of those two to its bare English string left the whole lane green."""
@@ -77,7 +77,7 @@ def test_a_gone_subscription_recipient_or_job_says_what_is_gone(db, make_user, a
     verbatim into an otherwise Hungarian UI: "Not subscribed to this channel", "No user with that
     email.", "Unknown job".
 
-    All three, with a request each. Round 6 found this test naming three and issuing two: the
+    All three, with a request each. A review found this test naming three and issuing two: the
     recipient site had no test in the whole suite (nor did the `errors.notFound.recipient` keys
     added beside it), and `run_job_now` rode on its PATCH sibling's coverage."""
     admin = make_user(role="admin")
@@ -117,8 +117,8 @@ def test_a_gone_subscription_recipient_or_job_says_what_is_gone(db, make_user, a
 
 def test_a_nul_in_a_request_string_is_a_422_not_a_500(db, make_user, as_user):
     """Postgres cannot hold NUL in text, so the driver refuses the query outright: a DataError, i.e.
-    a 500 with a traceback, wherever a `%00` or an escaped NUL reached a comparison (deep-review
-    round 4 — round 3 had guarded only the by-rating_key lookup). One app-wide handler now answers
+    a 500 with a traceback, wherever a `%00` or an escaped NUL reached a comparison (an
+    earlier fix had guarded only the by-rating_key lookup). One app-wide handler now answers
     all of them."""
     client = as_user(make_user())
     r = client.get("/api/plex/playlists?contains=%00")
@@ -132,7 +132,7 @@ def test_any_other_data_error_is_still_a_500():
     registered for EVERY DataError on every route and decides on a substring of the driver's message,
     so only a NUL may become a 422. Without this, simplifying it to an unconditional 422 — it reads
     like dead defensive code — would answer a numeric overflow or an over-long ingested title with
-    "your input was bad", losing the traceback that names the real fault (deep-review round 5)."""
+    "your input was bad", losing the traceback that names the real fault."""
     import asyncio
 
     import pytest
diff --git a/backend/tests/test_og.py b/backend/tests/test_og.py
index 9882ab73..2e9e41aa 100644
--- a/backend/tests/test_og.py
+++ b/backend/tests/test_og.py
@@ -1,4 +1,4 @@
-"""JPEG dimension parsing for the /watch OG image tags (S2, item 6).
+"""JPEG dimension parsing for the /watch OG image tags.
 
 Facebook's scraper fetches og:image asynchronously on first scrape, so the card is image-less
 unless og:image:width/height are declared — which needs the poster's real dimensions, read from the
diff --git a/backend/tests/test_override_dep_convention.py b/backend/tests/test_override_dep_convention.py
index 32eeb61a..89aab606 100644
--- a/backend/tests/test_override_dep_convention.py
+++ b/backend/tests/test_override_dep_convention.py
@@ -39,7 +39,7 @@ def test_a_request_gets_the_session_that_checks_its_commit():
 
 def test_the_commit_check_counts_only_the_root_transaction(db):
     """A savepoint released inside a handler commits nothing to the database; ending it must not
-    clear the check (round 2). Driven directly, as a request would drive the dependency."""
+    clear the check. Driven directly, as a request would drive the dependency."""
     import pytest
     from starlette.requests import HTTPConnection
 
@@ -63,7 +63,7 @@ def test_the_commit_check_counts_only_the_root_transaction(db):
 def test_a_request_that_raises_leaves_nothing_it_did_not_commit(db):
     """Production closes a failing request's session, which rolls back whatever it flushed and did
     not commit; the shared test session must do the same, or a later read in the test sees a write
-    production would have lost (E16: the tracker's issue link, kept only by an explicit commit in
+    production would have lost (the tracker's issue link, kept only by an explicit commit in
     the handler's failure path). Driven directly, as a request would drive the dependency."""
     import pytest
     from sqlalchemy import select
diff --git a/backend/tests/test_playlist_add_position.py b/backend/tests/test_playlist_add_position.py
index d351b0f2..e766b0be 100644
--- a/backend/tests/test_playlist_add_position.py
+++ b/backend/tests/test_playlist_add_position.py
@@ -1,4 +1,4 @@
-"""E28 S3e2 — adding a video AT a position: the list page's "Undo" of a removal.
+"""Adding a video AT a position: the list page's "Undo" of a removal.
 
 The row has to come back where it was in ONE request. The two-call shape (append, then send the
 whole order) leaves it at the end of the list whenever the second call fails, and the reorder would
diff --git a/backend/tests/test_playlist_merge.py b/backend/tests/test_playlist_merge.py
index 8059e320..7755104a 100644
--- a/backend/tests/test_playlist_merge.py
+++ b/backend/tests/test_playlist_merge.py
@@ -1,4 +1,4 @@
-"""S7 — two-way (3-way) YouTube playlist merge.
+"""Two-way (3-way) YouTube playlist merge.
 
 The load-bearing property: an item added (or deleted) on EITHER side survives the sync — the old
 push was one-directional (local wins, deletes everything not local from YouTube), so YouTube-side
diff --git a/backend/tests/test_playlist_move.py b/backend/tests/test_playlist_move.py
index 9d6470f7..31e941b5 100644
--- a/backend/tests/test_playlist_move.py
+++ b/backend/tests/test_playlist_move.py
@@ -1,4 +1,4 @@
-"""E10 S2 — the one-step "move this video to another list" endpoint, and the `updated_at` touch
+"""The one-step "move this video to another list" endpoint, and the `updated_at` touch
 the rail's "recently changed" sort reads.
 
 Two properties are load-bearing and neither is visible from the happy path alone:
@@ -238,7 +238,7 @@ def test_item_edits_bump_updated_at(db, make_user, as_user):
     assert db.get(Playlist, src.id).updated_at > old
     assert db.get(Playlist, dst.id).updated_at > old
 
-    # …and removing one, the fourth item-only write (it had no test: E10 review coverage debt).
+    # …and removing one, the fourth item-only write (it had no test).
     src.updated_at = old
     db.commit()
     assert client.delete(f"/api/playlists/{src.id}/items/v1").status_code == 200
diff --git a/backend/tests/test_playlist_position_lock.py b/backend/tests/test_playlist_position_lock.py
index 74e69cab..3785bd7a 100644
--- a/backend/tests/test_playlist_position_lock.py
+++ b/backend/tests/test_playlist_position_lock.py
@@ -1,4 +1,4 @@
-"""E28 review — every request that reads a playlist's item positions and writes new ones locks the
+"""Every request that reads a playlist's item positions and writes new ones locks the
 playlist row first.
 
 Without it two adds (two tabs; the rail and the page) both read the same `max(position)` and land
@@ -7,7 +7,7 @@ rows is then whatever the planner returns. A true two-connection race is not rep
 demand, so the test holds the mechanism: the parent row is taken `FOR UPDATE` by each such route.
 A Plex reorder that omits a row (added in another tab meanwhile) must not collide with it either.
 
-Round 2: the lock also comes FIRST — before the request reads or writes a single item row. A remove
+The lock also comes FIRST — before the request reads or writes a single item row. A remove
 that deleted an item and then touched the playlist beside a reorder that went the other way was a
 deadlock (a 500 for one of them), and an add that checked "already there?" before the lock let two
 adds of one video both insert (a 500 on the unique key).
diff --git a/backend/tests/test_playlist_sync_claim.py b/backend/tests/test_playlist_sync_claim.py
index b627cef7..cf63d762 100644
--- a/backend/tests/test_playlist_sync_claim.py
+++ b/backend/tests/test_playlist_sync_claim.py
@@ -1,4 +1,4 @@
-"""E28 review C1 — one YouTube sync of a playlist at a time, whoever starts it.
+"""One YouTube sync of a playlist at a time, whoever starts it.
 
 A push reads YouTube and then writes both sides for seconds, committing step by step, so the
 client's in-flight flag (one page's menus) and a row lock (gone at the first commit) both leave two
@@ -67,7 +67,7 @@ def test_push_and_revert_refuse_while_the_list_is_claimed(
             r = c.post(f"/api/playlists/{pl.id}/{path}")
             assert r.status_code == 409
             assert r.json()["detail"] == {"code": "playlist", "reason": "sync_busy"}
-        # a delete too: a push mid-way would plan the deleted list as emptied (E28 round 4)
+        # a delete too: a push mid-way would plan the deleted list as emptied
         r = c.delete(f"/api/playlists/{pl.id}")
         assert r.status_code == 409
         assert r.json()["detail"] == {"code": "playlist", "reason": "sync_busy"}
@@ -132,7 +132,7 @@ def test_the_scheduled_refresh_skips_a_mirror_being_synced(db, make_user, monkey
 def test_refused_reverts_do_not_spend_the_pull_cooldown(
     db, as_user, make_user, override_dep, monkeypatch
 ):
-    """Round 2: the cooldown (three pulls per ten minutes) is checked after the claim, so clicking
+    """The cooldown (three pulls per ten minutes) is checked after the claim, so clicking
     Revert while a push runs is refused as busy without using up a pull."""
     user = make_user()
     pl = _linked(db, user)
diff --git a/backend/tests/test_playlist_sync_lock_order.py b/backend/tests/test_playlist_sync_lock_order.py
index 5c631510..80ac6a48 100644
--- a/backend/tests/test_playlist_sync_lock_order.py
+++ b/backend/tests/test_playlist_sync_lock_order.py
@@ -1,7 +1,7 @@
-"""E28 review round 3 — the YouTube sync paths take the playlist row BEFORE they touch an item, and
+"""The YouTube sync paths take the playlist row BEFORE they touch an item, and
 hold it to the commit that writes them.
 
-Round 2 made every route edit lock the playlist first. The sync paths were left item-first (a push's
+Every route edit already locked the playlist first. The sync paths were left item-first (a push's
 and a re-pull's item replace, a delete's cascade), so a push beside a remove could deadlock (a 500),
 and the scheduled mirror refresh re-ingested inside its lock — its commit let go of the lock before
 the replace, so a remove made then was undone and the list read as synced. A push also replaced the
diff --git a/backend/tests/test_plex_admin_routes.py b/backend/tests/test_plex_admin_routes.py
index 6de5f0aa..d39a4cde 100644
--- a/backend/tests/test_plex_admin_routes.py
+++ b/backend/tests/test_plex_admin_routes.py
@@ -1,4 +1,4 @@
-"""routes/plex/admin — the connection test and the owner's watch-sync link (E32 S2: 37% covered).
+"""routes/plex/admin — the connection test and the owner's watch-sync link (it was 37% covered).
 
 The connection test is the admin's one early warning that the media mount or path map is wrong, and
 it must not quote the server's URL back in a toast. The watch link runs the one-time "Plex is master"
diff --git a/backend/tests/test_plex_cards.py b/backend/tests/test_plex_cards.py
index fc35fe8c..b1f1267a 100644
--- a/backend/tests/test_plex_cards.py
+++ b/backend/tests/test_plex_cards.py
@@ -1,6 +1,6 @@
 """Plex card serializers (app.plex.cards) — pure model->dict projections, no DB needed.
 
-E5 S1: movie/show cards now also emit `art` (the wide backdrop, for a Discover rail's landscape tile
+Movie/show cards now also emit `art` (the wide backdrop, for a Discover rail's landscape tile
 and the crossfading hero), but ONLY when the item actually has an `art_key` — otherwise the URL would
 resolve to a blank image on every card that tried to use it, so it must be null and let the client fall
 back to the poster."""
diff --git a/backend/tests/test_plex_client.py b/backend/tests/test_plex_client.py
index a2be2326..76362a4f 100644
--- a/backend/tests/test_plex_client.py
+++ b/backend/tests/test_plex_client.py
@@ -1,4 +1,4 @@
-"""plex/client — the one door to the Plex server (E32 S2: 31% covered).
+"""plex/client — the one door to the Plex server (it was 31% covered).
 
 What matters here is what the callers cannot see: a failure must surface as PlexError (never as an
 empty answer), the paged reads must stop where they should, and the write URIs must be well formed.
@@ -79,7 +79,7 @@ def test_a_section_page_asks_for_guids_and_reports_the_server_total(plex):
     assert params["includeGuids"] == "1" and params["type"] == "1"
     assert params["X-Plex-Container-Start"] == "200" and params["X-Plex-Container-Size"] == "50"
 
-    # Measured on the real server (E32 review): a paged request carries `totalSize` even when the
+    # Measured on the real server: a paged request carries `totalSize` even when the
     # page is empty, past the end, or the section holds nothing — `size: 0, totalSize: 0`.
     plex.routes["/library/sections/7/all"] = {"Metadata": [], "size": 0, "totalSize": 0}
     assert plex.section_items("7", 2) == ([], 0)
@@ -168,7 +168,7 @@ def test_a_collection_is_created_with_a_well_formed_uri(plex):
 
 def test_a_server_without_a_machine_id_refuses_the_write(plex):
     """No machineIdentifier used to become `server:///…` in the write URI — a malformed request
-    Plex answers in its own way. It is refused here, named (E32 S2)."""
+    Plex answers in its own way. It is refused here, named."""
     plex.routes["/identity"] = {}
     plex.routes["/library/collections"] = {"Metadata": [{"ratingKey": "c1"}]}
     with pytest.raises(PlexError, match="machine"):
diff --git a/backend/tests/test_plex_detail.py b/backend/tests/test_plex_detail.py
index bf18f9c5..cca81afb 100644
--- a/backend/tests/test_plex_detail.py
+++ b/backend/tests/test_plex_detail.py
@@ -1,4 +1,4 @@
-"""Regression (E5 S5b): the info-page rich detail (IMDb score/id, tagline, full cast) is persisted at
+"""Regression: the info-page rich detail (IMDb score/id, tagline, full cast) is persisted at
 rich-fetch time and served from the DB row instead of a live plex.metadata() call.
 
 - `rich_detail`/`apply_rich_detail` are pure — parse + persist the rich-only fields.
@@ -64,7 +64,7 @@ def test_rich_detail_prefers_imdb_entry_and_builds_link():
 
 
 def test_rich_detail_is_imdb_only_no_audience_fallback():
-    # E5 S6: imdb_rating is IMDb-ONLY. With no imdb:// Rating entry it's NULL — the Plex audience score
+    # Imdb_rating is IMDb-ONLY. With no imdb:// Rating entry it's NULL — the Plex audience score
     # is NOT mislabelled as an IMDb score (it's served separately via the `rating` column).
     d = detail.rich_detail({"audienceRating": 7.25})
     assert d["imdb_rating"] is None
@@ -113,7 +113,7 @@ class _StubClient:
 def test_apply_facet_fields_preserves_enriched_cast_names():
     """A full sync must NOT downgrade an already-enriched full cast back to the listing top-20 — since
     sync never clears people_enriched_at, nothing would regrow it and the person-page filter would lose
-    the names past the listing cap (regression guard for E5 S5b's enrich gating)."""
+    the names past the listing cap (regression guard for the enrich gating)."""
     # The cheap listing's top few cast + the (always-present) director.
     thin = {
         "Role": [{"tag": "Al Pacino"}, {"tag": "James Caan"}],
@@ -357,7 +357,7 @@ def test_show_detail_lazy_fills_when_unenriched(db, monkeypatch, override_dep):
 def test_item_detail_names_tracks_from_their_language_not_plexs_title(
     db, monkeypatch, override_dep
 ):
-    """E30: Plex titles a track in the Plex SERVER's language ("English (AC3 5.1)", "magyar Forced",
+    """Plex titles a track in the Plex SERVER's language ("English (AC3 5.1)", "magyar Forced",
     "中文 (EAC3 Stereo)"), so a Hungarian reader got a mix. The route sends what the client names it
     from instead — the language tag, the forced / SDH flags, the codec tail — keeping Plex's title
     only as the fallback, and no invented English "Audio 2" for a track with neither."""
diff --git a/backend/tests/test_plex_discover.py b/backend/tests/test_plex_discover.py
index 75477af8..e3b4c52b 100644
--- a/backend/tests/test_plex_discover.py
+++ b/backend/tests/test_plex_discover.py
@@ -1,4 +1,4 @@
-"""E5 S4: the Plex Discover rail-surface. GET /api/plex/discover returns the consolidated rail
+"""The Plex Discover rail-surface. GET /api/plex/discover returns the consolidated rail
 payload (continue watching / recently added / genre tiles / because-you-watched) served from the DB,
 and GET /api/plex/surprise returns a scope-bounded random sample. DB lane (`db` fixture) — skipped
 without Postgres.
diff --git a/backend/tests/test_plex_facets.py b/backend/tests/test_plex_facets.py
index 3589db2e..09c334e3 100644
--- a/backend/tests/test_plex_facets.py
+++ b/backend/tests/test_plex_facets.py
@@ -1,4 +1,4 @@
-"""DB-backed regression for the 0.53.1 hotfix (R6 S3b-test): GET /api/plex/facets?scope=show
+"""DB-backed regression for the 0.53.1 hotfix: GET /api/plex/facets?scope=show
 must return 200 — not the "cannot extract elements from a scalar" 500 — for a metadata-poor
 library whose show has a JSONB-scalar `null` genres (a pre-0.53.1 row). The endpoint's
 `jsonb_typeof(genres)='array'` read-guard is what makes it safe; this test would 500 without it.
@@ -17,7 +17,7 @@ from app.models import PlexItem, PlexLibrary, PlexShow, User
 
 
 def test_facets_returns_studio_vocabulary(db, monkeypatch, override_dep):
-    """E5 S7: /facets returns the studio vocabulary (distinct studio + count) for the sidebar picker."""
+    """/facets returns the studio vocabulary (distinct studio + count) for the sidebar picker."""
     lib = PlexLibrary(plex_key="1", title="Movies", kind="movie", enabled=True)
     db.add(lib)
     db.flush()
diff --git a/backend/tests/test_plex_facets_grid_parity.py b/backend/tests/test_plex_facets_grid_parity.py
index 151bbc55..ad17cbb3 100644
--- a/backend/tests/test_plex_facets_grid_parity.py
+++ b/backend/tests/test_plex_facets_grid_parity.py
@@ -1,6 +1,6 @@
-"""E3 S1 characterization net — /library grid ⟷ /facets equivalence across watch-state scopes.
+"""Characterization net — /library grid ⟷ /facets equivalence across watch-state scopes.
 
-The Plex god-module split (E3 S1) extracts the movie/show watch-state predicates that are currently
+The Plex god-module split extracts the movie/show watch-state predicates that are currently
 HAND-DUPLICATED in two places: `unified_library` (the grid) and `facets.wsq` (the facet aggregation).
 The facets docstring promises the facets "reflect exactly the visible result set" — i.e. with NO
 metadata filter active (only the `show` state scope), a facet's genre/content-rating counts must equal
@@ -218,7 +218,7 @@ def test_hidden_movie_absent_from_grid_and_facets(db, as_user):
 
 def test_a_watch_state_scope_rolls_the_episodes_up_once(db, as_user):
     """The per-user episode rollup behind a show's watch state is a pass over every episode; each show
-    facet group asked it again (E31 S4e: half of a filtered facets call). It is asked once now."""
+    facet group asked it again (half of a filtered facets call). It is asked once now."""
     from sqlalchemy import event
 
     from app.db import engine
diff --git a/backend/tests/test_plex_field_scoped_search.py b/backend/tests/test_plex_field_scoped_search.py
index 2b375f17..c2aafd5f 100644
--- a/backend/tests/test_plex_field_scoped_search.py
+++ b/backend/tests/test_plex_field_scoped_search.py
@@ -1,4 +1,4 @@
-"""S2 · field-scoped search — the `field` param on /api/plex/library.
+"""Field-scoped search — the `field` param on /api/plex/library.
 
 The search box's scope-pill narrows a full-text query to ONE facet of the row: Everywhere (`all`,
 the untouched weighted `search_vector`), Titles, Cast & crew (`people`), Descriptions (`summary`),
diff --git a/backend/tests/test_plex_hls_file_route.py b/backend/tests/test_plex_hls_file_route.py
index 127086bb..56571696 100644
--- a/backend/tests/test_plex_hls_file_route.py
+++ b/backend/tests/test_plex_hls_file_route.py
@@ -5,11 +5,11 @@ seek-restart — or a second viewer of the same item — replaces the registered
 viewer's next request for `seg_12.ts`, resolved by rating_key, was answered 200 with the NEW
 session's twelfth segment: bytes produced from a different `-ss` offset under `-copyts`, i.e. a
 timeline the client is not on. Wrong content with a success status is the one failure a player cannot
-notice, and the reclaim-on-404 added in round 4 could never fire on it (deep-review round 5).
+notice, and the client's reclaim-on-404 could never fire on it.
 
 No `db` fixture: the route reads nothing from the database (its own `Depends(get_db)` went with the
 removed auto-start, and `current_user` is overridden wholesale), so these must not sit in the DB
-lane — there they SKIP on a machine with no Postgres while pytest prints green (round 6).
+lane — there they SKIP on a machine with no Postgres while pytest prints green.
 """
 
 import time
@@ -127,7 +127,7 @@ def test_a_segment_that_will_never_arrive_fails_at_once(client, tmp_path, sessio
     """`stream_hls_file` is a SYNC route: it runs on the ~40-slot threadpool and holds a pooled DB
     connection while it waits. It used to poll out the whole 20 s for a name that could never appear
     — an ordinary seek past the produced region was enough to park a worker and a connection, and
-    forty hopeless names parked the API (deep-review round 5). ffmpeg writes segments in order, so a
+    forty hopeless names parked the API. ffmpeg writes segments in order, so a
     segment whose predecessor is absent is not the next one, and that is knowable at once — even
     while ffmpeg is still running, which is the case `proc` alone cannot shorten."""
     d = tmp_path / "m1_0_0_+0.00"
@@ -152,11 +152,11 @@ def test_a_segment_that_will_never_arrive_fails_at_once(client, tmp_path, sessio
 def test_a_multi_audio_segment_beyond_the_region_fails_at_once_too(
     client, tmp_path, sessions, name
 ):
-    """The round-5 guard read `seg_<seq>_<variant>.ts`, but ffmpeg substitutes `%v` FIRST — so the
+    """An earlier guard read `seg_<seq>_<variant>.ts`, but ffmpeg substitutes `%v` FIRST — so the
     real names are `seg_<variant>_<seq>.ts` and every multi-audio request fell through to the full
     20 s wait: the video rendition because its variant "0" parsed as segment 0, the audio renditions
     (`a0`, `a1`) because they did not parse at all. Dual-audio is the common shape in this library,
-    so the guard was inert exactly where it was needed (round 6)."""
+    so the guard was inert exactly where it was needed."""
     d = tmp_path / "m1_0_multi_+0.00"
     d.mkdir()
     (d / "seg_0_0.ts").write_bytes(b"x")
@@ -261,7 +261,7 @@ def test_the_name_ffmpeg_is_asked_for_is_a_name_the_guard_understands(tmp_path,
 def test_the_argv_asks_for_exactly_the_names_the_guard_accepts(tmp_path):
     """The producer and the parser, pinned to each other through the argv itself.
 
-    Round 6's HIGH was a guard that read `seg_%v_%d.ts` sequence-first, so it was inert on every
+    The bug was a guard that read `seg_%v_%d.ts` sequence-first, so it was inert on every
     multi-audio item, and a warm-up that waited 8 s for a name ffmpeg never writes. The fix was to
     give the layout one spelling — but a comment saying so is what had just failed, so assert that
     the `-hls_segment_filename` pattern in the real argv is literally what `segment_name` produces,
@@ -302,7 +302,7 @@ def test_a_name_only_the_other_argv_branch_writes_is_refused_at_once(tmp_path, c
     it can never write — and vice versa. Accepting the union read them as "an HLS name, so wait and
     see", and each one then held a threadpool worker and its pooled DB connection for the full
     timeout: measured through this route against a live single-audio session, `master.m3u8` took
-    30.0 s and `seg_a0_0.ts` 20.1 s to answer 404 (deep-review round 7)."""
+    30.0 s and `seg_a0_0.ts` 20.1 s to answer 404."""
     single = tmp_path / "m1_0_0_+0.00"
     single.mkdir()
     sessions[(VIEWER, "m1")] = _Session("sid-a", single, running=True)
diff --git a/backend/tests/test_plex_image_sizes.py b/backend/tests/test_plex_image_sizes.py
index 3c250296..8091998d 100644
--- a/backend/tests/test_plex_image_sizes.py
+++ b/backend/tests/test_plex_image_sizes.py
@@ -1,4 +1,4 @@
-"""A card asks the Plex image proxy for a small cut; a detail page keeps the full one (E31 S4e).
+"""A card asks the Plex image proxy for a small cut; a detail page keeps the full one.
 
 Cards fetched the 400×600 poster for a ~144px picture and the 1280×720 backdrop for a ~212px shelf
 picture. The `_sm` variants are cut by Plex at a card's size and cached apart from the full ones; an
diff --git a/backend/tests/test_plex_jsonb_normalize.py b/backend/tests/test_plex_jsonb_normalize.py
index c204af42..77fd2a04 100644
--- a/backend/tests/test_plex_jsonb_normalize.py
+++ b/backend/tests/test_plex_jsonb_normalize.py
@@ -1,4 +1,4 @@
-"""DB-backed test for the S3a data normalization (migration 0060): a JSONB scalar `null` in the
+"""DB-backed test for the data normalization (migration 0060): a JSONB scalar `null` in the
 plex tag columns becomes SQL NULL, while a real array is left untouched. Runs the migration's exact
 UPDATE statements against seeded rows (the migration itself is a no-op in the empty test DB).
 
diff --git a/backend/tests/test_plex_keyword_filter.py b/backend/tests/test_plex_keyword_filter.py
index 4a0cbbdb..196ee9ed 100644
--- a/backend/tests/test_plex_keyword_filter.py
+++ b/backend/tests/test_plex_keyword_filter.py
@@ -1,4 +1,4 @@
-"""E5 S5: the TMDB keyword filter. A keyword chip on the detail page sets ?keywords=<kw>, which
+"""The TMDB keyword filter. A keyword chip on the detail page sets ?keywords=<kw>, which
 narrows the unified library to rows whose persisted `keywords` JSONB array contains it. DB lane
 (`db` fixture) — skipped without Postgres.
 """
diff --git a/backend/tests/test_plex_lang.py b/backend/tests/test_plex_lang.py
index 00da79c9..1c112575 100644
--- a/backend/tests/test_plex_lang.py
+++ b/backend/tests/test_plex_lang.py
@@ -1,4 +1,4 @@
-"""E5 S6: HU-overlay language serving. When ?lang=hu, the unified library, facets, genre filter and
+"""HU-overlay language serving. When ?lang=hu, the unified library, facets, genre filter and
 detail endpoints serve the Hungarian `*_hu` columns (falling back to EN where a row has no HU twin);
 ?lang=en (the default) serves English. Also covers the imdb_rating IMDb-only / audience-score split.
 DB lane (`db` fixture) — skipped without Postgres.
@@ -119,7 +119,7 @@ def test_genre_filter_matches_active_language_vocabulary(db, monkeypatch, overri
 
 
 def test_a_genre_filter_saved_in_english_still_matches_in_hungarian(db, monkeypatch, override_dep):
-    """E30: the HU column holds one Hungarian word per genre. A filter saved while the HU list still
+    """The HU column holds one Hungarian word per genre. A filter saved while the HU list still
     offered "Action" is read through the same map, so it finds the "Akció" title instead of nothing."""
     user = _seed(db)
     resp = _get(
@@ -129,7 +129,7 @@ def test_a_genre_filter_saved_in_english_still_matches_in_hungarian(db, monkeypa
 
 
 def test_a_genre_the_hungarian_list_offers_in_english_still_matches(db, monkeypatch, override_dep):
-    """E30 review: a row the sync has not given Hungarian genres yet is listed under its English word
+    """A row the sync has not given Hungarian genres yet is listed under its English word
     (the facets read coalesce(genres_hu, genres)); filtering by that word must find it."""
     user = _seed(db)
     facets = _get(db, user, monkeypatch, override_dep, "/api/plex/facets?scope=movie&lang=hu")
@@ -161,7 +161,7 @@ def test_item_detail_language_and_rating_split(db, monkeypatch, override_dep):
     body = resp.json()
     assert body["title"] == "Magyar Cím"
     assert body["summary"] == "Magyar összefoglaló."
-    assert body["tagline"] == "Magyar mottó."  # E30: the HU overlay's tagline
+    assert body["tagline"] == "Magyar mottó."  # the HU overlay's tagline
     en = _get(db, user, monkeypatch, override_dep, "/api/plex/item/m1").json()
     assert en["tagline"] == "English tagline."
     # imdb_rating is IMDb-only (None here); the audience score is served separately as `rating`.
@@ -285,7 +285,7 @@ def _seed_rails(db):
 
 
 def test_every_card_rail_serves_the_readers_language(db, monkeypatch, override_dep):
-    """E30: the grid spoke Hungarian, but every other card surface (Discover rails, show page,
+    """The grid spoke Hungarian, but every other card surface (Discover rails, show page,
     search, collection, person page, playlist, Home) served the English title to a HU reader."""
     user, pid = _seed_rails(db)
 
diff --git a/backend/tests/test_plex_last_watched_sort.py b/backend/tests/test_plex_last_watched_sort.py
index 9f34e808..f3ef2f31 100644
--- a/backend/tests/test_plex_last_watched_sort.py
+++ b/backend/tests/test_plex_last_watched_sort.py
@@ -1,4 +1,4 @@
-"""S3: the "last watched" browse sort (`sort=lastwatched`). Movies rank by
+"""The "last watched" browse sort (`sort=lastwatched`). Movies rank by
 coalesce(progress_updated_at, watched_at); shows by max(coalesce(...)) across their episodes
 (rollup.resumed_at). Never-watched titles sink to the bottom (nullslast). DB lane (`db` fixture) —
 skipped without Postgres.
diff --git a/backend/tests/test_plex_overlay.py b/backend/tests/test_plex_overlay.py
index 3497da53..35148196 100644
--- a/backend/tests/test_plex_overlay.py
+++ b/backend/tests/test_plex_overlay.py
@@ -1,4 +1,4 @@
-"""DB-backed regression (E5 S5a): the HU-overlay sync writes Hungarian metadata onto the matched EN
+"""DB-backed regression: the HU-overlay sync writes Hungarian metadata onto the matched EN
 rows (paired by guid), never creating browsable HU rows, and overlay libraries are excluded from the
 browse scope. Also covers the canonical-guid parse and that the generated search_vector_hu populates.
 
@@ -197,7 +197,7 @@ def test_overlay_reconcile_clears_stale_hu_when_twin_vanishes(db):
 
 
 def test_a_listing_cut_short_keeps_the_hungarian_text_it_did_not_reach(db):
-    """E32 S2: the reconcile clears HU text only after a COMPLETE listing. A walk a Plex hiccup cut
+    """The reconcile clears HU text only after a COMPLETE listing. A walk a Plex hiccup cut
     short (an empty page before the server's total), or an empty section, says nothing about the
     titles it did not reach — clearing them dropped their Hungarian text until the next full sync."""
     en_lib = PlexLibrary(plex_key="4", title="Movies", kind="movie")
@@ -304,7 +304,7 @@ class _KindStub:
 
 
 def test_a_show_overlay_writes_hungarian_episode_titles_and_summaries(db):
-    """E30: the HU TV section lists every episode in Hungarian; they were never read, so a Hungarian
+    """The HU TV section lists every episode in Hungarian; they were never read, so a Hungarian
     reader saw every episode title and summary in English."""
     en_lib = PlexLibrary(plex_key="1", title="TV Shows", kind="show")
     hu_lib = PlexLibrary(plex_key="9", title="Sorozatok", kind="show", metadata_lang="hu")
@@ -341,7 +341,7 @@ def test_a_show_overlay_writes_hungarian_episode_titles_and_summaries(db):
 
 
 def test_the_overlay_gives_every_row_one_hungarian_word_per_genre(db):
-    """E30: Plex's HU agent mixes "Action" with "Dráma", and a title with no HU twin kept only its
+    """Plex's HU agent mixes "Action" with "Dráma", and a title with no HU twin kept only its
     English list — so the HU genre list offered "Drama" beside "Dráma"."""
     en_lib = PlexLibrary(plex_key="4", title="Movies", kind="movie")
     hu_lib = PlexLibrary(plex_key="9", title="Filmek", kind="movie", metadata_lang="hu")
@@ -407,7 +407,7 @@ def test_a_twin_without_genres_keeps_the_rows_own_hungarian_list(db):
 
 
 def test_every_synced_row_gets_hungarian_genres():
-    """E30 review: not only an overlaid row — the HU facets and filter read genres_hu for all."""
+    """Not only an overlaid row — the HU facets and filter read genres_hu for all."""
     from app.plex.sync import _apply_facet_fields
 
     row = PlexItem(title="Solo")
diff --git a/backend/tests/test_plex_paths.py b/backend/tests/test_plex_paths.py
index 446e8bd7..02ea1578 100644
--- a/backend/tests/test_plex_paths.py
+++ b/backend/tests/test_plex_paths.py
@@ -1,4 +1,4 @@
-"""plex/paths — the Plex-side path → local mount translation (E32 S2: 23% covered, and a wrong answer
+"""plex/paths — the Plex-side path → local mount translation (it was 23% covered, and a wrong answer
 here reads as "media file not found" for a whole library at once, with nothing else failing).
 
 Pure logic: the admin map is read through sysconfig, stubbed per test.
diff --git a/backend/tests/test_plex_people_enrich.py b/backend/tests/test_plex_people_enrich.py
index 33ff2fb7..d10909d2 100644
--- a/backend/tests/test_plex_people_enrich.py
+++ b/backend/tests/test_plex_people_enrich.py
@@ -1,4 +1,4 @@
-"""E30 S6: the people are made local ahead of time. The people_enrich job fetches linked people's TMDB
+"""The people are made local ahead of time. The people_enrich job fetches linked people's TMDB
 bios (the most-credited first) and caches their portraits resized through Plex; the person page says
 when a bio is still on its way (`enriching`), so it can ask again instead of staying empty.
 DB lane (Postgres); the portrait cache runs in a temp directory.
diff --git a/backend/tests/test_plex_person.py b/backend/tests/test_plex_person.py
index 9ce49958..9e7519f4 100644
--- a/backend/tests/test_plex_person.py
+++ b/backend/tests/test_plex_person.py
@@ -1,4 +1,4 @@
-"""DB-backed regression (E5 S4): GET /api/plex/person/{name} returns a cast/crew member's
+"""DB-backed regression: GET /api/plex/person/{name} returns a cast/crew member's
 filmography — movies + shows in the ENABLED libraries whose cast OR directors include the name,
 each carrying the caller's watch-state, plus the cached headshot. Also covers `content_libs`
 scoping (disabled libraries excluded) and the kind filter (episodes are not movies).
@@ -123,7 +123,7 @@ def test_person_detail_unknown_name_is_empty(db, monkeypatch, override_dep):
     resp = _get(db, user, monkeypatch, override_dep, "/api/plex/person/Ghost%20Actor")
     assert resp.status_code == 200, resp.text
     body = resp.json()
-    # An unknown name has no plex_people row → no bio, no titles (E5 S6 added the bio fields, all null).
+    # An unknown name has no plex_people row → no bio, no titles (the bio fields are all null).
     assert body == {
         "name": "Ghost Actor",
         "photo": None,
diff --git a/backend/tests/test_plex_person_bio.py b/backend/tests/test_plex_person_bio.py
index c52e570b..9dadf06d 100644
--- a/backend/tests/test_plex_person_bio.py
+++ b/backend/tests/test_plex_person_bio.py
@@ -1,4 +1,4 @@
-"""E5 S6: person page TMDB bio enrichment. `parse_person` shapes the /person payload (bio + a
+"""Person page TMDB bio enrichment. `parse_person` shapes the /person payload (bio + a
 popularity-ranked, deduped `known_for`); `enrich_person` lazily fetches + persists once (guarded on a
 key + a tmdb_person_id); and /person/{name} serves the bio + resolves `known_for` to library rows.
 DB lane for the endpoint/enrich tests; parse_person is pure. Skipped without Postgres where DB-backed.
@@ -335,7 +335,7 @@ def test_person_detail_serves_bio_and_resolves_known_for(db, monkeypatch, overri
     assert [c["title"] for c in j["known_for"]] == ["Known Movie"]
 
 
-# --- E30 S4: the biography in the reader's language --------------------------------------------------
+# --- the biography in the reader's language -------------------------------------------------------
 # The same /person request appends `translations`; the Hungarian one is kept beside the instance-language
 # biography, and a Hungarian reader is served it, falling back to the English one when TMDB has none.
 
diff --git a/backend/tests/test_plex_playback_class.py b/backend/tests/test_plex_playback_class.py
index b08b2ee1..82f16212 100644
--- a/backend/tests/test_plex_playback_class.py
+++ b/backend/tests/test_plex_playback_class.py
@@ -1,4 +1,4 @@
-"""The playback-class filter (E7): filter the Plex feed by Direct Play / Direct Stream / Transcode·HW /
+"""The playback-class filter: filter the Plex feed by Direct Play / Direct Stream / Transcode·HW /
 Transcode·SW. Covers the shared classifier + Stream parsing (unit), the sync derivation + codec-change
 reset, the bit-depth backfill, and the /library filter + /facets counts (DB lane).
 
diff --git a/backend/tests/test_plex_playback_session.py b/backend/tests/test_plex_playback_session.py
index 5dd921da..d7339afb 100644
--- a/backend/tests/test_plex_playback_session.py
+++ b/backend/tests/test_plex_playback_session.py
@@ -1,4 +1,4 @@
-"""The playback-session route's mode routing (E6 S1b).
+"""The playback-session route's mode routing.
 
 `POST /stream/{rk}/session` is the single switch that decides how an item plays: a browser-native
 file is served raw (`mode:"direct"`), everything else (re)starts an HLS session — and a
diff --git a/backend/tests/test_plex_playlist_add_positions.py b/backend/tests/test_plex_playlist_add_positions.py
index 3d8f970a..6c20ed6d 100644
--- a/backend/tests/test_plex_playlist_add_positions.py
+++ b/backend/tests/test_plex_playlist_add_positions.py
@@ -1,4 +1,4 @@
-"""E28 S3e2 — putting removed Plex playlist rows back WHERE THEY WERE: the list page's "Undo".
+"""Putting removed Plex playlist rows back WHERE THEY WERE: the list page's "Undo".
 
 A removal can take one row, a season or a whole show, and a season's episodes need not sit together
 (a reorder inside the show interleaves them), so each key carries its own index — over the ORDERED
diff --git a/backend/tests/test_plex_query_conversion.py b/backend/tests/test_plex_query_conversion.py
index ba919ba3..5f63c507 100644
--- a/backend/tests/test_plex_query_conversion.py
+++ b/backend/tests/test_plex_query_conversion.py
@@ -1,4 +1,4 @@
-"""S1 characterization net for the Plex-package db.query() -> SQLAlchemy 2.0 select() conversion.
+"""Characterization net for the Plex-package db.query() -> SQLAlchemy 2.0 select() conversion.
 
 These lock the OBSERVABLE behaviour of the previously-untested hot query paths — the unified_library
 union builder (+ its watch-state branches, ordering, search ranking, episode grouping), the rollup
diff --git a/backend/tests/test_plex_stream.py b/backend/tests/test_plex_stream.py
index 22859570..bb0e85c1 100644
--- a/backend/tests/test_plex_stream.py
+++ b/backend/tests/test_plex_stream.py
@@ -331,7 +331,7 @@ class TestWantHw:
 
     @staticmethod
     def _opencl(monkeypatch, present):
-        # Pin the OpenCL-runtime probe so the routing doesn't depend on the CI box's /etc/OpenCL.
+        # Pin the OpenCL-runtime probe so the routing doesn't depend on the test machine's /etc/OpenCL.
         monkeypatch.setattr(stream, "_opencl_present", lambda: present)
 
     def test_no_hw_when_not_transcoding(self, monkeypatch):
@@ -832,7 +832,7 @@ class TestProbeVideoKind:
 
 
 class TestProbeExitStatus:
-    """A probe whose ffprobe EXITS NON-ZERO is a failed probe, not an answer (E32). Each probe used to
+    """A probe whose ffprobe EXITS NON-ZERO is a failed probe, not an answer. Each probe used to
     read stdout without looking at the exit status, so a refusing ffprobe silently picked the fallback
     — HW-safe, single audio, the requested offset — and skipped the warning its except branch promises.
     Drives the REAL subprocess.run with the probe's own kwargs against a stand-in command that prints a
diff --git a/backend/tests/test_plex_subtitle_auth.py b/backend/tests/test_plex_subtitle_auth.py
index edbc5fb3..c9beb4f8 100644
--- a/backend/tests/test_plex_subtitle_auth.py
+++ b/backend/tests/test_plex_subtitle_auth.py
@@ -3,7 +3,7 @@
 They used to sit behind `_require_session`, the cookie-only gate the poster proxies use — a signed
 cookie was enough, with none of `current_user`'s checks (is_active, is_suspended, the session epoch
 that "log out everywhere" bumps). Fine for a poster; not for a route that starts reads of the media
-library. Found by the 2026-09 bug-hunt deep-review; the gate itself pre-dates that round.
+library. Found by a 2026-09 code review; the gate itself pre-dates that review.
 """
 
 from fastapi.testclient import TestClient
diff --git a/backend/tests/test_plex_subtitle_prepare.py b/backend/tests/test_plex_subtitle_prepare.py
index 87677ab8..613af2e3 100644
--- a/backend/tests/test_plex_subtitle_prepare.py
+++ b/backend/tests/test_plex_subtitle_prepare.py
@@ -12,7 +12,7 @@ thread sat with it), and picking the second language cost the whole read again.
 
 These tests pin the three things that fixes it: the request never waits for ffmpeg, the extraction
 publishes a window around the playhead before the whole track, and one ffmpeg run covers every
-embedded text track — plus what the deep-review of that fix found (cues doubled at the window/full
+embedded text track — plus what the review of that fix found (cues doubled at the window/full
 seam, a truncated pass cached as complete, a poll that respawned ffmpeg every second, a sidecar stuck
 behind an unrelated pass). No Postgres (the auth half is in test_plex_subtitle_auth.py, which needs
 the DB). Almost every test stubs ffmpeg out, but not all: a few run a real child process, and
@@ -316,7 +316,7 @@ def test_a_cached_vtt_from_an_older_build_counts_as_complete(tmp_path):
     assert subtitles.read_meta(key) == ([[0.0, 1_000_000_000.0]], True)
 
 
-# --- the deep-review round: the seams between the window and the full pass ----------------------
+# --- the seams between the window and the full pass ---------------------------------------------
 
 
 def test_a_window_and_the_full_pass_do_not_double_a_cue():
@@ -614,7 +614,7 @@ def test_an_absurd_position_is_rejected_before_it_reaches_ffmpeg(client, monkeyp
     assert pool.jobs == []
 
 
-# --- the second deep-review round ---------------------------------------------------------------
+# --- failed passes, seeks, saturation and shutdown ----------------------------------------------
 
 
 def _window_raises(monkeypatch):
@@ -865,7 +865,7 @@ def test_a_full_pass_resumed_mid_file_lines_up_on_a_real_file(tmp_path, monkeypa
     assert merged.count("-->") == 30, "a cue across the join was kept twice or lost"
 
 
-# --- the third deep-review round ----------------------------------------------------------------
+# --- transient failures, read-ahead, memos and slot fairness ------------------------------------
 
 
 def test_a_transient_failure_is_said_but_is_not_a_final_answer(monkeypatch):
@@ -1094,7 +1094,7 @@ def test_a_nul_rating_key_names_no_row():
     assert by_rating_key(None, PlexItem, "12\x0034") is None  # type: ignore[arg-type]
 
 
-# --- the fourth deep-review round ---------------------------------------------------------------
+# --- output that could not be kept, absurd keys -------------------------------------------------
 
 
 def test_a_pass_whose_output_could_not_be_kept_is_backed_off_like_a_failed_one(monkeypatch):
@@ -1154,7 +1154,7 @@ def test_an_absurd_rating_key_or_ordinal_is_refused_not_a_500(client, monkeypatc
     # ENAMETOOLONG rather than the real filesystem: on Linux pathlib re-raises it (the defect), but
     # Windows reports ERROR_INVALID_NAME, which pathlib's `exists()` already swallows — so on a dev
     # machine this assertion passed with `_exists` reverted and only the container lane was honest
-    # about it (deep-review round 5).
+    # about it.
     def _too_long(self):
         raise OSError(errno.ENAMETOOLONG, "File name too long")
 
diff --git a/backend/tests/test_plex_sync_prune.py b/backend/tests/test_plex_sync_prune.py
index c7b06a10..cfb5232a 100644
--- a/backend/tests/test_plex_sync_prune.py
+++ b/backend/tests/test_plex_sync_prune.py
@@ -1,4 +1,4 @@
-"""E3 S1 catalog-prune (B-sub-6): a sync now deletes rows for titles that disappeared from Plex,
+"""Catalog prune: a sync now deletes rows for titles that disappeared from Plex,
 diffing each section's freshly-listed rating_keys against the stored ones. The prune is GUARDED on a
 non-empty listing so a transient Plex glitch (an empty page) can never wipe a whole library.
 
diff --git a/backend/tests/test_plex_sync_txn.py b/backend/tests/test_plex_sync_txn.py
index f714b432..a2c19ea5 100644
--- a/backend/tests/test_plex_sync_txn.py
+++ b/backend/tests/test_plex_sync_txn.py
@@ -1,4 +1,4 @@
-"""DB-backed test for R6 S2's Plex per-section commit: a PlexError on a LATER library must keep the
+"""DB-backed test for the Plex per-section commit: a PlexError on a LATER library must keep the
 libraries already mirrored (committed per section), not roll the whole reconcile back. Uses the DB
 lane (`db` fixture) with a faked PlexClient — skipped without Postgres.
 """
diff --git a/backend/tests/test_plex_tmdb.py b/backend/tests/test_plex_tmdb.py
index e09335ee..7ee9cc44 100644
--- a/backend/tests/test_plex_tmdb.py
+++ b/backend/tests/test_plex_tmdb.py
@@ -1,4 +1,4 @@
-"""TMDB enrichment engine (E5 S2): the pure parser + persister, guid→tmdb-id resolution, and the
+"""TMDB enrichment engine: the pure parser + persister, guid→tmdb-id resolution, and the
 DB-lane batch/serve integration (enrich stamps the watermark + links people; serve_block resolves
 recommendations to library rows; the whole thing no-ops without an API key).
 
@@ -126,7 +126,7 @@ def test_parse_movie_pulls_all_fields():
         },
     ]  # the Gaffer is filtered; the two Coppola jobs survive (dedup is by name+job)
     assert d["studios"] == ["Paramount", "Alfran"]
-    # E30: the code beside the English name, so the client can name the country in the reader's language.
+    # The code beside the English name, so the client can name the country in the reader's language.
     assert d["production_countries"] == [{"code": "US", "name": "United States of America"}]
     assert [r["tmdb_id"] for r in d["recommendations"]] == [240, 999]
     assert d["backdrops"] == ["/bd1.jpg", "/bd2.jpg"]
@@ -432,7 +432,7 @@ def test_resolve_recs_matches_by_media_type_not_bare_id(db):
     assert hit[500]["in_library"] is True and hit[500]["rating_key"] == "s500"
 
 
-# ---- E30: countries by ISO code -----------------------------------------------------------------
+# ---- countries by ISO code -----------------------------------------------------------------------
 
 
 class FakeCountries(FakeTmdb):
diff --git a/backend/tests/test_plex_watch_reconcile.py b/backend/tests/test_plex_watch_reconcile.py
index ce50368c..1b2e7e61 100644
--- a/backend/tests/test_plex_watch_reconcile.py
+++ b/backend/tests/test_plex_watch_reconcile.py
@@ -1,5 +1,5 @@
 """The daily full watch reconcile (`run_plex_watch_reconcile`) — the one pass that DELETES watch state:
-a mirrored row Plex no longer has a record for is read as "Plex un-watched it" and cleared. E32 S2
+a mirrored row Plex no longer has a record for is read as "Plex un-watched it" and cleared. A review
 found it trusting a scan a Plex hiccup had cut short; these hold what it may and may not clear.
 """
 
@@ -149,7 +149,7 @@ _LISTED = [
 
 def test_a_genuinely_empty_second_section_still_lets_the_reconcile_clear(db, monkeypatch, world):
     # The server SAYS the shows section holds 0: that is a complete listing, not a hiccup — before
-    # the E32 review it read as "incomplete" forever and un-watches never synced again.
+    # a review it read as "incomplete" forever and un-watches never synced again.
     state, rows = world
     _local_states(state)
     db.commit()
@@ -181,8 +181,8 @@ def test_a_section_we_mirror_that_says_0_keeps_its_rows_and_does_not_hold_up_the
     db, monkeypatch, world
 ):
     # A total of 0 from a section our items come from is a Plex that lost the library for a moment,
-    # not one that un-watched all of it (E32 review round 2): its rows stay. And it is decided per
-    # section: before round 3 one such section (a library emptied on Plex, its mirrored items kept)
+    # not one that un-watched all of it: its rows stay. And it is decided per
+    # section: at first one such section (a library emptied on Plex, its mirrored items kept)
     # made EVERY run incomplete, and un-watches in every other section never synced again.
     state, rows = world
     _local_states(state)
@@ -196,7 +196,7 @@ def test_a_section_we_mirror_that_says_0_keeps_its_rows_and_does_not_hold_up_the
 
 def test_a_library_the_allowlist_leaves_out_keeps_its_watch_states(db, monkeypatch, world):
     # Its items are absent from every scan because the scan never walks it — not because Plex
-    # un-watched them. It cleared them on every run (E32 review round 2).
+    # un-watched them. It cleared them on every run.
     state, _rows = world
     other = PlexLibrary(plex_key="2", title="Shows", kind="show", enabled=True)
     db.add(other)
diff --git a/backend/tests/test_plex_watch_sync.py b/backend/tests/test_plex_watch_sync.py
index c812d147..6e119974 100644
--- a/backend/tests/test_plex_watch_sync.py
+++ b/backend/tests/test_plex_watch_sync.py
@@ -1,4 +1,4 @@
-"""S2 watch-sync semantics: Plex is the source of truth.
+"""Watch-sync semantics: Plex is the source of truth.
 
 Two independent pieces:
 - `_pull_apply` (DB lane): on a genuine divergence for an item Plex knows about, Plex now WINS —
@@ -45,7 +45,7 @@ class _FakePlex:
 
 
 def test_pull_plex_wins_over_diverging_synced_local_resume(db):
-    """The core S2 change: a SYNCED local row (its state already reached Plex) that later diverges from
+    """The core change: a SYNCED local row (its state already reached Plex) that later diverges from
     Plex = a real external Plex-side change, so the incremental pull resolves to PLEX's position — Plex
     is authoritative, no LWW. (A DIRTY local row is protected instead — see the dirty-guard test.)"""
     item_id, user_id = _seed_item_and_user(db)
@@ -210,7 +210,7 @@ def test_pull_settles_flag_on_matching_dirty_row(db):
 
 
 def test_movie_probe_flips_stale_in_progress_to_watched(db):
-    """S1 core: a local in-progress MOVIE that Plex has since finished (viewCount>0) and dropped from
+    """Core: a local in-progress MOVIE that Plex has since finished (viewCount>0) and dropped from
     Continue-Watching flips to watched on the incremental pass — without waiting for the daily reconcile.
     This is the "movie stuck in progress after scrubbing the credits" bug."""
     item_id, user_id = _seed_item_and_user(db)
diff --git a/backend/tests/test_python_engine_contract.py b/backend/tests/test_python_engine_contract.py
index f7298c8a..808d9735 100644
--- a/backend/tests/test_python_engine_contract.py
+++ b/backend/tests/test_python_engine_contract.py
@@ -1,4 +1,4 @@
-"""The Python major is a contract, not a coincidence — the backend half (E27 S3).
+"""The Python major is a contract, not a coincidence — the backend half.
 
 `0.93.2` was released to fix exactly this bug on the JavaScript side: four machines built or checked
 the app and none of them agreed on which Node they ran, the server gate went red for 73 of its last
diff --git a/backend/tests/test_quota_ownership.py b/backend/tests/test_quota_ownership.py
index 111fad14..a951ef98 100644
--- a/backend/tests/test_quota_ownership.py
+++ b/backend/tests/test_quota_ownership.py
@@ -1,4 +1,4 @@
-"""DB-backed tests for R6 S2 quota transaction ownership: quota accounting writes in its OWN
+"""DB-backed tests for quota transaction ownership: quota accounting writes in its OWN
 session, so a spend is DURABLE even when the calling job rolls back (the units were really consumed
 at YouTube), and it NEVER commits the caller's session (the old behaviour flushed a job's partial
 state mid-run behind its own rollback). Uses the DB lane (`db` fixture) — skipped without Postgres.
diff --git a/backend/tests/test_ratelimit.py b/backend/tests/test_ratelimit.py
index 3508aa1d..50b44132 100644
--- a/backend/tests/test_ratelimit.py
+++ b/backend/tests/test_ratelimit.py
@@ -1,4 +1,4 @@
-"""The sliding-window limiter behind /auth/register, password-login, password-reset and demo.
+"""The sliding-window limiter behind /auth/register, password-login and password-reset.
 
 Pure logic, no DB. `reset()` in particular is only ever called by a test fixture (conftest clears
 the module-level limiters between tests), so without a test here a refactor could turn it into a
diff --git a/backend/tests/test_request_models.py b/backend/tests/test_request_models.py
index 6309aa75..5b5d48b0 100644
--- a/backend/tests/test_request_models.py
+++ b/backend/tests/test_request_models.py
@@ -1,4 +1,4 @@
-"""R6 S1b: the request models turn payloads that used to 500 into clean validation errors,
+"""The request models turn payloads that used to 500 into clean validation errors,
 and PATCH models distinguish an absent field from an explicit null. Pure-logic (no DB) — it
 exercises the Pydantic models the route modules define, not the endpoints."""
 
@@ -51,7 +51,7 @@ def test_admin_quota_rejects_non_numeric_limit():
 
 def test_progress_accepts_fractional_seconds():
     # The player may post a raw currentTime (a float). The field must accept it (truncated in the
-    # handler) — a plain `int` field would 422 on the progress hot path. (code-review round 1.)
+    # handler) — a plain `int` field would 422 on the progress hot path.
     assert VideoProgressIn(position_seconds=12.7).position_seconds == 12.7
     assert int(VideoProgressIn(position_seconds=12.7).position_seconds) == 12
     with pytest.raises(ValidationError):
diff --git a/backend/tests/test_reset_link_states.py b/backend/tests/test_reset_link_states.py
index 30f0e7c7..05380afc 100644
--- a/backend/tests/test_reset_link_states.py
+++ b/backend/tests/test_reset_link_states.py
@@ -1,4 +1,4 @@
-"""What a dead email link says, and what it costs to ask (E9.5 S4 follow-up), DB-lane.
+"""What a dead email link says, and what it costs to ask, DB-lane.
 
 Reported 2026-09-05: delete an account, then open its password-reset link. The card drew a full
 "set a new password" form — because a `#reset=` fragment was present, nothing more — and only after
diff --git a/backend/tests/test_response_checked.py b/backend/tests/test_response_checked.py
index 655c8a23..b649078b 100644
--- a/backend/tests/test_response_checked.py
+++ b/backend/tests/test_response_checked.py
@@ -1,7 +1,7 @@
-"""No test sends a request and throws the response away (E32 S2).
+"""No test sends a request and throws the response away.
 
 A discarded `client.post(...)` passes whatever it got back. As a SETUP step, a failure leaves the
-test asserting on a state it never reached; as the step UNDER test, the test proves nothing. E32
+test asserting on a state it never reached; as the step UNDER test, the test proves nothing. We
 found `test_youtube_sources_never_consult_the_guard` passing on a 400 that stopped the request
 before the code it meant to exercise, and 53 more discarded responses across the suite. Each one
 now states the status it expects; this keeps it that way.
diff --git a/backend/tests/test_review_round.py b/backend/tests/test_review_round.py
index 6574e296..62202993 100644
--- a/backend/tests/test_review_round.py
+++ b/backend/tests/test_review_round.py
@@ -1,10 +1,13 @@
-"""E9.5 review round — the invariants the epic's own review found unpinned.
+"""The onboarding and access invariants a review of that work found unpinned.
 
 Every test here corresponds to a defect a reviewer could still introduce with the whole suite green:
-a mail whose body never renders in any test, an activation that only works for the exact spelling, a
-"we already wrote to them" stamp for a mail that was dropped, an env allow-list that answers a
-different question than the gate it backs, and the address pre-emption that E9.5 S1's argument
-covered only while the address stayed unverified.
+a mail whose body never renders in some language, a link lifetime described in the wrong unit, a
+registration that rewrites an existing password or kills a link already in flight, an activation
+that only works for the exact spelling, a "we already wrote to them" stamp for a mail that was
+dropped, an env allow-list that answers a different question than the gate it backs, a reset or
+resend that reports success it did not have, and a throttle that leaks whether an account exists.
+Approval's password revoke was called redundant because `password_login` refuses an unverified
+account; that holds only until the address is verified, which is what the tests on pre-emption pin.
 """
 
 from datetime import datetime, timedelta, timezone
@@ -79,7 +82,7 @@ def test_every_mail_renders_in_every_language(wire, name, args, lang):
 
 
 def test_a_weeks_link_is_described_in_days_not_hours(wire):
-    # The S6 approval token lives seven days, and the mail used to say "expires in 168 hours".
+    # The approval token lives seven days, and the mail used to say "expires in 168 hours".
     email_mod.send_access_approved("to@example.com", "en", "https://x/#verify=t", True, 168)
     assert "7 days" in wire[0][2] and "168" not in wire[0][2]
 
@@ -91,7 +94,7 @@ def test_a_weeks_link_is_described_in_days_not_hours(wire):
 
 
 def test_a_later_registration_never_touches_an_existing_password(db, client, smtp_on, wire):
-    """The rule E9.5's review round 2 put back, having tried the opposite and found it worse.
+    """The rule a review put back, having tried the opposite and found it worse.
 
     "While the address is unverified, the newest registration owns it" looked like a fix for address
     pre-emption. It is symmetric — an attacker can always be last — so it closed nothing, and it
@@ -175,7 +178,7 @@ def test_a_stripped_account_keeps_its_recovery_stamp(db, client, smtp_on, make_u
     assert row.password_hash is None and row.password_revoked_at is not None
 
 
-def test_a_denied_sibling_is_not_reopened_while_a_pending_row_exists(db, client):
+def test_a_denied_sibling_is_not_reopened_while_a_pending_row_exists(db):
     # Canonical siblings exist on prod. Picking the denied one reopens it and re-notifies every
     # admin, putting one person in the queue twice — and the exact-spelling tie-break made that
     # deterministic rather than merely possible.
@@ -187,9 +190,7 @@ def test_a_denied_sibling_is_not_reopened_while_a_pending_row_exists(db, client)
     )
     db.commit()
 
-    assert (
-        client.post("/auth/request-access", json={"email": "pairone@gmail.com"}).status_code == 200
-    )
+    auth_routes.upsert_pending_invite(db, "pairone@gmail.com")
 
     db.expire_all()
     rows = {i.email: i.status for i in db.execute(select(Invite)).scalars().all()}
@@ -210,12 +211,13 @@ def test_the_env_allow_list_is_matched_canonically(db, monkeypatch):
 
 
 def test_an_env_granted_address_cannot_be_shadowed_by_a_stranger(db, client, monkeypatch):
-    # `is_allowed` short-circuits on ANY invite row for the canonical form, so before this an
-    # unauthenticated caller could request access under a sibling spelling and permanently shadow an
-    # env grant. With the env list matched canonically the request never opens a row.
+    # `is_allowed` short-circuits on ANY invite row for the canonical form, so an unauthenticated
+    # caller registering under a sibling spelling would open a pending row and permanently shadow an
+    # env grant. The env list is matched canonically, so the registration never opens a row.
     monkeypatch.setattr(settings, "allowed_emails", "bob@gmail.com")
 
-    assert client.post("/auth/request-access", json={"email": "b.ob@gmail.com"}).status_code == 200
+    r = client.post("/auth/register", json={"email": "b.ob@gmail.com", "password": _PW})
+    assert r.status_code == 200
 
     assert db.execute(select(Invite)).scalars().all() == []
     assert auth_core.is_allowed(db, "bob@gmail.com") is True
@@ -351,12 +353,8 @@ def test_two_admins_two_languages_two_mails(db, client, make_user, smtp_on, wire
     make_user(email="hu.admin@example.com", role="admin", preferences={"language": "hu"})
     make_user(email="en.admin@example.com", role="admin", preferences={"language": "en"})
 
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "en"}
-        ).status_code
-        == 200
-    )
+    r = client.post("/auth/register", json={"email": "asking@example.com", "password": _PW})
+    assert r.status_code == 200
 
     notices = [w for w in wire if "asking@example.com" in w[1]]
     assert len(notices) == 2
diff --git a/backend/tests/test_route_conventions.py b/backend/tests/test_route_conventions.py
index c3850fe0..819232b9 100644
--- a/backend/tests/test_route_conventions.py
+++ b/backend/tests/test_route_conventions.py
@@ -23,11 +23,9 @@ COMMITTING_HELPERS = {
     "search.py:_ingest_candidates": "stages around YouTube calls: the stubs must survive an enrich "
     "that fails",
     "search.py:_classify_shorts": "the last stage of that ingest, after its probes",
-    "auth.py:upsert_pending_invite": "commits only when it writes — the contract its three "
+    "auth.py:upsert_pending_invite": "commits only when it writes — the contract its two "
     "callers rely on (`_register_account` persists its own flushed user because a no-op here "
     "commits nothing)",
-    "messages.py:ensure_welcome": "the websocket push after it must announce a row the client "
-    "can already fetch",
     "debug_sessions.py:_end_send": "gives back the claim a send took, in a `finally`: it runs when "
     "the handler is already unwinding and has no commit left to reach",
 }
@@ -48,9 +46,7 @@ SERIALIZERS = {
     "_collection_card",
     "_playlist_card",
     "_serialize",
-    "_serialize_demo",
     "_serialize_job",
-    "_serialize_msg",
     "_serialize_profile",
     "_serialize_user",
     "_summary",
diff --git a/backend/tests/test_saved_views_source.py b/backend/tests/test_saved_views_source.py
index a45938b5..23abc3b5 100644
--- a/backend/tests/test_saved_views_source.py
+++ b/backend/tests/test_saved_views_source.py
@@ -16,7 +16,7 @@ def _client(db, user, monkeypatch, override_dep):
         state, "_configured_cache", True
     )  # the request gate 503s an unconfigured app
     override_dep(get_db, db.info["request"])
-    override_dep(current_user, lambda: user)  # require_human resolves through this
+    override_dep(current_user, lambda: user)
     return TestClient(app)
 
 
@@ -70,7 +70,7 @@ def test_duplicate_name_within_a_source_conflicts(db, monkeypatch, override_dep)
 
 
 def test_a_feed_views_tag_pick_must_be_a_short_list_of_ids(db, monkeypatch, override_dep):
-    """The autotag job reads every view's tag pick (E32 review): the route holds it to the shape the
+    """The autotag job reads every view's tag pick: the route holds it to the shape the
     feed sends, on create and on update."""
     user = _user(db)
     c = _client(db, user, monkeypatch, override_dep)
diff --git a/backend/tests/test_scheduler.py b/backend/tests/test_scheduler.py
index abeac71f..9c47d3c9 100644
--- a/backend/tests/test_scheduler.py
+++ b/backend/tests/test_scheduler.py
@@ -28,7 +28,7 @@ def test_claim_is_exclusive_until_released():
     _release()
 
 
-# ---- E30: the result as data -------------------------------------------------------------------
+# ---- the result as data --------------------------------------------------------------------------
 
 
 def _snapshot_job(job_id):
@@ -70,7 +70,7 @@ def test_a_failed_run_drops_the_previous_result(db):
 
 
 def test_a_job_runs_audit_row_carries_its_result_as_data(db):
-    """E30 review: the audit log names a run's result in the reader's language, as the inbox does —
+    """The audit log names a run's result in the reader's language, as the inbox does —
     from data, not from the English one-liner (a nested phase there was a Python dict repr)."""
     from app.models import AuditLog, User
 
@@ -89,7 +89,7 @@ def test_a_job_runs_audit_row_carries_its_result_as_data(db):
 
 
 def test_a_failure_the_job_names_rides_along_as_data(db, make_user):
-    """E31: a failed RSS poll reached the Hungarian audit log as the server's English sentence. A
+    """A failed RSS poll reached the Hungarian audit log as the server's English sentence. A
     failure the job names (`progress.JobFailed`) is stored as data beside that sentence — on the
     dashboard, the manual-run notice and the audit row — so the client says it in the reader's
     language. Any other failure keeps only its own text (the test above)."""
diff --git a/backend/tests/test_search_scrape.py b/backend/tests/test_search_scrape.py
index b2dc0d79..79f071ae 100644
--- a/backend/tests/test_search_scrape.py
+++ b/backend/tests/test_search_scrape.py
@@ -1,4 +1,4 @@
-"""youtube/search_scrape — the zero-quota InnerTube search (E32 S2: the module was 20% covered).
+"""youtube/search_scrape — the zero-quota InnerTube search (the module was 20% covered).
 
 Everything here breaks silently when YouTube moves: a parser that stops finding videos, a cursor that
 stops paging, a fallback key that outlives its usefulness. The network is an httpx MockTransport.
@@ -168,7 +168,7 @@ def test_the_live_key_is_fetched_once_and_cached(net):
 def test_a_failed_key_fetch_falls_back_for_now_and_tries_again_next_time(net, results_html):
     """The fallback pair used to be CACHED for the life of the process: one failed fetch pinned
     every later search to a hard-coded key, and once that went stale search returned nothing,
-    with no error anywhere (E32 S2)."""
+    with no error anywhere."""
     net["handler"] = _serve(results_html=results_html)
     search_scrape.search("a")
     assert net["calls"][-1].url.params["key"] == search_scrape._FALLBACK_KEY
diff --git a/backend/tests/test_search_scrape_ingest.py b/backend/tests/test_search_scrape_ingest.py
index 7686f146..7961bcb2 100644
--- a/backend/tests/test_search_scrape_ingest.py
+++ b/backend/tests/test_search_scrape_ingest.py
@@ -104,7 +104,7 @@ def test_search_youtube_route_returns_422_when_ingest_fails(db, monkeypatch, ove
     from fastapi.testclient import TestClient
 
     import app.state as state
-    from app.auth import require_human
+    from app.auth import current_user
     from app.db import get_db
     from app.main import app
     from app.routes import search as search_mod
@@ -146,7 +146,7 @@ def test_search_youtube_route_returns_422_when_ingest_fails(db, monkeypatch, ove
     monkeypatch.setattr(search_mod, "_ingest_candidates", _boom)
 
     override_dep(get_db, db.info["request"])
-    override_dep(require_human, lambda: user)
+    override_dep(current_user, lambda: user)
     resp = TestClient(app).get("/api/search/youtube?q=test+term")
 
     assert resp.status_code == 422, resp.text
diff --git a/backend/tests/test_set_password_link.py b/backend/tests/test_set_password_link.py
index 2c037e24..5dcfc722 100644
--- a/backend/tests/test_set_password_link.py
+++ b/backend/tests/test_set_password_link.py
@@ -1,4 +1,4 @@
-"""E12 · S5 — the admin-issued set-password link.
+"""The admin-issued set-password link.
 
 One mechanism answering three things: SEC-15 (a no-SMTP instance auto-verifies every registration, so
 a pre-empted address cannot be recovered by mail), SEC-16 (a pre-empted address stays takeable until
@@ -155,18 +155,6 @@ def test_only_an_admin_can_mint_one(db, as_user, make_user):
     assert db.query(AuthToken).filter(AuthToken.kind == "setpw").count() == 0
 
 
-def test_the_shared_demo_account_is_refused(db, as_user, make_user):
-    """The demo account is shared, so handing anyone a way to change its password hands them
-    everyone else's session on it."""
-    admin = make_user(role="admin")
-    demo = make_user(is_demo=True)
-    db.commit()
-
-    r = as_user(admin).post(f"/api/admin/users/{demo.id}/set-password-link")
-    assert r.status_code == 400
-    assert r.json()["detail"]["reason"] == "demo"
-
-
 def test_the_access_panel_reports_the_gates(db, as_user, make_user):
     admin = make_user(role="admin")
     target = make_user(email_verified=False, is_active=False)
diff --git a/backend/tests/test_shorts_probe.py b/backend/tests/test_shorts_probe.py
index a05cc7b1..89be4fc8 100644
--- a/backend/tests/test_shorts_probe.py
+++ b/backend/tests/test_shorts_probe.py
@@ -1,4 +1,4 @@
-"""youtube/shorts.probe_is_short — three answers, and the third is not the second (E32 S2: 33% covered).
+"""youtube/shorts.probe_is_short — three answers, and the third is not the second (was 33% covered).
 
 A Short answers 200 at /shorts/<id>; a regular video redirects to /watch. Anything else — an error
 page, a network failure — is "undetermined, ask again", never "not a Short": that would file a Short
diff --git a/backend/tests/test_smoke.py b/backend/tests/test_smoke.py
index 83a897ba..4c737728 100644
--- a/backend/tests/test_smoke.py
+++ b/backend/tests/test_smoke.py
@@ -7,7 +7,7 @@ route registration or import fails right here.
 
 Endpoints that actually answer (/healthz, /api/version, the auth/feed/downloads routers) all touch
 the database, so exercising THEM belongs in a DB-backed integration lane (needs a test Postgres +
-migrations) — deferred; see siftlode-ops/ROADMAP.md R2 S2b.
+migrations) — deferred.
 """
 
 from fastapi.testclient import TestClient
diff --git a/backend/tests/test_source_size.py b/backend/tests/test_source_size.py
deleted file mode 100644
index 373a1f84..00000000
--- a/backend/tests/test_source_size.py
+++ /dev/null
@@ -1,145 +0,0 @@
-"""The size / complexity RATCHET for the backend (E32, owner 2026-10-03 — "class size" from the quality
-checklist, measured rather than argued). The frontend's twin is src/lib/sourceSize.contract.test.ts.
-
-Two limits, each with today's offenders as a CEILING:
-  * a module over MAX_LINES lines — a listed one may not grow past its line count; any other module
-    may not cross the limit;
-  * a function over ruff's C901 limit (cyclomatic complexity, MAX_COMPLEXITY) — a listed one, by its
-    NAME (`module::function`), may not rise; no other function may cross the limit. (Ranked per
-    module until the E32 review: one function could grow by what another in the same module lost.)
-    A rename reads as a new offender plus a stale entry: move its row.
-Shrinking is free; a module or function that drops UNDER the limit must be taken off its list (red
-until it is), so the lists only get shorter. Raising a ceiling is a decision for the owner, with the
-reason in docs/gates.md.
-
-C901 is measured here rather than switched on in ruff.toml because ruff has no per-function
-baseline: on, it would need a `noqa` on each of today's offenders, and a `noqa` lets the function
-grow without limit. This keeps the ceiling on the number.
-"""
-
-import json
-import re
-import subprocess
-import sys
-from pathlib import Path
-
-BACKEND = Path(__file__).resolve().parent.parent
-MAX_LINES = 800
-MAX_COMPLEXITY = 10  # ruff's C901 default (mccabe max-complexity)
-
-BIG_MODULES: dict[str, int] = {
-    "app/downloads/edit.py": 833,
-    "app/downloads/pipeline.py": 870,
-    "app/logs.py": 839,
-    "app/models.py": 1607,
-    "app/plex/stream.py": 1128,
-    "app/plex/subtitles.py": 1092,
-    "app/routes/admin.py": 864,
-    "app/routes/auth.py": 1353,
-    "app/routes/downloads.py": 1237,
-}
-
-COMPLEX: dict[str, int] = {
-    "app/bodylimit.py::__call__": 11,
-    "app/discover/hero.py::pick": 14,
-    "app/discover/pins.py::_shelf_card": 12,
-    "app/downloads/edit.py::normalize_edit_spec": 16,
-    "app/downloads/edit.py::run_ffmpeg": 15,
-    "app/downloads/formats.py::build_ydl_opts": 11,
-    "app/downloads/gc.py::_sweep_orphan_files": 15,
-    "app/downloads/gc.py::run_download_gc": 11,
-    "app/downloads/og.py::_jpeg_size": 12,
-    "app/downloads/og.py::_watch_tags": 11,
-    "app/downloads/pipeline.py::_download": 14,
-    "app/downloads/pipeline.py::_process_edit": 12,
-    "app/feedquery.py::feed_summary": 14,
-    "app/feedquery.py::filtered_query": 28,
-    "app/plex/query.py::meta_filter_conds": 13,
-    "app/plex/stream.py::start_session": 14,
-    "app/plex/subtitles.py::_ffmpeg_extract": 12,
-    "app/plex/sync.py::sync": 13,
-    "app/plex/tmdb.py::parse_tmdb": 11,
-    "app/plex/watch_sync.py::run_plex_watch_sync": 12,
-    "app/routes/auth.py::callback": 19,
-    "app/routes/debug_sessions.py::send_issue": 12,
-    "app/routes/downloads.py::resolve_source": 11,
-    "app/routes/plex/browse.py::facets": 25,
-    "app/routes/plex/browse.py::per_table": 13,
-    "app/routes/plex/browse.py::unified_library": 18,
-    "app/routes/plex/detail.py::item_detail": 13,
-    "app/routes/search.py::search_youtube": 15,
-    "app/sync/playlists.py::merge_playlist": 19,
-    "app/sync/runner.py::run_rss_poll": 13,
-    "app/sync/tagsuggest.py::compute_tag_suggestions": 14,
-    "app/worker.py::_run_supervised": 18,
-}
-
-
-def _line_counts() -> dict[str, int]:
-    return {
-        p.relative_to(BACKEND).as_posix(): len(p.read_text(encoding="utf-8").split("\n"))
-        for p in sorted((BACKEND / "app").rglob("*.py"))
-    }
-
-
-def _complexity() -> dict[str, int]:
-    """`module::function` -> its complexity; a name taken twice in a module gets ` 2`, ` 3` in
-    source order."""
-    out = subprocess.run(
-        [
-            sys.executable,
-            "-m",
-            "ruff",
-            "check",
-            "--config",
-            str(BACKEND / "ruff.toml"),
-            "--select",
-            "C901",
-            "--output-format",
-            "json",
-            "--exit-zero",
-            str(BACKEND / "app"),
-        ],
-        capture_output=True,
-        text=True,
-        check=True,
-    ).stdout
-    found: dict[str, int] = {}
-    for m in sorted(json.loads(out), key=lambda m: (m["filename"], m["location"]["row"])):
-        value = re.search(r"\((\d+) > \d+\)", m["message"])
-        name = re.search(r"`([^`]+)`", m["message"])
-        assert value and name, m["message"]
-        rel = Path(m["filename"]).resolve().relative_to(BACKEND).as_posix()
-        key, n = f"{rel}::{name.group(1)}", 2
-        while key in found:
-            key, n = f"{rel}::{name.group(1)} {n}", n + 1
-        found[key] = int(value.group(1))
-    return found
-
-
-def test_no_module_crosses_the_line_limit_and_a_listed_one_does_not_grow():
-    over = [
-        f"{f}: {n} lines (ceiling {BIG_MODULES.get(f, MAX_LINES)})"
-        for f, n in _line_counts().items()
-        if n > BIG_MODULES.get(f, MAX_LINES)
-    ]
-    assert over == []
-
-
-def test_lists_no_module_that_is_back_under_the_limit():
-    lines = _line_counts()
-    assert [f for f in BIG_MODULES if lines.get(f, 0) <= MAX_LINES] == []
-
-
-def test_no_function_crosses_the_complexity_limit_and_a_listed_one_does_not_rise():
-    worse = [
-        f"{fn}: {v} (ceiling {COMPLEX.get(fn, MAX_COMPLEXITY)})"
-        for fn, v in _complexity().items()
-        if v > COMPLEX.get(fn, MAX_COMPLEXITY)
-    ]
-    assert worse == []
-
-
-def test_lists_no_function_that_is_back_under_the_limit_or_gone():
-    actual = _complexity()
-    assert [fn for fn in COMPLEX if fn not in actual] == []
diff --git a/backend/tests/test_swallowed_exceptions.py b/backend/tests/test_swallowed_exceptions.py
index 5e1343b7..85e5d442 100644
--- a/backend/tests/test_swallowed_exceptions.py
+++ b/backend/tests/test_swallowed_exceptions.py
@@ -1,4 +1,4 @@
-"""E22.5 S3 — every swallowed exception has been ruled on.
+"""Every swallowed exception has been ruled on.
 
 A handler that neither logs nor re-raises is a decision: someone looked at it and decided the
 failure is not worth a line. 114 of them were in `app/` at the start of this epic, and almost none
diff --git a/backend/tests/test_sync_guards.py b/backend/tests/test_sync_guards.py
index 8408cbc7..5cbf6cca 100644
--- a/backend/tests/test_sync_guards.py
+++ b/backend/tests/test_sync_guards.py
@@ -227,7 +227,7 @@ class TestRssPollResult:
 
         with pytest.raises(RuntimeError, match="HTTP 404") as err:
             self._run(monkeypatch, fetch=dead, apply_=lambda db, ch, e: 1, channels=("UC_dead",))
-        # E31: and as data, for the reader's language — whose feed, and the reason code that tells a
+        # And as data, for the reader's language — whose feed, and the reason code that tells a
         # dead feed (`http_404`) from a dead egress (`transport`).
         assert isinstance(err.value, progress.JobFailed)
         assert (err.value.reason, err.value.params) == (
diff --git a/backend/tests/test_sysconfig_describe_queries.py b/backend/tests/test_sysconfig_describe_queries.py
index 9c1aff47..a1e7a59c 100644
--- a/backend/tests/test_sysconfig_describe_queries.py
+++ b/backend/tests/test_sysconfig_describe_queries.py
@@ -1,4 +1,4 @@
-"""The admin Configuration page reads every override in one query (E31 S4d).
+"""The admin Configuration page reads every override in one query.
 
 `sysconfig.describe()` did a `db.get` per key to tell whether an override was set, and `get()` did one
 more for its value: ~55 keys, and two round trips for a key with no row, since the session cannot cache
diff --git a/backend/tests/test_sysconfig_registry.py b/backend/tests/test_sysconfig_registry.py
index 4190f71e..8a2f5d9b 100644
--- a/backend/tests/test_sysconfig_registry.py
+++ b/backend/tests/test_sysconfig_registry.py
@@ -3,10 +3,10 @@ knob is a CHOICE.
 
 The admin Configuration page used to keep its own hand-written group order, which had already drifted
 (`explore` was missing, so its tab sorted last). The page now follows the registry: SECTIONS orders the
-groups under their headings (E31), and a group missing there would fall off the page — so each group
+groups under their headings, and a group missing there would fall off the page — so each group
 of SPECS sits in exactly one section.
 
-A closed-set admin knob is a CHOICE, not free text (E22 S2 follow-up).
+A closed-set admin knob is a CHOICE, not free text.
 
 `log_level`, `search_source`, `download_layout` and the transcode `hw`/`preset` used to be free-text
 fields: the admin could type anything and every consumer carried its own `or "auto").lower()` guess
@@ -81,7 +81,7 @@ class _FakeDb:
         return self.rows.get(key)
 
     def scalars(self, _stmt):
-        # describe() reads every override at once (E31 S4d).
+        # describe() reads every override at once.
         return list(self.rows.values())
 
 
diff --git a/backend/tests/test_tag_suggest.py b/backend/tests/test_tag_suggest.py
index 3552a2c7..7274736f 100644
--- a/backend/tests/test_tag_suggest.py
+++ b/backend/tests/test_tag_suggest.py
@@ -1,4 +1,4 @@
-"""DB-backed regression (E8·S4): the manual-tag-pattern suggester.
+"""DB-backed regression: the manual-tag-pattern suggester.
 
 compute_tag_suggestions learns which auto TOPIC tags are *characteristic* of each user tag (from the
 channels the user tagged), then proposes that tag for still-untagged subscribed channels whose own
diff --git a/backend/tests/test_upload.py b/backend/tests/test_upload.py
index 4a3d2160..39de2ca2 100644
--- a/backend/tests/test_upload.py
+++ b/backend/tests/test_upload.py
@@ -1,4 +1,4 @@
-"""E7 S5a — local file upload ingest (the non-yt-dlp path into the media library).
+"""Local file upload ingest (the non-yt-dlp path into the media library).
 
 Covers the ingest spine: media vs generic-file classification, the download-only serving of a
 generic file (force-download so uploaded HTML/SVG can't execute inline), quota accounting with the
@@ -131,7 +131,7 @@ def test_ingest_rejects_over_footprint_cap_before_writing(db, make_user, _root,
     assert db.query(MediaAsset).count() == 0  # and no orphan asset row
 
 
-# --- route: the auth-first body (P1) --------------------------------------------------------
+# --- route: the auth-first body ------------------------------------------------------------
 
 
 def _counting_body(chunks: int = 4, size: int = 1024):
@@ -183,10 +183,10 @@ def _counting_multipart(chunks: int = 4, size: int = 1024):
 
 
 def test_an_anonymous_upload_is_refused_before_a_byte_of_it_is_read(client):
-    """P1 — the defect E27 bounded but did not close.
+    """The defect an earlier fix bounded but did not close.
 
     While the route declared `file: UploadFile = File(...)`, FastAPI parsed and spooled the body
-    BEFORE the first dependency ran, so `require_human` could not gate it: an unauthenticated
+    BEFORE the first dependency ran, so the auth dependency could not gate it: an unauthenticated
     caller could make the server write the whole per-file allowance (500 MiB by default) to temp,
     per request. SEC-20's ceiling capped the number; it could not stop the writing.
 
@@ -433,7 +433,7 @@ def test_a_long_display_name_is_truncated_on_EVERY_route_that_takes_one(
     this varchar(255) column; `POST /api/downloads` and `POST /api/downloads/edit` kept the old
     `(x or "").strip() or None` and would still have answered a bare 500 (a psycopg DataError,
     which main.py re-raises for everything but the NUL case) to a name a user simply pasted. Found
-    by four independent readers in deep-review round 2 — a sweep is exactly the kind of thing that
+    by four independent readers of one review — a sweep is exactly the kind of thing that
     gets done four-fifths of the way, so this holds all of it at once.
     """
     _probe(monkeypatch, ("h264", "aac", 640, 480, 60))
@@ -487,7 +487,7 @@ def _display_write_sites() -> dict[tuple[str, str], set[str]]:
     TWO SHAPES, because the first version of this guard walked only `ast.Assign` and was therefore
     blind to the shape the upload route itself uses — `SpooledUpload(..., display_name=...)` is an
     `ast.keyword`, not an assignment, so the one site with an unbounded REQUEST HEADER behind it was
-    the site the guard could not see (deep-review round 3).
+    the site the guard could not see.
 
     ANNOTATED assignments are excluded on purpose: `display_name: Mapped[str | None] =
     mapped_column(...)` in `models.py` and `display_name: str | None = None` in a Pydantic model are
@@ -532,7 +532,6 @@ def _display_write_sites() -> dict[tuple[str, str], set[str]]:
 # file has transferred — so each of these has to be bounded, and each one here has been read.
 #
 # Bounded by `display_text` unless noted:
-#   auth.get_or_create_demo_user      a literal.
 #   service.redownload                CLEARS the field so the fresh metadata wins — `None` is the
 #                                     one value that needs no bound, and a clear is still a write.
 #   service.enqueue / enqueue_edit    `display_name` is already bounded by its caller; the fallback
@@ -541,10 +540,9 @@ def _display_write_sites() -> dict[tuple[str, str], set[str]]:
 #
 # Held as EXACT EQUALITY rather than as a list of offenders. The offender form could only fail
 # upward: refactoring the writers into a shape the walker did not recognise left it asserting
-# `not []` and enforcing nothing, which is how a drift guard dies quietly (round 3). This one fails
+# `not []` and enforcing nothing, which is how a drift guard dies quietly. This one fails
 # when a site appears, when one disappears, and when one changes what it writes.
 DISPLAY_WRITE_SITES = {
-    ("auth.py", "get_or_create_demo_user"): {"'Demo'"},
     ("downloads/service.py", "redownload"): {"None"},
     ("downloads/service.py", "enqueue"): {
         "display_name or (asset.title[:DISPLAY_TEXT_MAX] "
@@ -602,7 +600,7 @@ def test_the_display_name_header_reaches_the_job_and_is_bounded(
 ):
     """The second header, which had no backend test at all — and the length nothing bounded.
 
-    Since P1 the display name arrives in a REQUEST HEADER rather than as a form field, so the only
+    The display name arrives in a REQUEST HEADER rather than as a form field, so the only
     limit on it was the header size. The column is varchar(255), so a longer one reached Postgres as
     a DataError: a 500 AFTER the whole file had been transferred. It is truncated now, by the same
     helper the metadata PATCH uses.
@@ -629,7 +627,7 @@ def test_the_display_name_header_reaches_the_job_and_is_bounded(
 def test_the_upload_holds_no_db_transaction_while_the_body_streams(
     as_user, make_user, db, _root, monkeypatch, upload_headers
 ):
-    """P1 moved the body read behind the auth dependency, which put the whole transfer INSIDE the
+    """Moving the body read behind the auth dependency put the whole transfer INSIDE the
     request's database session: resolving the caller and reading the cap are SELECTs, SQLAlchemy 2.0
     autobegins on the first one, and the session then holds one of the twenty pooled connections —
     `idle in transaction` to Postgres, with no `idle_in_transaction_session_timeout` to end it — for
@@ -680,7 +678,7 @@ def test_the_usage_route_reports_the_per_file_upload_cap(as_user, make_user, db)
     """The dialog refuses an over-cap file off this number, and it is the only layer that produces
     a refusal carrying the limit on a default install — so the field is load-bearing, not
     decorative. Nothing held it: the route had no test at all, and the frontend's `DownloadUsage`
-    is an unvalidated cast, so dropping the key would have been green everywhere (round 2).
+    is an unvalidated cast, so dropping the key would have been green everywhere.
     """
     from app import sysconfig
 
@@ -916,7 +914,7 @@ class TestResolveMediaFacts:
         assert mediakind.derive(v, a) == mediakind.VIDEO  # NOT 'file'
 
     def test_the_duration_comes_from_the_file_when_info_has_none(self, monkeypatch):
-        # Facebook reel 257 (E11.5): yt-dlp gave no duration, the file is 128.4 s. A NULL duration hid
+        # Facebook reel 257: yt-dlp gave no duration, the file is 128.4 s. A NULL duration hid
         # the Library row's trim action.
         self._ffprobe(
             monkeypatch,
diff --git a/backend/tests/test_userscope.py b/backend/tests/test_userscope.py
index 5392963e..1071bd81 100644
--- a/backend/tests/test_userscope.py
+++ b/backend/tests/test_userscope.py
@@ -1,16 +1,16 @@
-"""is_messageable_user — the "real, active, non-suspended human" predicate reused by the messaging
-directory and the download share endpoints. A row must be non-demo AND active AND not-suspended."""
+"""is_messageable_user — the "active, non-suspended account" predicate reused by the download share
+endpoints. A row must be active AND not-suspended."""
 
 from types import SimpleNamespace
 
 from app.userscope import is_messageable_user
 
 
-def _user(is_demo=False, is_active=True, is_suspended=False):
-    return SimpleNamespace(is_demo=is_demo, is_active=is_active, is_suspended=is_suspended)
+def _user(is_active=True, is_suspended=False):
+    return SimpleNamespace(is_active=is_active, is_suspended=is_suspended)
 
 
-def test_a_real_active_human_is_messageable():
+def test_an_active_account_is_messageable():
     assert is_messageable_user(_user()) is True
 
 
@@ -18,7 +18,6 @@ def test_none_is_not_messageable():
     assert is_messageable_user(None) is False
 
 
-def test_demo_suspended_or_inactive_are_not_messageable():
-    assert is_messageable_user(_user(is_demo=True)) is False
+def test_suspended_or_inactive_are_not_messageable():
     assert is_messageable_user(_user(is_suspended=True)) is False
     assert is_messageable_user(_user(is_active=False)) is False
diff --git a/backend/tests/test_utils.py b/backend/tests/test_utils.py
index 091f402a..e9f84ab1 100644
--- a/backend/tests/test_utils.py
+++ b/backend/tests/test_utils.py
@@ -1,4 +1,4 @@
-"""iso(): the single date/datetime→JSON serializer the routes share (R6 S1a); to_tsquery_str()."""
+"""iso(): the single date/datetime→JSON serializer the routes share; to_tsquery_str()."""
 
 from datetime import date, datetime, timezone
 
@@ -64,7 +64,7 @@ def test_tsquery_prefix_matches_a_last_word_of_three_or_more():
 
 
 def test_tsquery_matches_a_short_last_word_whole():
-    # A 1-2 letter prefix made ts_rank score most of the library (5-8 s on prod, E31 S4e).
+    # A 1-2 letter prefix made ts_rank score most of the library (5-8 s on prod).
     assert to_tsquery_str("m") == "m"
     assert to_tsquery_str("minecraft 4k") == "minecraft & 4k"
     assert to_tsquery_str("ti amo m") == "ti & amo & m"
diff --git a/backend/tests/test_welcome_mail.py b/backend/tests/test_welcome_mail.py
index 4ce4f99d..7a7e63a2 100644
--- a/backend/tests/test_welcome_mail.py
+++ b/backend/tests/test_welcome_mail.py
@@ -1,4 +1,4 @@
-"""One mail, one click — the branching welcome/invitation mail (E9.5 S6), DB-lane.
+"""One mail, one click — the branching welcome/invitation mail, DB-lane.
 
 The funnel's common ordering makes a person open TWO messages: one saying their access is approved,
 another asking them to confirm their address. The C option carries the confirmation link inside the
diff --git a/backend/tests/test_youtube_refusals.py b/backend/tests/test_youtube_refusals.py
index c41b9765..2ec5c619 100644
--- a/backend/tests/test_youtube_refusals.py
+++ b/backend/tests/test_youtube_refusals.py
@@ -1,5 +1,5 @@
 """An action YouTube refuses answers a 422 the UI can translate — never a raw 500 — and says what the
-user can do about it (`routes/_common.youtube_refusal`). E9 F1: the two manual syncs had no handler
+user can do about it (`routes/_common.youtube_refusal`). The two manual syncs had no handler
 at all, so a quota or transport failure opened the blocking "Server error" dialog."""
 
 from types import SimpleNamespace
@@ -41,7 +41,7 @@ def test_a_failure_is_sorted_by_what_the_user_can_do(exc, reason):
 def test_a_missing_playlist_is_gone_only_on_a_route_about_that_playlist():
     # A playlist deleted on YouTube: neither a retry nor a reconnect helps (it said "reconnect").
     # Said only where the user picked that one list — anywhere else "this playlist no longer
-    # exists" names nothing on their screen (E32 review round 2).
+    # exists" names nothing on their screen.
     exc = YouTubeError("m", reason="playlistNotFound", path="playlists")
     assert refusal_reason(exc, playlist=True) == "gone"
     assert refusal_reason(exc) == "unavailable"
@@ -71,7 +71,7 @@ class _NoUploads:
 
 def test_a_channel_without_uploads_backfills_as_done_and_is_not_charged_again(db):
     # The recent pass stamped nothing on this answer, so the channel was picked — and charged a
-    # quota unit, with an ERROR traceback — on every backfill run, forever (E32 review round 3).
+    # quota unit, with an ERROR traceback — on every backfill run, forever.
     ch = Channel(id="UCempty", title="Empty", uploads_playlist_id="UUempty")
     db.add(ch)
     db.commit()
diff --git a/backend/tests/test_ytdlp_logging.py b/backend/tests/test_ytdlp_logging.py
index 02950256..bc98cacc 100644
--- a/backend/tests/test_ytdlp_logging.py
+++ b/backend/tests/test_ytdlp_logging.py
@@ -1,4 +1,4 @@
-"""E22.5 S4 — yt-dlp explains itself to our log, not to a stdout nobody reads.
+"""Yt-dlp explains itself to our log, not to a stdout nobody reads.
 
 `quiet: True` was doing more than quieting: with no `logger`, yt-dlp's whole account of a download
 went to the child process's stdout, so "Requested format is not available", a signature-extraction
diff --git a/docker-compose.localdev.yml b/docker-compose.localdev.yml
index 88dab27d..202ca5b8 100644
--- a/docker-compose.localdev.yml
+++ b/docker-compose.localdev.yml
@@ -1,138 +1,54 @@
-# Self-contained local development stack — Postgres + API + scheduler, all on this machine.
+# Self-contained local development stack — Postgres + API + scheduler + worker, all on this machine.
+# An OVERRIDE of docker-compose.yml, not a copy of it: only what local development changes lives
+# here, so the two cannot drift apart (they had — the worker here lost its wait for the API's
+# migrations).
 #
-# Fully decoupled: its own local database (a Docker volume) and its own scheduler, so there
-# is no shared DB and no migration coupling with any other instance. Edit code, rebuild, and
-# everything (including the background sync) runs right here.
+#   docker compose -f docker-compose.yml -f docker-compose.localdev.yml up -d --build
 #
-#   docker compose -f docker-compose.localdev.yml up -d --build
-#
-# Browse at http://localhost:8080 — Google login works because the OAuth redirect is
-# http://localhost:8080/auth/callback. The API runs `alembic upgrade head` on startup, so it
-# applies local migrations to THIS local DB only. Seed the catalog once with a pg_dump from
-# another instance if you want real data (see RUNBOOK).
-
-# Bounded container logs. Docker's json-file driver keeps every line forever by default, and the API
-# now writes one structured line per request (E22 S2) — 3×50 MB per service is days of history on a
-# busy instance and a hard ceiling on the disk it can take.
-x-logging: &logging
-  driver: json-file
-  options:
-    max-size: "50m"
-    max-file: "3"
+# Fully decoupled: its own local database (a Docker volume) and its own scheduler, so there is no
+# shared DB and no migration coupling with any other instance. Browse at http://localhost:8080 —
+# Google login works because the OAuth redirect is http://localhost:8080/auth/callback. The API runs
+# `alembic upgrade head` on startup, so it applies local migrations to THIS local DB only. Seed the
+# catalog once with a pg_dump from another instance if you want real data (see RUNBOOK).
 
 services:
   db:
-    image: postgres:16-alpine
-    environment:
-      POSTGRES_USER: ${POSTGRES_USER:-siftlode}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-siftlode}
-      POSTGRES_DB: ${POSTGRES_DB:-siftlode}
-    volumes:
-      - pgdata:/var/lib/postgresql/data
+    # Harmless on Docker Desktop; needed on some nested/hardened Docker hosts (every service below).
     security_opt:
       - apparmor:unconfined
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-siftlode} -d ${POSTGRES_DB:-siftlode}"]
-      interval: 5s
-      timeout: 5s
-      retries: 12
-    logging: *logging
-    restart: unless-stopped
 
   api:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      args:
-        APP_VERSION: ${APP_VERSION:-dev}
-        GIT_SHA: ${GIT_SHA:-unknown}
-        BUILD_DATE: ${BUILD_DATE:-}
-    env_file: .env
     environment:
-      # Own local database (overrides whatever DATABASE_URL is in .env).
-      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-siftlode}:${POSTGRES_PASSWORD:-siftlode}@db:5432/${POSTGRES_DB:-siftlode}
-      # This instance owns its scheduler now (its own DB, so no double-write concern).
+      # This instance owns its scheduler (its own DB, so no double-write concern).
       SCHEDULER_ENABLED: "true"
-      # Download center: the API serves finished files (it does NOT run the worker loop).
-      DOWNLOAD_ROOT: /downloads
-      WORKER_ENABLED: "false"
       # Plex HLS remux scratch on fast container-local storage (the /downloads bind-mount is a slow
       # Windows Docker Desktop mount in dev; prod uses fast local disk so it keeps the default).
       PLEX_HLS_DIR: /var/tmp/plex-hls
-    depends_on:
-      db:
-        condition: service_healthy
-    # Harmless on Docker Desktop; needed on some nested/hardened Docker hosts.
     security_opt:
       - apparmor:unconfined
-    ports:
-      - "${APP_PORT:-8080}:8000"
     volumes:
-      # Downloaded media lives on the host so you can inspect the generated Plex tree.
-      # Gitignored. The worker writes here; the API reads it to serve local downloads.
+      # Downloaded media lives on the host so you can inspect the generated Plex tree. Gitignored.
       - ./downloads:/downloads
-      # Plex media, read-only (see the plex_media volume note below). Maps to plex_path_map.
       - plex_media:/plex-media:ro
-    logging: *logging
-    restart: unless-stopped
 
-  # Dedicated download worker: same image, runs the yt-dlp job loop instead of the API.
-  # It shares the DB (job queue) and the downloads mount with the API.
   worker:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      args:
-        APP_VERSION: ${APP_VERSION:-dev}
-        GIT_SHA: ${GIT_SHA:-unknown}
-        BUILD_DATE: ${BUILD_DATE:-}
-    command: ["python", "-m", "app.worker"]
-    # tini as PID 1: reaps orphaned ffmpeg/yt-dlp grandchildren when the watchdog hard-kills a
-    # download child's process group (the worker reaps its own direct children via subprocess.wait).
-    init: true
-    env_file: .env
-    environment:
-      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-siftlode}:${POSTGRES_PASSWORD:-siftlode}@db:5432/${POSTGRES_DB:-siftlode}
-      # The worker must not also run the scheduler; the API owns that.
-      SCHEDULER_ENABLED: "false"
-      DOWNLOAD_ROOT: /downloads
-      WORKER_ENABLED: "true"
-    depends_on:
-      db:
-        condition: service_healthy
-      bgutil-pot:
-        condition: service_started
     security_opt:
       - apparmor:unconfined
     volumes:
       - ./downloads:/downloads
       - plex_media:/plex-media:ro
-    logging: *logging
-    restart: unless-stopped
 
-  # PO-token provider: mints YouTube Proof-of-Origin tokens on demand so the worker bypasses
-  # bot-detection and gets high-quality formats. The worker reaches it at http://bgutil-pot:4416
-  # (DOWNLOAD_POT_BASE_URL). Pin the tag to match the plugin version in requirements.txt.
   bgutil-pot:
-    image: brainicism/bgutil-ytdlp-pot-provider:1.3.1
-    init: true
     security_opt:
       - apparmor:unconfined
-    logging: *logging
-    restart: unless-stopped
 
 volumes:
-  pgdata:
   # OPTIONAL (Plex integration dev testing): the Plex media, mounted READ-ONLY so the container can
   # play the physical file locally (this dev box isn't the Plex host). Only referenced when the Plex
-  # module is enabled; harmless otherwise (Docker mounts it lazily on first container use). On prod
-  # (LXC on the Plex host) this is a plain host bind-mount.
-  #
-  # Local bind to a few test movies/shows kept on this box — the full nas.lan SMB share was too slow.
-  # Point PLEX_MEDIA_HOST_PATH (.env, gitignored, so no site path lives in the tracked compose) at the
-  # Docker-Desktop host path (e.g. /run/desktop/mnt/host/d/plex-test-media for D:\plex-test-media),
-  # mirroring the Plex server's /data/<lib>/… layout so plex_path_map (/data=/plex-media) resolves.
-  # (The prior CIFS/PLEX_SMB_* approach for the whole nas.lan share lives in git history.)
+  # module is enabled; harmless otherwise. Point PLEX_MEDIA_HOST_PATH (.env, gitignored, so no site
+  # path lives in the tracked compose) at the Docker-Desktop host path (e.g.
+  # /run/desktop/mnt/host/d/plex-test-media for D:\plex-test-media), mirroring the Plex server's
+  # /data/<lib>/… layout so plex_path_map (/data=/plex-media) resolves.
   plex_media:
     driver: local
     driver_opts:
diff --git a/docker-compose.selfhost.yml b/docker-compose.selfhost.yml
index e1ba83c0..d3087d9d 100644
--- a/docker-compose.selfhost.yml
+++ b/docker-compose.selfhost.yml
@@ -11,7 +11,7 @@
 # first run. See docs/self-hosting.md.
 
 # Bounded container logs. Docker's json-file driver keeps every line forever by default, and the API
-# now writes one structured line per request (E22 S2) — 3×50 MB per service is days of history on a
+# now writes one structured line per request — 3×50 MB per service is days of history on a
 # busy instance and a hard ceiling on the disk it can take.
 x-logging: &logging
   driver: json-file
diff --git a/docker-compose.yml b/docker-compose.yml
index de724afe..fe760858 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,5 +1,5 @@
 # Bounded container logs. Docker's json-file driver keeps every line forever by default, and the API
-# now writes one structured line per request (E22 S2) — 3×50 MB per service is days of history on a
+# now writes one structured line per request — 3×50 MB per service is days of history on a
 # busy instance and a hard ceiling on the disk it can take.
 x-logging: &logging
   driver: json-file
diff --git a/docs/DESIGN.md b/docs/DESIGN.md
index c4c48b5e..544589fb 100644
--- a/docs/DESIGN.md
+++ b/docs/DESIGN.md
@@ -705,3 +705,4 @@ of a full-width panel and nothing on the right.
 | 2026-10-02 | E31 Plex detail second column (refined)          | The facts over the key crew beside the text; the keywords, chips that filter like the genres, under the text; the show page gets all three too                                                                                                                                                                         | All three in the column, as the mockup drew it                                                                                                                                                         | At 20 keywords and 12 crew the column ran to twice the text's height (849 vs ~400 px at 133%): a hole under the text instead of beside it                                                     |
 | 2026-10-02 | E31 Plex detail poster and crew                  | The movie and show poster keeps its 2:3 and grows a rung in a wide hero (w-56 at a 64rem panel); the crew shows its first 6 names and "Show N more" (a list of 8 or fewer shows whole)                                                                                                                                 | Poster stretched to the row; a "More" on the keywords                                                                                                                                                  | The row is as tall as the crew column, so the poster drew ~175×590 and cropped; the crew, not the keywords, set the hero's height                                                             |
 | 2026-10-04 | E32 `field` focus skips a mode switch | A form opens on its first field; a control above it that is not a field (the composer's Edit / Preview) is passed over by marking the field `data-initial-focus` | The first text field everywhere | That moved the focus in the download dialog off its profile choice and in the upload dialog off its drop zone; the mark changes only the form that needs it |
+| 2026-10-04 | E35 Lint for z-levels and edged labels | Both rules stay; the two eslint selectors (`Z_RAW`, `EDGED_LABEL`) that refused them go | Keep the selectors | 0 hits since the E28 sweep that fixed the sites: a check that never fires costs a probe test and a snapshot each, and the UI review holds both rules |
diff --git a/docs/development.md b/docs/development.md
index 03b8cfae..bd9171e3 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -16,10 +16,10 @@ next. A gate that is green on a major you do not ship is green about nothing.
 
 ## Run it locally
 
-The whole stack (Postgres + API + worker) comes up from the localdev compose file:
+The whole stack (Postgres + API + worker) comes up from the base compose file plus the localdev override:
 
 ```bash
-docker compose -f docker-compose.localdev.yml up --build
+docker compose -f docker-compose.yml -f docker-compose.localdev.yml up --build
 ```
 
 Browse at **http://localhost:8080** (Google login works — the OAuth redirect is
@@ -43,9 +43,19 @@ A change is done when this is green, from the repo root:
 ```bash
 bash scripts/check.sh        # every lane
 bash scripts/check.sh lint   # the static lanes only (no tests, build or audits) — the quick loop
+bash scripts/check.sh --brief          # either mode: one line per lane, output only for a red one
+bash scripts/lint-changed.sh           # ruff + eslint + prettier on the uncommitted files only
 ```
 
-It runs every lane even after one fails and names each red one at the end. What it runs, and why
+It runs every lane even after one fails and names each red one at the end. `lint-changed.sh` is a
+convenience, not the gate; with `--hook` it doubles as a Claude Code Stop hook (silent when clean,
+the findings handed back otherwise).
+
+The codebase's health numbers — size, complexity, test ratio, gate weight, comment noise — come from
+`python scripts/audit_metrics.py` (seconds; it reports, it never fails). `--speed` adds the speed
+baseline (`frontend/e2e/speed.measure.ts`: the feed's first card and a shared `/watch` link's
+time-to-play against the :8080 stack, with `E2E_PASSWORD` set). An epic that changes structure
+compares its before and after. What it runs, and why
 each lane runs where it does, is in the script's comments; `frontend/src/lib/gates.contract.test.ts`
 holds its lines, so a lane dropped or narrowed there fails a test. What each gate deliberately does
 NOT check — and why — is the [gate register](gates.md). There is no CI: the gate runs here, and a
@@ -65,8 +75,8 @@ python -m ruff format --check --config backend/ruff.toml backend scripts
 docker compose -f backend/docker-compose.test.yml run --rm --no-deps --build test \
   python -m basedpyright --project pyrightconfig.json
 
-# tests — pure-logic + the DB-backed integration lane, against an ephemeral Postgres, ending with the
-# coverage total. The backend tree is bind-mounted, so it always tests your working files.
+# tests — pure-logic + the DB-backed integration lane, against an ephemeral Postgres. The backend
+# tree is bind-mounted, so it always tests your working files.
 docker compose -f backend/docker-compose.test.yml up --build --abort-on-container-exit --exit-code-from test
 docker compose -f backend/docker-compose.test.yml down -v
 
@@ -87,13 +97,16 @@ node ../scripts/check-node-modules.mjs   # node_modules == package-lock.json (el
 npm run typecheck     # tsc x3 (app / node / e2e)
 npm run lint          # eslint (typed rules included; warnings fail)
 npm run format:check  # prettier
-npm run knip          # unused files/exports/deps — and unused by what SHIPS (--production)
-npm run test          # vitest (incl. the compiler, size/complexity and gate-register contracts)
+npm run knip          # unused files/exports/deps
+npm run test          # vitest (incl. the compiler and gate-register contracts)
 npx vite build        # the production bundle (devOnlyGuard fails it on dev-only code)
 npm audit --omit=dev --audit-level=high   # what ships to the browser, at high or above
 ```
 
-Coverage is reported, never enforced: `npm run test -- --coverage`, and the pytest lane's last line.
+Coverage is on demand, never enforced and not in the gate (E35): `npm run test -- --coverage` in
+`frontend/`, and for the backend
+`docker compose -f backend/docker-compose.test.yml run --rm test python -m pytest --cov=app` (then
+`… down -v`).
 The Playwright suite (`npm run e2e`) runs against the `:8080` stack built from your tree; the release
 requires it. Before an image is pushed, it is scanned with Trivy (HIGH/CRITICAL with a fix fails;
 exceptions in `.trivyignore.yaml`, each with a reason and an expiry).
diff --git a/docs/gates.md b/docs/gates.md
index f1ebf3b8..fc88f61e 100644
--- a/docs/gates.md
+++ b/docs/gates.md
@@ -13,16 +13,18 @@ name its invariant. Whatever is left narrowed is listed here, and
 **effective** configuration and fails when a narrowing is not on this page. A row here is a decision,
 not an oversight; a narrowing missing from here is a test failure.
 
-**The snapshot.** ESLint's effective config for every code file `eslint .` reaches, and the lines
-that run the lanes (`scripts/check.sh`, `backend/docker-compose.test.yml`,
+**The snapshot.** ESLint's effective config for every scope `eslint .` reaches, and the lines that
+run the lanes (`scripts/check.sh`, `backend/docker-compose.test.yml`,
 `backend/Dockerfile.test`, the npm scripts, `vitest.config.ts`, `.prettierignore`), are committed in
 [`frontend/src/lib/gates.snapshot.json`](../frontend/src/lib/gates.snapshot.json). The test fails on
-ANY difference — a rule, an option, a glob that moves one file to another config, a new ignore, a gate
-flag. So a change to a gate is always a diff of that file in review, never a shape a detector failed
+ANY difference — a rule, an option, a new ignore, a gate flag. A scope is named by path (`scopeOf` in
+the test: `src`, `src tests`, `ui`, …) and every file in it must get the same config, so a glob that
+moves one file into another config fails too, while a new file in a known place changes nothing
+(until E35 the snapshot listed every file, and 31% of commits regenerated it). So a change to a gate is always a diff of that file in review, never a shape a detector failed
 to model (E32 review: three rounds of a cleverer detector each found a bypass of the last one's
 fixes). Regenerate it with `GATE_SNAPSHOT=update npx vitest run src/lib/gates.contract.test.ts`
-(from `frontend/`), and read its diff as a gate change: a new file only adds its path; anything else
-needs a reason. A new code file is part of that diff by design.
+(from `frontend/`), and read its diff as a gate change. A new kind of file (a new config, a new place)
+needs a line in `scopeOf`.
 
 **How the register is matched:** each narrowing must appear in a table row below as its
 `code-quoted` id, in a row whose **Scope** cell names the scope exactly as the test reports it (a cell
@@ -55,11 +57,8 @@ them itself (`no-undef`, `no-redeclare`, `no-dupe-keys`, …), nor the formattin
 | e2e | `@typescript-eslint/no-floating-promises` — narrowed | The same `allowForKnownSafeCalls` list (the typed rules are one object for both scopes). | 6 names |
 | lib/http.ts | `no-restricted-globals` — narrowed | A network owner (`NETWORK_OWNERS` in eslint.config.js): the one module that may call `fetch` (`send`, which `req` and the public pages go through). Every other network global stays restricted there. | 1 global |
 | lib/api/core.ts | `no-restricted-globals` — narrowed | A network owner: `uploadReq` is the one `XMLHttpRequest` (upload progress). | 1 global |
-| lib/messagesSocket.ts | `no-restricted-globals` — narrowed | A network owner: the chat socket is the one `WebSocket`. | 1 global |
 | src tests · ui tests · lib tests | `no-restricted-globals`, `no-restricted-properties` — off | A test stands a double in for the network (`vi.stubGlobal("fetch", …)`) and may reach it directly. | — |
-| src tests · ui tests · lib tests | `local/literal-a11y-text`, `local/button-primitive`, `local/input-primitive`, `local/surface-role`, `local/glyph-link` — off | A test renders throwaway markup (a raw button as a focus target, an untranslated label) that is not product UI. | — |
-| FocusSafeButton.tsx + AnchoredPopover.tsx | `local/focus-safe-disabled` — off | FocusSafeButton: it IS the focus-safe primitive the rule points everyone else to. | — |
-| FocusSafeButton.tsx + AnchoredPopover.tsx | `local/focus-safe-disabled` — off | AnchoredPopover: the popover's menu row: its native `disabled` is what floating-ui's roving focus reads to skip it. | — |
+| src tests · ui tests · lib tests | `local/literal-a11y-text`, `local/input-primitive`, `local/surface-role`, `local/glyph-link` — off | A test renders throwaway markup (a raw input as a focus target, an untranslated label) that is not product UI. `local/button-primitive` stays on: in a test file (and in a control primitive) it only refuses a raw `<button disabled>`, which drops focus there as anywhere. | — |
 | design-lab | `local/literal-a11y-text` — off | The dev-only design lab (never in the bundle — devOnlyGuard fails the build if it is) holds the owner's working copy, not product copy. | — |
 | e2e | `react-hooks/*`, `react-refresh/*`, `local/*`, `no-console`, `no-restricted-globals`, `no-restricted-properties`, `no-restricted-syntax` — not applied | Playwright specs drive a browser from Node: no React, no product UI, and they print to the console on purpose. They get the base + typed rules + the playwright rules. | — |
 | ts configs | `react-hooks/*`, `react-refresh/*`, `local/*`, `no-console`, `no-restricted-globals`, `no-restricted-properties`, `no-restricted-syntax` — not applied | The build configs (vite, vitest, playwright, reactPlugin, devOnlyGuard) run in Node at build time. | — |
@@ -88,29 +87,21 @@ project checks needs a row.
 | Scope | Narrowed | Why | Measured |
 | --- | --- | --- | --- |
 | backend + scripts | `B008` — narrowed: `fastapi.Depends`, `fastapi.Query` declared immutable | FastAPI's dependency injection IS a call in a default argument, on every route. Every other call in a default still fails. | 474 sites, all of them FastAPI |
-| backend/app | `C901` — not in ruff; measured by `tests/test_source_size.py` | Ruff has no per-function baseline, so turning it on would need a `noqa` per offender, and a `noqa` lets a function grow without limit. The test holds each offender, by name, at its current value. Tests and scripts are outside it: see the size / complexity rows under Lanes. | 32 functions over 10 |
+| backend/app | `C901` — not in ruff; reported by `scripts/audit_metrics.py` | Ruff has no per-function baseline, so turning it on would need a `noqa` per offender, and a `noqa` lets a function grow without limit. Complexity is a number an epic reads before and after (E35), not a gate: the ratchet that held it caught no defect in E32–E34, went red 8 times on its own ceilings and drew 5 review findings about itself. | 32 functions over 10 (E34) |
 
 ## basedpyright (backend)
 
 | Scope | Narrowed | Why | Measured |
 | --- | --- | --- | --- |
 | backend/app + alembic | `typeCheckingMode` — `standard` | Not `strict`/`all`: those report on every untyped third-party boundary (SQLAlchemy rows, yt-dlp dicts) — thousands of findings, near-zero real ones. `standard` was measured at 7 findings, all fixed (E32 S1). | — |
-| backend/app + alembic | `baseline.json` — pre-existing errors absorbed | The lane fails on NEW errors only; the baseline only shrinks (the lane fails when a run tightens it and it is not committed). Matching is per (file, rule, column span) + count, so burn the hot files first. | 195 entries (E32 S1) |
+| backend/app + alembic | `baseline.json` — pre-existing errors absorbed | The lane fails on NEW errors only; the baseline only shrinks (the lane fails when a run tightens it and it is not committed). Matching is per (file, rule, column span) + count. No burn-down mandate (E35): the entries go when their code is touched, not as work of their own. None of them was ever triaged one by one (the 7 findings E34 read were the `standard` ones above, fixed and not in the baseline), so an entry is not known to be harmless — the `reportOptional*` ones (24 in E35) are the likeliest real bugs; read one before re-baselining code around it. | 195 entries (E32 S1); 176 (E35) |
 | tests/ | not type-checked | A test's job is to fail loudly when wrong — the opposite of the silent runtime failure this lane catches — and annotating fixtures for a checker is churn. | — |
 
 ## pytest (backend)
 
 | Scope | Narrowed | Why | Measured |
 | --- | --- | --- | --- |
-| a hand run | `SIFTLODE_TEST_REQUIRE_DB=0` — the DB-backed and ffmpeg tests skip | The explicit "pure-logic only" run for a machine without Postgres. Off by default since E32: without it a missing DB is a hard error; the gate and CI never set it. | — |
-
-## knip (frontend)
-
-| Scope | Narrowed | Why | Measured |
-| --- | --- | --- | --- |
-| --production | `!**/*.testkit.ts!`, `!e2e/**!` | Test kits and the e2e suite are test code: the production pass asks what the SHIPPED code uses. | — |
-| --production | `!reactPlugin.ts!`, `!devOnlyGuard.ts!` | Build tooling the vite config imports: it shapes the bundle but is not in it. | — |
-| --production | `@internal` exports | An export only its test imports says so with a JSDoc `@internal` tag naming the test; knip skips those in production mode. | 35 (E32 S1) |
+| a hand run | `SIFTLODE_TEST_REQUIRE_DB=0` — the DB-backed and ffmpeg tests skip | The explicit "pure-logic only" run for a machine without Postgres. Off by default since E32: without it a missing DB is a hard error; the gate never sets it. | — |
 
 ## Lanes and pipeline
 
@@ -118,12 +109,10 @@ project checks needs a row.
 | --- | --- | --- | --- |
 | check | e2e (Playwright) not in `check` | It needs the :8080 stack built from the tree (minutes). It runs in `check-full`, and `release` rebuilds the stack and requires it (E32 D2) — nothing ships without it. | 5 specs × 3 engines |
 | pushes | no server-side gate (no CI) | Owner decision 2026-10-04. The gate (`scripts/check.sh`) runs on the dev machine before work is handed over, and `release` runs it, then e2e, before anything is merged and Trivy before the image is pushed — the CI only repeated that, after the merge. Its runner shared the git host's container, and one run there starved Gitea of memory until it stopped answering. What it added — a fresh `npm ci` on Linux — the image build does at publish. | — |
-| coverage | no threshold | Owner decision E32 D4: reported on both sides, never enforced. "Every regression test seen red" is the bar; a percentage invites tests written to move it. | frontend 80% / backend 78% of lines (E32 S1) |
+| coverage | not in the gate; no threshold | Owner decision E32 D4: never enforced; "every regression test seen red" is the bar, and a percentage invites tests written to move it. Out of the lanes since E35: read once, by hand, it found 5 bugs; as a lane it was a number nobody acted on, and the slowest vitest run (the one that flaked). On demand: docs/development.md. | frontend 80% / backend 78% of lines (E32 S1) |
 | CVE gate | HIGH/CRITICAL with a fix available only | `--ignore-unfixed` + `--severity HIGH,CRITICAL`: a finding with no fix cannot be acted on by an upgrade; it shows in the scan output. A fixable one fails the publish, and the only way past it is `.trivyignore.yaml`. | 0 open (E32 S1) |
 | npm audit | `--omit=dev --audit-level=high` | What ships to the browser, at high or above. The dev toolchain's advisories were burned down by hand in E32 S1 (18 → 0). | 0 |
 | React Compiler | the functions it skips, pinned | `components/compilerCoverage.contract.test.ts` — the list may only shrink. End state: only VirtualGrid (TanStack Virtual, an IncompatibleLibrary) remains. | 93 (E32 S1) → 29 (E32 S3) → 1, VirtualGrid (E32 S4) |
-| size / complexity | today's offenders as ceilings | `src/lib/sourceSize.contract.test.ts`, `backend/tests/test_source_size.py`: listed files and functions may not grow, nothing new may cross the limit, an entry back under it must be deleted. A function is held by its name, not its rank in the file. | files >800 lines: 13 FE / 9 BE; functions over the limit: 64 FE / 32 BE (E32 review) |
-| size / complexity | shipped code only — not tests, test kits, e2e or `scripts/` | The ratchet guards what runs in production. A test file is long because it is a list of cases, and a test kit is test code; splitting either moves lines without making anything easier to change. `scripts/` is release and seed tooling, not in the image. | outside it: tests >800 lines 2 FE / 5 BE; functions over the limit 2 FE test code (`gates.contract.test.ts` `eslintNarrowings` 23, E32 review round 3; `compilerSkips.testkit.ts` 25), 1 BE test (11), 1 script (`e2e_seed.py` `main` 13) |
 
 ## Accepted findings
 
diff --git a/frontend/e2e/README.md b/frontend/e2e/README.md
index f25b6885..fba13bd3 100644
--- a/frontend/e2e/README.md
+++ b/frontend/e2e/README.md
@@ -32,7 +32,7 @@ login-free `/watch/<token>` share link).
 - **`:8080`** (baked SPA) is authoritative and same-origin. After a **frontend change you must
   `siftlode dev` (rebuild)** for its baked SPA to carry the latest test hooks.
 - **`:5173`** (Vite dev) serves source live — the fast refactor loop; it proxies `/api` to `:8080`,
-  so the stack must still be up. All five flows are proxy-safe (none use the WebSocket):
+  so the stack must still be up. All five flows are proxy-safe:
 
   ```sh
   PW_BASE_URL=http://localhost:5173 siftlode e2e
@@ -40,7 +40,7 @@ login-free `/watch/<token>` share link).
 
 ## Account & fixture
 
-Tests run as a dedicated, **non-demo admin** account `e2e@siftlode.local` (never a real account;
+Tests run as a dedicated **admin** account `e2e@siftlode.local` (never a real account;
 admin so the suite can reach the admin-only pages / render branches, matching the real primary
 user), reset to a deterministic baseline every run by
 [`scripts/e2e_seed.py`](../../scripts/e2e_seed.py) (run
diff --git a/frontend/e2e/channel.spec.ts b/frontend/e2e/channel.spec.ts
index 2b9a3c23..e7b080a6 100644
--- a/frontend/e2e/channel.spec.ts
+++ b/frontend/e2e/channel.spec.ts
@@ -30,7 +30,7 @@ test.describe("channel view", () => {
     await expect(page.getByTestId("video-card").first()).toBeVisible();
   });
 
-  // Bug 1 (Platform S4): opening a channel and coming Back restores the feed's scroll position
+  // Opening a channel and coming Back restores the feed's scroll position
   // rather than dumping you at the top. The shell owns the scroller and remembers each view's offset.
   test("Back restores the feed scroll position", async ({ page }) => {
     await openApp(page);
@@ -60,7 +60,7 @@ test.describe("channel view", () => {
       .toBeGreaterThan(saved - 500);
   });
 
-  // Bug 2 (Platform S5): opening a channel no longer FORCES Live/Upcoming on — the channel view
+  // Opening a channel no longer FORCES Live/Upcoming on — the channel view
   // seeds its content-type prefs (normal / shorts / live) from the global feed. Locked both ways so
   // a future refactor can't silently re-hardcode it.
   test("the channel view inherits the feed's content filters (no forced Live/Upcoming)", async ({
@@ -86,7 +86,7 @@ test.describe("channel view", () => {
     await expectContentType(page, "includeLive", true);
   });
 
-  // Bug 2 (Platform S5): the channel view is its OWN filter scope — a content toggle made there
+  // The channel view is its OWN filter scope — a content toggle made there
   // must NOT leak back into the global feed. (FeedFiltersProvider owns the feed's filters; the
   // channel page keeps a separate local cell.)
   test("a channel's content toggle does not leak into the feed", async ({ page }) => {
@@ -106,7 +106,7 @@ test.describe("channel view", () => {
     await expectContentType(page, "includeLive", false);
   });
 
-  // Platform S4b + E31 S4c: the channel chrome sits outside the scroller. Scrolling into the videos
+  // The channel chrome sits outside the scroller. Scrolling into the videos
   // folds the banner and identity once (the name moves into the tab row); from then on the folded
   // chrome stays put while only the video grid scrolls.
   test("the channel chrome folds once, then stays fixed while the grid scrolls", async ({
diff --git a/frontend/e2e/feed.spec.ts b/frontend/e2e/feed.spec.ts
index 55700b6f..b636d78c 100644
--- a/frontend/e2e/feed.spec.ts
+++ b/frontend/e2e/feed.spec.ts
@@ -51,7 +51,7 @@ test.describe("feed", () => {
       .toBe(true);
   });
 
-  // Bug 4 (Platform S4): the toolbar (show/content chips, count, sort, view) is fixed chrome — it
+  // The toolbar (show/content chips, count, sort, view) is fixed chrome — it
   // pins in the shell's toolbar band above the scroller, so it stays put while the cards scroll.
   test("the feed toolbar stays pinned while cards scroll", async ({ page }) => {
     await openApp(page);
@@ -66,7 +66,7 @@ test.describe("feed", () => {
     expect(Math.abs(topAfter - topBefore)).toBeLessThan(4);
   });
 
-  // Bug 3 (Platform S4): changing a filter is a fresh result set, so the scroll jumps back to the
+  // Changing a filter is a fresh result set, so the scroll jumps back to the
   // top rather than stranding you deep in the old list's offset.
   test("a new filter resets the scroll to the top", async ({ page }) => {
     await openApp(page);
diff --git a/frontend/e2e/global.setup.ts b/frontend/e2e/global.setup.ts
index aa729556..782ca13e 100644
--- a/frontend/e2e/global.setup.ts
+++ b/frontend/e2e/global.setup.ts
@@ -76,7 +76,7 @@ setup("seed + authenticate", async ({ page }) => {
 
   // 4. Pin the UI locale, suppress the first-login onboarding wizard (a full-screen overlay
   //    that would intercept every click — the test account has no YouTube connection, so it
-  //    auto-opens), and opt the account out of starting on Home. Since E24 a bare URL lands on
+  //    auto-opens), and opt the account out of starting on Home. A bare URL lands on
   //    Home, and the feed, channel and player flows this net locks all open "/" expecting the
   //    feed; the opt-out is the one Settings → Appearance → Startup writes. Both flags are
   //    per-account: `siftlode.onboarding.dismissed.<id>`, `siftlode.startOnHome.<id>`.
diff --git a/frontend/e2e/helpers.ts b/frontend/e2e/helpers.ts
index 78dd0c80..d0681f04 100644
--- a/frontend/e2e/helpers.ts
+++ b/frontend/e2e/helpers.ts
@@ -18,7 +18,7 @@ export async function gotoPage(page: Page, id: string): Promise<void> {
  * Playwright would scroll it into view to click it, moving the scroll position — fatal to any test
  * that then asserts on where the feed was. Being inside the viewport is not enough either: a card
  * can sit under the page chrome above the scroller (the update banner, the toolbar band), and the
- * covered click makes Playwright scroll and retry — the same move (E32 S2: webkit failed 3 in 24).
+ * covered click makes Playwright scroll and retry — the same move (webkit failed 3 in 24).
  * So the link must be the element hit at its own centre. Returns false if none found.
  */
 export async function clickVisibleChannelLink(page: Page): Promise<boolean> {
diff --git a/frontend/e2e/nav.spec.ts b/frontend/e2e/nav.spec.ts
index 5637be7d..70142078 100644
--- a/frontend/e2e/nav.spec.ts
+++ b/frontend/e2e/nav.spec.ts
@@ -6,9 +6,9 @@ import { openApp } from "./helpers";
 // this exercises is precisely what the module-registry refactor replaces.
 test.describe("page switching", () => {
   // Core + admin modules (the E2E account is an admin, matching the real primary user), so this
-  // also exercises the admin pages. Since E31 those sit behind ONE rail row ("Administration",
+  // also exercises the admin pages. They sit behind ONE rail row ("Administration",
   // `nav-admin`) that opens a panel of them — the spec still listed them as rail rows of their own,
-  // and it failed on every run from E31 to E32 without anyone seeing it, because e2e was in no
+  // and it failed on every run for a while without anyone seeing it, because e2e was in no
   // required gate (it is now part of `release`).
   const RAIL = ["channels", "playlists", "stats", "settings", "feed"];
   const ADMIN = ["scheduler", "config", "users", "audit"];
diff --git a/frontend/e2e/player.spec.ts b/frontend/e2e/player.spec.ts
index a0599392..0fdc3bfd 100644
--- a/frontend/e2e/player.spec.ts
+++ b/frontend/e2e/player.spec.ts
@@ -2,7 +2,7 @@ import { test, expect } from "@playwright/test";
 import { openApp, openFirstVideo } from "./helpers";
 
 // Locks the in-app player's open/close contract. The player is a portaled overlay whose
-// inconsistent mounting caused an E3 regression — exactly the kind of thing the refactor's
+// inconsistent mounting caused a regression — exactly the kind of thing the refactor's
 // overlay-root convention must not break. We assert the modal shell, not YouTube playback.
 test.describe("player modal", () => {
   test.beforeEach(async ({ page }) => {
diff --git a/frontend/e2e/speed.measure.ts b/frontend/e2e/speed.measure.ts
new file mode 100644
index 00000000..8a661ca8
--- /dev/null
+++ b/frontend/e2e/speed.measure.ts
@@ -0,0 +1,126 @@
+import { test, type Page } from "@playwright/test";
+import { execFileSync } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+
+/**
+ * The speed baseline: numbers, not assertions — read by `scripts/audit_metrics.py --speed`, which
+ * runs this as the `speed` project (never part of the e2e suite: its file name is not a `.spec`).
+ * Each reading is the median of RUNS cold page loads (a fresh browser context, so no HTTP cache),
+ * against the localdev stack and the seeded E2E account. It is a baseline for before/after within
+ * one machine, not an absolute figure: the same measurement on a phone over the internet is slower.
+ *
+ * Not measured here: the in-app players (the E2E account owns no download, Plex item or watch
+ * history to open), and any iOS reading (Playwright's WebKit decodes media through the host OS —
+ * see playwright.config.ts) — the owner's phone gives that one by hand.
+ */
+
+const RUNS = 5;
+const OUT = "e2e/.speed/latest.json";
+const CONTAINER = process.env.E2E_DB_CONTAINER || "siftlode-db-1";
+
+const median = (xs: number[]) => [...xs].sort((a, b) => a - b)[Math.floor(xs.length / 2)] ?? NaN;
+
+/** JavaScript the page pulled in, uncompressed: the same on every stack (localdev serves it raw,
+ *  prod gzips it at the proxy), and what the browser has to parse. */
+const scriptBytes = (page: Page) =>
+  page.evaluate(() =>
+    (performance.getEntriesByType("resource") as PerformanceResourceTiming[])
+      .filter((r) => r.initiatorType === "script" || r.name.endsWith(".js"))
+      .reduce((sum, r) => sum + r.decodedBodySize, 0),
+  );
+
+/** Public share links on the local stack that could play: no password, not expired, asset ready.
+ *  The page itself is the judge of the last step (its file must be on THIS disk — a localdev DB
+ *  seeded from prod lists assets whose files never came along), so the caller probes them. */
+function shareTokens(): string[] {
+  const sql =
+    "select l.token from download_links l join download_jobs j on j.id = l.job_id" +
+    " join media_assets a on a.id = j.asset_id" +
+    " where l.password_hash is null and (l.expires_at is null or l.expires_at > now())" +
+    " and a.status = 'ready' order by l.id";
+  // Not caught: a database this cannot reach (no docker, a renamed container) is a failed
+  // measurement, not "no playable share link on the local stack".
+  const out = execFileSync(
+    "docker",
+    ["exec", CONTAINER, "psql", "-U", "siftlode", "-d", "siftlode", "-tAc", sql],
+    { encoding: "utf8" },
+  );
+  return out
+    .split("\n")
+    .map((t) => t.trim())
+    .filter(Boolean);
+}
+
+test("speed baseline", async ({ browser, page: page0 }) => {
+  test.setTimeout(180_000);
+  const result: Record<string, number | string | null> = {
+    measured_at: new Date().toISOString(),
+    runs: RUNS,
+  };
+
+  // Feed: navigation start → the first video card on screen.
+  const feedMs: number[] = [];
+  let feedJs = 0;
+  for (let i = 0; i < RUNS; i++) {
+    const ctx = await browser.newContext();
+    const page = await ctx.newPage();
+    await page.goto("/");
+    // Timed inside the page, every frame: an `expect` would read the clock on its own retry
+    // schedule (100 ms … 1 s steps), not when the card appeared.
+    const at = await page.waitForFunction(
+      () => document.querySelector('[data-testid="video-card"]') && performance.now(),
+      null,
+      { polling: "raf", timeout: 30_000 },
+    );
+    feedMs.push((await at.jsonValue()) as number);
+    feedJs = await scriptBytes(page);
+    await ctx.close();
+  }
+  result.feed_first_card_ms = Math.round(median(feedMs));
+  result.feed_js_raw_bytes = feedJs;
+
+  // /watch: navigation start → the shared video playing (started muted by script, standing in for
+  // the visitor's tap — the page has no autoplay).
+  let token: string | null = null;
+  for (const t of shareTokens()) {
+    if ((await page0.request.get(`/api/public/watch/${t}`)).ok()) {
+      token = t;
+      break;
+    }
+  }
+  if (token) {
+    const watchMs: number[] = [];
+    let watchJs = 0;
+    for (let i = 0; i < RUNS; i++) {
+      const ctx = await browser.newContext({ storageState: { cookies: [], origins: [] } });
+      const page = await ctx.newPage();
+      await page.goto(`/watch/${token}`);
+      await page.waitForFunction(() => document.querySelector("video, audio"), null, {
+        polling: "raf",
+        timeout: 30_000,
+      });
+      const video = page.locator("video, audio").first();
+      watchMs.push(
+        await video.evaluate(
+          (el: HTMLMediaElement) =>
+            new Promise<number>((resolve, reject) => {
+              el.muted = true;
+              el.addEventListener("playing", () => resolve(performance.now()), { once: true });
+              el.play().catch(reject);
+            }),
+        ),
+      );
+      watchJs = await scriptBytes(page);
+      await ctx.close();
+    }
+    result.watch_time_to_play_ms = Math.round(median(watchMs));
+    result.watch_js_raw_bytes = watchJs;
+  } else {
+    result.watch_time_to_play_ms = null;
+    result.watch_js_raw_bytes = null;
+    result.watch_note = "no playable share link on the local stack";
+  }
+
+  mkdirSync("e2e/.speed", { recursive: true });
+  writeFileSync(OUT, JSON.stringify(result, null, 2) + "\n");
+});
diff --git a/frontend/e2e/tsconfig.json b/frontend/e2e/tsconfig.json
index 81e33f9c..0972e972 100644
--- a/frontend/e2e/tsconfig.json
+++ b/frontend/e2e/tsconfig.json
@@ -11,7 +11,7 @@
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "noFallthroughCasesInSwitch": true,
-    // E32: an index read is `T | undefined` here, as it really is (0 errors when switched on).
+    // An index read is `T | undefined` here, as it really is (0 errors when switched on).
     "noUncheckedIndexedAccess": true,
     "esModuleInterop": true,
     "resolveJsonModule": true
diff --git a/frontend/eslint.config.js b/frontend/eslint.config.js
index 77659e09..eb786fef 100644
--- a/frontend/eslint.config.js
+++ b/frontend/eslint.config.js
@@ -10,28 +10,28 @@ import playwright from "eslint-plugin-playwright";
 
 // Flat config (ESLint 9). Deliberately NARROW: the high-value rules here are react-hooks' (the
 // hook rules and the React Compiler's diagnostics). The 33 inline `exhaustive-deps` suppressions this
-// config first met are all gone (0 left, E32 review); what is still suppressed is suppressed inline,
+// config first met are all gone (0 left); what is still suppressed is suppressed inline,
 // one site at a time, each naming its invariant. tsc already owns unused vars, undefined names
 // and types (noUnusedLocals/Parameters + strict), so typescript-eslint's non-type-checked
 // `recommended` is layered on but its overlap with tsc is turned off below to avoid double-reporting
 // and a churny diff. `eslint-config-prettier` is LAST so formatting rules never fight Prettier.
 //
 // reportUnusedDisableDirectives: a `// eslint-disable` that no longer suppresses anything is itself
-// an error — that is what keeps inert disable comments from re-accumulating (the S1b mandate).
+// an error — that is what keeps inert disable comments from re-accumulating.
 //
-// E32 (gate integrity): every switched-off or narrowed rule here is listed, with its reason and its
+// Gate integrity: every switched-off or narrowed rule here is listed, with its reason and its
 // measured count, in docs/gates.md, and lib/gates.contract.test.ts fails when one is not. A rule
 // with a single real hit is never switched off — its sites are fixed, or each suppressed inline with
 // a `-- <the invariant>` description (eslint-comments/require-description makes that mandatory).
 
-// E22 S4: every way out of the browser goes through the one module that LOGS it — a request line
-// with a request id (lib/http.ts), the upload XHR (lib/api/core.ts), the messages socket
-// (lib/messagesSocket.ts). A bare `fetch` elsewhere is a request the client log never sees, which is
-// exactly how the baseline survey found four. Each owner is exempt from its OWN global only.
+// Every way out of the browser goes through the one module that LOGS it — a request line
+// with a request id (lib/http.ts), the upload XHR (lib/api/core.ts). A bare `fetch` elsewhere is a
+// request the client log never sees, which is exactly how the baseline survey found four. Each owner
+// is exempt from its OWN global only; a global with no owner (null) has no exempt file at all.
 const NETWORK_OWNERS = {
   fetch: "src/lib/http.ts",
   XMLHttpRequest: "src/lib/api/core.ts",
-  WebSocket: "src/lib/messagesSocket.ts",
+  WebSocket: null,
   EventSource: null,
 };
 const networkGlobals = (exempt) =>
@@ -40,16 +40,16 @@ const networkGlobals = (exempt) =>
     .map(([name, owner]) => ({
       name,
       message: owner
-        ? `Use the logged request layer: \`${name}\` belongs to ${owner} only (E22 S4 — a request outside it never reaches the client log).`
-        : `No \`${name}\` without a logged owner module (E22 S4).`,
+        ? `Use the logged request layer: \`${name}\` belongs to ${owner} only — a request outside it never reaches the client log.`
+        : `No \`${name}\` without a logged owner module.`,
     }));
 const networkProperties = [
-  { object: "window", property: "fetch", message: "Use lib/http.ts `send` (E22 S4)." },
-  { object: "globalThis", property: "fetch", message: "Use lib/http.ts `send` (E22 S4)." },
+  { object: "window", property: "fetch", message: "Use lib/http.ts `send`." },
+  { object: "globalThis", property: "fetch", message: "Use lib/http.ts `send`." },
   {
     object: "navigator",
     property: "sendBeacon",
-    message: "Use lib/api/core.ts `beacon` (E22 S4).",
+    message: "Use lib/api/core.ts `beacon`.",
   },
 ];
 
@@ -70,28 +70,7 @@ const jsxCommentText = {
     };
   },
 };
-// A raw `<button disabled>` drops a focused keyboard user to <body> the moment its caller disables it
-// (a mutation pending, a list at its end, a form gone clean) — measured in Chrome, and ~60 buttons in
-// this app are disabled by their own click. `ui/FocusSafeButton` (and `ui/Button` on top of it)
-// keeps the focus; this is what stops a new raw one from reopening the hole.
-const focusSafeDisabled = {
-  meta: {
-    type: "problem",
-    messages: {
-      raw: "A raw <button disabled> throws a focused user to <body> when it turns disabled. Build the primitive on ui/FocusSafeButton; anywhere else use ui/Button, IconButton or Pressable.",
-    },
-  },
-  create(context) {
-    return {
-      JSXOpeningElement(node) {
-        if (node.name.type !== "JSXIdentifier" || node.name.name !== "button") return;
-        if (node.attributes.some((a) => a.type === "JSXAttribute" && a.name.name === "disabled"))
-          context.report({ node, messageId: "raw" });
-      },
-    };
-  },
-};
-// E28 S3g + E30 S3 (docs/DESIGN.md "Copy"): a date, a number and an alphabetical order are all in the
+// docs/DESIGN.md "Copy": a date, a number and an alphabetical order are all in the
 // UI language — dates and numbers built in lib/format.ts, text compared in lib/collate.ts. A bare
 // `toLocaleString()` formats in the BROWSER's locale (seven date sites had drifted into five shapes), a
 // bare `toFixed` writes the English decimal point, a bare `localeCompare` sorts in the browser's
@@ -155,11 +134,17 @@ const localeFormat = {
     };
   },
 };
-// E28 S3b: one primitive per button family (docs/DESIGN.md). 268 hand-rolled buttons in 79 files had
+// One primitive per button family (docs/DESIGN.md). 268 hand-rolled buttons in 79 files had
 // drifted into as many looks, heights and hover styles; they were swept onto ui/Button, IconButton,
 // Pressable, Chip and DragHandle, and this keeps the next one out. The raw element lives only in the
 // files that ARE a control primitive — not in the rest of components/ui/, whose composites (a pager, a
 // side panel, a toast) are built from the primitives like any feature component.
+//
+// The same rule keeps a raw `<button disabled>` out of the primitives themselves, and out of tests: a
+// native disabled drops a focused keyboard user to <body> the moment the button turns disabled (a
+// mutation pending, a list at its end, a form gone clean) — measured in Chrome, and ~60 buttons in this
+// app are disabled by their own click. ui/FocusSafeButton (and ui/Button on top of it) keeps the
+// focus. (It used to be its own rule, `focus-safe-disabled`.)
 const BUTTON_PRIMITIVES = new Set([
   "FocusSafeButton.tsx", // the focus-keeping <button> everything stands on
   "Button.tsx",
@@ -177,26 +162,42 @@ const BUTTON_PRIMITIVES = new Set([
   "FilterSelect.tsx", // its option rows
   "Combobox.tsx", // the field's chevron (A4)
 ]);
+// The two that ARE the raw disabled button: the primitive itself, and the popover's menu row, whose
+// native `disabled` is what floating-ui's roving focus reads to skip it (see ActionMenu).
+const NATIVE_DISABLED = new Set(["FocusSafeButton.tsx", "AnchoredPopover.tsx"]);
 const buttonPrimitive = {
   meta: {
     type: "problem",
     messages: {
       raw: "A raw <{{name}}> outside the control primitives: use ui/Button (a labelled action), IconButton (a glyph), Pressable (a card or row that is the control), Chip or DragHandle.",
       role: 'A <{{name}} role="button"> is a hand-built button (its own Enter/Space, no focus-safe disabled, no touch target): use ui/Pressable for a surface that is the control.',
+      disabled:
+        "A raw <button disabled> throws a focused user to <body> when it turns disabled. Build the primitive on ui/FocusSafeButton; anywhere else use ui/Button, IconButton or Pressable.",
     },
   },
   create(context) {
     const path = context.filename.split("\\").join("/");
     const file = path.slice(path.lastIndexOf("/") + 1);
-    if (path.includes("/src/components/ui/") && BUTTON_PRIMITIVES.has(file)) return {};
+    const ui = path.includes("/src/components/ui/");
+    // A test renders a raw button as a stand-in trigger or a focus target — not product UI, so only
+    // the disabled check applies to it.
+    const exempt = (ui && BUTTON_PRIMITIVES.has(file)) || /\.test\.tsx?$/.test(path);
+    const nativeDisabled = ui && NATIVE_DISABLED.has(file);
     return {
       JSXOpeningElement(node) {
         if (node.name.type !== "JSXIdentifier") return;
         const name = node.name.name;
-        if (name === "button" || name === "FocusSafeButton")
+        if (
+          name === "button" &&
+          !nativeDisabled &&
+          node.attributes.some((a) => a.type === "JSXAttribute" && a.name.name === "disabled")
+        )
+          context.report({ node, messageId: "disabled" });
+        else if (exempt) return;
+        else if (name === "button" || name === "FocusSafeButton")
           context.report({ node, messageId: "raw", data: { name } });
-        // S3g: the same button spelled as a div with a role slipped past the rule above (my own
-        // S3h Plex picture). A component (capitalised) may take a role for its own reasons.
+        // The same button spelled as a div with a role slipped past the rule above (one Plex
+        // picture did it). A component (capitalised) may take a role for its own reasons.
         else if (
           /^[a-z]/.test(name) &&
           node.attributes.some(
@@ -212,8 +213,8 @@ const buttonPrimitive = {
     };
   },
 };
-// The same for a text field and the native checkbox / slider / colour well (docs/DESIGN.md A4, A6;
-// E28 S3c): ~100 hand-styled boxes carried six edges, four radii and two focus looks between them. A
+// The same for a text field and the native checkbox / slider / colour well (docs/DESIGN.md A4, A6):
+// ~100 hand-styled boxes carried six edges, four radii and two focus looks between them. A
 // file picker has no look (it is hidden behind a Button), so it passes.
 const INPUT_PRIMITIVES = new Set([
   "Input.tsx",
@@ -246,7 +247,7 @@ const inputPrimitive = {
     };
   },
 };
-// B5 (docs/DESIGN.md; E28 S3d): a glass surface is a ROLE from ui/surfaces.ts, which brings its radius.
+// B5 (docs/DESIGN.md): a glass surface is a ROLE from ui/surfaces.ts, which brings its radius.
 // ~140 sites had paired the three glass tiers with five radii and three menu paddings. A class string
 // (two or more tokens, so `variant="glass"` passes) holding a bare glass tier is refused outside the
 // role table and the control primitives that paint a glass BUTTON face.
@@ -388,7 +389,7 @@ const sortableA11y = {
   },
 };
 // An <a> whose content is only a glyph is a link that looks like a button (DESIGN.md): `IconLink`, with
-// a name, a 24+ box and the icon button's layer. The E28 audit found five bare 14px ones. Text or an
+// a name, a 24+ box and the icon button's layer. An audit found five bare 14px ones. Text or an
 // expression anywhere in its CHILDREN (not its attributes: every link has an `href={…}`) is a text
 // link or a card, and passes; a self-closing <a> is a `Trans` slot that i18n fills with text.
 const glyphLink = {
@@ -422,7 +423,6 @@ const localRules = {
     "glyph-link": glyphLink,
     "sortable-a11y": sortableA11y,
     "jsx-comment-text": jsxCommentText,
-    "focus-safe-disabled": focusSafeDisabled,
     "button-primitive": buttonPrimitive,
     "locale-format": localeFormat,
     "input-primitive": inputPrimitive,
@@ -431,24 +431,16 @@ const localRules = {
   },
 };
 
-// A px-frozen BOX utility (the no-restricted-syntax block below): an esquery regex, as a string.
-// `[\d.]+`, not `\d+`: a fractional `text-[9.5px]` slipped past the integer-only pattern.
+// A px-frozen BOX (the no-restricted-syntax block below): an esquery regex, as a string. A box utility
+// (`w-[150px]`) or a grid's auto-fill column MINIMUM (`minmax(150px,1fr)`): the text inside grows with
+// the slider while the box or the column floor stays, so it re-wraps, clips or cramps at a large text
+// size (seen in the grid). `[\d.]+`, not `\d+`: a fractional `text-[9.5px]` slipped past the
+// integer-only pattern. A fixed track (`grid-cols-[1fr_240px]`) is left alone, as is VirtualGrid's
+// measured `minCol` (a number).
 const BOX_PX =
-  "/(^|[\\s:])(min-|max-)?(w|h|size|left|right|top|bottom|inset|gap|p[xytrbl]?|m[xytrbl]?)-\\[[\\d.]+px\\]/";
+  "/(^|[\\s:])(min-|max-)?(w|h|size|left|right|top|bottom|inset|gap|p[xytrbl]?|m[xytrbl]?)-\\[[\\d.]+px\\]|minmax\\([\\d.]+px,/";
 const BOX_PX_MESSAGE =
-  "px-frozen box size doesn't scale with --font-scale: use the spacing scale (w-37.5, max-w-60), not w-[Npx].";
-// …and a grid's auto-fill column MINIMUM in px (`minmax(150px,1fr)`): the cards' text grows with the
-// slider while the column floor stays, so the cards get cramped at a large text size (E30 review). A
-// fixed track (`grid-cols-[1fr_240px]`) is left alone, as is VirtualGrid's measured `minCol` (a number).
-const GRID_MIN_PX = "/minmax\\([\\d.]+px,/";
-const GRID_MIN_PX_MESSAGE =
-  "px-frozen box size doesn't scale with --font-scale: give a grid column's minimum in rem (minmax(9.375rem,1fr)), not minmax(Npx,…).";
-// A stacking order outside the layer scale (DESIGN.md Tokens: `base < menu < chrome < … < tooltip` in
-// index.css). A numeric `z-10` equals a level today but doesn't follow it when the scale moves; name it.
-const Z_RAW = "/(^|[\\s:])-?z-([1-9]\\d*|\\[[^\\]]+\\])(?![\\w-])/";
-const Z_RAW_MESSAGE =
-  "z-index off the layer scale: use a named level (z-under, z-base, z-menu, z-chrome, z-panel, z-rail, z-overlay, z-popover, z-tooltip), not z-N or z-[…].";
-
+  "px-frozen box size doesn't scale with --font-scale: use the spacing scale (w-37.5, max-w-60) or rem (minmax(9.375rem,1fr)), not w-[Npx] or minmax(Npx,…).";
 // A hover that swaps a colour instead of laying the B3 state layer (DESIGN.md Tokens): `bg-card`,
 // `bg-border` and `bg-surface` vanish on a light card, an opacity dim reads as "disabled", and
 // `bg-(--hover)` restates the `state-layer` utility by hand. `group-hover:` (a reveal on a parent's
@@ -466,23 +458,15 @@ const PALETTE =
 const PALETTE_MESSAGE =
   "a palette colour: use a semantic token (text-rating, bg-live, bg-media-chrome, text-danger, …; DESIGN.md Tokens), not text-amber-500.";
 
-// A static label with an edge (DESIGN.md "Static vs pressable", audit F29): a <span> drawn round with a
-// border reads as a chip, is clicked and does nothing. A label that does nothing is ui/Badge (flat).
-// A small `rounded` box (a check mark drawn inside a menu row) is a glyph, not a label: only the label
-// radii match.
-const EDGED_LABEL = "/^(?=.*(^|\\s)rounded-(full|md|lg|xl|2xl)(\\s|$))(?=.*(^|\\s)border(\\s|$))/";
-const EDGED_LABEL_MESSAGE =
-  "a static label with an edge reads as a pressable chip: use ui/Badge (flat, tonal) for a label that does nothing.";
-
 // A class name split by an interpolation: the text right after `${…}` starts with a variant (`hover:`),
-// or the interpolation IS the variant and the text goes on with its class (`${NARROW}:w-24`, E28 S3f3).
+// or the interpolation IS the variant and the text goes on with its class (`${NARROW}:w-24`).
 // A clock (`${m}:00`) and a URL (`${u}://`) are not classes.
 const SPLIT_CLASS = "/^([a-z][\\w-]*:[\\w\\[!-]|:[a-z\\[!])/";
 const SPLIT_CLASS_MESSAGE =
   "a class split by an interpolation (`${x}hover:…`): Tailwind never sees it whole and emits no CSS; write the class literally (a shared guard is the `act:` variant).";
 
 // Applies to EVERY linted file: a suppression says which rule and why. A bare
-// `eslint-disable-next-line rule` named nothing in four places the E32 audit found, against the
+// `eslint-disable-next-line rule` named nothing in four places an audit found, against the
 // CLAUDE.md rule that each one names its invariant; a blanket `eslint-disable` names no rule at all.
 const suppressionRules = {
   plugins: { "@eslint-community/eslint-comments": eslintComments },
@@ -493,9 +477,9 @@ const suppressionRules = {
   },
 };
 
-// The two type-aware rules (E32 D3: a curated pair, not strictTypeChecked — ~2000 hits there, none
+// The two type-aware rules (a curated pair, not strictTypeChecked — ~2000 hits there, none
 // real in the sample). A floating promise is a rejection nobody handles: the audit found two real
-// ones (ChatDock's device key store, VideoEditor's play()). `void` marks a deliberate fire-and-forget
+// ones (the chat dock's device key store, since removed, and VideoEditor's play()). `void` marks a deliberate fire-and-forget
 // whose callee reports its own failure. React Query's invalidate/refetch family never rejects
 // unless asked to (`throwOnError`), so those calls are known-safe by name.
 const typedRules = {
@@ -540,46 +524,41 @@ export default tseslint.config(
     rules: {
       ...reactHooks.configs.recommended.rules,
       ...typedRules,
-      // The React Compiler's own diagnostics that `recommended` leaves out (E32). Each is a function
+      // The React Compiler's own diagnostics that `recommended` leaves out. Each is a function
       // the compiler SKIPS, silently — `panicThreshold` is "none" and there is no logger, so a lint
       // error is the only place the skip is said out loud. `todo` is the compiler's "cannot lower
-      // this shape yet" (E32 S4 rewrote all 31 try statements it found); the rest had 0 hits when
-      // switched on. Most are tripwires, but three cannot report anything under
-      // eslint-plugin-react-hooks 7.1.1 (E32 review, read in its source and probed):
-      // `exhaustive-effect-dependencies` (its validation is compiled off — a missing effect dependency
-      // is reported by the classic `exhaustive-deps` only), `memoized-effect-dependencies` (nothing
-      // emits its category) and `rule-suppression` (lint mode hands it no suppression rules, so an
-      // inline disable is never named). They stay on for the plugin version that wires them up; a
-      // function the compiler skips over a suppression is caught by the coverage ratchet below.
+      // this shape yet" (all 31 try statements it found were rewritten); the rest had 0 hits when
+      // switched on, and are tripwires. Three more exist but cannot report anything under
+      // eslint-plugin-react-hooks 7.1.1 (read in its source and probed), so they are not
+      // listed: `exhaustive-effect-dependencies` (its validation is compiled off — the classic
+      // `exhaustive-deps` reports a missing effect dependency), `memoized-effect-dependencies` (nothing
+      // emits its category) and `rule-suppression` (lint mode hands it no suppression rules). A
+      // function the compiler skips over a suppression is caught by the coverage contract below.
       // `todo` does NOT see every such shape — a conditional, a loop
       // or an optional call inside a try skips the function with no lint hit at all — so the full
       // per-function picture is components/compilerCoverage.contract.test.ts.
       "react-hooks/todo": "error",
       "react-hooks/memo-dependencies": "error",
-      "react-hooks/rule-suppression": "error",
       "react-hooks/invariant": "error",
       "react-hooks/syntax": "error",
       "react-hooks/void-use-memo": "error",
       "react-hooks/component-hook-factories": "error",
       "react-hooks/capitalized-calls": "error",
       "react-hooks/hooks": "error",
-      "react-hooks/memoized-effect-dependencies": "error",
-      "react-hooks/exhaustive-effect-dependencies": "error",
       "react-hooks/no-deriving-state-in-effects": "error",
       // eslint-plugin-react-hooks 7's `recommended` is no longer two rules — it carries the whole
-      // React Compiler rule set (E27 S1). On this codebase that landed 283 findings. 66 were fixed or
+      // React Compiler rule set. On this codebase that landed 283 findings. 66 were fixed or
       // suppressed inline, each naming its invariant; there is DELIBERATELY no suppressions file — a
       // bulk `--suppress-all` would hide the next violation instead of answering it.
       //
-      // `refs` (the other 217) was switched OFF in E27 as mostly false positives, and that triage was
+      // `refs` (the other 217) was once switched OFF as mostly false positives, and that triage was
       // wrong: the rule and the React Compiler share one analysis, so every hit was a function the
-      // compiler SKIPS — 21 popover components among them, and Channels' 0.9 s row menu was the bill
-      // (E32). E32 S3–S4 fixed every site (245 measured) instead of narrowing the rule: the popover
+      // compiler SKIPS — 21 popover components among them, and Channels' 0.9 s row menu was the bill.
+      // Every site was fixed (245 measured) instead of narrowing the rule: the popover
       // engine is read through destructuring, render-phase ref writes became `useEffectEvent` /
       // `useLatest`. It is on, at error, with no exception.
       "react-hooks/refs": "error",
       "local/jsx-comment-text": "error",
-      "local/focus-safe-disabled": "error",
       "local/button-primitive": "error",
       "local/locale-format": "error",
       "local/input-primitive": "error",
@@ -592,12 +571,12 @@ export default tseslint.config(
       // finding is reported once, by one tool, and this config stays about hooks + refresh safety.
       "@typescript-eslint/no-unused-vars": "off",
       "no-undef": "off",
-      // R7 S3a eliminated every explicit `any` (api.ts prefs/data bags → Record<string, unknown>;
+      // Every explicit `any` was eliminated (api.ts prefs/data bags → Record<string, unknown>;
       // catch clauses → unknown + HttpError narrowing; the YouTube IFrame boundary → lib/youtube.ts
       // types; i18n `t` props → TFunction), so the rule is now enforced to keep new ones from
       // creeping back in. Prefer `unknown` + narrowing, or a typed boundary, over `any`.
       "@typescript-eslint/no-explicit-any": "error",
-      // E22 S4: the client log (lib/log.ts) is the one place diagnostics go — redacted, levelled,
+      // The client log (lib/log.ts) is the one place diagnostics go — redacted, levelled,
       // bounded. A `console.*` call is none of those, and it is invisible to the user's own log.
       "no-console": "error",
       "no-restricted-globals": ["error", ...networkGlobals(null)],
@@ -613,7 +592,7 @@ export default tseslint.config(
       "no-restricted-syntax": [
         "error",
         // A next-page fetch called bare CANCELS the one in flight and sends the same cursor again;
-        // our requests ignore the abort, so the server ran both (E31 S4e: every feed page 2–3×).
+        // our requests ignore the abort, so the server ran both (every feed page 2–3×).
         // lib/nextPage.ts NEXT_PAGE makes the second call join the first.
         {
           selector:
@@ -635,7 +614,7 @@ export default tseslint.config(
         },
         // Tailwind emits CSS only for a class it finds WHOLE in the source. A variant glued onto an
         // interpolated prefix (`${ACT}hover:text-fg`) is never found, so it ships with no rule: every
-        // hover colour of the button and chip primitives was dead that way (E28 audit).
+        // hover colour of the button and chip primitives was dead that way (a design audit).
         {
           selector: `TemplateLiteral > TemplateElement:not(:first-child)[value.raw=${SPLIT_CLASS}]`,
           message: SPLIT_CLASS_MESSAGE,
@@ -648,46 +627,34 @@ export default tseslint.config(
           message:
             "No native <select>: use ui/SegmentedToggle for a short fixed set, ui/FilterSelect for a longer one or a user's own list.",
         },
-        // R10 S2: keep the rem system from rotting. A px-frozen `text-[Npx]` font size does NOT
+        // Keep the rem system from rotting. A px-frozen `text-[Npx]` font size does NOT
         // scale with the Settings --font-scale slider while its rem neighbours do; use
         // `text-2xs`/`text-3xs` or a `text-[Nrem]` arbitrary instead. Matches both plain strings and
         // template-literal chunks; rem arbitraries (text-[0.75rem]) don't match (no "px").
         {
           selector: "Literal[value=/text-\\[[\\d.]+px\\]/]",
           message:
-            "px-frozen font size doesn't scale with --font-scale: use text-2xs/text-3xs or text-[Nrem], not text-[Npx] (R10 S2).",
+            "px-frozen font size doesn't scale with --font-scale: use text-2xs/text-3xs or text-[Nrem], not text-[Npx].",
         },
         {
           selector: "TemplateElement[value.raw=/text-\\[[\\d.]+px\\]/]",
           message:
-            "px-frozen font size doesn't scale with --font-scale: use text-2xs/text-3xs or text-[Nrem], not text-[Npx] (R10 S2).",
+            "px-frozen font size doesn't scale with --font-scale: use text-2xs/text-3xs or text-[Nrem], not text-[Npx].",
         },
         // …and the same for a BOX: a `w-[150px]` stays 150px while the text inside it grows with the
         // slider, so the label re-wraps or clips at large sizes. Use the spacing scale (`w-37.5` is
         // 150px at the default size) — 32 of these were swept in the 2026-09 debt burn.
         { selector: `Literal[value=${BOX_PX}]`, message: BOX_PX_MESSAGE },
         { selector: `TemplateElement[value.raw=${BOX_PX}]`, message: BOX_PX_MESSAGE },
-        { selector: `Literal[value=${GRID_MIN_PX}]`, message: GRID_MIN_PX_MESSAGE },
-        { selector: `TemplateElement[value.raw=${GRID_MIN_PX}]`, message: GRID_MIN_PX_MESSAGE },
-        { selector: `Literal[value=${Z_RAW}]`, message: Z_RAW_MESSAGE },
-        { selector: `TemplateElement[value.raw=${Z_RAW}]`, message: Z_RAW_MESSAGE },
         { selector: `Literal[value=${HOVER_SWAP}]`, message: HOVER_SWAP_MESSAGE },
         { selector: `TemplateElement[value.raw=${HOVER_SWAP}]`, message: HOVER_SWAP_MESSAGE },
         { selector: `Literal[value=${PALETTE}]`, message: PALETTE_MESSAGE },
         { selector: `TemplateElement[value.raw=${PALETTE}]`, message: PALETTE_MESSAGE },
-        {
-          selector: `JSXOpeningElement[name.name='span'] JSXAttribute[name.name='className'] Literal[value=${EDGED_LABEL}]`,
-          message: EDGED_LABEL_MESSAGE,
-        },
-        {
-          selector: `JSXOpeningElement[name.name='span'] JSXAttribute[name.name='className'] TemplateElement[value.raw=${EDGED_LABEL}]`,
-          message: EDGED_LABEL_MESSAGE,
-        },
       ],
     },
   },
   {
-    // E10 S1: `components/ui/` is the PLATFORM layer, and the rule that makes it a layer rather than
+    // `components/ui/` is the PLATFORM layer, and the rule that makes it a layer rather than
     // a folder is enforced here, not in prose (see components/ui/README.md). A platform component is
     // domain-free: it may import sibling primitives and generic `lib/` helpers, never a feature
     // component (`../Feed`) and never a domain API slice. Without this rule the boundary erodes on
@@ -699,7 +666,7 @@ export default tseslint.config(
         {
           // NOTE the String.raw: these are REGEX sources, and in a plain "..." literal `\.` is an
           // unknown escape that collapses to a bare `.` — the any-char wildcard. The first cut of
-          // this rule shipped that way and matched far less than it read like (E10 review round 1).
+          // this rule shipped that way and matched far less than it read like.
           patterns: [
             {
               // `../X` (exactly one level up = a feature component). A `regex` rather than a glob:
@@ -729,7 +696,7 @@ export default tseslint.config(
     },
   },
   {
-    // E11 S3: the same one-way rule one layer down. `lib/` is what components are built ON (hooks,
+    // The same one-way rule one layer down. `lib/` is what components are built ON (hooks,
     // the API slices, pure helpers), so it may not reach back UP into `components/` — not even for a
     // type. That is how the `Column` contract came to be owned by a ui component that three lib
     // helpers had to import from. A piece both layers need moves down into `lib/`.
@@ -758,13 +725,7 @@ export default tseslint.config(
       rules: { "no-restricted-globals": ["error", ...networkGlobals(name)] },
     })),
   {
-    // The two that ARE the raw button: the primitive itself, and the popover's menu row, whose
-    // native `disabled` is what floating-ui's roving focus reads to skip it (see ActionMenu).
-    files: ["src/components/ui/FocusSafeButton.tsx", "src/components/ui/AnchoredPopover.tsx"],
-    rules: { "local/focus-safe-disabled": "off" },
-  },
-  {
-    // The design lab (src/design-lab, E28) is a dev-only page that never reaches the production
+    // The design lab (src/design-lab) is a dev-only page that never reaches the production
     // bundle (devOnlyGuard fails the build if it does). Its copy is the developer's and the product
     // owner's working text, not the product's, so the translate-every-label rule does not apply.
     files: ["src/design-lab/**/*.{ts,tsx}"],
@@ -777,21 +738,19 @@ export default tseslint.config(
     plugins: { vitest },
     rules: {
       // A focused test silently skips the rest of the suite; a skipped one is a test nobody runs
-      // (E32 — vitest's allowOnly is on outside CI, so nothing else catches a stray `.only` locally).
+      // (vitest's allowOnly is on outside CI, so nothing else catches a stray `.only` locally).
       "vitest/no-focused-tests": "error",
       "vitest/no-disabled-tests": "error",
       "no-restricted-globals": "off",
       "no-restricted-properties": "off",
       "local/literal-a11y-text": "off",
-      // A test renders a raw button as a stand-in trigger or a focus target, not as product UI.
-      "local/button-primitive": "off",
       "local/input-primitive": "off",
       "local/surface-role": "off",
       "local/glyph-link": "off",
     },
   },
   {
-    // Outside src (E32): the e2e suite and the TypeScript build-tool configs went unlinted — the
+    // Outside src: the e2e suite and the TypeScript build-tool configs went unlinted — the
     // flat config named only src/**, so `eslint .` skipped them without a word. The same base and
     // typed rules as the app; Node globals, since none of it runs in the browser.
     files: ["e2e/**/*.ts", "*.config.ts", "reactPlugin.ts", "devOnlyGuard.ts"],
diff --git a/frontend/knip.jsonc b/frontend/knip.jsonc
index 7fa7cc10..e5bb1921 100644
--- a/frontend/knip.jsonc
+++ b/frontend/knip.jsonc
@@ -1,20 +1,8 @@
 {
   "$schema": "https://unpkg.com/knip@6/schema.json",
-  // `--production` (E32) asks a second question besides "is this used?": "is it used by the code
-  // that SHIPS?" — an export only a test reaches is either dead in the bundle or exported for its
-  // test, which then says so with a JSDoc `@internal` tag (knip skips those in production mode).
-  // What is not production code at all is excluded from the production project with a `!…!`
-  // pattern: the test kits, the e2e suite, and the two build-tooling modules the vite config
-  // imports (they shape the bundle but are not in it).
-  "project": [
-    "**/*.{ts,tsx,js}!",
-    "!**/*.testkit.ts!",
-    "!e2e/**!",
-    "!reactPlugin.ts!",
-    "!devOnlyGuard.ts!",
-  ],
+  "project": ["**/*.{ts,tsx,js}"],
   "playwright": {
     "config": ["playwright.config.ts"],
-    "entry": ["e2e/**/*.@(spec|setup).ts"],
+    "entry": ["e2e/**/*.@(spec|setup|measure).ts"],
   },
 }
diff --git a/frontend/package.json b/frontend/package.json
index 6cf9f47e..0fc26506 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -14,7 +14,7 @@
     "typecheck:e2e": "tsc --noEmit -p e2e/tsconfig.json",
     "build": "npm run typecheck:app && npm run typecheck:node && vite build",
     "preview": "vite preview",
-    "knip": "knip && knip --production",
+    "knip": "knip",
     "lint": "eslint . --max-warnings 0",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
diff --git a/frontend/playwright.config.ts b/frontend/playwright.config.ts
index 45b26084..6fe0aa9e 100644
--- a/frontend/playwright.config.ts
+++ b/frontend/playwright.config.ts
@@ -4,8 +4,8 @@ import { defineConfig, devices } from "@playwright/test";
  * E2E characterization (golden-master) net for the Platform refactor.
  *
  * Target (PW_BASE_URL): defaults to the baked localdev stack on :8080 (production-faithful,
- * same-origin, no HMR/WS gaps). Point it at http://localhost:5173 for the fast Vite loop — all
- * five characterization flows are proxy-safe (none use the WebSocket).
+ * same-origin, no HMR gaps). Point it at http://localhost:5173 for the fast Vite loop — all
+ * five characterization flows are proxy-safe.
  *
  * The stack must already be UP (owned by `siftlode dev`); there is deliberately no `webServer`.
  * `e2e/global.setup.ts` seeds the dedicated test account and logs in once, sharing the resulting
@@ -61,5 +61,17 @@ export default defineConfig({
       use: { ...devices["iPad (gen 7) landscape"], storageState: STORAGE_STATE },
       dependencies: ["setup"],
     },
+    // The speed baseline (e2e/speed.measure.ts): readings, not tests. Only when PW_SPEED is set —
+    // `scripts/audit_metrics.py --speed` sets it — so the e2e suite never runs it.
+    ...(process.env.PW_SPEED
+      ? [
+          {
+            name: "speed",
+            testMatch: /\.measure\.ts/,
+            use: { ...devices["Desktop Chrome"], storageState: STORAGE_STATE },
+            dependencies: ["setup"],
+          },
+        ]
+      : []),
   ],
 });
diff --git a/frontend/public/welcome/channels.webp b/frontend/public/welcome/channels.webp
index b90e3452..89ac52a0 100644
Binary files a/frontend/public/welcome/channels.webp and b/frontend/public/welcome/channels.webp differ
diff --git a/frontend/public/welcome/downloads.webp b/frontend/public/welcome/downloads.webp
index 679a4fec..120ffdc7 100644
Binary files a/frontend/public/welcome/downloads.webp and b/frontend/public/welcome/downloads.webp differ
diff --git a/frontend/public/welcome/feed.webp b/frontend/public/welcome/feed.webp
index 30ebdd6c..45ee9b33 100644
Binary files a/frontend/public/welcome/feed.webp and b/frontend/public/welcome/feed.webp differ
diff --git a/frontend/public/welcome/player.webp b/frontend/public/welcome/player.webp
index 2ddb3bba..419dc3b1 100644
Binary files a/frontend/public/welcome/player.webp and b/frontend/public/welcome/player.webp differ
diff --git a/frontend/public/welcome/playlists.webp b/frontend/public/welcome/playlists.webp
index 8d33fe21..f2b299d7 100644
Binary files a/frontend/public/welcome/playlists.webp and b/frontend/public/welcome/playlists.webp differ
diff --git a/frontend/public/welcome/plex.webp b/frontend/public/welcome/plex.webp
index b59c5a94..9ec9fb60 100644
Binary files a/frontend/public/welcome/plex.webp and b/frontend/public/welcome/plex.webp differ
diff --git a/frontend/public/welcome/search.webp b/frontend/public/welcome/search.webp
index 513d3268..04372648 100644
Binary files a/frontend/public/welcome/search.webp and b/frontend/public/welcome/search.webp differ
diff --git a/frontend/reactPlugin.ts b/frontend/reactPlugin.ts
index 8d898a04..a85a2219 100644
--- a/frontend/reactPlugin.ts
+++ b/frontend/reactPlugin.ts
@@ -1,7 +1,7 @@
 import react from "@vitejs/plugin-react";
 import reactCompiler from "babel-plugin-react-compiler";
 
-// ONE React transform, shared by vite.config.ts and vitest.config.ts (E27 S1).
+// ONE React transform, shared by vite.config.ts and vitest.config.ts.
 //
 // It is a shared factory rather than two `react()` calls because the two configs must not drift:
 // if the compiler ran only in the production build, every vitest run would be exercising code the
@@ -14,7 +14,7 @@ import reactCompiler from "babel-plugin-react-compiler";
 // bails out on its own for anything it cannot prove safe — SILENTLY: `panicThreshold` is "none" and
 // there is no logger here, so a skipped component still works and simply re-renders everything under
 // it. This comment used to say "its rules are also linted"; it was false while `react-hooks/refs` was
-// off, and 95 functions sat uncompiled behind it (E32). What actually holds the line now is
+// off, and 95 functions sat uncompiled behind it. What actually holds the line now is
 // src/components/compilerCoverage.contract.test.ts, which runs THIS compiler over the shipped source
 // and fails on any skip not on its list; the react-hooks lint rules are the early warning. None of
 // them is off (three run at the preset's warn, which `--max-warnings 0` fails — docs/gates.md), but
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 2b0db8f3..5c59153e 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -35,7 +35,6 @@ import BackToTop from "./components/ui/BackToTop";
 import PageShell from "./components/ui/PageShell";
 import { SkipLink } from "./components/ui/SkipLink";
 import { pageTitleKey } from "./lib/pageMeta";
-import ChatDock from "./components/ChatDock";
 import DebugRecorder from "./components/DebugRecorder";
 import Toaster from "./components/ui/Toaster";
 import KeyboardHelp from "./components/ui/KeyboardHelp";
@@ -43,7 +42,6 @@ import AppCommandPalette from "./components/AppCommandPalette";
 import { useGlobalKeymap } from "./lib/keymap";
 import ErrorDialog from "./components/ErrorDialog";
 import VersionBanner from "./components/VersionBanner";
-import DemoBanner from "./components/DemoBanner";
 import VerifyBanner from "./components/VerifyBanner";
 import { focusAccessRequestsTab } from "./lib/adminUsersTab";
 // The built app version, NOT imported from releaseNotes — importing anything from that module
@@ -148,9 +146,9 @@ export default function App() {
   // account can reach (the nav rail's own list, plus Settings, which is not in the rail's order).
   useGlobalKeymap(!!me, setPage, me ? [...moduleOrder(me), "settings"] : []);
 
-  // The account's consented diagnostics level (E22 S5), applied to this tab's log: raised, the log is
+  // The account's consented diagnostics level, applied to this tab's log: raised, the log is
   // kept in more detail and streamed to the server until the level lapses. A debug session that is
-  // recording (E16) raises it for its own run and tags what it keeps. A lapse (its own timer, or the
+  // recording raises it for its own run and tags what it keeps. A lapse (its own timer, or the
   // server saying it is off) refetches `me`, so Settings and the recorder show what is in force.
   // Re-running this on every `me` refetch is FREE and therefore the deps are the honest ones:
   // applyDiagnostics computes an effective-level key and returns early when it has not moved
@@ -397,7 +395,7 @@ export default function App() {
       )}
       {/* `@container/appmain`: the floating header + its search box adapt to THIS column's width
           (which shrinks when the filter sidebar is open), not the viewport — a viewport breakpoint
-          can't see the sidebar-driven narrowing (E5 S7). NB: `container-type: inline-size` implies
+          can't see the sidebar-driven narrowing. NB: `container-type: inline-size` implies
           `contain: layout`, making this column a containing block for `position: fixed` descendants
           too — safe today because floating-ui menus render via FloatingPortal (to document.body) and
           the toasts below are absolute; keep any new fixed overlay inside here body-portalled. */}
@@ -439,7 +437,6 @@ export default function App() {
             banners={
               <>
                 <VerifyBanner entry={verifyEntry} />
-                {me!.is_demo && <DemoBanner />}
                 <VersionBanner onOpen={() => openReleaseNotes(FRONTEND_VERSION)} />
               </>
             }
@@ -459,9 +456,8 @@ export default function App() {
           "take me to X" the same way. Their keys are bound by useGlobalKeymap above. */}
       <KeyboardHelp />
       <AppCommandPalette />
-      {me && !me.is_demo && <ChatDock meId={me.id} />}
-      {/* The debug recorder (E16): its start dialog, and its pill docked under the toasts. */}
-      {me && !me.is_demo && <DebugRecorder />}
+      {/* The debug recorder: its start dialog, and its pill docked under the toasts. */}
+      {me && <DebugRecorder />}
       <Suspense fallback={null}>
         {aboutOpen && (
           <About
diff --git a/frontend/src/components/AboutCell.tsx b/frontend/src/components/AboutCell.tsx
index b4412c94..915600bc 100644
--- a/frontend/src/components/AboutCell.tsx
+++ b/frontend/src/components/AboutCell.tsx
@@ -17,7 +17,7 @@ import { SURFACE } from "./ui/surfaces";
  * tables.
  *
  * The card keeps the platform's default hover role (`tooltip`); making this rich, interactive panel
- * properly keyboard-reachable belongs to R9 (focus/a11y), not to the mechanical migration.
+ * properly keyboard-reachable belongs to the focus/a11y work, not to the mechanical migration.
  */
 export default function AboutCell({ text, channelId }: { text: string | null; channelId: string }) {
   const preview = (text ?? "").trim();
diff --git a/frontend/src/components/AccountPanel.tsx b/frontend/src/components/AccountPanel.tsx
index f6b61efe..16601eee 100644
--- a/frontend/src/components/AccountPanel.tsx
+++ b/frontend/src/components/AccountPanel.tsx
@@ -18,7 +18,7 @@ import { SURFACE } from "./ui/surfaces";
 import { SectionLabel } from "./ui/Headings";
 
 // The admin's answer to "why can this person not get in?", and the place every recovery action for
-// one account lives (E12 · S5, design option C).
+// one account lives.
 //
 // It exists because nothing in the admin UI showed an account's GATE STATE: an admin could see a
 // "Pending approval" chip but not whether the address was confirmed, whether the password had been
@@ -175,18 +175,14 @@ export default function AccountPanel({
               }
               tone={a.has_google ? "ok" : "muted"}
             />
-            {/* The exact moment; the list row beside it only says how long ago. Null has two different
-                meanings, so it says which: nothing recorded yet, or the shared demo account, which is
-                deliberately never stamped. */}
+            {/* The exact moment; the list row beside it only says how long ago. */}
             <AccessRow
               icon={LogIn}
               label={t("users.account.lastLogin")}
               value={
                 a.last_login_at
                   ? formatDateTime(a.last_login_at, lang)
-                  : a.is_demo
-                    ? t("users.account.lastLoginDemo")
-                    : t("users.account.lastLoginNone")
+                  : t("users.account.lastLoginNone")
               }
             />
             {/* The gate that explains a Google sign-in silently becoming a fresh access request. */}
@@ -223,9 +219,7 @@ export default function AccountPanel({
               icon={<Send />}
               loading={resend.isPending}
               onClick={() => resend.mutate()}
-              // The demo account's address is never confirmed, and the server refuses to mail it — as
-              // it refuses it a set-password link below (deep-review E11 round 3).
-              disabled={user.is_demo || !a.email_configured || a.email_verified}
+              disabled={!a.email_configured || a.email_verified}
             >
               <span className="flex-1 text-left">{t("users.account.resend")}</span>
               {/* Says WHY it is unavailable instead of just greying out — the no-mail case is the
@@ -243,7 +237,6 @@ export default function AccountPanel({
               fullWidth
               icon={<KeyRound />}
               loading={issue.isPending}
-              disabled={user.is_demo}
               onClick={() => issue.mutate()}
               className="border border-accent/40 text-accent"
             >
diff --git a/frontend/src/components/AddToPlaylist.tsx b/frontend/src/components/AddToPlaylist.tsx
index 4c055fb2..fd0c7582 100644
--- a/frontend/src/components/AddToPlaylist.tsx
+++ b/frontend/src/components/AddToPlaylist.tsx
@@ -16,7 +16,7 @@ import { Input } from "./ui/Input";
 import { SURFACE } from "./ui/surfaces";
 
 // A small anchored menu for toggling a video's membership in the user's playlists, with inline
-// "new playlist" creation. Same shape as the channel tag editor (R8 S1's pilot): radio-style
+// "new playlist" creation. Same shape as the channel tag editor (the popover pilot): radio-style
 // toggles plus a free-text creator, so it follows that file's two conventions — typeahead OFF and
 // the input swallowing non-Escape keys, since character and arrow keys belong to the text field.
 export default function AddToPlaylist({
@@ -55,7 +55,7 @@ export default function AddToPlaylist({
   );
 }
 
-/** The same panel, opened from an object's menu ("Add to playlist…", E28 C1) rather than its own
+/** The same panel, opened from an object's menu ("Add to playlist…") rather than its own
  *  button: anchored to the element the menu came from, and gone when it closes. */
 export function AddToPlaylistAt({
   videoId,
diff --git a/frontend/src/components/AdminLogs.dom.test.tsx b/frontend/src/components/AdminLogs.dom.test.tsx
index d342bda4..9b9c28de 100644
--- a/frontend/src/components/AdminLogs.dom.test.tsx
+++ b/frontend/src/components/AdminLogs.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E22.6: the admin log console. A request id narrows the list to that request (and says so, in the
+// The admin log console. A request id narrows the list to that request (and says so, in the
 // filter row and the URL); a filter value the facets no longer count stays pickable; "Live" watches
 // the newest page only, and stops on a failed read instead of re-raising it; a failed read is an
 // error, not an empty log; Copy takes every loaded line, oldest first.
diff --git a/frontend/src/components/AdminLogs.tsx b/frontend/src/components/AdminLogs.tsx
index 7c4a13d7..0dad5d23 100644
--- a/frontend/src/components/AdminLogs.tsx
+++ b/frontend/src/components/AdminLogs.tsx
@@ -42,7 +42,7 @@ import { DismissibleChip } from "./ui/Chip";
 import { InnerInput } from "./ui/Input";
 import { fieldClass } from "./ui/fieldStyles";
 
-// Admin → Szervernapló: the server's stored log (`log_events`, E22.6). One list, newest first; a line
+// Admin → Szervernapló: the server's stored log (`log_events`). One list, newest first; a line
 // opens in place to its full record, and its request id / job id narrow the list to that request or
 // job. Filters live in the URL, so a filtered view is a link. "Élő" re-reads the newest page every
 // few seconds while the tab is visible — the newest page only: live is watching the top, so paging
diff --git a/frontend/src/components/AdminUsers.dom.test.tsx b/frontend/src/components/AdminUsers.dom.test.tsx
index c6eb94b3..ef024bcf 100644
--- a/frontend/src/components/AdminUsers.dom.test.tsx
+++ b/frontend/src/components/AdminUsers.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// A failed user action is said once, and a user who is gone is not left listed (deep-review round 4).
+// A failed user action is said once, and a user who is gone is not left listed.
 // setRole / suspend / delete had no onError at all — "the global error dialog says it" — but a 404
 // (the user was deleted in another tab) gets no dialog, so the click did nothing and the row stayed.
 // And the invite approve/deny toasted unconditionally on top of the dialog `req` opens for a 409.
@@ -44,7 +44,6 @@ const row = {
   email: "gone@x",
   role: "user",
   is_suspended: false,
-  is_demo: false,
   email_verified: true,
   is_active: true,
 } as unknown as AdminUserRow;
@@ -77,13 +76,12 @@ function mount() {
   return users;
 }
 
-describe("the last sign-in column (E22 S1)", () => {
+describe("the last sign-in column", () => {
   it("says how long ago each account signed in, and a dash where nothing is recorded", async () => {
     const at = new Date(Date.now() - 3 * 86_400_000).toISOString();
     vi.spyOn(api, "adminUsers").mockResolvedValue([
       { ...row, id: 3, email: "seen@x", last_login_at: at },
       { ...row, id: 4, email: "never@x", last_login_at: null },
-      { ...row, id: 5, email: "demo@x", is_demo: true, last_login_at: null },
     ] as never);
     render(
       <QueryClientProvider
@@ -94,11 +92,11 @@ describe("the last sign-in column (E22 S1)", () => {
     );
 
     expect(await screen.findByText(relativeTime(at, "en"))).toBeTruthy();
-    expect(screen.getAllByText("—")).toHaveLength(2);
+    expect(screen.getAllByText("—")).toHaveLength(1);
   });
 });
 
-// E28 (owner): the hover ended wherever the row's first badge or button began, because the layer was
+// The hover ended wherever the row's first badge or button began, because the layer was
 // the name button's own. The card is the row: it paints the layer under its content, and the name
 // button's hit layer spans the card, under the actions that sit above it.
 describe("a user row", () => {
@@ -119,7 +117,7 @@ describe("a user row", () => {
 /** The open menu's rows (a closed popover's are hidden from the accessibility tree in jsdom). */
 const menuRows = () => screen.queryAllByRole("menuitem", { hidden: true });
 
-/** The row's actions live in its "…" menu (E31): open it, then pick the row. */
+/** The row's actions live in its "…" menu: open it, then pick the row. */
 async function chooseInRowMenu(label: string) {
   fireEvent.click(await screen.findByRole("button", { name: "users.rowMenu" }));
   const item = await waitFor(() => {
@@ -130,7 +128,7 @@ async function chooseInRowMenu(label: string) {
   fireEvent.click(item);
 }
 
-// E31 (DESIGN § Action placement): the role, the suspension and the delete moved off the row into
+// DESIGN § Action placement: the role, the suspension and the delete moved off the row into
 // ONE menu — the row's "…", which a right-click on the row opens too. A locked one stays listed with
 // its reason.
 describe("a user row's menu", () => {
diff --git a/frontend/src/components/AdminUsers.tsx b/frontend/src/components/AdminUsers.tsx
index 7717cf5e..da8953c7 100644
--- a/frontend/src/components/AdminUsers.tsx
+++ b/frontend/src/components/AdminUsers.tsx
@@ -53,9 +53,9 @@ import type { ActionMenuItem } from "./ui/ActionMenu";
 import { Input } from "./ui/Input";
 import { SURFACE } from "./ui/surfaces";
 
-// Admin-only user & access management: roles, access requests (the Invite whitelist), and the
-// demo whitelist + reset. Each section is its own tab (persisted across reloads); the Access tab
-// carries a badge with the count of pending requests so it's visible without switching to it.
+// Admin-only user & access management: roles and access requests (the Invite whitelist). Each
+// section is its own tab (persisted across reloads); the Access tab carries a badge with the count
+// of pending requests so it's visible without switching to it.
 // (The tab key + a "focus the Access tab" helper live in lib/adminUsersTab so callers can
 // pre-select the tab without importing this lazy-loaded page — see that file.)
 
@@ -81,7 +81,6 @@ export default function AdminUsers() {
       label: t("users.tabs.access"),
       badge: me.pending_invites + me.pending_activations,
     },
-    { id: "demo", label: t("users.tabs.demo") },
   ];
   const active = tabs.some((x) => x.id === tab) ? tab : "roles";
   return (
@@ -100,7 +99,6 @@ export default function AdminUsers() {
             <PendingAccess />
           </>
         )}
-        {active === "demo" && <AdminDemo />}
       </div>
     </>
   );
@@ -115,7 +113,7 @@ function UsersRoles({ me }: { me: Me }) {
   // Which rows have an action in flight, so we disable ONLY those rows' buttons (SC1) — a Set, since
   // with per-row disabling the admin can now start actions on several rows concurrently.
   const [pendingIds, setPendingIds] = useState<Set<number>>(new Set());
-  // The account panel (E12 S5): which user it is showing, or null. Held here rather than per row so
+  // The account panel: which user it is showing, or null. Held here rather than per row so
   // only one is ever mounted.
   const [panelFor, setPanelFor] = useState<AdminUserRow | null>(null);
   const startPending = (id: number) => setPendingIds((s) => new Set(s).add(id));
@@ -160,7 +158,7 @@ function UsersRoles({ me }: { me: Me }) {
       });
     },
     onSettled: (_d, _e, vars) => endPending(vars.id),
-    // Guards (demo / self / last admin) surface via the global error dialog; the rest, as above.
+    // Guards (self / last admin) surface via the global error dialog; the rest, as above.
     onError: (e) => onGoneOrFailed(e, t("users.suspend.failed")),
   });
   const del = useMutation({
@@ -210,19 +208,17 @@ function UsersRoles({ me }: { me: Me }) {
     if (ok) del.mutate({ id: u.id, email: u.email });
   };
 
-  // The row's actions are ONE menu (DESIGN § Action placement, E31): the role, the suspension and
+  // The row's actions are ONE menu (DESIGN § Action placement): the role, the suspension and
   // the delete — rare and two of them destructive — open from the row's "…", a right-click on the row,
   // a long-press or Shift+F10. The row keeps what the admin reads: the name, the role and state
-  // badges, the last sign-in. A locked action (the demo, yourself) stays listed with its reason.
+  // badges, the last sign-in. A locked action (on yourself) stays listed with its reason.
   const rowMenu = useContextMenu<AdminUserRow>({ keyOf: (u) => u.id });
   const menuItems = (u: AdminUserRow): ActionMenuItem[] => {
     const self = u.id === me.id;
     const pending = pendingIds.has(u.id);
-    const locked = (demoNote: string, selfNote: string) =>
-      u.is_demo ? demoNote : self ? selfNote : undefined;
-    const roleNote = locked(t("users.roles.demoLocked"), t("users.roles.selfLocked"));
-    const suspendNote = locked(t("users.suspend.demoLocked"), t("users.suspend.selfLocked"));
-    const deleteNote = u.is_demo || self ? t("users.delete.locked") : undefined;
+    const roleNote = self ? t("users.roles.selfLocked") : undefined;
+    const suspendNote = self ? t("users.suspend.selfLocked") : undefined;
+    const deleteNote = self ? t("users.delete.locked") : undefined;
     return [
       {
         id: "role",
@@ -277,7 +273,7 @@ function UsersRoles({ me }: { me: Me }) {
           {rows.map((u) => {
             const self = u.id === me.id;
             return (
-              // The whole card is the row, so the whole card answers (owner, E28): the name's button
+              // The whole card is the row, so the whole card answers (owner's call): the name's button
               // stretches an invisible layer over the card (`after:inset-0`), so a click on a badge or
               // a gap opens the account too, and the B3 hover layer is the card's own `::before`, under
               // the badges and buttons (`isolate` + `z-under`). The actions are `relative`, above the
@@ -301,7 +297,6 @@ function UsersRoles({ me }: { me: Me }) {
                   <div className="text-2xs text-muted truncate">{u.email}</div>
                 </Pressable>
                 {u.role === "admin" && <Badge tone="accent">{t("users.roles.admin")}</Badge>}
-                {u.is_demo && <Badge>{t("users.roles.demo")}</Badge>}
                 {u.is_suspended && <Badge tone="warn">{t("users.roles.suspended")}</Badge>}
                 {!u.is_active && <Badge tone="warn">{t("users.roles.pending")}</Badge>}
                 {/* A Google sign-in proves the email, so "unverified" only applies to a
@@ -317,9 +312,7 @@ function UsersRoles({ me }: { me: Me }) {
                   hint={
                     u.last_login_at
                       ? t("users.roles.lastLogin", { time: formatDateTime(u.last_login_at, lang) })
-                      : u.is_demo
-                        ? t("users.roles.lastLoginDemo")
-                        : t("users.roles.lastLoginNone")
+                      : t("users.roles.lastLoginNone")
                   }
                 >
                   <span className="relative hidden sm:inline-block w-20 shrink-0 text-right text-2xs text-muted tabular-nums">
@@ -784,130 +777,6 @@ function AdminInvites() {
   );
 }
 
-function AdminDemo() {
-  const { t } = useTranslation();
-  const qc = useQueryClient();
-  const confirm = useConfirm();
-  const list = useQuery({ queryKey: qk.demoWhitelist(), queryFn: () => api.adminDemoWhitelist() });
-  const [newEmail, setNewEmail] = useState("");
-
-  const add = useMutation({
-    mutationFn: (email: string) => api.addDemoWhitelist(email),
-    onSuccess: (_d, email) => {
-      setNewEmail("");
-      qc.invalidateQueries({ queryKey: qk.demoWhitelist() });
-      notify({ level: "success", message: t("settings.demo.added", { email }) });
-    },
-    onError: (e) => notifyActionError(e, t("settings.demo.addFailed")),
-  });
-  const remove = useMutation({
-    mutationFn: (id: number) => api.removeDemoWhitelist(id),
-    onSuccess: () => {
-      qc.invalidateQueries({ queryKey: qk.demoWhitelist() });
-      notify({ level: "success", message: t("settings.demo.removed") });
-    },
-    onError: (e) => notifyActionError(e, t("settings.demo.removeFailed")),
-  });
-  const onRemove = async (r: { id: number; email: string }) => {
-    const ok = await confirm({
-      title: t("settings.demo.removeTitle"),
-      message: t("settings.demo.removeConfirm", { email: r.email }),
-      confirmLabel: t("settings.demo.remove"),
-      danger: true,
-    });
-    if (ok) remove.mutate(r.id);
-  };
-  const reset = useMutation({
-    mutationFn: () => api.resetDemo(),
-    onSuccess: (r: { playlists_seeded: number }) =>
-      notify({
-        level: "success",
-        message: t("settings.demo.resetDone", { count: r.playlists_seeded }),
-      }),
-    onError: (e) => notifyActionError(e, t("settings.demo.resetFailed")),
-  });
-
-  const rows = list.data ?? [];
-
-  return (
-    <Section card title={t("settings.demo.title")}>
-      <p className="text-xs text-muted leading-relaxed mb-2">{t("settings.demo.intro")}</p>
-
-      {rows.length > 0 && (
-        <div className="space-y-1.5 mb-3">
-          {rows.map((r) => (
-            <div key={r.id} className={`${SURFACE.card} flex items-center gap-2 p-2.5`}>
-              <div className="min-w-0 flex-1">
-                <div className="text-sm truncate">{r.email}</div>
-                {r.added_by && (
-                  <div className="text-2xs text-muted truncate">
-                    {t("settings.demo.addedBy", { who: r.added_by })}
-                  </div>
-                )}
-              </div>
-              <Tooltip hint={t("settings.demo.removeHint")}>
-                <IconButton
-                  noTitle
-                  label={t("settings.demo.remove")}
-                  size="sm"
-                  variant="outline-danger"
-                  onClick={() => onRemove(r)}
-                  disabled={remove.isPending}
-                >
-                  <Trash2 className="w-4 h-4" />
-                </IconButton>
-              </Tooltip>
-            </div>
-          ))}
-        </div>
-      )}
-
-      <form
-        onSubmit={(e) => {
-          e.preventDefault();
-          if (newEmail.trim()) add.mutate(newEmail.trim());
-        }}
-        className="flex items-center gap-2"
-      >
-        <Input
-          className="flex-1"
-          type="email"
-          value={newEmail}
-          onChange={(e) => setNewEmail(e.target.value)}
-          placeholder={t("settings.demo.addPlaceholder")}
-        />
-        <Button variant="glass" size="md" className="shrink-0" type="submit">
-          <UserPlus className="w-4 h-4" /> {t("settings.demo.add")}
-        </Button>
-      </form>
-
-      <div className="mt-4 pt-3 border-t border-border">
-        <Tooltip hint={t("settings.demo.resetHint")}>
-          <Button
-            variant="glass"
-            size="sm"
-            icon={<RotateCcw />}
-            loading={reset.isPending}
-            onClick={async () => {
-              if (
-                await confirm({
-                  title: t("settings.demo.resetTitle"),
-                  message: t("settings.demo.resetConfirm"),
-                  confirmLabel: t("settings.demo.reset"),
-                  danger: true,
-                })
-              )
-                reset.mutate();
-            }}
-          >
-            {t("settings.demo.reset")}
-          </Button>
-        </Tooltip>
-      </div>
-    </Section>
-  );
-}
-
 function InviteRow({
   inv,
   onApprove,
diff --git a/frontend/src/components/AppCommandPalette.dom.test.tsx b/frontend/src/components/AppCommandPalette.dom.test.tsx
index 88367d4e..679d3b2b 100644
--- a/frontend/src/components/AppCommandPalette.dom.test.tsx
+++ b/frontend/src/components/AppCommandPalette.dom.test.tsx
@@ -68,7 +68,6 @@ import AppCommandPalette from "./AppCommandPalette";
 const user = (over: Record<string, unknown> = {}) => ({
   id: 1,
   role: "user",
-  is_demo: false,
   plex_enabled: false,
   ...over,
 });
@@ -143,7 +142,7 @@ describe("AppCommandPalette", () => {
     expect(requestSurprise).toHaveBeenCalledTimes(1);
   });
 
-  it("offers the debug recorder by its state, and not to the demo account", () => {
+  it("offers the debug recorder by its state", () => {
     const recorder = () => ids("actions").filter((id) => id.startsWith("action:recorder:"));
     mount();
     expect(recorder()).toEqual(["action:recorder:start"]);
@@ -153,10 +152,5 @@ describe("AppCommandPalette", () => {
     me = user({ debug_session: { id: "0123456789abcdef", until, ended_at: null } });
     mount();
     expect(recorder()).toEqual(["action:recorder:step", "action:recorder:stop"]);
-
-    cleanup();
-    me = user({ is_demo: true });
-    mount();
-    expect(recorder()).toEqual([]);
   });
 });
diff --git a/frontend/src/components/AppCommandPalette.tsx b/frontend/src/components/AppCommandPalette.tsx
index e855c6dc..d45d6c82 100644
--- a/frontend/src/components/AppCommandPalette.tsx
+++ b/frontend/src/components/AppCommandPalette.tsx
@@ -129,7 +129,7 @@ export default function AppCommandPalette() {
       id: "actions",
       label: t("palette.groups.actions"),
       items: [
-        // "Meglepetés" — Home's reroll, reachable from anywhere (E24). There is deliberately no
+        // "Meglepetés" — Home's reroll, reachable from anywhere. There is deliberately no
         // second "Mit nézzek?" row beside it: the Home module row above ALREADY matches that phrase,
         // because the palette searches a module's descriptive `titleKey` too and Home's is literally
         // "Mit nézzek most?". A row that navigates where an existing row already navigates would be
@@ -151,34 +151,31 @@ export default function AppCommandPalette() {
           icon: <Keyboard className="w-4 h-4" />,
           run: toggleKeyboardHelp,
         },
-        // The debug recorder (E16) — not for the shared demo account, which cannot record. While
-        // it runs, Stop and a step marker take Start's place: the palette is reachable inside a
+        // The debug recorder. While it runs, Stop and a step marker take Start's place: the palette is reachable inside a
         // player or a dialog where the pill's buttons are a long Tab away.
-        ...(me?.is_demo
-          ? []
-          : recordingSession
-            ? [
-                {
-                  id: "action:recorder:step",
-                  label: t("recorder.palette.step"),
-                  icon: <Flag className="w-4 h-4" />,
-                  run: () => markStep(""),
-                },
-                {
-                  id: "action:recorder:stop",
-                  label: t("recorder.palette.stop"),
-                  icon: <Square className="w-4 h-4" />,
-                  run: () => stopMutate(recordingSession.id),
-                },
-              ]
-            : [
-                {
-                  id: "action:recorder:start",
-                  label: t("recorder.palette.start"),
-                  icon: <Bug className="w-4 h-4" />,
-                  run: openRecorderStart,
-                },
-              ]),
+        ...(recordingSession
+          ? [
+              {
+                id: "action:recorder:step",
+                label: t("recorder.palette.step"),
+                icon: <Flag className="w-4 h-4" />,
+                run: () => markStep(""),
+              },
+              {
+                id: "action:recorder:stop",
+                label: t("recorder.palette.stop"),
+                icon: <Square className="w-4 h-4" />,
+                run: () => stopMutate(recordingSession.id),
+              },
+            ]
+          : [
+              {
+                id: "action:recorder:start",
+                label: t("recorder.palette.start"),
+                icon: <Bug className="w-4 h-4" />,
+                run: openRecorderStart,
+              },
+            ]),
         ...SCHEMES.map((s) => ({
           id: `action:theme:${s.id}`,
           label: t("palette.theme", { name: s.name }),
diff --git a/frontend/src/components/AuditEarlierRuns.tsx b/frontend/src/components/AuditEarlierRuns.tsx
index 62036b7e..a5433ac6 100644
--- a/frontend/src/components/AuditEarlierRuns.tsx
+++ b/frontend/src/components/AuditEarlierRuns.tsx
@@ -6,7 +6,7 @@ import type { AuditRow } from "../lib/api";
 import { Button } from "./ui/Button";
 import { RelativeTime } from "./ui/RelativeTime";
 
-/** A folded run of one job's successful runs (lib/auditGroups, E31): the row shows the newest, this
+/** A folded run of one job's successful runs (lib/auditGroups): the row shows the newest, this
  *  opens the earlier ones, each with its moment and its result (`detailOf`, the row's own wording). */
 export default function AuditEarlierRuns({
   runs,
diff --git a/frontend/src/components/AuditLog.tsx b/frontend/src/components/AuditLog.tsx
index b2a5c97c..95d402df 100644
--- a/frontend/src/components/AuditLog.tsx
+++ b/frontend/src/components/AuditLog.tsx
@@ -26,7 +26,7 @@ export default function AuditLog() {
   const confirm = useConfirm();
   const q = useQuery({ queryKey: qk.adminAudit(), queryFn: () => api.adminAudit() });
   const data = q.data;
-  // Back-to-back successful runs of one job fold into one row (lib/auditGroups, E31).
+  // Back-to-back successful runs of one job fold into one row (lib/auditGroups).
   const rows = useMemo(() => foldJobRuns(data?.items ?? []), [data]);
 
   const actionOptions = useMemo(() => {
diff --git a/frontend/src/components/ChannelAbout.tsx b/frontend/src/components/ChannelAbout.tsx
index 64050d86..1508cf72 100644
--- a/frontend/src/components/ChannelAbout.tsx
+++ b/frontend/src/components/ChannelAbout.tsx
@@ -11,7 +11,7 @@ function parseKeywords(s: string): string[] {
   return (s.match(/"[^"]+"|\S+/g) ?? []).map((k) => k.replace(/^"|"$/g, "")).filter(Boolean);
 }
 // topicCategories are Wikipedia URLs (…/wiki/Music) → the page slug ("Pop_music"), de-duplicated. The
-// slug is the vocabulary word (E30): named in the reader's language, else shown with spaces.
+// slug is the vocabulary word: named in the reader's language, else shown with spaces.
 function topicSlugs(urls: string[]): string[] {
   const seen = new Set<string>();
   for (const url of urls) {
diff --git a/frontend/src/components/ChannelDiscovery.tsx b/frontend/src/components/ChannelDiscovery.tsx
index 96164322..c90fa9ac 100644
--- a/frontend/src/components/ChannelDiscovery.tsx
+++ b/frontend/src/components/ChannelDiscovery.tsx
@@ -94,7 +94,7 @@ export default function ChannelDiscovery({
 
   const columns: Column<DiscoveredChannel>[] = [
     // Subscribe first: it is this table's primary action, the one thing a discovery row is for (the
-    // Subscriptions table has no such button — its row ends in the channel's "…", E28 C1).
+    // Subscriptions table has no such button — its row ends in the channel's "…").
     {
       key: "actions",
       header: t("channels.cols.actions"),
diff --git a/frontend/src/components/ChannelLayoutGrid.dom.test.tsx b/frontend/src/components/ChannelLayoutGrid.dom.test.tsx
index 7fdbb01f..58e32a05 100644
--- a/frontend/src/components/ChannelLayoutGrid.dom.test.tsx
+++ b/frontend/src/components/ChannelLayoutGrid.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The channel manager's card layout as a keyboard list (E11 S4c): each card is an item, and Enter opens
+// The channel manager's card layout as a keyboard list: each card is an item, and Enter opens
 // the channel through the name ChannelLink renders. VirtualGrid is replaced by a stand-in that mounts
 // every item — jsdom has no layout for the virtualizer to measure — and registers with listNav exactly
 // when the real one would: when it is asked to (`keyboardNav`).
diff --git a/frontend/src/components/ChannelLayoutGrid.tsx b/frontend/src/components/ChannelLayoutGrid.tsx
index dfde3c12..be8e3aae 100644
--- a/frontend/src/components/ChannelLayoutGrid.tsx
+++ b/frontend/src/components/ChannelLayoutGrid.tsx
@@ -6,7 +6,7 @@ import { CHANNEL_LAYOUT_SPEC } from "../lib/channelLayout";
 import { navItemAttrs } from "../lib/listNav";
 import { SURFACE } from "./ui/surfaces";
 
-// The channel manager's `cards` layout (E4 S3), built by reusing the SAME `Column<T>` render closures
+// The channel manager's `cards` layout, built by reusing the SAME `Column<T>` render closures
 // the DataTable draws — so the subscribed and discovery tables (which have different columns) both get
 // the card view for free, and a cell's behaviour (priority bump, tag toggle, sync, actions) is defined
 // once. The `table` layout keeps DataTable; this renders only when the manager's layout is `cards`.
@@ -28,7 +28,7 @@ interface ChannelLayoutGridProps<T> {
   aboutKey?: string;
   /** Column key rendered as the action cluster, pinned to the card's bottom edge. */
   actionsKey?: string;
-  /** Column key docked at the top-right corner after the lead: the card's "…" (E28 C1), which
+  /** Column key docked at the top-right corner after the lead: the card's "…", which
    *  belongs beside the name it acts on, not under the card's last line. */
   moreKey?: string;
   rowClassName?: (row: T) => string;
diff --git a/frontend/src/components/ChannelPage.busyFocus.dom.test.tsx b/frontend/src/components/ChannelPage.busyFocus.dom.test.tsx
index 18672182..7fc5a128 100644
--- a/frontend/src/components/ChannelPage.busyFocus.dom.test.tsx
+++ b/frontend/src/components/ChannelPage.busyFocus.dom.test.tsx
@@ -1,9 +1,9 @@
 // @vitest-environment jsdom
 //
-// The channel page's Block and Hide toggles (deep-review E11 round 2) and its Subscribe / Unsubscribe
-// button (round 3: the same row, missed) while their request runs. A
+// The channel page's Block and Hide toggles and its Subscribe / Unsubscribe button (the same row,
+// missed by the first fix) while their request runs. A
 // focused button that turns natively `disabled` drops the keyboard to <body> in Chrome (measured for
-// ui/Button in E11 S2), so a busy toggle blocks the click with aria-disabled instead — focusable, and
+// ui/Button), so a busy toggle blocks the click with aria-disabled instead — focusable, and
 // still pressed only once.
 import type { ReactNode } from "react";
 import { describe, it, expect, vi, beforeAll, afterEach, onTestFinished } from "vitest";
@@ -99,7 +99,7 @@ describe("ChannelPage — a busy toggle keeps the keyboard", () => {
 });
 
 // The banner is retried on error (googleusercontent drops a burst); while an attempt fails and the
-// next waits, a visible <img> shows the browser's broken-image glyph (seen live, E28). It stays
+// next waits, a visible <img> shows the browser's broken-image glyph (seen live). It stays
 // invisible until a source has actually loaded.
 describe("ChannelPage — the banner", () => {
   it("is invisible until it loads, and again while a failed attempt is retried", async () => {
diff --git a/frontend/src/components/ChannelPage.fold.dom.test.tsx b/frontend/src/components/ChannelPage.fold.dom.test.tsx
index 03730394..c79d4f29 100644
--- a/frontend/src/components/ChannelPage.fold.dom.test.tsx
+++ b/frontend/src/components/ChannelPage.fold.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E31 (the owner's pick): the channel page's chrome is fixed, and its banner + identity block kept ~40% of a
+// The owner's pick: the channel page's chrome is fixed, and its banner + identity block kept ~40% of a
 // 133% screen before the first video for as long as the page was open. Once the grid scrolls they fold
 // away and the name rides in the tab row; back at the top they return. The Back button is one element in
 // both states, so a focused Back keeps its focus through the fold.
diff --git a/frontend/src/components/ChannelPage.tsx b/frontend/src/components/ChannelPage.tsx
index 758a3b78..fa0279ca 100644
--- a/frontend/src/components/ChannelPage.tsx
+++ b/frontend/src/components/ChannelPage.tsx
@@ -90,7 +90,7 @@ export default function ChannelPage({
   // where the channelScoped Feed portals ITS toolbar (via the overridden PageToolbarSlot below), so
   // the toolbar lands under the tabs inside the fixed band rather than in the scroller.
   const [chromeSlot, setChromeSlot] = useState<HTMLDivElement | null>(null);
-  // The banner and the identity block fold away once the grid scrolls (E31, the owner's pick): the chrome
+  // The banner and the identity block fold away once the grid scrolls (owner's pick): the chrome
   // is fixed, so unfolded it kept ~40% of a 133% screen for good. Folded, the name rides in the tab row.
   const foldable = useRef<HTMLDivElement>(null);
   const folded = useScrollFold(foldable);
@@ -102,7 +102,7 @@ export default function ChannelPage({
   const MAX_BANNER_RETRIES = 3;
   const [bannerAttempt, setBannerAttempt] = useState(0);
   // The banner source that has actually loaded. Until then the <img> is invisible: an attempt that
-  // fails shows the browser's broken-image glyph for as long as the retry waits (seen live, E28).
+  // fails shows the browser's broken-image glyph for as long as the retry waits (seen live).
   const [bannerLoaded, setBannerLoaded] = useState<string | null>(null);
 
   // A LIVE query: while THIS user's full-history backfill is running, poll so the stored count (and
@@ -144,7 +144,7 @@ export default function ChannelPage({
             qc.invalidateQueries({ queryKey: qk.channel(channelId) });
           })
           // Both the automatic first-visit explore and "load more" used to fail in silence: an empty
-          // channel page that looked like a channel with no videos (E11 S2b).
+          // channel page that looked like a channel with no videos.
           .catch((err: unknown) => notifyActionError(err, t("errors.writeFailed.exploreChannel")))
           .finally(() => setExploring(false))
       );
@@ -152,18 +152,17 @@ export default function ChannelPage({
     [channelId, qc, t],
   );
 
-  // First visit of an un-subscribed channel → ingest its recent uploads. Skipped for the demo
-  // account (explore spends shared quota) and when videos are already present (a revisit, or a
-  // subscribed channel whose uploads the scheduler backfills).
+  // First visit of an un-subscribed channel → ingest its recent uploads. Skipped when videos are
+  // already present (a revisit, or a subscribed channel whose uploads the scheduler backfills).
   useEffect(() => {
-    if (!ch || me.is_demo) return;
+    if (!ch) return;
     if (autoTried.current === channelId) return;
     if (ch.subscribed || ch.blocked) return;
     if (ch.explored && ch.stored_videos > 0) return;
     autoTried.current = channelId;
     // eslint-disable-next-line react-hooks/set-state-in-effect -- a one-off INGEST of an unsubscribed channel's uploads on first visit — a network side effect, not state. The autoTried ref keyed on the channel id is what makes it once per channel.
     void runExplore();
-  }, [ch, channelId, me.is_demo, runExplore]);
+  }, [ch, channelId, runExplore]);
 
   const block = useMutation({
     mutationFn: () => (ch?.blocked ? api.unblockChannel(channelId) : api.blockChannel(channelId)),
@@ -238,9 +237,9 @@ export default function ChannelPage({
   // Personal tags, editable right here (the same control + flow the channel manager uses). Optimistic
   // on this channel's detail cache; a failed attach/detach reverts by refetching, and a success
   // invalidates the manager list so a tag added here shows there too.
-  // Only fetch the tag catalog when the editor will actually render (subscribed, non-demo) — an
-  // unsubscribed/demo channel page never shows the control, so the request would be thrown away.
-  const tagsQuery = useTags({ enabled: !!ch?.subscribed && !me.is_demo });
+  // Only fetch the tag catalog when the editor will actually render (subscribed) — an unsubscribed
+  // channel page never shows the control, so the request would be thrown away.
+  const tagsQuery = useTags({ enabled: !!ch?.subscribed });
   const userTags = (tagsQuery.data ?? []).filter((tg) => !tg.system);
   const { toggleTag, createAndAttachTag } = useChannelTagActions({
     optimisticToggle: (id, tagId, attach) =>
@@ -268,7 +267,7 @@ export default function ChannelPage({
 
   // Channel-scoped feed: the whole catalog filtered to this channel (scope=all + source=all so
   // the explored, per-user-private videos show — the backend gates them to this explorer).
-  // The watch state is the one filter a channel page remembers (the owner, E31): a fresh page shows
+  // The watch state is the one filter a channel page remembers (owner's call): a fresh page shows
   // what is still unwatched, and a change sticks — across channels, reloads and devices.
   const [show, setShow] = usePref<string>("channelShow", "unwatched", {
     localKey: LS.channelShow,
@@ -314,7 +313,7 @@ export default function ChannelPage({
     ch?.total_view_count != null
       ? t("channel.totalViews", { formatted: formatCompact(ch.total_view_count, lang) })
       : null,
-    // Per-type breakdown (R14 moved this off the manager table's N/S/L column). Only meaningful
+    // Per-type breakdown (moved here off the manager table's old N/S/L column). Only meaningful
     // once we actually hold some of the channel's videos.
     ch && ch.stored_videos > 0
       ? t("channel.videoTypes", {
@@ -440,7 +439,7 @@ export default function ChannelPage({
             corner: there are only ever two tabs, so there's room, and it keeps the things you click
             within a few pixels of each other instead of across the page. */}
             {/* Wraps rather than overflows: at a tablet width (1024) the actions + tags ran past the edge and
-            the whole page scrolled sideways (E31 S1). The tag lane takes what is left and folds into "+N". */}
+            the whole page scrolled sideways. The tag lane takes what is left and folds into "+N". */}
             <div
               className={`flex flex-wrap items-center gap-2 border-b border-border pb-2 ${folded ? "pt-3" : "mt-3"}`}
             >
@@ -503,7 +502,7 @@ export default function ChannelPage({
                     <SlidersHorizontal className="w-4 h-4" />
                   </IconButton>
                 )}
-                {ch?.subscribed && !me.is_demo && (
+                {ch?.subscribed && (
                   <div className="inline-flex items-center gap-1.5 h-9 px-2.5 rounded-lg border border-border">
                     <span className="text-xs text-muted">{t("channels.cols.priority")}</span>
                     <PriorityStepper
@@ -520,7 +519,7 @@ export default function ChannelPage({
                 While loading, the label carries the live stored/total count (the detail poll refreshes
                 it) so a large channel's paced tail reads as visible progress rather than a stuck
                 spinner. */}
-                {ch?.subscribed && !ch.backfill_done && !me.is_demo && (
+                {ch?.subscribed && !ch.backfill_done && (
                   <Button
                     variant="outline"
                     onClick={() => !ch.deep_requested && deepBackfill.mutate()}
@@ -545,23 +544,21 @@ export default function ChannelPage({
                     </span>
                   </Button>
                 )}
-                {!me.is_demo && (
-                  <IconButton
-                    // Busy blocks the click, not the focus (FocusSafeButton). Nor does a busy toggle
-                    // light up on hover, as if a click would do something.
-                    size="md"
-                    variant={ch?.blocked ? "danger-soft" : "outline-danger"}
-                    onClick={() => block.mutate()}
-                    loading={block.isPending}
-                    label={ch?.blocked ? t("channel.unblock") : t("channel.block")}
-                  >
-                    <Ban />
-                  </IconButton>
-                )}
+                <IconButton
+                  // Busy blocks the click, not the focus (FocusSafeButton). Nor does a busy toggle
+                  // light up on hover, as if a click would do something.
+                  size="md"
+                  variant={ch?.blocked ? "danger-soft" : "outline-danger"}
+                  onClick={() => block.mutate()}
+                  loading={block.isPending}
+                  label={ch?.blocked ? t("channel.unblock") : t("channel.block")}
+                >
+                  <Ban />
+                </IconButton>
                 {/* Hide-from-feed toggle — subscription-scoped, so offered only on a followed channel
                   (mirrors the manager's Eye/EyeOff). Keeps the subscription; only drops its videos
                   from the feed. EyeOff = currently hidden (click to unhide). */}
-                {ch?.subscribed && !me.is_demo && (
+                {ch?.subscribed && (
                   <IconButton
                     size="md"
                     variant={ch.hidden ? "outline-accent" : "outline"}
@@ -573,8 +570,7 @@ export default function ChannelPage({
                     {ch.hidden ? <EyeOff /> : <Eye />}
                   </IconButton>
                 )}
-                {!me.is_demo &&
-                  !ch?.blocked &&
+                {!ch?.blocked &&
                   (ch?.subscribed ? (
                     <Button
                       variant="outline"
@@ -598,7 +594,7 @@ export default function ChannelPage({
                 {/* Tagging is a subscription-scoped action (attach_tag → _user_subscription 404s
                   otherwise), and personal tags are for your subscriptions — so only offer it on a
                   channel you actually follow. */}
-                {ch?.subscribed && !me.is_demo && (
+                {ch?.subscribed && (
                   <div className="min-w-0 flex-1">
                     <ChannelTagsControl
                       userTags={userTags}
@@ -631,7 +627,6 @@ export default function ChannelPage({
                 view={view}
                 setView={setView}
                 canRead={me.can_read}
-                isDemo={me.is_demo}
                 ytSearch={null}
                 onYtSearch={() => {}}
                 onExitYtSearch={() => {}}
diff --git a/frontend/src/components/ChannelPage.watchState.dom.test.tsx b/frontend/src/components/ChannelPage.watchState.dom.test.tsx
index 1533fa0b..7cda2ba6 100644
--- a/frontend/src/components/ChannelPage.watchState.dom.test.tsx
+++ b/frontend/src/components/ChannelPage.watchState.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E31 (the owner): a freshly opened channel page shows what is still unwatched, and a watch state the
+// The owner's call: a freshly opened channel page shows what is still unwatched, and a watch state the
 // viewer picks there sticks — a reload (a fresh mount, seeded from the stored preference) keeps it.
 import type { ReactNode } from "react";
 import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
diff --git a/frontend/src/components/ChannelStatsPopover.dom.test.tsx b/frontend/src/components/ChannelStatsPopover.dom.test.tsx
index 570f8743..70791df2 100644
--- a/frontend/src/components/ChannelStatsPopover.dom.test.tsx
+++ b/frontend/src/components/ChannelStatsPopover.dom.test.tsx
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
 // Contract of the catalog-stats hover chip: the compact trigger, the rows it reveals on open (value
-// formatting + the conditional "left" row), and — the point of the R13-S3 review fix — that each row
+// formatting + the conditional "left" row), and — the point of a review fix — that each row
 // still carries its per-stat explanation as a `title`, so the guidance the old inline stats showed is
 // not lost. i18n is mocked to a key-passthrough so assertions read the stable keys, not translations.
 // The AnchoredPopover platform is floating-ui based (hover mode), so we stub the observers autoUpdate
diff --git a/frontend/src/components/ChannelTags.suggest.dom.test.tsx b/frontend/src/components/ChannelTags.suggest.dom.test.tsx
index cefa69eb..7449ab23 100644
--- a/frontend/src/components/ChannelTags.suggest.dom.test.tsx
+++ b/frontend/src/components/ChannelTags.suggest.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Contract of the suggested-tag ghost chips (E8·S4): on an UNTAGGED channel, ChannelTagsControl renders
+// Contract of the suggested-tag ghost chips: on an UNTAGGED channel, ChannelTagsControl renders
 // one dashed "ghost" chip per suggestion; clicking the chip body accepts it (onAcceptSuggestion with the
 // tag id), the trailing × dismisses it (onDismissSuggestion), and a suggestion whose tag is already
 // attached is never shown. i18n is key-passthrough; the control rides the floating-ui popover platform
diff --git a/frontend/src/components/ChannelTags.tsx b/frontend/src/components/ChannelTags.tsx
index e8e545a9..81177e85 100644
--- a/frontend/src/components/ChannelTags.tsx
+++ b/frontend/src/components/ChannelTags.tsx
@@ -15,7 +15,7 @@ import { Input } from "./ui/Input";
 import { SURFACE } from "./ui/surfaces";
 
 // The channel tag surface, shared by the channel manager (table + cards) and the channel detail
-// page. Built on the R8 popover platform. Two design goals it fixes over the old inline TagsCell:
+// page. Built on the popover platform. Two design goals it fixes over the old inline TagsCell:
 //   1. Stable edit anchor — the "+" edit trigger LEADS the row (fixed left slot), so toggling tags
 //      (which grows the chip row to its right) never moves it, and the editor popover doesn't drift.
 //   2. Fixed footprint — the chip row lives in a width-bounded, single-line, overflow-hidden box and
@@ -42,7 +42,7 @@ function TagChip({ tag, onClick, title }: TagChipProps) {
   );
 }
 
-// A suggested user tag (E8·S4): a dashed "ghost" chip the user hasn't applied yet, learned from
+// A suggested user tag: a dashed "ghost" chip the user hasn't applied yet, learned from
 // their own tagging pattern. The chip body accepts it (one tap → attaches the real tag); the trailing
 // × dismisses it for the session. Rendered only on untagged channels, so it never competes with the
 // measured attached-chip row. (Two sibling buttons, not a button-in-button — invalid nesting.)
@@ -296,7 +296,7 @@ export function ChannelTagsControl({
   onCreate: (name: string) => void;
   /** Manager only: clicking a chip filters the feed by that tag. Omit on the detail page. */
   onChipClick?: (tagId: number, name: string) => void;
-  /** Manager only (E8·S4): suggested user tags for an UNTAGGED channel, shown as accept/dismiss ghost
+  /** Manager only: suggested user tags for an UNTAGGED channel, shown as accept/dismiss ghost
    *  chips after the (empty) attached row. Omit on the detail page. */
   suggestions?: SuggestedTag[];
   onAcceptSuggestion?: (tagId: number) => void;
diff --git a/frontend/src/components/Channels.tsx b/frontend/src/components/Channels.tsx
index 7bdf3749..125709fe 100644
--- a/frontend/src/components/Channels.tsx
+++ b/frontend/src/components/Channels.tsx
@@ -211,7 +211,7 @@ export default function Channels() {
     onError: () => qc.invalidateQueries({ queryKey: qk.channels() }),
   });
 
-  // A priority step picked from the row's menu (E28 S3e3b, owner): the one thing a pick is FOR is
+  // A priority step picked from the row's menu (the owner's call): the one thing a pick is FOR is
   // to move the channel up (or down) the list, so the list re-sorts at once — only that row moves
   // (`placeByPriority`, the server's order) — and the page and the focus follow it (`follow`): the
   // table/card pager turns to its page, and the effect below hands the focus to its "…" (its node
@@ -248,7 +248,7 @@ export default function Channels() {
       // Keep the channel DETAIL cache in step with the manager list (the detail page reads its tags
       // from qk.channel(id)); mirrors the detail page invalidating the manager list on its side. Also
       // recompute suggestions: a channel that just gained/lost a user tag changes the untagged set and
-      // the learned pattern (E8·S4).
+      // the learned pattern.
       onSuccess: (id) => {
         qc.invalidateQueries({ queryKey: qk.channel(id) });
         qc.invalidateQueries({ queryKey: qk.tagSuggestions() });
@@ -267,7 +267,7 @@ export default function Channels() {
   // The options are a memo so the hook's toggleTag/createAndAttachTag stay the same functions: the
   // column memo below names them (see `columns`).
   const { toggleTag, createAndAttachTag } = useChannelTagActions(tagActionOpts);
-  // --- Suggested tags (E8·S4): learned from the user's own manual-tag pattern, shown as accept/dismiss
+  // --- Suggested tags: learned from the user's own manual-tag pattern, shown as accept/dismiss
   // ghost chips on untagged channels. Dismissal is session-only (an accepted suggestion self-clears —
   // the channel becomes tagged and the server drops it; a dismissed one just hides until reload). The
   // /tags/suggestions query, the session dismiss set, and the optimistic accept/dismiss/bulk logic all
@@ -311,7 +311,7 @@ export default function Channels() {
   // funnel share ONE state and stay in sync (bidirectional). Toggling a chip rewrites `filters.tags`;
   // filterRows / DataTable then applies it. Channel-name search stays separate (the shared top box).
   const tagFilter = Array.isArray(filters.tags) ? filters.tags : [];
-  // B4 (E28 review L7): on a short window the band's filters — the tag chip lane and the status /
+  // B4: on a short window the band's filters — the tag chip lane and the status /
   // pager row — fold behind one "Filters · n"; the tabs and the TAGS editor stay. n = each picked tag,
   // plus every other active column filter (the status chips are the Sync column's).
   const fold = useFilterFold();
@@ -369,7 +369,7 @@ export default function Channels() {
     (c: ManagedChannel) => onViewChannel(c.id, c.title ?? t("channels.row.thisChannel")),
     [onViewChannel, t],
   );
-  // The channel's ONE action list (E28 C1) — ONE menu for the list, shared by the table and the card
+  // The channel's ONE action list — ONE menu for the list, shared by the table and the card
   // layout: they are two paints of the same rows, so a right-click, a long-press and the row's "…"
   // must mean the same thing in both. Only mounted under the SUBSCRIBED branch below: a discovery
   // result is not a `Channel` row yet, so pinning or hiding one could only 404.
@@ -405,7 +405,7 @@ export default function Channels() {
 
   // Tag/priority/text filters stay controlled COLUMN filters (`filters.tags` etc.) shared by the top
   // chips, the column funnels and the cards. The sync-status filter (`filters.sync`) is no longer a
-  // column — R14 retired the Sync column and folded its status into a ✓ charm on Stored — so it's
+  // column — the retired Sync column became a ✓ charm on Stored — so it's
   // applied as a pre-filter (`applySyncFilter`) over the rows fed to BOTH the table and the cards,
   // still driven by the same top chips. Hidden channels have their own tab (excluded here). Only the
   // name search filters at this step; the remaining column funnels run in DataTable / filterRows below.
@@ -698,7 +698,7 @@ export default function Channels() {
             {/* One row: the TAGS editor trigger (left) + the tag-filter chip lane (folds overflow into
           "+N") + Clear, then the catalog "…" actions pinned right, so the "…" menu always stays on the
           first line. Only the suggestions block wraps: below 40rem it takes a line of its own under
-          the row (E28 S3f3, the owner's pick A) — at 375 it had squeezed the chip lane to 0 px and
+          the row (the owner's pick) — at 375 it had squeezed the chip lane to 0 px and
           pushed the "…" off the screen. Channel-name search lives in the shared top SearchBar. */}
             <div className="flex flex-wrap items-center gap-2 min-w-0">
               {/* The "TAGS" label IS the tags-editor trigger (pencil), replacing the separate
@@ -725,7 +725,7 @@ export default function Channels() {
                   {t("datatable.clear")}
                 </Button>
               )}
-              {/* Suggested-tags affordance (E8·S4): a sparkle count of the visible suggestions, with a
+              {/* Suggested-tags affordance: a sparkle count of the visible suggestions, with a
                   one-click bulk-accept for the high-confidence ones. The per-row ghost chips handle the
                   rest. Hidden when there's nothing to suggest. */}
               {visibleSuggestions.length > 0 && (
@@ -865,7 +865,7 @@ export default function Channels() {
                   rowClassName={() => "group"}
                 />
                 {/* Folded, the status / pager row leaves the band, as the table's does — and the
-                    list's own end keeps it here too (round 2, F2: the cards had lost their pager). */}
+                    list's own end keeps it here too (the cards had once lost their pager). */}
                 {fold.folded && (
                   <div className="pt-3 flex items-center justify-between gap-3 flex-wrap">
                     {statusChips}
diff --git a/frontend/src/components/ChannelsProvider.dom.test.tsx b/frontend/src/components/ChannelsProvider.dom.test.tsx
index cdd36b56..df316c92 100644
--- a/frontend/src/components/ChannelsProvider.dom.test.tsx
+++ b/frontend/src/components/ChannelsProvider.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // ChannelsProvider's tab-history behaviour: setView pushes a `_chTab` history entry + persists the tab,
 // and a genuine browser Back (popstate carrying `_chTab`) restores + re-persists it. This wiring was
-// re-routed through useAccountPersistedState in R13 S2b, so it's exercised here rather than only by hand E2E.
+// re-routed through useAccountPersistedState, so it's exercised here rather than only by hand E2E.
 //
 // Uses REAL storage (jsdom localStorage/sessionStorage) with the tab's account pinned to 1, so
 // useAccountPersistedState / useSortState / useFilterState all resolve their account-scoped keys; only
@@ -29,7 +29,7 @@ beforeEach(() => {
   localStorage.clear();
   sessionStorage.setItem("siftlode.activeAccount", "1"); // pin the tab's account
   // Reset BOTH the history state and the query string: setView only owns an entry on the channels page,
-  // and the S8 URL mirror writes ctab/csort/cf — a stale key left by a prior test would be read back by
+  // and the URL mirror writes ctab/csort/cf — a stale key left by a prior test would be read back by
   // this provider's mount-time URL seed and change the starting tab.
   window.history.replaceState({ sfPage: "channels" }, "", "/");
 });
@@ -78,7 +78,7 @@ describe("ChannelsProvider tab history", () => {
   });
 });
 
-describe("ChannelsProvider — S8 shareable URL", () => {
+describe("ChannelsProvider — shareable URL", () => {
   it("seeds tab + sort + filters from a shared manager link at mount (URL wins over stored)", () => {
     // Stored view says "blocked"; the shared link says "hidden" + a sort + a filter → the URL wins.
     localStorage.setItem(VIEW_KEY, "blocked");
diff --git a/frontend/src/components/ChannelsProvider.tsx b/frontend/src/components/ChannelsProvider.tsx
index 6b6f79c7..4ea649e7 100644
--- a/frontend/src/components/ChannelsProvider.tsx
+++ b/frontend/src/components/ChannelsProvider.tsx
@@ -76,7 +76,7 @@ function readStoredFilters(): FilterMap {
   return migrateSyncChip() ?? {};
 }
 
-// S8: a shared manager link carries the content state in namespaced URL keys (ctab/csort/cf). When
+// A shared manager link carries the content state in namespaced URL keys (ctab/csort/cf). When
 // present, the URL wins over this account's stored view — read once at mount and applied over the slice
 // hooks (see the provider). The keys are channels-unique, so their mere presence identifies a shared
 // manager view; no ?page check is needed (the mirror below is page-gated so it never pollutes others).
@@ -114,7 +114,7 @@ export function ChannelsProvider({ children }: { children: ReactNode }) {
   const [focusNameRaw, setFocusName] = useState<string | null>(null);
   const [focusToken, setFocusToken] = useState(0);
 
-  // S8 — shareable manager view. Captured once at mount (or null when no manager URL keys are present).
+  // Shareable manager view. Captured once at mount (or null when no manager URL keys are present).
   const [urlSeed] = useState(readChannelsUrlSeed);
   const seededRef = useRef(false);
 
@@ -239,7 +239,7 @@ export function ChannelsProvider({ children }: { children: ReactNode }) {
     ],
   );
 
-  // S8: mirror the content state (tab + sort + column filters) into the address bar under the namespaced
+  // Mirror the content state (tab + sort + column filters) into the address bar under the namespaced
   // keys so a manager view is shareable. Gated on page===channels: off the manager the keys are cleared
   // (localStorage still holds the state; it re-mirrors on return). The name `search` stays OUT — it's a
   // deliberately transient rail-search, like the feed's and plex's.
diff --git a/frontend/src/components/ChatDock.tsx b/frontend/src/components/ChatDock.tsx
deleted file mode 100644
index db984d3d..00000000
--- a/frontend/src/components/ChatDock.tsx
+++ /dev/null
@@ -1,131 +0,0 @@
-import { useEffect } from "react";
-import { qk } from "../lib/queryKeys";
-import { useTranslation } from "react-i18next";
-import { useQueryClient } from "@tanstack/react-query";
-import { ChevronDown, ChevronUp, X } from "lucide-react";
-import {
-  closeChat,
-  initDock,
-  notifyIncoming,
-  toggleMinimize,
-  useDockChats,
-  type DockChat,
-} from "../lib/chatDock";
-import { onMessage, onUnread } from "../lib/messagesSocket";
-import * as e2ee from "../lib/e2ee";
-import { errorAttrs, log } from "../lib/log";
-import Avatar from "./ui/Avatar";
-import ChatThread from "./ChatThread";
-import Overlay from "./ui/Overlay";
-import { IconButton } from "./ui/IconButton";
-import { Pressable } from "./ui/Pressable";
-import { SURFACE } from "./ui/surfaces";
-
-// The Messenger-style floating chat dock: open conversations live here, bottom-right, across
-// page navigation (state persisted per user). Always mounted (for human users) so it also owns
-// the app-wide live-message subscription and restores this device's unlock state on load.
-export default function ChatDock({ meId }: { meId: number }) {
-  const qc = useQueryClient();
-  const chats = useDockChats();
-
-  // Restore the per-device unlocked key and the persisted dock windows once, app-wide.
-  useEffect(() => {
-    initDock(meId);
-    // The device key store can be unopenable (storage disabled, some private windows): messages then
-    // stay locked behind the passphrase, as on a new device — said in the log, not thrown at nobody.
-    e2ee
-      .loadFromDevice(meId)
-      .catch((err: unknown) =>
-        log.warn(
-          "ui.e2ee_device_key_unreadable",
-          "the device key store could not be read",
-          errorAttrs(err),
-        ),
-      );
-  }, [meId]);
-
-  // Live delivery: refresh the conversation list, unread badge, and the affected thread; and
-  // for an INCOMING message, open or flash that partner's dock window.
-  useEffect(
-    () =>
-      onMessage(({ message: m, from }) => {
-        qc.invalidateQueries({ queryKey: qk.conversations() });
-        qc.invalidateQueries({ queryKey: qk.messageUnread() });
-        const partnerId = m.sender_id === meId ? m.recipient_id : m.sender_id;
-        qc.invalidateQueries({ queryKey: qk.thread(partnerId) });
-        // Auto-open/flash only for messages from someone else (not my own echo) and only for
-        // real user conversations.
-        if (m.kind === "user" && m.sender_id !== meId && from) {
-          notifyIncoming({ id: from.id, name: from.name, avatar_url: from.avatar_url });
-        }
-      }),
-    [qc, meId],
-  );
-
-  // Live badge sync: another tab/device read a thread → refresh this tab's unread count + list.
-  useEffect(
-    () =>
-      onUnread(() => {
-        qc.invalidateQueries({ queryKey: qk.messageUnread() });
-        qc.invalidateQueries({ queryKey: qk.conversations() });
-      }),
-    [qc],
-  );
-
-  if (chats.length === 0) return null;
-  return (
-    <Overlay>
-      <div className="fixed bottom-0 right-0 z-rail flex flex-row-reverse items-end gap-3 p-4 pointer-events-none">
-        {chats.map((c) => (
-          <ChatWindow key={c.partnerId} chat={c} meId={meId} />
-        ))}
-      </div>
-    </Overlay>
-  );
-}
-
-function ChatWindow({ chat, meId }: { chat: DockChat; meId: number }) {
-  const { t } = useTranslation();
-  return (
-    <div
-      className={`${SURFACE.panel} pointer-events-auto relative w-80 max-w-[calc(100vw-2rem)] flex flex-col overflow-hidden`}
-    >
-      {/* One-shot attention flash on a new message; keyed by the counter so it replays each time. */}
-      {chat.flash > 0 && (
-        <div
-          key={chat.flash}
-          className="chat-flash pointer-events-none absolute inset-0 rounded-2xl z-base"
-        />
-      )}
-      <div className="flex items-center gap-2 px-3 py-2 border-b border-border bg-card/50">
-        <Pressable
-          selectable
-          onClick={() => toggleMinimize(chat.partnerId)}
-          className="flex items-center gap-2 min-w-0 flex-1"
-          title={chat.minimized ? t("messages.expand") : t("messages.minimize")}
-        >
-          <Avatar
-            src={chat.avatar}
-            fallback={chat.name}
-            className="w-7 h-7 rounded-full shrink-0 text-xs"
-          />
-          <span className="font-semibold text-sm truncate">{chat.name}</span>
-        </Pressable>
-        <IconButton
-          onClick={() => toggleMinimize(chat.partnerId)}
-          label={chat.minimized ? t("messages.expand") : t("messages.minimize")}
-        >
-          {chat.minimized ? <ChevronUp /> : <ChevronDown />}
-        </IconButton>
-        <IconButton onClick={() => closeChat(chat.partnerId)} label={t("messages.close")}>
-          <X />
-        </IconButton>
-      </div>
-      {!chat.minimized && (
-        <div className="flex flex-col h-96">
-          <ChatThread meId={meId} partnerId={chat.partnerId} isSystem={false} />
-        </div>
-      )}
-    </div>
-  );
-}
diff --git a/frontend/src/components/ChatThread.tsx b/frontend/src/components/ChatThread.tsx
deleted file mode 100644
index 80b84671..00000000
--- a/frontend/src/components/ChatThread.tsx
+++ /dev/null
@@ -1,243 +0,0 @@
-import { useEffect, useEffectEvent, useRef, useState } from "react";
-import { qk } from "../lib/queryKeys";
-import { useTranslation } from "react-i18next";
-import { useMutation, useQueryClient } from "@tanstack/react-query";
-import { Send } from "lucide-react";
-import { api, type Message, type MessageUser } from "../lib/api";
-import { useLiveQuery } from "../lib/useLiveQuery";
-import { useScrollFade } from "../lib/useScrollFade";
-import { IconButton } from "./ui/IconButton";
-import { LoadingState, StateMessage } from "./ui/QueryState";
-import { notifyActionError } from "../lib/actionErrors";
-import { partnerPub, POLL_MS, refreshPartnerPub, useKeyState } from "../lib/messaging";
-import * as e2ee from "../lib/e2ee";
-import KeyGate from "./KeyGate";
-import { Textarea } from "./ui/Input";
-import { RelativeTime } from "./ui/RelativeTime";
-
-// The message list + composer for one conversation, shared by the full Messages page and the
-// floating dock window. Handles client-side decryption and encrypt-on-send; the surrounding
-// chrome (back button / minimize / close) is the caller's. Self-contained key gating: prompts
-// setup/unlock (server-truth) for a user conversation until messaging is ready.
-export default function ChatThread({
-  meId,
-  partnerId,
-  isSystem,
-}: {
-  meId: number;
-  partnerId: number;
-  isSystem: boolean;
-}) {
-  const { t } = useTranslation();
-  const qc = useQueryClient();
-  const [draft, setDraft] = useState("");
-  const [plain, setPlain] = useState<Record<number, string>>({});
-  const bottomRef = useRef<HTMLDivElement>(null);
-  const { ref: fadeRef, style: fadeStyle } = useScrollFade();
-  const ready = useKeyState() === "ready";
-  const needsKey = !isSystem && !ready;
-
-  const q = useLiveQuery<{ partner: MessageUser; items: Message[] }>(
-    qk.thread(partnerId),
-    () => api.thread(partnerId),
-    { intervalMs: POLL_MS, enabled: !needsKey },
-  );
-  const items = q.data?.items ?? [];
-  // The two effects below take the FETCH as their trigger and read the payload through this effect
-  // event, so their dep lists name everything they touch without making the identity of `q.data` a
-  // trigger.
-  const latestThread = useEffectEvent(() => q.data);
-
-  // Decrypt the thread when fresh server data arrives. Keyed on dataUpdatedAt (not `items`): the
-  // `?? []` fallback is a new array reference every render, which would otherwise re-run this
-  // effect (and setPlain a new object) on every render while data is loading — a render storm.
-  useEffect(() => {
-    if (isSystem || !ready) return;
-    let cancelled = false;
-    const thread = latestThread();
-    // Every await inside is caught per message (a failure reads "can't decrypt"), so this never rejects.
-    void (async () => {
-      const out: Record<number, string> = {};
-      // Fetch the partner key lazily inside the try (only when there's a ciphertext message) and
-      // once — so an empty thread never fetches, and a fetch failure (e.g. a partner who reset and
-      // hasn't re-set-up, so has no key) degrades to "can't decrypt" instead of rejecting the pass.
-      let pub: string | null = null;
-      let refreshed = false;
-      for (const m of thread?.items ?? []) {
-        if (!m.ciphertext || !m.iv) continue;
-        try {
-          if (!pub) pub = await partnerPub(partnerId);
-          out[m.id] = await e2ee.decryptFrom(partnerId, pub, m.ciphertext, m.iv);
-        } catch {
-          // A decrypt failure can mean the partner rotated their keypair (a passphrase reset), so
-          // this device's cached public key is stale. Refresh it ONCE per pass and retry — that
-          // also re-derives future sends under the current key. A genuinely bad message still ends
-          // up "can't decrypt".
-          if (!refreshed) {
-            refreshed = true;
-            try {
-              pub = await refreshPartnerPub(partnerId);
-              out[m.id] = await e2ee.decryptFrom(partnerId, pub, m.ciphertext, m.iv);
-              continue;
-            } catch {
-              /* fall through to the error label below */
-            }
-          }
-          out[m.id] = "⚠ " + t("messages.cantDecrypt");
-        }
-      }
-      if (!cancelled) setPlain(out);
-    })();
-    return () => {
-      cancelled = true;
-    };
-    // `dataUpdatedAt` is the trigger and the payload is read through the effect event above — see
-    // Messages, where keying this family on `q.data` itself produced a render loop.
-  }, [q.dataUpdatedAt, ready, isSystem, partnerId, t]);
-
-  // Opening the thread (or a new incoming message arriving) marks messages read server-side, so
-  // refresh the badges — but ONLY when the incoming-message count actually changed, not on every
-  // 20s poll (which would needlessly refetch /conversations + /unread_count each tick).
-  const lastIncoming = useRef(-1);
-  const lastPartner = useRef(partnerId);
-  useEffect(() => {
-    if (!q.dataUpdatedAt) return;
-    // The Messages page reuses one ChatThread instance across conversation switches (not keyed by
-    // partnerId), so reset the counter when the partner changes — otherwise switching to a thread
-    // with the same incoming-count would skip the open-marks-read refresh.
-    if (lastPartner.current !== partnerId) {
-      lastPartner.current = partnerId;
-      lastIncoming.current = -1;
-    }
-    const incoming = (latestThread()?.items ?? []).filter((m) => m.recipient_id === meId).length;
-    if (incoming !== lastIncoming.current) {
-      lastIncoming.current = incoming;
-      qc.invalidateQueries({ queryKey: qk.conversations() });
-      qc.invalidateQueries({ queryKey: qk.messageUnread() });
-    }
-  }, [q.dataUpdatedAt, partnerId, meId, qc]);
-
-  // Scroll to the newest message when the count changes (open / new message) — NOT on `plain`,
-  // which gets a fresh object on every poll's decrypt pass and would yank a scrolled-up reader
-  // back to the bottom even when nothing new arrived.
-  useEffect(() => {
-    bottomRef.current?.scrollIntoView({ block: "end" });
-  }, [items.length]);
-
-  const send = useMutation({
-    mutationFn: async (text: string) => {
-      const pub = await partnerPub(partnerId);
-      const { ciphertext, iv } = await e2ee.encryptFor(partnerId, pub, text);
-      return api.sendMessage(partnerId, ciphertext, iv);
-    },
-    onSuccess: () => {
-      setDraft("");
-      qc.invalidateQueries({ queryKey: qk.thread(partnerId) });
-      qc.invalidateQueries({ queryKey: qk.conversations() });
-    },
-    onError: (e) => {
-      // The draft is kept (only cleared on success) so the user can retry. 400/409/422/500 already
-      // raised the global error dialog; 404 (recipient gone) and 429 (rate-limited) are "caller-
-      // handled" in api.req (no modal), so surface those here or the send fails silently.
-      //
-      // Through the shared helper, which knows both of those rules: it no-ops on anything already
-      // reported, and it prefers the server's reason only when that reason is a STRUCTURED detail.
-      // The hand-written copy that used to live here did `e.detail || …`, so a Hungarian reader got
-      // the route's English sentence — "That member hasn't set up messaging yet." — which is
-      // exactly what round 5 changed `notifyActionError` to stop doing. A second copy of a contract
-      // is how the fix misses a caller (round 6).
-      notifyActionError(e, t("messages.sendFailed"));
-    },
-  });
-
-  const submit = () => {
-    const text = draft.trim();
-    if (text && !send.isPending) send.mutate(text);
-  };
-
-  if (needsKey) {
-    return (
-      <div className="flex-1 grid place-items-center p-3 overflow-y-auto">
-        <div className="w-full max-w-sm">
-          <KeyGate meId={meId} compact />
-        </div>
-      </div>
-    );
-  }
-
-  return (
-    <>
-      <div
-        ref={fadeRef}
-        style={fadeStyle}
-        className="flex-1 overflow-y-auto no-scrollbar p-3 flex flex-col gap-2"
-      >
-        {q.isError && !q.data ? (
-          <div className="m-auto">
-            <StateMessage tone="error" onRetry={() => q.refetch()}>
-              {t("common.loadError")}
-            </StateMessage>
-          </div>
-        ) : q.isPending ? (
-          <div className="m-auto">
-            <LoadingState />
-          </div>
-        ) : items.length === 0 ? (
-          <div className="m-auto text-sm text-muted">{t("messages.threadEmpty")}</div>
-        ) : (
-          items.map((m) => {
-            const mine = m.sender_id === meId;
-            const text = m.kind === "system" ? (m.body ?? "") : (plain[m.id] ?? "…");
-            return (
-              <div key={m.id} className={`flex ${mine ? "justify-end" : "justify-start"}`}>
-                <div
-                  className={`max-w-[80%] rounded-2xl px-3 py-2 text-sm whitespace-pre-wrap wrap-break-word ${
-                    mine ? "bg-accent text-accent-fg rounded-br-sm" : "bg-card rounded-bl-sm"
-                  }`}
-                >
-                  {text}
-                  <RelativeTime
-                    at={m.created_at}
-                    className={`block text-3xs mt-1 ${mine ? "text-accent-fg/70" : "text-muted"}`}
-                  />
-                </div>
-              </div>
-            );
-          })
-        )}
-        <div ref={bottomRef} />
-      </div>
-
-      {isSystem ? (
-        <div className="p-2 border-t border-border text-center text-xs text-muted">
-          {t("messages.systemReadOnly")}
-        </div>
-      ) : (
-        <div className="flex items-end gap-2 p-2 border-t border-border">
-          <Textarea
-            className="flex-1 resize-none max-h-28"
-            value={draft}
-            onChange={(e) => setDraft(e.target.value)}
-            onKeyDown={(e) => {
-              if (e.key === "Enter" && !e.shiftKey) {
-                e.preventDefault();
-                submit();
-              }
-            }}
-            rows={1}
-            placeholder={t("messages.writePlaceholder")}
-          />
-          <IconButton
-            label={t("messages.send")}
-            size="md"
-            variant="primary"
-            onClick={submit}
-            disabled={!draft.trim() || send.isPending}
-          >
-            <Send className="w-4 h-4" />
-          </IconButton>
-        </div>
-      )}
-    </>
-  );
-}
diff --git a/frontend/src/components/ConfigPanel.field.dom.test.tsx b/frontend/src/components/ConfigPanel.field.dom.test.tsx
index 49e1c407..1033e738 100644
--- a/frontend/src/components/ConfigPanel.field.dom.test.tsx
+++ b/frontend/src/components/ConfigPanel.field.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E22 round-2 review: locks the stacking that makes an admin config row usable on a phone. The
+// Locks the stacking that makes an admin config row usable on a phone. The
 // control column cannot shrink, so beside a wide control it left the label and its hint a sliver of
 // the ~250 px a phone leaves next to the navigation rail. The sibling fix — a long-labelled choice
 // becoming a dropdown — is covered in ConfigPanel.choice.dom.test.tsx, but that one does nothing for
@@ -61,7 +61,7 @@ afterEach(() => {
   vi.clearAllMocks();
 });
 
-describe("ConfigPanel field row (E22 round 2)", () => {
+describe("ConfigPanel field row", () => {
   it("stacks the label above the control below `sm`, and lets the control fit the screen", async () => {
     render(
       <QueryClientProvider client={new QueryClient()}>
diff --git a/frontend/src/components/ConfigPanel.sections.dom.test.tsx b/frontend/src/components/ConfigPanel.sections.dom.test.tsx
index 388634cf..fe33b577 100644
--- a/frontend/src/components/ConfigPanel.sections.dom.test.tsx
+++ b/frontend/src/components/ConfigPanel.sections.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E31 (the owner's pick): Configuration's sixteen group tabs wrapped to three rows at 133% zoom, so they
+// The owner's pick: Configuration's sixteen group tabs wrapped to three rows at 133% zoom, so they
 // are a side list under four headings, as Settings has. The registry owns the order: the groups follow
 // its sections, not the order the groups object happens to arrive in.
 import { afterEach, describe, expect, it, vi } from "vitest";
@@ -64,7 +64,7 @@ const renderPanel = () =>
     </QueryClientProvider>,
   );
 
-describe("Configuration sections (E31)", () => {
+describe("Configuration sections", () => {
   it("lists the groups in the registry's sections, each heading once above its run", async () => {
     renderPanel();
     const list = await screen.findByRole("tablist");
diff --git a/frontend/src/components/ConfigPanel.tsx b/frontend/src/components/ConfigPanel.tsx
index b6211445..9465f400 100644
--- a/frontend/src/components/ConfigPanel.tsx
+++ b/frontend/src/components/ConfigPanel.tsx
@@ -159,7 +159,7 @@ export default function ConfigPanel() {
       notifyActionError(e, t("config.plexTestFailed"));
     },
   });
-  // Bug reports' "Test connection" (E16): the repository answers, takes issues, is private.
+  // Bug reports' "Test connection": the repository answers, takes issues, is private.
   const testIssues = useMutation({
     mutationFn: () => api.testIssues(),
     onSuccess: (r) =>
@@ -192,7 +192,7 @@ export default function ConfigPanel() {
     return <LoadingState label={t("config.loading")} />;
   }
 
-  // The groups in the registry's sections, in order (E31: sixteen tabs wrapped to three rows at 133%
+  // The groups in the registry's sections, in order (sixteen tabs wrapped to three rows at 133%
   // zoom, so they are a side list under four headings, as Settings has).
   const groupKeys = data.sections.flatMap((s) => s.groups);
   // Clamp the persisted tab to a real group (the registry can change between sessions). The
@@ -214,7 +214,7 @@ export default function ConfigPanel() {
       <div className="px-4 pb-24 pt-3 max-w-4xl w-full mx-auto">
         <p className="text-xs text-muted mb-3 leading-relaxed">{t("config.intro")}</p>
         {/* The groups as a side list under their headings, the fields beside it: Settings' own
-            layout, one pattern for both settings pages (E31). */}
+            layout, one pattern for both settings pages. */}
         <div className={`${SURFACE.panel} mb-4 flex flex-col overflow-hidden sm:flex-row`}>
           <Tabs
             idBase={panel.idBase}
diff --git a/frontend/src/components/DateFilterSelect.dom.test.tsx b/frontend/src/components/DateFilterSelect.dom.test.tsx
index 112bf148..4ae6c37e 100644
--- a/frontend/src/components/DateFilterSelect.dom.test.tsx
+++ b/frontend/src/components/DateFilterSelect.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 (owner): a native date field reports a complete, valid date on every keystroke of its year, so
+// A native date field reports a complete, valid date on every keystroke of its year, so
 // typing 2026 applied 0002, 0020, 0202 and 2026 — four feed refetches for one year.
 import { describe, it, expect, vi, afterEach } from "vitest";
 import { render, cleanup, screen, fireEvent } from "@testing-library/react";
diff --git a/frontend/src/components/DebugRecorder.dom.test.tsx b/frontend/src/components/DebugRecorder.dom.test.tsx
index 0db9d6d4..7043659b 100644
--- a/frontend/src/components/DebugRecorder.dom.test.tsx
+++ b/frontend/src/components/DebugRecorder.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E16 S2: the debug recorder. Its pill rides the toast hosts (lib/toastDock) and stays out of their
+// The debug recorder. Its pill rides the toast hosts (lib/toastDock) and stays out of their
 // live region; Start is consent-first; Stop sends what is waiting BEFORE the server closes the
 // session; a step is one tagged event; Escape in the step prompt closes only the prompt, never the
 // dialog the pill sits in. i18n is a key-passthrough with its params; the API is stubbed and `me`
@@ -117,7 +117,6 @@ function mount(me: Partial<Me>, extra: React.ReactNode = null) {
   const qc = new QueryClient({ defaultOptions: { mutations: { retry: false } } });
   qc.setQueryData(qk.me(), {
     id: 1,
-    is_demo: false,
     preferences: {},
     diagnostics: { level: "INFO", until: null, retention_days: 7, session_minutes: 60 },
     debug_session: null,
@@ -317,7 +316,6 @@ describe("the past sessions a user goes back to check", () => {
     const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
     qc.setQueryData(qk.me(), {
       id: 1,
-      is_demo: false,
       preferences: {},
       diagnostics: { level: "INFO", until: null, retention_days: 7, session_minutes: 60 },
       debug_session: null,
diff --git a/frontend/src/components/DebugRecorder.tsx b/frontend/src/components/DebugRecorder.tsx
index b74d9e24..abfeb44d 100644
--- a/frontend/src/components/DebugRecorder.tsx
+++ b/frontend/src/components/DebugRecorder.tsx
@@ -31,12 +31,12 @@ import { useDebugRecording } from "./useDebugRecording";
 import { Input } from "./ui/Input";
 import { SURFACE } from "./ui/surfaces";
 
-// The debug recorder (E16): Start → reproduce → Stop.
+// The debug recorder: Start → reproduce → Stop.
 //
 // While a session records, its pill sits under the toasts (lib/toastDock), so it rides every toast
 // host — the page, each dialog, both players, the fullscreen player — and is reachable wherever the
 // bug is being reproduced, above a player's control band rather than on it. Mounted once, in the
-// app shell, for a signed-in account other than the demo.
+// app shell, for a signed-in account.
 
 /** The time since `since`, as the app's other clocks show it, re-rendered every second. */
 function useElapsed(since: string): string {
@@ -296,7 +296,7 @@ function StepPrompt({ id, onDone }: { id: string; onDone: (label: string | null)
   // It does NOT take the Tab, though: it is a field inside whatever dialog the pill is docked in,
   // not a dialog of its own, and the trap belongs to that one — it spans the prompt as it spans the
   // rest of the toast host. Claiming it here switched the dialog's off and left every control
-  // OUTSIDE this little box untrapped (deep-review round 3).
+  // OUTSIDE this little box untrapped.
   useLayer(true, () => onDone(null), { trapsTab: false });
   const onKeyDown = (e: ReactKeyboardEvent<HTMLInputElement>) => {
     if (e.key === "Enter") {
@@ -332,7 +332,7 @@ function StepPrompt({ id, onDone }: { id: string; onDone: (label: string | null)
 
 /** The five words a past session can read as. A union, not `string`, because `chipTone` below
  *  matches on these same keys: untyped, a rename in one of them left the other matching nothing
- *  and every chip untoned, with the gate green (deep-review round 4). */
+ *  and every chip untoned, with the gate green. */
 type HistoryState =
   | "recorder.history.sending"
   | "recorder.history.draft"
diff --git a/frontend/src/components/DemoBanner.tsx b/frontend/src/components/DemoBanner.tsx
deleted file mode 100644
index e7837a92..00000000
--- a/frontend/src/components/DemoBanner.tsx
+++ /dev/null
@@ -1,15 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { AlertTriangle } from "lucide-react";
-import Banner from "./ui/Banner";
-
-// Permanent, non-dismissible bar shown to the shared demo account so it's always clear the
-// state is communal. (Replaces the old login-time toast, which re-popped on every reload.)
-export default function DemoBanner() {
-  const { t } = useTranslation();
-  return (
-    <Banner tone="warning" icon={AlertTriangle}>
-      <span className="font-semibold">{t("common.demoTitle")}</span>
-      <span className="text-muted"> — {t("common.demoSharedNotice")}</span>
-    </Banner>
-  );
-}
diff --git a/frontend/src/components/DiagnosticsSettings.dom.test.tsx b/frontend/src/components/DiagnosticsSettings.dom.test.tsx
index 2300d8a5..2d8cab16 100644
--- a/frontend/src/components/DiagnosticsSettings.dom.test.tsx
+++ b/frontend/src/components/DiagnosticsSettings.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E22 S5: Settings → Diagnosztika. Raising the level is a consent, so choosing Részletes or Teljes
+// Settings → Diagnosztika. Raising the level is a consent, so choosing Részletes or Teljes
 // must change NOTHING until the consent box's own button is pressed; going back to Alap needs no
 // consent. i18n is a key-passthrough (with the count, so the retention days are visible); the level
 // endpoint is stubbed, and `me` lives in a real query cache so a saved level re-renders like in the app.
@@ -60,7 +60,6 @@ function mount(me: Partial<Me>) {
   const qc = new QueryClient();
   qc.setQueryData(qk.me(), {
     id: 1,
-    is_demo: false,
     preferences: {},
     diagnostics: { level: "INFO", until: null, retention_days: 7, session_minutes: 60 },
     ...me,
@@ -212,7 +211,6 @@ describe("DiagnosticsSettings", () => {
     await waitFor(() => expect(screen.getByTestId("diagnostics-status")).toBeTruthy());
     answerStale({
       id: 1,
-      is_demo: false,
       preferences: {},
       diagnostics: { level: "INFO", until: null, retention_days: 7, session_minutes: 60 },
     });
@@ -229,10 +227,4 @@ describe("DiagnosticsSettings", () => {
     );
     expect(screen.queryByTestId("diagnostics-status")).toBeNull();
   });
-
-  it("the shared demo account gets an explanation instead of the picker", () => {
-    mount({ is_demo: true });
-    expect(screen.queryByRole("group", { name: "settings.diagnostics.level" })).toBeNull();
-    expect(screen.getByText("settings.diagnostics.demo")).toBeTruthy();
-  });
 });
diff --git a/frontend/src/components/DiagnosticsSettings.tsx b/frontend/src/components/DiagnosticsSettings.tsx
index c6f57f69..d6e1ac63 100644
--- a/frontend/src/components/DiagnosticsSettings.tsx
+++ b/frontend/src/components/DiagnosticsSettings.tsx
@@ -7,7 +7,6 @@ import { levelInForce } from "../lib/diagnostics";
 import { focusIsUnclaimed } from "../lib/useFocusKeeper";
 import { updateMeCache, useMe } from "../lib/useMe";
 import { Button } from "./ui/Button";
-import InlineNotice from "./ui/InlineNotice";
 import SegmentedToggle from "./ui/SegmentedToggle";
 import { Section, SettingRow } from "./ui/form";
 import MyLogViewer from "./MyLogViewer";
@@ -33,7 +32,7 @@ function useRemaining(until: string | null): { h: number; m: number } | null {
   return { h: Math.floor(minutes / 60), m: minutes % 60 };
 }
 
-// Settings → Diagnosztika (E22 S5): the consented diagnostics level and the tab's own log.
+// Settings → Diagnosztika: the consented diagnostics level and the tab's own log.
 //
 // There is no separate on/off switch: Alap IS off. Choosing Részletes or Teljes does not change
 // anything yet — it opens the consent box under the picker, which says what will be recorded, that
@@ -99,24 +98,20 @@ export default function DiagnosticsSettings() {
   return (
     <>
       <Section title={t("settings.diagnostics.title")}>
-        {me.is_demo ? (
-          <InlineNotice>{t("settings.diagnostics.demo")}</InlineNotice>
-        ) : (
-          <SettingRow
-            label={t("settings.diagnostics.level")}
-            hint={t("settings.diagnostics.levelHint")}
-          >
-            <div ref={pickerRef}>
-              <SegmentedToggle
-                size="md"
-                ariaLabel={t("settings.diagnostics.level")}
-                value={pending ?? current}
-                onChange={choose}
-                options={LEVELS.map((level) => ({ value: level, label: levelName(level) }))}
-              />
-            </div>
-          </SettingRow>
-        )}
+        <SettingRow
+          label={t("settings.diagnostics.level")}
+          hint={t("settings.diagnostics.levelHint")}
+        >
+          <div ref={pickerRef}>
+            <SegmentedToggle
+              size="md"
+              ariaLabel={t("settings.diagnostics.level")}
+              value={pending ?? current}
+              onChange={choose}
+              options={LEVELS.map((level) => ({ value: level, label: levelName(level) }))}
+            />
+          </div>
+        </SettingRow>
 
         {pending && (
           <div
@@ -186,11 +181,9 @@ export default function DiagnosticsSettings() {
         )}
       </Section>
 
-      {!me.is_demo && (
-        <Section title={t("recorder.settings.title")}>
-          <RecorderSettings />
-        </Section>
-      )}
+      <Section title={t("recorder.settings.title")}>
+        <RecorderSettings />
+      </Section>
 
       <Section title={t("settings.myLog.title")}>
         <MyLogViewer />
diff --git a/frontend/src/components/DownloadButton.tsx b/frontend/src/components/DownloadButton.tsx
index 93230492..e12c2f84 100644
--- a/frontend/src/components/DownloadButton.tsx
+++ b/frontend/src/components/DownloadButton.tsx
@@ -1,17 +1,16 @@
 import { lazy, Suspense, useState } from "react";
 import { qk } from "../lib/queryKeys";
 import { useTranslation } from "react-i18next";
-import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { useQuery } from "@tanstack/react-query";
 import { Download } from "lucide-react";
 import clsx from "clsx";
 // Lazy: the download dialog (+ its profile editor) loads only when a card's download button is
 // clicked, so it never ships in the feed chunk for the majority who just browse.
 const DownloadDialog = lazy(() => import("./DownloadDialog"));
-import { api, type Me } from "../lib/api";
+import { api } from "../lib/api";
 import { IconButton } from "./ui/IconButton";
 
-// Self-contained download affordance for a video card / the player. Hidden for the demo account
-// (downloads spend server disk + need a real identity). Reflects the video's current state from
+// Self-contained download affordance for a video card / the player. Reflects the video's current state from
 // the shared per-user download index (one polled query shared across every card).
 export default function DownloadButton({
   videoId,
@@ -25,20 +24,13 @@ export default function DownloadButton({
   size?: "sm" | "md";
 }) {
   const { t } = useTranslation();
-  const qc = useQueryClient();
-  const me = qc.getQueryData<Me>(qk.me());
-  const isDemo = !!me?.is_demo;
-
   const indexQ = useQuery({
     queryKey: qk.downloadIndex(),
     queryFn: api.downloadIndex,
-    enabled: !isDemo,
     staleTime: 10000,
   });
   const [open, setOpen] = useState(false);
 
-  if (isDemo) return null;
-
   const status = indexQ.data?.[videoId];
   const downloaded = status === "done";
   const inQueue = status === "queued" || status === "running" || status === "paused";
diff --git a/frontend/src/components/DownloadCenter.confirm.dom.test.tsx b/frontend/src/components/DownloadCenter.confirm.dom.test.tsx
index 06ba4905..f4adee4c 100644
--- a/frontend/src/components/DownloadCenter.confirm.dom.test.tsx
+++ b/frontend/src/components/DownloadCenter.confirm.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The Download Center's confirm dialogs name their ACTION on the confirm button (E11.5): the shared
+// The Download Center's confirm dialogs name their ACTION on the confirm button: the shared
 // `confirmThen` once labelled it with the dialog's question — "Re-download this file?" on the button,
 // and the cancel dialog's own "Cancel" beside "Cancel". i18n is key-passthrough, so labels read as keys.
 import { afterEach, describe, expect, it, vi } from "vitest";
@@ -107,7 +107,7 @@ describe("DownloadCenter confirm dialogs", () => {
       </QueryClientProvider>,
     );
 
-    // E28 C1: the destructive and rare row buttons live in the row's "…".
+    // The destructive and rare row buttons live in the row's "…".
     await pick("Clip 1", "downloads.actions.cancel");
     await waitFor(() => expect(mocks.confirm).toHaveBeenCalledTimes(1));
     // The tab's label shares its button with a count badge.
diff --git a/frontend/src/components/DownloadCenter.menu.dom.test.tsx b/frontend/src/components/DownloadCenter.menu.dom.test.tsx
index ae34950e..f3e19550 100644
--- a/frontend/src/components/DownloadCenter.menu.dom.test.tsx
+++ b/frontend/src/components/DownloadCenter.menu.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 C1 on the Download Center: a download row keeps its primary action (play; pause / resume /
+// The Download Center: a download row keeps its primary action (play; pause / resume /
 // retry in the queue) and the save link in sight, and everything else — the editors, sharing,
 // re-download, the copies, cancel / delete / remove — is its ONE menu, opened by the row's "…" (it
 // shows on hover or focus) or a right-click on the row. A link inside the row keeps the browser's own
diff --git a/frontend/src/components/DownloadCenter.tsx b/frontend/src/components/DownloadCenter.tsx
index 21fd324a..aa6c5fca 100644
--- a/frontend/src/components/DownloadCenter.tsx
+++ b/frontend/src/components/DownloadCenter.tsx
@@ -88,7 +88,7 @@ export default function DownloadCenter() {
   const queue = jobs.filter((j) => ["queued", "running", "paused", "error"].includes(j.status));
   const library = jobs.filter((j) => j.status === "done");
 
-  // --- The rows' ONE menu (E28 C1) -------------------------------------------------------------
+  // --- The rows' ONE menu -------------------------------------------------------------
   // Keyed by the job's id: the queue polls every 2 s while a job runs, replacing the object under an
   // open menu, and its "…" must still close it. The tab is the one on screen.
   const rowMenu = useContextMenu<DownloadJob>({ keyOf: jobKey });
@@ -203,7 +203,7 @@ export default function DownloadCenter() {
               >
                 {t("downloads.page.add")}
               </Button>
-              {/* Local upload is a peer to "add a URL": a general file → the same library (E7 S5c). */}
+              {/* Local upload is a peer to "add a URL": a general file → the same library. */}
               <Button
                 variant="outline"
                 size="sm"
@@ -307,7 +307,7 @@ export default function DownloadCenter() {
         {tab === "shared" && (
           <NavGrid className="space-y-2">
             {(sharedQ.data ?? []).map((job, i) => {
-              // Same media_kind + can_download gate as the library, via the shared helper (S5b).
+              // Same media_kind + can_download gate as the library, via the shared helper.
               const a = sharedRowActions(job);
               return (
                 <DownloadRow key={job.id} job={job} navIndex={i} {...rowMenuProps(job)}>
diff --git a/frontend/src/components/DownloadDialog.tsx b/frontend/src/components/DownloadDialog.tsx
index b748d631..bf09fd3e 100644
--- a/frontend/src/components/DownloadDialog.tsx
+++ b/frontend/src/components/DownloadDialog.tsx
@@ -58,7 +58,7 @@ export default function DownloadDialog({
     } catch (e) {
       // A quota or validation refusal (422/409) is already in the global error dialog, which the
       // reporter skips; a 403/404/429 or a lost connection is not, and used to leave the dialog
-      // open with nothing said (E11 S2b).
+      // open with nothing said.
       notifyActionError(e, t("errors.writeFailed.enqueueDownload"));
       setBusy(false);
     }
diff --git a/frontend/src/components/ErrorBoundary.message.dom.test.tsx b/frontend/src/components/ErrorBoundary.message.dom.test.tsx
index 0513a9a6..86af687e 100644
--- a/frontend/src/components/ErrorBoundary.message.dom.test.tsx
+++ b/frontend/src/components/ErrorBoundary.message.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E30: a render crash's notice speaks the reader's language. It showed `error.message` — the JS
+// A render crash's notice speaks the reader's language. It showed `error.message` — the JS
 // engine's English ("Cannot read properties of undefined (reading 'x')") — in the toast and the inbox,
 // where it outlives the reload. The technical text stays in the `ui.crash` log.
 import { afterEach, expect, it, vi } from "vitest";
diff --git a/frontend/src/components/ErrorBoundary.tsx b/frontend/src/components/ErrorBoundary.tsx
index cd2a1d5a..ce94e769 100644
--- a/frontend/src/components/ErrorBoundary.tsx
+++ b/frontend/src/components/ErrorBoundary.tsx
@@ -33,7 +33,7 @@ export default class ErrorBoundary extends Component<Props, State> {
       level: "fatal",
       title: i18n.t("errors.boundary.notifTitle"),
       // Never the raw `error.message`: a JS engine's English ("Cannot read properties of undefined…")
-      // is no message for the reader (E30) — the `ui.crash` log above carries it for diagnosis.
+      // is no message for the reader — the `ui.crash` log above carries it for diagnosis.
       message: i18n.t("errors.boundary.notifMessage"),
       requiresInteraction: true,
     });
diff --git a/frontend/src/components/ExcludedChannelList.dom.test.tsx b/frontend/src/components/ExcludedChannelList.dom.test.tsx
index 567f373b..33c3ff67 100644
--- a/frontend/src/components/ExcludedChannelList.dom.test.tsx
+++ b/frontend/src/components/ExcludedChannelList.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The Hidden / Blocked channel cards as a keyboard list (E11 S4c): `j`/`k` walk the cards, Enter opens
+// The Hidden / Blocked channel cards as a keyboard list: `j`/`k` walk the cards, Enter opens
 // the channel — the ChannelLink name is the card's open element — and the card's own action button
 // keeps its Enter.
 import { afterEach, describe, expect, it, vi } from "vitest";
diff --git a/frontend/src/components/Feed.countStale.dom.test.tsx b/frontend/src/components/Feed.countStale.dom.test.tsx
index c97ac578..6de9c37b 100644
--- a/frontend/src/components/Feed.countStale.dom.test.tsx
+++ b/frontend/src/components/Feed.countStale.dom.test.tsx
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
 // The count pill while a new search's count loads. keepPreviousData holds the last filter's count, and a
-// broad word's count takes seconds ("a": ~3 s on the prod-sized library, E31): the pill showed the old
+// broad word's count takes seconds ("a": ~3 s on the prod-sized library): the pill showed the old
 // number as if it were the new search's. It now dims and is aria-busy until the new count lands.
 import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
 import { render, screen, waitFor, cleanup } from "@testing-library/react";
diff --git a/frontend/src/components/Feed.nextPageFailed.dom.test.tsx b/frontend/src/components/Feed.nextPageFailed.dom.test.tsx
index ee75c06d..969dede4 100644
--- a/frontend/src/components/Feed.nextPageFailed.dom.test.tsx
+++ b/frontend/src/components/Feed.nextPageFailed.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // A next page that fails. Retry is off and the read-ahead re-runs whenever a fetch settles, so a failed
 // page was requested again once a round-trip, forever, while the end of the list was in view, and
-// nothing said it had failed (E31 review 2). The read-ahead now stops at a failed page, and a row says
+// nothing said it had failed. The read-ahead now stops at a failed page, and a row says
 // so and retries on a click. VirtualFeed is replaced by what Feed hands it: the read-ahead's gate and a
 // button standing in for the read-ahead itself.
 import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
diff --git a/frontend/src/components/Feed.reset.dom.test.tsx b/frontend/src/components/Feed.reset.dom.test.tsx
index 949b6223..09cc25b3 100644
--- a/frontend/src/components/Feed.reset.dom.test.tsx
+++ b/frontend/src/components/Feed.reset.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // "Reset — clear watch progress/status" on a half-watched video. The optimistic layer overrode only
 // the STATUS, so the card kept its resume position — its progress bar and its Continue button — until
-// the next refetch (found in the E28 S3e1 UAT). The grid is replaced by a list that shows what Feed
+// the next refetch (found in a UAT). The grid is replaced by a list that shows what Feed
 // hands it: each video's position, and a button that fires the reset.
 import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
 import { render, screen, fireEvent, waitFor, cleanup } from "@testing-library/react";
diff --git a/frontend/src/components/Feed.tsx b/frontend/src/components/Feed.tsx
index c04ae797..91e1ec44 100644
--- a/frontend/src/components/Feed.tsx
+++ b/frontend/src/components/Feed.tsx
@@ -111,7 +111,6 @@ export default function Feed({
   view,
   setView,
   canRead,
-  isDemo = false,
   ytSearch,
   onYtSearch,
   onExitYtSearch,
@@ -125,11 +124,10 @@ export default function Feed({
   view: FeedView;
   setView: (v: FeedView) => void;
   canRead: boolean;
-  isDemo?: boolean;
   // Live YouTube search: the active search term (null = normal feed). Entering a search and
   // leaving it both step browser history (the search is a feed sub-view with its own history
   // entry), so the empty-state CTA enters via onYtSearch and "back to feed" pops via
-  // onExitYtSearch. Search affordances are hidden for demo.
+  // onExitYtSearch.
   ytSearch: string | null;
   onYtSearch: (q: string) => void;
   onExitYtSearch: () => void;
@@ -595,41 +593,24 @@ export default function Feed({
         {t("feed.loadError")}
       </StateMessage>
     );
-  // Empty "my" feed with no YouTube access. The shared demo account can never connect
-  // YouTube, so it gets a gentle nudge into the shared library instead of the connect
-  // wizard; real users get the onboarding prompt. No toolbar (sort/type are meaningless).
+  // Empty "my" feed with no YouTube access: the onboarding prompt, plus a way into the shared
+  // library. No toolbar (sort/type are meaningless).
   if (items.length === 0 && !canRead && filters.scope === "my")
     return (
       <div className="p-8 grid place-items-center text-center">
         <div className="max-w-sm">
-          <h2 className="text-lg font-semibold">
-            {isDemo ? t("feed.demoEmptyTitle") : t("feed.emptyTitle")}
-          </h2>
-          <p className="text-sm text-muted mt-2 mb-4">
-            {isDemo ? t("feed.demoEmptyBody") : t("feed.emptyBody")}
-          </p>
-          {isDemo ? (
-            <Button
-              variant="primary"
-              size="lg"
-              onClick={() => setFilters({ ...filters, scope: "all" })}
-            >
-              {t("feed.browseLibrary")}
-            </Button>
-          ) : (
-            <>
-              <Button variant="primary" size="lg" onClick={onOpenWizard}>
-                {t("feed.setUp")}
-              </Button>
-              <Button
-                variant="link-muted"
-                className="mx-auto mt-3 flex text-sm"
-                onClick={() => setFilters({ ...filters, scope: "all" })}
-              >
-                {t("feed.browseShared")}
-              </Button>
-            </>
-          )}
+          <h2 className="text-lg font-semibold">{t("feed.emptyTitle")}</h2>
+          <p className="text-sm text-muted mt-2 mb-4">{t("feed.emptyBody")}</p>
+          <Button variant="primary" size="lg" onClick={onOpenWizard}>
+            {t("feed.setUp")}
+          </Button>
+          <Button
+            variant="link-muted"
+            className="mx-auto mt-3 flex text-sm"
+            onClick={() => setFilters({ ...filters, scope: "all" })}
+          >
+            {t("feed.browseShared")}
+          </Button>
         </div>
       </div>
     );
@@ -879,7 +860,7 @@ export default function Feed({
               </Button>
             </div>
           )}
-          {filters.q.trim() && !isDemo && (
+          {filters.q.trim() && (
             <Button
               className="mt-4"
               icon={<YouTubeIcon />}
@@ -898,7 +879,7 @@ export default function Feed({
           onResetState={onResetState}
           onOpen={openVideo}
           // A failed next page stops the read-ahead: retry is off, and re-running on every settle would
-          // re-request it once a round-trip for as long as the end is in view (E31 review 2). The row
+          // re-request it once a round-trip for as long as the end is in view. The row
           // below says so and retries on a click.
           hasNextPage={!!hasNextPage && !query.isFetchNextPageError}
           isFetching={query.isFetching}
diff --git a/frontend/src/components/Feed.ytsort.dom.test.tsx b/frontend/src/components/Feed.ytsort.dom.test.tsx
index e7eae5d2..c0c51518 100644
--- a/frontend/src/components/Feed.ytsort.dom.test.tsx
+++ b/frontend/src/components/Feed.ytsort.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // The live-YouTube results' Sort control, wired end to end: the pref it writes, the key and
 // direction Feed hands to sortYtResults, and the order that reaches the grid. sortYtResults itself
-// is pinned in feedSort.yt.test.ts; a deep-review of the 2026-09 bug hunt found that the CALL SITE
+// is pinned in feedSort.yt.test.ts; a review during the 2026-09 bug hunt found that the CALL SITE
 // could ignore the chosen direction (or skip the sort entirely) with every lane green.
 //
 // The virtualised grid lays out nothing in jsdom, so it is replaced by a plain list that shows the
diff --git a/frontend/src/components/FeedFiltersProvider.seed.dom.test.tsx b/frontend/src/components/FeedFiltersProvider.seed.dom.test.tsx
index b4a7dfe6..1123db27 100644
--- a/frontend/src/components/FeedFiltersProvider.seed.dom.test.tsx
+++ b/frontend/src/components/FeedFiltersProvider.seed.dom.test.tsx
@@ -1,12 +1,7 @@
 // @vitest-environment jsdom
 //
-// The shared demo account has no subscriptions, so its feed opens on the whole library. The filters are
-// seeded from the `me` cache at mount — BootGate mounts the tree only once it is there. The adopt effect
-// this replaced applied the demo default after mounting; with it gone, a seed that did not read `me`
-// would open the demo account on its empty subscriptions scope.
-//
-// A share link's filters are written to the account once at mount too, so the view the link opened
-// survives a later plain reload (the state itself is seeded from the URL, so only storage shows it).
+// The feed's filters are seeded at mount from the account's stored view. A share link's filters are
+// written to the account once at mount too, so the view the link opened survives a later plain reload (the state itself is seeded from the URL, so only storage shows it).
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { cleanup, render } from "@testing-library/react";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
@@ -49,20 +44,14 @@ afterEach(() => {
 });
 
 describe("FeedFiltersProvider seed", () => {
-  it("opens the shared demo account on the whole library from its first render", () => {
-    mount({ is_demo: true });
-    expect(scopes.length).toBeGreaterThan(0);
-    expect(scopes).toEqual(scopes.map(() => "all"));
-  });
-
-  it("opens any other account on its own scope", () => {
-    mount({ is_demo: false });
+  it("opens an account on its own scope", () => {
+    mount({});
     expect(scopes[0]).toBe("my");
   });
 
   it("keeps a share link's filters for the account, so a plain reload opens the same view", () => {
     window.history.replaceState(null, "", "/?scope=all");
-    mount({ is_demo: false });
+    mount({});
     expect(scopes[0]).toBe("all");
     expect(JSON.parse(localStorage.getItem("siftlode.filters.5") ?? "{}").scope).toBe("all");
   });
diff --git a/frontend/src/components/FeedFiltersProvider.tsx b/frontend/src/components/FeedFiltersProvider.tsx
index 455182d1..a0a4027f 100644
--- a/frontend/src/components/FeedFiltersProvider.tsx
+++ b/frontend/src/components/FeedFiltersProvider.tsx
@@ -1,7 +1,5 @@
 import { useCallback, useEffect, useMemo, useState, type ReactNode } from "react";
-import { qk } from "../lib/queryKeys";
-import { useQueryClient } from "@tanstack/react-query";
-import { getActiveAccount, type FeedFilters, type Me } from "../lib/api";
+import { getActiveAccount, type FeedFilters } from "../lib/api";
 import { filterParamUpdates, hasFilterParams, paramsToFilters } from "../lib/urlState";
 import { useUrlMirror } from "../lib/useUrlMirror";
 import { accountKey, writeJSON } from "../lib/storage";
@@ -28,21 +26,16 @@ import { DEFAULT_FILTERS, FILTERS_KEY, loadAccountFilters } from "./feedFiltersI
 // feedFiltersInit.ts.
 
 // URL wins over localStorage so a pasted link reproduces the exact view.
-function loadInitialFilters(me: Me | null | undefined): FeedFilters {
+function loadInitialFilters(): FeedFilters {
   const params = new URLSearchParams(window.location.search);
   if (hasFilterParams(params)) return paramsToFilters(params, DEFAULT_FILTERS);
-  const f = loadAccountFilters(getActiveAccount());
-  // The shared demo account has no subscriptions, so default it to the whole library.
-  return me?.is_demo ? { ...f, scope: "all" } : f;
+  return loadAccountFilters(getActiveAccount());
 }
 
 export function FeedFiltersProvider({ children }: { children: ReactNode }) {
-  const qc = useQueryClient();
   // Seeded for the account this tab is — BootGate mounts this provider only once the account is
-  // pinned and `me` is cached, so this is the account's own view from the first render.
-  const [filters, setFiltersState] = useState<FeedFilters>(() =>
-    loadInitialFilters(qc.getQueryData<Me | null>(qk.me())),
-  );
+  // pinned, so this is the account's own view from the first render.
+  const [filters, setFiltersState] = useState<FeedFilters>(loadInitialFilters);
   // Whether this load arrived with feed-filter params in the URL (a bookmark/shared link). Captured
   // once at mount — such filters win over the account's stored view and are persisted to the account.
   const [initialHadUrlFilters] = useState(() =>
diff --git a/frontend/src/components/Header.searchTip.dom.test.tsx b/frontend/src/components/Header.searchTip.dom.test.tsx
index 8b120412..64def281 100644
--- a/frontend/src/components/Header.searchTip.dom.test.tsx
+++ b/frontend/src/components/Header.searchTip.dom.test.tsx
@@ -31,7 +31,7 @@ import type { Me } from "../lib/api";
 afterEach(cleanup);
 
 function tipFor(source: Me["search_source"]): string | null {
-  const me = { is_demo: false, plex_enabled: false, search_source: source } as Me;
+  const me = { plex_enabled: false, search_source: source } as Me;
   render(<Header me={me} onYtSearch={() => {}} />);
   return screen.getByRole("button", { name: /header\.searchYoutube$/ }).getAttribute("title");
 }
diff --git a/frontend/src/components/Header.tsx b/frontend/src/components/Header.tsx
index 0fbe3651..14b49611 100644
--- a/frontend/src/components/Header.tsx
+++ b/frontend/src/components/Header.tsx
@@ -18,13 +18,12 @@ import { PaletteLauncher } from "./PaletteLauncher";
 // has one, and the per-user sync chip at the right end.
 // `forwardRef` so PageShell can attach a ref to the header's root box and measure its real (possibly
 // wrapped) height — that measurement + the `--hdr-h` content pad it drives live in PageShell, which
-// owns both the header slot and the padded content wrapper (E5 S7).
+// owns both the header slot and the padded content wrapper.
 const Header = forwardRef<
   HTMLDivElement,
   {
     me: Me;
-    // Trigger a live YouTube search for the current term (feed only; hidden for the demo account,
-    // which can't spend the shared quota).
+    // Trigger a live YouTube search for the current term (feed only).
     onYtSearch: (q: string) => void;
   }
 >(function Header({ me, onYtSearch }, ref) {
@@ -64,7 +63,7 @@ const Header = forwardRef<
           me.search_source === "api" ? "header.searchYoutubeTipApi" : "header.searchYoutubeTip",
         )}
         goIcon={<YouTubeIcon className="w-4 h-4" />}
-        goDisabled={!trimmed || me.is_demo}
+        goDisabled={!trimmed}
       />
     );
   } else if (page === "plex" && me.plex_enabled) {
@@ -108,7 +107,7 @@ const Header = forwardRef<
           so the primary "what am I browsing" control is always in reach (mirrors Plex's scope toggle). */}
       {page === "feed" && <FeedScopeToggle />}
       {/* Library scope (movie/show/both) sits right of the search box on Plex — relocated here from
-          the filter sidebar (S3) so the primary "what am I browsing" control is always in reach. The
+          the filter sidebar so the primary "what am I browsing" control is always in reach. The
           Discover ⟷ Browse toggle sits right beside it (driven via the PlexViewBridge). */}
       {page === "plex" && me.plex_enabled && <PlexScopeToggle />}
       {page === "plex" && me.plex_enabled && <PlexViewToggle />}
diff --git a/frontend/src/components/Home.dom.test.tsx b/frontend/src/components/Home.dom.test.tsx
index 4501d837..b69e3c76 100644
--- a/frontend/src/components/Home.dom.test.tsx
+++ b/frontend/src/components/Home.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E24 S2: the Home surface. Covers the four behaviours the browser round actually caught, each of
+// The Home surface. Covers the four behaviours the browser round actually caught, each of
 // which is invisible to tsc and to a render-only check:
 //   • the hero's kicker comes from the SERVER's tier, never from the card's shape;
 //   • the hero is not printed twice (once as the hero, once as the first resume tile);
@@ -308,7 +308,7 @@ describe("Home", () => {
     // through the disabled seed-0 query the chip click leaves behind. So the first reroll under a new
     // budget offered the old budget's card — while it loaded, and permanently once it failed, since
     // `retry: false` makes a failed pick terminal. Under a chip that promises ten minutes, that makes
-    // the page's one control meaningless (round 2).
+    // the page's one control meaningless.
     discover.mockResolvedValue({
       budget: "any",
       hero: { tier: "resume", card: ytCard("v1", "Hero v1") },
@@ -381,7 +381,7 @@ describe("Home", () => {
     // every mark-watched, bookmark, pin and shelf move on this page refetches it in the BACKGROUND —
     // so binding the button's `loading` to raw `isFetching` made it spin and, since a `loading`
     // `ui/Button` swallows its clicks, ignore presses after actions the user never associated with a
-    // reroll (round 2). A press is outstanding only while THIS key has no answer of its own.
+    // reroll. A press is outstanding only while THIS key has no answer of its own.
     const rerollBtn = () =>
       screen.getByText("home.hero.reroll").closest("button") as HTMLButtonElement;
     let resolvePick!: (v: unknown) => void;
@@ -419,7 +419,7 @@ describe("Home", () => {
   });
 
   it("a press that FAILED does not leave the button hostage to the next mutation", async () => {
-    // Round 3's correction to the case above. A key whose request failed never gets data of its own
+    // A later correction to the case above. A key whose request failed never gets data of its own
     // (`retry: false` makes it terminal), so a predicate reading `data === undefined` stayed true
     // forever and every later background refetch re-disabled the button — the same defect, one
     // branch over. `isFetched` remembers that the key settled, an error counting as settled.
@@ -437,7 +437,7 @@ describe("Home", () => {
     await waitFor(() => expect(discoverPick).toHaveBeenCalledTimes(1));
     // `waitFor`, not a fixed tick: react-query hands the rejection to the observer through
     // `notifyManager`'s own `setTimeout(0)`, registered AFTER any timer this test schedules, so
-    // "await one macrotask then assert" races it. Round 4 measured that race as an intermittent red.
+    // "await one macrotask then assert" races it. That race was measured as an intermittent red.
     failPick(new Error("boom"));
     await waitFor(() => expect(rerollBtn().getAttribute("aria-busy")).toBeNull()); // the failure releases the button
 
@@ -454,7 +454,7 @@ describe("Home", () => {
     // The tagged slot is authoritative for its own budget, including when what it holds is "no hero
     // at all". Under a `??` chain that read as "nothing remembered" and fell through to the loaded
     // payload, so a failed press resurrected the card the page had already excluded as seen and just
-    // said it had nothing beyond (round 3).
+    // said it had nothing beyond.
     discover.mockResolvedValue({
       budget: "short",
       hero: { tier: "resume", card: ytCard("v1", "Hero v1") },
@@ -543,7 +543,7 @@ describe("Home", () => {
     expect(screen.getByText("Hero v1")).toBeTruthy();
   });
 
-  // E24 S4. The palette's "Meglepetés" is pressed on ANOTHER page, so Home's lazy chunk is not
+  // The palette's "Meglepetés" is pressed on ANOTHER page, so Home's lazy chunk is not
   // mounted yet — the request has to WAIT as a token rather than fire into an empty room. And it
   // must be spent: a token that survived would make a later visit reroll on its own, which reads as
   // the page overruling the answer you came back for.
@@ -703,7 +703,7 @@ describe("Home", () => {
       comfort: [],
     });
     mount();
-    // Since E28 C1 the tile's ⓘ is its menu's "Media info" row, opened from the tile's "…".
+    // The tile's ⓘ is now its menu's "Media info" row, opened from the tile's "…".
     fireEvent.click((await screen.findAllByRole("button", { name: "card.menu.more" }))[0]!);
     const info = screen
       .getAllByRole("menuitem", { hidden: true })
@@ -782,7 +782,7 @@ describe("Home", () => {
   });
 });
 
-// E11 S4b, owner decision D4: the rails are one keyboard page — `j` walks a rail's cards and goes on
+// The owner's decision: the rails are one keyboard page — `j` walks a rail's cards and goes on
 // into the next rail, whichever order the page stacks them in.
 describe("Home · keyboard", () => {
   it("walks the rails with j, from one rail on into the next", async () => {
@@ -828,7 +828,7 @@ describe("Home · keyboard", () => {
   });
 });
 
-// E28 S3h (the owner, 2026-09-26/27): the hero stands in three quarters of a wide page with its text
+// The owner's call (2026-09-26/27): the hero stands in three quarters of a wide page with its text
 // centred beside the picture; one fact line, no repeated year, and prose only where there is some,
 // at a readable measure.
 describe("Home's hero text", () => {
@@ -883,7 +883,7 @@ describe("Home's hero text", () => {
   });
 });
 
-describe("Home · the reader's language (E30)", () => {
+describe("Home · the reader's language", () => {
   it("asks for the page in Hungarian, so a Plex card comes back with its Hungarian title", async () => {
     setLanguage("hu");
     try {
diff --git a/frontend/src/components/Home.pin.dom.test.tsx b/frontend/src/components/Home.pin.dom.test.tsx
index b0db7e68..bcb78a04 100644
--- a/frontend/src/components/Home.pin.dom.test.tsx
+++ b/frontend/src/components/Home.pin.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E24 S3: the comfort shelf's editor — the right-click menu on the Home rails. Its own file, not an
+// The comfort shelf's editor — the right-click menu on the Home rails. Its own file, not an
 // addition to Home.dom.test.tsx, because the shelf query is module-level react-query state that a
 // sibling test's mocks would leak into.
 //
diff --git a/frontend/src/components/Home.tsx b/frontend/src/components/Home.tsx
index 25fc67b4..3d68b850 100644
--- a/frontend/src/components/Home.tsx
+++ b/frontend/src/components/Home.tsx
@@ -73,7 +73,7 @@ import {
   mediaTitleClass,
 } from "./ui/mediaCardStyles";
 
-// The Home surface (E24) — "Mit nézzek most?".
+// The Home surface — "Mit nézzek most?".
 //
 // Layout C+, chosen from mockups: the time-budget chips sit ABOVE a single large hero, so the
 // question comes first and the hero is its answer; the shelves follow, compact. The page's whole
@@ -144,7 +144,7 @@ function useHomeCardMenu({
   // the scroll, and because these rows are keyboard-reachable (Shift+F10) for free.
   const menu = useContextMenu<DiscoverCard>();
   const pin = useComfortPin(menu.open);
-  // A video tile's own action list (E28 C1), the same one the feed's menu shows; the rail keeps its
+  // A video tile's own action list, the same one the feed's menu shows; the rail keeps its
   // Play row (it resolves `next`) and its shelf rows around it.
   const videoActions = useVideoActions({ onState, onToggleSave }, menu.open);
   // A Plex tile's, likewise (its "Media info" row goes where the tile's `onInfo` does).
@@ -723,7 +723,7 @@ export default function Home() {
   }, [budget, seed, press, seen]);
   const [player, setPlayer] = useState<{ video: Video; startAt: number | null } | null>(null);
 
-  // A Plex card's title is in the reader's language (E30), so the answer is cached per language.
+  // A Plex card's title is in the reader's language, so the answer is cached per language.
   const lang = plexLang(i18n.language);
   const q = useQuery({
     queryKey: qk.discover(budget, lang),
@@ -745,7 +745,7 @@ export default function Home() {
     //
     // But only WITHIN a budget. Plain `keepPreviousData` chains through the disabled seed-0 query a
     // chip click leaves behind, so the first reroll under a new budget held up the card the PREVIOUS
-    // question was answered with — under a chip promising something else (round 2). Returning
+    // question was answered with — under a chip promising something else. Returning
     // undefined instead falls the hero back to this budget's own loaded answer, which is already in
     // hand; the spinner still covers the wait.
     placeholderData: (prev) => (prev?.budget === budget ? prev : undefined),
@@ -754,11 +754,11 @@ export default function Home() {
   // `["discover"]` prefix so a mutation's invalidation reaches the rerolled hero — which also means
   // every mark-watched, bookmark, pin/unpin and shelf move on this page refetches it in the
   // background, and `ui/Button` turns `loading` into `disabled`. So the reroll spun and swallowed
-  // clicks after actions the user never associated with it (round 2). A press is outstanding exactly
+  // clicks after actions the user never associated with it. A press is outstanding exactly
   // while THIS key has never settled — which is what `isFetched` means (react-query counts both a
   // success and an error as settled), and every press mints a fresh seed, so a fresh key.
   //
-  // Round 3 corrected this: `isPlaceholderData || data === undefined` looked equivalent and was not.
+  // Since corrected: `isPlaceholderData || data === undefined` looked equivalent and was not.
   // A pick that FAILED leaves its key data-less forever (`retry: false`), so the second disjunct
   // stayed true and the next unrelated mutation re-disabled the button — the same defect, surviving
   // in the error branch. Guarding on `!isError` does NOT help either: query-core resets a data-less
@@ -775,7 +775,7 @@ export default function Home() {
   // reset an answer that already resolved, so an untagged slot outlived the question it answered —
   // switch to "10 perc", press reroll, let that request fail (`retry: false`, so it is terminal),
   // and the two-hour film picked under "Bármennyi" was still the hero, under a chip promising ten
-  // minutes (round 2). Taken from the SERVER's `budget` echo rather than this render's state, so the
+  // minutes. Taken from the SERVER's `budget` echo rather than this render's state, so the
   // tag cannot be minted from a budget the pick never answered.
   const [lastPick, setLastPick] = useState<{
     budget: DiscoverBudget;
@@ -802,7 +802,7 @@ export default function Home() {
           // pick for this budget resolved to no hero" is a real answer, not a missing one. Under
           // `??` the two collapsed, so a failed press after an empty pick resurrected the card the
           // page loaded with — which it had already excluded as seen and just said it had nothing
-          // beyond (round 3). A mismatched or absent tag still falls through to the loaded hero,
+          // beyond. A mismatched or absent tag still falls through to the loaded hero,
           // which is what the FIRST press of a budget needs.
           lastPick?.budget === budget
           ? lastPick.hero
diff --git a/frontend/src/components/IssueComposer.dom.test.tsx b/frontend/src/components/IssueComposer.dom.test.tsx
index 0af536b4..32437c55 100644
--- a/frontend/src/components/IssueComposer.dom.test.tsx
+++ b/frontend/src/components/IssueComposer.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E16 S3: the issue composer. It drafts the steps from the session, saves as it goes (the rendered
+// The issue composer. It drafts the steps from the session, saves as it goes (the rendered
 // text included — the export is built from what it SAVED), reopens as it was left, takes a log line
 // out of the evidence in the review, adds a pasted image, and a sent session is read-only. i18n is a
 // key-passthrough with its params; the API is stubbed.
@@ -495,7 +495,7 @@ describe("the issue composer", () => {
 
   it("opens on the title, not on the Edit / Preview switch above it", async () => {
     // The form arrives after the dialog opens; its first control is the switch, and the focus
-    // landed there — typing went nowhere (E32 review round 3).
+    // landed there — typing went nowhere.
     layOut();
     mount();
     await waitFor(() => expect(document.activeElement).toBe(title()));
diff --git a/frontend/src/components/IssueComposer.tsx b/frontend/src/components/IssueComposer.tsx
index baed165d..64052c2c 100644
--- a/frontend/src/components/IssueComposer.tsx
+++ b/frontend/src/components/IssueComposer.tsx
@@ -30,12 +30,12 @@ import { Textarea, Input } from "./ui/Input";
 import { Checkbox } from "./ui/NativeControls";
 import { SURFACE } from "./ui/surfaces";
 
-// The issue composer (E16 S3, D4 A): one dialog — the draft on the left (title, description, the
+// The issue composer: one dialog — the draft on the left (title, description, the
 // steps drafted from the session, the environment), what goes with it on the right (the two logs,
 // each reviewable line by line, and the screenshots, removable one by one, with paste / drop / pick
 // to add more — an image pasted anywhere in it is taken). It saves as it goes, and what is still
 // waiting to be saved when it closes is saved then, so closing it loses nothing: Settings →
-// Diagnosztika reopens any past session. The export and (S4) the issue are built from what it SAVED.
+// Diagnosztika reopens any past session. The export and the issue are built from what it SAVED.
 
 const SAVE_DELAY_MS = 800;
 type Source = "web" | "server";
@@ -200,7 +200,7 @@ function ComposerBody({
     setForm(next);
   };
 
-  // The issue (S4), like the export, is built from the SAVED draft: save what is on screen first.
+  // The issue, like the export, is built from the SAVED draft: save what is on screen first.
   // A send that stopped half-way is finished by the same call, which does only what is missing.
   // While it runs the draft is held as it was saved: nothing typed then would reach the issue.
   const target = useMe()?.issues ?? null;
@@ -274,7 +274,7 @@ function ComposerBody({
   // draft is already frozen (`locked`), where the save is both pointless and refused. While a send
   // holds the claim the server 409s `issue_sending`, and that refusal would take the zip with it:
   // `GET /export` has no send guard and would have served exactly what the send is uploading, so
-  // the one tracker-free way out of a stuck send used to fail at the last step (round 4).
+  // the one tracker-free way out of a stuck send used to fail at the last step.
   const exportZip = useMutation({
     mutationFn: async () => {
       if (!locked) await save.mutateAsync();
diff --git a/frontend/src/components/KeyGate.tsx b/frontend/src/components/KeyGate.tsx
deleted file mode 100644
index 52716f21..00000000
--- a/frontend/src/components/KeyGate.tsx
+++ /dev/null
@@ -1,185 +0,0 @@
-import { useState } from "react";
-import { qk } from "../lib/queryKeys";
-import { useTranslation } from "react-i18next";
-import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { AlertTriangle, Lock, ShieldCheck } from "lucide-react";
-import { api, HttpError } from "../lib/api";
-import * as e2ee from "../lib/e2ee";
-import { Button } from "./ui/Button";
-import { Input } from "./ui/Input";
-import { SURFACE } from "./ui/surfaces";
-
-// Secure-messaging key gate: first-run setup (choose a passphrase) or unlock on this device.
-// Self-contained — on success it updates the shared e2ee unlock state, so any observing view
-// (the Messages page, a dock window) swaps out of the gate automatically. In unlock mode it also
-// offers a forgotten-passphrase reset (the only escape from the set-once wall).
-export default function KeyGate({ meId, compact = false }: { meId: number; compact?: boolean }) {
-  const { t } = useTranslation();
-  const qc = useQueryClient();
-  const keyQ = useQuery({
-    queryKey: qk.messageKey(),
-    queryFn: api.messageMyKey,
-    staleTime: 60_000,
-  });
-  const configured = keyQ.data?.configured ?? false;
-  // Password accounts must re-verify to reset (guards a hijacked session); Google-only accounts
-  // have no password to check. Passive observer of the qk.me() query BootGate fetches (enabled:false),
-  // so hasPassword follows the cache when a refetch changes it.
-  const meQ = useQuery({ queryKey: qk.me(), queryFn: api.me, enabled: false });
-  const hasPassword = meQ.data?.has_password ?? false;
-
-  const [view, setView] = useState<"gate" | "reset">("gate");
-  const [pass, setPass] = useState("");
-  const [confirm, setConfirm] = useState("");
-  const [curPass, setCurPass] = useState("");
-  const [err, setErr] = useState<string | null>(null);
-  // Keys the error: failing the same way twice is a new node, so a screen reader announces it again (a clear
-  // and a set in one handler commit together, leaving the node untouched).
-  const [attempt, setAttempt] = useState(0);
-  const [busy, setBusy] = useState(false);
-
-  async function submit() {
-    setAttempt((n) => n + 1);
-    setErr(null);
-    if (pass.length < 6) return setErr(t("messages.passTooShort"));
-    if (!configured && pass !== confirm) return setErr(t("messages.passMismatch"));
-    setBusy(true);
-    try {
-      if (configured) {
-        await e2ee.unlock(meId, pass, keyQ.data!);
-      } else {
-        const payload = await e2ee.setup(meId, pass);
-        await api.setupMessageKey(payload);
-      }
-      qc.invalidateQueries({ queryKey: qk.messageKey() });
-    } catch {
-      setErr(configured ? t("messages.wrongPass") : t("messages.setupFailed"));
-    }
-    setBusy(false);
-  }
-
-  function toReset() {
-    setErr(null);
-    setPass("");
-    setConfirm("");
-    setView("reset");
-  }
-  function cancelReset() {
-    setErr(null);
-    setCurPass("");
-    setView("gate");
-  }
-
-  async function doReset() {
-    setAttempt((n) => n + 1);
-    setErr(null);
-    if (hasPassword && !curPass) return setErr(t("messages.resetNeedPass"));
-    setBusy(true);
-    const confirmPass = hasPassword ? curPass : undefined;
-    try {
-      await api.resetMessageKey(confirmPass);
-      // Server key + dead history are gone; wipe this device's identity too so the gate re-appears
-      // in setup mode. Invalidate last so the refetch sees configured:false.
-      await e2ee.resetLocal(meId);
-      setCurPass("");
-      setView("gate");
-      qc.invalidateQueries({ queryKey: qk.messageKey() });
-    } catch (e) {
-      setErr(e instanceof HttpError && e.detail ? e.detail : t("messages.resetFailed"));
-    }
-    setBusy(false);
-  }
-
-  if (keyQ.isLoading)
-    return <div className="p-6 text-center text-muted text-sm">{t("common.loading")}</div>;
-
-  if (view === "reset")
-    return (
-      <div className={`${SURFACE.panel} space-y-3 ${compact ? "p-3" : "p-4"}`}>
-        <div className="flex items-center gap-2">
-          <AlertTriangle className="w-5 h-5 text-danger shrink-0" />
-          <div className="font-semibold text-sm">{t("messages.resetTitle")}</div>
-        </div>
-        <p className="text-sm text-muted">{t("messages.resetWarn")}</p>
-        {hasPassword && (
-          <Input
-            className="w-full"
-            type="password"
-            autoComplete="current-password"
-            value={curPass}
-            onChange={(e) => setCurPass(e.target.value)}
-            placeholder={t("messages.resetCurrentPass")}
-          />
-        )}
-        {err && (
-          <div key={attempt} role="alert" className="text-sm text-danger">
-            {err}
-          </div>
-        )}
-        <div className="flex gap-2">
-          <Button variant="outline" onClick={cancelReset} disabled={busy}>
-            {t("common.cancel")}
-          </Button>
-          <Button
-            variant="danger"
-            onClick={doReset}
-            disabled={busy}
-            icon={<AlertTriangle className="w-4 h-4" />}
-          >
-            {t("messages.resetButton")}
-          </Button>
-        </div>
-      </div>
-    );
-
-  return (
-    <div className={`${SURFACE.panel} space-y-3 ${compact ? "p-3" : "p-4"}`}>
-      <div className="flex items-center gap-2">
-        <ShieldCheck className="w-5 h-5 text-accent shrink-0" />
-        <div className="font-semibold text-sm">
-          {configured ? t("messages.unlockTitle") : t("messages.setupTitle")}
-        </div>
-      </div>
-      {!compact && (
-        <p className="text-sm text-muted">
-          {configured ? t("messages.unlockBody") : t("messages.setupBody")}
-        </p>
-      )}
-      <Input
-        className="w-full"
-        type="password"
-        value={pass}
-        onChange={(e) => setPass(e.target.value)}
-        onKeyDown={(e) => e.key === "Enter" && configured && submit()}
-        placeholder={t("messages.passphrase")}
-      />
-      {!configured && (
-        <Input
-          className="w-full"
-          type="password"
-          value={confirm}
-          onChange={(e) => setConfirm(e.target.value)}
-          placeholder={t("messages.passphraseConfirm")}
-        />
-      )}
-      {err && (
-        <div key={attempt} role="alert" className="text-sm text-danger">
-          {err}
-        </div>
-      )}
-      {/* One row with a gap: as two bare inline buttons the link sat flush against the primary. */}
-      <div className="flex flex-wrap items-center gap-3">
-        <Button variant="primary" size="md" onClick={submit} disabled={busy || !pass}>
-          <Lock className="w-4 h-4" />
-          {configured ? t("messages.unlock") : t("messages.setUp")}
-        </Button>
-        {configured && (
-          <Button variant="link-muted" onClick={toReset} className="text-xs">
-            {t("messages.forgotPass")}
-          </Button>
-        )}
-      </div>
-      {!configured && !compact && <p className="text-xs text-muted">{t("messages.setupWarn")}</p>}
-    </div>
-  );
-}
diff --git a/frontend/src/components/LanguageSwitcher.tsx b/frontend/src/components/LanguageSwitcher.tsx
index a7a1bebb..2a848c25 100644
--- a/frontend/src/components/LanguageSwitcher.tsx
+++ b/frontend/src/components/LanguageSwitcher.tsx
@@ -11,7 +11,7 @@ import { SURFACE } from "./ui/surfaces";
 // Compact language picker (globe + current code). Presentational: the parent decides what
 // changing the language does (set it; persist server-side when signed in).
 //
-// Two variants, now one implementation on the R8 popover platform: "header" opens below the pill
+// Two variants, now one implementation on the popover platform: "header" opens below the pill
 // (used on the landing page and the setup wizard) and "rail" is an icon-only button in the left
 // nav's bottom cluster whose menu opens to the RIGHT, bottom-aligned. Both used to hand-roll their
 // own anchoring, and the header one also opened on hover — dropped on purpose: the platform focuses
diff --git a/frontend/src/components/LibraryPlayer.dom.test.tsx b/frontend/src/components/LibraryPlayer.dom.test.tsx
index 8e4ba9e5..d01f275f 100644
--- a/frontend/src/components/LibraryPlayer.dom.test.tsx
+++ b/frontend/src/components/LibraryPlayer.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E7·S4b — the in-app library player streams the completed item's LOCAL file into a native media
+// The in-app library player streams the completed item's LOCAL file into a native media
 // element. video/audio is chosen from the stored media_kind (the single source), NOT a container
 // list — so an audio upload with an uncommon/absent container still renders <audio src=/file>. i18n
 // is key-passthrough here.
diff --git a/frontend/src/components/LibraryPlayer.tsx b/frontend/src/components/LibraryPlayer.tsx
index cfead9b1..2c82f43c 100644
--- a/frontend/src/components/LibraryPlayer.tsx
+++ b/frontend/src/components/LibraryPlayer.tsx
@@ -6,7 +6,7 @@ import { jobTitle } from "./downloadTitle";
 import { exposeVideoToBackgroundPlay } from "../lib/browserBackgroundPlay";
 import { useMediaLogRef } from "../lib/mediaLog";
 
-// E7 S4b — in-app player for a completed library item. We do NOT reuse PlayerModal (a cross-origin
+// In-app player for a completed library item. We do NOT reuse PlayerModal (a cross-origin
 // YouTube IFrame shell) or PlexPlayer (a Plex HLS/session shell): both are bound to their own domain
 // APIs and can't point at a local file. Instead we reuse the shared a11y shell (`Modal`: focus-trap,
 // ESC/back-to-close, scroll-lock, layer-stack, portal) and stream the local file into a NATIVE
diff --git a/frontend/src/components/Messages.keyboard.dom.test.tsx b/frontend/src/components/Messages.keyboard.dom.test.tsx
deleted file mode 100644
index 05644f1a..00000000
--- a/frontend/src/components/Messages.keyboard.dom.test.tsx
+++ /dev/null
@@ -1,70 +0,0 @@
-// @vitest-environment jsdom
-//
-// The conversation list as a keyboard list (E11 S5): `j`/`k` walk the conversations and Enter opens
-// the one the row's name button opens — not the pop-out button beside it. The live query, the key
-// state and the thread are stubbed: the list itself is what is under test.
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { act, cleanup, render, screen } from "@testing-library/react";
-
-vi.mock("react-i18next", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("react-i18next")>();
-  return {
-    ...actual,
-    useTranslation: () => ({ i18n: { language: "en" }, t: (key: string) => key }),
-  };
-});
-
-const conversation = (id: number, name: string) => ({
-  partner: { id, name, avatar_url: null },
-  last_message: { kind: "system", body: `hello from ${name}`, created_at: "2026-09-13T00:00:00Z" },
-  unread: 0,
-});
-const items = [conversation(0, "Siftlode"), conversation(7, "Anna"), conversation(9, "Bence")];
-
-vi.mock("../lib/useLiveQuery", () => ({
-  useLiveQuery: () => ({ data: { items }, isError: false, isLoading: false, refetch: () => {} }),
-}));
-vi.mock("../lib/messaging", () => ({
-  SYSTEM_ID: 0,
-  POLL_MS: 20000,
-  partnerPub: async () => "",
-  useKeyState: () => "ready",
-}));
-const openChat = vi.fn();
-vi.mock("../lib/chatDock", () => ({ openChat: (...a: unknown[]) => openChat(...a) }));
-vi.mock("./ChatThread", () => ({
-  default: ({ partnerId }: { partnerId: number }) => <div data-testid="thread">{partnerId}</div>,
-}));
-
-import Messages from "./Messages";
-
-afterEach(() => {
-  cleanup();
-  history.replaceState(null, "");
-});
-
-function press(key: string) {
-  act(() => {
-    (document.activeElement ?? document.body).dispatchEvent(
-      new KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }),
-    );
-  });
-}
-
-describe("Messages · the conversation list is a keyboard list", () => {
-  it("walks the conversations with j/k and opens the focused one on Enter", () => {
-    render(<Messages meId={1} />);
-    const focusedRow = () => document.activeElement?.getAttribute("data-nav-index");
-    press("j");
-    press("j");
-    press("j");
-    expect(focusedRow()).toBe("2");
-    expect(document.activeElement?.textContent).toContain("Bence");
-    press("k");
-    expect(focusedRow()).toBe("1");
-    expect(document.activeElement?.textContent).toContain("Anna");
-    press("Enter");
-    expect(screen.getByTestId("thread").textContent).toBe("7");
-    expect(openChat).not.toHaveBeenCalled();
-  });
-});
diff --git a/frontend/src/components/Messages.tsx b/frontend/src/components/Messages.tsx
deleted file mode 100644
index 4b557b82..00000000
--- a/frontend/src/components/Messages.tsx
+++ /dev/null
@@ -1,338 +0,0 @@
-import { useEffect, useEffectEvent, useState } from "react";
-import { qk } from "../lib/queryKeys";
-import { useTranslation } from "react-i18next";
-import { useQuery } from "@tanstack/react-query";
-import { ArrowLeft, ShieldCheck, SquarePen, ExternalLink } from "lucide-react";
-import { api, type Conversation, type MessageUser } from "../lib/api";
-import { useLiveQuery } from "../lib/useLiveQuery";
-import { Button } from "./ui/Button";
-import { IconButton } from "./ui/IconButton";
-import { LoadingState, StateMessage } from "./ui/QueryState";
-import { partnerPub, POLL_MS, SYSTEM_ID, useKeyState } from "../lib/messaging";
-import { useHistorySubview } from "../lib/history";
-import { openChat } from "../lib/chatDock";
-import * as e2ee from "../lib/e2ee";
-import Avatar from "./ui/Avatar";
-import KeyGate from "./KeyGate";
-import ChatThread from "./ChatThread";
-import NavGrid from "./ui/NavGrid";
-import { navItemAttrs } from "../lib/listNav";
-import { Pressable } from "./ui/Pressable";
-import { Input } from "./ui/Input";
-import { SURFACE } from "./ui/surfaces";
-import { SectionLabel } from "./ui/Headings";
-import { RelativeTime } from "./ui/RelativeTime";
-
-type View =
-  | "list"
-  | "new"
-  | { partnerId: number; name?: string; avatar?: string | null; system?: boolean };
-
-export default function Messages({ meId }: { meId: number }) {
-  // Sub-views live in browser history, so Back returns to the conversation list before leaving
-  // the module (open() pushes an entry; back() = history.back()).
-  const { view, open, back } = useHistorySubview<View>("list");
-
-  // Guard against a stale sub-view whose partnerId is the current user's own id (you can't
-  // message yourself). This can be inherited across an account switch — fall back to the list.
-  if (typeof view === "object" && view.partnerId !== meId) {
-    return (
-      <PageThread
-        meId={meId}
-        partnerId={view.partnerId}
-        isSystem={!!view.system}
-        seedName={view.name}
-        seedAvatar={view.avatar}
-        onBack={back}
-      />
-    );
-  }
-  if (view === "new") {
-    return (
-      <Directory
-        onPick={(u) => open({ partnerId: u.id, name: u.name, avatar: u.avatar_url })}
-        onBack={back}
-      />
-    );
-  }
-  return (
-    <ConversationList
-      meId={meId}
-      onOpen={(c) =>
-        open({
-          partnerId: c.partner.id,
-          name: c.partner.name,
-          avatar: c.partner.avatar_url,
-          system: c.partner.id === SYSTEM_ID,
-        })
-      }
-      onNew={() => open("new")}
-    />
-  );
-}
-
-function ConversationList({
-  meId,
-  onOpen,
-  onNew,
-}: {
-  meId: number;
-  onOpen: (c: Conversation) => void;
-  onNew: () => void;
-}) {
-  const { t } = useTranslation();
-  const keyState = useKeyState();
-  const ready = keyState === "ready";
-  const q = useLiveQuery<{ items: Conversation[] }>(qk.conversations(), api.conversations, {
-    intervalMs: POLL_MS,
-  });
-  const items = q.data?.items ?? [];
-  const [previews, setPreviews] = useState<Record<number, string>>({});
-
-  // Decrypt conversation previews when fresh data arrives. The TRIGGER is `dataUpdatedAt` and the
-  // payload is read through an effect event, which is what makes the dep list below complete without
-  // making the identity of `q.data` a trigger. That distinction is load-bearing: the `?? []` fallback is a
-  // new array every render, and anything handing back a fresh object per render (a stub, a caller
-  // that rebuilds it) turns "re-run when the data changes" into a render loop through setPreviews.
-  // Measured the hard way — E27 S2 keyed this on `q.data`, and Messages.keyboard.dom.test hung.
-  const latestConversations = useEffectEvent(() => q.data);
-  useEffect(() => {
-    if (!ready) return;
-    let cancelled = false;
-    const conversations = latestConversations();
-    // Each decrypt is caught (a failure previews as "⚠"), so this never rejects.
-    void (async () => {
-      const out: Record<number, string> = {};
-      for (const c of conversations?.items ?? []) {
-        const m = c.last_message;
-        if (m.kind === "user" && m.ciphertext && m.iv) {
-          try {
-            const pub = await partnerPub(c.partner.id);
-            out[c.partner.id] = await e2ee.decryptFrom(c.partner.id, pub, m.ciphertext, m.iv);
-          } catch {
-            out[c.partner.id] = "⚠";
-          }
-        }
-      }
-      if (!cancelled) setPreviews(out);
-    })();
-    return () => {
-      cancelled = true;
-    };
-  }, [q.dataUpdatedAt, ready]);
-
-  function previewText(c: Conversation): string {
-    const m = c.last_message;
-    if (m.kind === "system") return m.body ?? "";
-    if (!ready) return "🔒 " + t("messages.encrypted");
-    return previews[c.partner.id] ?? "…";
-  }
-
-  return (
-    <div className="space-y-3">
-      <div className="flex items-center justify-between">
-        <SectionLabel>{t("messages.conversations")}</SectionLabel>
-        {ready && (
-          <Button variant="primary" size="xs" onClick={onNew}>
-            <SquarePen className="w-4 h-4" />
-            {t("messages.new")}
-          </Button>
-        )}
-      </div>
-      {(keyState === "setup" || keyState === "unlock") && <KeyGate meId={meId} />}
-      {q.isError && !q.data ? (
-        <StateMessage tone="error" onRetry={() => q.refetch()}>
-          {t("common.loadError")}
-        </StateMessage>
-      ) : q.isLoading && !q.data ? (
-        <LoadingState shape="list" />
-      ) : items.length === 0 ? (
-        <div className={`${SURFACE.panel} p-10 text-center text-muted`}>{t("messages.empty")}</div>
-      ) : (
-        // A keyboard list (E11): `j`/`k` walk the conversations, Enter opens the one the name button
-        // opens; the pop-out button beside it keeps its own Enter.
-        <NavGrid className="flex flex-col gap-1.5">
-          {items.map((c, i) => {
-            const isSystem = c.partner.id === SYSTEM_ID;
-            return (
-              <div
-                key={c.partner.id}
-                {...navItemAttrs(i, c.partner.name)}
-                className="group flex items-center gap-1 rounded-xl state-layer transition"
-              >
-                <Pressable
-                  selectable
-                  data-nav-open=""
-                  onClick={() => onOpen(c)}
-                  className="flex items-center gap-3 p-2.5 min-w-0 flex-1"
-                >
-                  <Avatar
-                    src={c.partner.avatar_url}
-                    fallback={c.partner.name}
-                    className="w-10 h-10 rounded-full shrink-0 text-sm"
-                  />
-                  <div className="min-w-0 flex-1">
-                    <div className="flex items-center gap-2">
-                      <span
-                        className={`truncate ${c.unread > 0 ? "font-semibold" : "font-medium"}`}
-                      >
-                        {c.partner.name}
-                      </span>
-                      <RelativeTime
-                        at={c.last_message.created_at}
-                        className="ml-auto text-2xs text-muted shrink-0"
-                      />
-                    </div>
-                    <div className="flex items-center gap-2">
-                      <span
-                        className={`truncate text-sm ${c.unread > 0 ? "text-fg" : "text-muted"}`}
-                      >
-                        {previewText(c)}
-                      </span>
-                      {c.unread > 0 && (
-                        <span className="ml-auto shrink-0 min-w-5 h-5 px-1.5 grid place-items-center rounded-full bg-accent text-accent-fg text-2xs font-semibold">
-                          {c.unread}
-                        </span>
-                      )}
-                    </div>
-                  </div>
-                </Pressable>
-                {!isSystem && ready && (
-                  <IconButton
-                    size="md"
-                    onClick={() => openChat(c.partner)}
-                    label={t("messages.popOut")}
-                    className="mr-1.5 reveal"
-                  >
-                    <ExternalLink />
-                  </IconButton>
-                )}
-              </div>
-            );
-          })}
-        </NavGrid>
-      )}
-    </div>
-  );
-}
-
-function Directory({ onPick, onBack }: { onPick: (u: MessageUser) => void; onBack: () => void }) {
-  const { t } = useTranslation();
-  const [filter, setFilter] = useState("");
-  const q = useQuery({ queryKey: qk.messageUsers(), queryFn: api.messageUsers });
-  const users = (q.data ?? []).filter((u) =>
-    u.name.toLowerCase().includes(filter.trim().toLowerCase()),
-  );
-  return (
-    <div className="space-y-3">
-      <div className="flex items-center gap-2">
-        <IconButton
-          label={t("channel.back")}
-          size="sm"
-          variant="ghost"
-          // An icon-only button needs a name: both of these announced themselves as a bare "button",
-          // and they are the only way out of the sub-view (E10 review round 1).
-          onClick={onBack}
-        >
-          <ArrowLeft className="w-4 h-4" />
-        </IconButton>
-        <SectionLabel>{t("messages.newTitle")}</SectionLabel>
-      </div>
-      <Input
-        className="w-full"
-        value={filter}
-        onChange={(e) => setFilter(e.target.value)}
-        placeholder={t("messages.searchPeople")}
-      />
-      {q.isError && !q.data ? (
-        <StateMessage tone="error" onRetry={() => q.refetch()}>
-          {t("common.loadError")}
-        </StateMessage>
-      ) : q.isLoading ? (
-        <LoadingState shape="list" />
-      ) : users.length === 0 ? (
-        <div className={`${SURFACE.panel} p-10 text-center text-muted`}>
-          {t("messages.noPeople")}
-        </div>
-      ) : (
-        <div className="flex flex-col gap-1">
-          {users.map((u) => (
-            <Pressable
-              selectable
-              key={u.id}
-              layer
-              onClick={() => onPick(u)}
-              className="flex items-center gap-3 p-2.5 rounded-xl"
-            >
-              <Avatar
-                src={u.avatar_url}
-                fallback={u.name}
-                className="w-9 h-9 rounded-full shrink-0 text-sm"
-              />
-              <span className="truncate font-medium">{u.name}</span>
-            </Pressable>
-          ))}
-        </div>
-      )}
-    </div>
-  );
-}
-
-function PageThread({
-  meId,
-  partnerId,
-  isSystem,
-  seedName,
-  seedAvatar,
-  onBack,
-}: {
-  meId: number;
-  partnerId: number;
-  isSystem: boolean;
-  seedName?: string;
-  seedAvatar?: string | null;
-  onBack: () => void;
-}) {
-  const { t } = useTranslation();
-  const ready = useKeyState() === "ready";
-  const name = seedName ?? "";
-  return (
-    <div className="flex flex-col h-[65dvh] min-h-80">
-      <div className="flex items-center gap-3 pb-3 border-b border-border">
-        <IconButton
-          label={t("channel.back")}
-          size="sm"
-          variant="ghost"
-          // An icon-only button needs a name: both of these announced themselves as a bare "button",
-          // and they are the only way out of the sub-view (E10 review round 1).
-          onClick={onBack}
-        >
-          <ArrowLeft className="w-4 h-4" />
-        </IconButton>
-        <Avatar
-          src={seedAvatar}
-          fallback={name}
-          className="w-9 h-9 rounded-full shrink-0 text-sm"
-        />
-        <span className="font-semibold truncate">{name}</span>
-        {!isSystem && (
-          <ShieldCheck
-            className="w-4 h-4 text-muted shrink-0"
-            aria-label={t("messages.encryptedHint")}
-          />
-        )}
-        <div className="flex-1" />
-        {!isSystem && ready && (
-          <IconButton
-            size="md"
-            onClick={() => openChat({ id: partnerId, name, avatar_url: seedAvatar ?? null })}
-            label={t("messages.popOut")}
-          >
-            <ExternalLink />
-          </IconButton>
-        )}
-      </div>
-      <ChatThread meId={meId} partnerId={partnerId} isSystem={isSystem} />
-    </div>
-  );
-}
diff --git a/frontend/src/components/MyLogViewer.dom.test.tsx b/frontend/src/components/MyLogViewer.dom.test.tsx
index 9659cff5..316a5026 100644
--- a/frontend/src/components/MyLogViewer.dom.test.tsx
+++ b/frontend/src/components/MyLogViewer.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E22 S5: "Saját napló" shows this tab's own log live, newest first, filters it by level group and
+// "Saját napló" shows this tab's own log live, newest first, filters it by level group and
 // text, and copies exactly what is filtered (oldest first, one JSON event per line).
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { act, cleanup, fireEvent, render, screen, within } from "@testing-library/react";
diff --git a/frontend/src/components/NavSidebar.tsx b/frontend/src/components/NavSidebar.tsx
index 0ddb0685..a539ec44 100644
--- a/frontend/src/components/NavSidebar.tsx
+++ b/frontend/src/components/NavSidebar.tsx
@@ -7,7 +7,6 @@ import { Info, LogOut, Settings, Shield, UserPlus, type LucideIcon } from "lucid
 import { api, type Me } from "../lib/api";
 import { displayName, roleKey } from "../lib/api/account";
 import { pinOnNextPage } from "../lib/activeAccount";
-import * as e2ee from "../lib/e2ee";
 import { useLiveQuery } from "../lib/useLiveQuery";
 import { getUnreadCount, subscribe } from "../lib/notifications";
 import type { Page } from "../lib/urlState";
@@ -84,14 +83,6 @@ export default function NavSidebar({
     } catch {
       /* clear locally and reload regardless */
     }
-    // Forget this device's E2EE private key on sign-out: it's otherwise persisted in IndexedDB
-    // and auto-unlocks on the next visit, so on a shared machine the conversations would stay
-    // decryptable after logout. Re-entering the message passphrase is required next time.
-    try {
-      await e2ee.clearDevice(me.id);
-    } catch {
-      /* IndexedDB unavailable (e.g. private mode) — never let it block the logout + reload */
-    }
     pinOnNextPage(null);
     location.reload();
   }
@@ -112,8 +103,7 @@ export default function NavSidebar({
     pinOnNextPage(id);
     // Drop the previous account's in-module sub-view/overlay before the reload (which would
     // otherwise preserve history.state across the swap). Otherwise the new account lands on a
-    // stale sub-view — e.g. an open chat thread whose partnerId belongs to the OLD identity
-    // (often the new account's own id → an empty self-thread). Start at the module root instead.
+    // stale sub-view that belongs to the OLD identity. Start at the module root instead.
     const st = { ...(window.history.state || {}) };
     delete st._sub;
     delete st._ov;
@@ -130,17 +120,10 @@ export default function NavSidebar({
   // events (the former separate bell is now folded into the inbox page).
   const clientUnread = useSyncExternalStore(subscribe, getUnreadCount, getUnreadCount);
   const unread = (unreadQuery.data?.count ?? 0) + clientUnread;
-  // Direct messages are their own module with their own unread badge (demo can't message).
-  const msgUnreadQuery = useLiveQuery(qk.messageUnread(), api.messageUnreadCount, {
-    intervalMs: 30000,
-    enabled: !me.is_demo,
-  });
-  const msgUnread = msgUnreadQuery.data?.count ?? 0;
   // Download center badge = items still working (queued/running/paused). Reuses the same
   // lightweight per-user index the feed cards poll, so no extra request shape.
   const dlIndexQuery = useLiveQuery(qk.downloadIndex(), api.downloadIndex, {
     intervalMs: 30000,
-    enabled: !me.is_demo,
   });
   const dlActive = Object.values(dlIndexQuery.data ?? {}).filter((s) => s !== "done").length;
 
@@ -155,7 +138,6 @@ export default function NavSidebar({
   // badge NUMBERS are the only nav-only concern (they need the live polling queries above).
   const BADGE: Partial<Record<Page, number>> = {
     notifications: unread,
-    messages: msgUnread,
     downloads: dlActive,
   };
   const META = (p: Page): Omit<NavItem, "page"> => ({
@@ -204,7 +186,7 @@ export default function NavSidebar({
           {systemItems.length > 0 && (
             <>
               <NavRailDivider />
-              {/* The admin pages, one row opening a panel of them (E31): five rows of their own sat
+              {/* The admin pages, one row opening a panel of them: five rows of their own sat
                   below the fold at 133% zoom, behind a fade alone. */}
               <NavRailGroup
                 testId="nav-admin"
diff --git a/frontend/src/components/NavigationProvider.dom.test.tsx b/frontend/src/components/NavigationProvider.dom.test.tsx
index d7f36e40..23cc87c1 100644
--- a/frontend/src/components/NavigationProvider.dom.test.tsx
+++ b/frontend/src/components/NavigationProvider.dom.test.tsx
@@ -92,7 +92,7 @@ describe("NavigationProvider · the tab title", () => {
     expect(document.title.endsWith(" · Siftlode")).toBe(true);
   });
 
-  // E31 S1: the Feed's tab read a bare "Siftlode" — the one page that named no place.
+  // The Feed's tab read a bare "Siftlode" — the one page that named no place.
   it("names the Feed like every other page", async () => {
     window.history.replaceState({ sfPage: "feed" }, "", "/?page=feed");
     render();
@@ -100,7 +100,7 @@ describe("NavigationProvider · the tab title", () => {
     expect(document.title).toBe("header.account.feed · Siftlode");
   });
 
-  // E31 S1: a channel opened from a link was "Channels · Siftlode", the same channel opened in the
+  // A channel opened from a link was "Channels · Siftlode", the same channel opened in the
   // app was named; a Plex title, person or collection only "Plex". The object is the view's heading.
   it("puts the open view's own heading before the place, and drops it when the view closes", async () => {
     window.history.replaceState({ sfPage: "plex" }, "", "/?page=plex");
@@ -161,8 +161,8 @@ describe("NavigationProvider · setPage's same-page guard", () => {
     // the channel page. The `&& !channelViewRef.current` half of the guard is what makes it one.
     const { result } = render();
     // The page under test must be the one that is ALREADY current, or the guard's first conjunct is
-    // false and this never reaches the clause it is named for — the mistake round 4 caught here: a
-    // bare URL with cleared storage lands on "home" (navigationInit's E24 default), not "feed", so
+    // false and this never reaches the clause it is named for — the mistake a review caught here: a
+    // bare URL with cleared storage lands on "home" (navigationInit's default), not "feed", so
     // asking for "feed" was just an ordinary page change and deleting the clause left it green.
     const current = result.current.page;
     expect(current).toBe("home");
@@ -176,6 +176,36 @@ describe("NavigationProvider · setPage's same-page guard", () => {
   });
 });
 
+describe("NavigationProvider · Back", () => {
+  // A tab that had a since-removed module open, reloaded onto the new build: its older history
+  // entries still name that page, and Back lands on one of them.
+  it("lands on the feed when the entry names a page this build does not have", () => {
+    const { result } = render();
+    act(() => result.current.setPage("plex"));
+    act(() => {
+      window.history.replaceState({ sfPage: "messages" }, "", "/?page=messages&keep=1");
+      window.dispatchEvent(new PopStateEvent("popstate", { state: { sfPage: "messages" } }));
+    });
+    expect(result.current.page).toBe("feed");
+    // …and the entry says so too, so the address bar and a later Feed click agree with the screen.
+    expect(window.history.state).toMatchObject({ sfPage: "feed" });
+    expect(window.location.search).toBe("?keep=1");
+  });
+
+  // lib/history's own listener takes a spent focus stamp off the entry it lands on; the rewrite must
+  // not put it back, or the next landing there (an overlay closing) would refocus a stale item.
+  it("does not put back the focus stamp the landing spent", () => {
+    render();
+    const st = { sfPage: "messages", sfNav: { list: 0, lists: 1 } };
+    act(() => {
+      window.history.replaceState(st, "", "/?page=messages");
+      window.dispatchEvent(new PopStateEvent("popstate", { state: st }));
+    });
+    expect(window.history.state).toMatchObject({ sfPage: "feed" });
+    expect(window.history.state).not.toHaveProperty("sfNav");
+  });
+});
+
 describe("NavigationProvider · never under an open overlay", () => {
   it("setPage closes the overlay first and pushes only once its entry is reclaimed", async () => {
     const { result } = render();
diff --git a/frontend/src/components/NavigationProvider.tsx b/frontend/src/components/NavigationProvider.tsx
index 158de493..fbbc571f 100644
--- a/frontend/src/components/NavigationProvider.tsx
+++ b/frontend/src/components/NavigationProvider.tsx
@@ -2,7 +2,7 @@ import { useCallback, useEffect, useMemo, useState, type ReactNode } from "react
 import { useLatest } from "../lib/useLatest";
 import { useTranslation } from "react-i18next";
 import { useMe } from "../lib/useMe";
-import { urlWithParams, type Page } from "../lib/urlState";
+import { isPage, urlWithParams, type Page } from "../lib/urlState";
 import { LOGS_KEYS } from "../lib/logsUrlState";
 import { pageTitleKey } from "../lib/pageMeta";
 import { useDocumentObjectTitle } from "../lib/documentTitle";
@@ -197,7 +197,19 @@ export function NavigationProvider({ children }: { children: ReactNode }) {
       window.history.replaceState({ ...rest, sfPage: mountPage }, "", url);
     }
     function onPop(e: PopStateEvent) {
-      const p = (e.state?.sfPage as Page) ?? "feed";
+      // An entry can name a page this build no longer has (one pushed before a module was removed,
+      // reached by Back after a reload onto the new build); that lands on the feed, not on a crash.
+      // The entry is rewritten to say so: left alone, the address bar would keep naming the dead page
+      // and a click on Feed would be a no-op (setPage's same-page guard). It spreads the LIVE entry,
+      // not `e.state`: lib/history's listener ran first and already took the spent `sfNav` off it.
+      const sf: unknown = e.state?.sfPage;
+      const p: Page = typeof sf === "string" && isPage(sf) ? sf : "feed";
+      if (typeof sf === "string" && sf !== p)
+        window.history.replaceState(
+          { ...window.history.state, sfPage: p },
+          "",
+          urlWithParams({ page: null }),
+        );
       setPageState(p);
       setAccountRaw(PAGE_KEY, p);
       // The YouTube-search sub-view and the channel page ride in history.state, so Back/Forward
diff --git a/frontend/src/components/NotificationsPanel.menu.dom.test.tsx b/frontend/src/components/NotificationsPanel.menu.dom.test.tsx
index 131e4925..d450ec12 100644
--- a/frontend/src/components/NotificationsPanel.menu.dom.test.tsx
+++ b/frontend/src/components/NotificationsPanel.menu.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 C1 on the notification center: a row keeps its link and its unread mark in sight, its dismiss
+// The notification center: a row keeps its link and its unread mark in sight, its dismiss
 // shows on hover (on touch it is in the "…"), and everything it can do is its ONE menu — opened by
 // the row's "…" or a right-click; a hidden / watched notice's Find in feed and Undo live only there.
 // The band keeps Mark all read; Clear everything moved into the header's "…" and asks first.
@@ -46,7 +46,7 @@ vi.mock("../lib/notifications", async (importOriginal) => ({
 vi.mock("./navigationContext", () => ({ useNavigationActions: () => ({ setPage: h.setPage }) }));
 vi.mock("./channelsContext", () => ({ useChannelsActions: () => ({ focusChannel: vi.fn() }) }));
 vi.mock("./feedFiltersContext", () => ({
-  // Every narrowing a feed can carry (E28 review C2: the year, the custom range, the length, the
+  // Every narrowing a feed can carry (the year, the custom range, the length, the
   // content types and the scope survived "Find in feed" and could still hide the video).
   useFeedFilters: () => ({
     tags: [54],
@@ -331,7 +331,7 @@ describe("NotificationsPanel · the page's background menu", () => {
   });
 });
 
-describe("a download-lifecycle notice (E30)", () => {
+describe("a download-lifecycle notice", () => {
   it("is named from its data in the reader's language, never the server's English title", () => {
     h.server = [
       server(1, {
diff --git a/frontend/src/components/NotificationsPanel.tsx b/frontend/src/components/NotificationsPanel.tsx
index 99912cd7..9ea0cab7 100644
--- a/frontend/src/components/NotificationsPanel.tsx
+++ b/frontend/src/components/NotificationsPanel.tsx
@@ -128,7 +128,7 @@ export default function NotificationsPanel() {
     else refresh();
   }
   // It empties both lists for good (the server's are deleted), so it asks first — it moved from the
-  // band into the header's "…" (E28 C1), where a destructive row keeps its confirm.
+  // band into the header's "…", where a destructive row keeps its confirm.
   async function clearEverything() {
     const ok = await confirm({
       title: t("inbox.clearConfirmTitle"),
@@ -145,8 +145,8 @@ export default function NotificationsPanel() {
   // notices — jump to the feed filtered to that state and the video's channel.
   // Built from nothing, not spread over the reader's filters: EVERY narrowing that could leave the
   // video out goes — a tag, "no tag", a search, the age cap, the year, the custom range, the length,
-  // a content type (a hidden Short under "no Shorts"), the scope and the library source (E28 review
-  // C2: the spread kept whatever this list forgot). Only how the reader orders and matches stays.
+  // a content type (a hidden Short under "no Shorts"), the scope and the library source (the
+  // spread kept whatever this list forgot). Only how the reader orders and matches stays.
   function locate(meta: VideoHiddenMeta | VideoWatchedMeta) {
     setFilters({
       tags: [],
@@ -176,7 +176,7 @@ export default function NotificationsPanel() {
       .catch((e) => notifyActionError(e, t("inbox.revertFailed")));
   }
 
-  // --- The rows' ONE menu (E28 C1) -------------------------------------------------------------
+  // --- The rows' ONE menu -------------------------------------------------------------
   // A row keeps its link and its unread mark in sight; its dismiss shows on hover. Everything it can
   // do — the link again, find / undo on an activity row, mark read, dismiss — is its menu.
   // One menu per list, keyed by the notification's id: the server list polls, and the "…" must still
@@ -329,7 +329,7 @@ export default function NotificationsPanel() {
 
   return (
     <>
-      {/* The inbox band (B4): Mark all read in sight, Clear everything in its "…" (E28 C1), fixed
+      {/* The inbox band (B4): Mark all read in sight, Clear everything in its "…", fixed
           while the list scrolls. No title card: the nav rail and the tab title name the page, and the
           shell's hidden h1 names it to a screen reader. */}
       {/* The page's background menu (DESIGN "Background menu"): the band's own non-destructive
@@ -518,7 +518,7 @@ function NotificationRow({
   const isScheduler = serverKind(n) === "scheduler";
   const isDownloadDone = serverKind(n) === "download";
   const isEmailUndelivered = n.type === "email_undelivered" && typeof n.data?.reason === "string";
-  // A download's life after it is done (E30): shared with you, about to expire, expired, evicted.
+  // A download's life after it is done: shared with you, about to expire, expired, evicted.
   const lifecycle = DOWNLOAD_LIFECYCLE[n.type];
   let title = n.title;
   let body = n.body;
@@ -529,7 +529,7 @@ function NotificationRow({
     body = t("inbox.maintenance.body", { count: d.count });
   } else if (isScheduler) {
     // "<Job label> finished/failed", with the result as the body — named in the reader's language
-    // when it rode along as data (E30), else the English summary of an older notice.
+    // when it rode along as data, else the English summary of an older notice.
     const run = jobRunText(t, n.data as { job_id: string }, lang);
     title = run.title;
     body = run.body || n.body;
@@ -636,7 +636,7 @@ function ClientActivityRow({
 }) {
   const { icon: Icon, color } = LEVEL_STYLE[n.level];
   const needsAction = n.requiresInteraction && !n.dismissed;
-  // A hidden / watched notice's Find in feed and Undo are in its menu (E28 C1): the row reads.
+  // A hidden / watched notice's Find in feed and Undo are in its menu: the row reads.
   const quiet = n.meta?.kind === "video-hidden" || n.meta?.kind === "video-watched";
   const subscribed: ChannelSubscribedMeta | null =
     n.meta?.kind === "channel-subscribed" ? n.meta : null;
diff --git a/frontend/src/components/OnboardingWizard.dialog.dom.test.tsx b/frontend/src/components/OnboardingWizard.dialog.dom.test.tsx
index 5e3194bd..290a9a0c 100644
--- a/frontend/src/components/OnboardingWizard.dialog.dom.test.tsx
+++ b/frontend/src/components/OnboardingWizard.dialog.dom.test.tsx
@@ -3,7 +3,7 @@
 // The wizard is a modal overlay in every way that matters to a user, but it renders its own shell
 // instead of going through `ui/Modal` — and for a keyboard or screen-reader user it had nothing of
 // the dialog contract: no role, no label, no initial focus, no trap, no restore. Tab past its last
-// control walked into the app behind the scrim, where the focus ring is invisible (round 5).
+// control walked into the app behind the scrim, where the focus ring is invisible.
 //
 // `focusablesIn` filters on `el.offsetParent !== null` and jsdom reports null for everything, so the
 // trap is untestable as written without the same stub `ui/Modal.dom.test.tsx` uses.
@@ -90,7 +90,7 @@ describe("the onboarding wizard as a dialog", () => {
     // `Node.contains(self)` is true, so focus sitting ON the tabIndex=-1 panel — where a click on
     // its dead space puts it — matched no branch of `trapTab` and the browser's native Shift+Tab
     // ran, into the app behind the scrim. That is what the third argument exists for, and this
-    // caller was written without it on the very commit that extracted the helper (round 6).
+    // caller was written without it on the very commit that extracted the helper.
     mount();
     const panel = screen.getByRole("dialog");
     panel.focus();
@@ -104,7 +104,7 @@ describe("the onboarding wizard as a dialog", () => {
     // Ownership has to be measured over the same scope the Tab trap uses. The wizard's toast host
     // sits beside the panel and INSIDE the dialog, so tabbing to a toast's ✕ is legal — but read
     // against the panel alone it said "the user left", and since removing the toast fires no
-    // focusin to re-arm, closing afterwards stranded the focus on <body> (round 6). Unlike
+    // focusin to re-arm, closing afterwards stranded the focus on <body>. Unlike
     // `ui/Modal`, whose root carries the aria-modal attribute, nothing else can rescue this one.
     const outside = document.createElement("button");
     document.body.appendChild(outside);
diff --git a/frontend/src/components/OnboardingWizard.escape.dom.test.tsx b/frontend/src/components/OnboardingWizard.escape.dom.test.tsx
index 749b4878..e092144c 100644
--- a/frontend/src/components/OnboardingWizard.escape.dom.test.tsx
+++ b/frontend/src/components/OnboardingWizard.escape.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Escape closes the topmost layer only — the wizard included (deep-review round 4). Its own Escape
+// Escape closes the topmost layer only — the wizard included. Its own Escape
 // was a raw `document` listener with no layer check, and document listeners run before the window
 // listener ui/Modal uses: a sync that failed inside the wizard opens the global error dialog, and one
 // Esc dismissed the error AND ended onboarding, skipping the write-scope step.
diff --git a/frontend/src/components/OnboardingWizard.tsx b/frontend/src/components/OnboardingWizard.tsx
index a4db3b82..8e60ccb0 100644
--- a/frontend/src/components/OnboardingWizard.tsx
+++ b/frontend/src/components/OnboardingWizard.tsx
@@ -117,13 +117,13 @@ export default function OnboardingWizard({ me, onClose }: { me: Me; onClose: ()
 
   // A layer in the shared stack, so Escape closes the wizard only when it is on top: a raw document
   // listener ran BEFORE the error dialog's (a sync that failed inside the wizard opens one), and one
-  // Esc closed the error AND ended onboarding, skipping the write-scope step (deep-review round 4).
+  // Esc closed the error AND ended onboarding, skipping the write-scope step.
   const layer = useLayer(true, close);
 
   // The rest of the dialog contract. This is a modal overlay in every way that matters to a user, but
   // it renders its own shell (it is not a titled dialog with a header row), so Escape ordering was all
   // it had: focus started on <body>, nothing announced a dialog, and Tab past the last control walked
-  // into the app behind the scrim — where the focus ring is invisible (deep-review round 5). The trap
+  // into the app behind the scrim — where the focus ring is invisible. The trap
   // and the roles come from the same place `ui/Modal` gets them, not from a second hand-written copy.
   const panelRef = useRef<HTMLDivElement>(null);
   const rootRef = useRef<HTMLDivElement>(null);
@@ -136,7 +136,7 @@ export default function OnboardingWizard({ me, onClose }: { me: Me; onClose: ()
       if (e.key !== "Tab" || layer.blockingAbove()) return;
       const panel = panelRef.current;
       // The SAME three arguments `ui/Modal` passes, for the same two reasons — and this call had
-      // neither of them (round 6, on the commit that extracted the helper so the two shells could
+      // neither of them (on the commit that extracted the helper so the two shells could
       // not disagree). Scope is the whole dialog, so the toast host beside the panel stays in the
       // Tab cycle (a sticky connection notice's ✕ was unreachable from the keyboard); `container`
       // is the tabIndex=-1 panel, because `panel.contains(panel)` is true, so focus sitting ON the
@@ -151,7 +151,7 @@ export default function OnboardingWizard({ me, onClose }: { me: Me; onClose: ()
   // Are we currently importing (or about to)? Show a progress screen instead of the
   // "you're connected" step until the first import settles. Once triggered, the mutation itself says
   // which (pending / success / error) — the trigger ref is the effect's once-only latch, never read
-  // here (a ref read in render made the React Compiler skip the wizard, E32).
+  // here (a ref read in render made the React Compiler skip the wizard).
   const importing =
     me.can_read &&
     !importSubs.isError &&
diff --git a/frontend/src/components/PaletteLauncher.dom.test.tsx b/frontend/src/components/PaletteLauncher.dom.test.tsx
index d2b0e067..928060b2 100644
--- a/frontend/src/components/PaletteLauncher.dom.test.tsx
+++ b/frontend/src/components/PaletteLauncher.dom.test.tsx
@@ -43,7 +43,7 @@ function mount() {
   }
   render(
     <>
-      <Header me={{ is_demo: false, plex_enabled: false } as Me} onYtSearch={() => {}} />
+      <Header me={{ plex_enabled: false } as Me} onYtSearch={() => {}} />
       <Probe />
     </>,
   );
diff --git a/frontend/src/components/PersonalViewsModal.dom.test.tsx b/frontend/src/components/PersonalViewsModal.dom.test.tsx
index 9d08d7a9..fa944ae5 100644
--- a/frontend/src/components/PersonalViewsModal.dom.test.tsx
+++ b/frontend/src/components/PersonalViewsModal.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// S7 — the Personal-views manager gains an EDITABLE detail pane: captured filters are now removable
+// The Personal-views manager gains an EDITABLE detail pane: captured filters are now removable
 // chips that write the pruned set back to the stored view (undoable), an explicit Save-current button
 // stores the live filters into the view, and rename has a visible commit affordance. This drives the
 // real modal against a mocked savedViewsContext so we can assert exactly which mutation fires; the
@@ -108,7 +108,7 @@ afterEach(() => {
   vi.restoreAllMocks();
 });
 
-describe("PersonalViewsModal — S7 editable detail pane", () => {
+describe("PersonalViewsModal — editable detail pane", () => {
   it("removing a captured-filter chip writes the pruned filters back to the stored view", async () => {
     mount();
     const removeBtn = await screen.findByLabelText("feed.chips.remove");
diff --git a/frontend/src/components/PlayerModal.dom.test.tsx b/frontend/src/components/PlayerModal.dom.test.tsx
index 3d17a25b..f856b5cd 100644
--- a/frontend/src/components/PlayerModal.dom.test.tsx
+++ b/frontend/src/components/PlayerModal.dom.test.tsx
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
 // The YouTube player modal, rendered for real. Its pure helpers (afterRemoval, the progress cache)
-// had tests; what the modal DOES with them had none — a deep-review of the 2026-09 bug hunt found
+// had tests; what the modal DOES with them had none — a review during the 2026-09 bug hunt found
 // that deleting the lines that apply them left every lane green.
 //
 // `window.YT` is a fake installed before the module's API loader first runs (that loader memoises
@@ -293,9 +293,9 @@ describe("PlayerModal — toasts raised while it is open", () => {
 });
 
 // --- the dialog contract it now shares (ui/dialogFocus) -----------------------------------------
-// Until E11 this was the one `aria-modal` shell with no accessible name, no Tab trap and no focus
+// This was once the one `aria-modal` shell with no accessible name, no Tab trap and no focus
 // restore: Tab walked out of an open player into the page behind the scrim, and closing it with
-// Escape left a keyboard user on <body>, their place in a long feed lost (deep-review round 7).
+// Escape left a keyboard user on <body>, their place in a long feed lost.
 describe("PlayerModal — the dialog contract", () => {
   const open = (onClose = () => {}) => {
     vi.spyOn(api, "videoDetail").mockReturnValue(new Promise(() => {}));
@@ -444,7 +444,7 @@ describe("PlayerModal — the side arrows", () => {
   });
 });
 
-// E31 S1: at 133% zoom (a 685px window) a full-width card ran 20px past the bottom and cut its channel
+// At 133% zoom (a 685px window) a full-width card ran 20px past the bottom and cut its channel
 // row. The card's width is capped from the window height less what sits under the video, measured.
 describe("PlayerModal — fits the window's height", () => {
   it("caps the card's width by the chrome measured under the video", () => {
@@ -469,7 +469,7 @@ describe("PlayerModal — fits the window's height", () => {
   });
 });
 
-// E31 (the owner's pick "A"): on a wide window the video was capped at ~1008 px of a 1920 screen, with
+// The owner's pick: on a wide window the video was capped at ~1008 px of a 1920 screen, with
 // empty space all round. From 1280 px the title, channel, actions, description and queue sit in a side
 // panel beside the video, and the video takes the window's height.
 describe("PlayerModal — the side panel on a wide window", () => {
@@ -542,7 +542,7 @@ describe("PlayerModal — the side panel on a wide window", () => {
     expect(spin(document.querySelector(".player-stage")!, 100)).toBe(true); // over the video
   });
 
-  // E31 S5: a failed load read "No description." in the always-open panel — an error drawn as empty.
+  // A failed load read "No description." in the always-open panel — an error drawn as empty.
   it("says the description failed to load, with a retry, instead of 'No description'", async () => {
     wideWindow(true);
     const detail = vi
@@ -563,7 +563,7 @@ describe("PlayerModal — the side panel on a wide window", () => {
     expect(detail).toHaveBeenCalledTimes(2);
   });
 
-  // E31 review 2: the popover below 1280 px said it the same way only by a copy nobody tested.
+  // The popover below 1280 px said it the same way only by a copy nobody tested.
   it("says it in the description popover below 1280 px too", async () => {
     wideWindow(false);
     vi.spyOn(api, "videoDetail").mockRejectedValue(new Error("boom"));
diff --git a/frontend/src/components/PlayerModal.tsx b/frontend/src/components/PlayerModal.tsx
index 94983305..3736cbf1 100644
--- a/frontend/src/components/PlayerModal.tsx
+++ b/frontend/src/components/PlayerModal.tsx
@@ -100,7 +100,7 @@ function canScrollBy(el: HTMLElement | null, dir: -1 | 1): boolean {
   return false;
 }
 
-// From this window width the player's details sit in a side panel beside the video (E31). The panel is
+// From this window width the player's details sit in a side panel beside the video. The panel is
 // a rem width, so it grows with the text size; the video takes what is left.
 const WIDE_PLAYER_PX = 1280;
 const SIDE_PANEL = "20rem";
@@ -206,10 +206,10 @@ export default function PlayerModal({
   const focusModal = useCallback(() => cardRef.current?.focus(), []);
   // The card fits the window, video AND what sits under it (the queue strip, title, channel row): the
   // video is 16:9 at the card's width, so on a short window (133% zoom on a 1080p screen: 685px) a
-  // full-width card ran past the bottom and cut its channel row (E31 S1). `below` is that chrome's
+  // full-width card ran past the bottom and cut its channel row. `below` is that chrome's
   // height, measured (it wraps with the title and the text size), and caps the card's width below.
   const [below, setBelow] = useState(0);
-  // A wide window (E31, the owner's pick "A"): the title, channel, actions, description and the queue
+  // A wide window (the owner's pick): the title, channel, actions, description and the queue
   // move into a side panel beside the video, so the video takes the window's whole height — at
   // 1920×911 it was capped at ~1008 px wide with empty space all round. Narrower, they stay under it.
   const wide = useMediaQuery(`(min-width: ${WIDE_PLAYER_PX}px)`, false);
@@ -229,8 +229,8 @@ export default function PlayerModal({
   }, []);
   // The dialog contract every other `aria-modal` shell shares (ui/dialogFocus): the focus goes back
   // to whatever opened the player, and the page lock is the one counted lock. It opens focused on the
-  // CARD, not its first button, so Space/F/arrows reach the shortcuts. Until E11 this was the one
-  // hand-rolled shell — no accessible name, no Tab trap, no restore (deep-review round 7).
+  // CARD, not its first button, so Space/F/arrows reach the shortcuts. This was once the one
+  // hand-rolled shell — no accessible name, no Tab trap, no restore.
   useDialogChrome(cardRef, dialogRef, { focusScope: true });
   const titleId = useId();
   const togglePlay = () => {
@@ -477,7 +477,7 @@ export default function PlayerModal({
   // over the player by doing so.
   const overlayOrder = useOverlayOrder();
   // This player is a dismissable layer: register it so a Modal or popover opened ABOVE it (e.g. the
-  // download dialog, or — after S4 — an anchored menu) takes Escape first and this player defers.
+  // download dialog, or an anchored menu) takes Escape first and this player defers.
   const layerIdRef = useRef<number | null>(null);
   useEffect(() => {
     const id = pushLayer();
diff --git a/frontend/src/components/PlaylistEditFailures.dom.test.tsx b/frontend/src/components/PlaylistEditFailures.dom.test.tsx
index ce1b22fe..34138017 100644
--- a/frontend/src/components/PlaylistEditFailures.dom.test.tsx
+++ b/frontend/src/components/PlaylistEditFailures.dom.test.tsx
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
-// A playlist or tag edit that fails is said, and what the screen shows goes back to what is true
-// (deep-review round 4). The Plex playlist page, the add-to-playlist popover and the tag manager had
+// A playlist or tag edit that fails is said, and what the screen shows goes back to what is true.
+// The Plex playlist page, the add-to-playlist popover and the tag manager had
 // no failure handling at all: a 404 for a list or tag deleted elsewhere — now a structured
 // `not_found`, which the request layer leaves to the caller — failed in silence, and an optimistic
 // removal stayed removed.
@@ -92,7 +92,7 @@ describe("the Plex playlist page", () => {
       </QueryClientProvider>,
     );
     await screen.findByText("Movie 1");
-    // E28 C1: the row's X went into its menu (right-click here, the "…" beside it on screen).
+    // The row's X went into its menu (right-click here, the "…" beside it on screen).
     await pickFromMenu(
       () => fireEvent.contextMenu(screen.getByText("Movie 1").closest("[data-nav-index]")!),
       "plex.playlist.removeFromPlaylist",
@@ -160,8 +160,8 @@ describe("the add-to-playlist popover", () => {
   it("says so on the PLEX side too, where the same sweep had missed the dialog", async () => {
     // Same shape, same 404, same silence — `req` leaves 403/404/429 to the caller, and this one had
     // no catch: the tick did not flip, nothing was said, the gone row stayed, and the floating
-    // promise became an unhandled rejection. Round 5 fixed the collection editor and the YouTube
-    // twin above; this dialog was left behind (round 6).
+    // promise became an unhandled rejection. A sweep fixed the collection editor and the YouTube
+    // twin above; this dialog was left behind.
     const lists = vi
       .spyOn(api, "plexPlaylists")
       .mockResolvedValue({ playlists: [{ id: 9, title: "Gone", has_item: false }] } as never);
diff --git a/frontend/src/components/PlaylistLimitsHint.tsx b/frontend/src/components/PlaylistLimitsHint.tsx
index 839cb2e9..44261c40 100644
--- a/frontend/src/components/PlaylistLimitsHint.tsx
+++ b/frontend/src/components/PlaylistLimitsHint.tsx
@@ -9,7 +9,7 @@ import { SURFACE } from "./ui/surfaces";
 
 // The playlists module shows fewer lists than youtube.com does, and without a word about it that
 // reads as Siftlode being broken (the owner's ask, 2026-09-03: say it is YouTube's API, up front).
-// Three facts, behind one quiet line at the foot of the rail — the owner's pick from the S7 mockups
+// Three facts, behind one quiet line at the foot of the rail — the owner's pick from the mockups
 // (2026-09-19): always there to find again, never in the way.
 export default function PlaylistLimitsHint() {
   const { t } = useTranslation();
diff --git a/frontend/src/components/Playlists.dom.test.tsx b/frontend/src/components/Playlists.dom.test.tsx
index 0254e75a..9f5dfb59 100644
--- a/frontend/src/components/Playlists.dom.test.tsx
+++ b/frontend/src/components/Playlists.dom.test.tsx
@@ -392,7 +392,7 @@ describe("Playlists — a change the server refused is taken back on screen", ()
     // refetch that follows a successful reorder did. So a second reorder rejected while that refetch
     // was still in flight rolled the rows back past the FIRST one, which the server had accepted.
     // The membership guard cannot correct an order (its key is the sorted id set), so the wrong
-    // order stayed on screen for good and the next drag persisted it (deep-review round 5).
+    // order stayed on screen for good and the next drag persisted it.
     const reorder = vi
       .spyOn(api, "reorderPlaylist")
       .mockResolvedValueOnce(undefined as never)
@@ -429,7 +429,7 @@ describe("Playlists — a change the server refused is taken back on screen", ()
   });
 });
 
-// E28 C1: a row's X column went. Remove is in the row's menu and on the Delete key, with no confirm —
+// A row's X column went. Remove is in the row's menu and on the Delete key, with no confirm —
 // the toast's Undo puts the row back where it stood, in ONE request.
 describe("Playlists — removing a row, and undoing it", () => {
   // The server's side of a removal, so the refetch after it agrees with it.
@@ -489,7 +489,7 @@ describe("Playlists — removing a row, and undoing it", () => {
     await waitFor(() => expect(api.addToPlaylist).toHaveBeenCalledWith(1, "A", 0));
   });
 
-  // E28 review C4: the stored index drifts when the list changes before the Undo (a row added at
+  // The stored index drifts when the list changes before the Undo (a row added at
   // the top in another tab) — the row goes back after its old neighbour instead.
   it("puts it back after its neighbour when the list changed before the Undo", async () => {
     const lists = { 1: [vid("A", 0), vid("B", 0), vid("C", 0)] };
@@ -566,7 +566,7 @@ describe("Playlists — removing a row, and undoing it", () => {
   });
 });
 
-// E28 C1: the header keeps Play all; rename, YouTube and delete are the list's menu, behind a "…".
+// The header keeps Play all; rename, YouTube and delete are the list's menu, behind a "…".
 describe("Playlists · the header's '…'", () => {
   it("replaces the pencil, the YouTube buttons and the trash, and renames from its menu", async () => {
     mount({ 1: [vid("A", 0)] });
@@ -615,7 +615,7 @@ describe("Playlists · a narrow table", () => {
       el.classList.contains("hidden") && el.classList.contains("@2xl:table-cell");
     const heads = [...document.querySelectorAll("thead th")];
     const cells = [...document.querySelectorAll("tbody tr:first-child td")];
-    // Columns: grip, #, title, channel, length, "…". Length went too (E28 S3f3, the owner's pick A).
+    // Columns: grip, #, title, channel, length, "…". Length went too (the owner's pick).
     expect(heads.map(narrowHidden)).toEqual([false, true, false, true, true, false]);
     expect(cells.map(narrowHidden)).toEqual([false, true, false, true, true, false]);
   });
@@ -661,7 +661,7 @@ describe("Playlists — the rows are a keyboard list", () => {
 });
 
 // The header's meta line and its view-controls gate were typechecked and linted but never rendered,
-// so a regression in either shipped green (E9 review). The count and the runtime sum the WHOLE
+// so a regression in either shipped green. The count and the runtime sum the WHOLE
 // list; an unknown duration counts as nothing rather than poisoning the sum; and a list of one has
 // no view to change.
 describe("Playlists · the header", () => {
diff --git a/frontend/src/components/Playlists.tsx b/frontend/src/components/Playlists.tsx
index fbcfde4f..e0a1391a 100644
--- a/frontend/src/components/Playlists.tsx
+++ b/frontend/src/components/Playlists.tsx
@@ -68,11 +68,11 @@ import { HiddenFilterCue } from "./ui/HiddenFilterCue";
 import { PageHeading } from "./ui/Headings";
 import { useCopyItems } from "./copyItems";
 
-// The playlist detail is a HYBRID table (E4 S4): real sortable/filterable column headers over a
+// The playlist detail is a HYBRID table: real sortable/filterable column headers over a
 // body that is still a drag-reorderable @dnd-kit list.
 //
 // The distinction that shapes the whole module: **the column sort and the filters are a VIEW**,
-// while the playlist's own order is stored data. Before S4 the sort control wrote straight through
+// while the playlist's own order is stored data. At first the sort control wrote straight through
 // to the server, so picking "sort by title" silently rewrote the playlist and marked a
 // YouTube-linked mirror dirty. Now nothing is written until the user presses "Save this order",
 // which still goes through the undoable path — the capability is intact, it just stopped being a
@@ -186,7 +186,7 @@ export default function Playlists() {
           // `restoreFromCache` rolls back to, and until this refetch landed it still held the order
           // from before this reorder — so a SECOND reorder failing in that window rolled the rows
           // back to an order the server does not have, permanently (the membership guard cannot
-          // correct an order). One accepted write, one cache entry that matches it (round 5).
+          // correct an order). One accepted write, one cache entry that matches it.
           qc.setQueryData<PlaylistDetail>(qk.playlist(listId), (old) =>
             old ? { ...old, items: next } : old,
           );
@@ -220,8 +220,8 @@ export default function Playlists() {
   // Put the rows back to what the CACHED detail says — the server's list as last fetched. A failed
   // reorder or move must not wait for the resync to do it: the server's list is unchanged, so the
   // refetch comes back deep-equal, react-query keeps the same `data` object, and the effect below
-  // (keyed on it) never runs. The moved row stayed gone and the rejected order stayed on screen
-  // (deep-review round 4). Only for the list on screen: the selection may have moved meanwhile.
+  // (keyed on it) never runs. The moved row stayed gone and the rejected order stayed on screen.
+  // Only for the list on screen: the selection may have moved meanwhile.
   function restoreFromCache(listId: number) {
     if (listId !== selectedRef.current) return;
     const cur = qc.getQueryData<PlaylistDetail>(qk.playlist(listId));
@@ -257,7 +257,7 @@ export default function Playlists() {
   // ONE context menu for the whole table, not one popover per <tr> (see ui/ContextMenu): the row it
   // belongs to is `rowMenu.target`, and the panel anchors to the pointer.
   const rowMenu = useContextMenu<Video>();
-  // The comfort-shelf pin composes into the row's existing menu (E24 S3) rather than mounting a
+  // The comfort-shelf pin composes into the row's existing menu rather than mounting a
   // second one on the same <tr>.
   const comfortPin = useComfortPin(rowMenu.open);
   const copy = useCopyItems();
@@ -370,7 +370,7 @@ export default function Playlists() {
     [items],
   );
 
-  // The row's "…" opens the row menu under itself (E28 C1). Which row's menu is open is part of the
+  // The row's "…" opens the row menu under itself. Which row's menu is open is part of the
   // cell (aria-expanded), so the columns rebuild when it changes — a cheap array of closures.
   const { buttonProps: rowMenuButton, open: rowMenuOpen, target: rowMenuTarget } = rowMenu;
   const columns = useMemo(
@@ -451,8 +451,8 @@ export default function Playlists() {
     order.set(arrayMove(items, oldIndex, newIndex)); // onApply persists
   }
 
-  /** Takes a row out at once and says so in a toast whose Undo puts it back where it was (E28 C1:
-   *  the X column became the Delete key + this toast; no confirm, because nothing is lost).
+  /** Takes a row out at once and says so in a toast whose Undo puts it back where it was (the
+   *  X column became the Delete key + this toast; no confirm, because nothing is lost).
    *  @returns whether the item was actually removed — the player needs to know, because it must
    *  step to the next item (or close) only when the removal really happened. */
   async function removeItem(video: Video, listIdArg?: number | null): Promise<boolean> {
@@ -558,9 +558,9 @@ export default function Playlists() {
       // NOT a silent revert. `req` deliberately leaves 401/403/404 to the caller as control flow, and
       // every move failure a user can actually reach is a 404 (the 400 `same_playlist` case is already
       // impossible — the submenu never offers the current list). So the row used to snap back with no
-      // explanation and the shipped moveErrors strings were unreachable (E10 review round 1).
+      // explanation and the shipped moveErrors strings were unreachable.
       // A fault `req` already put in its error dialog is not toasted again — `notifyActionError`
-      // checks (E10 review round 2 found it reported twice).
+      // checks (a review found it reported twice).
       notifyActionError(e, t("playlists.moveFailed"));
       restoreFromCache(selectedId); // the row is still in this list
     }
@@ -600,7 +600,7 @@ export default function Playlists() {
         qc.invalidateQueries({ queryKey: qk.playlist() });
         qc.invalidateQueries({ queryKey: qk.feed() });
       })
-      // No catch used to mean an unhandled rejection and nothing said (E11 S2b).
+      // No catch used to mean an unhandled rejection and nothing said.
       .catch((e: unknown) => notifyActionError(e, t("errors.writeFailed.videoState")));
   }
 
@@ -896,7 +896,7 @@ export default function Playlists() {
                       {t("playlists.playAll")}
                     </Button>
                     {/* Rename, the pin, YouTube (open / push / revert) and Delete: the list's ONE
-                      menu (E28 C1), the same the rail row opens — the header keeps Play all. */}
+                      menu, the same the rail row opens — the header keeps Play all. */}
                     <MoreButton
                       ref={renameTarget}
                       variant="outline"
@@ -1016,7 +1016,7 @@ export default function Playlists() {
                     dnd-kit has handled). */}
                   <NavGrid
                     as="tbody"
-                    // Delete on a walked row = the menu's Remove (E28 C1), with the same undo toast.
+                    // Delete on a walked row = the menu's Remove, with the same undo toast.
                     onDelete={
                       canEdit
                         ? (i) => {
diff --git a/frontend/src/components/PlaylistsRail.rename.dom.test.tsx b/frontend/src/components/PlaylistsRail.rename.dom.test.tsx
index cec4806e..45a0366e 100644
--- a/frontend/src/components/PlaylistsRail.rename.dom.test.tsx
+++ b/frontend/src/components/PlaylistsRail.rename.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // The rail's in-row rename, from the keyboard. Enter and Escape unmount the focused field and render
 // the row as a NEW button; without a refocus the keyboard user was dropped on <body> and lost their
-// place (E10 review round 1, measured again in Chrome in E11 S2). Everything around the rail that is
+// place (measured in Chrome). Everything around the rail that is
 // not the rename path is stubbed.
 import { describe, it, expect, vi, afterEach, beforeAll } from "vitest";
 import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
@@ -107,7 +107,7 @@ describe("PlaylistsRail · rename from the keyboard", () => {
   it("Escape cancels and puts the focus back on the row", async () => {
     const field = await openRename();
     fireEvent.change(field, { target: { value: "alpha2" } });
-    // Cancelled: the closing key must not go on to press the row the focus lands on (E28 audit).
+    // Cancelled: the closing key must not go on to press the row the focus lands on.
     expect(fireEvent.keyDown(field, { key: "Escape" })).toBe(false);
     await vi.waitFor(() => expect(document.activeElement).toBe(rowButton()));
     expect(rename).not.toHaveBeenCalled();
@@ -122,7 +122,7 @@ describe("PlaylistsRail · rename from the keyboard", () => {
   });
 });
 
-// E28 C1: the row's "…" opens the same menu as its right-click — the list's one action list.
+// The row's "…" opens the same menu as its right-click — the list's one action list.
 describe("PlaylistsRail · the row's '…'", () => {
   it("opens the playlist's menu under the row, and says so", async () => {
     vi.spyOn(api, "playlists").mockResolvedValue([alpha]);
diff --git a/frontend/src/components/PlaylistsRail.tsx b/frontend/src/components/PlaylistsRail.tsx
index b1983b77..6013690f 100644
--- a/frontend/src/components/PlaylistsRail.tsx
+++ b/frontend/src/components/PlaylistsRail.tsx
@@ -70,7 +70,7 @@ export default function PlaylistsRail({
     { key: "name", label: t("playlists.railSortName"), defaultDir: "asc" },
     { key: "count", label: t("playlists.railSortCount"), defaultDir: "desc" },
     { key: "duration", label: t("playlists.railSortDuration"), defaultDir: "desc" },
-    // E10 S2 — "the one I just touched, first". Reads `updated_at`, which the API bumps for item
+    // "the one I just touched, first". Reads `updated_at`, which the API bumps for item
     // adds/removes/moves/reorders too, not just renames (see the backend's _touch). NOT the
     // default: a rail that reshuffles itself while you look at it costs more than it saves.
     { key: "recent", label: t("playlists.railSortRecent"), defaultDir: "desc" },
@@ -178,9 +178,9 @@ export default function PlaylistsRail({
   });
 
   // Enter and Escape unmount the focused <input> and re-render the row as a NEW <button>, so without
-  // this a keyboard user was dropped on <body> and lost their place in the rail (E10 review round 1).
-  // The row is focused from its ref callback, i.e. as that button attaches: measured in Chrome (E11
-  // S2), a focus issued after the commit sticks and nothing takes it back — the round-1 attempt that
+  // this a keyboard user was dropped on <body> and lost their place in the rail.
+  // The row is focused from its ref callback, i.e. as that button attaches: measured in Chrome, a
+  // focus issued after the commit sticks and nothing takes it back — the first attempt that
   // "never worked" focused before the replacement button existed. Set by Enter/Escape only: a
   // blur-commit means the user put the focus somewhere else on purpose.
   const refocusRowRef = useRef<number | null>(null);
@@ -189,7 +189,7 @@ export default function PlaylistsRail({
   // Opening this field from the context menu used to race the menu's own focus return (floating-ui
   // hands the focus back to the trigger from a microtask queued as the popover unmounts, and the field
   // mounted in that same commit). `MenuItemList` now runs the item's action on a fresh task AFTER that
-  // return, so the field simply mounts and is focused here; measured in Chrome (E11 S2), the field is
+  // return, so the field simply mounts and is focused here; measured in Chrome, the field is
   // focused and survives.
   useEffect(() => {
     if (renamingId !== null) renameInputRef.current?.focus();
diff --git a/frontend/src/components/PlexBrowse.tsx b/frontend/src/components/PlexBrowse.tsx
index 9cf081ac..c65a1cf7 100644
--- a/frontend/src/components/PlexBrowse.tsx
+++ b/frontend/src/components/PlexBrowse.tsx
@@ -120,7 +120,7 @@ export default function PlexBrowse() {
   const sortOptions = plexSortOptions(scope, (k) => t(`plex.sort.${k}`), lang);
   // Same idiom for the search scope-pill: a movie-only scope can't hold the Episode field.
   const fieldState = healPlexField(field, scope);
-  // Discover is the landing (E5 S4); the flat grid is the "Browse all" secondary view. A header search
+  // Discover is the landing; the flat grid is the "Browse all" secondary view. A header search
   // or an added filter is a browse intent → flip to the grid (below); an explicit toggle returns.
   const sub = useHistorySubview<Sub>({ kind: "discover" }, PLEX_SUB_URL);
 
diff --git a/frontend/src/components/PlexCollectionEditor.tsx b/frontend/src/components/PlexCollectionEditor.tsx
index dea1eb37..3533a13d 100644
--- a/frontend/src/components/PlexCollectionEditor.tsx
+++ b/frontend/src/components/PlexCollectionEditor.tsx
@@ -14,7 +14,7 @@ import { Pressable } from "./ui/Pressable";
 import { Input } from "./ui/Input";
 import { SURFACE } from "./ui/surfaces";
 
-// Admin-only "manage this movie's collections" dialog (Collections P2). Lists the library's EDITABLE
+// Admin-only "manage this movie's collections" dialog. Lists the library's EDITABLE
 // collections with an in/out toggle (add/remove the movie, written back to Plex), plus a field to
 // create a new collection seeded with this movie. Read-only collections (smart / IMDb-TMDb auto-lists)
 // never appear here. Opened from the movie info page.
@@ -84,7 +84,7 @@ export default function PlexCollectionEditor({
     } catch (e) {
       // 403/404 are left to the caller by `req` (see reportFailure), so without this the tick
       // simply never appeared and the user clicked again — a collection deleted on the Plex server
-      // or flipped read-only failed in silence (deep-review round 5).
+      // or flipped read-only failed in silence.
       notifyActionError(e, t("plex.collection.editFailed"));
     }
     setBusy(null);
diff --git a/frontend/src/components/PlexCollectionView.dom.test.tsx b/frontend/src/components/PlexCollectionView.dom.test.tsx
index 7bcd337d..7d72d5c4 100644
--- a/frontend/src/components/PlexCollectionView.dom.test.tsx
+++ b/frontend/src/components/PlexCollectionView.dom.test.tsx
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
-// S4 Play-all — buildQueue's show→episode expansion and playAll's decision branch, the honest-states
-// behaviour the deep-review flagged as untested. A leaf member queues as itself; a show member is
+// Play-all — buildQueue's show→episode expansion and playAll's decision branch, the honest-states
+// behaviour a review flagged as untested. A leaf member queues as itself; a show member is
 // expanded (lazily, on click) into its episodes in season→episode order; a show that expands to zero
 // episodes must NOT silently no-op but surface the `playEmpty` info notice. api.plexCollection /
 // api.plexShow are stubbed so the queries resolve synchronously; notify is spied to assert the notice.
@@ -142,7 +142,7 @@ describe("PlexCollectionView — Play-all", () => {
   });
 });
 
-// Bug-hunt deep-review: the Sort control put the sort into the detail query's key, and two things
+// Bug hunt: the Sort control put the sort into the detail query's key, and two things
 // on this page did not follow it.
 describe("PlexCollectionView — after the sort joined the query key", () => {
   it("flips a poster's watched state on the page it was clicked on", async () => {
@@ -212,7 +212,7 @@ describe("PlexCollectionView — after the sort joined the query key", () => {
   });
 });
 
-describe("PlexCollectionView — the reader's language (E30)", () => {
+describe("PlexCollectionView — the reader's language", () => {
   it("asks for the members, and a show it expands, in Hungarian", async () => {
     setLanguage("hu");
     try {
@@ -228,7 +228,7 @@ describe("PlexCollectionView — the reader's language (E30)", () => {
   });
 });
 
-describe("PlexCollectionView — the summary (E30 review)", () => {
+describe("PlexCollectionView — the summary", () => {
   it("offers no More under a summary that fits", async () => {
     vi.spyOn(api, "plexCollection").mockResolvedValue({
       ...detail([card("m1", "movie")]),
diff --git a/frontend/src/components/PlexCollectionView.tsx b/frontend/src/components/PlexCollectionView.tsx
index 59286276..2c2e4b9e 100644
--- a/frontend/src/components/PlexCollectionView.tsx
+++ b/frontend/src/components/PlexCollectionView.tsx
@@ -282,7 +282,7 @@ export default function PlexCollectionView({
             posterDisabled={!canPlay || queueBusy}
             showPlayOverlay={canPlay}
             onPosterClick={() => canPlay && !queueBusy && playAll(false)}
-            // Sized to the text beside it (E31, the owner's pick): a title, one meta line and a short
+            // Sized to the text beside it (the owner's pick): a title, one meta line and a short
             // description sat beside a show-sized poster, two thirds of the hero empty under them.
             posterSizeClass="w-20 sm:w-24"
             customizeMenu={null}
@@ -423,7 +423,7 @@ export default function PlexCollectionView({
                 </div>
               </div>
               {/* Two columns on a phone, like every other poster grid (≥140px a card): three left
-                  an ~85px card whose title shared its line with the touch "…" (E28 C1). */}
+                  an ~85px card whose title shared its line with the touch "…". */}
               <NavGrid className="grid grid-cols-2 gap-3 sm:grid-cols-4 md:grid-cols-5 lg:grid-cols-6">
                 {items.map((c, i) => (
                   <PlexPosterCard
@@ -451,7 +451,7 @@ export default function PlexCollectionView({
           canEdit
             ? [
                 {
-                  // A write to the shared Plex library: a menu row since E28 C1 (the card's hover
+                  // A write to the shared Plex library: a menu row (the card's hover
                   // row owns its corner now), still behind the confirmation in `doRemove`.
                   id: "collection-remove",
                   label: t("plex.collection.removeItem"),
diff --git a/frontend/src/components/PlexDiscover.dom.test.tsx b/frontend/src/components/PlexDiscover.dom.test.tsx
index c874d782..63c4ace6 100644
--- a/frontend/src/components/PlexDiscover.dom.test.tsx
+++ b/frontend/src/components/PlexDiscover.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E5 S4: the Plex Discover landing. Covers the rail surface served from the mocked /discover +
+// The Plex Discover landing. Covers the rail surface served from the mocked /discover +
 // /surprise calls — that each non-empty rail renders, the genre tile fires onGenre, the recently-added
 // "see all" fires onSeeAllRecent, the ↻ reshuffle refetches the surprise rail alone, and an all-empty
 // payload shows the empty message. i18n is key-passthrough; the api is mocked so queries resolve
@@ -272,7 +272,7 @@ describe("PlexDiscover", () => {
   });
 });
 
-// E11 S4b: every rail and the genre grid are lists the keyboard walks (lib/listNav), so `j` goes on
+// Every rail and the genre grid are lists the keyboard walks (lib/listNav), so `j` goes on
 // from one to the next in page order (owner decision D4).
 describe("PlexDiscover · keyboard", () => {
   it("registers every rail and the genre grid, and j walks on from rail to rail", async () => {
diff --git a/frontend/src/components/PlexDiscover.tsx b/frontend/src/components/PlexDiscover.tsx
index 55a79075..00d6c2d8 100644
--- a/frontend/src/components/PlexDiscover.tsx
+++ b/frontend/src/components/PlexDiscover.tsx
@@ -17,7 +17,7 @@ import { LoadingState, StateMessage } from "./ui/QueryState";
 import NavGrid from "./ui/NavGrid";
 import { IconButton } from "./ui/IconButton";
 
-// The Plex "Discover" landing (E5 S4): a stack of horizontal Carousel rails served from ONE
+// The Plex "Discover" landing: a stack of horizontal Carousel rails served from ONE
 // /api/plex/discover call — Continue watching, Recently added, Browse by genre (tiles), Because you
 // watched X — plus a separately-fetched, reshuffling Surprise-me rail. The flat browse grid stays its
 // own view (PlexBrowse's grid branch); a header search or filter flips the user there. Card click /
diff --git a/frontend/src/components/PlexInfo.dom.test.tsx b/frontend/src/components/PlexInfo.dom.test.tsx
index 70a55c88..556f03cb 100644
--- a/frontend/src/components/PlexInfo.dom.test.tsx
+++ b/frontend/src/components/PlexInfo.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E5 S5: the enriched Plex detail page. Covers the TMDB-fed pieces added on the page variant — the
+// The enriched Plex detail page. Covers the TMDB-fed pieces added on the page variant — the
 // multi-source ratings row (IMDb / TMDb / audience), the facts panel (budget / revenue / studios /
 // countries), the keyword chips (→ onFilter), and the full crew (→ onOpenPerson). i18n is
 // key-passthrough; PlexInfo is prop-driven (no queries) so it just needs a QueryClient for its cache
@@ -104,7 +104,7 @@ describe("PlexInfo enriched detail (page)", () => {
     expect(screen.getByText("$160M")).toBeTruthy();
     expect(screen.getByText("$830M")).toBeTruthy();
     expect(screen.getByText("Studio A")).toBeTruthy(); // tmdb.studios preferred over the fallback
-    // E30: a coded country is named through the vocab (key-echo i18n here), an uncoded one as stored.
+    // A coded country is named through the vocab (key-echo i18n here), an uncoded one as stored.
     expect(screen.getByText("vocab.region.HU, United States")).toBeTruthy();
   });
 
@@ -115,7 +115,7 @@ describe("PlexInfo enriched detail (page)", () => {
     expect(onFilter).toHaveBeenCalledWith({ keywords: ["heist"] });
   });
 
-  // E28: every value that filters says so on hover — the genre, certificate and studio had no hint
+  // Every value that filters says so on hover — the genre, certificate and studio had no hint
   // while the keyword and the year did — and a value filters in the facts panel as in the header.
   it("every filtering value carries a filter hint", () => {
     wrap(<PlexInfo onPlayItem={noop} detail={detail} variant="page" onFilter={() => {}} />);
@@ -139,7 +139,7 @@ describe("PlexInfo enriched detail (page)", () => {
     const onOpenPerson = vi.fn();
     wrap(<PlexInfo onPlayItem={noop} detail={detail} variant="page" onOpenPerson={onOpenPerson} />);
     expect(screen.getByText("plex.info.crew")).toBeTruthy();
-    // E30: the job is TMDB's English word, named through the vocab (key-echo i18n here).
+    // The job is TMDB's English word, named through the vocab (key-echo i18n here).
     expect(screen.getByText("vocab.crewJob.Director")).toBeTruthy();
     fireEvent.click(screen.getByText("Jane Director"));
     expect(onOpenPerson).toHaveBeenCalledWith("Jane Director");
@@ -173,9 +173,9 @@ describe("PlexInfo enriched detail (page)", () => {
   });
 });
 
-// E28 S3h, the owner's layout B: a main column (collection strips → crew → cast) beside a sidebar of
+// The owner's layout: a main column (collection strips → crew → cast) beside a sidebar of
 // facts (details, keywords); a column with nothing in it is not rendered and the other takes the width.
-// E31 (the owner's pick "A"): the hero's text stopped at ~55% of the panel. The facts and the key crew are
+// The owner's pick: the hero's text stopped at ~55% of the panel. The facts and the key crew are
 // its second column now (a grid that splits in a wide hero), the keywords sit under the text, and under
 // the hero only the collection strips and the cast remain, stacked.
 describe("PlexInfo — the hero's second column (page)", () => {
@@ -252,7 +252,7 @@ describe("PlexInfo — the hero's second column (page)", () => {
     expect(follows(heading("Test Movie"), kw)).toBe(true);
   });
 
-  // E31: the hero's grid row is as tall as its taller column — the crew, beside the text — and the poster,
+  // The hero's grid row is as tall as its taller column — the crew, beside the text — and the poster,
   // a flex child, stretched to it: a 2:3 picture drawn ~175×590 and cropped. It keeps its own ratio.
   it("keeps the poster at its own height, not stretched to the row", () => {
     wrap(<PlexInfo onPlayItem={noop} detail={full} variant="page" />);
@@ -261,7 +261,7 @@ describe("PlexInfo — the hero's second column (page)", () => {
     expect(poster.className.split(/\s+/)).toContain("self-start");
   });
 
-  // E31 (the owner's call): twelve names ran the column ~170px past the text. The first CREW_SHOWN show,
+  // The owner's call: twelve names ran the column ~170px past the text. The first CREW_SHOWN show,
   // the rest behind "Show N more"; a list barely longer shows whole.
   it("shows the first crew names and opens the rest on demand", () => {
     const crew = Array.from({ length: 12 }, (_, i) => ({ name: `Person ${i}`, job: "Producer" }));
@@ -301,7 +301,7 @@ describe("PlexInfo — the hero's second column (page)", () => {
     expect(screen.queryByRole("button", { name: "plex.info.crewMore" })).toBeNull();
   });
 
-  // E32 S2: the cast row is the shared CastRow now; the page and the player's overlay hand it their
+  // The cast row is the shared CastRow now; the page and the player's overlay hand it their
   // own palette. Only the overlay sits on the dark art, so only it may carry the white text.
   it.each([
     ["page", false],
@@ -313,7 +313,7 @@ describe("PlexInfo — the hero's second column (page)", () => {
   });
 });
 
-// E28 review D1 + D2: a collection sibling is a Plex card like any other — its "…" menu, its watched
+// A collection sibling is a Plex card like any other — its "…" menu, its watched
 // toggle and its playlist add, as on the related strip — where it used to be a Play and nothing else.
 describe("a collection strip's card", () => {
   beforeAll(() => {
diff --git a/frontend/src/components/PlexInfo.tsx b/frontend/src/components/PlexInfo.tsx
index 1242b324..9bca97cb 100644
--- a/frontend/src/components/PlexInfo.tsx
+++ b/frontend/src/components/PlexInfo.tsx
@@ -38,7 +38,7 @@ import { vocab } from "../lib/vocab";
 // a card's "i" button (variant="page", with a big Play/Resume + watch controls), and a lean overlay
 // over the running player (variant="overlay", opened with "i"). Two GUI elements are user-toggleable
 // personal preferences, persisted in users.preferences: the faint art backdrop and the cast row.
-// The TMDB-enriched pieces (multi-source ratings row, facts, keyword chips, full crew — E5 S5) render
+// The TMDB-enriched pieces (multi-source ratings row, facts, keyword chips, full crew) render
 // on the page variant only; the overlay stays lean.
 
 // One rating chip's number: a filter button when this is the score the backend's ratingMin column
@@ -74,7 +74,7 @@ function Score({
   );
 }
 
-// Multi-source ratings cluster (E5 S5): IMDb (links out) · TMDb (with vote count) · Plex audience —
+// Multi-source ratings cluster: IMDb (links out) · TMDb (with vote count) · Plex audience —
 // whichever are present. The "primary" score (IMDb, else audience) mirrors the backend rating column
 // (coalesce(imdb, audience)), so only it carries the ratingMin filter; the others are informational.
 function RatingsRow({
@@ -181,8 +181,7 @@ type Props = {
   // When provided, a cast member's photo/name opens their filmography page instead of filtering.
   onOpenPerson?: (name: string) => void;
   // Play a sibling title from a collection strip: the page opens its player, the overlay plays it
-  // in the running one. Required, so no variant draws a collection card whose Play does nothing
-  // (E28 review D1).
+  // in the running one. Required, so no variant draws a collection card whose Play does nothing.
   onPlayItem: (id: string, fromStart?: boolean) => void;
   // The item's library key — enables the admin "Manage collections" editor (page variant, movies).
   library?: string;
@@ -229,7 +228,7 @@ export default function PlexInfo({
   const [playlistOpen, setPlaylistOpen] = useState(false);
 
   // Faint art backdrop, HTPC-style (page variant only) — cross-dissolves through the item's own art,
-  // its TMDB backdrops (E5 S2), and its collection siblings' art (E5 S8). Cleared in the overlay
+  // its TMDB backdrops, and its collection siblings' art. Cleared in the overlay
   // variant / when disabled / on unmount.
   const backdropPool = [
     detail.art,
@@ -251,7 +250,7 @@ export default function PlexInfo({
     onStateChange?.();
   };
 
-  // A collection sibling is a Plex card like any other (E28 review D2): the related strip's menu, its
+  // A collection sibling is a Plex card like any other: the related strip's menu, its
   // watched toggle and its playlist add. The flip lands on this item's cached detail, whose strip it
   // is; the resync corrects it to the truth either way.
   const colMenu = useContextMenu<PlexCard>();
@@ -416,7 +415,7 @@ export default function PlexInfo({
                   <PlaybackChip detail={detail} overlay={overlay} />
                 </div>
 
-                {/* Multi-source ratings row (E5 S5): IMDb / TMDb / audience, whichever are present. */}
+                {/* Multi-source ratings row: IMDb / TMDb / audience, whichever are present. */}
                 <div className="mt-2">
                   <RatingsRow
                     imdbRating={detail.imdb_rating}
@@ -539,7 +538,7 @@ export default function PlexInfo({
 
         {/* Below the hero: the collection strips first (the owner's most used), then the cast, each
             per-user toggleable, stacked so a hidden one leaves no hole. The facts / keywords / crew that
-            sat beside them (E28 S3h) moved up into the hero's second column (E31). The overlay (over
+            sat beside them moved up into the hero's second column. The overlay (over
             the running player) is the same stack, lean. */}
         {(() => {
           const collections = (detail.collections ?? []).filter(
@@ -568,7 +567,7 @@ export default function PlexInfo({
               </div>
               <Carousel ariaLabel={col.title} gap="gap-3" keyboardNav>
                 {col.items.map((m, i) => (
-                  // The one media card, as on every other strip (E28 S3h). A grid cell, so the
+                  // The one media card, as on every other strip. A grid cell, so the
                   // card fills the slot the carousel stretches to its tallest card.
                   <div key={m.id} className="grid w-37.5 shrink-0 grid-cols-1">
                     <PlexPosterCard
diff --git a/frontend/src/components/PlexMenu.dom.test.tsx b/frontend/src/components/PlexMenu.dom.test.tsx
index 5ae5d027..cb79aa1b 100644
--- a/frontend/src/components/PlexMenu.dom.test.tsx
+++ b/frontend/src/components/PlexMenu.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 C1: a Plex title's ONE action list. The poster's right-click and its "…" open the same menu,
+// A Plex title's ONE action list. The poster's right-click and its "…" open the same menu,
 // which holds what the card no longer shows (details, copy, the pin) beside the everyday toggles;
 // the card's hover "add" and the menu's "Add to playlist" open the same dialog.
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
diff --git a/frontend/src/components/PlexPersonView.dom.test.tsx b/frontend/src/components/PlexPersonView.dom.test.tsx
index 4adbaef2..b6e2acb0 100644
--- a/frontend/src/components/PlexPersonView.dom.test.tsx
+++ b/frontend/src/components/PlexPersonView.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E5 S4: the actor detail page. Covers the two pieces the /code-review flagged as untested — the
+// The actor detail page. Covers the two pieces the /code-review flagged as untested — the
 // cast-row rewiring (a cast click now OPENS the person page via onOpenPerson, falling back to the old
 // filter gesture only when no onOpenPerson is wired) and PlexPersonView's render (headshot/name hero,
 // the Movies/Shows sections, and the "filter library by this person" action). i18n is key-passthrough
@@ -117,11 +117,11 @@ describe("PlexPersonView", () => {
     expect(screen.getByText("plex.person.movies")).toBeTruthy(); // section headings (key passthrough)
     expect(screen.getByText("plex.person.shows")).toBeTruthy();
 
-    // E5 S6 bio hero: department, biography, birth facts, aka.
-    // E30: TMDB's English department, named through the vocab (key-echo i18n here).
+    // The bio hero: department, biography, birth facts, aka.
+    // TMDB's English department, named through the vocab (key-echo i18n here).
     expect(screen.getByText("vocab.department.Acting")).toBeTruthy();
     expect(screen.getByText("A celebrated actor.")).toBeTruthy();
-    // E30 S3: the birth date as a date in the UI language, not the raw ISO string
+    // The birth date as a date in the UI language, not the raw ISO string
     expect(screen.getByText("Jan 1, 1970 · Springfield")).toBeTruthy();
     expect(screen.getByText(/plex\.person\.aka/)).toBeTruthy();
     expect(screen.getByText(/Janie D/)).toBeTruthy();
@@ -157,7 +157,7 @@ describe("PlexPersonView", () => {
   });
 });
 
-describe("PlexPersonView — the reader's language (E30)", () => {
+describe("PlexPersonView — the reader's language", () => {
   it("asks for the filmography in Hungarian", async () => {
     setLanguage("hu");
     try {
@@ -189,7 +189,7 @@ describe("PlexPersonView — the reader's language (E30)", () => {
 
 const BIO_POLL = 1600; // just past plexViews' BIO_POLL_MS
 
-describe("PlexPersonView — a bio on its way (E30 S6)", () => {
+describe("PlexPersonView — a bio on its way", () => {
   const view = (
     <PlexPersonView
       name="Jane Doe"
@@ -320,7 +320,7 @@ describe("PlexPersonView — a bio on its way (E30 S6)", () => {
   });
 });
 
-describe("PlexPersonView — the hero's columns (E30 S6)", () => {
+describe("PlexPersonView — the hero's columns", () => {
   const heroGrid = async (knownFor: number) => {
     plexPerson.mockReset();
     plexPerson.mockResolvedValue({
diff --git a/frontend/src/components/PlexPlayer.backspace.dom.test.tsx b/frontend/src/components/PlexPlayer.backspace.dom.test.tsx
index 8983176e..3ec0d3a0 100644
--- a/frontend/src/components/PlexPlayer.backspace.dom.test.tsx
+++ b/frontend/src/components/PlexPlayer.backspace.dom.test.tsx
@@ -5,7 +5,7 @@
 // player's OWN menus push layers, so ⌫ stopped closing them), then naming just the sheet and the
 // palette (the app-wide ErrorDialog is neither, so ⌫ tore the player down under it). The rule that
 // holds: the player's own panels answer first; anything else layered above it takes the key. It had
-// no test (E10 review coverage debt).
+// no test.
 import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
 import { render, cleanup, waitFor, act } from "@testing-library/react";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
diff --git a/frontend/src/components/PlexPlayer.controls.dom.test.tsx b/frontend/src/components/PlexPlayer.controls.dom.test.tsx
index 43a60a9d..f02d71cf 100644
--- a/frontend/src/components/PlexPlayer.controls.dom.test.tsx
+++ b/frontend/src/components/PlexPlayer.controls.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The Plex player's controls on touch and the C5 control set (DESIGN "Players", E28 S3f2): a tap on
+// The Plex player's controls on touch and the C5 control set (DESIGN "Players"): a tap on
 // the picture only shows or hides the controls, a double-tap on a side third skips 10 s, Back goes by
 // position, Next exists only with a next item, the rare tools sit behind a fixed ⋯, and the card's
 // Restart opens the player at 0. jsdom has no media pipeline: the <video> is stubbed as in
@@ -226,7 +226,7 @@ describe("a tap on the picture (C3)", () => {
   });
 });
 
-// E28 review E6: the volume slider counted as a text field, so its arrows never woke the bands — the
+// The volume slider counted as a text field, so its arrows never woke the bands — the
 // bar faded from under a keyboard user adjusting it — and nothing held the bands while a key-focused
 // control sat in them.
 describe("keyboard focus in the bands", () => {
@@ -436,7 +436,7 @@ describe("a double-tap on a side third skips 10 s (C5)", () => {
     expect(session.mock.calls.length).toBe(calls);
   });
 
-  // E28 review E5: the tap that brings the bands back must not hand the SECOND tap to them — a double-tap
+  // The tap that brings the bands back must not hand the SECOND tap to them — a double-tap
   // at the bottom would land on the seek bar (a seek to wherever the finger was) instead of the skip.
   it("a tap that reveals the bands keeps them out of the finger's way for the double-tap window", async () => {
     mount({ details: { A: item("A") } });
@@ -464,7 +464,7 @@ describe("a double-tap on a side third skips 10 s (C5)", () => {
   });
 });
 
-// E28 review D1: the info overlay drew its collection siblings with a Play that did nothing — the
+// The info overlay drew its collection siblings with a Play that did nothing — the
 // overlay had no way to play one. It plays it in this player, at its resume point or from the start.
 describe("a collection sibling in the info overlay", () => {
   const withSibling = (id: string): PlexItemDetail => ({
@@ -671,7 +671,7 @@ describe("the C5 row", () => {
     expect(screen.getByLabelText("plex.player.more").getAttribute("aria-expanded")).toBe("true");
   });
 
-  // E28 review D3: the ⋯ was a hand-built <div> of buttons — no menu role, no arrow keys, and Escape
+  // The ⋯ was a hand-built <div> of buttons — no menu role, no arrow keys, and Escape
   // closed it with the focus left on <body>. It is a menu on the popover engine now.
   it("↑/↓ on the closed ⋯ and tracks buttons are the volume, not an open menu", async () => {
     const two = item("A");
@@ -742,7 +742,7 @@ describe("the C5 row", () => {
     await waitFor(() => expect(document.activeElement).toBe(more));
   });
 
-  // E28 review E4: an episode's Next comes from its detail, which is unknown while the next episode
+  // An episode's Next comes from its detail, which is unknown while the next episode
   // loads — the button unmounted from under the focus that had just pressed it (focus on <body>).
   it("Next keeps the focus while the next item's detail loads", async () => {
     let arrive: (d: PlexItemDetail) => void = () => {};
diff --git a/frontend/src/components/PlexPlayer.hls.dom.test.tsx b/frontend/src/components/PlexPlayer.hls.dom.test.tsx
index 7377fa7a..e740ed1d 100644
--- a/frontend/src/components/PlexPlayer.hls.dom.test.tsx
+++ b/frontend/src/components/PlexPlayer.hls.dom.test.tsx
@@ -158,7 +158,7 @@ describe("an HLS session the server no longer has", () => {
     // so a session that parses its manifest and then 404s re-arms the guard every cycle. The server
     // also answers 404 for "that segment is not there YET" (a transcode falling behind realtime),
     // which is indistinguishable on the wire — so the player respawned ffmpeg forever behind a
-    // spinner that never became an error (round 5).
+    // spinner that never became an error.
     const session = mount();
     const v = () => document.querySelector("video") as Media;
     // The first session plus the two it is allowed to reclaim; the third 404 has nothing left.
@@ -178,7 +178,7 @@ describe("an HLS session the server no longer has", () => {
     // The budget used to be cleared by the first FRAG_LOADED of any session — and a reclaimed
     // session essentially always delivers one, because `start_session` does not return until its
     // first segment exists. So it bounded NEITHER case its own comment named: measured at 40 loss
-    // cycles, the player opened 41 sessions and never showed an error (deep-review round 6). A
+    // cycles, the player opened 41 sessions and never showed an error. A
     // fragment is not proof the session can be served; surviving the window is.
     const session = mount();
     const v = () => document.querySelector("video") as Media;
@@ -227,7 +227,7 @@ describe("an HLS session the server no longer has", () => {
     // loss and the bound never bit: a transcode falling ~70s behind realtime — the case the ERROR
     // handler itself names — reclaimed forever (measured: 200 losses 70s apart → 200 reclaims,
     // never an error). The two cases above space their losses 0s and 10min apart, i.e. both sit
-    // outside the 60–120s band where the defect lived (deep-review round 7).
+    // outside the 60–120s band where the defect lived.
     vi.useFakeTimers({ shouldAdvanceTime: true, toFake: ["Date"] });
     try {
       const session = mount();
diff --git a/frontend/src/components/PlexPlayer.session.dom.test.tsx b/frontend/src/components/PlexPlayer.session.dom.test.tsx
index cbb3d66e..6d6b4870 100644
--- a/frontend/src/components/PlexPlayer.session.dom.test.tsx
+++ b/frontend/src/components/PlexPlayer.session.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The Plex player's session lifecycle, rendered for real (deep-review round 3 of bug hunt 2026-09).
+// The Plex player's session lifecycle, rendered for real.
 //
 // jsdom has no media pipeline, so the <video> is a small stand-in that behaves like Chrome where it
 // matters here: `pause()` fires its `timeupdate` in a LATER task (measured in Chrome — which is how the
@@ -279,7 +279,7 @@ it("shows a toast raised while it is open inside itself, not under its scrim", a
   expect(host).not.toBe(document.body); // the player's own host, beside its <video>
 });
 
-// --- deep-review round 4 ------------------------------------------------------------------------
+// --- leaving a played-through item, restarts, failed requests -----------------------------------
 
 /** A session answer that FAILS when the test says so. */
 function deferredFailure() {
@@ -300,8 +300,7 @@ describe("leaving an item that was played through", () => {
 
   // The end of the media, in the order the HTML spec mandates: the browser sets `paused`, fires
   // 'pause', and only THEN fires 'ended'. Dispatching a bare 'ended' models a browser that does not
-  // exist, and hid the fact that the pause checkpoint goes out before the finish latch is up
-  // (deep-review round 5).
+  // exist, and hid the fact that the pause checkpoint goes out before the finish latch is up.
   const endMedia = () => {
     const el = video();
     Object.defineProperty(el, "ended", { configurable: true, get: () => true });
@@ -361,7 +360,7 @@ describe("leaving an item that was played through", () => {
     // The mark was fired and forgotten (`.catch(() => {})`) while the cache was patched to
     // watched / position 0 regardless, and the once-per-id start guard meant the corrected detail
     // arriving later was never used: the episode reopened at 0:00 with a Watched badge the server
-    // disagreed with (round 5).
+    // disagreed with.
     prefs({ upNext: false });
     const { qc, progress } = mount({
       details: { A: item("A"), B: item("B") },
@@ -379,19 +378,19 @@ describe("leaving an item that was played through", () => {
     // And the rollback does NOT write the position back. 2995 of 3000 is inside the backend's
     // finish margin, so that checkpoint would have set watched / position 0 and scrobbled to Plex
     // — performing, through a second route, the very write that was just refused, while the error
-    // toast said it had failed (round 6). There is no resume point at the end of the media to
+    // toast said it had failed. There is no resume point at the end of the media to
     // restore; the cache drop is the whole of the rollback here.
     expect(progress.mock.calls.filter(([id, , , final]) => id === "A" && final)).toEqual([]);
   });
 
   it("performs the refused mark through no OTHER route while it stays on the finished item", async () => {
-    // Round 6 guarded the explicit rollback write, but the same catch lowered the play-through
+    // A fix guarded the explicit rollback write, but the same catch lowered the play-through
     // latch — and that latch is the only gate on the 10s interval, the page-hide beacon and
     // `settle`. All three post `absRef`, which on this path IS the end of the media, and the
     // backend reads a position within `_FINISH_MARGIN_S` of the duration as a finish: within ten
     // seconds of the toast saying the mark had failed, the item was watched, its position cleared
-    // and a scrobble sent to Plex (deep-review round 7). `upNext` is ON here — the default — so the
-    // player STAYS on the finished item and those routes are live; the round-6 test above turns it
+    // and a scrobble sent to Plex. `upNext` is ON here — the default — so the
+    // player STAYS on the finished item and those routes are live; the test above turns it
     // off, which tears the effect down before any of them can fire.
     prefs({ upNext: true });
     const beacon = vi.spyOn(api, "plexProgressBeacon").mockImplementation(() => {});
@@ -467,7 +466,7 @@ describe("leaving an item that was played through", () => {
   it("records a second viewing when the viewer plays on from the finished frame", async () => {
     // `finished` is a latch that makes every checkpoint a no-op; the only thing that lowers it is
     // the video's own 'play' event. Nothing tested that, so dropping the listener would have
-    // discarded a whole rewatch with the gate green (round 5).
+    // discarded a whole rewatch with the gate green.
     prefs({ upNext: true });
     const { progress } = mount({
       details: { A: item("A"), B: item("B") },
diff --git a/frontend/src/components/PlexPlayer.tabtrap.dom.test.tsx b/frontend/src/components/PlexPlayer.tabtrap.dom.test.tsx
index e4dabf25..cad8435c 100644
--- a/frontend/src/components/PlexPlayer.tabtrap.dom.test.tsx
+++ b/frontend/src/components/PlexPlayer.tabtrap.dom.test.tsx
@@ -1,11 +1,11 @@
 // @vitest-environment jsdom
 //
-// The Plex player paints an opaque, full-viewport layer over the whole app — and until deep-review
-// round 4 it was the only overlay in the tree with no Tab trap at all. Tab from its transport bar,
+// The Plex player paints an opaque, full-viewport layer over the whole app — and for a long
+// time it was the only overlay in the tree with no Tab trap at all. Tab from its transport bar,
 // from its menus, or from the debug recorder's pill (which docks in THIS player's toast host) walked
 // straight out into the page behind it, where the focus ring is invisible and the next Enter fires
 // something the user cannot see. `ui/Modal`, `PlayerModal`, `OnboardingWizard` and `Welcome` all trap;
-// the round-3 comment that handed the step prompt's trap to "the dialog below" assumed this one did
+// an earlier comment that handed the step prompt's trap to "the dialog below" assumed this one did
 // too. Its own file because `layerStack` is module state and these tests push into it.
 import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
 import { render, cleanup, waitFor, act, screen } from "@testing-library/react";
diff --git a/frontend/src/components/PlexPlayer.tsx b/frontend/src/components/PlexPlayer.tsx
index 23f382b0..787907e7 100644
--- a/frontend/src/components/PlexPlayer.tsx
+++ b/frontend/src/components/PlexPlayer.tsx
@@ -114,7 +114,7 @@ const PLAYER_MENU =
   "rounded-xl border border-white/15 bg-media-chrome/95 text-sm text-white shadow-2xl";
 const PLAYER_ROW = "block w-full rounded-lg px-2 py-1.5 text-left hover:bg-white/10";
 // A track choice: the chosen one wears the tick in the leading slot (DESIGN "one of several"), which
-// the highlight's white text cannot wash out the way it did the accent-coloured label (round 2, P6).
+// the highlight's white text cannot wash out the way it did the accent-coloured label.
 const TRACK_ROW =
   "flex w-full min-h-9 items-center gap-2 rounded-lg px-2 py-1.5 text-left hover:bg-white/10";
 const TAP_SKIP_S = 10;
@@ -139,12 +139,12 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
   // rebuilt loadSession → re-ran the detail effect → reloaded the session from the STALE saved resume
   // position (losing live progress). See the detail effect's deps.
   const tRef = useLatest(t);
-  // E30: a track named in the reader's language (lib/vocab), not in the Plex server's ("English (AC3 5.1)").
+  // A track named in the reader's language (lib/vocab), not in the Plex server's ("English (AC3 5.1)").
   const audioName = (a: PlexTrackNaming) => trackLabel(t, a, "audio", i18n.language);
   const subtitleName = (x: PlexTrackNaming) => trackLabel(t, x, "subtitle", i18n.language);
   const qc = useQueryClient();
   const [id, setId] = useState(itemId);
-  // Serve the player's title/summary/rich detail in the active language (E5 S6), matching the grid.
+  // Serve the player's title/summary/rich detail in the active language, matching the grid.
   const lang = plexLang(i18n.language);
   const detailQ = useQuery({
     queryKey: qk.plexItem(id, lang),
@@ -160,7 +160,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
   const aliveRef = useRef(true);
   const wrapRef = useRef<HTMLDivElement>(null);
   // A control that goes while it holds the focus — Next onto the last item or a series finale —
-  // hands it to its neighbour instead of <body> (round 2, P5). The player is portaled outside the
+  // hands it to its neighbour instead of <body>. The player is portaled outside the
   // page scroller, whose keeper does not watch it.
   useFocusKeeper(wrapRef);
   const sessionStartRef = useRef(0); // absolute offset the current HLS/direct session begins at
@@ -185,7 +185,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
   // Whether the session being asked for plays once it can — null while none is out. Set from
   // loadSession's `resumePlay` and then the viewer's to change: until the answer attaches, the media
   // is the OUTGOING one, and a play() there sounded the old stream while the new one still attached
-  // paused (E28 review round 4). `said`: the viewer changed it, so it is what they now see.
+  // paused. `said`: the viewer changed it, so it is what they now see.
   const pendingPlayRef = useRef<{ play: boolean; said?: boolean } | null>(null);
   // The key of the last press that landed on faded bands, while it is held (see onKey).
   const blindKeyRef = useRef<string | null>(null);
@@ -279,7 +279,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
     videoRef,
   });
   // The pointer resting on either band holds the controls up (F22), and so does a keyboard focus in
-  // one (E6) — not the focus a click leaves on a button, which would pin the bar until the next click;
+  // one — not the focus a click leaves on a button, which would pin the bar until the next click;
   // `:focus-visible` is the browser's own "this focus came from the keyboard". Both bands wear these.
   const holdWhileHovered = {
     "data-player-band": "", // what a key on a faded-out control is told apart by (onKey, below)
@@ -294,7 +294,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
   // It renders inside the player, whose Tab trap spans it; the ⋯ counts as inside, since the ⋯ is
   // what closes it (below).
   useDismiss(menuOpen, () => setMenuOpen(false), [menuRef, menuTriggerRef]);
-  // The ⋯ and the tracks list are real menus on the popover engine (E28 review D3): roving arrows,
+  // The ⋯ and the tracks list are real menus on the popover engine: roving arrows,
   // Home/End, Escape as a layer, and the focus back on the trigger however they close. They were
   // hand-built <div>s — no roles, no arrows, and Escape left the focus on <body>. The engine portals
   // them into the fullscreen element when there is one, so they show in fullscreen too.
@@ -335,8 +335,8 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
   const helpOpen = useKeyboardHelpOpen();
   const helpOpenRef = useLatest(helpOpen);
 
-  // On-screen confirmation for a KEYBOARD track switch. A/S have cycled audio and subtitles since
-  // E5, but silently — you changed the track and the only way to see what you landed on was to open
+  // On-screen confirmation for a KEYBOARD track switch. A/S have long cycled audio and
+  // subtitles, but silently — you changed the track and the only way to see what you landed on was to open
   // the tracks menu, which is exactly the modal round-trip the shortcut exists to avoid. The menu
   // itself needs no OSD: it shows the selection where you clicked.
   const [osd, setOsd] = useState<string | null>(null);
@@ -358,7 +358,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
   // "D" toggles the stats-for-nerds debug overlay (active mode, codec, dropped frames, buffer…).
   const [statsOpen, setStatsOpen] = useState(false);
   const statsOpenRef = useLatest(statsOpen);
-  // Up-next end-card: shown at episode end (with a next item) instead of an instant jump (S4).
+  // Up-next end-card: shown at episode end (with a next item) instead of an instant jump.
   const [upNextOpen, setUpNextOpen] = useState(false);
   const upNextOpenRef = useLatest(upNextOpen);
   const upNextPrefRef = useLatest(prefs.upNext);
@@ -540,7 +540,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
         // server also answers 404 for "that segment is not there YET" — indistinguishable from "the
         // session is gone" on the wire — so a transcode that falls behind realtime, or two viewers of
         // one item taking turns reclaiming its session, restarted ffmpeg forever behind a spinner
-        // that never became an error (deep-review round 5). A couple of reclaims is what a genuine
+        // that never became an error. A couple of reclaims is what a genuine
         // reap needs; past that the honest answer is that playback failed.
         hls.on(Hls.Events.ERROR, (_e, data) => {
           // Fatal ones are what the user saw fail; the recoverable ones hls.js retries by itself
@@ -568,8 +568,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
             // longer than half the window satisfied the reset on every second loss, so the budget
             // never reached its bound and the reclaim loop it exists to end ran forever (measured:
             // 200 losses 70s apart → 200 reclaims, never an error; 5s apart → 2 and an error, which
-            // is why the committed test, spacing its cases 0s and 10min apart, could not see it —
-            // deep-review round 7).
+            // is why the committed test, spacing its cases 0s and 10min apart, could not see it).
             if (now - restartsRef.current.at > RECLAIM_WINDOW_MS) restartsRef.current.n = 0;
             restartsRef.current.at = now;
             if (restartsRef.current.n < MAX_SESSION_RECLAIMS) {
@@ -652,7 +651,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
   // reconnect (Wi-Fi blips, the query is stale after 30 s and every checkpoint moved the position),
   // the in-player info panel invalidates it after a watched toggle, a language switch fetches it
   // again. Keyed on its identity, each of those restarted the film at the last saved checkpoint — or
-  // at 0 after marking it watched (deep-review round 4). The trade-off: a detail that was stale in
+  // at 0 after marking it watched. The trade-off: a detail that was stale in
   // the cache when the player opened is not corrected by the refetch that follows; the player's own
   // leave-patch (usePlexProgress) keeps the cache honest for everything played here.
   const startedForRef = useRef<string | null>(null);
@@ -878,7 +877,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
       if (otherId && otherId === id) {
         // The item already playing (the info overlay's collection strip lists the film itself):
         // nothing to switch to. The switch below would pause it and stop trusting its clock, and
-        // `setId` to the same id loads nothing — a frozen 0:00 (E28 review round 2, P1). The play
+        // `setId` to the same id loads nothing — a frozen 0:00. The play
         // intent goes INTO the seek: a paused film whose session starts past 0 restarts the session,
         // and a play() beside that resumed the outgoing stream while the new one stayed paused.
         if (fromZero) seekTo(0, true);
@@ -927,7 +926,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
     : detail?.next_id;
   // Whether the row has a Next. An episode's next is in its detail, unknown while the next episode
   // loads; the slot keeps its last answer meanwhile (a disabled Next), because the button unmounting
-  // took the focus that had just pressed it to <body> (E28 review E4). Adjusted during render.
+  // took the focus that had just pressed it to <body>. Adjusted during render.
   const nextKnown = queue || !detailQ.isPending ? !!nextId : undefined;
   const [nextSlot, setNextSlot] = useState(false);
   if (nextKnown !== undefined && nextKnown !== nextSlot) setNextSlot(nextKnown);
@@ -952,7 +951,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
     null,
   );
   // A tap that brings the bands back keeps them out of the pointer's way until a double-tap can no
-  // longer follow (E28 review E5): the second tap of a skip at the bottom would otherwise land on the
+  // longer follow: the second tap of a skip at the bottom would otherwise land on the
   // band the first one just revealed — the seek bar, a seek to wherever the finger was.
   const [tapShield, setTapShield] = useState(false);
   const tapShieldTimer = useRef<number | undefined>(undefined);
@@ -1082,7 +1081,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
       // the server refuses the mark, in which case `finish` takes itself back (see usePlexProgress).
       finishProgress(watchedWrite);
       // With a next item and the up-next pref on, surface the end-card (poster + countdown + Cancel)
-      // and let IT advance — binge stays in the viewer's control (S4/D6-A). The card only appears here,
+      // and let IT advance — binge stays in the viewer's control. The card only appears here,
       // on play-to-the-end; credits-auto-skip advances earlier and this handler never fires for it.
       if (nextId && upNextPrefRef.current) setUpNextOpen(true);
       else if (nextId) go(nextId);
@@ -1145,7 +1144,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
   // Its toast host's rank among open overlays (see ui/Toaster).
   const overlayOrder = useOverlayOrder();
   // This player is a dismissable layer: register it so a Modal or popover opened ABOVE it (its own
-  // settings/tracks menus included) takes Escape first and this player defers (R8 S3).
+  // settings/tracks menus included) takes Escape first and this player defers.
   const layerIdRef = useRef<number | null>(null);
   useEffect(() => {
     const id = pushLayer();
@@ -1185,7 +1184,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
       // Keyboard use also reveals the controls — but typing in a player field is not "using the
       // remote", and `dispatch` still lets Escape through from inside a field (the only key that
       // opts in), which is why this is a guard around `wake` rather than an early return.
-      // A slider is not a text field: its arrows are the remote too (E28 review E6).
+      // A slider is not a text field: its arrows are the remote too.
       if (!isTypingTarget(e) || (e.target as Element | null)?.matches?.('input[type="range"]'))
         wake();
       if (swallow) {
@@ -1196,7 +1195,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
       // The shared dialog Tab trap. This player paints an opaque full-viewport layer over the app,
       // so Tab leaving it lands on a control nobody can see, where the ring is invisible and the
       // next Enter fires something blind. Every other overlay in the tree traps (ui/Modal,
-      // PlayerModal, OnboardingWizard, Welcome); this one never did, and deep-review round 4 caught
+      // PlayerModal, OnboardingWizard, Welcome); this one never did, and a review caught
       // it when the recorder's step prompt — which docks in this player's toast host — handed its
       // own trap to "the dialog below" and found none. Only while nothing that owns the keyboard is
       // layered above: a Modal opened over the player traps for itself. `wake()` above has already
@@ -1257,10 +1256,10 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
           // Back button (shared cascade).
           // Who owns ⌫ when something is open over the player. Modal stopPropagation()s Escape ONLY
           // and its focused close button is not a typing target, so the key reaches us regardless.
-          // Two wrong answers so far: deferring to nothing at all (round 1's bug — the cheat sheet
+          // Two wrong answers so far: deferring to nothing at all (the first bug — the cheat sheet
           // took ⌫ and the player stopped underneath it), then deferring to `anyLayerAbove` outright
-          // (round 1's fix, round 2's bug — the player's OWN gear/tracks popovers push layers too, so
-          // ⌫ stopped closing them), then naming just the sheet and palette (round 2's fix, round 3's
+          // (the first fix, the second bug — the player's OWN gear/tracks popovers push layers too, so
+          // ⌫ stopped closing them), then naming just the sheet and palette (the second fix, the third
           // bug — the app-wide ErrorDialog is neither, so ⌫ tore the player down under it).
           // The rule that holds: the player's own panels answer first, because `handleBack`'s cascade
           // is what closes them; anything else layered above us takes the key.
@@ -1348,7 +1347,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
   const currentAudio = detail?.audio_streams.find((x) => x.ord === (audioOrd ?? 0));
   const currentSub = detail?.subtitle_streams.find((x) => x.ord === subOrd);
 
-  // Portaled to <body>, like every other full-screen overlay here (Modal, PlayerModal, ChatDock,
+  // Portaled to <body>, like every other full-screen overlay here (Modal, PlayerModal,
   // BackToTop). A fixed, full-viewport player must not be painted inside the page scroller: the
   // moment that scroller gets a mask/filter/transform/contain it becomes a stacking context, and
   // this z-overlay is then scoped inside it — the rail, the side panel and the header paint straight
@@ -1465,7 +1464,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
           leaving the viewer to conclude that switching subtitles "does nothing" (bug hunt 2026-09,
           item 8). A failure is said even over a mounted window (see `subNotice`). It sits one rung
           above the track-switch OSD so the two never overlap. Both notices are `z-base`, under the
-          settings and tracks popovers (`z-menu`): an open menu is never drawn over (E28 audit). */}
+          settings and tracks popovers (`z-menu`): an open menu is never drawn over. */}
       <div
         className="pointer-events-none absolute inset-x-0 bottom-36 z-base flex justify-center px-4"
         aria-live="polite"
@@ -1490,8 +1489,8 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
           The REGION is always mounted and only the bubble is conditional: a polite region has to
           pre-exist in the accessibility tree for a later insertion to be announced, so one created
           together with its own first message is unreliably read — and since `osd` clears after 2.2s,
-          conditioning the wrapper re-created it for every switch, not just the first (E10 review
-          round 1). Toaster.tsx carries the same rule and the same shape. */}
+          conditioning the wrapper re-created it for every switch, not just the first.
+          Toaster.tsx carries the same rule and the same shape. */}
       <div
         className="pointer-events-none absolute inset-x-0 bottom-24 z-base flex justify-center px-4"
         aria-live="polite"
@@ -1953,7 +1952,7 @@ export default function PlexPlayer({ itemId, onClose, queue, fromStart = false }
                 detail={detail}
                 variant="overlay"
                 onClose={() => setInfoOpen(false)}
-                // A collection sibling plays right here (E28 review D1), as Next would.
+                // A collection sibling plays right here, as Next would.
                 onPlayItem={(other, fromZero) => {
                   setInfoOpen(false);
                   go(other, undefined, fromZero);
diff --git a/frontend/src/components/PlexPlayerSettings.dom.test.tsx b/frontend/src/components/PlexPlayerSettings.dom.test.tsx
index 37289ca8..339a2abb 100644
--- a/frontend/src/components/PlexPlayerSettings.dom.test.tsx
+++ b/frontend/src/components/PlexPlayerSettings.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 review D5 + L5 + D6: the Plex player's settings panel. Its section switch was a row of
+// The Plex player's settings panel. Its section switch was a row of
 // `aria-pressed` buttons (now an ARIA tab list on `ui/Tabs`), its rows sat under the 44 touch target,
 // its on/off rows were a hand-laid label (now `CheckRow`), and its sliders and colour wells had no
 // accessible name — the visible label beside them was not tied to them.
diff --git a/frontend/src/components/PlexPlayerSettings.tsx b/frontend/src/components/PlexPlayerSettings.tsx
index 81047446..013af0dd 100644
--- a/frontend/src/components/PlexPlayerSettings.tsx
+++ b/frontend/src/components/PlexPlayerSettings.tsx
@@ -21,7 +21,7 @@ export function PlexPlayerSettings(props: {
   // about that and 18's types let it.
   menuRef: RefObject<HTMLDivElement | null>;
   /** The ⋯ that opened the panel: the focus goes back to it when the panel closes with the focus
-   *  inside — by Escape, Back or the ⋯ itself — instead of falling to <body> (E28 review D3). */
+   *  inside — by Escape, Back or the ⋯ itself — instead of falling to <body>. */
   returnFocusTo: RefObject<HTMLElement | null>;
   settingsTabs: { key: SettingsTab; label: string }[];
   activeTab: SettingsTab;
diff --git a/frontend/src/components/PlexPlaylistAdd.tsx b/frontend/src/components/PlexPlaylistAdd.tsx
index dfc96a22..f9a2ebc6 100644
--- a/frontend/src/components/PlexPlaylistAdd.tsx
+++ b/frontend/src/components/PlexPlaylistAdd.tsx
@@ -62,8 +62,8 @@ export default function PlexPlaylistAdd({
   // A failure is said, and the list refreshed either way. With no catch, a playlist deleted on
   // another device (a 404 `not_found/playlist` — still offered here, from a cache up to 30 s old)
   // was an unhandled rejection: `req` leaves 403/404/429 to the caller, so nothing was shown, the
-  // tick never flipped and the gone row stayed. Round 5 swept the collection editor and its own
-  // YouTube twin (`AddToPlaylist`) and missed this one (round 6).
+  // tick never flipped and the gone row stayed. A sweep fixed the collection editor and its own
+  // YouTube twin (`AddToPlaylist`) and missed this one.
   async function toggle(p: PlexPlaylist) {
     if (busy) return;
     setBusy(true);
diff --git a/frontend/src/components/PlexPlaylistReorder.dom.test.tsx b/frontend/src/components/PlexPlaylistReorder.dom.test.tsx
index 8697e4e7..afba7ccc 100644
--- a/frontend/src/components/PlexPlaylistReorder.dom.test.tsx
+++ b/frontend/src/components/PlexPlaylistReorder.dom.test.tsx
@@ -2,10 +2,10 @@
 //
 // One accepted write, one cache entry that matches it — the Plex half.
 //
-// `Playlists.tsx` (the YouTube list) got this rule in round 5: the detail cache is what a rollback
+// `Playlists.tsx` (the YouTube list) got this rule first: the detail cache is what a rollback
 // reads and what a re-entry inside the 30 s staleTime renders without refetching, so an accepted
 // reorder that is not written there leaves the cache disagreeing with the server. The Plex list got
-// the rollback half of that round's fix and not this half (round 6).
+// the rollback half of that fix and not this half.
 //
 // Its own file: `@dnd-kit/core` is mocked module-wide so the test can fire `onDragEnd` directly —
 // dnd-kit's pointer sensor does not activate under jsdom (no layout, no pointer capture).
@@ -64,10 +64,10 @@ const movie = (id: string) =>
   ({ id, type: "movie", title: `Movie ${id}`, year: 2020, thumb: "" }) as unknown as PlexCard;
 
 it("writes the order the server accepted into the detail cache, without waiting for a refetch", async () => {
-  // The refetch that same handler schedules (round 7) must not be what makes the cache right: the
+  // The refetch that same handler schedules must not be what makes the cache right: the
   // point of the write is that a re-entry inside the 30 s staleTime renders the accepted order
   // immediately, with no request at all. So the refetch is HELD OPEN here — if this assertion
-  // needed it to land, deleting the write would still pass and round 6's fix would be unguarded.
+  // needed it to land, deleting the write would still pass and that fix would be unguarded.
   let calls = 0;
   vi.spyOn(api, "plexPlaylist").mockImplementation(() =>
     ++calls === 1
@@ -101,7 +101,7 @@ it("refetches the detail too, so a membership change that landed meanwhile is no
   // surface, an item added elsewhere), and with only the LIST key invalidated nothing corrected it:
   // staleTime is 30 s and refetchOnWindowFocus is off, so the phantom row stayed on screen for as
   // long as the view was mounted and the next drag persisted an order built from it. The YouTube
-  // sibling invalidates the detail key right after writing it; this half did not (round 7).
+  // sibling invalidates the detail key right after writing it; this half did not.
   let calls = 0;
   vi.spyOn(api, "plexPlaylist").mockImplementation(() =>
     Promise.resolve(
diff --git a/frontend/src/components/PlexPlaylistView.header.dom.test.tsx b/frontend/src/components/PlexPlaylistView.header.dom.test.tsx
index 6b063720..a197a913 100644
--- a/frontend/src/components/PlexPlaylistView.header.dom.test.tsx
+++ b/frontend/src/components/PlexPlaylistView.header.dom.test.tsx
@@ -1,8 +1,8 @@
 // @vitest-environment jsdom
 //
 // The Plex playlist header's meta line — the count and the playlist's total runtime, mirroring the
-// YouTube playlist header — was never rendered by a test, so a regression in the sum shipped green
-// (E9 review). The runtime sums the WHOLE list, an unknown duration counts as nothing, and a list
+// YouTube playlist header — was never rendered by a test, so a regression in the sum shipped green.
+// The runtime sums the WHOLE list, an unknown duration counts as nothing, and a list
 // nothing sums for says no runtime at all.
 import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
 import { render, cleanup, screen, fireEvent, waitFor } from "@testing-library/react";
@@ -86,7 +86,7 @@ describe("PlexPlaylistView · the header's meta line", () => {
   });
 });
 
-// E28 audit: Enter on an unchanged (or emptied) title wrote the same name back to Plex, and an empty
+// Enter on an unchanged (or emptied) title wrote the same name back to Plex, and an empty
 // one armed the focus hand-back while leaving the field open. Now both close with no write, as the
 // collection rename does.
 describe("PlexPlaylistView · rename", () => {
diff --git a/frontend/src/components/PlexPlaylistView.menu.dom.test.tsx b/frontend/src/components/PlexPlaylistView.menu.dom.test.tsx
index 5f94722f..c32f9372 100644
--- a/frontend/src/components/PlexPlaylistView.menu.dom.test.tsx
+++ b/frontend/src/components/PlexPlaylistView.menu.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 C1 on the Plex playlist page: a title, a show group and a season each open ONE menu (the "…"
+// The Plex playlist page: a title, a show group and a season each open ONE menu (the "…"
 // beside them, a right-click, a long-press, Shift+F10) instead of a red X at rest; removing needs no
 // confirm, since the toast's Undo puts the rows back; `j`/`k` walk the visible rows and Delete takes
 // out the one the keyboard is on; the playlist's rename and delete sit in the header's "…".
@@ -330,7 +330,7 @@ describe("PlexPlaylistView · the header's '…'", () => {
   });
 });
 
-// E28 review E2: the watched toggle flips the view's LOCAL copy of the rows. On a failure the
+// The watched toggle flips the view's LOCAL copy of the rows. On a failure the
 // resync refetches an identical list, react-query keeps the same `data`, and the copy was never
 // re-seeded — the row stayed "watched" on screen while Plex still had it unwatched.
 describe("PlexPlaylistView · a failed watched toggle", () => {
@@ -351,7 +351,7 @@ describe("PlexPlaylistView · a failed watched toggle", () => {
   });
 });
 
-describe("PlexPlaylistView · the reader's language (E30)", () => {
+describe("PlexPlaylistView · the reader's language", () => {
   it("asks for the rows in Hungarian", async () => {
     setLanguage("hu");
     try {
@@ -364,7 +364,7 @@ describe("PlexPlaylistView · the reader's language (E30)", () => {
   });
 });
 
-describe("PlexPlaylistView · a season's name (E30 review)", () => {
+describe("PlexPlaylistView · a season's name", () => {
   it("names season 0 the Specials, as the show page does", async () => {
     mount([ep("e0", 0, 1), ep("e1", 1, 1)]);
     fireEvent.click(await screen.findByText("The Show")); // open the show's seasons
diff --git a/frontend/src/components/PlexPlaylistView.tsx b/frontend/src/components/PlexPlaylistView.tsx
index 5d1bf1a4..5b78febd 100644
--- a/frontend/src/components/PlexPlaylistView.tsx
+++ b/frontend/src/components/PlexPlaylistView.tsx
@@ -64,7 +64,7 @@ import { cardImage } from "../lib/plexImage";
 // per-account preference. Rendered as a PlexBrowse subview; "Play all" opens the player with the
 // whole ordered list as its queue.
 //
-// E28 C1: every row — a title, a show group, a season — has ONE menu, opened by its "…" (shown on
+// Every row — a title, a show group, a season — has ONE menu, opened by its "…" (shown on
 // hover or focus, always on touch), a right-click, a long-press or Shift+F10. Removing needs no
 // confirm: the toast's Undo puts the rows back where they stood. `j`/`k` walk the visible rows and
 // Delete takes out the one the keyboard is on; the playlist's own rename and delete sit in the
@@ -436,7 +436,7 @@ export default function PlexPlaylistView({
     usePlexPlaylistEdits(playlistId);
   const blocks = useMemo(() => buildBlocks(items), [items]);
   const order = useMemo(() => items.map((i) => i.id), [items]);
-  // Total playtime of the whole playlist, mirroring the YouTube playlist header (E9 12D): items with
+  // Total playtime of the whole playlist, mirroring the YouTube playlist header: items with
   // an unknown duration count as 0, and the runtime is dropped from the meta line when nothing sums.
   const totalSeconds = useMemo(
     () => items.reduce((acc, it) => acc + (it.duration_seconds ?? 0), 0),
@@ -553,7 +553,7 @@ export default function PlexPlaylistView({
     if (to >= 0) moveEpisode(aId, to);
   }
 
-  // --- The rows' ONE menu (E28 C1) -------------------------------------------------------------
+  // --- The rows' ONE menu -------------------------------------------------------------
   // Keyed: a row builds its target afresh each render, and its "…" must close the menu it opened.
   const rowMenu = useContextMenu<MenuTarget>({ keyOf: targetKey });
   const copy = useCopyItems();
@@ -780,7 +780,7 @@ export default function PlexPlaylistView({
               {t("plex.playlist.playAll")}
             </Button>
           )}
-          {/* Rename and delete — the playlist's own, rarer actions — sit in its "…" (E28 C1); a
+          {/* Rename and delete — the playlist's own, rarer actions — sit in its "…"; a
               rename opened from there hands the focus back to it. */}
           <MoreButton
             ref={renameTarget}
diff --git a/frontend/src/components/PlexProvider.tsx b/frontend/src/components/PlexProvider.tsx
index 8736d53a..e1194e13 100644
--- a/frontend/src/components/PlexProvider.tsx
+++ b/frontend/src/components/PlexProvider.tsx
@@ -73,7 +73,7 @@ function readPlexSort(): SortState {
   return { key: raw, dir };
 }
 
-// S4: a shared Plex-browse link carries the content state in namespaced URL keys (pscope/psort/pshow/
+// A shared Plex-browse link carries the content state in namespaced URL keys (pscope/psort/pshow/
 // pf). When present, the URL wins over this account's stored view (like the feed's URL-over-localStorage
 // seed) — read once at mount. The keys are Plex-unique, so their mere presence identifies a shared Plex
 // view; no ?page check is needed (and the mirror below is page-gated so it never pollutes other pages).
@@ -194,7 +194,7 @@ export function PlexProvider({ children }: { children: ReactNode }) {
     [setScope, setShow, setSort, setFilters, setQ, setField],
   );
 
-  // S4: mirror the content state (scope + sort + watch-state + filters) into the address bar under the
+  // Mirror the content state (scope + sort + watch-state + filters) into the address bar under the
   // namespaced keys so a Plex-browse view is shareable. Gated on page===plex: off the Plex page the keys
   // are cleared (localStorage still holds the state; it re-mirrors on return). `q`/`field` stay OUT — the
   // search term is deliberately transient-per-view and not part of the shared four-key contract.
diff --git a/frontend/src/components/PlexScopeToggle.dom.test.tsx b/frontend/src/components/PlexScopeToggle.dom.test.tsx
index 6861e5b7..dd257551 100644
--- a/frontend/src/components/PlexScopeToggle.dom.test.tsx
+++ b/frontend/src/components/PlexScopeToggle.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Contract of the header library-scope pill (S3 relocation + Piece 2 browse modes): it renders the
+// Contract of the header library-scope pill (scopes + browse modes): it renders the
 // three library scopes PLUS the Playlist/Collection browse-mode entries, marks the active one, writes a
 // picked scope to the provider, and drives the playlists/collections views through the PlexViewBridge.
 // i18n is key-passthrough and both the provider and the bridge are mocked; SegmentedToggle is a plain
diff --git a/frontend/src/components/PlexSearchBox.dom.test.tsx b/frontend/src/components/PlexSearchBox.dom.test.tsx
index 872fba57..822a29bf 100644
--- a/frontend/src/components/PlexSearchBox.dom.test.tsx
+++ b/frontend/src/components/PlexSearchBox.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Contract of the Plex header search box (S2): the field scope-pill and the instant typeahead.
+// Contract of the Plex header search box: the field scope-pill and the instant typeahead.
 // Covers the pieces the /code-review flagged: the pill's per-scope options (Episode only in
 // show/both), the suggestion list rendering, keyboard pick → jumpTo hand-off, and the regression
 // that closing the panel (Escape) must NOT wedge it shut while the input keeps focus — typing again
@@ -180,7 +180,7 @@ describe("PlexSearchBox — typeahead", () => {
     );
   });
 
-  // E11 S4: SearchBar's Escape hands the keyboard back to the page (blur). With the panel open, the
+  // SearchBar's Escape hands the keyboard back to the page (blur). With the panel open, the
   // first Escape belongs to the panel: it must close it and leave the caret in the field; only the
   // next Escape leaves.
   it("spends the first Escape on the panel and only the second on leaving the field", async () => {
@@ -220,7 +220,7 @@ describe("PlexSearchBox — typeahead", () => {
     expect(input.getAttribute("aria-controls")).toBeNull();
   });
 
-  // Round 2 (F4 sibling): a listbox may own options only — "Loading…" sat inside it.
+  // A listbox may own options only — "Loading…" sat inside it.
   it("shows its loading line beside the listbox, not in it", async () => {
     plexState.q = "matrix";
     plexLibrary.mockReturnValue(new Promise(() => {}));
diff --git a/frontend/src/components/PlexSearchBox.tsx b/frontend/src/components/PlexSearchBox.tsx
index febb0383..10fc24bc 100644
--- a/frontend/src/components/PlexSearchBox.tsx
+++ b/frontend/src/components/PlexSearchBox.tsx
@@ -14,7 +14,7 @@ import { SURFACE } from "./ui/surfaces";
 import { ROVING_HIGHLIGHT } from "./ui/AnchoredPopover";
 import { cardImage } from "../lib/plexImage";
 
-// The Plex header search box: the shared SearchBar enriched with the S2 search scope-pill (a
+// The Plex header search box: the shared SearchBar enriched with the search scope-pill (a
 // GitHub-style field selector inside the box) and an instant typeahead of the top matches attached
 // below it. Kept out of the generic SearchBar (and out of Header) so all Plex-specific wiring —
 // provider state, the suggest query, the jump-to hand-off — lives in one place. Everything reuses
@@ -140,7 +140,7 @@ export default function PlexSearchBox() {
           <div
             className={`${SURFACE.menu} absolute left-0 right-0 top-full z-menu mt-2 max-h-[70dvh] overflow-y-auto animate-[popIn_0.16s_ease]`}
           >
-            {/* Beside the listbox, not in it: a listbox may own options only (round 2, F4). */}
+            {/* Beside the listbox, not in it: a listbox may own options only. */}
             {suggestions.length === 0 && suggestQ.isFetching && (
               <div className="px-3 py-2 text-sm text-muted">{t("plex.loading")}</div>
             )}
diff --git a/frontend/src/components/PlexSidebar.picker.dom.test.tsx b/frontend/src/components/PlexSidebar.picker.dom.test.tsx
index 1be3c43f..8c4c90be 100644
--- a/frontend/src/components/PlexSidebar.picker.dom.test.tsx
+++ b/frontend/src/components/PlexSidebar.picker.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The sidebar's playlist picker (E28 review round 2, P7): typing a name offers "Create …" — but only
+// The sidebar's playlist picker: typing a name offers "Create …" — but only
 // once the lists have loaded. Over a failed load the create row pushed the error and its Retry out
 // of the list at the first keystroke, and whether the name already existed was unknown anyway.
 import { describe, it, expect, vi, afterEach, beforeAll } from "vitest";
diff --git a/frontend/src/components/PlexSidebar.tsx b/frontend/src/components/PlexSidebar.tsx
index f42824e1..8279c1e7 100644
--- a/frontend/src/components/PlexSidebar.tsx
+++ b/frontend/src/components/PlexSidebar.tsx
@@ -20,7 +20,6 @@ import SavedViewsPopover from "./SavedViewsPopover";
 import PersonalViewsModal from "./PersonalViewsModal";
 import { useSavedViews } from "./savedViewsContext";
 import { usePlex, usePlexActions } from "./plexContext";
-import { useMe } from "../lib/useMe";
 import { DismissibleChip } from "./ui/Chip";
 import { Input } from "./ui/Input";
 
@@ -51,9 +50,8 @@ export default function PlexSidebar({ layout, setLayout, collapsed, onToggleColl
   // hand-off to PlexBrowse via the shared `playlistOpen` slot.
   const { scope, show, filters } = usePlex();
   const { setFilters } = usePlexActions();
-  const isDemo = useMe().is_demo;
   // Personal ("saved") views for the Plex module: the rail header icon opens a quick-pick popover, the
-  // title opens the full manager modal (same shared components as the feed). Hidden for the demo account.
+  // title opens the full manager modal (same shared components as the feed).
   const { openModal, modalOpen } = useSavedViews();
   // This rail's media source (the Plex library) — names the abstraction the feed and Plex rails
   // share; drives the panel layout key. `FilterRail` owns the customize `editing` state now.
@@ -71,7 +69,7 @@ export default function PlexSidebar({ layout, setLayout, collapsed, onToggleColl
   const facets = facetsQ.data;
 
   const fCount = plexFilterCount(filters);
-  // Scope and sort moved to the header / above-the-grid toolbar (S3); the panel badge now counts only
+  // Scope and sort moved to the header / above-the-grid toolbar; the panel badge now counts only
   // the filters that still live in this panel (expanded filters + watch-state).
   const activeCount = fCount + (show !== "all" ? 1 : 0);
 
@@ -314,15 +312,11 @@ export default function PlexSidebar({ layout, setLayout, collapsed, onToggleColl
         // The Plex widgets are simple label + control rows now, not collapsible islands (matches the
         // feed rail). The rail's own "Clear all" is dropped too — the chip row above the grid owns it.
         collapsible={false}
-        // Saved ("personal") views: header icon → quick-pick popover, title → the manager modal. Hidden
-        // for the demo account. Same shared components as the feed rail (SavedViewsProvider switches source).
-        iconExpanded={
-          isDemo ? undefined : (
-            <SavedViewsPopover trigger={<SlidersHorizontal className="w-4 h-4" />} />
-          )
-        }
-        onTitleClick={isDemo ? undefined : openModal}
-        titleActionLabel={isDemo ? undefined : t("views.manageTitle")}
+        // Saved ("personal") views: header icon → quick-pick popover, title → the manager modal.
+        // Same shared components as the feed rail (SavedViewsProvider switches source).
+        iconExpanded={<SavedViewsPopover trigger={<SlidersHorizontal className="w-4 h-4" />} />}
+        onTitleClick={openModal}
+        titleActionLabel={t("views.manageTitle")}
       />
       {/* The manager modal lives here (rail is always mounted on plex); Modal portals to <body>. */}
       {modalOpen && <PersonalViewsModal />}
@@ -351,7 +345,7 @@ export function PlaylistPicker() {
   const options: ComboboxOption[] = [
     ...matches.map((p) => ({ value: `pl:${p.id}`, label: p.title, count: p.item_count })),
     // Offer to create only when the typed name isn't already a playlist — which is unknown until the
-    // lists load: over a failed load the row pushed out the error and its Retry (round 2, P7).
+    // lists load: over a failed load the row pushed out the error and its Retry.
     ...(q && !exact && playlistsQ.data ? [{ value: CREATE_PLAYLIST, label: q }] : []),
   ];
 
@@ -361,7 +355,7 @@ export function PlaylistPicker() {
       qc.invalidateQueries({ queryKey: qk.plexPlaylists() });
       onOpenPlaylist(pl.id);
     } catch (e) {
-      // Called without an await from the picker, so a refusal was an unhandled rejection (E11 S2b).
+      // Called without an await from the picker, so a refusal was an unhandled rejection.
       notifyActionError(e, t("plex.playlistAdd.createFailed"));
     }
   }
@@ -409,7 +403,7 @@ export function PlaylistPicker() {
   );
 }
 
-// The collection filter (E5 S7 → combobox; now multi-select): a combi-input matching the genre/studio
+// The collection filter (a multi-select combobox): a combi-input matching the genre/studio
 // pickers, its vocabulary searched SERVER-side (the union can run to hundreds). The generic <Combobox>
 // owns the field/keyboard/ARIA + the any/all match footer; this wrapper owns the query→fetch (gated on
 // `open`) and maps collections to options. A title can belong to several collections, so multiple can
diff --git a/frontend/src/components/PlexStatsOverlay.tsx b/frontend/src/components/PlexStatsOverlay.tsx
index 35a8492d..5234ee34 100644
--- a/frontend/src/components/PlexStatsOverlay.tsx
+++ b/frontend/src/components/PlexStatsOverlay.tsx
@@ -5,9 +5,9 @@ import { X } from "lucide-react";
 import { buildStatRows, type FragMeter, type HlsLevelInfo, type StatRow } from "../lib/plexStats";
 import { IconButton } from "./ui/IconButton";
 
-// "Stats for nerds" debug overlay (E6 S2). Samples the live HTML5 <video> + hls.js state once a second
+// "Stats for nerds" debug overlay. Samples the live HTML5 <video> + hls.js state once a second
 // and renders the active mode, resolution, codec/bitrate, dropped frames, buffer, hls level and session
-// offset. No data layer — the refs are already in hand. Doubles as the S1 verification surface (it shows
+// offset. No data layer — the refs are already in hand. Doubles as a verification surface (it shows
 // the transcode mode + that the re-encode is engaged). Toggled with "d" / the gauge button / its X.
 /** Dropped / total frames so far. Outside the component: the React Compiler cannot lower an
  *  optional call inside a try yet, and skipped the whole overlay for it. */
diff --git a/frontend/src/components/PosterTile.tsx b/frontend/src/components/PosterTile.tsx
index 9acfb9f9..ed42d450 100644
--- a/frontend/src/components/PosterTile.tsx
+++ b/frontend/src/components/PosterTile.tsx
@@ -10,7 +10,7 @@ import { cardImage } from "../lib/plexImage";
 // (a full-bleed poster collage drowned it). A group with no art falls back to an all-colour tile, never
 // blank. Shared by the Discover genre tiles and the Playlist/Collection browse tiles.
 //
-// Hover = the media card's (E28 S3h): the shadow lifts and the art zooms inside its half, plus the
+// Hover = the media card's: the shadow lifts and the art zooms inside its half, plus the
 // accent edge glass-hover gives a pressable panel. It had `glass-hover` on a tile with no border, so
 // the only visible change was a shadow under a colour band — the owner read it as no hover at all.
 export default function PosterTile({
diff --git a/frontend/src/components/SavedViewsPopover.dom.test.tsx b/frontend/src/components/SavedViewsPopover.dom.test.tsx
index 1cbc9685..97bf282b 100644
--- a/frontend/src/components/SavedViewsPopover.dom.test.tsx
+++ b/frontend/src/components/SavedViewsPopover.dom.test.tsx
@@ -2,8 +2,8 @@
 //
 // "Manage views…" opens a dialog from a menu row, so it must close the menu FIRST and open the dialog
 // on a fresh task (`closeThenAct`): the menu's focus return, queued as it unmounts, otherwise takes the
-// dialog's focus back to the trigger behind its scrim — measured in Chrome on ActionMenu (E11 S2), and
-// this row was the sibling that fix missed (deep-review E11 round 1). jsdom does not run that focus
+// dialog's focus back to the trigger behind its scrim — measured in Chrome on ActionMenu, and
+// this row was the sibling that fix missed. jsdom does not run that focus
 // race, so the ORDER is what is pinned: the menu is gone before the dialog is asked to open.
 import { beforeAll, describe, expect, it, vi } from "vitest";
 import { fireEvent, render, screen } from "@testing-library/react";
@@ -50,7 +50,7 @@ describe("SavedViewsPopover · Manage views…", () => {
   });
 });
 
-// E28: the toolbar chip's glyph sat INSIDE the value text, and an <svg> is display:block under the
+// The toolbar chip's glyph sat INSIDE the value text, and an <svg> is display:block under the
 // preflight, so the chip broke onto two lines (the bookmark above "gaming ▾"). The glyph and the
 // modified dot ride in the trigger's own slots; the value is a row.
 describe("SavedViewsPopover · toolbar chip", () => {
diff --git a/frontend/src/components/SavedViewsProvider.dom.test.tsx b/frontend/src/components/SavedViewsProvider.dom.test.tsx
index ae68873b..e242db89 100644
--- a/frontend/src/components/SavedViewsProvider.dom.test.tsx
+++ b/frontend/src/components/SavedViewsProvider.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// S2 — the single default-application path. On the saved-views query's FIRST resolve, SavedViewsProvider
+// The single default-application path. On the saved-views query's FIRST resolve, SavedViewsProvider
 // seeds the starred default view's filters into a genuinely fresh module (no stored filters), for BOTH
 // the feed and Plex — but leaves them alone once the account has its own stored filters. This is the
 // fix for the old feed-only LS mirror that raced FeedFiltersProvider's login effect and never applied a
diff --git a/frontend/src/components/Scheduler.dom.test.tsx b/frontend/src/components/Scheduler.dom.test.tsx
index 4ec5142c..88301ba4 100644
--- a/frontend/src/components/Scheduler.dom.test.tsx
+++ b/frontend/src/components/Scheduler.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // The scheduler's two number editors — a job's interval and the maintenance batch size. Both used to
 // hold a MIRROR of the server value that an effect re-synced; both now show the server value and keep
-// a draft only while the field is being edited (E27 S2). That matters here more than elsewhere
+// a draft only while the field is being edited. That matters here more than elsewhere
 // because this page polls: every few seconds a fresh status arrives, and a mirror is exactly the
 // thing a poll can overwrite at the wrong moment.
 import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
@@ -81,7 +81,7 @@ afterEach(() => {
 const intervalBox = () => screen.queryByRole("spinbutton", { name: "" });
 const batchBox = () => screen.getByLabelText("scheduler.maintenance.batchLabel");
 
-// The FIRST FOUR tests below are CHARACTERIZATION, not regression guards for E27 S2: the old
+// The FIRST FOUR tests below are CHARACTERIZATION, not regression guards for the draft sweep: the old
 // JobRow's re-sync effect was already guarded by `if (!editing)` and the mirror only rendered while
 // editing, so each of those four passes against the pre-sweep code too. They are here because the
 // editor had no tests at all. The two after them — the range refusal and the focus return — ARE
@@ -167,7 +167,7 @@ describe("Scheduler · the job interval editor", () => {
     );
   });
 
-  // E28 audit: a real Enter re-opened the editor — the keystroke's own activation landed on the trigger
+  // A real Enter re-opened the editor — the keystroke's own activation landed on the trigger
   // the focus had just returned to. The closing keys cancel their default action.
   it("closing by a key does not press the trigger again", async () => {
     await mount();
@@ -180,7 +180,7 @@ describe("Scheduler · the job interval editor", () => {
 
 describe("Scheduler · the maintenance batch editor", () => {
   it("keeps what you are typing when a poll changes the batch underneath", async () => {
-    // THE regression this editor needed: its pre-E27 effect re-synced on every
+    // THE regression this editor needed: its old effect re-synced on every
     // `revalidate_batch` change with no editing guard, so a poll landing mid-keystroke replaced
     // what the admin had typed.
     await mount();
@@ -242,7 +242,7 @@ describe("Scheduler · the maintenance batch editor", () => {
   });
 });
 
-describe("Scheduler while paused (E28 audit F13)", () => {
+describe("Scheduler while paused", () => {
   // Unavailable WITH a reason ("resume first"): the runs stay in the tab order, so a keyboard user
   // reaches the hint, and they are inert. Natively disabled, the reason was mouse-only.
   it("keeps Run all and a job's Run focusable and inert", async () => {
@@ -260,7 +260,7 @@ describe("Scheduler while paused (E28 audit F13)", () => {
   });
 });
 
-describe("a job's last result (E30)", () => {
+describe("a job's last result", () => {
   it("is named from its data, not the server's English one-liner", async () => {
     const base = status();
     await mount({
diff --git a/frontend/src/components/Scheduler.menu.dom.test.tsx b/frontend/src/components/Scheduler.menu.dom.test.tsx
index d9f5fafd..c9322a1f 100644
--- a/frontend/src/components/Scheduler.menu.dom.test.tsx
+++ b/frontend/src/components/Scheduler.menu.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 C1 on the Scheduler page: Run all and Pause stay in the status strip; the destructive Purge
+// The Scheduler page: Run all and Pause stay in the status strip; the destructive Purge
 // discovery left it for the strip's "…", which holds the page's whole list and asks before purging.
 import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
 import { render, screen, fireEvent, cleanup, act, waitFor } from "@testing-library/react";
diff --git a/frontend/src/components/Scheduler.tsx b/frontend/src/components/Scheduler.tsx
index 7e95738f..0d8a1967 100644
--- a/frontend/src/components/Scheduler.tsx
+++ b/frontend/src/components/Scheduler.tsx
@@ -311,7 +311,7 @@ function MaintenanceSettings({
   const { t, i18n } = useTranslation();
   const lang = i18n.language;
   // Same shape as the job row above: a draft while editing, the server's value otherwise. This is
-  // the editor a poll really could overwrite mid-keystroke before E27 S2 — its old effect had no
+  // the editor a poll really could overwrite mid-keystroke before the draft sweep — its old effect had no
   // `editing` guard at all.
   const rangeId = useId();
   const [draft, setDraft] = useState<string | null>(null);
@@ -505,7 +505,7 @@ export default function Scheduler() {
     },
   });
 
-  // The page's own menu: the status strip's "…" (E28 C1). Run all and Pause stay in sight; the
+  // The page's own menu: the status strip's "…". Run all and Pause stay in sight; the
   // destructive Purge discovery lives only here, behind its confirm.
   const pageMenu = useContextMenu<"scheduler">();
 
diff --git a/frontend/src/components/SearchBar.dom.test.tsx b/frontend/src/components/SearchBar.dom.test.tsx
index 8c53178a..0021719f 100644
--- a/frontend/src/components/SearchBar.dom.test.tsx
+++ b/frontend/src/components/SearchBar.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E5 S7: locks the container-query classes on the shared search box that fix the narrow-header
+// Locks the container-query classes on the shared search box that fix the narrow-header
 // collapse — the box must WRAP to its own line (not shrink the input to ~0) when the content column
 // (@container/appmain) is narrow. jsdom does no layout, but the class presence is the contract these
 // rules depend on, so a refactor that drops them fails here instead of only on a hand-resized window.
@@ -13,7 +13,7 @@ vi.mock("react-i18next", async (importOriginal) => {
   return { ...actual, useTranslation: () => ({ t: (key: string) => key }) };
 });
 
-describe("SearchBar responsive wrapper (E5 S7)", () => {
+describe("SearchBar responsive wrapper", () => {
   it("carries the container-query classes that make it wrap instead of collapsing", () => {
     const { container } = render(<SearchBar value="" onChange={() => {}} placeholder="Search…" />);
     const cls = (container.firstElementChild as HTMLElement).className;
diff --git a/frontend/src/components/SearchBar.keys.dom.test.tsx b/frontend/src/components/SearchBar.keys.dom.test.tsx
index 05735421..1a1b5914 100644
--- a/frontend/src/components/SearchBar.keys.dom.test.tsx
+++ b/frontend/src/components/SearchBar.keys.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E11 S4: `s` puts the caret in the module's search box from anywhere on the page, and Escape hands
+// `s` puts the caret in the module's search box from anywhere on the page, and Escape hands
 // the keyboard back to the page — the way in needs a way out, or `j`/`k` end up typed into the query.
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { act, cleanup, render, screen } from "@testing-library/react";
diff --git a/frontend/src/components/SearchBar.tsx b/frontend/src/components/SearchBar.tsx
index c19207a9..f63765ac 100644
--- a/frontend/src/components/SearchBar.tsx
+++ b/frontend/src/components/SearchBar.tsx
@@ -61,14 +61,14 @@ export default function SearchBar({
   inputProps?: InputHTMLAttributes<HTMLInputElement>;
 }) {
   const { t } = useTranslation();
-  // `s` puts the caret here from anywhere on the page (E11 S4) — the header mounts exactly one box.
+  // `s` puts the caret here from anywhere on the page — the header mounts exactly one box.
   const inputRef = useRef<HTMLInputElement>(null);
   useSearchFocusKey(inputRef);
   const fire = () => {
     if (onGo && !goDisabled) onGo();
   };
   // Responsive rules on the SHARED search box (every module's header, not just Plex), keyed on the
-  // content column's width via `@container/appmain` (E5 S7): `min-w-0` by default so it never forces
+  // content column's width via `@container/appmain`: `min-w-0` by default so it never forces
   // overflow on a truly tiny column; once the column has room (≥420px) a `min-w-[15rem]` floor makes
   // the box WRAP to its own line via the header's flex-wrap instead of shrinking the input to ~0; on
   // a narrow column (≤640px) it also takes a full line of its own (basis-full) and sorts LAST, so the
diff --git a/frontend/src/components/SettingsPanel.account.dom.test.tsx b/frontend/src/components/SettingsPanel.account.dom.test.tsx
index 82598b1c..8448b1a4 100644
--- a/frontend/src/components/SettingsPanel.account.dom.test.tsx
+++ b/frontend/src/components/SettingsPanel.account.dom.test.tsx
@@ -33,7 +33,6 @@ const me = (extra: Partial<Me>): Me =>
     display_name: "Someone",
     avatar_url: null,
     role: "user",
-    is_demo: false,
     last_login_at: null,
     ...extra,
   }) as Me;
@@ -47,14 +46,10 @@ describe("AccountHeader", () => {
     expect(screen.getByText("nav.role.user")).toBeTruthy();
   });
 
-  it("says when none is recorded, and says nothing about it for the demo", () => {
+  it("says when none is recorded", () => {
     render(<AccountHeader me={me({})} />);
     expect(screen.getByTestId("account-last-login").textContent).toBe(
       "settings.account.lastLoginNone",
     );
-    cleanup();
-    render(<AccountHeader me={me({ is_demo: true })} />);
-    expect(screen.queryByTestId("account-last-login")).toBeNull();
-    expect(screen.getByText("nav.role.demo")).toBeTruthy();
   });
 });
diff --git a/frontend/src/components/SettingsPanel.downloadAuth.dom.test.tsx b/frontend/src/components/SettingsPanel.downloadAuth.dom.test.tsx
index 9de28e61..022c8d51 100644
--- a/frontend/src/components/SettingsPanel.downloadAuth.dom.test.tsx
+++ b/frontend/src/components/SettingsPanel.downloadAuth.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// S6 — the per-user download-cookies section is WRITE-ONLY: the stored blob is never fetched or
+// The per-user download-cookies section is WRITE-ONLY: the stored blob is never fetched or
 // shown back, so opening "Set"/"Update" always reveals an EMPTY field, and saving posts exactly the
 // pasted value to the matching host. This drives the real DownloadAuth against a mocked api so we can
 // assert the field never carries a prior value and the right host is written.
diff --git a/frontend/src/components/SettingsPanel.tsx b/frontend/src/components/SettingsPanel.tsx
index fc0e0dd1..8c397753 100644
--- a/frontend/src/components/SettingsPanel.tsx
+++ b/frontend/src/components/SettingsPanel.tsx
@@ -146,7 +146,7 @@ function Appearance({ prefs }: { prefs: PrefsController }) {
   const { t } = useTranslation();
   // Controlled by PrefsProvider: each change applies locally at once and auto-saves (debounced).
   const { theme, setTheme, perf, setPerf, hints, setHints, railLabels, setRailLabels } = prefs;
-  // The landing page (E24). Per-account localStorage, not a server preference like the rest of this
+  // The landing page. Per-account localStorage, not a server preference like the rest of this
   // tab: `loadInitialPage` reads it synchronously in NavigationProvider's initializer. The two stored
   // values come from navigationInit, which is what reads them back at boot.
   const [startOnHome, setStartOnHome] = useAccountPersistedState(LS.startOnHome, START_ON_HOME.on);
@@ -342,7 +342,7 @@ function AccessRow({
 // Sign-in methods: link a Google account to a password account (or vice-versa set a password),
 // so either method can reach the same account. Google connect is a full-page OAuth round-trip
 // (auth.py attaches the identity to the current session via /auth/link); the password form posts
-// directly with inline errors. Demo accounts never see this (handled by the caller).
+// directly with inline errors.
 function SignInMethods({ me }: { me: Me }) {
   const { t } = useTranslation();
   const qc = useQueryClient();
@@ -611,7 +611,7 @@ function PlexWatchSync() {
   );
 }
 
-// Per-user download authentication (S6): store your own login cookies for an auth-walled host
+// Per-user download authentication: store your own login cookies for an auth-walled host
 // (e.g. a private Facebook group you belong to) so downloads from it use YOUR login. Write-only —
 // the stored blob is never shown back; each row shows only the host + whether it's set + when.
 // A cookie-authed download is kept private to your account (never cache-shared with another user).
@@ -785,13 +785,11 @@ export function AccountHeader({ me }: { me: Me }) {
           <div className="text-xs text-muted truncate">{me.email}</div>
           {/* Translated, like the sidebar's tooltip: the raw `user` read in English under HU. */}
           <div className="text-xs text-muted">{t(`nav.role.${roleKey(me)}`)}</div>
-          {!me.is_demo && (
-            <div className="text-xs text-muted" data-testid="account-last-login">
-              {me.last_login_at
-                ? t("settings.account.lastLogin", { time: formatDateTime(me.last_login_at, lang) })
-                : t("settings.account.lastLoginNone")}
-            </div>
-          )}
+          <div className="text-xs text-muted" data-testid="account-last-login">
+            {me.last_login_at
+              ? t("settings.account.lastLogin", { time: formatDateTime(me.last_login_at, lang) })
+              : t("settings.account.lastLoginNone")}
+          </div>
         </div>
       </div>
     </Section>
@@ -823,17 +821,13 @@ function Account({ me, onOpenWizard }: { me: Me; onOpenWizard: () => void }) {
     <>
       <AccountHeader me={me} />
 
-      {!me.is_demo && <SignInMethods me={me} />}
+      <SignInMethods me={me} />
 
       {me.role === "admin" && me.plex_enabled && <PlexWatchSync />}
 
-      {!me.is_demo && <DownloadAuth />}
+      <DownloadAuth />
 
-      {me.is_demo ? (
-        <Section title={t("settings.account.youtubeAccess")}>
-          <p className="text-xs text-muted leading-relaxed">{t("settings.account.demoNotice")}</p>
-        </Section>
-      ) : me.google_enabled ? (
+      {me.google_enabled ? (
         // YouTube access requires Google OAuth; hidden when this instance has no Google configured.
         <Section title={t("settings.account.youtubeAccess")}>
           <p className="text-xs text-muted leading-relaxed mb-1">
@@ -865,17 +859,15 @@ function Account({ me, onOpenWizard }: { me: Me; onOpenWizard: () => void }) {
         </Section>
       ) : null}
 
-      {!me.is_demo && (
-        <Section title={t("settings.account.dangerZone")}>
-          <p className="text-xs text-muted leading-relaxed mb-2">
-            {t("settings.account.deleteHint")}
-          </p>
-          <Button variant="danger-soft" size="md" onClick={onDeleteAccount}>
-            <Trash2 className="w-4 h-4" />
-            {t("settings.account.deleteAccount")}
-          </Button>
-        </Section>
-      )}
+      <Section title={t("settings.account.dangerZone")}>
+        <p className="text-xs text-muted leading-relaxed mb-2">
+          {t("settings.account.deleteHint")}
+        </p>
+        <Button variant="danger-soft" size="md" onClick={onDeleteAccount}>
+          <Trash2 className="w-4 h-4" />
+          {t("settings.account.deleteAccount")}
+        </Button>
+      </Section>
     </>
   );
 }
diff --git a/frontend/src/components/ShareDialog.tsx b/frontend/src/components/ShareDialog.tsx
index ef003ac4..d9a9f76b 100644
--- a/frontend/src/components/ShareDialog.tsx
+++ b/frontend/src/components/ShareDialog.tsx
@@ -118,10 +118,10 @@ function LinkRow({ link, onChanged }: { link: ShareLink; onChanged: () => void }
         <IconButton label={t("downloads.share.copy")} size="sm" variant="ghost" onClick={copy}>
           {copied ? <Check className="w-4 h-4 text-success" /> : <Copy className="w-4 h-4" />}
         </IconButton>
-        {/* All three on the same rung. Only Copy was migrated in S1, which left one 2rem button
+        {/* All three on the same rung. Only Copy was migrated at first, which left one 2rem button
             between two 1.75rem ones with a different radius and hover fill — and, on a coarse
             pointer, `.touch-target` grew ONLY the migrated one to 2.75rem while the destructive
-            Revoke stayed small (E10 review round 1). */}
+            Revoke stayed small. */}
         <IconButton
           label={
             link.has_password
@@ -136,7 +136,7 @@ function LinkRow({ link, onChanged }: { link: ShareLink; onChanged: () => void }
           }}
           // On the ICON, not the button: `clsx` does not merge Tailwind, so a colour className loses
           // to the variant's own `text-muted`/`hover:text-fg` by stylesheet order and the state was
-          // simply invisible (E10 review round 2). The Copy button above already does it this way.
+          // simply invisible. The Copy button above already does it this way.
         >
           <Lock className={`w-4 h-4 ${link.has_password ? "text-accent" : ""}`} />
         </IconButton>
@@ -235,7 +235,7 @@ function LinkShare({ job }: { job: DownloadJob }) {
     queryFn: () => api.downloadLinks(job.id),
   });
   const [creating, setCreating] = useState(false);
-  // D1 (E7 S3): downloadable by default — matches the one-click Share (which relies on the backend
+  // D1: downloadable by default — matches the one-click Share (which relies on the backend
   // default) and the common "let them have the file" intent. The owner can uncheck it here.
   const [allowDownload, setAllowDownload] = useState(true);
   const [expiryDays, setExpiryDays] = useState<number | null>(null);
diff --git a/frontend/src/components/Sidebar.tsx b/frontend/src/components/Sidebar.tsx
index 8d374ac3..007b6a51 100644
--- a/frontend/src/components/Sidebar.tsx
+++ b/frontend/src/components/Sidebar.tsx
@@ -21,7 +21,6 @@ import Combobox from "./ui/Combobox";
 import MatchToggle from "./ui/MatchToggle";
 import { useFeedFilters, useFeedFiltersActions } from "./feedFiltersContext";
 import { useChannelsActions } from "./channelsContext";
-import { useMe } from "../lib/useMe";
 import { useTags } from "../lib/useTags";
 import { compareText } from "../lib/collate";
 
@@ -51,7 +50,6 @@ export default function Sidebar({
 }) {
   const { t, i18n } = useTranslation();
   const lang = i18n.language;
-  const isDemo = useMe().is_demo;
   const { openModal } = useSavedViews();
   const filters = useFeedFilters();
   const { setFilters } = useFeedFiltersActions();
@@ -245,14 +243,14 @@ export default function Sidebar({
       // The feed widgets are simple label + control rows, not collapsible islands.
       collapsible={false}
       // Saved ("personal") views: the header icon opens a quick-pick popover, the title opens the
-      // full manager modal. Hidden for the demo account (no per-user views). Feed rail only.
+      // full manager modal. Feed rail only.
       iconExpanded={
-        !isDemo && source === "feed" ? (
+        source === "feed" ? (
           <SavedViewsPopover trigger={<SlidersHorizontal className="w-4 h-4" />} />
         ) : undefined
       }
-      onTitleClick={!isDemo && source === "feed" ? openModal : undefined}
-      titleActionLabel={!isDemo && source === "feed" ? t("views.manageTitle") : undefined}
+      onTitleClick={source === "feed" ? openModal : undefined}
+      titleActionLabel={source === "feed" ? t("views.manageTitle") : undefined}
     >
       {tagManagerOpen && (
         <TagManager onClose={() => setTagManagerOpen(false)} onFocusChannel={onFocusChannel} />
diff --git a/frontend/src/components/Stats.tsx b/frontend/src/components/Stats.tsx
index e84ab0ff..3c895cd2 100644
--- a/frontend/src/components/Stats.tsx
+++ b/frontend/src/components/Stats.tsx
@@ -3,7 +3,7 @@ import { useTranslation } from "react-i18next";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { qk } from "../lib/queryKeys";
 import { History, Pause, Play, RefreshCw } from "lucide-react";
-import { api, type AdminQuotaRow, type Me } from "../lib/api";
+import { api, type AdminQuotaRow } from "../lib/api";
 import { formatEta, formatNumber, formatUnit, quotaActionLabel } from "../lib/format";
 import { notify } from "../lib/notifications";
 import { notifyYouTubeActionError } from "../lib/youtubeErrors";
@@ -61,13 +61,13 @@ export default function Stats() {
         </PageToolbar>
       )}
 
-      {tab === "system" && isAdmin ? <SystemStats /> : <Overview me={me} />}
+      {tab === "system" && isAdmin ? <SystemStats /> : <Overview />}
     </div>
   );
 }
 
-// Per-user view: sync status + your own API usage + (for real accounts) the manual sync actions.
-function Overview({ me }: { me: Me }) {
+// Per-user view: sync status + your own API usage + the manual sync actions.
+function Overview() {
   const { t, i18n } = useTranslation();
   const lang = i18n.language;
   const qc = useQueryClient();
@@ -203,32 +203,30 @@ function Overview({ me }: { me: Me }) {
         )}
       </Section>
 
-      {!me.is_demo && (
-        <Section title={t("stats.sync.actions")}>
-          <div className="flex flex-wrap gap-2">
-            <Tooltip hint={t("stats.sync.syncSubscriptionsHint")}>
-              <Button
-                variant="glass"
-                icon={<RefreshCw />}
-                loading={syncSubs.isPending}
-                onClick={() => syncSubs.mutate()}
-              >
-                {t("stats.sync.syncSubscriptions")}
-              </Button>
-            </Tooltip>
-            <Tooltip hint={t("stats.sync.backfillEverythingHint")}>
-              <Button
-                variant="glass"
-                icon={<History />}
-                loading={deepAll.isPending}
-                onClick={() => deepAll.mutate()}
-              >
-                {t("stats.sync.backfillEverything")}
-              </Button>
-            </Tooltip>
-          </div>
-        </Section>
-      )}
+      <Section title={t("stats.sync.actions")}>
+        <div className="flex flex-wrap gap-2">
+          <Tooltip hint={t("stats.sync.syncSubscriptionsHint")}>
+            <Button
+              variant="glass"
+              icon={<RefreshCw />}
+              loading={syncSubs.isPending}
+              onClick={() => syncSubs.mutate()}
+            >
+              {t("stats.sync.syncSubscriptions")}
+            </Button>
+          </Tooltip>
+          <Tooltip hint={t("stats.sync.backfillEverythingHint")}>
+            <Button
+              variant="glass"
+              icon={<History />}
+              loading={deepAll.isPending}
+              onClick={() => deepAll.mutate()}
+            >
+              {t("stats.sync.backfillEverything")}
+            </Button>
+          </Tooltip>
+        </div>
+      </Section>
     </>
   );
 }
diff --git a/frontend/src/components/TagManager.tsx b/frontend/src/components/TagManager.tsx
index 80ad4f74..15915ee1 100644
--- a/frontend/src/components/TagManager.tsx
+++ b/frontend/src/components/TagManager.tsx
@@ -20,7 +20,7 @@ import { useTags } from "../lib/useTags";
 
 // One editable row: rename in place (commit on Enter/blur), delete with a confirm, and a
 // hover popover on the count listing the tagged channels (each a link that focuses it in the
-// Channel manager). The popover rides the R8 platform, so the list's own scroll can't clip it and
+// Channel manager). The popover rides the shared platform, so the list's own scroll can't clip it and
 // the cursor can travel the gap into it (safePolygon) without the old hand-rolled 150 ms timer.
 function TagRow({
   tag,
diff --git a/frontend/src/components/UpNextCard.dom.test.tsx b/frontend/src/components/UpNextCard.dom.test.tsx
index bea3686a..fe4912b1 100644
--- a/frontend/src/components/UpNextCard.dom.test.tsx
+++ b/frontend/src/components/UpNextCard.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The up-next end-card's core behaviour (E6 S4): the countdown that auto-advances at ~10s (the whole
+// The up-next end-card's core behaviour: the countdown that auto-advances at ~10s (the whole
 // point — it REPLACED the old instant jump, so a regression that fires early or never is exactly the
 // bug to guard), the "Play now"/Cancel controls, and the episode heading's null season/episode
 // fallback. i18n is key-passthrough; `../lib/api` is mocked so no network runs; the countdown uses
diff --git a/frontend/src/components/UpNextCard.tsx b/frontend/src/components/UpNextCard.tsx
index d43d07c0..8b541533 100644
--- a/frontend/src/components/UpNextCard.tsx
+++ b/frontend/src/components/UpNextCard.tsx
@@ -9,7 +9,7 @@ import { cardImage } from "../lib/plexImage";
 import { Button } from "./ui/Button";
 import { IconButton } from "./ui/IconButton";
 
-// Up-next / end-card (E6 S4). Shown at episode end when a next item exists and the pref is on, INSTEAD
+// Up-next / end-card. Shown at episode end when a next item exists and the pref is on, INSTEAD
 // of the old instant jump — so binge stays under the viewer's control (D6-A). Counts down ~10s then
 // advances; "Play now" advances immediately; Cancel/✕ dismisses and stays on the finished frame. It only
 // lives on the play-to-the-end path; credits-auto-skip advances earlier and never reaches this card.
diff --git a/frontend/src/components/UploadDialog.dom.test.tsx b/frontend/src/components/UploadDialog.dom.test.tsx
index 61a085f7..4a3ca217 100644
--- a/frontend/src/components/UploadDialog.dom.test.tsx
+++ b/frontend/src/components/UploadDialog.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E7·S5c — the local-upload dialog. It's a general file upload (any type, no format list): a picked
+// The local-upload dialog. It's a general file upload (any type, no format list): a picked
 // file surfaces its name+size, and Upload streams it through api.uploadDownload (the XHR-progress
 // path). This drives the real dialog against a mocked api so we can assert the file + optional name
 // actually reach the ingest call, and that the success toast points at the library. i18n is
diff --git a/frontend/src/components/UploadDialog.tsx b/frontend/src/components/UploadDialog.tsx
index e54a2964..d410e70e 100644
--- a/frontend/src/components/UploadDialog.tsx
+++ b/frontend/src/components/UploadDialog.tsx
@@ -16,7 +16,7 @@ import { DISPLAY_NAME_MAX } from "../lib/api/downloads";
 import { Pressable } from "./ui/Pressable";
 import { Input } from "./ui/Input";
 
-// Local-file ingest (E7 S5c · D5-A). A general upload — ANY file type, no format list: media
+// Local-file ingest. A general upload — ANY file type, no format list: media
 // (video/audio) joins the library with the full function set, a generic file is download-only. The
 // file is streamed to the server via XHR so this dialog can show real upload progress. On success it
 // lands in the Library as an already-`done` job, so we invalidate + point the user there.
@@ -46,7 +46,7 @@ export default function UploadDialog({ onClose }: { onClose: () => void }) {
   // Every pick gets a new number, so the refusal below REMOUNTS rather than being reconciled. Two
   // over-cap picks in a row leave the node and its text identical — the message names the cap, not
   // the file — and a live region that is not touched is not announced, so the second refusal was
-  // silent to a screen reader. `KeyGate`, `SetupWizard` and `Welcome` all key their alerts for the
+  // silent to a screen reader. `SetupWizard` and `Welcome` both key their alerts for the
   // same reason, and `formAlerts.dom.test.tsx` is the test that exists because of it.
   const [pickSeq, setPickSeq] = useState(0);
   const pick_ = (f: File) => {
@@ -91,7 +91,7 @@ export default function UploadDialog({ onClose }: { onClose: () => void }) {
       // with only the transient "connection lost" notice — so this empty catch meant a proxy 502 on
       // a long upload, or an nginx 413, snapped the dialog back to its pre-upload state with nothing
       // named and no job in the list. The comment here claimed the global error modal had it; it
-      // had not since the shared `reportFailure` landed (deep-review round 5).
+      // had not since the shared `reportFailure` landed.
       if (!isAborted(e)) notifyActionError(e, t("downloads.upload.failed"));
       // Re-arm the form so the user can retry or pick again.
       setPct(null);
diff --git a/frontend/src/components/VideoCard.actions.dom.test.tsx b/frontend/src/components/VideoCard.actions.dom.test.tsx
index 10a6b051..8170e57f 100644
--- a/frontend/src/components/VideoCard.actions.dom.test.tsx
+++ b/frontend/src/components/VideoCard.actions.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 C1: the card shows its state and the everyday toggles (watched, save, add to playlist) and a
+// The card shows its state and the everyday toggles (watched, save, add to playlist) and a
 // "…" into the list's ONE menu; download, details, hide and reset live only in that menu. Every view
 // carries the same set, and a view that shows the "…" twice (the card: in the hover row on the
 // picture, and beside the title for touch — only one is displayed per device) points both at the
@@ -92,7 +92,7 @@ describe.each(Object.keys(FEED_VIEW_SPEC) as FeedView[])("the %s view's actions"
   });
 });
 
-// E28 S3h, the owner's pick B (2026-09-26): the compact row had a leading action column that sat
+// The owner's pick (2026-09-26): the compact row had a leading action column that sat
 // empty at rest. Now the title leads, the "…" is always at the row's end, and on hover the quick
 // toggles float in beside it over the date, which steps aside.
 describe("the compact row (rowsCompact)", () => {
@@ -116,7 +116,7 @@ describe("the compact row (rowsCompact)", () => {
 });
 
 // On a shelf (Home's strips) the card is one title line over the channel alone, so every card on
-// the strip is the same height (E28 S3h, the owner's shelf density).
+// the strip is the same height (the owner's shelf density).
 describe("the card on a shelf", () => {
   function renderSmall(shelf: boolean) {
     render(
diff --git a/frontend/src/components/VideoCard.channel.dom.test.tsx b/frontend/src/components/VideoCard.channel.dom.test.tsx
index 83185d28..c4b80eda 100644
--- a/frontend/src/components/VideoCard.channel.dom.test.tsx
+++ b/frontend/src/components/VideoCard.channel.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // The video card's channel name was a <button>: a plain click opened the channel in-app, but
 // middle-click and Ctrl/Cmd-click did nothing — while the title right above it, an anchor, honoured
-// them. Found by the 2026-09 bug-hunt deep-review, when the player's channel name had just become a
+// them. Found in the 2026-09 bug hunt, when the player's channel name had just become a
 // real link and the card's had not. (The link's own gesture rules are pinned in
 // ChannelNameLink.dom.test.tsx; this pins that the CARD uses it.)
 import { describe, it, expect, vi, beforeAll, beforeEach } from "vitest";
diff --git a/frontend/src/components/VideoCard.nav.dom.test.tsx b/frontend/src/components/VideoCard.nav.dom.test.tsx
index 783b52c6..5caab5fd 100644
--- a/frontend/src/components/VideoCard.nav.dom.test.tsx
+++ b/frontend/src/components/VideoCard.nav.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E11 S4: the video card's half of keyboard navigation (`lib/listNav`). Every layout's ROOT carries the
+// The video card's half of keyboard navigation (`lib/listNav`). Every layout's ROOT carries the
 // list index — that is the element `j`/`k` focus and ring — and the title link is the card's `open`
 // element, so Enter on a selected card runs the very click a mouse would: the in-app player.
 import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
@@ -88,7 +88,7 @@ describe("VideoCard — keyboard navigation hooks", () => {
   });
 });
 
-// E28 S3d4: the thumbnail link's only text is the duration badge, so each card's first Tab stop was
+// The thumbnail link's only text is the duration badge, so each card's first Tab stop was
 // announced as "20:00". It is named by the title, like the title link beside it.
 describe("VideoCard — the thumbnail link", () => {
   it("is named by the video's title, not its duration", () => {
@@ -99,13 +99,13 @@ describe("VideoCard — the thumbnail link", () => {
   });
 });
 
-// E28 C1 "Text stays selectable": the mouseup that ends selecting the title's words fires a click on
+// "Text stays selectable": the mouseup that ends selecting the title's words fires a click on
 // the title; that click must not open the player (nor follow the link).
 describe("VideoCard — a title you select", () => {
   it("does not open when the click ends a selection inside it, and still opens on a plain click", () => {
     const onOpen = renderCard("cards");
     const title = screen.getByTestId("video-card").querySelector("[data-nav-open]") as HTMLElement;
-    // Both, or Chrome starts no selection on a link (measured in the S3e1 UAT).
+    // Both, or Chrome starts no selection on a link (measured in a real browser).
     expect(title.getAttribute("draggable")).toBe("false");
     expect(title.classList.contains("select-text")).toBe(true);
     const range = document.createRange();
diff --git a/frontend/src/components/VideoCard.tsx b/frontend/src/components/VideoCard.tsx
index c0b126f7..d8f624e1 100644
--- a/frontend/src/components/VideoCard.tsx
+++ b/frontend/src/components/VideoCard.tsx
@@ -47,7 +47,7 @@ import { RelativeTime } from "./ui/RelativeTime";
 /** The "…" that opens the video's action list, and whether its menu is the open one. */
 type More = { props: Record<string, unknown>; open: boolean };
 
-// E28 C1: the card keeps its state and the everyday toggles — watched, save, add to playlist — and
+// The card keeps its state and the everyday toggles — watched, save, add to playlist — and
 // a "…" for everything else (download, details, copy, hide, reset, pin), which is the list's ONE
 // menu (useVideoActions). On a mouse the row shows on hover or keyboard focus; on touch the toggles
 // are gone (the "…" and the long-press are the way in) and only the "…" stays.
@@ -242,7 +242,7 @@ function Thumb({
     // tall, which stretched a whole Home shelf to it (ui/mediaCardStyles `mediaPictureBox`).
     <div className={clsx("relative min-h-0", MEDIA_PICTURE_CONTAINER, className)}>
       {/* Named by the title: its only text is the duration badge, so a screen reader heard the first
-        Tab stop of every card as "44:10" (E28 S3d4). */}
+        Tab stop of every card as "44:10". */}
       <a
         href={video.watch_url}
         target="_blank"
@@ -381,7 +381,7 @@ function VideoCard({
   onState: (id: string, status: VideoStatus) => void;
   onToggleSave: (id: string, saved: boolean) => void;
   onOpen?: (v: Video, startAt?: number | null) => void;
-  /** Right-click / long-press props for the LIST's one context menu (E28 C1: the video's actions).
+  /** Right-click / long-press props for the LIST's one context menu (the video's actions).
    *  A FUNCTION, not the already-built props object: `useContextMenu.triggerProps` is stable across
    *  renders while its return value is a fresh object every call, and a fresh object prop would
    *  blow past this component's memo for every card in the virtualized feed on every parent
@@ -460,7 +460,7 @@ function VideoCard({
       rel="noreferrer"
       onClick={(e) => openInApp(e, video, onOpen)}
       // A link is dragged, not selected: Chrome starts no selection on one even with the drag off,
-      // until it is also `user-select: text` (select-text below) — measured in the S3e1 UAT.
+      // until it is also `user-select: text` (select-text below) — measured in a real browser.
       draggable={false}
       // Enter on a keyboard-selected card clicks THIS link (lib/listNav), so it opens exactly like a
       // click: the in-app player, resuming where the reader left off.
@@ -544,7 +544,7 @@ function VideoCard({
           {...(navIndex !== undefined && navItemAttrs(navIndex))}
           className={clsx(rowShell, "flex items-center gap-3 px-3 py-2", watched && "opacity-55")}
         >
-          {/* The title leads (E28 S3h, the owner's pick B, 2026-09-26): the actions used to lead in a
+          {/* The title leads (the owner's pick, 2026-09-26): the actions used to lead in a
               128px column that sat EMPTY at rest, a hole at the start of every row. Now the row's
               end holds a faint "…" (always there: the menu's door on every device), and on hover or
               keyboard focus the quick toggles float in beside it OVER the date, which steps aside —
diff --git a/frontend/src/components/VideoEditor.partial.dom.test.tsx b/frontend/src/components/VideoEditor.partial.dom.test.tsx
index 52fd18f2..ca7d44a5 100644
--- a/frontend/src/components/VideoEditor.partial.dom.test.tsx
+++ b/frontend/src/components/VideoEditor.partial.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// A split export that fails part-way (deep-review E11 rounds 2 and 3). Every clip is its own job,
+// A split export that fails part-way. Every clip is its own job,
 // committed as it goes, so a failure at clip 2 of 2 (the job cap) left clip 1 queued while the editor
 // reported a plain failure and kept both selected — and trying again queued clip 1 a second time. It
 // now says how many made it (also when `req` has already shown the refusal in its dialog), deselects
diff --git a/frontend/src/components/VideoEditor.tsx b/frontend/src/components/VideoEditor.tsx
index cfa8ce2d..66178a43 100644
--- a/frontend/src/components/VideoEditor.tsx
+++ b/frontend/src/components/VideoEditor.tsx
@@ -77,7 +77,7 @@ export default function VideoEditor({ job, onClose }: { job: DownloadJob; onClos
   const [segments, setSegments] = useState<Seg[]>([{ id: 0, start: 0, end: srcDur, keep: true }]);
   // Set while Create queues its clips. A part-way failure deselects the clips it queued by the ids
   // Create started with, so the cut list holds still until it is done: a split or a merge in between
-  // would deselect a range that was never queued, or keep one that was (deep-review E11 round 3).
+  // would deselect a range that was never queued, or keep one that was.
   const creating = useRef(false);
   // The "(i/N)" each clip of the last Create was named with, by segment id: a retry after a part-way
   // failure goes on with that series instead of renumbering what is left ("(1/2)" beside "(1/4)").
@@ -203,7 +203,7 @@ export default function VideoEditor({ job, onClose }: { job: DownloadJob; onClos
   // --- timeline drag (seek / boundary) + hover preview ---
   const [drag, setDrag] = useState<Drag | null>(null);
   // The hover point, measured in the pointer handler (track-relative x and its time), so render never
-  // reads the track's geometry (a DOM read in render made the React Compiler skip the editor, E32).
+  // reads the track's geometry (a DOM read in render made the React Compiler skip the editor).
   const [hover, setHover] = useState<{ x: number; time: number } | null>(null);
   const timeAt = useCallback(
     (clientX: number) => {
@@ -369,7 +369,7 @@ export default function VideoEditor({ job, onClose }: { job: DownloadJob; onClos
           setSegments((segs) => segs.map((s) => (done.includes(s.id) ? { ...s, keep: false } : s)));
           // Its own toast, not notifyActionError: a quota or edit refusal has already opened req's
           // error dialog and marked the error, so that helper would say nothing — and the count is
-          // what the dialog does not tell (deep-review E11 round 3).
+          // what the dialog does not tell.
           notify({
             level: "error",
             title: t("editor.partlyCreated", { done: done.length, total: N }),
diff --git a/frontend/src/components/VideoInfoCard.dom.test.tsx b/frontend/src/components/VideoInfoCard.dom.test.tsx
index c4f22f49..bb97b84c 100644
--- a/frontend/src/components/VideoInfoCard.dom.test.tsx
+++ b/frontend/src/components/VideoInfoCard.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Contract of a video's details panel (E8·S3; opened from the video's menu since E28 C1): the
+// Contract of a video's details panel (opened from the video's menu): the
 // header (full title + channel) renders IMMEDIATELY from the Video we already hold, while the
 // description (videoDetail) and the channel's tags (channelDetail.tag_ids resolved against the tag
 // list) fill in from their on-demand queries; an empty description falls back to the "no description"
diff --git a/frontend/src/components/VideoInfoCard.tsx b/frontend/src/components/VideoInfoCard.tsx
index ddc74a63..ad6e3d04 100644
--- a/frontend/src/components/VideoInfoCard.tsx
+++ b/frontend/src/components/VideoInfoCard.tsx
@@ -12,8 +12,8 @@ import { SURFACE } from "./ui/surfaces";
 import { Badge } from "./ui/Badge";
 import { useTags } from "../lib/useTags";
 
-// A video's details (E8·S3, decision D3): full (un-clamped) title, channel, views·duration·date, a
-// description snippet, and the channel's tags. E28 C1 moved it from a hover ⓘ on the thumbnail into
+// A video's details: full (un-clamped) title, channel, views·duration·date, a
+// description snippet, and the channel's tags. It moved from a hover ⓘ on the thumbnail into
 // the video's action list ("Details"): the hover card was invisible on touch and one more button in
 // the card's hover row, and the menu is the one door every device has. It opens anchored to the card
 // the menu came from, as a small dialog.
diff --git a/frontend/src/components/VideoMenu.dom.test.tsx b/frontend/src/components/VideoMenu.dom.test.tsx
index 85e92b87..75c2c62f 100644
--- a/frontend/src/components/VideoMenu.dom.test.tsx
+++ b/frontend/src/components/VideoMenu.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 C1: a video's ONE action list. The right-click and the card's "…" open the same menu, which
+// A video's ONE action list. The right-click and the card's "…" open the same menu, which
 // holds everything the card no longer shows (download, details, copy, hide, reset, pin) beside the
 // everyday toggles, and each row fires the same handler the card's own buttons do.
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
@@ -9,7 +9,6 @@ import { FloatingTree } from "@floating-ui/react";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 
 import type { Video } from "../lib/api";
-import { qk } from "../lib/queryKeys";
 
 vi.mock("react-i18next", async (importOriginal) => {
   const actual = await importOriginal<typeof import("react-i18next")>();
@@ -99,7 +98,7 @@ function Feed({
   );
 }
 
-function setup(v: Video, { demo = false } = {}) {
+function setup(v: Video) {
   const handlers = {
     onState: vi.fn(),
     onToggleSave: vi.fn(),
@@ -107,7 +106,6 @@ function setup(v: Video, { demo = false } = {}) {
     onOpen: vi.fn(),
   };
   const qc = new QueryClient();
-  qc.setQueryData(qk.me(), { is_demo: demo });
   render(
     <QueryClientProvider client={qc}>
       <FloatingTree>
@@ -175,12 +173,6 @@ describe("a video's menu", () => {
     expect(await screen.findByText("playlists.noneYet")).toBeTruthy();
   });
 
-  it("has no download row on the demo account", () => {
-    setup(video({}), { demo: true });
-    rightClick();
-    expect(labels()).not.toContain("downloads.menu.download");
-  });
-
   it("the '…' opens the same menu, says so, and a second press closes it", () => {
     setup(video({}));
     expect(more().getAttribute("aria-haspopup")).toBe("menu");
diff --git a/frontend/src/components/ViewSwitcher.tsx b/frontend/src/components/ViewSwitcher.tsx
index 8148edd1..710bf418 100644
--- a/frontend/src/components/ViewSwitcher.tsx
+++ b/frontend/src/components/ViewSwitcher.tsx
@@ -18,7 +18,7 @@ export interface ViewOption<T extends string> {
 // density modes; the managers' layouts) without re-deriving the menu behaviour.
 //
 // This was the house's textbook menu, with its own hand-rolled roving-tabindex/arrow/Escape engine.
-// It now rides the R8 popover platform like every other menu, which supplies the same model
+// It now rides the popover platform like every other menu, which supplies the same model
 // (arrows/Home/End rove, Escape closes and hands focus back to the trigger, Tab out closes) plus the
 // two things the hand-rolled version lacked: typeahead, and anchoring that flips and shifts instead
 // of being absolutely positioned inside whatever ancestor happens to clip it.
diff --git a/frontend/src/components/VirtualFeed.tsx b/frontend/src/components/VirtualFeed.tsx
index 3fc2d66a..52c2c63c 100644
--- a/frontend/src/components/VirtualFeed.tsx
+++ b/frontend/src/components/VirtualFeed.tsx
@@ -10,7 +10,7 @@ import VirtualGrid from "./ui/VirtualGrid";
 // the very first paint and the scrollbar's initial guess. Taken from measuring each mode in the
 // browser rather than guessed — a bad estimate makes the scrollbar jump as you scroll in.
 // RE-MEASURE these when a mode's layout changes: they have gone stale twice already, most recently
-// when the E28 C1 action row moved onto the card's picture (cards 340 -> 262, small 257 -> 226).
+// when the action row moved onto the card's picture (cards 340 -> 262, small 257 -> 226).
 // The card figures are the roughest of the set by nature — a card's height follows its column width
 // (262 measured at 4 columns in a 1268px window), so no single constant is right for every window.
 const ROW_EST: Record<FeedView, number> = {
@@ -48,7 +48,7 @@ export default function VirtualFeed({
   fetchNextPage,
 }: VirtualFeedProps) {
   const { minCol, colMaxWidth, maxCols, thumb } = FEED_VIEW_SPEC[view];
-  // The card menu (the video's whole action list, E28 C1) lives HERE rather than in each of the
+  // The card menu (the video's whole action list) lives HERE rather than in each of the
   // feed's callers: this is the list, and `useContextMenu`'s contract is one menu per list. Mounting
   // it at this level is also what gives the channel page the menu for free — it renders
   // `<Feed channelScoped>`, so it is the same component all the way down.
diff --git a/frontend/src/components/WatchPage.dom.test.tsx b/frontend/src/components/WatchPage.dom.test.tsx
index 15951517..1395cab8 100644
--- a/frontend/src/components/WatchPage.dom.test.tsx
+++ b/frontend/src/components/WatchPage.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// S3 item 5a: the public watch page must render a native <audio> element for an audio-only asset
+// The public watch page must render a native <audio> element for an audio-only asset
 // (mp3) and a <video> for everything else. WebKit (all iOS browsers) refuses to play an audio-only
 // mp3 inside a <video>, which is exactly why the branch exists — this locks it so a refactor can't
 // silently drop the audio player and reintroduce the iPad-broken behavior.
@@ -67,7 +67,7 @@ describe("WatchPage repeat", () => {
   });
 });
 
-// E28: the Download link sat at the button's 32 beside the Repeat chip's 28 — one row, two heights.
+// The Download link sat at the button's 32 beside the Repeat chip's 28 — one row, two heights.
 describe("WatchPage action row", () => {
   it("puts the Download on the toolbar rung, level with the Repeat chip", async () => {
     window.history.replaceState({}, "", "/watch/tok-row");
@@ -85,7 +85,7 @@ describe("WatchPage action row", () => {
     expect(download.className).toContain("h-7");
   });
 
-  // E28 S3d4 (B6): the page the stranger sees wears the app's surfaces — the scheme's ambient
+  // DESIGN B6: the page the stranger sees wears the app's surfaces — the scheme's ambient
   // backdrop (no page fill over the body's), the title and actions on a glass panel, a glass Download.
   it("sits on the app's surfaces: backdrop, a glass panel, a glass Download", async () => {
     window.history.replaceState({}, "", "/watch/tok-b6");
@@ -107,7 +107,7 @@ describe("WatchPage action row", () => {
   });
 });
 
-describe("WatchPage media element (S3 · 5a)", () => {
+describe("WatchPage media element", () => {
   it("renders a native <audio> for an audio-only asset", async () => {
     window.history.replaceState({}, "", "/watch/tok-audio");
     mockMeta({ needs_password: false, audio: true, file_url: "/f.mp3", title: "A song" });
@@ -124,7 +124,7 @@ describe("WatchPage media element (S3 · 5a)", () => {
     expect(container.querySelector("audio")).toBeNull();
   });
 
-  it("renders an info card + Download for a generic file, no player (S5d)", async () => {
+  it("renders an info card + Download for a generic file, no player", async () => {
     window.history.replaceState({}, "", "/watch/tok-file");
     mockMeta({
       needs_password: false,
@@ -143,11 +143,11 @@ describe("WatchPage media element (S3 · 5a)", () => {
     await findByText(/PDF · 2\.3 MB/);
     const dl = container.querySelector('a[href="/f.pdf"]');
     expect(dl).not.toBeNull();
-    // E28: the page's one action is the filled primary, not a muted outline.
+    // The page's one action is the filled primary, not a muted outline.
     expect(dl!.className).toContain("state-filled");
   });
 
-  it("omits the Download for a view-only file link (S5d)", async () => {
+  it("omits the Download for a view-only file link", async () => {
     window.history.replaceState({}, "", "/watch/tok-file-noview");
     mockMeta({
       needs_password: false,
diff --git a/frontend/src/components/WatchPage.tsx b/frontend/src/components/WatchPage.tsx
index d14c692e..40da9bf0 100644
--- a/frontend/src/components/WatchPage.tsx
+++ b/frontend/src/components/WatchPage.tsx
@@ -313,7 +313,7 @@ export default function WatchPage() {
              link allows it, a Download. The backend serves the file force-download regardless, so
              gating the button on allow_download only mirrors the owner's ACL, matching the media
              branch's download affordance below. It is the page's one action, so it is the filled
-             primary (E28), as the unlock card's Watch is. */
+             primary, as the unlock card's Watch is. */
           <div className="flex-1 grid place-items-center">
             <div className={`${SURFACE.panel} w-full max-w-md p-6 text-center`}>
               <div className="mx-auto w-16 h-16 rounded-xl bg-surface grid place-items-center mb-4">
diff --git a/frontend/src/components/Welcome.tsx b/frontend/src/components/Welcome.tsx
index 322dfb6e..ba604bac 100644
--- a/frontend/src/components/Welcome.tsx
+++ b/frontend/src/components/Welcome.tsx
@@ -61,7 +61,7 @@ const SUBMIT_KEY: Record<Mode, string> = {
 };
 
 // Public landing + authentication. One scrollable page: a hero with the auth card (email+
-// password, Google, explicit demo) over a short marketing pitch with feature cards. Shown
+// password, Google) over a short marketing pitch with feature cards. Shown
 // whenever the user isn't signed in (see App.tsx). The auth forms talk to /auth/* (see the
 // backend); errors are surfaced inline (the api calls use the quiet flag).
 export default function Welcome({ verify }: { verify: VerifyEntry }) {
@@ -211,7 +211,7 @@ function FeatureCard({ icon: Icon, k }: { icon: LucideIcon; k: string }) {
 }
 
 // Image with a graceful fallback: if the file isn't present yet, show a tasteful placeholder
-// frame instead of a broken image (the demo screenshots drop into frontend/public/welcome/).
+// frame instead of a broken image (the screenshots drop into frontend/public/welcome/).
 // When loaded it's a button that opens the full-size lightbox (onOpen).
 function Preview({
   src,
@@ -258,28 +258,28 @@ function Preview({
 // (aspect ratio preserved via object-contain). Closes on backdrop click, the ✕, or Escape.
 function Lightbox({ src, label, onClose }: { src: string; label: string; onClose: () => void }) {
   const { t } = useTranslation();
-  // An `aria-modal` shell that round 5's focus extraction did not sweep in: it declared itself a
+  // An `aria-modal` shell that the focus extraction did not sweep in: it declared itself a
   // modal dialog while leaving focus on the thumbnail behind an 80%-black scrim, announcing nothing,
   // and letting Tab walk the landing page underneath — the ✕ reachable only after tabbing past every
-  // remaining gallery shot (deep-review round 6). The contract comes from the same place `ui/Modal`
-  // and the wizard get theirs; the body-scroll lock moved with it, and round 7 added the layer
+  // remaining gallery shot. The contract comes from the same place `ui/Modal`
+  // and the wizard get theirs; the body-scroll lock moved with it, and a later fix added the layer
   // membership below.
   //
   // It was the third of four `aria-modal` shells to get the contract; `PlayerModal`, the fourth,
-  // joined in E11 S2, so all four (`ui/Modal`, the wizard, this, the player) now share
+  // joined last, so all four (`ui/Modal`, the wizard, this, the player) now share
   // `useDialogChrome` and its one counted scroll lock.
   const panelRef = useRef<HTMLDivElement>(null);
   useDialogChrome(panelRef);
   // An effect event, so the stack id is assigned once per mount (as in ui/Modal).
   const close = useEffectEvent(onClose);
   useEffect(() => {
-    // Round 6 gave this shell the trap and the restore but not the LAYER MEMBERSHIP the other three
+    // One fix gave this shell the trap and the restore but not the LAYER MEMBERSHIP the other three
     // have, so its Escape and Tab fired from a raw window listener whatever was on top of it. That
     // is the shape the wizard's own comment records being bitten by — "one Esc closed the error AND
     // ended onboarding" — and it is unreachable today only because `App` returns `<Welcome/>` before
     // it mounts `ErrorDialog` and the Toaster, i.e. by an ordering nothing enforces. Joining the
     // stack costs two lines and removes the trap-fights-trap failure mode from the next layer the
-    // landing page grows (deep-review round 7).
+    // landing page grows.
     const id = pushLayer();
     const onKey = (e: KeyboardEvent) => {
       if (takeEscape(e, id)) {
@@ -402,8 +402,8 @@ function AuthCard({ verify }: { verify: VerifyEntry }) {
       .catch(() => {});
   }, []);
   const [done, setDone] = useState<string>(""); // success/info message replacing the form
-  // Why password sign-in refused, when the server named a state worth a screen rather than a red line
-  // (E9.5 S4). It REPLACES the form: in all three of those states the password was already proven
+  // Why password sign-in refused, when the server named a state worth a screen rather than a red line.
+  // It REPLACES the form: in all three of those states the password was already proven
   // correct, so there is nothing to retype — leaving the form up would only invite a pointless retry.
   const [blocked, setBlocked] = useState<LoginBlocked | null>(null);
   // The emailed reset link turned out to be spent, expired, or to belong to an account that no longer
@@ -446,13 +446,6 @@ function AuthCard({ verify }: { verify: VerifyEntry }) {
     setDeadReset(false);
   }
 
-  // Explicit demo entry (replaces the old hidden probe): a labelled email field, still gated
-  // by the demo whitelist server-side.
-  const [showDemo, setShowDemo] = useState(false);
-  const [demoEmail, setDemoEmail] = useState("");
-  const [demoBusy, setDemoBusy] = useState(false);
-  const [demoError, setDemoError] = useState("");
-
   const reset = () => {
     setError("");
     setDone("");
@@ -533,25 +526,6 @@ function AuthCard({ verify }: { verify: VerifyEntry }) {
     setBusy(false);
   }
 
-  async function onDemo(e: React.SubmitEvent<HTMLFormElement>) {
-    e.preventDefault();
-    setDemoError("");
-    const mail = demoEmail.trim().toLowerCase();
-    if (!EMAIL_RE.test(mail)) {
-      setDemoError(t("welcome.auth.invalidEmail"));
-      return;
-    }
-    setDemoBusy(true);
-    try {
-      const r = await api.demoLogin(mail);
-      if (r.authenticated) window.location.reload();
-      else setDemoError(t("welcome.auth.demoDenied"));
-    } catch {
-      setDemoError(t("welcome.auth.demoDenied"));
-    }
-    setDemoBusy(false);
-  }
-
   // A named state owns the card's heading while it is up, so it reads as the card's subject rather
   // than a box sitting inside a heading that still says "Set a new password".
   const titleKey = blocked
@@ -691,7 +665,7 @@ function AuthCard({ verify }: { verify: VerifyEntry }) {
             </Button>
           </form>
 
-          {/* A confirmation mail can be slow, filtered, or — before E9.5 S6 — never sent at all for a
+          {/* A confirmation mail can be slow, filtered, or — in older builds — never sent at all for a
               repeat sign-up. Offered right under the form rather than below the mode switches: it is
               the second thing a stuck person needs, after the password they just tried. */}
           {mode === "signin" && (
@@ -736,46 +710,18 @@ function AuthCard({ verify }: { verify: VerifyEntry }) {
             )}
           </div>
 
-          {mode === "signin" && (
+          {/* The divider separates two ways in, so it goes with the second one: on an instance with
+              no Google sign-in there is nothing to say "or" to. */}
+          {mode === "signin" && googleEnabled && (
             <>
               <div className="flex items-center gap-3 my-4 text-2xs uppercase tracking-wide text-muted">
                 <span className="h-px flex-1 bg-border" />
                 {t("welcome.auth.or")}
                 <span className="h-px flex-1 bg-border" />
               </div>
-              {googleEnabled && (
-                <LinkButton href="/auth/login" size="lg" fullWidth>
-                  {t("welcome.auth.google")}
-                </LinkButton>
-              )}
-              {!showDemo ? (
-                <Button
-                  variant="outline"
-                  size="lg"
-                  fullWidth
-                  className="mt-2"
-                  onClick={() => setShowDemo(true)}
-                >
-                  {t("welcome.auth.tryDemo")}
-                </Button>
-              ) : (
-                <form onSubmit={onDemo} className="mt-2 flex flex-col gap-2">
-                  <p className="text-2xs text-muted">{t("welcome.auth.demoHint")}</p>
-                  <div className="flex gap-2">
-                    <Input
-                      className="w-full"
-                      type="email"
-                      value={demoEmail}
-                      onChange={(e) => setDemoEmail(e.target.value)}
-                      placeholder={t("welcome.auth.demoEmail")}
-                    />
-                    <Button type="submit" variant="outline" size="lg" disabled={demoBusy}>
-                      {demoBusy ? t("welcome.auth.working") : t("welcome.auth.demoEnter")}
-                    </Button>
-                  </div>
-                  {demoError && <p className="text-xs text-danger">{demoError}</p>}
-                </form>
-              )}
+              <LinkButton href="/auth/login" size="lg" fullWidth>
+                {t("welcome.auth.google")}
+              </LinkButton>
             </>
           )}
         </>
@@ -854,7 +800,7 @@ function StatePanel({
   );
 }
 
-// The named state behind a 403, in place of the sign-in form (E9.5 S4). It says WHICH mailbox the
+// The named state behind a 403, in place of the sign-in form. It says WHICH mailbox the
 // account is on and WHICH of the two gates is still shut, because the flat "awaiting admin approval"
 // string it replaces was true and useless: it never revealed that the address the account carried was
 // a different spelling of the one the user had just typed.
diff --git a/frontend/src/components/WizardProvider.tsx b/frontend/src/components/WizardProvider.tsx
index e51aee82..3f31841a 100644
--- a/frontend/src/components/WizardProvider.tsx
+++ b/frontend/src/components/WizardProvider.tsx
@@ -34,14 +34,13 @@ export function WizardProvider({ children }: { children: ReactNode }) {
   const meId = me?.id;
   const canRead = me?.can_read;
   const canWrite = me?.can_write;
-  const isDemo = me?.is_demo;
   const googleEnabled = me?.google_enabled;
   useEffect(() => {
     if (meId == null || canRead == null) return;
-    const account = { can_read: canRead, is_demo: isDemo, google_enabled: googleEnabled };
+    const account = { can_read: canRead, google_enabled: googleEnabled };
     // eslint-disable-next-line react-hooks/set-state-in-effect -- opening is a one-way decision taken from SERVER data as it arrives, not a value derivable in render — deriving `open` from the grants would re-open a wizard the user had just closed, which is exactly what the narrowed dep list above exists to prevent.
     if (shouldAutoOpenOnboarding(account)) setOpen(true);
-  }, [meId, canRead, canWrite, isDemo, googleEnabled]);
+  }, [meId, canRead, canWrite, googleEnabled]);
 
   const actions = useMemo<WizardActions>(
     () => ({ openWizard, closeWizard }),
@@ -51,10 +50,9 @@ export function WizardProvider({ children }: { children: ReactNode }) {
   return (
     <WizardActionsContext.Provider value={actions}>
       {children}
-      {/* The wizard is a full-screen overlay; the demo account can't connect YouTube, so it never
-          opens there. Lazy — its chunk loads only when first opened. */}
+      {/* The wizard is a full-screen overlay. Lazy — its chunk loads only when first opened. */}
       <Suspense fallback={null}>
-        {open && me && !me.is_demo && <OnboardingWizard me={me} onClose={closeWizard} />}
+        {open && me && <OnboardingWizard me={me} onClose={closeWizard} />}
       </Suspense>
     </WizardActionsContext.Provider>
   );
diff --git a/frontend/src/components/WriteFailureReporting.dom.test.tsx b/frontend/src/components/WriteFailureReporting.dom.test.tsx
index 705cef41..b430522e 100644
--- a/frontend/src/components/WriteFailureReporting.dom.test.tsx
+++ b/frontend/src/components/WriteFailureReporting.dom.test.tsx
@@ -2,10 +2,10 @@
 //
 // A write that fails is named, wherever it fails. `req`/`uploadReq` deliberately leave 403/404/429
 // to the caller (see reportFailure) and answer a 502/503/504 with only the transient "connection
-// lost" notice — so a handler with no `catch` reports nothing at all. Round 4 swept a dozen such
+// lost" notice — so a handler with no `catch` reports nothing at all. A sweep fixed a dozen such
 // call sites and missed these two: the collection editor's three siblings, in the very file it
 // edited, and the one `uploadReq` caller, whose empty catch still claimed the global error modal had
-// it (deep-review round 5).
+// it.
 import { describe, it, expect, vi, beforeAll, beforeEach, afterEach } from "vitest";
 import { render, cleanup, screen, fireEvent, waitFor } from "@testing-library/react";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
@@ -49,7 +49,7 @@ afterEach(() => {
   vi.restoreAllMocks();
 });
 
-// What failed, as the toast names it: the title (E11 S2b — the title says WHAT, the line under it WHY).
+// What failed, as the toast names it: the title (the title says WHAT, the line under it WHY).
 const errors = () =>
   notify.mock.calls.filter(([n]) => n.level === "error").map(([n]) => n.title ?? n.message);
 const client = () => new QueryClient({ defaultOptions: { queries: { retry: false } } });
@@ -131,7 +131,7 @@ describe("the upload dialog", () => {
     // fails, retries once after 250 ms and then raises the "connection lost" notice — a delayed
     // toast that outlives the test that spawned it and lands as an unexpected error in whichever
     // test is running by then. The file is fast enough today that it always lands after the suite,
-    // which is a coincidence, not a guarantee (deep-review round 2).
+    // which is a coincidence, not a guarantee.
     vi.spyOn(api, "downloadUsage").mockResolvedValue({
       upload_max_bytes: 1_000_000,
     } as Awaited<ReturnType<typeof api.downloadUsage>>);
@@ -162,7 +162,7 @@ describe("the upload dialog", () => {
 describe("the download dialog", () => {
   it("names a queueing the server refused with no dialog of its own", async () => {
     // Its catch said "the global error dialog already surfaced the reason" — true for a quota 422,
-    // not for a 403/404/429 or a lost connection, where the dialog just stayed open (E11 S2b).
+    // not for a 403/404/429 or a lost connection, where the dialog just stayed open.
     vi.spyOn(api, "downloadProfiles").mockResolvedValue([{ id: 1, name: "Best" }] as never);
     vi.spyOn(api, "enqueueDownload").mockRejectedValue(new HttpError(403, "nope"));
     render(
diff --git a/frontend/src/components/YearFilter.tsx b/frontend/src/components/YearFilter.tsx
index 97da87f8..e2344063 100644
--- a/frontend/src/components/YearFilter.tsx
+++ b/frontend/src/components/YearFilter.tsx
@@ -13,7 +13,7 @@ import CountBadge from "./ui/CountBadge";
 import { useDebounced } from "../lib/useDebounced";
 import { SURFACE } from "./ui/surfaces";
 
-// The feed rail's "Year" control (item 8 / E8·S2): quick chips for the most recent years plus a
+// The feed rail's "Year" control: quick chips for the most recent years plus a
 // "More…" popover listing ALL years with per-year counts, sortable by year or count. Selecting a year
 // filters the feed to that calendar year (a whole-year published_after/before range, applied in the
 // api layer); it's a single-select toggle (click the active year to clear it) and mutually exclusive
diff --git a/frontend/src/components/accountPanel.dom.test.tsx b/frontend/src/components/accountPanel.dom.test.tsx
index a7b286f3..55151e6a 100644
--- a/frontend/src/components/accountPanel.dom.test.tsx
+++ b/frontend/src/components/accountPanel.dom.test.tsx
@@ -58,7 +58,6 @@ const user = {
   email: "stuck@example.com",
   display_name: null,
   role: "user",
-  is_demo: false,
   is_active: false,
   is_suspended: false,
 };
@@ -88,7 +87,7 @@ beforeEach(() => {
 afterEach(cleanup);
 
 // What each error toast names: its title when it has one (a failure reported with its reason under
-// it — E11 S2b), else the specific sentence (the no-mail case).
+// it), else the specific sentence (the no-mail case).
 const errorMessages = () =>
   notifyMock.mock.calls
     .map(([a]) => a as { level?: string; title?: string; message?: string })
@@ -148,15 +147,3 @@ describe("the account panel reports a refused recovery action", () => {
     await waitFor(() => expect(errorMessages()).toContain("users.pendingAccess.activateFailed"));
   });
 });
-
-describe("the account panel on the demo account", () => {
-  // The demo account's address is never confirmed, so "send the confirmation link again" looked
-  // available — and the server refused it as "nothing left to confirm", beside a row reading
-  // "unconfirmed" (deep-review E11 round 3).
-  it("does not offer it a confirmation mail, which the server refuses", async () => {
-    mount({ ...user, is_demo: true });
-    await screen.findByText("users.account.recovery");
-    const resend = screen.getByText("users.account.resend").closest("button")!;
-    expect(resend.hasAttribute("disabled")).toBe(true);
-  });
-});
diff --git a/frontend/src/components/adminInvites.dom.test.tsx b/frontend/src/components/adminInvites.dom.test.tsx
index e7bb319a..a0134b2e 100644
--- a/frontend/src/components/adminInvites.dom.test.tsx
+++ b/frontend/src/components/adminInvites.dom.test.tsx
@@ -72,7 +72,7 @@ vi.mock("../lib/api", async (importOriginal) => {
       adminInvites: () => listMock(),
       deleteInvite: (id: number) => deleteMock(id),
       sendInvitation: (id: number, lang: string) => inviteMock(id, lang),
-      // The access tab also renders the stuck-sign-ups section (E9.5 S5); nothing stuck here, so it
+      // The access tab also renders the stuck-sign-ups section; nothing stuck here, so it
       // renders nothing and this file stays about the delete affordance.
       adminPendingAccess: () => Promise.resolve([]),
     },
@@ -164,7 +164,7 @@ describe("Access requests — the delete affordance", () => {
     await openAccessTab();
 
     fireEvent.click(await screen.findByText(/settings\.invites\.decided/));
-    // E30: the decision is named, not the raw status word ("denied").
+    // The decision is named, not the raw status word ("denied").
     expect(screen.getByText("settings.invites.status.denied")).toBeTruthy();
     expect(screen.queryByText("denied")).toBeNull();
     fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
@@ -243,7 +243,7 @@ describe("Access requests — the delete affordance", () => {
 
 // Whitelisting an address is opening a door as a possibility, not knocking on one — the operator has
 // usually already agreed it with the person, and a row can sit approved for weeks. So adding stays
-// silent and telling them is its own act, on its own button (E9.5 S6).
+// silent and telling them is its own act, on its own button.
 describe("inviting someone the admin whitelisted", () => {
   // The decided rows live behind a <details>; await the summary rather than the section title, or
   // the click races the invite query that populates it.
@@ -317,7 +317,7 @@ describe("inviting someone the admin whitelisted", () => {
     expect(dialog.container.textContent).toContain("settings.invites.inviteConfirmAgain");
   });
 
-  it("dates the earlier invite in the admin's language, not the invitee's (E30 review)", async () => {
+  it("dates the earlier invite in the admin's language, not the invitee's", async () => {
     listMock.mockResolvedValue([
       invite({ status: "approved", invited_at: "2026-09-05T09:00:00Z", lang: "hu" }),
     ]);
diff --git a/frontend/src/components/adminPendingAccess.dom.test.tsx b/frontend/src/components/adminPendingAccess.dom.test.tsx
index 2faed812..c4110d7e 100644
--- a/frontend/src/components/adminPendingAccess.dom.test.tsx
+++ b/frontend/src/components/adminPendingAccess.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The admin lifeline for a sign-up that is stuck outside (E9.5 S5, roadmap UX-25). Approve an address
+// The admin lifeline for a sign-up that is stuck outside (roadmap UX-25). Approve an address
 // BEFORE the person registers and their sign-up produces no queue row at all, so the Access-requests
 // screen was empty while they sat locked out and the only working move — re-typing the address into
 // the whitelist box — was undiscoverable. These pin what the section shows and, just as importantly,
@@ -79,7 +79,6 @@ const row = (over: Record<string, unknown> = {}) => ({
   is_active: false,
   is_suspended: false,
   email_verified: true,
-  is_demo: false,
   has_password: true,
   has_google: false,
   created_at: "2026-09-01T10:00:00Z",
diff --git a/frontend/src/components/auditColumns.dom.test.tsx b/frontend/src/components/auditColumns.dom.test.tsx
index dee35785..43001585 100644
--- a/frontend/src/components/auditColumns.dom.test.tsx
+++ b/frontend/src/components/auditColumns.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E30: an audit row whose server summary is a fixed English line ("rss_poll: ok — new=5, failed=0",
+// An audit row whose server summary is a fixed English line ("rss_poll: ok — new=5, failed=0",
 // "log_level = DEBUG", "Background sync paused") reads in the reader's language, rebuilt from the row's
 // data through the REAL catalog. A row whose summary is data (an e-mail, a URL) keeps it.
 import { afterEach, describe, expect, it } from "vitest";
@@ -10,7 +10,7 @@ import type { AuditRow } from "../lib/api";
 import { auditColumns } from "./auditColumns";
 
 // Unmount BEFORE the language goes back: a mounted reader re-renders on the switch, and under a loaded
-// run that render landed after the test environment was gone ("window is not defined", E31 S5).
+// run that render landed after the test environment was gone ("window is not defined").
 afterEach(() => {
   cleanup();
   setLanguage("en");
@@ -87,7 +87,7 @@ describe("an audit row's details", () => {
     expect(details(secret)).toMatch(/ \| titok frissítve/);
   });
 
-  it("name a nested result and a skipped run from the row's data (E30 review)", () => {
+  it("name a nested result and a skipped run from the row's data", () => {
     const nested = row({
       target_type: "job",
       target_id: "people_enrich",
@@ -158,7 +158,7 @@ describe("an audit row's details", () => {
   });
 });
 
-// E31: a folded run (lib/auditGroups) shows its newest run and opens to the earlier ones; a failed run
+// A folded run (lib/auditGroups) shows its newest run and opens to the earlier ones; a failed run
 // is the line to see in a page of routine ones.
 describe("a folded run of one job", () => {
   const ok = (id: number, enriched: number) =>
diff --git a/frontend/src/components/auditColumns.tsx b/frontend/src/components/auditColumns.tsx
index 61b5ef4b..782979f9 100644
--- a/frontend/src/components/auditColumns.tsx
+++ b/frontend/src/components/auditColumns.tsx
@@ -34,7 +34,7 @@ function counts(after: Record<string, unknown>): JobResult | null {
   return Object.keys(out).length ? out : null;
 }
 
-/** The details of the rows whose server `summary` is a fixed English line (E30), rebuilt from the row's
+/** The details of the rows whose server `summary` is a fixed English line, rebuilt from the row's
  *  data in the reader's language: a job run names the job and its result (as the inbox does), a config
  *  change names the field and its values, an interval or batch change its new value, a count-bearing
  *  action its counts; a pause/resume says nothing the action has not. `undefined` = not one of these (or
@@ -74,11 +74,7 @@ function localDetails(
       head: t("scheduler.maintenance.batchLabel"),
       sub: formatNumber(after.revalidate_batch, lang),
     };
-  if (
-    row.action === "audit_clear" ||
-    row.action === "demo_reset" ||
-    row.action === "discovery_purge"
-  ) {
+  if (row.action === "audit_clear" || row.action === "discovery_purge") {
     const result = counts(after);
     return result ? { head: null, sub: jobResultText(t, result, lang) } : undefined;
   }
@@ -150,7 +146,7 @@ export function auditColumns(
         const local = localDetails(t, r, lang);
         const summary = local ? local.head : r.summary;
         const change = local ? local.sub : changeText(r);
-        // A failed run is the row to see in a page of routine ones (E31): its line in the danger colour.
+        // A failed run is the row to see in a page of routine ones: its line in the danger colour.
         const failed = r.action === "job_run" && r.after?.status === "error";
         return (
           // wrap-break-word (wrap), NOT truncate: in the auto-layout table a `truncate` (nowrap) cell
diff --git a/frontend/src/components/authCardStates.dom.test.tsx b/frontend/src/components/authCardStates.dom.test.tsx
index c0e09e56..1e2f630f 100644
--- a/frontend/src/components/authCardStates.dom.test.tsx
+++ b/frontend/src/components/authCardStates.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The honest states of the sign-in card (E9.5 S4). Two things are under test and they share a root:
+// The honest states of the sign-in card. Two things are under test and they share a root:
 // a screen that does not name the address it is talking about hides an alias mismatch. On 2026-09-03
 // a registration as `np.temu@gmail.com` met a Google claim of `nptemu@gmail.com` and every screen in
 // the funnel stayed silent about it.
@@ -19,7 +19,7 @@ const noVerify: VerifyEntry = {
 };
 
 // Every case re-imports the whole Welcome tree after a module reset. The FIRST import also transforms
-// it, which under the full suite's parallel load ran past the 5 s test timeout (E32 S2, gate flake).
+// it, which under the full suite's parallel load ran past the 5 s test timeout (a gate flake).
 // Transforms survive resetModules, so warming them once here leaves each case only the evaluation.
 beforeAll(async () => {
   await import("./Welcome");
@@ -121,7 +121,7 @@ describe("a refused sign-in becomes a named state", () => {
 
     await signIn("approved.first@example.com");
 
-    // E9.5 S1 made the two gates order-independent; a screen that assumed a sequence would send this
+    // The two gates are order-independent; a screen that assumed a sequence would send this
     // user off to wait for an admin who has already decided.
     expect(screen.getByText("welcome.auth.blocked.gate.emailPending")).toBeTruthy();
     expect(screen.getByText("welcome.auth.blocked.gate.approvalDone")).toBeTruthy();
diff --git a/frontend/src/components/channelColumns.dom.test.tsx b/frontend/src/components/channelColumns.dom.test.tsx
index 794db934..81e668e4 100644
--- a/frontend/src/components/channelColumns.dom.test.tsx
+++ b/frontend/src/components/channelColumns.dom.test.tsx
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
-// applySyncFilter is the sync-status pre-filter the top chips drive (R14 retired the Sync column and
-// folded its status into a Stored charm). It replaced a column `filter.test`, so it carries the exact
+// applySyncFilter is the sync-status pre-filter the top chips drive (the Sync column was retired and
+// its status folded into a Stored charm). It replaced a column `filter.test`, so it carries the exact
 // "fully" | "needsFull" | "" vocab + predicate — asserted here so a regression can't silently change
 // which channels the top chips show.
 import { describe, it, expect } from "vitest";
@@ -78,7 +78,7 @@ describe("tagsColumnTest (item B — 'No tag')", () => {
   });
 });
 
-describe("tagFilterChips — a pick whose tag is gone (E32 S2)", () => {
+describe("tagFilterChips — a pick whose tag is gone", () => {
   const mine = { id: 1, name: "Music", system: false } as Tag;
   const t = ((k: string) => k) as unknown as TFunction;
   type State = "loaded" | "loading" | "failed";
@@ -105,7 +105,7 @@ describe("tagFilterChips — a pick whose tag is gone (E32 S2)", () => {
     ]);
   });
 
-  // E32 review: before, a pick had NO chip at all until the list loaded — or ever, after a failed
+  // Before, a pick had NO chip at all until the list loaded — or ever, after a failed
   // load — while it still narrowed the table.
   it("is a placeholder while the tag list loads, never called deleted", () => {
     expect(chips("loading", ["77"]).map((c) => [c.key, c.label, c.pending])).toEqual([
diff --git a/frontend/src/components/channelColumns.tsx b/frontend/src/components/channelColumns.tsx
index 1bbd8808..d973a472 100644
--- a/frontend/src/components/channelColumns.tsx
+++ b/frontend/src/components/channelColumns.tsx
@@ -33,7 +33,7 @@ export function subsColumn<T extends { subscriber_count: number | null }>(
   };
 }
 
-/** Sync-status pre-filter for the subscribed table. The Sync COLUMN is gone (R14) — its status folded
+/** Sync-status pre-filter for the subscribed table. The Sync COLUMN is gone — its status folded
  *  into a charm on Stored — so the top chips' `filters.sync` value is applied here instead of via a
  *  column predicate. Same vocab as the old column filter: "fully" | "needsFull" | "" (all). */
 export function applySyncFilter(rows: ManagedChannel[], value: unknown): ManagedChannel[] {
@@ -45,7 +45,6 @@ export function applySyncFilter(rows: ManagedChannel[], value: unknown): Managed
 /** The Tags column filter predicate (item B): the "No tag" sentinel keeps channels the user hasn't
  *  personally tagged (empty `tag_ids`); it's exclusive with real tag picks (the chip row enforces that),
  *  so when present it wins. Otherwise a channel passes if it carries ANY selected tag id. */
-/** @internal exported for channelColumns.dom.test.tsx */
 export function tagsColumnTest(c: ManagedChannel, values: string[]): boolean {
   if (values.includes(NO_TAG_SENTINEL)) return c.tag_ids.length === 0;
   return values.some((v) => c.tag_ids.includes(Number(v)));
@@ -54,9 +53,9 @@ export function tagsColumnTest(c: ManagedChannel, values: string[]): boolean {
 /** The manager's tag-filter chip row (the Tags column filter's values): any picked id that is not one
  *  of the user's tags, then each user tag, then the "No tag" sentinel. A stored pick can outlive its
  *  tag (deleted here or on another device) and still narrows the table to nothing, so it stays a
- *  visible, removable chip — FIRST, so the row's "+N" overflow never folds the reason away (E32 S2) —
+ *  visible, removable chip — FIRST, so the row's "+N" overflow never folds the reason away —
  *  and so does every pick while the tag list loads or after it failed, named by lib/tagPicks' rule
- *  (a placeholder, then the name, "Deleted tag" or the id), not hidden (E32 review). */
+ *  (a placeholder, then the name, "Deleted tag" or the id), not hidden. */
 export function tagFilterChips(o: {
   userTags: Tag[];
   tags: TagList;
@@ -108,7 +107,7 @@ export interface ChannelColumnDeps {
   toggleTag: (channelId: string, tagId: number, hasTag: boolean) => void;
   createAndAttachTag: (channelId: string, name: string) => void;
   onFilterByTag: (tagId: number, name: string) => void;
-  // E8·S4 — suggested user tags per channel (resolved to Tag + confidence), plus accept/dismiss.
+  // Suggested user tags per channel (resolved to Tag + confidence), plus accept/dismiss.
   suggestionsFor: (channelId: string) => SuggestedTag[];
   onAcceptSuggestion: (channelId: string, tagId: number) => void;
   onDismissSuggestion: (channelId: string, tagId: number) => void;
@@ -161,7 +160,7 @@ export function buildChannelColumns(deps: ChannelColumnDeps): Column<ManagedChan
       sortValue: (c) => (c.title ?? c.id).toLowerCase(),
       filter: { kind: "text", get: (c) => `${c.title ?? ""} ${c.handle ?? ""}` },
       cardPrimary: true,
-      // A FLUID column (R14): no width cap. Under the manager table's fixed layout this cell takes a
+      // A FLUID column: no width cap. Under the manager table's fixed layout this cell takes a
       // share of the leftover space and ChannelLink truncates the name to fit (full name on hover via
       // title), so a long name can't push the table wider than its container at any zoom.
       render: (c) => (
@@ -192,7 +191,7 @@ export function buildChannelColumns(deps: ChannelColumnDeps): Column<ManagedChan
       width: "5rem",
       sortable: true,
       sortValue: (c) => c.stored_videos,
-      // The stored count carries the "fully synced" ✓ charm (R14 folded the retired Sync column in).
+      // The stored count carries the "fully synced" ✓ charm (the retired Sync column folded in).
       render: (c) => <StoredCell c={c} />,
     },
     { ...subsColumn<ManagedChannel>(t, lang), width: "6rem" },
@@ -253,7 +252,7 @@ export function buildChannelColumns(deps: ChannelColumnDeps): Column<ManagedChan
       width: "3.25rem",
       nowrap: true,
       cardLabel: false,
-      // The row's full-history, hide and unsubscribe buttons went into the menu (E28 C1): the row
+      // The row's full-history, hide and unsubscribe buttons went into the menu: the row
       // keeps what is read or tuned all the time — priority, tags, the ✓ — and ends in its "…".
       render: more,
     },
diff --git a/frontend/src/components/channelsTagRow.contract.test.ts b/frontend/src/components/channelsTagRow.contract.test.ts
index 2db52de9..af5729f6 100644
--- a/frontend/src/components/channelsTagRow.contract.test.ts
+++ b/frontend/src/components/channelsTagRow.contract.test.ts
@@ -1,4 +1,4 @@
-// The Channels tag row at 375 (E28 S3f3): the suggestions block squeezed the tag-filter chip lane to
+// The Channels tag row at 375: the suggestions block squeezed the tag-filter chip lane to
 // 0 px and pushed the row's "…" off the screen. Below 40rem of its own container it now takes a line of
 // its own under the row, which keeps the "…" on the first line. Channels.tsx needs the whole provider
 // tree to render, so this holds the classes the layout rests on; the widths were measured in a browser.
@@ -23,7 +23,7 @@ describe("the Channels tag row", () => {
   });
 });
 
-// E28 review L7: every other page band folds its filter row on a short window (B4, `useFilterFold`);
+// Every other page band folds its filter row on a short window (B4, `useFilterFold`);
 // the Channels band never did — its tag chips and the status / pager row kept a laptop's short window
 // for themselves. They fold behind one "Filters · n", the tabs and the TAGS editor stay.
 describe("the Channels band on a short window", () => {
@@ -35,7 +35,7 @@ describe("the Channels band on a short window", () => {
     expect(src).toMatch(/layout === "cards" && !fold\.folded/);
   });
 
-  // Round 2 (F2): folded, the table's status / pager row moves to the list's end; the cards' one
+  // Folded, the table's status / pager row moves to the list's end; the cards' one
   // simply vanished, and with it the only way to page them.
   it("keeps the cards' status / pager row at the list's end while folded", () => {
     const grid = src.slice(src.indexOf("<ChannelLayoutGrid"));
diff --git a/frontend/src/components/clientLogWiring.dom.test.tsx b/frontend/src/components/clientLogWiring.dom.test.tsx
index 4d7daeaa..64fbee37 100644
--- a/frontend/src/components/clientLogWiring.dom.test.tsx
+++ b/frontend/src/components/clientLogWiring.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E22 S4: what the user was SHOWN — a toast, the blocking error dialog, the crash screen — and what
+// What the user was SHOWN — a toast, the blocking error dialog, the crash screen — and what
 // failed behind the scenes (a query, a mutation) all land in the client log. Each producer is its
 // own module, so each is asserted here through the real thing, not a mock of it.
 import { afterEach, describe, expect, it, vi } from "vitest";
diff --git a/frontend/src/components/comfortPin.dom.test.ts b/frontend/src/components/comfortPin.dom.test.ts
index f0823f64..79e8f7fc 100644
--- a/frontend/src/components/comfortPin.dom.test.ts
+++ b/frontend/src/components/comfortPin.dom.test.ts
@@ -2,7 +2,7 @@
 //
 // jsdom only because the module graph reaches `lib/api` -> `i18n`, which reads localStorage at
 // import time; nothing here touches the DOM.
-// The two pure rules behind the comfort shelf (E24 S3). Both are one-liners that eight call sites
+// The two pure rules behind the comfort shelf. Both are one-liners that eight call sites
 // depend on, and both are exactly the kind of mapping that rots silently: a wrong pin kind is a 404
 // nobody sees until they try that one surface, and a move rule that disagrees with the menu row's
 // disabled state shows an enabled row that no-ops.
diff --git a/frontend/src/components/comfortPin.langSwitch.dom.test.tsx b/frontend/src/components/comfortPin.langSwitch.dom.test.tsx
index a3df99d4..568eadba 100644
--- a/frontend/src/components/comfortPin.langSwitch.dom.test.tsx
+++ b/frontend/src/components/comfortPin.langSwitch.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E30 S3: a Plex query follows a language switch. `plexLang()` read the i18n singleton, and under the
+// A Plex query follows a language switch. `plexLang()` read the i18n singleton, and under the
 // React Compiler a value with no reactive input is computed once: after switching to Hungarian the
 // comfort shelf kept asking for its English cards. The language now comes off useTranslation. Real
 // i18n (the key-echo mock does not re-render on a switch, which is the very thing under test).
@@ -13,7 +13,7 @@ import { api } from "../lib/api";
 import { useComfortPin } from "./comfortPin";
 
 // Unmount BEFORE the language goes back: a mounted reader re-renders on the switch, and under a loaded
-// run that render landed after the test environment was gone ("window is not defined", E31 S5).
+// run that render landed after the test environment was gone ("window is not defined").
 afterEach(() => {
   cleanup();
   vi.restoreAllMocks();
diff --git a/frontend/src/components/comfortPin.tsx b/frontend/src/components/comfortPin.tsx
index 0c3663cc..ce522587 100644
--- a/frontend/src/components/comfortPin.tsx
+++ b/frontend/src/components/comfortPin.tsx
@@ -10,13 +10,13 @@ import { notify } from "../lib/notifications";
 import { qk } from "../lib/queryKeys";
 import { type ActionMenuItem } from "./ui/ActionMenu";
 
-// E24 S3 — "put this on my comfort shelf", from wherever you happen to be looking at the thing.
+// "put this on my comfort shelf", from wherever you happen to be looking at the thing.
 //
 // The shelf is the Home surface's object, but the GESTURE belongs wherever a pinnable thing is
 // shown — a video, a channel, a playlist, a Plex show or movie: you decide something is comfort media
 // while you are watching it. (Locked decision 3: an episode, a season and a person are not pin kinds,
 // so their cards and strips carry no pin.) This file is the one place the pin lives; every surface
-// composes the same `ActionMenuItem` into its object's ONE action list (E28 C1): the video, Plex and
+// composes the same `ActionMenuItem` into its object's ONE action list: the video, Plex and
 // channel actions (`useVideoActions`, `usePlexCardActions`, `Channels`), the playlist rail and page,
 // and Home's shelves. There is no pin-only menu any more.
 //
@@ -199,7 +199,7 @@ export function useComfortPin(open: boolean): ComfortPin {
           // label and the icon rather than being decided at a call site. The shelf's own hand-rolled
           // unpin row on Home got the flag first; leaving this one neutral painted the identical
           // command (same label, same icon, same `removeComfortPin`) two different colours on one
-          // screen — the hero's menu and the Continue-watching rail come through here (round 2).
+          // screen — the hero's menu and the Continue-watching rail come through here.
           danger: pinId !== null,
           onSelect: () => toggle(target, title),
         },
diff --git a/frontend/src/components/compilerCoverage.contract.test.ts b/frontend/src/components/compilerCoverage.contract.test.ts
index bc24d36e..9c30c0fb 100644
--- a/frontend/src/components/compilerCoverage.contract.test.ts
+++ b/frontend/src/components/compilerCoverage.contract.test.ts
@@ -5,16 +5,16 @@ import { compileReport, shippedSources, type CompileReport } from "./compilerSki
 // still works, it just re-renders everything under it on every render. The channel manager is where
 // it hurt (the owner, 2026-10-03): Channels and DataTable both bailed out, every open, close and
 // reposition of a row's right-click menu rebuilt the rows and columns, and on "All" rows the menu
-// took ~0.9 s to open and ~0.6 s to close. The E32 audit then found 95 such functions across src.
+// took ~0.9 s to open and ~0.6 s to close. An audit then found 95 such functions across src.
 //
-// A RATCHET over everything the build compiles (E32 S1). KNOWN_SKIPS is the exact set the compiler
+// A RATCHET over everything the build compiles. KNOWN_SKIPS is the exact set the compiler
 // skips today, `file → function → the compiler's category`; everything else must compile. Both
 // directions are red:
 //   • a NEW skip (or a known one changing category) — fix the function; if it truly cannot be
 //     compiled, adding it here is a decision for the owner, with the reason in docs/gates.md;
 //   • a skip that is GONE — delete its entry, so the list only ever shrinks.
-// E32 burned it down from 93 to the one function below: S3 read the popover engine through
-// destructuring and moved every render-phase ref write to `useEffectEvent` / `useLatest`; S4 took
+// A cleanup burned it down from 93 to the one function below: it read the popover engine through
+// destructuring, moved every render-phase ref write to `useEffectEvent` / `useLatest`, took
 // try/finally and every conditional, loop or optional call out of try blocks (the compiler cannot
 // lower them yet — and `react-hooks/todo` does not see the latter, so THIS test is what catches them)
 // and replaced the two exhaustive-deps suppressions, each of which skipped its whole function.
@@ -28,11 +28,11 @@ const KNOWN_SKIPS: CompileReport["skipped"] = {
 const MUST_COMPILE: Record<string, string[]> = {
   "components/Channels.tsx": ["Channels"],
   "components/ui/DataTable.tsx": ["DataTable"],
-  // Under every button and every popover in the app (E32 S3).
+  // Under every button and every popover in the app.
   "components/ui/FocusSafeButton.tsx": ["FocusSafeButton"],
   "components/ui/anchoredPopoverHooks.ts": ["useAnchoredPopover"],
   "components/ui/AnchoredPopover.tsx": ["PopoverSurfaceInner"],
-  // The two players — the largest components here, and the last to compile (E32 S4).
+  // The two players — the largest components here, and the last to compile.
   "components/PlexPlayer.tsx": ["PlexPlayer"],
   "components/PlayerModal.tsx": ["PlayerModal"],
   "lib/playerModalHooks.ts": ["useYtProgress"],
diff --git a/frontend/src/components/copyItems.tsx b/frontend/src/components/copyItems.tsx
index 19f65e4a..87d391f8 100644
--- a/frontend/src/components/copyItems.tsx
+++ b/frontend/src/components/copyItems.tsx
@@ -5,8 +5,8 @@ import { copyText } from "../lib/clipboard";
 import { notify } from "../lib/notifications";
 import { type ActionMenuItem } from "./ui/ActionMenu";
 
-// "Copy title" and "Copy link", the two rows every object's menu ends its middle group with (E28 C1,
-// "Text stays selectable"): on touch the long-press belongs to the context menu, so the text a
+// "Copy title" and "Copy link", the two rows every object's menu ends its middle group with
+// (DESIGN.md C1, "Text stays selectable"): on touch the long-press belongs to the context menu, so the text a
 // finger cannot select is copied from here. One builder, so every object says it the same way and
 // the clipboard write always runs inside the gesture (`inGesture`, which Safari insists on).
 //
diff --git a/frontend/src/components/descriptionLinks.dom.test.tsx b/frontend/src/components/descriptionLinks.dom.test.tsx
index a8d06356..87e49a2b 100644
--- a/frontend/src/components/descriptionLinks.dom.test.tsx
+++ b/frontend/src/components/descriptionLinks.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 review C6: a link at the end of a sentence lost the punctuation after it — the trailing
+// A link at the end of a sentence lost the punctuation after it — the trailing
 // `.,;:!?)]` was trimmed off the href and then dropped from the text too — and a URL whose own path
 // ends in a balanced ")" (a Wikipedia article) was cut short and broken.
 import { afterEach, describe, expect, it, vi } from "vitest";
diff --git a/frontend/src/components/downloadAdmin.dom.test.tsx b/frontend/src/components/downloadAdmin.dom.test.tsx
index 575de8e9..a7eb6553 100644
--- a/frontend/src/components/downloadAdmin.dom.test.tsx
+++ b/frontend/src/components/downloadAdmin.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E32 S2: the admin's download-quota editor rendered NOTHING while its quota loaded and nothing when
+// The admin's download-quota editor rendered NOTHING while its quota loaded and nothing when
 // the load failed, so the click looked dead. It now opens at once and says which it is. The save
 // turns the GB field back into bytes; the reset drops the override.
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
diff --git a/frontend/src/components/downloadAdmin.tsx b/frontend/src/components/downloadAdmin.tsx
index 30af39a8..b7fb5f59 100644
--- a/frontend/src/components/downloadAdmin.tsx
+++ b/frontend/src/components/downloadAdmin.tsx
@@ -1,4 +1,4 @@
-import { useMemo, useState } from "react";
+import { useState } from "react";
 import { qk } from "../lib/queryKeys";
 import { useTranslation } from "react-i18next";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
@@ -22,7 +22,6 @@ import UserPicker from "./UserPicker";
 
 const GiB = 1024 ** 3;
 
-/** @internal exported for downloadAdmin.dom.test.tsx */
 export function QuotaModal({
   userId,
   email,
@@ -86,7 +85,7 @@ export function QuotaModal({
       onClose={onClose}
     >
       {/* The modal opens at once: while the quota loads it says so, and a failed load says THAT,
-          with a retry — it used to render nothing at all, so the click looked dead (E32 S2). The
+          with a retry — it used to render nothing at all, so the click looked dead. The
           first field still takes focus when the form arrives (Modal's initialFocus="field"). */}
       {!state ? (
         q.isError ? (
@@ -159,7 +158,7 @@ export function QuotaModal({
 function QuotaUserPicker({ onPick }: { onPick: (u: { id: number; email: string }) => void }) {
   const { t } = useTranslation();
   const users = useQuery({ queryKey: qk.adminUsers(), queryFn: api.adminUsers });
-  const list = useMemo(() => (users.data ?? []).filter((u) => !u.is_demo), [users.data]);
+  const list = users.data ?? [];
   return (
     <div className="w-full sm:w-72">
       <UserPicker
diff --git a/frontend/src/components/downloadRow.dom.test.tsx b/frontend/src/components/downloadRow.dom.test.tsx
index 7222d520..7ef2ba2e 100644
--- a/frontend/src/components/downloadRow.dom.test.tsx
+++ b/frontend/src/components/downloadRow.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Library-row metadata (E7·S1): the completed row surfaces the concrete container/format alongside the
+// Library-row metadata: the completed row surfaces the concrete container/format alongside the
 // already-shown size. The format chip reads the raw `asset.container` (uppercased in the UI), so it must
 // render when present and be absent when the asset has no container yet (queued/running before the worker
 // fills it). i18n is key-passthrough here.
@@ -95,7 +95,7 @@ describe("DownloadRow format chip", () => {
   });
 });
 
-// E7·S5b — a generic uploaded file (media_kind='file') has no video frame and no timeline: the row
+// A generic uploaded file (media_kind='file') has no video frame and no timeline: the row
 // shows a neutral file glyph instead of a thumbnail <img>, and no duration chip (it stays media info
 // like the container/size). Media rows keep their thumbnail path (an <img>, or empty until a poster).
 describe("DownloadRow file kind", () => {
@@ -144,7 +144,7 @@ describe("DownloadRow · keyboard", () => {
     expect(screen.getByTitle("delete").hasAttribute("data-nav-open")).toBe(false);
   });
 
-  // E28: the row once resized its actions with a `[&_button]:size-8` override, which a save LINK in the
+  // The row once resized its actions with a `[&_button]:size-8` override, which a save LINK in the
   // same row escaped (28px beside 32px buttons). The size is the primitive's own rung, set by IconBtn.
   it("sizes its actions through the primitive's rung, not a descendant override", () => {
     const { container } = render(
@@ -159,7 +159,7 @@ describe("DownloadRow · keyboard", () => {
   });
 });
 
-// E28 S3f3: the row answers to its own width (a container query) and its meta line never wraps — on
+// The row answers to its own width (a container query) and its meta line never wraps — on
 // the iPad, zoomed in, its "18.9 / MB" pieces broke into a jumble (the owner, 2026-09-27). jsdom lays
 // nothing out, so this holds the structure the layout rests on; the widths were measured in a browser.
 describe("DownloadRow · narrow", () => {
@@ -199,7 +199,7 @@ describe("DownloadRow · narrow", () => {
       expect(foot.className).toContain(c);
   });
 
-  it("gives the failure link a real 24px line on a mouse, not the text's 20 (DESIGN B1, S3g)", () => {
+  it("gives the failure link a real 24px line on a mouse, not the text's 20 (DESIGN B1)", () => {
     render(
       <DownloadRow job={{ ...baseJob, status: "error", error: "boom" }} onShowError={() => {}} />,
     );
@@ -237,7 +237,7 @@ describe("DownloadRow · a link with no details yet", () => {
     expect(container.textContent).not.toContain("https://");
   });
 
-  // E31 S5 (measured at 21px on the Downloads page): every link in the row stands on a 24px line on
+  // Measured at 21px on the Downloads page: every link in the row stands on a 24px line on
   // a mouse (DESIGN B1), as the link line and the failure link already did.
   it("gives the title link and the channel link a 24px line", () => {
     const { container } = render(
@@ -279,7 +279,7 @@ describe("DownloadRow · no picture", () => {
     );
     expect(audio.querySelector("svg.lucide-music")).not.toBeNull();
   });
-  // E28 review C5: the remote thumbnail was the last resort with no fallback of its own — when it
+  // The remote thumbnail was the last resort with no fallback of its own — when it
   // failed too (a dead CDN link), the row drew the browser's broken-image mark.
   it("falls back to the glyph when the remote picture fails too", () => {
     const { container } = render(
diff --git a/frontend/src/components/downloadRow.tsx b/frontend/src/components/downloadRow.tsx
index 4b48e4da..45096d94 100644
--- a/frontend/src/components/downloadRow.tsx
+++ b/frontend/src/components/downloadRow.tsx
@@ -67,7 +67,7 @@ export function StatusPill({ job }: { job: DownloadJob }) {
 
 // The row answers to its OWN width (a container query), not the window's: the same list sits in a
 // phone, a split-screen tablet and a desktop column. Below 40rem the actions no longer leave the title
-// column room for the meta line, so the row stacks (E28 S3f3, the owner's pick A): the picture beside a
+// column room for the meta line, so the row stacks (the owner's pick A): the picture beside a
 // two-line title and the channel; the meta line across the whole row; then the source link and the
 // actions on one wrapping line.
 const THUMB_BOX =
@@ -95,7 +95,7 @@ function Thumb({ job }: { job: DownloadJob }) {
   const [failedPrimary, setFailedPrimary] = useState<string | null>(null);
   if (failedPrimary !== null && failedPrimary !== primary) setFailedPrimary(null);
   // The remote picture is the last resort, and it fails too (a dead CDN link): remembered the same
-  // way, so the row falls to the glyph below instead of the browser's broken-image mark (E28 C5).
+  // way, so the row falls to the glyph below instead of the browser's broken-image mark.
   const [failedRemote, setFailedRemote] = useState<string | null>(null);
   if (failedRemote !== null && failedRemote !== remote) setFailedRemote(null);
   const candidate = failedPrimary && failedPrimary === primary ? remote : primary;
@@ -175,7 +175,7 @@ export function IconBtn({
 }
 
 // A link inside the row keeps the BROWSER's own right-click menu (open in a new tab, copy the
-// address): the row's menu answers everywhere else on it (E28 C1).
+// address): the row's menu answers everywhere else on it.
 const nativeMenu = { onContextMenu: (e: React.MouseEvent) => e.stopPropagation() };
 
 // "Downloaded from" reference: opens the original page in a new tab. Its copy moved into the row's
@@ -236,7 +236,7 @@ export function DownloadRow({
   navIndex?: number;
   /** The list's menu triggers (right-click, long-press, Shift+F10): `useContextMenu().triggerProps`. */
   rowProps?: Record<string, unknown>;
-  /** The row's "…", last in its action strip (E28 C1). */
+  /** The row's "…", last in its action strip. */
   more?: ReactNode;
   children?: ReactNode;
 }) {
diff --git a/frontend/src/components/facetOption.test.ts b/frontend/src/components/facetOption.test.ts
index 1a052638..4090730f 100644
--- a/frontend/src/components/facetOption.test.ts
+++ b/frontend/src/components/facetOption.test.ts
@@ -11,7 +11,7 @@ describe("a tag as a filter row", () => {
     expect(facetOption(music, {}).count).toBe(0);
   });
 
-  // E31 review 2, live: with the summary failed, the rail read "Music 238" beside a search that matched
+  // Seen live: with the summary failed, the rail read "Music 238" beside a search that matched
   // 3 Music channels — the whole library's count printed as the filter's.
   it("shows no count until the facets land, rather than the whole library's", () => {
     expect(facetOption(music, undefined).count).toBeUndefined();
diff --git a/frontend/src/components/facetOption.ts b/frontend/src/components/facetOption.ts
index ec888623..ec2586c7 100644
--- a/frontend/src/components/facetOption.ts
+++ b/frontend/src/components/facetOption.ts
@@ -3,7 +3,7 @@ import type { ComboboxOption } from "./ui/Combobox";
 
 // A tag as a filter row: its count is the CURRENT filter's (the summary's facets), or none at all while
 // the facets load or after they failed. The rail printed the tag's whole-library count in that gap, as
-// if it were the filter's: "Music 238" beside a search that matched 3 of its channels (E31 review 2).
+// if it were the filter's: "Music 238" beside a search that matched 3 of its channels.
 export const facetOption = (
   tag: Tag,
   facets: Record<string, number> | undefined,
diff --git a/frontend/src/components/formAlerts.dom.test.tsx b/frontend/src/components/formAlerts.dom.test.tsx
index 2a751a6c..8885c565 100644
--- a/frontend/src/components/formAlerts.dom.test.tsx
+++ b/frontend/src/components/formAlerts.dom.test.tsx
@@ -4,10 +4,9 @@
 // clear and the set of a validation failure commit together, so the alert node used to stay untouched on
 // the second attempt and a screen reader said nothing — a press that seemed to do nothing.
 //
-// i18n is mocked to a key-passthrough; the API and the E2EE module are stubbed so nothing reaches out.
+// i18n is mocked to a key-passthrough; the API is stubbed so nothing reaches out.
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { cleanup, fireEvent, render, screen } from "@testing-library/react";
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 
 vi.mock("react-i18next", async (importOriginal) => {
   const actual = await importOriginal<typeof import("react-i18next")>();
@@ -24,16 +23,12 @@ vi.mock("../lib/api", async (importOriginal) => {
     api: {
       ...actual.api,
       authConfig: () => Promise.resolve({ google_enabled: false }),
-      messageMyKey: () => Promise.resolve({ configured: true }),
       me: () => Promise.resolve({ authenticated: false }),
       setupInfo: () => Promise.resolve({ secrets_manageable: false }),
     },
   };
 });
 
-vi.mock("../lib/e2ee", () => ({ unlock: vi.fn(), setup: vi.fn(), clearDevice: vi.fn() }));
-
-import KeyGate from "./KeyGate";
 import SetupWizard from "./SetupWizard";
 import Welcome from "./Welcome";
 
@@ -54,19 +49,6 @@ async function failTwice(fail: () => void, message: string) {
 }
 
 describe("a form failing the same way twice announces it twice", () => {
-  it("the message passphrase gate", async () => {
-    render(
-      <QueryClientProvider client={new QueryClient()}>
-        <KeyGate meId={1} />
-      </QueryClientProvider>,
-    );
-    const unlock = await screen.findByText("messages.unlock");
-    fireEvent.change(screen.getByPlaceholderText("messages.passphrase"), {
-      target: { value: "abc" },
-    });
-    await failTwice(() => fireEvent.click(unlock), "messages.passTooShort");
-  });
-
   it("the sign-in card", async () => {
     render(
       <Welcome verify={{ outcome: null, email: null, resetPending: false, dismiss: () => {} }} />,
diff --git a/frontend/src/components/legal/LegalLayout.tsx b/frontend/src/components/legal/LegalLayout.tsx
index a4dd89bb..6fdb4b15 100644
--- a/frontend/src/components/legal/LegalLayout.tsx
+++ b/frontend/src/components/legal/LegalLayout.tsx
@@ -16,7 +16,7 @@ import LanguageSwitcher from "../LanguageSwitcher";
 import { SURFACE } from "../ui/surfaces";
 
 // The day the text last changed materially — bump it with every edit of either body.
-const LAST_UPDATED = "2026-09-17";
+const LAST_UPDATED = "2026-10-04";
 
 // Contact shown on the legal pages: the instance operator's configured admin email, from the
 // public /auth/config. One shared fetch across the page; null when the operator set none.
diff --git a/frontend/src/components/legal/PrivacyPolicy.tsx b/frontend/src/components/legal/PrivacyPolicy.tsx
index 8384d6da..a058ad39 100644
--- a/frontend/src/components/legal/PrivacyPolicy.tsx
+++ b/frontend/src/components/legal/PrivacyPolicy.tsx
@@ -87,10 +87,7 @@ export function PrivacyEn() {
           that log is sent to the server and stored with your account alongside the server's more
           detailed record of your requests, for the same retention period as the server logs;
         </li>
-        <li>
-          passwords, tokens, email addresses and the content of your messages are never included, at
-          any level.
-        </li>
+        <li>passwords, tokens and email addresses are never included, at any level.</li>
       </ul>
       <p>
         After 24 hours the level returns to the default by itself, and you can return to it earlier
@@ -112,10 +109,9 @@ export function PrivacyEn() {
       <H2 id="storage">Storage &amp; security</H2>
       <p>
         Data is stored in a private PostgreSQL database on a server we control, accessible only to
-        the operator. Google OAuth refresh tokens are encrypted at rest. Private messages between
-        users are end-to-end encrypted in the browser: the server stores only the encrypted text and
-        cannot read it. Access is restricted to the email addresses admitted to the app. No system
-        is perfectly secure, but we take reasonable measures to protect your data.
+        the operator. Google OAuth refresh tokens are encrypted at rest. Access is restricted to the
+        email addresses admitted to the app. No system is perfectly secure, but we take reasonable
+        measures to protect your data.
       </p>
 
       <H2 id="retention">Retention &amp; deletion</H2>
@@ -230,7 +226,7 @@ export function PrivacyHu() {
           ezt a naplót elküldi a szervernek, amely a fiókodhoz tárolja, a kéréseid részletesebb
           szerveroldali naplójával együtt, a szervernapló megőrzési idejéig;
         </li>
-        <li>jelszó, token, e-mail-cím és az üzeneteid tartalma egyik szinten sem kerül bele.</li>
+        <li>jelszó, token és e-mail-cím egyik szinten sem kerül bele.</li>
       </ul>
       <p>
         24 óra múlva a szint magától visszaáll az alapra, és bármikor korábban is visszaállíthatod.
@@ -252,11 +248,9 @@ export function PrivacyHu() {
       <H2 id="storage">Tárolás és biztonság</H2>
       <p>
         Az adatokat egy általunk kezelt szerveren, privát PostgreSQL-adatbázisban tároljuk, amelyhez
-        csak az üzemeltető fér hozzá. A Google OAuth frissítő tokeneket titkosítva tároljuk. A
-        felhasználók közötti privát üzenetek végponttól végpontig titkosítottak a böngészőben: a
-        szerver csak a titkosított szöveget tárolja, és nem tudja elolvasni. Csak az alkalmazásba
-        beengedett e-mail-címek férnek hozzá. Egyetlen rendszer sem tökéletesen biztonságos, de
-        észszerű intézkedésekkel védjük az adataidat.
+        csak az üzemeltető fér hozzá. A Google OAuth frissítő tokeneket titkosítva tároljuk. Csak az
+        alkalmazásba beengedett e-mail-címek férnek hozzá. Egyetlen rendszer sem tökéletesen
+        biztonságos, de észszerű intézkedésekkel védjük az adataidat.
       </p>
 
       <H2 id="retention">Megőrzés és törlés</H2>
diff --git a/frontend/src/components/legal/legalBodies.contract.dom.test.tsx b/frontend/src/components/legal/legalBodies.contract.dom.test.tsx
index 0e3b20e7..0e8c1d55 100644
--- a/frontend/src/components/legal/legalBodies.contract.dom.test.tsx
+++ b/frontend/src/components/legal/legalBodies.contract.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // The legal pages are written out once per language (a document, not UI strings — see LegalLayout).
 // What keeps the two from drifting apart is this: both languages must have the SAME sections, in the
-// same order, by anchor — so a section added to one (E22 S5 added the log sections) cannot be
+// same order, by anchor — so a section added to one (as the log sections were) cannot be
 // missing from the other, and a link to `/privacy#diagnostics` lands in either language.
 import { describe, expect, it, vi } from "vitest";
 import { cleanup, render } from "@testing-library/react";
diff --git a/frontend/src/components/listNav.wiring.contract.test.ts b/frontend/src/components/listNav.wiring.contract.test.ts
index 73654d05..f4c002c1 100644
--- a/frontend/src/components/listNav.wiring.contract.test.ts
+++ b/frontend/src/components/listNav.wiring.contract.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 
-// Every rail and every card of a card list is walkable by the keyboard (E11 S4, lib/listNav). Two
+// Every rail and every card of a card list is walkable by the keyboard (lib/listNav). Two
 // opt-in halves, both checked here, because either one missing silently leaves the keyboard out —
 // and a page where `j` walks two rails and skips the third reads as broken, not as unfinished:
 //   - a `Carousel`, a `VirtualGrid` and a `DataTable` say `keyboardNav`, and a card says `navIndex`;
@@ -10,7 +10,7 @@ import { describe, expect, it } from "vitest";
 // Each exception is listed with its reason.
 //
 // The assertion pins the SET of offending tags, never a count, and checks the glob matched at all: a
-// guard whose glob stops matching is green over nothing (E10 review round 4, round 7).
+// guard whose glob stops matching is green over nothing.
 const WALKABLE = ["Carousel", "VirtualGrid", "DataTable"];
 const CARDS = [
   "VideoCard",
diff --git a/frontend/src/components/mediaPicture.contract.test.ts b/frontend/src/components/mediaPicture.contract.test.ts
index 385c2bcb..27f52094 100644
--- a/frontend/src/components/mediaPicture.contract.test.ts
+++ b/frontend/src/components/mediaPicture.contract.test.ts
@@ -10,7 +10,7 @@ import {
   mediaPictureBox,
 } from "./ui/mediaCardStyles";
 
-// E31 S5, measured: at text size 1.3 a 242px feed thumbnail put the 63px Play 13px into the 37px hover
+// Measured: at text size 1.3 a 242px feed thumbnail put the 63px Play 13px into the 37px hover
 // row (the Play and the row grow with the root font, the picture's height does not). A narrow picture
 // (under 14rem, so the cut moves with the text size) centres what it carries above the row instead.
 describe("a media picture", () => {
@@ -28,7 +28,7 @@ describe("a media picture", () => {
     expect(layer.split(" ")).toContain("@max-[14rem]/pic:pb-(--bar-room)");
   });
 
-  // E31 review 2: the lift applied to every narrow picture, and the feed's row and tile views (a
+  // The lift once applied to every narrow picture, and the feed's row and tile views (a
   // 10rem thumbnail, no hover row) showed their Play 1.25rem above centre over an empty band. The band
   // is now the row's own: set only by a box that holds one.
   it("lifts it only where a hover row is there to clear", () => {
diff --git a/frontend/src/components/modulePages.tsx b/frontend/src/components/modulePages.tsx
index dd752c74..693809fe 100644
--- a/frontend/src/components/modulePages.tsx
+++ b/frontend/src/components/modulePages.tsx
@@ -10,7 +10,6 @@ import { useSavedViews } from "./savedViewsContext";
 // that file exports only data and this one only components (Fast Refresh). Their lazy chunks are
 // exported alongside so the registry can attach each chunk's preload to the wrapper that renders it.
 export const Feed = lazyWithPreload(() => import("./Feed"));
-export const Messages = lazyWithPreload(() => import("./Messages"));
 
 // The GLOBAL feed page: wires <Feed> to the app-wide feed filters / view / live-search. (The channel
 // page renders <Feed> itself with its own channel-scoped filters, so those two never share state.)
@@ -34,21 +33,11 @@ export function FeedPage() {
         view={view}
         setView={setView}
         canRead={me.can_read}
-        isDemo={me.is_demo}
         ytSearch={ytSearch}
         onYtSearch={enterYtSearch}
         onExitYtSearch={exitYtSearch}
       />
-      {modalOpen && !me.is_demo && <PersonalViewsModal />}
+      {modalOpen && <PersonalViewsModal />}
     </>
   );
 }
-
-export function MessagesPage() {
-  const me = useMe();
-  return (
-    <div className="p-4 max-w-3xl w-full mx-auto">
-      <Messages meId={me.id} />
-    </div>
-  );
-}
diff --git a/frontend/src/components/moduleRegistry.tsx b/frontend/src/components/moduleRegistry.tsx
index 4b424090..e6cab72b 100644
--- a/frontend/src/components/moduleRegistry.tsx
+++ b/frontend/src/components/moduleRegistry.tsx
@@ -4,7 +4,7 @@ import type { Page } from "../lib/urlState";
 import type { PanelId, PanelLayout } from "../lib/panelLayout";
 import Sidebar from "./Sidebar";
 import PlaylistsRail from "./PlaylistsRail";
-import { Feed, FeedPage, Messages, MessagesPage } from "./modulePages";
+import { Feed, FeedPage } from "./modulePages";
 
 // The RENDER half of the module registry: which component (and side rail) each page renders. The
 // metadata half — nav order, label, icon, gate — lives in lib/modules.ts (imported by NavSidebar /
@@ -54,7 +54,6 @@ export const PAGE_CONTENT: Record<Page, PageDef> = {
   playlists: { Component: Playlists, maxWidth: "64rem" },
   plex: { Component: PlexBrowse, maxWidth: "100rem" },
   notifications: { Component: NotificationsPanel, maxWidth: "48rem" },
-  messages: { Component: Object.assign(MessagesPage, { preload: Messages.preload }) },
   downloads: { Component: DownloadCenter, maxWidth: "56rem" },
   stats: { Component: Stats },
   scheduler: { Component: Scheduler },
diff --git a/frontend/src/components/navigation.dom.test.ts b/frontend/src/components/navigation.dom.test.ts
index 5e943093..56b96ce2 100644
--- a/frontend/src/components/navigation.dom.test.ts
+++ b/frontend/src/components/navigation.dom.test.ts
@@ -1,10 +1,10 @@
 // @vitest-environment jsdom
 //
-// NavigationProvider's URL-derived seeds, backfilling the E4 deep-review's deferred coverage:
+// NavigationProvider's URL-derived seeds, backfilling a code review's deferred coverage:
 //   • loadInitialPage — the bookmark deep-link precedence (?page > ?v > ?pl > filters/?chan > the
 //     account's stored landing page > feed).
 //   • channelViewFrom — the shared _chan/?chan resolver behind BOTH the channelView seed and the
-//     onPop handler (the S1 fix): a popstate landing on a URL-only bookmark entry must restore the
+//     onPop handler: a popstate landing on a URL-only bookmark entry must restore the
 //     channel from ?chan, not close it.
 // Only getAccountRaw is stubbed (the account's stored landing page); everything else is real.
 import { describe, it, expect, beforeEach, vi } from "vitest";
@@ -58,7 +58,7 @@ describe("loadInitialPage precedence", () => {
     setUrl("?v=show:1&pl=3&tags=1");
     expect(loadInitialPage()).toBe("plex");
   });
-  // E24 changed this rung: a bare URL lands on Home, OVER the remembered module. Landing on
+  // A bare URL lands on Home, OVER the remembered module. Landing on
   // whatever you happened to close the app on is precisely the habit the anti-paralysis surface
   // exists to replace, so the remembered page only wins once the account opts out.
   it("a bare URL lands on Home even when another module is remembered", () => {
@@ -92,7 +92,7 @@ describe("channelViewFrom", () => {
   it("_chan without a name yields an undefined name", () => {
     expect(channelViewFrom({ _chan: "UC1" }, "")).toEqual({ id: "UC1", name: undefined });
   });
-  it("falls back to the ?chan URL param when the entry has no _chan (fresh bookmark) — the S1 fix", () => {
+  it("falls back to the ?chan URL param when the entry has no _chan (fresh bookmark)", () => {
     expect(channelViewFrom(null, "?chan=UC9")).toEqual({ id: "UC9", name: undefined });
   });
   it("prefers _chan over the URL param", () => {
diff --git a/frontend/src/components/navigationInit.ts b/frontend/src/components/navigationInit.ts
index f1109778..e7453483 100644
--- a/frontend/src/components/navigationInit.ts
+++ b/frontend/src/components/navigationInit.ts
@@ -29,7 +29,7 @@ export function loadInitialPage(): Page {
   if (params.has("v")) return "plex";
   if (params.has("pl")) return "playlists";
   if (hasFilterParams(params) || params.has("chan")) return "feed";
-  // A bare URL → Home (E24), the surface whose whole job is to answer "what should I watch" before
+  // A bare URL → Home, the surface whose whole job is to answer "what should I watch" before
   // the user has to decide anything. It deliberately OVERRIDES the remembered last module: landing
   // on whatever you happened to close the app on is the behaviour the anti-paralysis epic exists to
   // replace. The account can opt out (Settings → Appearance → Startup) and get the remembered
diff --git a/frontend/src/components/playerModalControls.tsx b/frontend/src/components/playerModalControls.tsx
index 0649a20f..eb92132d 100644
--- a/frontend/src/components/playerModalControls.tsx
+++ b/frontend/src/components/playerModalControls.tsx
@@ -108,7 +108,7 @@ export function PlayerTransportControls({
 
 /** The description, said the same way in its two places (the popover under 1280 px, the panel beside
  *  the video above it): loading, failed with a retry, the text in the caller's box, or none. One
- *  ladder, so the two cannot drift (E31 review 2: the failed state was tested in the panel only).
+ *  ladder, so the two cannot drift (the failed state was once tested in the panel only).
  *  `ref` / `style` / `className` dress the text's box only. */
 export function PlayerDescription({
   detail,
diff --git a/frontend/src/components/playlistColumns.tsx b/frontend/src/components/playlistColumns.tsx
index 93cb9f26..88a8abc7 100644
--- a/frontend/src/components/playlistColumns.tsx
+++ b/frontend/src/components/playlistColumns.tsx
@@ -25,7 +25,7 @@ export function playlistColumns({
    * so a view-sort never renumbers the playlist under the reader. */
   indexOf: (v: Video) => number;
   onPlay: (v: Video) => void;
-  /** The row's "…" — the visible door to its menu (E28 C1), where "Remove" now lives. */
+  /** The row's "…" — the visible door to its menu, where "Remove" now lives. */
   more: (v: Video) => ReactNode;
 }): Column<Video>[] {
   const cols: Column<Video>[] = [
@@ -70,7 +70,7 @@ export function playlistColumns({
               <img src={v.thumbnail_url} alt="" className="w-full h-full object-cover" />
             )}
             {/* Narrow, the Length column is gone and its value rides on the picture, as on the
-                media card (E28 S3f3, the owner's pick A). */}
+                media card (the owner's pick A). */}
             <span className="pointer-events-none absolute right-0.5 bottom-0.5 @2xl:hidden">
               {lengthCell(v, t, true)}
             </span>
@@ -136,7 +136,7 @@ export function playlistColumns({
     // Room for the "…" at 44px on touch (`.touch-target`), not just its 28px under a mouse.
     width: "3.25rem",
     nowrap: true,
-    // The X that stood here went into the menu with the Delete key and an undo toast (E28 C1): a
+    // The X that stood here went into the menu with the Delete key and an undo toast: a
     // one-click destructive button on every row, for an action the toast now makes reversible.
     render: more,
   });
diff --git a/frontend/src/components/playlistsInit.test.ts b/frontend/src/components/playlistsInit.test.ts
index 5e67c970..c197999d 100644
--- a/frontend/src/components/playlistsInit.test.ts
+++ b/frontend/src/components/playlistsInit.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// readSelectedId: the Playlists selected-id seed. Backfills the E4 deep-review's deferred ?pl guard
+// readSelectedId: the Playlists selected-id seed. Backfills a code review's deferred ?pl guard
 // coverage — a ?pl bookmark wins over the stored selection but only when it's a positive integer;
 // anything else (empty / zero / negative / fractional / non-numeric) falls back to the stored id.
 import { describe, it, expect, beforeEach, vi } from "vitest";
diff --git a/frontend/src/components/plexCards.dom.test.tsx b/frontend/src/components/plexCards.dom.test.tsx
index defc33f5..af05785c 100644
--- a/frontend/src/components/plexCards.dom.test.tsx
+++ b/frontend/src/components/plexCards.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Plex card a11y: locks the accessible names on the icon-only card controls (the E4 a11y sweep). These
+// Plex card a11y: locks the accessible names on the icon-only card controls (an a11y sweep). These
 // buttons are icon-only (WatchedIcon / ListPlus / the "…", no text), so their name comes solely from the
 // aria-label — a dropped label silently reintroduces an unnamed button for screen-reader users. i18n is
 // key-passthrough, so the asserted names are the i18n keys.
@@ -60,7 +60,7 @@ describe("PlexPosterCard a11y", () => {
     expect(screen.getByRole("button", { name: "plex.playlistAdd.manage" })).toBeTruthy();
     // Two: the hover row's and its touch twin beside the title (CSS shows one per device).
     expect(screen.getAllByRole("button", { name: "card.menu.more" })).toHaveLength(2);
-    // Details moved into the menu (E28 C1): the card has no ⓘ of its own any more.
+    // Details moved into the menu: the card has no ⓘ of its own any more.
     expect(screen.queryByRole("button", { name: "plex.info.title" })).toBeNull();
   });
 
@@ -69,7 +69,7 @@ describe("PlexPosterCard a11y", () => {
     expect(screen.getByRole("button", { name: "plex.markUnwatched" })).toBeTruthy();
   });
 
-  // E28 S3h: the one media card — the year and the rating are the meta line under the title (pinned
+  // The one media card — the year and the rating are the meta line under the title (pinned
   // to the frame's bottom), the length a badge on the picture. The synopsis is NOT the picture's
   // tooltip any more: it lives in the card's preview (below).
   it("carries the year and rating in its meta line, the length on the picture", () => {
@@ -217,7 +217,7 @@ describe("a started Plex card", () => {
     expect(container.querySelector(".flex-col.reveal-hover")).toBeNull();
   });
 
-  // E28 review D4: the card read "started" off the rounded progress %, the menu off the position —
+  // The card read "started" off the rounded progress %, the menu off the position —
   // 20 s into a 3 h film is 0 % here and started there, so the card offered no Restart the menu had.
   it("a resume point under 1 % still offers the Restart, as the card's menu does", () => {
     render(
@@ -257,7 +257,7 @@ describe("EpisodeCard a11y", () => {
   });
 });
 
-// E11 S4b: in a keyboard-walkable grid or rail the WHOLE card is the item (the ring goes round the
+// In a keyboard-walkable grid or rail the WHOLE card is the item (the ring goes round the
 // poster and its title, D2) and the poster — the card's own role=button — is what Enter opens.
 describe("Plex cards in a keyboard-walkable list", () => {
   const cases = [
@@ -293,7 +293,7 @@ describe("Plex cards in a keyboard-walkable list", () => {
     expect(root.getAttribute("data-nav-index")).toBe("3");
     const open = root.querySelector<HTMLElement>("[data-nav-open]")!;
     // A real button (ui/Pressable), not a div wearing its role: Enter/Space and the touch target
-    // come from the primitive (S3g found the S3h picture hand-built).
+    // come from the primitive (the picture was once found hand-built).
     expect(open.tagName).toBe("BUTTON");
     expect(open.getAttribute("type")).toBe("button");
     fireEvent.click(open);
@@ -339,7 +339,7 @@ describe("a Plex card's caption and a drag", () => {
 
 // On a shelf (Home, the Plex rails, a collection strip) the title is one line, so every card on the
 // strip is the same height; a landscape shelf picture is short, so it takes the smaller Play, clear
-// of the hover row under it (E28 S3h: at the large size they touched on a 232px slot).
+// of the hover row under it (at the large size they touched on a 232px slot).
 describe("PlexPosterCard on a shelf", () => {
   const titleOf = () => screen.getByText("M");
   const play = (c: HTMLElement) =>
@@ -370,7 +370,7 @@ describe("PlexPosterCard on a shelf", () => {
   });
 });
 
-// E31 S4e: a card fetched the detail page's 400px poster for its ~144px picture. It offers the
+// A card fetched the detail page's 400px poster for its ~144px picture. It offers the
 // proxy's small cut too and lets the browser pick by its width.
 describe("a Plex card's picture", () => {
   it("offers the small cut beside the full one, lazily", () => {
diff --git a/frontend/src/components/plexCards.lang.dom.test.tsx b/frontend/src/components/plexCards.lang.dom.test.tsx
index d704a9e7..cf5e079a 100644
--- a/frontend/src/components/plexCards.lang.dom.test.tsx
+++ b/frontend/src/components/plexCards.lang.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E30: what a Plex card says, in the reader's language. An episode in a poster rail stands as its show
+// What a Plex card says, in the reader's language. An episode in a poster rail stands as its show
 // (the show's poster and name, the episode on the line under it), and a season Plex named generically
 // ("Season 1", "Specials") is named from its number instead. i18n here echoes the key AND its values,
 // so an assertion can see which words went into the line.
diff --git a/frontend/src/components/plexCards.langSwitch.dom.test.tsx b/frontend/src/components/plexCards.langSwitch.dom.test.tsx
index 3496dd59..a2135c62 100644
--- a/frontend/src/components/plexCards.langSwitch.dom.test.tsx
+++ b/frontend/src/components/plexCards.langSwitch.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E30 S3: a card's numbers follow a language switch. The formatters read the UI language, but the
+// A card's numbers follow a language switch. The formatters read the UI language, but the
 // React Compiler memoizes a call on its ARGUMENTS — `formatRuntime(card.duration_seconds)` stayed
 // "2 hr 4 min" after switching to Hungarian while the hero beside it said "2 ó 16 p". Real catalog.
 import { describe, it, expect, afterEach, vi } from "vitest";
diff --git a/frontend/src/components/plexCards.tsx b/frontend/src/components/plexCards.tsx
index ed1e769e..8ab9c281 100644
--- a/frontend/src/components/plexCards.tsx
+++ b/frontend/src/components/plexCards.tsx
@@ -33,7 +33,7 @@ import { cardImage } from "../lib/plexImage";
 // Presentational Plex cards + strips, split out of PlexBrowse (all purely prop-driven, no shared
 // state). Rendered by the browse grid, the person page, and the series show/season views.
 //
-// E28 C1 (docs/DESIGN.md "Action placement"): a card shows its state (watched, progress) at rest;
+// docs/DESIGN.md C1 ("Action placement"): a card shows its state (watched, progress) at rest;
 // on hover its picture carries the everyday toggles (watched, add to playlist) and the "…" that
 // opens the title's one action list (`usePlexCardActions`); on touch those toggles are gone and a 44px
 // "…" sits beside the title. The list's menu is the one door every device has.
@@ -211,7 +211,7 @@ function PlexPicture({
   children?: ReactNode;
 }) {
   // Not read off `pct`: that is rounded, so 20 s into a 3 h film was 0 % and "not started" here while
-  // the menu offered "from the start" (E28 review D4). One rule, `plexStarted`, for both.
+  // the menu offered "from the start". One rule, `plexStarted`, for both.
   const resumable = plays && started && !!onRestart;
   const pic = cardImage(thumb);
   return (
@@ -301,7 +301,7 @@ export function PlexPosterCard({
   const lang = i18n.language;
   const preview = useMediaPreview();
   // An episode in a poster rail (Discover's "Recently watched") stands as its SHOW: the show's poster
-  // and name, the episode on the line under it (E30, option A). Its own 16:9 still in a poster slot
+  // and name, the episode on the line under it (option A). Its own 16:9 still in a poster slot
   // was a cropped frame titled only "Countdown". Needs the show (`show_id`, from a leaf card).
   const asShow = card.type === "episode" && !wide && !!card.show_id && !!card.show_title;
   const landscape = wide || (card.type === "episode" && !asShow);
@@ -541,7 +541,7 @@ export function CastStrip({
 
 // The ONE cast carousel: a show's page (CastStrip) and a title's info (PlexInfo, page or the
 // player's overlay) each frame it with their own heading. Two hand copies of it had drifted apart
-// (gap, lazy pictures, the name's tooltip — E32 S2). `tone="overlay"` is the white-on-art palette.
+// (gap, lazy pictures, the name's tooltip). `tone="overlay"` is the white-on-art palette.
 export function CastRow({
   cast,
   tone = "panel",
@@ -631,7 +631,7 @@ export function RelatedStrip({
 }: {
   related: PlexCard[];
   onOpen: (c: PlexCard) => void;
-  /** The page's Plex menu (a related show is a Plex card like any other: E28 C1). */
+  /** The page's Plex menu (a related show is a Plex card like any other: DESIGN.md C1). */
   menuProps?: (c: PlexCard) => Record<string, unknown>;
   menuButtonProps?: (c: PlexCard) => Record<string, unknown>;
   /** The id whose menu is open. */
diff --git a/frontend/src/components/plexContext.ts b/frontend/src/components/plexContext.ts
index d1a48a0c..1166f08b 100644
--- a/frontend/src/components/plexContext.ts
+++ b/frontend/src/components/plexContext.ts
@@ -8,7 +8,7 @@ import { PLEX_SORT_FALLBACK } from "../lib/plexSort";
 // (Fast Refresh).
 
 // A "jump straight to this title" hand-off: PlexBrowse opens a movie's info page (like the card's ⓘ),
-// a show's drill-down (like clicking a show card), or — for E24's Home hero, whose whole promise is a
+// a show's drill-down (like clicking a show card), or — for the Home hero, whose whole promise is a
 // single Play button — the PLAYER for a movie/episode rating_key. `play` exists because the player
 // lives inside this module with its lazy hls.js and its provider tree; mounting a second one on the
 // landing page to avoid one hand-off would be the expensive way round.
diff --git a/frontend/src/components/plexDetailAside.tsx b/frontend/src/components/plexDetailAside.tsx
index 0696bae9..359a8994 100644
--- a/frontend/src/components/plexDetailAside.tsx
+++ b/frontend/src/components/plexDetailAside.tsx
@@ -8,9 +8,9 @@ import { Filterable, PrefToggle } from "./plexDetailUi";
 import { Button } from "./ui/Button";
 import { Pressable } from "./ui/Pressable";
 
-// The detail pages' second column (E31, the owner's pick "A"): the TMDB facts and key crew of a movie or
+// The detail pages' second column (the owner's pick "A"): the TMDB facts and key crew of a movie or
 // a show beside its description, inside the hero — as the person page sets its known-for rail beside
-// the bio (E30 S6) — and its keywords under the text. They used to sit under the hero (movie) or
+// the bio — and its keywords under the text. They used to sit under the hero (movie) or
 // nowhere at all (show), while the hero's text stopped at ~55% of the panel and left the rest empty. A
 // narrow hero stacks the column under the text. Each section is a per-user toggle (default ON), the same
 // three prefs on both pages (lib/plexDetail useDetailAside).
@@ -35,7 +35,7 @@ export function DetailAsideToggles({ aside }: { aside: DetailAsideState }) {
 // The hero's second column: the facts over the key crew — two lists, read down. Null when neither is
 // shown. The keywords are chips that filter, as the genres are, so they sit under the text instead
 // (DetailKeywords): all three in this column ran it to twice the text's height at 20 keywords and 12
-// crew, a hole under the text — the measured worst case (E31 S4c).
+// crew, a hole under the text — the measured worst case.
 export function DetailAside({
   facts,
   shown,
@@ -56,9 +56,9 @@ export function DetailAside({
   );
 }
 
-// The structured facts (E5 S5): release / runtime / cert / budget / revenue / studios / countries, from
+// The structured facts: release / runtime / cert / budget / revenue / studios / countries, from
 // the title's own fields + the persisted TMDB block. What filters the library is an edged chip, a plain
-// fact stays flat text (E28 S3h, the S3d1 rule).
+// fact stays flat text (edged = pressable, flat = just says).
 function FactsSection({ facts, onFilter }: { facts: DetailFacts; onFilter?: OnFilter }) {
   const { t, i18n } = useTranslation();
   const lang = i18n.language;
@@ -152,7 +152,7 @@ function FactsSection({ facts, onFilter }: { facts: DetailFacts; onFilter?: OnFi
   );
 }
 
-// TMDB keyword chips (E5 S5) — tap one to filter the library by that keyword. Under the hero's text.
+// TMDB keyword chips — tap one to filter the library by that keyword. Under the hero's text.
 export function DetailKeywords({
   keywords,
   onFilter,
@@ -182,13 +182,12 @@ export function DetailKeywords({
 }
 
 // The crew shows its first CREW_SHOWN names and a "Show N more" that opens the rest: the column beside the
-// text is the hero's tallest part, and twelve names ran it ~170px past the text (E31, the owner's call).
+// text is the hero's tallest part, and twelve names ran it ~170px past the text (the owner's call).
 // A list only a little longer than that shows whole: a toggle that hides one or two names saves no room.
-/** @internal exported for PlexInfo.dom.test.tsx */
 export const CREW_SHOWN = 6;
 const CREW_FOLD_OVER = CREW_SHOWN + 2;
 
-// The TMDB key crew (E5 S5) — Director / Writer / Producer / …, each opening their person page. It
+// The TMDB key crew — Director / Writer / Producer / …, each opening their person page. It
 // complements the hero's Director line (which comes from Plex directly).
 function CrewSection({
   crew,
diff --git a/frontend/src/components/plexDetailUi.tsx b/frontend/src/components/plexDetailUi.tsx
index 1eb6b547..532bacea 100644
--- a/frontend/src/components/plexDetailUi.tsx
+++ b/frontend/src/components/plexDetailUi.tsx
@@ -38,7 +38,7 @@ export function Filterable({
   title?: string;
   className?: string;
   /** A genre / keyword tag rather than a run of text: an edged chip when it filters, a flat badge
-   *  when it doesn't (E28 S3d: edged = pressable). */
+   *  when it doesn't (edged = pressable). */
   tag?: boolean;
   onDark?: boolean;
   children: ReactNode;
@@ -93,7 +93,7 @@ export function DetailCustomizeMenu({
   showRelated?: boolean;
   onToggleRelated?: () => void;
   hasRelated?: boolean;
-  // Crossfade toggle (E5 S8) — offered only when the art backdrop itself is on; omitted where a page
+  // Crossfade toggle — offered only when the art backdrop itself is on; omitted where a page
   // doesn't wire it (e.g. the season page reuses the show's backdrop prefs without its own control).
   crossfade?: boolean;
   onToggleCrossfade?: () => void;
@@ -105,7 +105,7 @@ export function DetailCustomizeMenu({
   const btnRef = useRef<HTMLButtonElement>(null);
   const menuRef = useRef<HTMLDivElement>(null);
   useDismiss(open, () => setOpen(false), [menuRef, btnRef]);
-  // Deliberately NOT on the R8 popover platform. In the player's OVERLAY variant this menu renders
+  // Deliberately NOT on the popover platform. In the player's OVERLAY variant this menu renders
   // inside PlexPlayer's `transform: scale(1.25)` windowed subtree, and the platform portals its panel
   // out to <body> — which would paint it at 1× while the surrounding player UI is at 1.25×. A plain
   // `absolute` child stays in the scaled subtree and matches, in both this variant and the unscaled
diff --git a/frontend/src/components/plexPlayerControls.tsx b/frontend/src/components/plexPlayerControls.tsx
index eac17896..95e6406f 100644
--- a/frontend/src/components/plexPlayerControls.tsx
+++ b/frontend/src/components/plexPlayerControls.tsx
@@ -110,7 +110,7 @@ export function Ctrl({
   // `will-change-[opacity]` keeps each tooltip on its own compositor layer from the start. Without it
   // the browser promotes a tooltip only while its fade runs, and inside the player's scale(1.25)
   // the neighbouring glyphs got re-layered with it: every button in the row shimmered as the
-  // pointer crossed one (owner, E28 audit).
+  // pointer crossed one (seen by the owner).
   return (
     <div className="relative flex group/ctrl">
       <IconButton
diff --git a/frontend/src/components/plexShow.aside.dom.test.tsx b/frontend/src/components/plexShow.aside.dom.test.tsx
index 79fb4368..1202688a 100644
--- a/frontend/src/components/plexShow.aside.dom.test.tsx
+++ b/frontend/src/components/plexShow.aside.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E31 (the owner's pick "A"): TMDB enriches shows as it does movies — studios, countries, keywords, key
+// The owner's pick "A": TMDB enriches shows as it does movies — studios, countries, keywords, key
 // crew — and the show page showed none of it, beside a hero whose text stopped at ~55% of the panel. Its
 // hero now has the movie page's second column (facts over crew) and the keywords under the text.
 import { describe, it, expect, afterEach, beforeAll, vi } from "vitest";
@@ -86,7 +86,7 @@ function renderShow(onFilter = vi.fn(), onOpenPerson = vi.fn()) {
   return { onFilter, onOpenPerson };
 }
 
-describe("the show page's facts, keywords and crew (E31)", () => {
+describe("the show page's facts, keywords and crew", () => {
   it("shows the facts over the crew beside the text, and the keywords under it", async () => {
     const { onFilter, onOpenPerson } = renderShow();
     const aside = await screen.findByTestId("detail-aside");
diff --git a/frontend/src/components/plexSubUrl.test.ts b/frontend/src/components/plexSubUrl.test.ts
index 5c9bc107..76821e21 100644
--- a/frontend/src/components/plexSubUrl.test.ts
+++ b/frontend/src/components/plexSubUrl.test.ts
@@ -1,11 +1,11 @@
-// PLEX_SUB_URL encode/decode round-trip + guards. Extracted from PlexBrowse for this test (E4
-// deep-review deferred gap). Pure — no DOM, no history.
+// PLEX_SUB_URL encode/decode round-trip + guards. Extracted from PlexBrowse for this test (a
+// code review's deferred gap). Pure — no DOM, no history.
 import { describe, it, expect } from "vitest";
 import { PLEX_SUB_URL as U, type Sub } from "./plexSubUrl";
 
 describe("PLEX_SUB_URL encode", () => {
   it("mirrors each bookmarkable sub-view to ?v=<kind>:<args>", () => {
-    expect(U.encode({ kind: "grid" })).toBe("browse"); // the flat "Browse all" grid (E5 S4)
+    expect(U.encode({ kind: "grid" })).toBe("browse"); // the flat "Browse all" grid
     expect(U.encode({ kind: "playlists" })).toBe("playlists"); // browse-all-playlists (Piece 2)
     expect(U.encode({ kind: "collections" })).toBe("collections"); // browse-all-collections (Piece 2)
     expect(U.encode({ kind: "show", id: "s1" })).toBe("show:s1");
@@ -78,7 +78,7 @@ describe("PLEX_SUB_URL decode guards", () => {
 });
 
 describe("PLEX_SUB_URL entry", () => {
-  // E28 review E1: the Restart click must not replay on a reload / Forward onto the player entry.
+  // The Restart click must not replay on a reload / Forward onto the player entry.
   it("keeps the player without its one-shot fromStart, and every other view whole", () => {
     const entry = U.entry!;
     expect(entry({ kind: "player", id: "7", queue: ["7", "8"], fromStart: true })).toEqual({
diff --git a/frontend/src/components/plexSubUrl.ts b/frontend/src/components/plexSubUrl.ts
index 6e59317e..52a9d9e2 100644
--- a/frontend/src/components/plexSubUrl.ts
+++ b/frontend/src/components/plexSubUrl.ts
@@ -19,7 +19,7 @@ export type Sub =
   | { kind: "collection"; id: string }; // the Collection info page (id = collection rating_key)
 
 // Mirror the Plex sub-view to ?v=<kind>:<args> so a show / season / movie-info / person / playlist page
-// — and the flat browse grid — are bookmarkable. Discover is the ROOT landing (E5 S4), so it (and the
+// — and the flat browse grid — are bookmarkable. Discover is the ROOT landing, so it (and the
 // ephemeral player) is not mirrored (encode → null); the grid gets `?v=browse` so "Browse all" is a
 // distinct, shareable URL. The person name is the whole tail after the first ":", so a name containing
 // ":" round-trips.
@@ -51,7 +51,7 @@ export const PLEX_SUB_URL: SubviewUrl<Sub> = {
   },
   // `fromStart` is the Restart CLICK, not a property of the entry: kept in history.state it restarted
   // the item from 0 again on every reload or Forward onto the player, and the progress checkpoint
-  // then overwrote the resume point it had skipped (E28 review E1).
+  // then overwrote the resume point it had skipped.
   entry: (v) => (v.kind === "player" && v.fromStart ? { ...v, fromStart: undefined } : v),
   decode: (raw) => {
     const i = raw.indexOf(":");
diff --git a/frontend/src/components/plexViews.restart.dom.test.tsx b/frontend/src/components/plexViews.restart.dom.test.tsx
index 14080e3f..61a86103 100644
--- a/frontend/src/components/plexViews.restart.dom.test.tsx
+++ b/frontend/src/components/plexViews.restart.dom.test.tsx
@@ -133,7 +133,7 @@ describe("the restart button on a show and a season", () => {
   });
 });
 
-describe("the show page's summary (E30 review)", () => {
+describe("the show page's summary", () => {
   it("is clamped with a More, so a long one can still be read in full", async () => {
     const tall = vi.spyOn(HTMLElement.prototype, "scrollHeight", "get").mockReturnValue(400);
     const box = vi.spyOn(HTMLElement.prototype, "clientHeight", "get").mockReturnValue(60);
diff --git a/frontend/src/components/plexViews.tsx b/frontend/src/components/plexViews.tsx
index 08c3e606..61c40bc3 100644
--- a/frontend/src/components/plexViews.tsx
+++ b/frontend/src/components/plexViews.tsx
@@ -122,12 +122,12 @@ export function PlexInfoView({
   );
 }
 
-// How often, and for how long, a person page asks again for a bio that is on its way (E30 S6). The
+// How often, and for how long, a person page asks again for a bio that is on its way. The
 // background fetch takes a second or two; twenty seconds covers a slow TMDB without waiting on a dead one.
 const BIO_POLL_MS = 1500;
 // From this many "Known for" titles the rail gets half the hero. Fewer (about one person in five) sit
 // right beside the text, at their posters' width, and what is left over is the panel's end — not a hole
-// between the text and a lone poster at the far edge (E30 S6, owner pick "b").
+// between the text and a lone poster at the far edge (owner pick "b").
 const KNOWN_FOR_HALF = 4;
 const BIO_WAIT_MS = 20_000;
 
@@ -158,8 +158,8 @@ export function PlexPersonView({
   const menu = useContextMenu<PlexCard>();
   const lang = plexLang(i18n.language);
   const personKey = qk.plexPerson(name, lang);
-  // A person the people_enrich job hasn't reached yet gets their bio fetched when the page opens (E30
-  // S6); the answer says so (`enriching`) and the page asks again until it lands — for a while, not
+  // A person the people_enrich job hasn't reached yet gets their bio fetched when the page opens;
+  // the answer says so (`enriching`) and the page asks again until it lands — for a while, not
   // forever: BIO_WAIT_MS after the page opened (by the clock, not by the last answer — a failing ask
   // leaves that where it was) a TMDB that is down stops being waited on, and a failing ask ends it at
   // once (the next open tries again). The page is keyed on the person, so the wait starts per person;
@@ -179,7 +179,7 @@ export function PlexPersonView({
         : false,
   });
   const bioOnItsWay = !!q.data?.enriching && !waitOver && !q.isError;
-  // E5 S8: cross-dissolve the backdrop through the person's films' art (the touch the roadmap calls
+  // Cross-dissolve the backdrop through the person's films' art (the touch the roadmap calls
   // out). Reuses the shared art-backdrop / crossfade prefs the detail pages own — no per-page control.
   const { artBg, crossfade } = useDetailPrefs();
   const pd = q.data;
@@ -264,7 +264,7 @@ export function PlexPersonView({
         <LoadingState label={t("plex.loading")} />
       ) : (
         <div className="p-4">
-          {/* Hero (E30 S6, owner pick "A"): the person — headshot, facts, a clamped bio — on the left,
+          {/* Hero (owner pick "A"): the person — headshot, facts, a clamped bio — on the left,
               what they are known for on the right, so the bio doesn't sit in a full-width panel with an
               empty half beside it. One column where the panel is narrow. */}
           <section className={`${SURFACE.panel} @container p-4 sm:p-5 mb-6`}>
@@ -357,7 +357,7 @@ export function PlexPersonView({
                 )}
               </div>
 
-              {/* "Known for" — the person's most-popular titles that are in our library (E5 S6). */}
+              {/* "Known for" — the person's most-popular titles that are in our library. */}
               {d.known_for.length > 0 && (
                 <div className="min-w-0">
                   <Carousel
@@ -453,7 +453,7 @@ export function PlexShowView({
     toggleRelated,
     toggleCrossfade,
   } = useDetailPrefs();
-  // The facts / keywords / crew (E31): TMDB enriches shows too, and the page showed none of it.
+  // The facts / keywords / crew: TMDB enriches shows too, and the page showed none of it.
   const aside = useDetailAside(show ?? {});
   useCrossfadeBackdrop(
     [
@@ -494,7 +494,7 @@ export function PlexShowView({
             title: `${show.title} — ${seasonTitle(se, t)}`,
           })
       : undefined;
-  // A season's one action list (E28 C1): the rows its card shows on hover, plus copy.
+  // A season's one action list: the rows its card shows on hover, plus copy.
   const seasonItems = (se: PlexSeasonDetail) => {
     const seWatched = se.status === "watched";
     const add = addSeason(se);
@@ -607,7 +607,7 @@ export function PlexShowView({
               )}
               {(() => {
                 // IMDb score when present, else the Plex audience score — mirrors PlexInfo so a show
-                // with no imdb:// entry (imdb_rating NULL after the S6 IMDb-only change) still shows a
+                // with no imdb:// entry (imdb_rating NULL since the IMDb-only change) still shows a
                 // rating instead of dropping the badge entirely.
                 const badge = pickRatingBadge(show.imdb_rating, show.rating);
                 if (!badge) return null;
diff --git a/frontend/src/components/tagChipNames.dom.test.tsx b/frontend/src/components/tagChipNames.dom.test.tsx
index b6aa34fa..a31a5b33 100644
--- a/frontend/src/components/tagChipNames.dom.test.tsx
+++ b/frontend/src/components/tagChipNames.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// A saved view or the stored feed filter can outlive its tag. The feed then matches nothing (E32 S2),
+// A saved view or the stored feed filter can outlive its tag. The feed then matches nothing,
 // so the chip must say the tag is gone, not read as a bare id; while the tag list loads it is a
 // placeholder, and if the list fails it falls back to the id rather than claiming "deleted".
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
diff --git a/frontend/src/components/ui/ActionMenu.dom.test.tsx b/frontend/src/components/ui/ActionMenu.dom.test.tsx
index 7f4a9a42..6c0a71ab 100644
--- a/frontend/src/components/ui/ActionMenu.dom.test.tsx
+++ b/frontend/src/components/ui/ActionMenu.dom.test.tsx
@@ -46,7 +46,7 @@ describe("ActionMenu", () => {
     // A `title` on a disabled row reached nobody: a disabled button fires no pointer events and
     // roving focus skips it. The reason is visible text now, undimmed so it can be read. An enabled
     // row's state ("Downloaded" under "Download…") is the same line: a `title` shows to a resting
-    // mouse only, never to a key or a finger (round 2, F5).
+    // mouse only, never to a key or a finger.
     renderMenu([
       { id: "move", label: "Move to", onSelect: vi.fn(), disabled: true, note: "No other list" },
       { id: "dl", label: "Download…", onSelect: vi.fn(), note: "Downloaded" },
@@ -76,7 +76,7 @@ describe("ActionMenu", () => {
 
   // Close first, act on a later task: floating-ui hands the focus back to the trigger from a microtask
   // as the menu unmounts, and an action run in that same batch (a confirm dialog) had its focus taken
-  // back to the trigger behind the dialog's scrim — measured in Chrome, E11 S2. jsdom does not run
+  // back to the trigger behind the dialog's scrim — measured in Chrome. jsdom does not run
   // that focus race, so the ORDER is what is pinned: the menu is gone before the action runs.
   it("selecting an item closes the menu first, then fires its onSelect once", async () => {
     const onSelect = vi.fn();
@@ -182,7 +182,7 @@ describe("ActionMenu", () => {
   });
 });
 
-// PageUp/PageDown in a roving menu (E11, owner request) — the same page as the palette's and the
+// PageUp/PageDown in a roving menu (owner request) — the same page as the palette's and the
 // combobox's (lib/listPaging); here the keyboard's row holds real DOM focus (the `tabindex=0` rover).
 describe("ActionMenu · paging", () => {
   it("moves the roving focus a page at a time, over disabled rows, stopping at the ends", () => {
diff --git a/frontend/src/components/ui/ActionMenu.tsx b/frontend/src/components/ui/ActionMenu.tsx
index 12b4d3e5..c113a0c2 100644
--- a/frontend/src/components/ui/ActionMenu.tsx
+++ b/frontend/src/components/ui/ActionMenu.tsx
@@ -8,12 +8,12 @@ import { Pressable } from "./Pressable";
 import { SURFACE } from "./surfaces";
 
 // A reusable "⋯ more actions" overflow menu: a compact trigger that opens a list of one-shot actions.
-// Built on the R8 AnchoredPopover platform (arrows/typeahead/Escape/anchor-flip), same as ViewSwitcher
+// Built on the AnchoredPopover platform (arrows/typeahead/Escape/anchor-flip), same as ViewSwitcher
 // and LanguageSwitcher. Use it to keep occasional actions out of a crowded toolbar. The items are
 // fire-and-close (`onSelect`) — all but a `check: { kind: "many" }` row, which toggles in place; a
 // `disabled` item (e.g. a mutation already in flight) is inert.
 //
-// E10 S2 split the ITEM LIST out of the trigger (`MenuItemList`) so the ⋯ menu and the right-click
+// The ITEM LIST is split out of the trigger (`MenuItemList`) so the ⋯ menu and the right-click
 // context menu (`ContextMenu`) render the same rows from the same item type. That is the whole point
 // of the split: a context menu that drifts from the overflow menu beside it is two menus, and the
 // user has to learn both.
@@ -46,11 +46,11 @@ interface MenuItemBase {
   title?: string;
   /** Why a DISABLED row is off, shown as a line under its label. Not a `title`: a disabled button
    *  fires no pointer events (no tooltip) and roving focus skips it, so a reason there reached
-   *  nobody. An `aria-disabled` row was tried and reverted (E10 review rounds 1–2: floating-ui skips
+   *  nobody. An `aria-disabled` row was tried and reverted (floating-ui skips
    *  it identically, and the mouse got a highlight that then no-opped). Visible text is the one
    *  place a disabled row's reason can be: seen, and read in a screen reader's browse mode.
    *  On an ENABLED row it is the state of what the row opens ("Downloaded" under "Download…"),
-   *  for the same reason: a `title` shows to a resting mouse only (round 2, F5). */
+   *  for the same reason: a `title` shows to a resting mouse only. */
   note?: string;
   /** Draw a divider above this item. Ignored on the first item — a menu never opens with a rule. */
   separatorBefore?: boolean;
diff --git a/frontend/src/components/ui/AnchoredPopover.returnFocus.dom.test.tsx b/frontend/src/components/ui/AnchoredPopover.returnFocus.dom.test.tsx
index 1ea0ea57..956ed440 100644
--- a/frontend/src/components/ui/AnchoredPopover.returnFocus.dom.test.tsx
+++ b/frontend/src/components/ui/AnchoredPopover.returnFocus.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Which surfaces give the focus back to a card focused as a whole (deep-review E11 rounds 2 and 3). A
+// Which surfaces give the focus back to a card focused as a whole (found in code review). A
 // menu does, by hand — floating-ui's own return would land on the card's first link (see
 // ContextMenu.dom.test). A hover card never returned focus, and one closing after the reader clicked a
 // link in it must not pull the focus back to the card under it.
diff --git a/frontend/src/components/ui/AnchoredPopover.tsx b/frontend/src/components/ui/AnchoredPopover.tsx
index dc64d06e..9a323a8c 100644
--- a/frontend/src/components/ui/AnchoredPopover.tsx
+++ b/frontend/src/components/ui/AnchoredPopover.tsx
@@ -18,7 +18,7 @@ import {
 import { useFullscreenPortalHost } from "../../lib/fullscreen";
 import type { useAnchoredPopover } from "./anchoredPopoverHooks";
 
-// R8 popover platform. ONE anchored-popover primitive over @floating-ui/react, replacing the ~9
+// The popover platform. ONE anchored-popover primitive over @floating-ui/react, replacing the ~9
 // hand-rolled positioning engines (measured flip / width clamp / rAF scroll-follow / scroller-relative
 // visibility) that had each re-derived the same maths. Floating UI's middleware does all four:
 //   - flip()  → measured two-way flip (top/bottom) when a side runs out of room
@@ -28,9 +28,10 @@ import type { useAnchoredPopover } from "./anchoredPopoverHooks";
 //   - autoUpdate → follows the trigger on scroll/resize (the old rAF loop), coalesced by the library
 // Positioning is portalled through FloatingPortal (escapes ancestor stacking contexts — same job the
 // house <Overlay> did for TagsCell). Every popover is a node in the app's <FloatingTree> so Escape /
-// outside-press dispatch is topmost-only across nested layers (S3 folds the Modal + players in too).
+// outside-press dispatch is topmost-only across nested popovers; against the Modal and the players,
+// which are not nodes, it is lib/layerStack that decides who is topmost.
 //
-// S2 (this layer) adds the keyboard/ARIA model the roles promise, mirroring `ViewSwitcher` (the house's
+// This layer adds the keyboard/ARIA model the roles promise, mirroring `ViewSwitcher` (the house's
 // textbook menu) but via Floating UI's idioms rather than a second hand-rolled roving engine:
 //   - useListNavigation → roving focus over the registered items (↑/↓/Home/End, loop), menu/listbox only;
 //     PageUp/PageDown (a page, no loop) are ours, for every list surface incl. the combobox
@@ -45,9 +46,9 @@ import type { useAnchoredPopover } from "./anchoredPopoverHooks";
 //
 // The trigger takes its ref DESTRUCTURED: `const { setReference } = pop.refs;` then
 // `ref={setReference} {...pop.getReferenceProps()}`. Written `ref={pop.refs.setReference}`, the React
-// Compiler treats the whole `pop` as a ref and skips the component (E32 S3 — 21 call sites did).
+// Compiler treats the whole `pop` as a ref and skips the component (21 call sites once did).
 //
-// S? adds a "combobox" mode — the ONE right way to build a typeable combobox (a search/filter input
+// A "combobox" mode — the ONE right way to build a typeable combobox (a search/filter input
 // with a listbox of options below), so a hand-rolled floating-ui engine (the old MultiSelectChips /
 // PlexSearchBox pattern) is no longer needed. It differs from menu/listbox in exactly the focus model:
 //   - the trigger IS a text input, so open is driven by the caller (focus/typing), NOT useClick;
@@ -93,7 +94,7 @@ type ItemRole = "menuitem" | "menuitemradio" | "menuitemcheckbox" | "option";
  *  key. (Since the Tailwind v4 migration `bg-accent/NN` works — v4 does the opacity modifier via
  *  color-mix — so the recipe no longer needs a hand-written color-mix arbitrary value.) */
 // The roving-focus highlight. A hovered/roving row gets the SAME strong accent fill whether or not it
-// is selected — a checked row no longer reads as a weak ring-only afterthought (R10 weak-ring fix). The
+// is selected — a checked row no longer reads as a weak ring-only afterthought. The
 // selected state stays legible ON the fill because these menus mark "selected" with a CHILD element (a
 // checkmark / checkbox) that paints over the row tint; the selected row just gets a stronger ring
 // (ring-2, accent/80) than an unselected one (ring-1, accent/60) to keep the two apart.
@@ -242,7 +243,7 @@ interface PopoverSurfaceProps {
   passthrough?: boolean;
   /** The panel's role (a combobox's `listbox`) goes on an inner `<PopoverList>` instead of the panel
    *  itself, so the panel can also hold lines ABOUT the list — loading, nothing found, a failed load
-   *  with its Retry — outside it: a listbox may own options only (round 2, F4). */
+   *  with its Retry — outside it: a listbox may own options only. */
   listInside?: boolean;
 }
 
@@ -308,7 +309,7 @@ function PopoverSurfaceInner({
   // handled by the element-identity dependency. (Keying the portal to remount instead would rebuild
   // the subtree and lose all of that.) Focus does NOT survive on its own — `appendChild` on an
   // already-parented node is remove-then-insert, which blurs to <body>; the hook saves and restores
-  // it. This used to be a second copy of Modal's re-parent that lacked exactly that (round 5).
+  // it. This used to be a second copy of Modal's re-parent that lacked exactly that.
   const container = useFullscreenPortalHost();
 
   const { style: floatingPropStyle, ...floatingProps } = getFloatingProps() as {
@@ -336,7 +337,7 @@ function PopoverSurfaceInner({
   // but when that element is not a Tab stop itself, to its first TABBABLE descendant instead, even
   // when handed the element as a ref (its return runs through `getFirstTabbableElement` either way).
   // A card the keyboard is on (lib/listNav gives its root tabindex=-1) is exactly that: measured in
-  // Chrome (deep-review E11 round 2), j, Shift+F10, Escape left focus on the card's thumbnail link, the
+  // Chrome, j, Shift+F10, Escape left focus on the card's thumbnail link, the
   // ring off the card and the next Enter on a control. So for such an element the library's return is
   // off and this gives the focus back to it as it is — captured at open, before focus moves into the
   // panel, and only when the focus was still in a floating layer (or nowhere) as the panel closed:
@@ -345,7 +346,7 @@ function PopoverSurfaceInner({
   //
   // Only for a focus-managed surface, whose return this replaces: a hover card or a combobox never
   // returned focus, and a hover card closing after the reader clicked a link in it must not pull the
-  // focus back to the card under it (deep-review E11 round 3).
+  // focus back to the card under it.
   const [returnTo] = useState(() => {
     const active = document.activeElement;
     return managed &&
@@ -360,7 +361,7 @@ function PopoverSurfaceInner({
     return () => {
       // "Still in the layer" is read off the portal marker, not the panel: FloatingPortal renders the
       // panel a commit after this surface mounts, so the panel's ref is still empty when this effect
-      // runs (deep-review E11 round 3).
+      // runs.
       const active = document.activeElement;
       const stillOurs =
         !active || active === document.body || !!active.closest("[data-floating-ui-portal]");
diff --git a/frontend/src/components/ui/Avatar.dom.test.tsx b/frontend/src/components/ui/Avatar.dom.test.tsx
index 74722030..2fd74f53 100644
--- a/frontend/src/components/ui/Avatar.dom.test.tsx
+++ b/frontend/src/components/ui/Avatar.dom.test.tsx
@@ -60,8 +60,8 @@ describe("Avatar · a failed image must not follow the component to the next ite
   });
 
   it("retries a URL it comes back to — a 429 is transient, and so is the memory of it", () => {
-    // The instance is not remounted here on purpose: the player's channel avatar and the Messages
-    // thread header both swap `src` on a live instance. A memory that outlived the reason for it
+    // The instance is not remounted here on purpose: the player's channel avatar swaps `src` on a
+    // live instance as it steps through a queue. A memory that outlived the reason for it
     // would pin a throttled channel to its initial for the rest of the session.
     const { rerender } = render(
       <Avatar src="https://cdn.test/a.jpg" alt="avatar" fallback="Zed" />,
diff --git a/frontend/src/components/ui/Avatar.tsx b/frontend/src/components/ui/Avatar.tsx
index d81f7621..712283b8 100644
--- a/frontend/src/components/ui/Avatar.tsx
+++ b/frontend/src/components/ui/Avatar.tsx
@@ -29,7 +29,7 @@ export default function Avatar({
   //
   // Forgetting the URL once `src` has moved off it is the other half, and it is what keeps the 429
   // TRANSIENT: without it the memory outlives the reason for it, and a mounted instance whose `src`
-  // swaps — the player's channel avatar stepping through a queue, the Messages thread header — would
+  // swaps — the player's channel avatar stepping through a queue — would
   // show the initial for a throttled channel forever, never re-requesting even after the CDN
   // relented. Written in render because it is convergent (the write falsifies its own condition) and
   // because an effect would leave one committed frame in which the memory is stale, which is the
diff --git a/frontend/src/components/ui/BackToTop.dom.test.tsx b/frontend/src/components/ui/BackToTop.dom.test.tsx
index 85fb47dd..a84bf2a6 100644
--- a/frontend/src/components/ui/BackToTop.dom.test.tsx
+++ b/frontend/src/components/ui/BackToTop.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 review F7: while hidden the button only went transparent — a Tab still landed on the invisible
+// While hidden the button only went transparent — a Tab still landed on the invisible
 // control. And a keyboard press scrolled to the top and hid it with the focus still on it.
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { act, cleanup, fireEvent, render, screen } from "@testing-library/react";
diff --git a/frontend/src/components/ui/BackToTop.tsx b/frontend/src/components/ui/BackToTop.tsx
index 09bfb527..5564da1b 100644
--- a/frontend/src/components/ui/BackToTop.tsx
+++ b/frontend/src/components/ui/BackToTop.tsx
@@ -44,7 +44,7 @@ export default function BackToTop({ dep, threshold = 600 }: { dep?: unknown; thr
   }, [dep, threshold]);
 
   // A keyboard press hides the button it was on: the focus goes to the page it scrolled (its <main>
-  // is a focus rest, not a Tab stop), not left on an invisible control (E28 review F7).
+  // is a focus rest, not a Tab stop), not left on an invisible control.
   const toTop = (e: React.MouseEvent) => {
     const main = scrollerRef.current ?? document.querySelector("main");
     main?.scrollTo({ top: 0, behavior: "smooth" });
diff --git a/frontend/src/components/ui/Badge.tsx b/frontend/src/components/ui/Badge.tsx
index f0fc530c..be4b8b60 100644
--- a/frontend/src/components/ui/Badge.tsx
+++ b/frontend/src/components/ui/Badge.tsx
@@ -1,7 +1,7 @@
 import clsx from "clsx";
 import type { ReactNode } from "react";
 
-// A static label (a topic, a keyword, a genre, a status): flat and tonal, with NO edge (owner, E28 S3d).
+// A static label (a topic, a keyword, a genre, a status): flat and tonal, with NO edge (owner's call).
 // Every chip that does something has an edge, so "edged = pressable, flat = just says" holds at a
 // glance; a static tag painted like a chip is clicked and does nothing. The tint is the text colour
 // at 8%, so it reads on the dark schemes and on white alike; `onDark` is the always-dark player's. A
diff --git a/frontend/src/components/ui/Banner.tsx b/frontend/src/components/ui/Banner.tsx
index b39e3275..0feceb79 100644
--- a/frontend/src/components/ui/Banner.tsx
+++ b/frontend/src/components/ui/Banner.tsx
@@ -20,7 +20,7 @@ const TONES: Record<BannerTone, { bar: string; icon: string; action: "primary" |
   },
 };
 
-// Shared top-of-app notification bar. VersionBanner and DemoBanner are thin wrappers over this;
+// Shared top-of-app notification bar. VersionBanner and VerifyBanner are thin wrappers over this;
 // a future news-ticker variant can build on the same shell (rotating content as children).
 export default function Banner({
   tone,
@@ -41,7 +41,7 @@ export default function Banner({
    *  control is not an acceptable default, and `Button`'s type now says so. */
   dismissTitle?: string;
   /** `"status"` for a bar that APPEARS in response to something the user just did, so a screen
-   * reader announces it. Left unset for the permanent bars (demo, version): those are part of the
+   * reader announces it. Left unset for the permanent bars (version): those are part of the
    * page when it loads, and announcing them on every visit is noise, not information. */
   role?: "status";
 }) {
diff --git a/frontend/src/components/ui/Button.dom.test.tsx b/frontend/src/components/ui/Button.dom.test.tsx
index 90760263..b7d35c00 100644
--- a/frontend/src/components/ui/Button.dom.test.tsx
+++ b/frontend/src/components/ui/Button.dom.test.tsx
@@ -1,8 +1,8 @@
 // @vitest-environment jsdom
 //
-// S5: the shared <Button> primitive. These lock the load-bearing contract the migrated call sites rely
-// on: variant/size paint (the E28 B1 ladder and B3 layers), the loading state (disabled + spinner +
-// aria-busy), the pressed toggle, and the type="button" default that stops an action button from
+// The shared <Button> primitive. These lock the load-bearing contract the migrated call sites rely
+// on: variant/size paint (the DESIGN.md B1 ladder and B3 layers), the loading state (disabled +
+// spinner + aria-busy), the pressed toggle, and the type="button" default that stops an action button from
 // submitting a surrounding form. A glyph-only button is `IconButton` (its own test).
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { act, render, screen, cleanup, fireEvent } from "@testing-library/react";
@@ -10,7 +10,7 @@ import { Button } from "./Button";
 
 afterEach(cleanup);
 
-describe("Button primitive (S5)", () => {
+describe("Button primitive", () => {
   it("defaults to type=button so it never submits a form", () => {
     render(<Button>Go</Button>);
     expect(screen.getByRole("button", { name: "Go" }).getAttribute("type")).toBe("button");
@@ -85,7 +85,7 @@ describe("Button primitive (S5)", () => {
     expect(onClick).not.toHaveBeenCalled();
   });
 
-  // E11 S2, measured in Chrome: a focused button that becomes natively disabled drops the focus to
+  // Measured in Chrome: a focused button that becomes natively disabled drops the focus to
   // <body> and never gets it back, so every "Something else" press threw a keyboard user out of Home.
   // jsdom has no focus fixup, so what is pinned here is the cause — native `disabled` stays off.
   it("loading keeps the button natively enabled, so it keeps the focus", () => {
@@ -159,7 +159,7 @@ describe("Button primitive (S5)", () => {
   it("carries the coarse-pointer minimum target and the 24 floor, a link variant too", () => {
     // The tablet comfort contract: the minimum lives in the primitive, so no call site can opt
     // out of it by accident. A link variant was once excluded as "text in a sentence", but every
-    // one stands alone, and the E28 audit measured them at 16–20px.
+    // one stands alone, and an audit measured them at 16–20px.
     const { unmount } = render(<Button>Tap</Button>);
     expect(screen.getByRole("button", { name: "Tap" }).className).toContain("touch-target");
     unmount();
@@ -180,16 +180,16 @@ describe("Button primitive (S5)", () => {
 
 // --- the accessible-name contract, pinned at the TYPE level ------------------------------------
 // A button that renders no text must carry a name, and that rule is a union in Button.tsx rather
-// than a doc comment because the comment version let two nameless icon buttons ship (E10 review
-// round 1). But a type with no test is a type someone widens to silence a stubborn call site:
-// replacing `ButtonProps` with the permissive shape left tsc, eslint, knip and vitest all green
-// (round 2). Each `@ts-expect-error` below FAILS THE BUILD if the error it expects stops happening,
+// than a doc comment because the comment version let two nameless icon buttons ship. But a
+// type with no test is a type someone widens to silence a stubborn call site:
+// replacing `ButtonProps` with the permissive shape left tsc, eslint, knip and vitest all green.
+// Each `@ts-expect-error` below FAILS THE BUILD if the error it expects stops happening,
 // so weakening the union turns the whole typecheck lane red.
 //
 // Rendered, not just declared, so eslint sees them used and the file stays one test suite.
 describe("Button · disabled while it holds the focus", () => {
-  // A focused button that turns natively disabled loses the focus to <body> in Chrome (measured, E11
-  // S2) — and ~60 call sites disable the very button that was just pressed while its mutation runs.
+  // A focused button that turns natively disabled loses the focus to <body> in Chrome (measured)
+  // — and ~60 call sites disable the very button that was just pressed while its mutation runs.
   // jsdom does not move the focus, so the CONTRACT is what is pinned: while focused, the button is
   // unavailable by aria-disabled + a click guard, never by the native attribute.
   it("keeps the native attribute off while focused, and blocks activation", () => {
@@ -255,7 +255,7 @@ describe("Button accessible-name contract (type level)", () => {
       <>
         {/* @ts-expect-error an icon with no children renders no text and no name */}
         <Button icon={<span />} data-testid="bad-c" />
-        {/* @ts-expect-error the icon-only sizes moved to IconButton (E28 S3b) */}
+        {/* @ts-expect-error the icon-only sizes moved to IconButton */}
         <Button size="icon" label="gone" />
         <Button icon={<span />} label="by label" />
         <Button icon={<span />} aria-label="by aria-label" />
diff --git a/frontend/src/components/ui/Button.tsx b/frontend/src/components/ui/Button.tsx
index 962735cb..f3657fb2 100644
--- a/frontend/src/components/ui/Button.tsx
+++ b/frontend/src/components/ui/Button.tsx
@@ -10,7 +10,7 @@ import { buttonClass, isLinkVariant, type ButtonSize, type ButtonVariant } from
 // holds. The app's other button families have their own primitives beside it: `IconButton` (a glyph
 // with no text), `Pressable` (a card, row or tile whose content is the control), `Chip` and
 // `FilterChipGroup` (filters), `SegmentedToggle`, `DragHandle`. A hand-rolled `<button>` is none of
-// them (E28 S3b).
+// them.
 //
 // No focus-visible here on purpose: @layer base in index.css already rings every <button> for keyboard
 // users. Adding one would double the ring.
diff --git a/frontend/src/components/ui/Carousel.dom.test.tsx b/frontend/src/components/ui/Carousel.dom.test.tsx
index 6023384d..14a55438 100644
--- a/frontend/src/components/ui/Carousel.dom.test.tsx
+++ b/frontend/src/components/ui/Carousel.dom.test.tsx
@@ -93,7 +93,7 @@ describe("Carousel", () => {
   });
 });
 
-// E11 S4b: a rail on Home, Discover or an info page is a list the keyboard walks — but only when the
+// A rail on Home, Discover or an info page is a list the keyboard walks — but only when the
 // caller says its cards carry `navItemAttrs`. A carousel of plain content must not claim `j`.
 describe("Carousel · keyboard", () => {
   const cards = () =>
diff --git a/frontend/src/components/ui/Chip.dom.test.tsx b/frontend/src/components/ui/Chip.dom.test.tsx
index 2798bfc7..a527f734 100644
--- a/frontend/src/components/ui/Chip.dom.test.tsx
+++ b/frontend/src/components/ui/Chip.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 S3b: the chip family (docs/DESIGN.md "One primitive per button family"). One geometry for a
+// The chip family (docs/DESIGN.md "One primitive per button family"). One geometry for a
 // filter, an applied narrowing, a tag and a suggestion, where five files had five.
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { act, cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
@@ -42,7 +42,7 @@ describe("Chip", () => {
     expect(onClick).toHaveBeenCalledOnce();
   });
 
-  // Round 2 (F6): the feed's and Plex's active-filter chips unmount with the filter they remove,
+  // The feed's and Plex's active-filter chips unmount with the filter they remove,
   // and a keyboard press left the focus on <body>. The chip hands it on itself, for every caller.
   it("a removing chip pressed from the keyboard hands the focus to its neighbour", () => {
     function Row() {
@@ -70,7 +70,7 @@ describe("Chip", () => {
     expect(document.activeElement).toBe(screen.getByRole("button", { name: "Remove News" }));
   });
 
-  // Round 3: the neighbour it hands the focus to can go in the same removal — the "Clear all" that
+  // The neighbour it hands the focus to can go in the same removal — the "Clear all" that
   // only shows beside enough filters. The focus then goes to the chip before, not to <body>.
   it("a removing chip whose neighbour goes with it hands the focus to the chip before", async () => {
     function Row() {
diff --git a/frontend/src/components/ui/Chip.tsx b/frontend/src/components/ui/Chip.tsx
index 33049528..2d885ea1 100644
--- a/frontend/src/components/ui/Chip.tsx
+++ b/frontend/src/components/ui/Chip.tsx
@@ -58,7 +58,7 @@ export const Chip = forwardRef<HTMLButtonElement, ChipProps>(function Chip(
       className={clsx(chipClass(variant, size), removeLabel && "pr-1.5", className)}
       onClick={(e) => {
         // A removal chip unmounts with what it removes: from the keyboard it holds the focus, which
-        // went to <body> (round 2, F6 — the active-filter chips of the feed and Plex). Every
+        // went to <body> (the active-filter chips of the feed and Plex). Every
         // removal chip gets it here, once, instead of each caller remembering.
         if (removeLabel && e.currentTarget === document.activeElement)
           handOffFocus(e.currentTarget, () => onClick?.(e));
@@ -126,8 +126,8 @@ export function DismissibleChip({
         type="button"
         onClick={(e) => {
           // From the keyboard the × holds the focus, and the chip unmounts: hand the focus to the
-          // next chip (else the previous one, else what follows the row) first, not to <body> (E28
-          // review F5). A mouse press on it leaves the focus where it was.
+          // next chip (else the previous one, else what follows the row) first, not to <body>.
+          // A mouse press on it leaves the focus where it was.
           const chip = e.currentTarget.parentElement;
           if (chip && e.currentTarget === document.activeElement) handOffFocus(chip, onDismiss);
           else onDismiss();
diff --git a/frontend/src/components/ui/ClampedText.dom.test.tsx b/frontend/src/components/ui/ClampedText.dom.test.tsx
index 6dbcad68..8fc2021a 100644
--- a/frontend/src/components/ui/ClampedText.dom.test.tsx
+++ b/frontend/src/components/ui/ClampedText.dom.test.tsx
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
-// A clamped text offers More only when it is actually cut (E30 S6 on the person page, shared with the
-// collection page in the E30 review, where a one-line summary carried a More that did nothing).
+// A clamped text offers More only when it is actually cut (built for the person page, shared with
+// the collection page, where a one-line summary carried a More that did nothing).
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 import { act, cleanup, fireEvent, render, screen } from "@testing-library/react";
 import { ClampedText } from "./ClampedText";
diff --git a/frontend/src/components/ui/Combobox.dom.test.tsx b/frontend/src/components/ui/Combobox.dom.test.tsx
index 34d208a6..44f5f804 100644
--- a/frontend/src/components/ui/Combobox.dom.test.tsx
+++ b/frontend/src/components/ui/Combobox.dom.test.tsx
@@ -207,7 +207,7 @@ describe("Combobox", () => {
   });
 
   it("names a chip by a label that arrives with later options, in that same render", () => {
-    // E32 S3: the label cache was a ref an effect filled AFTER the render that needed it, and nothing
+    // The label cache was a ref an effect filled AFTER the render that needed it, and nothing
     // re-rendered afterwards — the chip kept showing the raw id until something unrelated did.
     const view = (options: { value: string; label?: string }[]) => (
       <FloatingTree>
@@ -298,12 +298,12 @@ describe("Combobox", () => {
   });
 });
 
-// PageUp/PageDown (E11, owner request): the sidebar's channel filter and the Plex pickers run to
+// PageUp/PageDown (owner request): the sidebar's channel filter and the Plex pickers run to
 // hundreds of rows, and floating-ui's list navigation has only the arrows. jsdom has no layout, so a
 // page is the fixed fallback of 10 rows; the measured page is pinned in lib/listPaging.
-// E28 review J1 + J2: a failed list said "No matches" (an error dressed as an empty result), and a
+// A failed list said "No matches" (an error dressed as an empty result), and a
 // picker whose pick was still being written took another pick.
-// E28 review F5: a chip's × pressed from the keyboard unmounted with the focus on it — to <body>,
+// A chip's × pressed from the keyboard unmounted with the focus on it — to <body>,
 // out of the picker. The focus goes to the next chip's × (else the previous one, else the field).
 describe("Combobox · removing a chip from the keyboard", () => {
   function Harness({ initial }: { initial: string[] }) {
@@ -335,7 +335,7 @@ describe("Combobox · honest states", () => {
     expect(screen.queryByText("common.noResults")).toBeNull();
   });
 
-  // A failed list with no way back but closing its dialog was a dead end (E28 review, owner go).
+  // A failed list with no way back but closing its dialog was a dead end.
   it("offers a Retry on the error, by click and by Enter in the field, keeping the focus", () => {
     const onRetry = vi.fn();
     wrap(
@@ -363,7 +363,7 @@ describe("Combobox · honest states", () => {
     expect(document.activeElement).toBe(field);
   });
 
-  // Round 2 (F4): a listbox may own options only — the alert, "Loading…", "No matches" and the
+  // A listbox may own options only — the alert, "Loading…", "No matches" and the
   // "n more" line sat inside it (axe: aria-required-children). They sit beside it now.
   it("keeps the lines about the list outside the listbox, which the field still controls", () => {
     const { rerender } = wrap(
diff --git a/frontend/src/components/ui/Combobox.tsx b/frontend/src/components/ui/Combobox.tsx
index a6ce688e..584eed21 100644
--- a/frontend/src/components/ui/Combobox.tsx
+++ b/frontend/src/components/ui/Combobox.tsx
@@ -15,7 +15,7 @@ import { ChipLabelPending } from "./Skeleton";
 
 // The universal combobox: a react-select / Overseerr-style "combi input" — selected values are
 // removable chips that live INSIDE a text field you type into, and a checklist of options opens below.
-// It is the ONE control for "pick value(s) from a (possibly large, possibly async) vocabulary": the E5
+// It is the ONE control for "pick value(s) from a (possibly large, possibly async) vocabulary": the
 // Plex filters (genre / age-rating / studio, multi-select) and the collection picker (single-select,
 // server-searched) are both instances, and the header search typeahead can move onto it later.
 //
@@ -56,12 +56,12 @@ export interface ComboboxProps {
   clientFilter?: boolean;
   loading?: boolean;
   /** The options failed to load: said in the list instead of "No matches" (an error is not an empty
-   *  result — E28 review J1). */
+   *  result). */
   error?: string;
   /** Loads the options again after `error`: a Retry beside the message, and Enter in the field. A
    *  failed list with no way back but closing the dialog was a dead end. */
   onRetry?: () => void;
-  /** Takes no pick (e.g. the last one is still being written, J2). Soft, like `FocusSafeButton`: the
+  /** Takes no pick (e.g. the last one is still being written). Soft, like `FocusSafeButton`: the
    *  field keeps the focus (a natively disabled one drops it to <body>), announced as unavailable. */
   disabled?: boolean;
   /** Shown when there are no options to list. */
@@ -81,7 +81,7 @@ export interface ComboboxProps {
 /** Remember each value's display label as options flow through, so a selected chip can name itself
  *  even after the option leaves the query-narrowed list (async single-select). State, merged DURING
  *  render: a ref written in an effect was read by the render before it, so a chip could name itself
- *  by its raw value until something else re-rendered (E32). */
+ *  by its raw value until something else re-rendered. */
 function useLabelCache(options: readonly ComboboxOption[]): Record<string, string> {
   const [labelCache, setLabelCache] = useState<Record<string, string>>({});
   const newLabels = options.filter(
@@ -126,7 +126,7 @@ export default function Combobox({
     onQueryChange?.(q);
   };
   // The input node as STATE, not a ref: the handlers below are handed to getReferenceProps during
-  // render, and a ref inside them made the React Compiler skip the whole component (E32).
+  // render, and a ref inside them made the React Compiler skip the whole component.
   const [inputEl, setInputEl] = useState<HTMLInputElement | null>(null);
   const { ref: fadeRef, style: fadeStyle } = useScrollFade();
 
@@ -294,7 +294,7 @@ export default function Combobox({
       >
         {/* The scroll box owns the height cap AND the scroll-fade mask (ref+style on the same element). */}
         <div ref={fadeRef} style={fadeStyle} className="max-h-64 overflow-y-auto no-scrollbar">
-          {/* The listbox holds the options alone; the lines about the list sit beside it (F4). */}
+          {/* The listbox holds the options alone; the lines about the list sit beside it. */}
           <PopoverList>
             {!showError &&
               visible.map((o) => {
diff --git a/frontend/src/components/ui/CommandPalette.dom.test.tsx b/frontend/src/components/ui/CommandPalette.dom.test.tsx
index 49450919..e7a2430d 100644
--- a/frontend/src/components/ui/CommandPalette.dom.test.tsx
+++ b/frontend/src/components/ui/CommandPalette.dom.test.tsx
@@ -124,7 +124,7 @@ describe("CommandPalette", () => {
     ).toContain("page:feed");
   });
 
-  // E28 F35: the active row wore `bg-card`, ~1.07:1 on the palette's glass. It is the menus' row now.
+  // The active row wore `bg-card`, ~1.07:1 on the palette's glass. It is the menus' row now.
   it("marks the active row with the menus' roving highlight, and only that row", () => {
     open();
     const rows = screen.getAllByRole("option");
@@ -174,7 +174,7 @@ describe("CommandPalette", () => {
   });
 });
 
-// The owner's case (E11 S3): typing "theme" put a channel matched only through its handle above every
+// The owner's case: typing "theme" put a channel matched only through its handle above every
 // "Theme: …" row, and Enter opened the channel.
 describe("CommandPalette · ranking", () => {
   const noop = () => {};
@@ -276,7 +276,7 @@ describe("CommandPalette · accessibility", () => {
   });
 });
 
-// Owner request (E11): with 461 rows and ~11 in view, the arrows alone were a slog. PageUp/PageDown
+// Owner request: with 461 rows and ~11 in view, the arrows alone were a slog. PageUp/PageDown
 // move by what fits in the list, and — unlike the arrows — stop at the ends instead of wrapping.
 describe("CommandPalette · paging", () => {
   const many = (): CommandGroup[] => [
diff --git a/frontend/src/components/ui/CommandPalette.ordering.dom.test.tsx b/frontend/src/components/ui/CommandPalette.ordering.dom.test.tsx
index 3191b6d1..b5cdfa8e 100644
--- a/frontend/src/components/ui/CommandPalette.ordering.dom.test.tsx
+++ b/frontend/src/components/ui/CommandPalette.ordering.dom.test.tsx
@@ -9,7 +9,7 @@
 // and history.ts's overlay bookkeeping is module-global, so the sibling tests there leave an
 // in-flight programmatic back() behind — under which this one either hangs or, worse, goes green on
 // somebody else's popstate. That is exactly how it used to pass: it asserted nothing on its own, and
-// running it with `-t` failed (E10 review round 1). Its own file gives it clean module state.
+// running it with `-t` failed. Its own file gives it clean module state.
 import { useState } from "react";
 import { describe, it, expect, vi, beforeAll } from "vitest";
 import { render, screen, fireEvent, waitFor, act } from "@testing-library/react";
diff --git a/frontend/src/components/ui/CommandPalette.tsx b/frontend/src/components/ui/CommandPalette.tsx
index 05adc686..3a45cbee 100644
--- a/frontend/src/components/ui/CommandPalette.tsx
+++ b/frontend/src/components/ui/CommandPalette.tsx
@@ -11,7 +11,7 @@ import { ROVING_HIGHLIGHT } from "./AnchoredPopover";
 import { fieldClass } from "./fieldStyles";
 
 // The app's jump-to bar: one text field over every place you can go and every app-wide thing you can
-// do, opened with Ctrl/Cmd+K. It is the "one-layer operation" half of E10 — reaching a channel three
+// do, opened with Ctrl/Cmd+K. It is the "one-layer operation" idea — reaching a channel three
 // modules away should cost a keystroke and a word, not a rail, a page and a scroll.
 //
 // Domain-free on purpose: the items arrive as a prop, because `components/ui` may not import a
@@ -58,7 +58,7 @@ const byRank = (a: Rank, b: Rank) => a[0] - b[0] || a[1] - b[1];
  *  the hint, the hidden keywords or the group name carry it. An item ranks by its worst word first, so
  *  a row whose label holds every word beats one that needed its handle for any of them. Before this
  *  the list was pure group order: "theme" put the channel "The Meltzone Podcast" — matched through its
- *  handle `@themeltzone` alone — above every "Theme: …" row, and Enter opened a channel (E11 S3). */
+ *  handle `@themeltzone` alone — above every "Theme: …" row, and Enter opened a channel. */
 function rankItem(item: CommandItem, groupLabel: string, words: string[]): Rank | null {
   const label = fold(item.label);
   const rest = fold(`${item.hint ?? ""} ${item.keywords ?? ""} ${groupLabel}`);
@@ -262,21 +262,21 @@ function CommandPaletteBody({ onClose, groups }: { onClose: () => void; groups:
                 // The combobox input owns the tab stop; the arrows move a VIRTUAL selection over
                 // these rows. Leaving them tabbable put DOM focus on a row while
                 // aria-activedescendant named a different one — two competing "current" options —
-                // and made Tab walk every result (E10 review round 1).
+                // and made Tab walk every result.
                 tabIndex={-1}
                 onClick={() => choose(item)}
                 onMouseMove={(e) => {
                   // Only a pointer that actually MOVED may take the selection. After the arrow keys
                   // scroll a row past the fold, Blink re-dispatches a mousemove at the unchanged
                   // cursor position to refresh hover — which handed the highlight straight back to
-                  // whatever row slid under a resting cursor (E10 review round 1). The browser
+                  // whatever row slid under a resting cursor. The browser
                   // reports zero movement for exactly that synthetic event, so ask it directly:
-                  // round 1 remembered the last position instead, which could not judge the FIRST
-                  // move of a session and went stale across a close (round 2).
+                  // remembering the last position instead could not judge the FIRST
+                  // move of a session and went stale across a close.
                   if (e.movementX === 0 && e.movementY === 0) return;
                   setPicked(item.id);
                 }}
-                // The menus' roving highlight: a `bg-card` row was ~1.07:1 on the palette's glass (E28).
+                // The menus' roving highlight: a `bg-card` row was ~1.07:1 on the palette's glass.
                 data-active={item.id === activeId ? "true" : undefined}
                 className={`flex w-full items-center gap-2 rounded-lg px-2 py-1.5 text-sm text-muted hover:text-fg ${ROVING_HIGHLIGHT}`}
               >
diff --git a/frontend/src/components/ui/ContextMenu.dom.test.tsx b/frontend/src/components/ui/ContextMenu.dom.test.tsx
index 6656c0ce..eeb2ec36 100644
--- a/frontend/src/components/ui/ContextMenu.dom.test.tsx
+++ b/frontend/src/components/ui/ContextMenu.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Contract of the right-click / long-press context menu (E10 S2). Same floating-ui recipe as
+// Contract of the right-click / long-press context menu. Same floating-ui recipe as
 // ActionMenu.dom.test.tsx: stub the two observers autoUpdate wires and wrap in a FloatingTree, and
 // query with `{ hidden: true }` because floating-ui never positions in jsdom, so the surface stays
 // `visibility: hidden` and the a11y tree treats its contents as hidden.
@@ -176,7 +176,7 @@ describe("useContextMenu / ContextMenu", () => {
 
   // A card the keyboard is on is focused as a whole, through a tabindex=-1 root (lib/listNav), and
   // holds tabbable controls. floating-ui handed the focus back to the first of them instead of the
-  // card — measured in Chrome (deep-review E11 round 2): j, Shift+F10, Escape left it on the thumbnail.
+  // card — measured in Chrome: j, Shift+F10, Escape left it on the thumbnail.
   // Closed here by picking the row (the other way out; jsdom delivers no Escape to a keyboard-opened
   // menu — Escape is measured in the browser).
   it("gives the focus back to a card focused as a whole, not to a control inside it", async () => {
diff --git a/frontend/src/components/ui/DataTable.fixedLayout.dom.test.tsx b/frontend/src/components/ui/DataTable.fixedLayout.dom.test.tsx
index 55309e12..a3f0682e 100644
--- a/frontend/src/components/ui/DataTable.fixedLayout.dom.test.tsx
+++ b/frontend/src/components/ui/DataTable.fixedLayout.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The R14 zoom-fit foundation: DataTable's opt-in `fixedLayout` renders a <colgroup> and puts the
+// The zoom-fit foundation: DataTable's opt-in `fixedLayout` renders a <colgroup> and puts the
 // table into `table-layout: fixed`, so columns with a width keep it and the rest (fluid text columns)
 // split the remainder + truncate instead of pushing the table wider than its container. Off by
 // default so existing content-sized tables are untouched.
diff --git a/frontend/src/components/ui/DataTable.keyboard.dom.test.tsx b/frontend/src/components/ui/DataTable.keyboard.dom.test.tsx
index 42ff32b0..75c01647 100644
--- a/frontend/src/components/ui/DataTable.keyboard.dom.test.tsx
+++ b/frontend/src/components/ui/DataTable.keyboard.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// DataTable's `keyboardNav` (E11 S4c): the rows are a keyboard list — `j`/`k` walk them and Enter
+// DataTable's `keyboardNav`: the rows are a keyboard list — `j`/`k` walk them and Enter
 // clicks the element a column marks `data-nav-open`. It used to render its rows twice (a table and,
 // below `md`, a card list, one hidden by CSS), so `j` past the last row could carry on into the hidden
 // copy. Now it mounts exactly one layout, chosen by the `md` media query.
diff --git a/frontend/src/components/ui/DataTable.progressive.dom.test.tsx b/frontend/src/components/ui/DataTable.progressive.dom.test.tsx
index a5dd2910..5d870751 100644
--- a/frontend/src/components/ui/DataTable.progressive.dom.test.tsx
+++ b/frontend/src/components/ui/DataTable.progressive.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E31 S4d: the channel manager's "All" page (~400 rows) blocked one frame for 0.7–0.9 s on prod to
+// The channel manager's "All" page (~400 rows) blocked one frame for 0.7–0.9 s on prod to
 // mount, and every key in its search re-rendered every row. A long page now mounts its first rows at
 // once and the rest in small background steps (progressiveRows), and a step leaves the rows it holds
 // alone (a row is its own component, whose cells the React Compiler caches).
@@ -101,7 +101,7 @@ describe("DataTable — a long page mounts in steps", () => {
     await waitFor(() => expect(bodyRows()).toBe(150));
   });
 
-  // E31 S5: Channels turns the page to the row a priority pick moved and focuses it in the commit
+  // Channels turns the page to the row a priority pick moved and focuses it in the commit
   // that follows. That row was at index 40 of a 50-row page: not mounted yet, focus fell to <body>.
   it("mounts a revealed row in the render that turns to its page", () => {
     host = document.createElement("div");
@@ -125,7 +125,7 @@ describe("DataTable — a long page mounts in steps", () => {
     expect(host.querySelector("tbody")?.textContent).toContain("r 90");
   });
 
-  // E31 review 2: the reveal floor held for the page's lifetime. Channels never clears its `follow`, so
+  // The reveal floor once held for the page's lifetime. Channels never clears its `follow`, so
   // after one priority pick every later sort or search mounted every row up to that channel at once.
   it("lets a revealed row go once the reader moves to another view", () => {
     host = document.createElement("div");
diff --git a/frontend/src/components/ui/DataTable.tsx b/frontend/src/components/ui/DataTable.tsx
index b65f8b19..b258c389 100644
--- a/frontend/src/components/ui/DataTable.tsx
+++ b/frontend/src/components/ui/DataTable.tsx
@@ -270,7 +270,7 @@ export default function DataTable<T>({
   const [revealSeen, setRevealSeen] = useState(reveal?.seq);
   // The view the reveal was made for: the floor below holds only there. A caller keeps its reveal
   // after the focus (Channels never clears `follow`), and a floor that outlived its view mounted every
-  // row up to that channel on each later sort or search (E31 review 2).
+  // row up to that channel on each later sort or search.
   const [revealView, setRevealView] = useState<string | null>(null);
   if (reveal && reveal.seq !== revealSeen) {
     setRevealSeen(reveal.seq);
diff --git a/frontend/src/components/ui/FilterFold.dom.test.tsx b/frontend/src/components/ui/FilterFold.dom.test.tsx
index 6b513a14..3198de29 100644
--- a/frontend/src/components/ui/FilterFold.dom.test.tsx
+++ b/frontend/src/components/ui/FilterFold.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 S3d4 (B4): below ~600px of height a band's filter row folds into one "Filters · n" button that
+// DESIGN.md B4: below ~600px of height a band's filter row folds into one "Filters · n" button that
 // shows it again in place; on a tall window there is no button and the row is always there.
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { cleanup, fireEvent, render, screen } from "@testing-library/react";
diff --git a/frontend/src/components/ui/FilterSelect.tsx b/frontend/src/components/ui/FilterSelect.tsx
index 1765812c..d94b4997 100644
--- a/frontend/src/components/ui/FilterSelect.tsx
+++ b/frontend/src/components/ui/FilterSelect.tsx
@@ -13,7 +13,6 @@ import { SURFACE } from "./surfaces";
 // Built on the same AnchoredPopover platform as ActionMenu/Combobox (arrows/typeahead/Escape/anchor-flip);
 // reusable anywhere a small, known set of options currently renders as a chip group. See FilterSelect.dom.test.
 
-/** @internal exported for FilterSelect.dom.test.tsx */
 export interface FilterSelectOption {
   value: string;
   label: string;
diff --git a/frontend/src/components/ui/FocusSafeButton.select.dom.test.tsx b/frontend/src/components/ui/FocusSafeButton.select.dom.test.tsx
index fbf9a47c..1954cd60 100644
--- a/frontend/src/components/ui/FocusSafeButton.select.dom.test.tsx
+++ b/frontend/src/components/ui/FocusSafeButton.select.dom.test.tsx
@@ -38,7 +38,7 @@ describe("a selectable button", () => {
     expect(onClick).toHaveBeenCalledTimes(1);
   });
 
-  // E28 review H2: Enter / Space on a focused title with its words still selected (selected, then
+  // Enter / Space on a focused title with its words still selected (selected, then
   // tabbed to) did nothing — a keyboard click ends no selection; it carries no pointer at all.
   it("a keyboard click opens even with the title's words selected", () => {
     const onClick = vi.fn();
diff --git a/frontend/src/components/ui/FocusSafeButton.tsx b/frontend/src/components/ui/FocusSafeButton.tsx
index 6e22edcc..8ce309d5 100644
--- a/frontend/src/components/ui/FocusSafeButton.tsx
+++ b/frontend/src/components/ui/FocusSafeButton.tsx
@@ -12,7 +12,7 @@ import { endsTextSelection, movedPastSlop } from "../../lib/textSelection";
 // A `<button>` whose `disabled` never throws the focus out of the page.
 //
 // A focused button that turns natively disabled loses the focus — Chrome moves it to <body>
-// (measured, E11 S2) — and the app disables the very button that was just pressed on ~60 sites (a
+// (measured) — and the app disables the very button that was just pressed on ~60 sites (a
 // mutation pending, a form gone clean after its save), so a keyboard user was dropped out of the page
 // on every submit. While THIS button holds the focus, `disabled` (and `busy`) is expressed as
 // `aria-disabled` plus a click guard instead: still focusable, announced as unavailable, and not
@@ -69,7 +69,7 @@ export const FocusSafeButton = forwardRef<
   // not focused (another app in front) `.focus()` moves `activeElement` but fires no focus event
   // (measured in Chrome), and the button disabled in that state lost the focus all the same. Read
   // through useSyncExternalStore, which React asks on EVERY render, never from a memo: a bare
-  // render-time DOM read made the React Compiler skip the component (E32), and compiled it would be
+  // render-time DOM read made the React Compiler skip the component, and compiled it would be
   // cached. Nothing to subscribe to — the focus events above already re-render it.
   const activeNow = useSyncExternalStore(
     noSubscription,
diff --git a/frontend/src/components/ui/HiddenFilterCue.dom.test.tsx b/frontend/src/components/ui/HiddenFilterCue.dom.test.tsx
index 7c477db9..26370005 100644
--- a/frontend/src/components/ui/HiddenFilterCue.dom.test.tsx
+++ b/frontend/src/components/ui/HiddenFilterCue.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 review F2: a column filter is shown only by its column's header funnel, so a filter set on a
+// A column filter is shown only by its column's header funnel, so a filter set on a
 // column that is off screen — a `tabletHidden` column on a 1024 window, any column in the card layout
 // — narrowed the rows with nothing on screen saying so. The cue names it, and its chip removes it.
 import { afterEach, describe, expect, it, vi } from "vitest";
diff --git a/frontend/src/components/ui/HiddenFilterCue.tsx b/frontend/src/components/ui/HiddenFilterCue.tsx
index 22c4ad25..9b790a72 100644
--- a/frontend/src/components/ui/HiddenFilterCue.tsx
+++ b/frontend/src/components/ui/HiddenFilterCue.tsx
@@ -9,7 +9,7 @@ import {
 } from "../../lib/tableColumns";
 import { Chip } from "./Chip";
 
-// E28 F2: a column filter lives in its column's header funnel, so when the column is off screen — a
+// A column filter lives in its column's header funnel, so when the column is off screen — a
 // `tabletHidden` / `narrowHidden` column below its width, or any column in a card layout, which has no
 // header at all — the rows are narrowed by something nobody can see ("12 of 392", and no why). This
 // names each such filter above the rows, and its chip removes it (owner's pick A, 2026-09-27).
diff --git a/frontend/src/components/ui/IconButton.dom.test.tsx b/frontend/src/components/ui/IconButton.dom.test.tsx
index 36acf3af..b73b0c56 100644
--- a/frontend/src/components/ui/IconButton.dom.test.tsx
+++ b/frontend/src/components/ui/IconButton.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 S3b: the glyph-only button (DESIGN.md A2) and the two other click primitives that sit beside
+// The glyph-only button (DESIGN.md A2) and the two other click primitives that sit beside
 // `Button`: `Pressable` (a surface whose content is the control) and `DragHandle`.
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { cleanup, fireEvent, render, screen } from "@testing-library/react";
diff --git a/frontend/src/components/ui/Input.dom.test.tsx b/frontend/src/components/ui/Input.dom.test.tsx
index 606584a4..383d0fec 100644
--- a/frontend/src/components/ui/Input.dom.test.tsx
+++ b/frontend/src/components/ui/Input.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 S3c: the field primitives (docs/DESIGN.md A4-A6): one frame per rung, the native controls handing
+// The field primitives (docs/DESIGN.md A4-A6): one frame per rung, the native controls handing
 // back values, and the dropdown trigger by context.
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { cleanup, fireEvent, render, screen } from "@testing-library/react";
diff --git a/frontend/src/components/ui/Input.tsx b/frontend/src/components/ui/Input.tsx
index 5b9693af..a2928a19 100644
--- a/frontend/src/components/ui/Input.tsx
+++ b/frontend/src/components/ui/Input.tsx
@@ -2,7 +2,7 @@ import clsx from "clsx";
 import type { InputHTMLAttributes, Ref, TextareaHTMLAttributes } from "react";
 import { fieldClass, type FieldSize } from "./fieldStyles";
 
-// The text-field primitives (docs/DESIGN.md A4, E28 S3c). Every text, number, password, e-mail, search
+// The text-field primitives (docs/DESIGN.md A4). Every text, number, password, e-mail, search
 // and date box is an `Input`; a multi-line one a `Textarea`; a box whose frame also holds an icon,
 // chips or a clear button is a wrapper painted with `fieldClass` around an `InnerInput`. A raw
 // `<input>` or `<textarea>` anywhere else is a lint error (`local/input-primitive`), so the
diff --git a/frontend/src/components/ui/ItemCount.dom.test.tsx b/frontend/src/components/ui/ItemCount.dom.test.tsx
index 24675aad..87960490 100644
--- a/frontend/src/components/ui/ItemCount.dom.test.tsx
+++ b/frontend/src/components/ui/ItemCount.dom.test.tsx
@@ -29,7 +29,7 @@ describe("ItemCount", () => {
   it("pluralises and thousands-separates a normal count", () => {
     render(<ItemCount count={192045} />);
     // Separators come from the shared formatNumber — compare against it, not a fixed en-US string,
-    // so the test asserts ItemCount's formatting path rather than the CI locale.
+    // so the test asserts ItemCount's formatting path rather than the runner's locale.
     expect(text()).toBe(`${formatNumber(192045, "en")} items`);
   });
 
@@ -71,7 +71,7 @@ describe("ItemCount", () => {
     expect(screen.getByText("5 items").className).toContain("opacity-60");
   });
 
-  // E31 review 2: the dim and aria-busy were the only stale cue, and a screen reader voices neither on
+  // The dim and aria-busy were once the only stale cue, and a screen reader voices neither on
   // plain text; a failed count looked like a first load.
   it("tells a screen reader a stale count is updating", () => {
     render(<ItemCount count={5} stale />);
diff --git a/frontend/src/components/ui/ItemCount.tsx b/frontend/src/components/ui/ItemCount.tsx
index 3a01acb6..2d7c7ce2 100644
--- a/frontend/src/components/ui/ItemCount.tsx
+++ b/frontend/src/components/ui/ItemCount.tsx
@@ -8,7 +8,7 @@ import { formatNumber } from "../../lib/format";
 const OVERFLOW_AT = 1_000_000;
 
 // A compact, FIXED-WIDTH count pill for a toolbar: the filtered item count at the toolbar's 28, flat
-// and tonal like a `Badge` — no edge, because it does nothing (E28 S3d: edged = pressable, flat = just
+// and tonal like a `Badge` — no edge, because it does nothing (edged = pressable, flat = just
 // says; it used to wear the filter dropdowns' glass pill and read as one more). The fixed width is the point — a
 // changing number must never shove the controls beside it, so the box is sized to the widest value
 // ("999,999 items") and the content is centred within it. A count of a million or more collapses to
@@ -17,7 +17,7 @@ const OVERFLOW_AT = 1_000_000;
 // kept while the new one loads (keepPreviousData) — dimmed, and "updating" for a screen reader (which
 // does not voice aria-busy on plain text), so a broad search's slow count ("a": ~3 s) never reads as
 // the new result. `failed`: the count could not be read — a dash that says so, not the icon-only box
-// of a first load (E31 review 2).
+// of a first load.
 export default function ItemCount({
   count,
   stale = false,
diff --git a/frontend/src/components/ui/KeyboardHelp.dom.test.tsx b/frontend/src/components/ui/KeyboardHelp.dom.test.tsx
index 707b76d9..ba75c186 100644
--- a/frontend/src/components/ui/KeyboardHelp.dom.test.tsx
+++ b/frontend/src/components/ui/KeyboardHelp.dom.test.tsx
@@ -98,9 +98,9 @@ describe("KeyboardHelp", () => {
 
   // The context menu is NOT app-wide: it has its own scope, registered by `useContextMenu`, so the
   // sheet only offers Shift+F10 where something actually answers it. Advertising it globally was a
-  // promise the feed, Plex, Downloads and Settings did not keep (E10 review round 1) — the test above
+  // promise the feed, Plex, Downloads and Settings did not keep — the test above
   // pins the other half, that a bare app lists the two global keys and nothing else.
-  // Through the REAL hook, not a scope stub: round 2 showed that commenting out
+  // Through the REAL hook, not a scope stub: commenting out
   // `useKeyScope("contextMenu")` inside `useContextMenu` left the whole suite green, because the
   // only coverage registered the scope by hand. This binds the sheet to the thing that owns it.
   it("offers the context-menu key on a surface that has one, and not otherwise", () => {
diff --git a/frontend/src/components/ui/KeyboardHelp.tsx b/frontend/src/components/ui/KeyboardHelp.tsx
index 5c6d31bd..f62bd219 100644
--- a/frontend/src/components/ui/KeyboardHelp.tsx
+++ b/frontend/src/components/ui/KeyboardHelp.tsx
@@ -42,7 +42,7 @@ export default function KeyboardHelp() {
   // them there would promise keys that do nothing until the overlay closes. And a `g` chord is listed
   // only for a module this account can actually reach.
   // The context-menu key goes too: every `useContextMenu` is a page list, and with an overlay up the
-  // focus Shift+F10 needs is inside the overlay (pre-existing since E10, found in S4 UAT).
+  // focus Shift+F10 needs is inside the overlay (found in UAT).
   const live = overLayer
     ? scopes.filter((s) => !isPageLevelScope(s) && s !== "contextMenu")
     : scopes;
diff --git a/frontend/src/components/ui/MatchToggle.tsx b/frontend/src/components/ui/MatchToggle.tsx
index 4e198efc..7c1d400d 100644
--- a/frontend/src/components/ui/MatchToggle.tsx
+++ b/frontend/src/components/ui/MatchToggle.tsx
@@ -7,7 +7,7 @@ export type MatchMode = "any" | "all";
 // a captioned segment on the panel, right ABOVE its picker — never in the picker's popover, where a
 // closed picker hid that "all" was on (the owner, 2026-09-27; DESIGN "Action placement": the state
 // that shapes the results stays in sight). With fewer than two picks any and all are the same filter,
-// so it draws nothing then. The panel's captioned toggle is the one 24px segment (DESIGN log, S3g).
+// so it draws nothing then. The panel's captioned toggle is the one 24px segment (DESIGN log).
 export default function MatchToggle({
   picked,
   value,
diff --git a/frontend/src/components/ui/MediaCard.tsx b/frontend/src/components/ui/MediaCard.tsx
index ca91e527..3c4c0ca3 100644
--- a/frontend/src/components/ui/MediaCard.tsx
+++ b/frontend/src/components/ui/MediaCard.tsx
@@ -5,7 +5,7 @@ import { iconButtonClass } from "./buttonStyles";
 import { MoreButton } from "./MoreButton";
 import { SURFACE } from "./surfaces";
 
-// The ONE media card (docs/DESIGN.md "Media card", E28 S3h): a YouTube video, a Plex movie, show,
+// The ONE media card (docs/DESIGN.md "Media card"): a YouTube video, a Plex movie, show,
 // season or episode — in the feed, the Plex library, Home's shelves and the media pages' strips — is
 // the same object: one glass frame holding the picture, then the title, then a meta line PINNED to the
 // frame's bottom edge. Cards in a grid row stretch to the row's height, so pinning the meta puts every
diff --git a/frontend/src/components/ui/MediaPreview.tsx b/frontend/src/components/ui/MediaPreview.tsx
index 75c70efd..0888da56 100644
--- a/frontend/src/components/ui/MediaPreview.tsx
+++ b/frontend/src/components/ui/MediaPreview.tsx
@@ -3,7 +3,7 @@ import { PopoverSurface } from "./AnchoredPopover";
 import type { useMediaPreview } from "./useMediaPreview";
 import { SURFACE } from "./surfaces";
 
-// A media card's preview (docs/DESIGN.md "Media card", E28 S3h — the owner's pick C, 2026-09-26):
+// A media card's preview (docs/DESIGN.md "Media card" — the owner's pick C, 2026-09-26):
 // rest the mouse on a card for a moment and a panel beside it shows what the card has no room for —
 // the whole title, the facts, the synopsis in lines short enough to read. It replaced the synopsis as
 // the picture's native tooltip, which fired anywhere on the art, ran one long line, and shared its
diff --git a/frontend/src/components/ui/Modal.dom.test.tsx b/frontend/src/components/ui/Modal.dom.test.tsx
index 6c559669..6e22ab35 100644
--- a/frontend/src/components/ui/Modal.dom.test.tsx
+++ b/frontend/src/components/ui/Modal.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Modal: focus management (FE-9). This was DEFERRED from the E4 deep-review because it's
+// Modal: focus management (FE-9). This was DEFERRED from a code review because it's
 // jsdom-untestable as written — `focusablesIn` filters on `el.offsetParent !== null`, and jsdom
 // returns null for EVERY element (it never lays out), so the trap would see zero focusables and do
 // nothing. We stub `HTMLElement.prototype.offsetParent` to report "visible" (non-null) for any
@@ -225,7 +225,7 @@ describe("Modal focus trap (offsetParent stubbed 'visible')", () => {
     // The Tab trap deliberately spans the dialog ROOT so a toast's Undo/✕ is reachable; ownership
     // was tracked over the PANEL, so touching that ✕ read as "the user left the dialog" and the
     // restore was skipped — and removing the toast fires no focusin to re-arm it. Measured landing
-    // on <body> (deep-review round 6).
+    // on <body>.
     const trigger = document.createElement("button");
     document.body.appendChild(trigger);
     trigger.focus();
@@ -281,7 +281,7 @@ describe("Modal focus trap (offsetParent stubbed 'visible')", () => {
     // layer is above me" (measured). So a dialog that closes on its own — an in-flight mutation's
     // `onSuccess`, not a click, since a scrim covers it — under a modal raised above it yanked the
     // focus out of that standing dialog onto its own trigger, behind the scrim, where Enter still
-    // activated it (deep-review round 7). Sibling dialogs, not nested: that is the arrangement
+    // activated it. Sibling dialogs, not nested: that is the arrangement
     // `ConfirmProvider` and the app-wide `ErrorDialog` actually use.
     const trigger = document.createElement("button");
     document.body.appendChild(trigger);
@@ -366,7 +366,7 @@ describe("Modal — toasts raised while it is open", () => {
   });
 });
 
-// E28: one Escape in a dialog's open list closed the list AND the dialog (the share dialog's user
+// One Escape in a dialog's open list closed the list AND the dialog (the share dialog's user
 // picker). The list's `document` listener closes it with a synchronous flush, which pops its layer
 // before the dialog's `window` listener runs — so "am I topmost?" reads yes. The dialog must honour
 // the list's stamp, as the players already do (UX-8).
diff --git a/frontend/src/components/ui/Modal.fullscreen.dom.test.tsx b/frontend/src/components/ui/Modal.fullscreen.dom.test.tsx
index b8f9965a..fa4c7163 100644
--- a/frontend/src/components/ui/Modal.fullscreen.dom.test.tsx
+++ b/frontend/src/components/ui/Modal.fullscreen.dom.test.tsx
@@ -4,7 +4,7 @@
 // <body> is painted beneath it, i.e. invisible). Leaving fullscreen changes that container — and a
 // React portal whose container changes is torn down and recreated, so everything the dialog held went
 // with it: a half-filled download form reset to its defaults and focus fell to <body> (a verifier's
-// side finding in deep-review round 4).
+// side finding in a review).
 import { describe, it, expect, afterEach } from "vitest";
 import { render, cleanup, screen, fireEvent, act } from "@testing-library/react";
 import { vi } from "vitest";
@@ -58,7 +58,7 @@ describe("a dialog with an autoFocus child", () => {
     // has already called `.focus()` on a disconnected node — a no-op — and Modal's own fallback
     // then puts the focus on the first focusable in the panel, the header's ✕. That is what the
     // command palette, the download rename dialog and every non-danger confirm shipped with after
-    // deep-review round 4 (found in round 5).
+    // the first fix (found by a later review).
     render(
       <Modal initialFocus="close" title="Search" onClose={() => {}}>
         <input aria-label="query" autoFocus />
diff --git a/frontend/src/components/ui/Modal.strictmode.dom.test.tsx b/frontend/src/components/ui/Modal.strictmode.dom.test.tsx
index faf5b508..7eae4adf 100644
--- a/frontend/src/components/ui/Modal.strictmode.dom.test.tsx
+++ b/frontend/src/components/ui/Modal.strictmode.dom.test.tsx
@@ -4,11 +4,11 @@
 // mount→cleanup→mount is what the code under test reacts to, and the module-level layer stack in
 // ui/Modal (and the overlay-host registry in ui/Toaster) leaks between tests in one file.
 //
-// Round 5 fixed this in Chrome and shipped it with NO test: the second mount found the focus
+// A fix settled this in Chrome and shipped it with NO test: the second mount found the focus
 // outside the dialog (its own cleanup had just handed it back to the trigger) and moved it to the
 // first focusable — taking it off an `autoFocus` field a beat after the browser had put it there.
 // The command palette opened focused on its ✕ in dev and on its search field in prod, from the same
-// code. Round 6 measured that deleting the fix left all 1009 tests green, which is why this exists.
+// code. A check measured that deleting the fix left all 1009 tests green, which is why this exists.
 //
 // Same offsetParent stub as Modal.dom.test.tsx: jsdom never lays out, so every element reports
 // offsetParent null and `focusablesIn` would see nothing.
diff --git a/frontend/src/components/ui/Modal.tsx b/frontend/src/components/ui/Modal.tsx
index 1bf252fb..85d22811 100644
--- a/frontend/src/components/ui/Modal.tsx
+++ b/frontend/src/components/ui/Modal.tsx
@@ -52,8 +52,8 @@ const PANEL = "relative flex flex-col overflow-hidden outline-none panel-scroll-
 
 // Small centered modal shell: backdrop + ESC + scroll-lock close. Each open modal is a layer in the
 // shared `layerStack` so ESC only closes the topmost one — e.g. an error dialog over the tag editor
-// dismisses just the error and returns to the editor underneath, and a player below defers to it
-// (R8 S3). Portals into `document.fullscreenElement ?? document.body`: a node under <body> is painted
+// dismisses just the error and returns to the editor underneath, and a player below defers to it.
+// Portals into `document.fullscreenElement ?? document.body`: a node under <body> is painted
 // beneath whatever holds the fullscreen lock, so a Modal opened from a player in true fullscreen (the
 // download dialog) would otherwise open invisibly.
 export default function Modal({
@@ -85,15 +85,15 @@ export default function Modal({
   // Browser/mouse Back closes the topmost modal instead of navigating away.
   useBackToClose(onClose);
   // ONE container element for the dialog's whole life, re-parented between <body> and the fullscreen
-  // element (deep-review round 4) — and attached before the children commit, so an `autoFocus` child
-  // still gets the focus (round 5). Both rules live in the hook; `ui/AnchoredPopover` shares it.
+  // element — and attached before the children commit, so an `autoFocus` child
+  // still gets the focus. Both rules live in the hook; `ui/AnchoredPopover` shares it.
   const host = useFullscreenPortalHost();
   const panelRef = useRef<HTMLDivElement>(null);
   const rootRef = useRef<HTMLDivElement>(null);
   const titleId = useId();
   // Focus lands in the panel; OWNERSHIP is the whole dialog — the same element the Tab trap below
   // is scoped to, toast host included. Tracking ownership over the panel alone meant tabbing to an
-  // in-dialog toast counted as leaving, and the close-time restore was then skipped (round 6).
+  // in-dialog toast counted as leaving, and the close-time restore was then skipped.
   const bodyRef = useRef<HTMLDivElement>(null);
   const closeRef = useRef<HTMLButtonElement>(null);
   const [footerSlot, setFooterSlot] = useState<HTMLDivElement | null>(null);
@@ -108,11 +108,11 @@ export default function Modal({
   // to take the focus at open, so it lands on the ✕. When the form arrives the focus moves to its
   // first field — but only while it still rests on the ✕: a user who has moved it keeps it there.
   // The form takes it ONCE: arrived while the focus was elsewhere, it disarms all the same, or a later
-  // mutation would pull the focus off a ✕ the user went back to (E32 review round 2). The watch
+  // mutation would pull the focus off a ✕ the user went back to. The watch
   // re-arms only when the focus is taken away, not moved: the body has no control again, or the
   // focused one went (a failed load's Retry giving way to the spinner, or straight to the form) and
   // the focus fell to <body>. It then goes to the ✕, and on to the first field as soon as the body
-  // has one — at once, when other controls stayed beside the one that went (E32 review). Only
+  // has one — at once, when other controls stayed beside the one that went. Only
   // <body>: focus in a dialog stacked on top is not this one's to take.
   useEffect(() => {
     const body = bodyRef.current;
diff --git a/frontend/src/components/ui/NativeControls.tsx b/frontend/src/components/ui/NativeControls.tsx
index 5814195d..053d0edd 100644
--- a/frontend/src/components/ui/NativeControls.tsx
+++ b/frontend/src/components/ui/NativeControls.tsx
@@ -1,7 +1,7 @@
 import clsx from "clsx";
 import type { InputHTMLAttributes, ReactNode, Ref } from "react";
 
-// A6 (docs/DESIGN.md, E28 S3c): checkbox, slider and colour well are the BROWSER's controls, tinted
+// A6 (docs/DESIGN.md): checkbox, slider and colour well are the BROWSER's controls, tinted
 // with the accent — keyboard, screen reader and forced-colours support come free, and a drawn copy
 // would have to rebuild all three. What the browser does not give is the 44 touch target: the labelled
 // row (`CheckRow`) or the slider's own box grows to it on a coarse pointer. Like `Input`, a raw
diff --git a/frontend/src/components/ui/NavRail.dom.test.tsx b/frontend/src/components/ui/NavRail.dom.test.tsx
index c5dac0fc..7c71e99c 100644
--- a/frontend/src/components/ui/NavRail.dom.test.tsx
+++ b/frontend/src/components/ui/NavRail.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 S3d (B7): the nav rail's row. Icon-only, its name is the module's full name (with an unread
+// DESIGN.md B7: the nav rail's row. Icon-only, its name is the module's full name (with an unread
 // count, which was only ever drawn); with the labels on, the name is the short label the user SEES
 // (WCAG 2.5.3), the full one staying in the tooltip. "You are here" is aria-current plus the tint.
 import { readFileSync } from "node:fs";
@@ -49,7 +49,7 @@ describe("NavRailItem", () => {
     expect(row.getAttribute("aria-current")).toBeNull();
   });
 
-  // E28 audit: labelled, the name was the row's text, the corner badge first, so 20 unread was heard
+  // Audit: labelled, the name was the row's text, the corner badge first, so 20 unread was heard
   // as "9+Alerts" where the icon-only row says "Notifications (20)".
   it("labelled with a count: the visible label, then the exact count", () => {
     render(
@@ -66,7 +66,7 @@ describe("NavRailItem", () => {
     expect(screen.getByRole("link", { name: "Alerts (20)" })).toBeTruthy();
   });
 
-  // E31 (the owner): a middle-click on a rail row opens the page in a new tab. The row is a real link
+  // Owner's call: a middle-click on a rail row opens the page in a new tab. The row is a real link
   // to the page, so the browser's own gestures work; only a plain left click navigates in-app.
   it("is a link to its page, navigating in-app only on a plain left click", () => {
     const onClick = vi.fn();
@@ -124,7 +124,7 @@ describe("NavRailAction", () => {
   });
 });
 
-// E31 (the owner's pick): the five admin rows sat below the fold at 133% zoom behind a fade alone, so
+// The owner's pick: the five admin rows sat below the fold at 133% zoom behind a fade alone, so
 // they are one "Admin" row opening a panel of them. The panel's pages stay links, as the rail's are.
 describe("NavRailGroup", () => {
   const pages = (active: string | null, onSelect = vi.fn()) =>
diff --git a/frontend/src/components/ui/NavRail.tsx b/frontend/src/components/ui/NavRail.tsx
index d9c1dd2e..af15e5ea 100644
--- a/frontend/src/components/ui/NavRail.tsx
+++ b/frontend/src/components/ui/NavRail.tsx
@@ -92,7 +92,7 @@ export function NavRailItem({
   active?: boolean;
   /** An unread / in-progress count on the icon's corner (0 hides it). */
   badge?: number;
-  /** The page's own address. A page row is a real link (the owner, E31): a middle-click, a
+  /** The page's own address. A page row is a real link (the owner's call): a middle-click, a
    *  Ctrl/Cmd-click or the browser's "Open in new tab" opens the page in a tab of its own. */
   href: string;
   /** The in-app navigation, run only for a plain left click. */
@@ -112,7 +112,7 @@ export function NavRailItem({
         }}
         // With the label visible the row's name starts with that text (WCAG 2.5.3: the spoken name
         // contains the visible one); the full name stays in the tooltip. Icon-only, the full name is the
-        // name. The exact count rides in the name either way, so "Messages (3)" is heard and not only
+        // name. The exact count rides in the name either way, so "Alerts (3)" is heard and not only
         // seen; the drawn badge is hidden (labelled, it was read first and capped: "9+Alerts").
         aria-label={`${showLabel ? shortLabel : label}${shown ? ` (${badge})` : ""}`}
         aria-current={active ? "page" : undefined}
@@ -186,7 +186,7 @@ export interface NavRailGroupPage {
   onSelect: () => void;
 }
 
-/** One rail row standing for a set of rare pages (E31, the owner's pick: the admin pages), opening a
+/** One rail row standing for a set of rare pages (the owner's pick: the admin pages), opening a
  *  panel of them to its right. The rail fits a 133–150% zoom without a scroll nobody sees: five admin
  *  rows sat below the fold behind a fade alone. The row is "you are here" while any of its pages is.
  *  The panel's pages are real links, as the rail's own rows are (a middle-click opens a tab), so it is a
diff --git a/frontend/src/components/ui/Overlay.tsx b/frontend/src/components/ui/Overlay.tsx
index 41730abb..64e4306a 100644
--- a/frontend/src/components/ui/Overlay.tsx
+++ b/frontend/src/components/ui/Overlay.tsx
@@ -4,7 +4,7 @@ import { createPortal } from "react-dom";
 // The app's overlay-root convention. Any full-screen or floating overlay renders THROUGH this so it
 // escapes whatever ancestor stacking context it was declared in — a `mask-image`/`transform`/`filter`
 // on the page scroller (or a rail's `backdrop-filter`) would otherwise trap a `fixed` child and let
-// the chrome paint over it. That is the exact class of bug that buried the players in E3; the
+// the chrome paint over it. That is the exact class of bug that once buried the players; the
 // modal/player family already dodges it by portaling to <body>, and this makes that the one blessed
 // way. Stacking among overlays is then decided by DOM order + the z-index token scale (tailwind
 // `zIndex`), never by an ad-hoc magic number. Portals to <body> (the existing de-facto target).
diff --git a/frontend/src/components/ui/PageScroller.dom.test.tsx b/frontend/src/components/ui/PageScroller.dom.test.tsx
index 261c46c8..04317e5b 100644
--- a/frontend/src/components/ui/PageScroller.dom.test.tsx
+++ b/frontend/src/components/ui/PageScroller.dom.test.tsx
@@ -81,7 +81,7 @@ describe("PageScroller scroll memory", () => {
     expect(main.scrollTop).toBe(200);
   });
 
-  // Round 2 (F8): the page's very end, whose Back-to-top spacer only shows once scrolled, is out of
+  // The page's very end, whose Back-to-top spacer only shows once scrolled, is out of
   // reach when Back rebuilds the page — and the restore gave up with the page at the top.
   it("Back to a spot within the end's spacer lands at the page's end, not its top", () => {
     setEntry(1);
@@ -125,7 +125,7 @@ describe("PageScroller scroll memory", () => {
     expect(main.scrollTop).toBe(450);
   });
 
-  // Round 3: landing at the end shows Back to top, whose spacer then brings the spot within reach.
+  // Landing at the end shows Back to top, whose spacer then brings the spot within reach.
   it("finishes the way to a spot the spacer brings within reach after it lands", () => {
     let frames: FrameRequestCallback[] = [];
     vi.stubGlobal("requestAnimationFrame", (cb: FrameRequestCallback) => frames.push(cb));
@@ -154,7 +154,7 @@ describe("PageScroller scroll memory", () => {
     expect(main.scrollTop).toBe(500);
   });
 
-  // Round 3: the give-up put the page at its end 1.5 s in, wherever the reader had scrolled to.
+  // The give-up put the page at its end 1.5 s in, wherever the reader had scrolled to.
   // Every way a reader takes the page: a wheel, a finger, the scrollbar (a pointer), a key.
   it.each([
     ["a wheel", (main: HTMLElement) => fireEvent.wheel(main)],
@@ -213,7 +213,7 @@ describe("PageScroller scroll memory", () => {
   });
 });
 
-// E28 UAT: Back to top floats over the bottom-right corner, and at the end of a long table it covered
+// UAT: Back to top floats over the bottom-right corner, and at the end of a long table it covered
 // the closing pager's "100" and "All". While it is up, the page ends a button's height later.
 describe("PageScroller · room for Back to top", () => {
   it("ends the page later while the button is up, and not otherwise", () => {
diff --git a/frontend/src/components/ui/PageScroller.tsx b/frontend/src/components/ui/PageScroller.tsx
index 0a4584b0..8a8e0b5c 100644
--- a/frontend/src/components/ui/PageScroller.tsx
+++ b/frontend/src/components/ui/PageScroller.tsx
@@ -37,10 +37,10 @@ function rememberScroll(key: string, top: number): void {
 // clamp short. Re-apply over a few frames until it sticks (or the content is simply shorter now).
 // A spot the page can no longer reach — the last stretch of a page scrolled to its very end, whose
 // Back-to-top spacer only shows once scrolled — goes as far as the page does: it used to be left at
-// the top (round 2, F8). Only a spacer's worth short, and only once the height has held still, is
+// the top. Only a spacer's worth short, and only once the height has held still, is
 // that answer early; a list still loading is further short than that, and gets the full wait. And
 // landing there is not the end of it: that scroll is what shows Back to top, whose spacer then
-// makes the spot reachable, so the loop watches a few frames more and finishes the way (round 3).
+// makes the spot reachable, so the loop watches a few frames more and finishes the way.
 //
 // The reader scrolling meanwhile — a wheel, a finger, a key, the scrollbar — takes the page over:
 // the restore stops where they are, instead of pulling them back or dropping them at the end.
diff --git a/frontend/src/components/ui/PageShell.dom.test.tsx b/frontend/src/components/ui/PageShell.dom.test.tsx
index e076c068..9577a649 100644
--- a/frontend/src/components/ui/PageShell.dom.test.tsx
+++ b/frontend/src/components/ui/PageShell.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E5 S7: PageShell measures the floating header and publishes its real height as `--hdr-h` onto the
+// PageShell measures the floating header and publishes its real height as `--hdr-h` onto the
 // content wrapper, so a header that flex-wraps to 2–3 rows on a narrow window never overlaps the
 // content below it. jsdom does no layout (offsetHeight is 0) and has no ResizeObserver, so we stub
 // both: a ResizeObserver that hands us its callback, and offset metrics on the measured header.
@@ -32,7 +32,7 @@ afterEach(() => {
   vi.unstubAllGlobals();
 });
 
-describe("PageShell --hdr-h (E5 S7)", () => {
+describe("PageShell --hdr-h", () => {
   it("publishes the measured header height onto the content wrapper", () => {
     const { container } = render(
       <PageShell header={<div data-testid="hdr">H</div>}>content</PageShell>,
@@ -139,7 +139,7 @@ describe("PageShell --rail-pinned-w / --content-mw", () => {
   });
 });
 
-// E28 S3d4 (B4): every page has one h1 — the page's name, visually hidden, unless a view shows its
+// DESIGN.md B4: every page has one h1 — the page's name, visually hidden, unless a view shows its
 // own title (a channel, a Plex show), which is then the page's h1 instead.
 describe("PageShell page heading", () => {
   it("names the page with a visually hidden h1", () => {
diff --git a/frontend/src/components/ui/PageShell.tsx b/frontend/src/components/ui/PageShell.tsx
index 1feedef1..fca644c2 100644
--- a/frontend/src/components/ui/PageShell.tsx
+++ b/frontend/src/components/ui/PageShell.tsx
@@ -41,7 +41,7 @@ export function PageToolbar({ children }: { children: ReactNode }) {
 //  - `title`   — the page's name as a visually hidden `h1` (B4): the nav rail and the tab title are
 //                the visible identity, and a screen reader still lands on a named page. A view that
 //                shows its own title renders it through `PageHeading`, and this one steps aside.
-//  - `banners` — in-flow, fixed notices (demo/version) above the scroll region.
+//  - `banners` — in-flow, fixed notices (verify/version) above the scroll region.
 //  - toolbar band — in-flow, FIXED per-module band (filter chips / sort / counts); filled by a
 //                module via <PageToolbar>. Empty ⇒ zero height, so pages without one lose nothing.
 //  - children  — the ONE scrollable region. `PageScroller` owns the scroller and its two
@@ -111,7 +111,7 @@ export default function PageShell({
   }, [maxWidth]);
   // The floating header pads the content below it by `--hdr-h`. That must equal the header's REAL
   // height, which grows as the flex-wrap header wraps to 2–3 rows on a narrow window — a fixed pad
-  // would let the content toolbar slide up under it (E5 S7). Measure the header and write its height
+  // would let the content toolbar slide up under it. Measure the header and write its height
   // straight onto the content wrapper that consumes `--hdr-h`.
   //
   // Both nodes are held in STATE (callback refs), NOT plain refs behind a one-shot `useLayoutEffect([])`:
diff --git a/frontend/src/components/ui/Pager.dom.test.tsx b/frontend/src/components/ui/Pager.dom.test.tsx
index 3221debf..e71e065c 100644
--- a/frontend/src/components/ui/Pager.dom.test.tsx
+++ b/frontend/src/components/ui/Pager.dom.test.tsx
@@ -34,7 +34,7 @@ describe("Pager · rows per page", () => {
   });
 });
 
-// The page box DERIVES the current page (E27 S2): it holds a draft only while being edited, so the
+// The page box DERIVES the current page: it holds a draft only while being edited, so the
 // parent moving the page needs no re-sync effect. The layout-phase probe is what proves "derived"
 // rather than "re-synced after paint" — a passive effect could not have run yet when it reads.
 describe("Pager · the page box follows the page without an effect", () => {
diff --git a/frontend/src/components/ui/PanelGroups.dom.test.tsx b/frontend/src/components/ui/PanelGroups.dom.test.tsx
index 02828d5a..3bb69942 100644
--- a/frontend/src/components/ui/PanelGroups.dom.test.tsx
+++ b/frontend/src/components/ui/PanelGroups.dom.test.tsx
@@ -62,7 +62,7 @@ describe("PanelGroups — reordering without a drag", () => {
   });
 });
 
-// E28 review F4: every group's grip was "Drag to reorder" — a screen reader heard the same name five
+// Every group's grip was "Drag to reorder" — a screen reader heard the same name five
 // times and could not tell which group it would lift. It names its group, as the playlist grips do.
 describe("PanelGroups — the drag grip", () => {
   it("is named by its group", () => {
diff --git a/frontend/src/components/ui/QueryState.tsx b/frontend/src/components/ui/QueryState.tsx
index 8752b723..06d6b02f 100644
--- a/frontend/src/components/ui/QueryState.tsx
+++ b/frontend/src/components/ui/QueryState.tsx
@@ -73,7 +73,7 @@ export function LoadingState({
 }
 
 // Centered inline status line for a page/section's loading and error(+retry) states, in the house
-// style (mirrors Playlists' error block). Text-only by design — R3's goal is to stop pages
+// style (mirrors Playlists' error block). Text-only by design — the goal is to stop pages
 // rendering an error or a still-loading fetch AS an "empty" state, not to add skeletons. The
 // `role=status`/`aria-live` also gives screen readers the state change (the app had zero live
 // regions before).
@@ -118,6 +118,6 @@ export function StateMessage({
 
 // The honest-state convention every page now follows: check `isError && <no data>` BEFORE the empty
 // branch, so a failed fetch renders this message (with Retry) instead of the page's "empty" text
-// — the R3 bug where a backend restart read as "No channels". The `&& <no data>` guard matters: a
+// — the bug where a backend restart read as "No channels". The `&& <no data>` guard matters: a
 // transient refetch error while data is already on screen keeps the data rather than blanking it to
 // an error. `StateMessage` is the shared building block pages wire into their loading/empty ternary.
diff --git a/frontend/src/components/ui/README.md b/frontend/src/components/ui/README.md
index 5e2b5e7d..533ba48f 100644
--- a/frontend/src/components/ui/README.md
+++ b/frontend/src/components/ui/README.md
@@ -30,9 +30,8 @@ The direction is one-way from below, too: `lib/` may not import from `components
 included, not even a type (same lint file). A contract both layers need lives in `lib/`: the `Column`
 / `FilterMap` shape and `filterRows` are `lib/tableColumns`, which `tableHeader` and `DataTable` import.
 
-Counter-examples, deliberately NOT here: `PosterTile` (knows about Plex montage posters), `KeyGate`
-(secure-messaging key setup), `plexCards`, `downloadRow`, `channelColumns` — all shared, none
-domain-free.
+Counter-examples, deliberately NOT here: `PosterTile` (knows about Plex montage posters),
+`plexCards`, `downloadRow`, `channelColumns` — all shared, none domain-free.
 
 ## What lives here
 
diff --git a/frontend/src/components/ui/SegmentedToggle.dom.test.tsx b/frontend/src/components/ui/SegmentedToggle.dom.test.tsx
index 4bf5364a..8f9c267a 100644
--- a/frontend/src/components/ui/SegmentedToggle.dom.test.tsx
+++ b/frontend/src/components/ui/SegmentedToggle.dom.test.tsx
@@ -32,7 +32,7 @@ describe("SegmentedToggle", () => {
     expect(onChange).toHaveBeenCalledWith("and");
   });
 
-  it("sits on the toolbar rung unless a panel's caption asks for the small one (S3g)", () => {
+  it("sits on the toolbar rung unless a panel's caption asks for the small one", () => {
     render(<SegmentedToggle options={OPTS} value="or" onChange={vi.fn()} ariaLabel="Default" />);
     const plain = screen.getByRole("group", { name: "Default" });
     expect(plain.className).toContain("text-xs");
diff --git a/frontend/src/components/ui/SegmentedToggle.tsx b/frontend/src/components/ui/SegmentedToggle.tsx
index e28b73bb..872a626a 100644
--- a/frontend/src/components/ui/SegmentedToggle.tsx
+++ b/frontend/src/components/ui/SegmentedToggle.tsx
@@ -39,7 +39,7 @@ export default function SegmentedToggle<T extends string>({
   fullWidth?: boolean;
   // md (28, text-xs) is the toolbar rung: it lines up with the search pill, the triggers and an `sm`
   // Button (DESIGN B1). sm (24, text-3xs) is only a side panel's captioned match toggle. md is the
-  // default because the old sm default slid a pager and a toolbar count onto 10px type (S3g).
+  // default because the old sm default slid a pager and a toolbar count onto 10px type.
   size?: "sm" | "md";
   className?: string;
 }) {
diff --git a/frontend/src/components/ui/SelectTrigger.tsx b/frontend/src/components/ui/SelectTrigger.tsx
index be7edc6b..bef9e098 100644
--- a/frontend/src/components/ui/SelectTrigger.tsx
+++ b/frontend/src/components/ui/SelectTrigger.tsx
@@ -4,7 +4,7 @@ import clsx from "clsx";
 import { ChevronDown } from "lucide-react";
 import { FocusSafeButton } from "./FocusSafeButton";
 
-// The dropdown trigger (docs/DESIGN.md A5, E28 S3c): the one button that opens a list of choices —
+// The dropdown trigger (docs/DESIGN.md A5): the one button that opens a list of choices —
 // `SortControl`, `FilterSelect`, the view switcher, the date filter. By context: a pill at the toolbar's
 // 28 (in a toolbar the pill means "a filter or a choice"), or r8 at the form's 32, full width, lining up
 // with the inputs around it. The form trigger is one of the field family, so it wears the field's frame
@@ -45,8 +45,8 @@ export const SelectTrigger = forwardRef<
       {icon}
       {label != null && <span className="shrink-0 text-muted">{label}:</span>}
       {/* The toolbar value is a row, whatever the caller puts in it: an <svg> is display:block under the
-          preflight, and in a plain span it broke the value onto its own line (the saved-view chip,
-          E28). The form value is text that truncates, which a flex box would not do — nor would a bare
+          preflight, and in a plain span it broke the value onto its own line (the saved-view chip).
+          The form value is text that truncates, which a flex box would not do — nor would a bare
           text node in the toolbar row, so a text value gets its own truncating span: in a narrow place
           (the playlists rail) a long value ("Rendezés: Egyéni sorrend") used to wrap out of the pill. */}
       <span
diff --git a/frontend/src/components/ui/SidePanel.drawer.dom.test.tsx b/frontend/src/components/ui/SidePanel.drawer.dom.test.tsx
index 673efe03..538a7793 100644
--- a/frontend/src/components/ui/SidePanel.drawer.dom.test.tsx
+++ b/frontend/src/components/ui/SidePanel.drawer.dom.test.tsx
@@ -84,7 +84,7 @@ describe("SidePanel · a mouse on a wide window", () => {
   });
 });
 
-// E28 review F6: the pinned (or peeking) card covers the tab, which only goes transparent — yet it
+// The pinned (or peeking) card covers the tab, which only goes transparent — yet it
 // stayed a Tab stop, an invisible control the focus landed on, named just "Unpin panel".
 describe("SidePanel · the tab under an open card", () => {
   it("is out of the Tab order while the card is open, and names its panel", () => {
diff --git a/frontend/src/components/ui/SidePanel.tsx b/frontend/src/components/ui/SidePanel.tsx
index 6f30301a..b3927999 100644
--- a/frontend/src/components/ui/SidePanel.tsx
+++ b/frontend/src/components/ui/SidePanel.tsx
@@ -79,7 +79,7 @@ export default function SidePanel({
   // adjusted during render, so it cannot come back open on the next turn.
   if (drawerOpen && (!drawerMode || pinned)) setDrawerOpen(false);
   // A key landing on the tab peeks the card open over it, and the tab then goes inert below — with
-  // the focus still on it: a hidden control, out of the tree, that Enter still pinned (round 2, F1).
+  // the focus still on it: a hidden control, out of the tree, that Enter still pinned.
   // The focus steps into the card as it opens, onto its pin: the same control. In the commit that
   // mounts the card, not a frame later — a frame never comes in a page the browser is not painting.
   useLayoutEffect(() => {
@@ -156,7 +156,7 @@ export default function SidePanel({
           nowhere. It only goes transparent: the card's rounded corner cuts away its own pixels, and
           this square-cornered tab sits right under that arc, so it would otherwise bleed through.
           `opacity-0` (not `invisible`/`hidden`) keeps it hoverable, and a focus already on it stays.
-          But no Tab lands on it while the card covers it (E28 review F6): an invisible stop, where the
+          But no Tab lands on it while the card covers it: an invisible stop, where the
           card's own pin says the same. A keyboard pin hands the focus into the card it opened. */}
       <Pressable
         {...(drawerMode ? {} : peek.hoverHandlers)}
diff --git a/frontend/src/components/ui/SkipLink.dom.test.tsx b/frontend/src/components/ui/SkipLink.dom.test.tsx
index 5e6e5e25..515cc8d6 100644
--- a/frontend/src/components/ui/SkipLink.dom.test.tsx
+++ b/frontend/src/components/ui/SkipLink.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 S3d4 (UX-4): "Skip to content" moves the focus to the page's <main> itself. Following its
+// "Skip to content" moves the focus to the page's <main> itself. Following its
 // `#content` fragment would push a history entry, and the app reads every popstate as a page change.
 import { afterEach, describe, expect, it } from "vitest";
 import { cleanup, fireEvent, render, screen } from "@testing-library/react";
diff --git a/frontend/src/components/ui/StatTiles.dom.test.tsx b/frontend/src/components/ui/StatTiles.dom.test.tsx
index 39cd04b1..18aeeff7 100644
--- a/frontend/src/components/ui/StatTiles.dom.test.tsx
+++ b/frontend/src/components/ui/StatTiles.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E31 (the owner's pick for the Statistics overview): a figure's name sits by its number in a tile, and a
+// The owner's pick for the Statistics overview: a figure's name sits by its number in a tile, and a
 // breakdown is horizontal bars, largest first, so what spends the most is seen before a number is read.
 import { afterEach, describe, expect, it } from "vitest";
 import { cleanup, render, screen } from "@testing-library/react";
diff --git a/frontend/src/components/ui/StatTiles.tsx b/frontend/src/components/ui/StatTiles.tsx
index c4fbe30a..013d84f9 100644
--- a/frontend/src/components/ui/StatTiles.tsx
+++ b/frontend/src/components/ui/StatTiles.tsx
@@ -2,7 +2,7 @@ import type { ReactNode } from "react";
 import { HintLabel } from "./form";
 import { SURFACE } from "./surfaces";
 
-// E31 (the owner's pick for the Statistics overview): label…value rows stretched across a wide column
+// The owner's pick for the Statistics overview: label…value rows stretched across a wide column
 // made the eye travel from a name to its number. A tile keeps the two together, a row of them is read at
 // a glance, and a breakdown is a set of horizontal bars, so what spends the most is seen before a number
 // is read.
diff --git a/frontend/src/components/ui/Tabs.dom.test.tsx b/frontend/src/components/ui/Tabs.dom.test.tsx
index 96bec0a2..12bc60bd 100644
--- a/frontend/src/components/ui/Tabs.dom.test.tsx
+++ b/frontend/src/components/ui/Tabs.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 review F3: the tab rail was a row of `aria-pressed` toggle buttons — every tab a Tab stop, no
+// The tab rail was a row of `aria-pressed` toggle buttons — every tab a Tab stop, no
 // arrow keys, and nothing tying a tab to the content it shows. It is an ARIA tab list now.
 import { useState } from "react";
 import { afterEach, describe, expect, it } from "vitest";
diff --git a/frontend/src/components/ui/Tabs.tsx b/frontend/src/components/ui/Tabs.tsx
index 948951c9..23c4ddfe 100644
--- a/frontend/src/components/ui/Tabs.tsx
+++ b/frontend/src/components/ui/Tabs.tsx
@@ -9,12 +9,12 @@ import CountBadge from "./CountBadge";
 // Below it a side rail leaves a phone too little width for the content beside it (measured at 390 px:
 // the rail clipped its own labels and Settings → Account pushed its buttons over their text), so there
 // it is a horizontal row that scrolls. A page whose sub-tab is worth keeping persists it with
-// lib/storage's useTabPersistedState (per browser tab, E31 S4b: Admin Users, Config, Settings, Stats):
+// lib/storage's useTabPersistedState (per browser tab: Admin Users, Config, Settings, Stats):
 // a reload keeps the user where they were, and a fresh tab opens on the first sub-tab. Not every
 // caller: the channel manager's view is account-wide (ChannelsProvider), and Downloads, a channel page
 // and the player settings start on their first tab each time.
 //
-// An ARIA tab list (E28 review F3), not a row of toggle buttons: `tablist` / `tab` / `aria-selected`,
+// An ARIA tab list, not a row of toggle buttons: `tablist` / `tab` / `aria-selected`,
 // ONE Tab stop (the selected tab; roving tabindex), the arrows move and select (either axis, since the
 // vertical rail is a row below `sm`), Home/End jump to the ends. The panel it controls is wired with
 // `useTabPanel`: the tabs point at it (`aria-controls`) and it is labelled by the selected tab.
@@ -27,7 +27,7 @@ export interface TabDef {
   badge?: number; // optional count pill (e.g. pending requests); hidden when 0/undefined
   icon?: LucideIcon; // optional leading icon (the vertical settings rail)
   testId?: string; // optional data-testid, to preserve existing e2e hooks
-  /** The vertical rail's heading this tab sits under (E31: Configuration's sixteen groups under four).
+  /** The vertical rail's heading this tab sits under (Configuration's sixteen groups under four).
    *  Drawn above the first tab of each run; tabs of one heading stay together. */
   group?: string;
 }
diff --git a/frontend/src/components/ui/Toaster.dom.test.tsx b/frontend/src/components/ui/Toaster.dom.test.tsx
index b42508ea..76a6664c 100644
--- a/frontend/src/components/ui/Toaster.dom.test.tsx
+++ b/frontend/src/components/ui/Toaster.dom.test.tsx
@@ -95,7 +95,7 @@ describe("Toaster — handing the toasts to another host", () => {
   });
 
   it("takes the inherited set ONCE, at the takeover: a toast of its own stays an alert", () => {
-    // E32: the handover is a snapshot made when the host becomes top, not a read of what the top
+    // The handover is a snapshot made when the host becomes top, not a read of what the top
     // host last showed — re-read on every render, this host's own "first" turned silent the moment
     // "second" arrived (its own screen had become the handover by then).
     render(<Toaster />);
@@ -124,7 +124,7 @@ describe("Toaster — handing the toasts to another host", () => {
     // A dialog that notifies and closes in ONE handler (UploadDialog: "added to the queue" + close)
     // puts its toast into the very batch that hands the app host the top spot. Classifying it from
     // the store live at the takeover render counted it among the inherited, so it went in with no
-    // role into a region that was still `aria-live="off"` — announced by neither path (round 5).
+    // role into a region that was still `aria-live="off"` — announced by neither path.
     function Stage() {
       const [open, setOpen] = useState(true);
       return (
diff --git a/frontend/src/components/ui/Toaster.hosts.test.ts b/frontend/src/components/ui/Toaster.hosts.test.ts
index e77650f5..02ad0b52 100644
--- a/frontend/src/components/ui/Toaster.hosts.test.ts
+++ b/frontend/src/components/ui/Toaster.hosts.test.ts
@@ -4,19 +4,19 @@
 // viewport at z-overlay paints over it, so a toast raised while that overlay is open is unreadable and
 // a click on it lands on the overlay's backdrop. The fix is a convention — the overlay mounts
 // `<Toaster overlay order={useOverlayOrder()} />` inside itself — and a convention stated in a comment
-// is one the next overlay forgets (deep-review round 3 found every ui/Modal and the onboarding wizard
+// is one the next overlay forgets (a review found every ui/Modal and the onboarding wizard
 // without one). So it is checked here: a component that renders a viewport-covering layer at
 // z-overlay or above mounts an overlay host, ranked by when the overlay opened.
 //
 // The class TOKENS are matched in any order, and the layer need not be `inset-0`: the first version
 // matched the exact string "fixed inset-0 z-overlay", so PlexPlayer's own root (`fixed left-0 top-0
 // z-overlay`) was never checked at all, and a new viewer copying it would have slipped past
-// (deep-review round 4).
+// (found by a later review).
 import { describe, it, expect } from "vitest";
 
 // BOTH patterns: `../**/*.tsx` from this directory does not match the siblings in `ui/` itself, so
 // ui/Modal.tsx — the overlay behind every dialog in the app — was never checked by this guard at all
-// (deep-review round 4).
+// (found by a later review).
 const sources = import.meta.glob(["../**/*.tsx", "./*.tsx"], {
   query: "?raw",
   import: "default",
diff --git a/frontend/src/components/ui/Toaster.strictmode.dom.test.tsx b/frontend/src/components/ui/Toaster.strictmode.dom.test.tsx
index 4f07ac15..699124e1 100644
--- a/frontend/src/components/ui/Toaster.strictmode.dom.test.tsx
+++ b/frontend/src/components/ui/Toaster.strictmode.dom.test.tsx
@@ -3,11 +3,11 @@
 // The toast handover under React 18 StrictMode — its own file, because `lastTopIds` is module-level
 // state that leaks between tests.
 //
-// Round 5 made a taking-over host inherit "what the PREVIOUS top host last had on screen" by reading
+// One fix made a taking-over host inherit "what the PREVIOUS top host last had on screen" by reading
 // a module global in a `useMemo` and overwriting it in the same render pass. React re-invokes a
 // component body — and every `useMemo` factory in it — on a StrictMode double render, and the LAST
 // invocation is what commits: so the second pass re-read what the first had just written, the host
-// classified its OWN new toast as inherited, and the dev build behaved exactly like the code round 5
+// classified its OWN new toast as inherited, and the dev build behaved exactly like the code it
 // replaced. Measured in Chrome and in jsdom: role "status" without StrictMode, null with it.
 //
 // The named case is UploadDialog's — notify and close the overlay in ONE handler, so the toast is
diff --git a/frontend/src/components/ui/Toaster.tsx b/frontend/src/components/ui/Toaster.tsx
index bcd8a8e4..271e5466 100644
--- a/frontend/src/components/ui/Toaster.tsx
+++ b/frontend/src/components/ui/Toaster.tsx
@@ -22,7 +22,7 @@ import { SURFACE } from "./surfaces";
 // "Opened last", not "host mounted last": a host can remount while its overlay stays open —
 // PlayerModal's moves into the fullscreen stage and back — and ranked by mount time it came back on
 // top of a dialog opened over the player (the download dialog after leaving true fullscreen), so the
-// toasts were drawn under that dialog's scrim again (deep-review round 4). So the OVERLAY takes its
+// toasts were drawn under that dialog's scrim again. So the OVERLAY takes its
 // rank once, when it opens (`useOverlayOrder`, in overlayOrder.ts), and hands it to every host it renders.
 type Host = { id: string; order: number };
 const overlayHosts = createStore<readonly Host[]>([]);
@@ -70,16 +70,16 @@ export default function Toaster({
   // the takeover render. Reading the store live also silenced a toast RAISED in the same commit as
   // the takeover: a dialog that notifies and closes in one handler (UploadDialog) put its success
   // toast up in the very batch that handed the app host the top spot, so it was classified as
-  // inherited and announced by neither path (deep-review round 5). The top host records its screen
+  // inherited and announced by neither path. The top host records its screen
   // after each commit (the layout effect below); a host taking over reads it in a LATER render, after
   // that commit, so it always sees the outgoing host's last committed screen. (It was written during
-  // render, which made the React Compiler skip the Toaster — E32 — and let a discarded render
+  // render, which made the React Compiler skip the Toaster and let a discarded render
   // overwrite it.)
   //
   // Snapshotted into state when `isTop` flips, adjusted DURING render — not a `useMemo`, which React
   // may recompute (and the compiler is free to): a recompute while top would re-read this host's OWN
   // screen and silence its next toast. Under StrictMode the double invocation reads the same,
-  // unchanged global, so both passes agree (the round-6 failure was a render-phase WRITE racing it).
+  // unchanged global, so both passes agree (an earlier failure was a render-phase WRITE racing it).
   const [handover, setHandover] = useState<{ top: boolean; ids: ReadonlySet<number> }>({
     top: false,
     ids: EMPTY_IDS,
diff --git a/frontend/src/components/ui/Tooltip.layer.dom.test.tsx b/frontend/src/components/ui/Tooltip.layer.dom.test.tsx
index 4b0c88c3..17660911 100644
--- a/frontend/src/components/ui/Tooltip.layer.dom.test.tsx
+++ b/frontend/src/components/ui/Tooltip.layer.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E11 S4: a hover surface (tooltip, hover card) is a PASSIVE layer. It still sits on the layer stack —
+// A hover surface (tooltip, hover card) is a PASSIVE layer. It still sits on the layer stack —
 // Escape closes it before the surface beneath — but it does not own the keyboard, so the page-level
 // keys (`j`/`k`, `s`, the `g` chords) keep working while one happens to be open under a resting pointer.
 // Without the flag, hovering any hinted icon silently disabled keyboard navigation.
diff --git a/frontend/src/components/ui/Tooltip.tsx b/frontend/src/components/ui/Tooltip.tsx
index 68408328..a383ea25 100644
--- a/frontend/src/components/ui/Tooltip.tsx
+++ b/frontend/src/components/ui/Tooltip.tsx
@@ -7,7 +7,7 @@ import { SURFACE } from "./surfaces";
 type Side = "top" | "bottom" | "left" | "right";
 
 /** Wrap any element to show a short glass hint caption on hover — by default only while the
- *  app-wide hints toggle (Settings → Appearance) is on. Anchored by the R8 popover platform, so it
+ *  app-wide hints toggle (Settings → Appearance) is on. Anchored by the popover platform, so it
  *  is never clipped by an overflow/stacking ancestor, flips when the preferred side runs out of room
  *  and slides back inside the viewport near an edge.
  *  `always` bypasses the hints toggle (for a label that IS the primary affordance, e.g. the slim nav
diff --git a/frontend/src/components/ui/UndoToolbar.tsx b/frontend/src/components/ui/UndoToolbar.tsx
index 4c5ec3d8..4e616958 100644
--- a/frontend/src/components/ui/UndoToolbar.tsx
+++ b/frontend/src/components/ui/UndoToolbar.tsx
@@ -21,7 +21,7 @@ export default function UndoToolbar({
 }) {
   const { t } = useTranslation();
   // Only while a key actually DOES something: the sheet must not advertise Ctrl+Z on a page where
-  // nothing has been done yet and the handler returns immediately (E10 review round 1) — the same
+  // nothing has been done yet and the handler returns immediately — the same
   // honest-states gate PlexBrowse uses for its Backspace.
   useKeyScope("undo", canUndo || canRedo);
 
diff --git a/frontend/src/components/ui/VirtualGrid.tsx b/frontend/src/components/ui/VirtualGrid.tsx
index 325f36bc..d00f6ad8 100644
--- a/frontend/src/components/ui/VirtualGrid.tsx
+++ b/frontend/src/components/ui/VirtualGrid.tsx
@@ -44,7 +44,7 @@ export interface VirtualGridProps<T> {
   /** Single-column layout only (`minCol == null`): the reading-width cap in px (null = fill). */
   colMaxWidth?: number | null;
   /** Multi-column layout only (`minCol != null`): the most columns to lay out, or null for as many
-   * as fit. This is the UPPER end of the viewport contract (E10 S4): an auto-fill grid always settles
+   * as fit. This is the UPPER end of the viewport contract: an auto-fill grid always settles
    * just above its minimum column, so on an ultrawide it answers "more room" with more, smaller
    * items forever — 3440px gave the feed 11 columns of 264px. With a cap the extra width goes into
    * the items instead (8 columns of ~370px), which is what a screen watched from a distance wants.
@@ -131,7 +131,7 @@ export default function VirtualGrid<T>({
 
   const rows = useMemo(() => chunk(items, colCount), [items, colCount]);
 
-  // The React Compiler (E27 S1) SKIPS memoising this whole component, and says so: TanStack
+  // The React Compiler SKIPS memoising this whole component, and says so: TanStack
   // Virtual's `useVirtualizer()` hands back functions that cannot be memoised without going stale,
   // so the compiler bails rather than risk a frozen viewport. That is the correct trade here — this
   // component's cost is the row window it mounts, not its render closures — and it is the ONE such
diff --git a/frontend/src/components/ui/anchoredPopoverHooks.ts b/frontend/src/components/ui/anchoredPopoverHooks.ts
index eb5e0eef..a00c55e7 100644
--- a/frontend/src/components/ui/anchoredPopoverHooks.ts
+++ b/frontend/src/components/ui/anchoredPopoverHooks.ts
@@ -23,7 +23,7 @@ import {
 import { useLayer } from "../../lib/layerStack";
 import { pageStep, pageTarget, scrollParent } from "../../lib/listPaging";
 
-// The non-component half of the R8 popover platform: the `useAnchoredPopover` engine hook and the
+// The non-component half of the popover platform: the `useAnchoredPopover` engine hook and the
 // `closeThenAct` row helper. The surfaces it drives (PopoverSurface / PopoverItem) and the platform's
 // design notes live in AnchoredPopover.tsx; the split keeps that file components-only (Fast Refresh).
 
@@ -69,13 +69,13 @@ export interface AnchoredPopoverOptions {
   /** Close when a scroll container under the panel scrolls. Off by default, because a panel anchored
    *  to a real trigger element simply MOVES with it. Turn it on when the anchor is a fixed point
    *  rather than an element — a right-click menu, which otherwise stays parked over whatever row
-   *  scrolls under it while its actions still target the row you opened it on (E10 review round 1).
+   *  scrolls under it while its actions still target the row you opened it on.
    *  This is also what a native context menu does. */
   dismissOnScroll?: boolean;
   /** Menu/listbox only: ↑/↓ on the CLOSED trigger open the panel (the APG menu-button default, on).
    *  Turn it off where those keys already mean something on that trigger — a media player's row,
-   *  where ↑/↓ are the volume from anywhere, and a trigger that swallowed them killed it (E28 review
-   *  round 2, P2). Enter/Space/click still open it, and the arrows still rove once it is open. */
+   *  where ↑/↓ are the volume from anywhere, and a trigger that swallowed them killed it.
+   *  Enter/Space/click still open it, and the arrows still rove once it is open. */
   openOnArrowKey?: boolean;
 }
 
@@ -308,7 +308,7 @@ export function useAnchoredPopover(opts: AnchoredPopoverOptions) {
 /** A menu row whose action opens a dialog or moves the focus: close the menu FIRST and act once it
  *  has handed the focus back. floating-ui returns the focus to the trigger from a microtask queued as
  *  the menu unmounts, so an action run in the same batch had its focus taken back by it: measured in
- *  Chrome (E11 S2), a confirm dialog opened from the rail's menu landed its focus on Cancel and lost it
+ *  Chrome, a confirm dialog opened from the rail's menu landed its focus on Cancel and lost it
  *  7 ms later to the row BEHIND its scrim, where Enter activated the row. A fresh task runs after that
  *  microtask — and a dialog opened there captures the trigger, not a dying menu item, as the element
  *  to restore the focus to. Every such row goes through here (`ActionMenu`, "Manage views…"). */
diff --git a/frontend/src/components/ui/backToTopState.ts b/frontend/src/components/ui/backToTopState.ts
index 2bfab1bb..c863698e 100644
--- a/frontend/src/components/ui/backToTopState.ts
+++ b/frontend/src/components/ui/backToTopState.ts
@@ -2,7 +2,7 @@ import { createStore } from "../../lib/store";
 
 // Whether the Back-to-top button is up. It floats over the page's bottom-right corner, so PageScroller
 // reads this to keep the END of the page clear of it while it shows: a table's closing pager sat under
-// the button — "100" and "All" covered (E28 UAT, the channel manager on a short window).
+// the button — "100" and "All" covered (found in UAT, the channel manager on a short window).
 export const backToTopShown = createStore(false);
 
 export function useBackToTopShown(): boolean {
diff --git a/frontend/src/components/ui/buttonStyles.ts b/frontend/src/components/ui/buttonStyles.ts
index 2a662209..f41472a8 100644
--- a/frontend/src/components/ui/buttonStyles.ts
+++ b/frontend/src/components/ui/buttonStyles.ts
@@ -151,7 +151,7 @@ export function buttonClass({
     // The coarse-pointer target (DESIGN.md A3) lives HERE, not in the call sites — on every variant.
     // The link variants were once excluded as "a run of text inside a sentence", but none is: every
     // one stands on its own ("See all", "Forgot your passphrase?", a notification's action), and the
-    // E28 audit measured them at 16–20px on a tablet. Text inside a sentence is a plain <a>.
+    // an audit measured them at 16–20px on a tablet. Text inside a sentence is a plain <a>.
     "touch-target",
     fullWidth && "w-full",
   );
diff --git a/frontend/src/components/ui/dialogFocus.ts b/frontend/src/components/ui/dialogFocus.ts
index 33a439fb..318f04da 100644
--- a/frontend/src/components/ui/dialogFocus.ts
+++ b/frontend/src/components/ui/dialogFocus.ts
@@ -4,7 +4,7 @@ import { useEffect, useEffectEvent, useRef, useState, type RefObject } from "rea
 // through the shell; the onboarding wizard renders its own shell (a bare `ui/Overlay`, because it is
 // not a titled dialog with a header row) and used to have NONE of this — no trap, no initial focus,
 // no restore — so a keyboard user tabbed straight out of the first-login wizard into the app behind
-// the scrim, where the focus ring is invisible (deep-review round 5). A second hand-written copy is
+// the scrim, where the focus ring is invisible. A second hand-written copy is
 // how two shells drift apart; this is the shared one.
 
 // Tabbable elements inside the dialog, in DOM order. `:not([tabindex="-1"])` drops programmatically
@@ -19,7 +19,7 @@ export const focusablesIn = (root: HTMLElement): HTMLElement[] =>
 /** A form's first field — where a dialog opened to fill something in takes the focus: its first
  *  control, unless one is marked `data-initial-focus`. The mark is for a form with a control above
  *  its fields that is not one of them — the issue composer's Edit / Preview switch took the focus,
- *  and typing went nowhere (E32 review). */
+ *  and typing went nowhere. */
 export const firstFieldIn = (root: HTMLElement): HTMLElement | undefined => {
   const all = focusablesIn(root);
   return all.find((el) => el.hasAttribute("data-initial-focus")) ?? all[0];
@@ -58,7 +58,7 @@ export function trapTab(
 // ONE body scroll lock for every open dialog, counted. Each dialog used to save and restore
 // `overflow` on its own, so two unmounting out of order (the player's cleanup running before a Modal
 // opened above it) put back a stale "hidden". Invisible today — the app scrolls inside <main>, not
-// the document (measured, E11 S2) — but a count cannot be restored out of order, and PlayerModal's
+// the document (measured) — but a count cannot be restored out of order, and PlayerModal's
 // second copy of the lock is gone.
 let scrollLocks = 0;
 let unlockedOverflow = "";
@@ -100,7 +100,7 @@ export function useDialogChrome(
   // the cleanup hands focus back to the trigger, and the second mount then found the focus outside
   // the dialog and moved it to the first focusable — taking it off the `autoFocus` field a beat
   // after the browser had put it there. Measured in Chrome: the command palette opened with the
-  // focus on its ✕ in dev and on its search field in prod, from the same code (round 5).
+  // focus on its ✕ in dev and on its search field in prod, from the same code.
   const focusedRef = useRef<HTMLElement | null>(null);
   // Whether the dialog still holds the focus. Read at cleanup rather than computed there: by the
   // time a passive cleanup runs on a real unmount the panel is already out of the document and the
@@ -112,7 +112,7 @@ export function useDialogChrome(
   // stays reachable — so tabbing to that ✕ read as "the user left the dialog", and since removing
   // the toast fires no `focusin` to re-arm, closing the dialog afterwards stranded the focus on
   // <body> instead of handing it back to the trigger. Measured in jsdom, and a regression: before
-  // this hook existed the restore was unconditional (deep-review round 6).
+  // this hook existed the restore was unconditional.
   const heldRef = useRef(true);
   // Read at open, not a dependency: a caller's fresh function each render must not re-run the open.
   const pickInitial = useEffectEvent(() => initial?.() ?? null);
@@ -144,7 +144,7 @@ export function useDialogChrome(
       // it — and while it held the focus we read that as the user walking away. Then both closing
       // together left the focus on <body>: ours skipped the restore, and the child's own
       // `restoreTo` was already detached (passive cleanups run parent-first). Measured in jsdom,
-      // and it is the ordinary case — an error dialog raised over a dialog (round 6).
+      // and it is the ordinary case — an error dialog raised over a dialog.
       heldRef.current =
         (owner?.contains(active) ?? false) ||
         (active instanceof Element && active.closest('[aria-modal="true"]') != null);
@@ -171,7 +171,7 @@ export function useDialogChrome(
       // a layer closing with us is already disconnected while one that stays open is not. Without
       // this, a dialog closing on its own (an in-flight mutation's `onSuccess`) under a modal raised
       // above it pulled the focus out of that standing dialog onto our own trigger, behind its
-      // scrim — where Enter still activated it (deep-review round 7).
+      // scrim — where Enter still activated it.
       const owner = ownerAtOpen;
       const active = document.activeElement;
       const above = active instanceof Element ? active.closest('[aria-modal="true"]') : null;
diff --git a/frontend/src/components/ui/form.dom.test.tsx b/frontend/src/components/ui/form.dom.test.tsx
index 9d084438..f9857d63 100644
--- a/frontend/src/components/ui/form.dom.test.tsx
+++ b/frontend/src/components/ui/form.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 audit: the Switch was a bare 36×20 track — under the 24 floor on a mouse, never the 44 touch box
+// Audit: the Switch was a bare 36×20 track — under the 24 floor on a mouse, never the 44 touch box
 // DESIGN.md A3 lists it under, and its name was optional, so the Plex-sync switch shipped nameless.
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { cleanup, fireEvent, render, screen } from "@testing-library/react";
diff --git a/frontend/src/components/ui/gridColumns.test.ts b/frontend/src/components/ui/gridColumns.test.ts
index 0e939080..511f3505 100644
--- a/frontend/src/components/ui/gridColumns.test.ts
+++ b/frontend/src/components/ui/gridColumns.test.ts
@@ -17,7 +17,7 @@ describe("columnsFor", () => {
   // The GUTTERS have to be in the count, not just in itemWidthFor. Every other assertion in this file
   // survives replacing `floor((w + GAP) / (minCol + GAP))` with the naive `floor(w / (minCol + GAP))`
   // — the fixed widths agree, the capped cases are cap-bound, and the two loops compare columnsFor
-  // against itself, so they cancel any shared change (E10 review round 1). These are the exact-fit
+  // against itself, so they cancel any shared change. These are the exact-fit
   // boundaries where the two formulas first disagree: an n-column row needs n*minCol + (n-1)*GAP, so
   // at exactly that width the naive form loses the last column and wastes a third of the row.
   it("counts the gutters, not one gap per column", () => {
diff --git a/frontend/src/components/ui/gridColumns.ts b/frontend/src/components/ui/gridColumns.ts
index f082cf01..425e1e8f 100644
--- a/frontend/src/components/ui/gridColumns.ts
+++ b/frontend/src/components/ui/gridColumns.ts
@@ -3,7 +3,7 @@
 // the grid simply drops to the columns that fit).
 //
 // An auto-fill grid answers "more room" with more columns, never bigger ones, so it always settles
-// just above its minimum column width no matter how wide the screen is. Measured at 3440px (E10 S4),
+// just above its minimum column width no matter how wide the screen is. Measured at 3440px,
 // the feed laid out 11 columns of 264px — a diluted feed is as bad a failure of the viewport contract
 // as a broken one, so `maxCols` stops the multiplication and lets the leftover width flow into the
 // items instead. The cap can only bind ABOVE the width at which that many columns already fit, so the
diff --git a/frontend/src/components/ui/hiddenFilterCue.contract.test.ts b/frontend/src/components/ui/hiddenFilterCue.contract.test.ts
index daccad46..9c8d5df8 100644
--- a/frontend/src/components/ui/hiddenFilterCue.contract.test.ts
+++ b/frontend/src/components/ui/hiddenFilterCue.contract.test.ts
@@ -1,7 +1,7 @@
 import { readdirSync, readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 
-// E28 review F2: a view that applies the column filters itself (`filterRows`) — DataTable, the
+// A view that applies the column filters itself (`filterRows`) — DataTable, the
 // playlist manager's own table, the channel manager's cards — can hide the column a filter lives in,
 // or have no header at all. Each renders the hidden-filter cue, so no filter narrows its rows unseen.
 describe("every view that filters rows by column", () => {
diff --git a/frontend/src/components/ui/mediaCardStyles.ts b/frontend/src/components/ui/mediaCardStyles.ts
index e976424f..45a74001 100644
--- a/frontend/src/components/ui/mediaCardStyles.ts
+++ b/frontend/src/components/ui/mediaCardStyles.ts
@@ -22,14 +22,14 @@ export const MEDIA_BADGE =
  *  Every picture box carries it: `mediaPictureBox` and the video card's own box. A box that holds a
  *  hover row (MEDIA_BAR) also sets `--bar-room`, the band the row needs: the narrow-picture rule
  *  below lifts the Play by it, and a box with no row (the feed's row and tile views, a Plex card
- *  without actions) lifts it by nothing (E31 review 2: it sat off-centre there). */
+ *  without actions) lifts it by nothing (it once sat off-centre there). */
 export const MEDIA_PICTURE_CONTAINER = "@container/pic has-[.media-bar]:[--bar-room:2.5rem]";
 
 /** The hover layer over the picture: a dim that carries the Play (mouse only, like the hover row).
  *  On a narrow picture the Play centres in the band ABOVE the hover row instead of on the whole
  *  picture: the picture's height follows the card's width, but the Play and the row grow with the
- *  text size, so at 1.3 a 242px thumbnail put the 63px Play 13px into the 37px row (E31 S5,
- *  measured). The cut is in rem, so it moves with the text size too: a picture under 14rem wide.
+ *  text size, so at 1.3 a 242px thumbnail put the 63px Play 13px into the 37px row
+ *  (measured). The cut is in rem, so it moves with the text size too: a picture under 14rem wide.
  *  Only where a row is there to clear (`--bar-room`, MEDIA_PICTURE_CONTAINER). */
 export const MEDIA_HOVER_LAYER =
   "reveal-hover absolute inset-0 flex items-center justify-center gap-2 bg-black/45 opacity-0 transition-opacity group-hover:opacity-100 group-focus-within:opacity-100 @max-[14rem]/pic:pb-(--bar-room)";
diff --git a/frontend/src/components/ui/mediaRail.contract.test.ts b/frontend/src/components/ui/mediaRail.contract.test.ts
index e2b2497f..f1645d73 100644
--- a/frontend/src/components/ui/mediaRail.contract.test.ts
+++ b/frontend/src/components/ui/mediaRail.contract.test.ts
@@ -3,8 +3,8 @@ import { describe, expect, it } from "vitest";
 
 // A card skips its off-screen rendering (`cv-card` / `cv-poster`: content-visibility auto with a
 // reserved height), but not inside a carousel. A rail stretches every card to its tallest, and an
-// off-screen card's reserve WAS the tallest — Home's shelves measured 338px around 170–216px cards
-// (E28 S3h). The pair lives in two files and neither can be seen in jsdom, so it is held here.
+// off-screen card's reserve WAS the tallest — Home's shelves measured 338px around 170–216px cards.
+// The pair lives in two files and neither can be seen in jsdom, so it is held here.
 const read = (file: string) => readFileSync(new URL(file, import.meta.url), "utf8");
 
 describe("a carousel turns the cards' content-visibility off", () => {
diff --git a/frontend/src/components/ui/menuCheck.contract.test.ts b/frontend/src/components/ui/menuCheck.contract.test.ts
index d2da1309..86095712 100644
--- a/frontend/src/components/ui/menuCheck.contract.test.ts
+++ b/frontend/src/components/ui/menuCheck.contract.test.ts
@@ -9,7 +9,7 @@ const sources = () =>
 
 /** Checkable menu rows a file renders: a literal `role="menuitemradio"`, and a role CHOSEN by an
  *  expression that can come out checkable — FilterSelect's and ActionMenu's rows, every filter select
- *  and checkable action menu in the app, which a literal-only count skipped (round 3). */
+ *  and checkable action menu in the app, which a literal-only count skipped. */
 function checkableRoles(src: string): number {
   const literal = (src.match(/role="menuitem(?:radio|checkbox)"/g) ?? []).length;
   const chosen = [...src.matchAll(/role=\{([^{}]*)\}/g)].filter(([, e]) =>
@@ -18,7 +18,7 @@ function checkableRoles(src: string): number {
   return literal + chosen;
 }
 
-// E28 review L2: `ui/MenuCheck` is the ONE drawn check box of a checkable row (S3e3b replaced seven
+// `ui/MenuCheck` is the ONE drawn check box of a checkable row (S3e3b replaced seven
 // hand-drawn copies), yet FilterSelect and Combobox still painted their own — a 14px box beside the
 // menus' 16px one. The filled-box paint is the tell: it may live in MenuCheck only.
 describe("the drawn check box", () => {
@@ -30,7 +30,7 @@ describe("the drawn check box", () => {
     expect(offenders).toEqual([]);
   });
 
-  // Round 2 (P6): the player's track rows marked the choice only by an accent label — which the
+  // The player's track rows marked the choice only by an accent label — which the
   // highlight's white text wiped — and four more menus ticked it their own way (a trailing tick, a
   // dot, a filled row). A file with a checkable menu row draws MenuCheck, and no tick of its own.
   it("marks every checkable menu row, with no tick of its own beside it", () => {
diff --git a/frontend/src/components/ui/pressableSelectable.contract.test.ts b/frontend/src/components/ui/pressableSelectable.contract.test.ts
index 522835ac..0b156e3b 100644
--- a/frontend/src/components/ui/pressableSelectable.contract.test.ts
+++ b/frontend/src/components/ui/pressableSelectable.contract.test.ts
@@ -48,7 +48,7 @@ const PLAIN: Record<string, [number, string]> = {
   "ui/CommandPalette.tsx": [1, "a command row"],
   "ui/NavRail.tsx": [
     2,
-    "the action rows (About, Sign out) and the group row that opens its panel; a page row is a link (E31)",
+    "the action rows (About, Sign out) and the group row that opens its panel; a page row is a link",
   ],
   "ui/PanelGroup.tsx": [2, "a group's collapse toggle and its label"],
   "ui/SidePanel.tsx": [2, "panel controls"],
diff --git a/frontend/src/components/ui/progressiveRows.ts b/frontend/src/components/ui/progressiveRows.ts
index d3e39d50..3351391b 100644
--- a/frontend/src/components/ui/progressiveRows.ts
+++ b/frontend/src/components/ui/progressiveRows.ts
@@ -1,7 +1,7 @@
 import { startTransition, useEffect, useState } from "react";
 
 // A long page of table rows mounts in steps: the first FIRST_ROWS at once, then STEP_ROWS more per
-// background transition until all are in (E31 S4d). The channel manager's "All" page (~400 rows) took
+// background transition until all are in. The channel manager's "All" page (~400 rows) took
 // 0.7–0.9 s of one blocked frame to mount on prod, and every sort and every keystroke in its search
 // re-rendered all of them (300–400 ms per key). No single cell is to blame: measured column by column,
 // each costs its share, and all of them together cost ~9× an empty row. The first rows fill more than
@@ -12,7 +12,6 @@ import { startTransition, useEffect, useState } from "react";
 //
 // Not virtualization: every row still ends up in the DOM, so browser find, keyboard nav past the screen,
 // and the Back focus/scroll restore (which wait for the list to grow) keep working as they did.
-/** @internal exported for DataTable.progressive.dom.test.tsx */
 export const FIRST_ROWS = 30;
 const STEP_ROWS = 40;
 
@@ -22,7 +21,7 @@ const STEP_ROWS = 40;
 //
 // `through` is a row that must be in the DOM in THIS render: the row a page turn was made to show
 // (DataTable's `reveal`). Its page is a new view, and the caller focuses that row right after the
-// commit — at index 40 of a 50-row page it was not mounted yet, and focus fell to <body> (E31 S5).
+// commit — at index 40 of a 50-row page it was not mounted yet, and focus fell to <body>.
 export function useProgressiveRows<T>(rows: T[], view: string, through = -1): T[] {
   const [seen, setSeen] = useState(view);
   const [limit, setLimit] = useState(FIRST_ROWS);
diff --git a/frontend/src/components/ui/readAhead.ts b/frontend/src/components/ui/readAhead.ts
index 817eda1d..701adcdc 100644
--- a/frontend/src/components/ui/readAhead.ts
+++ b/frontend/src/components/ui/readAhead.ts
@@ -8,16 +8,12 @@
 //   - ceiling MAX_LOOKAHEAD_ROWS: a tall window renders many rows, and an uncapped lookahead would
 //     eagerly prefetch several pages on every mount / filter change — wasted work on the app's
 //     heaviest query (the feed). The cap bounds that while still buffering a couple of screens ahead.
-/** @internal exported for readAhead.test.ts */
 export const PREFETCH_ROWS = 4;
-/** @internal exported for readAhead.test.ts */
 export const PREFETCH_VIEWPORTS = 2;
-/** @internal exported for readAhead.test.ts */
 export const MAX_LOOKAHEAD_ROWS = 40;
 
 /** How many rows ahead of the last rendered row to keep buffered, for a viewport rendering
  *  `renderedRows` rows. Clamped to [PREFETCH_ROWS, MAX_LOOKAHEAD_ROWS]. */
-/** @internal exported for readAhead.test.ts */
 export function readAheadLookahead(renderedRows: number): number {
   return Math.min(MAX_LOOKAHEAD_ROWS, Math.max(PREFETCH_ROWS, renderedRows * PREFETCH_VIEWPORTS));
 }
diff --git a/frontend/src/components/ui/reveal.ts b/frontend/src/components/ui/reveal.ts
index 23ceffe1..e960f114 100644
--- a/frontend/src/components/ui/reveal.ts
+++ b/frontend/src/components/ui/reveal.ts
@@ -1,4 +1,4 @@
-// A card's hover chrome (E28 C1): shown when the card is hovered or holds keyboard focus on a mouse,
+// A card's hover chrome: shown when the card is hovered or holds keyboard focus on a mouse,
 // removed on touch (`.reveal-hover`, index.css), where the card offers the same actions through its
 // "…" beside the title. One string, so the video card and the Plex cards reveal the same way.
 export const HOVER_REVEAL =
diff --git a/frontend/src/components/ui/scrollFold.test.ts b/frontend/src/components/ui/scrollFold.test.ts
index 24c83e6e..114cdf08 100644
--- a/frontend/src/components/ui/scrollFold.test.ts
+++ b/frontend/src/components/ui/scrollFold.test.ts
@@ -1,4 +1,4 @@
-// E31 (the owner's pick): the channel page's tall header folds to one row once the grid scrolls. The header
+// The owner's pick: the channel page's tall header folds to one row once the grid scrolls. The header
 // is fixed, so folding gives the scroller its height back — these are the rules that keep that from
 // flickering on a page barely taller than the window.
 import { describe, expect, it } from "vitest";
diff --git a/frontend/src/components/ui/scrollFold.ts b/frontend/src/components/ui/scrollFold.ts
index 11e08800..71b07740 100644
--- a/frontend/src/components/ui/scrollFold.ts
+++ b/frontend/src/components/ui/scrollFold.ts
@@ -1,7 +1,7 @@
 import { useEffect, useRef, useState, type RefObject } from "react";
 import { CONTENT_ID } from "./landmarks";
 
-// A tall page header that folds to one row once the page's content scrolls (E31, the owner's pick for the
+// A tall page header that folds to one row once the page's content scrolls (the owner's pick for the
 // channel page: the banner and the identity block took ~40% of a 133% screen before the first video).
 //
 // The header is FIXED (it sits in the shell's toolbar band, outside the scroller), so folding it makes the
@@ -10,7 +10,6 @@ import { CONTENT_ID } from "./landmarks";
 //    back (`room - saving > FOLD_AT`): a page barely taller than the window would otherwise fold, lose its
 //    scroll, land at the top, unfold, and so on, with every wheel tick;
 //  - unfold only at the very top, not at the fold point: between the two the header keeps whatever it was.
-/** @internal exported for scrollFold.test.ts */
 export const FOLD_AT = 32;
 
 interface ScrollPosition {
@@ -21,7 +20,6 @@ interface ScrollPosition {
 }
 
 // `saving` = the height the header gives back when it folds (measured while it is unfolded).
-/** @internal exported for scrollFold.test.ts */
 export function nextFolded(
   folded: boolean,
   { top, room }: ScrollPosition,
diff --git a/frontend/src/components/ui/tableHeader.tsx b/frontend/src/components/ui/tableHeader.tsx
index 379579b4..3f2aae78 100644
--- a/frontend/src/components/ui/tableHeader.tsx
+++ b/frontend/src/components/ui/tableHeader.tsx
@@ -23,7 +23,7 @@ import { SURFACE } from "./surfaces";
 // Why it lives here and not in DataTable: DataTable owns its filter/sort/page state internally,
 // while the playlist manager's body is a drag-reorderable list whose order is the persisted
 // server-side one. Two owners of the same ordering fight; composing these pieces instead lets the
-// playlist keep its stored order and still get real column headers. Same move as E4 S3's
+// playlist keep its stored order and still get real column headers. Same move as
 // ChannelLayoutGrid, which builds a card view straight from the `Column<T>` render closures.
 
 // The multi-select filter's option list, capped and scrollable. Its own component because it owns a
@@ -46,7 +46,7 @@ function FilterOptionList({ children }: { children: ReactNode }) {
 // so the caret jumped to the end and IME composition (accents, any CJK input) broke mid-word. The
 // `autoFocus` masked it well enough that it read as "the filter is just twitchy".
 //
-// The funnel and its panel live in ONE component because the R8 popover platform anchors the panel
+// The funnel and its panel live in ONE component because the popover platform anchors the panel
 // to its trigger. That also retires this file's three hand-rolled focus chores: capturing the
 // trigger element at open time (a `ref` scoped to the open column nulled out before focus could go
 // back), the restore-focus effect that stopped Escape stranding focus on <body>, and the useDismiss
diff --git a/frontend/src/components/ui/tailwindScan.contract.test.ts b/frontend/src/components/ui/tailwindScan.contract.test.ts
index 2331d085..0f8381fe 100644
--- a/frontend/src/components/ui/tailwindScan.contract.test.ts
+++ b/frontend/src/components/ui/tailwindScan.contract.test.ts
@@ -14,7 +14,7 @@ import { type ChipSize, type ChipVariant, chipClass } from "./chipStyles";
 
 // Tailwind generates CSS only for the class names it FINDS in the source, token by token. A class
 // assembled at runtime (`${ACT}hover:text-fg`) is never found whole, so it ships with no rule at all:
-// every hover colour of Button, IconButton and Chip was dead that way, found in the E28 audit by
+// every hover colour of Button, IconButton and Chip was dead that way, found in an audit by
 // reading the stylesheet (0 rules for `not-aria-disabled`). So: every class a primitive can emit has
 // to stand in its source file whole, between the delimiters the scanner splits on.
 const tokens = (file: string) =>
diff --git a/frontend/src/components/ui/useContextMenu.ts b/frontend/src/components/ui/useContextMenu.ts
index bf9c08d5..e5c8ed55 100644
--- a/frontend/src/components/ui/useContextMenu.ts
+++ b/frontend/src/components/ui/useContextMenu.ts
@@ -10,7 +10,7 @@ import { matchesShortcut, useKeyScope } from "../../lib/keymap";
 import { pointOnSelection } from "../../lib/textSelection";
 import { useAnchoredPopover } from "./anchoredPopoverHooks";
 
-// E10 S2 — the right-click context menu's INPUT half: the gestures that open it and the row they
+// The right-click context menu's INPUT half: the gestures that open it and the row they
 // belong to. The surface itself is `<ContextMenu>` (ContextMenu.tsx); they are two files only so
 // that the component file exports a component and nothing else (react-refresh).
 //
@@ -68,8 +68,8 @@ export interface ContextMenuController<T> {
   anchor: Element | null;
   /** Spread on the element that should answer a right-click — the whole row, not a handle. */
   triggerProps: (payload: T) => Record<string, unknown>;
-  /** Spread on the row's visible "…" button (E28 C1: nothing is reachable only by a gesture). A
-   *  click opens the SAME menu under the button; a second click on it while its menu is open closes
+  /** Spread on the row's visible "…" button (DESIGN.md C1: nothing is reachable only by a gesture).
+   *  A click opens the SAME menu under the button; a second click on it while its menu is open closes
    *  it, like any menu button. Pair it with `aria-expanded` from the caller, which knows its row. */
   buttonProps: (payload: T) => Record<string, unknown>;
   /** Opens the menu at a viewport point for `payload`, anchored to `contextElement` — for an input
@@ -148,7 +148,7 @@ export function useContextMenu<T>({
   // never produce that click (a pan ends in pointercancel, the finger lifts over the portalled menu,
   // Android Chrome suppresses the trailing click after its own contextmenu). The flag then stayed
   // armed, and since it is one ref per LIST, the next genuine tap on ANY row of that list was eaten
-  // and the row looked dead until tapped twice (E10 review round 1). So a fresh press also disarms
+  // and the row looked dead until tapped twice. So a fresh press also disarms
   // it: whatever the last gesture left behind cannot outlive the start of the next one.
   const swallowClick = useRef(false);
   const cancelPress = useCallback(() => {
diff --git a/frontend/src/components/ui/useReturnFocus.dom.test.tsx b/frontend/src/components/ui/useReturnFocus.dom.test.tsx
index 2b5fdc14..b6fdf328 100644
--- a/frontend/src/components/ui/useReturnFocus.dom.test.tsx
+++ b/frontend/src/components/ui/useReturnFocus.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 audit: an in-place editor closed by a REAL Enter re-opened at once. The keydown commits and hands
+// Audit: an in-place editor closed by a REAL Enter re-opened at once. The keydown commits and hands
 // the focus back to the trigger button; the same keystroke's default action (the keypress activation)
 // then lands on that button and clicks it. A synthetic keydown has no default action, so the first
 // test passed while the live rename was broken. Arming now cancels the key's default action.
diff --git a/frontend/src/components/useChannelActions.dom.test.tsx b/frontend/src/components/useChannelActions.dom.test.tsx
index 973c9d0d..52c7d4db 100644
--- a/frontend/src/components/useChannelActions.dom.test.tsx
+++ b/frontend/src/components/useChannelActions.dom.test.tsx
@@ -1,9 +1,9 @@
 // @vitest-environment jsdom
 //
-// A subscribed channel's ONE action list (E28 C1): what the manager row's "…" (and its right-click,
+// A subscribed channel's ONE action list: what the manager row's "…" (and its right-click,
 // long-press and Shift+F10) offers — and the row buttons it replaced, now rows here: full history,
 // hide (an undo toast instead of a confirm), unsubscribe (danger, confirmed) — and the Tags and
-// Priority submenus (E28 S3e3b).
+// Priority submenus.
 import { describe, it, expect, vi, afterEach } from "vitest";
 import { renderHook, act, cleanup, waitFor } from "@testing-library/react";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
@@ -233,7 +233,7 @@ describe("useChannelActions — the Tags submenu", () => {
     expect(onToggleTag).toHaveBeenCalledWith(expect.objectContaining({ id: "UC1" }), 2);
   });
 
-  // E28 review J3: a failed /tags read said "no tags yet" — an error dressed as an empty list.
+  // A failed /tags read said "no tags yet" — an error dressed as an empty list.
   it("says the tags are loading, or failed to load, instead of 'no tags yet'", () => {
     tagsState = "loading";
     expect(row(ch(), "tags")).toMatchObject({ disabled: true, note: "common.loading" });
diff --git a/frontend/src/components/useChannelActions.tsx b/frontend/src/components/useChannelActions.tsx
index 3ba69ccd..32b2f4dd 100644
--- a/frontend/src/components/useChannelActions.tsx
+++ b/frontend/src/components/useChannelActions.tsx
@@ -14,7 +14,7 @@ import { useConfirm } from "./confirmContext";
 import { useCopyItems } from "./copyItems";
 import { type ActionMenuItem } from "./ui/ActionMenu";
 
-// A subscribed channel's ONE action list (E28 C1): the manager row's "…", its right-click, long-press
+// A subscribed channel's ONE action list: the manager row's "…", its right-click, long-press
 // and Shift+F10, in the table and in the card layout alike. The row keeps what the reader looks at
 // or tunes all the time (priority, tags, the stored count's ✓); everything that was a button on the
 // row — full history, hide, unsubscribe — is here, beside open, the pin and the copies. Tags and
@@ -33,8 +33,7 @@ export function useChannelActions({
   onOpenWizard: () => void;
   /** The reader's own tags (no system tags) — the Tags submenu lists them A–Z. */
   tags: readonly Tag[];
-  /** Whether `tags` is the answer yet: loading or failed is said as such, never as "no tags yet"
-   *  (E28 review J3). */
+  /** Whether `tags` is the answer yet: loading or failed is said as such, never as "no tags yet". */
   tagsState?: "loading" | "error" | "ready";
   onToggleTag: (c: ManagedChannel, tagId: number) => void;
   /** A priority step picked: the caller re-sorts its list and follows the row. */
diff --git a/frontend/src/components/useDebugRecording.ts b/frontend/src/components/useDebugRecording.ts
index 80837101..071ffcc1 100644
--- a/frontend/src/components/useDebugRecording.ts
+++ b/frontend/src/components/useDebugRecording.ts
@@ -18,7 +18,7 @@ import { notify } from "../lib/notifications";
 import { qk } from "../lib/queryKeys";
 import { updateMeCache, useMe } from "../lib/useMe";
 
-/** The debug recording's actions (E16), shared by everything that drives it: the pill, Settings →
+/** The debug recording's actions, shared by everything that drives it: the pill, Settings →
  *  Diagnosztika and the command palette. The session itself is `me.debug_session` — the server's
  *  answer, so a reload, another tab or the cap all show the same thing. */
 export function useDebugRecording() {
diff --git a/frontend/src/components/useDownloadActions.tsx b/frontend/src/components/useDownloadActions.tsx
index 23e7a70d..aa549678 100644
--- a/frontend/src/components/useDownloadActions.tsx
+++ b/frontend/src/components/useDownloadActions.tsx
@@ -26,7 +26,7 @@ import { jobTitle } from "./downloadTitle";
 import { type ActionMenuItem } from "./ui/ActionMenu";
 import { menuGroups } from "./ui/menuGroups";
 
-// A download's ONE action list (E28 C1): the row's "…", its right-click, long-press and Shift+F10,
+// A download's ONE action list: the row's "…", its right-click, long-press and Shift+F10,
 // on the queue, the library and the shared tab. The row keeps its primary action (play; pause /
 // resume / retry in the queue), the save link and its state (the error and its details) in sight;
 // a library row also keeps Share (the link copy) in sight, ahead of save. The rest — the editors,
@@ -81,7 +81,7 @@ export function useDownloadActions({
     if (await confirm({ title, message: body, confirmLabel: action, danger: true })) fn();
   };
 
-  // One-click share (E7 S3 · D2-A): ensure a downloadable link, copy it, toast with "open in new tab"
+  // One-click share: ensure a downloadable link, copy it, toast with "open in new tab"
   // (see quickShareLink). Re-choosing reuses the existing link; a per-job in-flight guard also stops a
   // double pick from racing two POSTs into two links before the cache is primed. Advanced controls
   // (password, expiry, revoke, share-with-a-user) live in the Share dialog, "Manage sharing".
@@ -233,7 +233,7 @@ export function useDownloadActions({
   }
 
   function sharedItems(job: DownloadJob): ActionMenuItem[] {
-    // Same media_kind + can_download gate as the library, via the shared helper (S5b).
+    // Same media_kind + can_download gate as the library, via the shared helper.
     const a = sharedRowActions(job);
     return menuGroups(
       [...(a.play ? [play(job)] : []), ...(a.save ? [save(job)] : [])],
diff --git a/frontend/src/components/usePlaylistActions.dom.test.tsx b/frontend/src/components/usePlaylistActions.dom.test.tsx
index 3f88c256..91034958 100644
--- a/frontend/src/components/usePlaylistActions.dom.test.tsx
+++ b/frontend/src/components/usePlaylistActions.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// A failed playlist delete is reported once (deep-review round 3 of bug hunt 2026-09). `req` already
+// A failed playlist delete is reported once (a bug hunt, 2026-09). `req` already
 // opens the blocking error dialog for a 422 (a YouTube-side delete failure) and a 5xx; the delete
 // then toasted the same failure as well — in English, before the router's errors were structured.
 import { describe, it, expect, vi, afterEach } from "vitest";
@@ -68,7 +68,7 @@ describe("usePlaylistActions — deleting a list", () => {
 
   it("does say one it was left to handle — in the reader's language", async () => {
     // A plain-string `detail` is whatever English the route hand-wrote, so it is never shown: the
-    // caller's translated title says what failed, and the status says why (deep-review round 5, S2b).
+    // caller's translated title says what failed, and the status says why.
     vi.spyOn(api, "deletePlaylist").mockRejectedValue(new HttpError(404, "Unknown playlist"));
     const { result } = mount();
     await act(() => result.current.remove(linked));
@@ -92,7 +92,7 @@ describe("usePlaylistActions — deleting a list", () => {
   });
 });
 
-// E28 C1: ONE list per playlist, which the rail row and the page header's "…" both open — rename,
+// ONE list per playlist, which the rail row and the page header's "…" both open — rename,
 // the pin, YouTube (open / push / revert) and delete, grouped, the destructive rows last.
 describe("usePlaylistActions — a playlist's menu", () => {
   const pin = [{ id: "pin", label: "pin", onSelect: () => {} }];
@@ -156,7 +156,7 @@ describe("usePlaylistActions — a playlist's menu", () => {
     }
   });
 
-  // E28 review L6: every object's menu copies its name and link (the finger cannot select them);
+  // Every object's menu copies its name and link (the finger cannot select them);
   // the playlist's did not.
   it("copies the list's name, and a linked list's YouTube address", () => {
     const items = rows(linked);
@@ -177,7 +177,7 @@ describe("usePlaylistActions — a playlist's menu", () => {
   });
 });
 
-// E28 review C1: the push / revert in-flight flag was per hook instance, and two instances run at
+// The push / revert in-flight flag was per hook instance, and two instances run at
 // once (the rail row's menu and the list page header's "…") — a push started from one left the other
 // offering a second push of the same list.
 describe("usePlaylistActions — one push at a time, across menus", () => {
@@ -201,7 +201,7 @@ describe("usePlaylistActions — one push at a time, across menus", () => {
     expect(push(header).disabled).toBeFalsy();
   });
 
-  // Round 2 (F9): the running push was ONE slot for the app — another list's push, from a row that
+  // The running push was ONE slot for the app — another list's push, from a row that
   // looked enabled, was refused without a word.
   it("a push of one list leaves another list's push free, and its own revert off", async () => {
     type Plan = Awaited<ReturnType<typeof api.playlistPushPlan>>;
diff --git a/frontend/src/components/usePlaylistActions.tsx b/frontend/src/components/usePlaylistActions.tsx
index 57248215..0a32a1e0 100644
--- a/frontend/src/components/usePlaylistActions.tsx
+++ b/frontend/src/components/usePlaylistActions.tsx
@@ -15,7 +15,7 @@ import { type ActionMenuItem } from "./ui/ActionMenu";
 import { createStore } from "../lib/store";
 import { useCopyItems } from "./copyItems";
 
-// A playlist's ONE action list (E28 C1) and the mutations behind it. Two entry points open it — the
+// A playlist's ONE action list and the mutations behind it. Two entry points open it — the
 // rail row (right-click, long-press, its "…") and the list page header's "…" — so it lives here,
 // not in either caller: the delete is not one API call but a dialog whose SHAPE depends on whether
 // the list is linked to YouTube, plus the "what gets selected next" dance, and the push is a plan, a
@@ -28,9 +28,9 @@ type Menuable = Pick<Playlist, "id" | "name" | "kind" | "yt_playlist_id" | "dirt
 
 // Which lists a push / revert is running for, so their rows are off (and say so) until it is done.
 // ONE for the app, not per hook: the rail row's menu and the list page header's "…" are two instances
-// at once, and a per-instance flag left the other offering a second push of the same list (E28 review
-// C1). Per LIST, not one slot: a single id refused a push of ANOTHER list, silently, from a row that
-// looked enabled (round 2, F9) — and the server serializes a list's syncs anyway (`sync_claim`).
+// at once, and a per-instance flag left the other offering a second push of the same list.
+// Per LIST, not one slot: a single id refused a push of ANOTHER list, silently, from a row that
+// looked enabled — and the server serializes a list's syncs anyway (`sync_claim`).
 // Read with `get()` at the start, so a second start refuses before any render has happened.
 type Running = ReadonlySet<number>;
 const inFlight = createStore<{ pushing: Running; reverting: Running }>({
@@ -241,8 +241,8 @@ export function usePlaylistActions() {
     const builtin = pl.kind === "watch_later";
     const linked = !builtin && !!pl.yt_playlist_id;
     // Interpolated, not spelled out: the HU copy said "Watch later", a name the Hungarian UI never
-    // shows for this list ("Megnézem később") — so the message named a list the reader had never seen
-    // (E10 review round 1). Passing the localized name makes the two impossible to drift.
+    // shows for this list ("Megnézem később") — so the message named a list the reader had never seen.
+    // Passing the localized name makes the two impossible to drift.
     const lockedNote = builtin
       ? t("playlists.builtinLocked", { name: t("playlists.watchLater") })
       : undefined;
@@ -304,7 +304,7 @@ export function usePlaylistActions() {
         note: lockedNote,
         onSelect: onRename,
       },
-      // Its name and, when linked, its YouTube address — every object's menu copies them (E28 L6).
+      // Its name and, when linked, its YouTube address — every object's menu copies them.
       ...copy(playlistName(pl, t), ytUrl, "name"),
       ...pin,
       ...youtube.map((it, i) => ({ ...it, separatorBefore: i === 0 })),
diff --git a/frontend/src/components/usePlexActiveFilters.dom.test.tsx b/frontend/src/components/usePlexActiveFilters.dom.test.tsx
index b5ca2b93..14ea758f 100644
--- a/frontend/src/components/usePlexActiveFilters.dom.test.tsx
+++ b/frontend/src/components/usePlexActiveFilters.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Guards the S3 behavior change: the active-filter chip row (usePlexActiveFilters) still emits chips
+// Guards a behavior change: the active-filter chip row (usePlexActiveFilters) still emits chips
 // for the in-panel narrowings (expanded filters + watch-state) but NO LONGER emits a sort chip —
 // sort is an always-visible control above the grid now, like the Feed. i18n is key-passthrough and
 // the provider is mocked so the hook can be driven with a non-default sort present.
@@ -65,7 +65,7 @@ describe("usePlexActiveFilters", () => {
     expect(result.current.every((c) => !c.key.startsWith("sort"))).toBe(true);
   });
 
-  // E31 S1: the chip read Plex's English word ("Not Rated") under a Hungarian UI.
+  // The chip read Plex's English word ("Not Rated") under a Hungarian UI.
   it("names a certificate chip through the vocabulary, keeping Plex's value as the key", () => {
     const { result } = renderHook(() => usePlexActiveFilters(), { wrapper });
     const chip = result.current.find((c) => c.key === "contentRating:Not Rated");
diff --git a/frontend/src/components/usePlexActiveFilters.ts b/frontend/src/components/usePlexActiveFilters.ts
index a9716b9e..23c0876c 100644
--- a/frontend/src/components/usePlexActiveFilters.ts
+++ b/frontend/src/components/usePlexActiveFilters.ts
@@ -12,7 +12,7 @@ import { usePlexCollectionTitles } from "../lib/usePlexCollectionTitles";
 // the feed has, instead of the narrowing being visible only inside the collapsed sidebar. Labels reuse
 // the existing plex.* i18n keys; multi-value dimensions (genres, people, ratings) emit one chip each so
 // removing one keeps the rest (same shape as the feed's tag/channel chips). Sort is NOT a chip here —
-// it's an always-visible control above the grid (S3), like the feed. Lives here, not in lib, because
+// it's an always-visible control above the grid, like the feed. Lives here, not in lib, because
 // it reads the Plex provider (lib stays provider-free, like useActiveFilters).
 type TFn = (key: string, options?: Record<string, unknown>) => string;
 
diff --git a/frontend/src/components/usePlexCardActions.tsx b/frontend/src/components/usePlexCardActions.tsx
index 523dfad0..069d39ef 100644
--- a/frontend/src/components/usePlexCardActions.tsx
+++ b/frontend/src/components/usePlexCardActions.tsx
@@ -8,7 +8,7 @@ import { useCopyItems } from "./copyItems";
 import PlexPlaylistAdd, { type PlexAddTarget } from "./PlexPlaylistAdd";
 import { type ActionMenuItem } from "./ui/ActionMenu";
 
-// E28 C1 — a Plex title's ONE action list (docs/DESIGN.md "Action placement"): the right-click, the
+// A Plex title's ONE action list (docs/DESIGN.md "Action placement"): the right-click, the
 // long-press, Shift+F10 and the card's "…" open a menu built here, so every poster grid and rail
 // lists the same actions in the same order. The card keeps its state (watched, progress) at rest and
 // the everyday toggles (watched, add to playlist) on hover; details, copy and the pin live here.
diff --git a/frontend/src/components/usePlexPlaylistEdits.dom.test.tsx b/frontend/src/components/usePlexPlaylistEdits.dom.test.tsx
index 8098dfdc..046c09e3 100644
--- a/frontend/src/components/usePlexPlaylistEdits.dom.test.tsx
+++ b/frontend/src/components/usePlexPlaylistEdits.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // The Plex playlist's reorder is a dnd-kit drag, and neither of dnd-kit's sensors activates under
 // jsdom — so `commit()`'s failure path, the one edit written as a promise chain (the easiest to lose
-// in an async/await refactor), was unreachable from any test (deep-review round 5). The writes live
+// in an async/await refactor), was unreachable from any test. The writes live
 // in this hook now, and are driven directly.
 import { describe, it, expect, vi, afterEach } from "vitest";
 import { renderHook, waitFor, act, cleanup } from "@testing-library/react";
@@ -85,7 +85,7 @@ describe("usePlexPlaylistEdits · the reorder", () => {
   // B2, settled here rather than in a browser: `putBack` must read the cache AT ROLLBACK TIME. A
   // removal that landed while the reorder was in flight refreshed the list; a rollback bound to the
   // render that STARTED the reorder put the removed row back on screen, where no refetch cleared it
-  // and the next drag persisted an order containing it (deep-review round 5).
+  // and the next drag persisted an order containing it.
   it("rolls back to the list as it is NOW, not as it was when the reorder began", async () => {
     const { hook, qc, detail } = setup([movie("1"), movie("2"), movie("3")]);
     await waitFor(() => expect(hook.result.current.items).toHaveLength(3));
@@ -131,7 +131,7 @@ describe("usePlexPlaylistEdits · the removal", () => {
     expect(notify.mock.calls.some(([n]) => n.action)).toBe(false);
   });
 
-  // E28 C1: no confirm — the toast's Undo is the way back, and it puts each row where it stood.
+  // No confirm — the toast's Undo is the way back, and it puts each row where it stood.
   it("says what went, and its Undo puts the rows back at their own indices in one request", async () => {
     const { hook, detail } = setup([movie("1"), movie("2"), movie("3"), movie("4")]);
     await waitFor(() => expect(hook.result.current.items).toHaveLength(4));
@@ -151,7 +151,7 @@ describe("usePlexPlaylistEdits · the removal", () => {
     expect(add).toHaveBeenCalledWith(5, ["2", "4"], [1, 3]);
   });
 
-  // E28 review C4: a raw index drifts when the list changes before the Undo — another tab added a
+  // A raw index drifts when the list changes before the Undo — another tab added a
   // row at the top — and the row came back one place off. It goes back after its old neighbour.
   it("puts a row back after its neighbour when the list changed before the Undo", async () => {
     const { hook, detail } = setup([movie("1"), movie("2"), movie("3")]);
diff --git a/frontend/src/components/usePlexPlaylistEdits.ts b/frontend/src/components/usePlexPlaylistEdits.ts
index 925e8327..6c8a70f8 100644
--- a/frontend/src/components/usePlexPlaylistEdits.ts
+++ b/frontend/src/components/usePlexPlaylistEdits.ts
@@ -16,7 +16,7 @@ export function usePlexPlaylistEdits(playlistId: number) {
   const { t, i18n } = useTranslation();
   const qc = useQueryClient();
   const [busy, setBusy] = useState(false);
-  // The rows' titles are in the reader's language (E30), so the cache entry is per language — and ONE
+  // The rows' titles are in the reader's language, so the cache entry is per language — and ONE
   // key serves the read and every write below (setQueryData matches exactly).
   const lang = plexLang(i18n.language);
   const key = qk.plexPlaylist(playlistId, lang);
@@ -39,13 +39,13 @@ export function usePlexPlaylistEdits(playlistId: number) {
   // Every edit here is optimistic on the local copy, and none of them used to handle a failure: a
   // removal that failed stayed removed on screen (the resync never ran), and a 404 — the playlist
   // deleted on another device, now a structured `not_found` — was an unhandled rejection that said
-  // nothing at all (deep-review round 4; the YouTube side was fixed in round 3). A failure is said,
+  // nothing at all (the YouTube side was fixed first). A failure is said,
   // and the rows are put back from what the server last sent — explicitly, because a resync that
   // returns the same list keeps the same `q.data` and the re-sync effect above never runs.
   // Read the cache AT ROLLBACK TIME, not the `q.data` of the render that bound the failing handler:
   // a removal completing while a reorder was in flight refreshed the list, and the reorder's stale
   // closure then put the removed row back on screen — where the deep-equal refetch could not clear
-  // it, and the next drag persisted an order containing it (deep-review round 5). `Playlists.tsx`'s
+  // it, and the next drag persisted an order containing it. `Playlists.tsx`'s
   // sibling `restoreFromCache` reads it live for the same reason.
   const putBack = () => {
     const cur = qc.getQueryData<{ items: PlexCard[] }>(key);
@@ -66,8 +66,8 @@ export function usePlexPlaylistEdits(playlistId: number) {
         // `putBack` rolls back to and what a re-entry inside the 30 s staleTime renders without
         // refetching — so after an accepted reorder it showed the pre-reorder order again, and the
         // next drag from there persisted it, silently undoing the one the server took. The
-        // YouTube sibling (`Playlists.tsx`) got this in round 5; this half was left behind (round
-        // 6). One accepted write, one cache entry that matches it.
+        // YouTube sibling (`Playlists.tsx`) got this first; this half was left behind.
+        // One accepted write, one cache entry that matches it.
         qc.setQueryData<{ items: PlexCard[] }>(key, (old) => (old ? { ...old, items: next } : old));
         qc.invalidateQueries({ queryKey: qk.plexPlaylist(playlistId) });
         // …and then REFETCH it, exactly as the sibling does. `next` is this render's membership, and
@@ -75,7 +75,7 @@ export function usePlexPlaylistEdits(playlistId: number) {
         // removed from another surface, an item added elsewhere) is clobbered by that write. With
         // only the list key invalidated nothing corrected it: staleTime is 30 s and
         // refetchOnWindowFocus is off, so the wrong membership stayed on screen for as long as the
-        // view was mounted and the next drag persisted an order built from it (round 7).
+        // view was mounted and the next drag persisted an order built from it.
         qc.invalidateQueries({ queryKey: qk.plexPlaylists() });
       })
       .catch((e: unknown) => {
@@ -85,7 +85,7 @@ export function usePlexPlaylistEdits(playlistId: number) {
   }
 
   /** Take `keys` out — one row, a season or a whole show — with no confirm: the toast's Undo puts
-   *  each row back where it stood (E28 C1, the same bargain as a YouTube playlist's rows) — after
+   *  each row back where it stood (C1 in DESIGN.md: the same bargain as a YouTube playlist's rows) — after
    *  its old neighbour in the list as it is at Undo time (`reinsertAt`), since a raw index drifts
    *  once anything changes in between. `title` names what went in that toast. */
   async function onRemove(keys: string[], title: string) {
diff --git a/frontend/src/components/useTagSuggestions.dom.test.tsx b/frontend/src/components/useTagSuggestions.dom.test.tsx
index b87a46da..2ddafc61 100644
--- a/frontend/src/components/useTagSuggestions.dom.test.tsx
+++ b/frontend/src/components/useTagSuggestions.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Container-logic contract of the tag-suggestion hook (E8·S4), the wiring the presentational
+// Container-logic contract of the tag-suggestion hook, the wiring the presentational
 // ChannelTagsControl test can't reach: suggestionsFor resolves tag ids to Tags and DROPS a suggestion
 // whose tag was deleted since the last compute; accept optimistically removes the WHOLE channel from
 // the /tags/suggestions cache and toggles the tag on; dismiss is session-only and scoped to one
diff --git a/frontend/src/components/useTagSuggestions.ts b/frontend/src/components/useTagSuggestions.ts
index c527a7c3..0433fce0 100644
--- a/frontend/src/components/useTagSuggestions.ts
+++ b/frontend/src/components/useTagSuggestions.ts
@@ -13,7 +13,7 @@ const HIGH_CONFIDENCE = 0.9;
 
 type VisibleSuggestion = { cid: string; tagId: number; confidence: number };
 
-/** Suggested-tag state for the Channel Manager (E8·S4): the /tags/suggestions query, a session-only
+/** Suggested-tag state for the Channel Manager: the /tags/suggestions query, a session-only
  *  dismiss set, and the accept / dismiss / bulk-accept actions. Suggestions are learned from the
  *  user's own manual-tag pattern and shown as ghost chips on UNTAGGED channels. Extracted as a hook
  *  (like useChannelTagActions) so the optimistic-cache and dismiss logic is unit-testable apart from
diff --git a/frontend/src/components/useVideoActions.dom.test.tsx b/frontend/src/components/useVideoActions.dom.test.tsx
index 269b2c07..1045a934 100644
--- a/frontend/src/components/useVideoActions.dom.test.tsx
+++ b/frontend/src/components/useVideoActions.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 review J4: the video menu's download row was labelled with the download's STATE ("Downloaded",
+// The video menu's download row was labelled with the download's STATE ("Downloaded",
 // "In queue") — a row that reads as a status yet opens the download dialog. It is "Download…" now,
 // the state riding along as the row's hint.
 import type { ReactNode } from "react";
@@ -44,7 +44,7 @@ function downloadRow(state: string | undefined) {
 }
 
 describe("the video menu's download row", () => {
-  // Round 2 (F5): the state rode in a `title`, which a key or a finger never shows.
+  // The state rode in a `title`, which a key or a finger never shows.
   it("says what it does, whatever the state, and carries the state as its note", async () => {
     const done = downloadRow("done");
     await waitFor(() => expect(done().note).toBe("downloads.button.downloaded"));
diff --git a/frontend/src/components/useVideoActions.tsx b/frontend/src/components/useVideoActions.tsx
index 2b23bb0a..a213515a 100644
--- a/frontend/src/components/useVideoActions.tsx
+++ b/frontend/src/components/useVideoActions.tsx
@@ -1,6 +1,6 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
-import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { useQuery } from "@tanstack/react-query";
 import {
   Bookmark,
   BookmarkX,
@@ -17,7 +17,7 @@ import {
   Undo2,
 } from "lucide-react";
 
-import { api, type Me, type Video, type VideoStatus } from "../lib/api";
+import { api, type Video, type VideoStatus } from "../lib/api";
 import { isResettable } from "../lib/api/feed";
 import { qk } from "../lib/queryKeys";
 import { pinVideo, useComfortPin } from "./comfortPin";
@@ -26,7 +26,7 @@ import { useNavigationActions } from "./navigationContext";
 import { type ActionMenuItem } from "./ui/ActionMenu";
 import { VideoFollowUp, type VideoFollowUpState } from "./VideoFollowUp";
 
-// E28 C1 — a video's ONE action list (docs/DESIGN.md "Action placement"). The right-click, the
+// A video's ONE action list (docs/DESIGN.md "Action placement"). The right-click, the
 // long-press, Shift+F10 and the card's "…" all open a menu built here, so the feed, a channel page
 // and the Home shelves list the same actions in the same order. The card itself keeps only its
 // state and the everyday toggles (watched, save, add to playlist) on hover; everything else —
@@ -48,17 +48,13 @@ const icon = "w-4 h-4";
  *  panel to render beside the menu (one per list). */
 export function useVideoActions(handlers: VideoActionHandlers, open: boolean) {
   const { t } = useTranslation();
-  const qc = useQueryClient();
   const { openChannel } = useNavigationActions();
   const pin = useComfortPin(open);
   const copy = useCopyItems();
-  // Downloads spend server disk and need a real identity: the demo account has none (as the
-  // player's DownloadButton).
-  const canDownload = !qc.getQueryData<Me>(qk.me())?.is_demo;
   const index = useQuery({
     queryKey: qk.downloadIndex(),
     queryFn: api.downloadIndex,
-    enabled: open && canDownload,
+    enabled: open,
     staleTime: 10000,
   });
   const [followUp, setFollowUp] = useState<VideoFollowUpState | null>(null);
@@ -75,8 +71,8 @@ export function useVideoActions(handlers: VideoActionHandlers, open: boolean) {
     const inProgress = v.position_seconds > 0 && !watched;
     const dl = index.data?.[v.id];
     // The row opens the download dialog, so it says so; the download's state is the line under its
-    // label — "Downloaded" read as a status, not as a row that opens something (E28 review J4) — and
-    // not a `title`, which a key or a finger never shows (round 2, F5).
+    // label — "Downloaded" read as a status, not as a row that opens something — and
+    // not a `title`, which a key or a finger never shows.
     const dlState =
       dl === "done"
         ? t("downloads.button.downloaded")
@@ -139,17 +135,13 @@ export function useVideoActions(handlers: VideoActionHandlers, open: boolean) {
             },
           ]
         : []),
-      ...(canDownload
-        ? [
-            {
-              id: "download",
-              label: t("downloads.menu.download"),
-              note: dlState,
-              icon: <Download className={icon} />,
-              onSelect: () => setFollowUp({ kind: "download", video: v }),
-            },
-          ]
-        : []),
+      {
+        id: "download",
+        label: t("downloads.menu.download"),
+        note: dlState,
+        icon: <Download className={icon} />,
+        onSelect: () => setFollowUp({ kind: "download", video: v }),
+      },
       ...(details
         ? [
             {
diff --git a/frontend/src/components/welcomeMode.render.dom.test.tsx b/frontend/src/components/welcomeMode.render.dom.test.tsx
index 13172a1c..8d306a3c 100644
--- a/frontend/src/components/welcomeMode.render.dom.test.tsx
+++ b/frontend/src/components/welcomeMode.render.dom.test.tsx
@@ -137,9 +137,9 @@ describe("the verification outcome handed down from App", () => {
 });
 
 describe("the screenshot lightbox", () => {
-  // The fourth `aria-modal` surface in the app, and the one the round-5 focus extraction did not
+  // The fourth `aria-modal` surface in the app, and the one the focus extraction did not
   // sweep in: it declared itself a modal dialog while leaving focus on the thumbnail behind an
-  // 80%-black scrim and letting Tab walk the landing page underneath (round 6).
+  // 80%-black scrim and letting Tab walk the landing page underneath.
   let origDesc: PropertyDescriptor | undefined;
   beforeEach(() => {
     origDesc = Object.getOwnPropertyDescriptor(HTMLElement.prototype, "offsetParent");
@@ -181,11 +181,11 @@ describe("the screenshot lightbox", () => {
   });
 
   it("defers its Escape and its Tab to a layer opened above it", async () => {
-    // Round 6 gave this shell the trap and the restore but not the LAYER MEMBERSHIP the other
+    // One fix gave this shell the trap and the restore but not the LAYER MEMBERSHIP the other
     // three have, so both fired from a raw window listener no matter what was on top. That is the
     // shape the wizard's own comment records being bitten by ("one Esc closed the error AND ended
     // onboarding"), and it was unreachable here only because `App` renders `<Welcome/>` before it
-    // mounts `ErrorDialog` and the Toaster — an ordering nothing enforces (round 7).
+    // mounts `ErrorDialog` and the Toaster — an ordering nothing enforces.
     const { panel } = await openIt();
     const above = pushLayer(); // whatever the landing page grows next
     try {
diff --git a/frontend/src/content/release-notes/en.json b/frontend/src/content/release-notes/en.json
index eb8b480c..f9418aef 100644
--- a/frontend/src/content/release-notes/en.json
+++ b/frontend/src/content/release-notes/en.json
@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.100.0",
+    "date": "2026-10-05",
+    "new": [
+      "Direct messages are gone: the Messages page, the chat dock and their encryption keys were removed with their stored messages, and the privacy policy no longer describes end-to-end encrypted chat.",
+      "The shared demo account is gone, with its sign-in entry and its whitelist."
+    ],
+    "fixed": [
+      "Sign-in security without email: when a Google sign-in takes over an account someone else registered first, or makes it an admin through the admin list, its password is cleared and its sessions end. The owner sets a new one in Settings.",
+      "Pressing Back onto a page that no longer exists opens the feed instead of breaking the app.",
+      "Behind the scenes: tidier checks and comments across the code."
+    ]
+  },
   {
     "version": "0.99.2",
     "date": "2026-10-04",
diff --git a/frontend/src/content/release-notes/hu.json b/frontend/src/content/release-notes/hu.json
index 86b8e971..f62c2b44 100644
--- a/frontend/src/content/release-notes/hu.json
+++ b/frontend/src/content/release-notes/hu.json
@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.100.0",
+    "date": "2026-10-05",
+    "new": [
+      "Megszűntek a közvetlen üzenetek: az Üzenetek oldal, a csevegőablak és a titkosítási kulcsok a tárolt üzenetekkel együtt eltűntek, és az adatvédelmi tájékoztató már nem ír végponttól végpontig titkosított csevegésről.",
+      "Megszűnt a közös demófiók, a belépési lehetőségével és az engedélylistájával együtt."
+    ],
+    "fixed": [
+      "Bejelentkezési biztonság e-mail nélkül: ha egy Google-belépés átvesz egy fiókot, amelyet más regisztrált előbb, vagy az adminlista alapján adminná teszi, a jelszava törlődik és a munkamenetei véget érnek. Újat a Beállításokban lehet megadni.",
+      "Ha a Vissza gomb egy már nem létező oldalra vinne, a hírfolyam nyílik meg, és az alkalmazás nem omlik össze.",
+      "A háttérben: rendezettebb ellenőrzések és kommentek a kódban."
+    ]
+  },
   {
     "version": "0.99.2",
     "date": "2026-10-04",
diff --git a/frontend/src/design-lab/DesignLab.tsx b/frontend/src/design-lab/DesignLab.tsx
index 42a71cdd..33a3233b 100644
--- a/frontend/src/design-lab/DesignLab.tsx
+++ b/frontend/src/design-lab/DesignLab.tsx
@@ -8,14 +8,14 @@ import { Chip } from "../components/ui/Chip";
 import { Slider } from "../components/ui/NativeControls";
 import { SURFACE } from "../components/ui/surfaces";
 
-// The design lab (E28): the living style guide. Dev-only — see main.tsx and devOnlyGuard.ts. It sits
+// The design lab: the living style guide. Dev-only — see main.tsx and devOnlyGuard.ts. It sits
 // OUTSIDE <App>, so it owns the theme attributes on <html> itself, through the same data-theme /
 // data-scheme / --font-scale / data-backdrop switches the app's PrefsProvider drives. Nothing here
 // is saved: the lab's bar changes this tab only.
 
 type Look = { mode: "dark" | "light"; scheme: Scheme; fontScale: number; backdrop: boolean };
 
-// The owner's own daily look (E28 S1 inventory) is the starting point — decisions are taken on it.
+// The owner's own daily look (as inventoried) is the starting point — decisions are taken on it.
 const START: Look = { mode: "dark", scheme: "midnight", fontScale: 1.02, backdrop: true };
 
 function applyLook(l: Look) {
@@ -114,7 +114,7 @@ export default function DesignLab() {
         <header id="decided-c" className="mt-6 scroll-mt-20">
           <h2 className="text-xl font-bold">Decided · batch C, behaviour and device</h2>
           <p className="text-sm text-muted">
-            C1 is the action classification S3 builds each object&apos;s one action list from.
+            C1 is the action classification each object&apos;s one action list is built from.
           </p>
         </header>
         <BatchC />
diff --git a/frontend/src/design-lab/batchA.tsx b/frontend/src/design-lab/batchA.tsx
index 6f455f6f..9bab6bc6 100644
--- a/frontend/src/design-lab/batchA.tsx
+++ b/frontend/src/design-lab/batchA.tsx
@@ -20,13 +20,13 @@ import { fieldClass } from "../components/ui/fieldStyles";
 import { SelectTrigger } from "../components/ui/SelectTrigger";
 import { SwitchRow } from "../components/ui/form";
 
-// E28 S2 · Batch A — controls, DECIDED (owner, 2026-09-24: all six as recommended), rendered with the
+// Batch A — controls, DECIDED (owner, 2026-09-24: all six as recommended), rendered with the
 // batch B decisions that refine them: B1's compact ladder and B3's state layers. Only the chosen
-// rendering of each stays, as the reference the S3 primitives are built to. Wired to no data.
+// rendering of each stays, as the reference the ui/ primitives are built to. Wired to no data.
 
 type Tone = "primary" | "ghost" | "outline" | "glass" | "danger";
 
-// The lab renders the shipped primitives (E28 S3b), so a reference can never drift from the app.
+// The lab renders the shipped primitives, so a reference can never drift from the app.
 export function Btn({
   tone,
   size,
@@ -67,7 +67,6 @@ function TouchRow() {
   return (
     <div className="flex flex-col gap-2">
       <div className="flex flex-wrap items-center gap-2">
-        {/* eslint-disable-next-line no-restricted-syntax -- a drawing of the segmented control, not a label */}
         <span className="inline-flex rounded-full border border-border bg-card p-0.5 text-xs">
           <span className={clsx(pill, "rounded-full bg-accent text-accent-fg")}>Mine</span>
           <span className={clsx(pill, "rounded-full text-muted")}>Library</span>
diff --git a/frontend/src/design-lab/batchB.tsx b/frontend/src/design-lab/batchB.tsx
index a4b3b2f0..4153cdf2 100644
--- a/frontend/src/design-lab/batchB.tsx
+++ b/frontend/src/design-lab/batchB.tsx
@@ -9,7 +9,6 @@ import {
   Home,
   ListVideo,
   Lock,
-  MessageSquare,
   PlayCircle,
   Repeat,
   Settings,
@@ -28,7 +27,7 @@ import { SelectTrigger } from "../components/ui/SelectTrigger";
 import { SkeletonShapes } from "../components/ui/Skeleton";
 import { Button } from "../components/ui/Button";
 
-// E28 S2 · Batch B — surfaces, chrome and colour, DECIDED (owner, 2026-09-24): every recommendation,
+// Batch B — surfaces, chrome and colour, DECIDED (owner, 2026-09-24): every recommendation,
 // except B7, where the owner combined the soft tint + edge bar with optional labels. B1 (density) and
 // B3 (state layers) render inside batch A's references. Only the chosen rendering of each stays.
 
@@ -290,7 +289,6 @@ const NAV: NavDef[] = [
   { icon: ListVideo, en: "Playlists", hu: "Listák" },
   { icon: Clapperboard, en: "Plex", hu: "Plex" },
   { icon: Bell, en: "Alerts", hu: "Értesítés" },
-  { icon: MessageSquare, en: "Messages", hu: "Üzenetek" },
   { icon: Download, en: "Downloads", hu: "Letöltések" },
 ];
 const SYSTEM: NavDef[] = [
diff --git a/frontend/src/design-lab/batchC.tsx b/frontend/src/design-lab/batchC.tsx
index c5895432..a8e3985b 100644
--- a/frontend/src/design-lab/batchC.tsx
+++ b/frontend/src/design-lab/batchC.tsx
@@ -31,8 +31,8 @@ import { fieldClass } from "../components/ui/fieldStyles";
 // The ui/ primitives' own classes on static spans: the lab draws what the app ships, not a copy.
 const ICON = iconButtonClass({ variant: "ghost", size: "sm" });
 
-// E28 S2 · Batch C — behaviour on touch and on a narrow window, DECIDED (owner, 2026-09-24): C1–C4 as
-// proposed; C5 is the owner's reworked Plex control set (found by the live player pass, E28 S2d: the
+// Batch C — behaviour on touch and on a narrow window, DECIDED (owner, 2026-09-24): C1–C4 as
+// proposed; C5 is the owner's reworked Plex control set (found by the live player pass: the
 // old row ran off-screen below 1024) with the two refinements they accepted. References only.
 
 const ico = "w-4 h-4";
diff --git a/frontend/src/design-lab/batchCActions.tsx b/frontend/src/design-lab/batchCActions.tsx
index 0caff28e..ecb4b02f 100644
--- a/frontend/src/design-lab/batchCActions.tsx
+++ b/frontend/src/design-lab/batchCActions.tsx
@@ -5,9 +5,9 @@ import { LAYER } from "./labTokens";
 import { iconButtonClass } from "../components/ui/buttonStyles";
 import { SURFACE } from "../components/ui/surfaces";
 
-// E28 S2 · Batch C, part 1 — action placement: the classification table (object × action → where it
-// lives), DECIDED (owner, 2026-09-24: accepted as proposed). It is the source S3 builds each object's
-// ONE action list from. It applies
+// Batch C, part 1 — action placement: the classification table (object × action → where it
+// lives), DECIDED (owner, 2026-09-24: accepted as proposed). It is the source each object's
+// ONE action list is built from. It applies
 // the decided guard rails (DESIGN.md "Action placement"): ONE action list per object feeds every
 // trigger; the primary action and visible state stay on the object; rare, secondary and destructive
 // actions go to the menu; nothing is gesture-only, because the "…" button opens the same menu.
@@ -19,7 +19,7 @@ type Row = {
   mouse: Where;
   /** touch card / row: visible, or reached through "…" */
   touch: "visible" | "…";
-  /** what changes against today (the S2 inventory), empty when nothing does */
+  /** what changes against today's actions, empty when nothing does */
   change?: string;
   danger?: boolean;
 };
diff --git a/frontend/src/design-lab/batchD.tsx b/frontend/src/design-lab/batchD.tsx
index 5d7e6c42..f65e3089 100644
--- a/frontend/src/design-lab/batchD.tsx
+++ b/frontend/src/design-lab/batchD.tsx
@@ -13,7 +13,7 @@ import {
 import { iconButtonClass } from "../components/ui/buttonStyles";
 import { HOVER_YIELD } from "../components/ui/reveal";
 
-// E28 S3h — the one media card, DECIDED (owner, 2026-09-26/27: anatomy C, shelf density, the preview
+// The one media card, DECIDED (owner, 2026-09-26/27: anatomy C, shelf density, the preview
 // C, the Home hero A, list row B, info layout B). Drawn with the real ui/MediaCard and its classes;
 // hover a card to see its Play and its hover row. The preview panel, the hero and the info page are
 // live in the app (Plex, Home), not copied here.
diff --git a/frontend/src/design-lab/labKit.tsx b/frontend/src/design-lab/labKit.tsx
index 55873e24..b5332f59 100644
--- a/frontend/src/design-lab/labKit.tsx
+++ b/frontend/src/design-lab/labKit.tsx
@@ -2,9 +2,9 @@ import { useSyncExternalStore, type ReactNode } from "react";
 import clsx from "clsx";
 import { SURFACE } from "../components/ui/surfaces";
 
-// Building blocks of the design lab. Every E28 decision is taken, so the lab is the reference half
+// Building blocks of the design lab. Every decision is taken, so the lab is the reference half
 // only: each <Reference> is the chosen rendering with the rule it became. A new design round brings
-// back the side-by-side <Decision>/<Variant> pair (E28 S2 history) for its open questions. Everything
+// back the side-by-side <Decision>/<Variant> pair (as before) for its open questions. Everything
 // is static markup on purpose: a rendering that only exists here must not need app state.
 
 /** A decision already taken: the chosen rendering only, with the rule it became. The lab's
diff --git a/frontend/src/design-lab/labTokens.ts b/frontend/src/design-lab/labTokens.ts
index ea28b967..96e00342 100644
--- a/frontend/src/design-lab/labTokens.ts
+++ b/frontend/src/design-lab/labTokens.ts
@@ -1,5 +1,5 @@
 // The decided values the lab's reference renderings share (batches A and B, 2026-09-24). The colour
-// rules are real now (E28 S3a): each constant below names the index.css utility or token that holds
+// rules are real now: each constant below names the index.css utility or token that holds
 // it, so the lab renders what the app ships. The height ladder lives in the primitives (ui/buttonStyles,
 // ui/fieldStyles), and a lab drawing takes their classes (F31).
 
diff --git a/frontend/src/i18n/appCopy.dom.test.ts b/frontend/src/i18n/appCopy.dom.test.ts
index 9e65a5b6..4f342c5b 100644
--- a/frontend/src/i18n/appCopy.dom.test.ts
+++ b/frontend/src/i18n/appCopy.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E22 S5: a clicked control's label is logged only when it is the app's own copy — as its English
+// A clicked control's label is logged only when it is the app's own copy — as its English
 // wording — so nothing a user wrote (a title, a tag, a channel name) can come out of the click log.
 import { describe, expect, it } from "vitest";
 
diff --git a/frontend/src/i18n/appCopy.ts b/frontend/src/i18n/appCopy.ts
index f5246ef9..9217c8b4 100644
--- a/frontend/src/i18n/appCopy.ts
+++ b/frontend/src/i18n/appCopy.ts
@@ -1,6 +1,6 @@
 import i18n from "./index";
 
-// The translation KEY a piece of on-screen text is, or null (E22 S5 click capture).
+// The translation KEY a piece of on-screen text is, or null (for click capture).
 //
 // A click is logged by what the control IS, and its visible label is the most telling part — but a
 // label can be the user's own content (a video title, a tag, a channel name), which the log must not
diff --git a/frontend/src/i18n/backendIds.contract.test.ts b/frontend/src/i18n/backendIds.contract.test.ts
index f5f173e4..ce25fbbe 100644
--- a/frontend/src/i18n/backendIds.contract.test.ts
+++ b/frontend/src/i18n/backendIds.contract.test.ts
@@ -6,7 +6,7 @@ import { vocabKey } from "../lib/vocab";
 // up with the raw id as the fallback — `t(\`config.fields.${key}.label\`, key)` — so a missing key never
 // fails loudly: the admin Configuration page showed `maintenance`, `tmdb`, `tmdb_api_key`,
 // `plex_overlay_map`… as bare identifiers, for months, and the i18n parity test stayed green because EN
-// and HU were missing the SAME keys (owner report, E11 S5). The ids live in Python, so the check reads
+// and HU were missing the SAME keys (owner report). The ids live in Python, so the check reads
 // the registries straight from the backend sources:
 //   - `sysconfig.SPECS`      → `config.groups.<group>`, `config.fields.<key>.label` + `.hint`, and for a
 //     "choice" key `config.choices.<key>.<option>` — the options read from its Literal in config.py
@@ -171,7 +171,7 @@ const youtubeReasons = [
   ).matchAll(/"(\w+)"/g),
 ].map((m) => m[1]!);
 
-// E30: the closed English vocabularies the backend WRITES into data, named through `vocab.<group>`
+// The closed English vocabularies the backend WRITES into data, named through `vocab.<group>`
 // (lib/vocab) by their letters-and-digits key. A word the backend adds shows in English until named —
 // so each list is read from its source here: the TMDB crew jobs kept, every auto-tag the tagger can
 // create, and the built-in download profiles of the latest migration that seeds them.
@@ -228,7 +228,7 @@ describe("backend ids have their names in both languages", () => {
     expect(jobs).toEqual(expect.arrayContaining(["rss_poll", "audit_gc"]));
     expect(auditActions).toEqual(expect.arrayContaining(["config_set", "audit_clear"]));
     expect(quotaActions.length).toBeGreaterThan(0);
-    expect(adminCodes).toEqual(expect.arrayContaining(["activate", "setpw"]));
+    expect(adminCodes).toEqual(expect.arrayContaining(["activate", "resend"]));
     expect(failDetails).toEqual(expect.arrayContaining(["facebook.login_wall"]));
     expect(goneWhats).toEqual(expect.arrayContaining(["playlist", "download", "job"]));
     expect(opaqueWhats).toEqual([]);
diff --git a/frontend/src/i18n/copyRule.test.ts b/frontend/src/i18n/copyRule.test.ts
index 30e61d86..6fc65876 100644
--- a/frontend/src/i18n/copyRule.test.ts
+++ b/frontend/src/i18n/copyRule.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 
-// docs/DESIGN.md "Copy" (E28 S3g): the parts of the copy rule a machine can read, held over every
+// docs/DESIGN.md "Copy": the parts of the copy rule a machine can read, held over every
 // value in both languages. The rest (one name per feature, one verb per meaning, "…" when a command
 // asks first) needs a reader and is checked by the DESIGN conformance step.
 
@@ -46,7 +46,7 @@ describe("the copy rule", () => {
 
 describe("one name per thing", () => {
   // The options of one choice are told apart by their names alone: two playback classes once shared
-  // "Közvetlen lejátszás" in the HU filter (E30 review). A set = a `…Opt` object, or one choice key's
+  // "Közvetlen lejátszás" in the HU filter. A set = a `…Opt` object, or one choice key's
   // options under config.choices.
   const sets = (): [string, Record<string, unknown>][] => {
     const out: [string, Record<string, unknown>][] = [];
diff --git a/frontend/src/i18n/index.ts b/frontend/src/i18n/index.ts
index d3a8768f..ece2ce5e 100644
--- a/frontend/src/i18n/index.ts
+++ b/frontend/src/i18n/index.ts
@@ -67,8 +67,8 @@ export function setLanguage(code: LangCode): void {
   document.documentElement.lang = code;
 }
 
-// The Plex overlay serves only EN or HU metadata (E5 S6). Collapse a UI language to one of those for
-// the `?lang=` param / query keys. It takes the language instead of reading the singleton (E30 S3):
+// The Plex overlay serves only EN or HU metadata. Collapse a UI language to one of those for
+// the `?lang=` param / query keys. It takes the language instead of reading the singleton:
 // under the React Compiler a component's `plexLang()` was a value with no reactive input, so it kept
 // the language the component first rendered in — a switch left every Plex query on the old language.
 // A component passes `i18n.language` from useTranslation; non-component code the singleton's.
diff --git a/frontend/src/i18n/locales/en/auditActions.json b/frontend/src/i18n/locales/en/auditActions.json
index 24004a99..08e722a8 100644
--- a/frontend/src/i18n/locales/en/auditActions.json
+++ b/frontend/src/i18n/locales/en/auditActions.json
@@ -9,9 +9,6 @@
   "invite_approve": "Access request approved",
   "invite_deny": "Access request denied",
   "invite_add": "Email whitelisted",
-  "demo_add": "Demo email added",
-  "demo_remove": "Demo email removed",
-  "demo_reset": "Demo reset",
   "discovery_purge": "Discovery purged",
   "config_set": "Setting changed",
   "config_reset": "Setting reset",
diff --git a/frontend/src/i18n/locales/en/common.json b/frontend/src/i18n/locales/en/common.json
index 10017eef..8fdd8286 100644
--- a/frontend/src/i18n/locales/en/common.json
+++ b/frontend/src/i18n/locales/en/common.json
@@ -20,8 +20,6 @@
   "accessRequestsMessage_one": "{{count}} pending — review it on the Users page.",
   "accessRequestsMessage_other": "{{count}} pending — review them on the Users page.",
   "accessRequestsReview": "Review",
-  "demoTitle": "Demo account",
-  "demoSharedNotice": "You're in the shared demo account. Everything you do here — playlists, hidden videos, settings — is communal and may be changed by other demo visitors at the same time.",
   "backToTop": "Back to top",
   "retry": "Retry",
   "retryWithEnter": "Press Enter to try again.",
diff --git a/frontend/src/i18n/locales/en/errors.json b/frontend/src/i18n/locales/en/errors.json
index 60517e95..b01b9ff5 100644
--- a/frontend/src/i18n/locales/en/errors.json
+++ b/frontend/src/i18n/locales/en/errors.json
@@ -1,7 +1,6 @@
 {
   "title": "Couldn't complete that",
   "generic": "The server couldn't carry out that action. Please try again.",
-  "demo": "This isn't available in the demo account",
   "validation": "Some of the values you entered weren't valid. Please check them and try again.",
   "tooLarge": "That was too large for the server to accept",
   "server": "Server error",
@@ -45,8 +44,7 @@
     "not_applicable": "This account has nothing left to confirm",
     "not_approved": "Only an approved address can be invited",
     "email_off": "No mail was sent: this instance has no working SMTP setup. Check Configuration → Email / SMTP.",
-    "send_failed": "The mail couldn't be sent: the mail server was unreachable, or it refused the login or the message. Check Configuration → Email / SMTP, then try again.",
-    "demo": "The demo account is shared, so it can't get a set-password link"
+    "send_failed": "The mail couldn't be sent: the mail server was unreachable, or it refused the login or the message. Check Configuration → Email / SMTP, then try again."
   },
   "reason": {
     "unreachable": "The server couldn't be reached. Try again.",
@@ -132,10 +130,6 @@
     "collection_pending_sync": "The collection changed in Plex, but refreshing the local copy failed — it catches up on the next sync",
     "collection_read_only": "This collection is read-only",
     "collection_smart": "Smart and auto-list collections can't be made editable",
-    "demo_activate": "The demo account can't be activated",
-    "demo_delete": "The demo account can't be deleted",
-    "demo_role": "The demo account's role can't be changed",
-    "demo_suspend": "The demo account can't be suspended",
     "download_not_ready": "This download isn't ready",
     "edit_unfinished": "Only a finished download can be edited",
     "filters_not_object": "The view's filters are malformed",
@@ -155,14 +149,8 @@
     "link_gone": "This link is no longer available",
     "link_required": "A video link or id is required",
     "media_missing": "The media file isn't on disk",
-    "message_empty": "The message is empty",
-    "message_rate": "Too many messages — slow down a moment",
-    "message_self": "You can't message yourself",
-    "message_too_long": "The message is too long",
-    "messaging_set_up": "Secure messaging is already set up",
     "name_required": "A name is required",
     "no_encryption_key": "Set TOKEN_ENCRYPTION_KEY to store secrets in the database",
-    "no_messaging": "That member hasn't set up messaging yet",
     "no_profile": "There's no download profile to use",
     "no_subscription_id": "There's no YouTube subscription on record yet — sync your subscriptions first",
     "not_authenticated": "You're not signed in",
diff --git a/frontend/src/i18n/locales/en/feed.json b/frontend/src/i18n/locales/en/feed.json
index 80f14326..64b53f9f 100644
--- a/frontend/src/i18n/locales/en/feed.json
+++ b/frontend/src/i18n/locales/en/feed.json
@@ -17,9 +17,6 @@
   "emptyBody": "Connect your YouTube account to import your subscriptions and build your Feed.",
   "setUp": "Set up my Feed",
   "browseShared": "Or just browse the shared Library",
-  "demoEmptyTitle": "Nothing here in the demo",
-  "demoEmptyBody": "The demo account has no subscriptions of its own — but the whole shared Library is yours to explore, filter and sort.",
-  "browseLibrary": "Browse the Library",
   "noMatches": "No videos match these filters.",
   "channelScopeHint": "This channel isn't in your Feed — it may be hidden. Its videos are in the shared Library.",
   "viewInLibrary": "View in Library",
diff --git a/frontend/src/i18n/locales/en/keys.json b/frontend/src/i18n/locales/en/keys.json
index 977c6532..2841d5dc 100644
--- a/frontend/src/i18n/locales/en/keys.json
+++ b/frontend/src/i18n/locales/en/keys.json
@@ -27,7 +27,6 @@
   "goPlaylists": "Go to Playlists",
   "goPlex": "Go to Plex",
   "goNotifications": "Go to Notifications",
-  "goMessages": "Go to Messages",
   "goDownloads": "Go to Downloads",
   "goStats": "Go to Stats",
   "goSettings": "Go to Settings",
diff --git a/frontend/src/i18n/locales/en/messages.json b/frontend/src/i18n/locales/en/messages.json
deleted file mode 100644
index 5bb48d8b..00000000
--- a/frontend/src/i18n/locales/en/messages.json
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "navLabel": "Messages",
-  "popOut": "Open in pop-out",
-  "expand": "Expand",
-  "minimize": "Minimize",
-  "close": "Close",
-  "conversations": "Conversations",
-  "new": "New message…",
-  "newTitle": "New message",
-  "empty": "No conversations yet. Start one with the New message button.",
-  "searchPeople": "Search people…",
-  "noPeople": "No one to message yet.",
-  "threadEmpty": "No messages yet — say hello.",
-  "writePlaceholder": "Write a message…",
-  "send": "Send",
-  "encrypted": "Encrypted message",
-  "encryptedHint": "End-to-end encrypted",
-  "cantDecrypt": "Can't decrypt",
-  "sendFailed": "Couldn't send your message. Try again.",
-  "systemReadOnly": "This is an automated message.",
-  "setupTitle": "Set up secure messaging",
-  "setupBody": "Messages are end-to-end encrypted. Choose a passphrase to protect your key — it never leaves your device, so no one (not even an admin) can read your conversations.",
-  "setupWarn": "If you forget this passphrase, your message history can't be recovered.",
-  "setUp": "Set up",
-  "unlockTitle": "Unlock messaging",
-  "unlockBody": "Enter your message passphrase to unlock your conversations on this device.",
-  "unlock": "Unlock",
-  "passphrase": "Passphrase",
-  "passphraseConfirm": "Confirm passphrase",
-  "passTooShort": "Use at least 6 characters",
-  "passMismatch": "The passphrases don't match",
-  "wrongPass": "Wrong passphrase",
-  "setupFailed": "Couldn't set up secure messaging. Please try again.",
-  "forgotPass": "Forgot your passphrase?",
-  "resetTitle": "Reset secure messaging",
-  "resetWarn": "This permanently erases your entire message history — every conversation, for you and the people you messaged — because it can no longer be decrypted. Then you can set a new passphrase and start fresh. This can't be undone.",
-  "resetCurrentPass": "Current account password",
-  "resetNeedPass": "Enter your current account password to confirm.",
-  "resetButton": "Reset & erase history",
-  "resetFailed": "Couldn't reset secure messaging. Please try again."
-}
diff --git a/frontend/src/i18n/locales/en/nav.json b/frontend/src/i18n/locales/en/nav.json
index c2c0802d..407e1041 100644
--- a/frontend/src/i18n/locales/en/nav.json
+++ b/frontend/src/i18n/locales/en/nav.json
@@ -4,8 +4,7 @@
   "skipToContent": "Skip to content",
   "role": {
     "admin": "Admin",
-    "user": "User",
-    "demo": "Demo"
+    "user": "User"
   },
   "rail": {
     "home": "Home",
@@ -14,7 +13,6 @@
     "playlists": "Playlists",
     "plex": "Plex",
     "notifications": "Notifications",
-    "messages": "Messages",
     "downloads": "Downloads",
     "stats": "Stats",
     "scheduler": "Scheduler",
diff --git a/frontend/src/i18n/locales/en/scheduler.json b/frontend/src/i18n/locales/en/scheduler.json
index 655e74e8..87d9de9b 100644
--- a/frontend/src/i18n/locales/en/scheduler.json
+++ b/frontend/src/i18n/locales/en/scheduler.json
@@ -69,7 +69,6 @@
     "shorts": "Probes youtube.com/shorts to mark which videos are Shorts. If it stops, Shorts aren't separated from normal videos in the Feed.",
     "subscriptions": "Re-imports every user's YouTube subscriptions. If it stops, channels subscribed to or dropped on YouTube aren't reflected here.",
     "playlist_sync": "Mirrors each user's YouTube playlists into the app. If it stops, changes to your YouTube playlists don't show up locally.",
-    "demo_reset": "Resets the shared demo account (its playlists and state) so every visitor starts from the same sandbox. Does nothing when there is no demo account. If it stops, the demo keeps whatever the last visitor left behind.",
     "maintenance": "Finds videos that can no longer be played (deleted, made private, abandoned premieres), hides them from the Feed and removes them after a grace period; re-checks the least-recently-checked videos. If it stops, dead videos linger in the catalogue.",
     "explore_cleanup": "Removes channels you explored but never subscribed to (and their videos) after a grace period, so curiosity browsing doesn't pile up in the catalogue. If it stops, abandoned explored channels linger.",
     "download_gc": "Deletes downloaded files past their retention window, reclaims space no one is holding anymore, and warns owners before a shared file expires. If it stops, old downloads pile up and disk space isn't freed.",
@@ -90,7 +89,6 @@
     "subscriptions": "Subscription sync from YouTube",
     "playlist_sync": "Playlist sync from YouTube",
     "maintenance": "Maintenance + validation",
-    "demo_reset": "Demo account reset",
     "explore_cleanup": "Explored-channel cleanup",
     "download_gc": "Download cleanup",
     "plex_sync": "Plex library sync",
@@ -139,7 +137,6 @@
     "revalidated": "revalidated",
     "flagged": "flagged",
     "skipped": "skipped",
-    "playlists_seeded": "playlists seeded",
     "expired": "expired",
     "videos_deleted": "videos deleted",
     "channels_deleted": "channels deleted",
@@ -183,7 +180,6 @@
     "disabled": "disabled",
     "PlexserverURLortokenisnotconfigured": "Plex server URL or token is not configured",
     "tmdbapikeynotset": "TMDB API key not set",
-    "nodemoaccount": "no demo account",
     "noserviceuser": "no service user",
     "syncpaused": "sync paused",
     "lowquota": "low quota",
diff --git a/frontend/src/i18n/locales/en/settings.json b/frontend/src/i18n/locales/en/settings.json
index 89a5ec43..64dd2144 100644
--- a/frontend/src/i18n/locales/en/settings.json
+++ b/frontend/src/i18n/locales/en/settings.json
@@ -73,7 +73,6 @@
     "deleteTitle": "Delete your account?",
     "deleteConfirm": "This permanently erases your account and all your data (subscriptions, tags, watch/saved/hidden state, playlists, settings). It can't be undone.",
     "deleteConfirmButton": "Delete everything",
-    "demoNotice": "This is the shared demo account. It has no YouTube connection — you can browse the whole shared Library, filter and sort it, build playlists and try things out, but nothing touches a real YouTube account.",
     "signInMethods": "Sign-in methods",
     "googleLink": {
       "title": "Google account",
@@ -132,28 +131,6 @@
     "removeConfirmAction": "Delete",
     "loadError": "Couldn't load your download authentication settings"
   },
-  "demo": {
-    "title": "Demo access",
-    "intro": "Emails here can enter the shared demo account straight from the login page — no Google sign-in. They just type the address into the field and are let in after a moment.",
-    "addPlaceholder": "Whitelist an email for demo…",
-    "add": "Add",
-    "added": "{{email}} added to the demo whitelist",
-    "addFailed": "Couldn't add that email",
-    "removeFailed": "Couldn't remove that email",
-    "remove": "Remove",
-    "removeHint": "Remove this email from the demo whitelist.",
-    "addedBy": "added by {{who}}",
-    "reset": "Reset demo state",
-    "resetHint": "Wipe the demo account's playlists, hidden/watched/saved videos and settings, then re-seed a few sample playlists.",
-    "resetTitle": "Reset demo state?",
-    "resetConfirm": "This clears everything the demo account has accumulated — playlists, hidden/watched/saved videos and settings — and re-seeds a few sample playlists. It can't be undone.",
-    "resetDone_one": "Demo reset — {{count}} sample playlist seeded",
-    "resetDone_other": "Demo reset — {{count}} sample playlists seeded",
-    "resetFailed": "Couldn't reset the demo account",
-    "removed": "Removed from the demo whitelist",
-    "removeTitle": "Remove demo access?",
-    "removeConfirm": "Remove {{email}} from the demo whitelist? They'll no longer be able to enter the demo account."
-  },
   "invites": {
     "title": "Access requests",
     "noPending": "No pending requests.",
@@ -220,7 +197,7 @@
       },
       "server_one": "The Siftlode server receives this too and keeps it for {{count}} day, so the problem can be tracked down.",
       "server_other": "The Siftlode server receives this too and keeps it for {{count}} days, so the problem can be tracked down.",
-      "never": "Passwords, tokens, email addresses and the content of your messages are never included.",
+      "never": "Passwords, tokens and email addresses are never included.",
       "lapse": "After 24 hours it goes back to “Basic” by itself.",
       "policy": "Privacy policy",
       "cancel": "Cancel",
@@ -228,7 +205,6 @@
     },
     "status": "{{level}} logging · back to “Basic” in {{time}}",
     "revert": "Back to “Basic” now",
-    "demo": "The demo account is shared by several people, so detailed logging can't be turned on here.",
     "failed": "Couldn't change the logging level"
   },
   "myLog": {
diff --git a/frontend/src/i18n/locales/en/users.json b/frontend/src/i18n/locales/en/users.json
index 70c4064b..75b6f944 100644
--- a/frontend/src/i18n/locales/en/users.json
+++ b/frontend/src/i18n/locales/en/users.json
@@ -1,8 +1,7 @@
 {
   "tabs": {
     "roles": "Users & roles",
-    "access": "Access requests",
-    "demo": "Demo"
+    "access": "Access requests"
   },
   "pendingAccess": {
     "title": "Signed up, but still outside",
@@ -26,14 +25,11 @@
     "empty": "No users yet.",
     "you": "you",
     "admin": "Admin",
-    "demo": "Demo",
     "suspended": "Suspended",
     "pending": "Pending approval",
     "unverified": "Unverified email",
     "lastLogin": "Last sign-in: {{time}}",
     "lastLoginNone": "No sign-in recorded yet",
-    "lastLoginDemo": "Not recorded for the demo account",
-    "demoLocked": "The demo account's role can't be changed.",
     "selfLocked": "You can't change your own role.",
     "makeAdmin": "Make admin",
     "makeUser": "Make user",
@@ -53,7 +49,6 @@
     "undoConfirm": "Unsuspend {{email}}? They'll be able to sign in again.",
     "done": "{{email}} suspended",
     "undone": "{{email}} unsuspended",
-    "demoLocked": "The demo account can't be suspended.",
     "selfLocked": "You can't suspend your own account.",
     "failed": "Couldn't change the suspension"
   },
@@ -86,7 +81,6 @@
     "invite": "Invite",
     "lastLogin": "Last sign-in",
     "lastLoginNone": "none recorded yet",
-    "lastLoginDemo": "not recorded for the demo account",
     "inviteMissing": "this address is not on the allow-list",
     "linkNote": "Valid 24 hours, works once. Opening it lets this person set a password and signs out anyone already using the account. It does not confirm their address.",
     "mailOff": "no mail configured",
diff --git a/frontend/src/i18n/locales/en/welcome.json b/frontend/src/i18n/locales/en/welcome.json
index 3fa1dee0..32bbdc6c 100644
--- a/frontend/src/i18n/locales/en/welcome.json
+++ b/frontend/src/i18n/locales/en/welcome.json
@@ -77,11 +77,6 @@
     "backToSignin": "Back to sign in",
     "or": "or",
     "google": "Continue with Google",
-    "tryDemo": "Try the demo",
-    "demoHint": "Enter an email that's been enabled for the demo account.",
-    "demoEmail": "Demo email",
-    "demoEnter": "Enter",
-    "demoDenied": "That email isn't enabled for the demo. Ask the admin to add it.",
     "registerDone": "Almost there — check your email for a confirmation link, and your spam folder if it isn't there in a minute. After you confirm it, an admin approves your account before you can sign in.",
     "forgotDone": "If that email has an account, we've sent a reset link. Check your inbox, and your spam folder if it hasn't arrived in a minute.",
     "resetDone": "Your password has been set — you can sign in now",
diff --git a/frontend/src/i18n/locales/hu/auditActions.json b/frontend/src/i18n/locales/hu/auditActions.json
index 3f27b63d..4c1acc37 100644
--- a/frontend/src/i18n/locales/hu/auditActions.json
+++ b/frontend/src/i18n/locales/hu/auditActions.json
@@ -9,9 +9,6 @@
   "invite_approve": "Hozzáférési kérelem jóváhagyva",
   "invite_deny": "Hozzáférési kérelem elutasítva",
   "invite_add": "E-mail fehérlistára téve",
-  "demo_add": "Demó e-mail hozzáadva",
-  "demo_remove": "Demó e-mail eltávolítva",
-  "demo_reset": "Demó visszaállítva",
   "discovery_purge": "Felfedezés ürítve",
   "config_set": "Beállítás módosítva",
   "config_reset": "Beállítás visszaállítva",
diff --git a/frontend/src/i18n/locales/hu/common.json b/frontend/src/i18n/locales/hu/common.json
index 0e0c00f3..29550bd7 100644
--- a/frontend/src/i18n/locales/hu/common.json
+++ b/frontend/src/i18n/locales/hu/common.json
@@ -20,8 +20,6 @@
   "accessRequestsMessage_one": "{{count}} függőben — nézd át a Felhasználók oldalon.",
   "accessRequestsMessage_other": "{{count}} függőben — nézd át a Felhasználók oldalon.",
   "accessRequestsReview": "Áttekintés",
-  "demoTitle": "Demó fiók",
-  "demoSharedNotice": "Egy közös demó fiókban vagy. Minden, amit itt csinálsz — lejátszási listák, elrejtett videók, beállítások — közös, és más demó látogatók egyszerre módosíthatják.",
   "backToTop": "Vissza a tetejére",
   "retry": "Újra",
   "retryWithEnter": "Újrapróbáláshoz nyomd meg az Entert.",
diff --git a/frontend/src/i18n/locales/hu/errors.json b/frontend/src/i18n/locales/hu/errors.json
index 598455bb..b622dbc9 100644
--- a/frontend/src/i18n/locales/hu/errors.json
+++ b/frontend/src/i18n/locales/hu/errors.json
@@ -1,7 +1,6 @@
 {
   "title": "Nem sikerült",
   "generic": "A szerver nem tudta végrehajtani a műveletet. Próbáld újra.",
-  "demo": "Ez a demó fiókban nem érhető el",
   "validation": "Néhány megadott érték érvénytelen volt. Ellenőrizd, majd próbáld újra.",
   "tooLarge": "Ez túl nagy, a szerver nem fogadta el",
   "server": "Szerverhiba",
@@ -45,8 +44,7 @@
     "not_applicable": "Ezen a fiókon már nincs mit megerősíteni",
     "not_approved": "Csak jóváhagyott címre küldhető meghívó",
     "email_off": "Nem ment ki levél: ezen a példányon nincs működő SMTP. Nézd meg a Konfiguráció → E-mail / SMTP fület.",
-    "send_failed": "Nem sikerült elküldeni a levelet: a levelezőszerver nem volt elérhető, vagy elutasította a belépést vagy a levelet. Nézd meg a Konfiguráció → E-mail / SMTP fület, majd próbáld újra.",
-    "demo": "A demó fiók közös, ezért nem kaphat jelszóbeállító linket"
+    "send_failed": "Nem sikerült elküldeni a levelet: a levelezőszerver nem volt elérhető, vagy elutasította a belépést vagy a levelet. Nézd meg a Konfiguráció → E-mail / SMTP fület, majd próbáld újra."
   },
   "reason": {
     "unreachable": "A szerver nem volt elérhető. Próbáld újra.",
@@ -132,10 +130,6 @@
     "collection_pending_sync": "A kollekció a Plexben megváltozott, de a helyi másolat frissítése nem sikerült — a következő szinkron pótolja",
     "collection_read_only": "Ez a kollekció csak olvasható",
     "collection_smart": "Az okos és az automatikus listás kollekciók nem tehetők szerkeszthetővé",
-    "demo_activate": "A demó fiók nem aktiválható",
-    "demo_delete": "A demó fiók nem törölhető",
-    "demo_role": "A demó fiók szerepköre nem módosítható",
-    "demo_suspend": "A demó fiók nem függeszthető fel",
     "download_not_ready": "Ez a letöltés még nincs kész",
     "edit_unfinished": "Csak befejezett letöltés szerkeszthető",
     "filters_not_object": "A nézet szűrői hibás formátumúak",
@@ -155,14 +149,8 @@
     "link_gone": "Ez a link már nem érhető el",
     "link_required": "Adj meg egy videólinket vagy -azonosítót",
     "media_missing": "A médiafájl nincs a lemezen",
-    "message_empty": "Az üzenet üres",
-    "message_rate": "Túl sok üzenet — várj egy kicsit",
-    "message_self": "Magadnak nem küldhetsz üzenetet",
-    "message_too_long": "Az üzenet túl hosszú",
-    "messaging_set_up": "A biztonságos üzenetküldés már be van állítva",
     "name_required": "Adj meg egy nevet",
     "no_encryption_key": "Titkos értékek tárolásához állítsd be a TOKEN_ENCRYPTION_KEY-t",
-    "no_messaging": "Ez a tag még nem állította be az üzenetküldést",
     "no_profile": "Nincs használható letöltési profil",
     "no_subscription_id": "Még nincs rögzített YouTube-feliratkozás — előbb szinkronizáld a feliratkozásaidat",
     "not_authenticated": "Nem vagy bejelentkezve",
diff --git a/frontend/src/i18n/locales/hu/feed.json b/frontend/src/i18n/locales/hu/feed.json
index 38a7c63d..e2fea925 100644
--- a/frontend/src/i18n/locales/hu/feed.json
+++ b/frontend/src/i18n/locales/hu/feed.json
@@ -17,9 +17,6 @@
   "emptyBody": "Kösd össze a YouTube-fiókodat, hogy importáld a feliratkozásaidat, és felépítsd a Feededet.",
   "setUp": "Feed beállítása",
   "browseShared": "Vagy csak böngészd a közös Könyvtárat",
-  "demoEmptyTitle": "Itt a demóban nincs semmi",
-  "demoEmptyBody": "A demó fióknak nincsenek saját feliratkozásai — de a teljes közös Könyvtár a tiéd: böngészd, szűrd és rendezd kedvedre.",
-  "browseLibrary": "Könyvtár böngészése",
   "noMatches": "Egy videó sem felel meg ezeknek a szűrőknek.",
   "channelScopeHint": "Ez a csatorna nincs a Feededben – lehet, hogy el van rejtve. A videói a közös Könyvtárban vannak.",
   "viewInLibrary": "Megnézés a Könyvtárban",
diff --git a/frontend/src/i18n/locales/hu/keys.json b/frontend/src/i18n/locales/hu/keys.json
index 1986af78..db11eb23 100644
--- a/frontend/src/i18n/locales/hu/keys.json
+++ b/frontend/src/i18n/locales/hu/keys.json
@@ -27,7 +27,6 @@
   "goPlaylists": "Ugrás: Lejátszási listák",
   "goPlex": "Ugrás: Plex",
   "goNotifications": "Ugrás: Értesítések",
-  "goMessages": "Ugrás: Üzenetek",
   "goDownloads": "Ugrás: Letöltések",
   "goStats": "Ugrás: Statisztika",
   "goSettings": "Ugrás: Beállítások",
diff --git a/frontend/src/i18n/locales/hu/messages.json b/frontend/src/i18n/locales/hu/messages.json
deleted file mode 100644
index f17cad86..00000000
--- a/frontend/src/i18n/locales/hu/messages.json
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "navLabel": "Üzenetek",
-  "popOut": "Megnyitás felugró ablakban",
-  "expand": "Kinyitás",
-  "minimize": "Összecsukás",
-  "close": "Bezárás",
-  "conversations": "Beszélgetések",
-  "new": "Új üzenet…",
-  "newTitle": "Új üzenet",
-  "empty": "Még nincs beszélgetés. Indíts egyet az Új üzenet gombbal.",
-  "searchPeople": "Emberek keresése…",
-  "noPeople": "Még nincs kinek üzenni.",
-  "threadEmpty": "Még nincs üzenet — köszönj be.",
-  "writePlaceholder": "Írj egy üzenetet…",
-  "send": "Küldés",
-  "encrypted": "Titkosított üzenet",
-  "encryptedHint": "Végpontig titkosítva",
-  "cantDecrypt": "Nem fejthető vissza",
-  "sendFailed": "Nem sikerült elküldeni az üzenetet. Próbáld újra.",
-  "systemReadOnly": "Ez egy automatikus üzenet.",
-  "setupTitle": "Biztonságos üzenetküldés beállítása",
-  "setupBody": "Az üzenetek végpontig titkosítottak. Válassz egy jelszót a kulcsod védelméhez — sosem hagyja el az eszközödet, így senki (még az admin sem) olvashatja a beszélgetéseidet.",
-  "setupWarn": "Ha elfelejted ezt a jelszót, az üzenet-előzményeid nem állíthatók helyre.",
-  "setUp": "Beállítás",
-  "unlockTitle": "Üzenetküldés feloldása",
-  "unlockBody": "Add meg az üzenet-jelszavadat a beszélgetéseid feloldásához ezen az eszközön.",
-  "unlock": "Feloldás",
-  "passphrase": "Jelszó",
-  "passphraseConfirm": "Jelszó megerősítése",
-  "passTooShort": "Legalább 6 karakter legyen",
-  "passMismatch": "A jelszavak nem egyeznek",
-  "wrongPass": "Hibás jelszó",
-  "setupFailed": "Nem sikerült beállítani a biztonságos üzenetküldést. Próbáld újra.",
-  "forgotPass": "Elfelejtetted a jelszavad?",
-  "resetTitle": "Biztonságos üzenetküldés visszaállítása",
-  "resetWarn": "Ez véglegesen törli a teljes üzenet-előzményedet — minden beszélgetést, nálad és a partnereidnél is —, mert az többé nem visszafejthető. Utána új jelszót állíthatsz be és tiszta lappal indulhatsz. Ez nem visszavonható.",
-  "resetCurrentPass": "Jelenlegi fiók-jelszó",
-  "resetNeedPass": "Add meg a jelenlegi fiók-jelszavad a megerősítéshez.",
-  "resetButton": "Visszaállítás és előzmény törlése",
-  "resetFailed": "Nem sikerült visszaállítani a biztonságos üzenetküldést. Próbáld újra."
-}
diff --git a/frontend/src/i18n/locales/hu/nav.json b/frontend/src/i18n/locales/hu/nav.json
index 767bb022..1a7a1dee 100644
--- a/frontend/src/i18n/locales/hu/nav.json
+++ b/frontend/src/i18n/locales/hu/nav.json
@@ -4,8 +4,7 @@
   "skipToContent": "Ugrás a tartalomra",
   "role": {
     "admin": "Admin",
-    "user": "Felhasználó",
-    "demo": "Demó"
+    "user": "Felhasználó"
   },
   "rail": {
     "home": "Kezdőlap",
@@ -14,7 +13,6 @@
     "playlists": "Listák",
     "plex": "Plex",
     "notifications": "Értesítések",
-    "messages": "Üzenetek",
     "downloads": "Letöltések",
     "stats": "Statisztika",
     "scheduler": "Ütemező",
diff --git a/frontend/src/i18n/locales/hu/scheduler.json b/frontend/src/i18n/locales/hu/scheduler.json
index eff5d3e1..8919266e 100644
--- a/frontend/src/i18n/locales/hu/scheduler.json
+++ b/frontend/src/i18n/locales/hu/scheduler.json
@@ -69,7 +69,6 @@
     "shorts": "A youtube.com/shorts próbával jelöli, mely videók Shorts-ok. Ha leáll, a Shorts-ok nem különülnek el a normál videóktól a Feedben.",
     "subscriptions": "Újraimportálja minden felhasználó YouTube-feliratkozásait. Ha leáll, a YouTube-on felvett vagy törölt feliratkozások nem tükröződnek itt.",
     "playlist_sync": "Tükrözi a felhasználók YouTube lejátszási listáit az appba. Ha leáll, a YouTube-listák változásai nem jelennek meg lokálisan.",
-    "demo_reset": "Visszaállítja a közös demó fiókot (lejátszási listák és állapot), hogy minden látogató ugyanabból a homokozóból induljon. Ha nincs demó fiók, nem csinál semmit. Ha leáll, a demóban az marad, amit az előző látogató hagyott benne.",
     "maintenance": "Megkeresi a már sehol le nem játszható videókat (törölt, priváttá tett, elhagyott premier), elrejti őket a Feedből, és türelmi idő után eltávolítja; újraellenőrzi a legrégebben ellenőrzött videókat. Ha leáll, a halott videók a katalógusban maradnak.",
     "explore_cleanup": "A türelmi idő után eltávolítja a felfedezett, de nem követett csatornákat (és videóikat), hogy a kíváncsiság-böngészés ne halmozódjon a katalógusban. Ha leáll, az elhagyott felfedezett csatornák megmaradnak.",
     "download_gc": "Törli a megőrzési időn túli letöltéseket, felszabadítja a már senki által nem használt helyet, és a lejárat előtt figyelmezteti a tulajdonost. Ha leáll, a régi letöltések felhalmozódnak, és a tárhely nem szabadul fel.",
@@ -90,7 +89,6 @@
     "subscriptions": "Feliratkozások szinkronizálása a YouTube-ról",
     "playlist_sync": "Lejátszási listák szinkronizálása a YouTube-ról",
     "maintenance": "Karbantartás + ellenőrzés",
-    "demo_reset": "Demó fiók visszaállítása",
     "explore_cleanup": "Felfedezett csatornák takarítása",
     "download_gc": "Letöltések takarítása",
     "plex_sync": "Plex-könyvtár szinkron",
@@ -139,7 +137,6 @@
     "revalidated": "újraérvényesítve",
     "flagged": "megjelölve",
     "skipped": "kihagyva",
-    "playlists_seeded": "létrehozott lejátszási lista",
     "expired": "lejárt",
     "videos_deleted": "törölt videó",
     "channels_deleted": "törölt csatorna",
@@ -183,7 +180,6 @@
     "disabled": "kikapcsolva",
     "PlexserverURLortokenisnotconfigured": "a Plex-szerver címe vagy tokenje nincs beállítva",
     "tmdbapikeynotset": "nincs TMDB API-kulcs",
-    "nodemoaccount": "nincs demófiók",
     "noserviceuser": "nincs szolgáltatásfiók",
     "syncpaused": "a szinkron szünetel",
     "lowquota": "kevés a kvóta",
diff --git a/frontend/src/i18n/locales/hu/settings.json b/frontend/src/i18n/locales/hu/settings.json
index c641fba3..bcfada78 100644
--- a/frontend/src/i18n/locales/hu/settings.json
+++ b/frontend/src/i18n/locales/hu/settings.json
@@ -73,7 +73,6 @@
     "deleteTitle": "Törlöd a fiókodat?",
     "deleteConfirm": "Ez véglegesen törli a fiókodat és minden adatodat (feliratkozások, címkék, megnézett/mentett/elrejtett állapot, lejátszási listák, beállítások). Nem vonható vissza.",
     "deleteConfirmButton": "Minden törlése",
-    "demoNotice": "Ez a közös demó fiók. Nincs YouTube-kapcsolata — böngészheted a teljes közös Könyvtárat, szűrheted és rendezheted, listákat építhetsz és kipróbálhatsz dolgokat, de semmi nem nyúl valódi YouTube-fiókhoz.",
     "signInMethods": "Bejelentkezési módok",
     "googleLink": {
       "title": "Google-fiók",
@@ -132,28 +131,6 @@
     "removeConfirmAction": "Törlés",
     "loadError": "Nem sikerült betölteni a letöltési hitelesítési beállításokat"
   },
-  "demo": {
-    "title": "Demó hozzáférés",
-    "intro": "Az itt szereplő e-mailek a bejelentkező oldalról közvetlenül beléphetnek a közös demó fiókba — Google-bejelentkezés nélkül. Csak beírják a címet a mezőbe, és pár pillanat múlva bekerülnek.",
-    "addPlaceholder": "E-mail fehérlistára a demóhoz…",
-    "add": "Hozzáadás",
-    "added": "{{email}} hozzáadva a demó fehérlistához",
-    "addFailed": "Nem sikerült hozzáadni ezt az e-mailt",
-    "removeFailed": "Nem sikerült eltávolítani ezt az e-mailt",
-    "remove": "Eltávolítás",
-    "removeHint": "E-mail eltávolítása a demó fehérlistáról.",
-    "addedBy": "hozzáadta: {{who}}",
-    "reset": "Demó állapot visszaállítása",
-    "resetHint": "Törli a demó fiók lejátszási listáit, elrejtett/megnézett/mentett videóit és beállításait, majd újra létrehoz pár minta lejátszási listát.",
-    "resetTitle": "Visszaállítod a demó állapotot?",
-    "resetConfirm": "Ez törli mindazt, amit a demó fiók összegyűjtött — lejátszási listák, elrejtett/megnézett/mentett videók és beállítások —, és újra létrehoz pár minta lejátszási listát. Nem vonható vissza.",
-    "resetDone_one": "Demó visszaállítva — {{count}} minta lejátszási lista létrehozva",
-    "resetDone_other": "Demó visszaállítva — {{count}} minta lejátszási lista létrehozva",
-    "resetFailed": "Nem sikerült visszaállítani a demó fiókot",
-    "removed": "Eltávolítva a demó fehérlistáról",
-    "removeTitle": "Visszavonod a demó hozzáférést?",
-    "removeConfirm": "Eltávolítod {{email}} címet a demó fehérlistáról? Többé nem tud belépni a demó fiókba."
-  },
   "invites": {
     "title": "Hozzáférési kérelmek",
     "noPending": "Nincs függőben lévő kérelem.",
@@ -220,7 +197,7 @@
       },
       "server_one": "Ezt a Siftlode szervere is megkapja, és {{count}} napig őrzi, hogy a hibát ki lehessen nyomozni.",
       "server_other": "Ezt a Siftlode szervere is megkapja, és {{count}} napig őrzi, hogy a hibát ki lehessen nyomozni.",
-      "never": "Jelszó, token, e-mail-cím és az üzeneteid tartalma soha nem kerül bele.",
+      "never": "Jelszó, token és e-mail-cím soha nem kerül bele.",
       "lapse": "24 óra múlva magától visszaáll „Alap” szintre.",
       "policy": "Adatvédelmi irányelvek",
       "cancel": "Mégse",
@@ -228,7 +205,6 @@
     },
     "status": "{{level}} naplózás · {{time}} múlva visszaáll „Alap” szintre",
     "revert": "Visszaállítás most",
-    "demo": "A demó fiókot többen használják, ezért itt nem kapcsolható be részletes naplózás.",
     "failed": "Nem sikerült módosítani a naplózási szintet"
   },
   "myLog": {
diff --git a/frontend/src/i18n/locales/hu/users.json b/frontend/src/i18n/locales/hu/users.json
index b897a21c..7fdb2749 100644
--- a/frontend/src/i18n/locales/hu/users.json
+++ b/frontend/src/i18n/locales/hu/users.json
@@ -1,8 +1,7 @@
 {
   "tabs": {
     "roles": "Felhasználók és szerepek",
-    "access": "Hozzáférési kérelmek",
-    "demo": "Demó"
+    "access": "Hozzáférési kérelmek"
   },
   "pendingAccess": {
     "title": "Regisztrált, de még kívül van",
@@ -26,14 +25,11 @@
     "empty": "Még nincs felhasználó.",
     "you": "te",
     "admin": "Admin",
-    "demo": "Demó",
     "suspended": "Felfüggesztve",
     "pending": "Jóváhagyásra vár",
     "unverified": "Nem igazolt e-mail",
     "lastLogin": "Utolsó belépés: {{time}}",
     "lastLoginNone": "Nincs még rögzített belépés",
-    "lastLoginDemo": "A demó fióknál nem rögzítjük",
-    "demoLocked": "A demó fiók szerepe nem módosítható.",
     "selfLocked": "A saját szerepedet nem módosíthatod.",
     "makeAdmin": "Adminná tesz",
     "makeUser": "Felhasználóvá tesz",
@@ -53,7 +49,6 @@
     "undoConfirm": "Feloldod a felfüggesztést: {{email}}? Újra be tud majd lépni.",
     "done": "{{email}} felfüggesztve",
     "undone": "{{email}} felfüggesztése feloldva",
-    "demoLocked": "A demó fiók nem függeszthető fel.",
     "selfLocked": "A saját fiókodat nem függesztheted fel.",
     "failed": "Nem sikerült módosítani a felfüggesztést"
   },
@@ -86,7 +81,6 @@
     "invite": "Meghívó",
     "lastLogin": "Utolsó belépés",
     "lastLoginNone": "még nincs rögzítve",
-    "lastLoginDemo": "a demó fióknál nem rögzítjük",
     "inviteMissing": "ez a cím nincs a fehérlistán",
     "linkNote": "24 óráig érvényes, egyszer használható. Aki megnyitja, beállíthat egy jelszót, és ezzel kilép mindenki, aki eddig használta a fiókot. A címet nem erősíti meg.",
     "mailOff": "nincs beállítva levelezés",
diff --git a/frontend/src/i18n/locales/hu/welcome.json b/frontend/src/i18n/locales/hu/welcome.json
index baebf1e9..568176e8 100644
--- a/frontend/src/i18n/locales/hu/welcome.json
+++ b/frontend/src/i18n/locales/hu/welcome.json
@@ -77,11 +77,6 @@
     "backToSignin": "Vissza a belépéshez",
     "or": "vagy",
     "google": "Folytatás Google-lel",
-    "tryDemo": "Demó kipróbálása",
-    "demoHint": "Adj meg egy e-mailt, amely engedélyezve van a demó fiókhoz.",
-    "demoEmail": "Demó e-mail",
-    "demoEnter": "Belépés",
-    "demoDenied": "Ez az e-mail nincs engedélyezve a demóhoz. Kérd az admint, hogy adja hozzá.",
     "registerDone": "Majdnem kész — nézd meg a postafiókod a megerősítő linkért, és a Spam mappát is, ha egy percen belül nem jön meg. Miután megerősítetted, egy admin jóváhagyja a fiókodat, mielőtt beléphetnél.",
     "forgotDone": "Ha ehhez az e-mailhez tartozik fiók, elküldtük a visszaállító linket. Nézd meg a postafiókod, és a Spam mappát is, ha egy percen belül nem érkezik meg.",
     "resetDone": "A jelszavad be van állítva — most már beléphetsz",
diff --git a/frontend/src/i18n/parity.test.ts b/frontend/src/i18n/parity.test.ts
index 72369f7c..21e80aad 100644
--- a/frontend/src/i18n/parity.test.ts
+++ b/frontend/src/i18n/parity.test.ts
@@ -1,4 +1,4 @@
-// E5 S6: every locale namespace must carry the SAME key set in English and Hungarian. A key present
+// Every locale namespace must carry the SAME key set in English and Hungarian. A key present
 // in one language but not the other renders the raw key string (missing translation) or is dead
 // weight (orphaned translation); this test fails loudly on either, per namespace.
 import { describe, expect, it } from "vitest";
diff --git a/frontend/src/i18n/plurals.test.ts b/frontend/src/i18n/plurals.test.ts
index 5b858929..87c33316 100644
--- a/frontend/src/i18n/plurals.test.ts
+++ b/frontend/src/i18n/plurals.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E28 review J5: a count in copy goes through i18next's plural forms (`count`), never a bare `n` —
+// A count in copy goes through i18next's plural forms (`count`), never a bare `n` —
 // the share dialog's expiry read "1 days".
 import { describe, expect, it } from "vitest";
 
@@ -37,7 +37,7 @@ describe("counted copy", () => {
   });
 });
 
-// E31: "1 seasons", "Synced 1 subscriptions" — a counted string written as one plain key reads plural at
+// "1 seasons", "Synced 1 subscriptions" — a counted string written as one plain key reads plural at
 // one. So the rule is held for every string, not key by key: a value that carries {{count}} is a plural
 // pair (`_one` / `_other`), even where the two read the same today, so the next wording is a plural too.
 describe("every counted string is a plural pair", () => {
diff --git a/frontend/src/index.css b/frontend/src/index.css
index b61c3ca3..686669d7 100644
--- a/frontend/src/index.css
+++ b/frontend/src/index.css
@@ -75,14 +75,14 @@
   --text-3xs: 0.625rem; /* 10px @ base */
 }
 
-/* ===== E28 tokens as utilities (docs/DESIGN.md) — the ONE source the ui/ primitives and the design
+/* ===== Tokens as utilities (docs/DESIGN.md) — the ONE source the ui/ primitives and the design
    lab both read, so a decided value is never restated as an arbitrary class. ===== */
 
 /* B3: `act:` — a hover or press that answers only a control that can act: not a disabled one, not a busy
    one (FocusSafeButton's aria-disabled). `:disabled` never matches an <a>, so one variant serves a
    button and a link alike. A literal variant, never a prefix glued on at runtime: Tailwind emits CSS
    only for a class it finds WHOLE in the source, and the `${ACT}hover:…` the primitives used to build
-   shipped with no rule at all (E28 audit; ui/tailwindScan.contract.test.ts). */
+   shipped with no rule at all (ui/tailwindScan.contract.test.ts). */
 @custom-variant act (&:not(:disabled, [aria-disabled="true"]));
 
 /* B3: a transparent control's hover / pressed layer. The layer answers only a control that can act:
@@ -96,9 +96,9 @@
     background-color: var(--press);
   }
 }
-/* A3: the coarse-pointer target (the why is at the E10 S1c note below). A caller's own `min-h-6` /
+/* A3: the coarse-pointer target (the why is in the tablet note below). A caller's own `min-h-6` /
    `min-w-6` (the mouse's 24 floor, B1) is a utility too and sorted after this one, so every control
-   that carried both stayed 24 on a tablet (E28 audit, measured): on a coarse pointer the target wins,
+   that carried both stayed 24 on a tablet (measured): on a coarse pointer the target wins,
    hence `!important`. (It would lower a caller's LARGER minimum; no control pairs it with one.) */
 @utility touch-target {
   @media (pointer: coarse) {
@@ -144,7 +144,7 @@
 
 /* The reading measure for prose (a synopsis, a biography, a channel's description): ~65 characters
    a line, inside the 45–75 a reader follows back to the next line's start. A full-width page ran
-   one to 110 (owner, E28 S3h: "shorter lines are easier to follow"). Only where the container can
+   one to 110 (owner: "shorter lines are easier to follow"). Only where the container can
    be wider than that; a narrow panel or popover is its own measure. */
 @utility measure {
   max-width: 65ch;
@@ -154,7 +154,7 @@
    dissolves as it slides under (the reference is DataTable's sticky header). The host is positioned. */
 /* A STICKY header's fade (a table head, the server log's toolbar), inside the scroller it sticks in.
    It shows only once content has slid under it: at rest it lay over the first row's top 16 px,
-   dimming it and hiding the top edge of its keyboard ring (E28, seen live). It fades in over the
+   dimming it and hiding the top edge of its keyboard ring (seen live). It fades in over the
    first 1rem of scroll by a scroll-driven animation; an engine without one draws no fade rather than
    a fade over the resting first row. */
 @keyframes fade-edge-in {
@@ -271,17 +271,17 @@
   }
 }
 
-/* R9 focus foundation: one accent focus ring for keyboard users on every interactive element that
+/* Focus foundation: one accent focus ring for keyboard users on every interactive element that
    doesn't define its own. In @layer base so any component/utility focus style (.selectable, an input's
    focus:ring, a menu item's data-active highlight + outline-hidden) overrides it. Non-input controls
-   app-wide had no visible keyboard focus before R9; this is the single biggest a11y win. */
+   app-wide had no visible keyboard focus before this; this is the single biggest a11y win. */
 @layer base {
   button:focus-visible,
   a:focus-visible,
   [role="button"]:focus-visible,
   [role="tab"]:focus-visible,
   summary:focus-visible {
-    /* Solid accent (E11 D2 = B): the 60% mix of R9 all but vanished on the dark glass. */
+    /* Solid accent: the earlier 60% mix all but vanished on the dark glass. */
     outline: 2px solid var(--accent);
     outline-offset: 2px;
   }
@@ -547,7 +547,7 @@ body {
 /* ===== Liquid-glass surface system (theme-aware, GPU-light) ===== */
 /* In @layer components so the recipe classes below (.selectable) compose with utilities instead of
    silently beating them the way these rules did while unlayered. (The ~9 dead `shadow-*` that used to
-   sit on glass surfaces were REMOVED in R9, not activated: the tuned glass box-shadow — including its
+   sit on glass surfaces were REMOVED, not activated: the tuned glass box-shadow — including its
    inset top-edge highlight — is the intended depth, and a shadow-* utility would atomically replace it
    and drop that highlight.) The perf-mode and :hover overrides below stay UNLAYERED on purpose. */
 @layer components {
@@ -614,7 +614,7 @@ body {
     box-shadow: var(--shadow-float);
   }
 
-  /* R9: standard interactive-row recipe. The hover tint menu/list rows already use, PLUS the
+  /* Standard interactive-row recipe. The hover tint menu/list rows already use, PLUS the
      app-wide focus-visible ring that was missing on non-input controls (buttons, rows, menu items) —
      the biggest single a11y win. In @layer components so a consumer's own utilities still win; the
      accent ring renders correctly under v4 (color-mix), matching the input ring in ui/form.tsx. */
@@ -633,8 +633,8 @@ body {
     outline-offset: -2px;
   }
 
-  /* E11 S4 · a list/grid item the keyboard landed on (`lib/listNav`): the SAME solid ring, around the
-     whole card rather than one control inside it (D2 = B). It is focus-visible only, so a mouse click
+  /* A list/grid item the keyboard landed on (`lib/listNav`): the SAME solid ring, around the
+     whole card rather than one control inside it. It is focus-visible only, so a mouse click
      never paints it, and it is a ring rather than a fill, so it never reads like the hover tint. The
      scroll margins are what `scrollIntoView({block:"nearest"})` honours: they keep a card stepped to
      from sliding under the floating header (`--hdr-h`) or flush against the bottom edge. */
@@ -670,7 +670,7 @@ body {
     outline-offset: -2px;
   }
 
-  /* ===== R10 S4 · Selection-paint recipes =====
+  /* ===== Selection-paint recipes =====
      The ~14 hand-rolled "this is the selected / current / active one" idioms all painted the SAME
      bg-accent fill via an inline ternary (`sel ? "bg-accent text-accent-fg border-accent" : "…"`),
      which drifted over time. These recipes OWN that paint, keyed on the semantic ARIA the control
@@ -678,7 +678,7 @@ body {
      ui/Tabs) or `aria-current` (the single current item) and the CSS paints, so one control's selected look can never diverge from
      the next's. Geometry (padding / radius / border-width / font) stays a per-site utility since it
      legitimately varies. NO focus-visible here on purpose: the `@layer base` rule above already rings
-     every button/a/[role]; re-adding it would duplicate that (an R9 review finding). Because these sit
+     every button/a/[role]; re-adding it would duplicate that (a review finding). Because these sit
      in @layer components, a site's own utility still wins — so a MIGRATED site must DROP its bg/text/
      border-color utilities (else a utility-layer `bg-*` beats the recipe's pressed fill). Add
      data-soft="true" for the subtle tint some surfaces use instead of the solid fill. */
@@ -704,7 +704,7 @@ body {
     border-color: color-mix(in srgb, var(--accent) 55%, transparent);
   }
   /* selected — SOLID accent fill (the dominant idiom). (The nav rail's "you are here" is ui/NavRail's
-     tint + edge bar since E28 S3d; its old `.is-current` recipe is gone.) */
+     tint + edge bar now; its old `.is-current` recipe is gone.) */
   .pill[aria-pressed="true"],
   .pill[role="tab"][aria-selected="true"] {
     background-color: var(--accent);
@@ -740,7 +740,7 @@ body {
     color: var(--accent-fg);
     border-color: var(--accent);
   }
-  /* ===== E10 S1c · the minimum-target half of the tablet comfort contract (docs/DESIGN.md) =====
+  /* ===== The minimum-target half of the tablet comfort contract (docs/DESIGN.md) =====
      A 32px icon button is fine with a mouse (a precise pointer plus hover to confirm the aim) and
      not fine with a thumb. So the minimum grows ONLY where there is no precise pointer, which on
      this app's real second device — a tablet — is exactly where it is needed.
@@ -755,7 +755,7 @@ body {
      would be the one control that ignores the user's text-size setting.
      (The rule itself is the `touch-target` utility near the top of this file.) */
 
-  /* ===== E10 S2 · rows that answer a right-click / long-press (useContextMenu) =====
+  /* ===== Rows that answer a right-click / long-press (useContextMenu) =====
      The long-press path competes with two browser behaviours that fire at the same gesture:
      iOS Safari's own callout (Copy / Share over a link or image) and the text-selection handles.
      Both would appear ON TOP of our menu, so the attribute the hook stamps on the row turns them
@@ -772,8 +772,8 @@ body {
   }
 }
 /* `:not(:disabled)` for the same reason ui/Button prefixes every variant hover with `enabled:` — a
-   disabled control must not advertise a click that does nothing. The Tailwind half was gated in E10
-   review round 1 and this half was missed, so a disabled glass button still lifted (round 2).
+   disabled control must not advertise a click that does nothing. The Tailwind half was gated first
+   and this half was missed, so a disabled glass button still lifted.
    `:not([aria-disabled="true"])` too: a FocusSafeButton that holds the focus is disabled by
    aria-disabled, not the native attribute (debt burn 2026-09), and lifted again until this. */
 .glass-hover:not(:disabled):not([aria-disabled="true"]):hover {
@@ -801,7 +801,8 @@ body {
   }
   /* The mirror of `.reveal-hover`: a control that exists ONLY on touch, because a mouse reaches the
      same action another way — a video or Plex card's "…" beside the title, whose mouse twin sits
-     in the hover row on the picture (E28 C1, `ui/reveal.ts`). `display: none`, so it is no Tab stop either. */
+     in the hover row on the picture (DESIGN.md C1, `ui/reveal.ts`). `display: none`, so it is no
+     Tab stop either. */
   .touch-only {
     display: none;
   }
@@ -972,32 +973,6 @@ html[data-perf="1"] .overlay-backdrop {
     transform: none;
   }
 }
-/* One-shot attention flash for a chat dock window on a new message. Inset glow so the
-   window's own overflow-hidden doesn't clip it; pulses twice then fades. */
-@keyframes chatFlash {
-  0% {
-    box-shadow: inset 0 0 0 0 transparent;
-  }
-  18% {
-    box-shadow:
-      inset 0 0 0 3px var(--accent),
-      inset 0 0 22px 0 color-mix(in srgb, var(--accent) 55%, transparent);
-  }
-  40% {
-    box-shadow: inset 0 0 0 1px transparent;
-  }
-  62% {
-    box-shadow:
-      inset 0 0 0 3px var(--accent),
-      inset 0 0 22px 0 color-mix(in srgb, var(--accent) 55%, transparent);
-  }
-  100% {
-    box-shadow: inset 0 0 0 0 transparent;
-  }
-}
-.chat-flash {
-  animation: chatFlash 1.1s ease-out;
-}
 
 /* ===== Color schemes (accent + neutrals), each with dark + light ===== */
 
@@ -1023,7 +998,7 @@ html[data-scheme="midnight"][data-theme="light"] {
   --accent-fg: #ffffff;
 }
 
-/* Forest — dark green-slate with a cyan accent (E28 B2: teal read as success) */
+/* Forest — dark green-slate with a cyan accent (DESIGN.md B2: teal read as success) */
 html[data-scheme="forest"][data-theme="dark"] {
   --bg: #0a1512;
   --surface: #0f1f1a;
@@ -1045,7 +1020,7 @@ html[data-scheme="forest"][data-theme="light"] {
   --accent-fg: #ffffff;
 }
 
-/* Slate — neutral grey with a fuchsia accent (E28 B2: orange read as warn) */
+/* Slate — neutral grey with a fuchsia accent (DESIGN.md B2: orange read as warn) */
 html[data-scheme="slate"][data-theme="dark"] {
   --bg: #15171c;
   --surface: #1b1e25;
@@ -1067,7 +1042,7 @@ html[data-scheme="slate"][data-theme="light"] {
   --accent-fg: #ffffff;
 }
 
-/* Matrix — near-black with a lime accent (E28 B2: the terminal green read as success) */
+/* Matrix — near-black with a lime accent (DESIGN.md B2: the terminal green read as success) */
 /* Matrix is moss, not neon (owner, 2026-09-24): the accent sits at Midnight's lightness (OKLCH L 0.67)
    with half the old lime's chroma, and the neutrals are barely tinted, so the page doesn't glow green. */
 html[data-scheme="matrix"][data-theme="dark"] {
@@ -1207,7 +1182,7 @@ html[data-theme="light"] {
   z-index: var(--z-index-rail);
 }
 /* …and it only fills the viewport while no ancestor has a filter: a `backdrop-filter` makes that
-   ancestor the fixed stage's containing block. The modal's card is a blurred `.glass` panel (E28 S3d1),
+   ancestor the fixed stage's containing block. The modal's card is a blurred `.glass` panel,
    so while the stage is maximised the card drops its blur — the stage covers the card anyway. `html `
    outranks `html[data-theme="dark"] .glass`, which sets the blur again (lib/playerStage.contract.test.ts). */
 html .glass:has(> .player-stage--max) {
diff --git a/frontend/src/lib/accountPinnedStores.dom.test.ts b/frontend/src/lib/accountPinnedStores.dom.test.ts
index 04e9ab0c..7f69c363 100644
--- a/frontend/src/lib/accountPinnedStores.dom.test.ts
+++ b/frontend/src/lib/accountPinnedStores.dom.test.ts
@@ -4,7 +4,7 @@
 // tab (bookmark, typed URL: no pin in sessionStorage) that is before BootGate pins the account, so they
 // read as nobody's; they must read again on the pin. The notification store used to keep its empty,
 // nobody's history, and the tab's first notice replaced the account's stored history with it.
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 
 const entry = (id: number, message: string) => ({
   id,
@@ -24,6 +24,15 @@ const storedMessages = (account: number) =>
     }[]
   ).map((n) => n.message);
 
+// Warm the transform cache once (see verifyEntry.dom.test.tsx): the first cold import costs ~0.8 s
+// alone and outran the 5 s case timeout under a full coverage run. Transformed code outlives
+// vi.resetModules, so each case still gets fresh module instances, only faster.
+beforeAll(async () => {
+  await import("./notifications");
+  await import("./hints");
+  await import("./api/core");
+}, 60_000);
+
 beforeEach(() => {
   localStorage.clear();
   sessionStorage.clear();
diff --git a/frontend/src/lib/actionErrors.test.ts b/frontend/src/lib/actionErrors.test.ts
index 83c25542..a35c366a 100644
--- a/frontend/src/lib/actionErrors.test.ts
+++ b/frontend/src/lib/actionErrors.test.ts
@@ -23,7 +23,7 @@ beforeEach(() => {
 describe("a Plex collection name that is already taken", () => {
   it("is reported once, in the reader's language", async () => {
     // The 409 was a bare English string: the global error dialog showed it in English, and the
-    // editor's own toast said the same thing again, translated (deep-review round 4).
+    // editor's own toast said the same thing again, translated.
     vi.spyOn(globalThis, "fetch").mockResolvedValue(
       new Response(JSON.stringify({ detail: { code: "collection", reason: "name_taken" } }), {
         status: 409,
@@ -78,7 +78,7 @@ describe("notifyActionError", () => {
   it("says a bare-English server reason in the reader's language, not the server's", () => {
     // `reportFailure` leaves 403/404/429 to the caller, so for exactly those statuses whatever
     // English a route hand-wrote went straight into the toast — "No user with that email." in an
-    // otherwise Hungarian UI, while the caller's translated fallback sat unused (round 5).
+    // otherwise Hungarian UI, while the caller's translated fallback sat unused.
     notifyActionError(new HttpError(404, "No user with that email."), "TRANSLATED");
     expect(notifyMock).toHaveBeenCalledWith({
       level: "error",
@@ -87,27 +87,6 @@ describe("notifyActionError", () => {
     });
   });
 
-  it("tells a demo user that the demo account is the reason", async () => {
-    // `require_human`'s refusal was a plain English string, so round 5's fix — discard a
-    // plain-string detail, show the caller's translated fallback — discarded the only explanation
-    // the demo user got: a generic "couldn't pin it" with no hint why (round 6). The gate answers
-    // a structured code now, and `localizeDetail` has a branch for it in both locales.
-    vi.spyOn(globalThis, "fetch").mockResolvedValue(
-      new Response(JSON.stringify({ detail: { code: "demo" } }), {
-        status: 403,
-        headers: { "content-type": "application/json" },
-      }),
-    );
-    const err = await api.addComfortPin("video", "v1").catch((e: unknown) => e);
-    notifyMock.mockClear();
-    notifyActionError(err, "GENERIC FALLBACK");
-    expect(notifyMock).toHaveBeenCalledWith({
-      level: "error",
-      title: "GENERIC FALLBACK",
-      message: i18n.t("errors.demo"),
-    });
-  });
-
   it("still prefers a STRUCTURED reason, which the request layer has already localized", () => {
     // `req` runs `{code, reason}` through localizeDetail, so `detail` is in the reader's language
     // AND more specific than anything a status can say — quota numbers, which row is gone.
diff --git a/frontend/src/lib/activeAccount.ts b/frontend/src/lib/activeAccount.ts
index 3f196d3f..c57493ff 100644
--- a/frontend/src/lib/activeAccount.ts
+++ b/frontend/src/lib/activeAccount.ts
@@ -10,7 +10,6 @@
 // again through `onAccountPinned`.
 //
 // ACTIVE_ACCOUNT_KEY is duplicated here rather than imported from api.ts so this stays dependency-free.
-/** @internal exported for 13 tests (BootGate.dom.test.tsx, …) */
 export const ACTIVE_ACCOUNT_KEY = "siftlode.activeAccount";
 
 // Re-readers for module-level per-account state, run each time the tab is pinned.
diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index 3b4fdd87..9e765723 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -5,7 +5,7 @@
 //      unchanged,
 //   3. spreads each domain's method slice into the single `api` object consumers call.
 // A new endpoint therefore has nowhere to land except a domain module — the interleave that
-// motivated R7.5 cannot re-grow here. (An automated guard for that invariant lands in S3.)
+// motivated the split cannot re-grow here. (lib/api/facade.test.ts guards that invariant.)
 import { getActiveAccount, HttpError, setActiveAccount, setUnauthorizedHandler } from "./api/core";
 
 // Re-export the shared HTTP machinery so consumers keep importing these from "./api" unchanged.
@@ -58,8 +58,6 @@ export {
   parsePlexFilters,
   isIntrinsicReadOnly,
 } from "./api/plex";
-import { messagingApi } from "./api/messaging";
-export type * from "./api/messaging";
 import { downloadsApi } from "./api/downloads";
 export type * from "./api/downloads";
 import { debugSessionsApi, diagnosticsApi } from "./api/diagnostics";
@@ -81,7 +79,6 @@ export const api = {
   ...quotaApi,
   ...adminApi,
   ...plexApi,
-  ...messagingApi,
   ...downloadsApi,
   ...diagnosticsApi,
   ...debugSessionsApi,
diff --git a/frontend/src/lib/api/account.ts b/frontend/src/lib/api/account.ts
index 47574547..449cdca9 100644
--- a/frontend/src/lib/api/account.ts
+++ b/frontend/src/lib/api/account.ts
@@ -9,7 +9,6 @@ export interface Me {
   display_name: string | null;
   avatar_url: string | null;
   role: string;
-  is_demo: boolean;
   /** The latest sign-in on any device (ISO), or null when none is recorded. */
   last_login_at: string | null;
   has_google: boolean;
@@ -32,18 +31,17 @@ export interface Me {
   /** Admin-only: false when SMTP is incomplete, so every outbound message is silently skipped. */
   email_configured: boolean;
   preferences: Record<string, unknown>;
-  /** The consented diagnostics level in force and when it lapses (E22 S5). */
+  /** The consented diagnostics level in force and when it lapses. */
   diagnostics: DiagnosticsState;
-  /** The debug session recording right now, if any (E16) — a reload resumes it. */
+  /** The debug session recording right now, if any — a reload resumes it. */
   debug_session: DebugSession | null;
-  /** Where a bug report goes — the tracker's repository — or null: download only (E16 S4). */
+  /** Where a bug report goes — the tracker's repository — or null: download only. */
   issues: { repo: string } | null;
 }
 
-/** The `nav.role.*` key an account is shown under. Demo isn't a real role (it's a flag on a `user`
- *  row), so it comes first. */
-export function roleKey(a: Pick<Me, "is_demo" | "role">): "admin" | "user" | "demo" {
-  return a.is_demo ? "demo" : a.role === "admin" ? "admin" : "user";
+/** The `nav.role.*` key an account is shown under. */
+export function roleKey(a: Pick<Me, "role">): "admin" | "user" {
+  return a.role === "admin" ? "admin" : "user";
 }
 
 /** What an account is called on screen: its display name, else the local part of its email. */
diff --git a/frontend/src/lib/api/admin.ts b/frontend/src/lib/api/admin.ts
index edeae591..1c248ed0 100644
--- a/frontend/src/lib/api/admin.ts
+++ b/frontend/src/lib/api/admin.ts
@@ -1,18 +1,9 @@
 // The admin surface: discovery purge, system configuration, users & roles, the audit log, the
-// diagnostics console's server log, the scheduler + maintenance controls, the demo-account
-// whitelist, and access invites. Only touches core's req. (Grouped by sub-area below; kept in one
+// diagnostics console's server log, the scheduler + maintenance controls, and access invites. Only touches core's req. (Grouped by sub-area below; kept in one
 // module as the cohesive "admin" domain.)
 import type { Level } from "../log";
 import { req } from "./core";
 
-export interface DemoWhitelistEntry {
-  id: number;
-  email: string;
-  note: string | null;
-  added_by: string | null;
-  created_at: string | null;
-}
-
 export interface Invite {
   id: number;
   email: string;
@@ -64,7 +55,7 @@ export interface ConfigItem {
 }
 export interface SystemConfigData {
   groups: Record<string, ConfigItem[]>;
-  /** The page's headings, in order, each with its groups in order; every group is in one (E31). */
+  /** The page's headings, in order, each with its groups in order; every group is in one. */
   sections: { id: string; groups: string[] }[];
   secrets_manageable: boolean;
 }
@@ -78,20 +69,19 @@ export interface AdminUserRow {
   is_active: boolean;
   is_suspended: boolean;
   email_verified: boolean;
-  is_demo: boolean;
   has_password: boolean;
   /** When SEC-10 cleared this account's password, or null. Separates "never had one" (a Google-only
    *  account) from "we took it away" — different problems needing different help. */
   password_revoked_at: string | null;
   has_google: boolean;
-  /** The Google account's address, ONLY when it differs from the account address (E9.5 S3). */
+  /** The Google account's address, ONLY when it differs from the account address. */
   google_email: string | null;
   created_at: string | null;
-  /** Last sign-in (Google or password). Null = not since 0.88 (no backfill), or the demo account. */
+  /** Last sign-in (Google or password). Null = not since 0.88 (no backfill). */
   last_login_at: string | null;
 }
 
-/** The account panel's view of why someone can or cannot get in (E12 S5). */
+/** The account panel's view of why someone can or cannot get in. */
 export interface AdminUserAccess extends AdminUserRow {
   /** The address passes the invite gate — so Google sign-in will be let through, not filed as a
    *  fresh access request. */
@@ -203,7 +193,7 @@ export interface SchedulerJob {
   last_started: string | null;
   last_finished: string | null;
   last_result: string | null; // the English one-liner — the fallback for a job with no `result`
-  // The last result as data (E30): counts, a `skipped` / `reason` word, a nested dict per phase —
+  // The last result as data: counts, a `skipped` / `reason` word, a nested dict per phase —
   // named in the reader's language by lib/jobResult.
   result: JobResult | null;
   last_error: string | null;
@@ -251,7 +241,7 @@ export const adminApi = {
     req(`/api/admin/config/${key}`, { method: "DELETE" }),
   testEmail: (): Promise<{ sent: boolean; to: string }> =>
     req("/api/admin/config/test-email", { method: "POST" }),
-  /** The bug-report tracker (E16): answers, takes issues, and is private. */
+  /** The bug-report tracker: answers, takes issues, and is private. */
   testIssues: (): Promise<{ ok: true; repo: string; url: string | null }> =>
     req("/api/admin/config/test-issues", { method: "POST" }),
   // --- users & roles ---
@@ -288,13 +278,6 @@ export const adminApi = {
       method: "PATCH",
       body: JSON.stringify({ revalidate_batch: revalidateBatch }),
     }),
-  // --- demo whitelist ---
-  adminDemoWhitelist: (): Promise<DemoWhitelistEntry[]> => req("/api/admin/demo/whitelist"),
-  addDemoWhitelist: (email: string): Promise<DemoWhitelistEntry> =>
-    req("/api/admin/demo/whitelist", { method: "POST", body: JSON.stringify({ email }) }),
-  removeDemoWhitelist: (id: number) => req(`/api/admin/demo/whitelist/${id}`, { method: "DELETE" }),
-  resetDemo: (): Promise<{ reset: boolean; playlists_seeded: number }> =>
-    req("/api/admin/demo/reset", { method: "POST" }),
   // --- access invites ---
   // Sign-ups that registered but still cannot get in — the admin lifeline for roadmap UX-25.
   adminPendingAccess: (): Promise<PendingAccessRow[]> => req("/api/admin/pending-access"),
diff --git a/frontend/src/lib/api/auth.ts b/frontend/src/lib/api/auth.ts
index b556b425..6cc9441d 100644
--- a/frontend/src/lib/api/auth.ts
+++ b/frontend/src/lib/api/auth.ts
@@ -1,12 +1,12 @@
 // The sign-in funnel: public auth config, email+password register/login/reset, email verification,
-// session management, access requests, and the hidden demo login. Errors on the interactive paths
-// are surfaced inline (quiet) rather than via the global modal. Only touches core's req.
+// and session management. Errors on the interactive paths are surfaced inline (quiet) rather than
+// via the global modal. Only touches core's req.
 import { req, uiLang } from "./core";
 
 /** Why password sign-in refused. The three account-shaped reasons name the mailbox and both gates,
  * so the card can render an honest state instead of a red line; `invalid` and `rate_limited` answer
  * BEFORE the password is proven and therefore carry nothing (they must stay identical for a real
- * account and an unknown one). Since E9.5 S1 the gates are order-independent — read both flags, never
+ * account and an unknown one). The gates are order-independent — read both flags, never
  * infer one from the other. */
 export type LoginBlocked = {
   reason: "email_unverified" | "pending_approval" | "suspended" | "invalid" | "rate_limited";
@@ -101,8 +101,8 @@ export const authApi = {
   // Confirm an email-verification token the SPA read from the URL fragment (SB3).
   // `password_reset_required` = SEC-10 dropped the password this account registered with, so signing
   // in would fail with the uniform credentials error. The card sends the user to the reset flow instead
-  // of leaving them to guess. Rare since E9.5 S1: only accounts stripped before that change, and the
-  // Google-adoption path, still reach it.
+  // of leaving them to guess. Rare now: only accounts stripped before the gates became
+  // order-independent, and the Google-adoption path, still reach it.
   // `email` is the address that was just confirmed — echoed back so the banner can name it, which
   // matters when the browser holds a session for a DIFFERENT account.
   verifyEmail: (
@@ -126,17 +126,4 @@ export const authApi = {
       { method: "POST", body: JSON.stringify({ password, current_password: currentPassword }) },
       { quiet: true },
     ),
-
-  // --- onboarding: access requests + demo entry ---
-  // Same reasoning as register: the requester has no account to carry a language preference, so the
-  // page they asked from is what decides the language of the approval or denial mail.
-  requestAccess: (email: string): Promise<{ status: string }> =>
-    req("/auth/request-access", {
-      method: "POST",
-      body: JSON.stringify({ email, lang: uiLang() }),
-    }),
-  // Hidden demo entry: a whitelisted email logs into the shared demo account, no Google
-  // sign-in. Returns whether a session was established.
-  demoLogin: (email: string): Promise<{ authenticated: boolean }> =>
-    req("/auth/demo", { method: "POST", body: JSON.stringify({ email }) }),
 };
diff --git a/frontend/src/lib/api/core.test.ts b/frontend/src/lib/api/core.test.ts
index e7993b90..9b68a2a6 100644
--- a/frontend/src/lib/api/core.test.ts
+++ b/frontend/src/lib/api/core.test.ts
@@ -79,7 +79,7 @@ beforeEach(() => {
   vi.stubGlobal("XMLHttpRequest", FakeXHR as unknown as typeof XMLHttpRequest);
 });
 
-// The upload body is a Blob and only a Blob: `FormData` was accepted until P1 and is gone, because
+// The upload body is a Blob and only a Blob: `FormData` was accepted once and is gone, because
 // a multipart part is a DECLARED body that FastAPI spools before the route's auth dependency runs —
 // and nothing on the backend can parse one any more (`python-multipart` was dropped with it).
 const body = () => new Blob(["x"]);
@@ -97,7 +97,7 @@ describe("uploadReq", () => {
   // Both abort producers are asserted through `isAborted`, not through `{status: 0}`: what the
   // upload dialog reads is the SENTINEL, and a cancelled upload that stops matching it becomes a
   // red "the upload failed" toast. Changing either `reject` to a friendlier message left every
-  // test green, because the only consumer test hand-builds the error it expects (round 6).
+  // test green, because the only consumer test hand-builds the error it expects.
   it("rejects immediately if the signal is already aborted (never sends)", async () => {
     const ac = new AbortController();
     ac.abort();
@@ -215,7 +215,6 @@ describe("req — a structured refusal reads in the user's language", () => {
     [{ code: "activate", reason: "not_allowed" }, "errors.admin.not_allowed"],
     [{ code: "invite_send", reason: "not_approved" }, "errors.admin.not_approved"],
     [{ code: "resend", reason: "send_failed" }, "errors.admin.send_failed"],
-    [{ code: "setpw", reason: "demo" }, "errors.admin.demo"],
   ])("says why an admin action was refused (%o)", async (detail, localized) => {
     // These read as the generic "try again" — which no retry fixes when the address is not approved.
     vi.spyOn(globalThis, "fetch").mockResolvedValue(
@@ -404,7 +403,7 @@ describe("req — what it has already put in front of the user", () => {
   });
 });
 
-// E16: while a debug session records, every request path names it — the server tags ITS lines of
+// While a debug session records, every request path names it — the server tags ITS lines of
 // that request with it. A path that forgot the header would leave holes in the evidence exactly
 // where the upload (XHR) or the unload beacon happened.
 describe("the debug session a tab records into", () => {
@@ -433,9 +432,9 @@ describe("the debug session a tab records into", () => {
   });
 });
 
-// P1 — the upload's wire shape is a security boundary, not a detail. A multipart part is a DECLARED
+// The upload's wire shape is a security boundary, not a detail. A multipart part is a DECLARED
 // body, which the server reads and spools BEFORE its auth dependency runs; the raw body is what lets
-// `require_human` resolve first. A revert to FormData here would silently re-open that, and the
+// `current_user` resolve first. A revert to FormData here would silently re-open that, and the
 // backend's own test only sees the shape the client actually sends.
 describe("uploadDownload's wire shape", () => {
   it("sends the File as the raw body, with the names as percent-encoded headers", () => {
diff --git a/frontend/src/lib/api/core.ts b/frontend/src/lib/api/core.ts
index 1a646932..2e5011bb 100644
--- a/frontend/src/lib/api/core.ts
+++ b/frontend/src/lib/api/core.ts
@@ -13,7 +13,7 @@ import { currentDebugSession, newRequestId } from "../log";
 /** The active UI language, as a bare code the server understands ("en"/"hu" — never "en-GB").
  *  Lives here so the request builders can stamp it themselves: a signal that has to be passed in by
  *  every caller is one every caller can forget, which is how the registration language shipped as a
- *  field nobody ever filled (E9.5 S6 → S7). */
+ *  field nobody ever filled. */
 export const uiLang = (): string => i18n.language.split("-")[0] || "en";
 
 // Errors `req` has already put in front of the user for good — the blocking error dialog, or the
@@ -24,7 +24,7 @@ export const uiLang = (): string => i18n.language.split("-")[0] || "en";
 // NOT the connection notice. It says the server is unreachable, not that this action failed, and it
 // removes itself on the next answer — which every caller's own resync refetch fetches at once. Marked
 // as reported, a delete that hit a keepalive reset (a 502) flashed the notice for a moment and was
-// then reported nowhere at all, the list still there (deep-review round 4).
+// then reported nowhere at all, the list still there.
 //
 // A caller that reports a failure itself marks it too (`notifyActionError` does), which is what lets
 // the ONE app-wide mutation reporter (lib/queryClient) stay quiet for a mutation whose own `onError`
@@ -71,7 +71,7 @@ export class HttpError extends Error {
 // with a dot-decimal separator. Falls back to a generic message for unknown shapes.
 // The refusal codes of the admin's account and invite actions (routes/admin.py). Their reasons share
 // one namespace, `errors.admin.<reason>`, which i18n/backendIds.contract checks against the backend.
-const ADMIN_REFUSALS = new Set(["activate", "resend", "invite_send", "setpw"]);
+const ADMIN_REFUSALS = new Set(["activate", "resend", "invite_send"]);
 
 function localizeDetail(d: unknown): string {
   const t = i18n.t.bind(i18n);
@@ -96,16 +96,12 @@ function localizeDetail(d: unknown): string {
     return t(`downloads.errors.edit.${o.reason}`, t("downloads.errors.edit.generic"));
   if (o?.code === "cookies")
     return t(`downloads.errors.cookies.${o.reason}`, t("downloads.errors.cookies.generic"));
-  // Password sign-in refusals (E9.5 S4). The card renders the account-shaped ones as a full panel
+  // Password sign-in refusals. The card renders the account-shaped ones as a full panel
   // off `detailData`; this is the one-line form every other consumer (and the card's own fallback)
   // gets. A reason this build doesn't know falls through to the generic message rather than showing
   // a raw key, which is what an i18n miss would otherwise put on screen.
   if (o?.code === "login")
     return t(`welcome.auth.blocked.${o.reason}.short`, t("welcome.auth.genericError"));
-  // The shared demo account refusing a personal-state write (`require_human`). Not every affordance
-  // behind that gate is UI-gated on `is_demo` — the comfort shelf is not — so without this the demo
-  // user got their caller's generic "couldn't do that" and no reason at all (round 6).
-  if (o?.code === "demo") return t("errors.demo");
   // The two email-link confirmations. Their failure is one a user meets by simply clicking an old
   // link, so it is the last place that may answer in hardcoded English under a bilingual UI.
   if (o?.code === "verify") return t("welcome.auth.verifyInvalid");
@@ -113,7 +109,7 @@ function localizeDetail(d: unknown): string {
     return o.reason === "weak_password"
       ? t("welcome.auth.weakPassword", { min: o.limit ?? o.min })
       : t("welcome.auth.deadLink.short");
-  // Local-upload ingest (E7 S5): the per-file cap carries the limit in bytes; empty is a bare code.
+  // Local-upload ingest: the per-file cap carries the limit in bytes; empty is a bare code.
   if (o?.code === "upload_too_large")
     return t("downloads.errors.upload.tooLarge", { size: formatBytes(o.limit, i18n.language) });
   if (o?.code === "upload_empty") return t("downloads.errors.upload.empty");
@@ -140,7 +136,7 @@ function localizeDetail(d: unknown): string {
   // from that address" — so an unknown reason falls back to the generic refusal rather than a key.
   if (o?.code === "url_blocked")
     return t(`downloads.errors.urlBlocked.${o.reason}`, t("downloads.errors.urlBlocked.generic"));
-  // E10 S2: the one-step "move to another list". Both reasons mean the same thing to a reader —
+  // The one-step "move to another list". Both reasons mean the same thing to a reader —
   // the list moved under you — but they are different enough to be worth naming separately, and an
   // unknown reason falls back to the plain failure rather than printing a key.
   if (o?.code === "playlist_move")
@@ -163,8 +159,8 @@ function localizeDetail(d: unknown): string {
   if (o?.code === "playlist") return t(`playlists.errors.${o.reason}`, t("errors.generic"));
   // An admin action on an account or an invite that the server refused: activating an address that
   // is no longer approved, a confirmation link or invitation with nothing to go to or no mail to go
-  // by, a set-password link for the shared demo account. The toast's title already names the button;
-  // this is the WHY, and it used to be the generic "try again", which no retry could fix.
+  // by. The toast's title already names the button; this is the WHY, and it used to be the generic
+  // "try again", which no retry could fix.
   if (ADMIN_REFUSALS.has(o?.code ?? "")) return t(`errors.admin.${o?.reason}`, t("errors.generic"));
   // Any row that is gone — deleted in another tab or device, or never the caller's (a stranger's
   // row 404s the same way). `reason` names WHAT is gone; one this build doesn't know says it
@@ -271,7 +267,7 @@ export const setupHeaders = (token: string) => ({
 // sessionStorage (per-tab, survives F5, not shared across tabs). null = use the session default.
 // The storage key + reader live in storage.ts (so its per-account helpers can use them too).
 const ACTIVE_ACCOUNT_HEADER = "X-Siftlode-Account";
-// The debug session this tab is recording (E16): the server tags its own lines of the request with
+// The debug session this tab is recording: the server tags its own lines of the request with
 // it, and logs them at the session's level. Ignored by the server unless it is the caller's own.
 const DEBUG_SESSION_HEADER = "X-Debug-Session";
 
@@ -395,7 +391,7 @@ export async function req<T = unknown>(
 // `HttpError` throw — so callers handle failures exactly as they do a `req` call.
 //
 // `body` is a `Blob`/`File` — the bytes themselves, and nothing else. `FormData` was the other
-// accepted shape until P1 and is deliberately gone: a multipart part is a DECLARED body, which
+// accepted shape once and is deliberately gone: a multipart part is a DECLARED body, which
 // FastAPI spools to disk before the route's auth dependency runs, and the backend dropped
 // `python-multipart` altogether, so there is no longer anything on the other end that could parse
 // one. `cfg.headers` is how a caller sends the metadata that used to ride as sibling form fields.
diff --git a/frontend/src/lib/api/diagnostics.ts b/frontend/src/lib/api/diagnostics.ts
index 489c62a3..a074b0da 100644
--- a/frontend/src/lib/api/diagnostics.ts
+++ b/frontend/src/lib/api/diagnostics.ts
@@ -1,4 +1,4 @@
-// The user's diagnostics level (E22 S5) and the browser log it lets out. Only touches core's req and
+// The user's diagnostics level and the browser log it lets out. Only touches core's req and
 // beacon. The streaming itself — what is sent, when, and when it stops — is `lib/diagnostics.ts`.
 import type { LogEvent } from "../log";
 import type { ServerLogRow } from "./admin";
@@ -37,7 +37,7 @@ export const diagnosticsApi = {
   sendLogEventsOnUnload: (events: LogEvent[]): void => beacon(DIAGNOSTICS_EVENTS_PATH, { events }),
 };
 
-// --- debug sessions (E16) ----------------------------------------------------------------------
+// --- debug sessions ----------------------------------------------------------------------
 
 /** The two levels a recording can run at — it always records more than the base. */
 export type DebugSessionLevel = "DEBUG" | "TRACE";
diff --git a/frontend/src/lib/api/discover.dom.test.ts b/frontend/src/lib/api/discover.dom.test.ts
index 880ba3aa..fc6309d3 100644
--- a/frontend/src/lib/api/discover.dom.test.ts
+++ b/frontend/src/lib/api/discover.dom.test.ts
@@ -51,7 +51,7 @@ describe("discoverApi query strings", () => {
   });
 });
 
-describe("the reader's language (E30)", () => {
+describe("the reader's language", () => {
   it("asks for Hungarian Plex cards on every Home read, and leaves English implied", async () => {
     await discoverApi.discover("any", 0, "hu");
     expect(lastUrl()).toContain("lang=hu");
diff --git a/frontend/src/lib/api/discover.ts b/frontend/src/lib/api/discover.ts
index e7d3794f..b11c5d26 100644
--- a/frontend/src/lib/api/discover.ts
+++ b/frontend/src/lib/api/discover.ts
@@ -1,4 +1,4 @@
-// The Home surface ("Mit nézzek most?", E24): one hero suggestion, a cross-source resume rail, and
+// The Home surface ("Mit nézzek most?"): one hero suggestion, a cross-source resume rail, and
 // the comfort shelf. Types mirror `backend/app/discover/` — the card carries the NATIVE feed / Plex
 // payload under `video` / `plex`, so the page renders through the existing VideoCard /
 // PlexPosterCard instead of a third card component.
@@ -71,7 +71,7 @@ export interface DiscoverPayload {
 }
 
 export const discoverApi = {
-  // `lang` "hu" serves a Plex card's Hungarian title (E30); en is the server default.
+  // `lang` "hu" serves a Plex card's Hungarian title; en is the server default.
   discover: (budget: DiscoverBudget, seed: number, lang?: string): Promise<DiscoverPayload> =>
     req(`/api/discover?budget=${budget}&seed=${seed}${lang === "hu" ? "&lang=hu" : ""}`),
   // The "Mást kérek" reroll: a new hero alone, so pressing it does not re-fetch the rails under the
diff --git a/frontend/src/lib/api/downloads.ts b/frontend/src/lib/api/downloads.ts
index 42777e78..2c05db1d 100644
--- a/frontend/src/lib/api/downloads.ts
+++ b/frontend/src/lib/api/downloads.ts
@@ -194,13 +194,13 @@ export const downloadsApi = {
     spec?: DownloadSpec;
     display_name?: string;
   }): Promise<DownloadJob> => req("/api/downloads", { method: "POST", body: JSON.stringify(body) }),
-  // Ingest a local file into the library (E7 S5). Sent via XHR rather than `req` so the dialog can
+  // Ingest a local file into the library. Sent via XHR rather than `req` so the dialog can
   // show upload progress; any file type is accepted (media gets the full function set, a generic
   // file is download-only). Returns the already-`done` job the ingest creates.
   // The body IS the file, and the two names ride as headers. Not a style choice: a multipart part is
-  // a DECLARED body, which FastAPI reads and spools BEFORE the route's `require_human` dependency
+  // a DECLARED body, which FastAPI reads and spools BEFORE the route's `current_user` dependency
   // runs — so with the old shape an unauthenticated caller could make the server write the whole
-  // per-file allowance to temp (P1). Headers are latin-1 on the wire, hence `encodeURIComponent`;
+  // per-file allowance to temp. Headers are latin-1 on the wire, hence `encodeURIComponent`;
   // the server percent-decodes both. Content-Type is left to the browser (the File's own type).
   uploadDownload: (
     file: File,
@@ -274,8 +274,9 @@ export const downloadsApi = {
   revokeDownloadLink: (linkId: number): Promise<{ deleted: number }> =>
     req(`/api/downloads/links/${linkId}`, { method: "DELETE" }),
   // A plain <a> navigation can't send the X-Siftlode-Account header, so pass the active
-  // account via ?account= (same wallet-gated selection the WebSocket uses) — otherwise the
-  // download resolves to the session-default account and 404s for a per-tab account's file.
+  // account via ?account= (the server honours it only for an account in this browser's wallet) —
+  // otherwise the download resolves to the session-default account and 404s for a per-tab
+  // account's file.
   downloadFileUrl: (id: number): string => {
     const a = getActiveAccount();
     return a != null ? `/api/downloads/${id}/file?account=${a}` : `/api/downloads/${id}/file`;
diff --git a/frontend/src/lib/api/facade.test.ts b/frontend/src/lib/api/facade.test.ts
index 936264f7..fb1f219c 100644
--- a/frontend/src/lib/api/facade.test.ts
+++ b/frontend/src/lib/api/facade.test.ts
@@ -1,9 +1,10 @@
 import { describe, it, expect, beforeAll } from "vitest";
 
-// The R7.5 guard: lib/api.ts is a spread-only façade over per-domain slice modules. These tests
+// The façade guard: lib/api.ts is a spread-only façade over per-domain slice modules. These tests
 // mechanise the two invariants that make that structure safe — so a future edit that reintroduces
 // the interleave (a method dropped into two slices → a silent last-wins spread override) or bloats
-// the barrel (a method defined inline instead of in a domain module) fails CI instead of shipping.
+// the barrel (a method defined inline instead of in a domain module) fails the gate instead of
+// shipping.
 //
 // Scope, on purpose: this covers RUNTIME method-key collisions — the only *silent* failure mode,
 // since tsc does not flag overlapping spread keys. It deliberately does NOT cover exported-TYPE-name
@@ -30,7 +31,6 @@ const SLICE_MODULES = [
   ["quotaApi", () => import("./quota")],
   ["adminApi", () => import("./admin")],
   ["plexApi", () => import("./plex")],
-  ["messagingApi", () => import("./messaging")],
   ["downloadsApi", () => import("./downloads")],
   ["diagnosticsApi", () => import("./diagnostics")],
   ["debugSessionsApi", () => import("./diagnostics")],
diff --git a/frontend/src/lib/api/feed.test.ts b/frontend/src/lib/api/feed.test.ts
index bc05aa09..eac57e59 100644
--- a/frontend/src/lib/api/feed.test.ts
+++ b/frontend/src/lib/api/feed.test.ts
@@ -1,4 +1,4 @@
-// E32 S2: lib/api/feed was barely covered, and it is where a filter turns into a query string.
+// Lib/api/feed was barely covered, and it is where a filter turns into a query string.
 // FastAPI IGNORES a query parameter it does not know, so a misspelt or renamed key does not fail —
 // the filter simply stops applying while its chip still shows. Locked two ways: what each filter
 // emits, and that every key emitted is one the backend's feed endpoints actually read.
diff --git a/frontend/src/lib/api/feed.ts b/frontend/src/lib/api/feed.ts
index 4f0a24b5..07bbd6ef 100644
--- a/frontend/src/lib/api/feed.ts
+++ b/frontend/src/lib/api/feed.ts
@@ -99,7 +99,7 @@ export interface FeedFilters {
   year?: number;
 }
 
-/** One year's video count for the year control's chips + "more…" dialog (item 8 / E8·S2). */
+/** One year's video count for the year control's chips + "more…" dialog. */
 export interface YearCount {
   year: number;
   count: number;
@@ -169,7 +169,7 @@ export const feedApi = {
   // the separate feedCount + facets the feed and sidebar used to fire on every filter change (PERF-13).
   feedSummary: (f: FeedFilters): Promise<{ count: number; facets: Record<string, number> }> =>
     req(`/api/feed/summary?${filterParams(f).toString()}`),
-  // Per-year video counts for the year control (item 8 / E8·S2). The backend drops the publish-date
+  // Per-year video counts for the year control. The backend drops the publish-date
   // narrowing, so callers key this on the date-stripped filters (picking a year mustn't refetch it).
   feedYears: (f: FeedFilters): Promise<{ years: YearCount[] }> =>
     req(`/api/feed/years?${filterParams(f).toString()}`),
diff --git a/frontend/src/lib/api/messaging.ts b/frontend/src/lib/api/messaging.ts
deleted file mode 100644
index 95f9b0bd..00000000
--- a/frontend/src/lib/api/messaging.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-// Direct-messaging domain: the E2EE key bundle setup/reset, the conversation list, threads, and
-// send/unread. Self-contained — types reference only each other, methods only touch core's req.
-// (The WebCrypto layer that encrypts/decrypts message bodies lives in e2ee.ts, not here.)
-import { req } from "./core";
-
-export interface MessageUser {
-  id: number;
-  name: string;
-  avatar_url: string | null;
-}
-
-export interface Message {
-  id: number;
-  kind: "user" | "system";
-  sender_id: number | null;
-  recipient_id: number;
-  body: string | null; // plaintext, system messages only
-  ciphertext: string | null; // base64, E2EE user messages only
-  iv: string | null;
-  read_at: string | null;
-  created_at: string | null;
-}
-
-export interface Conversation {
-  partner: MessageUser;
-  last_message: Message;
-  unread: number;
-}
-
-// My own E2EE key bundle. When configured, the wrapped blob + params let a device unlock.
-export interface MyKeyBundle {
-  configured: boolean;
-  public_key?: string;
-  wrapped_private_key?: string;
-  salt?: string;
-  wrap_iv?: string;
-  key_check?: string;
-}
-
-export interface KeySetup {
-  public_key: string;
-  wrapped_private_key: string;
-  salt: string;
-  wrap_iv: string;
-  key_check: string;
-}
-
-export const messagingApi = {
-  messageMyKey: (): Promise<MyKeyBundle> => req("/api/messages/keys/me"),
-  setupMessageKey: (k: KeySetup): Promise<{ configured: boolean }> =>
-    req("/api/messages/keys", { method: "POST", body: JSON.stringify(k) }),
-  // Forgotten-passphrase reset: drops the server key (and the now-undecryptable history) so a new
-  // passphrase can be set. Password accounts must pass their current password; errors shown inline.
-  resetMessageKey: (currentPassword?: string): Promise<{ configured: boolean }> =>
-    req(
-      "/api/messages/keys/reset",
-      { method: "POST", body: JSON.stringify({ current_password: currentPassword ?? null }) },
-      { quiet: true },
-    ),
-  messagePublicKey: (userId: number): Promise<{ user_id: number; public_key: string }> =>
-    req(`/api/messages/keys/${userId}`),
-  messageUsers: (): Promise<MessageUser[]> => req("/api/messages/users"),
-  conversations: (): Promise<{ items: Conversation[] }> => req("/api/messages/conversations"),
-  thread: (partnerId: number): Promise<{ partner: MessageUser; items: Message[] }> =>
-    req(`/api/messages/conversations/${partnerId}`),
-  sendMessage: (recipientId: number, ciphertext: string, iv: string): Promise<Message> =>
-    req("/api/messages", {
-      method: "POST",
-      body: JSON.stringify({ recipient_id: recipientId, ciphertext, iv }),
-    }),
-  messageUnreadCount: (): Promise<{ count: number }> => req("/api/messages/unread_count"),
-};
diff --git a/frontend/src/lib/api/plex.ts b/frontend/src/lib/api/plex.ts
index 516124d6..72b5e03c 100644
--- a/frontend/src/lib/api/plex.ts
+++ b/frontend/src/lib/api/plex.ts
@@ -55,8 +55,8 @@ export interface PlexCard {
   show_id?: string | null; // episode: the show's rating_key (for grouping a playlist by show/season)
   summary?: string | null; // movie/show hover-overview synopsis (trimmed) + episode summary
 }
-// TMDB enrichment block (E5 S2), served from OUR DB (never a live TMDB call) on a movie/show detail.
-// null until the row has been enriched. Powers the S5 enriched detail page: multi-source ratings row,
+// TMDB enrichment block, served from OUR DB (never a live TMDB call) on a movie/show detail.
+// null until the row has been enriched. Powers the enriched detail page: multi-source ratings row,
 // facts sidebar, keyword chips (→ filter), and the full crew.
 interface PlexTmdbCrew {
   name: string;
@@ -73,7 +73,7 @@ export interface PlexTmdb {
   keywords: string[];
   crew: PlexTmdbCrew[];
   studios: string[];
-  // ISO code (null on a row enriched before E30 whose name TMDB's list lacked) + TMDB's English name.
+  // ISO code (null on an older enriched row whose name TMDB's list lacked) + TMDB's English name.
   production_countries: { code: string | null; name: string }[];
   recommendations: { tmdb_id?: number | null; title?: string | null; in_library: boolean }[];
   backdrops: string[];
@@ -133,7 +133,7 @@ export interface PlexMarker {
   start_s: number;
   end_s: number;
 }
-// What the player names an audio/subtitle track from (E30, `lib/vocab` trackLabel). Plex's own title
+// What the player names an audio/subtitle track from (`lib/vocab` trackLabel). Plex's own title
 // (`label`) is in the Plex SERVER's language, so it is only the fallback for a track with no language tag.
 export interface PlexTrackNaming {
   ord: number;
@@ -239,7 +239,7 @@ export interface PlexPersonCard {
 export interface PlexPersonDetail {
   name: string;
   photo?: string | null; // cached headshot, or null (placeholder)
-  // TMDB bio (E5 S6), fetched ahead of time by the people_enrich job (E30 S6) and served from the row.
+  // TMDB bio, fetched ahead of time by the people_enrich job and served from the row.
   // Null when the person has no linked tmdb_person_id (never appeared in a TMDB-enriched title), TMDB
   // has none, or it is still on its way (`enriching`).
   biography?: string | null;
@@ -270,7 +270,7 @@ export interface PlexFilters {
   actorMode?: "any" | "all"; // how multiple actors combine (default any = OR)
   studios: string[]; // OR — from any selected studio
   playable: string[]; // OR — playback class (direct | remux | transcode_hw | transcode_sw); movie-only
-  keywords: string[]; // AND — TMDB keyword chips from the detail page (E5 S5)
+  keywords: string[]; // AND — TMDB keyword chips from the detail page
   collections: string[]; // Plex collection rating_keys; a title can be in several
   collectionMode?: "any" | "all"; // how multiple collections combine (default any = OR)
   collectionTitles?: Record<string, string>; // rating_key → title, for the active-filter chips
@@ -400,7 +400,7 @@ export function parsePlexFilters(p: URLSearchParams): PlexFilters {
 export interface PlexFacets {
   genres: { value: string; count: number }[];
   content_ratings: { value: string; count: number }[];
-  studios: { value: string; count: number }[]; // studio vocabulary for the sidebar picker (E5 S7)
+  studios: { value: string; count: number }[]; // studio vocabulary for the sidebar picker
   // Playback-class facet (movie-only): value ∈ direct|remux|transcode_hw|transcode_sw. Empty on shows.
   playable: { value: string; count: number }[];
   year_min: number | null;
@@ -418,7 +418,7 @@ export interface PlexPlaySession {
   tonemap?: boolean; // hls HW transcode only: 10-bit/HDR source tone-mapped HDR→SDR on the GPU (OpenCL)
 }
 
-// Discover surface (E5 S4): the consolidated rail payload. Every rail is a plain PlexCard list the
+// Discover surface: the consolidated rail payload. Every rail is a plain PlexCard list the
 // dedicated Discover landing renders as a horizontal Carousel; `because_you_watched` is null when the
 // user has no TMDB-enriched watch history (rail hidden). Served from DB — no live Plex/TMDB call.
 export interface PlexDiscover {
diff --git a/frontend/src/lib/api/plexFilters.dom.test.ts b/frontend/src/lib/api/plexFilters.dom.test.ts
index cdeef134..5ab4faa0 100644
--- a/frontend/src/lib/api/plexFilters.dom.test.ts
+++ b/frontend/src/lib/api/plexFilters.dom.test.ts
@@ -6,7 +6,7 @@ import { plexFiltersToParams, type PlexFilters } from "./plex";
 
 // FastAPI ignores a query parameter it does not know, so a Plex filter key the frontend misspells or
 // the backend renames does not fail anywhere — the filter silently stops narrowing while its chip
-// still shows (E32 S2, the sibling of lib/api/feed.test.ts). Every key the filter set can put on the
+// still shows (the sibling of lib/api/feed.test.ts). Every key the filter set can put on the
 // wire must be a field of the backend's LibraryFilters, which /library and /facets both inject.
 // Required: a new filter field fails tsc here until it has a value, so the checks below see its key.
 const EVERYTHING: Required<PlexFilters> = {
diff --git a/frontend/src/lib/api/plexLang.dom.test.ts b/frontend/src/lib/api/plexLang.dom.test.ts
index 8add679c..4e9f8ab6 100644
--- a/frontend/src/lib/api/plexLang.dom.test.ts
+++ b/frontend/src/lib/api/plexLang.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E30: every Plex read that returns cards carries the reader's language, so the server can serve the
+// Every Plex read that returns cards carries the reader's language, so the server can serve the
 // Hungarian titles. The grid and the detail pages always did; these reads did not.
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { plexApi } from "./plex";
diff --git a/frontend/src/lib/api/tagModes.ts b/frontend/src/lib/api/tagModes.ts
index a8e67d28..47863787 100644
--- a/frontend/src/lib/api/tagModes.ts
+++ b/frontend/src/lib/api/tagModes.ts
@@ -4,7 +4,6 @@
 
 /**
  * A tag category's match: "or" = a channel with ANY selected tag passes, "and" = it must carry ALL.
- * @internal exported for its test
  */
 type TagMode = "or" | "and";
 /** The three tag categories, each with its OWN independent match mode. */
diff --git a/frontend/src/lib/api/tags.ts b/frontend/src/lib/api/tags.ts
index 144eb30d..fc1db31b 100644
--- a/frontend/src/lib/api/tags.ts
+++ b/frontend/src/lib/api/tags.ts
@@ -10,7 +10,7 @@ export interface Tag {
   channel_count: number;
 }
 
-// One suggested user-tag for a channel, learned from the user's own manual-tag pattern (E8·S4).
+// One suggested user-tag for a channel, learned from the user's own manual-tag pattern.
 interface TagSuggestion {
   tag_id: number;
   confidence: number;
diff --git a/frontend/src/lib/auditGroups.test.ts b/frontend/src/lib/auditGroups.test.ts
index a4f6a7c3..85ff1f18 100644
--- a/frontend/src/lib/auditGroups.test.ts
+++ b/frontend/src/lib/auditGroups.test.ts
@@ -1,4 +1,4 @@
-// E31: the audit log's first screen was one job's "done" ten times over. A job's successful runs fold
+// The audit log's first screen was one job's "done" ten times over. A job's successful runs fold
 // into one row whatever ran between them (the owner: a fold broken by every other job read as the same
 // row five times); only that job's own failure or skip breaks it.
 import { describe, expect, it } from "vitest";
diff --git a/frontend/src/lib/auditGroups.ts b/frontend/src/lib/auditGroups.ts
index ace58e36..4cb380a7 100644
--- a/frontend/src/lib/auditGroups.ts
+++ b/frontend/src/lib/auditGroups.ts
@@ -1,6 +1,6 @@
 import type { AuditRow } from "./api";
 
-// The audit log's scheduler noise, folded (E31, the owner's pick): the background jobs write a row per
+// The audit log's scheduler noise, folded (the owner's pick): the background jobs write a row per
 // run that changed something, so an hour of "enrichment done" filled the first screen and pushed the
 // admins' own actions down. A job's SUCCESSFUL runs become one row that names how many there were and
 // opens to each — whatever ran between them (another job, an admin's action): the owner read a fold
diff --git a/frontend/src/lib/buttonPrimitive.contract.test.ts b/frontend/src/lib/buttonPrimitive.contract.test.ts
index 3cc4b8eb..7d5f69b3 100644
--- a/frontend/src/lib/buttonPrimitive.contract.test.ts
+++ b/frontend/src/lib/buttonPrimitive.contract.test.ts
@@ -1,9 +1,9 @@
 import { describe, expect, it } from "vitest";
 
-import { eslint } from "./lintProbe.testkit";
+import { eslint, uiFiles } from "./lintProbe.testkit";
 
-// `local/button-primitive` (eslint.config.js): one primitive per button family (docs/DESIGN.md, E28
-// S3b). 268 hand-rolled buttons were swept onto ui/Button, IconButton, Pressable, Chip and
+// `local/button-primitive` (eslint.config.js): one primitive per button family (docs/DESIGN.md).
+// 268 hand-rolled buttons were swept onto ui/Button, IconButton, Pressable, Chip and
 // DragHandle; this pins that the rule keeping a new one out actually fires, and where it stands down.
 const RULE = "local/button-primitive";
 
@@ -43,6 +43,37 @@ describe("a hand-rolled button", () => {
     ).toBe(0);
   });
 
+  // The primitive list lives in the rule body, where neither the gate snapshot nor docs/gates.md
+  // sees it, so this holds it to exactly these files of ui/.
+  it("is allowed in exactly the control primitives of ui/", { timeout: 60_000 }, async () => {
+    const allowed: string[] = [];
+    for (const file of uiFiles())
+      if (
+        (await hits(
+          'export const R = () => <button type="button">x</button>;\n',
+          `src/components/ui/${file}`,
+        )) === 0
+      )
+        allowed.push(file);
+    expect(allowed).toEqual([
+      "AnchoredPopover.tsx",
+      "Button.tsx",
+      "Chip.tsx",
+      "Combobox.tsx",
+      "DragHandle.tsx",
+      "FilterSelect.tsx",
+      "FocusSafeButton.tsx",
+      "IconButton.tsx",
+      "Pressable.tsx",
+      "PriorityStepper.tsx",
+      "SegmentedToggle.tsx",
+      "SelectTrigger.tsx",
+      "SortControl.tsx",
+      "Tabs.tsx",
+      "form.tsx",
+    ]);
+  });
+
   it("is refused spelled as an element with the button role; a component's role is its own", async () => {
     expect(await hits('export const F = () => <div role="button" tabIndex={0}>x</div>;\n')).toBe(1);
     expect(await hits('export const G = () => <span role="button">x</span>;\n')).toBe(1);
diff --git a/frontend/src/lib/captureTab.dom.test.ts b/frontend/src/lib/captureTab.dom.test.ts
index 3b751d76..83efb790 100644
--- a/frontend/src/lib/captureTab.dom.test.ts
+++ b/frontend/src/lib/captureTab.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E16: one screenshot of this tab. The browser's picker is stubbed (jsdom has no Screen Capture API):
+// One screenshot of this tab. The browser's picker is stubbed (jsdom has no Screen Capture API):
 // a cancelled or refused picker is the user saying no (null, no error); anything else is an error;
 // a tab that was shared but gave no frame is an error too, not a silent nothing; and the capture is
 // stopped whatever happened — nothing keeps sharing the tab after one frame.
diff --git a/frontend/src/lib/captureTab.ts b/frontend/src/lib/captureTab.ts
index 69c8220f..c7b21fb2 100644
--- a/frontend/src/lib/captureTab.ts
+++ b/frontend/src/lib/captureTab.ts
@@ -1,4 +1,4 @@
-// One screenshot of this tab, for a debug session (E16 D5).
+// One screenshot of this tab, for a debug session.
 //
 // Through the Screen Capture API with the current tab preferred: the browser asks every time (there
 // is no silent capture on the web, by design), the user can pick something else or cancel, and one
diff --git a/frontend/src/lib/channelLayout.ts b/frontend/src/lib/channelLayout.ts
index b4a1d7e4..58b6ebb6 100644
--- a/frontend/src/lib/channelLayout.ts
+++ b/frontend/src/lib/channelLayout.ts
@@ -1,4 +1,4 @@
-// The channel manager's layout vocabulary (E4 S3). Named `ChannelLayout` — NOT `ChannelView` — on
+// The channel manager's layout vocabulary. Named `ChannelLayout` — NOT `ChannelView` — on
 // purpose: the manager already has a `ChannelsView` (the subscribed/discovery/blocked TAB), and a
 // one-letter-apart type would be a footgun. This is the table-vs-card density switch, riding the
 // same generic `ViewSwitcher` as the feed. Two layouts: the DataTable, and a virtualized card grid.
diff --git a/frontend/src/lib/channelOrder.dom.test.ts b/frontend/src/lib/channelOrder.dom.test.ts
index 479b8751..04fa69f3 100644
--- a/frontend/src/lib/channelOrder.dom.test.ts
+++ b/frontend/src/lib/channelOrder.dom.test.ts
@@ -42,7 +42,7 @@ describe("placeByPriority", () => {
     expect(ids(placeByPriority(list, "nope", EN))).toEqual(ids(list));
   });
 
-  it("places a title in the reader's alphabet, as the server's collation does (E30 review)", () => {
+  it("places a title in the reader's alphabet, as the server's collation does", () => {
     const rows = [row("e", 0, "Ecset"), row("f", 0, "Fa"), row("m", 5, "Életrajz")];
     const moved = [...rows.slice(0, 2), { ...rows[2]!, priority: 0 }];
     expect(ids(placeByPriority(moved, "m", HU))).toEqual(["e", "m", "f"]);
diff --git a/frontend/src/lib/channelOrder.ts b/frontend/src/lib/channelOrder.ts
index 5eb877f0..f9251137 100644
--- a/frontend/src/lib/channelOrder.ts
+++ b/frontend/src/lib/channelOrder.ts
@@ -1,7 +1,7 @@
 import { compareText } from "./collate";
 import { serverOrderLang } from "./saveLanguage";
 
-// The channel manager's list order, and the priority steps its menu offers (E28 S3e3b).
+// The channel manager's list order, and the priority steps its menu offers.
 
 /** The steps a channel's menu offers (owner, 2026-09-26): fixed levels, so bubbling a channel up
  *  the list is one pick, not a run of +1 presses, and not straight to the top either. The row's
diff --git a/frontend/src/lib/channelWriteFailures.dom.test.tsx b/frontend/src/lib/channelWriteFailures.dom.test.tsx
index 6d90be4f..ec087934 100644
--- a/frontend/src/lib/channelWriteFailures.dom.test.tsx
+++ b/frontend/src/lib/channelWriteFailures.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The two shared channel write flows report their own failures, with the real error (E11 S2b).
+// The two shared channel write flows report their own failures, with the real error.
 // Before: the channel detail page's tag toggle and both pages' priority stepper only refetched, so a
 // refused write just snapped back; and the manager reported a failed tag toggle by handing the
 // CHANNEL ID to the reporter as though it were the error.
diff --git a/frontend/src/lib/channelsUrlState.dom.test.ts b/frontend/src/lib/channelsUrlState.dom.test.ts
index a91490ea..852a2d4c 100644
--- a/frontend/src/lib/channelsUrlState.dom.test.ts
+++ b/frontend/src/lib/channelsUrlState.dom.test.ts
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
-// S8 — the Channels-manager content state (active tab + column sort + the column-filter map) round-trips
-// through namespaced URL keys (ctab/csort/cf) so a manager view is shareable, the S4/plexUrlState
+// The Channels-manager content state (active tab + column sort + the column-filter map) round-trips
+// through namespaced URL keys (ctab/csort/cf) so a manager view is shareable, the plexUrlState
 // analogue. `cf` carries the mixed scalar/array FilterMap as a JSON blob.
 import { describe, expect, it } from "vitest";
 import {
diff --git a/frontend/src/lib/channelsUrlState.ts b/frontend/src/lib/channelsUrlState.ts
index 2a930f9d..3a0fdd0e 100644
--- a/frontend/src/lib/channelsUrlState.ts
+++ b/frontend/src/lib/channelsUrlState.ts
@@ -1,6 +1,6 @@
 // Serialize the Channels-manager content state (active tab + column sort + the column-filter map) to/
-// from the address bar so a manager view is bookmarkable/shareable — the S8 analogue of the feed's
-// urlState and Plex's plexUrlState (S4). Keys are NAMESPACED (`ctab`/`csort`/`cf`) so they're
+// from the address bar so a manager view is bookmarkable/shareable — the analogue of the feed's
+// urlState and Plex's plexUrlState. Keys are NAMESPACED (`ctab`/`csort`/`cf`) so they're
 // channels-unique (like `?v=`/`?pl`/`pscope`): no other provider ever reads or clears them, and the
 // feed's URL-stripping can't delete them out from under the manager. Only non-default values are
 // emitted, so URLs stay clean. The manager's name search is deliberately EPHEMERAL (like the feed/plex
@@ -8,7 +8,7 @@
 import { decodeSortParam, encodeSortParam, type SortState } from "./columnSort";
 import { type FilterMap } from "./tableColumns";
 
-// The content state S8 mirrors. `view` is the raw tab string (the provider clamps it); `sort` is the
+// The content state this mirrors. `view` is the raw tab string (the provider clamps it); `sort` is the
 // raw provider SortState (healed against live columns only at the point of use), so the user's real
 // preference round-trips through the URL.
 export interface ChannelsUrlState {
diff --git a/frontend/src/lib/chatDock.dom.test.ts b/frontend/src/lib/chatDock.dom.test.ts
deleted file mode 100644
index adaf4e7f..00000000
--- a/frontend/src/lib/chatDock.dom.test.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-// @vitest-environment jsdom
-//
-// The floating chat dock's store (E32 review: moved onto lib/store's createStore). It restores the
-// signed-in user's windows, keeps at most three, flashes a window a message arrives for, and
-// persists everything but the transient flash counter.
-import { describe, expect, it } from "vitest";
-import { act, renderHook } from "@testing-library/react";
-import {
-  closeChat,
-  initDock,
-  notifyIncoming,
-  openChat,
-  toggleMinimize,
-  useDockChats,
-} from "./chatDock";
-import { LS } from "./storage";
-
-const partner = (id: number) => ({ id, name: `P${id}`, avatar_url: null });
-
-describe("the chat dock", () => {
-  it("restores, caps, flashes and persists the user's windows", () => {
-    localStorage.setItem(
-      LS.chatDock(7),
-      JSON.stringify([{ partnerId: 1, name: "P1", avatar: null, minimized: true }]),
-    );
-    const { result } = renderHook(() => useDockChats());
-    act(() => initDock(7));
-    expect(result.current).toEqual([
-      { partnerId: 1, name: "P1", avatar: null, minimized: true, flash: 0 },
-    ]);
-
-    act(() => notifyIncoming(partner(1))); // already open: flash it, keep it minimised
-    expect(result.current[0]).toMatchObject({ partnerId: 1, minimized: true, flash: 1 });
-
-    act(() => {
-      for (const id of [2, 3, 4]) openChat(partner(id));
-    });
-    expect(result.current.map((c) => c.partnerId)).toEqual([4, 3, 2]); // newest first, three at most
-
-    act(() => toggleMinimize(3));
-    act(() => closeChat(2));
-    expect(result.current.map((c) => [c.partnerId, c.minimized])).toEqual([
-      [4, false],
-      [3, true],
-    ]);
-    const stored = JSON.parse(localStorage.getItem(LS.chatDock(7))!) as object[];
-    expect(stored).toEqual([
-      { partnerId: 4, name: "P4", avatar: null, minimized: false },
-      { partnerId: 3, name: "P3", avatar: null, minimized: true },
-    ]);
-  });
-});
diff --git a/frontend/src/lib/chatDock.ts b/frontend/src/lib/chatDock.ts
deleted file mode 100644
index 2f8216c6..00000000
--- a/frontend/src/lib/chatDock.ts
+++ /dev/null
@@ -1,113 +0,0 @@
-// App-wide store of open floating chat windows (the Messenger-style dock, bottom-right).
-// A window can be opened from anywhere (a conversation's "pop out" button, or automatically
-// when a message arrives) and stays open across page navigation. The dock state (which chats
-// are open + their minimised state) is persisted per user so it survives a reload.
-import { LS } from "./storage";
-import { createStore } from "./store";
-
-export interface DockChat {
-  partnerId: number;
-  name: string;
-  avatar: string | null;
-  minimized: boolean;
-  flash: number; // bumped to trigger a one-shot attention flash on the window
-}
-
-type PartnerLike = { id: number; name: string; avatar_url: string | null };
-
-const MAX_OPEN = 3; // keep the dock from overflowing the corner
-const dock = createStore<DockChat[]>([]);
-let userId: number | null = null;
-
-function storageKey(): string | null {
-  return userId != null ? LS.chatDock(userId) : null;
-}
-
-function persist(): void {
-  const k = storageKey();
-  if (!k) return;
-  try {
-    // Don't persist the transient flash counter.
-    localStorage.setItem(k, JSON.stringify(dock.get().map(({ flash, ...c }) => c)));
-  } catch {
-    /* ignore quota/serialization errors */
-  }
-}
-
-function emit(next: DockChat[]): void {
-  dock.set(next);
-  persist();
-}
-
-// Bind the dock to the signed-in user and restore their persisted windows (once per user).
-export function initDock(uid: number): void {
-  if (userId === uid) return;
-  userId = uid;
-  let restored: DockChat[] = [];
-  try {
-    const raw = localStorage.getItem(storageKey()!);
-    if (raw)
-      restored = (JSON.parse(raw) as Omit<DockChat, "flash">[]).map((c) => ({ ...c, flash: 0 }));
-  } catch {
-    restored = [];
-  }
-  dock.set(restored.slice(0, MAX_OPEN));
-}
-
-export function openChat(partner: PartnerLike): void {
-  const existing = dock.get().find((c) => c.partnerId === partner.id);
-  if (existing) {
-    // Re-opening focuses it: ensure expanded and move to the front.
-    emit([
-      { ...existing, minimized: false },
-      ...dock.get().filter((c) => c.partnerId !== partner.id),
-    ]);
-    return;
-  }
-  emit(
-    [
-      {
-        partnerId: partner.id,
-        name: partner.name,
-        avatar: partner.avatar_url,
-        minimized: false,
-        flash: 0,
-      },
-      ...dock.get(),
-    ].slice(0, MAX_OPEN),
-  );
-}
-
-// An incoming message arrived from `partner`: open the window if it's closed, otherwise just
-// flash it (whether expanded or minimised — don't disturb the minimised state).
-export function notifyIncoming(partner: PartnerLike): void {
-  const existing = dock.get().find((c) => c.partnerId === partner.id);
-  if (!existing) {
-    emit(
-      [
-        {
-          partnerId: partner.id,
-          name: partner.name,
-          avatar: partner.avatar_url,
-          minimized: false,
-          flash: 1,
-        },
-        ...dock.get(),
-      ].slice(0, MAX_OPEN),
-    );
-    return;
-  }
-  emit(dock.get().map((c) => (c.partnerId === partner.id ? { ...c, flash: c.flash + 1 } : c)));
-}
-
-export function closeChat(partnerId: number): void {
-  emit(dock.get().filter((c) => c.partnerId !== partnerId));
-}
-
-export function toggleMinimize(partnerId: number): void {
-  emit(dock.get().map((c) => (c.partnerId === partnerId ? { ...c, minimized: !c.minimized } : c)));
-}
-
-export function useDockChats(): DockChat[] {
-  return dock.useValue();
-}
diff --git a/frontend/src/lib/chipLane.contract.test.ts b/frontend/src/lib/chipLane.contract.test.ts
index 15bda4c1..64161194 100644
--- a/frontend/src/lib/chipLane.contract.test.ts
+++ b/frontend/src/lib/chipLane.contract.test.ts
@@ -4,7 +4,7 @@ import { describe, expect, it } from "vitest";
 
 import { chipLaneClass } from "./useChipOverflowFit";
 
-// E10 S4. The chip lanes' hidden measurer is laid out UNBOUNDED on purpose (it exists to read natural
+// The chip lanes' hidden measurer is laid out UNBOUNDED on purpose (it exists to read natural
 // widths), and an absolutely-positioned box still feeds its ancestors' SCROLLABLE overflow even while
 // `visibility: hidden`. Un-clipped, that leaked to <html>: at a 1024px viewport the channel manager's
 // document scrolled 249px sideways and the fixed header slid off. `chipLaneClass` carries the clip that
@@ -15,7 +15,7 @@ import { chipLaneClass } from "./useChipOverflowFit";
 // COUNTED per occurrence, not tested per file. The first cut asked `src.includes(chipLaneClass)`, which
 // a file could satisfy with ONE compliant lane while hand-rolling a second — and ChannelTags already
 // holds two lanes and two mirrors, so the likeliest place for a fifth lane was the one file the check
-// was blind inside (E10 review round 1).
+// was blind inside.
 const MIRROR = "invisible absolute left-0 top-0";
 // A mirror only exists to be measured, so the hook is the other half of the signature. Discovering by
 // BOTH means a mirror written with the utilities in another order is still caught by its import.
@@ -28,7 +28,7 @@ function count(haystack: string, needle: string): number {
 /** Occurrences of `chipLaneClass` that are actually a LANE, i.e. not the import that brings it in.
  *  Counting raw occurrences gave every file one free mirror — the import — so a second, unprotected
  *  lane in a file that already had a compliant one still passed, which is the exact hole this test
- *  was rewritten to close (E10 review round 2, caught by mutation). */
+ *  was rewritten to close (caught by mutation). */
 function laneCount(src: string): number {
   // `[^;]` rather than `[\s\S]`: an import is stripped up to ITS OWN `from "…";`. The lazy any-char
   // form ran past a side-effect import (`import "./x.css";` has no `from`) into the next statement's
@@ -86,7 +86,7 @@ describe("chip lane containment contract", () => {
 
   it("finds the measurers it claims to guard (the marker has not been renamed away)", () => {
     // The MIRROR alone, not the hook: `lib/chipOverflow.ts` names the hook in a prose comment and was
-    // padding this canary, so it stayed satisfied with one real measurer fewer (round 2).
+    // padding this canary, so it stayed satisfied with one real measurer fewer.
     expect(sources().filter(([, src]) => src.includes(MIRROR)).length).toBeGreaterThanOrEqual(3);
   });
 
diff --git a/frontend/src/lib/collate.ts b/frontend/src/lib/collate.ts
index e829818c..f439dac2 100644
--- a/frontend/src/lib/collate.ts
+++ b/frontend/src/lib/collate.ts
@@ -1,4 +1,4 @@
-// Alphabetical order in the UI language (E30 S3): Hungarian puts "Ö" after "O" and "Cs" after "Cu". A
+// Alphabetical order in the UI language: Hungarian puts "Ö" after "O" and "Cs" after "Cu". A
 // bare `localeCompare` compares in the BROWSER's locale; the server sorts by the same ICU rules
 // (backend `app/collation.py`), so a list sorted here agrees with one the server sorted. Its own
 // module, apart from lib/format.ts, because it needs no i18n: the pure sort helpers import it.
diff --git a/frontend/src/lib/colorMath.ts b/frontend/src/lib/colorMath.ts
index a58f6b19..c5d072f0 100644
--- a/frontend/src/lib/colorMath.ts
+++ b/frontend/src/lib/colorMath.ts
@@ -34,7 +34,6 @@ export function hueGap(a: string, b: string): number {
 
 /** `color-mix(in srgb, a w, b)` for two opaque hex colours: the channels mix gamma-encoded, as the
  *  browser does in the srgb space. */
-/** @internal exported for theme.contract.test.ts */
 export function mixHex(a: string, b: string, w: number): string {
   const [x, y] = [rgb(a), rgb(b)];
   return `#${x
diff --git a/frontend/src/lib/columnSort.test.ts b/frontend/src/lib/columnSort.test.ts
index e0441999..096b63aa 100644
--- a/frontend/src/lib/columnSort.test.ts
+++ b/frontend/src/lib/columnSort.test.ts
@@ -55,7 +55,7 @@ describe("sortRows", () => {
     ]);
   });
 
-  // E30 S3: text sorts in the UI language's alphabet, not the browser's — Hungarian puts "Ö" after
+  // Text sorts in the UI language's alphabet, not the browser's — Hungarian puts "Ö" after
   // "O" and "Cs" after "Cu". Both languages are asserted and differ, so a bare `localeCompare` (one
   // runtime locale for both) cannot pass on any machine.
   it("sorts text in the UI language's alphabet", () => {
diff --git a/frontend/src/lib/cropGeometry.ts b/frontend/src/lib/cropGeometry.ts
index eebd268f..3082a134 100644
--- a/frontend/src/lib/cropGeometry.ts
+++ b/frontend/src/lib/cropGeometry.ts
@@ -1,7 +1,7 @@
 // Crop geometry for the video editor — the display-px ↔ source-px mapping, isolated as pure
 // functions so the math is unit-testable without a DOM.
 //
-// The bug this fixes (E7 S1→S2): the crop marquee is drawn in fractions of the *video element box*,
+// The bug this fixes: the crop marquee is drawn in fractions of the *video element box*,
 // but a letterboxed video (object-fit: contain) does NOT fill that box — pillar/letterbox bars sit
 // between the box edge and the actual picture. Multiplying box-fractions by the source resolution
 // therefore emitted an ffmpeg crop shifted/scaled off from what the selector showed. The fix is to
diff --git a/frontend/src/lib/dateFilter.ts b/frontend/src/lib/dateFilter.ts
index 57db0d2b..2c63f6f2 100644
--- a/frontend/src/lib/dateFilter.ts
+++ b/frontend/src/lib/dateFilter.ts
@@ -67,7 +67,7 @@ const FIRST_UPLOAD_YEAR = 2005;
 
 /** Whether a native date field's value is a bound worth filtering by. The field reports a COMPLETE
  *  date on every keystroke of its year — typing 2026 passes 0002, 0020 and 0202, each a valid date to
- *  the browser — so applying every value refetched the feed four times for one year (E28). A bound is
+ *  the browser — so applying every value refetched the feed four times for one year. A bound is
  *  applied once it is a plausible upload day; a half-typed field reports "" and is not one either. */
 export function isCommittableDay(s: string): boolean {
   const m = /^(\d{4})-\d{2}-\d{2}$/.exec(s);
diff --git a/frontend/src/lib/debugRecorder.ts b/frontend/src/lib/debugRecorder.ts
index 4f0ec654..f4efd5ee 100644
--- a/frontend/src/lib/debugRecorder.ts
+++ b/frontend/src/lib/debugRecorder.ts
@@ -1,6 +1,6 @@
 import { createStore } from "./store";
 
-// The debug recorder's app-wide state (E16) — what several surfaces open or read, held outside any
+// The debug recorder's app-wide state — what several surfaces open or read, held outside any
 // one of them: Settings, the command palette and the recorder itself all open the start dialog, and
 // the composer opens for whichever session just ended.
 
diff --git a/frontend/src/lib/detailLog.dom.test.ts b/frontend/src/lib/detailLog.dom.test.ts
index 37b73392..02c07ec1 100644
--- a/frontend/src/lib/detailLog.dom.test.ts
+++ b/frontend/src/lib/detailLog.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E22 S5: the detail the consented levels add — filter changes and what a player went through.
+// The detail the consented levels add — filter changes and what a player went through.
 // Below Részletes they cost nothing and log nothing, except a media error, which is always a warning.
 import { afterEach, describe, expect, it } from "vitest";
 
diff --git a/frontend/src/lib/diagnostics.dom.test.ts b/frontend/src/lib/diagnostics.dom.test.ts
index 57ff9feb..5491ff46 100644
--- a/frontend/src/lib/diagnostics.dom.test.ts
+++ b/frontend/src/lib/diagnostics.dom.test.ts
@@ -1,9 +1,9 @@
 // @vitest-environment jsdom
 //
-// E22 S5: the consented level applied to the tab, and the stream it opens. The module keeps its state
+// The consented level applied to the tab, and the stream it opens. The module keeps its state
 // at module level (what is applied, the queue), so every test imports a fresh copy — and the log
 // from that same copy, or it would be reading a different ring.
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 
 const sent: unknown[][] = [];
 const unloaded: unknown[][] = [];
@@ -24,6 +24,15 @@ vi.mock("./api", async () => {
   };
 });
 
+// Warm the transform cache once (see verifyEntry.dom.test.tsx): the first cold import costs ~0.8 s
+// alone and outran the 5 s case timeout under a full coverage run. Transformed code outlives
+// vi.resetModules, so each case still gets fresh module instances, only faster.
+beforeAll(async () => {
+  await import("./diagnostics");
+  await import("./log");
+  await import("./api");
+}, 60_000);
+
 beforeEach(() => {
   vi.useFakeTimers();
   vi.resetModules();
diff --git a/frontend/src/lib/diagnostics.session.dom.test.ts b/frontend/src/lib/diagnostics.session.dom.test.ts
index 0cb2ec0a..25aeae78 100644
--- a/frontend/src/lib/diagnostics.session.dom.test.ts
+++ b/frontend/src/lib/diagnostics.session.dom.test.ts
@@ -1,10 +1,10 @@
 // @vitest-environment jsdom
 //
-// E16: a debug session applied to the tab. It raises the level for its own run (starting it was the
+// A debug session applied to the tab. It raises the level for its own run (starting it was the
 // consent), never lowers a raised one, tags every event it keeps, and its last seconds reach the
 // server before Stop. Its own file: `lib/diagnostics` and `lib/log` keep module-level state, so every
 // test imports fresh copies of both, as diagnostics.dom.test does.
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 
 const sent: { event: string; debug_session_id?: string }[][] = [];
 
@@ -45,6 +45,14 @@ const recording = (level: "DEBUG" | "TRACE", minutes = 60, over = {}) => ({
   ...over,
 });
 
+// Warm the transform cache once (see verifyEntry.dom.test.tsx): the first cold import costs ~0.8 s
+// alone and outran the 5 s case timeout under a full coverage run. Transformed code outlives
+// vi.resetModules, so each case still gets fresh module instances, only faster.
+beforeAll(async () => {
+  await import("./diagnostics");
+  await import("./log");
+}, 60_000);
+
 let current: typeof import("./diagnostics") | null = null;
 beforeEach(() => {
   vi.useFakeTimers();
diff --git a/frontend/src/lib/diagnostics.ts b/frontend/src/lib/diagnostics.ts
index dae32b72..0fd9549c 100644
--- a/frontend/src/lib/diagnostics.ts
+++ b/frontend/src/lib/diagnostics.ts
@@ -1,5 +1,5 @@
-// The user's consented diagnostics level, applied to this tab (E22 S5) — and the debug session it
-// may be recording (E16).
+// The user's consented diagnostics level, applied to this tab — and the debug session it
+// may be recording.
 //
 // `applyDiagnostics(me.diagnostics, me.debug_session)` runs whenever `me` answers. It sets the client
 // log's level, and while that level is raised (Részletes / Teljes) it streams the log to the server:
diff --git a/frontend/src/lib/downloadActions.test.ts b/frontend/src/lib/downloadActions.test.ts
index 4b3fc85a..f638f195 100644
--- a/frontend/src/lib/downloadActions.test.ts
+++ b/frontend/src/lib/downloadActions.test.ts
@@ -1,4 +1,4 @@
-// E7·S5b — the Library/Shared row-action gate. A generic uploaded file (media_kind='file') is
+// The Library/Shared row-action gate. A generic uploaded file (media_kind='file') is
 // download+share only (no Play/Edit/Details); an edit clip and an upload can't be re-downloaded.
 // These pin the gate so a regression that shows Play/Edit on a file, or re-download on an upload,
 // is caught (the affordance itself, not just the backend guard behind it).
diff --git a/frontend/src/lib/downloadActions.ts b/frontend/src/lib/downloadActions.ts
index c89d53da..2c97b761 100644
--- a/frontend/src/lib/downloadActions.ts
+++ b/frontend/src/lib/downloadActions.ts
@@ -1,7 +1,7 @@
 import type { DownloadJob } from "./api";
 
 // Which row actions apply to a completed library / shared item — gated on the stored media_kind and
-// job_kind (E7·S5b). A generic uploaded file (media_kind='file') is download + share only: no player,
+// job_kind. A generic uploaded file (media_kind='file') is download + share only: no player,
 // no trim, no details edit. Re-download needs a re-fetchable source, which an edit clip and an upload
 // both lack (the backend 409s both). A single source for the gate the Library + Shared rows render,
 // so it's unit-testable instead of buried in JSX conditionals — and the two tabs can't drift apart.
diff --git a/frontend/src/lib/downloadFailure.test.ts b/frontend/src/lib/downloadFailure.test.ts
index 607ec0a3..d4e0dcb9 100644
--- a/frontend/src/lib/downloadFailure.test.ts
+++ b/frontend/src/lib/downloadFailure.test.ts
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
-// A failed download's explanation: the failure-catalog entry first, its category as the fallback
-// (E11.5 S1). The second case runs the REAL i18next with the real locales, because the fallback is
+// A failed download's explanation: the failure-catalog entry first, its category as the fallback.
+// The second case runs the REAL i18next with the real locales, because the fallback is
 // i18next's list-key lookup, not code of ours — an older client meeting a detail it has no copy for
 // must still say the category, not print a key.
 import { describe, expect, it } from "vitest";
diff --git a/frontend/src/lib/downloads.test.ts b/frontend/src/lib/downloads.test.ts
index 51b1ab35..5d1224ee 100644
--- a/frontend/src/lib/downloads.test.ts
+++ b/frontend/src/lib/downloads.test.ts
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
-// One-click share (E7 S3 · D2-A): quickShareLink turns the row's Share button into a single action —
-// ensure a public link (mint on demand, downloadable per D1), copy it, and toast with an "open in new
+// One-click share: quickShareLink turns the row's Share button into a single action —
+// ensure a public link (mint on demand, downloadable), copy it, and toast with an "open in new
 // tab" action. These pin the branch matrix: reuse-vs-mint, copy-ok-vs-fail, and the create-failure path.
 import { describe, it, expect, beforeEach, vi } from "vitest";
 import { QueryClient } from "@tanstack/react-query";
@@ -50,7 +50,7 @@ describe("quickShareLink", () => {
     const url = await quickShareLink(qc(), { id: 42 }, t);
 
     expect(url).toBe(`${origin}/watch/tok7`);
-    // Minted with an EMPTY body so the backend D1 default (allow_download=true) applies.
+    // Minted with an EMPTY body so the backend default (allow_download=true) applies.
     expect(createDownloadLink).toHaveBeenCalledWith(42, {});
     expect(copyText).toHaveBeenCalledWith(`${origin}/watch/tok7`);
     const arg = firstToast();
diff --git a/frontend/src/lib/downloads.ts b/frontend/src/lib/downloads.ts
index e4cef770..6a65271e 100644
--- a/frontend/src/lib/downloads.ts
+++ b/frontend/src/lib/downloads.ts
@@ -13,9 +13,9 @@ export function invalidateDownloads(qc: QueryClient) {
   qc.invalidateQueries({ queryKey: qk.downloadUsage() });
 }
 
-// One-click share (E7 S3 · D2-A): the row's Share button turns "share this" into a single action.
+// One-click share: the row's Share button turns "share this" into a single action.
 // Ensure the job has a public link (minting one on demand — omitting `allow_download` so the backend
-// D1 default makes it downloadable), copy it to the clipboard, and toast with an "open in new tab"
+// default makes it downloadable), copy it to the clipboard, and toast with an "open in new tab"
 // action. A copy failure still toasts (warning) WITH that action, so the link is never a dead end.
 // Advanced controls (password, expiry, revoke, share-with-a-user) live in the Share dialog. Returns
 // the shared URL, or null if link creation failed — so the caller/tests can react to the outcome.
@@ -32,7 +32,7 @@ export async function quickShareLink(
     });
     link = existing[0];
     if (!link) {
-      link = await api.createDownloadLink(job.id, {}); // omit allow_download → backend D1 default (true)
+      link = await api.createDownloadLink(job.id, {}); // omit allow_download → backend default (true)
       qc.setQueryData(qk.downloadLinks(job.id), [link]);
     }
   } catch (e) {
diff --git a/frontend/src/lib/e2ee.test.ts b/frontend/src/lib/e2ee.test.ts
deleted file mode 100644
index c7b3ac01..00000000
--- a/frontend/src/lib/e2ee.test.ts
+++ /dev/null
@@ -1,180 +0,0 @@
-// E32 S2: lib/e2ee was 14% covered, and every way it can break is silent — a message that will not
-// decrypt, a passphrase that unlocks nothing, a key that does not survive a reload. Real WebCrypto
-// (Node's), a minimal in-memory IndexedDB (the module uses open / one store / get / put / delete),
-// and a fresh module per "device", because the unlocked key is module state.
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { MyKeyBundle } from "./api";
-
-type E2ee = typeof import("./e2ee");
-
-function memoryIndexedDb() {
-  const stores = new Map<string, Map<unknown, unknown>>();
-  const later = (fn: () => void) => setTimeout(fn, 0);
-  const request = <T>(run: () => T) => {
-    const r: { result?: T; onsuccess?: () => void; onerror?: () => void } = {};
-    later(() => {
-      r.result = run();
-      r.onsuccess?.();
-    });
-    return r;
-  };
-  const db = {
-    createObjectStore: (name: string) => stores.set(name, new Map()),
-    transaction: (name: string) => {
-      const tx: { oncomplete?: () => void; onerror?: () => void; objectStore: () => unknown } = {
-        objectStore: () => {
-          const s = stores.get(name)!;
-          const done = <T>(v: T) => (later(() => tx.oncomplete?.()), v);
-          return {
-            get: (k: unknown) => request(() => s.get(k)),
-            put: (v: unknown, k: unknown) => done(s.set(k, v)),
-            delete: (k: unknown) => done(s.delete(k)),
-          };
-        },
-      };
-      return tx;
-    },
-  };
-  return {
-    open: () => {
-      const r: { result?: unknown; onupgradeneeded?: () => void; onsuccess?: () => void } = {};
-      later(() => {
-        r.result = db;
-        if (stores.size === 0) r.onupgradeneeded?.();
-        r.onsuccess?.();
-      });
-      return r;
-    },
-  };
-}
-
-async function freshDevice(): Promise<E2ee> {
-  vi.resetModules();
-  return import("./e2ee");
-}
-
-const bundleOf = (k: Awaited<ReturnType<E2ee["setup"]>>): MyKeyBundle =>
-  ({ ...k, has_key: true }) as unknown as MyKeyBundle;
-
-beforeEach(() => {
-  vi.stubGlobal("indexedDB", memoryIndexedDb());
-});
-afterEach(() => {
-  vi.unstubAllGlobals();
-});
-
-describe("e2ee", () => {
-  it("a message one user encrypts, the other decrypts — and nobody else", async () => {
-    const alice = await freshDevice();
-    const aliceKey = await alice.setup(1, "alice passphrase");
-    const bob = await freshDevice();
-    const bobKey = await bob.setup(2, "bob passphrase");
-
-    const msg = await alice.encryptFor(2, bobKey.public_key, "szia, Bob — ő 🎬");
-    expect(msg.ciphertext).not.toContain("Bob");
-    expect(await bob.decryptFrom(1, aliceKey.public_key, msg.ciphertext, msg.iv)).toBe(
-      "szia, Bob — ő 🎬",
-    );
-
-    const eve = await freshDevice();
-    await eve.setup(3, "eve passphrase");
-    await expect(eve.decryptFrom(1, aliceKey.public_key, msg.ciphertext, msg.iv)).rejects.toThrow();
-  }, 30_000);
-
-  it("each message gets its own IV", async () => {
-    const alice = await freshDevice();
-    await alice.setup(1, "p");
-    const bob = await freshDevice();
-    const bobKey = await bob.setup(2, "q");
-    const a = await alice.encryptFor(2, bobKey.public_key, "same");
-    const b = await alice.encryptFor(2, bobKey.public_key, "same");
-    expect(a.iv).not.toBe(b.iv);
-    expect(a.ciphertext).not.toBe(b.ciphertext);
-  }, 30_000);
-
-  it("a new device unlocks with the passphrase and refuses a wrong one", async () => {
-    const first = await freshDevice();
-    const bundle = bundleOf(await first.setup(1, "the right one"));
-
-    vi.stubGlobal("indexedDB", memoryIndexedDb()); // another browser: nothing stored
-    const second = await freshDevice();
-    expect(await second.loadFromDevice(1)).toBe(false);
-    await expect(second.unlock(1, "a wrong one", bundle)).rejects.toThrow();
-    expect(second.isUnlocked()).toBe(false);
-    await second.unlock(1, "the right one", bundle);
-    expect(second.isUnlocked()).toBe(true);
-  }, 30_000);
-
-  it("the unlocked key survives a reload on the same device, until it is reset", async () => {
-    const before = await freshDevice();
-    await before.setup(7, "p");
-    const after = await freshDevice(); // a reload: module state gone, IndexedDB kept
-    expect(after.isUnlocked()).toBe(false);
-    const seen = vi.fn();
-    after.subscribeUnlock(seen);
-    expect(await after.loadFromDevice(7)).toBe(true);
-    expect(after.isUnlocked()).toBe(true);
-    expect(seen).toHaveBeenCalled();
-
-    await after.resetLocal(7);
-    expect(after.isUnlocked()).toBe(false);
-    const again = await freshDevice();
-    expect(await again.loadFromDevice(7)).toBe(false);
-  }, 30_000);
-
-  it("an incomplete bundle and a locked device are refused, not guessed around", async () => {
-    const e = await freshDevice();
-    await expect(e.unlock(1, "p", { has_key: true } as unknown as MyKeyBundle)).rejects.toThrow(
-      "incomplete key bundle",
-    );
-    await expect(e.encryptFor(2, "AAAA", "x")).rejects.toThrow("locked");
-  });
-
-  it("the key check uses its own nonce, never the wrap IV (GCM nonce reuse)", async () => {
-    const e = await freshDevice();
-    const k = await e.setup(1, "p");
-    // Re-derive the wrap key the way the module does; then the key check must NOT open under the
-    // wrap IV (it would, were the nonce reused), while the wrapped key does.
-    const raw = (s: string) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
-    const base = await crypto.subtle.importKey(
-      "raw",
-      new TextEncoder().encode("p"),
-      "PBKDF2",
-      false,
-      ["deriveKey"],
-    );
-    const wrapKey = await crypto.subtle.deriveKey(
-      { name: "PBKDF2", salt: raw(k.salt), iterations: 600_000, hash: "SHA-256" },
-      base,
-      { name: "AES-GCM", length: 256 },
-      false,
-      ["decrypt"],
-    );
-    const open = (ct: string) =>
-      crypto.subtle.decrypt({ name: "AES-GCM", iv: raw(k.wrap_iv) }, wrapKey, raw(ct));
-    await expect(open(k.wrapped_private_key)).resolves.toBeDefined();
-    await expect(open(k.key_check)).rejects.toThrow();
-  }, 30_000);
-
-  it("a partner's rotated key is used only after forgetConv", async () => {
-    const alice = await freshDevice();
-    const aliceKey = await alice.setup(1, "p");
-    const bobOld = await freshDevice();
-    const oldKey = await bobOld.setup(2, "q");
-    await alice.encryptFor(2, oldKey.public_key, "warm the cache");
-
-    const bobNew = await freshDevice(); // Bob reset his passphrase: a new keypair
-    const newKey = await bobNew.setup(2, "r");
-    // Cached by partner id alone: without forgetConv the OLD conversation key is still used…
-    const stale = await alice.encryptFor(2, newKey.public_key, "after the reset");
-    await expect(
-      bobNew.decryptFrom(1, aliceKey.public_key, stale.ciphertext, stale.iv),
-    ).rejects.toThrow();
-    // …and after it, the new one.
-    alice.forgetConv(2);
-    const fresh = await alice.encryptFor(2, newKey.public_key, "after the reset");
-    expect(await bobNew.decryptFrom(1, aliceKey.public_key, fresh.ciphertext, fresh.iv)).toBe(
-      "after the reset",
-    );
-  }, 60_000);
-});
diff --git a/frontend/src/lib/e2ee.ts b/frontend/src/lib/e2ee.ts
deleted file mode 100644
index 2e515220..00000000
--- a/frontend/src/lib/e2ee.ts
+++ /dev/null
@@ -1,253 +0,0 @@
-// End-to-end encryption for direct messages (notification module phase 2).
-//
-// Contract (validated against the backend): each user has an ECDH P-256 keypair. The private
-// key is wrapped in the browser with an AES-GCM key derived (PBKDF2) from a message passphrase
-// the server never sees; only the wrapped blob is uploaded. A conversation key is derived from
-// ECDH(my private, partner public) → HKDF → AES-GCM, and each message is AES-GCM encrypted with
-// a random IV. The server stores only ciphertext, so not even an admin can read a conversation.
-//
-// The unlocked private key is persisted per-device as a NON-EXTRACTABLE CryptoKey in IndexedDB,
-// so the passphrase is needed once per device, then survives reloads (cleared with browser data).
-import type { KeySetup, MyKeyBundle } from "./api";
-
-const subtle = crypto.subtle;
-const enc = new TextEncoder();
-const dec = new TextDecoder();
-const PBKDF2_ITERS = 600_000;
-const HKDF_INFO = "siftlode-dm-v1";
-
-const b64 = (buf: ArrayBuffer | Uint8Array): string => {
-  const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
-  let s = "";
-  for (const b of bytes) s += String.fromCharCode(b);
-  return btoa(s);
-};
-const ub64 = (s: string): Uint8Array => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
-// WebCrypto byte inputs: the DOM lib types want BufferSource backed by a plain ArrayBuffer;
-// our Uint8Arrays/ArrayBuffers are functionally that, so coerce at the call sites.
-const bsrc = (x: Uint8Array | ArrayBuffer): BufferSource => x as BufferSource;
-
-// --- module state ---
-let privKey: CryptoKey | null = null; // current unlocked (non-extractable) private key
-const convKeys = new Map<number, CryptoKey>(); // partnerId → derived AES key
-
-// Unlock state is shared app-wide (the Messages page and the floating chat dock both observe
-// it), so expose a subscription for useSyncExternalStore.
-const unlockSubs = new Set<() => void>();
-function emitUnlock(): void {
-  for (const cb of unlockSubs) cb();
-}
-export function subscribeUnlock(cb: () => void): () => void {
-  unlockSubs.add(cb);
-  return () => unlockSubs.delete(cb);
-}
-
-export function isUnlocked(): boolean {
-  return !!privKey;
-}
-
-// --- IndexedDB (per-device persistence of the unlocked private key) ---
-const DB_NAME = "siftlode-e2ee";
-const STORE = "privkeys";
-
-function idb(): Promise<IDBDatabase> {
-  return new Promise((resolve, reject) => {
-    const req = indexedDB.open(DB_NAME, 1);
-    req.onupgradeneeded = () => req.result.createObjectStore(STORE);
-    req.onsuccess = () => resolve(req.result);
-    req.onerror = () => reject(req.error);
-  });
-}
-async function idbGet(userId: number): Promise<CryptoKey | null> {
-  const db = await idb();
-  return new Promise((resolve) => {
-    const r = db.transaction(STORE, "readonly").objectStore(STORE).get(userId);
-    r.onsuccess = () => resolve((r.result as CryptoKey) ?? null);
-    r.onerror = () => resolve(null);
-  });
-}
-async function idbPut(userId: number, key: CryptoKey): Promise<void> {
-  const db = await idb();
-  await new Promise<void>((resolve) => {
-    const tx = db.transaction(STORE, "readwrite");
-    tx.objectStore(STORE).put(key, userId);
-    tx.oncomplete = () => resolve();
-    tx.onerror = () => resolve();
-  });
-}
-export async function clearDevice(userId: number): Promise<void> {
-  const db = await idb();
-  await new Promise<void>((resolve) => {
-    const tx = db.transaction(STORE, "readwrite");
-    tx.objectStore(STORE).delete(userId);
-    tx.oncomplete = () => resolve();
-    tx.onerror = () => resolve();
-  });
-}
-
-// Wipe this device's E2EE identity: forget the unlocked key + every derived conversation key,
-// delete the persisted copy, and notify observers so the gate re-appears. Used by the passphrase
-// reset, which also drops the server key so the next screen is a fresh setup.
-export async function resetLocal(userId: number): Promise<void> {
-  privKey = null;
-  convKeys.clear();
-  await clearDevice(userId);
-  emitUnlock();
-}
-
-// --- key derivation ---
-async function wrapKeyFrom(passphrase: string, salt: Uint8Array): Promise<CryptoKey> {
-  const base = await subtle.importKey("raw", bsrc(enc.encode(passphrase)), "PBKDF2", false, [
-    "deriveKey",
-  ]);
-  return subtle.deriveKey(
-    { name: "PBKDF2", salt: bsrc(salt), iterations: PBKDF2_ITERS, hash: "SHA-256" },
-    base,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt", "decrypt"],
-  );
-}
-async function importPrivate(pkcs8: ArrayBuffer): Promise<CryptoKey> {
-  // Non-extractable: usable for deriveBits but can never be exported again.
-  return subtle.importKey("pkcs8", bsrc(pkcs8), { name: "ECDH", namedCurve: "P-256" }, false, [
-    "deriveBits",
-  ]);
-}
-
-// Try to restore the unlocked key from this device's storage. Returns true if unlocked.
-export async function loadFromDevice(userId: number): Promise<boolean> {
-  const stored = await idbGet(userId);
-  if (stored) {
-    privKey = stored;
-    emitUnlock();
-    return true;
-  }
-  return false;
-}
-
-// Install a freshly-imported private key as the current identity: drop any derived conversation
-// keys, persist it to this device, and notify unlock subscribers. Shared by setup() and unlock().
-async function installKey(userId: number, key: CryptoKey): Promise<void> {
-  privKey = key;
-  convKeys.clear();
-  await idbPut(userId, key);
-  emitUnlock();
-}
-
-// First-run setup: generate a keypair, wrap the private key with the passphrase, persist a
-// non-extractable copy locally, and return the bundle to upload to the server.
-export async function setup(userId: number, passphrase: string): Promise<KeySetup> {
-  const kp = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const wrapIv = crypto.getRandomValues(new Uint8Array(12));
-  const wrapKey = await wrapKeyFrom(passphrase, salt);
-  const pkcs8 = await subtle.exportKey("pkcs8", kp.privateKey);
-  const wrapped = await subtle.encrypt({ name: "AES-GCM", iv: bsrc(wrapIv) }, wrapKey, bsrc(pkcs8));
-  // key_check is retained for the upload schema but MUST use its own nonce: reusing wrapIv under
-  // wrapKey would be GCM nonce-reuse (leaks keystream + enables GHASH forgery). It is no longer a
-  // verification oracle either — unlock() authenticates the passphrase via the wrapped-key GCM tag.
-  const checkIv = crypto.getRandomValues(new Uint8Array(12));
-  const keyCheck = await subtle.encrypt(
-    { name: "AES-GCM", iv: bsrc(checkIv) },
-    wrapKey,
-    bsrc(enc.encode("ok")),
-  );
-  const spki = await subtle.exportKey("spki", kp.publicKey);
-
-  await installKey(userId, await importPrivate(pkcs8));
-  return {
-    public_key: b64(spki),
-    wrapped_private_key: b64(wrapped),
-    salt: b64(salt),
-    wrap_iv: b64(wrapIv),
-    key_check: b64(keyCheck),
-  };
-}
-
-// Unlock on a device from the server blob; throws if the passphrase is wrong.
-export async function unlock(
-  userId: number,
-  passphrase: string,
-  bundle: MyKeyBundle,
-): Promise<void> {
-  if (!bundle.wrapped_private_key || !bundle.salt || !bundle.wrap_iv || !bundle.key_check) {
-    throw new Error("incomplete key bundle");
-  }
-  const wrapKey = await wrapKeyFrom(passphrase, ub64(bundle.salt));
-  // Wrong passphrase → the AES-GCM auth tag fails on this decrypt. (No separate key_check oracle:
-  // that was redundant with this tag and formerly shared wrapIv — see setup().)
-  const pkcs8 = await subtle.decrypt(
-    { name: "AES-GCM", iv: bsrc(ub64(bundle.wrap_iv)) },
-    wrapKey,
-    bsrc(ub64(bundle.wrapped_private_key)),
-  );
-  await installKey(userId, await importPrivate(pkcs8));
-}
-
-// Drop the cached derived conversation key for a partner. convKeyFor caches by partnerId alone, so
-// after a partner rotates their public key (a passphrase reset) the caller must call this before
-// re-deriving with the fresh key — otherwise the stale key would be returned.
-export function forgetConv(partnerId: number): void {
-  convKeys.delete(partnerId);
-}
-
-// --- per-conversation encryption ---
-async function convKeyFor(partnerId: number, partnerPubB64: string): Promise<CryptoKey> {
-  const cached = convKeys.get(partnerId);
-  if (cached) return cached;
-  if (!privKey) throw new Error("locked");
-  const pub = await subtle.importKey(
-    "spki",
-    bsrc(ub64(partnerPubB64)),
-    { name: "ECDH", namedCurve: "P-256" },
-    false,
-    [],
-  );
-  const bits = await subtle.deriveBits({ name: "ECDH", public: pub }, privKey, 256);
-  const hk = await subtle.importKey("raw", bits, "HKDF", false, ["deriveKey"]);
-  const key = await subtle.deriveKey(
-    {
-      name: "HKDF",
-      hash: "SHA-256",
-      salt: bsrc(new Uint8Array(0)),
-      info: bsrc(enc.encode(HKDF_INFO)),
-    },
-    hk,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt", "decrypt"],
-  );
-  convKeys.set(partnerId, key);
-  return key;
-}
-
-export async function encryptFor(
-  partnerId: number,
-  partnerPubB64: string,
-  plaintext: string,
-): Promise<{ ciphertext: string; iv: string }> {
-  const key = await convKeyFor(partnerId, partnerPubB64);
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const ct = await subtle.encrypt(
-    { name: "AES-GCM", iv: bsrc(iv) },
-    key,
-    bsrc(enc.encode(plaintext)),
-  );
-  return { ciphertext: b64(ct), iv: b64(iv) };
-}
-
-export async function decryptFrom(
-  partnerId: number,
-  partnerPubB64: string,
-  ciphertext: string,
-  iv: string,
-): Promise<string> {
-  const key = await convKeyFor(partnerId, partnerPubB64);
-  const pt = await subtle.decrypt(
-    { name: "AES-GCM", iv: bsrc(ub64(iv)) },
-    key,
-    bsrc(ub64(ciphertext)),
-  );
-  return dec.decode(pt);
-}
diff --git a/frontend/src/lib/entryUrl.ts b/frontend/src/lib/entryUrl.ts
index 1614828d..0c5ea421 100644
--- a/frontend/src/lib/entryUrl.ts
+++ b/frontend/src/lib/entryUrl.ts
@@ -19,7 +19,7 @@ export const entryHash = new URLSearchParams(window.location.hash.replace(/^#/,
 
 /** One-time QUERY flags: safe to drop once the snapshot above has them, because re-reading them on a
  * reload would re-show a notice about something that already happened (`access` only appears here
- * in its pre-S4 shape — it rides the fragment now). Deliberately NOT `link`,
+ * in its old shape — it rides the fragment now). Deliberately NOT `link`,
  * `oauth`, `admin` or the setup `token` — those have their own readers, and some of them (the setup
  * wizard, the lazily-mounted module views) do not run until several commits later. */
 const ONE_TIME_QUERY = ["login", "deleted", "access"] as const;
@@ -30,7 +30,7 @@ const ONE_TIME_QUERY = ["login", "deleted", "access"] as const;
  *
  * SURGICAL, and that is the whole of it. This used to blank the entire query string, the fragment
  * and `history.state`, which was safe only while it lived inside the signed-out auth card; moving it
- * up to App (E9.5 S2) pointed it at every load. It then ran on the FIRST commit — before the setup
+ * up to App pointed it at every load. It then ran on the FIRST commit — before the setup
  * wizard mounts behind its own `?token=`, before App's own `?link=`/`?oauth=` effects read theirs,
  * and before a lazily-loaded module view reads its `?v=`/`?chan=` deep link — and took
  * `history.state` (scroll restoration, the channel entry) with it. Everything not listed above is
@@ -45,7 +45,7 @@ export function clearEntryUrl(): void {
   // again does the same, because the token is untouched and the session is still there. Leaving it
   // in the address bar keeps the recovery `main` had, where this strip lived inside the auth card:
   // sign out (which reloads, fragment intact) and the reset form is waiting. Once the card has used
-  // it the token is spent, so a later reload meets S4's named dead-link screen — which is true.
+  // it the token is spent, so a later reload meets the named dead-link screen — which is true.
   const hash = new URLSearchParams(window.location.hash.replace(/^#/, ""));
   const keep = hash.has("reset") ? window.location.hash : "";
   if (!dropped.length && !window.location.hash) return;
diff --git a/frontend/src/lib/fadeEdge.contract.test.ts b/frontend/src/lib/fadeEdge.contract.test.ts
index b0f14136..5d24bc12 100644
--- a/frontend/src/lib/fadeEdge.contract.test.ts
+++ b/frontend/src/lib/fadeEdge.contract.test.ts
@@ -2,7 +2,7 @@ import { readdirSync, readFileSync } from "node:fs";
 
 import { describe, expect, it } from "vitest";
 
-// E28 S3d4 (B9). The header + fade edge is one recipe, the `fade-below` / `fade-below-panel` /
+// docs/DESIGN.md B9. The header + fade edge is one recipe, the `fade-below` / `fade-below-panel` /
 // `fade-above-panel` utilities in index.css: a crisp band and a 1rem gradient of the colour under
 // it. The table header carried its own arbitrary-value copy of it, which a change to the recipe (its
 // height, its colour on a panel) would have left behind.
@@ -30,7 +30,7 @@ describe("the fade edge", () => {
 });
 
 // A sticky header's fade shows only once content has slid under it. Drawn at rest it lay over the
-// first row's top 16 px, dimming it and hiding the top edge of the row's keyboard ring (E28, seen
+// first row's top 16 px, dimming it and hiding the top edge of the row's keyboard ring (seen
 // live). jsdom runs no scroll timeline, so what is pinned is the recipe: resting opacity 0, and the
 // scroll-driven fade-in over the first 1rem, only where the engine has scroll timelines.
 describe("the sticky header's fade", () => {
diff --git a/frontend/src/lib/feedView.ts b/frontend/src/lib/feedView.ts
index e99f39d5..f8d76a4c 100644
--- a/frontend/src/lib/feedView.ts
+++ b/frontend/src/lib/feedView.ts
@@ -23,7 +23,7 @@ export interface FeedViewSpec {
    * scan, so the stacked row keeps a cap; the one-line row doesn't need as tight a one. */
   colMaxWidth: number | null;
   /** Multi-column views only: the most columns to lay out (null = as many as fit). The UPPER end of
-   * the tablet..ultrawide contract (E10 S4; tablet portrait since E28). An auto-fill grid always settles just above `minCol`,
+   * the tablet..ultrawide contract (tablet portrait included). An auto-fill grid always settles just above `minCol`,
    * so without a cap a wider screen buys more, smaller items rather than better ones — measured at
    * 3440px, `cards` laid out 11 columns of 264px. Each cap here is set so the item tops out near
    * 1.5x its own `minCol` on a 3440px ultrawide, which keeps each view recognisably itself (a capped
diff --git a/frontend/src/lib/filterLog.ts b/frontend/src/lib/filterLog.ts
index ae41ea30..0a902e65 100644
--- a/frontend/src/lib/filterLog.ts
+++ b/frontend/src/lib/filterLog.ts
@@ -1,4 +1,4 @@
-// A filter/sort/view change, for the client log (E22 S5). Filter state is what makes "the feed shows
+// A filter/sort/view change, for the client log. Filter state is what makes "the feed shows
 // nothing" diagnosable, so its VALUES are logged — at Részletes (DEBUG), the level the user consented
 // to for exactly that. What the user TYPED into a search box is Teljes (TRACE) only; below it the log
 // just says whether there is a search at all.
diff --git a/frontend/src/lib/focusSafe.contract.test.ts b/frontend/src/lib/focusSafe.contract.test.ts
index 481a7f95..c00a9588 100644
--- a/frontend/src/lib/focusSafe.contract.test.ts
+++ b/frontend/src/lib/focusSafe.contract.test.ts
@@ -1,17 +1,20 @@
 import { describe, expect, it } from "vitest";
 
-import { eslint } from "./lintProbe.testkit";
-
-// `local/focus-safe-disabled` (eslint.config.js): a raw `<button disabled>` throws a focused keyboard
-// user to <body> the moment it turns disabled. ~60 were swept onto ui/FocusSafeButton; this pins that
-// the rule keeping a new one out actually fires.
-const RULE = "local/focus-safe-disabled";
+import { eslint, uiFiles } from "./lintProbe.testkit";
 
+// `local/button-primitive`'s disabled check (eslint.config.js): a raw `<button disabled>` throws a
+// focused keyboard user to <body> the moment it turns disabled. ~60 were swept onto ui/FocusSafeButton;
+// this pins that the check keeping a new one out fires — also inside a control primitive and a test,
+// where the rest of the rule stands aside.
 async function hits(source: string, filePath = "src/components/__probe.tsx"): Promise<number> {
   const [result] = await eslint.lintText(source, { filePath });
-  return (result?.messages ?? []).filter((m) => m.ruleId === RULE).length;
+  return (result?.messages ?? []).filter(
+    (m) => m.ruleId === "local/button-primitive" && m.messageId === "disabled",
+  ).length;
 }
 
+const DISABLED = "export const D = (p: { d: boolean }) => <button disabled={p.d}>x</button>;\n";
+
 describe("a raw button that can be disabled", () => {
   it("is refused, statically or not", async () => {
     expect(
@@ -20,13 +23,24 @@ describe("a raw button that can be disabled", () => {
     expect(await hits("export const B = () => <button disabled>x</button>;\n")).toBe(1);
   });
 
-  it("leaves a raw button with no disabled, and the primitive, alone", async () => {
+  it("is refused inside a control primitive and in a test too", async () => {
+    expect(await hits(DISABLED, "src/components/ui/Button.tsx")).toBe(1);
+    // an existing test file: the project service admits only lintProbe.testkit's probe names
+    expect(await hits(DISABLED, "src/components/Feed.countStale.dom.test.tsx")).toBe(1);
+  });
+
+  it("leaves a raw button with no disabled, and the two native-disabled owners, alone", async () => {
     expect(await hits("export const C = () => <button onClick={() => {}}>x</button>;\n")).toBe(0);
-    expect(
-      await hits(
-        "export const D = (p: { d: boolean }) => <button disabled={p.d}>x</button>;\n",
-        "src/components/ui/FocusSafeButton.tsx",
-      ),
-    ).toBe(0);
+    expect(await hits(DISABLED, "src/components/ui/FocusSafeButton.tsx")).toBe(0);
+    expect(await hits(DISABLED, "src/components/ui/AnchoredPopover.tsx")).toBe(0);
+  });
+
+  // The exemption lives in the rule body, where neither the gate snapshot nor docs/gates.md sees it,
+  // so this holds it to exactly those two: every other file in ui/ is refused.
+  it("is exempt in exactly those two of the ui/ files", { timeout: 60_000 }, async () => {
+    const exempt: string[] = [];
+    for (const file of uiFiles())
+      if ((await hits(DISABLED, `src/components/ui/${file}`)) === 0) exempt.push(file);
+    expect(exempt).toEqual(["AnchoredPopover.tsx", "FocusSafeButton.tsx"]);
   });
 });
diff --git a/frontend/src/lib/format.test.ts b/frontend/src/lib/format.test.ts
index b4aec1d3..e3773ece 100644
--- a/frontend/src/lib/format.test.ts
+++ b/frontend/src/lib/format.test.ts
@@ -124,7 +124,7 @@ describe("relativeFromMs", () => {
   });
 });
 
-// formatRuntime went from "one Plex movie's length" to "a playlist's total playtime" (E9 12D), and a
+// formatRuntime went from "one Plex movie's length" to "a playlist's total playtime", and a
 // TOTAL is the only input that can legitimately be 1-59 seconds. That tier had no coverage and no
 // implementation: 45s floored to "0m", so a playlist of Shorts reported no runtime while the rail
 // beside it read "0:45". The table pins every tier boundary, so the sub-minute branch cannot be
@@ -132,8 +132,8 @@ describe("relativeFromMs", () => {
 // A bare `n.toLocaleString()` groups in the BROWSER's locale, so an English UI in a Hungarian browser
 // printed "1 234 567" (and a Hungarian UI in an English browser "1,234,567"). The case below asserts
 // BOTH languages and that the two differ, rather than comparing against the runtime's own default:
-// the default is whatever locale the machine running the suite has (Hungarian on the dev box, English
-// on a CI image), so a one-language assertion passes under the old bug on half the machines.
+// the default is whatever locale the host running the gate has (Hungarian on the dev box, English or
+// C on a Linux host), so a one-language assertion passes under the old bug on half the machines.
 describe("formatNumber", () => {
   afterEach(() => {
     i18nStub.language = "en";
@@ -248,7 +248,7 @@ describe("formatDateTime / formatDate", () => {
   });
 });
 
-// E30 S3: every number a reader sees is in the UI language — the decimal mark, the grouping and the
+// Every number a reader sees is in the UI language — the decimal mark, the grouping and the
 // compact suffix. `toFixed` and hand-built "1.2K" wrote English in both languages. Both languages are
 // asserted and differ, so an implementation that ignores the language cannot pass.
 describe("numbers in the UI language", () => {
diff --git a/frontend/src/lib/format.ts b/frontend/src/lib/format.ts
index 1ba32853..af813387 100644
--- a/frontend/src/lib/format.ts
+++ b/frontend/src/lib/format.ts
@@ -4,8 +4,8 @@ import i18n from "../i18n";
 // The one home of the app's LOCALE forms — numbers, units, dates (alphabetical order: `collate.ts`) —
 // all in the UI language, never the browser's (lint: `local/locale-format` refuses a hand-built one elsewhere).
 //
-// Every formatter takes the language (or `t`) as an ARGUMENT, and that is load-bearing, not style
-// (E30 S3): the React Compiler memoizes a call on its arguments, so a formatter that read the language
+// Every formatter takes the language (or `t`) as an ARGUMENT, and that is load-bearing, not style:
+// the React Compiler memoizes a call on its arguments, so a formatter that read the language
 // off the i18n singleton kept its old answer after a language switch — a card still said "2 hr 4 min"
 // beside a hero saying "2 ó 16 p". Passing `i18n.language` (from useTranslation) makes the language a
 // dependency the compiler can see; the signature makes forgetting it a type error.
@@ -60,7 +60,6 @@ export function formatSpeed(bps: number | null | undefined, lang: string): strin
  * Module-level because it is constant, and exported so the tests can hold that invariant. */
 // A non-empty tuple type (first element + rest) so `RELATIVE_UNITS[0]` is known-present under
 // noUncheckedIndexedAccess — the "sub-minute" branch relies on that first entry always existing.
-/** @internal exported for format.test.ts */
 export const RELATIVE_UNITS: readonly [
   [number, Intl.RelativeTimeFormatUnit],
   ...[number, Intl.RelativeTimeFormatUnit][],
@@ -122,8 +121,8 @@ export function formatDuration(sec: number | null): string {
   return h > 0 ? `${h}:${pad(m)}:${pad(s)}` : `${m}:${pad(s)}`;
 }
 
-// A duration's unit in the UI language, in the browser's own short form (docs/DESIGN.md "Copy", E28
-// S3g): "90 min", "2 hr" / "90 p", "2 ó". Hand-typed "90m" / "2h" were English in both languages and
+// A duration's unit in the UI language, in the browser's own short form (docs/DESIGN.md "Copy"):
+// "90 min", "2 hr" / "90 p", "2 ó". Hand-typed "90m" / "2h" were English in both languages and
 // came in three spellings. One formatter per language × unit, built lazily (the grids format one per card).
 export type DurationUnit = "second" | "minute" | "hour" | "day";
 export function formatUnit(
@@ -226,7 +225,7 @@ export function formatCountOrDash(n: number | null | undefined, lang: string): s
   return n != null ? formatCompact(n, lang) : "—";
 }
 
-// The app's date forms (docs/DESIGN.md "Copy", E28 S3g), all in the UI language — never a bare
+// The app's date forms (docs/DESIGN.md "Copy"), all in the UI language — never a bare
 // `toLocaleString()`, which formats in the BROWSER's locale (an English UI showed a Hungarian-shaped
 // date) and, with no options, as numbers with seconds ("9/27/2026, 8:30:14 AM"):
 //   relativeTime      "3d ago" / "3 napja"            — recency in a list; the exact form on hover
diff --git a/frontend/src/lib/fullscreen.ts b/frontend/src/lib/fullscreen.ts
index 054ddb6b..9874126a 100644
--- a/frontend/src/lib/fullscreen.ts
+++ b/frontend/src/lib/fullscreen.ts
@@ -74,8 +74,7 @@ function useFullscreenElement(): HTMLElement | null {
  *  and builds it again when its container changes, and the overlay's contents go with it (a
  *  half-filled form reset to its defaults the moment the viewer left true fullscreen).
  *
- *  Two rules this owns, which the two hand-written copies it replaced disagreed about (deep-review
- *  round 5):
+ *  Two rules this owns, which the two hand-written copies it replaced disagreed about:
  *
  *  1. **It is attached BEFORE the portal's children commit.** `useInsertionEffect` runs in the
  *     mutation phase, and React handles `autoFocus` in `commitMount` during the LAYOUT phase — one
diff --git a/frontend/src/lib/gates.contract.test.ts b/frontend/src/lib/gates.contract.test.ts
index ed065311..9f793a86 100644
--- a/frontend/src/lib/gates.contract.test.ts
+++ b/frontend/src/lib/gates.contract.test.ts
@@ -10,7 +10,7 @@ import ts from "typescript";
 import tseslint from "typescript-eslint";
 import { describe, expect, it } from "vitest";
 
-// The gate register (docs/gates.md) is held to the EFFECTIVE configuration (E32). A narrowing that
+// The gate register (docs/gates.md) is held to the EFFECTIVE configuration. A narrowing that
 // is not on the register fails here — a rule switched off for a scope, a weak compiler flag, a ruff
 // ignore, a knip exclusion, an accepted CVE. So "the gate checks X" is a claim this test verifies,
 // not one a comment makes. (The comment that claimed the React Compiler's rules "are also linted"
@@ -101,20 +101,23 @@ function restrictedEntries(entry: Linter.RuleEntry | undefined): Set<string> {
 
 // --- the snapshot ---------------------------------------------------------------------------------
 // The configs that can narrow a gate in more shapes than a check can enumerate are held to a
-// COMMITTED SNAPSHOT (E32 review): ESLint's effective config for every file `eslint .` reaches, and
-// the lines that run the lanes. Any change fails until the snapshot is regenerated, so a narrowing
-// arrives as a diff of `gates.snapshot.json` in review instead of slipping past a detector. (Three
-// review rounds kept finding shapes the detector this replaced did not model — a `basePath` global
-// ignore, a widened glob filed under a narrow row, a substring check on a gate line. A comparison
-// against everything has no shape to miss.)
+// COMMITTED SNAPSHOT: ESLint's effective config per scope, and the lines that run the
+// lanes. Any change fails until the snapshot is regenerated, so a narrowing arrives as a diff of
+// `gates.snapshot.json` in review instead of slipping past a detector. (Three review rounds kept
+// finding shapes the detector this replaced did not model — a `basePath` global ignore, a widened glob
+// filed under a narrow row, a substring check on a gate line. A comparison against everything has no
+// shape to miss.)
+//
+// A scope is named by PATH (`scopeOf`), and every file of a scope must get the same effective config.
+// So a new file in a known place changes nothing (the snapshot once listed every file, and 31% of
+// commits regenerated it), while a glob that moves a file into another config splits its scope and
+// fails below, and a scope whose rules change is a snapshot diff.
 //
 // Regenerate:  GATE_SNAPSHOT=update npx vitest run src/lib/gates.contract.test.ts
-// then read the diff like any gate change. An ESLint config that changed keeps its scope name when
-// most of its files had it; one no name fits is written as `new config N` — rename it to the
-// register scope it is (the register test below then asks for its rows).
+// then read the diff like any gate change. A new kind of file (a new config or a new place) needs a
+// line in `scopeOf` and, when it narrows anything, its register rows.
 
 const SNAPSHOT = "frontend/src/lib/gates.snapshot.json";
-const NOT_LINTED = "(not linted)";
 type EslintConfig = {
   rules: Record<string, unknown[]>;
   linterOptions: Record<string, unknown>;
@@ -123,10 +126,24 @@ type EslintConfig = {
   settings: unknown;
 };
 type Snapshot = {
-  eslint: { configs: Record<string, EslintConfig>; files: Record<string, string[]> };
+  eslint: Record<string, EslintConfig>;
   lanes: Record<string, unknown>;
 };
 
+/** The register scope a code file belongs to, by its path (relative to frontend/). */
+function scopeOf(file: string): string {
+  if (!file.includes("/")) return /[.][mc]?js$/.test(file) ? "js configs" : "ts configs";
+  if (file.startsWith("e2e/")) return "e2e";
+  if (file.startsWith("src/design-lab/")) return "design-lab";
+  // the network owners (NETWORK_OWNERS in eslint.config.js)
+  if (file === "src/lib/http.ts") return "lib/http.ts";
+  if (file === "src/lib/api/core.ts") return "lib/api/core.ts";
+  const test = /[.]test[.]tsx?$/.test(file);
+  if (file.startsWith("src/components/ui/")) return test ? "ui tests" : "ui";
+  if (file.startsWith("src/lib/")) return test ? "lib tests" : "src/lib";
+  return test ? "src tests" : "src";
+}
+
 const sortKeys = (v: unknown): unknown =>
   Array.isArray(v)
     ? v.map(sortKeys)
@@ -173,7 +190,7 @@ function normalize(cfg: Linter.Config): EslintConfig {
 
 // Every code file `eslint .` walks into. The skipped directories are the global ignores' generated
 // output (the register's `everywhere` row) — untracked, and present on one machine but not another.
-// Every other file is asked for its config, so a file a new ignore drops lands in `(not linted)`.
+// Every other file is asked for its config, so a file a new ignore drops is reported as not linted.
 const WALK_SKIP = new Set([
   "node_modules",
   "dist",
@@ -192,7 +209,7 @@ function codeFiles(dir = ""): string[] {
 
 // On disk every config but src is written as its difference from src — the rules it sets otherwise
 // and the src rules it does not apply — so a scope reads like its register rows, and one rule set
-// is not repeated fourteen times. In memory it is always whole.
+// is not repeated a dozen times. In memory it is always whole.
 type Stored = Omit<EslintConfig, "rules"> & {
   rules: Record<string, unknown[]>;
   notApplied?: string[];
@@ -225,15 +242,22 @@ function fromStored(stored: Record<string, Stored>): Record<string, EslintConfig
   );
 }
 const committed = (): Snapshot => {
-  const s = JSON.parse(read(SNAPSHOT)) as Snapshot & {
-    eslint: { configs: Record<string, Stored> };
+  const s = JSON.parse(read(SNAPSHOT)) as Omit<Snapshot, "eslint"> & {
+    eslint: Record<string, Stored>;
   };
-  return canonical({ ...s, eslint: { ...s.eslint, configs: fromStored(s.eslint.configs) } });
+  return canonical({ ...s, eslint: fromStored(s.eslint) });
 };
 
-async function eslintActual(names: Snapshot["eslint"]): Promise<Snapshot["eslint"]> {
+type EslintActual = {
+  configs: Record<string, EslintConfig>;
+  /** the files no config lints */
+  notLinted: string[];
+  /** `scope: file` for each file whose config is not its scope's (the scope's majority) */
+  strays: string[];
+};
+async function eslintActual(): Promise<EslintActual> {
   const eslint = new ESLint({ cwd: FRONTEND });
-  const groups = new Map<string, { config: EslintConfig; files: string[] }>();
+  const byScope = new Map<string, Map<string, { config: EslintConfig; files: string[] }>>();
   const notLinted: string[] = [];
   for (const file of codeFiles().sort()) {
     const raw = (await eslint.calculateConfigForFile(file)) as Linter.Config | undefined;
@@ -243,35 +267,22 @@ async function eslintActual(names: Snapshot["eslint"]): Promise<Snapshot["eslint
     }
     const config = normalize(raw);
     const key = JSON.stringify(config);
+    const scope = scopeOf(file);
+    const groups =
+      byScope.get(scope) ?? new Map<string, { config: EslintConfig; files: string[] }>();
     const group = groups.get(key) ?? { config, files: [] };
     group.files.push(file);
     groups.set(key, group);
+    byScope.set(scope, groups);
   }
-  // a config is named by the snapshot entry it equals; a changed one by the old name most of its
-  // files had (if still free), so the diff shows the rule that moved, not a renamed scope
-  const byContent = new Map(Object.entries(names.configs).map(([n, c]) => [JSON.stringify(c), n]));
-  const oldName = new Map(
-    Object.entries(names.files).flatMap(([n, files]) => files.map((f) => [f, n] as const)),
-  );
   const configs: Record<string, EslintConfig> = {};
-  const files: Record<string, string[]> = { [NOT_LINTED]: notLinted };
-  const unnamed: { config: EslintConfig; files: string[] }[] = [];
-  for (const [key, group] of groups) {
-    const name = byContent.get(key);
-    if (name) [configs[name], files[name]] = [group.config, group.files];
-    else unnamed.push(group);
+  const strays: string[] = [];
+  for (const [scope, groups] of byScope) {
+    const [first, ...rest] = [...groups.values()].sort((a, b) => b.files.length - a.files.length);
+    configs[scope] = first!.config;
+    for (const g of rest) strays.push(...g.files.map((f) => `${scope}: ${f}`));
   }
-  unnamed.forEach((group, i) => {
-    const votes = new Map<string, number>();
-    for (const f of group.files) {
-      const n = oldName.get(f);
-      if (n && n !== NOT_LINTED) votes.set(n, (votes.get(n) ?? 0) + 1);
-    }
-    const best = [...votes].sort((a, b) => b[1] - a[1])[0]?.[0];
-    const name = best && !(best in configs) ? best : `new config ${i + 1}`;
-    [configs[name], files[name]] = [group.config, group.files];
-  });
-  return canonical({ configs, files });
+  return { configs: canonical(configs), notLinted, strays };
 }
 
 // the lines that run each lane, comments and blank lines aside
@@ -295,10 +306,10 @@ const lanes = () => ({
   "frontend/.prettierignore": meaningful("frontend/.prettierignore"),
 });
 
-let actual: Promise<Snapshot> | undefined;
-const current = () =>
-  (actual ??= (async () =>
-    canonical({ eslint: await eslintActual(committed().eslint), lanes: lanes() }))());
+let actual: Promise<EslintActual> | undefined;
+const linted = () => (actual ??= eslintActual());
+const current = async (): Promise<Snapshot> =>
+  canonical({ eslint: (await linted()).configs, lanes: lanes() });
 
 // --- the register, read off the snapshot ------------------------------------------------------------
 
@@ -310,11 +321,8 @@ const ignorable = (rule: string, all: Record<string, unknown>) =>
 const entry = (v: unknown[] | undefined) => v as Linter.RuleEntry | undefined;
 
 /** Every narrowing in the effective ESLint configs, as (scope, id). */
-function eslintNarrowings({ configs, files }: Snapshot["eslint"]): [string, string][] {
-  const found: [string, string][] = files[NOT_LINTED]!.map((f) => [
-    "everywhere",
-    `${f} — not linted`,
-  ]);
+function eslintNarrowings({ configs, notLinted }: EslintActual): [string, string][] {
+  const found: [string, string][] = notLinted.map((f) => ["everywhere", `${f} — not linted`]);
   const src = configs.src?.rules;
   if (!src) return [...found, ["src", "(no config named src)"]];
   for (const [scope, { rules, linterOptions }] of Object.entries(configs)) {
@@ -347,22 +355,29 @@ function eslintNarrowings({ configs, files }: Snapshot["eslint"]): [string, stri
 }
 
 describe("the gate snapshot (gates.snapshot.json)", () => {
-  it("holds the effective ESLint config of every file and the lines that run each lane", async () => {
+  it("holds the effective ESLint config of every scope and the lines that run each lane", async () => {
     const now = await current();
     if (process.env.GATE_SNAPSHOT === "update") {
       const path = REPO + SNAPSHOT;
       const options = { ...(await resolveConfig(path)), filepath: path };
-      const stored = { ...now, eslint: { ...now.eslint, configs: toStored(now.eslint.configs) } };
+      const stored = { ...now, eslint: toStored(now.eslint) };
       writeFileSync(path, await format(JSON.stringify(sortKeys(stored)), options));
       return;
     }
     expect(now).toEqual(committed());
   }, 120_000);
+
+  // A glob that moves one file into another config (a product file into the test config) leaves its
+  // scope's config as it was, so the snapshot alone would not see it: the file now differs from the
+  // rest of its scope, and that is what fails here.
+  it("gives every file of a scope the same config", async () => {
+    expect((await linted()).strays).toEqual([]);
+  }, 120_000);
 });
 
 describe("the gate register (docs/gates.md)", () => {
   it("lists every ESLint rule narrowed, by scope", async () => {
-    expect(missingFrom(eslintNarrowings((await current()).eslint))).toEqual([]);
+    expect(missingFrom(eslintNarrowings(await linted()))).toEqual([]);
   }, 120_000);
 
   it("keeps --max-warnings 0, which is what makes a warn-level rule fail", () => {
@@ -389,7 +404,7 @@ describe("the gate register (docs/gates.md)", () => {
   });
   // `strict: true` is a bundle: a sub-flag set false beside it, an `extends` this test cannot see
   // through, or a narrowed `include` / an `exclude` weakens the project while the five flags above
-  // still read true (E32 review).
+  // still read true.
   const STRICT_FAMILY = [
     "noImplicitAny",
     "strictNullChecks",
@@ -433,7 +448,7 @@ describe("the gate register (docs/gates.md)", () => {
       .map((f): [string, string] => ["config files", `${f} — not type-checked`]);
     expect(missingFrom(found)).toEqual([]);
     // a `.js` in `include` is dropped without a word unless allowJs, and read unchecked without
-    // checkJs (E32 review round 2)
+    // checkJs
     const opts = jsonc("frontend/tsconfig.node.json").compilerOptions as Record<string, unknown>;
     if ([...checked].some((f) => /[.][mc]?js$/.test(f)))
       expect([opts.allowJs, opts.checkJs]).toEqual([true, true]);
@@ -442,10 +457,10 @@ describe("the gate register (docs/gates.md)", () => {
   // --- Ruff -----------------------------------------------------------------------------------------
   // Ruff, pyright, pytest and knip are read as whitelists: a key this test does not know (an
   // `extend-exclude`, a `lint.extend-ignore`, a narrowing `select`, a pyright `exclude`, a pytest
-  // `-m "not slow"`, a knip `rules`) fails until someone decides whether it narrows (E32 review —
-  // only `ignore` and the immutable calls used to be read). The TOML is PARSED, not scanned line by
-  // line: a `[lint.per-file-ignores]` table or a quoted key is a key path like any other (E32 review
-  // round 2 — a line regex saw neither).
+  // `-m "not slow"`, a knip `rules`) fails until someone decides whether it narrows (only
+  // `ignore` and the immutable calls used to be read). The TOML is PARSED, not scanned line by
+  // line: a `[lint.per-file-ignores]` table or a quoted key is a key path like any other (a line
+  // regex saw neither).
   const keyPaths = (o: Record<string, unknown>, prefix = ""): string[] =>
     Object.entries(o).flatMap(([k, v]) =>
       v !== null && typeof v === "object" && !Array.isArray(v)
@@ -486,7 +501,7 @@ describe("the gate register (docs/gates.md)", () => {
   // Every ruff lane passes `--config backend/ruff.toml`, which makes ruff ignore any other config
   // file it would discover (measured: a nested `ruff.toml` selecting the `D` rules changed nothing).
   // So that flag is what makes this file the whole configuration. The snapshot holds every line of
-  // the gate script; these two are spelled out because the reason is (round 3: a substring check let
+  // the gate script; these two are spelled out because the reason is (a substring check once let
   // an extra `--config "lint.extend-ignore=…"` override through).
   it("runs both ruff lanes on backend/ruff.toml and nothing else", () => {
     const lanes = read("scripts/check.sh")
@@ -526,8 +541,8 @@ describe("the gate register (docs/gates.md)", () => {
 
   // --- pytest ---------------------------------------------------------------------------------------
   // Held line by line, not key by key: pytest's ini reader also takes `key: value` and indented
-  // continuation lines (`addopts = -q` + `    -m "not slow"`), and a key regex saw neither (E32 review
-  // round 2). Every line that is not blank or a comment must be one of these, and all must be there.
+  // continuation lines (`addopts = -q` + `    -m "not slow"`), and a key regex saw neither.
+  // Every line that is not blank or a comment must be one of these, and all must be there.
   it("keeps pytest strict: the whole tests/ tree, no selection, no warning filters, --strict-markers", () => {
     const lines = read("backend/pytest.ini")
       .split("\n")
@@ -542,22 +557,22 @@ describe("the gate register (docs/gates.md)", () => {
   });
 
   // --- knip -----------------------------------------------------------------------------------------
-  it("lists every knip production exclusion and every other key, and runs both modes", () => {
+  it("lists every knip exclusion and every other key", () => {
     const cfg = jsonc("frontend/knip.jsonc") as { project?: string[] } & Record<string, unknown>;
     const found: [string, string][] = (cfg.project ?? [])
       .filter((p) => p.startsWith("!"))
-      .map((p): [string, string] => ["--production", p]);
+      .map((p): [string, string] => ["knip", p]);
     for (const key of Object.keys(cfg).filter(
       (k) => !["$schema", "project", "playwright"].includes(k),
     ))
       found.push(["knip", key]);
     expect(missingFrom(found)).toEqual([]);
     const pkg = JSON.parse(read("frontend/package.json")) as { scripts: Record<string, string> };
-    expect(pkg.scripts.knip).toBe("knip && knip --production");
-    // the positive pattern is the project itself: narrowing it drops files from both modes
-    expect((cfg.project ?? []).filter((p) => !p.startsWith("!"))).toEqual(["**/*.{ts,tsx,js}!"]);
+    expect(pkg.scripts.knip).toBe("knip");
+    // the positive pattern is the project itself: narrowing it drops files from the lane
+    expect((cfg.project ?? []).filter((p) => !p.startsWith("!"))).toEqual(["**/*.{ts,tsx,js}"]);
     // and knip.jsonc is the config knip reads: a knip.json (read first) or a package.json `knip` key
-    // (merged in) would narrow it unseen (E32 review round 3)
+    // (merged in) would narrow it unseen
     const KNIP_FILES = /^\.?knip(\.config)?\.(json|jsonc|js|ts|mjs|cjs|mts|cts|toml|ya?ml)$/;
     expect(readdirSync(FRONTEND).filter((f) => KNIP_FILES.test(f))).toEqual(["knip.jsonc"]);
     expect("knip" in pkg).toBe(false);
diff --git a/frontend/src/lib/gates.snapshot.json b/frontend/src/lib/gates.snapshot.json
index e208ef36..0dcf7ed0 100644
--- a/frontend/src/lib/gates.snapshot.json
+++ b/frontend/src/lib/gates.snapshot.json
@@ -1,2225 +1,1211 @@
 {
   "eslint": {
-    "configs": {
-      "FocusSafeButton.tsx + AnchoredPopover.tsx": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [],
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh"
-        ],
-        "rules": {
-          "local/focus-safe-disabled": [0],
-          "no-restricted-imports": [
-            2,
-            {
-              "patterns": [
-                {
-                  "message": "components/ui/ is domain-free: a platform component may not import a feature component. Invert the dependency (take a prop/render-prop) or keep the component outside ui/.",
-                  "regex": "^\\.\\./(?!\\.\\./)"
-                },
-                {
-                  "message": "components/ui/ is domain-free: a platform component may not import a feature component. Invert the dependency (take a prop/render-prop) or keep the component outside ui/.",
-                  "regex": "^\\.\\./\\.\\./components/(?!ui/)"
-                },
-                {
-                  "message": "components/ui/ is domain-free: a platform component may not call a domain API slice. Take the data as props.",
-                  "regex": "^\\.\\./\\.\\./lib/api(/|$)"
-                }
-              ]
-            }
-          ]
-        },
-        "settings": null
+    "design-lab": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "1169 names, sha1 aee621727a03",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
       },
-      "design-lab": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [],
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh"
-        ],
-        "rules": { "local/literal-a11y-text": [0] },
-        "settings": null
-      },
-      "e2e": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "82 names, sha1 29467d490e30",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [
-          "local/button-primitive",
-          "local/focus-safe-disabled",
-          "local/glyph-link",
-          "local/input-primitive",
-          "local/jsx-comment-text",
-          "local/literal-a11y-text",
-          "local/locale-format",
-          "local/sortable-a11y",
-          "local/surface-role",
-          "no-console",
-          "no-restricted-globals",
-          "no-restricted-properties",
-          "no-restricted-syntax",
-          "react-hooks/capitalized-calls",
-          "react-hooks/component-hook-factories",
-          "react-hooks/config",
-          "react-hooks/error-boundaries",
-          "react-hooks/exhaustive-deps",
-          "react-hooks/exhaustive-effect-dependencies",
-          "react-hooks/gating",
-          "react-hooks/globals",
-          "react-hooks/hooks",
-          "react-hooks/immutability",
-          "react-hooks/incompatible-library",
-          "react-hooks/invariant",
-          "react-hooks/memo-dependencies",
-          "react-hooks/memoized-effect-dependencies",
-          "react-hooks/no-deriving-state-in-effects",
-          "react-hooks/preserve-manual-memoization",
-          "react-hooks/purity",
-          "react-hooks/refs",
-          "react-hooks/rule-suppression",
-          "react-hooks/rules-of-hooks",
-          "react-hooks/set-state-in-effect",
-          "react-hooks/set-state-in-render",
-          "react-hooks/static-components",
-          "react-hooks/syntax",
-          "react-hooks/todo",
-          "react-hooks/unsupported-syntax",
-          "react-hooks/use-memo",
-          "react-hooks/void-use-memo",
-          "react-refresh/only-export-components"
-        ],
-        "plugins": ["@", "@eslint-community/eslint-comments", "@typescript-eslint", "playwright"],
-        "rules": {
-          "@typescript-eslint/no-unused-expressions": [
-            2,
-            { "allowShortCircuit": false, "allowTaggedTemplates": false, "allowTernary": false }
-          ],
-          "playwright/no-focused-test": [2],
-          "playwright/no-skipped-test": [2]
-        },
-        "settings": null
-      },
-      "js configs": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "82 names, sha1 29467d490e30",
-          "parser": "(unnamed parser)",
-          "parserOptions": { "sourceType": "module" },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [
-          "@typescript-eslint/ban-ts-comment",
-          "@typescript-eslint/no-array-constructor",
-          "@typescript-eslint/no-deprecated",
-          "@typescript-eslint/no-duplicate-enum-values",
-          "@typescript-eslint/no-empty-object-type",
-          "@typescript-eslint/no-explicit-any",
-          "@typescript-eslint/no-extra-non-null-assertion",
-          "@typescript-eslint/no-floating-promises",
-          "@typescript-eslint/no-misused-new",
-          "@typescript-eslint/no-namespace",
-          "@typescript-eslint/no-non-null-asserted-optional-chain",
-          "@typescript-eslint/no-require-imports",
-          "@typescript-eslint/no-this-alias",
-          "@typescript-eslint/no-unnecessary-type-constraint",
-          "@typescript-eslint/no-unsafe-declaration-merging",
-          "@typescript-eslint/no-unsafe-function-type",
-          "@typescript-eslint/no-unused-expressions",
-          "@typescript-eslint/no-unused-vars",
-          "@typescript-eslint/no-wrapper-object-types",
-          "@typescript-eslint/prefer-as-const",
-          "@typescript-eslint/prefer-namespace-keyword",
-          "@typescript-eslint/triple-slash-reference",
-          "local/button-primitive",
-          "local/focus-safe-disabled",
-          "local/glyph-link",
-          "local/input-primitive",
-          "local/jsx-comment-text",
-          "local/literal-a11y-text",
-          "local/locale-format",
-          "local/sortable-a11y",
-          "local/surface-role",
-          "no-array-constructor",
-          "no-console",
-          "no-new-symbol",
-          "no-restricted-globals",
-          "no-restricted-properties",
-          "no-restricted-syntax",
-          "no-unused-expressions",
-          "no-var",
-          "prefer-const",
-          "prefer-rest-params",
-          "prefer-spread",
-          "react-hooks/capitalized-calls",
-          "react-hooks/component-hook-factories",
-          "react-hooks/config",
-          "react-hooks/error-boundaries",
-          "react-hooks/exhaustive-deps",
-          "react-hooks/exhaustive-effect-dependencies",
-          "react-hooks/gating",
-          "react-hooks/globals",
-          "react-hooks/hooks",
-          "react-hooks/immutability",
-          "react-hooks/incompatible-library",
-          "react-hooks/invariant",
-          "react-hooks/memo-dependencies",
-          "react-hooks/memoized-effect-dependencies",
-          "react-hooks/no-deriving-state-in-effects",
-          "react-hooks/preserve-manual-memoization",
-          "react-hooks/purity",
-          "react-hooks/refs",
-          "react-hooks/rule-suppression",
-          "react-hooks/rules-of-hooks",
-          "react-hooks/set-state-in-effect",
-          "react-hooks/set-state-in-render",
-          "react-hooks/static-components",
-          "react-hooks/syntax",
-          "react-hooks/todo",
-          "react-hooks/unsupported-syntax",
-          "react-hooks/use-memo",
-          "react-hooks/void-use-memo",
-          "react-refresh/only-export-components"
-        ],
-        "plugins": ["@", "@eslint-community/eslint-comments"],
-        "rules": {
-          "constructor-super": [2],
-          "getter-return": [2, { "allowImplicit": false }],
-          "no-class-assign": [2],
-          "no-const-assign": [2],
-          "no-dupe-args": [2],
-          "no-dupe-class-members": [2],
-          "no-dupe-keys": [2],
-          "no-func-assign": [2],
-          "no-import-assign": [2],
-          "no-new-native-nonconstructor": [2],
-          "no-obj-calls": [2],
-          "no-redeclare": [2, { "builtinGlobals": true }],
-          "no-setter-return": [2],
-          "no-this-before-super": [2],
-          "no-undef": [2, { "typeof": false }],
-          "no-unreachable": [2],
-          "no-unsafe-negation": [2, { "enforceForOrderingRelations": false }],
-          "no-unused-vars": [2],
-          "no-with": [2]
-        },
-        "settings": null
-      },
-      "lib tests": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [],
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh",
-          "vitest"
-        ],
-        "rules": {
-          "local/button-primitive": [0],
-          "local/glyph-link": [0],
-          "local/input-primitive": [0],
-          "local/literal-a11y-text": [0],
-          "local/surface-role": [0],
-          "no-restricted-globals": [
-            0,
-            {
-              "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "fetch"
-            },
-            {
-              "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "XMLHttpRequest"
-            },
-            {
-              "message": "Use the logged request layer: `WebSocket` belongs to src/lib/messagesSocket.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "WebSocket"
-            },
-            {
-              "message": "No `EventSource` without a logged owner module (E22 S4).",
-              "name": "EventSource"
-            }
-          ],
-          "no-restricted-imports": [
-            2,
-            {
-              "patterns": [
-                {
-                  "message": "lib/ sits below components/: it may not import from components/, not even a type. Move the shared piece down into lib/.",
-                  "regex": "^(\\.\\./)+components(/|$)"
-                }
-              ]
-            }
-          ],
-          "no-restricted-properties": [
-            0,
-            {
-              "message": "Use lib/http.ts `send` (E22 S4).",
-              "object": "window",
-              "property": "fetch"
-            },
-            {
-              "message": "Use lib/http.ts `send` (E22 S4).",
-              "object": "globalThis",
-              "property": "fetch"
-            },
-            {
-              "message": "Use lib/api/core.ts `beacon` (E22 S4).",
-              "object": "navigator",
-              "property": "sendBeacon"
-            }
-          ],
-          "vitest/no-disabled-tests": [2],
-          "vitest/no-focused-tests": [2, { "fixable": true }]
-        },
-        "settings": null
-      },
-      "lib/api/core.ts": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [],
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh"
-        ],
-        "rules": {
-          "no-restricted-globals": [
-            2,
-            {
-              "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "fetch"
-            },
-            {
-              "message": "Use the logged request layer: `WebSocket` belongs to src/lib/messagesSocket.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "WebSocket"
-            },
-            {
-              "message": "No `EventSource` without a logged owner module (E22 S4).",
-              "name": "EventSource"
-            }
-          ],
-          "no-restricted-imports": [
-            2,
-            {
-              "patterns": [
-                {
-                  "message": "lib/ sits below components/: it may not import from components/, not even a type. Move the shared piece down into lib/.",
-                  "regex": "^(\\.\\./)+components(/|$)"
-                }
-              ]
-            }
-          ]
-        },
-        "settings": null
-      },
-      "lib/http.ts": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [],
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh"
-        ],
-        "rules": {
-          "no-restricted-globals": [
-            2,
-            {
-              "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "XMLHttpRequest"
-            },
-            {
-              "message": "Use the logged request layer: `WebSocket` belongs to src/lib/messagesSocket.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "WebSocket"
-            },
-            {
-              "message": "No `EventSource` without a logged owner module (E22 S4).",
-              "name": "EventSource"
-            }
-          ],
-          "no-restricted-imports": [
-            2,
-            {
-              "patterns": [
-                {
-                  "message": "lib/ sits below components/: it may not import from components/, not even a type. Move the shared piece down into lib/.",
-                  "regex": "^(\\.\\./)+components(/|$)"
-                }
-              ]
-            }
-          ]
-        },
-        "settings": null
-      },
-      "lib/messagesSocket.ts": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [],
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh"
-        ],
-        "rules": {
-          "no-restricted-globals": [
-            2,
-            {
-              "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "fetch"
-            },
-            {
-              "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "XMLHttpRequest"
-            },
-            {
-              "message": "No `EventSource` without a logged owner module (E22 S4).",
-              "name": "EventSource"
-            }
-          ],
-          "no-restricted-imports": [
-            2,
-            {
-              "patterns": [
-                {
-                  "message": "lib/ sits below components/: it may not import from components/, not even a type. Move the shared piece down into lib/.",
-                  "regex": "^(\\.\\./)+components(/|$)"
-                }
-              ]
-            }
-          ]
-        },
-        "settings": null
-      },
-      "src": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh"
-        ],
-        "rules": {
-          "@babel/object-curly-spacing": [0],
-          "@babel/semi": [0],
-          "@eslint-community/eslint-comments/no-unlimited-disable": [2],
-          "@eslint-community/eslint-comments/require-description": [2, { "ignore": [] }],
-          "@stylistic/array-bracket-newline": [0],
-          "@stylistic/array-bracket-spacing": [0],
-          "@stylistic/array-element-newline": [0],
-          "@stylistic/arrow-parens": [0],
-          "@stylistic/arrow-spacing": [0],
-          "@stylistic/block-spacing": [0],
-          "@stylistic/brace-style": [0],
-          "@stylistic/comma-dangle": [0],
-          "@stylistic/comma-spacing": [0],
-          "@stylistic/comma-style": [0],
-          "@stylistic/computed-property-spacing": [0],
-          "@stylistic/dot-location": [0],
-          "@stylistic/eol-last": [0],
-          "@stylistic/func-call-spacing": [0],
-          "@stylistic/function-call-argument-newline": [0],
-          "@stylistic/function-call-spacing": [0],
-          "@stylistic/function-paren-newline": [0],
-          "@stylistic/generator-star-spacing": [0],
-          "@stylistic/implicit-arrow-linebreak": [0],
-          "@stylistic/indent": [0],
-          "@stylistic/indent-binary-ops": [0],
-          "@stylistic/js/array-bracket-newline": [0],
-          "@stylistic/js/array-bracket-spacing": [0],
-          "@stylistic/js/array-element-newline": [0],
-          "@stylistic/js/arrow-parens": [0],
-          "@stylistic/js/arrow-spacing": [0],
-          "@stylistic/js/block-spacing": [0],
-          "@stylistic/js/brace-style": [0],
-          "@stylistic/js/comma-dangle": [0],
-          "@stylistic/js/comma-spacing": [0],
-          "@stylistic/js/comma-style": [0],
-          "@stylistic/js/computed-property-spacing": [0],
-          "@stylistic/js/dot-location": [0],
-          "@stylistic/js/eol-last": [0],
-          "@stylistic/js/func-call-spacing": [0],
-          "@stylistic/js/function-call-argument-newline": [0],
-          "@stylistic/js/function-call-spacing": [0],
-          "@stylistic/js/function-paren-newline": [0],
-          "@stylistic/js/generator-star-spacing": [0],
-          "@stylistic/js/implicit-arrow-linebreak": [0],
-          "@stylistic/js/indent": [0],
-          "@stylistic/js/jsx-quotes": [0],
-          "@stylistic/js/key-spacing": [0],
-          "@stylistic/js/keyword-spacing": [0],
-          "@stylistic/js/linebreak-style": [0],
-          "@stylistic/js/lines-around-comment": [0],
-          "@stylistic/js/max-len": [0],
-          "@stylistic/js/max-statements-per-line": [0],
-          "@stylistic/js/multiline-ternary": [0],
-          "@stylistic/js/new-parens": [0],
-          "@stylistic/js/newline-per-chained-call": [0],
-          "@stylistic/js/no-confusing-arrow": [0],
-          "@stylistic/js/no-extra-parens": [0],
-          "@stylistic/js/no-extra-semi": [0],
-          "@stylistic/js/no-floating-decimal": [0],
-          "@stylistic/js/no-mixed-operators": [0],
-          "@stylistic/js/no-mixed-spaces-and-tabs": [0],
-          "@stylistic/js/no-multi-spaces": [0],
-          "@stylistic/js/no-multiple-empty-lines": [0],
-          "@stylistic/js/no-tabs": [0],
-          "@stylistic/js/no-trailing-spaces": [0],
-          "@stylistic/js/no-whitespace-before-property": [0],
-          "@stylistic/js/nonblock-statement-body-position": [0],
-          "@stylistic/js/object-curly-newline": [0],
-          "@stylistic/js/object-curly-spacing": [0],
-          "@stylistic/js/object-property-newline": [0],
-          "@stylistic/js/one-var-declaration-per-line": [0],
-          "@stylistic/js/operator-linebreak": [0],
-          "@stylistic/js/padded-blocks": [0],
-          "@stylistic/js/quote-props": [0],
-          "@stylistic/js/quotes": [0],
-          "@stylistic/js/rest-spread-spacing": [0],
-          "@stylistic/js/semi": [0],
-          "@stylistic/js/semi-spacing": [0],
-          "@stylistic/js/semi-style": [0],
-          "@stylistic/js/space-before-blocks": [0],
-          "@stylistic/js/space-before-function-paren": [0],
-          "@stylistic/js/space-in-parens": [0],
-          "@stylistic/js/space-infix-ops": [0],
-          "@stylistic/js/space-unary-ops": [0],
-          "@stylistic/js/switch-colon-spacing": [0],
-          "@stylistic/js/template-curly-spacing": [0],
-          "@stylistic/js/template-tag-spacing": [0],
-          "@stylistic/js/wrap-iife": [0],
-          "@stylistic/js/wrap-regex": [0],
-          "@stylistic/js/yield-star-spacing": [0],
-          "@stylistic/jsx-child-element-spacing": [0],
-          "@stylistic/jsx-closing-bracket-location": [0],
-          "@stylistic/jsx-closing-tag-location": [0],
-          "@stylistic/jsx-curly-newline": [0],
-          "@stylistic/jsx-curly-spacing": [0],
-          "@stylistic/jsx-equals-spacing": [0],
-          "@stylistic/jsx-first-prop-new-line": [0],
-          "@stylistic/jsx-indent": [0],
-          "@stylistic/jsx-indent-props": [0],
-          "@stylistic/jsx-max-props-per-line": [0],
-          "@stylistic/jsx-newline": [0],
-          "@stylistic/jsx-one-expression-per-line": [0],
-          "@stylistic/jsx-props-no-multi-spaces": [0],
-          "@stylistic/jsx-quotes": [0],
-          "@stylistic/jsx-tag-spacing": [0],
-          "@stylistic/jsx-wrap-multilines": [0],
-          "@stylistic/jsx/jsx-child-element-spacing": [0],
-          "@stylistic/jsx/jsx-closing-bracket-location": [0],
-          "@stylistic/jsx/jsx-closing-tag-location": [0],
-          "@stylistic/jsx/jsx-curly-newline": [0],
-          "@stylistic/jsx/jsx-curly-spacing": [0],
-          "@stylistic/jsx/jsx-equals-spacing": [0],
-          "@stylistic/jsx/jsx-first-prop-new-line": [0],
-          "@stylistic/jsx/jsx-indent": [0],
-          "@stylistic/jsx/jsx-indent-props": [0],
-          "@stylistic/jsx/jsx-max-props-per-line": [0],
-          "@stylistic/key-spacing": [0],
-          "@stylistic/keyword-spacing": [0],
-          "@stylistic/linebreak-style": [0],
-          "@stylistic/lines-around-comment": [0],
-          "@stylistic/max-len": [0],
-          "@stylistic/max-statements-per-line": [0],
-          "@stylistic/member-delimiter-style": [0],
-          "@stylistic/multiline-ternary": [0],
-          "@stylistic/new-parens": [0],
-          "@stylistic/newline-per-chained-call": [0],
-          "@stylistic/no-confusing-arrow": [0],
-          "@stylistic/no-extra-parens": [0],
-          "@stylistic/no-extra-semi": [0],
-          "@stylistic/no-floating-decimal": [0],
-          "@stylistic/no-mixed-operators": [0],
-          "@stylistic/no-mixed-spaces-and-tabs": [0],
-          "@stylistic/no-multi-spaces": [0],
-          "@stylistic/no-multiple-empty-lines": [0],
-          "@stylistic/no-tabs": [0],
-          "@stylistic/no-trailing-spaces": [0],
-          "@stylistic/no-whitespace-before-property": [0],
-          "@stylistic/nonblock-statement-body-position": [0],
-          "@stylistic/object-curly-newline": [0],
-          "@stylistic/object-curly-spacing": [0],
-          "@stylistic/object-property-newline": [0],
-          "@stylistic/one-var-declaration-per-line": [0],
-          "@stylistic/operator-linebreak": [0],
-          "@stylistic/padded-blocks": [0],
-          "@stylistic/quote-props": [0],
-          "@stylistic/quotes": [0],
-          "@stylistic/rest-spread-spacing": [0],
-          "@stylistic/semi": [0],
-          "@stylistic/semi-spacing": [0],
-          "@stylistic/semi-style": [0],
-          "@stylistic/space-before-blocks": [0],
-          "@stylistic/space-before-function-paren": [0],
-          "@stylistic/space-in-parens": [0],
-          "@stylistic/space-infix-ops": [0],
-          "@stylistic/space-unary-ops": [0],
-          "@stylistic/switch-colon-spacing": [0],
-          "@stylistic/template-curly-spacing": [0],
-          "@stylistic/template-tag-spacing": [0],
-          "@stylistic/ts/block-spacing": [0],
-          "@stylistic/ts/brace-style": [0],
-          "@stylistic/ts/comma-dangle": [0],
-          "@stylistic/ts/comma-spacing": [0],
-          "@stylistic/ts/func-call-spacing": [0],
-          "@stylistic/ts/function-call-spacing": [0],
-          "@stylistic/ts/indent": [0],
-          "@stylistic/ts/key-spacing": [0],
-          "@stylistic/ts/keyword-spacing": [0],
-          "@stylistic/ts/lines-around-comment": [0],
-          "@stylistic/ts/member-delimiter-style": [0],
-          "@stylistic/ts/no-extra-parens": [0],
-          "@stylistic/ts/no-extra-semi": [0],
-          "@stylistic/ts/object-curly-spacing": [0],
-          "@stylistic/ts/quotes": [0],
-          "@stylistic/ts/semi": [0],
-          "@stylistic/ts/space-before-blocks": [0],
-          "@stylistic/ts/space-before-function-paren": [0],
-          "@stylistic/ts/space-infix-ops": [0],
-          "@stylistic/ts/type-annotation-spacing": [0],
-          "@stylistic/type-annotation-spacing": [0],
-          "@stylistic/type-generic-spacing": [0],
-          "@stylistic/type-named-tuple-spacing": [0],
-          "@stylistic/wrap-iife": [0],
-          "@stylistic/wrap-regex": [0],
-          "@stylistic/yield-star-spacing": [0],
-          "@typescript-eslint/ban-ts-comment": [2],
-          "@typescript-eslint/block-spacing": [0],
-          "@typescript-eslint/brace-style": [0],
-          "@typescript-eslint/comma-dangle": [0],
-          "@typescript-eslint/comma-spacing": [0],
-          "@typescript-eslint/func-call-spacing": [0],
-          "@typescript-eslint/indent": [0],
-          "@typescript-eslint/key-spacing": [0],
-          "@typescript-eslint/keyword-spacing": [0],
-          "@typescript-eslint/lines-around-comment": [0],
-          "@typescript-eslint/member-delimiter-style": [0],
-          "@typescript-eslint/no-array-constructor": [2],
-          "@typescript-eslint/no-deprecated": [2],
-          "@typescript-eslint/no-duplicate-enum-values": [2],
-          "@typescript-eslint/no-empty-object-type": [2],
-          "@typescript-eslint/no-explicit-any": [2],
-          "@typescript-eslint/no-extra-non-null-assertion": [2],
-          "@typescript-eslint/no-extra-parens": [0],
-          "@typescript-eslint/no-extra-semi": [0],
-          "@typescript-eslint/no-floating-promises": [
-            2,
-            {
-              "allowForKnownSafeCalls": [
-                {
-                  "from": "package",
-                  "name": [
-                    "invalidateQueries",
-                    "refetchQueries",
-                    "cancelQueries",
-                    "resetQueries",
-                    "prefetchQuery",
-                    "prefetchInfiniteQuery"
-                  ],
-                  "package": "@tanstack/query-core"
-                }
-              ]
-            }
-          ],
-          "@typescript-eslint/no-misused-new": [2],
-          "@typescript-eslint/no-namespace": [2],
-          "@typescript-eslint/no-non-null-asserted-optional-chain": [2],
-          "@typescript-eslint/no-require-imports": [2],
-          "@typescript-eslint/no-this-alias": [2],
-          "@typescript-eslint/no-unnecessary-type-constraint": [2],
-          "@typescript-eslint/no-unsafe-declaration-merging": [2],
-          "@typescript-eslint/no-unsafe-function-type": [2],
-          "@typescript-eslint/no-unused-expressions": [
-            2,
-            { "allowShortCircuit": true, "allowTaggedTemplates": false, "allowTernary": true }
-          ],
-          "@typescript-eslint/no-unused-vars": [0],
-          "@typescript-eslint/no-wrapper-object-types": [2],
-          "@typescript-eslint/object-curly-spacing": [0],
-          "@typescript-eslint/prefer-as-const": [2],
-          "@typescript-eslint/prefer-namespace-keyword": [2],
-          "@typescript-eslint/quotes": [0],
-          "@typescript-eslint/semi": [0],
-          "@typescript-eslint/space-before-blocks": [0],
-          "@typescript-eslint/space-before-function-paren": [0],
-          "@typescript-eslint/space-infix-ops": [0],
-          "@typescript-eslint/triple-slash-reference": [2],
-          "@typescript-eslint/type-annotation-spacing": [0],
-          "array-bracket-newline": [0],
-          "array-bracket-spacing": [0],
-          "array-element-newline": [0],
-          "arrow-parens": [0],
-          "arrow-spacing": [0],
-          "babel/object-curly-spacing": [0],
-          "babel/quotes": [0],
-          "babel/semi": [0],
-          "block-spacing": [0],
-          "brace-style": [0],
-          "comma-dangle": [0],
-          "comma-spacing": [0],
-          "comma-style": [0],
-          "computed-property-spacing": [0],
-          "constructor-super": [0],
-          "curly": [0, "all"],
-          "dot-location": [0],
-          "eol-last": [0],
-          "flowtype/boolean-style": [0],
-          "flowtype/delimiter-dangle": [0],
-          "flowtype/generic-spacing": [0],
-          "flowtype/object-type-curly-spacing": [0],
-          "flowtype/object-type-delimiter": [0],
-          "flowtype/quotes": [0],
-          "flowtype/semi": [0],
-          "flowtype/space-after-type-colon": [0],
-          "flowtype/space-before-generic-bracket": [0],
-          "flowtype/space-before-type-colon": [0],
-          "flowtype/union-intersection-spacing": [0],
-          "for-direction": [2],
-          "func-call-spacing": [0],
-          "function-call-argument-newline": [0],
-          "function-paren-newline": [0],
-          "generator-star": [0],
-          "generator-star-spacing": [0],
-          "getter-return": [0, { "allowImplicit": false }],
-          "implicit-arrow-linebreak": [0],
-          "indent": [0],
-          "indent-legacy": [0],
-          "jsx-quotes": [0],
-          "key-spacing": [0],
-          "keyword-spacing": [0],
-          "linebreak-style": [0],
-          "lines-around-comment": [0],
-          "local/button-primitive": [2],
-          "local/focus-safe-disabled": [2],
-          "local/glyph-link": [2],
-          "local/input-primitive": [2],
-          "local/jsx-comment-text": [2],
-          "local/literal-a11y-text": [2],
-          "local/locale-format": [2],
-          "local/sortable-a11y": [2],
-          "local/surface-role": [2],
-          "max-len": [0],
-          "max-statements-per-line": [0],
-          "multiline-ternary": [0],
-          "new-parens": [0],
-          "newline-per-chained-call": [0],
-          "no-array-constructor": [0],
-          "no-arrow-condition": [0],
-          "no-async-promise-executor": [2],
-          "no-case-declarations": [2],
-          "no-class-assign": [0],
-          "no-comma-dangle": [0],
-          "no-compare-neg-zero": [2],
-          "no-cond-assign": [2, "except-parens"],
-          "no-confusing-arrow": [0],
-          "no-console": [2, {}],
-          "no-const-assign": [0],
-          "no-constant-binary-expression": [2],
-          "no-constant-condition": [2, { "checkLoops": "allExceptWhileTrue" }],
-          "no-control-regex": [2],
-          "no-debugger": [2],
-          "no-delete-var": [2],
-          "no-dupe-args": [0],
-          "no-dupe-class-members": [0],
-          "no-dupe-else-if": [2],
-          "no-dupe-keys": [0],
-          "no-duplicate-case": [2],
-          "no-empty": [2, { "allowEmptyCatch": false }],
-          "no-empty-character-class": [2],
-          "no-empty-pattern": [2, { "allowObjectPatternsAsParameters": false }],
-          "no-empty-static-block": [2],
-          "no-ex-assign": [2],
-          "no-extra-boolean-cast": [2, {}],
-          "no-extra-parens": [0],
-          "no-extra-semi": [0],
-          "no-fallthrough": [
-            2,
-            { "allowEmptyCase": false, "reportUnusedFallthroughComment": false }
-          ],
-          "no-floating-decimal": [0],
-          "no-func-assign": [0],
-          "no-global-assign": [2, { "exceptions": [] }],
-          "no-import-assign": [0],
-          "no-invalid-regexp": [2, {}],
-          "no-irregular-whitespace": [
-            2,
-            {
-              "skipComments": false,
-              "skipJSXText": false,
-              "skipRegExps": false,
-              "skipStrings": true,
-              "skipTemplates": false
-            }
-          ],
-          "no-loss-of-precision": [2],
-          "no-misleading-character-class": [2, { "allowEscape": false }],
-          "no-mixed-operators": [0],
-          "no-mixed-spaces-and-tabs": [0],
-          "no-multi-spaces": [0],
-          "no-multiple-empty-lines": [0],
-          "no-new-native-nonconstructor": [0],
-          "no-new-symbol": [0],
-          "no-nonoctal-decimal-escape": [2],
-          "no-obj-calls": [0],
-          "no-octal": [2],
-          "no-prototype-builtins": [2],
-          "no-redeclare": [0, { "builtinGlobals": true }],
-          "no-regex-spaces": [2],
-          "no-reserved-keys": [0],
-          "no-restricted-globals": [
-            2,
-            {
-              "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "fetch"
-            },
-            {
-              "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "XMLHttpRequest"
-            },
-            {
-              "message": "Use the logged request layer: `WebSocket` belongs to src/lib/messagesSocket.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "WebSocket"
-            },
-            {
-              "message": "No `EventSource` without a logged owner module (E22 S4).",
-              "name": "EventSource"
-            }
-          ],
-          "no-restricted-properties": [
-            2,
-            {
-              "message": "Use lib/http.ts `send` (E22 S4).",
-              "object": "window",
-              "property": "fetch"
-            },
-            {
-              "message": "Use lib/http.ts `send` (E22 S4).",
-              "object": "globalThis",
-              "property": "fetch"
-            },
-            {
-              "message": "Use lib/api/core.ts `beacon` (E22 S4).",
-              "object": "navigator",
-              "property": "sendBeacon"
-            }
-          ],
-          "no-restricted-syntax": [
-            2,
-            {
-              "message": "fetchNextPage() cancels and re-sends a page already loading: call fetchNextPage(NEXT_PAGE) (lib/nextPage.ts).",
-              "selector": "CallExpression[arguments.length=0]:matches([callee.name='fetchNextPage'], [callee.property.name='fetchNextPage'])"
-            },
-            {
-              "message": "`enabled:hover:` misses a focused FocusSafeButton (aria-disabled): use `act:hover:` (index.css).",
-              "selector": "Literal[value=/(^|\\s)enabled:hover:/]"
-            },
-            {
-              "message": "`enabled:hover:` misses a focused FocusSafeButton (aria-disabled): use `act:hover:` (index.css).",
-              "selector": "TemplateElement[value.raw=/(^|\\s)enabled:hover:/]"
-            },
-            {
-              "message": "a class split by an interpolation (`${x}hover:…`): Tailwind never sees it whole and emits no CSS; write the class literally (a shared guard is the `act:` variant).",
-              "selector": "TemplateLiteral > TemplateElement:not(:first-child)[value.raw=/^([a-z][\\w-]*:[\\w\\[!-]|:[a-z\\[!])/]"
-            },
-            {
-              "message": "No native <select>: use ui/SegmentedToggle for a short fixed set, ui/FilterSelect for a longer one or a user's own list.",
-              "selector": "JSXOpeningElement[name.name='select']"
-            },
-            {
-              "message": "px-frozen font size doesn't scale with --font-scale: use text-2xs/text-3xs or text-[Nrem], not text-[Npx] (R10 S2).",
-              "selector": "Literal[value=/text-\\[[\\d.]+px\\]/]"
-            },
-            {
-              "message": "px-frozen font size doesn't scale with --font-scale: use text-2xs/text-3xs or text-[Nrem], not text-[Npx] (R10 S2).",
-              "selector": "TemplateElement[value.raw=/text-\\[[\\d.]+px\\]/]"
-            },
-            {
-              "message": "px-frozen box size doesn't scale with --font-scale: use the spacing scale (w-37.5, max-w-60), not w-[Npx].",
-              "selector": "Literal[value=/(^|[\\s:])(min-|max-)?(w|h|size|left|right|top|bottom|inset|gap|p[xytrbl]?|m[xytrbl]?)-\\[[\\d.]+px\\]/]"
-            },
-            {
-              "message": "px-frozen box size doesn't scale with --font-scale: use the spacing scale (w-37.5, max-w-60), not w-[Npx].",
-              "selector": "TemplateElement[value.raw=/(^|[\\s:])(min-|max-)?(w|h|size|left|right|top|bottom|inset|gap|p[xytrbl]?|m[xytrbl]?)-\\[[\\d.]+px\\]/]"
-            },
-            {
-              "message": "px-frozen box size doesn't scale with --font-scale: give a grid column's minimum in rem (minmax(9.375rem,1fr)), not minmax(Npx,…).",
-              "selector": "Literal[value=/minmax\\([\\d.]+px,/]"
-            },
-            {
-              "message": "px-frozen box size doesn't scale with --font-scale: give a grid column's minimum in rem (minmax(9.375rem,1fr)), not minmax(Npx,…).",
-              "selector": "TemplateElement[value.raw=/minmax\\([\\d.]+px,/]"
-            },
-            {
-              "message": "z-index off the layer scale: use a named level (z-under, z-base, z-menu, z-chrome, z-panel, z-rail, z-overlay, z-popover, z-tooltip), not z-N or z-[…].",
-              "selector": "Literal[value=/(^|[\\s:])-?z-([1-9]\\d*|\\[[^\\]]+\\])(?![\\w-])/]"
-            },
-            {
-              "message": "z-index off the layer scale: use a named level (z-under, z-base, z-menu, z-chrome, z-panel, z-rail, z-overlay, z-popover, z-tooltip), not z-N or z-[…].",
-              "selector": "TemplateElement[value.raw=/(^|[\\s:])-?z-([1-9]\\d*|\\[[^\\]]+\\])(?![\\w-])/]"
-            },
-            {
-              "message": "hover by a colour swap: use the B3 layer (`state-layer`, Pressable `layer`, `state-filled` on a fill), not hover:bg-card / bg-border / opacity-N.",
-              "selector": "Literal[value=/(^|[\\s:])hover:(bg-(card|border|surface|muted)(?![\\w-])|bg-\\(--(hover|press)\\)|opacity-)/]"
-            },
-            {
-              "message": "hover by a colour swap: use the B3 layer (`state-layer`, Pressable `layer`, `state-filled` on a fill), not hover:bg-card / bg-border / opacity-N.",
-              "selector": "TemplateElement[value.raw=/(^|[\\s:])hover:(bg-(card|border|surface|muted)(?![\\w-])|bg-\\(--(hover|press)\\)|opacity-)/]"
-            },
-            {
-              "message": "a palette colour: use a semantic token (text-rating, bg-live, bg-media-chrome, text-danger, …; DESIGN.md Tokens), not text-amber-500.",
-              "selector": "Literal[value=/(^|[\\s:])(text|bg|border|fill|stroke|from|via|to|ring|outline|decoration|divide|caret|shadow)-(red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose|slate|gray|zinc|neutral|stone)-\\d/]"
-            },
-            {
-              "message": "a palette colour: use a semantic token (text-rating, bg-live, bg-media-chrome, text-danger, …; DESIGN.md Tokens), not text-amber-500.",
-              "selector": "TemplateElement[value.raw=/(^|[\\s:])(text|bg|border|fill|stroke|from|via|to|ring|outline|decoration|divide|caret|shadow)-(red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose|slate|gray|zinc|neutral|stone)-\\d/]"
-            },
-            {
-              "message": "a static label with an edge reads as a pressable chip: use ui/Badge (flat, tonal) for a label that does nothing.",
-              "selector": "JSXOpeningElement[name.name='span'] JSXAttribute[name.name='className'] Literal[value=/^(?=.*(^|\\s)rounded-(full|md|lg|xl|2xl)(\\s|$))(?=.*(^|\\s)border(\\s|$))/]"
-            },
-            {
-              "message": "a static label with an edge reads as a pressable chip: use ui/Badge (flat, tonal) for a label that does nothing.",
-              "selector": "JSXOpeningElement[name.name='span'] JSXAttribute[name.name='className'] TemplateElement[value.raw=/^(?=.*(^|\\s)rounded-(full|md|lg|xl|2xl)(\\s|$))(?=.*(^|\\s)border(\\s|$))/]"
-            }
-          ],
-          "no-self-assign": [2, { "props": true }],
-          "no-setter-return": [0],
-          "no-shadow-restricted-names": [2, { "reportGlobalThis": false }],
-          "no-space-before-semi": [0],
-          "no-spaced-func": [0],
-          "no-sparse-arrays": [2],
-          "no-tabs": [0],
-          "no-this-before-super": [0],
-          "no-trailing-spaces": [0],
-          "no-undef": [0, { "typeof": false }],
-          "no-unexpected-multiline": [0],
-          "no-unreachable": [0],
-          "no-unsafe-finally": [2],
-          "no-unsafe-negation": [0, { "enforceForOrderingRelations": false }],
-          "no-unsafe-optional-chaining": [2, { "disallowArithmeticOperators": false }],
-          "no-unused-expressions": [
-            0,
-            {
-              "allowShortCircuit": false,
-              "allowTaggedTemplates": false,
-              "allowTernary": false,
-              "enforceForJSX": false,
-              "ignoreDirectives": false
-            }
-          ],
-          "no-unused-labels": [2],
-          "no-unused-private-class-members": [2],
-          "no-unused-vars": [0],
-          "no-useless-backreference": [2],
-          "no-useless-catch": [2],
-          "no-useless-escape": [2, { "allowRegexCharacters": [] }],
-          "no-var": [2],
-          "no-whitespace-before-property": [0],
-          "no-with": [0],
-          "no-wrap-func": [0],
-          "nonblock-statement-body-position": [0],
-          "object-curly-newline": [0],
-          "object-curly-spacing": [0],
-          "object-property-newline": [0],
-          "one-var-declaration-per-line": [0],
-          "operator-linebreak": [0],
-          "padded-blocks": [0],
-          "prefer-const": [2, { "destructuring": "any", "ignoreReadBeforeAssign": false }],
-          "prefer-rest-params": [2],
-          "prefer-spread": [2],
-          "quote-props": [0],
-          "quotes": [0],
-          "react-hooks/capitalized-calls": [2],
-          "react-hooks/component-hook-factories": [2],
-          "react-hooks/config": [2],
-          "react-hooks/error-boundaries": [2],
-          "react-hooks/exhaustive-deps": [1],
-          "react-hooks/exhaustive-effect-dependencies": [2],
-          "react-hooks/gating": [2],
-          "react-hooks/globals": [2],
-          "react-hooks/hooks": [2],
-          "react-hooks/immutability": [2],
-          "react-hooks/incompatible-library": [1],
-          "react-hooks/invariant": [2],
-          "react-hooks/memo-dependencies": [2],
-          "react-hooks/memoized-effect-dependencies": [2],
-          "react-hooks/no-deriving-state-in-effects": [2],
-          "react-hooks/preserve-manual-memoization": [2],
-          "react-hooks/purity": [2],
-          "react-hooks/refs": [2],
-          "react-hooks/rule-suppression": [2],
-          "react-hooks/rules-of-hooks": [2],
-          "react-hooks/set-state-in-effect": [2],
-          "react-hooks/set-state-in-render": [2],
-          "react-hooks/static-components": [2],
-          "react-hooks/syntax": [2],
-          "react-hooks/todo": [2],
-          "react-hooks/unsupported-syntax": [1],
-          "react-hooks/use-memo": [2],
-          "react-hooks/void-use-memo": [2],
-          "react-refresh/only-export-components": [1, { "allowConstantExport": true }],
-          "react/jsx-child-element-spacing": [0],
-          "react/jsx-closing-bracket-location": [0],
-          "react/jsx-closing-tag-location": [0],
-          "react/jsx-curly-newline": [0],
-          "react/jsx-curly-spacing": [0],
-          "react/jsx-equals-spacing": [0],
-          "react/jsx-first-prop-new-line": [0],
-          "react/jsx-indent": [0],
-          "react/jsx-indent-props": [0],
-          "react/jsx-max-props-per-line": [0],
-          "react/jsx-newline": [0],
-          "react/jsx-one-expression-per-line": [0],
-          "react/jsx-props-no-multi-spaces": [0],
-          "react/jsx-space-before-closing": [0],
-          "react/jsx-tag-spacing": [0],
-          "react/jsx-wrap-multilines": [0],
-          "require-yield": [2],
-          "rest-spread-spacing": [0],
-          "semi": [0],
-          "semi-spacing": [0],
-          "semi-style": [0],
-          "space-after-function-name": [0],
-          "space-after-keywords": [0],
-          "space-before-blocks": [0],
-          "space-before-function-paren": [0],
-          "space-before-function-parentheses": [0],
-          "space-before-keywords": [0],
-          "space-in-brackets": [0],
-          "space-in-parens": [0],
-          "space-infix-ops": [0],
-          "space-return-throw-case": [0],
-          "space-unary-ops": [0],
-          "space-unary-word-ops": [0],
-          "standard/array-bracket-even-spacing": [0],
-          "standard/computed-property-even-spacing": [0],
-          "standard/object-curly-even-spacing": [0],
-          "switch-colon-spacing": [0],
-          "template-curly-spacing": [0],
-          "template-tag-spacing": [0],
-          "unicorn/empty-brace-spaces": [0],
-          "unicorn/no-nested-ternary": [0],
-          "unicorn/number-literal-case": [0],
-          "unicorn/template-indent": [0],
-          "use-isnan": [2, { "enforceForIndexOf": false, "enforceForSwitchCase": true }],
-          "valid-typeof": [2, { "requireStringLiterals": false }],
-          "vue/array-bracket-newline": [0],
-          "vue/array-bracket-spacing": [0],
-          "vue/array-element-newline": [0],
-          "vue/arrow-spacing": [0],
-          "vue/block-spacing": [0],
-          "vue/block-tag-newline": [0],
-          "vue/brace-style": [0],
-          "vue/comma-dangle": [0],
-          "vue/comma-spacing": [0],
-          "vue/comma-style": [0],
-          "vue/dot-location": [0],
-          "vue/func-call-spacing": [0],
-          "vue/html-closing-bracket-newline": [0],
-          "vue/html-closing-bracket-spacing": [0],
-          "vue/html-end-tags": [0],
-          "vue/html-indent": [0],
-          "vue/html-quotes": [0],
-          "vue/html-self-closing": [0],
-          "vue/key-spacing": [0],
-          "vue/keyword-spacing": [0],
-          "vue/max-attributes-per-line": [0],
-          "vue/max-len": [0],
-          "vue/multiline-html-element-content-newline": [0],
-          "vue/multiline-ternary": [0],
-          "vue/mustache-interpolation-spacing": [0],
-          "vue/no-extra-parens": [0],
-          "vue/no-multi-spaces": [0],
-          "vue/no-spaces-around-equal-signs-in-attribute": [0],
-          "vue/object-curly-newline": [0],
-          "vue/object-curly-spacing": [0],
-          "vue/object-property-newline": [0],
-          "vue/operator-linebreak": [0],
-          "vue/quote-props": [0],
-          "vue/script-indent": [0],
-          "vue/singleline-html-element-content-newline": [0],
-          "vue/space-in-parens": [0],
-          "vue/space-infix-ops": [0],
-          "vue/space-unary-ops": [0],
-          "vue/template-curly-spacing": [0],
-          "wrap-iife": [0],
-          "wrap-regex": [0],
-          "yield-star-spacing": [0]
-        },
-        "settings": null
-      },
-      "src tests": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [],
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh",
-          "vitest"
-        ],
-        "rules": {
-          "local/button-primitive": [0],
-          "local/glyph-link": [0],
-          "local/input-primitive": [0],
-          "local/literal-a11y-text": [0],
-          "local/surface-role": [0],
-          "no-restricted-globals": [
-            0,
-            {
-              "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "fetch"
-            },
-            {
-              "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "XMLHttpRequest"
-            },
-            {
-              "message": "Use the logged request layer: `WebSocket` belongs to src/lib/messagesSocket.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "WebSocket"
-            },
-            {
-              "message": "No `EventSource` without a logged owner module (E22 S4).",
-              "name": "EventSource"
-            }
-          ],
-          "no-restricted-properties": [
-            0,
-            {
-              "message": "Use lib/http.ts `send` (E22 S4).",
-              "object": "window",
-              "property": "fetch"
-            },
-            {
-              "message": "Use lib/http.ts `send` (E22 S4).",
-              "object": "globalThis",
-              "property": "fetch"
-            },
-            {
-              "message": "Use lib/api/core.ts `beacon` (E22 S4).",
-              "object": "navigator",
-              "property": "sendBeacon"
-            }
-          ],
-          "vitest/no-disabled-tests": [2],
-          "vitest/no-focused-tests": [2, { "fixable": true }]
-        },
-        "settings": null
-      },
-      "src/lib": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [],
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh"
-        ],
-        "rules": {
-          "no-restricted-imports": [
-            2,
-            {
-              "patterns": [
-                {
-                  "message": "lib/ sits below components/: it may not import from components/, not even a type. Move the shared piece down into lib/.",
-                  "regex": "^(\\.\\./)+components(/|$)"
-                }
-              ]
-            }
-          ]
-        },
-        "settings": null
-      },
-      "ts configs": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "82 names, sha1 29467d490e30",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [
-          "local/button-primitive",
-          "local/focus-safe-disabled",
-          "local/glyph-link",
-          "local/input-primitive",
-          "local/jsx-comment-text",
-          "local/literal-a11y-text",
-          "local/locale-format",
-          "local/sortable-a11y",
-          "local/surface-role",
-          "no-console",
-          "no-restricted-globals",
-          "no-restricted-properties",
-          "no-restricted-syntax",
-          "react-hooks/capitalized-calls",
-          "react-hooks/component-hook-factories",
-          "react-hooks/config",
-          "react-hooks/error-boundaries",
-          "react-hooks/exhaustive-deps",
-          "react-hooks/exhaustive-effect-dependencies",
-          "react-hooks/gating",
-          "react-hooks/globals",
-          "react-hooks/hooks",
-          "react-hooks/immutability",
-          "react-hooks/incompatible-library",
-          "react-hooks/invariant",
-          "react-hooks/memo-dependencies",
-          "react-hooks/memoized-effect-dependencies",
-          "react-hooks/no-deriving-state-in-effects",
-          "react-hooks/preserve-manual-memoization",
-          "react-hooks/purity",
-          "react-hooks/refs",
-          "react-hooks/rule-suppression",
-          "react-hooks/rules-of-hooks",
-          "react-hooks/set-state-in-effect",
-          "react-hooks/set-state-in-render",
-          "react-hooks/static-components",
-          "react-hooks/syntax",
-          "react-hooks/todo",
-          "react-hooks/unsupported-syntax",
-          "react-hooks/use-memo",
-          "react-hooks/void-use-memo",
-          "react-refresh/only-export-components"
-        ],
-        "plugins": ["@", "@eslint-community/eslint-comments", "@typescript-eslint"],
-        "rules": {
-          "@typescript-eslint/no-unused-expressions": [
-            2,
-            { "allowShortCircuit": false, "allowTaggedTemplates": false, "allowTernary": false }
-          ]
-        },
-        "settings": null
-      },
-      "ui": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [],
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh"
-        ],
-        "rules": {
-          "no-restricted-imports": [
-            2,
-            {
-              "patterns": [
-                {
-                  "message": "components/ui/ is domain-free: a platform component may not import a feature component. Invert the dependency (take a prop/render-prop) or keep the component outside ui/.",
-                  "regex": "^\\.\\./(?!\\.\\./)"
-                },
-                {
-                  "message": "components/ui/ is domain-free: a platform component may not import a feature component. Invert the dependency (take a prop/render-prop) or keep the component outside ui/.",
-                  "regex": "^\\.\\./\\.\\./components/(?!ui/)"
-                },
-                {
-                  "message": "components/ui/ is domain-free: a platform component may not call a domain API slice. Take the data as props.",
-                  "regex": "^\\.\\./\\.\\./lib/api(/|$)"
-                }
-              ]
-            }
-          ]
-        },
-        "settings": null
-      },
-      "ui tests": {
-        "languageOptions": {
-          "ecmaVersion": 2022,
-          "globals": "1169 names, sha1 aee621727a03",
-          "parser": "typescript-eslint/parser",
-          "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
-          "sourceType": "module"
-        },
-        "linterOptions": { "reportUnusedDisableDirectives": 2 },
-        "notApplied": [],
-        "plugins": [
-          "@",
-          "@eslint-community/eslint-comments",
-          "@typescript-eslint",
-          "local",
-          "react-hooks",
-          "react-refresh",
-          "vitest"
-        ],
-        "rules": {
-          "local/button-primitive": [0],
-          "local/glyph-link": [0],
-          "local/input-primitive": [0],
-          "local/literal-a11y-text": [0],
-          "local/surface-role": [0],
-          "no-restricted-globals": [
-            0,
-            {
-              "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "fetch"
-            },
-            {
-              "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "XMLHttpRequest"
-            },
-            {
-              "message": "Use the logged request layer: `WebSocket` belongs to src/lib/messagesSocket.ts only (E22 S4 — a request outside it never reaches the client log).",
-              "name": "WebSocket"
-            },
-            {
-              "message": "No `EventSource` without a logged owner module (E22 S4).",
-              "name": "EventSource"
-            }
-          ],
-          "no-restricted-imports": [
-            2,
-            {
-              "patterns": [
-                {
-                  "message": "components/ui/ is domain-free: a platform component may not import a feature component. Invert the dependency (take a prop/render-prop) or keep the component outside ui/.",
-                  "regex": "^\\.\\./(?!\\.\\./)"
-                },
-                {
-                  "message": "components/ui/ is domain-free: a platform component may not import a feature component. Invert the dependency (take a prop/render-prop) or keep the component outside ui/.",
-                  "regex": "^\\.\\./\\.\\./components/(?!ui/)"
-                },
-                {
-                  "message": "components/ui/ is domain-free: a platform component may not call a domain API slice. Take the data as props.",
-                  "regex": "^\\.\\./\\.\\./lib/api(/|$)"
-                }
-              ]
-            }
-          ],
-          "no-restricted-properties": [
-            0,
-            {
-              "message": "Use lib/http.ts `send` (E22 S4).",
-              "object": "window",
-              "property": "fetch"
-            },
-            {
-              "message": "Use lib/http.ts `send` (E22 S4).",
-              "object": "globalThis",
-              "property": "fetch"
-            },
-            {
-              "message": "Use lib/api/core.ts `beacon` (E22 S4).",
-              "object": "navigator",
-              "property": "sendBeacon"
-            }
-          ],
-          "vitest/no-disabled-tests": [2],
-          "vitest/no-focused-tests": [2, { "fixable": true }]
-        },
-        "settings": null
-      }
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [],
+      "plugins": [
+        "@",
+        "@eslint-community/eslint-comments",
+        "@typescript-eslint",
+        "local",
+        "react-hooks",
+        "react-refresh"
+      ],
+      "rules": { "local/literal-a11y-text": [0] },
+      "settings": null
     },
-    "files": {
-      "(not linted)": [],
-      "FocusSafeButton.tsx + AnchoredPopover.tsx": [
-        "src/components/ui/AnchoredPopover.tsx",
-        "src/components/ui/FocusSafeButton.tsx"
+    "e2e": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "82 names, sha1 29467d490e30",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [
+        "local/button-primitive",
+        "local/glyph-link",
+        "local/input-primitive",
+        "local/jsx-comment-text",
+        "local/literal-a11y-text",
+        "local/locale-format",
+        "local/sortable-a11y",
+        "local/surface-role",
+        "no-console",
+        "no-restricted-globals",
+        "no-restricted-properties",
+        "no-restricted-syntax",
+        "react-hooks/capitalized-calls",
+        "react-hooks/component-hook-factories",
+        "react-hooks/config",
+        "react-hooks/error-boundaries",
+        "react-hooks/exhaustive-deps",
+        "react-hooks/gating",
+        "react-hooks/globals",
+        "react-hooks/hooks",
+        "react-hooks/immutability",
+        "react-hooks/incompatible-library",
+        "react-hooks/invariant",
+        "react-hooks/memo-dependencies",
+        "react-hooks/no-deriving-state-in-effects",
+        "react-hooks/preserve-manual-memoization",
+        "react-hooks/purity",
+        "react-hooks/refs",
+        "react-hooks/rules-of-hooks",
+        "react-hooks/set-state-in-effect",
+        "react-hooks/set-state-in-render",
+        "react-hooks/static-components",
+        "react-hooks/syntax",
+        "react-hooks/todo",
+        "react-hooks/unsupported-syntax",
+        "react-hooks/use-memo",
+        "react-hooks/void-use-memo",
+        "react-refresh/only-export-components"
       ],
-      "design-lab": [
-        "src/design-lab/DesignLab.tsx",
-        "src/design-lab/batchA.tsx",
-        "src/design-lab/batchB.tsx",
-        "src/design-lab/batchC.tsx",
-        "src/design-lab/batchCActions.tsx",
-        "src/design-lab/batchD.tsx",
-        "src/design-lab/labKit.tsx",
-        "src/design-lab/labTokens.ts"
+      "plugins": ["@", "@eslint-community/eslint-comments", "@typescript-eslint", "playwright"],
+      "rules": {
+        "@typescript-eslint/no-unused-expressions": [
+          2,
+          { "allowShortCircuit": false, "allowTaggedTemplates": false, "allowTernary": false }
+        ],
+        "playwright/no-focused-test": [2],
+        "playwright/no-skipped-test": [2]
+      },
+      "settings": null
+    },
+    "js configs": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "82 names, sha1 29467d490e30",
+        "parser": "(unnamed parser)",
+        "parserOptions": { "sourceType": "module" },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [
+        "@typescript-eslint/ban-ts-comment",
+        "@typescript-eslint/no-array-constructor",
+        "@typescript-eslint/no-deprecated",
+        "@typescript-eslint/no-duplicate-enum-values",
+        "@typescript-eslint/no-empty-object-type",
+        "@typescript-eslint/no-explicit-any",
+        "@typescript-eslint/no-extra-non-null-assertion",
+        "@typescript-eslint/no-floating-promises",
+        "@typescript-eslint/no-misused-new",
+        "@typescript-eslint/no-namespace",
+        "@typescript-eslint/no-non-null-asserted-optional-chain",
+        "@typescript-eslint/no-require-imports",
+        "@typescript-eslint/no-this-alias",
+        "@typescript-eslint/no-unnecessary-type-constraint",
+        "@typescript-eslint/no-unsafe-declaration-merging",
+        "@typescript-eslint/no-unsafe-function-type",
+        "@typescript-eslint/no-unused-expressions",
+        "@typescript-eslint/no-unused-vars",
+        "@typescript-eslint/no-wrapper-object-types",
+        "@typescript-eslint/prefer-as-const",
+        "@typescript-eslint/prefer-namespace-keyword",
+        "@typescript-eslint/triple-slash-reference",
+        "local/button-primitive",
+        "local/glyph-link",
+        "local/input-primitive",
+        "local/jsx-comment-text",
+        "local/literal-a11y-text",
+        "local/locale-format",
+        "local/sortable-a11y",
+        "local/surface-role",
+        "no-array-constructor",
+        "no-console",
+        "no-new-symbol",
+        "no-restricted-globals",
+        "no-restricted-properties",
+        "no-restricted-syntax",
+        "no-unused-expressions",
+        "no-var",
+        "prefer-const",
+        "prefer-rest-params",
+        "prefer-spread",
+        "react-hooks/capitalized-calls",
+        "react-hooks/component-hook-factories",
+        "react-hooks/config",
+        "react-hooks/error-boundaries",
+        "react-hooks/exhaustive-deps",
+        "react-hooks/gating",
+        "react-hooks/globals",
+        "react-hooks/hooks",
+        "react-hooks/immutability",
+        "react-hooks/incompatible-library",
+        "react-hooks/invariant",
+        "react-hooks/memo-dependencies",
+        "react-hooks/no-deriving-state-in-effects",
+        "react-hooks/preserve-manual-memoization",
+        "react-hooks/purity",
+        "react-hooks/refs",
+        "react-hooks/rules-of-hooks",
+        "react-hooks/set-state-in-effect",
+        "react-hooks/set-state-in-render",
+        "react-hooks/static-components",
+        "react-hooks/syntax",
+        "react-hooks/todo",
+        "react-hooks/unsupported-syntax",
+        "react-hooks/use-memo",
+        "react-hooks/void-use-memo",
+        "react-refresh/only-export-components"
       ],
-      "e2e": [
-        "e2e/channel.spec.ts",
-        "e2e/feed.spec.ts",
-        "e2e/global.setup.ts",
-        "e2e/helpers.ts",
-        "e2e/nav.spec.ts",
-        "e2e/player.spec.ts",
-        "e2e/settings.spec.ts"
+      "plugins": ["@", "@eslint-community/eslint-comments"],
+      "rules": {
+        "constructor-super": [2],
+        "getter-return": [2, { "allowImplicit": false }],
+        "no-class-assign": [2],
+        "no-const-assign": [2],
+        "no-dupe-args": [2],
+        "no-dupe-class-members": [2],
+        "no-dupe-keys": [2],
+        "no-func-assign": [2],
+        "no-import-assign": [2],
+        "no-new-native-nonconstructor": [2],
+        "no-obj-calls": [2],
+        "no-redeclare": [2, { "builtinGlobals": true }],
+        "no-setter-return": [2],
+        "no-this-before-super": [2],
+        "no-undef": [2, { "typeof": false }],
+        "no-unreachable": [2],
+        "no-unsafe-negation": [2, { "enforceForOrderingRelations": false }],
+        "no-unused-vars": [2],
+        "no-with": [2]
+      },
+      "settings": null
+    },
+    "lib tests": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "1169 names, sha1 aee621727a03",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [],
+      "plugins": [
+        "@",
+        "@eslint-community/eslint-comments",
+        "@typescript-eslint",
+        "local",
+        "react-hooks",
+        "react-refresh",
+        "vitest"
       ],
-      "js configs": ["eslint.config.js", "postcss.config.js"],
-      "lib tests": [
-        "src/lib/accountPinnedStores.dom.test.ts",
-        "src/lib/actionErrors.test.ts",
-        "src/lib/activeAccount.dom.test.ts",
-        "src/lib/adminUsers.test.ts",
-        "src/lib/api/adminLogs.dom.test.ts",
-        "src/lib/api/core.test.ts",
-        "src/lib/api/diagnostics.dom.test.ts",
-        "src/lib/api/discover.dom.test.ts",
-        "src/lib/api/downloads.contract.test.ts",
-        "src/lib/api/facade.test.ts",
-        "src/lib/api/feed.test.ts",
-        "src/lib/api/plex.dom.test.ts",
-        "src/lib/api/plexFilters.dom.test.ts",
-        "src/lib/api/plexLang.dom.test.ts",
-        "src/lib/api/tagModes.test.ts",
-        "src/lib/auditGroups.test.ts",
-        "src/lib/browserBackgroundPlay.dom.test.ts",
-        "src/lib/buttonPrimitive.contract.test.ts",
-        "src/lib/captureTab.dom.test.ts",
-        "src/lib/channelDetailPoll.backfill.dom.test.tsx",
-        "src/lib/channelDetailPoll.test.ts",
-        "src/lib/channelOrder.dom.test.ts",
-        "src/lib/channelWriteFailures.dom.test.tsx",
-        "src/lib/channelsUrlState.dom.test.ts",
-        "src/lib/chatDock.dom.test.ts",
-        "src/lib/chipLane.contract.test.ts",
-        "src/lib/chipOverflow.test.ts",
-        "src/lib/columnSort.test.ts",
-        "src/lib/controlRules.contract.test.ts",
-        "src/lib/cropGeometry.test.ts",
-        "src/lib/dateFilter.test.ts",
-        "src/lib/detailLog.dom.test.ts",
-        "src/lib/diagnostics.dom.test.ts",
-        "src/lib/diagnostics.session.dom.test.ts",
-        "src/lib/downloadActions.test.ts",
-        "src/lib/downloadFailure.test.ts",
-        "src/lib/downloads.test.ts",
-        "src/lib/e2ee.test.ts",
-        "src/lib/fadeEdge.contract.test.ts",
-        "src/lib/feedSort.yt.test.ts",
-        "src/lib/focusSafe.contract.test.ts",
-        "src/lib/format.test.ts",
-        "src/lib/gates.contract.test.ts",
-        "src/lib/globalKeymap.dom.test.tsx",
-        "src/lib/headings.contract.test.ts",
-        "src/lib/history.dom.test.ts",
-        "src/lib/history.nav.dom.test.ts",
-        "src/lib/history.navPosition.dom.test.tsx",
-        "src/lib/history.navRestore.reload.dom.test.tsx",
-        "src/lib/history.subview.dom.test.ts",
-        "src/lib/hoverAndLink.contract.test.ts",
-        "src/lib/http.test.ts",
-        "src/lib/inputPrimitive.contract.test.ts",
-        "src/lib/issueDraft.test.ts",
-        "src/lib/jobResult.dom.test.ts",
-        "src/lib/jsxCommentText.contract.test.ts",
-        "src/lib/keymap.sequence.test.ts",
-        "src/lib/keymap.test.ts",
-        "src/lib/layerStack.dom.test.ts",
-        "src/lib/layerStack.integration.dom.test.tsx",
-        "src/lib/lazyWithPreload.dom.test.tsx",
-        "src/lib/linkify.test.ts",
-        "src/lib/listNav.dom.test.tsx",
-        "src/lib/listNav.scope.dom.test.tsx",
-        "src/lib/listPaging.test.ts",
-        "src/lib/literalA11yText.contract.test.ts",
-        "src/lib/localeFormat.contract.test.ts",
-        "src/lib/log.contract.test.ts",
-        "src/lib/log.test.ts",
-        "src/lib/logHooks.dom.test.ts",
-        "src/lib/logsUrlState.test.ts",
-        "src/lib/messagesSocket.test.ts",
-        "src/lib/moveInList.test.ts",
-        "src/lib/mutationFailures.contract.test.ts",
-        "src/lib/navPosition.wiring.contract.test.ts",
-        "src/lib/navRing.contract.test.ts",
-        "src/lib/networkBoundary.contract.test.ts",
-        "src/lib/nextPage.contract.test.ts",
-        "src/lib/nextPage.dom.test.ts",
-        "src/lib/nextPage.wiring.contract.test.ts",
-        "src/lib/nodeEngine.contract.test.ts",
-        "src/lib/notifications.actionTtl.dom.test.ts",
-        "src/lib/pageKeys.dom.test.tsx",
-        "src/lib/pageMeta.test.ts",
-        "src/lib/panelLayout.dom.test.ts",
-        "src/lib/parseId.test.ts",
-        "src/lib/playerModalHooks.apiload.dom.test.tsx",
-        "src/lib/playerModalHooks.progress.dom.test.tsx",
-        "src/lib/playerQueue.test.ts",
-        "src/lib/playerStage.contract.test.ts",
-        "src/lib/playerVolume.test.ts",
-        "src/lib/playlistView.test.ts",
-        "src/lib/plexBackdrop.dom.test.tsx",
-        "src/lib/plexFinishMargin.contract.test.ts",
-        "src/lib/plexImage.contract.test.ts",
-        "src/lib/plexImage.test.ts",
-        "src/lib/plexPlayerHooks.controls.dom.test.tsx",
-        "src/lib/plexPlayerHooks.subtitle.dom.test.tsx",
-        "src/lib/plexQueue.test.ts",
-        "src/lib/plexRating.test.ts",
-        "src/lib/plexStats.test.ts",
-        "src/lib/plexUrlState.dom.test.ts",
-        "src/lib/pxBox.contract.test.ts",
-        "src/lib/pythonEngine.contract.test.ts",
-        "src/lib/queryClient.dom.test.ts",
-        "src/lib/queryKeys.test.ts",
-        "src/lib/reactEngine.contract.test.ts",
-        "src/lib/reinsert.test.ts",
-        "src/lib/releaseNotes.test.ts",
-        "src/lib/repoScripts.contract.test.ts",
-        "src/lib/rovingHighlight.contract.test.ts",
-        "src/lib/saveLanguage.dom.test.ts",
-        "src/lib/savedViews.test.ts",
-        "src/lib/sortableA11y.contract.test.ts",
-        "src/lib/sourceSize.contract.test.ts",
-        "src/lib/staleBuild.dom.test.ts",
-        "src/lib/store.dom.test.tsx",
-        "src/lib/subscriptionCache.test.ts",
-        "src/lib/surfaceRole.contract.test.ts",
-        "src/lib/tabState.dom.test.ts",
-        "src/lib/theme.contract.test.ts",
-        "src/lib/theme.test.ts",
-        "src/lib/touchTarget.contract.test.ts",
-        "src/lib/uiBoundary.contract.test.ts",
-        "src/lib/urlState.dom.test.ts",
-        "src/lib/useCardPager.dom.test.tsx",
-        "src/lib/useChipOverflowFit.dom.test.tsx",
-        "src/lib/useDebounced.dom.test.ts",
-        "src/lib/useDismiss.dom.test.tsx",
-        "src/lib/useFilterState.dom.test.ts",
-        "src/lib/useFocusKeeper.dom.test.tsx",
-        "src/lib/useFocusKeeper.restore.dom.test.tsx",
-        "src/lib/useHoverFocusWithin.dom.test.tsx",
-        "src/lib/usePlexCollectionTitles.dom.test.tsx",
-        "src/lib/usePref.dom.test.ts",
-        "src/lib/usePref.saveFailure.dom.test.ts",
-        "src/lib/useSortState.dom.test.ts",
-        "src/lib/useTags.dom.test.tsx",
-        "src/lib/useUndoable.dom.test.ts",
-        "src/lib/useUrlMirror.dom.test.ts",
-        "src/lib/verifyEntry.dom.test.tsx",
-        "src/lib/viewportUnits.contract.test.ts",
-        "src/lib/vocab.dom.test.ts",
-        "src/lib/zLayer.contract.test.ts"
+      "rules": {
+        "local/glyph-link": [0],
+        "local/input-primitive": [0],
+        "local/literal-a11y-text": [0],
+        "local/surface-role": [0],
+        "no-restricted-globals": [
+          0,
+          {
+            "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only — a request outside it never reaches the client log.",
+            "name": "fetch"
+          },
+          {
+            "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only — a request outside it never reaches the client log.",
+            "name": "XMLHttpRequest"
+          },
+          { "message": "No `WebSocket` without a logged owner module.", "name": "WebSocket" },
+          { "message": "No `EventSource` without a logged owner module.", "name": "EventSource" }
+        ],
+        "no-restricted-imports": [
+          2,
+          {
+            "patterns": [
+              {
+                "message": "lib/ sits below components/: it may not import from components/, not even a type. Move the shared piece down into lib/.",
+                "regex": "^(\\.\\./)+components(/|$)"
+              }
+            ]
+          }
+        ],
+        "no-restricted-properties": [
+          0,
+          { "message": "Use lib/http.ts `send`.", "object": "window", "property": "fetch" },
+          { "message": "Use lib/http.ts `send`.", "object": "globalThis", "property": "fetch" },
+          {
+            "message": "Use lib/api/core.ts `beacon`.",
+            "object": "navigator",
+            "property": "sendBeacon"
+          }
+        ],
+        "vitest/no-disabled-tests": [2],
+        "vitest/no-focused-tests": [2, { "fixable": true }]
+      },
+      "settings": null
+    },
+    "lib/api/core.ts": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "1169 names, sha1 aee621727a03",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [],
+      "plugins": [
+        "@",
+        "@eslint-community/eslint-comments",
+        "@typescript-eslint",
+        "local",
+        "react-hooks",
+        "react-refresh"
       ],
-      "lib/api/core.ts": ["src/lib/api/core.ts"],
-      "lib/http.ts": ["src/lib/http.ts"],
-      "lib/messagesSocket.ts": ["src/lib/messagesSocket.ts"],
-      "src": [
-        "src/App.tsx",
-        "src/components/About.tsx",
-        "src/components/AboutCell.tsx",
-        "src/components/AccountPanel.tsx",
-        "src/components/ActiveFilterChips.tsx",
-        "src/components/AddToPlaylist.tsx",
-        "src/components/AdminLogs.tsx",
-        "src/components/AdminUsers.tsx",
-        "src/components/AppCommandPalette.tsx",
-        "src/components/AuditEarlierRuns.tsx",
-        "src/components/AuditLog.tsx",
-        "src/components/BootGate.tsx",
-        "src/components/ChannelAbout.tsx",
-        "src/components/ChannelDiscovery.tsx",
-        "src/components/ChannelLayoutGrid.tsx",
-        "src/components/ChannelLink.tsx",
-        "src/components/ChannelNameLink.tsx",
-        "src/components/ChannelPage.tsx",
-        "src/components/ChannelPicker.tsx",
-        "src/components/ChannelStatsPopover.tsx",
-        "src/components/ChannelTags.tsx",
-        "src/components/Channels.tsx",
-        "src/components/ChannelsProvider.tsx",
-        "src/components/ChatDock.tsx",
-        "src/components/ChatThread.tsx",
-        "src/components/ConfigPanel.tsx",
-        "src/components/ConfirmProvider.tsx",
-        "src/components/DateFilterSelect.tsx",
-        "src/components/DebugRecorder.tsx",
-        "src/components/DemoBanner.tsx",
-        "src/components/DiagnosticsSettings.tsx",
-        "src/components/DownloadButton.tsx",
-        "src/components/DownloadCenter.tsx",
-        "src/components/DownloadDialog.tsx",
-        "src/components/ErrorBoundary.tsx",
-        "src/components/ErrorDialog.tsx",
-        "src/components/ExcludedChannelList.tsx",
-        "src/components/Feed.tsx",
-        "src/components/FeedFiltersProvider.tsx",
-        "src/components/FeedScopeToggle.tsx",
-        "src/components/FeedViewProvider.tsx",
-        "src/components/FilterRail.tsx",
-        "src/components/Header.tsx",
-        "src/components/Home.tsx",
-        "src/components/IssueComposer.tsx",
-        "src/components/KeyGate.tsx",
-        "src/components/LanguageSwitcher.tsx",
-        "src/components/LibraryPlayer.tsx",
-        "src/components/LogLine.tsx",
-        "src/components/MediaResumeButtons.tsx",
-        "src/components/Messages.tsx",
-        "src/components/MyLogViewer.tsx",
-        "src/components/NavSidebar.tsx",
-        "src/components/NavigationProvider.tsx",
-        "src/components/NotificationsPanel.tsx",
-        "src/components/OnboardingWizard.tsx",
-        "src/components/PaletteLauncher.tsx",
-        "src/components/PersonalViewsModal.tsx",
-        "src/components/PlayerModal.tsx",
-        "src/components/PlaylistLimitsHint.tsx",
-        "src/components/Playlists.tsx",
-        "src/components/PlaylistsProvider.tsx",
-        "src/components/PlaylistsRail.tsx",
-        "src/components/PlexBrowse.tsx",
-        "src/components/PlexCollectionEditor.tsx",
-        "src/components/PlexCollectionView.tsx",
-        "src/components/PlexDiscover.tsx",
-        "src/components/PlexInfo.tsx",
-        "src/components/PlexLibraryPicker.tsx",
-        "src/components/PlexMenu.tsx",
-        "src/components/PlexPlayer.tsx",
-        "src/components/PlexPlayerSettings.tsx",
-        "src/components/PlexPlaylistAdd.tsx",
-        "src/components/PlexPlaylistView.tsx",
-        "src/components/PlexProvider.tsx",
-        "src/components/PlexScopeToggle.tsx",
-        "src/components/PlexSearchBox.tsx",
-        "src/components/PlexSidebar.tsx",
-        "src/components/PlexStatsOverlay.tsx",
-        "src/components/PlexViewBridge.tsx",
-        "src/components/PlexViewToggle.tsx",
-        "src/components/PosterTile.tsx",
-        "src/components/PrefsProvider.tsx",
-        "src/components/ProfileEditor.tsx",
-        "src/components/ReleaseNotes.tsx",
-        "src/components/SavedViewsPopover.tsx",
-        "src/components/SavedViewsProvider.tsx",
-        "src/components/Scheduler.tsx",
-        "src/components/SearchBar.tsx",
-        "src/components/SelectedViewChip.tsx",
-        "src/components/SettingsPanel.tsx",
-        "src/components/SetupWizard.tsx",
-        "src/components/ShareDialog.tsx",
-        "src/components/Sidebar.tsx",
-        "src/components/Stats.tsx",
-        "src/components/SyncStatus.tsx",
-        "src/components/TagFilterChips.tsx",
-        "src/components/TagManager.tsx",
-        "src/components/UpNextCard.tsx",
-        "src/components/UploadDialog.tsx",
-        "src/components/UserPicker.tsx",
-        "src/components/VerifyBanner.tsx",
-        "src/components/VersionBanner.tsx",
-        "src/components/VideoCard.tsx",
-        "src/components/VideoEditor.tsx",
-        "src/components/VideoFollowUp.tsx",
-        "src/components/VideoInfoCard.tsx",
-        "src/components/VideoMenu.tsx",
-        "src/components/ViewSwitcher.tsx",
-        "src/components/VirtualFeed.tsx",
-        "src/components/WatchPage.tsx",
-        "src/components/Welcome.tsx",
-        "src/components/WizardProvider.tsx",
-        "src/components/YearFilter.tsx",
-        "src/components/auditColumns.tsx",
-        "src/components/channelCells.tsx",
-        "src/components/channelColumns.tsx",
-        "src/components/channelSync.ts",
-        "src/components/channelsContext.ts",
-        "src/components/comfortPin.tsx",
-        "src/components/compilerSkips.testkit.ts",
-        "src/components/confirmContext.ts",
-        "src/components/copyItems.tsx",
-        "src/components/descriptionLinks.tsx",
-        "src/components/downloadAdmin.tsx",
-        "src/components/downloadModals.tsx",
-        "src/components/downloadRow.tsx",
-        "src/components/downloadTitle.ts",
-        "src/components/facetOption.ts",
-        "src/components/feedFiltersContext.ts",
-        "src/components/feedFiltersInit.ts",
-        "src/components/feedViewContext.ts",
-        "src/components/legal/LegalLayout.tsx",
-        "src/components/legal/PrivacyPolicy.tsx",
-        "src/components/legal/Terms.tsx",
-        "src/components/legal/useHungarian.ts",
-        "src/components/logLineParts.ts",
-        "src/components/modulePages.tsx",
-        "src/components/moduleRegistry.tsx",
-        "src/components/navigationContext.ts",
-        "src/components/navigationInit.ts",
-        "src/components/playerModalControls.tsx",
-        "src/components/playlistColumns.tsx",
-        "src/components/playlistsContext.ts",
-        "src/components/playlistsInit.ts",
-        "src/components/plexBrowseLists.tsx",
-        "src/components/plexCards.tsx",
-        "src/components/plexContext.ts",
-        "src/components/plexDetailAside.tsx",
-        "src/components/plexDetailUi.tsx",
-        "src/components/plexPlayable.ts",
-        "src/components/plexPlayerControls.tsx",
-        "src/components/plexSubUrl.ts",
-        "src/components/plexViewContext.ts",
-        "src/components/plexViews.tsx",
-        "src/components/prefsContext.ts",
-        "src/components/savedViewsContext.ts",
-        "src/components/useChannelActions.tsx",
-        "src/components/useDebugRecording.ts",
-        "src/components/useDownloadActions.tsx",
-        "src/components/usePlaylistActions.tsx",
-        "src/components/usePlexActiveFilters.ts",
-        "src/components/usePlexCardActions.tsx",
-        "src/components/usePlexPlaylistEdits.ts",
-        "src/components/useTagSuggestions.ts",
-        "src/components/useVideoActions.tsx",
-        "src/components/welcomeMode.ts",
-        "src/components/wizardContext.ts",
-        "src/i18n/appCopy.ts",
-        "src/i18n/index.ts",
-        "src/main.tsx",
-        "src/vite-env.d.ts"
+      "rules": {
+        "no-restricted-globals": [
+          2,
+          {
+            "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only — a request outside it never reaches the client log.",
+            "name": "fetch"
+          },
+          { "message": "No `WebSocket` without a logged owner module.", "name": "WebSocket" },
+          { "message": "No `EventSource` without a logged owner module.", "name": "EventSource" }
+        ],
+        "no-restricted-imports": [
+          2,
+          {
+            "patterns": [
+              {
+                "message": "lib/ sits below components/: it may not import from components/, not even a type. Move the shared piece down into lib/.",
+                "regex": "^(\\.\\./)+components(/|$)"
+              }
+            ]
+          }
+        ]
+      },
+      "settings": null
+    },
+    "lib/http.ts": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "1169 names, sha1 aee621727a03",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [],
+      "plugins": [
+        "@",
+        "@eslint-community/eslint-comments",
+        "@typescript-eslint",
+        "local",
+        "react-hooks",
+        "react-refresh"
       ],
-      "src tests": [
-        "src/components/AdminLogs.dom.test.tsx",
-        "src/components/AdminUsers.dom.test.tsx",
-        "src/components/AppCommandPalette.dom.test.tsx",
-        "src/components/BootGate.dom.test.tsx",
-        "src/components/ChannelLayoutGrid.dom.test.tsx",
-        "src/components/ChannelNameLink.dom.test.tsx",
-        "src/components/ChannelPage.backfill.dom.test.tsx",
-        "src/components/ChannelPage.banner.dom.test.tsx",
-        "src/components/ChannelPage.busyFocus.dom.test.tsx",
-        "src/components/ChannelPage.fold.dom.test.tsx",
-        "src/components/ChannelPage.watchState.dom.test.tsx",
-        "src/components/ChannelStatsPopover.dom.test.tsx",
-        "src/components/ChannelTags.suggest.dom.test.tsx",
-        "src/components/ChannelsProvider.dom.test.tsx",
-        "src/components/ConfigPanel.choice.dom.test.tsx",
-        "src/components/ConfigPanel.field.dom.test.tsx",
-        "src/components/ConfigPanel.sections.dom.test.tsx",
-        "src/components/DateFilterSelect.dom.test.tsx",
-        "src/components/DebugRecorder.dom.test.tsx",
-        "src/components/DiagnosticsSettings.dom.test.tsx",
-        "src/components/DownloadCenter.confirm.dom.test.tsx",
-        "src/components/DownloadCenter.menu.dom.test.tsx",
-        "src/components/ErrorBoundary.message.dom.test.tsx",
-        "src/components/ErrorBoundary.staleBuild.dom.test.tsx",
-        "src/components/ExcludedChannelList.dom.test.tsx",
-        "src/components/Feed.countStale.dom.test.tsx",
-        "src/components/Feed.nextPageFailed.dom.test.tsx",
-        "src/components/Feed.reset.dom.test.tsx",
-        "src/components/Feed.ytsort.dom.test.tsx",
-        "src/components/FeedFiltersProvider.dom.test.ts",
-        "src/components/FeedFiltersProvider.seed.dom.test.tsx",
-        "src/components/Header.searchTip.dom.test.tsx",
-        "src/components/Home.dom.test.tsx",
-        "src/components/Home.pin.dom.test.tsx",
-        "src/components/IssueComposer.dom.test.tsx",
-        "src/components/LibraryPlayer.dom.test.tsx",
-        "src/components/Messages.keyboard.dom.test.tsx",
-        "src/components/MyLogViewer.dom.test.tsx",
-        "src/components/NavigationProvider.dom.test.tsx",
-        "src/components/NotificationsPanel.menu.dom.test.tsx",
-        "src/components/OnboardingWizard.dialog.dom.test.tsx",
-        "src/components/OnboardingWizard.escape.dom.test.tsx",
-        "src/components/PaletteLauncher.dom.test.tsx",
-        "src/components/PersonalViewsModal.dom.test.tsx",
-        "src/components/PlayerModal.dom.test.tsx",
-        "src/components/PlaylistEditFailures.dom.test.tsx",
-        "src/components/PlaylistLimitsHint.dom.test.tsx",
-        "src/components/Playlists.dom.test.tsx",
-        "src/components/PlaylistsRail.rename.dom.test.tsx",
-        "src/components/PlexCollectionView.dom.test.tsx",
-        "src/components/PlexDiscover.dom.test.tsx",
-        "src/components/PlexInfo.dom.test.tsx",
-        "src/components/PlexLibraryPicker.dom.test.tsx",
-        "src/components/PlexMenu.dom.test.tsx",
-        "src/components/PlexPersonView.dom.test.tsx",
-        "src/components/PlexPlayer.backspace.dom.test.tsx",
-        "src/components/PlexPlayer.controls.dom.test.tsx",
-        "src/components/PlexPlayer.hls.dom.test.tsx",
-        "src/components/PlexPlayer.session.dom.test.tsx",
-        "src/components/PlexPlayer.strictmode.dom.test.tsx",
-        "src/components/PlexPlayer.tabtrap.dom.test.tsx",
-        "src/components/PlexPlayerSettings.dom.test.tsx",
-        "src/components/PlexPlaylistReorder.dom.test.tsx",
-        "src/components/PlexPlaylistView.header.dom.test.tsx",
-        "src/components/PlexPlaylistView.menu.dom.test.tsx",
-        "src/components/PlexProvider.dom.test.tsx",
-        "src/components/PlexScopeToggle.dom.test.tsx",
-        "src/components/PlexSearchBox.dom.test.tsx",
-        "src/components/PlexSidebar.picker.dom.test.tsx",
-        "src/components/PlexViewToggle.dom.test.tsx",
-        "src/components/PrefsProvider.dom.test.tsx",
-        "src/components/SavedViewsPopover.dom.test.tsx",
-        "src/components/SavedViewsProvider.dom.test.tsx",
-        "src/components/Scheduler.dom.test.tsx",
-        "src/components/Scheduler.menu.dom.test.tsx",
-        "src/components/SearchBar.dom.test.tsx",
-        "src/components/SearchBar.keys.dom.test.tsx",
-        "src/components/SettingsPanel.account.dom.test.tsx",
-        "src/components/SettingsPanel.downloadAuth.dom.test.tsx",
-        "src/components/ShareDialog.dom.test.tsx",
-        "src/components/TagFilterChips.dom.test.tsx",
-        "src/components/UpNextCard.dom.test.tsx",
-        "src/components/UploadDialog.dom.test.tsx",
-        "src/components/VideoCard.actions.dom.test.tsx",
-        "src/components/VideoCard.channel.dom.test.tsx",
-        "src/components/VideoCard.nav.dom.test.tsx",
-        "src/components/VideoEditor.partial.dom.test.tsx",
-        "src/components/VideoInfoCard.dom.test.tsx",
-        "src/components/VideoMenu.dom.test.tsx",
-        "src/components/WatchPage.dom.test.tsx",
-        "src/components/WriteFailureReporting.dom.test.tsx",
-        "src/components/accountPanel.dom.test.tsx",
-        "src/components/adminInvites.dom.test.tsx",
-        "src/components/adminPendingAccess.dom.test.tsx",
-        "src/components/auditColumns.dom.test.tsx",
-        "src/components/authCardStates.dom.test.tsx",
-        "src/components/channelChipNames.dom.test.tsx",
-        "src/components/channelColumns.dom.test.tsx",
-        "src/components/channelsTagRow.contract.test.ts",
-        "src/components/clientLogWiring.dom.test.tsx",
-        "src/components/comfortPin.dom.test.ts",
-        "src/components/comfortPin.langSwitch.dom.test.tsx",
-        "src/components/compilerCoverage.contract.test.ts",
-        "src/components/descriptionLinks.dom.test.tsx",
-        "src/components/downloadAdmin.dom.test.tsx",
-        "src/components/downloadRow.dom.test.tsx",
-        "src/components/facetOption.test.ts",
-        "src/components/formAlerts.dom.test.tsx",
-        "src/components/legal/legalBodies.contract.dom.test.tsx",
-        "src/components/listNav.wiring.contract.test.ts",
-        "src/components/mediaPicture.contract.test.ts",
-        "src/components/navigation.dom.test.ts",
-        "src/components/playlistsInit.test.ts",
-        "src/components/plexCards.dom.test.tsx",
-        "src/components/plexCards.lang.dom.test.tsx",
-        "src/components/plexCards.langSwitch.dom.test.tsx",
-        "src/components/plexShow.aside.dom.test.tsx",
-        "src/components/plexSubUrl.test.ts",
-        "src/components/plexViews.restart.dom.test.tsx",
-        "src/components/tagChipNames.dom.test.tsx",
-        "src/components/useChannelActions.dom.test.tsx",
-        "src/components/usePlaylistActions.dom.test.tsx",
-        "src/components/usePlexActiveFilters.dom.test.tsx",
-        "src/components/usePlexPlaylistEdits.dom.test.tsx",
-        "src/components/useTagSuggestions.dom.test.tsx",
-        "src/components/useVideoActions.dom.test.tsx",
-        "src/components/welcomeMode.dom.test.ts",
-        "src/components/welcomeMode.render.dom.test.tsx",
-        "src/i18n/appCopy.dom.test.ts",
-        "src/i18n/backendIds.contract.test.ts",
-        "src/i18n/copyRule.test.ts",
-        "src/i18n/parity.test.ts",
-        "src/i18n/plurals.test.ts",
-        "src/i18n/unusedKeys.contract.test.ts",
-        "src/jsxWhitespace.dom.test.tsx"
+      "rules": {
+        "no-restricted-globals": [
+          2,
+          {
+            "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only — a request outside it never reaches the client log.",
+            "name": "XMLHttpRequest"
+          },
+          { "message": "No `WebSocket` without a logged owner module.", "name": "WebSocket" },
+          { "message": "No `EventSource` without a logged owner module.", "name": "EventSource" }
+        ],
+        "no-restricted-imports": [
+          2,
+          {
+            "patterns": [
+              {
+                "message": "lib/ sits below components/: it may not import from components/, not even a type. Move the shared piece down into lib/.",
+                "regex": "^(\\.\\./)+components(/|$)"
+              }
+            ]
+          }
+        ]
+      },
+      "settings": null
+    },
+    "src": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "1169 names, sha1 aee621727a03",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "plugins": [
+        "@",
+        "@eslint-community/eslint-comments",
+        "@typescript-eslint",
+        "local",
+        "react-hooks",
+        "react-refresh"
       ],
-      "src/lib": [
-        "src/lib/actionErrors.ts",
-        "src/lib/activeAccount.ts",
-        "src/lib/adminUsers.ts",
-        "src/lib/adminUsersTab.ts",
-        "src/lib/api.ts",
-        "src/lib/api/account.ts",
-        "src/lib/api/admin.ts",
-        "src/lib/api/auth.ts",
-        "src/lib/api/channels.ts",
-        "src/lib/api/diagnostics.ts",
-        "src/lib/api/discover.ts",
-        "src/lib/api/downloads.ts",
-        "src/lib/api/feed.ts",
-        "src/lib/api/messaging.ts",
-        "src/lib/api/notifications.ts",
-        "src/lib/api/playlists.ts",
-        "src/lib/api/plex.ts",
-        "src/lib/api/quota.ts",
-        "src/lib/api/savedViews.ts",
-        "src/lib/api/setup.ts",
-        "src/lib/api/sync.ts",
-        "src/lib/api/tagModes.ts",
-        "src/lib/api/tags.ts",
-        "src/lib/auditGroups.ts",
-        "src/lib/backgroundTarget.ts",
-        "src/lib/brandIcons.ts",
-        "src/lib/browserBackgroundPlay.ts",
-        "src/lib/captureTab.ts",
-        "src/lib/channelDetailPoll.ts",
-        "src/lib/channelLayout.ts",
-        "src/lib/channelOrder.ts",
-        "src/lib/channelsUrlState.ts",
-        "src/lib/chatDock.ts",
-        "src/lib/chipOverflow.ts",
-        "src/lib/clipboard.ts",
-        "src/lib/collate.ts",
-        "src/lib/colorMath.ts",
-        "src/lib/columnSort.ts",
-        "src/lib/cropGeometry.ts",
-        "src/lib/dateFilter.ts",
-        "src/lib/debugRecorder.ts",
-        "src/lib/diagnostics.ts",
-        "src/lib/documentTitle.ts",
-        "src/lib/downloadActions.ts",
-        "src/lib/downloadFailure.ts",
-        "src/lib/downloads.ts",
-        "src/lib/e2ee.ts",
-        "src/lib/entryUrl.ts",
-        "src/lib/errorDialog.ts",
-        "src/lib/feedSort.ts",
-        "src/lib/feedView.ts",
-        "src/lib/filterLog.ts",
-        "src/lib/format.ts",
-        "src/lib/fullscreen.ts",
-        "src/lib/hints.ts",
-        "src/lib/history.ts",
-        "src/lib/homeIntent.ts",
-        "src/lib/hueTile.ts",
-        "src/lib/issueDraft.ts",
-        "src/lib/jobResult.ts",
-        "src/lib/keymap.ts",
-        "src/lib/layerStack.ts",
-        "src/lib/lazyWithPreload.ts",
-        "src/lib/linkify.tsx",
-        "src/lib/lintProbe.testkit.ts",
-        "src/lib/listNav.ts",
-        "src/lib/listPaging.ts",
-        "src/lib/log.ts",
-        "src/lib/logHooks.ts",
-        "src/lib/logsUrlState.ts",
-        "src/lib/mediaLog.ts",
-        "src/lib/mediaSource.ts",
-        "src/lib/messaging.ts",
-        "src/lib/modules.ts",
-        "src/lib/moveInList.ts",
-        "src/lib/nav.ts",
-        "src/lib/nextPage.ts",
-        "src/lib/notifications.ts",
-        "src/lib/onboarding.ts",
-        "src/lib/pageMeta.ts",
-        "src/lib/panelLayout.ts",
-        "src/lib/parseId.ts",
-        "src/lib/playerModalHooks.ts",
-        "src/lib/playerModes.ts",
-        "src/lib/playerQueue.ts",
-        "src/lib/playerVolume.ts",
-        "src/lib/playlistName.ts",
-        "src/lib/playlistView.ts",
-        "src/lib/plexDetail.ts",
-        "src/lib/plexImage.ts",
-        "src/lib/plexPlayerHooks.ts",
-        "src/lib/plexPlayerPrefs.ts",
-        "src/lib/plexQueue.ts",
-        "src/lib/plexRating.ts",
-        "src/lib/plexSearch.ts",
-        "src/lib/plexSort.ts",
-        "src/lib/plexStats.ts",
-        "src/lib/plexUrlState.ts",
-        "src/lib/plexWatch.ts",
-        "src/lib/progressCache.ts",
-        "src/lib/queryClient.ts",
-        "src/lib/queryKeys.ts",
-        "src/lib/reinsert.ts",
-        "src/lib/releaseNotes.ts",
-        "src/lib/saveLanguage.ts",
-        "src/lib/savedViews.ts",
-        "src/lib/seekableEnd.ts",
-        "src/lib/sortOptions.ts",
-        "src/lib/sourceSize.testkit.ts",
-        "src/lib/staleBuild.ts",
-        "src/lib/storage.ts",
-        "src/lib/store.ts",
-        "src/lib/subscriptionCache.ts",
-        "src/lib/tableColumns.ts",
-        "src/lib/tagPicks.ts",
-        "src/lib/textSelection.ts",
-        "src/lib/theme.ts",
-        "src/lib/toastDock.ts",
-        "src/lib/urlState.ts",
-        "src/lib/useActiveFilters.ts",
-        "src/lib/useCardPager.ts",
-        "src/lib/useChannelNames.ts",
-        "src/lib/useChannelPriority.ts",
-        "src/lib/useChannelTagActions.ts",
-        "src/lib/useChipOverflowFit.ts",
-        "src/lib/useDebounced.ts",
-        "src/lib/useDismiss.ts",
-        "src/lib/useFilterFold.ts",
-        "src/lib/useFilterState.ts",
-        "src/lib/useFocusKeeper.ts",
-        "src/lib/useHoverFocusWithin.ts",
-        "src/lib/useLatest.ts",
-        "src/lib/useLiveQuery.ts",
-        "src/lib/useMe.ts",
-        "src/lib/useMediaQuery.ts",
-        "src/lib/usePlexCollectionTitles.ts",
-        "src/lib/usePref.ts",
-        "src/lib/useScrollEdges.ts",
-        "src/lib/useScrollFade.ts",
-        "src/lib/useSortState.ts",
-        "src/lib/useTags.ts",
-        "src/lib/useUndoable.ts",
-        "src/lib/useUrlMirror.ts",
-        "src/lib/useVerifyEntry.ts",
-        "src/lib/version.ts",
-        "src/lib/vocab.ts",
-        "src/lib/youtube.ts",
-        "src/lib/youtubeErrors.ts"
+      "rules": {
+        "@babel/object-curly-spacing": [0],
+        "@babel/semi": [0],
+        "@eslint-community/eslint-comments/no-unlimited-disable": [2],
+        "@eslint-community/eslint-comments/require-description": [2, { "ignore": [] }],
+        "@stylistic/array-bracket-newline": [0],
+        "@stylistic/array-bracket-spacing": [0],
+        "@stylistic/array-element-newline": [0],
+        "@stylistic/arrow-parens": [0],
+        "@stylistic/arrow-spacing": [0],
+        "@stylistic/block-spacing": [0],
+        "@stylistic/brace-style": [0],
+        "@stylistic/comma-dangle": [0],
+        "@stylistic/comma-spacing": [0],
+        "@stylistic/comma-style": [0],
+        "@stylistic/computed-property-spacing": [0],
+        "@stylistic/dot-location": [0],
+        "@stylistic/eol-last": [0],
+        "@stylistic/func-call-spacing": [0],
+        "@stylistic/function-call-argument-newline": [0],
+        "@stylistic/function-call-spacing": [0],
+        "@stylistic/function-paren-newline": [0],
+        "@stylistic/generator-star-spacing": [0],
+        "@stylistic/implicit-arrow-linebreak": [0],
+        "@stylistic/indent": [0],
+        "@stylistic/indent-binary-ops": [0],
+        "@stylistic/js/array-bracket-newline": [0],
+        "@stylistic/js/array-bracket-spacing": [0],
+        "@stylistic/js/array-element-newline": [0],
+        "@stylistic/js/arrow-parens": [0],
+        "@stylistic/js/arrow-spacing": [0],
+        "@stylistic/js/block-spacing": [0],
+        "@stylistic/js/brace-style": [0],
+        "@stylistic/js/comma-dangle": [0],
+        "@stylistic/js/comma-spacing": [0],
+        "@stylistic/js/comma-style": [0],
+        "@stylistic/js/computed-property-spacing": [0],
+        "@stylistic/js/dot-location": [0],
+        "@stylistic/js/eol-last": [0],
+        "@stylistic/js/func-call-spacing": [0],
+        "@stylistic/js/function-call-argument-newline": [0],
+        "@stylistic/js/function-call-spacing": [0],
+        "@stylistic/js/function-paren-newline": [0],
+        "@stylistic/js/generator-star-spacing": [0],
+        "@stylistic/js/implicit-arrow-linebreak": [0],
+        "@stylistic/js/indent": [0],
+        "@stylistic/js/jsx-quotes": [0],
+        "@stylistic/js/key-spacing": [0],
+        "@stylistic/js/keyword-spacing": [0],
+        "@stylistic/js/linebreak-style": [0],
+        "@stylistic/js/lines-around-comment": [0],
+        "@stylistic/js/max-len": [0],
+        "@stylistic/js/max-statements-per-line": [0],
+        "@stylistic/js/multiline-ternary": [0],
+        "@stylistic/js/new-parens": [0],
+        "@stylistic/js/newline-per-chained-call": [0],
+        "@stylistic/js/no-confusing-arrow": [0],
+        "@stylistic/js/no-extra-parens": [0],
+        "@stylistic/js/no-extra-semi": [0],
+        "@stylistic/js/no-floating-decimal": [0],
+        "@stylistic/js/no-mixed-operators": [0],
+        "@stylistic/js/no-mixed-spaces-and-tabs": [0],
+        "@stylistic/js/no-multi-spaces": [0],
+        "@stylistic/js/no-multiple-empty-lines": [0],
+        "@stylistic/js/no-tabs": [0],
+        "@stylistic/js/no-trailing-spaces": [0],
+        "@stylistic/js/no-whitespace-before-property": [0],
+        "@stylistic/js/nonblock-statement-body-position": [0],
+        "@stylistic/js/object-curly-newline": [0],
+        "@stylistic/js/object-curly-spacing": [0],
+        "@stylistic/js/object-property-newline": [0],
+        "@stylistic/js/one-var-declaration-per-line": [0],
+        "@stylistic/js/operator-linebreak": [0],
+        "@stylistic/js/padded-blocks": [0],
+        "@stylistic/js/quote-props": [0],
+        "@stylistic/js/quotes": [0],
+        "@stylistic/js/rest-spread-spacing": [0],
+        "@stylistic/js/semi": [0],
+        "@stylistic/js/semi-spacing": [0],
+        "@stylistic/js/semi-style": [0],
+        "@stylistic/js/space-before-blocks": [0],
+        "@stylistic/js/space-before-function-paren": [0],
+        "@stylistic/js/space-in-parens": [0],
+        "@stylistic/js/space-infix-ops": [0],
+        "@stylistic/js/space-unary-ops": [0],
+        "@stylistic/js/switch-colon-spacing": [0],
+        "@stylistic/js/template-curly-spacing": [0],
+        "@stylistic/js/template-tag-spacing": [0],
+        "@stylistic/js/wrap-iife": [0],
+        "@stylistic/js/wrap-regex": [0],
+        "@stylistic/js/yield-star-spacing": [0],
+        "@stylistic/jsx-child-element-spacing": [0],
+        "@stylistic/jsx-closing-bracket-location": [0],
+        "@stylistic/jsx-closing-tag-location": [0],
+        "@stylistic/jsx-curly-newline": [0],
+        "@stylistic/jsx-curly-spacing": [0],
+        "@stylistic/jsx-equals-spacing": [0],
+        "@stylistic/jsx-first-prop-new-line": [0],
+        "@stylistic/jsx-indent": [0],
+        "@stylistic/jsx-indent-props": [0],
+        "@stylistic/jsx-max-props-per-line": [0],
+        "@stylistic/jsx-newline": [0],
+        "@stylistic/jsx-one-expression-per-line": [0],
+        "@stylistic/jsx-props-no-multi-spaces": [0],
+        "@stylistic/jsx-quotes": [0],
+        "@stylistic/jsx-tag-spacing": [0],
+        "@stylistic/jsx-wrap-multilines": [0],
+        "@stylistic/jsx/jsx-child-element-spacing": [0],
+        "@stylistic/jsx/jsx-closing-bracket-location": [0],
+        "@stylistic/jsx/jsx-closing-tag-location": [0],
+        "@stylistic/jsx/jsx-curly-newline": [0],
+        "@stylistic/jsx/jsx-curly-spacing": [0],
+        "@stylistic/jsx/jsx-equals-spacing": [0],
+        "@stylistic/jsx/jsx-first-prop-new-line": [0],
+        "@stylistic/jsx/jsx-indent": [0],
+        "@stylistic/jsx/jsx-indent-props": [0],
+        "@stylistic/jsx/jsx-max-props-per-line": [0],
+        "@stylistic/key-spacing": [0],
+        "@stylistic/keyword-spacing": [0],
+        "@stylistic/linebreak-style": [0],
+        "@stylistic/lines-around-comment": [0],
+        "@stylistic/max-len": [0],
+        "@stylistic/max-statements-per-line": [0],
+        "@stylistic/member-delimiter-style": [0],
+        "@stylistic/multiline-ternary": [0],
+        "@stylistic/new-parens": [0],
+        "@stylistic/newline-per-chained-call": [0],
+        "@stylistic/no-confusing-arrow": [0],
+        "@stylistic/no-extra-parens": [0],
+        "@stylistic/no-extra-semi": [0],
+        "@stylistic/no-floating-decimal": [0],
+        "@stylistic/no-mixed-operators": [0],
+        "@stylistic/no-mixed-spaces-and-tabs": [0],
+        "@stylistic/no-multi-spaces": [0],
+        "@stylistic/no-multiple-empty-lines": [0],
+        "@stylistic/no-tabs": [0],
+        "@stylistic/no-trailing-spaces": [0],
+        "@stylistic/no-whitespace-before-property": [0],
+        "@stylistic/nonblock-statement-body-position": [0],
+        "@stylistic/object-curly-newline": [0],
+        "@stylistic/object-curly-spacing": [0],
+        "@stylistic/object-property-newline": [0],
+        "@stylistic/one-var-declaration-per-line": [0],
+        "@stylistic/operator-linebreak": [0],
+        "@stylistic/padded-blocks": [0],
+        "@stylistic/quote-props": [0],
+        "@stylistic/quotes": [0],
+        "@stylistic/rest-spread-spacing": [0],
+        "@stylistic/semi": [0],
+        "@stylistic/semi-spacing": [0],
+        "@stylistic/semi-style": [0],
+        "@stylistic/space-before-blocks": [0],
+        "@stylistic/space-before-function-paren": [0],
+        "@stylistic/space-in-parens": [0],
+        "@stylistic/space-infix-ops": [0],
+        "@stylistic/space-unary-ops": [0],
+        "@stylistic/switch-colon-spacing": [0],
+        "@stylistic/template-curly-spacing": [0],
+        "@stylistic/template-tag-spacing": [0],
+        "@stylistic/ts/block-spacing": [0],
+        "@stylistic/ts/brace-style": [0],
+        "@stylistic/ts/comma-dangle": [0],
+        "@stylistic/ts/comma-spacing": [0],
+        "@stylistic/ts/func-call-spacing": [0],
+        "@stylistic/ts/function-call-spacing": [0],
+        "@stylistic/ts/indent": [0],
+        "@stylistic/ts/key-spacing": [0],
+        "@stylistic/ts/keyword-spacing": [0],
+        "@stylistic/ts/lines-around-comment": [0],
+        "@stylistic/ts/member-delimiter-style": [0],
+        "@stylistic/ts/no-extra-parens": [0],
+        "@stylistic/ts/no-extra-semi": [0],
+        "@stylistic/ts/object-curly-spacing": [0],
+        "@stylistic/ts/quotes": [0],
+        "@stylistic/ts/semi": [0],
+        "@stylistic/ts/space-before-blocks": [0],
+        "@stylistic/ts/space-before-function-paren": [0],
+        "@stylistic/ts/space-infix-ops": [0],
+        "@stylistic/ts/type-annotation-spacing": [0],
+        "@stylistic/type-annotation-spacing": [0],
+        "@stylistic/type-generic-spacing": [0],
+        "@stylistic/type-named-tuple-spacing": [0],
+        "@stylistic/wrap-iife": [0],
+        "@stylistic/wrap-regex": [0],
+        "@stylistic/yield-star-spacing": [0],
+        "@typescript-eslint/ban-ts-comment": [2],
+        "@typescript-eslint/block-spacing": [0],
+        "@typescript-eslint/brace-style": [0],
+        "@typescript-eslint/comma-dangle": [0],
+        "@typescript-eslint/comma-spacing": [0],
+        "@typescript-eslint/func-call-spacing": [0],
+        "@typescript-eslint/indent": [0],
+        "@typescript-eslint/key-spacing": [0],
+        "@typescript-eslint/keyword-spacing": [0],
+        "@typescript-eslint/lines-around-comment": [0],
+        "@typescript-eslint/member-delimiter-style": [0],
+        "@typescript-eslint/no-array-constructor": [2],
+        "@typescript-eslint/no-deprecated": [2],
+        "@typescript-eslint/no-duplicate-enum-values": [2],
+        "@typescript-eslint/no-empty-object-type": [2],
+        "@typescript-eslint/no-explicit-any": [2],
+        "@typescript-eslint/no-extra-non-null-assertion": [2],
+        "@typescript-eslint/no-extra-parens": [0],
+        "@typescript-eslint/no-extra-semi": [0],
+        "@typescript-eslint/no-floating-promises": [
+          2,
+          {
+            "allowForKnownSafeCalls": [
+              {
+                "from": "package",
+                "name": [
+                  "invalidateQueries",
+                  "refetchQueries",
+                  "cancelQueries",
+                  "resetQueries",
+                  "prefetchQuery",
+                  "prefetchInfiniteQuery"
+                ],
+                "package": "@tanstack/query-core"
+              }
+            ]
+          }
+        ],
+        "@typescript-eslint/no-misused-new": [2],
+        "@typescript-eslint/no-namespace": [2],
+        "@typescript-eslint/no-non-null-asserted-optional-chain": [2],
+        "@typescript-eslint/no-require-imports": [2],
+        "@typescript-eslint/no-this-alias": [2],
+        "@typescript-eslint/no-unnecessary-type-constraint": [2],
+        "@typescript-eslint/no-unsafe-declaration-merging": [2],
+        "@typescript-eslint/no-unsafe-function-type": [2],
+        "@typescript-eslint/no-unused-expressions": [
+          2,
+          { "allowShortCircuit": true, "allowTaggedTemplates": false, "allowTernary": true }
+        ],
+        "@typescript-eslint/no-unused-vars": [0],
+        "@typescript-eslint/no-wrapper-object-types": [2],
+        "@typescript-eslint/object-curly-spacing": [0],
+        "@typescript-eslint/prefer-as-const": [2],
+        "@typescript-eslint/prefer-namespace-keyword": [2],
+        "@typescript-eslint/quotes": [0],
+        "@typescript-eslint/semi": [0],
+        "@typescript-eslint/space-before-blocks": [0],
+        "@typescript-eslint/space-before-function-paren": [0],
+        "@typescript-eslint/space-infix-ops": [0],
+        "@typescript-eslint/triple-slash-reference": [2],
+        "@typescript-eslint/type-annotation-spacing": [0],
+        "array-bracket-newline": [0],
+        "array-bracket-spacing": [0],
+        "array-element-newline": [0],
+        "arrow-parens": [0],
+        "arrow-spacing": [0],
+        "babel/object-curly-spacing": [0],
+        "babel/quotes": [0],
+        "babel/semi": [0],
+        "block-spacing": [0],
+        "brace-style": [0],
+        "comma-dangle": [0],
+        "comma-spacing": [0],
+        "comma-style": [0],
+        "computed-property-spacing": [0],
+        "constructor-super": [0],
+        "curly": [0, "all"],
+        "dot-location": [0],
+        "eol-last": [0],
+        "flowtype/boolean-style": [0],
+        "flowtype/delimiter-dangle": [0],
+        "flowtype/generic-spacing": [0],
+        "flowtype/object-type-curly-spacing": [0],
+        "flowtype/object-type-delimiter": [0],
+        "flowtype/quotes": [0],
+        "flowtype/semi": [0],
+        "flowtype/space-after-type-colon": [0],
+        "flowtype/space-before-generic-bracket": [0],
+        "flowtype/space-before-type-colon": [0],
+        "flowtype/union-intersection-spacing": [0],
+        "for-direction": [2],
+        "func-call-spacing": [0],
+        "function-call-argument-newline": [0],
+        "function-paren-newline": [0],
+        "generator-star": [0],
+        "generator-star-spacing": [0],
+        "getter-return": [0, { "allowImplicit": false }],
+        "implicit-arrow-linebreak": [0],
+        "indent": [0],
+        "indent-legacy": [0],
+        "jsx-quotes": [0],
+        "key-spacing": [0],
+        "keyword-spacing": [0],
+        "linebreak-style": [0],
+        "lines-around-comment": [0],
+        "local/button-primitive": [2],
+        "local/glyph-link": [2],
+        "local/input-primitive": [2],
+        "local/jsx-comment-text": [2],
+        "local/literal-a11y-text": [2],
+        "local/locale-format": [2],
+        "local/sortable-a11y": [2],
+        "local/surface-role": [2],
+        "max-len": [0],
+        "max-statements-per-line": [0],
+        "multiline-ternary": [0],
+        "new-parens": [0],
+        "newline-per-chained-call": [0],
+        "no-array-constructor": [0],
+        "no-arrow-condition": [0],
+        "no-async-promise-executor": [2],
+        "no-case-declarations": [2],
+        "no-class-assign": [0],
+        "no-comma-dangle": [0],
+        "no-compare-neg-zero": [2],
+        "no-cond-assign": [2, "except-parens"],
+        "no-confusing-arrow": [0],
+        "no-console": [2, {}],
+        "no-const-assign": [0],
+        "no-constant-binary-expression": [2],
+        "no-constant-condition": [2, { "checkLoops": "allExceptWhileTrue" }],
+        "no-control-regex": [2],
+        "no-debugger": [2],
+        "no-delete-var": [2],
+        "no-dupe-args": [0],
+        "no-dupe-class-members": [0],
+        "no-dupe-else-if": [2],
+        "no-dupe-keys": [0],
+        "no-duplicate-case": [2],
+        "no-empty": [2, { "allowEmptyCatch": false }],
+        "no-empty-character-class": [2],
+        "no-empty-pattern": [2, { "allowObjectPatternsAsParameters": false }],
+        "no-empty-static-block": [2],
+        "no-ex-assign": [2],
+        "no-extra-boolean-cast": [2, {}],
+        "no-extra-parens": [0],
+        "no-extra-semi": [0],
+        "no-fallthrough": [2, { "allowEmptyCase": false, "reportUnusedFallthroughComment": false }],
+        "no-floating-decimal": [0],
+        "no-func-assign": [0],
+        "no-global-assign": [2, { "exceptions": [] }],
+        "no-import-assign": [0],
+        "no-invalid-regexp": [2, {}],
+        "no-irregular-whitespace": [
+          2,
+          {
+            "skipComments": false,
+            "skipJSXText": false,
+            "skipRegExps": false,
+            "skipStrings": true,
+            "skipTemplates": false
+          }
+        ],
+        "no-loss-of-precision": [2],
+        "no-misleading-character-class": [2, { "allowEscape": false }],
+        "no-mixed-operators": [0],
+        "no-mixed-spaces-and-tabs": [0],
+        "no-multi-spaces": [0],
+        "no-multiple-empty-lines": [0],
+        "no-new-native-nonconstructor": [0],
+        "no-new-symbol": [0],
+        "no-nonoctal-decimal-escape": [2],
+        "no-obj-calls": [0],
+        "no-octal": [2],
+        "no-prototype-builtins": [2],
+        "no-redeclare": [0, { "builtinGlobals": true }],
+        "no-regex-spaces": [2],
+        "no-reserved-keys": [0],
+        "no-restricted-globals": [
+          2,
+          {
+            "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only — a request outside it never reaches the client log.",
+            "name": "fetch"
+          },
+          {
+            "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only — a request outside it never reaches the client log.",
+            "name": "XMLHttpRequest"
+          },
+          { "message": "No `WebSocket` without a logged owner module.", "name": "WebSocket" },
+          { "message": "No `EventSource` without a logged owner module.", "name": "EventSource" }
+        ],
+        "no-restricted-properties": [
+          2,
+          { "message": "Use lib/http.ts `send`.", "object": "window", "property": "fetch" },
+          { "message": "Use lib/http.ts `send`.", "object": "globalThis", "property": "fetch" },
+          {
+            "message": "Use lib/api/core.ts `beacon`.",
+            "object": "navigator",
+            "property": "sendBeacon"
+          }
+        ],
+        "no-restricted-syntax": [
+          2,
+          {
+            "message": "fetchNextPage() cancels and re-sends a page already loading: call fetchNextPage(NEXT_PAGE) (lib/nextPage.ts).",
+            "selector": "CallExpression[arguments.length=0]:matches([callee.name='fetchNextPage'], [callee.property.name='fetchNextPage'])"
+          },
+          {
+            "message": "`enabled:hover:` misses a focused FocusSafeButton (aria-disabled): use `act:hover:` (index.css).",
+            "selector": "Literal[value=/(^|\\s)enabled:hover:/]"
+          },
+          {
+            "message": "`enabled:hover:` misses a focused FocusSafeButton (aria-disabled): use `act:hover:` (index.css).",
+            "selector": "TemplateElement[value.raw=/(^|\\s)enabled:hover:/]"
+          },
+          {
+            "message": "a class split by an interpolation (`${x}hover:…`): Tailwind never sees it whole and emits no CSS; write the class literally (a shared guard is the `act:` variant).",
+            "selector": "TemplateLiteral > TemplateElement:not(:first-child)[value.raw=/^([a-z][\\w-]*:[\\w\\[!-]|:[a-z\\[!])/]"
+          },
+          {
+            "message": "No native <select>: use ui/SegmentedToggle for a short fixed set, ui/FilterSelect for a longer one or a user's own list.",
+            "selector": "JSXOpeningElement[name.name='select']"
+          },
+          {
+            "message": "px-frozen font size doesn't scale with --font-scale: use text-2xs/text-3xs or text-[Nrem], not text-[Npx].",
+            "selector": "Literal[value=/text-\\[[\\d.]+px\\]/]"
+          },
+          {
+            "message": "px-frozen font size doesn't scale with --font-scale: use text-2xs/text-3xs or text-[Nrem], not text-[Npx].",
+            "selector": "TemplateElement[value.raw=/text-\\[[\\d.]+px\\]/]"
+          },
+          {
+            "message": "px-frozen box size doesn't scale with --font-scale: use the spacing scale (w-37.5, max-w-60) or rem (minmax(9.375rem,1fr)), not w-[Npx] or minmax(Npx,…).",
+            "selector": "Literal[value=/(^|[\\s:])(min-|max-)?(w|h|size|left|right|top|bottom|inset|gap|p[xytrbl]?|m[xytrbl]?)-\\[[\\d.]+px\\]|minmax\\([\\d.]+px,/]"
+          },
+          {
+            "message": "px-frozen box size doesn't scale with --font-scale: use the spacing scale (w-37.5, max-w-60) or rem (minmax(9.375rem,1fr)), not w-[Npx] or minmax(Npx,…).",
+            "selector": "TemplateElement[value.raw=/(^|[\\s:])(min-|max-)?(w|h|size|left|right|top|bottom|inset|gap|p[xytrbl]?|m[xytrbl]?)-\\[[\\d.]+px\\]|minmax\\([\\d.]+px,/]"
+          },
+          {
+            "message": "hover by a colour swap: use the B3 layer (`state-layer`, Pressable `layer`, `state-filled` on a fill), not hover:bg-card / bg-border / opacity-N.",
+            "selector": "Literal[value=/(^|[\\s:])hover:(bg-(card|border|surface|muted)(?![\\w-])|bg-\\(--(hover|press)\\)|opacity-)/]"
+          },
+          {
+            "message": "hover by a colour swap: use the B3 layer (`state-layer`, Pressable `layer`, `state-filled` on a fill), not hover:bg-card / bg-border / opacity-N.",
+            "selector": "TemplateElement[value.raw=/(^|[\\s:])hover:(bg-(card|border|surface|muted)(?![\\w-])|bg-\\(--(hover|press)\\)|opacity-)/]"
+          },
+          {
+            "message": "a palette colour: use a semantic token (text-rating, bg-live, bg-media-chrome, text-danger, …; DESIGN.md Tokens), not text-amber-500.",
+            "selector": "Literal[value=/(^|[\\s:])(text|bg|border|fill|stroke|from|via|to|ring|outline|decoration|divide|caret|shadow)-(red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose|slate|gray|zinc|neutral|stone)-\\d/]"
+          },
+          {
+            "message": "a palette colour: use a semantic token (text-rating, bg-live, bg-media-chrome, text-danger, …; DESIGN.md Tokens), not text-amber-500.",
+            "selector": "TemplateElement[value.raw=/(^|[\\s:])(text|bg|border|fill|stroke|from|via|to|ring|outline|decoration|divide|caret|shadow)-(red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose|slate|gray|zinc|neutral|stone)-\\d/]"
+          }
+        ],
+        "no-self-assign": [2, { "props": true }],
+        "no-setter-return": [0],
+        "no-shadow-restricted-names": [2, { "reportGlobalThis": false }],
+        "no-space-before-semi": [0],
+        "no-spaced-func": [0],
+        "no-sparse-arrays": [2],
+        "no-tabs": [0],
+        "no-this-before-super": [0],
+        "no-trailing-spaces": [0],
+        "no-undef": [0, { "typeof": false }],
+        "no-unexpected-multiline": [0],
+        "no-unreachable": [0],
+        "no-unsafe-finally": [2],
+        "no-unsafe-negation": [0, { "enforceForOrderingRelations": false }],
+        "no-unsafe-optional-chaining": [2, { "disallowArithmeticOperators": false }],
+        "no-unused-expressions": [
+          0,
+          {
+            "allowShortCircuit": false,
+            "allowTaggedTemplates": false,
+            "allowTernary": false,
+            "enforceForJSX": false,
+            "ignoreDirectives": false
+          }
+        ],
+        "no-unused-labels": [2],
+        "no-unused-private-class-members": [2],
+        "no-unused-vars": [0],
+        "no-useless-backreference": [2],
+        "no-useless-catch": [2],
+        "no-useless-escape": [2, { "allowRegexCharacters": [] }],
+        "no-var": [2],
+        "no-whitespace-before-property": [0],
+        "no-with": [0],
+        "no-wrap-func": [0],
+        "nonblock-statement-body-position": [0],
+        "object-curly-newline": [0],
+        "object-curly-spacing": [0],
+        "object-property-newline": [0],
+        "one-var-declaration-per-line": [0],
+        "operator-linebreak": [0],
+        "padded-blocks": [0],
+        "prefer-const": [2, { "destructuring": "any", "ignoreReadBeforeAssign": false }],
+        "prefer-rest-params": [2],
+        "prefer-spread": [2],
+        "quote-props": [0],
+        "quotes": [0],
+        "react-hooks/capitalized-calls": [2],
+        "react-hooks/component-hook-factories": [2],
+        "react-hooks/config": [2],
+        "react-hooks/error-boundaries": [2],
+        "react-hooks/exhaustive-deps": [1],
+        "react-hooks/gating": [2],
+        "react-hooks/globals": [2],
+        "react-hooks/hooks": [2],
+        "react-hooks/immutability": [2],
+        "react-hooks/incompatible-library": [1],
+        "react-hooks/invariant": [2],
+        "react-hooks/memo-dependencies": [2],
+        "react-hooks/no-deriving-state-in-effects": [2],
+        "react-hooks/preserve-manual-memoization": [2],
+        "react-hooks/purity": [2],
+        "react-hooks/refs": [2],
+        "react-hooks/rules-of-hooks": [2],
+        "react-hooks/set-state-in-effect": [2],
+        "react-hooks/set-state-in-render": [2],
+        "react-hooks/static-components": [2],
+        "react-hooks/syntax": [2],
+        "react-hooks/todo": [2],
+        "react-hooks/unsupported-syntax": [1],
+        "react-hooks/use-memo": [2],
+        "react-hooks/void-use-memo": [2],
+        "react-refresh/only-export-components": [1, { "allowConstantExport": true }],
+        "react/jsx-child-element-spacing": [0],
+        "react/jsx-closing-bracket-location": [0],
+        "react/jsx-closing-tag-location": [0],
+        "react/jsx-curly-newline": [0],
+        "react/jsx-curly-spacing": [0],
+        "react/jsx-equals-spacing": [0],
+        "react/jsx-first-prop-new-line": [0],
+        "react/jsx-indent": [0],
+        "react/jsx-indent-props": [0],
+        "react/jsx-max-props-per-line": [0],
+        "react/jsx-newline": [0],
+        "react/jsx-one-expression-per-line": [0],
+        "react/jsx-props-no-multi-spaces": [0],
+        "react/jsx-space-before-closing": [0],
+        "react/jsx-tag-spacing": [0],
+        "react/jsx-wrap-multilines": [0],
+        "require-yield": [2],
+        "rest-spread-spacing": [0],
+        "semi": [0],
+        "semi-spacing": [0],
+        "semi-style": [0],
+        "space-after-function-name": [0],
+        "space-after-keywords": [0],
+        "space-before-blocks": [0],
+        "space-before-function-paren": [0],
+        "space-before-function-parentheses": [0],
+        "space-before-keywords": [0],
+        "space-in-brackets": [0],
+        "space-in-parens": [0],
+        "space-infix-ops": [0],
+        "space-return-throw-case": [0],
+        "space-unary-ops": [0],
+        "space-unary-word-ops": [0],
+        "standard/array-bracket-even-spacing": [0],
+        "standard/computed-property-even-spacing": [0],
+        "standard/object-curly-even-spacing": [0],
+        "switch-colon-spacing": [0],
+        "template-curly-spacing": [0],
+        "template-tag-spacing": [0],
+        "unicorn/empty-brace-spaces": [0],
+        "unicorn/no-nested-ternary": [0],
+        "unicorn/number-literal-case": [0],
+        "unicorn/template-indent": [0],
+        "use-isnan": [2, { "enforceForIndexOf": false, "enforceForSwitchCase": true }],
+        "valid-typeof": [2, { "requireStringLiterals": false }],
+        "vue/array-bracket-newline": [0],
+        "vue/array-bracket-spacing": [0],
+        "vue/array-element-newline": [0],
+        "vue/arrow-spacing": [0],
+        "vue/block-spacing": [0],
+        "vue/block-tag-newline": [0],
+        "vue/brace-style": [0],
+        "vue/comma-dangle": [0],
+        "vue/comma-spacing": [0],
+        "vue/comma-style": [0],
+        "vue/dot-location": [0],
+        "vue/func-call-spacing": [0],
+        "vue/html-closing-bracket-newline": [0],
+        "vue/html-closing-bracket-spacing": [0],
+        "vue/html-end-tags": [0],
+        "vue/html-indent": [0],
+        "vue/html-quotes": [0],
+        "vue/html-self-closing": [0],
+        "vue/key-spacing": [0],
+        "vue/keyword-spacing": [0],
+        "vue/max-attributes-per-line": [0],
+        "vue/max-len": [0],
+        "vue/multiline-html-element-content-newline": [0],
+        "vue/multiline-ternary": [0],
+        "vue/mustache-interpolation-spacing": [0],
+        "vue/no-extra-parens": [0],
+        "vue/no-multi-spaces": [0],
+        "vue/no-spaces-around-equal-signs-in-attribute": [0],
+        "vue/object-curly-newline": [0],
+        "vue/object-curly-spacing": [0],
+        "vue/object-property-newline": [0],
+        "vue/operator-linebreak": [0],
+        "vue/quote-props": [0],
+        "vue/script-indent": [0],
+        "vue/singleline-html-element-content-newline": [0],
+        "vue/space-in-parens": [0],
+        "vue/space-infix-ops": [0],
+        "vue/space-unary-ops": [0],
+        "vue/template-curly-spacing": [0],
+        "wrap-iife": [0],
+        "wrap-regex": [0],
+        "yield-star-spacing": [0]
+      },
+      "settings": null
+    },
+    "src tests": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "1169 names, sha1 aee621727a03",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [],
+      "plugins": [
+        "@",
+        "@eslint-community/eslint-comments",
+        "@typescript-eslint",
+        "local",
+        "react-hooks",
+        "react-refresh",
+        "vitest"
       ],
-      "ts configs": [
-        "devOnlyGuard.ts",
-        "playwright.config.ts",
-        "reactPlugin.ts",
-        "vite.config.ts",
-        "vitest.config.ts"
+      "rules": {
+        "local/glyph-link": [0],
+        "local/input-primitive": [0],
+        "local/literal-a11y-text": [0],
+        "local/surface-role": [0],
+        "no-restricted-globals": [
+          0,
+          {
+            "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only — a request outside it never reaches the client log.",
+            "name": "fetch"
+          },
+          {
+            "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only — a request outside it never reaches the client log.",
+            "name": "XMLHttpRequest"
+          },
+          { "message": "No `WebSocket` without a logged owner module.", "name": "WebSocket" },
+          { "message": "No `EventSource` without a logged owner module.", "name": "EventSource" }
+        ],
+        "no-restricted-properties": [
+          0,
+          { "message": "Use lib/http.ts `send`.", "object": "window", "property": "fetch" },
+          { "message": "Use lib/http.ts `send`.", "object": "globalThis", "property": "fetch" },
+          {
+            "message": "Use lib/api/core.ts `beacon`.",
+            "object": "navigator",
+            "property": "sendBeacon"
+          }
+        ],
+        "vitest/no-disabled-tests": [2],
+        "vitest/no-focused-tests": [2, { "fixable": true }]
+      },
+      "settings": null
+    },
+    "src/lib": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "1169 names, sha1 aee621727a03",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [],
+      "plugins": [
+        "@",
+        "@eslint-community/eslint-comments",
+        "@typescript-eslint",
+        "local",
+        "react-hooks",
+        "react-refresh"
       ],
-      "ui": [
-        "src/components/ui/ActionMenu.tsx",
-        "src/components/ui/Avatar.tsx",
-        "src/components/ui/BackToTop.tsx",
-        "src/components/ui/Badge.tsx",
-        "src/components/ui/Banner.tsx",
-        "src/components/ui/Button.tsx",
-        "src/components/ui/Carousel.tsx",
-        "src/components/ui/Chip.tsx",
-        "src/components/ui/ClampedText.tsx",
-        "src/components/ui/ColumnSortControl.tsx",
-        "src/components/ui/Combobox.tsx",
-        "src/components/ui/CommandPalette.tsx",
-        "src/components/ui/ContextMenu.tsx",
-        "src/components/ui/CountBadge.tsx",
-        "src/components/ui/DataTable.tsx",
-        "src/components/ui/DraftSaveBar.tsx",
-        "src/components/ui/DragHandle.tsx",
-        "src/components/ui/FilterChipGroup.tsx",
-        "src/components/ui/FilterFold.tsx",
-        "src/components/ui/FilterSelect.tsx",
-        "src/components/ui/Headings.tsx",
-        "src/components/ui/HiddenFilterCue.tsx",
-        "src/components/ui/IconButton.tsx",
-        "src/components/ui/InlineNotice.tsx",
-        "src/components/ui/Input.tsx",
-        "src/components/ui/ItemCount.tsx",
-        "src/components/ui/KeyboardHelp.tsx",
-        "src/components/ui/LinkButton.tsx",
-        "src/components/ui/MatchToggle.tsx",
-        "src/components/ui/MediaCard.tsx",
-        "src/components/ui/MediaPreview.tsx",
-        "src/components/ui/MenuCheck.tsx",
-        "src/components/ui/Modal.tsx",
-        "src/components/ui/MoreButton.tsx",
-        "src/components/ui/NativeControls.tsx",
-        "src/components/ui/NavGrid.tsx",
-        "src/components/ui/NavRail.tsx",
-        "src/components/ui/OrderButtons.tsx",
-        "src/components/ui/Overlay.tsx",
-        "src/components/ui/PageMenu.tsx",
-        "src/components/ui/PageScroller.tsx",
-        "src/components/ui/PageShell.tsx",
-        "src/components/ui/Pager.tsx",
-        "src/components/ui/PanelGroup.tsx",
-        "src/components/ui/PanelGroups.tsx",
-        "src/components/ui/Pressable.tsx",
-        "src/components/ui/PriorityStepper.tsx",
-        "src/components/ui/QueryState.tsx",
-        "src/components/ui/RelativeTime.tsx",
-        "src/components/ui/SegmentedToggle.tsx",
-        "src/components/ui/SelectTrigger.tsx",
-        "src/components/ui/SidePanel.tsx",
-        "src/components/ui/Skeleton.tsx",
-        "src/components/ui/SkipLink.tsx",
-        "src/components/ui/SortControl.tsx",
-        "src/components/ui/StatTiles.tsx",
-        "src/components/ui/Tabs.tsx",
-        "src/components/ui/Toaster.tsx",
-        "src/components/ui/Tooltip.tsx",
-        "src/components/ui/UndoToolbar.tsx",
-        "src/components/ui/VirtualGrid.tsx",
-        "src/components/ui/anchoredPopoverHooks.ts",
-        "src/components/ui/backToTopState.ts",
-        "src/components/ui/buttonStyles.ts",
-        "src/components/ui/chipStyles.ts",
-        "src/components/ui/dialogFocus.ts",
-        "src/components/ui/fieldStyles.ts",
-        "src/components/ui/form.tsx",
-        "src/components/ui/gridColumns.ts",
-        "src/components/ui/landmarks.ts",
-        "src/components/ui/mediaCardStyles.ts",
-        "src/components/ui/menuGroups.ts",
-        "src/components/ui/overlayOrder.ts",
-        "src/components/ui/pageHeading.ts",
-        "src/components/ui/pageMenuItems.ts",
-        "src/components/ui/pageMenuSlot.ts",
-        "src/components/ui/pageToolbarSlot.ts",
-        "src/components/ui/pagerContent.ts",
-        "src/components/ui/progressiveRows.ts",
-        "src/components/ui/readAhead.ts",
-        "src/components/ui/reveal.ts",
-        "src/components/ui/scrollFold.ts",
-        "src/components/ui/sortableA11y.ts",
-        "src/components/ui/stickyTop.ts",
-        "src/components/ui/surfaces.ts",
-        "src/components/ui/tabPanel.ts",
-        "src/components/ui/tableAlign.ts",
-        "src/components/ui/tableHeader.tsx",
-        "src/components/ui/toastLevels.ts",
-        "src/components/ui/useContextMenu.ts",
-        "src/components/ui/useMediaPreview.ts",
-        "src/components/ui/useOrderItems.tsx",
-        "src/components/ui/useReturnFocus.ts"
+      "rules": {
+        "no-restricted-imports": [
+          2,
+          {
+            "patterns": [
+              {
+                "message": "lib/ sits below components/: it may not import from components/, not even a type. Move the shared piece down into lib/.",
+                "regex": "^(\\.\\./)+components(/|$)"
+              }
+            ]
+          }
+        ]
+      },
+      "settings": null
+    },
+    "ts configs": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "82 names, sha1 29467d490e30",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [
+        "local/button-primitive",
+        "local/glyph-link",
+        "local/input-primitive",
+        "local/jsx-comment-text",
+        "local/literal-a11y-text",
+        "local/locale-format",
+        "local/sortable-a11y",
+        "local/surface-role",
+        "no-console",
+        "no-restricted-globals",
+        "no-restricted-properties",
+        "no-restricted-syntax",
+        "react-hooks/capitalized-calls",
+        "react-hooks/component-hook-factories",
+        "react-hooks/config",
+        "react-hooks/error-boundaries",
+        "react-hooks/exhaustive-deps",
+        "react-hooks/gating",
+        "react-hooks/globals",
+        "react-hooks/hooks",
+        "react-hooks/immutability",
+        "react-hooks/incompatible-library",
+        "react-hooks/invariant",
+        "react-hooks/memo-dependencies",
+        "react-hooks/no-deriving-state-in-effects",
+        "react-hooks/preserve-manual-memoization",
+        "react-hooks/purity",
+        "react-hooks/refs",
+        "react-hooks/rules-of-hooks",
+        "react-hooks/set-state-in-effect",
+        "react-hooks/set-state-in-render",
+        "react-hooks/static-components",
+        "react-hooks/syntax",
+        "react-hooks/todo",
+        "react-hooks/unsupported-syntax",
+        "react-hooks/use-memo",
+        "react-hooks/void-use-memo",
+        "react-refresh/only-export-components"
       ],
-      "ui tests": [
-        "src/components/ui/ActionMenu.dom.test.tsx",
-        "src/components/ui/AnchoredPopover.dom.test.tsx",
-        "src/components/ui/AnchoredPopover.returnFocus.dom.test.tsx",
-        "src/components/ui/Avatar.dom.test.tsx",
-        "src/components/ui/BackToTop.dom.test.tsx",
-        "src/components/ui/Banner.dom.test.tsx",
-        "src/components/ui/Button.dom.test.tsx",
-        "src/components/ui/Carousel.dom.test.tsx",
-        "src/components/ui/Chip.dom.test.tsx",
-        "src/components/ui/ClampedText.dom.test.tsx",
-        "src/components/ui/Combobox.dom.test.tsx",
-        "src/components/ui/CommandPalette.dom.test.tsx",
-        "src/components/ui/CommandPalette.ordering.dom.test.tsx",
-        "src/components/ui/ContextMenu.dom.test.tsx",
-        "src/components/ui/DataTable.fixedLayout.dom.test.tsx",
-        "src/components/ui/DataTable.keyboard.dom.test.tsx",
-        "src/components/ui/DataTable.progressive.dom.test.tsx",
-        "src/components/ui/FilterChipGroup.dom.test.tsx",
-        "src/components/ui/FilterFold.dom.test.tsx",
-        "src/components/ui/FilterSelect.dom.test.tsx",
-        "src/components/ui/FocusSafeButton.select.dom.test.tsx",
-        "src/components/ui/HiddenFilterCue.dom.test.tsx",
-        "src/components/ui/IconButton.dom.test.tsx",
-        "src/components/ui/Input.dom.test.tsx",
-        "src/components/ui/ItemCount.dom.test.tsx",
-        "src/components/ui/KeyboardHelp.dom.test.tsx",
-        "src/components/ui/MatchToggle.dom.test.tsx",
-        "src/components/ui/Modal.dom.test.tsx",
-        "src/components/ui/Modal.fullscreen.dom.test.tsx",
-        "src/components/ui/Modal.purpose.dom.test.tsx",
-        "src/components/ui/Modal.strictmode.dom.test.tsx",
-        "src/components/ui/NavRail.dom.test.tsx",
-        "src/components/ui/OrderButtons.dom.test.tsx",
-        "src/components/ui/PageMenu.dom.test.tsx",
-        "src/components/ui/PageScroller.dom.test.tsx",
-        "src/components/ui/PageShell.dom.test.tsx",
-        "src/components/ui/Pager.dom.test.tsx",
-        "src/components/ui/PanelGroups.dom.test.tsx",
-        "src/components/ui/PriorityStepper.dom.test.tsx",
-        "src/components/ui/QueryState.dom.test.tsx",
-        "src/components/ui/RelativeTime.dom.test.tsx",
-        "src/components/ui/SegmentedToggle.dom.test.tsx",
-        "src/components/ui/SidePanel.drawer.dom.test.tsx",
-        "src/components/ui/SkipLink.dom.test.tsx",
-        "src/components/ui/SortControl.dom.test.tsx",
-        "src/components/ui/StatTiles.dom.test.tsx",
-        "src/components/ui/Tabs.dom.test.tsx",
-        "src/components/ui/Toaster.dom.test.tsx",
-        "src/components/ui/Toaster.hosts.test.ts",
-        "src/components/ui/Toaster.strictmode.dom.test.tsx",
-        "src/components/ui/Tooltip.layer.dom.test.tsx",
-        "src/components/ui/dialogFocus.dom.test.tsx",
-        "src/components/ui/form.dom.test.tsx",
-        "src/components/ui/gridColumns.test.ts",
-        "src/components/ui/hiddenFilterCue.contract.test.ts",
-        "src/components/ui/mediaRail.contract.test.ts",
-        "src/components/ui/menuCheck.contract.test.ts",
-        "src/components/ui/pageMenuScope.contract.test.ts",
-        "src/components/ui/pressableSelectable.contract.test.ts",
-        "src/components/ui/readAhead.test.ts",
-        "src/components/ui/scrollFold.test.ts",
-        "src/components/ui/sortableA11y.dom.test.tsx",
-        "src/components/ui/stickyTop.dom.test.tsx",
-        "src/components/ui/tailwindScan.contract.test.ts",
-        "src/components/ui/uiI18n.contract.test.ts",
-        "src/components/ui/useItemTriggers.dom.test.ts",
-        "src/components/ui/useReturnFocus.dom.test.tsx"
-      ]
+      "plugins": ["@", "@eslint-community/eslint-comments", "@typescript-eslint"],
+      "rules": {
+        "@typescript-eslint/no-unused-expressions": [
+          2,
+          { "allowShortCircuit": false, "allowTaggedTemplates": false, "allowTernary": false }
+        ]
+      },
+      "settings": null
+    },
+    "ui": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "1169 names, sha1 aee621727a03",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [],
+      "plugins": [
+        "@",
+        "@eslint-community/eslint-comments",
+        "@typescript-eslint",
+        "local",
+        "react-hooks",
+        "react-refresh"
+      ],
+      "rules": {
+        "no-restricted-imports": [
+          2,
+          {
+            "patterns": [
+              {
+                "message": "components/ui/ is domain-free: a platform component may not import a feature component. Invert the dependency (take a prop/render-prop) or keep the component outside ui/.",
+                "regex": "^\\.\\./(?!\\.\\./)"
+              },
+              {
+                "message": "components/ui/ is domain-free: a platform component may not import a feature component. Invert the dependency (take a prop/render-prop) or keep the component outside ui/.",
+                "regex": "^\\.\\./\\.\\./components/(?!ui/)"
+              },
+              {
+                "message": "components/ui/ is domain-free: a platform component may not call a domain API slice. Take the data as props.",
+                "regex": "^\\.\\./\\.\\./lib/api(/|$)"
+              }
+            ]
+          }
+        ]
+      },
+      "settings": null
+    },
+    "ui tests": {
+      "languageOptions": {
+        "ecmaVersion": 2022,
+        "globals": "1169 names, sha1 aee621727a03",
+        "parser": "typescript-eslint/parser",
+        "parserOptions": { "projectService": true, "tsconfigRootDir": "." },
+        "sourceType": "module"
+      },
+      "linterOptions": { "reportUnusedDisableDirectives": 2 },
+      "notApplied": [],
+      "plugins": [
+        "@",
+        "@eslint-community/eslint-comments",
+        "@typescript-eslint",
+        "local",
+        "react-hooks",
+        "react-refresh",
+        "vitest"
+      ],
+      "rules": {
+        "local/glyph-link": [0],
+        "local/input-primitive": [0],
+        "local/literal-a11y-text": [0],
+        "local/surface-role": [0],
+        "no-restricted-globals": [
+          0,
+          {
+            "message": "Use the logged request layer: `fetch` belongs to src/lib/http.ts only — a request outside it never reaches the client log.",
+            "name": "fetch"
+          },
+          {
+            "message": "Use the logged request layer: `XMLHttpRequest` belongs to src/lib/api/core.ts only — a request outside it never reaches the client log.",
+            "name": "XMLHttpRequest"
+          },
+          { "message": "No `WebSocket` without a logged owner module.", "name": "WebSocket" },
+          { "message": "No `EventSource` without a logged owner module.", "name": "EventSource" }
+        ],
+        "no-restricted-imports": [
+          2,
+          {
+            "patterns": [
+              {
+                "message": "components/ui/ is domain-free: a platform component may not import a feature component. Invert the dependency (take a prop/render-prop) or keep the component outside ui/.",
+                "regex": "^\\.\\./(?!\\.\\./)"
+              },
+              {
+                "message": "components/ui/ is domain-free: a platform component may not import a feature component. Invert the dependency (take a prop/render-prop) or keep the component outside ui/.",
+                "regex": "^\\.\\./\\.\\./components/(?!ui/)"
+              },
+              {
+                "message": "components/ui/ is domain-free: a platform component may not call a domain API slice. Take the data as props.",
+                "regex": "^\\.\\./\\.\\./lib/api(/|$)"
+              }
+            ]
+          }
+        ],
+        "no-restricted-properties": [
+          0,
+          { "message": "Use lib/http.ts `send`.", "object": "window", "property": "fetch" },
+          { "message": "Use lib/http.ts `send`.", "object": "globalThis", "property": "fetch" },
+          {
+            "message": "Use lib/api/core.ts `beacon`.",
+            "object": "navigator",
+            "property": "sendBeacon"
+          }
+        ],
+        "vitest/no-disabled-tests": [2],
+        "vitest/no-focused-tests": [2, { "fixable": true }]
+      },
+      "settings": null
     }
   },
   "lanes": {
@@ -2260,10 +1246,7 @@
       "    volumes:",
       "      - ./:/app",
       "    working_dir: /app",
-      "    command:",
-      "      - sh",
-      "      - -c",
-      "      - 'python -m pytest --cov=app --cov-report= ; rc=$$?; echo \">> backend coverage (app/) $$(python -m coverage report --format=total)% of lines\"; exit $$rc'"
+      "    command: [\"python\", \"-m\", \"pytest\"]"
     ],
     "frontend/.prettierignore": [
       "dist",
@@ -2279,7 +1262,7 @@
       "e2e": "playwright test",
       "format": "prettier --write .",
       "format:check": "prettier --check .",
-      "knip": "knip && knip --production",
+      "knip": "knip",
       "lint": "eslint . --max-warnings 0",
       "preview": "vite preview",
       "test": "vitest run",
@@ -2309,16 +1292,46 @@
     "scripts/check.sh": [
       "set -u",
       "cd \"$(dirname \"$0\")/..\" || exit 2",
-      "mode=\"${1:-all}\"",
-      "case \"$mode\" in all | lint) ;; *) echo \"usage: scripts/check.sh [lint]\" >&2; exit 2 ;; esac",
+      "mode=all",
+      "brief=0",
+      "for arg in \"$@\"; do",
+      "  case \"$arg\" in",
+      "    all | lint) mode=\"$arg\" ;;",
+      "    --brief) brief=1 ;;",
+      "  esac",
+      "done",
       "export MSYS_NO_PATHCONV=1 # Git Bash: do not rewrite the in-container paths below",
       "TESTCOMPOSE=backend/docker-compose.test.yml",
       "failed=()",
       "lane() { # lane <name> <command…> — run it, remember a failure, never stop",
       "  local name=\"$1\"",
       "  shift",
-      "  echo \">> $name…\"",
-      "  \"$@\" || failed+=(\"$name\")",
+      "  if [ \"$brief\" = 0 ]; then",
+      "    echo \">> $name…\"",
+      "    \"$@\" || failed+=(\"$name\")",
+      "    return 0",
+      "  fi",
+      "  local out",
+      "  out=\"$(mktemp)\"",
+      "  if \"$@\" >\"$out\" 2>&1; then",
+      "    echo \">> $name: ok\"",
+      "  else",
+      "    failed+=(\"$name\")",
+      "    echo \">> $name: FAILED\"",
+      "    brief_excerpt \"$out\"",
+      "  fi",
+      "  rm -f \"$out\"",
+      "}",
+      "brief_excerpt() {",
+      "  local log hits",
+      "  log=\"$(grep -v -E '^testdb-[0-9]+ ' \"$1\")\"",
+      "  if [ \"$(printf '%s\\n' \"$log\" | wc -l)\" -le 60 ]; then",
+      "    printf '%s\\n' \"$log\"",
+      "    return",
+      "  fi",
+      "  hits=\"$(printf '%s\\n' \"$log\" |",
+      "    grep -E -i -B 1 -A 2 -m 20 'error|fail|✗|×|warn|would reformat|unused|vulnerab|found [0-9]')\"",
+      "  if [ -n \"$hits\" ]; then printf '%s\\n' \"$hits\"; else printf '%s\\n' \"$log\" | tail -n 20; fi",
       "}",
       "ruff_pinned() {",
       "  local pin host",
@@ -2351,7 +1364,7 @@
       "lane \"tsc (src + configs + e2e)\" frontend npm run --silent typecheck",
       "lane \"eslint (warnings fail too)\" frontend npm run --silent lint",
       "lane \"prettier --check\" frontend npm run --silent format:check",
-      "lane \"knip (unused, and unused by what ships)\" frontend npm run --silent knip",
+      "lane \"knip (unused files, exports, dependencies)\" frontend npm run --silent knip",
       "pytest_lane() { # the full suite against a throwaway Postgres; --pull keeps the base image current",
       "  docker compose -f \"$TESTCOMPOSE\" build --pull -q test || return 1",
       "  local rc=0",
@@ -2364,7 +1377,7 @@
       "    pip-audit -r requirements.lock --no-deps --disable-pip",
       "}",
       "if [ \"$mode\" = all ]; then",
-      "  lane \"vitest (+ coverage report)\" frontend npm run --silent test -- --coverage",
+      "  lane \"vitest\" frontend npm run --silent test",
       "  lane \"vite build\" frontend npx vite build --logLevel warn",
       "  lane \"pytest (pure-logic + DB lane)\" pytest_lane",
       "  lane \"pip-audit (backend lock)\" pip_audit",
diff --git a/frontend/src/lib/globalKeymap.dom.test.tsx b/frontend/src/lib/globalKeymap.dom.test.tsx
index e4ac224f..dd840b1a 100644
--- a/frontend/src/lib/globalKeymap.dom.test.tsx
+++ b/frontend/src/lib/globalKeymap.dom.test.tsx
@@ -3,7 +3,7 @@
 // The `global` scope's LIVE behaviour, as opposed to `matches`/`dispatch` in isolation (keymap.test.ts
 // covers those against a handler map the test supplies itself, which cannot see the real handlers).
 //
-// Every assertion here pins a fix that E10 review round 2 proved was un-pinned: reverting the guard
+// Every assertion here pins a fix that a review proved was un-pinned: reverting the guard
 // each one covers left the whole suite green, which is how a fix round quietly becomes the next
 // round's source of regressions.
 import { useEffect } from "react";
@@ -69,7 +69,7 @@ describe("useGlobalKeymap", () => {
 
   // Mod+K is written as a toggle, and the palette autofocuses its own search field — so without
   // `allowInInput` on the row the second press was eaten by the typing guard and Chrome took the
-  // chord instead (round 1). The FIRST press must still be routed from a field, too.
+  // chord instead. The FIRST press must still be routed from a field, too.
   it("toggles the palette shut from inside a text field", () => {
     let state = "";
     render(<Host onState={(s) => (state = s)} />);
@@ -119,7 +119,7 @@ describe("useGlobalKeymap", () => {
     expect(state).toBe("none");
   });
 
-  // E24. The chord is the point: the Plex player binds bare letters and `w` sits on top of `s`, so a
+  // The chord is the point: the Plex player binds bare letters and `w` sits on top of `s`, so a
   // bare `w` would yank a viewer out of the film on a blind reach for the subtitle key.
   it("jumps Home on Shift+W and ignores a bare w", () => {
     const onHome = vi.fn();
diff --git a/frontend/src/lib/headings.contract.test.ts b/frontend/src/lib/headings.contract.test.ts
index 18f2f7ce..f9084dd0 100644
--- a/frontend/src/lib/headings.contract.test.ts
+++ b/frontend/src/lib/headings.contract.test.ts
@@ -2,7 +2,7 @@ import { readdirSync, readFileSync } from "node:fs";
 
 import { describe, expect, it } from "vitest";
 
-// E28 S3d4 (B4, UX-15). One `h1` per page: the shell's hidden page name, or a view's own visible
+// DESIGN.md B4, UX-15. One `h1` per page: the shell's hidden page name, or a view's own visible
 // title through `PageHeading`, which makes the shell's step aside. A hand-written `<h1>` inside the
 // shell would be a second one, beside the page name the shell already put there.
 function sources(): Array<[string, string]> {
diff --git a/frontend/src/lib/history.dom.test.ts b/frontend/src/lib/history.dom.test.ts
index 380d81d9..8e6e6df3 100644
--- a/frontend/src/lib/history.dom.test.ts
+++ b/frontend/src/lib/history.dom.test.ts
@@ -142,7 +142,7 @@ describe("closeOverlaysThenNavigate", () => {
       // Not inside the popstate dispatch that settled it — a later listener would still apply the
       // OLD entry's page over the push. Asserted FROM such a later listener (registered after the
       // helper's own), not after `settle()`: that async act can flush the unmounts on a macrotask,
-      // and the navigate task sometimes ran first — a 1-in-5 false failure (E11 S2b gate).
+      // and the navigate task sometimes ran first — a 1-in-5 false failure in the gate.
       const navigatedByPopstate: number[] = [];
       const laterListener = () => navigatedByPopstate.push(navigate.mock.calls.length);
       window.addEventListener("popstate", laterListener);
@@ -165,7 +165,7 @@ describe("closeOverlaysThenNavigate", () => {
 
   // An overlay's Back callback is a Back STEP: the Plex player keeps its panels on one entry and peels
   // one per call. Called once, the entry stayed and the navigation was dropped 1.5 s later — `i`, `d`,
-  // Shift+W in the player closed the info panel and nothing else (deep-review E11 round 1).
+  // Shift+W in the player closed the info panel and nothing else.
   it("asks again, a render apart, when one call peels only a step off the overlay", async () => {
     const back = stubBack();
     try {
diff --git a/frontend/src/lib/history.navPosition.dom.test.tsx b/frontend/src/lib/history.navPosition.dom.test.tsx
index eb1bdd06..139501d3 100644
--- a/frontend/src/lib/history.navPosition.dom.test.tsx
+++ b/frontend/src/lib/history.navPosition.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// Back hands focus to the list item a view was left from (E11 S5): opening a Plex title from Home's
+// Back hands focus to the list item a view was left from: opening a Plex title from Home's
 // rail switches the page, which unmounts the rail, so focus used to come back to <body>. The position is
 // stamped onto the entry being left (`rememberNavPosition`) and a popstate landing on it focuses the item
 // once the page's lists are back. A landing is simulated the way the browser delivers one: the entry's
@@ -97,8 +97,8 @@ describe("rememberNavPosition · Back focuses the item a view was left from", ()
   });
 
   // A sub-view (a Plex show page) switches back in its OWN popstate listener, registered after this
-  // module's: while ours runs, focus still sits in the view being left. Measured in Chrome (deep-review
-  // E11 round 1) — Discover card → show → `j` on the show page → Back left focus on <body>.
+  // module's: while ours runs, focus still sits in the view being left. Measured in Chrome:
+  // Discover card → show → `j` on the show page → Back left focus on <body>.
   it("restores when a later popstate listener switches the view the focus was still in", async () => {
     const { unmount } = render(<Page />);
     const stamped = leaveFrom("b1", 4);
@@ -147,7 +147,7 @@ describe("rememberNavPosition · Back focuses the item a view was left from", ()
   });
 });
 
-// E28 review H1: the page region is `<main tabIndex={-1}>` (the skip link's target), so a mouse click
+// The page region is `<main tabIndex={-1}>` (the skip link's target), so a mouse click
 // on the page's blank area focuses it. The restore took that for a control the reader had chosen and
 // gave up: Back left the focus on the page instead of on the item the view was opened from.
 describe("rememberNavPosition · the focus resting on the page region", () => {
@@ -163,7 +163,7 @@ describe("rememberNavPosition · the focus resting on the page region", () => {
   });
 });
 
-describe("rememberNavPosition · the list it comes back to (deep-review E11 round 2)", () => {
+describe("rememberNavPosition · the list it comes back to", () => {
   // Discover: a title opened from "Recently added" and watched — the page's cache expires and
   // "Continue watching" fills with that very title, a rail ABOVE. Found by its place, focus landed in
   // that rail, on a title never picked.
diff --git a/frontend/src/lib/history.navRestore.reload.dom.test.tsx b/frontend/src/lib/history.navRestore.reload.dom.test.tsx
index 78f888d6..33fbe190 100644
--- a/frontend/src/lib/history.navRestore.reload.dom.test.tsx
+++ b/frontend/src/lib/history.navRestore.reload.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // The stamp `rememberNavPosition` leaves in history.state survives a reload, but module state does not:
 // the listener that reads it was installed by the first push, so after F5 the first Back onto a
-// stamped entry restored nothing (deep-review E11 round 1). Its own file, because the point is a
+// stamped entry restored nothing. Its own file, because the point is a
 // module that has made NO push yet — any other test in history.navPosition would have made one.
 import { useRef } from "react";
 import { afterEach, expect, it } from "vitest";
diff --git a/frontend/src/lib/history.subview.dom.test.ts b/frontend/src/lib/history.subview.dom.test.ts
index fde4b97a..0654ead4 100644
--- a/frontend/src/lib/history.subview.dom.test.ts
+++ b/frontend/src/lib/history.subview.dom.test.ts
@@ -2,7 +2,7 @@
 //
 // useHistorySubview: a module's active sub-view rides in history.state._sub, with optional address-bar
 // mirroring so a deep sub-view (Plex show/season/info/person/playlist) is bookmarkable. This backfills
-// the E4 deep-review's deferred coverage for the S2 fix — the seed AND the popstate handler must share
+// the coverage a review found missing — the seed AND the popstate handler must share
 // the SAME URL fallback, so a popstate that lands on a bookmark entry (URL-only, no _sub — e.g. after
 // an overlay's programmatic history.back()) restores the sub-view from the URL instead of collapsing
 // it to root. The overlay/back-ladder half of history.ts is covered in history.dom.test.ts.
@@ -77,7 +77,7 @@ describe("useHistorySubview open", () => {
     expect(window.location.search).toBe(""); // ?v dropped
   });
 
-  // E24: a cross-module hand-off (Home plays a Plex title) arrives on an entry the page navigation
+  // A cross-module hand-off (Home plays a Plex title) arrives on an entry the page navigation
   // just pushed. Opening the sub-view on TOP of it stranded the user on a module root they never
   // visited — browser-Back from the player landed on the Plex Discover page instead of Home
   // (measured 2026-09-06). `replace` makes the sub-view BE that entry.
@@ -121,7 +121,7 @@ describe("useHistorySubview popstate", () => {
     expect(result.current.view).toBe("a");
   });
 
-  it("restores from the ?<key> URL when the landed entry has no _sub — the S2 bookmark fix", () => {
+  it("restores from the ?<key> URL when the landed entry has no _sub — the bookmark fix", () => {
     // Start in-app at root, then a popstate lands on a URL-only bookmark entry (no _sub). Reading
     // history.state alone would wrongly collapse to root; the shared URL fallback must decode ?v=b.
     const { result } = renderHook(() => useHistorySubview("root", url));
@@ -139,7 +139,7 @@ describe("useHistorySubview popstate", () => {
   });
 });
 
-// E28 review E1: a one-shot flag the view is OPENED with (the Plex player's `fromStart`, a card's
+// A one-shot flag the view is OPENED with (the Plex player's `fromStart`, a card's
 // Restart) rode in history.state._sub, so a reload or a Forward onto that entry restarted from 0
 // again — and the player's checkpoint then overwrote the resume point. `entry` says what the
 // history entry keeps of a view; the view itself still opens with the flag.
diff --git a/frontend/src/lib/history.ts b/frontend/src/lib/history.ts
index 3f136f77..28fcfd07 100644
--- a/frontend/src/lib/history.ts
+++ b/frontend/src/lib/history.ts
@@ -3,7 +3,7 @@
 //
 // Two primitives share the existing page-history (App stamps `sfPage` in history.state):
 //   - useHistorySubview: a module's active sub-view rides in history.state._sub, so Back inside
-//     a module (e.g. Messages thread → list) returns to the parent view first.
+//     a module (e.g. the sign-in card's "forgot password" → sign-in) returns to the parent view first.
 //   - useBackToClose: while an overlay/modal is mounted it occupies one history entry; Back
 //     closes the topmost one. A module-level stack keeps nesting correct — closing one modal by
 //     its own button pops exactly its entry without tripping the modals underneath.
@@ -70,7 +70,7 @@ export function subscribeNav(cb: () => void): () => void {
 // push opens a new view over it; read when Back/Forward lands on that entry, and dropped from it there,
 // so a later landing on the same entry — an overlay closing over it — cannot pull focus to an old item.
 // Installed at load, not by the first push: a stamp survives a reload in history.state, and the first
-// Back after one must still find a listener (deep-review E11 round 1).
+// Back after one must still find a listener.
 let cancelNavRestore = () => {};
 if (typeof window !== "undefined") {
   window.addEventListener("popstate", (e) => {
@@ -196,12 +196,12 @@ export function useHistorySubview<T>(
 // Back walked off the app entirely instead of closing the modal. Coalescing removes both.
 //
 // A navigation never lands UNDER an open overlay: `setPage` and `openChannel` close every overlay
-// first and push only once their entries are back (`closeOverlaysThenNavigate`). The design before
-// E11 let the push land above the overlays and "buried" their entries with a counter, and that
+// first and push only once their entries are back (`closeOverlaysThenNavigate`). An earlier design
+// let the push land above the overlays and "buried" their entries with a counter, and that
 // counter was a whole family of bugs — a burial spent by a different overlay closing first, a
 // navigation that could not report whether it pushed and was assumed to have, one browser Back that
 // both undid the navigation AND closed the dialog above it, and the dead Back press after that (the
-// last two measured in Chrome, E11 S1). With nothing ever buried, the stack and the history agree by
+// last two measured in Chrome). With nothing ever buried, the stack and the history agree by
 // construction.
 type Overlay = { token: number; cb: () => void };
 const overlayStack: Overlay[] = [];
@@ -280,7 +280,7 @@ const RECLOSE_MS = 50;
  *  silently does nothing but close. PlayerModal hit it first; the command palette the day it was
  *  written.
  *
- *  It waits for a STATE, not an event. The helper before E11 waited for "a popstate" plus a 250 ms
+ *  It waits for a STATE, not an event. An earlier helper waited for "a popstate" plus a 250 ms
  *  fallback — but one reconcile can issue several back()s, an overlay closed in the tick it opened
  *  issues none, and the fallback then ran with back()s still in flight. Here the reconcile and every
  *  popstate re-check one predicate.
diff --git a/frontend/src/lib/homeIntent.ts b/frontend/src/lib/homeIntent.ts
index ad20cee1..ca17bec1 100644
--- a/frontend/src/lib/homeIntent.ts
+++ b/frontend/src/lib/homeIntent.ts
@@ -1,7 +1,7 @@
 import { ensureNavId, peekNavId } from "./history";
 import { createStore } from "./store";
 
-// A one-shot "…and surprise me straight away" request for the Home surface (E24), handed over by
+// A one-shot "…and surprise me straight away" request for the Home surface, handed over by
 // callers that cannot reach its state — today the command palette's "Meglepetés".
 //
 // A TOKEN that waits, not an event that fires: Home is a lazy module and is normally NOT mounted
diff --git a/frontend/src/lib/hoverAndLink.contract.test.ts b/frontend/src/lib/hoverAndLink.contract.test.ts
index c222876c..e7870ae0 100644
--- a/frontend/src/lib/hoverAndLink.contract.test.ts
+++ b/frontend/src/lib/hoverAndLink.contract.test.ts
@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 
 import { eslint } from "./lintProbe.testkit";
 
-// Three E28-audit rules in eslint.config.js, pinned so a selector that stops matching cannot pass for
+// Three audit rules in eslint.config.js, pinned so a selector that stops matching cannot pass for
 // a clean codebase: a hover that swaps a colour instead of the B3 state layer, an <a> that holds only a
 // glyph (DESIGN.md "A link that looks like a button" is IconLink), and a palette colour (F16).
 
@@ -13,7 +13,6 @@ async function messages(source: string, starts: string): Promise<number> {
 const swaps = (src: string) => messages(src, "hover by a colour swap");
 const glyphs = (src: string) => messages(src, "a glyph-only <a>");
 const palette = (src: string) => messages(src, "a palette colour");
-const edged = (src: string) => messages(src, "a static label with an edge");
 
 describe("a hover by a colour swap", () => {
   // Assembled, so this file does not trip the very rule it probes.
@@ -74,36 +73,3 @@ describe("a palette colour", () => {
     expect(await palette(`export const g = "bg-accent text-danger border-border";\n`)).toBe(0);
   });
 });
-
-// F29: DESIGN.md "Static vs pressable": a label that does nothing is a flat Badge. A span drawn with a
-// rounded edge reads as a chip, gets clicked and does nothing (three sites and a private Badge had it).
-describe("a static label with an edge", () => {
-  const b = "border"; // assembled, as above
-
-  it("is refused, in a plain class and inside clsx", async () => {
-    const src = [
-      'import clsx from "clsx";',
-      "export const A = ({ on }: { on: boolean }) => (",
-      "  <>",
-      `    <span className="px-2 rounded-full ${b} ${b}-accent/40 text-accent">x</span>`,
-      `    <span className={clsx("rounded-lg ${b} ${b}-dashed", on && "text-accent")}>y</span>`,
-      "  </>",
-      ");",
-    ].join("\n");
-    expect(await edged(src)).toBe(2);
-  });
-
-  it("passes a flat tint, an edge on a non-label element, a span with no rounding, a drawn check mark", async () => {
-    const src = [
-      "export const B = () => (",
-      "  <>",
-      '    <span className="rounded-full bg-fg/8 text-muted">x</span>',
-      `    <div className="rounded-lg ${b} ${b}-border">y</div>`,
-      `    <span className="${b}-b ${b}-border">z</span>`,
-      `    <span className="grid h-3.5 w-3.5 rounded ${b}">✓</span>`,
-      "  </>",
-      ");",
-    ].join("\n");
-    expect(await edged(src)).toBe(0);
-  });
-});
diff --git a/frontend/src/lib/inputPrimitive.contract.test.ts b/frontend/src/lib/inputPrimitive.contract.test.ts
index 1634d3cd..dfe72bdd 100644
--- a/frontend/src/lib/inputPrimitive.contract.test.ts
+++ b/frontend/src/lib/inputPrimitive.contract.test.ts
@@ -3,7 +3,7 @@ import { describe, expect, it } from "vitest";
 import { eslint } from "./lintProbe.testkit";
 
 // `local/input-primitive` (eslint.config.js): every text field is ui/Input, Textarea or InnerInput and
-// every checkbox / slider / colour well a NativeControls primitive (docs/DESIGN.md A4, A6; E28 S3c).
+// every checkbox / slider / colour well a NativeControls primitive (docs/DESIGN.md A4, A6).
 // ~100 hand-styled boxes were swept; this pins that the rule keeping a new one out fires, and where it
 // stands down.
 const RULE = "local/input-primitive";
diff --git a/frontend/src/lib/issueDraft.test.ts b/frontend/src/lib/issueDraft.test.ts
index e4c4d391..495a8c3d 100644
--- a/frontend/src/lib/issueDraft.test.ts
+++ b/frontend/src/lib/issueDraft.test.ts
@@ -1,4 +1,4 @@
-// E16 S3: the draft a session suggests, and the markdown an issue carries. Pure, so the composer's
+// The draft a session suggests, and the markdown an issue carries. Pure, so the composer's
 // preview and what it saves are provably one computation.
 import { describe, expect, it } from "vitest";
 
diff --git a/frontend/src/lib/issueDraft.ts b/frontend/src/lib/issueDraft.ts
index 4602d936..196e4b3c 100644
--- a/frontend/src/lib/issueDraft.ts
+++ b/frontend/src/lib/issueDraft.ts
@@ -1,4 +1,4 @@
-// The issue drafted from a debug session (E16 S3) — pure functions, so what the composer shows and
+// The issue drafted from a debug session — pure functions, so what the composer shows and
 // what it saves are one computation, testable without a browser.
 //
 // The composer renders the markdown HERE, in the user's language, and the server carries it as it
@@ -58,7 +58,6 @@ export function draftSteps(
 
 /** The operating system a user agent names. Checked most specific first: Android's agent also says
  *  "Linux" — and says it first — and an iPad's also says "Mac OS X". */
-/** @internal exported for issueDraft.test.ts */
 export function osName(ua: string): string {
   const tests: [RegExp, (m: RegExpExecArray) => string][] = [
     [/Android [\d.]+/, (m) => m[0]],
diff --git a/frontend/src/lib/jobResult.dom.test.ts b/frontend/src/lib/jobResult.dom.test.ts
index 9ef045d4..98c5315b 100644
--- a/frontend/src/lib/jobResult.dom.test.ts
+++ b/frontend/src/lib/jobResult.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E30: a scheduler job's result in the reader's language, through the REAL catalog. The server's own
+// A scheduler job's result in the reader's language, through the REAL catalog. The server's own
 // one-liner was "recent={'channels_processed': 0, …}, deep={…}" — English keys and a Python repr.
 import { afterEach, describe, expect, it } from "vitest";
 import i18n, { setLanguage } from "../i18n";
@@ -66,7 +66,7 @@ describe("an older notice's one-liner", () => {
   });
 });
 
-// E31: the audit log showed a failed RSS poll as the server's English sentence ("RSS poll failed for
+// The audit log showed a failed RSS poll as the server's English sentence ("RSS poll failed for
 // all 399 channels — first: …") under a Hungarian UI. A failure the job names rides along as data.
 describe("a failed run", () => {
   const run = {
@@ -88,7 +88,7 @@ describe("a failed run", () => {
     );
   });
 
-  // E31 S5: the server raises it for an instance with one subscription too ("none of the 1 channels").
+  // The server raises it for an instance with one subscription too ("none of the 1 channels").
   it("reads one channel as one, and keeps its stop", () => {
     const t = i18n.getFixedT("en");
     expect(jobFailureText(t, { ...run.result, total: 1 }, "en")).toBe(
diff --git a/frontend/src/lib/jobResult.ts b/frontend/src/lib/jobResult.ts
index 70b7bc45..f940247a 100644
--- a/frontend/src/lib/jobResult.ts
+++ b/frontend/src/lib/jobResult.ts
@@ -7,7 +7,6 @@ import { vocabKey } from "./vocab";
  *  one-liner: `_summarize`'s "new=3, failed=0" (backend/app/scheduler.py). A flat one reads back into a
  *  result, and `enrich`'s bare count ("50") into `{enriched: 50}` as `_result_data` names it; a nested
  *  phase (a Python dict repr) or anything else does not, and stays as it was. */
-/** @internal exported for jobResult.dom.test.ts */
 export function parseSummary(summary: string | null | undefined): JobResult | null {
   if (!summary || /[{}[\]]/.test(summary)) return null;
   if (/^\d+$/.test(summary)) return { enriched: Number(summary) };
@@ -21,7 +20,7 @@ export function parseSummary(summary: string | null | undefined): JobResult | nu
   return out;
 }
 
-/** A scheduler job's result in the reader's language (E30): "új videó: 3 · sikertelen: 0". The server
+/** A scheduler job's result in the reader's language: "új videó: 3 · sikertelen: 0". The server
  *  stored "new=3, failed=0" — English keys, a Python dict repr for a nested phase. A count's key is
  *  named from `scheduler.result`, a `skipped` / `reason` word from `scheduler.skip`; an unnamed key or
  *  word shows as it is, and an `error` stays the upstream's own text (it is diagnostic). */
@@ -40,7 +39,7 @@ export function jobResultText(t: TFunction, result: JobResult, lang: string): st
 }
 
 /** A failure the job named (the server's `progress.JobFailed`: `{failure: <reason>, …params}`) in the
- *  reader's language (E31); null for any other failure, which keeps the upstream's own text. */
+ *  reader's language; null for any other failure, which keeps the upstream's own text. */
 export function jobFailureText(t: TFunction, result: unknown, lang: string): string | null {
   if (!result || typeof result !== "object") return null;
   const { failure, ...params } = result as Record<string, unknown>;
@@ -62,10 +61,10 @@ function rssCause(t: TFunction, cause: string): string {
   return t(`scheduler.rssCause.${cause}`, { defaultValue: cause });
 }
 
-/** What a job run said, as the inbox notice and the audit row both show it (E30): a title naming the job
+/** What a job run said, as the inbox notice and the audit row both show it: a title naming the job
  *  and how the run ended, and its result in the reader's language — from the data when it rode along,
  *  else read back from the English one-liner. A skipped run names only why; a failed run says the
- *  failure the job named (`jobFailureText`, E31), else keeps the upstream's own text (diagnostic). */
+ *  failure the job named (`jobFailureText`), else keeps the upstream's own text (diagnostic). */
 export function jobRunText(
   t: TFunction,
   run: { job_id: string; status?: unknown; summary?: unknown; result?: unknown },
diff --git a/frontend/src/lib/keymap.test.ts b/frontend/src/lib/keymap.test.ts
index 3118eb2a..d26edc0f 100644
--- a/frontend/src/lib/keymap.test.ts
+++ b/frontend/src/lib/keymap.test.ts
@@ -144,7 +144,7 @@ describe("dispatch", () => {
     input.remove();
   });
 
-  // E28: an Escape a menu above already took is spent — a player or page acting on it too is the
+  // An Escape a menu above already took is spent — a player or page acting on it too is the
   // double close the layer stack exists to prevent.
   it("ignores an Escape a layer already took", () => {
     const calls: string[] = [];
@@ -154,7 +154,7 @@ describe("dispatch", () => {
     expect(calls).toEqual([]);
   });
 
-  // E28 UAT: an arrow the player's settings tabs had already taken (they switch tab and prevent its
+  // UAT: an arrow the player's settings tabs had already taken (they switch tab and prevent its
   // default) ALSO sought the video 10 s. A key a focused widget consumed is spent, for every scope.
   it("ignores a key a focused widget already handled", () => {
     const calls: string[] = [];
@@ -209,7 +209,7 @@ describe("the table itself", () => {
     }
   });
 
-  // The done-condition of E10 S3: every shortcut in the app is listed in one place AND named in
+  // The keymap's contract: every shortcut in the app is listed in one place AND named in
   // both languages. A row whose label is missing would render as a raw i18n key in the help sheet.
   it("names every shortcut in both languages", () => {
     for (const s of SHORTCUTS) {
diff --git a/frontend/src/lib/keymap.ts b/frontend/src/lib/keymap.ts
index f37990a9..8b825be1 100644
--- a/frontend/src/lib/keymap.ts
+++ b/frontend/src/lib/keymap.ts
@@ -4,7 +4,7 @@ import { createStore } from "./store";
 import type { Page } from "./urlState";
 
 // ── The app's ONE keyboard map ────────────────────────────────────────────────────────────────
-// Before E10 S3 six surfaces each owned a private `keydown` listener with its own key literals and
+// Earlier, six surfaces each owned a private `keydown` listener with its own key literals and
 // its own idea of "am I typing?" — and they had drifted: `PlexPlayer` matched `case "a"` without
 // checking modifiers (so Ctrl+A, select-all, cycled the audio track) and its typing guard missed
 // `<select>` and `contentEditable`, which the other two surfaces already covered. The classic
@@ -22,7 +22,7 @@ import type { Page } from "./urlState";
 /** Which surface a shortcut belongs to. `global` is live app-wide; the rest only while that surface
  *  is mounted. The help sheet shows `global` plus the registered scopes.
  *
- *  `page`, `search` and `list` are the PAGE-LEVEL scopes (E11 S4): they act on the page underneath
+ *  `page`, `search` and `list` are the PAGE-LEVEL scopes: they act on the page underneath
  *  every overlay, so `dispatch` keeps them quiet while a layer that owns the keyboard is open. That is
  *  also what keeps them clear of the players' bare letters — the Plex player's `s` and `k` only ever
  *  run with the player's own layer up. */
@@ -78,7 +78,7 @@ export interface Shortcut {
 // focused button reports `key === " "` inconsistently across engines). A SPACE separates the two
 // steps of a sequence: `g h` is `g`, then `h` within SEQUENCE_MS.
 //
-// Owner rule (E11 D1): no new binding may need a modifier on the Hungarian QWERTZ layout — so no `/`
+// Owner rule: no new binding may need a modifier on the Hungarian QWERTZ layout — so no `/`
 // or `?` (both Shift chords there). Letters, digits, `-`, `,`, `.`, Esc/Enter/arrows only. `keyMatches`
 // compares `e.key`, so a letter follows the printed legend (the HU Z/Y swap included).
 export const SHORTCUTS = [
@@ -86,11 +86,11 @@ export const SHORTCUTS = [
   // `h`, not `?`: on a Hungarian layout `?` is a Shift chord, and the one help key people already
   // have in their fingers here is the Plex player's `h`. Making it app-wide costs no relearning.
   // `allowInInput` because the palette AUTOFOCUSES its search field: without it the typing guard ate
-  // the second Mod+K, so the toggle only ever fired one way and Chrome took the chord instead
-  // (E10 review round 1). Its handler preventDefaults, so nothing leaks to the browser either way.
+  // the second Mod+K, so the toggle only ever fired one way and Chrome took the chord instead.
+  // Its handler preventDefaults, so nothing leaks to the browser either way.
   { id: "palette", scope: "global", keys: ["Mod+k"], labelKey: "keys.palette", allowInInput: true },
   { id: "help", scope: "global", keys: ["h"], labelKey: "keys.help" },
-  // Shift+W and not a bare `w` (E24): the Plex player binds bare letters (a s d f h i k m) and `w`
+  // Shift+W and not a bare `w`: the Plex player binds bare letters (a s d f h i k m) and `w`
   // sits directly above `s`, so a blind reach for the subtitle key would yank you out of the film
   // and onto the landing page. A chord makes it the deliberate "I'm stuck — answer the question".
   { id: "home", scope: "global", keys: ["Shift+w"], labelKey: "keys.home" },
@@ -116,7 +116,6 @@ export const SHORTCUTS = [
     labelKey: "keys.goNotifications",
     page: "notifications",
   },
-  { id: "goMessages", scope: "page", keys: ["g m"], labelKey: "keys.goMessages", page: "messages" },
   {
     id: "goDownloads",
     scope: "page",
@@ -144,7 +143,7 @@ export const SHORTCUTS = [
   // --- the row context menu (wherever useContextMenu is wired) ---------------------------------
   // Its OWN scope, not `global`: only the surfaces that actually call `useContextMenu` register it,
   // so the sheet stops advertising "Open the context menu" on the feed, Plex, Downloads and Settings
-  // — where nothing answers the key (E10 review round 1). Same honest-states rule `plexBrowse` obeys.
+  // — where nothing answers the key. Same honest-states rule `plexBrowse` obeys.
   {
     id: "contextMenu",
     scope: "contextMenu",
@@ -230,7 +229,7 @@ export type ShortcutId<S extends KeyScope> = Extract<
   { scope: S; handledLocally?: undefined }
 >["id"];
 
-/** True while focus sits somewhere that swallows plain keys. The ONE definition: before S3 the
+/** True while focus sits somewhere that swallows plain keys. The ONE definition: before it the
  *  players disagreed about `<select>` and `contentEditable`, so the same keystroke was a shortcut in
  *  one and text in the other. Reads `e.target` (the focused node for a keydown) and falls back to
  *  `document.activeElement` for synthetic events that carry no target. */
@@ -259,7 +258,6 @@ function keyMatches(e: KeyboardEvent, name: string): boolean {
  *  Ctrl+A too, so select-all cycled the Plex audio track. It also means Shift+H is not `h` — a
  *  narrowing from the old `case "h": case "H":`, and the reason Shift chords can now be their own
  *  rows (Shift+← steps an episode without ← also seeking). */
-/** @internal exported for keymap.test.ts */
 export function matches(e: KeyboardEvent, chord: string): boolean {
   const parts = chord.split("+");
   const key = parts[parts.length - 1] ?? "";
@@ -274,11 +272,11 @@ export function matches(e: KeyboardEvent, chord: string): boolean {
  *  matched at the element level (Shift+F10 belongs to whichever row has focus, not to the window),
  *  but it must still go through `matches` or the table's `keys` become decoration. They had: the
  *  context menu hand-rolled `e.key === "F10" && e.shiftKey`, so Ctrl+Shift+F10 opened it too and
- *  editing the row changed the help sheet and nothing else (E10 review round 1).
+ *  editing the row changed the help sheet and nothing else.
  *
  *  Keyed on scope AND id, both as literal types: ids are only unique WITHIN a scope (`back` is on
  *  both players), so a bare `ROWS.find(s => s.id === id)` would answer for whichever came first, and
- *  a typo'd string would silently never match (round 2). */
+ *  a typo'd string would silently never match. */
 export function matchesShortcut<S extends KeyScope>(
   e: KeyboardEvent,
   scope: S,
@@ -308,7 +306,7 @@ function liveSequence(e: KeyboardEvent): typeof pending {
     return null;
   }
   if (MODIFIER_KEYS.has(e.key)) return null;
-  // A chord with a modifier cannot be a second step (no binding may need one, D1): it abandons the
+  // A chord with a modifier cannot be a second step (no binding may need one): it abandons the
   // sequence and is matched as itself, or `g` then Mod+K would open the browser's search, not ours.
   if (e.ctrlKey || e.metaKey || e.altKey || e.shiftKey) {
     pending = null;
@@ -334,7 +332,7 @@ export function dispatch<S extends KeyScope>(
   if (sequenceEvents.has(e)) return false;
   // A key a focused widget already handled is not a shortcut: every listener here is on `window`,
   // so a tablist or a keyboard drag (dnd-kit, on the document) has acted on it and prevented its
-  // default first. The player's settings tabs switched tab AND sought the video 10 s (E28 UAT).
+  // default first. The player's settings tabs switched tab AND sought the video 10 s (seen in UAT).
   if (e.defaultPrevented) return false;
   // An Escape a layer already took (a menu that just closed) is spent: a page or a player reacting to
   // it too is the double close the layer stack exists to prevent.
@@ -419,8 +417,8 @@ export function useActiveScopes(): KeyScope[] {
   const stack = scopeStack.useValue();
   // DEDUPED: a scope can be registered by more than one live component (the Playlists page and its
   // rail each mount a `useContextMenu`), and `helpLines` appends a row's chords once per occurrence —
-  // so without this the sheet rendered "⇧ F10 Menu ⇧ F10 Menu" under a duplicated React key
-  // (E10 review round 2). Innermost registration wins the ordering.
+  // so without this the sheet rendered "⇧ F10 Menu ⇧ F10 Menu" under a duplicated React key.
+  // Innermost registration wins the ordering.
   const live = [...new Set([...stack].reverse())];
   // The page-level scopes go in a FIXED order after the surfaces, not in registration order: App
   // registers `page` in its own effect, which React runs after every child's — so by mount order
@@ -476,7 +474,7 @@ export const usePaletteOpen = (): boolean => paletteOpen.useValue();
  *  `enabled` must track where those overlays (and the pages Shift+W jumps to) are actually MOUNTED.
  *  Bound unconditionally it swallowed `h` and Mod+K on the loading/Welcome/setup screens — the
  *  browser shortcut was preventDefault'ed, nothing appeared, and the flipped module-level store then
- *  popped the overlay open by itself the moment the signed-in shell mounted (E10 review round 1). */
+ *  popped the overlay open by itself the moment the signed-in shell mounted. */
 export function useGlobalKeymap(
   enabled: boolean,
   onNavigate: (page: Page) => void,
diff --git a/frontend/src/lib/layerStack.dom.test.ts b/frontend/src/lib/layerStack.dom.test.ts
index 4a9783d9..b9da0ccb 100644
--- a/frontend/src/lib/layerStack.dom.test.ts
+++ b/frontend/src/lib/layerStack.dom.test.ts
@@ -80,7 +80,7 @@ describe("layerStack Escape coordination (UX-8)", () => {
   });
 });
 
-// A layer answers TWO questions, and round 3 found they are not the same one: "do the page's own
+// A layer answers TWO questions, and a review found they are not the same one: "do the page's own
 // keys stay quiet?" and "do I take the Tab trap from the dialog below?". The recorder's step prompt
 // is the case that separates them — a field inside whatever dialog the pill is docked in, so it
 // owns the keyboard but its two controls are no trap for that dialog's many.
diff --git a/frontend/src/lib/layerStack.ts b/frontend/src/lib/layerStack.ts
index 0a1ed310..439c9aaa 100644
--- a/frontend/src/lib/layerStack.ts
+++ b/frontend/src/lib/layerStack.ts
@@ -1,6 +1,6 @@
 import { useEffect, useEffectEvent, useRef } from "react";
 
-// R8 S3 — one shared registry of open "dismissable layers" (modals, popovers, players), ordered by
+// One shared registry of open "dismissable layers" (modals, popovers, players), ordered by
 // open time. It replaces the three mutually-unaware Escape systems that each guessed at ordering with
 // its own `stopPropagation`: Modal's private `modalStack`, the popovers' document listeners, and the
 // two players' `modalCount()` checks. Now EVERY layer keeps its own key handler but coordinates
@@ -24,7 +24,7 @@ const passive = new Set<number>();
 // inside one (the recorder's step field). It must silence the page's keys — an autofocused field
 // does — yet it is not a dialog of its own, so claiming the trap left the dialog around it with
 // none, and Tab from anything outside the prompt walked into the page behind the scrim. The two
-// questions are separate; a layer answers each for itself (deep-review round 3).
+// questions are separate; a layer answers each for itself.
 const defers = new Set<number>();
 
 export function pushLayer(opts?: { passive?: boolean; trapsTab?: boolean }): number {
@@ -48,7 +48,6 @@ export function anyBlockingLayer(): boolean {
   return stack.some((id) => !passive.has(id));
 }
 
-/** @internal exported for layerStack.dom.test.ts */
 export function isTopmost(id: number): boolean {
   return stack.length > 0 && stack[stack.length - 1] === id;
 }
@@ -79,7 +78,6 @@ export function anyBlockingLayerAbove(id: number): boolean {
 // mutation; `anyLayerAbove` stays as the fallback for a layer above with no Escape handler of its own.
 // WeakSet so a spent event is GC'd without a manual sweep.
 const handledEscapes = new WeakSet<KeyboardEvent>();
-/** @internal exported for keymap.test.ts, layerStack.dom.test.ts */
 export function markEscapeHandled(e: KeyboardEvent): void {
   handledEscapes.add(e);
 }
@@ -90,7 +88,7 @@ export function escapeHandled(e: KeyboardEvent): boolean {
 /** THE close-on-Escape test for layer `id`: an Escape no layer above has taken yet, while `id` is on
  *  top — and it claims the event for `id`. Both halves are needed: a list inside a dialog closes with a
  *  synchronous flush that pops its layer before the dialog's `window` listener runs, so topmost alone
- *  read "yes" and one Escape closed the list AND the dialog (E28, the share dialog's user picker). */
+ *  read "yes" and one Escape closed the list AND the dialog (the share dialog's user picker). */
 export function takeEscape(e: KeyboardEvent, id: number): boolean {
   if (e.key !== "Escape" || escapeHandled(e) || !isTopmost(id)) return false;
   markEscapeHandled(e);
diff --git a/frontend/src/lib/lintProbe.testkit.ts b/frontend/src/lib/lintProbe.testkit.ts
index 849b8f42..40b433cc 100644
--- a/frontend/src/lib/lintProbe.testkit.ts
+++ b/frontend/src/lib/lintProbe.testkit.ts
@@ -1,3 +1,4 @@
+import { readdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 import { ESLint } from "eslint";
@@ -5,12 +6,12 @@ import { beforeAll } from "vitest";
 
 // The one ESLint the lint-rule contract tests probe with (`*.contract.test.ts` that pin a selector in
 // eslint.config.js). Its first lint loads the whole config and every plugin: ~1.5 s warm, measured at
-// 8 s cold, past vitest's 5 s per test, so the first probe of a file timed out once (E28 audit). The
+// 8 s cold, past vitest's 5 s per test, so the first probe of a file timed out once. The
 // hook below pays that cost once per test file, under its own budget; importing this registers it.
 const FRONTEND = fileURLToPath(new URL("../../", import.meta.url));
 
 // The probes lint TEXT under file names that do not exist (`__probe.tsx`, `x.ts`, a feature-folder
-// `Button.tsx`). Since E32 the src config runs type-aware rules, whose project service refuses a
+// `Button.tsx`). The src config runs type-aware rules, whose project service refuses a
 // file no tsconfig includes, so those names are let into TypeScript's default project here — the
 // probe still runs the real config, typed rules included, rather than a copy with them switched off.
 const PROBE_FILES = [
@@ -35,6 +36,12 @@ export const eslint = new ESLint({
   },
 });
 
+/** Every component file in ui/, by name — for a probe that pins which of them a rule exempts. */
+export const uiFiles = (): string[] =>
+  readdirSync(new URL("../components/ui/", import.meta.url))
+    .filter((f) => f.endsWith(".tsx") && !f.includes(".test."))
+    .sort();
+
 beforeAll(async () => {
   await eslint.lintText("", { filePath: "src/components/__probe.tsx" });
 }, 60_000);
diff --git a/frontend/src/lib/listNav.dom.test.tsx b/frontend/src/lib/listNav.dom.test.tsx
index 2f1d0956..9df0b364 100644
--- a/frontend/src/lib/listNav.dom.test.tsx
+++ b/frontend/src/lib/listNav.dom.test.tsx
@@ -87,7 +87,7 @@ describe("useListNav", () => {
     expect(screen.getByTestId("a1").getAttribute("tabindex")).toBe("-1");
   });
 
-  // The player (E11 S2) restores focus to whatever held it when it opened. If the item gave its
+  // The player restores focus to whatever held it when it opened. If the item gave its
   // tabindex back on blur, that restore would silently fail and focus would fall to <body>.
   it("keeps the item focusable after focus leaves it, so a dialog can restore onto it", () => {
     render(
@@ -112,7 +112,7 @@ describe("useListNav", () => {
     expect(focused()).toBe("a1");
   });
 
-  // Owner decision D4: j/k walk every collection on the page in reading order.
+  // Owner decision: j/k walk every collection on the page in reading order.
   it("continues into the next list, and back, in document order", () => {
     render(
       <>
@@ -272,7 +272,7 @@ describe("useListNav · measured lists (rails and plain grids)", () => {
     );
   });
 
-  // Owner decision D4: ↑↓ from a rail go to the rail above or below, not nowhere.
+  // Owner decision: ↑↓ from a rail go to the rail above or below, not nowhere.
   it("goes on from a list's bottom row to the next list's nearest item, and back up", () => {
     withLayout(
       // Two rails of four; the lower one sits 30px further right.
@@ -350,7 +350,7 @@ describe("useListNav · keys and lists it must leave alone", () => {
   });
 });
 
-describe("useListNav · the roving tabindex and a removed item (deep-review E11 round 1)", () => {
+describe("useListNav · the roving tabindex and a removed item", () => {
   // A tile that is a native <button> is a Tab stop already. A tabindex="-1" on it took it out of the
   // Tab order until the next `j` moved elsewhere: Shift+Tab back to a genre tile skipped it.
   it("leaves an item that is a Tab stop in its own right out of the tabindex it roves", () => {
@@ -430,7 +430,7 @@ describe("useListNav · the roving tabindex and a removed item (deep-review E11
   });
 });
 
-describe("useListNav · leaving the list, and naming the item (deep-review E11 round 2)", () => {
+describe("useListNav · leaving the list, and naming the item", () => {
   function Swappable({ ids }: { ids: number[] }) {
     const ref = useRef<HTMLDivElement>(null);
     useListNav(ref, { enabled: true });
@@ -514,7 +514,7 @@ describe("useListNav · leaving the list, and naming the item (deep-review E11 r
 
   // A Plex poster's open element is the whole card — badges, title, year, rating and summary — and a
   // season card's holds only the hover caption "Open show": named from that text, every season was
-  // "Open show" (deep-review E11 round 3). The item's own name wins.
+  // "Open show". The item's own name wins.
   it("names a card by the name its item gives, over the text of what it opens", () => {
     function Posters() {
       const ref = useRef<HTMLDivElement>(null);
@@ -535,7 +535,7 @@ describe("useListNav · leaving the list, and naming the item (deep-review E11 r
   });
 
   // Hide a card, then Undo in the toast that put up: focus on the toast's button is not the reader
-  // leaving the list, and `j` goes on from the card put back (deep-review E11 round 3).
+  // leaving the list, and `j` goes on from the card put back.
   it("keeps the slot when focus went to the Undo of a toast", () => {
     withLayout(
       (_, n) => ({ left: 0, top: n * 100 }),
@@ -563,7 +563,7 @@ describe("useListNav · leaving the list, and naming the item (deep-review E11 r
   });
 });
 
-describe("useListNav · Delete (E28 S3e2: a playlist row's X became the Delete key)", () => {
+describe("useListNav · Delete (a playlist row's X became the Delete key)", () => {
   function Deletable({ onDelete }: { onDelete?: boolean }) {
     const [ids, setIds] = useState([0, 1, 2]);
     const ref = useRef<HTMLDivElement>(null);
diff --git a/frontend/src/lib/listNav.scope.dom.test.tsx b/frontend/src/lib/listNav.scope.dom.test.tsx
index 64556f8f..6d77cb3f 100644
--- a/frontend/src/lib/listNav.scope.dom.test.tsx
+++ b/frontend/src/lib/listNav.scope.dom.test.tsx
@@ -2,8 +2,8 @@
 //
 // The `list` key scope — what puts j/k, the arrows and Enter on the cheat sheet — is live only while a
 // registered list has an item to land on. An empty download queue, a list still loading or one that
-// failed mounts its container all the same, and the sheet listed the keys over nothing (deep-review
-// E11 round 2). Its own file: listNav keeps module state.
+// failed mounts its container all the same, and the sheet listed the keys over nothing.
+// Its own file: listNav keeps module state.
 import { useRef } from "react";
 import { afterEach, describe, expect, it } from "vitest";
 import { cleanup, render, screen, waitFor } from "@testing-library/react";
@@ -52,7 +52,7 @@ describe("useListNav · the list key scope", () => {
     await waitFor(() => expect(scopes()).not.toContain("list"));
   });
 
-  // E28 S3e2: Delete is on the sheet only where a list can take an item out — a playlist's rows, not
+  // Delete is on the sheet only where a list can take an item out — a playlist's rows, not
   // the feed or a Plex grid, where nothing answers it.
   it("puts Delete on the sheet only for a list that removes items", async () => {
     const { rerender } = render(page(2));
diff --git a/frontend/src/lib/listNav.ts b/frontend/src/lib/listNav.ts
index 39c6d89c..daf261f1 100644
--- a/frontend/src/lib/listNav.ts
+++ b/frontend/src/lib/listNav.ts
@@ -3,7 +3,7 @@ import { dispatch, useKeyScope } from "./keymap";
 import { scrollParent } from "./listPaging";
 import { focusIsUnclaimed } from "./useFocusKeeper";
 
-// ── Keyboard navigation over lists and grids (E11 S4, UX-6) ──────────────────────────────────────
+// ── Keyboard navigation over lists and grids (UX-6) ──────────────────────────────────────────────
 // Before this, a feed card cost ~10 Tab stops (thumb, play, info, title, channel, five actions), so
 // the tenth card sat ~135 Tabs from the top of the page. `j`/`k` step from ITEM to item instead, the
 // arrows move around a grid, and Enter opens — the same thing a click on the item does.
@@ -17,10 +17,10 @@ import { focusIsUnclaimed } from "./useFocusKeeper";
 // The Tab order is untouched: an item root is NOT a Tab stop. It gets `tabindex="-1"` at the moment
 // the keyboard lands on it — one item at a time, the previous one gives it back — so Tab still walks
 // the controls inside the cards, a mouse click on a card's blank area still focuses nothing, and the
-// player's focus restore (E11 S2) can land back on the card it was opened from.
+// player's focus restore can land back on the card it was opened from.
 //
 // Every page-level list shares ONE window listener, and the lists are walked in DOCUMENT order: `j`
-// at the end of one list continues at the start of the next (owner decision D4, "reading order").
+// at the end of one list continues at the start of the next (owner decision, "reading order").
 // ←→ stay inside the list they are in; ↑ on a list's top row and ↓ on its bottom row go on to the
 // neighbouring list — the rail above or below on Home and Discover — landing on the item nearest the
 // one you left, so a column of rails reads like one grid.
@@ -50,7 +50,7 @@ const REVEAL_FRAMES = 10;
 /** Spread onto an item's ROOT element. `name` is what a screen reader calls the item while the keyboard
  *  is on it (its title) — pass it where the element Enter opens wraps the whole card (a Plex poster:
  *  badges, year, rating and summary run together), shows a caption that is not the item's name, or
- *  holds no text at all (deep-review E11 round 3).
+ *  holds no text at all.
  *
  *  `inset` draws the keyboard ring INSIDE the item. The ring sits 2 px outside by default, which a
  *  card with a gap round it has room for; an item flush against its neighbours (a log line) or against
@@ -152,8 +152,8 @@ function onFocusIn(e: FocusEvent): void {
   // for other content — like a click on <body>, which fires no focusin at all.
   else if (focusIsUnclaimed(target)) return;
   // Focus went on to page content that is not an item — the search box, a filter chip: the reader
-  // left the list, and whatever it shows next (new results) is not "the slot they were in" (deep-review
-  // E11 round 2). A layer opened FROM the item — its menu, a confirm, the Undo toast its removal put
+  // left the list, and whatever it shows next (new results) is not "the slot they were in".
+  // A layer opened FROM the item — its menu, a confirm, the Undo toast its removal put
   // up — does not count: focus comes back from it, and what it did (a hidden card, a deleted row, the
   // card put back) is what the slot is kept for. Removing the focused node itself fires no focusin.
   else if (!target?.closest?.('[data-floating-ui-portal], [role="dialog"], [data-toast-region]'))
@@ -178,7 +178,7 @@ function slotOfRemoved(delta: 1 | -1): { list: NavList; index: number } | null {
 }
 
 /** What an item is called: its own name when it gives one (`navItemAttrs`), else the open element's
- *  label or text — a title link's text is the title (deep-review E11 round 3). */
+ *  label or text — a title link's text is the title. */
 function itemName(el: HTMLElement): string {
   const open = el.querySelector("[data-nav-open]");
   return (
@@ -203,7 +203,7 @@ function focusItem(el: HTMLElement, reveal = true): void {
       roved = el;
       // A card root is a plain <div>: focused, it has no role and no name, and a screen reader read it
       // as an unlabelled run of text. While it holds the focus it is a group named after what Enter
-      // opens (deep-review E11 round 2). A row (<tr>) keeps its own role.
+      // opens. A row (<tr>) keeps its own role.
       const name = itemName(el);
       if (
         el.tagName === "DIV" &&
@@ -386,7 +386,7 @@ function refocusSlot(list: NavList, index: number, removed: HTMLElement): void {
 // ── The item a view was left from ────────────────────────────────────────────────────────────────
 // Opening something that switches the page or the view — a Plex title from Home's rail, a channel from
 // the Channels table — unmounts the list the keyboard was on, so Back used to hand focus to <body> and
-// the next `j` started over at the top (E11 S5 UAT). The history entry being left remembers the
+// the next `j` started over at the top (seen in UAT). The history entry being left remembers the
 // position (lib/history `rememberNavPosition`) and Back gives focus back to that item once its list is
 // on screen again. An overlay (the YouTube player) never unmounts the list; it restores focus itself.
 
@@ -440,7 +440,7 @@ function restoreTarget(list: NavList, pos: NavPosition): HTMLElement | null {
 /** Focus the item at `pos` once its list is on screen again. A NAMED list (a rail) is found by its
  *  name: a rail that appeared above it in the meantime — "Continue watching", filled by the very title
  *  watched in between, after the page's cache expired — shifts every place after it, and matching by
- *  place landed the focus in the wrong rail (deep-review E11 round 2). An unnamed list only by its
+ *  place landed the focus in the wrong rail. An unnamed list only by its
  *  place, and only once the page has exactly as many lists as when it was left: with more or fewer,
  *  list N may be another list, and <body> is the honest outcome. Gives up when the time is up, and at
  *  once when focus is already somewhere (the reader moved on, a dialog took it). The item is focused
@@ -469,8 +469,8 @@ export function restoreNavPosition(pos: NavPosition): () => void {
   };
   // Not inside the popstate dispatch that landed: a sub-view's own listener (`useHistorySubview`)
   // may run after ours and has not switched the view yet — focus still sits in the view being left,
-  // and "focus is already somewhere" would give up for good (measured in Chrome, deep-review E11
-  // round 1: Plex show → Back left focus on <body>). One task later the view has rendered.
+  // and "focus is already somewhere" would give up for good (measured in Chrome:
+  // Plex show → Back left focus on <body>). One task later the view has rendered.
   timer = setTimeout(attempt, 0);
   return () => clearTimeout(timer);
 }
diff --git a/frontend/src/lib/listPaging.test.ts b/frontend/src/lib/listPaging.test.ts
index f8900af5..e656a7cd 100644
--- a/frontend/src/lib/listPaging.test.ts
+++ b/frontend/src/lib/listPaging.test.ts
@@ -1,4 +1,4 @@
-// One definition of a PageUp/PageDown page for the palette and every popover list (E11, owner
+// One definition of a PageUp/PageDown page for the palette and every popover list (owner
 // request). The DOM-bound halves are covered where they are wired (CommandPalette, Combobox,
 // ActionMenu); this pins the arithmetic both lean on.
 import { describe, expect, it } from "vitest";
diff --git a/frontend/src/lib/listPaging.ts b/frontend/src/lib/listPaging.ts
index 6468535a..c1ffc45a 100644
--- a/frontend/src/lib/listPaging.ts
+++ b/frontend/src/lib/listPaging.ts
@@ -1,11 +1,10 @@
-// ── PageUp/PageDown over a list the keyboard otherwise walks row by row (E11, owner request) ─────
+// ── PageUp/PageDown over a list the keyboard otherwise walks row by row (owner request) ──────────
 // The jump-to palette (461 rows, ~11 in view) and every popover list — the sidebar's channel filter
 // over hundreds of channels, the Plex pickers, the filter and sort menus — had only the arrows. One
 // definition of "a page" here, so the palette and the dropdowns cannot drift apart.
 
 /**
  * A page when there is no layout to measure (jsdom, or a list not painted yet).
- * @internal exported for listPaging.test.ts
  */
 export const PAGE_FALLBACK = 10;
 
diff --git a/frontend/src/lib/log.contract.test.ts b/frontend/src/lib/log.contract.test.ts
index f6612228..72fc718c 100644
--- a/frontend/src/lib/log.contract.test.ts
+++ b/frontend/src/lib/log.contract.test.ts
@@ -4,7 +4,7 @@ import { describe, expect, it } from "vitest";
 
 import { redact, SEVERITY } from "./log";
 
-// The browser log and the server log are ONE log (E22): a client batch lands in `log_events` beside
+// The browser log and the server log are ONE log: a client batch lands in `log_events` beside
 // the server's rows. So the two must agree on what is safe to keep and on what a level is worth —
 // asserted against the backend's own files, not a copy of them.
 const backend = (path: string) =>
diff --git a/frontend/src/lib/log.ts b/frontend/src/lib/log.ts
index ce36e3bf..ce8d1b0a 100644
--- a/frontend/src/lib/log.ts
+++ b/frontend/src/lib/log.ts
@@ -1,17 +1,17 @@
-// The client log (E22 S4): the browser half of the ONE event shape `backend/app/logs.py` defines.
+// The client log: the browser half of the ONE event shape `backend/app/logs.py` defines.
 //
 // Every event is `{ts, level, sev, source: "web", event, msg, attrs, request_id?, tab_id, version}` —
 // the same fields and level names as a server line, so a client batch can land in `log_events` beside
 // the server's own rows and a request joins across the two by `request_id`.
 //
 // Events are kept in memory only, in a bounded ring: nothing leaves the browser from here. Sending
-// them is `lib/diagnostics.ts`'s job, and only while the user's consented level is raised (E22 S5);
+// them is `lib/diagnostics.ts`'s job, and only while the user's consented level is raised;
 // it and the Settings log viewer follow the ring through `subscribe`.
 //
 // REDACTION HAPPENS HERE, at capture, not at the call site — the same rules as the server's handler,
 // held to them by a fixture both test suites run (`backend/tests/fixtures/log_redaction_cases.json`).
 // A secret cannot leak by forgetting to scrub it at one call site, and a new call site is safe by
-// default. Never kept, at any level: passwords, tokens, cookies, secret config, E2EE material, email
+// default. Never kept, at any level: passwords, tokens, cookies, secret config, ciphertext, email
 // addresses. What a level ADDS (filter values at DEBUG, search strings at TRACE) is decided by the
 // call site asking `enabled(level)` before it builds the attribute.
 //
@@ -23,7 +23,6 @@ export type Level = "TRACE" | "DEBUG" | "INFO" | "WARNING" | "ERROR" | "CRITICAL
 
 /**
  * OpenTelemetry severity numbers — the same table as `logs.SEVERITY` (a contract test compares).
- * @internal exported for log.contract.test.ts
  */
 export const SEVERITY: Record<Level, number> = {
   TRACE: 1,
@@ -56,13 +55,12 @@ export interface LogEvent {
   request_id?: string;
   tab_id: string;
   version: string;
-  /** The debug session recording when the event was kept (E16). */
+  /** The debug session recording when the event was kept. */
   debug_session_id?: string;
 }
 
 /** Events kept. At ~0.5 KB each the ring stays around a megabyte — a long session's worth of
  *  navigation and requests, without growing for as long as a tab stays open. */
-/** @internal exported for log.test.ts */
 export const RING_MAX = 2000;
 
 // --- redaction (mirrors backend/app/logs.py) ------------------------------------------------------
@@ -101,7 +99,6 @@ function redactText(text: string): string {
 
 /** Recursively scrub a structure destined for the log. A value whose KEY names a secret is dropped
  *  whole — a prefix of a token is still a leak. Everything else is scrubbed as text. */
-/** @internal exported for log.contract.test.ts */
 export function redact(value: unknown, key = ""): unknown {
   const lowered = key.toLowerCase();
   if (key && SECRET_KEY_PARTS.some((part) => lowered.includes(part))) return REDACTED;
@@ -145,7 +142,7 @@ const TAB_ID = tabId();
 // --- the logger -----------------------------------------------------------------------------------
 let threshold: Level = "INFO";
 let ring: LogEvent[] = [];
-// The debug session this tab is recording into (E16), or null. Held HERE, the lowest layer, because
+// The debug session this tab is recording into, or null. Held HERE, the lowest layer, because
 // two things below everything else need it: every kept event carries it, and `api/core` puts it on
 // every request as `X-Debug-Session` — which is how the server tags its own lines of that request.
 let debugSession: string | null = null;
@@ -161,7 +158,7 @@ export function currentDebugSession(): string | null {
 }
 
 /** The capture level. INFO is the always-on "Alap"; DEBUG and TRACE come from the user's consented
- *  diagnostics level (E22 S5). */
+ *  diagnostics level. */
 export function setLevel(level: Level): void {
   threshold = level;
 }
diff --git a/frontend/src/lib/logHooks.ts b/frontend/src/lib/logHooks.ts
index b7b6b82d..4c0c90c2 100644
--- a/frontend/src/lib/logHooks.ts
+++ b/frontend/src/lib/logHooks.ts
@@ -1,6 +1,6 @@
-// The client log's app-wide hooks (E22 S4), installed once from main.tsx before anything renders:
+// The client log's app-wide hooks, installed once from main.tsx before anything renders:
 // the start snapshot, uncaught errors and rejections, navigation, connectivity, and — only while the
-// user's consented level is raised (E22 S5) — which control was used and what the tab itself went
+// user's consented level is raised — which control was used and what the tab itself went
 // through (hidden/shown, restored from the back-forward cache, resized).
 //
 // Navigation has no single choke point in this router-free app — `setPage`, the channel and search
diff --git a/frontend/src/lib/mediaLog.ts b/frontend/src/lib/mediaLog.ts
index c97b55b3..d01bbba4 100644
--- a/frontend/src/lib/mediaLog.ts
+++ b/frontend/src/lib/mediaLog.ts
@@ -1,4 +1,4 @@
-// What a player went through, for the client log (E22 S5) — one definition for every player, so a
+// What a player went through, for the client log — one definition for every player, so a
 // stall in the Plex player and one in the library player read the same in a diagnosis.
 //
 // A media ERROR is a warning at every level: it is the thing a user reports. The rest — play, pause,
diff --git a/frontend/src/lib/messagesSocket.test.ts b/frontend/src/lib/messagesSocket.test.ts
deleted file mode 100644
index c20733ca..00000000
--- a/frontend/src/lib/messagesSocket.test.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-vi.mock("./api", () => ({ getActiveAccount: () => 7 }));
-
-// A WebSocket double the test drives: each instance is recorded, and its events are fired by hand.
-class FakeSocket {
-  static all: FakeSocket[] = [];
-  url: string;
-  onopen: (() => void) | null = null;
-  onmessage: ((ev: { data: string }) => void) | null = null;
-  onclose: ((ev: { code: number; wasClean: boolean }) => void) | null = null;
-  onerror: (() => void) | null = null;
-  closed = false;
-  constructor(url: string) {
-    this.url = url;
-    FakeSocket.all.push(this);
-  }
-  close() {
-    this.closed = true; // the real close event arrives later, on its own task — fired by the test
-  }
-}
-
-beforeEach(() => {
-  vi.useFakeTimers();
-  vi.resetModules();
-  FakeSocket.all = [];
-  vi.stubGlobal("WebSocket", FakeSocket);
-  vi.stubGlobal("location", { protocol: "https:", host: "app.example" });
-});
-afterEach(() => {
-  vi.useRealTimers();
-  vi.unstubAllGlobals();
-});
-
-const frame = (sock: FakeSocket) =>
-  sock.onmessage?.({ data: JSON.stringify({ type: "message", message: { id: 1 } }) });
-
-describe("messagesSocket", () => {
-  it("a socket closed on unsubscribe cannot take over from the one a re-subscribe opened", async () => {
-    const { onMessage } = await import("./messagesSocket");
-    const first = vi.fn();
-    onMessage(first)(); // subscribe, then leave (a remount / StrictMode's double effect)
-    const got = vi.fn();
-    onMessage(got);
-    const [old, current] = FakeSocket.all;
-    expect(old!.closed).toBe(true);
-    old!.onclose?.({ code: 1000, wasClean: true }); // the OLD socket's close lands late
-
-    vi.advanceTimersByTime(60_000);
-    expect(FakeSocket.all).toHaveLength(2); // no third socket
-    frame(current!);
-    expect(got).toHaveBeenCalledOnce();
-  });
-
-  it("reconnects when the current socket drops, and logs it without the account query", async () => {
-    // Imported after resetModules, like the socket module: the ring it writes to is this instance.
-    const { onMessage } = await import("./messagesSocket");
-    const { events } = await import("./log");
-    onMessage(() => {});
-    const [sock] = FakeSocket.all;
-    expect(sock!.url).toBe("wss://app.example/api/messages/ws?account=7");
-    sock!.onopen?.();
-    sock!.onclose?.({ code: 1006, wasClean: false });
-    vi.advanceTimersByTime(1000);
-    expect(FakeSocket.all).toHaveLength(2);
-
-    const logged = events().map((e) => [e.event, e.level, e.attrs?.path]);
-    expect(logged).toEqual([
-      ["ws.open", "INFO", "/api/messages/ws"],
-      ["ws.close", "WARNING", "/api/messages/ws"],
-    ]);
-    expect(JSON.stringify(events())).not.toContain("account");
-  });
-});
diff --git a/frontend/src/lib/messagesSocket.ts b/frontend/src/lib/messagesSocket.ts
deleted file mode 100644
index 47c29474..00000000
--- a/frontend/src/lib/messagesSocket.ts
+++ /dev/null
@@ -1,137 +0,0 @@
-// Live message delivery over a WebSocket. The server pushes a {type:"message", message} frame
-// to all of a user's open tabs when a message is stored; subscribers react (e.g. refetch the
-// thread + conversations). Auto-reconnects with backoff; a low-frequency poll elsewhere is the
-// safety net if the socket is down.
-import { getActiveAccount, type Message, type MessageUser } from "./api";
-import { log } from "./log";
-
-// What the client log records of the socket: its lifecycle, and at DEBUG each frame's TYPE. Never a
-// frame's content — chat plaintext stays out of every log structurally, not by redaction. The path
-// is fixed, without the `?account=` query.
-const WS_PATH = "/api/messages/ws";
-
-// A pushed message plus both parties, so the dock can open/flash the right window.
-interface IncomingMessage {
-  message: Message;
-  from?: MessageUser;
-  to?: MessageUser;
-}
-type Handler = (e: IncomingMessage) => void;
-type UnreadHandler = () => void;
-
-const handlers = new Set<Handler>();
-const unreadHandlers = new Set<UnreadHandler>();
-let ws: WebSocket | null = null;
-let started = false;
-let backoff = 1000;
-let reconnectTimer: ReturnType<typeof setTimeout> | null = null;
-
-function url(): string {
-  const proto = location.protocol === "https:" ? "wss" : "ws";
-  // A WebSocket can't carry the X-Siftlode-Account header, so the per-tab account rides in the
-  // query string (validated against the browser wallet server-side). The account is read once
-  // here: switching accounts always goes through location.reload() (NavSidebar), which rebuilds
-  // this module and reopens the socket, so it's intentionally fixed for the socket's lifetime.
-  const account = getActiveAccount();
-  const qs = account != null ? `?account=${account}` : "";
-  return `${proto}://${location.host}${WS_PATH}${qs}`;
-}
-
-function open() {
-  let sock: WebSocket;
-  try {
-    sock = new WebSocket(url());
-  } catch (e) {
-    log.warn("ws.failed", "could not open the socket", { path: WS_PATH, message: String(e) });
-    schedule();
-    return;
-  }
-  ws = sock;
-  // Every handler checks it still belongs to the CURRENT socket. A socket closed by the last
-  // subscriber leaving closes asynchronously: when a subscriber came back in between (a remount,
-  // StrictMode's double effect) a newer socket is already open, and the old one's close used to
-  // clear that newer reference and schedule a THIRD — two live sockets, every message delivered twice.
-  sock.onopen = () => {
-    if (ws !== sock) return;
-    log.info("ws.open", "socket open", { path: WS_PATH });
-    backoff = 1000;
-  };
-  sock.onmessage = (ev) => {
-    if (ws !== sock) return;
-    try {
-      const data = JSON.parse(ev.data);
-      log.debug("ws.frame", "socket frame", { path: WS_PATH, type: String(data?.type) });
-      if (data?.type === "message" && data.message) {
-        const e: IncomingMessage = {
-          message: data.message as Message,
-          from: data.from,
-          to: data.to,
-        };
-        for (const h of handlers) h(e);
-      } else if (data?.type === "unread") {
-        // Sent to a user's OTHER tabs when they read a thread elsewhere, so the badge updates live.
-        for (const h of unreadHandlers) h();
-      }
-    } catch {
-      /* ignore malformed frames */
-    }
-  };
-  sock.onclose = (ev) => {
-    const current = ws === sock;
-    // A socket we let go of (the last subscriber left) closing is routine; the current one closing
-    // is the server or the network going away, and the reconnect that follows is worth seeing.
-    (current ? log.warn : log.info)("ws.close", "socket closed", {
-      path: WS_PATH,
-      code: ev.code,
-      clean: ev.wasClean,
-      reconnect_ms: current && started ? backoff : null,
-    });
-    if (!current) return;
-    ws = null;
-    if (started) schedule();
-  };
-  sock.onerror = () => {
-    sock.close();
-  };
-}
-
-function schedule() {
-  if (reconnectTimer) return;
-  reconnectTimer = setTimeout(() => {
-    reconnectTimer = null;
-    if (started) open();
-  }, backoff);
-  backoff = Math.min(backoff * 2, 30000);
-}
-
-// Subscribe to live messages. Opens the socket on the first subscriber and closes it when the
-// last one leaves.
-export function onMessage(h: Handler): () => void {
-  handlers.add(h);
-  if (!started) {
-    started = true;
-    open();
-  }
-  return () => {
-    handlers.delete(h);
-    if (handlers.size === 0) {
-      started = false;
-      if (reconnectTimer) {
-        clearTimeout(reconnectTimer);
-        reconnectTimer = null;
-      }
-      ws?.close();
-      ws = null;
-    }
-  };
-}
-
-// Subscribe to "your unread changed elsewhere" pings (a read on another tab/device). The socket is
-// already opened/closed by onMessage subscribers (the app-wide ChatDock keeps one), so this only
-// registers a callback — it does not open the socket on its own.
-export function onUnread(h: UnreadHandler): () => void {
-  unreadHandlers.add(h);
-  return () => {
-    unreadHandlers.delete(h);
-  };
-}
diff --git a/frontend/src/lib/messaging.ts b/frontend/src/lib/messaging.ts
deleted file mode 100644
index 88b964d7..00000000
--- a/frontend/src/lib/messaging.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-// Shared messaging helpers used by both the Messages page and the floating chat dock.
-import { useSyncExternalStore } from "react";
-import { qk } from "./queryKeys";
-import { useQuery } from "@tanstack/react-query";
-import { api } from "./api";
-import { forgetConv, isUnlocked, subscribeUnlock } from "./e2ee";
-
-export const SYSTEM_ID = 0; // synthetic "Siftlode" system conversation partner id
-
-// Safety-net poll interval for message queries; live updates arrive over the WebSocket.
-export const POLL_MS = 20000;
-
-// Cache of partner public keys (the server is the directory). Keys are stable in normal use, but a
-// partner can rotate theirs via a passphrase reset — refreshPartnerPub() evicts a stale entry (and
-// its derived conversation key) so the next fetch picks up the new key.
-const pubCache = new Map<number, string>();
-export async function partnerPub(partnerId: number): Promise<string> {
-  const cached = pubCache.get(partnerId);
-  if (cached) return cached;
-  const r = await api.messagePublicKey(partnerId);
-  pubCache.set(partnerId, r.public_key);
-  return r.public_key;
-}
-
-// Drop a partner's cached public key + derived conversation key and refetch. Called after a decrypt
-// fails, which can mean the partner reset their passphrase and published a NEW keypair; refetching
-// lets this device both read their new messages and encrypt future ones under the current key.
-//
-// KNOWN LIMITATION: this refresh is wired only to the DECRYPT path. If you send a partner a message
-// AFTER they rotated their key but BEFORE any of their messages arrived to trigger a refresh, that
-// one send is encrypted under the stale cached key and is undecryptable for them (subsequent sends
-// self-heal once an incoming message refreshes the cache). Accepted for now — same cross-user
-// staleness envelope as the multi-device note in useKeyState; a fuller fix needs a key TTL / a
-// send-time freshness check, which is out of the current no-forward-secrecy scope.
-export async function refreshPartnerPub(partnerId: number): Promise<string> {
-  pubCache.delete(partnerId);
-  forgetConv(partnerId);
-  return partnerPub(partnerId);
-}
-
-// Live "is secure messaging unlocked on this device" — shared so the page and the dock agree.
-function useUnlocked(): boolean {
-  return useSyncExternalStore(subscribeUnlock, isUnlocked, isUnlocked);
-}
-
-// The SERVER is the source of truth for whether messaging is set up. Combining it with the
-// local unlock state gives the real gate: "setup" if the server has no key (even if a stale
-// private key lingers in this browser — setup overwrites it), "unlock" if the server has a key
-// but this device hasn't unlocked it, else "ready".
-//
-// KNOWN LIMITATION (multi-device, passphrase reset): this doesn't compare the locally-unlocked
-// key's public half against the server's current public_key, so if the user resets their passphrase
-// on ANOTHER device (new keypair), this already-unlocked device stays "ready" with the now-dead old
-// key and silently fails to decrypt new messages until it's manually re-unlocked. Accepted for now:
-// it fits the E2EE scope (static pairwise key, no forward secrecy) and self-heals once the device is
-// re-unlocked with the new passphrase. Incoming-message decrypt failures on the CURRENT device DO
-// self-heal via refreshPartnerPub() (a partner's rotation), which covers the common single-device case.
-export type KeyState = "loading" | "setup" | "unlock" | "ready";
-export function useKeyState(): KeyState {
-  const unlocked = useUnlocked();
-  const q = useQuery({ queryKey: qk.messageKey(), queryFn: api.messageMyKey, staleTime: 60_000 });
-  if (q.isLoading && !q.data) return "loading";
-  if (!(q.data?.configured ?? false)) return "setup";
-  if (!unlocked) return "unlock";
-  return "ready";
-}
diff --git a/frontend/src/lib/modules.ts b/frontend/src/lib/modules.ts
index d6147779..2b64a0cf 100644
--- a/frontend/src/lib/modules.ts
+++ b/frontend/src/lib/modules.ts
@@ -6,7 +6,6 @@ import {
   Download,
   Home,
   ListVideo,
-  MessageSquare,
   ScrollText,
   FileSearch,
   Settings,
@@ -42,13 +41,12 @@ export type ModuleDef = {
   // which owns the polling queries; this only flags which modules have one).
   hasBadge?: boolean;
   // Availability for THIS account, derived from language-independent account state (plex toggle,
-  // demo restrictions, admin role). Absent = always available. Drives both the reachable module
+  // admin role). Absent = always available. Drives both the reachable module
   // set (nav + stepper) and, later, the render gate.
   gate?: (me: Me) => boolean;
 };
 
 const isAdmin = (me: Me) => me.role === "admin";
-const notDemo = (me: Me) => !me.is_demo;
 
 // Ordered in nav-rail order — this array IS the sequence the rail and the stepper walk.
 const MODULES: readonly ModuleDef[] = [
@@ -90,21 +88,12 @@ const MODULES: readonly ModuleDef[] = [
     icon: Bell,
     hasBadge: true,
   },
-  {
-    id: "messages",
-    labelKey: "messages.navLabel",
-    railKey: "nav.rail.messages",
-    icon: MessageSquare,
-    hasBadge: true,
-    gate: notDemo,
-  },
   {
     id: "downloads",
     labelKey: "downloads.navLabel",
     railKey: "nav.rail.downloads",
     icon: Download,
     hasBadge: true,
-    gate: notDemo,
   },
   {
     id: "stats",
diff --git a/frontend/src/lib/mutationFailures.contract.test.ts b/frontend/src/lib/mutationFailures.contract.test.ts
index 257abb55..42130549 100644
--- a/frontend/src/lib/mutationFailures.contract.test.ts
+++ b/frontend/src/lib/mutationFailures.contract.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 
-// Every `useMutation` NAMES what failed (E11 S2b, owner decision: the toast's title says what, the
+// Every `useMutation` NAMES what failed (owner decision: the toast's title says what, the
 // line under it why). The app-wide reporter (lib/queryClient) reports a mutation that names nothing
 // too — so nothing is silent any more — but under the generic "Couldn't complete that", which is the
 // very toast that says nothing about what it is about when it lands a few seconds after the click.
@@ -12,7 +12,7 @@ import { describe, expect, it } from "vitest";
 //                                  under the title from `meta` if there is one).
 //
 // The assertion pins the SET of unnamed mutations, never a count, and checks the glob matched at
-// all: a guard whose glob stops matching is green over nothing (E10 review round 4, round 7).
+// all: a guard whose glob stops matching is green over nothing.
 const NAMES = /\bfailTitle\b|\berrorShownInline\b|\bonError\b/;
 
 /** The source of each `useMutation(...)` call, found by paren balance with comments stripped —
diff --git a/frontend/src/lib/nav.ts b/frontend/src/lib/nav.ts
index 53716af5..c008b50b 100644
--- a/frontend/src/lib/nav.ts
+++ b/frontend/src/lib/nav.ts
@@ -12,7 +12,7 @@ export function setNavigator(fn: (p: Page) => void): void {
 /** The "View" on a "Download added" toast is clicked INSIDE the player (its toast host). That is
  *  safe because `setPage` closes every open overlay before it pushes (see
  *  `lib/history.closeOverlaysThenNavigate`) — without it the player's Back-to-close cleanup popped the
- *  entry the navigation had just pushed (deep-review round 4). */
+ *  entry the navigation had just pushed. */
 export function navigateTo(p: Page): void {
   _navigate?.(p);
 }
diff --git a/frontend/src/lib/navPosition.wiring.contract.test.ts b/frontend/src/lib/navPosition.wiring.contract.test.ts
index 1cb12cbc..e1e1a446 100644
--- a/frontend/src/lib/navPosition.wiring.contract.test.ts
+++ b/frontend/src/lib/navPosition.wiring.contract.test.ts
@@ -1,14 +1,14 @@
 import { describe, expect, it } from "vitest";
 
 // Every push that opens a new view over the current one remembers the list item it was opened from
-// (`lib/history.rememberNavPosition`), so Back hands focus back to that item (E11 S5). A push that
+// (`lib/history.rememberNavPosition`), so Back hands focus back to that item. A push that
 // forgets strands keyboard focus on <body> again with no test noticing — the flow only shows in a real
 // browser, after a round trip. So the source is the check: each `history.pushState(` in the app has a
 // `rememberNavPosition(` right before it or inside its arguments. The overlay stack's own push is the
 // one exception — an overlay entry opens no view, and its list stays mounted underneath.
 //
 // The assertion pins the SET of offending sites and checks the scan found pushes at all: a guard whose
-// glob stops matching is green over nothing (E10 review round 4).
+// glob stops matching is green over nothing.
 
 const files = import.meta.glob(["../**/*.ts", "../**/*.tsx", "!../**/*.test.*"], {
   query: "?raw",
diff --git a/frontend/src/lib/navRing.contract.test.ts b/frontend/src/lib/navRing.contract.test.ts
index 5f4c4f8f..822caa51 100644
--- a/frontend/src/lib/navRing.contract.test.ts
+++ b/frontend/src/lib/navRing.contract.test.ts
@@ -7,7 +7,7 @@ import { navItemAttrs } from "./listNav";
 // The keyboard ring of a list item (`[data-nav-index]`) sits 2 px OUTSIDE the item: a card with a gap
 // round it has room. A table row, a log line or a row flush in a clipping card has none — the ring ran
 // under a sticky table head and past the table's sides, and in a Plex playlist show's card it was
-// clipped away so the focus was invisible (E28, seen live). A `tr` is inset by its tag (a table
+// clipped away so the focus was invisible (seen live). A `tr` is inset by its tag (a table
 // hand-built outside DataTable was the one first reported); the others ask for `inset`. jsdom does no
 // layout, so what is pinned is the attribute and the rule that draws it inside, with every selector the
 // outside ring uses (a `:has()` one outranks a plain attribute pair).
diff --git a/frontend/src/lib/networkBoundary.contract.test.ts b/frontend/src/lib/networkBoundary.contract.test.ts
index 9b6ac727..b62d5215 100644
--- a/frontend/src/lib/networkBoundary.contract.test.ts
+++ b/frontend/src/lib/networkBoundary.contract.test.ts
@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 
 import { eslint } from "./lintProbe.testkit";
 
-// E22 S4 put "every request is logged" into eslint.config.js, not prose: `fetch`, `XMLHttpRequest`
+// "Every request is logged" lives in eslint.config.js, not prose: `fetch`, `XMLHttpRequest`
 // and `WebSocket` each belong to ONE module that logs them, and `console` to none. A restriction
 // that matches nothing looks exactly like a clean codebase, so this asserts the rules FIRE — and
 // that each owner is exempt from its own global only.
@@ -34,7 +34,6 @@ describe("network and console boundary", () => {
   it.each([
     ["src/lib/http.ts", "fetch"],
     ["src/lib/api/core.ts", "XMLHttpRequest"],
-    ["src/lib/messagesSocket.ts", "WebSocket"],
   ])("%s may use %s — and nothing else", async (owner, own) => {
     const found = await flagged(ALL, owner);
     // Its own global goes quiet; the other two globals, the two properties and console still fire.
diff --git a/frontend/src/lib/nextPage.contract.test.ts b/frontend/src/lib/nextPage.contract.test.ts
index cefb3f5f..82402f94 100644
--- a/frontend/src/lib/nextPage.contract.test.ts
+++ b/frontend/src/lib/nextPage.contract.test.ts
@@ -2,8 +2,8 @@ import { describe, expect, it } from "vitest";
 
 import { eslint } from "./lintProbe.testkit";
 
-// eslint.config.js: a bare `fetchNextPage()` cancels the page already loading and sends it again
-// (E31 S4e). Pins that the rule keeping every call on NEXT_PAGE actually fires.
+// eslint.config.js: a bare `fetchNextPage()` cancels the page already loading and sends it again.
+// Pins that the rule keeping every call on NEXT_PAGE actually fires.
 const MESSAGE = "fetchNextPage() cancels";
 
 async function hits(source: string): Promise<number> {
diff --git a/frontend/src/lib/nextPage.dom.test.ts b/frontend/src/lib/nextPage.dom.test.ts
index 3a27d86f..cd173820 100644
--- a/frontend/src/lib/nextPage.dom.test.ts
+++ b/frontend/src/lib/nextPage.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// A next-page call while that page is still loading joins it instead of sending it again (E31 S4e):
+// A next-page call while that page is still loading joins it instead of sending it again:
 // on prod every feed page went out 2–3 times with the same cursor.
 import { InfiniteQueryObserver } from "@tanstack/react-query";
 import { describe, expect, it } from "vitest";
@@ -46,7 +46,7 @@ describe("NEXT_PAGE", () => {
     unsubscribe();
   });
 
-  // E31 S5: the join takes ANY fetch in flight. During a background refetch (an invalidation, a
+  // The join takes ANY fetch in flight. During a background refetch (an invalidation, a
   // poll) it reloads the pages already there and appends none — why a read-ahead waits it out.
   it("joins a background refetch and appends no page", async () => {
     const sent: (string | null)[] = [];
diff --git a/frontend/src/lib/nextPage.ts b/frontend/src/lib/nextPage.ts
index 0f6f4f58..b55839a3 100644
--- a/frontend/src/lib/nextPage.ts
+++ b/frontend/src/lib/nextPage.ts
@@ -3,11 +3,11 @@
  * fetch that is still in flight and sends it again with the same cursor. Our requests do not take the
  * abort signal, so the first one is not stopped: the server ran both. The feed's read-ahead effect
  * re-runs on every scroll frame, and a frame that lands before `isFetchingNextPage` turns true calls
- * again. On prod (E31 S4e) every feed page went out 2–3 times; on a 0.8 s title sort the copies
+ * again. On prod every feed page went out 2–3 times; on a 0.8 s title sort the copies
  * queued to 2.3 s. With this a second call joins the fetch already running.
  *
  * The join takes ANY fetch in flight, not only a next page: a call during a background refetch (an
- * invalidation, a poll) joins THAT, which reloads the pages already there and appends none (E31 S5).
+ * invalidation, a poll) joins THAT, which reloads the pages already there and appends none.
  * So a read-ahead also waits while the list is fetching at all (`mayReadAhead`) and runs again when
  * the fetch settles; a click uses `nextPageOnClick`.
  */
diff --git a/frontend/src/lib/nextPage.wiring.contract.test.ts b/frontend/src/lib/nextPage.wiring.contract.test.ts
index 581cfb56..b1674b08 100644
--- a/frontend/src/lib/nextPage.wiring.contract.test.ts
+++ b/frontend/src/lib/nextPage.wiring.contract.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from "vitest";
 
 // Every infinite list's read-ahead waits while the list fetches ANYTHING and runs again when the fetch
-// settles (E31 S5). A read-ahead that only checks `isFetchingNextPage` calls during a background
+// settles. A read-ahead that only checks `isFetchingNextPage` calls during a background
 // refetch, joins it through NEXT_PAGE and loads no page: the grid stalls at its loaded end until the
 // reader scrolls the range. The jsdom virtualizer measures nothing, so the wiring is pinned in source.
 const files = import.meta.glob(["../components/**/*.tsx", "!../components/**/*.test.tsx"], {
@@ -31,7 +31,7 @@ describe("an infinite list's read-ahead", () => {
   });
 
   // Retry is off, so a failed page settles at once; a read-ahead that re-runs on the settle would
-  // request it again once a round-trip while the end is in view (E31 review 2).
+  // request it again once a round-trip while the end is in view.
   it("stands down at a failed next page", () => {
     expect(source("Feed.tsx")).toMatch(
       /hasNextPage=\{!!hasNextPage && !query\.isFetchNextPageError\}/,
@@ -44,7 +44,7 @@ describe("an infinite list's read-ahead", () => {
 
 // A click joins an in-flight next page but cancels a background refetch (nextPageOnClick): through
 // NEXT_PAGE it would join the refetch and load nothing. NEXT_PAGE is only for the read-aheads, so a
-// click site that goes back to it fails here (E31 review 2: the YouTube "Load more" was missed).
+// click site that goes back to it fails here (the YouTube "Load more" was once missed).
 describe("a click that loads the next page", () => {
   const READ_AHEADS = new Set(["ui/VirtualGrid.tsx", "PlexBrowse.tsx"]);
   it("uses nextPageOnClick; NEXT_PAGE only in the read-aheads", () => {
diff --git a/frontend/src/lib/notifications.actionTtl.dom.test.ts b/frontend/src/lib/notifications.actionTtl.dom.test.ts
index b90014db..4c1106bb 100644
--- a/frontend/src/lib/notifications.actionTtl.dom.test.ts
+++ b/frontend/src/lib/notifications.actionTtl.dom.test.ts
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
 // A toast with an action (the list page's "Undo") outlives a short toast setting: its button is the
-// only way back, so it gets ACTION_TTL_MIN at least (owner, E28 S3e2). The setting still wins when it
+// only way back, so it gets ACTION_TTL_MIN at least (owner's call). The setting still wins when it
 // is longer, "never" still means never, and a plain toast keeps the reader's time.
 import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
 import {
diff --git a/frontend/src/lib/notifications.ts b/frontend/src/lib/notifications.ts
index 60b16a72..cc535420 100644
--- a/frontend/src/lib/notifications.ts
+++ b/frontend/src/lib/notifications.ts
@@ -93,9 +93,8 @@ const SETTINGS_KEY = LS.notifSettings;
 const MAX_HISTORY = 100;
 const ERROR_TTL = 15000;
 // A toast that carries an action (an "Undo") lives at least this long, whatever the reader's toast
-// time: its button is the only way back, and a 3 s toast leaves no time to reach it (owner, E28).
+// time: its button is the only way back, and a 3 s toast leaves no time to reach it (owner's call).
 // The setting still decides for longer, and "never" still means never.
-/** @internal exported for notifications.actionTtl.dom.test.ts */
 export const ACTION_TTL_MIN = 8000;
 
 // 6b: per-account notification settings (persisted by the Settings panel into the
diff --git a/frontend/src/lib/onboarding.ts b/frontend/src/lib/onboarding.ts
index 97e48b1e..cadbd976 100644
--- a/frontend/src/lib/onboarding.ts
+++ b/frontend/src/lib/onboarding.ts
@@ -22,11 +22,8 @@ const ONBOARD_DISMISSED = LS.onboardingDismissed;
 
 export function shouldAutoOpenOnboarding(me: {
   can_read: boolean;
-  is_demo?: boolean;
   google_enabled?: boolean;
 }): boolean {
-  // The shared demo account can never connect YouTube, so never nudge it to.
-  if (me.is_demo) return false;
   // YouTube connect needs Google OAuth configured on this instance. A self-host instance may run
   // email+password only — then there's nothing to connect, so don't nudge.
   if (me.google_enabled === false) return false;
diff --git a/frontend/src/lib/pageMeta.test.ts b/frontend/src/lib/pageMeta.test.ts
index 62614de7..2bca35da 100644
--- a/frontend/src/lib/pageMeta.test.ts
+++ b/frontend/src/lib/pageMeta.test.ts
@@ -11,7 +11,6 @@ const EXPECTED: Record<Page, string> = {
   channels: "header.channelManager",
   playlists: "header.account.playlists",
   notifications: "inbox.navLabel",
-  messages: "messages.navLabel",
   downloads: "downloads.navLabel",
   stats: "header.usageStats",
   plex: "plex.navLabel",
diff --git a/frontend/src/lib/planCodes.contract.test.ts b/frontend/src/lib/planCodes.contract.test.ts
new file mode 100644
index 00000000..4e3cf420
--- /dev/null
+++ b/frontend/src/lib/planCodes.contract.test.ts
@@ -0,0 +1,97 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+// The code says WHY; the plan that produced it stays in the private ops repo. A comment that cites
+// `E28 review J4`, `(R6 S3b)` or `deep-review round 5` names a document no reader of this repo has,
+// so the citation is noise at best, and at worst a rule that only makes sense next to the plan. All
+// of them were taken out at once (2026-10-04); this keeps new ones out of every tracked text file and
+// every new one not yet added (comments, docstrings, test titles, lint messages alike).
+//
+// Not scanned: Markdown (the docs and the changelog keep a decision's date and its epic as history)
+// and the Alembic migrations (each one is a dated record of what changed).
+
+const REPO = new URL("../../../", import.meta.url);
+const SKIPPED =
+  /\.(md|webp|png|jpe?g|ico|woff2?)$|^backend\/alembic\/versions\/|package-lock\.json$/;
+// the guard itself, and the metric that counts epics by the same definition
+const ALLOWED = new Set([
+  "frontend/src/lib/planCodes.contract.test.ts",
+  "scripts/audit_metrics.py",
+]);
+// Named exceptions, cut from a line before it is matched: TV episode notation (`S2 · E5`), a test
+// fixture's season or episode title (`title="S1"`, `title: "E1"`) and ruff's default rule families.
+// Anything else that looks like a code is one — `"""E30:`, `it("E36:`, `# S6:` and `S3's` included.
+const NOT_CODES = /\bS\d{1,2} ?·? ?E\d+|\btitle[=:] ?"[ES]\d{1,2}"|\bE4\/E7\/E9\b/g;
+const PLAN_CODES = [
+  // an epic (`E28`, `E9.5`, `E28/E30`), an older roadmap item (`R14`), a sprint (`S6`, `S3e2`) or a
+  // phase (`P1`) — not `E2E`, not a ruff rule (`S110`), not `S3h`, the media-card decision
+  // docs/DESIGN.md is headed by
+  /\b(?:E\d{1,2}(?:\.\d+)?|R\d{1,2}|S(?!3h\b)\d{1,2}(?:[a-z]\d?)?|P\d)\b/,
+  // a review round (`round 4`, `deep-review`)
+  /\b[Rr]ound[ -]\d|deep-review/,
+];
+
+const isPlanCode = (line: string) => {
+  const rest = line.replace(NOT_CODES, "");
+  return PLAN_CODES.some((re) => re.test(rest));
+};
+
+function tracked(): string[] {
+  const out = execFileSync(
+    "git",
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+    {
+      cwd: REPO,
+      encoding: "utf-8",
+    },
+  );
+  // a file deleted but not yet staged is still listed
+  return out
+    .split("\0")
+    .filter((f) => f && !SKIPPED.test(f) && !ALLOWED.has(f) && existsSync(new URL(f, REPO)));
+}
+
+describe("plan codes", () => {
+  it("are recognised in each form the purged citations took", () => {
+    const cited = [
+      '"""E30: the new sink.',
+      'it("E36: keeps x", () => {',
+      "// both sides (E28/E30)",
+      "# the roadmap's R6/R7 pair",
+      "// held since E9.5",
+      "// (S6) moved it",
+      "# S6: attach the acting user's cookie",
+      '"""S6 — per-user cookies',
+      "// S3's canonical upsert",
+      "// S1 justified that",
+      "// the order since P1",
+      '"""P1\'s invariant',
+      "// a sprint then a roadmap item: S2 R14",
+      "// deep-review round 4 found it",
+    ];
+    const clean = [
+      'title="E1",',
+      'title: "S1",',
+      "# ruff's default rule set (E4/E7/E9 + F)",
+      "// an E2E run",
+      "// S2 · E5 is the second episode",
+      'expect(btn.textContent).toContain("S2 · E1");',
+      "// the S3h media card",
+      '"S110", "S112",',
+    ];
+    expect(cited.filter((l) => !isPlanCode(l))).toEqual([]);
+    expect(clean.filter(isPlanCode)).toEqual([]);
+  });
+
+  it("are not cited in the code", () => {
+    const files = tracked();
+    expect(files.length).toBeGreaterThan(1000); // a scan that reads nothing is green over nothing
+    const hits = files.flatMap((f) =>
+      readFileSync(new URL(f, REPO), "utf-8")
+        .split("\n")
+        .flatMap((line, i) => (isPlanCode(line) ? [`${f}:${i + 1}: ${line.trim()}`] : [])),
+    );
+    expect(hits).toEqual([]);
+  });
+});
diff --git a/frontend/src/lib/playerModalHooks.apiload.dom.test.tsx b/frontend/src/lib/playerModalHooks.apiload.dom.test.tsx
index 54ae2e66..d2a3d327 100644
--- a/frontend/src/lib/playerModalHooks.apiload.dom.test.tsx
+++ b/frontend/src/lib/playerModalHooks.apiload.dom.test.tsx
@@ -3,7 +3,7 @@
 // The YouTube IFrame API script failing to load must END in an error state. `loadYouTubeApi` used to
 // return a promise that only ever resolved: a blocked or failed script (a content blocker, no
 // network) left the modal on an empty stage forever, with no error and no way to retry short of a
-// reload — the promise was memoised, so every later open waited on the same dead one (E32 audit).
+// reload — the promise was memoised, so every later open waited on the same dead one.
 //
 // Its own file on purpose: `loadYouTubeApi` memoises the API promise in a module-level singleton,
 // and these tests need a module instance that has never seen `window.YT`.
diff --git a/frontend/src/lib/playerModalHooks.ts b/frontend/src/lib/playerModalHooks.ts
index d2773848..d630393c 100644
--- a/frontend/src/lib/playerModalHooks.ts
+++ b/frontend/src/lib/playerModalHooks.ts
@@ -36,7 +36,6 @@ const MAX_CONSECUTIVE_ERRORS = 3;
 export const YT_API_LOAD_FAILED = -2;
 /** How long the script may take before the player gives up on it. The real answer comes in well
  *  under a second; anything near this is a blocked or stalled request, not a slow one. */
-/** @internal exported for playerModalHooks.apiload.dom.test.tsx */
 export const YT_API_TIMEOUT_MS = 15_000;
 let apiPromise: Promise<YTNamespace> | null = null;
 function loadYouTubeApi(): Promise<YTNamespace> {
@@ -156,7 +155,7 @@ export function useYtVolume({
     // Ctrl/⌘+wheel is the browser's zoom gesture — never swallow it.
     if (e.ctrlKey || e.metaKey) return;
     // Over a panel that can still scroll that way, the wheel scrolls it: the wide player's side panel
-    // holds the description, which a wheel spent on the volume could never be read past (E31).
+    // holds the description, which a wheel spent on the volume could never be read past.
     const panel =
       e.target instanceof Element ? e.target.closest<HTMLElement>("[data-wheel-scrolls]") : null;
     if (
@@ -556,7 +555,7 @@ export function useYtProgress({
     // this cleanup's late auto-mark land on the item being LEFT, which the modal then ignores. What
     // genuinely has to stay live mid-session is behind refs (currentIdRef, modeRef, navRef,
     // sessionPosRef, autoMarkedRef, errorStreakRef, playerRef) — and THAT split is the enforcement:
-    // a value that is not a snapshot does not belong in this closure. (E32: this replaced an
+    // a value that is not a snapshot does not belong in this closure. (This replaced an
     // exhaustive-deps suppression, which made the React Compiler skip the whole hook.)
   }, [activeId, mountRef, playerRef, currentIdRef, navRef, modeRef, sessionPosRef]);
 }
diff --git a/frontend/src/lib/playerStage.contract.test.ts b/frontend/src/lib/playerStage.contract.test.ts
index 4d8002aa..811a7830 100644
--- a/frontend/src/lib/playerStage.contract.test.ts
+++ b/frontend/src/lib/playerStage.contract.test.ts
@@ -4,8 +4,8 @@ import { expect, it } from "vitest";
 
 // The YouTube player's "full window" (F) is a `position: fixed; inset: 0` stage INSIDE the modal's card.
 // A fixed element is sized by the viewport only while no ancestor has a filter: a `backdrop-filter`
-// makes that ancestor its containing block. E28 S3d1 moved the card from `.glass-card` (no blur) to
-// `.glass` (blurred), and the full window shrank to a 894×161 strip inside the card (E28 audit, seen
+// makes that ancestor its containing block. A rework moved the card from `.glass-card` (no blur) to
+// `.glass` (blurred), and the full window shrank to a 894×161 strip inside the card (seen
 // live). jsdom does no layout, so what is pinned is the escape rule: while the stage is maximised, the
 // card drops its blur, with a selector that outranks `html[data-theme="dark"] .glass` (0,2,1).
 const css = readFileSync(new URL("../index.css", import.meta.url), "utf8");
diff --git a/frontend/src/lib/playerVolume.ts b/frontend/src/lib/playerVolume.ts
index face470f..61f5f726 100644
--- a/frontend/src/lib/playerVolume.ts
+++ b/frontend/src/lib/playerVolume.ts
@@ -19,7 +19,6 @@ export interface VolumeScale {
 
 /**
  * YouTube iframe API: 0–100 integers, no mute flag (level 0 IS muted).
- * @internal exported for playerVolume.test.ts
  */
 export const YT_SCALE: VolumeScale = { min: 0, max: 100, default: 100, round: true };
 /** HTML5 <video>: a 0..1 float (mute is a separate flag the caller carries). */
diff --git a/frontend/src/lib/playlistView.test.ts b/frontend/src/lib/playlistView.test.ts
index 3624373c..05d89bd7 100644
--- a/frontend/src/lib/playlistView.test.ts
+++ b/frontend/src/lib/playlistView.test.ts
@@ -3,7 +3,7 @@ import { applyView, sameOrder } from "./playlistView";
 import type { Column } from "./tableColumns";
 import type { Video } from "./api";
 
-// The playlist's view derivation (E4 S4). What makes it worth a test: the column sort and the
+// The playlist's view derivation. What makes it worth a test: the column sort and the
 // channel grouping compose — groups are ordered by channel name in the SORT's direction, and the
 // sort then applies within each group. Getting that backwards silently produces a plausible-looking
 // order, and the whole "save this order" feature writes whatever this function returned.
diff --git a/frontend/src/lib/plexBackdrop.dom.test.tsx b/frontend/src/lib/plexBackdrop.dom.test.tsx
index e24c61de..d8151892 100644
--- a/frontend/src/lib/plexBackdrop.dom.test.tsx
+++ b/frontend/src/lib/plexBackdrop.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E5 S8: the crossfading art backdrop hook. Covers the pieces that don't need real layout — that a
+// The crossfading art backdrop hook. Covers the pieces that don't need real layout — that a
 // pool paints #root + isolates it (so the z-index:-1 overlay can paint above #root's own background),
 // creates exactly one overlay layer when it may animate, and stays static (no overlay, first image
 // only) for a single image, the crossfade off, or when disabled. Then the crossfade setting itself:
diff --git a/frontend/src/lib/plexDetail.ts b/frontend/src/lib/plexDetail.ts
index f3ef8d31..c2c54de5 100644
--- a/frontend/src/lib/plexDetail.ts
+++ b/frontend/src/lib/plexDetail.ts
@@ -15,7 +15,7 @@ export function useDetailPrefs() {
   const [artBg, setArtBg] = usePref<boolean>("plexInfoArtBg", true);
   const [showCast, setShowCast] = usePref<boolean>("plexInfoCast", true);
   const [showRelated, setShowRelated] = usePref<boolean>("plexInfoRelated", true);
-  // E5 S8: slowly cross-dissolve the art backdrop through the item's backdrops/related art. Untouched,
+  // Slowly cross-dissolve the art backdrop through the item's backdrops/related art. Untouched,
   // it follows the system: off where the reader asked for less motion (prefers-reduced-motion — which
   // Windows also reports whenever its animation effects are off). Once the reader turns it on or off
   // here, that pick wins on every device: the owner never saw the crossfade, because the system signal
@@ -52,10 +52,10 @@ export type AsideSection = "facts" | "keywords" | "crew";
 
 // The movie and the show page's poster. It keeps its 2:3 (self-start, never stretched to the row: the
 // second column beside the text runs taller than the poster), and a wide hero (the @container
-// panel at 64rem+) gives it a bigger rung, so it is not a stamp beside a full text column (E31).
+// panel at 64rem+) gives it a bigger rung, so it is not a stamp beside a full text column.
 export const DETAIL_POSTER = "w-32 sm:w-44 @5xl:w-56";
 
-// The detail pages' second column (plexDetailAside, E31): which of its three sections — the TMDB facts,
+// The detail pages' second column (plexDetailAside): which of its three sections — the TMDB facts,
 // keywords and key crew — have something to show, which the reader keeps on (three per-user prefs,
 // default ON, the same on the movie and the show page), and the toggles' flips.
 export function useDetailAside(f: DetailFacts) {
@@ -101,7 +101,7 @@ export function tmdbBackdropUrl(path: string): string {
   return `https://image.tmdb.org/t/p/w1280${path}`;
 }
 
-// A faint full-viewport art backdrop that slowly cross-dissolves through a pool of images (E5 S8).
+// A faint full-viewport art backdrop that slowly cross-dissolves through a pool of images.
 //
 // Painting layer: the SETTLED image lives on the app root (#root) background — the proven full-viewport
 // layer (#root is exactly the viewport, transparent by default so the art shows through the glassy nav
@@ -211,7 +211,7 @@ export function epLabel(ep?: PlexCard | null): string | undefined {
 }
 
 // Plex names seasons in the library's language ("Season 1", "Specials"), so a Hungarian reader got
-// English there (E30). A generic name is rebuilt from the number in the reader's language; a season
+// English there. A generic name is rebuilt from the number in the reader's language; a season
 // with a name of its own ("Book One: Water") keeps it.
 const GENERIC_SEASON = /^(season \d+|specials)$/i;
 
diff --git a/frontend/src/lib/plexImage.contract.test.ts b/frontend/src/lib/plexImage.contract.test.ts
index ea996bce..6be3b85f 100644
--- a/frontend/src/lib/plexImage.contract.test.ts
+++ b/frontend/src/lib/plexImage.contract.test.ts
@@ -5,8 +5,8 @@ import { cardImage } from "./plexImage";
 
 // A card's srcset names each Plex cut by its width, and the browser picks one by that width. The
 // widths are the image proxy's (backend `app/plex/imgcache.py` SIZES), with no wire format between
-// the two: a backend-only change would have the browser pick a cut by a width it does not have (E31
-// S5). Read from source, as plexFinishMargin.contract does.
+// the two: a backend-only change would have the browser pick a cut by a width it does not have.
+// Read from source, as plexFinishMargin.contract does.
 const source = readFileSync(
   new URL("../../../backend/app/plex/imgcache.py", import.meta.url),
   "utf8",
@@ -45,12 +45,12 @@ it("names each backdrop cut by the width the proxy cuts it at", () => {
   });
 });
 
-// Every small Plex picture asks for its card-size cut through cardImage (E31 S4e, swept in S5: the
+// Every small Plex picture asks for its card-size cut through cardImage (the
 // playlist rows, the search box and the collection picker still fetched the 400px poster for a 32px
 // picture). A plain `src={…}` is allowed only where the full cut is the point or the URL is not the
 // proxy's; the SET is pinned, so a new one fails here. Every <img>'s src counts, wherever it sits
 // among the attributes and whatever its variable is called: the first cut of this test read only a
-// leading `src={…thumb…}` and missed two of the three sites it was written for (E31 review 2).
+// leading `src={…thumb…}` and missed two of the three sites it was written for.
 const plexFiles = import.meta.glob(
   [
     "../components/{Plex,plex}*.tsx",
diff --git a/frontend/src/lib/plexImage.ts b/frontend/src/lib/plexImage.ts
index 8da8264c..561cb371 100644
--- a/frontend/src/lib/plexImage.ts
+++ b/frontend/src/lib/plexImage.ts
@@ -1,4 +1,4 @@
-// A Plex picture at a card's size (E31 S4e). The image proxy cuts each picture twice (backend
+// A Plex picture at a card's size. The image proxy cuts each picture twice (backend
 // `app/plex/imgcache.py` SIZES): the full one a detail page shows and a card's `_sm` one. Cards fetched
 // the full cut — a 400px poster for a ~144px picture, the 1280px backdrop for a ~212px shelf picture.
 // A card now hands the browser both and lets it pick by the laid-out width: `sizes="auto"`, which the
diff --git a/frontend/src/lib/plexPlayerHooks.controls.dom.test.tsx b/frontend/src/lib/plexPlayerHooks.controls.dom.test.tsx
index 7fa37a5a..01c88f54 100644
--- a/frontend/src/lib/plexPlayerHooks.controls.dom.test.tsx
+++ b/frontend/src/lib/plexPlayerHooks.controls.dom.test.tsx
@@ -2,7 +2,7 @@
 //
 // The control bar must not hide while the pointer rests on it. It used to: the 3 s timer only knew
 // "paused" and "a menu is open", so with the mouse parked on the row (about to press Next) the bar
-// faded out from under it (E28 audit F22). YouTube and Plex Web both hold the bar while hovered.
+// faded out from under it. YouTube and Plex Web both hold the bar while hovered.
 import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
 import { act, renderHook } from "@testing-library/react";
 import { useControlsVisibility } from "./plexPlayerHooks";
@@ -54,9 +54,9 @@ describe("useControlsVisibility", () => {
     expect(result.current.uiVisible).toBe(false);
   });
 
-  // E28 E6 / round 2 P4: a keyboard focus in the chrome holds the bar — but only for FOCUS_HOLD_MS
+  // A keyboard focus in the chrome holds the bar — but only for FOCUS_HOLD_MS
   // after the last key, not for the whole film. The 3 s timer finds the hold, re-arms for what is
-  // left of it, and hides once it is over (E32 rewrote that re-arm without recursion).
+  // left of it, and hides once it is over (the re-arm runs without recursion).
   it("holds for a keyboard focus until 10 s after the last key, then hides", () => {
     const { result } = setup();
     act(() => {
diff --git a/frontend/src/lib/plexPlayerHooks.ts b/frontend/src/lib/plexPlayerHooks.ts
index d1d04120..c3f6c38d 100644
--- a/frontend/src/lib/plexPlayerHooks.ts
+++ b/frontend/src/lib/plexPlayerHooks.ts
@@ -32,7 +32,7 @@ import { PLEX_SCALE, normalizeVolumeIn, stepVolumeIn } from "./playerVolume";
 // watched, clears the position and scrobbles to Plex — re-performing the very write that was just
 // refused, i.e. exactly the defect this constant was introduced to close. So the invariant is
 // one-directional and it is PINNED, not described: `plexFinishMargin.contract.test.ts` reads the
-// Python and fails if this value ever drops below it (round 7).
+// Python and fails if this value ever drops below it.
 const FINISH_MARGIN_S = 30;
 
 // A live wall clock for the top bar, re-rendered every 15s (minute resolution is enough for the
@@ -71,11 +71,11 @@ export function useFullscreen(wrapRef: RefObject<HTMLElement | null>): {
 // closure rebuild: barAutoHide (per-user "never auto-hide" setting), whether a menu is open (keep the
 // bar up so it can't vanish mid-choice), and the <video> paused state (a paused video keeps the bar).
 // `holdOnHover` is the pointer resting on the chrome: the bar stays while it is there (as on YouTube
-// and Plex Web — E28 F22, it used to fade out from under a mouse parked on Next), and leaving it
-// starts a fresh 3 s. `holdOnFocus` is the same for a KEYBOARD focus in the chrome (E28 review E6): the
+// and Plex Web — it used to fade out from under a mouse parked on Next), and leaving it
+// starts a fresh 3 s. `holdOnFocus` is the same for a KEYBOARD focus in the chrome: the
 // bar must not fade from under the control a key user is on — but only for a while after the last
 // key (FOCUS_HOLD_MS). The focus never leaves the bands on its own (Escape hands it back to the ⋯), so
-// a hold without an end kept them over the whole film (round 2, P4); any key wakes them again.
+// a hold without an end kept them over the whole film; any key wakes them again.
 //
 // On touch (C3) nothing moves a mouse, so the timer is also armed by PLAYBACK starting — before, the
 // bar stayed up until the first tap however long the video played — and a tap on the picture only
@@ -155,7 +155,7 @@ export function useControlsVisibility(opts: {
       focused.current = on;
       // Only a hold that ENDS restarts the timer. A tap moving the focus out of the bands (a finger
       // never holds: its focus is not :focus-visible) re-showed them on its way to the picture, whose
-      // own toggle then hid them again — the tap did nothing on Android (round 2, P3).
+      // own toggle then hid them again — the tap did nothing on Android.
       if (was && !on) wake();
     },
     [wake],
@@ -209,8 +209,8 @@ export function usePlexProgress(opts: {
     // and the backend reads a position within `_FINISH_MARGIN_S` of the duration as a finish. So the
     // branch named "take the finish back" marked the item watched, cleared the position and
     // scrobbled to Plex within ten seconds — the refused write performed through a third route,
-    // under an error toast saying it had failed. Round 6 closed only the explicit rollback write;
-    // this closes the other three (deep-review round 7). What the refusal does take back is the
+    // under an error toast saying it had failed. An earlier fix closed only the explicit rollback
+    // write; this closes the other three. What the refusal does take back is the
     // CLAIM: the cache must not say watched, and `settle` must not re-assert it on the way out.
     let finishRefused = false;
     // `final` = a settled checkpoint (pause / page-hide / leaving the player) vs. the periodic tick.
@@ -232,14 +232,14 @@ export function usePlexProgress(opts: {
     // watch twice — and where Plex's reported duration runs more than the finish margin past the
     // real media, the checkpoint was not near-end either, so it wrote a resume position AFTER the
     // scrobble. That race is what `finish` exists to prevent; on a natural play-through it was
-    // raised a beat too late (deep-review round 5).
+    // raised a beat too late.
     const onPauseFlush = () => {
       if (videoRef.current?.ended) return;
       flush(true);
     };
     const video = videoRef.current;
     video?.addEventListener("pause", onPauseFlush);
-    // A seek is a settled position too (S2: Plex is the source of truth, so it must see the new spot
+    // A seek is a settled position too (Plex is the source of truth, so it must see the new spot
     // right away, not up to 10s later). Debounced so scrubbing — many `seeked` events in a row — pushes
     // just ONCE, once the user lands. `final=true` bypasses the backend's ≥10s push-throttle, which is
     // exactly why the debounce lives here: it bounds a scrub to one immediate Plex timeline call.
@@ -270,7 +270,7 @@ export function usePlexProgress(opts: {
     // that is when the position is final. Reading the LATEST abs/duration is the whole point of the
     // checkpoint (the resume point when leaving).
     const settle = () => {
-      // Match the language-keyed detail query (E5 S6) so the optimistic resume patch lands.
+      // Match the language-keyed detail query so the optimistic resume patch lands.
       const key = qk.plexItem(id, plexLang(i18n.language));
       if (finished) {
         // A refused finish claims nothing: the server has the item unwatched at the position the
@@ -297,7 +297,7 @@ export function usePlexProgress(opts: {
       // `finishRefused`): the cached detail said watched / position 0 while the server still had
       // the item unwatched at the last checkpoint, and the once-per-id start guard meant the
       // corrected detail arriving later was never used — the episode reopened at 0:00 with a
-      // Watched badge the server disagreed with (round 5).
+      // Watched badge the server disagreed with.
       const pos = Math.floor(absRef.current);
       const dur = durationRef.current;
       // The media's own end, not Plex's reported duration: a file shorter than its metadata (a
@@ -311,7 +311,7 @@ export function usePlexProgress(opts: {
         // position within `_FINISH_MARGIN_S` of the duration as a finish: it would set watched,
         // clear the position and scrobble to Plex. So the branch named "take the finish back"
         // performed, through a second route, exactly the write that had just been refused — while
-        // the caller's error toast was already on screen saying it had failed (round 6). The
+        // the caller's error toast was already on screen saying it had failed. The
         // credits-skip caller captures a mid-episode position and is unaffected.
         if (!ended && pos > 0 && dur > 0 && pos <= dur - FINISH_MARGIN_S)
           api.plexProgress(id, pos, dur, true).catch(() => {});
@@ -347,7 +347,7 @@ export function usePlexProgress(opts: {
  *  loading, or a resumed one that has stayed paused) it reads 0 while the film is minutes in, so the
  *  answer is where the session was ASKED to start. Anything that restarts the session "here" — an
  *  audio switch, an A/V offset, a keyboard seek — must use this: reading `abs` restarted a resume at
- *  20:00 from 0:00, and the next checkpoint saved that (deep-review round 4). */
+ *  20:00 from 0:00, and the next checkpoint saved that. */
 export function playhead(absRef: RefObject<number>, loadStartRef: RefObject<number>): number {
   return absRef.current > 0 ? absRef.current : loadStartRef.current;
 }
@@ -485,7 +485,7 @@ export function useAutoSkip(opts: {
         // (the current id, captured here — not the reactive id, which go() is about to change). The
         // write is handed to go() so a refusal takes the finish back: this path has no near-end
         // checkpoint to corroborate it, so one failed request used to leave the cache claiming
-        // watched / position 0 while the server still had the credits position (round 5).
+        // watched / position 0 while the server still had the credits position.
         const watchedWrite = api.plexSetState(id, "watched");
         watchedWrite.catch(reportWatchedErrorRef.current);
         go(nextId, watchedWrite);
diff --git a/frontend/src/lib/plexRating.ts b/frontend/src/lib/plexRating.ts
index 40cf6af2..fc0fb712 100644
--- a/frontend/src/lib/plexRating.ts
+++ b/frontend/src/lib/plexRating.ts
@@ -1,6 +1,6 @@
 // The rating badge shows the IMDb score when we have one (rendered with the imdb.com link),
 // otherwise the Plex audience score (no IMDb link/branding) — so a non-IMDb score is never
-// mislabelled as IMDb (E5 S6). Shared by the media-info panel (PlexInfo) and the show hero
+// mislabelled as IMDb. Shared by the media-info panel (PlexInfo) and the show hero
 // (PlexBrowse) so both surfaces agree. Returns null when neither score exists (no badge).
 export function pickRatingBadge(
   imdbRating?: number | null,
diff --git a/frontend/src/lib/plexSearch.ts b/frontend/src/lib/plexSearch.ts
index 7c027124..095a464d 100644
--- a/frontend/src/lib/plexSearch.ts
+++ b/frontend/src/lib/plexSearch.ts
@@ -1,4 +1,4 @@
-// The search-box scope-pill (S2): one field-scope active at a time, narrowing the Plex full-text
+// The search-box scope-pill: one field-scope active at a time, narrowing the Plex full-text
 // search to a single facet of the row. Kept in one module so the provider (state), the header
 // SearchBar (the pill UI), and the api layer (the `field` query param) share one source of truth.
 
diff --git a/frontend/src/lib/plexStats.test.ts b/frontend/src/lib/plexStats.test.ts
index f2235b6d..e1969cac 100644
--- a/frontend/src/lib/plexStats.test.ts
+++ b/frontend/src/lib/plexStats.test.ts
@@ -25,7 +25,7 @@ describe("plexStats formatters", () => {
     expect(fmtBitrate(820_000, "en")).toBe("820 kbps");
     expect(fmtBitrate(4_200_000, "en")).toBe("4.2 Mbps");
     expect(fmtBitrate(1_000_000, "en")).toBe("1.0 Mbps");
-    expect(fmtBitrate(4_200_000, "hu")).toBe("4,2 Mbps"); // E30 S3: the UI language's decimal mark
+    expect(fmtBitrate(4_200_000, "hu")).toBe("4,2 Mbps"); // the UI language's decimal mark
   });
 
   it("fmtBufferSecs shows one decimal, dashes negatives/non-finite", () => {
@@ -161,7 +161,7 @@ describe("fmtMode", () => {
 // believe. It was reading the master playlist's BANDWIDTH, and for a remux ffmpeg computes that from
 // the only stream whose rate it knows — the `-b:a 192k` AAC track — plus 10%: 192000 × 1.1 = 211200,
 // a constant that has nothing to do with the video. And the panel never said which audio or subtitle
-// track was playing, though the player has switched both since E5.
+// track was playing, though the player can switch both.
 
 describe("measured bitrate", () => {
   it("reports bytes per second of MEDIA, not of wall clock", () => {
diff --git a/frontend/src/lib/plexStats.ts b/frontend/src/lib/plexStats.ts
index a8b8aa7f..ced7d912 100644
--- a/frontend/src/lib/plexStats.ts
+++ b/frontend/src/lib/plexStats.ts
@@ -1,8 +1,8 @@
-// Pure formatters + row builder for the Plex player "stats for nerds" overlay (E6 S2). Kept free of
+// Pure formatters + row builder for the Plex player "stats for nerds" overlay. Kept free of
 // React/DOM so the number-crunching is unit-testable: the component gathers raw values off videoRef /
 // hlsRef and hands them here; this returns i18n-keyed rows the overlay renders. No data pipeline — the
 // HTML5 <video> + hls.js already expose everything (intrinsic dims, getVideoPlaybackQuality, levels).
-// The numbers are in the UI language (E30 S3: "4,2 Mbps", "12,3 mp" in Hungarian); the unit symbols of a
+// The numbers are in the UI language ("4,2 Mbps", "12,3 mp" in Hungarian); the unit symbols of a
 // stream (Mbps, kbps) are the same in both.
 
 import { formatDecimal, formatNumber, formatUnit } from "./format";
@@ -15,7 +15,7 @@ export interface PlexStatsInput {
   transport: "direct" | "hls"; // session transport (raw file vs HLS) — orthogonal to `playable`
   // For a transcode session, which encoder actually ran: true = VAAPI hardware, false = libx264
   // software, null/undefined = not a transcode (or unknown) — so the mode row can read "transcode · GPU"
-  // vs "transcode · CPU", the visible confirmation of which S1 path engaged.
+  // vs "transcode · CPU", the visible confirmation of which path engaged.
   hwEncoder?: boolean | null;
   // For a HW transcode of a 10-bit/HDR source: true = the GPU OpenCL tonemap path (HDR→SDR) engaged, so
   // the mode row can read "transcode · GPU · HDR→SDR". Absent/false for an 8-bit HW or software session.
@@ -58,7 +58,6 @@ export interface StatRow {
 const DASH = "—";
 
 // bits-per-second → "4.2 Mbps" / "820 kbps". Undefined/0 → dash (hls.js reports 0 before a level loads).
-/** @internal exported for plexStats.test.ts */
 export function fmtBitrate(bps: number | undefined, lang: string): string {
   if (!bps || bps <= 0) return DASH;
   if (bps >= 1_000_000) return `${formatDecimal(bps / 1_000_000, lang)} Mbps`;
@@ -66,14 +65,12 @@ export function fmtBitrate(bps: number | undefined, lang: string): string {
 }
 
 // Seconds of buffer ahead of the playhead → "12.3 sec" / "12,3 mp".
-/** @internal exported for plexStats.test.ts */
 export function fmtBufferSecs(s: number, lang: string): string {
   if (!Number.isFinite(s) || s < 0) return DASH;
   return formatUnit(s, "second", lang, 1);
 }
 
 // Dropped / total decoded frames, with a drop percentage once any frames have been decoded.
-/** @internal exported for plexStats.test.ts */
 export function fmtFrames(dropped: number, total: number, lang: string): string {
   if (total <= 0) return DASH;
   const pct = (dropped / total) * 100;
@@ -83,14 +80,12 @@ export function fmtFrames(dropped: number, total: number, lang: string): string
 
 // Intrinsic decoded resolution. 0×0 means the browser hasn't decoded (or can't) — an honest dash,
 // which is itself the tell for a not-yet-playable codec pre-transcode.
-/** @internal exported for plexStats.test.ts */
 export function fmtRes(w: number, h: number): string {
   if (w <= 0 || h <= 0) return DASH;
   return `${w}×${h}`;
 }
 
 // Seconds → m:ss (offsets/positions are small; hours are folded into minutes deliberately).
-/** @internal exported for plexStats.test.ts */
 export function fmtClock(s: number): string {
   if (!Number.isFinite(s) || s < 0) return DASH;
   const total = Math.floor(s);
@@ -100,7 +95,6 @@ export function fmtClock(s: number): string {
 }
 
 // hls.js active level → "2 / 4 · 1280×720" (1-based index for humans). Auto/unknown level → dash + count.
-/** @internal exported for plexStats.test.ts */
 export function fmtLevel(l: HlsLevelInfo | null): string {
   if (!l || l.total <= 0) return DASH;
   const idx = l.index >= 0 ? `${l.index + 1} / ${l.total}` : `auto / ${l.total}`;
@@ -109,7 +103,6 @@ export function fmtLevel(l: HlsLevelInfo | null): string {
 }
 
 // Video/audio codec from the active hls.js level (only HLS exposes them; direct play → dash).
-/** @internal exported for plexStats.test.ts */
 export function fmtCodec(video: string | undefined, audio: string | undefined): string {
   const v = video?.split(".")[0] || null; // "avc1.640028" → "avc1"
   const a = audio?.split(".")[0] || null;
@@ -118,11 +111,10 @@ export function fmtCodec(video: string | undefined, audio: string | undefined):
 }
 
 // Active mode, with the transcode encoder appended when known: "transcode · GPU" (VAAPI hardware) or
-// "transcode · CPU" (libx264 software) — the at-a-glance confirmation of which S1 path engaged — and a
+// "transcode · CPU" (libx264 software) — the at-a-glance confirmation of which path engaged — and a
 // "· HDR→SDR" tag when the GPU OpenCL tonemap path handled a 10-bit/HDR source ("transcode · GPU ·
 // HDR→SDR"). Non-transcode modes (direct/remux) and an unknown encoder read as the bare mode. Raw tokens
 // (not i18n'd), consistent with the other technical values in this overlay (e.g. transport "hls").
-/** @internal exported for plexStats.test.ts */
 export function fmtMode(
   playable: string,
   hwEncoder?: boolean | null,
@@ -166,7 +158,7 @@ export function buildStatRows(s: PlexStatsInput): StatRow[] {
     );
   }
   rows.push(
-    // Which audio/subtitle track is actually playing. The player has switched both since E5 and the
+    // Which audio/subtitle track is actually playing. The player can switch both, and the
     // panel never said which one you landed on — the one question "stats for nerds" was being asked.
     { key: "audio", labelKey: "plex.player.stats.audio", value: s.audioLabel || DASH },
     { key: "subtitle", labelKey: "plex.player.stats.subtitle", value: s.subLabel || DASH },
diff --git a/frontend/src/lib/plexUrlState.ts b/frontend/src/lib/plexUrlState.ts
index b02041bf..2b1c5990 100644
--- a/frontend/src/lib/plexUrlState.ts
+++ b/frontend/src/lib/plexUrlState.ts
@@ -1,5 +1,5 @@
 // Serialize the Plex-browse content state (library scope + watch-state + sort + metadata filters) to/
-// from the address bar so a Plex-browse view is bookmarkable/shareable — the S4 analogue of the feed's
+// from the address bar so a Plex-browse view is bookmarkable/shareable — the analogue of the feed's
 // urlState. Keys are NAMESPACED (`pscope`/`psort`/`pshow`/`pf`) rather than reusing the feed's bare
 // `scope`/`sort`/`show`: FeedFiltersProvider actively STRIPS its own KEYS from the URL whenever the app
 // is off the feed page, so a shared key would be deleted out from under the Plex page. The namespaced
@@ -9,7 +9,7 @@ import { parsePlexFilters, plexFiltersToParams, type PlexFilters } from "./api";
 import { decodeSortParam, encodeSortParam, type SortState } from "./columnSort";
 import { PLEX_SORT_FALLBACK } from "./plexSort";
 
-// The content state S4 mirrors. `sort` is the RAW provider SortState (scope-healed only at the point of
+// The content state this mirrors. `sort` is the RAW provider SortState (scope-healed only at the point of
 // use), so the user's real preference round-trips through the URL.
 export interface PlexUrlState {
   scope: string;
diff --git a/frontend/src/lib/pxBox.contract.test.ts b/frontend/src/lib/pxBox.contract.test.ts
index 85b507b6..598a9471 100644
--- a/frontend/src/lib/pxBox.contract.test.ts
+++ b/frontend/src/lib/pxBox.contract.test.ts
@@ -29,7 +29,7 @@ describe("a px-frozen box utility", () => {
     expect(font?.messages.some((m) => m.message.startsWith("px-frozen font size"))).toBe(true);
   });
 
-  it("is refused as a grid column's minimum (E30 review)", async () => {
+  it("is refused as a grid column's minimum", async () => {
     const mm = (n: string) => `grid-cols-[repeat(auto-fill,minmax(${n},1fr))]`;
     expect(await refused(`export const g = "grid ${mm("150px")}";\n`)).toBe(1);
     expect(await refused(`export const h = "grid ${mm("9.375rem")}";\n`)).toBe(0);
diff --git a/frontend/src/lib/queryClient.dom.test.ts b/frontend/src/lib/queryClient.dom.test.ts
index d0140000..e38ceced 100644
--- a/frontend/src/lib/queryClient.dom.test.ts
+++ b/frontend/src/lib/queryClient.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The ONE app-wide reporter for a failed mutation (E11 S2b). `req` shows its blocking dialog for
+// The ONE app-wide reporter for a failed mutation. `req` shows its blocking dialog for
 // 400/409/422/5xx only, so before this every mutation without a reporting `onError` failed in
 // silence on a 403/404/429 or a lost connection — 34 of them.
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
diff --git a/frontend/src/lib/queryClient.ts b/frontend/src/lib/queryClient.ts
index af1bde76..56722ac2 100644
--- a/frontend/src/lib/queryClient.ts
+++ b/frontend/src/lib/queryClient.ts
@@ -33,7 +33,7 @@ type FailMeta = { failTitle?: string; errorShownInline?: boolean } | undefined;
  * The ONE reporter for a failed mutation. `req` shows its blocking dialog for 400/409/422/5xx only;
  * a 403/404/429 was left to the caller and a 502–504 or network failure got just the connection
  * notice — so every `useMutation` without a reporting `onError` failed in silence: a channel hide
- * that snapped back, a share link that never revoked, a scheduler run that never started (E11 S2b
+ * that snapped back, a share link that never revoked, a scheduler run that never started (an audit
  * counted 34 such mutations). Reporting centrally means a new mutation cannot be silent.
  *
  * react-query awaits this BEFORE the mutation's own `onError`, so it waits a task: a site that
diff --git a/frontend/src/lib/queryKeys.test.ts b/frontend/src/lib/queryKeys.test.ts
index 645e7573..cff7f1c6 100644
--- a/frontend/src/lib/queryKeys.test.ts
+++ b/frontend/src/lib/queryKeys.test.ts
@@ -26,8 +26,6 @@ describe("qk — bare vs parameterized branch", () => {
     expect(qk.playlist(7)).toEqual(["playlist", 7]);
     expect(qk.ytSearch(null, 3)).toEqual(["yt-search", null, 3]);
     expect(qk.ytSearch("cats", 3)).toEqual(["yt-search", "cats", 3]);
-    expect(qk.thread(null)).toEqual(["thread", null]);
-    expect(qk.thread(42)).toEqual(["thread", 42]);
   });
 });
 
@@ -50,7 +48,6 @@ describe("qk — single-id and scalar keys", () => {
     expect(qk.myStatus()).toEqual(["my-status"]);
     expect(qk.channels()).toEqual(["channels"]);
     expect(qk.playlists()).toEqual(["playlists"]);
-    expect(qk.conversations()).toEqual(["conversations"]);
     expect(qk.downloads()).toEqual(["downloads"]);
     expect(qk.adminUsers()).toEqual(["admin-users"]);
     expect(qk.plex()).toEqual(["plex"]);
diff --git a/frontend/src/lib/queryKeys.ts b/frontend/src/lib/queryKeys.ts
index 13d608ca..c098fb48 100644
--- a/frontend/src/lib/queryKeys.ts
+++ b/frontend/src/lib/queryKeys.ts
@@ -2,19 +2,18 @@ import type { FeedFilters } from "./api";
 
 // Single source of truth for React Query keys. Every key root lives here exactly once, so a typo
 // at one of the ~200 call sites can no longer mint an orphan key that silently never invalidates
-// (the R7 driver: `["feed"]` was hand-written in 15+ files). CONTRACT: each function returns the
+// (the motive: `["feed"]` was hand-written in 15+ files). CONTRACT: each function returns the
 // SAME array shape the call sites used before, so TanStack's partial (prefix) matching is
 // unchanged — `qk.feed()` (`["feed"]`) still invalidates `qk.feed(filters)` (`["feed", filters]`).
 // Deliberately NOT bundling co-invalidations into helpers here: the clusters differ per call site
 // (some invalidate `feed` alone, others `feed` + `feed-summary`), so collapsing them would change
 // which queries refetch. Grouped invalidation stays opt-in per domain (see `invalidateDownloads`).
-// Extended per domain as R7 S2 migrates each area (S2a: feed/channels/playlists + shared roots).
 export const qk = {
   // --- shared roots (invalidated from more than one domain) ---
   me: () => ["me"] as const,
   myStatus: () => ["my-status"] as const,
   tags: () => ["tags"] as const,
-  // Per-channel suggested user tags, learned from the manual-tag pattern (E8·S4). Separate root so
+  // Per-channel suggested user tags, learned from the manual-tag pattern. Separate root so
   // accepting a suggestion can invalidate it without touching the whole tag catalog.
   tagSuggestions: () => ["tag-suggestions"] as const,
 
@@ -49,7 +48,7 @@ export const qk = {
   // arg) stays a prefix for a cross-source invalidation.
   savedViews: (...rest: unknown[]) => ["saved-views", ...rest],
 
-  // --- account / misc (R7 S2b) --- (me/myStatus/tags already declared as shared roots above)
+  // --- account / misc --- (me/myStatus/tags already declared as shared roots above)
   accounts: () => ["accounts"] as const,
   version: () => ["version"] as const,
   // Static text bundled with the app (lib/releaseNotes), one file per language: never stale.
@@ -62,12 +61,7 @@ export const qk = {
   notifications: () => ["notifications"] as const,
   notifUnread: () => ["notif-unread"] as const,
 
-  // --- messaging ---
-  conversations: () => ["conversations"] as const,
-  thread: (partnerId: number | null) => ["thread", partnerId] as const,
-  messageKey: () => ["message-key"] as const,
-  messageUnread: () => ["message-unread"] as const,
-  messageUsers: () => ["message-users"] as const,
+  // --- sharing ---
   shareRecipients: () => ["share-recipients"] as const,
 
   // --- downloads ---
@@ -93,7 +87,7 @@ export const qk = {
   adminLogs: (filters: object) => ["admin-logs", filters] as const,
   adminLogFacets: (filters: object) => ["admin-log-facets", filters] as const,
   adminStorage: () => ["admin-storage"] as const,
-  // --- debug sessions (E16) ---
+  // --- debug sessions ---
   debugSessions: () => ["debug-sessions"] as const,
   debugSession: (id: string) => ["debug-sessions", id] as const,
   debugSessionEvents: (id: string) => ["debug-sessions", id, "events"] as const,
@@ -106,14 +100,13 @@ export const qk = {
     ["debug-sessions", id, "preview", text] as const,
   adminDownloads: () => ["admin-downloads"] as const,
   adminQuota: (days: number) => ["admin-quota", days] as const,
-  demoWhitelist: () => ["demo-whitelist"] as const,
 
   // --- plex ---
   // The composite plex keys carry a heterogeneous arg list (a filters object, a ratingKeys
   // array, a "union"/"group"/"contains" discriminator), so they take a variadic pass-through:
   // the value this factory centralizes is the ROOT string, and TanStack keys are `unknown[]`
   // anyway. Single-id plex keys stay precisely typed.
-  // The Home surface (E24). `discover()` with no args is the prefix every mutation invalidates —
+  // The Home surface. `discover()` with no args is the prefix every mutation invalidates —
   // pinning something changes the shelf AND can change the hero, so the two are never invalidated
   // separately. The reroll has its own key so pressing "Mást kérek" does not refetch the rails —
   // but it sits UNDER the same root, because a sibling root ("discover-pick") is not matched by
@@ -125,7 +118,7 @@ export const qk = {
   plex: () => ["plex"] as const,
   plexWatchLink: () => ["plex-watch-link"] as const,
   plexLibrary: (...rest: unknown[]) => ["plex-library", ...rest],
-  // Discover surface (E5 S4): the rail payload keyed by scope+lang; `plexDiscover()` (no args) matches
+  // Discover surface: the rail payload keyed by scope+lang; `plexDiscover()` (no args) matches
   // both for a prefix invalidation after a watched-toggle. Surprise is its own key so the ↻ reshuffle
   // refetches it alone.
   plexDiscover: (...rest: unknown[]) => ["plex-discover", ...rest],
@@ -135,7 +128,7 @@ export const qk = {
   // card in place (and reverts it on a failure) rather than reshuffle the rail under the viewer.
   plexSurprise: (...rest: unknown[]) => ["plex-surprise", ...rest],
   plexSuggest: (...rest: unknown[]) => ["plex-suggest", ...rest],
-  // Optional trailing `lang` (E5 S6): a language switch remounts the detail with a new key so HU/EN
+  // Optional trailing `lang`: a language switch remounts the detail with a new key so HU/EN
   // metadata is cached separately. Omitting it (e.g. for a prefix invalidation) still matches both.
   plexShow: (showId?: string, lang?: string) =>
     showId !== undefined
@@ -161,13 +154,12 @@ export const qk = {
 /** The lists the SERVER puts in the reader's alphabet from the language stored in their preferences
  *  (backend `lang_for_user` → `app/collation.py`), so their keys carry no language. Once a language
  *  switch has been saved they are asked for again (App's `changeLanguage`): they re-sort, and a
- *  title-sorted feed never reads its next page under the other alphabet's cursor (E30 review). */
+ *  title-sorted feed never reads its next page under the other alphabet's cursor. */
 export const LANGUAGE_ORDERED = [
   qk.feed(),
   qk.channels(),
   qk.discoveredChannels(),
   qk.blockedChannels(),
   qk.shareRecipients(),
-  qk.messageUsers(),
   qk.plexCollections(),
 ] as const;
diff --git a/frontend/src/lib/reactEngine.contract.test.ts b/frontend/src/lib/reactEngine.contract.test.ts
index 61bfd1d2..becbfae8 100644
--- a/frontend/src/lib/reactEngine.contract.test.ts
+++ b/frontend/src/lib/reactEngine.contract.test.ts
@@ -5,10 +5,10 @@ import { expect, it } from "vitest";
 // that is spelled in two places drifts, and the drift is silent until something downstream breaks.
 //
 // Here the two places are `package.json`'s React pin and `reactPlugin.ts`'s `target`, which tells
-// babel-plugin-react-compiler which React runtime to emit memoisation against. E27 S1 wrote the rule
-// as a comment — "`target` follows the installed React major and must move with it" — and the house
-// rule this codebase was built on says a rule stated in a comment must also be enforced in code. So
-// it is enforced here.
+// babel-plugin-react-compiler which React runtime to emit memoisation against. The rule was first
+// written as a comment — "`target` follows the installed React major and must move with it" — and
+// the house rule this codebase was built on says a rule stated in a comment must also be enforced
+// in code. So it is enforced here.
 //
 // The compiler does validate the option itself (an unknown target throws at build time), which
 // bounds the damage: the failure mode is not a corrupt bundle but a STALE target — React moves to a
diff --git a/frontend/src/lib/reinsert.ts b/frontend/src/lib/reinsert.ts
index 657255b7..cce97d4f 100644
--- a/frontend/src/lib/reinsert.ts
+++ b/frontend/src/lib/reinsert.ts
@@ -1,8 +1,8 @@
 /** Where removed rows go back when their Undo comes LATER than the removal.
  *
  *  A raw index recorded at removal time drifts: an add or a reorder landing in between (another tab,
- *  the rail, the player) shifts everything after it, and the row came back one or more places off
- *  (E28 review C4). So each removed row goes back right after the row that preceded it in the list
+ *  the rail, the player) shifts everything after it, and the row came back one or more places off.
+ *  So each removed row goes back right after the row that preceded it in the list
  *  it was removed from — its neighbour, looked up in the list as it stands NOW — or at the start when
  *  it was first or no earlier neighbour is left. Rows already back in the list are skipped (the
  *  server's add is idempotent and would leave them where they are).
diff --git a/frontend/src/lib/releaseNotes.test.ts b/frontend/src/lib/releaseNotes.test.ts
index 91dead18..ac3d2e12 100644
--- a/frontend/src/lib/releaseNotes.test.ts
+++ b/frontend/src/lib/releaseNotes.test.ts
@@ -31,13 +31,13 @@ describe("release version consistency", () => {
   });
 });
 
-// E28 (owner): internal work never ships on its own — it waits for a release a user can see. So the
+// Owner rule: internal work never ships on its own — it waits for a release a user can see. So the
 // release being cut always says what changed for the user.
 it("the newest release has something a user notices", () => {
   expect(EN[0]!.new.length + EN[0]!.fixed.length).toBeGreaterThan(0);
 });
 
-// A note is a sentence or two (owner, E28): the old paragraphs were what made the dialog slow and
+// A note is a sentence or two (owner's call): the old paragraphs were what made the dialog slow and
 // unread. The ceiling is generous for Hungarian, whose words run longer.
 it("every item is short", () => {
   const long = [...EN, ...HU].flatMap((r) =>
diff --git a/frontend/src/lib/releaseNotes.ts b/frontend/src/lib/releaseNotes.ts
index bbe11e5e..6780794c 100644
--- a/frontend/src/lib/releaseNotes.ts
+++ b/frontend/src/lib/releaseNotes.ts
@@ -1,8 +1,8 @@
 // User-facing release notes: one entry per released version, newest first, as text in
 // content/release-notes/<lang>.json rather than code, so the dialog loads only the UI language's file
 // and only when it opens. A note says what a user notices, under "new" or "fixed", each item a
-// sentence or two; internal work is not listed. Internal work never ships on its own either (owner,
-// E28): it waits for the next release a user can see, so the newest entry always has an item.
+// sentence or two; internal work is not listed. Internal work never ships on its own either (owner
+// decision): it waits for the next release a user can see, so the newest entry always has an item.
 // releaseNotes.test.ts holds that, the version against VERSION, the length and the HU/EN parity, and
 // scripts/gen-changelog.mjs renders the English file as CHANGELOG.md.
 
diff --git a/frontend/src/lib/removedFeatures.contract.test.ts b/frontend/src/lib/removedFeatures.contract.test.ts
new file mode 100644
index 00000000..df509aff
--- /dev/null
+++ b/frontend/src/lib/removedFeatures.contract.test.ts
@@ -0,0 +1,51 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+// The shared demo account was removed (the owner's decision, 2026-10-04): its user, its whitelist, its
+// login entry, and every `is_demo` branch that kept it from quota, YouTube, downloads and the debug
+// recorder. A guard left behind is not harmless — it reads as a live rule, and the next reader keeps
+// it alive by copying it — so this fails on the word anywhere in the code a feature could live in:
+// the backend (app + tests), the frontend (src + e2e) and the repo scripts.
+//
+// Not scanned: the Alembic migrations (0014 added the account and 0098 removed it, and both stay true
+// as history) and the release notes, which record what shipped when. `audit_metrics.py` counts the
+// footprint by this same word, and test_migration_0098.py tests the removal itself, so both name it
+// on purpose.
+
+const REPO = new URL("../../../", import.meta.url);
+const ROOTS = ["backend/app", "backend/tests", "frontend/src", "frontend/e2e", "scripts"];
+const SKIP_DIRS = new Set(["node_modules", "__pycache__", "dist", ".speed", "release-notes"]);
+const EXTENSIONS = /\.(py|ts|tsx|js|mjs|json|css|md|sh)$/;
+const ALLOWED = new Set([
+  "frontend/src/lib/removedFeatures.contract.test.ts",
+  "scripts/audit_metrics.py",
+  "backend/tests/test_migration_0098.py",
+]);
+// "demo" as a word or an identifier part (`is_demo`, `DemoBanner`, `tryDemo`) — not "demote" (a role
+// change) and not "Demokratikus" (a country's Hungarian name in the vocab).
+const DEMO = /demo(?!t(e|ion)|kr)/i;
+
+function files(dir: string): string[] {
+  return readdirSync(new URL(dir, REPO), { withFileTypes: true }).flatMap((e) =>
+    e.isDirectory()
+      ? SKIP_DIRS.has(e.name)
+        ? []
+        : files(`${dir}/${e.name}`)
+      : EXTENSIONS.test(e.name)
+        ? [`${dir}/${e.name}`]
+        : [],
+  );
+}
+
+describe("removed features stay removed", () => {
+  it("leaves no trace of the demo account", () => {
+    const hits = ROOTS.flatMap(files)
+      .filter((f) => !ALLOWED.has(f))
+      .flatMap((f) =>
+        readFileSync(new URL(f, REPO), "utf-8")
+          .split("\n")
+          .flatMap((line, i) => (DEMO.test(line) ? [`${f}:${i + 1}: ${line.trim()}`] : [])),
+      );
+    expect(hits).toEqual([]);
+  });
+});
diff --git a/frontend/src/lib/repoScripts.contract.test.ts b/frontend/src/lib/repoScripts.contract.test.ts
index ad79c1fc..a554a816 100644
--- a/frontend/src/lib/repoScripts.contract.test.ts
+++ b/frontend/src/lib/repoScripts.contract.test.ts
@@ -8,7 +8,7 @@ import { describe, expect, it } from "vitest";
 
 // The repo-root `scripts/*.mjs` (the lock check `siftlode check` runs, the CHANGELOG generator its
 // release runs) sit outside every lint lane: the eslint and prettier lanes run from frontend/, and an
-// ESLint config cannot reach past its own directory (E32 review). This holds them to the same bar as
+// ESLint config cannot reach past its own directory. This holds them to the same bar as
 // the frontend's plain-JS config files — `js.configs.recommended` under Node, and the frontend's
 // Prettier style. Not the typed rules: they are not in a tsc project (docs/gates.md).
 
diff --git a/frontend/src/lib/rovingHighlight.contract.test.ts b/frontend/src/lib/rovingHighlight.contract.test.ts
index e422a2bf..c9492102 100644
--- a/frontend/src/lib/rovingHighlight.contract.test.ts
+++ b/frontend/src/lib/rovingHighlight.contract.test.ts
@@ -2,7 +2,7 @@ import { readdirSync, readFileSync } from "node:fs";
 
 import { describe, expect, it } from "vitest";
 
-// E28 audit F35. The keyboard row of a listbox has one look, ui/AnchoredPopover's `ROVING_HIGHLIGHT`
+// The keyboard row of a listbox has one look, ui/AnchoredPopover's `ROVING_HIGHLIGHT`
 // (a menu row, a combobox option, the command palette, the Plex typeahead). A listbox that paints its
 // own drifted: the palette's `bg-card` row was ~1.07:1 on its glass, and the Plex typeahead carried a
 // hand copy of the recipe that would not follow a change to it.
diff --git a/frontend/src/lib/saveLanguage.dom.test.ts b/frontend/src/lib/saveLanguage.dom.test.ts
index 3acbd8ab..f13de69f 100644
--- a/frontend/src/lib/saveLanguage.dom.test.ts
+++ b/frontend/src/lib/saveLanguage.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E30 review: the server orders some lists by the reader's STORED language (their keys carry none), so a
+// The server orders some lists by the reader's STORED language (their keys carry none), so a
 // switch must re-ask for them — after the save lands, not before (the server would sort in the old one).
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { QueryClient } from "@tanstack/react-query";
diff --git a/frontend/src/lib/savedViews.test.ts b/frontend/src/lib/savedViews.test.ts
index 0bb8e35e..1f292f74 100644
--- a/frontend/src/lib/savedViews.test.ts
+++ b/frontend/src/lib/savedViews.test.ts
@@ -21,7 +21,7 @@ describe("preferSticky", () => {
 
   it("without a sticky match, prefers the starred default over an earlier twin", () => {
     // The first-load seed applies the default's filters and leaves the name to this tie-break: an
-    // earlier view with the same filters must not take the default's name (E32).
+    // earlier view with the same filters must not take the default's name.
     const d = (id: number, is_default = false) => ({ id, name: `v${id}`, is_default });
     expect(preferSticky([d(1), d(2, true)], null)?.id).toBe(2);
     expect(preferSticky([d(1), d(2, true)], 99)?.id).toBe(2);
diff --git a/frontend/src/lib/sourceSize.contract.test.ts b/frontend/src/lib/sourceSize.contract.test.ts
deleted file mode 100644
index e587e12f..00000000
--- a/frontend/src/lib/sourceSize.contract.test.ts
+++ /dev/null
@@ -1,149 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  boundNamesIn,
-  complexityOffenders,
-  lineCounts,
-  MAX_COMPLEXITY,
-  MAX_LINES,
-  shippedFiles,
-} from "./sourceSize.testkit";
-
-// The size / complexity RATCHET for the shipped frontend (E32, owner 2026-10-03 — "class size" from
-// the quality checklist, measured rather than argued). Two limits, each with today's offenders as a
-// CEILING:
-//   • a file over 800 lines — the listed ones may not grow past their line count; any other
-//     file may not cross the limit;
-//   • a function over complexity 20 (eslint `complexity`, cyclomatic) — a listed one, by its
-//     NAME, may not rise; no other function may cross the limit. (Ranked per file until the E32
-//     review: one function could grow by what another in the same file lost.) A rename reads as a
-//     new offender plus a stale entry: move its row.
-// Shrinking is free; a file or function that drops UNDER the limit must be taken off its list (red
-// until it is), so the lists only get shorter. Raising a ceiling is a decision for the owner, with
-// the reason in docs/gates.md. JSX branches count toward complexity, so a component scores high by
-// construction — the limit catches the outliers, it does not grade style.
-
-const BIG_FILES: Record<string, number> = {
-  "components/AdminUsers.tsx": 993,
-  "components/Channels.tsx": 904,
-  "components/Feed.tsx": 934,
-  "components/Home.tsx": 1136,
-  "components/IssueComposer.tsx": 861,
-  "components/PlayerModal.tsx": 1142,
-  "components/Playlists.tsx": 1069,
-  "components/PlexPlayer.tsx": 1984,
-  "components/PlexPlaylistView.tsx": 830,
-  "components/plexViews.tsx": 941,
-  "components/SettingsPanel.tsx": 885,
-  "components/Welcome.tsx": 944,
-  "lib/plexPlayerHooks.ts": 922,
-};
-
-const COMPLEX: Record<string, number> = {
-  "App.tsx::App": 28,
-  "components/AccountPanel.tsx::AccountPanel": 29,
-  "components/AdminLogs.tsx::AdminLogs": 35,
-  "components/ChannelPage.tsx::ChannelPage": 91,
-  "components/Channels.tsx::Channels": 53,
-  "components/ConfigPanel.tsx::ConfigPanel": 24,
-  "components/ConfigPanel.tsx::Field": 28,
-  "components/DownloadCenter.tsx::DownloadCenter": 36,
-  "components/Feed.tsx::Feed": 64,
-  "components/Home.tsx::Hero": 32,
-  "components/Home.tsx::Home": 34,
-  "components/Home.tsx::useHomeCardMenu": 21,
-  "components/IssueComposer.tsx::ComposerBody": 34,
-  "components/KeyGate.tsx::KeyGate": 22,
-  "components/NotificationsPanel.tsx::NotificationRow": 28,
-  "components/OnboardingWizard.tsx::OnboardingWizard": 21,
-  "components/PersonalViewsModal.tsx::PersonalViewsModal": 22,
-  "components/PlayerModal.tsx::PlayerModal": 98,
-  "components/Playlists.tsx::Playlists": 66,
-  "components/PlexBrowse.tsx::PlexBrowse": 45,
-  "components/PlexCollectionView.tsx::PlexCollectionView": 41,
-  "components/PlexDiscover.tsx::PlexDiscover": 21,
-  "components/PlexInfo.tsx::PlexInfo": 65,
-  "components/PlexPlayer.tsx::onKey": 22,
-  "components/PlexPlayer.tsx::PlexPlayer": 103,
-  "components/PlexPlaylistView.tsx::PlexPlaylistView": 22,
-  "components/PlexSidebar.tsx::PlexSidebar": 32,
-  "components/PlexStatsOverlay.tsx::sample": 25,
-  "components/Scheduler.tsx::JobRow": 21,
-  "components/Scheduler.tsx::Scheduler": 21,
-  "components/SetupWizard.tsx::SetupWizard": 21,
-  "components/SyncStatus.tsx::SyncStatus": 22,
-  "components/VideoCard.tsx::VideoCard": 39,
-  "components/VideoEditor.tsx::VideoEditor": 49,
-  "components/WatchPage.tsx::WatchPage": 30,
-  "components/Welcome.tsx::AuthCard": 39,
-  "components/Welcome.tsx::onSubmit": 24,
-  "components/auditColumns.tsx::localDetails": 24,
-  "components/downloadRow.tsx::DownloadRow": 25,
-  "components/plexCards.tsx::PlexPosterCard": 58,
-  "components/plexViews.tsx::PlexPersonView": 30,
-  "components/plexViews.tsx::PlexSeasonView": 21,
-  "components/plexViews.tsx::PlexShowView": 50,
-  "components/ui/AnchoredPopover.tsx::PopoverSurfaceInner": 22,
-  "components/ui/Combobox.tsx::Combobox": 22,
-  "components/ui/DataTable.tsx::DataTable": 42,
-  "components/ui/PanelGroup.tsx::PanelGroup": 23,
-  "components/ui/SidePanel.tsx::SidePanel": 45,
-  "components/ui/SortControl.tsx::SortControl": 23,
-  "components/ui/anchoredPopoverHooks.ts::useAnchoredPopover": 30,
-  "components/usePlaylistActions.tsx::pushSteps": 23,
-  "components/usePlexActiveFilters.ts::buildPlexActiveFilters": 25,
-  "components/useVideoActions.tsx::items": 25,
-  "lib/api/core.ts::localizeDetail": 48,
-  "lib/api/core.ts::req": 22,
-  "lib/api/plex.ts::appendPlexFilters": 26,
-  "lib/diagnostics.ts::applyDiagnostics": 22,
-  "lib/keymap.ts::dispatch": 28,
-  "lib/logHooks.ts::controlAttrs": 21,
-  "lib/plexDetail.ts::useDetailAside": 24,
-  "lib/plexPlayerHooks.ts::usePlexTracks": 30,
-  "lib/urlState.ts::filtersToParams": 24,
-  "lib/urlState.ts::paramsToFilters": 26,
-  "lib/useActiveFilters.ts::useActiveFilters": 25,
-};
-
-describe("file size", () => {
-  const lines = lineCounts(shippedFiles());
-
-  it(`no file crosses ${MAX_LINES} lines, and a listed one does not grow`, () => {
-    const over = Object.entries(lines)
-      .filter(([f, n]) => n > (BIG_FILES[f] ?? MAX_LINES))
-      .map(([f, n]) => `${f}: ${n} lines (ceiling ${BIG_FILES[f] ?? MAX_LINES})`);
-    expect(over).toEqual([]);
-  });
-
-  it("lists no file that is back under the limit (delete it)", () => {
-    const back = Object.keys(BIG_FILES).filter((f) => (lines[f] ?? 0) <= MAX_LINES);
-    expect(back).toEqual([]);
-  });
-});
-
-describe("function complexity", async () => {
-  const actual = await complexityOffenders();
-
-  it(`no function crosses ${MAX_COMPLEXITY}, and a listed one does not rise`, () => {
-    const worse = Object.entries(actual)
-      .filter(([fn, v]) => v > (COMPLEX[fn] ?? MAX_COMPLEXITY))
-      .map(([fn, v]) => `${fn}: ${v} (ceiling ${COMPLEX[fn] ?? MAX_COMPLEXITY})`);
-    expect(worse).toEqual([]);
-  });
-
-  it("lists no function that is back under the limit, or gone (delete its row)", () => {
-    expect(Object.keys(COMPLEX).filter((fn) => !(fn in actual))).toEqual([]);
-  });
-});
-
-describe("function names (the ratchet's keys)", () => {
-  it("names an unnamed function by what it is bound to, through a wrapping call", () => {
-    const code = [
-      "const onSave = useCallback(() => 1);",
-      "useEffect(() => {});",
-      "const o = { k: function () {} };",
-      "const v = useMemo(() => g(() => 2));",
-    ].join(" ");
-    expect(boundNamesIn(code)).toEqual(["onSave", "useEffect callback", "k", "v", "g callback"]);
-  });
-});
diff --git a/frontend/src/lib/sourceSize.testkit.ts b/frontend/src/lib/sourceSize.testkit.ts
deleted file mode 100644
index 9cf51a4c..00000000
--- a/frontend/src/lib/sourceSize.testkit.ts
+++ /dev/null
@@ -1,141 +0,0 @@
-import { readdirSync, readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { ESLint, Linter, type Rule } from "eslint";
-import tseslint from "typescript-eslint";
-
-// Measures the shipped frontend source for the size/complexity ratchet (E32): lines per file, and the
-// cyclomatic complexity of every function over the limit. Used by sourceSize.contract.test.ts.
-
-export const MAX_LINES = 800;
-export const MAX_COMPLEXITY = 20;
-
-const SRC = fileURLToPath(new URL("../", import.meta.url));
-
-/** src-relative paths of everything the build ships (no tests, no test kits). */
-export function shippedFiles(): string[] {
-  return (readdirSync(SRC, { recursive: true }) as string[])
-    .map((p) => p.split("\\").join("/"))
-    .filter(
-      (p) => /\.(ts|tsx)$/.test(p) && !/\.(test|testkit)\.tsx?$/.test(p) && !p.endsWith(".d.ts"),
-    )
-    .sort();
-}
-
-export function lineCounts(files: string[]): Record<string, number> {
-  const out: Record<string, number> = {};
-  for (const f of files) out[f] = readFileSync(SRC + f, "utf8").split("\n").length;
-  return out;
-}
-
-/** `file::function` → its complexity, for every function over MAX_COMPLEXITY. Keyed by NAME, not by
- *  rank in the file: a ranked list let one function grow while another in the same file shrank by as
- *  much (E32 review). ESLint names declarations and methods; a function it leaves unnamed takes the
- *  name it is bound to (`const onSave = () => …`, `{ onSave: () => … }`), through a wrapping call
- *  (`const onSave = useCallback(() => …)`, round 3), else `<callee> callback` (`useEffect
- *  callback`), else `(anonymous)`. A name taken twice in a file gets ` 2`, ` 3` in source order —
- *  left only for repeated unbound callbacks (two `useEffect`s), where the order IS the identity. A
- *  bare rule run (no type info, no other rules), so it costs a couple of seconds, not the full lint. */
-type Node = Rule.Node;
-const ident = (n: { type: string; name?: string } | null | undefined): string | undefined =>
-  n?.type === "Identifier" ? n.name : undefined;
-function boundName(p: Node): string | undefined {
-  switch (p.type) {
-    case "VariableDeclarator":
-      return ident(p.id);
-    case "Property":
-    case "PropertyDefinition":
-      return ident(p.key);
-    case "AssignmentExpression":
-      return ident(p.left.type === "MemberExpression" ? p.left.property : p.left);
-    case "CallExpression": {
-      // a wrapped function takes the wrapper's binding: `const onSave = useCallback(() => …)`
-      const outer = p.parent as Node | null;
-      const bound = outer && outer.type !== "CallExpression" ? boundName(outer) : undefined;
-      if (bound) return bound;
-      const callee = ident(p.callee.type === "MemberExpression" ? p.callee.property : p.callee);
-      return callee && `${callee} callback`;
-    }
-    default:
-      return undefined;
-  }
-}
-/** The name each function is bound to, reported where `complexity` reports it (the function's HEAD:
- *  the `=>` of an arrow, the key of a method, else the function's start) so the two line up. */
-const functionNames: Rule.RuleModule = {
-  create(ctx) {
-    const visit = (node: Node) => {
-      const p = node.parent as Node | null;
-      const name = p && boundName(p);
-      if (!p || !name) return;
-      const head =
-        node.type === "ArrowFunctionExpression"
-          ? ctx.sourceCode.getTokenBefore(node.body, (t) => t.value === "=>")!.loc.start
-          : p.type === "Property" ||
-              p.type === "MethodDefinition" ||
-              p.type === "PropertyDefinition"
-            ? p.loc!.start
-            : node.loc!.start;
-      ctx.report({ loc: head, message: name });
-    };
-    return { ArrowFunctionExpression: visit, FunctionExpression: visit };
-  },
-};
-
-/** The name `functionNames` gives each unnamed function in `code`, in source order (its own test). */
-export function boundNamesIn(code: string): string[] {
-  return new Linter()
-    .verify(
-      code,
-      [
-        {
-          files: ["**/*.tsx"],
-          languageOptions: {
-            parser: tseslint.parser,
-            parserOptions: { ecmaFeatures: { jsx: true } },
-          },
-          plugins: { size: { rules: { "function-names": functionNames } } },
-          rules: { "size/function-names": "error" },
-        },
-      ],
-      "probe.tsx",
-    )
-    .map((m) => m.message);
-}
-
-export async function complexityOffenders(): Promise<Record<string, number>> {
-  const eslint = new ESLint({
-    cwd: fileURLToPath(new URL("../../", import.meta.url)),
-    overrideConfigFile: true,
-    overrideConfig: [
-      {
-        files: ["src/**/*.{ts,tsx}"],
-        ignores: ["**/*.test.*", "**/*.testkit.*"],
-        languageOptions: {
-          parser: tseslint.parser,
-          parserOptions: { ecmaFeatures: { jsx: true } },
-        },
-        plugins: { size: { rules: { "function-names": functionNames } } },
-        rules: { complexity: ["error", MAX_COMPLEXITY], "size/function-names": "error" },
-      },
-    ],
-  });
-  const out: Record<string, number> = {};
-  for (const r of await eslint.lintFiles(["src/**/*.{ts,tsx}"])) {
-    const file = r.filePath
-      .split("\\")
-      .join("/")
-      .replace(/^.*\/frontend\/src\//, "");
-    const at = (m: { line: number; column: number }) => `${m.line}:${m.column}`;
-    const bound = new Map(
-      r.messages.filter((m) => m.ruleId === "size/function-names").map((m) => [at(m), m.message]),
-    );
-    for (const m of r.messages) {
-      if (m.ruleId !== "complexity") continue;
-      const name = /'([^']+)'/.exec(m.message)?.[1] ?? bound.get(at(m)) ?? "(anonymous)";
-      let key = `${file}::${name}`;
-      for (let n = 2; key in out; n++) key = `${file}::${name} ${n}`;
-      out[key] = Number(/complexity of (\d+)/.exec(m.message)?.[1]);
-    }
-  }
-  return out;
-}
diff --git a/frontend/src/lib/storage.ts b/frontend/src/lib/storage.ts
index 82fe7d7d..10ab9510 100644
--- a/frontend/src/lib/storage.ts
+++ b/frontend/src/lib/storage.ts
@@ -14,7 +14,7 @@ export const LS = {
   lang: "siftlode.lang",
   filters: "siftlode.filters",
   page: "siftlode.page",
-  // E24: start every session on the Home surface rather than on the module you happened to leave
+  // Start every session on the Home surface rather than on the module you happened to leave
   // open. Per-account, "0" = opt out and go back to remembering the last module. Read by
   // `loadInitialPage` in NavigationProvider's initializer, which BootGate runs only once the tab's
   // account is pinned — so the landing is decided right before the first paint, never corrected after.
@@ -74,7 +74,6 @@ export const LS = {
   // The public /watch page's repeat toggle (JSON boolean; on by default). Browser-wide, NOT per account:
   // that page runs outside the app, with no account at all.
   watchRepeat: "siftlode.watchRepeat",
-  chatDock: (userId: number) => `siftlode.chatDock.${userId}`,
 } as const;
 
 // --- per-account scoping -----------------------------------------------------------------
@@ -183,7 +182,7 @@ export function useAccountPersistedState(
 
 // Which sub-tab a page was left on (Settings, Configuration, Statistics, Users) is kept for THIS browser
 // tab only — sessionStorage, account-scoped: it survives a reload and a trip to another page, and a new
-// tab opens the page on its first sub-tab (the owner, E31: a position remembered forever in
+// tab opens the page on its first sub-tab (the owner's call: a position remembered forever in
 // localStorage made Configuration open on "Plex" in every fresh tab, as if that were its home).
 
 /** The sub-tab stored for this browser tab, or null. */
@@ -213,7 +212,7 @@ export function useTabPersistedState(
   fallback = "",
 ): [string, (value: string) => void] {
   const [value, setValue] = useState<string>(() => {
-    // Before E31 the position lived in localStorage; a value left there would never be read again.
+    // The position used to live in localStorage; a value left there would never be read again.
     const old = accountKey(base);
     if (old) {
       try {
diff --git a/frontend/src/lib/store.dom.test.tsx b/frontend/src/lib/store.dom.test.tsx
index 9d54f6e3..5034e3c9 100644
--- a/frontend/src/lib/store.dom.test.tsx
+++ b/frontend/src/lib/store.dom.test.tsx
@@ -2,9 +2,9 @@
 //
 // A store is read from React through `useValue()`, a name the React Compiler knows as a hook. Its
 // old name, `use()`, it did not: the call was compiled as an ordinary one and memoized, so it ran
-// on the first render alone. Read straight from a component, Back to top never re-rendered (E28);
+// on the first render alone. Read straight from a component, Back to top never re-rendered;
 // read inside a hook that compiles memo scopes around it, usePlaylistActions rendered fewer hooks
-// on its second render and threw (E32 S4, the moment that hook started to compile). Vitest builds
+// on its second render and threw (the moment that hook started to compile). Vitest builds
 // with the same compiler as the app (reactPlugin), so this renders the compiled code.
 import { describe, it, expect, afterEach } from "vitest";
 import { render, screen, act, cleanup } from "@testing-library/react";
diff --git a/frontend/src/lib/store.ts b/frontend/src/lib/store.ts
index 83008505..ebf19eb6 100644
--- a/frontend/src/lib/store.ts
+++ b/frontend/src/lib/store.ts
@@ -1,16 +1,16 @@
 import { useSyncExternalStore } from "react";
 
 // A minimal observable value shared across React components AND non-React code (the api
-// layer, websocket handlers, etc.). Replaces the hand-rolled `listeners`/`subscribe`/`emit`
-// triad that several modules each re-implemented slightly differently.
+// layer, the debug recorder, the error dialog, etc.). Replaces the hand-rolled
+// `listeners`/`subscribe`/`emit` triad that several modules each re-implemented slightly differently.
 export interface Store<T> {
   get(): T;
   set(next: T | ((prev: T) => T)): void;
   subscribe(listener: () => void): () => void;
   /** Subscribe from a component; re-renders on every change. Named `use…` on purpose: the React
    *  Compiler knows a hook only by that name, and a plain `use()` was compiled as an ordinary call —
-   *  memoized, so it ran on the first render alone (E32: usePlaylistActions then rendered fewer hooks
-   *  and threw; E28: Back to top never re-rendered). */
+   *  memoized, so it ran on the first render alone (usePlaylistActions then rendered fewer hooks
+   *  and threw; Back to top never re-rendered). */
   useValue(): T;
 }
 
diff --git a/frontend/src/lib/subscriptionCache.test.ts b/frontend/src/lib/subscriptionCache.test.ts
index 90fd873f..0a3a7ff0 100644
--- a/frontend/src/lib/subscriptionCache.test.ts
+++ b/frontend/src/lib/subscriptionCache.test.ts
@@ -5,7 +5,7 @@ import { describe, expect, it, vi } from "vitest";
 import { qk } from "./queryKeys";
 import { invalidateSubscription } from "./subscriptionCache";
 
-// E28 review L8: a subscription change touches the same reads wherever it is made, and each site kept
+// A subscription change touches the same reads wherever it is made, and each site kept
 // its own list — the channel menu's unsubscribe left the feed showing the channel's videos, the
 // channel page's left the status counts stale. One set, one function, every site on it.
 describe("a subscription change", () => {
diff --git a/frontend/src/lib/subscriptionCache.ts b/frontend/src/lib/subscriptionCache.ts
index aa1cdb85..20721000 100644
--- a/frontend/src/lib/subscriptionCache.ts
+++ b/frontend/src/lib/subscriptionCache.ts
@@ -4,7 +4,7 @@ import { qk } from "./queryKeys";
 
 /** Everything a subscribe or an unsubscribe changes: the channel itself, the manager's list and its
  *  counts, the feed and its facets (the channel's videos come or go), and discovery (a subscribed
- *  channel leaves it). ONE set for every site that makes the change (E28 review L8): each used to keep
+ *  channel leaves it). ONE set for every site that makes the change: each used to keep
  *  its own list, and each list missed something. */
 export function invalidateSubscription(qc: QueryClient, channelId: string): void {
   for (const queryKey of [
diff --git a/frontend/src/lib/surfaceRole.contract.test.ts b/frontend/src/lib/surfaceRole.contract.test.ts
index 9995b554..99a4253c 100644
--- a/frontend/src/lib/surfaceRole.contract.test.ts
+++ b/frontend/src/lib/surfaceRole.contract.test.ts
@@ -3,7 +3,7 @@ import { describe, expect, it } from "vitest";
 import { eslint } from "./lintProbe.testkit";
 
 // `local/surface-role` (eslint.config.js): a glass surface is a role from ui/surfaces.ts, which brings
-// its radius (docs/DESIGN.md B5; E28 S3d). ~140 sites paired three tiers with five radii; this pins
+// its radius (docs/DESIGN.md B5). ~140 sites paired three tiers with five radii; this pins
 // that the rule keeping a new one out fires, and where it stands down.
 const RULE = "local/surface-role";
 
diff --git a/frontend/src/lib/tabState.dom.test.ts b/frontend/src/lib/tabState.dom.test.ts
index 4dceea4d..aaccd589 100644
--- a/frontend/src/lib/tabState.dom.test.ts
+++ b/frontend/src/lib/tabState.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E31 (the owner): a page's sub-tab was remembered forever in localStorage, so every fresh browser tab
+// Owner's call: a page's sub-tab was remembered forever in localStorage, so every fresh browser tab
 // opened Configuration on "Plex" as if that were its home. The position is now kept per browser tab
 // (sessionStorage): it survives a reload and a trip to another page, and a new tab starts on the first.
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
diff --git a/frontend/src/lib/tableColumns.ts b/frontend/src/lib/tableColumns.ts
index dd11e37c..e464eb28 100644
--- a/frontend/src/lib/tableColumns.ts
+++ b/frontend/src/lib/tableColumns.ts
@@ -51,7 +51,7 @@ export interface Column<T> {
 // The classes that hide a column below its width (`narrowHidden` / `tabletHidden`), for its cells and,
 // in a fixed layout, for its <col> too: a hidden cell under a <col> that keeps its width would leave an
 // empty stripe. The table's OWN width decides, so the caller wraps the table in an `@container`.
-// `cue` is the inverse: shown ONLY while the column is hidden — the hidden-filter cue (E28 F2) names a
+// `cue` is the inverse: shown ONLY while the column is hidden — the hidden-filter cue names a
 // filter whose funnel went off screen, and by the same container query, so it cannot disagree with
 // the table about which columns are gone (not at any text size: both are rem).
 // Whole literals, because Tailwind only generates a class it can read in one piece.
diff --git a/frontend/src/lib/tagPicks.ts b/frontend/src/lib/tagPicks.ts
index 106eb143..39e01b66 100644
--- a/frontend/src/lib/tagPicks.ts
+++ b/frontend/src/lib/tagPicks.ts
@@ -2,10 +2,10 @@ import type { TFunction } from "i18next";
 import type { Tag } from "./api";
 
 // A saved view or a stored filter can outlive its tag (deleted here or on another device). The filter
-// then matches nothing (E32 S2), so its chip must say why instead of reading as a bare id — but only
+// then matches nothing, so its chip must say why instead of reading as a bare id — but only
 // once the tag list has loaded: while it loads the chip is a placeholder (`isPending`), and if the load
 // failed it shows the id, never a guessed "deleted". One rule for the feed's applied-filter row and the
-// channel manager's tag row, which had each written their own and drifted (E32 review).
+// channel manager's tag row, which had each written their own and drifted.
 
 /** The tag list as react-query hands it over — only what the rule reads. */
 export interface TagList {
diff --git a/frontend/src/lib/textSelection.ts b/frontend/src/lib/textSelection.ts
index a722f2ea..29ceec8c 100644
--- a/frontend/src/lib/textSelection.ts
+++ b/frontend/src/lib/textSelection.ts
@@ -7,7 +7,7 @@
 /** True when this click ended a selection: the page's selection is non-empty and starts or ends
  *  inside the clicked element. Takes the EVENT, not the element, because a keyboard click (Enter /
  *  Space, `detail` 0) ends no selection — it has no pointer — so a title whose words are still
- *  selected must open on Enter (E28 review H2). */
+ *  selected must open on Enter. */
 export function endsTextSelection(e: { currentTarget: Element; detail: number }): boolean {
   if (e.detail === 0) return false;
   const el = e.currentTarget;
diff --git a/frontend/src/lib/theme.test.ts b/frontend/src/lib/theme.test.ts
index dfe647f8..7dccf8bf 100644
--- a/frontend/src/lib/theme.test.ts
+++ b/frontend/src/lib/theme.test.ts
@@ -1,7 +1,7 @@
 import { expect, it } from "vitest";
 import { DEFAULT_THEME, normalizeTheme } from "./theme";
 
-// YouTube and Starship were retired in E28 with no data migration (owner, 2026-09-24): an account or
+// YouTube and Starship were retired with no data migration (owner, 2026-09-24): an account or
 // a browser that still stores one must land on the default scheme, not on an html[data-scheme] that no
 // CSS block styles (an unstyled page), and the retired tuner flag must not ride along into the next save.
 it("maps a retired scheme to the default and keeps only the known keys", () => {
diff --git a/frontend/src/lib/theme.ts b/frontend/src/lib/theme.ts
index f80053f4..c9315f1c 100644
--- a/frontend/src/lib/theme.ts
+++ b/frontend/src/lib/theme.ts
@@ -35,8 +35,8 @@ export const DEFAULT_THEME: ThemePrefs = {
 };
 
 /** A stored theme (this browser's copy or the account's server prefs) as the app can apply it: only
- *  the known keys, and a scheme or mode that no longer exists (YouTube and Starship were retired in
- *  E28) falls back to the default instead of painting an unstyled page. */
+ *  the known keys, and a scheme or mode that no longer exists (YouTube and Starship were
+ *  retired) falls back to the default instead of painting an unstyled page. */
 export function normalizeTheme(raw: Partial<Record<keyof ThemePrefs, unknown>>): ThemePrefs {
   const d = DEFAULT_THEME;
   const num = (v: unknown, fallback: number) =>
diff --git a/frontend/src/lib/toastDock.ts b/frontend/src/lib/toastDock.ts
index 394b3680..c2afd91e 100644
--- a/frontend/src/lib/toastDock.ts
+++ b/frontend/src/lib/toastDock.ts
@@ -1,7 +1,7 @@
 import type { ComponentType } from "react";
 import { createStore } from "./store";
 
-// A control that lives where the toasts live, under them (E16: the debug recorder's pill).
+// A control that lives where the toasts live, under them (the debug recorder's pill).
 //
 // The toast stack already solves the hard part of "always visible, never in the way": it has a host
 // in the page and one inside every overlay — the dialogs, both players, the fullscreen player — the
diff --git a/frontend/src/lib/touchTarget.contract.test.ts b/frontend/src/lib/touchTarget.contract.test.ts
index 17c38585..a4cf3b39 100644
--- a/frontend/src/lib/touchTarget.contract.test.ts
+++ b/frontend/src/lib/touchTarget.contract.test.ts
@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 
 import { describe, expect, it } from "vitest";
 
-// DESIGN.md A3: on a coarse pointer every control primitive is a 44 target. The E28 audit measured
+// DESIGN.md A3: on a coarse pointer every control primitive is a 44 target. An audit measured
 // that it was not: `.touch-target` sat in @layer components, so a caller's own `min-h-6` (the mouse's
 // 24 floor, a utility) beat it and the control stayed 24 on a tablet. jsdom does no cascade, so what is
 // pinned is the rule's shape: a utility whose two minimums win over a sibling utility's.
diff --git a/frontend/src/lib/uiBoundary.contract.test.ts b/frontend/src/lib/uiBoundary.contract.test.ts
index c0e29587..54a5076e 100644
--- a/frontend/src/lib/uiBoundary.contract.test.ts
+++ b/frontend/src/lib/uiBoundary.contract.test.ts
@@ -2,13 +2,13 @@ import { describe, expect, it } from "vitest";
 
 import { eslint } from "./lintProbe.testkit";
 
-// E10 S1 declared `components/ui/` a platform layer and put the rule that makes it one — no feature
-// components, no domain API slices — into eslint.config.js rather than prose. This asserts the rule
+// `components/ui/` is a platform layer, and the rule that makes it one — no feature components,
+// no domain API slices — lives in eslint.config.js rather than prose. This asserts the rule
 // actually FIRES, because a `no-restricted-imports` pattern that matches nothing is indistinguishable
 // from a clean codebase: the first cut wrote its regexes in plain "..." literals, where `\.` collapses
 // to the any-char `.`, and it silently let through both `../../lib/api` (the barrel every feature
 // component imports) and `../../components/Feed` (the same file `../Feed` names). Eight green lanes
-// said nothing (E10 review round 1). A rule stated in a comment must also be enforced in code — and a
+// said nothing. A rule stated in a comment must also be enforced in code — and a
 // rule meant to enforce something must itself be tested.
 const BOUNDARY = "no-restricted-imports";
 
@@ -59,7 +59,7 @@ describe("components/ui/ boundary rule", () => {
   });
 });
 
-// E11 S3: one layer down, `lib/` may not import from `components/` at all. The type-only and the
+// One layer down, `lib/` may not import from `components/` at all. The type-only and the
 // re-export spellings are in here on purpose — both are how a lib helper most easily leans on a
 // component (`lib/sortOptions` imported `Column` from `ui/tableHeader` as a type).
 describe("lib/ boundary rule", () => {
diff --git a/frontend/src/lib/urlState.ts b/frontend/src/lib/urlState.ts
index 179b41dc..b74c0033 100644
--- a/frontend/src/lib/urlState.ts
+++ b/frontend/src/lib/urlState.ts
@@ -131,7 +131,6 @@ const PAGES = [
   "audit",
   "logs",
   "notifications",
-  "messages",
   "downloads",
   "plex",
 ] as const;
diff --git a/frontend/src/lib/useCardPager.dom.test.tsx b/frontend/src/lib/useCardPager.dom.test.tsx
index 9ec05b69..2871b2b2 100644
--- a/frontend/src/lib/useCardPager.dom.test.tsx
+++ b/frontend/src/lib/useCardPager.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The card layout's pager clamps an out-of-range page DURING RENDER (E27 S2), which is the right
+// The card layout's pager clamps an out-of-range page DURING RENDER, which is the right
 // shape — React discards that pass, so nothing is committed on a page that no longer exists — but
 // it is also the shape that turns a non-convergent condition into "Too many re-renders" rather than
 // a visual glitch. Neither the hook nor either of its two callers (ChannelDiscovery, Channels) had
diff --git a/frontend/src/lib/useChannelPriority.ts b/frontend/src/lib/useChannelPriority.ts
index 20257caf..42b4e66c 100644
--- a/frontend/src/lib/useChannelPriority.ts
+++ b/frontend/src/lib/useChannelPriority.ts
@@ -39,7 +39,7 @@ export function useChannelPriority(opts: {
         .then(() => optsRef.current.onSuccess?.(channelId))
         .catch((err: unknown) => {
           // Said here, once, for both callers: their `onError` only refetches, so a refused priority
-          // used to just snap back — often after the stepper had already been let go (E11 S2b).
+          // used to just snap back — often after the stepper had already been let go.
           notifyActionError(err, i18n.t("errors.writeFailed.channelPriority"));
           optsRef.current.onError(channelId);
         });
diff --git a/frontend/src/lib/useChannelTagActions.ts b/frontend/src/lib/useChannelTagActions.ts
index cc64c92e..11388a43 100644
--- a/frontend/src/lib/useChannelTagActions.ts
+++ b/frontend/src/lib/useChannelTagActions.ts
@@ -11,7 +11,7 @@ import { notifyActionError } from "./actionErrors";
  *
  *  A failure is REPORTED here, once, with the real error: the manager used to do it in its `onError`
  *  and hand the channel id to the reporter as though it were the error, and the detail page did not
- *  do it at all — a tag toggled there just snapped back (E11 S2b). */
+ *  do it at all — a tag toggled there just snapped back. */
 export function useChannelTagActions(opts: {
   /** Apply the optimistic tag change to whichever cache the caller owns. `attach` true = add. */
   optimisticToggle: (channelId: string, tagId: number, attach: boolean) => void;
diff --git a/frontend/src/lib/useChipOverflowFit.dom.test.tsx b/frontend/src/lib/useChipOverflowFit.dom.test.tsx
index 388c459e..55fb5997 100644
--- a/frontend/src/lib/useChipOverflowFit.dom.test.tsx
+++ b/frontend/src/lib/useChipOverflowFit.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The shared chip-overflow measure core (S3). jsdom has no layout engine — every offset* / clientWidth
+// The shared chip-overflow measure core. jsdom has no layout engine — every offset* / clientWidth
 // is 0 — so we stub those on the real ref'd nodes and assert the hook (a) reads the geometry off them
 // (chip right edges, pill width, the gap between the last chip and the pill, and the lane's available
 // width), (b) returns the caller's `decide` result, and (c) re-measures when `deps` changes.
diff --git a/frontend/src/lib/useChipOverflowFit.ts b/frontend/src/lib/useChipOverflowFit.ts
index c9064f0d..1e00ebd1 100644
--- a/frontend/src/lib/useChipOverflowFit.ts
+++ b/frontend/src/lib/useChipOverflowFit.ts
@@ -26,7 +26,7 @@ import { useEffectEvent, useLayoutEffect, useState, type RefObject } from "react
  * it reads natural widths — so its box sticks out far past the lane. An absolutely-positioned box still
  * contributes to its ancestors' SCROLLABLE overflow, and `visibility: hidden` does NOT exempt it, so
  * without a clip the mirror leaks all the way up to <html>. Measured on the channel manager at a 1024px
- * viewport (E10 S4): the mirror dragged the document's scroll width to 1258px — the whole app scrolled
+ * viewport: the mirror dragged the document's scroll width to 1258px — the whole app scrolled
  * 249px sideways and the fixed header slid to x=-177 — and widened the Tags cell 84px past the width its
  * fixed-layout column had assigned it. `clip`, not `hidden`, because clip creates no scrollport, so
  * nothing can ever scroll the mirror into view. The clip cannot disturb the measurement: offsetLeft and
@@ -37,7 +37,7 @@ import { useEffectEvent, useLayoutEffect, useState, type RefObject } from "react
  * `outline-offset: 2px` — i.e. it paints 4px OUTSIDE the border box. These lanes have no padding and
  * their height is set by the chip itself, so the first commit of this fix silently cut the ring's top
  * and bottom bands off every applied-filter chip and the tag lane's `+` trigger, leaving two floating
- * side bars (E10 review round 1). 0.25rem is exactly the ring's reach and nowhere near the ~600px the
+ * side bars. 0.25rem is exactly the ring's reach and nowhere near the ~600px the
  * mirror needs, so containment is unaffected.
  */
 export const chipLaneClass = "relative overflow-clip [overflow-clip-margin:0.25rem]";
diff --git a/frontend/src/lib/useDebounced.ts b/frontend/src/lib/useDebounced.ts
index cc191829..dc452bff 100644
--- a/frontend/src/lib/useDebounced.ts
+++ b/frontend/src/lib/useDebounced.ts
@@ -6,7 +6,7 @@ import { useEffect, useState } from "react";
 //
 // `settle`: a change of it takes `value` at once. A value that did not come from typing (Back
 // restoring a search, a pivot clearing one) has no keystrokes to wait out, and the lag only ran a
-// query mixing the new filters with the old text (deep-review 2026-09-19).
+// query mixing the new filters with the old text (found by a review, 2026-09-19).
 export function useDebounced<T>(value: T, delay = 300, settle?: unknown): T {
   const [debounced, setDebounced] = useState(value);
   const [settled, setSettled] = useState(settle);
diff --git a/frontend/src/lib/useDismiss.dom.test.tsx b/frontend/src/lib/useDismiss.dom.test.tsx
index ff467aef..bdaba492 100644
--- a/frontend/src/lib/useDismiss.dom.test.tsx
+++ b/frontend/src/lib/useDismiss.dom.test.tsx
@@ -3,7 +3,7 @@
 // The outside-press half of useDismiss. The hook subscribes its `mousedown` listener once per
 // open/close, which is what keeps a popover from re-subscribing on every parent render — but it
 // means the listener must not CAPTURE the caller's handler or the ref LIST, or it keeps using the
-// versions that existed when the popover opened. Both are read through refs (E27 S2); these tests
+// versions that existed when the popover opened. Both are read through refs; these tests
 // are what says so.
 import { useRef, useState } from "react";
 import { describe, it, expect, vi, afterEach } from "vitest";
diff --git a/frontend/src/lib/useDismiss.ts b/frontend/src/lib/useDismiss.ts
index d162528a..a048ce18 100644
--- a/frontend/src/lib/useDismiss.ts
+++ b/frontend/src/lib/useDismiss.ts
@@ -6,7 +6,7 @@ import { useLayer } from "./layerStack";
  * hand-rolled; positioning stays with the caller (it varies per popover). Pass the panel ref
  * (and optionally a trigger ref so clicking the trigger doesn't immediately re-close).
  *
- * Escape is dispatched through the shared `layerStack` (R8 S3): the popover registers as a layer and
+ * Escape is dispatched through the shared `layerStack`: the popover registers as a layer and
  * closes only when it is topmost, so a Modal or another popover opened above it takes the Escape
  * first, and a player below defers to it. This replaces the old blanket `stopPropagation` — which
  * swallowed a player's own Escape (e.g. PlexPlayer's auto-skip-cancel) whenever any popover was open. */
@@ -19,7 +19,7 @@ export function useDismiss(
   // it owns Escape and the outside-press, nothing more. Claiming the trap made a dialog underneath
   // stand its own down (`anyBlockingLayerAbove`) for a layer that traps nothing, so Tab walked out
   // of the dialog while one of its own menus was open — measured in a real browser on the Plex
-  // player, whose settings and track menus are both dismissables (deep-review round 4). Every
+  // player, whose settings and track menus are both dismissables. Every
   // consumer renders its panel INSIDE the surface below it, so that surface's trap already spans
   // the panel; a portaled one would need its own trap and must not use this default.
   useLayer(active, onClose, { trapsTab: false });
diff --git a/frontend/src/lib/useFocusKeeper.dom.test.tsx b/frontend/src/lib/useFocusKeeper.dom.test.tsx
index e91f79e0..295e56aa 100644
--- a/frontend/src/lib/useFocusKeeper.dom.test.tsx
+++ b/frontend/src/lib/useFocusKeeper.dom.test.tsx
@@ -79,7 +79,7 @@ describe("useFocusKeeper", () => {
 });
 
 describe("focusNeighbour", () => {
-  // E28 F2: the neighbour of the hidden-filter cue's chip is the table's first header button — the
+  // The neighbour of the hidden-filter cue's chip is the table's first header button — the
   // hidden column's own, `display: none`, which refuses focus(): the focus fell to <body>. jsdom paints
   // nothing, so `checkVisibility` is stood in for, answering for the one hidden button.
   it("passes over a focusable the CSS has taken off screen", () => {
diff --git a/frontend/src/lib/useFocusKeeper.ts b/frontend/src/lib/useFocusKeeper.ts
index aa00c603..c2268841 100644
--- a/frontend/src/lib/useFocusKeeper.ts
+++ b/frontend/src/lib/useFocusKeeper.ts
@@ -16,7 +16,7 @@ const FOCUSABLE =
   'button:not([disabled]), a[href], input:not([disabled]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex="-1"])';
 
 // A focusable element the CSS has taken off screen (a `tabletHidden` column's header button) refuses
-// `focus()`, and the focus it was meant to catch fell to <body> (E28 F2, measured in Chrome). An engine
+// `focus()`, and the focus it was meant to catch fell to <body> (measured in Chrome). An engine
 // without `checkVisibility` (jsdom) paints nothing, so there everything counts as shown.
 const shown = (el: HTMLElement) => !el.checkVisibility || el.checkVisibility();
 
@@ -38,7 +38,6 @@ function firstFocusable(node: Node | null, fromEnd = false): HTMLElement | null
  *  else the previous one, widening to the parent's neighbours — so its removal does not drop the
  *  focus to <body>. For a removal the caller makes itself (a chip's ×) anywhere, including a modal
  *  or a side panel, where the keeper below does not watch. False when nothing was found. */
-/** @internal exported for useFocusKeeper.dom.test.tsx */
 export function focusNeighbour(el: HTMLElement): boolean {
   for (let at: HTMLElement | null = el; at && at !== document.body; at = at.parentElement) {
     const hit = firstFocusable(at.nextSibling) ?? firstFocusable(at.previousSibling, true);
@@ -52,7 +51,7 @@ export function focusNeighbour(el: HTMLElement): boolean {
 
 /** Run `remove`, which takes `el` off the page, without dropping `el`'s focus: it goes to the
  *  neighbour first (`focusNeighbour`). That neighbour may go in the same removal — the "Clear all"
- *  that only shows beside two filters, the "+1" of the last hidden one (E28 review round 3) — so
+ *  that only shows beside two filters, the "+1" of the last hidden one — so
  *  once the removal has rendered, a focus left on <body> goes to what preceded `el`, else to the
  *  first control left in its row. Only when the focus was lost: a focus the reader moved stays. */
 export function handOffFocus(el: HTMLElement, remove: () => void): void {
@@ -91,7 +90,7 @@ export const FOCUS_REST_ATTRS = { "data-focus-rest": "" } as const;
 /** Whether the focus is nowhere the reader chose — <body>, the keeper's stand-in, or a resting place
  *  (`FOCUS_REST_ATTRS`) — so a restore may take it. The page region used to count as a choice: a
  *  click on its background focused it, and Back then left the focus there instead of on the item
- *  the view was opened from (E28 review H1). */
+ *  the view was opened from. */
 export function focusIsUnclaimed(el: Element | null = document.activeElement): boolean {
   return !el || el === document.body || isStandInFocus(el) || el.hasAttribute("data-focus-rest");
 }
diff --git a/frontend/src/lib/useHoverFocusWithin.dom.test.tsx b/frontend/src/lib/useHoverFocusWithin.dom.test.tsx
index 86dddb3c..10aa88ba 100644
--- a/frontend/src/lib/useHoverFocusWithin.dom.test.tsx
+++ b/frontend/src/lib/useHoverFocusWithin.dom.test.tsx
@@ -3,7 +3,7 @@
 // The focus half of the side panels' peek-open model. What is pinned: a dialog opened from inside
 // the panel (rendered at the app root, so outside it in both the DOM and the React tree) does not
 // collapse the panel — collapsing unmounted the row the dialog hands the focus back to, stranding a
-// keyboard user on <body> after Cancel (measured in Chrome, E11 S2).
+// keyboard user on <body> after Cancel (measured in Chrome).
 import { afterEach, describe, expect, it } from "vitest";
 import { act, cleanup, fireEvent, render, screen } from "@testing-library/react";
 import { useHoverFocusWithin } from "./useHoverFocusWithin";
diff --git a/frontend/src/lib/useHoverFocusWithin.ts b/frontend/src/lib/useHoverFocusWithin.ts
index 6ecd49f0..20132349 100644
--- a/frontend/src/lib/useHoverFocusWithin.ts
+++ b/frontend/src/lib/useHoverFocusWithin.ts
@@ -63,7 +63,7 @@ export function useHoverFocusWithin() {
       // A dialog opened FROM inside the panel (the rail row's "Delete?" confirm) renders at the app
       // root, so neither the DOM nor the React tree sees it as inside — and collapsing the panel under
       // it unmounted the very row the dialog hands the focus back to, leaving a keyboard user on
-      // <body> after Cancel (measured in Chrome, E11 S2). Hold while the focus is in a dialog: when it
+      // <body> after Cancel (measured in Chrome). Hold while the focus is in a dialog: when it
       // closes, the focus either comes back in here (onFocus) or lands nowhere, which the
       // document-level net below clears.
       if (to?.closest('[aria-modal="true"]')) return;
diff --git a/frontend/src/lib/useLatest.ts b/frontend/src/lib/useLatest.ts
index a4cb4ea4..009bfdba 100644
--- a/frontend/src/lib/useLatest.ts
+++ b/frontend/src/lib/useLatest.ts
@@ -5,7 +5,7 @@ import { useCallback, useLayoutEffect, useRef, type RefObject } from "react";
  *  value, use `useEffectEvent` instead.
  *
  *  Written in a layout effect, never during render. A render-phase `ref.current = value` makes the
- *  React Compiler skip the whole component (E32), and it is wrong under concurrent rendering anyway:
+ *  React Compiler skip the whole component, and it is wrong under concurrent rendering anyway:
  *  a render React throws away would still have overwritten the value. Read it outside render only. */
 export function useLatest<T>(value: T): RefObject<T> {
   const ref = useRef(value);
diff --git a/frontend/src/lib/usePref.saveFailure.dom.test.ts b/frontend/src/lib/usePref.saveFailure.dom.test.ts
index 5c8820b6..2ef8e931 100644
--- a/frontend/src/lib/usePref.saveFailure.dom.test.ts
+++ b/frontend/src/lib/usePref.saveFailure.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// A preference save the server refuses is REPORTED (E11 S2b). The local state and the `me` cache
+// A preference save the server refuses is REPORTED. The local state and the `me` cache
 // already show the new value, so a swallowed failure was invisible until the next load quietly put
 // the old value back — and the comment above the swallow claimed `req` toasted it, which it does not
 // for a 403/404/429 or a lost connection.
diff --git a/frontend/src/lib/usePref.ts b/frontend/src/lib/usePref.ts
index b195b5be..b00fbba2 100644
--- a/frontend/src/lib/usePref.ts
+++ b/frontend/src/lib/usePref.ts
@@ -10,7 +10,7 @@ import i18n from "../i18n";
 
 // The local state + cache already show the new value, so a refused save is otherwise invisible until
 // the next load quietly puts the old one back. `req` reports none of 403/404/429 and only the
-// connection notice for a lost connection — say it (E11 S2b).
+// connection notice for a lost connection — say it.
 const reportPrefSaveFailure = (err: unknown) =>
   notifyActionError(err, i18n.t("errors.writeFailed.prefs"));
 
diff --git a/frontend/src/lib/useTags.dom.test.tsx b/frontend/src/lib/useTags.dom.test.tsx
index 04931ac9..3a3e2fab 100644
--- a/frontend/src/lib/useTags.dom.test.tsx
+++ b/frontend/src/lib/useTags.dom.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E30 (D1 A): the tag catalog as every reader sees it. A system (auto) tag is stored in English and
+// The tag catalog as every reader sees it. A system (auto) tag is stored in English and
 // named in the reader's language; a user's own tag stays as they typed it, even when it happens to be
 // a vocabulary word.
 import { afterEach, describe, expect, it, vi } from "vitest";
@@ -12,7 +12,7 @@ import { api, type Tag } from "./api";
 import { useTags } from "./useTags";
 
 // Unmount BEFORE the language goes back: a mounted reader re-renders on the switch, and under a loaded
-// run that render landed after the test environment was gone ("window is not defined", E31 S5).
+// run that render landed after the test environment was gone ("window is not defined").
 afterEach(() => {
   cleanup();
   setLanguage("en");
diff --git a/frontend/src/lib/useTags.ts b/frontend/src/lib/useTags.ts
index a35a1f39..4007c8fb 100644
--- a/frontend/src/lib/useTags.ts
+++ b/frontend/src/lib/useTags.ts
@@ -6,7 +6,7 @@ import { qk } from "./queryKeys";
 import { vocab } from "./vocab";
 
 /** The tag catalog, every reader's ONE way to it: a system (auto) tag is stored under its English name
- *  ("Health & Fitness", "Hungarian") and named here in the reader's language (E30, decision D1 A — the
+ *  ("Health & Fitness", "Hungarian") and named here in the reader's language (so the
  *  data stays language-neutral, filters and saved views hold ids). A user's own tag is theirs, as typed.
  *  The list comes back in the reader's alphabetical order, by the names they see.
  *  Naming it once, at the source, is what reaches every chip, column, menu and sort that shows one. */
@@ -22,7 +22,7 @@ export function useTags(opts: { enabled?: boolean; staleTime?: number } = {}) {
         tg.system ? { ...tg, name: vocab(t, "autoTag", tg.name) } : tg,
       );
       // The server orders by category, then by the STORED (English) name; re-sorted by the name the
-      // reader sees, in their alphabet, keeping the server's category order (E30 S3).
+      // reader sees, in their alphabet, keeping the server's category order.
       const rank = new Map<string, number>();
       for (const tg of named) if (!rank.has(tg.category)) rank.set(tg.category, rank.size);
       return named.sort(
diff --git a/frontend/src/lib/useUndoable.ts b/frontend/src/lib/useUndoable.ts
index 56b89b38..99505d4f 100644
--- a/frontend/src/lib/useUndoable.ts
+++ b/frontend/src/lib/useUndoable.ts
@@ -13,7 +13,7 @@ import { useLatest } from "./useLatest";
 // of filters…) can use it. The history is state (what render reads) mirrored in a ref (what the
 // stable callbacks read, so two calls in one tick chain on each other, never on a stale snapshot —
 // save after a `reset`, which is state only and reaches the mirror at its commit; see `reset`).
-// Render never reads the ref: a compiled component would otherwise memoize a stale value (E32).
+// Render never reads the ref: a compiled component would otherwise memoize a stale value.
 export interface Undoable<T> {
   value: T;
   set: (next: T) => void;
@@ -98,7 +98,7 @@ export function useUndoable<T>(
   // still held the history before it, and rebasing that wrote the old value back over the reset (a
   // cached playlist remounted under StrictMode re-seeds with reset-then-rebase and painted empty).
   // The mirror is rebased too, so an `undo` later in the same tick steps back to a rebased snapshot,
-  // not to one that still holds the removed row (E32 review round 2). Called from handlers and
+  // not to one that still holds the removed row. Called from handlers and
   // effects only, never during render.
   const rebase = useCallback((map: (value: T) => T) => {
     const over = (s: History<T>) => ({
diff --git a/frontend/src/lib/useUrlMirror.dom.test.ts b/frontend/src/lib/useUrlMirror.dom.test.ts
index 3c9d2faa..c0c3f567 100644
--- a/frontend/src/lib/useUrlMirror.dom.test.ts
+++ b/frontend/src/lib/useUrlMirror.dom.test.ts
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 //
 // useUrlMirror: mirror a set of nav params onto the CURRENT history entry (replaceState) whenever they
-// change. Backfills the E4 deep-review's deferred coverage — the effect keys on the SERIALIZED updates
+// change. Backfills coverage a review found missing — the effect keys on the SERIALIZED updates
 // so an inline object literal (new identity every render) only fires when a param actually changes; a
 // null value clears a key; and every other param on the URL is preserved.
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
diff --git a/frontend/src/lib/useVerifyEntry.ts b/frontend/src/lib/useVerifyEntry.ts
index 87a04c2f..8370e404 100644
--- a/frontend/src/lib/useVerifyEntry.ts
+++ b/frontend/src/lib/useVerifyEntry.ts
@@ -19,7 +19,7 @@ export type VerifyEntry = {
   /** A `#reset=` link opened in a tab that already holds a session. Only the signed-OUT auth card
    * consumes a reset token, so nothing here can act on it — but silence is what made the verify half
    * a bug, so this says out loud that the link needs a signed-out window. The fragment is deliberately
-   * left in the address bar (E9.5 review round 4), so signing out still recovers it. */
+   * left in the address bar, so signing out still recovers it. */
   resetPending: boolean;
   /** Dismiss the outcome — the banner is a one-time entry notice, not persistent state. */
   dismiss: () => void;
@@ -58,7 +58,7 @@ export function useVerifyEntry(): VerifyEntry {
       if (next) setToken(next);
       // Both halves of the mailed pair arrive the same way — pasted into a running tab, which is a
       // same-document navigation the import-time snapshot never sees. The verify half got this
-      // listener in E9.5 S2; the reset half was left out, so it stayed silent (DX-17).
+      // listener first; the reset half was left out, so it stayed silent (DX-17).
       //
       // Set from the live hash rather than one-way, because the flag must not outlive the token it
       // describes: navigating away from a `#reset=` (a pasted verify link, the back button) leaves
diff --git a/frontend/src/lib/verifyEntry.dom.test.tsx b/frontend/src/lib/verifyEntry.dom.test.tsx
index 728c00c8..0cda779a 100644
--- a/frontend/src/lib/verifyEntry.dom.test.tsx
+++ b/frontend/src/lib/verifyEntry.dom.test.tsx
@@ -7,9 +7,17 @@
 //
 // entryUrl snapshots window.location at IMPORT time, so each case resets the module registry and sets
 // the URL before importing — that is the behaviour under test, not a workaround.
-import { describe, it, expect, afterEach, vi } from "vitest";
+import { describe, it, expect, afterEach, beforeAll, vi } from "vitest";
 import { render, screen, cleanup, act } from "@testing-library/react";
 
+// The first import of the hook transforms its whole graph (./api and everything under it): ~0.6 s
+// alone, past the 5 s case timeout when the full suite runs with coverage on every core — and the
+// case it timed out in left a half-done import that failed every case after it. Transformed code
+// outlives vi.resetModules, so paying it once here, with room, leaves each case its warm ~60 ms.
+beforeAll(async () => {
+  await import("./useVerifyEntry");
+}, 60_000);
+
 afterEach(() => {
   cleanup();
   vi.resetModules();
@@ -143,7 +151,7 @@ describe("confirming an emailed verification link", () => {
     expect(screen.getByTestId("reset").textContent).toBe("reset-pending");
   });
 
-  // DX-17: the verify half got a hashchange listener in E9.5 S2, the reset half did not — so pasting
+  // DX-17: the verify half got a hashchange listener, the reset half did not — so pasting
   // a reset link into a tab already running the app was silently ignored. Our mails were plain text
   // until 0.78.8, which makes pasting the normal way to use one.
   it("notices a reset link pasted into a tab that is already running", async () => {
diff --git a/frontend/src/lib/viewportUnits.contract.test.ts b/frontend/src/lib/viewportUnits.contract.test.ts
index a3948387..b1f67e3d 100644
--- a/frontend/src/lib/viewportUnits.contract.test.ts
+++ b/frontend/src/lib/viewportUnits.contract.test.ts
@@ -2,7 +2,7 @@ import { readdirSync, readFileSync } from "node:fs";
 
 import { describe, expect, it } from "vitest";
 
-// E28 S3d4 (E18.5's `h-screen` → `dvh`). `100vh` is the viewport with a mobile browser's toolbars
+// `h-screen` → `dvh`. `100vh` is the viewport with a mobile browser's toolbars
 // RETRACTED: on a tablet with the toolbar showing, an `h-screen` shell runs its bottom edge (the
 // last rows, a dialog's footer) under the toolbar. `dvh` follows the toolbar. A static `vh` size is
 // the same trap at a smaller scale, so the app sizes by `dvh` everywhere.
diff --git a/frontend/src/lib/vocab.dom.test.ts b/frontend/src/lib/vocab.dom.test.ts
index 8e1b9e42..f020dacf 100644
--- a/frontend/src/lib/vocab.dom.test.ts
+++ b/frontend/src/lib/vocab.dom.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// E30: the server's closed English vocabularies, named in the reader's language — through the REAL
+// The server's closed English vocabularies, named in the reader's language — through the REAL
 // catalog, so a missing or misnamed key shows here as the English word coming through.
 import { describe, expect, it } from "vitest";
 import i18n from "../i18n";
@@ -18,7 +18,7 @@ describe("a vocabulary word", () => {
     ["autoTag", "Hungarian", "Magyar"],
     ["profile", "Video only (MP4)", "Csak videó (MP4)"],
     ["topic", "Lifestyle_(sociology)", "Életmód"],
-    // E31 S1: Plex's certificate words came through in English on the info badge and the filter.
+    // Plex's certificate words came through in English on the info badge and the filter.
     ["certificate", "Not Rated", "Nincs besorolva"],
     ["certificate", "Approved", "Jóváhagyva"],
     ["certificate", "Passed", "Engedélyezve"],
diff --git a/frontend/src/lib/vocab.ts b/frontend/src/lib/vocab.ts
index 0336e392..53ea37c4 100644
--- a/frontend/src/lib/vocab.ts
+++ b/frontend/src/lib/vocab.ts
@@ -1,7 +1,7 @@
 import type { TFunction } from "i18next";
 import type { PlexTrackNaming } from "./api";
 
-// E30: the closed vocabularies the server stores in ENGLISH — a TMDB crew job or department, an
+// The closed vocabularies the server stores in ENGLISH — a TMDB crew job or department, an
 // auto-tag, a built-in download profile, a YouTube topic, a Plex certificate's word ("Not Rated"; a
 // code such as "PG-13" reads the same everywhere and falls through as stored) — named in the reader's language. The data
 // stays language-neutral (it is filtered and matched on); only the NAME is translated, here, from the
diff --git a/frontend/src/lib/zLayer.contract.test.ts b/frontend/src/lib/zLayer.contract.test.ts
deleted file mode 100644
index e6c72cf2..00000000
--- a/frontend/src/lib/zLayer.contract.test.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import { readFileSync } from "node:fs";
-
-import { describe, expect, it } from "vitest";
-
-import { eslint } from "./lintProbe.testkit";
-
-// The layer-scale rule in eslint.config.js (DESIGN.md Tokens: "No ad-hoc z-index"). A numeric `z-10`
-// happened to equal `base` and passed every review; a `no-restricted-syntax` selector that matches
-// nothing looks exactly like a clean codebase, so pin that it fires.
-
-async function refused(source: string): Promise<number> {
-  const [result] = await eslint.lintText(source, { filePath: "src/components/__probe.tsx" });
-  return (result?.messages ?? []).filter((m) => m.message.startsWith("z-index off the layer scale"))
-    .length;
-}
-
-describe("a z-index off the layer scale", () => {
-  // Assembled, so this file does not trip the very rule it probes.
-  const z = (v: string) => `z-${v}`;
-
-  it("is refused as a number, an arbitrary value or a variant, in a string and a template", async () => {
-    expect(await refused(`export const a = "absolute ${z("10")} top-0";\n`)).toBe(1);
-    expect(await refused(`export const b = "hover:${z("[5]")}";\n`)).toBe(1);
-    expect(await refused("export const c = `x ${1} -" + z("20") + "`;\n")).toBe(1);
-  });
-
-  it("leaves a named level, z-0 and z-auto alone", async () => {
-    expect(await refused(`export const d = "${z("base")} ${z("menu")} ${z("tooltip")}";\n`)).toBe(
-      0,
-    );
-    expect(await refused(`export const e = "${z("0")} md:${z("auto")}";\n`)).toBe(0);
-  });
-});
-
-// The Plex player's notices (the track-switch OSD, the subtitle notice) sat on `menu` while its settings
-// and tracks popovers had no level: a notice drew over the open menu (E28 audit, seen live). A menu is
-// above a notice; the info overlay (`menu`, later in the tree) still covers both.
-describe("the Plex player's layers", () => {
-  const src = ["PlexPlayer.tsx", "PlexPlayerSettings.tsx"]
-    .map((f) => readFileSync(new URL(`../components/${f}`, import.meta.url), "utf8"))
-    .join("\n");
-  const classes = (marker: RegExp) =>
-    [...src.matchAll(/className="([^"]*)"/g)].map((m) => m[1]!).filter((c) => marker.test(c));
-
-  it("puts every popover on the menu level", () => {
-    const popovers = classes(
-      /\bbottom-full\b.*\bbg-media-chrome\b|\bbg-media-chrome\b.*\bbottom-full\b/,
-    );
-    expect(popovers).toHaveLength(1); // the settings panel, which renders inside the player
-    for (const c of popovers) expect(c).toMatch(/\bz-menu\b/);
-    // The tracks list and the ⋯ menu are on the popover engine (E28 review D3), which lifts them to
-    // z-popover — above the player's own z-overlay — and into the fullscreen element.
-    expect([
-      ...src.matchAll(/<PopoverSurface\b[^>]*?className=\{`\$\{PLAYER_MENU\}/g),
-    ]).toHaveLength(2);
-  });
-
-  it("keeps the notices a level below", () => {
-    const notices = classes(/pointer-events-none absolute inset-x-0 bottom-(24|36)\b/);
-    expect(notices).toHaveLength(2);
-    for (const c of notices) expect(c).toMatch(/\bz-base\b/);
-  });
-});
diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx
index fac38dd9..61d41044 100644
--- a/frontend/src/main.tsx
+++ b/frontend/src/main.tsx
@@ -38,7 +38,7 @@ const App = lazyWithPreload(() => import("./App"));
 const PrivacyPolicy = lazy(() => import("./components/legal/PrivacyPolicy"));
 const Terms = lazy(() => import("./components/legal/Terms"));
 const WatchPage = lazy(() => import("./components/WatchPage"));
-// The design lab (E28): the living style guide, rendered with the app's real CSS so a design decision
+// The design lab: the living style guide, rendered with the app's real CSS so a design decision
 // is taken on what will ship. DEV only — Vite folds the condition to `false` in a production build,
 // the import becomes dead code and the chunk is never emitted (devOnlyGuard fails the build if it is).
 const DesignLab = import.meta.env.DEV ? lazy(() => import("./design-lab/DesignLab")) : null;
@@ -77,7 +77,8 @@ const root =
   ) : (
     <QueryClientProvider client={queryClient}>
       {/* One tree for the whole app: every anchored popover registers as a node so Escape and
-          outside-press act only on the topmost layer (S3 folds the Modal + players in). */}
+          outside-press act only on the topmost popover. The Modal and the players are not nodes:
+          they order against the popovers through lib/layerStack. */}
       <FloatingTree>
         <ConfirmProvider>
           {/* Nothing below renders until the tab knows which account it is: every provider
diff --git a/frontend/tsconfig.node.json b/frontend/tsconfig.node.json
index 0d2f3c60..adceb04f 100644
--- a/frontend/tsconfig.node.json
+++ b/frontend/tsconfig.node.json
@@ -1,7 +1,7 @@
 {
   // The build-tool configs run in Node, not the browser: they need node types and must NOT be
   // checked against the app's DOM lib. Split out because tsconfig.json's `include` is ["src"],
-  // so until now nothing type-checked these files at all (R2 / C-4.5). `npm run typecheck`
+  // so until now nothing type-checked these files at all. `npm run typecheck`
   // runs this project alongside src and e2e.
   "compilerOptions": {
     // composite: required to be the target of tsconfig.json's `references` (which is what makes
@@ -23,20 +23,20 @@
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "noFallthroughCasesInSwitch": true,
-    // E32: an index read is `T | undefined` here, as it really is (0 errors when switched on).
+    // An index read is `T | undefined` here, as it really is (0 errors when switched on).
     "noUncheckedIndexedAccess": true,
     "resolveJsonModule": true,
     // The build-tool configs include a hand-written .js file (postcss; tailwind 4 needs no config
-    // file, and the stale `tailwind.config.js` entry pointed at nothing until E32). checkJs runs
+    // file, and the stale `tailwind.config.js` entry pointed at nothing). checkJs runs
     // the type checker over it via its `@type` JSDoc, so a bad option is caught by the gate instead
-    // of silently mis-building CSS. Was the last hole in C-4.5.
+    // of silently mis-building CSS. Was the last unchecked file.
     "allowJs": true,
     "checkJs": true
   },
-  // reactPlugin.ts is the ONE React transform both configs import (E27 S1) — it is build tooling,
+  // reactPlugin.ts is the ONE React transform both configs import — it is build tooling,
   // not app source, so it belongs here and not under tsconfig.json's ["src"]. A file imported by a
   // listed one but absent from `include` is TS6307, not a silent pass. playwright.config.ts is
-  // here as well as in e2e/tsconfig.json because eslint's typed rules (E32) find a file's project
+  // here as well as in e2e/tsconfig.json because eslint's typed rules find a file's project
   // through tsconfig.json's `references`, which name this project and not the e2e one.
   "include": [
     "vite.config.ts",
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index d7f1f568..51197592 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -12,10 +12,7 @@ const target = "http://127.0.0.1:8080";
 // server returns to :5173 instead of the fixed :8080 callback. (Both are registered in the console.)
 const proxyOpts = { target, changeOrigin: false };
 const proxy = {
-  // ws: the in-app messages socket (/api/messages/ws) is a WebSocket. Without it Vite hands that upgrade
-  // to nobody, so the socket never connects on :5173 — and the first reset on it (a closed tab, a dropped
-  // connection) throws an unhandled ECONNRESET that takes the whole dev server down.
-  "/api": { ...proxyOpts, ws: true },
+  "/api": proxyOpts,
   "/auth": proxyOpts,
   "/healthz": proxyOpts,
 };
diff --git a/frontend/vitest.config.ts b/frontend/vitest.config.ts
index f7fc3212..3af2749f 100644
--- a/frontend/vitest.config.ts
+++ b/frontend/vitest.config.ts
@@ -19,8 +19,8 @@ export default defineConfig({
     // collected, and the gate still prints green.
     include: ["src/**/*.test.{ts,tsx}"],
     environment: "node",
-    // E32 D4: a coverage REPORT, read and not enforced — the gate's `vitest --coverage` prints the
-    // summary; no threshold, because "every regression test seen red" is the bar, not a percentage.
+    // A coverage REPORT on demand (`npm run test -- --coverage`), never enforced and not in the gate:
+    // "every regression test seen red" is the bar, not a percentage.
     coverage: {
       provider: "v8",
       include: ["src/**/*.{ts,tsx}"],
diff --git a/scripts/audit_metrics.py b/scripts/audit_metrics.py
new file mode 100644
index 00000000..5e86fe3b
--- /dev/null
+++ b/scripts/audit_metrics.py
@@ -0,0 +1,208 @@
+"""The codebase's health numbers in one deterministic run: size, complexity, tests, governance
+weight, comment noise and the footprint of features marked for removal. It REPORTS, it never fails
+— what used to be a gate (the size/complexity ratchet) is read here instead, and an epic compares
+its before and after.
+
+    python scripts/audit_metrics.py              the static numbers (seconds), as JSON on stdout
+    python scripts/audit_metrics.py --speed      plus the speed baseline: frontend/e2e/speed.measure.ts
+                                                 against the localdev stack (E2E_PASSWORD must be set;
+                                                 the ops wrapper exports it)
+
+The readings are counts of files and lines, so a number moves only when the code does.
+"""
+
+import ast
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+BE_APP = ROOT / "backend" / "app"
+BE_TESTS = ROOT / "backend" / "tests"
+FE_SRC = ROOT / "frontend" / "src"
+BIG_FILE = 800
+BE_COMPLEXITY = 10  # ruff's C901 default
+FE_COMPLEXITY = 20  # the frontend's line
+
+# planCodes.contract.test.ts's definition, copied: an epic, roadmap item, sprint or phase code, or a
+# review round; NOT_CODES are its named exceptions, cut first (TV episode notation, a fixture's
+# season or episode title, ruff's default `E4/E7/E9`). ASCII, because JavaScript's `\b` is.
+NOT_CODES = re.compile(r'\bS\d{1,2} ?·? ?E\d+|\btitle[=:] ?"[ES]\d{1,2}"|\bE4/E7/E9\b', re.ASCII)
+PLAN_CODE = re.compile(
+    r"\b(?:E\d{1,2}(?:\.\d+)?|R\d{1,2}|S(?!3h\b)\d{1,2}(?:[a-z]\d?)?|P\d)\b|\b[Rr]ound[ -]\d|deep-review",
+    re.ASCII,
+)
+NARRATION = re.compile(r"\b(used to|no longer)\b", re.IGNORECASE)
+
+
+def _is_fe_test(p: Path) -> bool:
+    return bool(re.search(r"\.(test|testkit)\.tsx?$", p.name))
+
+
+def _files(root: Path, pattern: str) -> list[Path]:
+    return sorted(p for p in root.rglob(pattern) if "__pycache__" not in p.parts)
+
+
+def _lines(paths: list[Path]) -> list[tuple[Path, list[str]]]:
+    return [(p, p.read_text(encoding="utf-8").splitlines()) for p in paths]
+
+
+def _comment_lines(lines: list[str], python: bool) -> int:
+    """Comment lines; for Python the docstrings count too — this codebase writes its "why" there."""
+    if not python:
+        return sum(1 for line in lines if line.lstrip().startswith(("//", "/*", "*")))
+    hashes = sum(1 for line in lines if line.lstrip().startswith("#"))
+    docs = 0
+    for node in ast.walk(ast.parse("\n".join(lines))):
+        body = getattr(node, "body", None)
+        if not isinstance(body, list) or not body:
+            continue
+        first = body[0]
+        if (
+            isinstance(first, ast.Expr)
+            and isinstance(first.value, ast.Constant)
+            and isinstance(first.value.value, str)
+        ):
+            docs += (first.end_lineno or first.lineno) - first.lineno + 1
+    return hashes + docs
+
+
+def _size(be: list[tuple[Path, list[str]]], fe: list[tuple[Path, list[str]]]) -> dict[str, object]:
+    be_tests = _lines(_files(BE_TESTS, "*.py"))
+    fe_tests = _lines([p for p in _files(FE_SRC, "*.ts*") if _is_fe_test(p)])
+    be_n = sum(len(ls) for _, ls in be)
+    fe_n = sum(len(ls) for _, ls in fe)
+    return {
+        "backend_lines": be_n,
+        "frontend_lines": fe_n,
+        "backend_test_ratio": round(sum(len(ls) for _, ls in be_tests) / be_n, 2),
+        "frontend_test_ratio": round(sum(len(ls) for _, ls in fe_tests) / fe_n, 2),
+        "files_over_800": sum(1 for _, ls in be + fe if len(ls) > BIG_FILE),
+        "largest_file": max(((len(ls), p) for p, ls in be + fe), key=lambda t: t[0])[1]
+        .relative_to(ROOT)
+        .as_posix(),
+        "tables": len(re.findall(r'__tablename__ = "', (BE_APP / "models.py").read_text("utf-8"))),
+    }
+
+
+def _complexity() -> dict[str, object]:
+    ruff = subprocess.run(
+        [sys.executable, "-m", "ruff", "check", "--config", "backend/ruff.toml", "--select", "C901"]
+        + ["--output-format", "json", "--exit-zero", "backend/app"],
+        cwd=ROOT,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    found = [
+        int(m) for d in json.loads(ruff.stdout) for m in re.findall(r"\((\d+) > ", d["message"])
+    ]
+    fe = subprocess.run(
+        ["node", "scripts/fe_complexity.mjs", str(FE_COMPLEXITY)],
+        cwd=ROOT,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    fe_json = json.loads(fe.stdout)
+    return {
+        f"backend_functions_over_{BE_COMPLEXITY}": len(found),
+        "backend_max_complexity": max(found, default=0),
+        f"frontend_functions_over_{FE_COMPLEXITY}": fe_json["over"],
+        "frontend_max_complexity": fe_json["max"],
+    }
+
+
+def _noise(be: list[tuple[Path, list[str]]], fe: list[tuple[Path, list[str]]]) -> dict[str, object]:
+    every = be + fe
+    plan = [(p, ln) for p, ls in every for ln in ls if PLAN_CODE.search(NOT_CODES.sub("", ln))]
+    be_c = sum(_comment_lines(ls, True) for _, ls in be)
+    fe_c = sum(_comment_lines(ls, False) for _, ls in fe)
+    return {
+        "plan_code_lines": len(plan),
+        "plan_code_files": len({p for p, _ in plan}),
+        "history_narration_lines": sum(1 for _, ls in every for ln in ls if NARRATION.search(ln)),
+        "backend_comment_share": round(be_c / sum(len(ls) for _, ls in be), 3),
+        "frontend_comment_share": round(fe_c / sum(len(ls) for _, ls in fe), 3),
+    }
+
+
+def _governance() -> dict[str, object]:
+    eslint = (ROOT / "frontend" / "eslint.config.js").read_text("utf-8")
+    check = (ROOT / "scripts" / "check.sh").read_text("utf-8")
+    contract = [p for p in _files(FE_SRC, "*.contract.test.ts*")]
+    return {
+        "gate_lanes": len(re.findall(r'^\s*lane "', check, re.MULTILINE)),
+        "local_eslint_rules": len(set(re.findall(r'"local/([a-z0-9-]+)"', eslint))),
+        "frontend_contract_tests": len(contract),
+        "gates_snapshot_lines": len(
+            (FE_SRC / "lib" / "gates.snapshot.json").read_text("utf-8").splitlines()
+        ),
+        "claude_md_lines": len((ROOT / "CLAUDE.md").read_text("utf-8").splitlines()),
+        "gates_md_lines": len((ROOT / "docs" / "gates.md").read_text("utf-8").splitlines()),
+    }
+
+
+def _footprint(
+    be: list[tuple[Path, list[str]]], fe: list[tuple[Path, list[str]]]
+) -> dict[str, int]:
+    """Files that still mention a feature marked for removal: 0 once it is gone."""
+    patterns = {
+        # the word removedFeatures.contract.test.ts bans: not "demote", not "Demokratikus"
+        "demo_files": re.compile(r"demo(?!t(e|ion)|kr)", re.IGNORECASE),
+        "chat_files": re.compile(r"\bchat\b|\bmessages?\.py|\bChat[A-Z]|message_keys"),
+        # the public form, not the admin's access-request queue (that stays)
+        "access_request_form_files": re.compile(r"request[-_]access|requestAccess|AccessRequestIn"),
+    }
+    return {
+        k: sum(1 for _, ls in be + fe if any(rx.search(ln) for ln in ls))
+        for k, rx in patterns.items()
+    }
+
+
+def _speed() -> dict[str, object]:
+    env = {**os.environ, "PW_SPEED": "1"}
+    out = ROOT / "frontend" / "e2e" / ".speed" / "latest.json"
+    out.unlink(missing_ok=True)  # never report an earlier run's readings
+    run = subprocess.run(
+        ["npx", "playwright", "test", "--project=speed", "--reporter=line"],
+        cwd=ROOT / "frontend",
+        env=env,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        shell=os.name == "nt",  # npx is a .cmd on Windows
+        check=False,  # a failed run is reported in the result, not raised
+    )
+    if run.returncode != 0 or not out.exists():
+        lines = [ln.strip() for ln in (run.stdout + run.stderr).splitlines() if ln.strip()]
+        first_error = next(
+            (i for i, ln in enumerate(lines) if "Error" in ln), max(0, len(lines) - 15)
+        )
+        return {"error": "the speed run failed", "output": lines[first_error : first_error + 15]}
+    return json.loads(out.read_text("utf-8"))
+
+
+def main() -> int:
+    be = _lines(_files(BE_APP, "*.py"))
+    fe = _lines(
+        [p for p in _files(FE_SRC, "*.ts*") if not _is_fe_test(p) and not p.name.endswith(".d.ts")]
+    )
+    report: dict[str, object] = {
+        "size": _size(be, fe),
+        "complexity": _complexity(),
+        "noise": _noise(be, fe),
+        "governance": _governance(),
+        "footprint": _footprint(be, fe),
+    }
+    if "--speed" in sys.argv[1:]:
+        report["speed"] = _speed()
+    sys.stdout.write(json.dumps(report, indent=2) + "\n")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/check-node-modules.mjs b/scripts/check-node-modules.mjs
index b3ced4fc..fb3bd154 100644
--- a/scripts/check-node-modules.mjs
+++ b/scripts/check-node-modules.mjs
@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-// Does frontend/node_modules hold exactly what frontend/package-lock.json pins? (E32)
+// Does frontend/node_modules hold exactly what frontend/package-lock.json pins?
 //
 // The local gate's frontend lanes run against the HOST's node_modules, and nothing tied that tree to
 // the lock: a `git pull` that bumped a dependency, or an `npm install` that was never committed, left
 // tsc/eslint/vitest judging the code against packages the build image (`npm ci`) does not use — a
-// green that proves nothing about what ships, in either direction. CI is immune (it runs `npm ci`);
-// this makes the local lanes say so instead of quietly differing.
+// green that proves nothing about what ships, in either direction. The image build is immune (it
+// runs `npm ci`); this makes the local lanes say so instead of quietly differing.
 //
 // Checks every package the lock places under node_modules/: present, at the pinned version. A package
 // marked `optional` may be absent (a platform binary for another OS). Exit 1 with the list and the
diff --git a/scripts/check.sh b/scripts/check.sh
index 562d8f50..1b66cf98 100644
--- a/scripts/check.sh
+++ b/scripts/check.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# The gate — every lane, in one place, run from the repo root (E32, after CI went: the lab runner
+# The gate — every lane, in one place, run from the repo root (since CI went: the lab runner
 # duplicated what this already ran before every release, and one CI run starved the git host of
 # memory until it stopped answering). The release dispatcher calls this; so can anyone with Docker
 # and the pinned toolchain. `frontend/src/lib/gates.contract.test.ts` holds its lines, so a lane
@@ -7,6 +7,8 @@
 #
 #   bash scripts/check.sh        every lane (what a release requires, before e2e and the CVE scan)
 #   bash scripts/check.sh lint   the static lanes only: no tests, no build, no audits
+#   … --brief                    (either mode) a lane's output only when it fails, and only its first
+#                                error lines — for an agent, whose context the full log would flood
 #
 # Each lane runs even when an earlier one failed, and the summary names every red one: a gate that
 # stops at the first failure hides the second until the first is fixed. The backend lanes run in the
@@ -14,8 +16,15 @@
 # type checker or auditor without the real packages reports nonsense.
 set -u
 cd "$(dirname "$0")/.." || exit 2
-mode="${1:-all}"
-case "$mode" in all | lint) ;; *) echo "usage: scripts/check.sh [lint]" >&2; exit 2 ;; esac
+mode=all
+brief=0
+for arg in "$@"; do
+  case "$arg" in
+    all | lint) mode="$arg" ;;
+    --brief) brief=1 ;;
+    *) echo "usage: scripts/check.sh [lint] [--brief]" >&2; exit 2 ;;
+  esac
+done
 
 export MSYS_NO_PATHCONV=1 # Git Bash: do not rewrite the in-container paths below
 TESTCOMPOSE=backend/docker-compose.test.yml
@@ -23,8 +32,39 @@ failed=()
 lane() { # lane <name> <command…> — run it, remember a failure, never stop
   local name="$1"
   shift
-  echo ">> $name…"
-  "$@" || failed+=("$name")
+  if [ "$brief" = 0 ]; then
+    echo ">> $name…"
+    "$@" || failed+=("$name")
+    return 0
+  fi
+  local out
+  out="$(mktemp)"
+  if "$@" >"$out" 2>&1; then
+    echo ">> $name: ok"
+  else
+    failed+=("$name")
+    echo ">> $name: FAILED"
+    brief_excerpt "$out"
+  fi
+  rm -f "$out"
+}
+# What broke, in a log's own words. A short log is shown whole: a keyword filter keeps ruff's
+# summary line and drops the rule and file above it, and eslint's file path sits on a line of its
+# own above its errors. A long one shows its first 20 error-looking lines, each with the line before
+# it and the two after (knip names the file on the line after "Unused files"); a long log with none
+# of them shows its tail, which is where a summary sits. The test database's own log is left out:
+# the DB lane provokes constraint errors on purpose, and its `ERROR:` lines filled the excerpt ahead
+# of the failing test.
+brief_excerpt() {
+  local log hits
+  log="$(grep -v -E '^testdb-[0-9]+ ' "$1")"
+  if [ "$(printf '%s\n' "$log" | wc -l)" -le 60 ]; then
+    printf '%s\n' "$log"
+    return
+  fi
+  hits="$(printf '%s\n' "$log" |
+    grep -E -i -B 1 -A 2 -m 20 'error|fail|✗|×|warn|would reformat|unused|vulnerab|found [0-9]')"
+  if [ -n "$hits" ]; then printf '%s\n' "$hits"; else printf '%s\n' "$log" | tail -n 20; fi
 }
 
 # --- static lanes ------------------------------------------------------------------------------------
@@ -70,7 +110,7 @@ lane "lock check (frontend/node_modules == package-lock.json)" node scripts/chec
 lane "tsc (src + configs + e2e)" frontend npm run --silent typecheck
 lane "eslint (warnings fail too)" frontend npm run --silent lint
 lane "prettier --check" frontend npm run --silent format:check
-lane "knip (unused, and unused by what ships)" frontend npm run --silent knip
+lane "knip (unused files, exports, dependencies)" frontend npm run --silent knip
 
 # --- tests, build, audits --------------------------------------------------------------------------
 
@@ -90,8 +130,7 @@ pip_audit() {
 }
 
 if [ "$mode" = all ]; then
-  # --coverage prints the summary: read, never a threshold (E32 D4)
-  lane "vitest (+ coverage report)" frontend npm run --silent test -- --coverage
+  lane "vitest" frontend npm run --silent test
   # the production bundle, and devOnlyGuard, which fails it when dev-only code reaches it
   lane "vite build" frontend npx vite build --logLevel warn
   lane "pytest (pure-logic + DB lane)" pytest_lane
diff --git a/scripts/e2e_seed.py b/scripts/e2e_seed.py
index e1dd85d0..3ef64bbd 100644
--- a/scripts/e2e_seed.py
+++ b/scripts/e2e_seed.py
@@ -4,7 +4,7 @@ Run INSIDE the api container — it needs the app's models + the argon2 hasher:
 
     docker exec -i siftlode-api-1 python - < scripts/e2e_seed.py
 
-Resets a dedicated, NON-demo test account to a known baseline every run, so the Playwright
+Resets a dedicated test account to a known baseline every run, so the Playwright
 golden-master net is deterministic and never touches a real account. Self-healing: a crashed
 spec that left the account dirty is cleaned on the next run. Prints one JSON line describing
 what it seeded (the wrapper / global-setup reads it).
@@ -45,10 +45,6 @@ if not PASSWORD:
 N_SUBS = 3
 
 
-def _now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
 def main() -> None:
     db = SessionLocal()
     try:
@@ -68,7 +64,7 @@ def main() -> None:
         db.commit()
 
         # 1. Upsert the account and always reset it to a clean, loginable baseline
-        #    (email_verified + is_active + not suspended + not demo + password set).
+        #    (email_verified + is_active + not suspended + password set).
         user = db.scalar(select(User).where(User.email == EMAIL))
         if user is None:
             user = User(email=EMAIL)
@@ -77,7 +73,6 @@ def main() -> None:
         user.email_verified = True
         user.is_active = True
         user.is_suspended = False
-        user.is_demo = False
         user.google_sub = None
         # Admin so the E2E can reach the admin-only pages (scheduler / config / users / audit) and
         # thus the render ternary's admin branches — the primary real user (npeter83) is admin too.
@@ -100,7 +95,11 @@ def main() -> None:
 
         db.execute(delete(Subscription).where(Subscription.user_id == user.id))
         for cid in channel_ids:
-            db.add(Subscription(user_id=user.id, channel_id=cid, subscribed_at=_now()))
+            db.add(
+                Subscription(
+                    user_id=user.id, channel_id=cid, subscribed_at=datetime.now(timezone.utc)
+                )
+            )
         db.commit()
 
         # 3. Deterministic watch state (reset each run):
@@ -134,7 +133,7 @@ def main() -> None:
                         video_id=vid.id,
                         status="new",
                         position_seconds=42,
-                        progress_updated_at=_now(),
+                        progress_updated_at=datetime.now(timezone.utc),
                     )
                 )
                 in_progress = vid.id
@@ -147,7 +146,7 @@ def main() -> None:
                         user_id=user.id,
                         video_id=wv.id,
                         status="watched",
-                        watched_at=_now(),
+                        watched_at=datetime.now(timezone.utc),
                     )
                 )
                 watched = wv.id
diff --git a/scripts/fe_complexity.mjs b/scripts/fe_complexity.mjs
new file mode 100644
index 00000000..9622c6ce
--- /dev/null
+++ b/scripts/fe_complexity.mjs
@@ -0,0 +1,45 @@
+// Frontend functions over a cyclomatic-complexity limit, counted for scripts/audit_metrics.py: a bare
+// `complexity` rule run (no type info, no other rules), so it takes seconds, not a full lint. Prints
+// one JSON object: {"limit": N, "over": count, "max": highest}. Shipped code only — tests and test
+// kits are lists of cases, not logic anyone has to change.
+//
+//   node scripts/fe_complexity.mjs [limit]   (default 20, the frontend's line)
+import { readdirSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SRC = fileURLToPath(new URL("../frontend/src/", import.meta.url));
+const require = createRequire(new URL("../frontend/package.json", import.meta.url));
+const { Linter } = require("eslint");
+const tseslint = require("typescript-eslint");
+
+const limit = Number(process.argv[2] ?? 20);
+const files = readdirSync(SRC, { recursive: true })
+  .map((p) => p.split("\\").join("/"))
+  .filter(
+    (p) => /\.(ts|tsx)$/.test(p) && !/\.(test|testkit)\.tsx?$/.test(p) && !p.endsWith(".d.ts"),
+  );
+
+const linter = new Linter();
+const config = [
+  {
+    files: ["**/*.{ts,tsx}"],
+    languageOptions: {
+      parser: tseslint.parser,
+      parserOptions: { ecmaFeatures: { jsx: true } },
+    },
+    rules: { complexity: ["error", limit] },
+  },
+];
+let over = 0;
+let max = 0;
+for (const f of files) {
+  for (const m of linter.verify(readFileSync(join(SRC, f), "utf8"), config, f)) {
+    const n = Number(/complexity of (\d+)/.exec(m.message)?.[1]);
+    if (!n) continue;
+    over += 1;
+    max = Math.max(max, n);
+  }
+}
+console.log(JSON.stringify({ limit, over, max }));
diff --git a/scripts/gen-changelog.mjs b/scripts/gen-changelog.mjs
index 866caf93..d4bd59d0 100644
--- a/scripts/gen-changelog.mjs
+++ b/scripts/gen-changelog.mjs
@@ -49,7 +49,7 @@ function render(entries) {
       let out = `## ${e.version} — ${e.date}${sha}\n\n`;
       out += section("New", e.new);
       out += section("Fixed", e.fixed);
-      // A release that carried only internal work (none has since the owner's E28 rule).
+      // A release that carried only internal work (the owner's rule says none should).
       if (e.new.length === 0 && e.fixed.length === 0) out += "Internal changes only.\n\n";
       return out;
     })
diff --git a/scripts/lint-changed.sh b/scripts/lint-changed.sh
new file mode 100644
index 00000000..817b48de
--- /dev/null
+++ b/scripts/lint-changed.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# The fast lint lanes on the uncommitted files only — ruff (check + format) on Python, eslint on the
+# frontend's code and prettier on all of the frontend — for a check after every edit instead of a
+# full gate run. It is a convenience, never the gate: scripts/check.sh stays what a merge or a
+# release requires.
+#
+#   bash scripts/lint-changed.sh          lint what `git status` shows as changed or new
+#   bash scripts/lint-changed.sh --hook   the same, as a Claude Code Stop hook: silent and exit 0 when
+#                                         clean; otherwise the findings on stderr and exit 2, which
+#                                         hands them back to the agent before it ends its turn
+#
+# Measured 2026-10-04: one cold eslint run (type-aware) takes 3.4–4.7 s, so this runs once per turn
+# (Stop), not after every edit — a warm daemon (eslint_d) would add a dependency and a stray process.
+set -u
+cd "$(dirname "$0")/.." || exit 2
+hook=0
+[ "${1:-}" = --hook ] && hook=1
+
+if [ "$hook" = 1 ]; then
+  # A Stop hook that blocked once is told so on the next stop; let that one through, or an unfixable
+  # finding would keep the agent in a loop.
+  grep -q '"stop_hook_active": *true' && exit 0
+fi
+
+mapfile -t changed < <(git status --porcelain --untracked-files=all | sed -E 's/^.. //; s/.* -> //' |
+  while read -r f; do [ -f "$f" ] && printf '%s\n' "$f"; done)
+# eslint reads code; prettier reads every file the gate's `prettier --check .` does (a locale JSON,
+# a stylesheet), and `--ignore-unknown` passes over the ones it has no parser for.
+py=() fe=() pretty=()
+for f in "${changed[@]}"; do
+  case "$f" in
+    backend/*.py | scripts/*.py) py+=("$f") ;;
+  esac
+  case "$f" in
+    frontend/*.ts | frontend/*.tsx | frontend/*.js | frontend/*.mjs) fe+=("${f#frontend/}") ;;
+  esac
+  case "$f" in
+    frontend/*) pretty+=("${f#frontend/}") ;;
+  esac
+done
+
+report="$(
+  if [ ${#py[@]} -gt 0 ]; then
+    python -m ruff check --quiet --config backend/ruff.toml "${py[@]}" 2>&1
+    python -m ruff format --check --quiet --config backend/ruff.toml "${py[@]}" 2>&1
+  fi
+  if [ ${#fe[@]} -gt 0 ]; then
+    (cd frontend && npx eslint --max-warnings 0 "${fe[@]}" 2>&1)
+  fi
+  if [ ${#pretty[@]} -gt 0 ]; then
+    (cd frontend && npx prettier --check --ignore-unknown --log-level warn "${pretty[@]}" 2>&1)
+  fi
+)"
+
+if [ -z "$report" ]; then
+  [ "$hook" = 1 ] || echo "lint-changed: clean (${#py[@]} py, ${#pretty[@]} frontend)"
+  exit 0
+fi
+if [ "$hook" = 1 ]; then
+  printf 'lint-changed found problems in the uncommitted files:\n%s\n' "$report" >&2
+  exit 2
+fi
+printf '%s\n' "$report"
+exit 1